MikroTik RouterOS Training User Management. VRProService Co.,Ltd.

Transcription

1 MikroTik RouterOS Training User Management VRProService Co.,Ltd.

2 Class Setup VRProService Co.,Ltd. 2

3 Class setup Lab (cont.) Set system identity of the board and wireless radio name to XY_<your_name>. Example: 00_Janis Upgrade your router to the latest Mikrotik RouterOS version 3.x Upgrade your Winbox loader version Set up NTP client use as server Create a configuration backup and copy it to the laptop (it will be default configuration) VRProService Co.,Ltd. 3

4 Point-to-Point Protocols PPTP, PPPoE, L2TP, BCP, MLPPP, MRRU, Interface routing, Dynamic address-lists, Dynamic simple queues VRProService Co.,Ltd. 4

5 L o c a l Use r D a t a b a s e PPP Profile, PPP Secret VRProService Co.,Ltd.

6 Point-to-Point protocol tunnels A little bit sophisticated in configuration Capable of authentication and data encryption Such tunnels are: PPPoE (Point-to-Point Protocol over Ethernet) PPTP (Point-to-Point Tunneling Protocol) L2TP (Layer 2 Tunneling Protocol) You should create user information before creating any tunnels VRProService Co.,Ltd. 6

7 PPP Secret PPP secret (aka local PPP user database) stores PPP user access records Make notice that user passwords are displayed in the plain text anyone who has access to the router are able to see all passwords It is possible to assign specific /32 address to both ends of the PPTP tunnel for this user Settings in /ppp secret user database override corresponding /ppp profile settings VRProService Co.,Ltd. 7

8 PPP Secret VRProService Co.,Ltd. 8

9 PPP Profile and IP Pools PPP profiles define default values for user access records stored under /ppp secret submenu PPP profiles are used for more than 1 user so there must be more than 1 IP address to give out - we should use IP pool as Remote address value Value default means if option is coming from RADIUS server it won't be overrided VRProService Co.,Ltd. 9

10 PPP Profile VRProService Co.,Ltd. 10

11 Dynamic Simple Queues It is possible to assign specific limit to each group belonging to the same PPP profile Every time new user connects RouterOS will create new simple queue This option can be acquired from RADIUS server VRProService Co.,Ltd. 11

12 Dynamic address-list It is also possible to implement custom QoS structures Every time new user connects RouterOS will create new address-list entry Address-list then can be utilized by mange facility for packet marking. VRProService Co.,Ltd. 12

13 Change TCP MSS Big 1500 byte packets have problems going trought the tunnels because: Standard Ethernet MTU is 1500 bytes PPTP and L2TP tunnel MTU is 1460 bytes PPPOE tunnel MTU is 1488 bytes By enabling change TCP MSS option, dynamic mangle rule will be created for each active user to ensure right size of TCP packets, so they will be able to go through the tunnel VRProService Co.,Ltd. 13

14 P P TP a n d L 2 TP Point-to-Point Tunnelling Protocol and Layer 2 Tunnelling Protocol VRProService Co.,Ltd.

15 PPTP Tunnels PPTP uses TCP port 1723 and IP protocol 47/ GRE There is a PPTP-server and PPTP-clients PPTP clients are available for and/or included in almost all OS You must use PPTP and GRE NAT helpers to connect to any public PPTP server from your private masqueraded network VRProService Co.,Ltd. 15

16 L2TP Tunnels PPTP and L2TP have mostly the same functionality L2TP traffic uses UDP port 1701 only for link establishment, further traffic is using any available UDP port L2TP don't have problems with NATed clients it don't required NAT helpers Configuration of the both tunnels are identical in RouterOS VRProService Co.,Ltd. 16

17 Creating PPTP/L2TP Client VRProService Co.,Ltd. 17

18 PPTP Client Lab Restore system backup (slide 12) Create PPTP client Server Address: User: admin Password: admin Add default route = yes Make necessary adjustments to access the internet VRProService Co.,Ltd. 18

