MikroTik

anav

# software id = TFI5-YPER # # model = CCR2004-16G-2S+ # serial number = REDACTED /interface bridge add name=bridge1 vlan-filtering=yes /interface ethernet set [ find default-name=ether5 ] advertise=\ 10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full /interface wireguard add listen-port=...

anav

Yes, its problems with your config.

anav

You assign vlans to the bridge not the port. On the port you can put one or more vlans as desired via the bridge setup. Vlans by themselves are blocked from other vlans at layer2. Using firewall rules you block them at layer3 on the router, the fact that they are on the same bridge is not an issue. ...

anav

ROUTER A Unable to progress as your VLANS are not quite there, maybe........ incongruence between bridge ports and bridge vlans. You have ports indicating both trunk and access port attributes. Can you provide the following information for all your ports................. port X --> to single dumb d...

anav

ROUTER B 1. Added ipv6 drop all firewall rules for whatever reason it got activated by mistake. 2. Remove unnecessary interface list members, bridge covers all ports. 3. With only one LAN subnet, two LAN interface lists is not logical??? 4. Adjusted,Updated firewall rules. Now only trusted can acce...

anav

What is the difference between LAN and SLAN??
Is LAN like home users and SLAN like iot and media and guest wifi ??

anav

Well it doesnt sound like you are sending users to safe servers. Most modern gaming servers like Steam do not require ports open etc........ in any case by dst address is actually very useful. First step is to simply and reduced to one Wireguard network. In case the main Wireguard network is down, w...

anav

Your choice, will move on to help others..........

I was quite clear.......
Need full config of router.
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys )

Also the wireguard configuration of the client ( minus any public WANIP information, keys etc. )

anav

If this is a public IP facing router it should be unplugged ASAP as you have no firewall rules.

anav

Unable at the moment.............

anav

Attaching both configs. Ideally both routers could reach each others subnets. Not quite complete............... Which LANIPs need to access the internet on Router B? Are there specific and unique dst ports involved. Is the WANIP (destination address on the www, fixed/static for game server, or alwa...

anav

Is there really no git repo/github...or modern known issues/feature request tracker for winbox4? A manually updated list at the top of a 1315 reply forum post seems like a bonkers implementation considering we're almost 1/4 of the way thru the 21st century. This is HOTEL Mikrotik, you can never lea...

anav

Need full config of router.
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys )

Also the wireguard configuration of the client ( minus any public WANIP information, keys etc. )

anav

viewtopic.php?t=143620

anav

No question the only two units worthy of consideration are the ax3 and 5009. However the ax3 is limited in wan throughput to 1gig connections, while the 5009 is future proofed to 2.5 gig connections ( maxes out aroundd 3Gbps on routing ) With a price differential of only 10E, its a no brainer to get...

anav

...but ROS can be hard to master.

Where did you get that from ?

You crack me up!!

BPWL for president of MT, re-assign the well-intentioned but failing staff they have running the wifi show. Mean well and positive outcomes have proven to be mutually exclusive!

anav

Sure, turn on IP cloud and get the dyndns address......... This is the endpoint address you will need on any client peers to connect to your wireguard VPN on the router. Identify the subnet you wish to be able to access over wireguard. /interface wireguard add listen-port=53477 mtu=1420 name=wgOLT /...

anav

I've already got WireGuard VPN connection between the devices. I use it to access the other device using WinBox. Further guidance is much appreciated. Show both configs /export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.) Also identify which IP address(e...

anav

Its getting clearer thanks!
Suggesting either a wireguard VPN connection or a zerotier connection (LARSA can help with), that will allow you to securely access your resources behind the mikrotik router while away.
I suppose which is readily available on the CHR would be a starting point.

anav

No argument from me vis-a-vis using zerotier....
Basically all connect to cloudflare VPS in a way

would just like to add wireguard doesnt really use certificates, it does add pre-shared key if you want extra security.

anav

PCC is but one part of the equation, all of the required user traffic needs to be identified before starting the config.

anav

Yes, but until I actually use zerotier, I will be unfamiliar with its application and nuances.
No worries, ehbowen, Anav1 Larsa 0

anav

It sounds like you almost dont need a router if opening all ports up.
Typically I advise that its a foolish thing to do......................... especially if your router is public IP facing.

anav

https://forum.mikrotik.com/viewtopic.php?t=143620 A. 1.6Gbps link is best served by the RB5009 Router with room for growth....... ( up to 3gigs so sufficient for an ISP 2.5gig connection ) B. Budget choice is indeed the hapax3 with 1.1Gbps with 25 filter rules and higher with less rules so close eno...

anav

1. Modify this /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN TO: /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=ether1 list=WAN add interface=vlan100 list=WAN 2. Modify this to so...

