Difference between revisions of “Manual:Packet Flow”


  (2 intermediate revisions by the same user not shown) Line 1: Line 1: − {{Versions|v3, v4, v5+}} +

{{Versions| +}}

     

==Overview==

 

==Overview==

    −

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or natting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router – you just go to corresponding menu and create necessary configuration.

+

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router – you just go to corresponding menu and create necessary configuration.

     

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?  

 

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?  

Line 9: Line 9:  

To address these questions we created a packet flow diagram.

 

To address these questions we created a packet flow diagram.

    −

==Diagram==

+

====

    −

{{Note | a new diagram has been created, specifically optimized for the new mechanisms in RouterOS v6 and above. [[Manual:Packet_Flow_v6|Please see it here]]}}

+   +   +   +   +

{

  +   +   +   +   +   +

{|

  +   +

, the in RouterOS.

  +

[[:|]]

  +

}

  +   +   +   +   +   +

}

    −

As it was impossible to get everything in one diagram, ”’Packet flow diagram”’ for Mikrotik RouterOS v3.x was created in 2 parts:

+

========

* ”’Bridging or Layer-2 (MAC)”’ where Routing part is simplified to one “Layer-3” box

+

in the

* ”’Routing or Layer-3 (IP)”’ where Bridging part is simplified to one  “Bridging” box

+ −

 

+

[[:.png|Packet Flow ||]]

The packet flow diagram is also available [http://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdf as a PDF].

+

====

 

  −

[[Image:Bridge_final.png|Packet Flow in Layer-2|700px]]

  −

 

  −

 

  −

[[Image:IP_final.png|Packet Flow in Layer-3|700px]]

  −

 

  −

==== Changes in RouterOS v6 ====

  −

 

  −

The following changes have been made to the Packet Flow in RouterOS v6, see red cirdled elements in the image:

  −

 

  −

[[File:Packetflowv6.png|700px]]

  −

 

  −

 

  −

==== MPLS Packet Flow ====

  −

 

  −

 

  −

[[File:mpls-packet-flow-input.png|330px]] [[File:mpls-packet-flow-output.png|400px]]

  −

 

  −

==Analysis==

       

===Basic Concepts===

 

===Basic Concepts===

    −

[[Image:Input_interface.jpg|Input Interface|100px]] starting point in packets way through the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.

+

|

  +

|-

  +   +     −

[[Image:output_interface.jpg|Output Interface|100px]] – last point in packets way through the router facilities. Just before the packet is actually sent out.

+   +

[[Image:.jpg|Interface|100px]]

  +

point in packets way through the router facilities. packet is

    −

[[Image:local_process-_in.jpg|Local Process IN|100px]] – last point in packets way ”’to”’ router itself, after this packet is discarded

+   +

[[Image:.jpg||100px]]

  +

point in packets way router packet is

    −

[[Image:local_process-_out.jpg|Local Process OUT|100px]] – starting point for packets generated by router itself

+   +

[[Image:local_process-.jpg|Local Process |100px]]

  +

point packets router itself

      +   +   +   +  

===Configurable Facilities===

 

===Configurable Facilities===

     

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly

 

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly

    −

 

+ −

[[Image:connection_tracking.jpg|Connection Tracking|100px]] – ”’/ip firewall connection tracking”’

+ −

 

+ −

[[Image:Filter_input.jpg|Filter Input|100px]]

+ −

[[Image:Filter_forward.jpg|Filter Forward|100px]]

+ −

[[Image:Filter_output.jpg|Filter Output|100px]] – ”’/ip firewall filter”’

+

[[Image:connection_tracking.jpg|Connection Tracking|100px]]

 

+

/ip firewall connection tracking

[[Image:src_nat.jpg|Source NAT|100px]]

+ −

[[Image:dst_nat.jpg|Destination NAT|100px]] – ”’/ip firewall nat”’

+

[[Image:Filter_input.jpg|Filter Input|100px]]

 

+ −

[[Image:mangle_prerouting.jpg|Mangle Prerouting|100px]]

+ −

[[Image:mangle_input.jpg|Mangle Input|100px]]

+

[[Image:Filter_forward.jpg|Filter Forward|100px]]

