In this article I want to show you how to create tunnel interface on Mikrotik. There are two types of tunneling supported by Mikrotik, IP-IP (IP over IP) tunnel and EoIP (Ethernet over IP) tunnel.

This article will show you how to create both tunneling. In this article we have to achieve the condition below.

Conditions:
Mikrotik Router A IP Address: 111.222.123.34/28
Mikrotik Router B IP Address: 100.200.101.130/27
Point to Point IP Address: 192.168.201.0/30

1. IP-IP (IP over IP) Tunnel

Router A:

interface ipip add name=ipip1 local-address=111.222.123.34 remote-address=100.200.101.130 disabled=no
ip address add address=192.168.201.1/30 interface=ipip1 disabled=no

Router B:

interface ipip add name=ipip1 local-address=100.200.101.130 remote-address=111.222.123.34 disabled=no
ip address add address=192.168.201.2/30 interface=ipip1 disabled=no

2. Ethernet over IP (EoIP) Tunnel

Router A:

interface eoip add name=eoip-tunnel1 remote-address=100.200.101.130 tunnel-id=1 arp=enabled
ip address add address=192.168.201.1/30 interface= eoip-tunnel1  disabled=no

Router B:

interface eoip add name=eoip-tunnel1 remote-address=111.222.123.34 tunnel-id=1 arp=enabled
ip address add address=192.168.201.2/30 interface= eoip-tunnel1  disabled=no

After the tunnel interface has been configured, you have to add route the network address that you want to allocate. For example if you want to add a network address of 100.200.102.0/24 that point to Router B, you have to add a route in the Router A as follow:

ip route add dst-address=100.200.102.0/24 gateway=192.168.201.2

In this article I want to show on how to block Facebook using Mikrotik in three steps. We will use Web Proxy feature included in Mikrotik. We assume the LAN (Local Area Network) address is 192.168.56.0/24 and the IP address of  ’ether1′  which facing to the LAN is 192.168.56.254.

Here are the three steps:

1. Enable Web Proxy

We enable this web proxy without cache on disk.

ip proxy set enabled=yes port=8080 cache-on-disk=no

2. Add proxy access rules

In this step we define which website we want to block. In this case, we want to block Facebook. Remember that Facebook has many sub-domains so we have to block all that sub-domains.

ip proxy access add src-address=192.168.56.0/24 dst-host=*.facebook.com action=deny

The ‘*.facebook.com’ value means all sub-domains of facebook.com.

3. Enable the transparent proxy

In this step we have to redirect all web access to facebook.com coming from the LAN to the web proxy.

ip firewall nat add chain=dstnat  in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080

That’s all. You can add as many websites that you want to block as described in step 2.

In my previous article, I showed you how to install Mikrotik on Vitualbox. Now I will show you how to make it accessible from HostOS via Winbox.

Winbox is a GUI application to manage and configure Mikrotik. It will be much easier to manage Mikrotik using Winbox than CLI.

There are two ways to access Mikrotik using Winbox installed in Virtualbox:

1. Assigning ether1 IP Address to the same network of VirtualBox Host-Only Network.
This is the easiest way. You have to attach the Network Adapter of Mikrotik to ‘Host-only Adapter’ belong to ‘VirtualBox Host-Only Ethernet Adapter’. See image below:

Adapter Setting (click to enlarge)

Later you have to set the IP address of ether1 of Mikrotik to be the same network of VirtualBox Host-Only Network. The default IP address assigned to this Ethernet is 192.168.56.1/24, of cource you can change this IP address as you want. You can check the IP Address by using ‘ipconfig’ (Windows) or ‘ifconfig’ (Unix/Linux). See image below:

Virtualbox Ethernet Adapter (click to enlarge)

Now run the Mikrotik OS running in Virtualbox. Login using ‘admin’ and empty password. Set the IP address of ether1 to 192.168.56.2/24 or whatever IP address still in the same network.

ip address add address=192.168.56.2/24 interface=ether1

After setting to ethet1 ip address, try to ping the IP address from Host OS (Windows).