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys)

anav

No worries, you are good shape. I would probably use the most stable internet connection ( with a public IP ) as the main Wireguard Server. Assuming its your VPS, since normally there is built-in redundancy available 24/7 and usually decent enough throughput. So I am talking about putting a licensed...

anav

Do NOT use multiple posts for same issue ---> viewtopic.php?t=211736

anav

MT wifi is a mess. Station in layman speak means "client", an interface in station mode connects to an existing wireless network (hotel access point) just like your phone or laptop would. AP is much more intuitive as a name, It is the mode where the interface creates a new wireless networ...

anav

What do you mean Mikrotik CHR? Do you have a licensed CHR in the cloud? If so you can setup wireguard on the CHR, and tne access all devices locally. One creates a peer to peer connection from the Main Router to CHR and from any remote devices to the CHR. With proper routing rules and firewall rules...

anav

Dice che gli script non risolveranno le tue esigenze e che utilizzeranno le impostazioni del router disponibili inclusi ma non limitati a elenchi e filtri.

anav

Your requirements are NOT clearly stated or accurate. Your writing states four internet WANS, but your diagram only shows 3?? What do you mean NOT distribute the load? How do you propose that the router share the load so to speak? Do you mean you have four different subnets, OR perhaps 4 groups of u...

anav

What model of router do you have attached to the internet?

anav

You have to decided on who does DHCP on your network.
If the switch will just be a switch that is easily accomplished, no double nat etc....
However if you want the switch to be a second router, then your thoughput may be limited to approx 300-400Mbps.......

anav

Nothing obvious to me.

1. set detect internet to none, its known to cause funny issues..

2. Remove this static DNS setting, it no longer appplies.
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A

anav

What purty colours!! Version 6. /ip firewall mangle add chain=forward action=mark-connections connection-mark=no-mark dst-address-type=!local src-address=192.168.1.0/24 new-connection-mark=stream1 passthrough=yes add chain=forward action=mark-connections connection-mark=no-mark dst-address-type=!loc...

anav

I use separate vlans to visualize different data needs ( single bridge ).

anav

1. Suggest remove these unless you can justify with purpose.... /interface bridge settings set allow-fast-path=no use-ip-firewall=yes 2. Why do you have fast forward=no for the normal bridge settings? ( Does it interfere with hotspot function?) 3. Missing route for modem2 table main................ ...

anav

Funny, I migrated away from MT WIFI, for the most part.

anav

Do post your config, interesting setup!!
/export file=anynameyouwish ( minus device serial number, any public WANIP information, keys etc. )

anav

If the AX3 is simply an AP, from an upstream router then it should be a relatively easy setup. Assuming wifi settings are good ............. will focus on mechanics of the rest. First, you need to identify the managment or Trusted vlan, from which the AX3 SHould get its IP address from. Only the tru...

anav

Why posting in wifi forum?
In any case post both configs
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

Also confirm at least one of the routers has a publicly reachable WANIP.

anav

Not enough information

anav

The mikrotik can only work with what its been given. Your problem is to get the traffic from the WWW to the mikrotik or more specifically to the WANIP of the Mikrotik ( the wanip also being the LANIP of the mt device on the load balance network I guess Why do the modems publish the same private subn...

anav

Your job is to provide the information requested so that assistance can be rendered.
- define requirements as previously explained
- provide complete config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )
- network diagram also helps.

anav

Okay, so basically asking how to reach the other remote site from the android device......... The other remote site being a router with subnet 10.1.1.0/24. Lets say someone from 192.168.1.0 local subnet wants to reach 10.1.1.X.................... The main router doesnt know about this remote subnet ...

anav

viewtopic.php?t=211681#p1102808

anav

1. Allowed IPs identifies remote addresses and thus this is not correct and should be removed. add allowed-address=172.16.0.3/32, 192.168.1.0/24 interface=wg0 name=wg1 \ public-key="" 2. Why did you create another wireguard address, the router only uses one address in this configuration......

anav

Concur, OP is confused or trying to follow to many guides and not really understanding what is being done in them.

anav

Yes and yes LOL. Be careful NOT to put in the drop all rule as the last rule in the input chain UNTIL your ALLOW trusted rule is in place and properly configured, otherwise you will lock yourself out. On that note, typically if I have a spare port, I take it off the bridge give it an IP of 192.168.5...

anav

Well it sounds like your asking different things. If a connection goes down, then that session effectively dies a slow death for sure........ The degree to which the new connections smoothly transition to the other WAN is always a work in progress. However, I dont agree with the assertion that the n...

anav

dont care about partial config in the slightest or commenting on so little information and a config is all interrelated. Mangling depends upon well articulated requirements identify devices/users ( internal, external, admin etc...) identify traffic they need to execute - config, with mangles or rout...

