Manhattan International Co .
, Ltd
ក្នុងមេមរៀងមែេះខ្ុុំចង់នែណុំអ្ក្
ន ទុំងអ្ស់ គ្ននមោយដង
ឺ ពកា
ី រ Configure MikroTik Routerែង
ិ
Configure Option េួយចុំែែ
ួ មៅក្នុង MikroTik ខាងមរកាេមែេះគជា
ី Diagramនដលខ្ុុំបាConfigure។
IP Address = 192.168.0.122/24
Default Gateway = 192.168.0.254
DHCP Server = 192.168.0.254
S_DNS = 192.168.0.3
LAN : 192.168.254.254 , WAN : 192.168.0.122/24
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 1
Manhattan International Co ., Ltd
រមបៀបក្ុំណត់មោយ MikroTik ទទូល IP DHCP ពី Modem ADSL for Access Internet
+IP - > Address
Address list : េែ
ិ ចុំបាច់ Assign Ip Address មៅមោយ Network WAN_ether1
= > IP - > DHCP Client - > ចុចមលើសញ្ញាបូក្ New DHCP Client បង្ហាញ
DHCP Tab
- Interface : WAN_ether1
- Tick Use Peer DNS
- Use Peer NTP
- Add Default Route
- Assign DNS Server or DNS ISP : 8.8.8.8 or 8.8.4.4
- Tick Allow Remote Requests
Allow Client Access Internet to WAN
Ip - > Firewall - > NA - > ចុចមលើបូក្
General Tab
- Chain : srcnat
Action Tab
- Action : masquerade
រមបៀបក្ុំណត់មោយ MikroTik ទទូល IP Static ពី Modem ADSL for Access Internet
+ IP - > Address - > ក្នុង Address List ចុចសញ្ញាបូក្ មដើេបប
ី មងកើត WAN interface
IP Address: 192.168.0.122 /24
Interface : Choose [ WAN_ether1 ]
Ip 192.168.0.0 គីជា Network
+ IP - > Route - > Routes Tab ចុចសញ្ា បូក្
Dst. Address =Default 0.0.0.0 /0
Gateway : 192.168.0.254
+ IP - > DNS
Server : 8.8.8.8 , 8.8.4.4
អ្នក្ោចដាក្់ DNS ISP or Windows Server របស់អ្ក្
ន ក្៍បាែនដល។
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 2
Manhattan International Co ., Ltd
+IP - > Firewall - > NAT - > ចុចមលើសញ្ញាបូក្មដើេបមី ោយ Client ោចAccess Internet
General Tab
- Chain : srcnat
Action Tab
- Action : masquerade
Assign IP Address DHCP to PC Client by Command
New Terminal
>ip dhcp-server
/ip dhcp-server > setup
dhcp-server interface :Choose LAN
Not : > / =រតលប់មរកាយ,Ctrl + C =ចក្់មចញ , > interface print = មេល
ើ LAN internet ,
Ex : >LAN-ether3
dhcp address space : Enter
gateway for dhcp network : IP of Router Ex: 192.168.0.254
address to give out : 192.168.0.1 – 192.168.0.254
dns server : IP DNS Server and 8.8.8.8 , 192.168.0.3
How to Access Connect Internet by Web Proxy
Ip - > Web Proxy
Tick មលើ Enabled
Port : 1689
Cache Administrator : mahattansez.com
Max.Cache Size :unlimited
Tick មលើ Cache On Disk
Allow Client Access Internet
Ip - > Firwall - > NAT - > ចុចសញ្ញាបូក្មដើេប ី Allow Internet
+ General
Chain : dstnat
Src.Address : 192.168.0.254 /24 ជាIp នដលមយង
ើ Allow មៅក្នុង LAN មយង
ើ
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 3
Manhattan International Co ., Ltd
Protocol : 6 (tcp)
Dst.Port : 80
+ Action Tab
Action : redirect
To Ports : 1689
Ip - > Firewall - > NAT - > ចុចមលើសញ្ា បូក្
General
Chain : scrnat
Src.Address : 192.168.0.254 /24
Action Tab
Action : masquerade
Test Web Proxy : www.whatismyipaddress.com
រមបៀប Block YouTube Facebook and Twitter មៅក្នុង Layer 7 Protocols
Ip - > Firewall - > Layer 7 Protocols
= > ^.*(YouTube.com).*$ , ^.+(facebook.com).*$ , ^.+(twitter.com).*$
Or
= > ^.*(facebook.com | hi5 | twitter | YouTube | porn ).*$
ក្នុង Filter Rules ចុចសញ្ញាបូក្ - > ក្នុង New Firewall Rule ម្វកា
ើ រក្ុំណត់ដូចខាងមរកាេ
Chain: forward
Src.Address: 192.168.0.20
Protocol : 6 (tcp)
Dst.Port:80
Layer 7 Protocol: Block YouTube , Block FaceBook , Block Twitter.