19 Creating PPTP/L2TP server VRProService Co.,Ltd. 19

20 PPTP Server Lab Create a PPTP server Create one user in PPP Secret Configure your laptop to connect to your PPTP server Make necessary adjustments to access the Internet via the tunnel Create PPP Profile for the router to use encryption Configure PPTP-client on the laptop accordingly VRProService Co.,Ltd. 20

21 Optional: Advanced VPN Lab Restore system backup (slide 12) Create secure L2TP tunnel with your neighbor Create EoIP tunnel over the L2TP tunnel Bridge your networks together! VRProService Co.,Ltd. 21

22 User Access Control Controlling the Hardware Static IP and ARP entries DHCP for assigning IP addresses and managing ARP entries Controlling the Users PPPoE requires PPPoE client configuration HotSpot redirects client request to the sign-up page PPTP requires PPTP client configuration VRProService Co.,Ltd. 22

23 PPPoE tunnels PPPoE works in OSI 2nd (data link) layer PPPoE is used to hand out IP addresses to clients based on the user authentication PPPoE requires a dedicated access concentrator (server), which PPPoE clients connect to. Most operating systems have PPPoE client software. Windows XP has PPPoE client installed by default VRProService Co.,Ltd. 23

24 PPPoE client VRProService Co.,Ltd. 24

25 PPPoE Client Lab Restore default system backup Create PPTP client Interface: wlan1 Service:pppoe User: admin Password: admin Add default route = yes Make necessary adjustments to access the internet VRProService Co.,Ltd. 25

26 PPPoE Client Status Check your PPPoE connection Is the interface enabled? Is it connected and running (R)? Is there a dynamic (D) IP address assigned to the pppoe client interface in the IP Address list? What are the netmask and the network address? What routes do you have on the pppoe client interface? See the Log for troubleshooting! VRProService Co.,Ltd. 26

27 * PPPoE Lab with Encryption * The PPPoE access concentrator is changed to use encryption now You should use encryption, either change the ppp profile used for the pppoe client to 'default-encryption', or, modify the ppp profile used for the pppoe client to use encryption See if you get the pppoe connection running VRProService Co.,Ltd. 27

28 PPPoE Server PPPoE server accepts PPPoE client connections on a given interface Clients can be authenticated against the local user database (ppp secrets) a remote RADIUS server a remote or a local MikroTik User Manager database Clients can have automatic data rate limitation according to their profile VRProService Co.,Ltd. 28

29 Creating PPPoE server (service) VRProService Co.,Ltd. 29

30 PPPoE Server Lab Create a PPPoE server Create one user in PPP Secret Configure your laptop to connect to your PPPoE server Make necessary adjustments to access the internet via the tunnel Create PPP Profile for the router to use encryption Configure PPPoE-client on the laptop accordingly VRProService Co.,Ltd. 30

31 P P P in t e rf a c e B rid g in g PPP BCP (Bridge Control Protocol) PPP MP (Multi-link Protocol) VRProService Co.,Ltd.

32 PPP Bridge Control Protocol RouterOS now have BCP support for all async. PPP, PPTP, L2TP & PPPoE (not ISDN) interfaces BCP allows to bridge Ethernet packets through the PPP link BCP is independent part of PPP tunnel - It is not related to IP address of PPP interface Bridging and routing over PPP link can happen at the same time, independently. VRProService Co.,Ltd. 32

33 Setting up BCP Bridge must be specified the ppp profiles on both sides of the tunnel Note that PPP interface don't have any MAC addresses so your bridge must have a MAC address before you add ppp to the bridge VRProService Co.,Ltd. 33

34 PPP MTU Problem PPP interface MTU is smaller than standard Ethernet interface It is impossible to fragment Ethernet frames tunnels must have inner algorithm how to transfer Ethernet frames via link with smaller MTU EOIP have encapsulation algorithm enabled by default, PPP interfaces doesn't PPP interfaces can utilize PPP Multi-link Protocol to handle Ethernet frames VRProService Co.,Ltd. 34

