8/11/2019 PAcket Flow

1/15

Manual:Packet Flow

Overview

MikroTik RouterOS is designed to be easy to operate in various aspects of network

configuration. Therefore creating limitation for individual IP or natting internal clients

to a public address or Hotspot configuration can be done without the knowledge about

how the packets are processed in the router - you just go to corresponding menu and

create necessary configuration.

However more complicated tasks, such as traffic prioritization, routing policies, where it

is necessary to utilize more than one RouterOS facility, requires knowledge: How these

facilities work together? What happens when and why?

To address these questions we created a packet flow diagram.

Diagram

As it was impossible to get everything in one diagram, Packet flow diagramfor

Mikrotik RouterOS v3.x was created in 2 parts:

Bridging or Layer-2 (MAC)where Routing part is simplified to one "Layer-3"

box

R i L 3 (IP) h B id i i i lifi d "B id i "

8/11/2019 PAcket Flow

2/15

R ti L 3 (IP) h B id i t i i lifi d t "B id i "

2

The packet flow diagram is also availableas a PDF.

http://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdfhttp://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdfhttp://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdfhttp://wiki.mikrotik.com/wiki/File:Bridge_final.pnghttp://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdf

8/11/2019 PAcket Flow

3/15

3

http://wiki.mikrotik.com/wiki/File:IP_final.pnghttp://wiki.mikrotik.com/wiki/File:IP_final.png

8/11/2019 PAcket Flow

4/15

4

Changes in RouterOS v6

The following changes have been made to the Packet Flow in RouterOS v6, see red cirdled elements in the image:

8/11/2019 PAcket Flow

5/15

5

http://wiki.mikrotik.com/wiki/File:Packetflowv6.pnghttp://wiki.mikrotik.com/wiki/File:Packetflowv6.png

8/11/2019 PAcket Flow

6/15

6

MPLS Packet Flow

http://wiki.mikrotik.com/wiki/File:Mpls-packet-flow-output.pnghttp://wiki.mikrotik.com/wiki/File:Mpls-packet-flow-input.pnghttp://wiki.mikrotik.com/wiki/File:Mpls-packet-flow-output.pnghttp://wiki.mikrotik.com/wiki/File:Mpls-packet-flow-input.png

8/11/2019 PAcket Flow

7/15

Analysis

Basic Concepts

- starting point in packets way through the router facilities. It does not

matter what interface (physical or virtual) packet is received it will start its way from

here.

- last point in packets way through the router facilities. Just before the

packet is actually sent out.

- last point in packets way torouter itself, after this packet is discarded

- starting point for packets generated by router itself

Configurable Facilities

E h d f iliti i thi ti d ith ti l i

http://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_out.jpghttp://wiki.mikrotik.com/wiki/File:Local_process-_in.jpghttp://wiki.mikrotik.com/wiki/File:Output_interface.jpghttp://wiki.mikrotik.com/wiki/File:Input_interface.jpg

8/11/2019 PAcket Flow

8/15

- /ip accounting

- /interface bridge settings- available only for traffic that go through

the bridge. For all other traffic default value is Yes

- /interface bridge filter

- /interface bridge nat

Automated processes and decisions

- check if the actual input interfaceis a port for bridge OR checks if

input interfaceis bridge

- allow to capture traffic witch otherwise would be discarded by

ti t ki thi H t t f t bl t id ti it

http://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_in.jpghttp://wiki.mikrotik.com/wiki/File:In-interface-bridge.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_src_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_dst_nat.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_output.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_forward.jpghttp://wiki.mikrotik.com/wiki/File:Bridge_input.jpghttp://wiki.mikrotik.com/wiki/File:Use_ip_firewall.jpghttp://wiki.mikrotik.com/wiki/File:Accounting.jpg

8/11/2019 PAcket Flow

9/15

- indicates exact place where Time To Live (TTL) of the routed packet

is reduced by 1. If it become 0 packet will be discarded

- self explainatory

- check if the actual output interfaceis a port for bridge OR checks ifoutput interfaceis bridge

- undo all that was done by hotspot-in for the packets that is going back

to client.

http://wiki.mikrotik.com/wiki/File:Hotspot_out.jpghttp://wiki.mikrotik.com/wiki/File:Out_interface_bridge.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Encryption.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Decryption.jpghttp://wiki.mikrotik.com/wiki/File:TTL=TTL-1.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_out.jpghttp://wiki.mikrotik.com/wiki/File:Out_interface_bridge.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Encryption.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Decryption.jpghttp://wiki.mikrotik.com/wiki/File:TTL=TTL-1.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_out.jpghttp://wiki.mikrotik.com/wiki/File:Out_interface_bridge.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Encryption.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Decryption.jpghttp://wiki.mikrotik.com/wiki/File:TTL=TTL-1.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_out.jpghttp://wiki.mikrotik.com/wiki/File:Out_interface_bridge.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Encryption.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Decryption.jpghttp://wiki.mikrotik.com/wiki/File:TTL=TTL-1.jpghttp://wiki.mikrotik.com/wiki/File:Hotspot_out.jpghttp://wiki.mikrotik.com/wiki/File:Out_interface_bridge.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Encryption.jpghttp://wiki.mikrotik.com/wiki/File:IPSec_Decryption.jpghttp://wiki.mikrotik.com/wiki/File:TTL=TTL-1.jpg

8/11/2019 PAcket Flow

10/15

10

Examples

Bridging with use-ip-firewall=yes

Routing - from Ethernet to Ethernet interface

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_1.png

8/11/2019 PAcket Flow

11/15

11

Routing from one Bridge interface to different Bridge interface

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_2c.png

8/11/2019 PAcket Flow

12/15

12

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_3_1.png

8/11/2019 PAcket Flow

13/15

13

IPsec encryption

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_3_2c.png

8/11/2019 PAcket Flow

14/15

14

IPsec decryption

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_4c.png

8/11/2019 PAcket Flow

15/15

15

http://wiki.mikrotik.com/wiki/File:Packet_Flow_Example_5c.png