if i use my ISP modem (Freebox France) in router mode, i got internet perfectly with the actual setup (firewall, NAT [masquarade out WAN], etc..)
when i set the modem to bridge mode and get a public IP in my Mikrotik RB5009, (DHCP Client released), all counters are still working on Firewall tab and NAT (nothing extra dropped, checked in the Log), but i cannot get internet in any device.
should i change something with the NAT rule?
actual:
0 ;;; WAN SFP+ masq
chain=srcnat action=masquerade to-addresses=***public IP address*** out-interface=sfp-sfpplus1[WAN] log=no log-prefix="
the only difference i can realize is that i have had internal IP before (when modem was in router mode) but now as it is in bridge, i have public IP in my Mikrotik RB5009.
i have switched off for a short period my firewall to test if maybe it is blocked somehwere there, but not, so i really lost what is the problem here.
Again, it can be dozens of reasons. This could have been 1 It was worth trying.
You state traffic-counters are moving. Can you test if your issue is DNS-related or actual connectivity ?
Can you ping 8.8.8.8 from a connected PC ?
What DNS are you PC’s on the LAN using ?
i cannot ping out any domain or IP, i got timeout for the PC from LAN ping the 8.8.8.8.
the PC is using a https DOH connection to QAUD9 and to cloudflare as secondary. (set under WIN11)
please tell me what other details you need and i will share as much as i can.
also what is very strange is that the packages are counting properly under my Firewall rules, so looks like everything is OK. the only bad sympton is that there is no Internet on LAN.
i am sure there is small thing that is overwatched by me, but i cannot find..
Best thing is to provide a FULL config-export on your box , minus sensitive stuff like serial-numbers or some bits of the public-IP itself.
I assume your Win11 PC can ping its default-gateway ? (= the RB5009)
From the RB5009-console, can you ping something like 8.8.8.8 ? Or not even that ?
I can be a small thing, it can be a major f*ckup too, but without the full picture very difficult to pinpoint.
i cannot ping 8.8.8.8 from console RB5009, it is time out too.
i can ping my RB5009 from LAN device, i also manage the router from this PC.
please see below my actual settings, i have removed the sensitive info and the firewall. (as the firewall does not cause the issue, as i have tested it without the complete firewall)
thank you again for help!
# 2024-06-12 by RouterOS 7.15.1
#
# model = RB5009UG+S+
/interface bridge
add name="RouterBridge[ETH-6,8]"
/interface ethernet
set [ find default-name=ether1 ] name="ether1[HAX]"
set [ find default-name=ether2 ] disabled=yes
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] name="ether5[PCG]"
set [ find default-name=ether6 ] disabled=yes name="ether6[WRT]"
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] name="ether8[TPR]"
set [ find default-name=sfp-sfpplus1 ] name="sfp-sfpplus1[WAN]"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=***DELETED***
/ip pool
add name="DHCP_pool_ether5[PCG]" ranges=10.0.0.10-10.0.0.200
add name=DHCP_pool_router_bridge ranges=10.0.50.199-10.0.50.200
add name="DHCP_pool_ether1[HAX]" ranges=10.0.1.10-10.0.1.200
/ip dhcp-server
add address-pool="DHCP_pool_ether5[PCG]" interface="ether5[PCG]" lease-time=\
8h name=dhcp_srv_1
add address-pool="DHCP_pool_ether1[HAX]" interface="ether1[HAX]" lease-time=\
8h name=dhcp_srv_2
add address-pool=DHCP_pool_router_bridge interface="RouterBridge[ETH-6,8]" \
lease-time=8h name=dhcp_srv_3
/container config
set registry-url=https://registry-1.docker.io tmpdir=***DELETED***
/dude
set enabled=yes
/interface bridge port
add bridge="RouterBridge[ETH-6,8]" interface="ether6[WRT]"
add bridge="RouterBridge[ETH-6,8]" interface="ether8[TPR]"
/ip neighbor discovery-settings
set discover-interface-list=none
/ip settings
set tcp-syncookies=yes
/ip address
add address=10.0.0.1/24 comment="ether5[PCG] address list" interface=\
"ether5[PCG]" network=10.0.0.0
add address=10.0.1.1/24 comment="ether1[HAX]" interface="ether1[HAX]" \
network=10.0.1.0
add address=10.0.50.1/24 comment="ether6&8 [RouterBridge]" interface=\
"RouterBridge[ETH-6,8]" network=10.0.50.0
/ip dhcp-client
add interface="sfp-sfpplus1[WAN]" use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.1.11 client-id=***MAC address*** mac-address=\
***MAC address*** server=dhcp_srv_2
add address=10.0.0.10 client-id=***MAC address*** mac-address=\
***MAC address*** server=dhcp_srv_1
add address=10.0.50.200 client-id=***MAC address*** mac-address=\
***MAC address*** server=dhcp_srv_3
add address=10.0.50.199 mac-address=***MAC address*** server=dhcp_srv_3
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=10.0.0.1
add address=10.0.1.0/24 dns-server=10.0.0.1 gateway=10.0.1.1
add address=10.0.50.0/24 gateway=10.0.50.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.1
/ip dns static
add address=9.9.9.9 name=Q9DNS
add address=1.1.1.1 name=CFDNS
/ip firewall address-list
***DELETED***
/ip firewall filter
***DELETED***
/ip firewall nat
add action=masquerade chain=srcnat comment="WAN SFP+ masq" out-interface=\
"sfp-sfpplus1[WAN]" to-addresses=***public IP***
/ip firewall raw
***DELETED***
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=***DELETED***
set api disabled=yes
set winbox address=***DELETED***
set api-ssl disabled=yes
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=***DELETED***
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=***DELETED***
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
If you want anyone to seriously take a look at it you’ll probably need to provide the full config.