35 PPP Multi-link Protocol PPP Multi-link Protocol allows divide packet to multiple channels therefore increasing possible MTU and MRU (up to bytes) MLPPP can be created: over single physical link where multiple channels run on the same link over multiple physical links - where multiple channels run on the multiple link VRProService Co.,Ltd. 35

36 MRRU To enable PPP Multi-link Protocol over single link you must specify MRRU option If both sides support this feature there are no need for MSS adjustment (in firewall mangle) MRRU is less CPU expensive that 2 mangle rules per client if you have more that 30 clients In MS Windows you must enable "Negotiate multi-link for single link connections" option VRProService Co.,Ltd. 36

37 PPP Multi-link Protocol VRProService Co.,Ltd. 37

38 PPP Bridging Lab Restore default system backup Create PPP tunnel with your neighbour(s) Bridge PPP tunnels with your local interface Ensure that MTU and MRU of the PPP link is at least 1518 byte (size of Ethernet frame) Check the configuration using ping tool with different packet size VRProService Co.,Ltd. 38

39 MLPPP MikroTik RouterOS have multi-link ppp over multiple links client support starting from V3.10 Server support will be added some time in the future To enable MLPPP just assign multiple interfaces for the same PPP client. Note: all PPP lines must have same user name and password Server must have support for MLPPP VRProService Co.,Ltd. 39

40 Interface ECMP Routing In case you have more that one PPP connection from the same server, but MLPPP is impossible (different user names, server support missing) it is possible to use Interface routing Simple IP address routing is impossible all PPP connections have the same gateway IP address To enable interface routing just specify all PPP interfaces as route gateway-interface Works only on PPP interfaces. VRProService Co.,Ltd. 40

41 MikroTik RouterOS Training HotSpot and User Manager

42 Schedule Training day: 9AM - 5PM 1 hour Lunch: 12:30PM 30 minute Breaks: 10:30AM and 3PM 2

43 Instructors Sergejs Boginskis, MikroTik Jānis Meģis, MikroTik Normunds Rustanovičs, MikroTik Māris Bulāns, MikroTik 3

44 Class Setup 4

45 Class Setup Set /system identity and wireless radio name as XY_<your_name> Instal the latest RouterOS version Use the latest Winbox version NTP server address Create backup and save it on the laptop 5

46 HotSpot Overview

47 Overview Plug-and-Play Internet access Users authentication before access to the Internet Walled-garden to allow resources without authentication Users accounting Transparent proxy 7

48 Usage Airports University Campuses Internet cafes Open Access Points Anywhere Authorization or Accounting are required 8

49 Operation Client can use wrong network configuration settings, HotSpot server translates them to correct ones No Internet available before HotSpot authorization Exceptions are added to walled-garden and /ip hotspot ip-binding 9

50 Operation Enter username/password in HotSpot login page to get the Internet Other login methods available Different accounting options 10

51 HotSpot Setup

52 HotSpot Setup Setup is launched by the command, /ip hotspot setup 12

53 HotSpot Setup Use /ip hotspot setup for HotSpot server setup, strongly recommended All configuration settings can be added manually 13

54 Before setup Valid IP address configuration on local (HotSpot) and Public (Internet) interfaces DNS servers added in /ip dns One HotSpot user (added by setup command) 14

55 Setup Click on Setup Select Interface Click Next 15 Set HotSpot address, offered automatically Masquerade Network or not

56 Setup Address-range to use for clients SSL certificate, used for HTTPS login SMTP server address, to redirect all HotSpot users to 16

57 Setup DNS server for HotSpot users, taken from /ip dns HotSpot DNS name for access login page, FQDN required ( Create first HotSpot user 17

58 Setup HotSpot setup is completed successfully Check /ip hotspot menu 18

59 Configuration Created Additional configuration is created in different sections by HotSpot setup No additional configuration necessary wiht /ip hotspot setup 19

60 Configuration Created DHCP-server 20

61 Configuration Created Address-pool 21

62 Configuration Created Dynamic Firewal and NAT rules /ip firewall filter print dynamic /ip firewall nat print dynamic 22

