howto/mikrotik.md
... ...
@@ -1,5 +1,6 @@
1 1
# How to connect to dn42 using Mikrotik RouterOS
2 2
3
+NB: this is a somewhat outdated page, it uses a VPN stack that's a bit less elegant and not as well supported nowadays. I'm sure it'll still work, but if you're interested in using a modern supported method and current RouterOS version (as of mid-2026), there's [a subpage you can check out](/howto/mikrotik/modern-style). It's a work in progress, but it works perfectly well!
3 4
4 5
## Legend
5 6
howto/mikrotik/modern-style-WIP.md
... ...
@@ -1,174 +0,0 @@
1
-This page is a scratchpad for a fully modernised (2026) config running on the latest version of RouterOS (7.22.1). It will use wireguard, BGP with Multihop and Extended Nexthop, and link-local addressing for address space efficiency.
2
-
3
-
4
-Wireguard tunnel setup
5
-====
6
-
7
-Wireguard seems to be the most popular option for peering now, so we'll use that. The first step is to setup a Wireguard interface. You can use a single interface for all connections if you want, but I prefer to make one for each peer, as it can make problems easier to debug.
8
-
9
-For the sake of this example we'll pretend we're peering with Kioubit, one of the most-connected and easiest to connect-with systems on DN42.
10
-
11
-Create the interface
12
-----
13
-
14
-We have to do this first so we can gather the connection details, which will be used to setup the peering.
15
-
16
-The standard port for Wireguard listeners is 51820, but you can use anything you like. An MTU of 1420 is recommended to avoid fragmentation and firewall issues.
17
-
18
-```
19
-/interface wireguard
20
-add name=DN42-KIOUBIT listen-port=51820 mtu=1420
21
-```
22
-
23
-Without any extra parameters, it'll automatically generate a new private and public key for you. Grab the public key, you'll need that to setup your peering connection.
24
-```
25
-/interface/wireguard/print where name="DN42-KIOUBIT"
26
-
27
-[furinkan@helian] > /interface/wireguard/print where name="DN42-KIOUBIT"
28
- 0 R name="DN42-KIOUBIT" mtu=1420 listen-port=51820 public-key="mGRGoKPl6fRffzUovFp/8AoOtHjCrWeEMN9/9NsVp2Q="
29
-```
30
-
31
-Exchange connection parameters
32
-----
33
-
34
-If connecting to a system with a self-serve automatic peering interface, now is the time to use it.
35
-
36
-You will need:
37
-* Your AS number
38
-* Your public IP address that they can connect to
39
-* Your listening port for Wireguard, eg. 51820 as above
40
-* Your public key for your Wireguard interface
41
-* An IPv4 address for your local end of the tunnel, this is often an address in your DN42 address allocation, but can also be any private-range address like 192.168.x.x; however this may be optional if you use...
42
-* An IPv6 address for your local end of the tunnel. Unlike IPv4, it's possible to use a pure link-local address, like `fe80::1234`
43
-* To know if your BGP daemon supports the Multihop and Extended Next Hop capabilities
44
-
45
-You will receive:
46
-* Their AS number
47
-* Their public IP address and port to use for the wireguard connection
48
-* Their Wireguard public key
49
-* The IPv4 and/or IPv6 address for the remote end of the tunnel
50
-
51
-Add the Wireguard peer
52
-----
53
-
54
-```
55
-/interface wireguard peers
56
-add name=DN42-KIOUBIT interface=<THE_INTERFACE_YOU_CREATED_EARLIER> endpoint-address=<THEIR_PUBLIC_ADDRESS> endpoint-port=<THEIR_WIREGUARD_PORT> public-key="<THEIR_WIREGUARD_PUBLIC_KEY>" allowed-address=fd00::/8,fe80::/10,172.20.0.0/14
57
-```
58
-
59
-At this point the tunnel should come up on its own, assuming the other end is already configured. However, it's not useful yet without an IP address attached to it.
60
-
61
-Add an IP address to your end of the tunnel
62
-----
63
-
64
-Once the tunnel is established you will need an address at each end of the link for routing to work. In this Kioubit example we only need an IPv6 address, because we can route IPv4 traffic between IPv6 BGP peers.
