I'm trying to configure the Mikrotik rb3011 as neutral router to manage the internal LAN and the internet access provided by the ISP fiber router-modem (Movistar HGU). I've got some doubts about the basic configuration. My planned steps are:
On ISP's router:
- Configure the ISP router in “bridge” mode (IP: 192.168.1.1/24) an disable Wi-Fi, dhcp-server and UpnP.
On Mikrotik's one:
- Connect the ether1 port on Mikrotik's router with the ISP router and the ether6 port to the internal LAN.
- Assign static IPs on ether1 (192.168.1.2/24) and ether6 (192.168.0.1/24)
- Configure ether1 port with pppoe-client (new interface's name: pppoe-out1). It'll act as WAN interface.
- Configure dhcp-server on interface ether6 (internal LAN)
- Configure DNS cache
- Configure NAT
- Configure firewall basic rules
- Enable UpnP

Are this steps ok? Do I miss anything? However, my great doubt is the following: once I've configured the pppoe-client on interface1, with name=pppoe-out1, from now on all references to “ether1” or WAN interface must be replaced by “pppoe-out1”??

For example, when I create this Nat rule:
/ip firewall nat add action=masquerade chain=srcnat out-interface=pppoe-out1

Or when I insert this firewall rule:
/ip firewall filter add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface=pppoe-out1

Or in the following command to enable UPnP:
/ip upnp set enable=yes
/ip upnp interfaces add interface=ether6 type=internal add interface=pppoe-out1 type=external

Any advice will be greatly grateful! Thanks in advance!

Are this steps ok? Do I miss anything? However, my great doubt is the following: once I've configured the pppoe-client on interface1, with name=pppoe-out1, from now on all references to “ether1” or WAN interface must be replaced by “pppoe-out1”??

It should work as you described.

Yes, now your WAN interface is pppoe-out1 so any ip > firewal >filter/NAT rules should refer to it. BTW, you can rename the pppoe device as "WAN".

Ok! Thanks a lot for your quick answer! Next week I hope to try the proposed configuration! If it's all ok I'll post it. I also post some other doubts about how to improve the mikrotik's configuration, better firewall rules, the necessary steps to use a softphone from the internal LAN, ...
Thanks, again!

Ok! Thanks a lot for your quick answer! Next week I hope to try the proposed configuration! If it's all ok I'll post it. I also post some other doubts about how to improve the mikrotik's configuration, better firewall rules, the necessary steps to use a softphone from the internal LAN, ...
Thanks, again!

Hi, I've got it! Mikrotik rb3011 updated and performing as a neutral router with Movistar's HGU Askey in bridge mode (single user mode). VoIP and IPtv are still managed by Askey box. Now, I'll try to improve the security adding more firewall rules (only 8 basic rules at the moment).
I'd also like to use a softphone from my internal LAN to take advantage of the VoIP's facilities but I can't figure out how to configure Mikrotik's router to tell the HGU to do the job! Any advice?
Thanks in advance!

Enviado desde mi Nexus 5 mediante Tapatalk

Hi, I've got the softphone (CSipSimple) working on my android mobile from the internal LAN. The steps were the following: Enable IGMP proxy on HGU's VLAN 3. On the Mikrotik: add a static route with dest-address=10.0.0.0/8 and gateway=192.168.1.1, as another forum's member had posted. And finally the trick was:
IP firewall NAT action=masquerade interface=ether1 (not only PPPoe-out1).

Enviado desde mi Nexus 5 mediante Tapatalk

Hey! Thank you very much for the steps. I will perform them in my HGU so I can configure my RB2011.

This is the post I asked to the community: viewtopic.php?f=13&t=120499

Any advices on the firewall? And what to do in order to connect to the HGU if something wrong happens?

Thank you very much!