MikroTik Router Setup

Turning a MikroTik into an Enforcer

A LucidView Enforcer is a supported MikroTik router with LucidView scripts installed. That installation unlocks the LucidView Firewall Content Filter, Saturation Manager, Scheduled Reports, Dashboard Views, Traffic Flow Analyser, MikroTik Administration and Behaviour-Based IPS-Style Protection. The current install path is simpler than the legacy profile-by-profile installer: use the company install script from the portal.

By following the straightforward instructions outlined below, you can offer your clients a significant value-add to their existing services, enhancing network management and security.

Company Install Script

The current company install script is designed for MikroTik router installations that will benefit from Firewall Content Filter, Scheduled Reports, Dashboard Views, Traffic Flow Analyser, Behaviour-Based IPS-Style Protection and Saturation Manager. The MikroTik router must be in the traffic path, have internet access and be supported by the current LucidView script path.

The same fleet/company script can be run across supported MikroTiks for that operator account. If the script is run on a router that already has LucidView installed, it removes the existing LucidView installation; run the current script a second time to install the latest LucidView version.

How LucidView Works on the MikroTik

The install creates an L2TP client connection from the MikroTik to a LucidView POP. LucidView has regional POPs in South Africa, the United Kingdom, the United States and Australia. On initial install, the Enforcer first connects to red-box.lucidview.net and can land on any POP. Within about 10 minutes, LucidView should move it to the closest/best regional POP for fast DNS.

LucidView uses 1.1.1.1 as the DNS service target on the MikroTik. When the L2TP route to LucidView is up, DNS sent to 1.1.1.1 is routed over the LucidView path and LucidView applies content filtering. MikroTik Traffic Flow / NetFlow metadata is also sent over the LucidView path so reports, dashboard views, Traffic Flow Analyser, policy updates and support visibility can work.

If the LucidView POP or tunnel is unavailable, the Enforcer fails open to public DNS instead of blocking the customer's internet. In fail-open mode, internet access should continue but LucidView DNS content filtering is not applied until the LucidView path recovers.

For ISPs, WISPs and MSPs, this DNS path control can help keep large-platform traffic on local or regional CDN caches. If devices bypass the ISP DNS path with international DNS-over-HTTPS or other external resolvers, services such as Google, YouTube and Facebook may choose international cache paths, using expensive international bandwidth and giving customers a worse experience. LucidView can block known DNS-over-HTTPS, private DNS and alternate DNS circumvention where configured.

LucidView performs its own classifications using cloud intelligence, DNS metadata, MikroTik Traffic Flow / NetFlow metadata, category data, risk signals and network behaviour. Those classifications power the Firewall Content Filter, reports, Traffic Flow Analyser and effective Behaviour-Based IPS-Style Protection.

Normal Enforcer Schedules

A normal installed Enforcer creates three primary RouterOS schedules:

• lvcloud_profiles runs every 4 minutes to keep firewall content-filter policy, profile instructions and operator/ISP policy current.
• vpn_dns_failover runs every 1 hour to check the LucidView tunnel and move to failover if the local LucidView POP path is unavailable. In failover the Enforcer fails open to public DNS, so internet access should continue while LucidView DNS content filtering is not applied until recovery.
• enforcer_checkin runs every 12 hours to fetch and import the current public runtime so LucidView can refresh scripts and release normal Enforcer updates.

More Information

Video Guide: How to Build a LucidView Enforcer

Please see the video for a step-by-step instruction guide on how to install LucidView on your MikroTik.

Multi-Profile Enforcer

For ISPs with a central break-out point, there's no need for a MikroTik router at each customer location. Instead, you can use a MikroTik Cloud Core Router to host thousands of profiles from a single central location.

This option requires assistance from LucidView. To get started, email info@lucidview.net and specify your interest in the Multi-Profile Enforcer.