[[Image:mangle_forward.jpg|Mangle Forward|100px]]

+ −

[[Image:mangle_output.jpg|Mangle Output|100px]]

+ −

[[Image:mangle_postrouting.jpg|Mangle Postrouting|100px]] – ”’/ip firewall mangle”’

+

[[Image:Filter_output.jpg|Filter Output|100px]]

 

+

/ip firewall filter

[[Image:global_in.jpg|Global-in HTB|100px]]

+ −

[[Image:global_out.jpg|Global-Out HTB|100px]]

+

[[Image:src_nat.jpg|Source NAT|100px]]

[[Image:Interface HTB.jpg|Interface HTB|100px]]  – ”’/queue simple”’ and ”’/queue tree”’

+ −

 

+ −

[[Image:IPsec_policy.jpg|IPSec_Policy|100px]] – ”’/ip ipsec policy”’

+

[[Image:dst_nat.jpg|Destination NAT|100px]]

 

+

/ip firewall nat

[[Image:accounting.jpg|Accounting|100px]] – ”’/ip accounting”’

+ −

 

+

[[Image:mangle_prerouting.jpg|Mangle Prerouting|100px]]

[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]] – ”’/interface bridge settings”’ available only for traffic that go ”’through”’ the bridge. For all other traffic default value is ”’Yes”’

+ −

 

+ −

[[Image:bridge_input.jpg|Bridge Input|100px]]

+

[[Image:mangle_input.jpg|Mangle Input|100px]]

[[Image:Bridge_forward.jpg|Bridge Forward|100px]]

+ −

[[Image:Bridge_output.jpg|Bridge Output|100px]] – ”’/interface bridge filter”’

+ −

 

+

[[Image:mangle_forward.jpg|Mangle Forward|100px]]

[[Image:Bridge_dst_nat.jpg|Bridge Destination NAT|100px]]

+ −

[[Image:Bridge_src_nat.jpg|Bridge Source NAT|100px]] – ”’/interface bridge nat”’

+   +

[[Image:mangle_output.jpg|Mangle Output|100px]]

  +   +   +

[[Image:mangle_postrouting.jpg|Mangle Postrouting|100px]]

  +

/ip firewall mangle

  +   +

[[Image:global_in.jpg|Global-in HTB|100px]]

  +   +   +

[[Image:global_out.jpg|Global-Out HTB|100px]]

  +   +   +

[[Image:Interface HTB.jpg|Interface HTB|100px]]

  +

/queue simpleand /queue tree

  +   +

[[Image:IPsec_policy.jpg|IPSec_Policy|100px]]

  +

/ip ipsec policy

  +   +

[[Image:accounting.jpg|Accounting|100px]]

  +

/ip accounting

  +   +

[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]]

  +

/interface bridge settings

  +

  +

[[Image:bridge_input.jpg|Bridge Input|100px]]

  +   +   +

[[Image:Bridge_forward.jpg|Bridge Forward|100px]]

  +   +   +

[[Image:Bridge_output.jpg|Bridge Output|100px]]

  +

/interface bridge filter

  +   +

[[Image:Bridge_dst_nat.jpg|Bridge Destination NAT|100px]]

  +   +   +

[[Image:Bridge_src_nat.jpg|Bridge Source NAT|100px]]

  +

/interface bridge nat

  +      

===Automated processes and decisions ===

 

===Automated processes and decisions ===

    −

[[Image:In-interface-bridge.jpg|In-interface Bridge|100px]] – check if the ”actual input interface” is a port for bridge OR  checks if ”input interface” is bridge

+ −

 

+ −

[[Image:hotspot_in.jpg|Hotspot In|100px]] – allow to capture traffic witch otherwise would be discarded by connection tracking – this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess

+ −

 

+ −

[[Image:Bridge Desicion.jpg|Bridge Decision|100px]] – bridge goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found – packet will be send out via corresponding bridge port. In case of no match – multiple copies of packet will be created and packet will be sent out via all bridge ports

+ −

 

+

[[Image:In-interface-bridge.jpg|In-interface Bridge|100px]]

[[Image:bridge_decision.jpg|Bridge Decision|100px]] – this is a workaround, allows to use “out-bridge-port” before actual bridge decision.

