IPIP Mesh/MikroTik RouterOS 7 Container - Revision history

KI5QKX: Organize IPIP Mesh documentation and navigation

2026-09-29T19:09:26Z

Organize IPIP Mesh documentation and navigation

← Older revision		Revision as of 19:09, 29 September 2026
Line 1:		Line 1:
			{{Section nav\|hub=IPIP Mesh\|title=IPIP Mesh\|category=IPIP Mesh}}

	Setting up a gateway in a ROS7 Mikrotik router running in a container on arm and arm64 models and x86-64 CHR		Setting up a gateway in a ROS7 Mikrotik router running in a container on arm and arm64 models and x86-64 CHR

KI5QKX: KI5QKX moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64 to IPIP Mesh/MikroTik RouterOS 7 Container: Group IPIP Mesh documentation under IPIP Mesh

2026-09-29T19:09:25Z

KI5QKX moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64 to IPIP Mesh/MikroTik RouterOS 7 Container: Group IPIP Mesh documentation under IPIP Mesh

← Older revision	Revision as of 19:09, 29 September 2026
(No difference)

KI5QKX: mw push

2026-09-28T22:28:18Z

mw push

← Older revision		Revision as of 22:28, 28 September 2026
Line 352:		Line 352:
	[[Category:Infrastructure]]		[[Category:Infrastructure]]
	[[Category:Gateways]]		[[Category:Gateways]]
			[[Category:Device and platform guides]]

KI5QKX: mw push

2026-04-30T18:53:01Z

mw push

← Older revision		Revision as of 18:53, 30 April 2026
Line 4:		Line 4:

	Source code is available in git.ampr.org: https://git.ampr.org/yo2loj/ampr-ros7-container/-/tree/main		Source code is available in git.ampr.org: https://git.ampr.org/yo2loj/ampr-ros7-container/-/tree/main


	<h1>Info</h1>		<h1>Info</h1>
Line 349:		Line 348:
	Rip Rip Hurray! de YO2LOJ		Rip Rip Hurray! de YO2LOJ

			[[Category:How-To]]
	[[Category:How-To Guides]]		[[Category:How-To Guides]]
	[[Category:Infrastructure]]		[[Category:Infrastructure]]
	[[Category:Gateways]]		[[Category:Gateways]]

KI5QKX: mw push

2026-03-01T00:15:01Z

mw push

← Older revision		Revision as of 00:15, 1 March 2026
Line 351:		Line 351:

	[[Category:How-To Guides]]		[[Category:How-To Guides]]
			[[Category:Infrastructure]]
			[[Category:Gateways]]

KI5QKX: mw push

2026-02-28T23:20:47Z

mw push

← Older revision		Revision as of 23:20, 28 February 2026
Line 14:		Line 14:
	Routers: CCR2004, CCR2116, CCR2216, RB5009		Routers: CCR2004, CCR2116, CCR2216, RB5009
	Switches: CRS520		Switches: CRS520
	Wireless & 5G: Netmetal ax, LHG-LTE6, ATL-LTE18		Wireless and 5G: Netmetal ax, LHG-LTE6, ATL-LTE18
	SOHO: hAP-ax2, cAP-ax, hAP-ax3, Chateau-ax		SOHO: hAP-ax2, cAP-ax, hAP-ax3, Chateau-ax
	Others: AMPERE		Others: AMPERE
Line 21:		Line 21:
	Routers: L009, RB3011, RB4011, RB1100AHx4,		Routers: L009, RB3011, RB4011, RB1100AHx4,
	Switches: CRS305, CRS309, CRS310, CRS317, CRS320, CRS326, CRS328		Switches: CRS305, CRS309, CRS310, CRS317, CRS320, CRS326, CRS328
	Wireless & 5G: SXTsq-5ac, NetBox-5ax, LHGXL-5ac		Wireless and 5G: SXTsq-5ac, NetBox-5ax, LHGXL-5ac
	SOHO: hAP-ax lite, hap-ac2, cAP-ac, wAP-ac, cAPXL-ac, hAP-ac3, Chateau		SOHO: hAP-ax lite, hap-ac2, cAP-ac, wAP-ac, cAPXL-ac, hAP-ac3, Chateau
	Routerboard: L11UG, L23UGSR, RB450Gx4		Routerboard: L11UG, L23UGSR, RB450Gx4
Line 122:		Line 122:
	You need to adapt the pre-existing container environment variables to your particular gateway before starting it again.		You need to adapt the pre-existing container environment variables to your particular gateway before starting it again.
	The following ENV parameters are preset in Container-> Envs:		The following ENV parameters are preset in Container-> Envs:
	<span style="color: blue;">AMPR_SUBNETS</span> - holds your local subnets as defined in the ~~portal~~, as comma separated list of <SUBNET>/<MASK> tupples, e.g. "44.128.0.0/24,44.128.1.0/24"		<span style="color: blue;">AMPR_SUBNETS</span> - holds your local subnets as defined in the Portal, as comma separated list of <SUBNET>/<MASK> tupples, e.g. "44.128.0.0/24,44.128.1.0/24"
	<span style="color: blue;">ALL_VIA_AMPRGW</span> - enables forwarding of all AMPR destinations via AMPRGW, values are "0" or "1"		<span style="color: blue;">ALL_VIA_AMPRGW</span> - enables forwarding of all AMPR destinations via AMPRGW, values are "0" or "1"
	<span style="color: blue;">FORWARD_INTERNET</span> - enables forward of traffic from/to internet hosts, values are "0" or "1"		<span style="color: blue;">FORWARD_INTERNET</span> - enables forward of traffic from/to internet hosts, values are "0" or "1"
Line 147:		Line 147:
	/ip firewall nat add action=src-nat chain=srcnat out-interface=vrf-ampr to-addresses=<span style="color: red;">44.128.0.1</span>		/ip firewall nat add action=src-nat chain=srcnat out-interface=vrf-ampr to-addresses=<span style="color: red;">44.128.0.1</span>