63 Common Mistakes HotSpot on bridge, configure server on bridge interface not on the bridge port Correct DNS name for HotSpot server arp=enabled for the interface 23

64 LAB HotSpot Lab Setup HotSpot on the router Make sure you get to the Internet 24

65 Remember Access to public networks is blocked (Internet, Winbox to the router) Login to the HotSpot to get the Internet Login by HotSpot page 25

66 Users

67 HotSpot users Users are added and managed from /ip hotspot user Required settings are username and password 27

68 Users Settings Server, HotSpot server user belongs to Name, client username Password, user s password Address, HotSpot IP address to be used by client MAC-address, login only from the specific MAC-address Profile, user s profile name 28

69 Users Limits Uptime, time allowed to be online for user Bytes In, bytes user can upload Bytes Out, bytes user can download Bytes Total = Bytes In + Bytes Out 29

70 Users lab LAB Add additional HotSpot user Set this user to login only from your laptop Restrict user to 5 hours 1Gb upload and 1Gb download per day 30

71 LAB Daily users For the previous lab, use scheduler and simple script /ip hotspot user reset-counters command to reset uptime 31

72 Monitor Users

73 Unauthorized Users All users connected to the HotSpot interface shown in /ip hotspot host 33

74 Authorized Users Authorized users are shown in /ip hotspot active 34

75 HotSpot Login Methods

76 Login Methods HTTP CHAP, HTTP PAP HTTPS MAC-Address Cookie Trial method 36

77 Login Configuration /ip hotspot profile stores Login Method configuration 37

78 HTTP CHAP, PAP Login page is shown for users login/password is necessary to get Internet CHAP, CHAP challenge for login, enabled browser s JavaScript PAP, login in plain text for legacy browsers 38

79 HTTPS Login page is shown for users Authorization is encrypted by SSL protocol Certificate should be imported to router 39

80 Cookie Cookie is sent to client, after successful HTTP login HotSpot does not ask for login/password for second time access 40

81 MAC-Address Avoid HotSpot login page Add MAC-address as username Authentication occurs, as user is connected to the Hotspot 41

82 Trial Use HotSpot free of charge for the period Set usage time over specific period 42

83 LAB Login Methods Lab Enable cookie login for 2 days lifetime Enable trial for 1 hour over 24 hours Enable MAC-address authentication for your laptop 43

84 HotSpot Sequence User is connected to the Router Universal Client IP address is translated, if necessary MAC-Address MAC-address users authentication HTTP, HTTPS Login page is shown for user Cookie Cookie used for second HTTP login 44

85 Sequence Exceptions IP-Binding Present on Universal client level Walled-Garden Allow access to specific resources 45

86 HotSpot Logout Logout from HotSpot to stop accounting Logout from login page, hotspot or After keepalive timeout reached 46

87 Group of Users

88 User Profile To apply common settings for the group of users 48

89 Profile Settings Address-Pool, to enable universal client Session Timeout, user is logged out after this time Keepalive Timeout, detects whether client is reachable Shared Users, allowed simultaneous logins with the same username 49

90 Rate Limit Bandwidth limit for HotSpot clients Creates dynamic simple queue Syntax, rx-rate[/tx-rate] [rx-burstrate[/tx-burst-rate] [rx-burstthreshold[/tx-burst-threshold] [rxburst-time[/tx-burst-time] [priority] [rx-rate-min[/tx-rate-min]]]] rx client s upload, tx client s download 50

91 Firewall and Mangle Filter, check users through the specific firewall filter chain Packet Mark, to set mangle mark for the users Add jump from built-in chains (input, forward, output) to hotspot chain 51

92 Advertise To show advertise web-page after period of time Internet is blocked, if not shown Popup blockers can disturb advertise 52

93 Alternative Advertising Put the advertisement information to status page HTML knowledges required to modify alogin.html (status) Open-status page=always, shows status page for all clients 53