Content: Youtube.com
In Action Tab: drop
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 4
Manhattan International Co ., Ltd
រមបៀប Block mp3 មៅក្នុង Layer 7 Protocols
Ip - > Firewall - > Layer 7 Protocols
= > \.(mp3)
Chain: forward
Src.Address: 192.168.0.20
Protocol : 6 (tcp)
Dst.Port:80
Layer 7 Protocol: Block MP3
Content: mp3
In Action Tab: mark connection
Connection Mark:mc_mp3
រមបៀបក្ុំណត់ Speed សុំរាប់ PC Client មរបើរបាស់ Internet Download & Upload
+ IP - > Queues - > Simple Queues - > ចុចមលើសញ្ា បូក្
+ General Tab
- Name : Client Name Ex : PC002
- Target Address : Ip Address for Client
- Tick Target Upload
- Tick Target Download
- Max Limit : 128 kbit/s
+ Set Group and Share Speed Internet in MikroTik
+ General Tab
- Name : Group Name Ex : G-Admin
- Target Address : Ip Address for Client in LAN Ex : 192.168.0.254/24
- Tick Target Upload
- Tick Target Download
- Max Limit : 1M
Create PC Client to in Group
- Name: PC Client Name Ex : PC01
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 5
Manhattan International Co ., Ltd
- Target Address: ip address for Client Ex : 192.168.0.41
- Tick Target Upload
- Tick Target Download
- Max Limit : 128 kbit/s
- Parent : Choose [ G-Admin]
- Priority : first Number Ex : 1
រមបៀប Block Web Site in Web Proxy and Create Web Cache in Web Proxy
ក្នុង Firewall - > NAT Tap ចុចសញ្ញាបូក្
+ General
Chain : dstnat
Protocol :6 (tcp)
Dst.Port : 80
+ Action
Acton : redirect
To Ports : 8080
Ip - > Web Proxy - > ក្នុង Access Tab ចុចមលើសញ្ា បូែ
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 6
Manhattan International Co ., Ltd
Ip - > Firewall
+ General
Chain : input
Protocol : 6(tcp)
Dst.Port : 8080
In.Interface: Wan1
+ Action Tap
Action : drop
រមបៀបបទ
ិ ក្េមវ្
ិ ី Ultrasurf in MikroTIk Router
1- Create Address List - > IP - > Firewall - > Address List - >ចុចមលើសញ្ញាបូក្មដេ
ើ បី
Add Name UltrasurfServer and IP
+ Name : UltrasurfServer
+ IP : 65.49.0.0/17 , 204.107.140.0/24
54.240.168.102 , 61.230.115.230
Note : មដាយមយង
ើ ោចម្វកា
ើ រ Add Ip Address ខាងមលើទង
ុំ អ្ស់ ក្បា
៍ ែ។
2- Create Mangle - > IP - > Firewall - > Mangle Tab - >ចុចមលើសញ្ញាបូក្
+ General Tab
- Chain : prerouting
- Protocal :6(tcp)
- Dst Port :433
+ Advanced Tab
Dst Address List : Choose [ UltrasurfServer]
+ Action Tab
- Action : add scr to address list
- Address List : UltrasurfServer
- Time out : 00:03:00
+ Create Firewall Rule - > IP - > Firewall Rule
- Chain : forward
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 7
Manhattan International Co ., Ltd
- Portocal :6(tcp)
- Dst Port :443
+ Comment : Block UltrasurfServer
រមបៀបបទ
ិ WebSite Sex ,Facebook ,hi5,twitter,YouTube, Game Crack….
