Can't connect to the internet from the LAN devices

Macedonian · Thu Mar 13, 2014 12:36 am

Hello all,

I'm new to the Mikrotik routers and they seem really powerful devices, especially in this price range!

I set up my WAN and LAN IP for accessing the router, set up DNS, I can login from Winbox, etc.
However, I'm running into an issue where I assign LAN IPs to say ports 6-10 and I can't ping anything when I connect to the LAN ports.
I added a src nat chain with the LAN source IP address to Out Interface with action src-nat and specified the WAN address. Still no luck.

If someone can point me in the right direction, I would really appreciate it.

Thank you!

Thu Mar 13, 2014 8:22 pm

Put all lan ports into one bridge and make all lan setting on that bridge instead separate ports.

Sent from Android by Tapatalk.

Thu Mar 13, 2014 8:23 pm

Do not forget the masquerade nat rule.

Sent from Android by Tapatalk.

Macedonian · Thu Mar 13, 2014 10:38 pm

Do not forget the masquerade nat rule.

Sent from Android by Tapatalk.

Hi Jarda,

Thanks for your reply. The nat masquerade rule would be under IP->Firewall->NAT->and then Chain-srcnat, OutInterface-ether1 (which is my WAN interface) and Action-masquerade, correct?

At first I thought it would be under Bridge->NAT, but then I never saw masquerade on that menu as an action...

Thanks again.

Fri Mar 14, 2014 2:31 pm

Correct. It should look like this:

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 to-addresses=0.0.0.0

It is not the bridge nat as you have only one bridge, so no natting between bridges occurs in your case.

Hope other things are working well and this is the last thing you had to do.

Click karma +, if you find my answer useful.

Fri Mar 14, 2014 2:40 pm

Does your default route (0.0.0.0) lead to your ISP gateway? And is this gateway reachable? If not, you will not be able to connect to internet.

Macedonian · Fri Mar 14, 2014 4:26 pm

Does your default route (0.0.0.0) lead to your ISP gateway? And is this gateway reachable? If not, you will not be able to connect to internet.

Under IP->Routes, I'm seeing the 0.0.0.0 default route and it shows reachable. Still no luck on being able to connect.
I've always used DHCP before and now I haven't set that up on the router because I need the LAN devices to be with static IP addresses.

I'm not sure what I'm missing. Any ideas?

Thanks.

Fri Mar 14, 2014 5:26 pm

Ok, you do not want to use dhcp server because you want to have fixed IPs. Have you considered to set static leasing of IP addresses?

Anyway, have you set the local ip address of your router as default route for each of the internal network devices?

Have you tried to ping external ip from the router? does it work? and from a device in the network?

Or you have problem with DNS resolving?

It is not easy to say, what could be the problem. Maybe you should post the complete export from mikrotik to check what you have set to it.

What ping directions have you tried with what result?

Macedonian · Fri Mar 14, 2014 5:47 pm

Ok, you do not want to use dhcp server because you want to have fixed IPs. Have you considered to set static leasing of IP addresses?

Yes, I will look into setting that up.

Anyway, have you set the local ip address of your router as default route for each of the internal network devices?

Have you tried to ping external ip from the router? does it work? and from a device in the network?

I can't ping either way.

Or you have problem with DNS resolving?

It seems like it. This is weird because I was able to ping earlier. I wonder if I restored from a bad backup....

It is not easy to say, what could be the problem. Maybe you should post the complete export from mikrotik to check what you have set to it.

What ping directions have you tried with what result?