65
-
66
-Kioubit is using fe80::ade0 on the remote end of the tunnel. We also chose a link-local address for our end of the tunnel, it's `fe80::` plus the last four digits of our AS number. You'll notice that the remote address does not need to be adjacent at all - this is the beauty of IPv6 link-local addressing.
67
-```
68
-/ipv6 address
69
-add address=fe80::2762/128 interface=DN42-KIOUBIT advertise=no
70
-```
71
-
72
-If you're using an IPv4 address, you can attach it to the loopback interface. This allows the address to be reused for multiple peering connections, without being "owned" by any of the wireguard interfaces.
73
-```
74
-/ip/address
75
-add address=172.31.254.254 interface=lo
76
-```
77
-
78
-Test connectivity
79
-----
80
-
81
-You should be able to ping the remote end of the tunnel now. If so, packets can make it there and back, correctly routed. Notice that we're appending the interface name to the IP address. This is necessary for IPv6 link-local addresses because the system doesn't know which interface to send the pings out of.
82
-```
83
-[furinkan@helian] > ping fe80::ade0%DN42-KIOUBIT
84
- SEQ HOST SIZE TTL TIME STATUS
85
- 0 fe80::ade0 56 64 133ms383us echo reply
86
- 1 fe80::ade0 56 64 136ms229us echo reply
87
- sent=2 received=2 packet-loss=0% min-rtt=133ms383us avg-rtt=134ms806us max-rtt=136ms229us
88
-```
89
-
90
-If you're using IPv4 inside the tunnel, it'll look something like this:
91
-```
92
-[furinkan@helian] > ping 172.20.53.105%DN42-KIOUBIT
93
- SEQ HOST SIZE TTL TIME STATUS
94
- 0 172.20.53.105 56 64 133ms544us
95
- 1 172.20.53.105 56 64 131ms672us
96
- 2 172.20.53.105 56 64 133ms521us
97
- sent=3 received=3 packet-loss=0% min-rtt=131ms672us avg-rtt=132ms912us max-rtt=133ms544us
98
-```
99
-
100
-Notice that we specified the egress interface again, you don't normally do this with IPv4 addresses. The router doesn't know how to get to the destination because it doesn't belong to a known subnet - it doesn't have a route!
101
-
102
-We'll add a static route to fix this:
103
-```
104
-/ip route
105
-add dst-address=172.20.53.105/32 gateway=DN42-KIOUBIT
106
-
107
-[furinkan@helian] > ping 172.20.53.105
108
- SEQ HOST SIZE TTL TIME STATUS
109
- 0 172.20.53.105 56 64 131ms152us
110
- 1 172.20.53.105 56 64 131ms128us
111
- sent=2 received=2 packet-loss=0% min-rtt=131ms128us avg-rtt=131ms140us max-rtt=131ms152us
112
-```
113
-
114
-That's better. Now we're ready for some BGP peering.
115
-
116
-
117
-Setup BGP
118
-====
119
-
120
-We'll create an instance for DN42, some basic route filters for security, a template to hold common DN42 peering settings, then finally the actual peering connection.
121
-
122
-Instance
123
-----
124
-
125
-An important part of the routing protocols is your router's ID, a 32-bit value usually written like an IPv4 address. It's common convention to use your router's IP address as the router ID, so we'll do that here too. I've picked the highest IP address in our IPv4 allocation as the router's IP, which we'll also use as the router's ID.
126
-
127
-This gives a text label to our router ID:
128
-```
129
-/routing id
130
-add id=172.22.124.62 name=my-DN42-router select-dynamic-id=""
131
-```
132
-
133
-Create the BGP instance, which will identify itself with your AS number:
134
-```
135
-/routing bgp instance
136
-add as=424242<YOUR_ASN> name=DN42 router-id=my-DN42-router
137
-```
138
-
139
-Route filters
140
-----
141
-
142
-Filters are necessary to prevent other people from hijacking our routing table. A malicious peer could send routes that override your default route to public internet services like Google, government services, your online banking, etc.
143
-
144
-These rules are reasonably tight, you can tighten or relax them as desired. [Interconnected networks'](/Interconnections) IPv4 ranges are included as well, if you don't want then you can ignore that rule.
