Mikrotik

Day 26 of #100daysofhomelab and I have been trying to figure out why my internet has been unstable today… it up and down a few times… well, parts of it are… Zerotier seems to be sorting out my main network, it’s smaller parts that are going wonky… I am half thinking of leaving it till next weekend since my RB5009 arrives next week… This should help me sort out my network…

Day 22 of #100daysofhomelab and I have been planning out my network update for when my RB5009 arrives… Not ready to share, yet, but it should be here on the 2nd Feb, so I will have a plan (maybe) by the weekend… Other than that, it’s a link dump for today:

Ok, I kind of got the following diagram, but it only makes sense in my head, and I’m not even sure it makes sense there… I’ll leave this here without further explanation, till maybe the weekend…

Day 21 (slightly late, forgot to post this last night) of #100daysofhomelab and its a links day.

on a more different note, my Mikrotik RB5009UG+S+IN is finally on its way! Hopefully will have it next week! Happy days!

Day 19 of #100daysofhomelab and not done a lot today, so its mostly links…

day 17 of #100daysofhomelab, and I haven’t done much, so its a link roundup today:

Day 14 of #100daysofhomelab and I have been thinking about future upgrades if I had the money… So, I have my CloudShed in the back garden. Currently, I only have an HP Micro Server and a (not currently in production) Dell R720, along with a Ubiquiti Edge Switch 48 Lite. Between the Shed and the house is a fibre link purchased through FS.com, with 6 pairs. Currently, only 1 pair is in use, giving me a 10Gb/s between the house and shed, and with the easy option to upgrade to 20Gb. But I have been thinking bigger.

As a follow-up to yesterday’s post on RouterOS Blocking Machine access to all but one IP, I thought I would show how to add extra IPs to that list, without having a shedload of firewall filters.

• First things first, get your list of IPs you allow access to. In my case, I just did an NSLOOKUP on the name and got the IPs.
• Create an “Address List” in RouterOS. This can be done on the Web Interface by going to IP / Firewall / Address List and clicking Add. I had none previously, so I created a new rule, naming it ExpressVPN (the lads I use for VPN access) and added the first address.
• this is where things get interesting. for extra IP (for ExpressVPN, I have 4) you create a new address with the SAME name, but different IP.
• in your firewall rule, you should have either an src address or a dst address. in my case, I had both, but this was a change for the dst address. I removed the address from the rule, and I added it as a dst address list entry. If you have multiple address lists, you will see them here.

to do this at the command prompt:

So, I have a machine on my network, which should be only connecting to the internet through a VPN. I needed to tell my RouterOS box to block all access, except to this said IP address. The following should do the trick. YMMV

this will drop any packets from the srcaddress (IP address) that are not for the destination dstaddress (IP address). in my case, dstaddress is the VPN server I want to connect to. So, in theory, all packets should just go through the VPN and not leak out into the rest of the network. again, still testing this so be careful!