Mikrotik Chateau

Entry ID: LMEG-20250511-FIN Stardate: Sunday, May 11, 2025 Prepared By: Lord Magos Explorator Ghidra

I. Objective Recap (Original Mandate)

Achieve direct, authenticated, programmatic control over the RVLink roof-mounted internet unit (Roof Unit (MV2402)) via its internal API. Understand and bypass the indoor unit’s (Indoor Unit (RV2458)) orchestration role to enable independent roof unit WAN management. Integrate this control with a downstream MikroTik Chateau Router for advanced WAN failover and policy routing.

II. Phase 1: RVLink System Analysis & Roof Unit Control (Summary)

  • Key Units:
    • MV2402 (Roof Unit, IP 192.168.10.254): Target for independent WAN control.
    • RV2458 (Indoor Unit, IP 192.168.10.1): Identified orchestrator, likely using wtpd suite.
  • Milestones Achieved:
    • Root shell access obtained on MV2402 (Roof Unit).
    • Full MTD backup of MV2402 secured.
    • RV2458 (Indoor Unit) Wi-Fi functionality disabled via hidden UI (http://192.168.10.1/formRedirect.htm?redirect-url=wlbasic.htm&wlan_id=0), minimizing its functions primarily to “control” over the MV2402.

III. Phase 2: Network Tap - Principles and Initial Testing

A. Purpose of a True Network Tap

  • A Network Tap is a hardware device or software configuration allowing for passive, non-intrusive monitoring of data traffic flowing between two points in a network.
  • Function: It duplicates network packets (all or a filtered subset) from a monitored link to a separate port connected to an analysis device (e.g., a PC running Wireshark).
  • Methodology (Port Mirroring): On managed switches (like MikroTik routers), this is achieved via “Port Mirroring” (or SPAN - Switched Port Analyzer). Traffic from source ports is copied to a destination/mirror port.
  • Relevance to RVLink: Considered for observing proprietary communication between MV2402 and RV2458 to understand orchestration if direct bypass methods proved insufficient.

B. Linksys E1200 (“Servo Skull”) Experiment

  • Objective: Primarily to verify electrical safety and operational impact of inserting an intermediary Layer 2 device between Roof and Indoor units. Also served as a temporary on-site switch/AP.
  • Configuration (DD-WRT):
    • Flashed with DD-WRT.
    • Configured as a simple Layer 2 switch and Wireless Access Point:
      • WAN port unused/disabled.
      • All physical LAN Ethernet ports assigned to the LAN bridge (br0).
      • Wireless interface(s) bridged to br0.
      • DHCP server disabled.
    • This setup allowed MV2402, RV2458, and your on-site PC to communicate through it.
  • Outcome: Confirmed safe pass-through and provided essential on-site Layer 2 connectivity. It was not ultimately configured as a true port-mirroring tap.

IV. Phase 3: MikroTik Chateau (Camper Router - Site 2) Configuration

Referred to as Chateau.

A. Primary Camper LAN (bridge)

  • Subnet: 192.168.69.0/24
  • Chateau IP: 192.168.69.1 (Gateway for Camper LAN clients)
  • DHCP Server: Configured for this LAN.
  • Purpose: Host MV2400 (Roof Unit) and RV2458 (Indoor Unit) on their native 192.168.10.0/24 subnet.
  • Member Ports: ether4 (for RV2458 @ 192.168.10.1), ether5 (for MV2400 @ 192.168.10.254).
  • Chateau IP: 192.168.10.250 (for Chateau’s communication on this segment).

C. Wireless Configuration (Chateau)

  • SSID: Single SSID (OmnissiahsReach) for both 2.4GHz & 5GHz bands.
  • Mode: ap bridge for wlan1 (2.4GHz) and wlan2 (5GHz).
  • Security: WPA2 PSK / WPA3 PSK.
  • Bridge Membership: wlan1 and wlan2 added as ports to the Primary Camper LAN bridge.

D. WAN Configuration (Chateau)

  • Primary WAN: Interface connected to Campground’s Wi-Fi network, requiring authentication via captive portal at 192.168.17.1:3456.
  • MV2400 (Roof Unit) as Managed WAN Source: The MV2400 (on br_rvlink), with its LTE WAN, is intended for integration as a primary/secondary WAN source for failover/policy routing by the Chateau.
  • NAT: srcnat masquerade rule on Chateau’s primary WAN interface (to Campground) for internet access for internal networks.

E. Firewall Filter Rules (Chateau - Conceptual Summary)

  • INPUT: Accept established/related. Define internal_lans address list carefully for management access. Drop invalid. Implement a default drop for input not from internal_lans.
  • FORWARD: Fasttrack, established/related.
    • Allow Primary Camper LAN (192.168.69.0/24) -> br_rvlink (192.168.10.0/24) & WAN.
    • Allow br_rvlink (192.168.10.0/24) -> Primary Camper LAN.
    • Handle WireGuard traffic (detailed below).
    • Final default drop.
  • Key Correction Made: A FORWARD rule for RVLink LAN -> Home LAN via WireGuard had in-interface=bridge (Camper LAN bridge); corrected to in-interface=br_rvlink.