145
-```
146
-/routing filter rule
147
-add chain=dn42-in comment="reject prefixes clashing with home network" disabled=no rule="if (dst in 192.168.0.0/16 && dst-len >= 16) { reject }"
148
-add chain=dn42-in comment="reject v4 auto-addressing prefixes" rule="if (dst in 169.254.0.0/16 && dst-len >= 16) { reject }"
149
-add chain=dn42-in comment="accept DN42 v4 prefixes" disabled=no rule="if (dst in 172.20.0.0/14) { accept }"
150
-add chain=dn42-in comment="accept DN42 interconnected network v4 prefixes" disabled=no rule="if (dst in 10.0.0.0/8) { accept }"
151
-add chain=dn42-in comment="accept DN42 and interconnected v6 prefixes" disabled=no rule="if (dst in fd00::/8) { accept }"
152
-```
153
-
154
-```
155
-/routing filter rule
156
-add chain=dn42-out comment="don't advertise our home network" rule="if (dst in 192.168.0.0/16 && dst-len >= 16) { reject }"
157
-add chain=dn42-out comment="don't advertise v4 auto-addressing prefixes" rule="if (dst in 169.254.0.0/16 && dst-len >= 16) { reject }"
158
-add chain=dn42-out comment="tag my prefixes with community" disabled=no rule="if ( dst in 172.20.0.0/14 && bgp-communities-empty ) { append bgp-communities DN42-communities; }"
159
-add chain=dn42-out comment="advertise DN42 v4 prefixes" disabled=no rule="if (dst in 172.20.0.0/14) { accept }"
160
-add chain=dn42-out comment="advertise DN42 interconnected network v4 prefixes" disabled=no rule="if (dst in 10.0.0.0/8) { accept }"
161
-add chain=dn42-out comment="tag my IPv6 prefixes with community" disabled=no rule="if ( dst in fd00::/8 && bgp-communities-empty ) { append bgp-communities DN42-communities; }"
162
-add chain=dn42-out comment="advertise DN42 and interconnected v6 prefixes" disabled=no rule="if (dst in fd00::/8) { accept }"
163
-```
164
-
165
-Connection template
166
-----
167
-
168
-WIP
169
-
170
-Create a template with the common BGP settings used for DN42:
171
-```
172
-/routing bgp template
173
-set DN42-thighhighs afi=ip,ipv6 as=424242<YOUR_ASN> input.filter=dn42-in multihop=yes name=DN42-thighhighs output.filter-chain=dn42-out .redistribute=connected,bgp routing-table=main
174
-```
howto/mikrotik/modern-style.md
... ...
@@ -0,0 +1,174 @@
1
+This page is a scratchpad for a fully modernised (2026) config running on the latest version of RouterOS (7.22.1). It will use wireguard, BGP with Multihop and Extended Nexthop, and link-local addressing for address space efficiency.
2
+
3
+
4
+Wireguard tunnel setup
5
+====
6
+
7
+Wireguard seems to be the most popular option for peering now, so we'll use that. The first step is to setup a Wireguard interface. You can use a single interface for all connections if you want, but I prefer to make one for each peer, as it can make problems easier to debug.
8
+
9
+For the sake of this example we'll pretend we're peering with Kioubit, one of the most-connected and easiest to connect-with systems on DN42.
10
+
11
+Create the interface
12
+----
13
+
14
+We have to do this first so we can gather the connection details, which will be used to setup the peering.
15
+
16
+The standard port for Wireguard listeners is 51820, but you can use anything you like. An MTU of 1420 is recommended to avoid fragmentation and firewall issues.
17
+
18
+```
19
+/interface wireguard
20
+add name=DN42-KIOUBIT listen-port=51820 mtu=1420
21
+```
22
+
23
+Without any extra parameters, it'll automatically generate a new private and public key for you. Grab the public key, you'll need that to setup your peering connection.
24
+```
25
+/interface/wireguard/print where name="DN42-KIOUBIT"
26
+
27
+[furinkan@helian] > /interface/wireguard/print where name="DN42-KIOUBIT"
28
+ 0 R name="DN42-KIOUBIT" mtu=1420 listen-port=51820 public-key="mGRGoKPl6fRffzUovFp/8AoOtHjCrWeEMN9/9NsVp2Q="
29
+```
30
+
31
+Exchange connection parameters
32
+----
33
+
34
+If connecting to a system with a self-serve automatic peering interface, now is the time to use it.