anav

Sounds like a misconfiguration on RoS6..............
No such issues if configured properly on 6 or 7 from my understanding (albeit limited).

anav

Suggest post mt router config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

Also publish settings on windows wireguard as well............

anav

1. You also have this config error but not sure what you have put here to cause this? add interface=*E list=LAN Related to the mostly likely incorrectly or not needed attempt to port forward using wireguard?? # no interface add action=dst-nat chain=dstnat dst-port=51821 in-interface=*E protocol=udp ...

anav

Your best bet is to ensure traffic for priorty can be expressed as ports or IP adddresses ( subnet, source-address-list ) as those are easier to manage ........

anav

Probably queuing, read up on that.

anav

Assuming your ISP connection is 400Mbps or less ???

anav

Most likely a firewall blocking on the windows machine.

anav

Your problem is simple get rid of the second wireguard its causing you all sorts of problems and not needed. Your allowed peers identifies the wrong thing... Adjusted: /interface wireguard add listen-port=51820 mtu=1420 name=wg0 /interface wireguard peers add allowed-address=172.16.0.2/32,10.1.1.0/2...

anav

THe config will likely reveal all, and should be fixed up quickly. WHile waiting for the config, the OP should make it clear. a. Are servers used by only external users or also by internal users b. If by internal users, how are they accessing the server ( lan ip or ??? ) c. confirm you have publicly...

anav

Ports, IPs easy to deal with, traffic types.......... you got the wrong router to do that. Its all a matter of mangling for the most part. Identify any vlans coming into specific WANs - mangle for that Identify any incoming port forwarding - mangle for that Identify the load balancing - mangle for t...

anav

State the requirements clearly, which ports for example..............

Post the config <----------
/export file=anynamyouwish ( minus router serial number, any public WANIP information, keys etc, dont need long lease lists either LOL )

anav

You still owe me a wireguard ( possibly using L2TP as well (not encrypted) dual WAN via CHR mt in the cloud setup help session for OSPF/BDF there LARSA.

anav

Yes, your config blocks it.

anav

Funny I have a friend who tried to use netwatch icmp and many parameters ex. host=9.9.9.9 interval=5s packet-count=10 \ packet-interval=500ms thr-avg=700ms thr-jitter=2s thr-loss-count=26 thr-max=2s thr-stdev=700ms timeout=3s ( real world many installs etc ) and after many false alarms has gone to t...

anav

Good day,
The defacto guide to understanding bridge vlans is here.
If you have any questions from that feel free to ask!!
viewtopic.php?t=143620

MT Documents are way better now on this topic.

anav

Who is going to by CCR class router and not have to schmucks about how to program it?
I think MT should require proof of MTCNA prior to purchase

( says the guy who bought a CCR1009 without any schmucks, truth be told I cut my teeth on two hex's, capac and RBG450G. )

anav

Another case of MT staff dont use the equipment they sell, should have been discovered long ago.
OR
Their test process is flawed, take your pick.

anav

Missing IP pool for the two vlans. Why do you have the bridge doing dhcp?? You need dchp server and dhcp server network for all three vlans! /ip pool add name=dhcp ranges=192.168.7.101-192.168.7.199 add name=pool-8 ranges=192.168.8.101-192.168.8.199 add name=pool-9 ranges=192.168.9.101-192.168.9.199...

anav

No idea, dont use chains as I rarely have an actual need, the concept of chains is very nice agreed, but rare to see. Well mostly see it in garbage firewall rulesets. /ip firewall filter { default rules to keep } add chain=input action=accept connection-state=established,related,untracked add chain=...

anav

sounds like your issues are all wifi........................ simple solution

anav

Standard config view please.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

This is the defacto bible on explaining the setup ...........
viewtopic.php?t=143620

anav

Not sure on your diagram, It would appear that you have the hapac wired directly to the ISP router ( the hapac is also setup as a router ). I am assuming that the ISP router gets a public IP and that you can forward the wireguard port from the ISP router to the MT router?? So need to confirm that an...

anav

Separate from jaclaz question, why not consider VRRP as a way to create a seamless connection from the client (lan) perspective, or will not work in your zooom example. ????

anav

Nice feedback AMMO. Conceptually, I like the idea. basic failover, - first step when learning how to use two wans Recursive failover - If concerned that the ISP is flaky and want to confirm connectivity to WWW ( seems many do ) Netwatch failover - If not happy with 20 seconds before any action is ta...

anav

Next lets look at other rules..... 1. CHANGE THIS TO /ip settings set max-neighbor-entries=8192 rp-filter= loose 2. DECIDE!!! Either use IP DHCP client for ether9 OR assign an IP address but not both !!! Since its a static IP, setting the IP address makes sense and I ssuspect you just entered a gene...