Here is the export:
# mar/14/2014 09:37:31 by RouterOS 6.10
# software id = XXXX-XXXX
#
/interface bridge
add l2mtu=1598 name=Bridge_6-10
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment=LAN
/ip neighbor discovery
set ether1 comment=WAN
set ether2 comment=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=RouterOS
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip pool
add name=Bridge_6-10 ranges=10.1.1.2-10.1.1.254
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=Bridge_6-10 interface=ether6
add bridge=Bridge_6-10 interface=ether7
add bridge=Bridge_6-10 interface=ether8
add bridge=Bridge_6-10 interface=ether9
add bridge=Bridge_6-10 interface=ether10
/ip address
add address=xxx.xx.xxx.5/25 comment="added by setup" interface=ether1 \
network=xxx.xx.xxx.0
add address=10.1.1.1/24 interface=ether2 network=10.1.1.0
add address=10.1.1.2/24 interface=Bridge_6-10 network=10.1.1.0
/ip dhcp-server config
set store-leases-disk=immediately
/ip dns static
add address=72.29.224.33 name=DNS1
add address=72.29.224.50 name=DNS2
/ip firewall address-list
add address=10.1.1.0/24 list=MyLAN
/ip firewall filter
add action=drop chain=input connection-state=invalid disabled=yes
add action=drop chain=forward connection-state=invalid disabled=yes
add chain=input disabled=yes src-address-list=MyLAN
add chain=input connection-state=established disabled=yes
add chain=forward disabled=yes src-address-list=MyLAN
add chain=forward connection-state=related disabled=yes
add chain=forward connection-state=established disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 to-addresses=0.0.0.0
/ip route
add comment="added by setup" distance=1 gateway=ether1
/ip upnp
set allow-disable-external-interface=no

Fri Mar 14, 2014 6:40 pm

Are you connected to winbox by MAC or by IP?

Try this:

ping www.google.com

It should resolve the ip and test the ping time. It should work. At least. You can end it by ctrl-c.
If not, try to ping 8.8.8.8. Does work?

Try to ping from router to local device. It should work also.

Than, I would say, you should have enabled some firewall rules. Something like this:

/ip firewall filter
add chain=forward comment=Established connection-state=established
add chain=input comment=Established connection-state=established
add action=drop chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1 protocol=udp
add chain=input comment=Related connection-state=related
add chain=forward comment=Related connection-state=related
add action=drop chain=input comment=Invalid connection-state=invalid
add action=drop chain=forward comment=Invalid connection-state=invalid
add chain=input comment=Ping protocol=icmp
add action=drop chain=input comment="Drop All - WAN" in-interface=ether1
add action=drop chain=forward comment="Drop All - WAN" in-interface=ether1

What about setting the DNS in router? This is for what:

/ip dns static
add address=72.29.224.33 name=DNS1
add address=72.29.224.50 name=DNS2

?

You should have the addresses of external dns servers in "servers", not in assignments. And enable "allow remote requests". Now test the ping to http://www.google.com from console again. It should work.

After that, it should be the question of setting the IP parameters to local network devices. They should have the local net ip address of router as default gateway and as dns server.

Macedonian · Fri Mar 14, 2014 6:47 pm

Are you connected to winbox by MAC or by IP?

Try this:
Code: Select all
ping www.google.com
It should resolve the ip and test the ping time. It should work. At least. You can end it by ctrl-c.
If not, try to ping 8.8.8.8. Does work?

Try to ping from router to local device. It should work also.

Than, I would say, you should have enabled some firewall rules. Something like this:
Code: Select all
/ip firewall filter
add chain=forward comment=Established connection-state=established
add chain=input comment=Established connection-state=established
add action=drop chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1 protocol=udp
add chain=input comment=Related connection-state=related
add chain=forward comment=Related connection-state=related
add action=drop chain=input comment=Invalid connection-state=invalid
add action=drop chain=forward comment=Invalid connection-state=invalid
add chain=input comment=Ping protocol=icmp
add action=drop chain=input comment="Drop All - WAN" in-interface=ether1
add action=drop chain=forward comment="Drop All - WAN" in-interface=ether1
What about setting the DNS in router? This is for what:
Code: Select all
/ip dns static
add address=72.29.224.33 name=DNS1
add address=72.29.224.50 name=DNS2
?

