On a MikroTik router, you connect Access Gate with two ports and add two pieces of routing: one route for the twin addresses, and one rule that sends a whole machine subnet through the gate. Nothing changes on the machines, and removing the rule undoes it.
What you will build
The examples use these addresses and port names. Replace them with yours.
| What | Example |
|---|---|
| Admin network | ether5, 192.168.254.0/24 |
| Dedicated subnet for the gate | ether2, 100.65.0.0/29: router 100.65.0.1, gate 100.65.0.6 |
| Twin addresses | 100.64.0.0/16 |
| Your machine subnet | 192.168.1.0/24 |
1. Connect two ports
Give one port an address on your admin network and the other an address on the dedicated subnet:
/ip address add address=192.168.254.1/24 interface=ether5 comment="AG admin"
/ip address add address=100.65.0.1/29 interface=ether2 comment="AG protection"
Cable ether5 to the Access Gate admin port (5) and ether2 to its protection port (1). The admin port takes an address from your admin network over DHCP, or uses 10.0.0.1 after about a minute if there is none. You can also set it to a fixed address, such as 192.168.254.50, from the Access Gate console.
2. Add the route for twin addresses
Access Gate gives each machine a twin address in 100.64.0.0/16. Tell the router where that range is:
/ip route add dst-address=100.64.0.0/16 gateway=100.65.0.6 comment="Secure Twin overlay"
Nothing uses these addresses yet, so this changes nothing on its own. It is what lets replies come back through the gate after step 3.
3. Switch with one rule
First, create a routing table whose only route leads to the gate. This changes nothing on its own:
/routing table add name=via-ag fib
/ip route add dst-address=0.0.0.0/0 gateway=100.65.0.6 routing-table=via-ag
Then add the rule. It marks everything coming from your machine subnet so it uses that table, and goes to the gate first, whatever its destination:
/ip firewall mangle add chain=prerouting src-address=192.168.1.0/24 \
action=mark-routing new-routing-mark=via-ag passthrough=yes comment="steer OT to AG"
This mangle rule is the switch. Your machines keep their address, gateway and settings.
To undo: /ip firewall mangle remove [find comment="steer OT to AG"].
4. Check it works
From a machine, reach something it usually talks to, exactly as before:
ping 192.168.2.20
In the Access Gate console, the flow now appears under its enclave. Access Gate starts in a dry run, so it shows what it would block without blocking anything until you approve the rules.
You can also check the other direction: from a computer on your office network, reach a machine by its twin address (ping 100.64.1.10). The route from step 2 carries it to the gate, which passes it to the real machine.
Other options
Protect one machine instead of a whole subnet
Send only the traffic going to one machine's twin address through the gate, with a host route. No mangle rule is needed:
/ip route add dst-address=100.64.1.10/32 gateway=100.65.0.6 comment="PLC twin only"
People and systems then reach that machine by its twin address (100.64.1.10) or its name. See Redirect traffic with your router's NAT.
Reach machines by name
Access Gate answers DNS at 100.65.0.6 and gives each machine a name that points to its twin address. Either hand that resolver to your machine subnet over DHCP:
/ip dhcp-server network set [find where address=192.168.1.0/24] dns-server=100.65.0.6
or keep your DNS and forward one subdomain to the gate. RouterOS does this with a FWD static entry, so only that subdomain goes to the gate:
/ip dns static add type=FWD name=secure.acme.corp match-subdomain=yes forward-to=100.65.0.6
Which traffic the rule covers
The rule in step 3 covers everything that leaves the machine subnet: machines to IT, and machines to other VLANs. Traffic coming into the subnet from IT, or from another routed VLAN, is covered when it is sent to a twin address or a name (the route in step 2 already handles it).
Machines that talk to each other on the same VLAN, with no router in between, never pass the router. For those, see Redirect traffic on your switches.
What stays on the router
The router holds one route and one rule, written once. Who may reach which machine, sign-in, session recording, encryption and logs all live on Access Gate. When the network team asks what changes on the router, the answer is: one mangle rule and its route, once.