Analog ip unnumbered in Mikrotik RouterOS
At once I will say that I was inspired to write the post by a similar article published on Habré back in 2009. Therefore, I will not retell its contents and present the configuration of Cisco devices.
Today, when IPv4-addresses have become even more deficient than the Moskvich car in Soviet times, it’s a crime to give a client a / 30 or / 31 network. In Cisco, to circumvent these problems, there is an “ip unnumbered” mode that allows you to assign a single address to a client without wasting addresses. Let's see how this is done in Mikrotik RouterOS. Imagine this (strongly simplified) scheme:
')
Our gateway (provider-gw) is connected via ether1 to the Internet via BGP (or in another way, it does not matter) and we have our own “large” public network, for example - 123.45.60.0/22. The first client is connected to the VLAN-interface vlan100, which, let's say, is connected to ether2. The second is for vlan200.
The router must have an IP address from our public network. Suppose 123.45.60.1 with a mask / 22. This address must be assigned to any free interface or vlan, even if they will not be used later. Let it be vlan1000:
Now we will make the settings on the router for our clients. To do this, we will allocate to them any free IP from the range of our public network, say, 123.45.60.5 and 123.45.60.6. Add static routes for these addresses leading to the corresponding client VLANs. It is desirable to specify the preffered source address of our router.
Customize client number 1:
IP: 123.45.60.5
Mask: 255.255.255.252 (or / 22; yes, here we indicate the mask of our “big” public network)
Gateway: 123.45.60.1
We configure client number 2 in the same way. Only the IP address changes.
IP: 123.45.60.6
Mask: 255.255.255.252 (or / 22)
Gateway: 123.45.60.1
Everything. It's enough. After that, IP clients will be accessible from the Internet, without waste of addresses. Other clients are included in a similar way, each in their own VLAN. But in this case, we have this situation: for example, client number 1 wants to send an ip package to client number 2. Since client's address # 2 falls under the network mask / 22, client # 1 considers that # 2 is in the same broadcast domain with it and tries to send a packet not through a router, but directly, for which it will try to find out its MAC address using ARP. Of course, it will not work with him, because the clients are in different VLANs and cannot send ARP requests to each other.
If you need to isolate clients from each other, you can leave everything as it is, although from the Internet point of view it is wrong (each node must have a connection to another node via IP). This situation is solved by enabling proxy-arp on client VLANs:
Now the router will respond to arp requests from clients, substituting its MAC address in the response and clients will be able to exchange IP traffic as if they are in the same segment.
As you might have guessed, similarly, you can assign several IP addresses or even subnets to one client VLAN simply by creating static routes with the corresponding dst-address.
UPD:
As practice has shown, it is much better to create non-static routes in / ip route, but simply add the IP address of the router to the interface with the desired IP address in the network field; the route will be created automatically. Example:
Today, when IPv4-addresses have become even more deficient than the Moskvich car in Soviet times, it’s a crime to give a client a / 30 or / 31 network. In Cisco, to circumvent these problems, there is an “ip unnumbered” mode that allows you to assign a single address to a client without wasting addresses. Let's see how this is done in Mikrotik RouterOS. Imagine this (strongly simplified) scheme:
')
Our gateway (provider-gw) is connected via ether1 to the Internet via BGP (or in another way, it does not matter) and we have our own “large” public network, for example - 123.45.60.0/22. The first client is connected to the VLAN-interface vlan100, which, let's say, is connected to ether2. The second is for vlan200.
/interface vlan add disabled=no name=vlan100 vlan-id=100 interface=ether2 comment="Client 1"/interface vlan add disabled=no name=vlan200 vlan-id=200 interface=ether2 comment="Client 2"The router must have an IP address from our public network. Suppose 123.45.60.1 with a mask / 22. This address must be assigned to any free interface or vlan, even if they will not be used later. Let it be vlan1000:
/interface vlan add disabled=no name=vlan1000 vlan-id=1000 interface=ether2/ip address add interface=vlan1000 address=123.45.60.1/22Now we will make the settings on the router for our clients. To do this, we will allocate to them any free IP from the range of our public network, say, 123.45.60.5 and 123.45.60.6. Add static routes for these addresses leading to the corresponding client VLANs. It is desirable to specify the preffered source address of our router.
/ip route add dst-address=123.45.60.5 gateway=vlan100 pref-src=123.45.60.1 comment="Static route to Client 1"/ip route add dst-address=123.45.60.6 gateway=vlan200 pref-src=123.45.60.1 comment="Static route to Client 2"Customize client number 1:
IP: 123.45.60.5
Mask: 255.255.255.252 (or / 22; yes, here we indicate the mask of our “big” public network)
Gateway: 123.45.60.1
We configure client number 2 in the same way. Only the IP address changes.
IP: 123.45.60.6
Mask: 255.255.255.252 (or / 22)
Gateway: 123.45.60.1
Everything. It's enough. After that, IP clients will be accessible from the Internet, without waste of addresses. Other clients are included in a similar way, each in their own VLAN. But in this case, we have this situation: for example, client number 1 wants to send an ip package to client number 2. Since client's address # 2 falls under the network mask / 22, client # 1 considers that # 2 is in the same broadcast domain with it and tries to send a packet not through a router, but directly, for which it will try to find out its MAC address using ARP. Of course, it will not work with him, because the clients are in different VLANs and cannot send ARP requests to each other.
If you need to isolate clients from each other, you can leave everything as it is, although from the Internet point of view it is wrong (each node must have a connection to another node via IP). This situation is solved by enabling proxy-arp on client VLANs:
/interface vlan set vlan100 arp=proxy-arp/interface vlan set vlan200 arp=proxy-arpNow the router will respond to arp requests from clients, substituting its MAC address in the response and clients will be able to exchange IP traffic as if they are in the same segment.
As you might have guessed, similarly, you can assign several IP addresses or even subnets to one client VLAN simply by creating static routes with the corresponding dst-address.
UPD:
As practice has shown, it is much better to create non-static routes in / ip route, but simply add the IP address of the router to the interface with the desired IP address in the network field; the route will be created automatically. Example:
/ip address add network=123.45.60.5 interface=vlan100 address=123.45.60.1 comment="IPoE Client 1"/ip address add network=123.45.60.6 interface=vlan100 address=123.45.60.1 comment="IPoE Client 2"Source: https://habr.com/ru/post/213037/
All Articles