35
+
36
+You will need:
37
+* Your AS number
38
+* Your public IP address that they can connect to
39
+* Your listening port for Wireguard, eg. 51820 as above
40
+* Your public key for your Wireguard interface
41
+* An IPv4 address for your local end of the tunnel, this is often an address in your DN42 address allocation, but can also be any private-range address like 192.168.x.x; however this may be optional if you use...
42
+* An IPv6 address for your local end of the tunnel. Unlike IPv4, it's possible to use a pure link-local address, like `fe80::1234`
43
+* To know if your BGP daemon supports the Multihop and Extended Next Hop capabilities
44
+
45
+You will receive:
46
+* Their AS number
47
+* Their public IP address and port to use for the wireguard connection
48
+* Their Wireguard public key
49
+* The IPv4 and/or IPv6 address for the remote end of the tunnel
50
+
51
+Add the Wireguard peer
52
+----
53
+
54
+```
55
+/interface wireguard peers
56
+add name=DN42-KIOUBIT interface=<THE_INTERFACE_YOU_CREATED_EARLIER> endpoint-address=<THEIR_PUBLIC_ADDRESS> endpoint-port=<THEIR_WIREGUARD_PORT> public-key="<THEIR_WIREGUARD_PUBLIC_KEY>" allowed-address=fd00::/8,fe80::/10,172.20.0.0/14
57
+```
58
+
59
+At this point the tunnel should come up on its own, assuming the other end is already configured. However, it's not useful yet without an IP address attached to it.
60
+
61
+Add an IP address to your end of the tunnel
62
+----
63
+
64
+Once the tunnel is established you will need an address at each end of the link for routing to work. In this Kioubit example we only need an IPv6 address, because we can route IPv4 traffic between IPv6 BGP peers.
65
+
66
+Kioubit is using fe80::ade0 on the remote end of the tunnel. We also chose a link-local address for our end of the tunnel, it's `fe80::` plus the last four digits of our AS number. You'll notice that the remote address does not need to be adjacent at all - this is the beauty of IPv6 link-local addressing.
67
+```
68
+/ipv6 address
69
+add address=fe80::2762/128 interface=DN42-KIOUBIT advertise=no
70
+```
71
+
72
+If you're using an IPv4 address, you can attach it to the loopback interface. This allows the address to be reused for multiple peering connections, without being "owned" by any of the wireguard interfaces.
73
+```
74
+/ip/address
75
+add address=172.31.254.254 interface=lo
76
+```
77
+
78
+Test connectivity
79
+----
80
+
81
+You should be able to ping the remote end of the tunnel now. If so, packets can make it there and back, correctly routed. Notice that we're appending the interface name to the IP address. This is necessary for IPv6 link-local addresses because the system doesn't know which interface to send the pings out of.
82
+```
83
+[furinkan@helian] > ping fe80::ade0%DN42-KIOUBIT
84
+ SEQ HOST SIZE TTL TIME STATUS
85
+ 0 fe80::ade0 56 64 133ms383us echo reply
86
+ 1 fe80::ade0 56 64 136ms229us echo reply
87
+ sent=2 received=2 packet-loss=0% min-rtt=133ms383us avg-rtt=134ms806us max-rtt=136ms229us
88
+```
89
+
90
+If you're using IPv4 inside the tunnel, it'll look something like this:
91
+```
92
+[furinkan@helian] > ping 172.20.53.105%DN42-KIOUBIT
93
+ SEQ HOST SIZE TTL TIME STATUS
94
+ 0 172.20.53.105 56 64 133ms544us
95
+ 1 172.20.53.105 56 64 131ms672us
96
+ 2 172.20.53.105 56 64 133ms521us
97
+ sent=3 received=3 packet-loss=0% min-rtt=131ms672us avg-rtt=132ms912us max-rtt=133ms544us
98
+```
99
+
100
+Notice that we specified the egress interface again, you don't normally do this with IPv4 addresses. The router doesn't know how to get to the destination because it doesn't belong to a known subnet - it doesn't have a route!