You should have the addresses of external dns servers in "servers", not in assignments. And enable "allow remote requests". Now test the ping to http://www.google.com from console again. It should work.

After that, it should be the question of setting the IP parameters to local network devices. They should have the local net ip address of router as default gateway and as dns server.

Thanks Jarda. I'm connecting with Winbox. Yes, I realized that I put the DNS servers in the static section of the setup. I corrected that and I can now ping both www.google.com and an IP address so DNS is fine now.

I have the 10.1.1.1 (Router's LAN IP on eth2) set as both the gateway and DNS server for the laptop plugged into eth6 on the router. No luck on pinging 10.1.1.1 nor a public IP or a domain.

Fri Mar 14, 2014 6:54 pm

I would suggest to try the QuickSet (first option in Winbox menu), set AP or HomeAP and let it work. Then everything should work for you. After that, try to understand what each setting is for and try to adapt it to your special needs. It could be easier start for you than trying to configure router from scratch for the first time.

Macedonian · Fri Mar 14, 2014 7:06 pm

I would suggest to try the QuickSet (first option in Winbox menu), set AP or HomeAP and let it work. Then everything should work for you. After that, try to understand what each setting is for and try to adapt it to your special needs. It could be easier start for you than trying to configure router from scratch for the first time.

The only thing that the QuickSet did differently than I did was set up the DHCP server, nothing else. I'll tinker with DHCP static leases and see if I can figure that out.

Thanks for your help.

Fri Mar 14, 2014 7:07 pm

Thanks Jarda. I'm connecting with Winbox. Yes, I realized that I put the DNS servers in the static section of the setup. I corrected that and I can now ping both http://www.google.com and an IP address so DNS is fine now.

I have the 10.1.1.1 (Router's LAN IP on eth2) set as both the gateway and DNS server for the laptop plugged into eth6 on the router. No luck on pinging 10.1.1.1 nor a public IP or a domain.

I am sure, you are connecting by winbox. But by IP or by MAC? Probably by MAC.

Good to read that connection out works. What do you see in

ip route print

?

If you connect device to ether6, you have to set the default GW and DNS server of the device to 10.1.1.2. Because this is the ip address of the bridge and therefore the ip address of the router in this network. Not the 10.1.1.1.

Why you have added different IP address to ether2?

When you write about pinging, always write from-to you are pinging.

Macedonian · Fri Mar 14, 2014 7:49 pm

Thanks Jarda. I'm connecting with Winbox. Yes, I realized that I put the DNS servers in the static section of the setup. I corrected that and I can now ping both http://www.google.com and an IP address so DNS is fine now.

I have the 10.1.1.1 (Router's LAN IP on eth2) set as both the gateway and DNS server for the laptop plugged into eth6 on the router. No luck on pinging 10.1.1.1 nor a public IP or a domain.

I am sure, you are connecting by winbox. But by IP or by MAC? Probably by MAC.
By IP. I never had to use MAC. I used serial cable for initial WAN IP setup and as soon as I did that, I used IP thru Winbox.
Good to read that connection out works. What do you see in
Code: Select all
ip route print
?
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 xxx.xx.xxx.1 1
1 DC 10.1.1.0/24 10.1.1.1 ether2 255
2 ADC xxx.xx.xxx.0/25 xxx.xx.xxx.5 ether1 0

If you connect device to ether6, you have to set the default GW and DNS server of the device to 10.1.1.2. Because this is the ip address of the bridge and therefore the ip address of the router in this network. Not the 10.1.1.1.

I removed the bridge and instead set up a DHCP server on eth2 and I pointed my laptop to 10.1.1.1
/ip dhcp-server
add disabled=no interface=ether2 name=DHCP1 relay=10.1.1.1
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip pool
add name=dhcp ranges=10.1.1.3-10.1.1.254
add name=dhcp_pool1 ranges=10.1.1.3-10.1.1.254
add name=dhcp_pool2 ranges=10.1.1.3-10.1.1.254

/ip dhcp-server lease
add address=10.1.1.6 mac-address=00:14:22:CE:53:24
/ip dhcp-server network
add gateway=10.1.1.1
add address=10.1.1.0/24 gateway=10.1.1.1 netmask=24

Even though I added a static lease, it shows as status waiting for some reason...