	Of course you need to set up additional firewall rules & stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.		Of course you need to set up additional firewall rules and stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.

	<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>" for forwarded and "<span style="color: red;">vrf-ampr</span>" for local outgoing data.</span>		<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>" for forwarded and "<span style="color: red;">vrf-ampr</span>" for local outgoing data.</span>
Line 223:		Line 223:
	All the above steps are available here as a rsc file: http://yo2loj.ro/containers/2_rip.rsc		All the above steps are available here as a rsc file: http://yo2loj.ro/containers/2_rip.rsc

	== Step 3: Firewall rules, ~~Filter~~, NAT and ~~Mangle~~ ==		== Step 3: Firewall rules, filter, NAT and mangle ==

	Now we need to forward out IPIP tunnels to the container, and extract our data from the VRF.		Now we need to forward out IPIP tunnels to the container, and extract our data from the VRF.
Line 279:		Line 279:

	/container envs		/container envs
	add comment="My subnets, as defined in the ~~portal~~" key=AMPR_SUBNETS name=ampr-cfg value=\		add comment="My subnets, as defined in the Portal" key=AMPR_SUBNETS name=ampr-cfg value=\
	44.128.0.0/24,44.128.1.0/24		44.128.0.0/24,44.128.1.0/24
	add comment="Default gateway is AMPRGW instead of Internet" key=ALL_VIA_AMPRGW name=ampr-cfg value=0		add comment="Default gateway is AMPRGW instead of Internet" key=ALL_VIA_AMPRGW name=ampr-cfg value=0
Line 344:		Line 344:
	src-address-list=!ampr_addr to-addresses=<your router's AMPR ip>		src-address-list=!ampr_addr to-addresses=<your router's AMPR ip>

	== Additional ~~Info~~ ==		== Additional info ==
	All available files are here: http://yo2loj.ro/containers/		All available files are here: http://yo2loj.ro/containers/

KI5QKX at 20:15, 12 December 2024

2024-12-12T20:15:04Z

← Older revision		Revision as of 20:15, 12 December 2024
Line 348:		Line 348:

	Rip Rip Hurray! de YO2LOJ		Rip Rip Hurray! de YO2LOJ


			[[Category:How-To Guides]]

Yo2loj: Yo2loj moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32, arm64 and x86-64 to Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64: Comma in the URL breaks some clients

2024-08-13T13:13:49Z

Yo2loj moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32, arm64 and x86-64 to Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64: Comma in the URL breaks some clients

← Older revision	Revision as of 13:13, 13 August 2024
(No difference)

Yo2loj: /* Container configuration parameters */

2024-08-13T06:17:29Z

Container configuration parameters

← Older revision		Revision as of 06:17, 13 August 2024
Line 149:		Line 149:
	Of course you need to set up additional firewall rules & stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.		Of course you need to set up additional firewall rules & stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.

	<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>".</span>		<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>" for forwarded and "<span style="color: red;">vrf-ampr</span>" for local outgoing data.</span>

	== Additional optional configuration ==		== Additional optional configuration ==

Yo2loj: /* Container configuration parameters */

2024-08-12T12:27:02Z

Container configuration parameters

← Older revision		Revision as of 12:27, 12 August 2024
Line 143:		Line 143:
	/ip address add address=<span style="color: red;">44.128.0.1/24</span> interface=<span style="color: red;"><interface name></span>		/ip address add address=<span style="color: red;">44.128.0.1/24</span> interface=<span style="color: red;"><interface name></span>

	And your src-nat NAT ~~rule~~:		And your src-nat NAT rules:
	/ip firewall nat add action=src-nat chain=srcnat out-interface=bridge-ampr-gw to-addresses=<span style="color: red;">44.128.0.1</span>		/ip firewall nat add action=src-nat chain=srcnat out-interface=bridge-ampr-gw to-addresses=<span style="color: red;">44.128.0.1</span>
			/ip firewall nat add action=src-nat chain=srcnat out-interface=vrf-ampr to-addresses=<span style="color: red;">44.128.0.1</span>

	Of course you need to set up firewall rules & stuff, but if you do not enable internet ~~forward~~, you should be pretty safe.		Of course you need to set up additional firewall rules & stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.

	<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>".</span>		<span style="color: blue;">Please note that for your firewall rules the incoming interface from the tunnels is "<span style="color: red;">vrf_ampr</span>" and the outgoing interface is "<span style="color: red;">bridge-ampr-gw</span>".</span>