IP - > Firwall
+ Layer 7 Protocol Tab - >
- Name : Block –URL+DNS
- Regexp : ^.*(facebook.com | hi5 | twitter | youtube | porn ).*$
= > Firewall Rule Tab - > Create - >
+ General Tab
Chain : forward
+ Advanced Tab
Layer 7 Protocol: Choose [Block-FB&YT]
+ Action Tabb
Action: drop
រមបៀប Block IP , Block Port ,Redirect in WebProxy
= > Ip - > Web Proxy - > General - > Access - > ចុចមលើសញ្ញាបូក្
Src.Address : ជាIp នដលមយង
ើ ចង់ Block Ex: 192.168.0.122
Action : deny
Dst Port : 0 send mail port =25 , receive mail port :110
Local Port :80 សុំ រាប់បទ
ិ Port Internet Ex : port 110
+ Redirect
Dst.Host : www.facebook.com
Action : deny
Dreirect To : wwww.manhattansez.com.kh
How to Create Web Cache in MikroTik Router
Ip - > Web Proxy - > Web Proxy Setting
+ General Tab
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 8
Manhattan International Co ., Ltd
Tick រតង់ Enabled
Cache Administrator : google.com
Max.Cache Size : unlimited
Tick រតង់ Cache On Disk
Ip - > Firewall - > NAT Tab
- General Tab
Chain :dstnat
Protocol : 6 (tcp)
Dst Port : 80
- Action Tab
Action : Redirect
To Ports : 8080
Ip - > Firewall - > Filter Rule
- General Tab
Chain : input
Protocol : 6 (tcp)
Dst.Port: 8080
In.interface : Wan 1
- Action Tab
Action: drop
Setup PPPOE Server and PPPOE Client
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 9
Manhattan International Co ., Ltd
Setup Hotspot in MikroTik Router
+ IP - > Hotsport - > Hotsport Setup
- HotSport interface : Choose [ LAN_ether2 ]
- Local Address of Network :ជាIP នដល HotSport មរបើក្ុ ងLAN
ន Hotsport
- Address Pool of Network :ជា IP Client ចប់យក្ដូចការមបាេះDHCP នដល
- Select CertifiCate : none
- IP Address of SMTP Server : ជាIP Address connect to Mail Server
- DNS Server : 8.8.8.8 , 8.8.4.4
- DNS Name: Manhattansez.com
- Name of local Hotsport User: admin
- Password for the User : admin4me
Create User Hotsport
េុែែង
ិ មោយ User Access to Hotsport we must Create User Profile for limits
Speed or limit user access to hotsport
IP - > Hotsport - > user profile - > add button
+ General Tab
- Name : for set name to user profile
- Shared user : for limits PC Client to us this user
- Rate Limit (Rx/tx) : for limit Speed Download / Upload
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 10
Manhattan International Co ., Ltd
Then We Create user:
IP - > Hotsport - > User Tab - > Add button
Server : for Hotsport server allow Hotsport user can access
Name : user name
Profile : ក្នែែងក្ុំណត់មររើសយក្ User Profile នដលមយង
ើ បាែបមងកើត
How to Backup and Restore Configuration in MikroTik
+Backup Configure
Files - > File List - > Click Backup button - >មពលម េះោចទញFile នដលអ្នក្Backup
ម យ
ើ មៅទុក្មៅក្នែែងណេួយនដលមាែសុ វតតិភាព។
+Restore Configure
File - > File List - > Click Restore button ម ើយ Reboot MikroTik .