101
+
102
+We'll add a static route to fix this:
103
+```
104
+/ip route
105
+add dst-address=172.20.53.105/32 gateway=DN42-KIOUBIT
106
+
107
+[furinkan@helian] > ping 172.20.53.105
108
+ SEQ HOST SIZE TTL TIME STATUS
109
+ 0 172.20.53.105 56 64 131ms152us
110
+ 1 172.20.53.105 56 64 131ms128us
111
+ sent=2 received=2 packet-loss=0% min-rtt=131ms128us avg-rtt=131ms140us max-rtt=131ms152us
112
+```
113
+
114
+That's better. Now we're ready for some BGP peering.
115
+
116
+
117
+Setup BGP
118
+====
119
+
120
+We'll create an instance for DN42, some basic route filters for security, a template to hold common DN42 peering settings, then finally the actual peering connection.
121
+
122
+Instance
123
+----
124
+
125
+An important part of the routing protocols is your router's ID, a 32-bit value usually written like an IPv4 address. It's common convention to use your router's IP address as the router ID, so we'll do that here too. I've picked the highest IP address in our IPv4 allocation as the router's IP, which we'll also use as the router's ID.
126
+
127
+This gives a text label to our router ID:
128
+```
129
+/routing id
130
+add id=172.22.124.62 name=my-DN42-router select-dynamic-id=""
131
+```
132
+
133
+Create the BGP instance, which will identify itself with your AS number:
134
+```
135
+/routing bgp instance
136
+add as=424242<YOUR_ASN> name=DN42 router-id=my-DN42-router
137
+```
138
+
139
+Route filters
140
+----
141
+
142
+Filters are necessary to prevent other people from hijacking our routing table. A malicious peer could send routes that override your default route to public internet services like Google, government services, your online banking, etc.
143
+
144
+These rules are reasonably tight, you can tighten or relax them as desired. [Interconnected networks'](/Interconnections) IPv4 ranges are included as well, if you don't want then you can ignore that rule.
145
+```
146
+/routing filter rule
147
+add chain=dn42-in comment="reject prefixes clashing with home network" disabled=no rule="if (dst in 192.168.0.0/16 && dst-len >= 16) { reject }"
148
+add chain=dn42-in comment="reject v4 auto-addressing prefixes" rule="if (dst in 169.254.0.0/16 && dst-len >= 16) { reject }"
149
+add chain=dn42-in comment="accept DN42 v4 prefixes" disabled=no rule="if (dst in 172.20.0.0/14) { accept }"
150
+add chain=dn42-in comment="accept DN42 interconnected network v4 prefixes" disabled=no rule="if (dst in 10.0.0.0/8) { accept }"
151
+add chain=dn42-in comment="accept DN42 and interconnected v6 prefixes" disabled=no rule="if (dst in fd00::/8) { accept }"
152
+```
153
+
154
+```
155
+/routing filter rule
156
+add chain=dn42-out comment="don't advertise our home network" rule="if (dst in 192.168.0.0/16 && dst-len >= 16) { reject }"
157
+add chain=dn42-out comment="don't advertise v4 auto-addressing prefixes" rule="if (dst in 169.254.0.0/16 && dst-len >= 16) { reject }"
158
+add chain=dn42-out comment="tag my prefixes with community" disabled=no rule="if ( dst in 172.20.0.0/14 && bgp-communities-empty ) { append bgp-communities DN42-communities; }"
159
+add chain=dn42-out comment="advertise DN42 v4 prefixes" disabled=no rule="if (dst in 172.20.0.0/14) { accept }"
160
+add chain=dn42-out comment="advertise DN42 interconnected network v4 prefixes" disabled=no rule="if (dst in 10.0.0.0/8) { accept }"
161
+add chain=dn42-out comment="tag my IPv6 prefixes with community" disabled=no rule="if ( dst in fd00::/8 && bgp-communities-empty ) { append bgp-communities DN42-communities; }"
162
+add chain=dn42-out comment="advertise DN42 and interconnected v6 prefixes" disabled=no rule="if (dst in fd00::/8) { accept }"
163
+```
164
+
165
+Connection template
166
+----
167
+
168
+WIP
169
+
170
+Create a template with the common BGP settings used for DN42:
171
+```
172
+/routing bgp template
173
+set DN42-thighhighs afi=ip,ipv6 as=424242<YOUR_ASN> input.filter=dn42-in multihop=yes name=DN42-thighhighs output.filter-chain=dn42-out .redistribute=connected,bgp routing-table=main
174
+```