+

if the ”actual input interface” is a port for bridge OR  checks if ”input interface” is bridge

 

+ −

[[Image:routing_decision.JPG|Routing Decision|100px]] – router goes through the route n order to find a match to destination IP address of packet. When match is found – packet will be send out via corresponding port or to the router itself . In case of no match – packet will be discarded.

+

[[Image:hotspot_in.jpg|Hotspot In|100px]]

 

+

to capture traffic witch otherwise would be discarded by connection tracking – this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess

[[Image:routing_adjustment.jpg|Routing Adjustment|100px]] – this is a workaround that allows to set-up policy routing in mangle chain output

+   +

[[Image:Bridge Desicion.jpg|Bridge Decision|100px]]

  +

goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found – packet will be send out via corresponding bridge port. In case of no match – multiple copies of packet will be created and packet will be sent out via all bridge ports

  +   +

[[Image:bridge_decision.jpg|Bridge Decision|100px]]

  +

is a workaround, allows to use “out-bridge-port” before actual bridge decision.

  +   +

[[Image:routing_decision.JPG|Routing Decision|100px]]

  +

goes through the route n order to find a match to destination IP address of packet. When match is found – packet will be send out via corresponding port or to the router itself . In case of no match – packet will be discarded.

  +   +

[[Image:routing_adjustment.jpg|Routing Adjustment|100px]]

  +

is a workaround that allows to set-up policy routing in mangle chain output

  +   +   +   +   +   +   +   +   +   +   +   +   +   +   +   +     −

[[Image:TTL=TTL-1.jpg|TTL Adjustment|100px]] – indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded

  −   −

[[Image:IPSec_Decryption.jpg|IPSec_Decryption|100px]] [[Image:IPSec_Encryption.jpg|IPSec_Encryption|100px]] – self explainatory

  −   −

[[Image:out_interface_bridge.jpg|Out-interface Bridge|100px]] – check if the ”actual output interface” is a port for bridge OR  checks if ”output interface” is bridge

  −   −

[[Image:Hotspot_out.jpg|Hotspot Out|100px]] – undo all that was done by hotspot-in for the packets that is going back to client.

       

==Examples==

 

==Examples==

    −

===Bridging with use-ip-firewall=yes===

+

different .

 

  −

[[Image:Packet_Flow_Example_1.png|Packet Flow Example 1|700px]]

  −

 

  −

 

  −

===Routing – from Ethernet to Ethernet interface===

  −

 

  −

[[Image:Packet_Flow_Example_2c.png|Packet Flow Example 2|700px]]

  −

 

  −

===Routing from one Bridge interface to different Bridge interface===

  −

 

  −

[[Image:Packet_Flow_Example_3_1.png|Packet Flow Example 3|700px]]

  −

[[Image:Packet_Flow_Example_3_2c.png|Packet Flow Example 3|700px]]

  −

 

  −

===IPsec encryption===

  −

 

  −

[[Image:Packet_Flow_Example_4c.png|Packet Flow Example 4|700px]]

  −

 

  −

===IPsec decryption===

  −

 

  −

[[Image:Packet_Flow_Example_5c.png|Packet Flow Example 5|700px]]

  −

 

      −

[[Category:Manual|P]]

+ −

[[Category:IP|P]]

+ −

[[Category:QoS|P]]

+ −

[[Category:Case Studies|P]]

+

[[:|]]

  +   +

[[:|]]

  +   +

[[:|]]

  +   +

[

  +

[:|]]

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or NATting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router – you just go to corresponding menu and create necessary configuration.

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?

To address these questions we created a packet flow diagram.

For MikroTik RouterOS v6.0 was created detailed diagrams to ease understanding of packet flow.

This diagram explains in detail each section of the Overall Packetflow Diagram.

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly

In this subsection you can overview different protocol packet processing in RouterOS.

Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to secure packet exchange over unprotected IP/IPv6 networks such as Internet.



Source link

Administrador AcessoWi-Fi.com – Gerente UnicoHost Soluções Web – Engenheiro de Redes

Julio Rossoni

Administrador AcessoWi-Fi.com - Gerente UnicoHost Soluções Web - Engenheiro de Redes

This site uses Akismet to reduce spam. Learn how your comment data is processed.