anav

The first thing to do in mangling is to ensure traffic heading for WAN2 is sent back out via WAN2. This should direct all VPNs coming on WAN2 to go back out WAN2. Of course one must have standard sourcenat rule in place as well Your wireguard rule seems to be deleted not sure why............ in anyc...

anav

So is your thinking that when one connection goes down for whatever reason, the netwatch setup is very good in terms of detecting and switching the users to the backup, however the problem is users sessions interrupted mid-stream are left hanging? Isnt that partially taken care of by using masquerad...

anav

Besides network diagram any advice has to be predicated upon a thorough understanding of the requirements, not parts thereof.
A, identify all the devices, users including the admin
B. identify the traffic they need to be able to execute

anav

no no no..................... ask about http3 support, by the time they implement 2, the draft for http4 will be out .

anav

Clearly Holvoe, Mikrotik staff use apple products and zyxel networking equipment and not MT products, as that kind of oversight only happens when you dont actually use the equipment for real.

anav

The explanation of your WAN is confusing. You state an ISP modem is feeding the MT router but then you state the MT is getting a DMZ IP..........?? If its a modem, the MT router would get a public IP, would it not?? If its a modem/router then getting a private IP for WAN would make more sense..... W...

anav

My question was for the OP, the originator, didnt realize it was you that had answered..........

anav

When you become more forthcoming with requirements an optimal config can be designed. What is wireguard on demand mean. ( your using a third party provider? you have wireguard vPS in the cloud? your MT is acting as a wireguard server and you as the admin login from away ? ) Which WAN is used for por...

anav

As I tried to explain your concept of forward chain and traffic is flawed. There is such a beast as WAN to LAN traffic. All traffic is not destined necessarily for the input chain. The dstnat rule, the default rule EVEN Tells you there is............... It says block all WAN to LAN traffic EXCEPT FO...

anav

Draw a diagram as your network design is very confusing when you try to explain it.....................

a. is the mikrotik connected to an upstream ISP router or Modem?
b. does the mikrotik get a public IP or a private IP from the upstream device?

anav

Well to help me understand I have created a recursive ruleset and a netwatch ruleset for the basic setup of TWO WANS. Most LAN users (single subnet /23) should use WAN1. Rest of users identified by firewall address list should use WAN2 Each WAN should be used as backup of the other. See result recur...

anav

Here is my attempt at using netwatch LOL. No promises and hopefully somebody can point out if there are errors. /ip route { WAN1 } add dst-address=0.0.0.0/0 gateway=ether1 routing-table=main add dst-address=1.1.1.1/32 gateway=ether1 routing-table=main add distance=2 dst-address=1.1.1.1 black-hole=ye...

anav

Going to take the easy way out. All traffic will go out WAN1, by default and thus we only have to 'force' business traffic out WAN2. First fix the mistake already noted: /interface list member add comment=defconf interface=bridge list=LAN add comment=Three interface=ether1 list=WAN add interface=ICU...

anav

With VPNs to the router involved mangling is required.
Since you didnt state otherwise, it would appear you have no port forwardings involved.

post your config on what you have so far....
/export file=anynameyouwish ( minus router serial number, any publicWANIP information, keys etc. )

anav

[quote=jaclaz post_id=1102129 time=1728390315 user_id=224177 -Tab -> Down /ip route enable [find comment=LTE-Failover] [find dst-address=0.0.0.0/0 and gateway=192.168.1.250] -Tab -> Up /ip route disable [find comment=LTE-Failover] [find dst-address=0.0.0.0/0 and gateway=192.168.1.250] [/quote] Just ...

anav

Do you have any VPNs ( such as wireguard ) in the mix via a specific WAN, and also any port forwarding to servers --> on either LAN??..........

anav

Remember, that each link is still peer to peer. There is hub and spoke network! However we set up the routes and firewall rules such that desired connectivity can be reached. Because each device is on the same wireguard subnet and each client peer has either 0.0.0.0/0 in allowed IPs OR 172.17.17. 0/...

anav

a roadmap would be nice (*wishful thinking*)

Easy Peasy just become a valued investor. ;-)

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.) To be clear what you want is NORMAL ( no sharing ) LAN1 to use WAN1 for all traffic LAN2 to use WAN2 for all traffic. Failover ( share available WAN ) If WAN1 is down, LAN1 should use WAN2 if WAN2 is do...

anav

What is your comfort level programming MT routers? The configuration is not a copy and paste exercise, you should understand what you are doing and how the different sections are related. routing, firewall rules, wireguard protocol and processes etc..... That said, wireguard is by far the easiest VP...

anav

Absolutely no ports are needed for call of duty, when using steam or other game sites.
If you are trying to run your own gaming server, good luck with that.