This is very weird, if you cannot even ping from the CLI there is something fundamentally wrong…
You could also try the “Quickset” and setup the box first with default settings ? At least you Internet should work and you’ll get basic FW-rules to start from?
Enable peer dns (check mark) in DHCP-Client for WAN. Check ping to 8.8.8.8 again.
If you can ping after eliminating the RB5009 DNS server, turn the DHCP-Client peer DNS off (no check mark) in DHCP-Client. Then try:
Your DHCP-Server DNS is set wrong. If you’re using the RB5009 as the DNS server, set the DNS to the IP address of the RB5009, not QUAD & CloudFlare. I believe there’s a resolution conflict.
Agree with the previous above post. Your masquerade rule is wrong. The “to-address” isn’t required & shouldn’t be populated. If the “to-address” is wrong, internet will not work.
thank you for all of you for the comments, i will try the advices tonight or tomorrow.
the strange thing is that my NAT is working without issue if i use my ISP modem in router mode. and in this case the tracert show me 2 LAN address before external IP. so that should be okay.
OR maybe my name translation is done by the ISP modem in router mode and that is why it is not working when i change it to bridge mode…
i will try the advices and get back with feedback for sure!
i have tried the mentioned advices and please see feedback below:
"If you can ping after eliminating the RB5009 DNS server, turn the DHCP-Client peer DNS off (no check mark) in DHCP-Client. Then try:
Your DHCP-Server DNS is set wrong. If you’re using the RB5009 as the DNS server, set the DNS to the IP address of the RB5009, not QUAD & CloudFlare. I believe there’s a resolution conflict."
→ i was able to ping from router the 8.8.8.8 and also google.com (which was resolved properly)
but no ping from my LAN PC.
i have done the changes as mentioned for the DNS addresses and to disable the Static addresses, but it changed nothing
/ip dhcp-client
add interface="sfp-sfpplus1[WAN]" use-peer-dns=no use-peer-ntp=no add-default-route=yes default-route-distance=1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.1 gateway=10.0.0.1 ntp-server=10.0.0.1
add address=10.0.1.0/24 dns-server=10.0.0.1 gateway=10.0.1.1 ntp-server=10.0.0.1
add address=10.0.50.0/24 dns-server=10.0.0.1 gateway=10.0.50.1 ntp-server=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.1
/ip firewall nat
add action=masquerade chain=srcnat comment="WAN SFP+ masq" out-interface="sfp-sfpplus1[WAN]"
Delete or disable the below unless a device/pc is using “Q9DNS” & “CFDNS” hard set by name specifically
/ip dns static
add address=9.9.9.9 name=Q9DNS disabled=yes
add address=1.1.1.1 name=CFDNS disabled=yes
what i have tried on LAN PC is that to use the nslookup and here i could see strange thing.
when the ISP modem is in bridge mode, it is working well with 9.9.9.9 resolve.
but when i switch ISP modem to bridge, nslookup started to give response:
C:\Users\X>nslookup
DNS request timed out.
timeout was 2 seconds.
Default Server: UnKnown
Address: 9.9.9.9
for me that is really weird that when i got a public IP via the bridge mode of ISP modem, i loose the internet connection on LAN network, but from router i can ping even domain name too and it is resolved via CLI.
I would expect your client to use 10.0.0.1 as DNS server (as specified in /ip dhcp-server network). Why is it showing 9.9.9.9?
Can you perform nslookup forum.mikrotik.com?
Can you post an ipconfig /all from this client?
Can you also post a tracert 9.9.9.9 from this client?
C:\Users\X>nslookup forum.mikrotik.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 10.0.0.1
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out
tracert for 9.9.9.9
C:\Users\X>tracert 9.9.9.9
Tracing route to 9.9.9.9 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 10.0.0.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * ^C
It was worth trying.