94 Scripts Execute scripts on HotSpot user login and logout 54

95 LAB User Profile Lab Set max-limit=1m/2m limit-at=512k/1m priority=3 for every HotSpot user Log HotSpot users traffic in firewall chain=log Set static queue and make sure they are before dynamic all the time 55

96 Dynamic Queues HotSpot Dynamic queues are added in the top of /queue simple Scripts allow to move static queue to the top Set options to distinguish static queues over dynamic 56

97 Server Configuration

98 HotSpot server Servers, menu lists all HotSpot servers 58

99 HotSpot Server Interface, specifies interface HotSpot is configured on Address-Pool, Universal client for non-authorized clients Timeouts, timeouts for unauthorized clients Addresses-Per-Mac, number of IP addresses allowed per one MACaddress 59

100 LAB HotSpot Server Lab Create Bridge on the router between HotSpot interface and unused interface Modify HotSpot servers settings appropriately 60

101 HotSpot Server Profile, contains all settings for the HotSpot server 61

102 Login HotSpot login method selection Additional authentication settings Trial User configuration 62

103 Server Profile DNS name, HotSpot server DNS name, use FQDN Rate-Limit, set bandwidth limit for the entire HotSpot server HTTP proxy, parent proxy settings SMTP server, to redirect s to your mail server 63

104 HotSpot Customization HTML-directory, sets location of the HotSpot server files Use FTP client to get HotSpot login page files 64

105 HotSpot pages redirect.html - redirect users to another url login.html - login page shown to a user md5.js - Javascript for MD5 password hashing status.html - statistics for the client logout.html - logout page error.html - error page You can put necessary information with basic HTML knowledge 65

106 Customize HotSpot ip hotspot reset-html <hotspotx>, command to get back default login page 66

107 LAB HotSpot Profile Lab Set Trial Login on the HotSpot server Set DNS-Name for HotSpot, use it to login and logout Modify HotSpot page to login without login and password 67

108 Previous Lab Get login.html page from ftp://router Open login.html with text editor 68

109 Page Modifications Change two lines <type= text value= $(username)> to <input type= hidden name= username value= yourname?> <input type= password > <input type= hidden name=password value= password > 69

110 Login without password No login/password required Put advertising information or any information for user to accept Increase shared-users 70

111 Exceptions

112 HotSpot Exceptions HotSpot blocks connection to the Internet Servers, switches, telephony terminals perhaps do not have browser for the login There are few ways to bypass HotSpot authentication 72

113 Walled-Garden Access for HTTP and HTTPS pages without authentication Ability to block pages 73

114 Walled-Garden Src. address, HotSpot client address Dst. address, HTTP/ HTTPs IP address Dst. Host, DNS name, example Path, 74

115 Walled-Garden IP Bypass other services without authentication Bypass for protocols and ports, SSH, Telnet, Winbox, SIP calls, etc. 75

116 IP Binding Allows full HotSpot bypass for the user Static Universal client (one-to-one NAT) translations Block unauthorized hosts or networks 76

117 One-to-One NAT Address, HotSpot client address To Address, new address of the HotSpot client 77

118 IP Binding types regular, no action for the client bypassed, client is bypassed without authentication blocked, block access for the client or network 78

119 Firewall rules HotSpot setup creates dynamic firewall rules Static rules are moved to the bottom after reboot Special chain available for placing static rules over dynamic 79

120 Filter and NAT Rules should be placed 80

121 Filter and NAT Static rules to be placed before dynamic 81

122 Firewall rules Jump rules are red, because there is no rules in custom chain Red rules does not make any problem for HotSpot or firewall operation 82

123 Exceptions lab LAB Set without authentication Set SSH without authentication Block Telnet for all HotSpot users Set access for HotSpot only for users with local network IP address 83

124 Accounting

125 Accounting 85

126 SNMP Information provided by SNMP 86

127 HotSpot + RADIUS

128 RADIUS RADIUS server is used for multiple routers management Used as HotSpot, DHCP, PPP, Wireless clients and RouterOS login database 88