Why you have added different IP address to ether2?
I only have 10.1.1.1 as the IP for eth2. Not sure what you mean...

When you write about pinging, always write from-to you are pinging.

Sorry for the confusion. Pinging from the router to Google for example both by IP and DNS works. Pinging from the router to the laptop on eth6 does not work. Pinging from the laptop to 10.1.1.1 and outside IPs does not work.

Sat Mar 15, 2014 1:56 pm

Is it possible to login to your router with view only rights? Or you can share your screen via TeamViewer. Write here your e-mail, I will send you mine and try to help you. It could be more effective than this way...

SurferTim · Sat Mar 15, 2014 2:12 pm

This will cause some routing confusion. You have the same subnet on two interfaces.

add address=10.1.1.1/24 interface=ether2 network=10.1.1.0
add address=10.1.1.2/24 interface=Bridge_6-10 network=10.1.1.0

Mon Mar 17, 2014 4:04 pm

So what is new? Everything works as it should or are you still facing any problems?

Macedonian · Mon Mar 17, 2014 5:06 pm

This will cause some routing confusion. You have the same subnet on two interfaces.
add address=10.1.1.1/24 interface=ether2 network=10.1.1.0
add address=10.1.1.2/24 interface=Bridge_6-10 network=10.1.1.0

Thanks SurferTim. I have corrected this. Still running into issues. Please see below in the forum responses for current setup.

Macedonian · Mon Mar 17, 2014 5:10 pm

So what is new? Everything works as it should or are you still facing any problems?

Hi jarda,

No, still can't get this working. Can't ping from the router to the LAN devices and I can't ping from the LAN devices to the router (and therefore to the outside). Current configuration:

Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; added by setup
xxx.xx.xxx.5/25 xxx.xx.xxx.0 ether1
1 10.1.1.1/24 10.1.1.0 ether2

Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=ether1
1 chain=srcnat action=accept src-address=10.1.1.0/24 dst-address=xxx.xx.xxx.5

Laptop settings:
IP: xxx.xx.xxx.120
Subnet: 255.255.255.128
Default Gateway: xxx.xx.xxx.5
DNS1: xxx.xx.xxx.5

I found out so many cool features by reading the forums and playing with the router but it's so complicated understanding the setup that it's still useless to me if I can't figure out the basic functions... Any advice is greatly appreciated.

SurferTim · Mon Mar 17, 2014 7:39 pm

Is the laptop on the WAN interface (ether1)? If so, then the laptop has the wrong default gateway to access the internet.

Is there a device connected to ether2?

Macedonian · Mon Mar 17, 2014 8:33 pm

Is the laptop on the WAN interface (ether1)? If so, then the laptop has the wrong default gateway to access the internet.

Is there a device connected to ether2?

The laptop is plugged into ether5. There is nothing plugged into ether2.

Ether1 is the WAN port and it's a test setup so I don't have anything else plugged into the router at this point.

SurferTim · Mon Mar 17, 2014 9:01 pm

If ether1 is the WAN interface and the laptop is on ether5, then this is wrong.

Laptop settings:
IP: xxx.xx.xxx.120
Subnet: 255.255.255.128
Default Gateway: xxx.xx.xxx.5
DNS1: xxx.xx.xxx.5

If ether2 to ether5 are on a switch, then it should be something like this. The dns ip may be wrong.
IP: 10.1.1.120
Subnet: 255.255.255.0
Default Gateway: 10.1.1.1
DNS1: 10.1.1.1

Macedonian · Mon Mar 17, 2014 10:29 pm

If ether1 is the WAN interface and the laptop is on ether5, then this is wrong.
Laptop settings:
IP: xxx.xx.xxx.120
Subnet: 255.255.255.128
Default Gateway: xxx.xx.xxx.5
DNS1: xxx.xx.xxx.5
If ether2 to ether5 are on a switch, then it should be something like this. The dns ip may be wrong.
IP: 10.1.1.120
Subnet: 255.255.255.0
Default Gateway: 10.1.1.1
DNS1: 10.1.1.1

I am not using a switch at all. I was under the assumption that once you set up your WAN/LAN ports on the switch you can use the rest of the ports, in my case ether3-ether10 to plug in devices directly into the router.

