Skip to main content

Use of Public IP

Why Public IPs are sometimes needed:

Assigning a Public IP allows the member’s device to be accessible from the public Internet (from anywhere in the world). This is done for a few reasons:

  1. A member has a resource in their LAN / Apartment they want to access via the public internet. Often a NAS, Media server, Security Camera NVR etc.
  2. A member has a webserver, video game server or service they want to publicly share on the internet.
  3. A building (management) requires remote access to a heating system, solar panel controller or other equipment.

For option 1: We should ask the member if they are able to connect via TailScale, ZeroTier or other similar service (or via a VPN)
This gives better security as only the member has access (and can give access to whomever they want to).
Alternatively, if the member is a volunteer or other known / trusted person, offer them a Wireguard VPN into the mesh. They can access their resource via the Mesh IP address, however it will be only accessible to people on the mesh or via a Mesh VPN connection.

For option 2 / option 3: If the member has a web server (option 2) or needs unrestricted public remote access (option 3) and want to give access to it to anyone in the world (with the risk associated with it) they will need a public IP to be set up. Continue below for setup instructions.

How it Public IP assignment works:

NYC Mesh will allocate a Public IP to the member and hand over that IP to the members device (router) via DHCP. 

This opens up the risk for the member to be hacked as well as all sorts of issues emanating from non-scrupulous sources on the net. Some ill-intentioned people on the www are scanning the web to find open ports and known security vulnerabilties, etc...

Pick a free public IP from the IPRanges spreadsheet (as a volunteer for help if you need access to this).
Check the OSPF route of the node you are looking to assign it to ensure you're assigning an IP that "lives" at the correct supernode.
Make sure it is free (unused). Check a routing table in one of the routers to double check it is not in use.

The Public IP will be associated with the member’s device (handed over to the device) via the DHCP server of the closest NYC Mesh router (typically the Omni they are connected to). 
All the ports will be “opened” on the Mesh side. It is up to the member to manage their router's port forwarding and the necessary firewall rules to protect its LAN.

Setup Instructions:

Here we are going to add an example Public IP of 199.167.59.85/32

You need first to know the MAC address of the member’s router/device where to allocate the Public IP. The easiest way is to have that router/device get an IP via DHCP and make that IP static in the omni IP > DHCP Server > Leases.
(Please add a comment to the static lease for other volunteers)

1. In IP>Routes

Add a blackhole route, Distance 2

Blackhole routing, also known as null routing, is a network route that sends matching packets to a "black hole" instead of forwarding them. This acts as a limited firewall, dropping or ignoring the packets

In RouterOS 7

AD_4nXf1wNvVCJaxuKAP303-vc-FAWceOl0yWLDK7yc7GSroberc7fmPras3FLd6mVNBYzIcJPD1d9Q39W8Iikzak1Xy-Y3KmUD0h0_YI_cOC5zlWixTEeEp8bWkEUO2r0N1RvLdth1aKRPA_XmRtwhjQ7bMCRQ?key=YRUpkczqsF-wm37Jp8N2Cg

In RouterOS 6 (illustation for a different Public IP)
AD_4nXehvtY0qsxjaDb1spJBMzo_JNdzXmezC5r0TriuzxYP2XKhttuMANHMOABJ35zjeht2UuiXnR7VcrnkVM9DlI_UfBpET5-7B0iDrLt_zSVR8o4M6DrUBVXzCnffrZWD5rGGTBDfIuya_g87TUcQVK9dob2D?key=YRUpkczqsF-wm37Jp8N2Cg

2. In IP>Routes

Add the route (gateway) where to route the packet for that IP address. Distance 1 (default).
This should be the bridge that the destination router for this port forward is on. In most cases this should be the "mesh" bridge.
Note that the Gateway (destination port syntax is different in ROS6 and ROS7)

RouterOS 7
AD_4nXeom5wxendKgD_7G9CyFql0RQZpGWtE51rx8AxyIuPaHuoqfOc_9t0sTtY7WPWq1SQ-PnxwrUFQah0LkHfPJSSDRxnD7pTBH3DyC9Nbs4LxDApN-Dfhk5fliMKs4M2LOyXlSWuzwmfUp0TvQ5X_5wGLIRxE?key=YRUpkczqsF-wm37Jp8N2Cg

RouterOS 6image.png

3. Have OSPF announce the static routes. Routing > OSPF > Instances


In #Routing:OSPF.Instances select the "default" and change "Redistribute Static Routes" to "As Type 1"

image.png

4. Confirm that route is being redistributed by OSPF

At this point check in a different router/omni that the route has been added (IP/routes). It should already be propagated by ospf.

  1. Log in to a different router somewhere else on the mesh (ie omni on a different rooftop)
  2. Go to IP>Routes
  3. CMD + F (or your computers shortcut) to search on the page
  4. Paste the public IP and see if it appears in the list

5. Add the network in IP > DHCP Server > Networks

Create a new network with the public IP address and the gateway of the Omni / Core router.

AD_4nXdWTFpOC0D_gfv4R7U1fxtbVklxIMJb03FkK0xvaddsd8SYAMu2C6S-ejoF8JMSCzgrDeZcgJ38HOimfQFD2l_Yn54dj613UHHVcdQalsVs48ZvCgICsOA7aM6GUBY0yQgvu5YDYeQNCLeAKpe8DklM-3k?key=YRUpkczqsF-wm37Jp8N2Cg

Note the Gateway is the address of the Omni/router handing over the Public IP via DHCP.
Go to IP>Addresses and look for the 10.96.x.x or 10.70.x.x on the "mesh" interface

In this case because it is a Public IP we add an external DNS server as the alternative to Mesh DNS.


6. Add the DHCP address (replace the Mesh IP in the static lease for the member’s router).

Find the static IP lease for the member's router (TP-Link or otherwise).
Edit the static lease to change the router's IP to the public IP.

image.png