129 RADIUS 89

130 RouterOS and RADIUS MikroTik RouterOS RADIUS client works with any RFC compliant server (e.g. FreeRADIUS) User Manager 90

131 User Manager

132 User Manager RADIUS based application integrated into RouterOS package HotSpot, PPP, DHCP, Wireless, RouterOS users management is supported 92

133 Advantages Easy to install and configure Web interface configuration support No additional expenses for separate server required (integrated to the RouterOS) 93

134 User Manager Install

135 Hardware 32 MB RAM 2MB on hard drive (more recommended) x86 architecture All RouterBOARDs 95

136 Software RouterOS v3 or v2.9 User Manager package RouterOS license; Level 3-10 active sessions Level 4-20 active sessions Level 5-50 active sessions Level 6 - Unlimited 96

137 Install Download package Upload package to the router Reboot the router 97

138 User Manager Install For the Training class only!!! Unreleased version of the New User Manager Package is available on teacher s FTP Not for production network now 98

139 User Manager + HotSpot

140 User Manager User Manager can be used for HotSpot, PPP(PPTP,L2TP PPPoE), DHCP, Wireless, RouterOS users management Training covers HotSpot with User Manager 100

141 RouterOS Access Console access, /tool user-manager WEB access, router_ip/userman 101

142 First Access Default login is admin without password Customer is User Manager administrator No relations to RouterOS users 102

143 Customers Management Customers managed from customer menu Different hierarchy levels Signup The same as /radius configuration 103

144 HotSpot Configuration use-radius=yes, send HotSpot requests to RADIUS Firstly local HotSpot database (/ip hotspot user) is contacted, then RADIUS server (User Manager) 104

145 LAB Customer Lab Create new customer with full privileges 105

146 Routers

147 User Manager Routers Routers, list of routers User Manager communicates with , User Manager and HotSpot on the same router 107

148 RADIUS client RouterOS RADIUS client configuration Service, facility RADIUS is used for Address, RADIUS server address Secret, authentication password 108

149 Users

150 Users Users managed from Users menu /tool usermanager user, console The same as /ip hotspot 110 user

151 User Manager Users Firstly, HotSpot database is contacted for user authentication Then, User Manager database 111

152 LAB Users Lab Add another user to /ip hotspot user Add the same user to User Manager Make sure User Manager is used for created user authentication 112

153 Users menu Username and password, client s login and password IP address, IP address assigned to client Group, HotSpot /ip hotspot user profile name Address-list and Caller-ID, used for PPP 113

154 Users menu /tool user-manager user stores users, /ip hotspot user /ppp secret /ip dhcp-server lease /user 114

155 Users Limits Download and Upload limit, amount of bytes to receive/send for HotSpot user Transfer limit, download +upload Uptime Limit, time allowed to be online 115

156 User Limits Rate limits, used to create dynamic /queue simple Rx - client upload, Tx - client download Bursts and limit-at settings are available additionally 116

157 LAB User Limits Lab Create new user with allowed 1M upload 2M download Set GB upload limit and 2GB download limit for user Set user active for 1 day Make configuration in local HotSpot Make configuration in User manager 117

158 Future Usage

159 RADIUS Incoming Change users authorization options on the fly by User Manager Example, change user bandwidth limit serttings, when specific amount of bandwidth is reached 119

160 Credits Different credit type, not only time credits, but bandwidth credits Advanced credits report generation 120

161 Profiles Options set assigned to the group users Different bandwidth and time limitations per profile Change profiles on the fly for user with RADIUS incoming 121

162 Customize Interface Customize configuration menus 122

163 Customize Appearance Change User Manager look Logo, Text, titles, colors Even Language 123

164 Customize Templates Change voucher and CSV files 124

165 Hidden Features /store management, v3 allows to save User Manager information on secondary drive Language localization, User Manager can be translated to your local language 125

166 Other Features Many other functions to come Do you have any suggestions? Contact support 126

167 Before Exam Reset the router configuration Set configuration to get access to the Internet Check there is no HotSpot configured or any settings that may block Internet connection 127

168 Certification Exam