anav

You do not need a secondary router to segment yournetwork. Simply create as many vlans as you need and attach them to the bridge. one for home/trusted one for servers one for iot one for guests etc............. You have four ports to distribute the vlans. If you have more ports required to ensure al...

anav

As noted you are confused about the chains. WAN TO the ROUTER is input chain, think of a. vpn connection to the router b. Configuring the router WAN to LAN ( through the router) a. port forwarding normally from the www. b. upstream router subnets to NATTED mikrotik router ( aka subnets on upstream r...

anav

The default firewall rules are for the sole purpose of an individual connecting to his ISP and using the internet. Once you start changing the network it is advised to revisit the firewall rules and modify accordingly. As you have found out, the default rules are not all that clear for the beginner....

anav

Prior to using capsman, it was quite easy to setup up vlan per SSID or vlan per USER group (and assign both SSIDS to same VLAN) and have them fully separated at layer2 by vlans, at layer 3 by firewall rules and then through wifi settings decide whether or not wifi users should be able to see others ...

anav

MTs are actually very cost effective, flexible and powerful devices, just needs a brain and some patience and they work just fine.
For anybody else,, aka with a lobotomy and the attention span of gnat, yes, Asus is better.

& Kisses!

anav

Without a specific subnet to differentiate, then its more complicated as you will need to mangle and use a firewall address list to identify the IPs that are considered business. If you have the business on a different subnet, then the routing rule method is more viable. What is keeping you from add...

anav

Very reasonable request. Couple of questions........ Assuming the PPOE is a public IP?? if not is WAN1 a public IP Do you port forward to any servers on family LAN? Do you have any VPNs required ............ If not, you should consider at least wireguard vpn so that you can access your router config...

anav

It will be a complicated setup but assuming you have port forwarding to servers on WAN2 and VPNS coming into WAN2, Simply make two routes, WAN1 PRIMARY WAN2 Secondary Mangle traffic to the router, ( vpns ) Mangle traffic through the router ( port forwarding ) Send all return traffic back out WAN2 th...

anav

Depends, If you are assigned a static WANIP, its often easier just to set the IP yourself. If assigned a dynamic WANIP a dhcp client setting can make sense for route, but it depends on the ISP provider. Same with ppppoe type connection... Typically if doing something funky with routes its often bett...

anav

You should get around 300Mbps on the 5009, I suspect your config, besides wireguard is not optimal either. Most of your setup is non-standard starting with adding a vlan to bridge setup, weird dhcp settings etc... Crappy firewall rule setup etc etc.. Crappy mangling setup etc etc.. Wireguard missing...

anav

Nothing is 'normal, there are default rules for the very basic setup and the rest are ADMIN decisions.

anav

anav

Certainly, assumed you were doing wireguard that you already had basic MT setup and use under your belt.
Not a good plan if not had some practical experience

anav

What ts a white IP..............

Need config of the router
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Did you turn off queues to establish that wasnt the issue??

anav

Hi Steve, he wants to hit 10Gigs with his ISP provider. Why dont you check which routers are capable of routing 10gigs to the ISP for starters, not the CCR1009 ;-) I have an older CCR1009, I would like to replace with a newer CCR router that can handle the following: 1 uplink via Fiber 10G to my ISP...

anav

Concur with erlinden, pull the router netinstall new clean firmware and redo your setup.
Start with the default settings and for gods sake dont open up the winbox port to the internet!!

anav

Without seeing your config, its not possible to comment. Most of the time its admin error.

anav

They are not access points, those are old wifi routers that could be used as access points. However these are dumb devices, there is no vlan capability and no real management capability. You can provide one subnet per port ( and thus per AP ) on the router and thats probably the extent of the separa...

anav

Once cannot copy, suggest start fresh and clean and build config slowly. Starting with a network diagram to identify all the users/devices on the network as well as switches Aps etc.. Also, if you didnt know, Mikrotik has a website with all the details you seek. Have a look and pick which one has th...

anav

Instead of blindly posting bits of a config and asking is the config okay, Start from the beginning. a. network diagram b. identify all users ( devices, users (external, internal, admin) c. identify all the traffic they should be able to execute d. provide enough details on wan side for type of ISP,...

anav

What is the purpose of connecting without a bridge????
Easy to assign ports to a single subnet no bridge, but what is the fun in that??

anav

1. Although not blocked I would probably add an explicit allow rule in forward chain, prior to the last rule. add chain=forward action=accept src-address=192.168.88.0/24 out-interface=wireguard-inert 2. This rule is NOT required add action=masquerade chain=srcnat out-interface=wireguard-inet src-add...

anav

From a basic perspective, a single subnet and bridge work well to allow use of ones wired and wifi ports on one network. There is no need to use IP Bridge filtering here. USE NORMAL FIREWALL RULES to separate traffic at layer 3. If you had two subnets one for the bridge and most wired and wifi ports...

