Use of Public IP

Why Public IPs are sometimes needed:

AttributingAssigning a Public IP to a member (via DHCP).


Public IP meansallows the member’s device isto be accessible from the public Internet (from anywhere in the world). This opensis updone asfor wella few reasons:

A member has a resource in their LAN / Apartment they want to access via the riskpublic forinternet. Often a NAS, Media server, Security Camera NVR etc. A member has a webserver, video game server or service they want to publicly share on the internet. A building (management) requires remote access to a heating system, solar panel controller or other equipment.

For option 1: We should ask the member toif be hacked as well as all sorts of issues emanating from non-scrupulous sources on the net. 
Some ill-intentioned people on the wwwthey are scanning the webable to findconnect "opening", etc...

1/ Usually a member wants to access a ressource such as a NAS, video camera, etc.. on its LAN (home network) for private use and not share with others. In this case it is better to usevia TailScale, ZeroTier or similar.other similar service (or via a VPN)
This givegives better security as only the member has access (and can give access to whomever they want to).

2/Alternatively, An alternative is forif the member to requestis a volunteer or other known / trusted person, offer them a Wireguard VPN into Meshthe andmesh. They can access histheir ressource (NAS)resource via the Mesh IP address.

3/address, Thehowever it will be only accessible to people on the mesh or via a Mesh VPN connection.

For option 2 / option 3: If the member has a web server (aoption Web2) serveror forneeds example)unrestricted public remote access (option 3) and want to give access to it to anyone in the world (with the risk associated with it). In this case they will need a public IP to be set up. Continue below for setup instructions.

How it Public IP address.

assignment works:

NYC Mesh will allocate a Public IP to the member and hand over that IP to the members device (router) via DHCP. 

This opens up the risk for the member to be hacked as well as all sorts of issues emanating from non-scrupulous sources on the net. Some ill-intentioned people on the www are scanning the web to find open ports and known security vulnerabilties, etc...

Pick a free public IP infrom the PublicIPRanges spreadsheet (as a volunteer for help if you need access to this).
Check the OSPF route of the node you are looking to assign it to ensure you're assigning an IP rangethat list"lives" ( 🔺inat the correct subnet please!). supernode.
Make sure it is free (unused). Check a routing table in one of the routers to double check it is not in use.

The Public IP will be associated with the member’s device (handed over to the device) via the DHCP server of the closest NYC Mesh router (typically the Omni they are connected to). 
All the ports will be “opened” on the Mesh side. It is forup to the member to manage itstheir portsrouter's port forwarding and the necessary firewall rules to protect its LAN.

This

is

Setup aInstructions:

simpler

Here andwe effectiveare method* and much easiergoing to setadd upan asexample wellPublic asIP muchof safer199.167.59.85/32

for the Mesh network. *It uses less resources on the router as the router only routes the packets. (Using Nat and filters use more resources (CPU), when it is done on the Mesh router). 

You need first to know the MAC address of the member’s router/device where to allocate the Public IP. The easiest way is to have that router/device get an IP via DHCP and make that IP static in ROS.

the

Setupomni Instructions:

IP

Here> weDHCP areServer going> Leases.
(Please add a comment to addthe anstatic examplelease Publicfor IPother of 199.167.59.85/32volunteers)

1. In IP>Routes

Add a blackhole route, Distance 2

Blackhole routing, also known as null routing, is a network route that sends matching packets to a "black hole" instead of forwarding them. This acts as a limited firewall, dropping or ignoring the packets

To add a blackhole route inIn RouterOS (ROS)7

In RouterOS 6 (illustation for a different Public IP)

2. In IP>Routes

Add the route (gateway) where to route the packet for that IP address. Distance 1 (default).
This should be the bridge that the destination router for this port forward is on. In most cases this should be the "mesh" bridge.
Note that the Gateway (destination port syntax is different in ROS6 and ROS7)

RouterOS 7

RouterOS 6

 

3. Have OSPF announce the static routes. Routing > OSPF > Instances

inIn #Routing:OSPF.Instances select the "default" and change "Redistribute Static Routes" to "As Type 1"

4. Confirm that route is being redistributed by OSPF

At this point check in a different router/omni that the route has been added (IP/routes). It should already be propagated by ospf.

1. Log in to a different router somewhere else on the mesh (ie omni on a different rooftop)
2. Go to IP>Routes
3. CMD + F (or your computers shortcut) to search on the page
4. Paste the public IP and see if it appears in the list

5. Add the network in IP > DHCP Server > Networks

Create a new network with the public IP address and the gateway of the Omni / Core router.

Note the Gateway is the address of the Omni/router handing over the Public IP via DHCP.
Go to IP>Addresses and look for the 10.96.x.x or 10.70.x.x on the "mesh" interface

In this case because it is a Public IP we add an external DNS server as the alternative to Mesh DNS.

E/6. Add the DHCP address (replace the Mesh IP in the static lease for the member’s router).

Find the static IP lease for the member's router (TP-Link or otherwise).
Edit the static lease to change the router's IP to the public IP.