What I'm trying to do is set up the router in the following way:
Ether1 - Router WAN port
Ether2 - Router LAN port
Ether3 - Ether5 - Ports to plug in devices that will have publicly accessible IPs
Ether6 - Ether10 - Ports to plug in devices that will be behind a LAN and can only be pinged / accessed if you are within the same network but are not accessible otherwise.

SurferTim · Mon Mar 17, 2014 10:55 pm

I am not using a switch at all. I was under the assumption that once you set up your WAN/LAN ports on the switch you can use the rest of the ports, in my case ether3-ether10 to plug in devices directly into the router.

Yes, you can plug devices directly into the router without any setup. But you can't access anything through it. You can plug your computers into ether3 to ether10, but if the interfaces are not set correctly, they will not be able to communicate with each other or any other device without being on a swiitch.

What I'm trying to do is set up the router in the following way:
Ether1 - Router WAN port
Ether2 - Router LAN port
Ether3 - Ether5 - Ports to plug in devices that will have publicly accessible IPs
Ether6 - Ether10 - Ports to plug in devices that will be behind a LAN and can only be pinged / accessed if you are within the same network but are not accessible otherwise.

I think you need to do a bit of study on the theory of networks and how they work. Ether2 is the only interface set up to access anything. From what you said, no other interface is on a bridge or switch, so nothing will go in or out of those interfaces.

On Ether3 - Ether5, I'm not sure what you mean by "publicly accessible IPs", but that can be done with port forwarding public IPs assigned to the WAN interface to private (localnet) IPs on those interfaces, but you need to set up a localnet network on those or no access from or to anywhere.

Ether6 - Ether10 is the easiest. Firewall them off, but you must still set up a localnet network if you expect them to have internet access.

Mon Mar 17, 2014 11:06 pm

It is really messy. Seems like you think that you have to dedicate one of the ethernets for the device itself. No.

Lets try this:

1) put all ethernets except ether1 into bridge (bridge).
2) give the bridge manually ip address 10.1.1.1/24, mask 10.1.1.0 (ip/addresses).
3) assign the dhcp server to this bridge with your pool 10.1.1.3-10.1.1.254 (ip/dhcp server).
4) into dhcp/networks add adddress 10.1.1.0/24 with gateway 10.1.1.1, dns servers 10.1.1.1 (ip/dhcpserver/networks).
5) in ip/dns have enabled remote requests.
6) configure your computer as dhcp client and connect it to one of the ethernets in the bridge. It should get the ip configuration from dhcp server and start communicating with the router.

Then the pings should be working forth and back between the computer and the router. If not, check the firewall on the computer (enable respond to ping).

Anyway - is your router accessible from the internet? If yes, provide ip address and create a read only user. I will try to check (or others if they will be faster) what has to be set next.

For this the firewall rule would be necessary to allow the remote connection (before default drops):

/ip firewall filter
add chain=input comment=Winbox dst-port=8291 protocol=tcp

Or we can share teamviewer session and check it together.

Regarding the dhcp pool: I would suggest to use shorter interval (pool), e.g. 10.1.1.200-10.1.1.250 for dynamic ip assignments and use static assignments to lower numbers when new device occurs in ip/dhcp server/leases. Then you will immediatelly know that a previously not known device has connected.

Can't connect to the internet from the LAN devices

Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Re: Can't connect to the internet from the LAN devices

Who is online