anav

The only guarantee is that you are the one responsible for the admin of the router and thus do things properly.
If not the admin, there is no way of knowing. I hope that makes you feel better.
Its the same with any router.

anav

Complete mikrotik config please.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Sorry I dont comment on partial configs as all parts are related, and yes your firewall rules need work.

anav

Yeah clickbait title threads I normally dont answer other than to point out the garbage title.

anav

I dont use official documentation or anyones documentation if it doesnt make sense to me. If the official documentation says jump off a cliff I am afraid we may not see you any longer. ;-) For the OP, please describe the requirements more fully before deciding on any config. Do you have any VPNs com...

anav

Your config has many errors in it, but more importantly your config also doesnt seem to match your intentions.
What are the requirements for pihole, should all vlans use it, only one vlan, what is the purpose of pihole on your network.

anav

Exactly, which I suggested above...
ROS without config should not have internet access because of exposed services.

On that we can agree LOL.

anav

Concur, not in this case but its often true, the more described up front in understanding the requirements that lead you to two wireguard interfaces, means a solution will be holistic and ensure all use cases are thought of/included.

anav

or just apply script... It seem logic is here - more stupid people are ones which cannot for any reason remove SIM than ones that don't know that lte1 needs to be enabled to have internet access (if is mitigated like that) Go ahead and rely on scripts the rest of the "real" IT human race ...

anav

Looking to see your config, to see what you are missing.

anav

Genius, brilliant! Solution of the century. So basically remove the invisible cable wire.... who would of thunk it.........

anav

Im sorry jaclaz, but you clearly missed the boat.
The OP has two subnets, one for the home lan and one for the guest wifi.
Two vlans makes much sense to me.

As for the OP, good luck, advice not followed, your in good hands with jaclaz, out.

anav

Perhaps if you were more honest about the config it would be helpful. You didnt mention why you have two wireguard interfaces for example????? There are many parts of the config, that I dont like but in terms of wireguard, you clearly do not understand how wireguard works. Your allowed IPs for being...

anav

Would it not be for the second bit...... ???? /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP1_interface" distance=1 add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP2_interface" distance=2 add dst-address=0.0.0.0/0 gateway=...

anav

1. You are attempting to have two different subnets assigned from the single bridge. There are several approaches, two bridges but not advised or two vlans, very much advised. You already have two pools.......... just complete the config...... and first add the vlans to the bridge. /interface vlan a...

anav

Why? SSH is not required if you have a wireguard connection??
Also is there a reason not to use the wireugard on the router itself?

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP info, keys etc..)

anav

For me, a detailed network diagram would help illustrate effectively what you are trying to accomplish. In general if you have a main router and then other sub-set routers connected ( creating double nat ) communication from the main router to the secondary router is easily handled by adding static ...

anav

The logic is NOT to connect to the internet until firewall rules are in place and admin information/access to router has been changed from default and secured. Relying on default anything in the router is the wrong approach. Just dont attach the cable or sim card etc, until the router is ready to be...

anav

https://www.youtube.com/watch?v=i1L2UAqrQZM

anav

So your thinking is that a client Wireguard HOST ( seeing as you are using a third party VPN provider and thus server is at the other end ) on your network vice using the router as the client itself is of course very possible. NOt sure that performance will be any better, but its a matter of appropr...

anav

Yes, if the upstream ISP or farther up line providers cannot prevent it, there is no chance in heck that RoS is going to do anything fruitful.

anav

Instead of trying to shove a wet noodle up a straw, come clean and state your USER requirements in a clear manner without discussing any actual configuration on wireguard. User X must be able to User Y must be able to User X must not be able to User Y must not be able to etc.... hypotheticals on wha...

anav

400Mbps is actually quite good!

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Ahh okay I didnt realize you had a small internet connection, the switch should be good for up to 300 down or so.

anav

No point in resetting anything as you have no idea why this happened and thus it will happen again.
Do you a copy of the config prior to hacking to show...........

Netinstall is the only viable method of putting a clean load, if the device is accessible.

anav

Post your config for review.

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

What router will you be using?

anav

Well generally speaking do not use vlan1, change that to vlan10 for your sanity. There should be no issue have the hapax3 running capsman but be aware the configuration when using it to run capsman is different than before when it wasnt. Too complex for me but search some threads in the wifi forum a...

anav

Rhetorical question, the answer is YES, remove work-arounds where possible. In this case, the cost/effort to remain compatible with major cloud providers is important in the support of the their CHR product line. To be fair, they cannot be on top of every issue and I am confident they will jump on t...

anav

(1) I will add dont mix apples and oranges. Once you go vlans, ensure all subnets are vlans, and thus the bridge does no DHCP etc, just bridging. Okay I see, that is what you have done, bridge ports was misleading..... Prefer......... clarity /interface bridge port add bridge=Bridge ingress-filterin...

