3

I've created network segments with my MikroTik RB1100 including 3 client LANs, a phone LAN, a trusted network (servers, printers, etc) and a DMZ. These are not VLAN's per-se as there is no tagging done, these are separate LANs on different physical ports on the RB1100.

Previously everything was on the same network (the trusted network) with the exception of the phones which were previously a POTS. To increase security I decided to segment the network, however I'm getting all sorts of weird issues now.

Some of the aforementioned issues are

  • Some users (not all) have issues accessing files on network drives
  • Users experiencing issues printing to communal printers
  • Sometimes users need to try to access network files multiple times before the file will open.

Has anyone seen this happen? There is no firewall (yet) between any client LANs and trusted LANs with the exception of Windows Firewall, though the profile for that shouldn't have changed.

Additional note

  • Client LANs are 10.0.10.0/24 - 10.0.12.0/24 (Configured eth 4-6)
  • Trusted 10.0.0.0/24 (configured eth1 with eth2 and 3 as slaves)
  • Phones - 10.1.0.0/24 (configured eth7 with 8,9,10 as slaves)

The routing table shows all as accessible, and users can access most of the files, but some are proving troublesome. Files on the Server 2008 box are easier to access than those on a server 2003. I don't think it's a networking issue but rather a firewalling issue.

  • Few questions to get started: What are the IPs/Netmasks/gateways of the various networks? What is the route table on the Mikrotik, and what interfaces are configured on it? – Ryan Apr 3 '13 at 20:53
  • Firewalls don't tend to cause chronic issues, but lets not rule anything out. Take a problematic printer, and do a continuous ping to it from an affected station. Do you see packet loss? Also what do the packet counts look like on your switch ports, is it possible that we have a switching/routing loop somewhere? – Ryan Apr 3 '13 at 21:13
  • Thanks @Ryan I will do this tomorrow, however I feel as though it's specific protocols that experience errors. Printing a PDF from multiple computers results in an error but on other computers on the same segment it can print. There is one file on a share that nobody can access (.mdb file) and says "Network Error" but if we put the computer on the same LAN as the server hosting it the file opens without an issue. – DKNUCKLES Apr 3 '13 at 22:50
2

For anyone who may stumble upon this later, the issue was resolved by explicitly stating the Out interface on the srcnat Masquerade rule. See below.

srcnat

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.