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 11
Manhattan International Co ., Ltd
Configuration VPN Site to Site in MikroTik Router
Branch Office Note : How to Configure VPN Site to site on MikroTik router
Step 1 : Configure Internet access on both router
IP 172.22.194.242/24 1 / . one router Head Office ( can access to internet ok)
2 / . one router Brach Office ( can access to internet ok )
Gateway : 172.22.194.254 Step 2 : Configure VPN site to site
1 /. On router HO-Office
BO-Router IP : 10.11.12.254/24
Create peer
Change proposals follow your encryption
IP lan : 10.11.12.0 /24
Create policies
Gateway : 10.11.12.254 Create firewall nat by pass
2 /. On router BO-Office
Head Office Create peer
Change proposals follow your encryption
IP : 172.22.201.242/24 Create policies
Create firewall nat by pass
Gateway : 172.22.201.254
Step 2 : Testing
1 /. Testing ping from Head office to Branch Office
HO-Router IP : 192.168.1.254/24
2/. Sharing docuemt from HO-Office to BO-Office.
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 12
Manhattan International Co ., Ltd
IP Lan : 192.168.1.0/24
Gateway : 192.168.1.254
System identity set name=HO-Router សុំ រាប់បូ រម្
ត ម េះពីAdmin@MikroTik >មៅជា Admin@HO-
Router
= > Head Office : បមងកត
ើ Interface Lan and Wan ម យ
ើ Rename ម្មេះណនដលង្ហយយល់
+ IP - > Address - > Address Listមដើេប ី Assign Ip address មោយ Interface Lan and Wan
Wan Interface :
- IP Address Wan : 172.22.201.242 / 24
- Network : ជាNetwork ពី IP Address Interface Wan
- Interface : Choose [ Wan Interface ]
Lan interface :
- IP Address Lan :192.168.1.254 / 24
- Network : ជាNetwork ពី IP Address Interface Lan
- Interface : Choose [ Lan Interface ]
+ IP - > DNS
- Server : 8.8.8.8 , 4.4.4.4
- Tick Allow remotes Requests
+ IP - > Routes - > Routes Tab - > ចុចមលើសញ្ញាបូក្
+ General Tab
- Dst.Address :0.0.0.0 /0
- Gateway : 172.22.201.254
- Check Gateway : ping
- Type : unicast
- Dstance : 1
- Scope :30
- Target Scope : 10
+ IP - > Firwall - > NAT Tab - > ចុចមលើសញ្ញាបូក្
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 13
Manhattan International Co ., Ltd
+ General Tab
- Chain : srcnat
- Out.Interface : Wan
+ Action Tab
- Action : masquerade
+ Tools - > Ping
+ General Tab
- Ping To : google.com
- Interface :Choose [ Wan Interface ]
+ IP - > DHCP Server - > DHCP Tab - > ចុចមលើ DHCP Setup button
- DHCP Server interface : Choose [ Lan Interface ]
- DHCP Address Space : 192.168.1.0 /24
- Gateway for DHCP Network : 192.168.1.254
- Address to Give Out : 192.168.1.1 – 192.168.1.253
- DNS Server : 8.8.8.8 , 4.4.4.4
- LeaseTime : 3d:00:00:00
រតលប់មៅឈរមៅមលើ MikroTik Router នសែងមទៀងគី Branch Office
= > Branch Office : បមងកត
ើ Interface Lan and Wan ម យ
ើ Rename ម្មេះណនដលង្ហយយល់
+ IP - > Address - > Address Listមដើេប ី Assign Ip address មោយ Interface Lan and Wan
Wan Interface :
- IP Address Wan : 172.22.194.242 / 24
- Network : ជាNetwork ពី IP Address Interface Wan
- Interface : Choose [ Wan Interface ]
Lan interface :
- IP Address Lan :10.11.12.254 / 24
- Network : ជាNetwork ពី IP Address Interface Lan
- Interface : Choose [ Lan Interface ]
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 14
Manhattan International Co ., Ltd
+ IP - > DNS
- Server : 8.8.8.8 , 4.4.4.4
- Tick Allow remotes Requests
+ IP - > Routes - > Routes Tab - > ចុចមលើសញ្ញាបូក្