anav

There are two options, the one that was stated as well as:
add action=change-mss chain=forward new-mss=1380 out-interface=wg-nordvpn protocol=tcp tcp-flags=syn tcp-mss=1381-65535

anav

Where is the the rest of the router config, firewall rules etc............ Would seem you need to just follow the pdf real close. Connected networks etc... The only real change I see is the special table routes. The rest seems to be close to good as is. /ip route add gateway=192.168.10.1 distance=1 ...

anav

Because............ they must be different in some way. Why not have a look at the configs and see what the difference is.........

anav

Get your hands dirty using the equipment, that will take a year, and then perhaps you will be ready to write something.
Nothing we can tell you will make a lick of sense without practical experience. Sorry have to write your own paper.

anav

The op was not asking for PCC, but more load balancing in the traditional way.
Yes you can somewhat load balance on PCC but its not as good at the pdf method which is more geared towards LB but a tad more complicated.

anav

No I dont need to tell myself on each config who is client for handshake and who is server for handshake. I am the admin I know what I have setup and can add comments if required.
These settings should only be required perhaps for BTH settings, certainly not normal wireguard setups......

anav

REMOTE OFFICE CONFIG 2. Based on Allowed IPs, assume you want the remote office to be able to use the internet of the Primary Office ??? ( as well as access subnets on the Main Office ). No, it must use its own internet and Wireguard for access to subnets on the Main Office 3. Your WAN setup is inc...

anav

For someone who is supposed to be adept at writing software requirements, concur it was a piss poor effort. I am thinking that the person is really someone who eats a lot and has developed processes that effectively allow him to get softer faster........... ( nothing to do with code at all ) Alterna...

anav

hoelvo, I cannot wait for you to ask another 100 hunt and peck questions! ;-PPP

Please post config, so we have a sense of your config.....
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

I have not played with the new settings yet but I will attempt to keep it cleaner and thus less confusing. SERVER for initial handshake allowedIPs=10.20.30.2/32,subnetA,subnetB interface=wg1 comment="client peer1 Hex home Router" public-key="key1" allowedIPs=10.20.30.3/32 interfa...

anav

Good to hear, and if you run into future issues, please post both configs /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) Allowed IPs describe three things 1. THE WIREGUARD NETWORK PORTION a. the wireguard subnet 0/24 ( at the client device peer at ...

anav

More space between units and between units and walls of enclosure and air circulating through, its not complicated.
Furthermore, look at at a portable air conditioner unit for the ambient air if you have no control over the room.
Electronics like cool but also DRY air.

anav

YOUR REMOTE OFFICE CONFIG 1. Fix error in config from: /ip address add address=172.16.46.1/24 comment=defconf interface =ether2 network=\ 172.16.46.0 TO: /ip address add address=172.16.46.1/24 comment=defconf interface =bridge network=\ 172.16.46.0 2. Based on Allowed IPs, assume you want the remote...

anav

Of course the foundation of the pdf is solid, and one only need to tweak it for RoS changes. I dont see the current config of the router to understand the setup you have vis-a-vis any subnets, firewall rules and existing routes. /export file=anynameyouwish ( minus router serial number, any public WA...

anav

Since you used chatgpt, does that mean you understand the config, or really dont have a clue??

anav

Dont agree, the 5ghz allows the flexibility required to deal with how the site provided wifi internet signal. If on 2ghz, then distribute to devices in the room with 5ghz and of course the reverse. If using LTE to capture signal, then having the option to deal with crowded wifi spectrum in the immed...

anav

Regarding the TOPIC
We have updated the manual with the Share function info (APP side) https://help.mikrotik.com/docs/display/ROS/Back+To+Home

Much thanks for these efforts!

anav

Very confusing without a diagram.
Do you mean you setup CHR in the cloud on some service??

anav

Concur, go back to basic config. Dont attempt to use RDP on your router, even enterprises have stopped using RDP with all their edge router firewalls and fancy protections etc........most if not all have moved to citrix like setups. As intimated, if you need to provide secure access, wireguard ( or ...

anav

Without seeing the main router (server for handshake ) settings, hard to say.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

I think i have one hap ax lite lte somehwhere, i will test it. If it works that is great. Mikrotik wifi is now rock solid... So WPA3 and PM is the issue here... I have an ax3 setup as a router and AP in the basement, its pretty decent with WPA2 only..... However the capac also in the basement is at...

anav

Well if you go by the title of the thread it does intimate what erlinden is suggesting, ( a wireguard server on the NETWORK, not on the router ).

anav

Along with leaked usernames which sindy pointed out, your firewall rule has an unsafe rule! Note: You have queues on both routers, this may cause slowdown if fastrack is turned on, but not 100% sure if your simple queue inputs affect fasttrack. I would test with queues on and then removed to see if ...

