Hi all,

I've got a problem with a RB411U with RouterOS 5.8 and a Sierra Wireless MC8705 HSPA+ Mini-pci-e card.

I configure everything:
- Internal IP (deleted default IP, added new static IP to ether1)
- PPPoE client with APN with default use everything (add-default-route, use-peer-dns, use-peer-ntp)
- NAT masquerade
- DynDNS script to check new IP every 10 minutes

Everything works fine, and now I want to change the ppp-client because I changed the SIM to another provider.

Now almost nothing works... I must explain:
- NAT masquerade becomes invalid (it's ok since i really have deleted the destination interface ppp-out1), it does not matter, so I regenerate the NAT and this problem had to dissapear. (I've also deleted the nat before changin the apn config if that helped and regenerate after the ppp-client reconfigured and ppp-out created, but same error)
- RB411U has access to internet and /tools fetch can download a file from internet
- Any computer in the LAN can ping any internet address(f.e. 8.8.8.
- No computer can browse any website

I've deleted ppp-client, deleted nat. Reconfigured everything, nothing works. Power cycled. Checked everything. In fact everything is ok and RB411U has internet connection...

The only way of making it work again is to restore a configuration backup or do a /system reset-configuration and reconfigure everything from scratch.

Any ideas?

Thanks in advance, regards,

Any computer in the LAN can ping any internet address(f.e. 8.8.8.8)
- No computer can browse any website
...
nothing works.

Can the problem accurately be reduced to "hosts behind the LAN interface are unable to complete DNS lookups"? It sort of sounds like that. Check your configuration in "IP > DNS".

You're right!!!

I didn't tried a connexion to any IP directly because I tried nslookup and was unable to resolve any address through an external DNS.
In fact I'm posting through the routerboard now.

The question now is why?
- If config were wrong, It should not to work on first try
- If config were right, It had to work everytime (As Einstein said: Madness is do the same thing two times and expect diferent result [Einstein wasn't informatic])

I've been searching through Internet and people do block external DNS requests, but in the Mikotik wiki says nothing it blocks external DNS request by feature.

Thanks a lot for your answer!, warm regards!!!!!!!!!!!!!!!!!!!

Pau

As I said on last post, it had to work everytime:

On /ip dns print I see: With this config in mind (allow-remote-requests: yes), the board should accept resolution from external DNS servers, isn't it?

Thanks in advance,

Pau

Are those DNS server IPs allowing access from your router's IP address? whois says those IPs belong to "Telefonica de Espana". Is that your ISP? Have you tried other DNS servers, such as OpenDNS or Google?

Yes, in fact I was using Google's.

I've retest now to make sure it doesn't works, tested too opendns servers without luck.

Thanks for your reply, regards,

Pau

Conversely: maybe your ISP doesn't allow any name servers other than their own. Have you tested with the ISP's name servers?

Unlikely but worth checking since we're not looking at the router like you are: are you 100% sure that there's no firewall filters in the input chain blocking users from using the router as a DNS resolver?

I can only say yes to you, but the facts are one step upper than the common sense:

- I've changed no config other than apn user and password in ppp-out1
- Before changes everything was fine
- After the changes I can't connect to the DNS from the internal machines
- The new test I've done: Although I see "yes" in the allow-remote-request in /ip dns, I've reconfigured it, and "boom". Everything works as expected

In any part of the ppp-client, deleting the ppp-client generates a "no" in allow-remote-request, allthough in the system configuration keeps the configured setting.

Thanks a lot from your help, I'll keep doing tests and see if I can replicate the problem now I have configured the allow-remote-request manually (in contrast with configured from the default configuration), regards,

Pau

Sorry, it didn't solved.

I still can't resolve to google's dns servers after manually set allow-remote-request, at that moment I was going out through my DSL.

But the fact remains the same, I've just restored a backup with vodafone configured and can request Google. At the moment I'll change the apn in the ppp-client interface. I'll be unable to do that (with /ip dns set allow-remote-request=yes and no manual filter configured nor windows firewall).

Thanks in advance,

Pau

You need to do more troubleshooting and provide more information. Without access to the router it's kind of hard to have an opinion on this.

Approach it like this first:
- determine whether the router can use its configured DNS servers, or whether both the router and client hosts fail for this. For example, ping www.google.com from the router CLI. Does this work?
- determine whether any DNS requests are making it outside the network. Configure a client statically to use Google or OpenDNS resolvers. Can the client now resolve names?

And so on. Figure out what is actually failing - the router resolver, DNS traffic to the Internet, or something else?

You couldn't be righter!

My ISP (Movistar) is the one who is blocking the connexion with any other DNS other than their's.

The best thing is that with the connexion missconfigured (Vodafone apn, user and password) Movistar (Telefonica) let me connect to the DNSs without any problem, but with their real good configuration doesn't (trying to pick customers, maybe?).

That's the reason everything seemed wrong, nothing to do with Mikrotik and the routerboard.

I've configured the board to do DNS caching and announce himself as DNS to the clients. On the ppp-client, I have to use the use-peer-dns or otherwise the board will not be able to resolve.

Thanks a lot another time for your help and your time, regards,

Pau

Hi Pau, i'm configuring an RB411U with a HUWEI dongle and movistar, could you help me with the configuration?

Regards,
Rafel Adrover.

The new firmware makes my configuration lot more stable.

I don't know if the huawei dongle wil be detected as a lte interface. If you see the lte interface then it's as easy as configuring the user/password/apn in the lte interface, adding a dhcp client as lte as source interface.

If the dongle is not detected as lte interface then you have to configure it the "old way", using the "interface ppp-client". You have to configure the user, password, apn, and "channels" on the ppp-client interface. The triky step is knowing the channels your dongle is using. You can see how many channels your card has issuing /port print (You'll see serial console and the usbX of your modem).
You have to configure data channel and info channel. To know which is the right info channel, you can use /system serial-console port=usbX channel=X. If you issue ATZ and the modem responds OK then it's the right channel. For the data channel you can do a test of all the ports once you know the info channel.

Hope this helps,

Fazerbcn