+ General Tab
- Dst.Address :0.0.0.0 /0
- Gateway : 172.22.194.254
- Check Gateway : ping
- Type : unicast
- Dstance : 1
- Scope :30
- Target Scope : 10
+ IP - > Firwall - > NAT Tab - > ចុចមលើសញ្ញាបូក្
+ General Tab
- Chain : srcnat
- Out.Interface : Wan
+ Action Tab
- Action : masquerade
+ Tools - > Ping
+ General Tab
- Ping To : google.com
- Interface :Choose [ Wan Interface ]
+ IP - > DHCP Server - > DHCP Tab - > ចុចមលើ DHCP Setup button
- DHCP Server interface : Choose [ Lan Interface ]
- DHCP Address Space : 10.11.12.0 /24
- Gateway for DHCP Network : 10.11.12.254
- Address to Give Out : 10.11.12.1 – 192.168.1.253
- DNS Server : 8.8.8.8 , 4.4.4.4
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 15
Manhattan International Co ., Ltd
- Lease Time : 3d:00:00:00
Configure VPN sites to sites
= > HO-Router
+ System - > Logging - > Rules Tab- > ចុចមលើសញ្ញាបូក្
- Topics : ipsec
- Action :memory
+ IP - > IPsec - > Peers Tab - > ចុចសញ្ញាបូក្
- Address :172.22.194.242
- Port :500
- Locol Address :
- Secrent :11111
- Hash Algorthim :md5
- Encrytion Algorthim : 3des
- DPD interval :10
- DPD Dardmum Failues :2
ក្នុងដ៍នដល IP - > IPsec មលើ Proposals Tab - > Double Click មលើ default
- Name : default
- Auth Algorithms : Tick md5
- Encr Algorithims : 3des
ក្នុង IP - > IPsec មលើ Policies Tab
+ General Tab :
- Src.Address :192.168.1.0 /24
- Src.Port :
- Dst.Address :10.11.12.0 / 24
- Dst.Port :
- Potocol :255
+ Action Tab :
- Action : encrypt
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 16
Manhattan International Co ., Ltd
- Level : require
- IPsec.Protocols :esp
- Tick Tunnel
- SA Src.Address : 172.22.201.242
- SA Dst.Address :172.22.194.242
- Proposals :default
- Priority : 0
+ IP - > Firewall - > NAT - > ចុចមលើសញ្ញាបូក្
+ General Tab :
- Chain : srcnat
- Src.Address : 192.168.1.0 /24
- Dst.Address :10.11.12 .0 /24
+ Action Tab :
- Action : accept OK go to Router Branch-Office
= > BO-Router
+ System - > logging -> ចុចសញ្ញាបូក្
- Topics : ipsec
- Prifix :
- Action : memory
+ IP - > IPsec - > Peers Tab- > ចុចសញ្ញាបូក្
- Address : 172.22.201.242
- Secret :11111
- Hash Algorithms : md5
- Encryption Algorithms :3des
- DPD intervel : 10
- DPD Maximum Failues :2
+ Proposals Tab:
- Name :default
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 17
Manhattan International Co ., Ltd
- Auth Algorithms : md5
- Encr Algorithms :3des
+ Policies Tab - >
+ General Tab :
- Src.Address : 10.11.12.0 /24
- Dst.Address :192.168.1.0 /24
+ Action Tab :
- Action :encrypt
- Level :requirs
- IPsec.Protocols :esp
- Tick Tunnel
- SA.Src.Address :172.22.194.242
- SA.Dst.Address :172.22.201.242
- Proposals :default
- Priority :0
IP - > Firewall - > NAT - > ចុចមលើសញ្ញាបូក្
+ General Tab :
- Chain : srcnat
- Src.Address : 10.11.12.0 /24
- Dst.Address : 192.168.1.0 /24
+ Action Tab :
- Action :accept
Testing :
Testing Ping From Heand Office to Branch Office
Testing Sharing File From HO Office to BO Office មដាយបមងកើតFolderេួយម ើយម្វើការ
Share permission everyone ម យ
ើ ចូលមៅក្នុង PC BO Office ម យ
ើ វាយIP HO Office មដេ
ើ បី
ចូលមៅយក្Document មៅក្នុងHO Office៕
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 18
Manhattan International Co ., Ltd
Prepare By: Seam BunSeng , Tell : 098 626 280 , Email : [email protected] Page 19