anav

Good to hear! Assuming that the persistent keep alive settings are only there to identify what is set on the peers themselves...... In terms of the router setup the only thing I would likely change is the access by admin. You have two separate accesses setup, and I would merge into one. There is no ...

anav

Connecting to the internet prior to having at least the requisite firewall rules in place is a fools game, unless one is into gambling.

anav

/export file=anynameyouwish ( minus router serial number, any public wanip information, keys, etc. )

anav

Two things I would change, (1) On the Client for handshake change the allowed IPs from 10.1.38.1/32 to: 10.1.38.0/24 (2) The allowed Ips cannot include 10.0.0.0/8 on both routers! It is ONLY to identify either a. remote subnet that local users need to reach OR b. remote subnet whose users need to ac...

anav

My rules of thumb
DISABLE IPV6
Ensure there are only two IPV6 firewall rules....
add chain=input action=drop
add chain=forward action=drop

That way if somehow you inadvertently enable IPV6, or an update enables it, your ass is covered.

anav

Yes, its amazing how clearly you can articulate the facts, with so few words. :-) Simply port forwarding the incoming wg port to the lanip of the wireguard server ON THE NETWORK . Confusion stems as the OP stated he is running the wireguard ON THE 5009 In any case you can port forward to any IP addr...

anav

Hi Holvoe perhaps you understand the requirement a bit better. 1. Is the OP trying to have clients attempt to reach Server at Router B via the public IP of Router A, and then have that traffic enter a wireguard tunnel and travel to Router B where the server resides?? OR 2. Is the OP trying to force ...

anav

Sorry on vacation. Still a problem??

anav

Zyxel doesnt do wireguard??

anav

Provide a diagram as you are unable to articulate clear requirements in writing.
Also recommend stating requirements NOT in config speak but in terms of use cases and users traffic that needs to be executed.

anav

Post both configs to see what is going on. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.). Conceptually once a wireguard connection is established, both ends keep the other end up to date on the relevant WANIP. Hence if the main router changes its ...

anav

1500 vpn endpoints,,,,,,,,,,,,, I would not use wireguard as you want something more enterprise.....
Look at cloudflare options or some sort of enteprise ipsec offering.

anav

Conceptually I understand you have a third party VPN provider (proton) of which you want to send ONE IP address out the wirguard for external internet. This is easily accomplished without any Mangling. Instead use Routing Rules. 1. Table add fib name=useProton 2. Route add dst-address=0.0.0.0/0 inte...

anav

Why not host wireguard on RB3011 directly??

anav

thanks khaaleex, Im ipv6 illiterate so any help in that regard is greatly appreciated. I suppose the OP thought his brainwaves were powerful enough that we knew he was using IPV6.

anav

My bad I missed that connection point, need glasses LOL.
in that case will only work if the APs are managed and can pass vlans.

anav

Sure I understand how it works, and its simple in terms of what is allowed or not allowed, and it appears you have made it way more complex than required. When a remote user comes in you simply allocate firewall rules accordingly on the incoming side, for good security.......... Examples: wg subnet ...

anav

CHR 1. Missing local network..........in address /ip address add address=10.0.123.1/24 interface=wireguard_CHR network=10.0.123.0 add address=192.168.130.1/24 interface=bridge network=192.168.130.0 2. Adjust, simplify NAT, too messy.......... /ip firewall nat add action=masquerade chain=srcnat out-i...

anav

Treat the capac as an AP not a router......... Assuming vlan20 is the trusted subnet. There is a clue in the error in your bridge port settings *A Assuming ether1 is trunk port to Router, will use ether2 as an off bridge backup or easy management access. Remove the IP dns static setting...... /ip dn...

anav

Wrong again, many people have wired connections between APs. Very common if one is using a AP based router as an AP/switch. Even my capac has two ports so that I can wire in from the main router and yet feed another smart or dumb device from the other connection. Depends on the type of AP and the re...

anav

To be clear, users do not have direct access to this off site other company server. Your Routers fixed WANIP is whitelisted so as to be able to reach that server. First you need to establish local router access to this whitelisted server ( aka from your LAN ). If you can do this, then remote wiregua...

anav

Last I checked, there's plenty of vpn or equivalent sneaky ways to get a MT to bypass a state based vpn block, that doesnt require some 'magic' plugin for MT that "would work", but other existing mechanisms already onboard dont... Please enlighten us as most States have ways of detecting ...

anav

The connection from your 5009 to the switch via proper direct trunk port works fine. If you attempt to connect two smart devices in between some dumb devices, results are never guaranteed. Suggest your connection points include small managed switches if neeed be so it looks like 50009 -----> small m...

Search found 21236 matches