V. Phase 4: MikroTik hEX (Home Router) & WireGuard Site-to-Site Tunnel

Referred to as hEX or GIEDI.

A. Home LAN (e.g., bridge1)

  • Subnet: 192.168.88.0/24
  • hEX IP: 192.168.88.1 (Gateway for Home LAN clients)

B. WireGuard Tunnel Configuration

  • Conceptual Tunnel Network: 10.10.10.0/24
  • hEX WireGuard Interface (wg-home):
    • IP Address: 10.10.10.1/32
    • Listen Port: 13231 (UDP)
  • Chateau WireGuard Interface (wg-site-2):
    • IP Address: 10.10.10.2/32
  • Peer Configuration on hEX (for Chateau):
    • Chateau’s Public Key.
    • Allowed IPs: 10.10.10.2/32 (Chateau WG IP), 192.168.69.0/24 (Camper LAN), 192.168.10.0/24 (RVLink LAN).
    • Endpoint: Dynamically learned.
  • Peer Configuration on Chateau (for hEX):
    • hEX’s Public Key.
    • Allowed IPs: 10.10.10.1/32 (hEX WG IP), 192.168.88.0/24 (Home LAN).
    • Endpoint Address: Public IP/DDNS of Home hEX.
    • Endpoint Port: 13231.
    • Persistent Keepalive: 25s (on Chateau).

C. Routing (hEX & Chateau)

  • Active routes confirmed on both routers for remote LANs and RVLink network via their respective WireGuard interfaces, automatically derived from Allowed IPs.

D. Firewall Filter Rules (hEX - Summary)

  • INPUT: Accept established/related. Allow WireGuard UDP port 13231 on WAN (ether1). Allow management from Home LAN. Drop invalid/other WAN.
  • FORWARD: Fasttrack, established/related. Drop invalid.
    • Allow Home LAN (192.168.88.0/24) -> Internet (via ether1).
    • Allow Home LAN (192.168.88.0/24) -> Camper LAN (192.168.69.0/24) via wg-home.
    • Allow Home LAN (192.168.88.0/24) -> RVLink LAN (192.168.10.0/24) via wg-home.
    • Allow Camper LAN (192.168.69.0/24 via wg-home) -> Home LAN.
    • Allow RVLink LAN (192.168.10.0/24 via wg-home) -> Home LAN.
    • Final default drop.

E. Firewall Filter Rules (Chateau - WireGuard Specific FORWARD Summary)

  • Allow Home LAN (from wg-site2) -> Camper LAN (to bridge-camper-lan).
  • Allow Home LAN (from wg-site2) -> RVLink LAN (to br_rvlink).
  • Allow Camper LAN (from bridge-camper-lan) -> Home LAN (to wg-site2).
  • Allow RVLink LAN (from br_rvlink) -> Home LAN (to wg-site2).

F. Key Troubleshooting Note (Home Server 192.168.88.5 - “NALTHIS”)

  • Initial inability for this server to reach remote WireGuard subnets (e.g., 192.168.10.1) was traced to a conflicting local Docker bridge network on the server (192.168.0.0/20, which included 192.168.10.x). This Docker route was more specific than the server’s default gateway and pointed to a linkdown interface (br-f2c77699d882 with IP 192.168.0.1), causing routing failures for these destinations on the server itself.
  • Resolution: The unused Docker container (Tmodloader) and its associated network were deleted from the server. This allowed the server to correctly use its default gateway (192.168.88.1 - the hEX) for traffic to the remote networks via WireGuard.

VI. RouterOS Version Anomaly (hEX - GIEDI)

  • hEX identified as running RouterOS 7.1B.2 (an early beta version).
  • The standard diagnostic command /ip route get <ip_address> was found to be non-functional (syntax errors) on this beta version.
  • Recommendation: Upgrade hEX RouterOS to a current stable v7 release for full command functionality, access to bug fixes, and overall system stability.

VII. Current Operational Status (as of Stardate)

  • Bidirectional Layer 3 connectivity successfully established and verified between:
    • Home LAN (192.168.88.0/24) <-> Camper LAN (192.168.69.0/24) via WireGuard.
    • Home LAN (192.168.88.0/24) <-> RVLink LAN (192.168.10.0/24) via WireGuard (including from the previously problematic server 192.168.88.5).
  • Local inter-segment routing on Chateau (Camper LAN <-> RVLink LAN) is configured.

Failure is unique among sin, in that we can turn it into a virtue when it drives us to succeed.

The living diminish, but the machine endures...

Wesley Ray · blog · git · resume