C:\Users\Fuad NAHDI>ping 192.168.56.2
 
Pinging 192.168.56.2 with 32 bytes of data:
Reply from 192.168.56.2: bytes=32 time<1ms TTL=64
Reply from 192.168.56.2: bytes=32 time=2ms TTL=64
Reply from 192.168.56.2: bytes=32 time<1ms TTL=64
Reply from 192.168.56.2: bytes=32 time<1ms TTL=64
 
Ping statistics for 192.168.56.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 2ms, Average = 0ms

If Mikrotik replied the ping, it is ready to access it using Winbox. Run Winbox now and set to Connect To: 192.168.56.2. See image below:

Click ‘Connect’ button and if there are no errors you should successfully log in to the Mikrotik using Winbox.

Winbox Mikrotik (click to enlarge)

2. Mapping / Forwarding port used by Winbox.
Using this way you have to map/forward port used by a GuestOS installed on Virtualbox. Winbox is using port 8291 to LISTEN on the system.

So we will map/forward this port from  HostOS to the GuestOS.

The command are as below:

C:\Users\Fuad NAHDI>cd\
C:\>cd "Program Files\Sun\xVM VirtualBox"
C:\Program Files\Sun\xVM VirtualBox>VBoxManage setextradata Mikrotik "VBoxInternal/Devices/pcnet/0/LUN#0/Config/winbox/HostPort" 8291
VirtualBox Command Line Management Interface Version 3.0.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.
 
C:\Program Files\Sun\xVM VirtualBox>VBoxManage setextradata Mikrotik "VBoxInternal/Devices/pcnet/0/LUN#0/Config/winbox/GuestPort" 8291
VirtualBox Command Line Management Interface Version 3.0.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.
 
C:\Program Files\Sun\xVM VirtualBox>VBoxManage setextradata Mikrotik "VBoxInternal/Devices/pcnet/0/LUN#0/Config/winbox/Protocol" TCP
VirtualBox Command Line Management Interface Version 3.0.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

After executing the above commands withour any errors, now open Winbox application.

Set the Connect To value to localhost and Login to admin, then click Connect button.

After clicking Connect button and no error during login process, you should successfully log in to the winbox application.

Winbox Mikrotik (click to enlarge)

Hope this tutorial useful for others.

Mikrotik is a Linux-based operating system that bundled with many tools already included such as static/dynamic routing, wireless, hotspot, bandwidth manager and many more. The thing that makes it more attractive is its price that much much cheaper than other router equipment brands.

To test mikrotik, you can download the iso file and install it on your PC or laptop.

Then you need to buy a licence to make it usable. Otherwise it will expire in 24 hours.

The easiest way to test mikrotik without buying the licence is using virtual machine.

This tutorial will show you how to install Mikrotik in Virtualbox, an open source and free virtual machine developed by Sun Microsystem.

Here are the steps:

1. Download the Mikrotik iso file on its website here. At the time this tutorial is written, the latest stable version is mikrotik-3.27.iso. Save it in you hard disk. We will boot mikrotik directly from the iso file so we do not need to burn it on a CD/DVD.
2. Run your Virtualbox software. Click Machine > New (Ctrl+N) to create new virtual machine through Virtual Machine Wizard. Then click Next.
3. On the VM Name and OS Type window, insert “Mikrotik” under the Name. Under OS Type, select Linux as Operating System and Other Linux as Version, then click Next.


VM Name and OS Type (click to enlarge)

4. For the memory allocation to the virtual machine, accept as default (256 MB) and then click Next.


Memory Allocation (click to enlarge)

5. On the Virtual Hard disk, check the Boot Hard Disk (Primary Master) option. And then we need to create new hard disk for the mikrotik to install.


Virtual Disk Location and Size (click to enlarge)

6. Create Virtual Disk Wizard will come up. Select Dynamically expanding storage for the Storage Type (selected by default).
7. Since mikrotik is very small software, 512 MB space is more than enough for you. Then click Finish.
8. The next step is point the virtualbox to use iso image file to boot. To do this, click Setting > CD/DVD-ROM. Check Mount CD/DVD Drive and select ISO Image File then point to the mikrotik iso file. Make sure in System category, the first Boot Order is using CD/DVD-ROM, then click OK.


Mount ISO Image (click to enlarge)



System Boot Order (click to enlarge)

9. Now it is the time to start to boot from ISO Image File. Make sure that Mikrotik virtual machine is selected and then click ‘Start’.
10. Mikrotik will boot and after detecting all the devices, the “Welcome to MikroTik Router Software Installation” and you are ready to continue to install the softwares you need.


Mikrotik Software Installation (click to enlarge)