MikroTik

anav

Which Router (wireguard) acts as a server for handshake?
Do any of the routers have a public IP address, or an upstream router that can port forward?

anav

post your lastest config and perhaps a network diagram.

anav

Remove the bogus entries in Orange. Dont use input chain for rules pertaining to the forward chain, they are not needed anyway in the forward chain as we drop all other traffic. There is no fastrack in input chain. Add missing rule (in blue). /ip firewall filter add action=drop chain=input comment=\...

anav

Good to know kccc, I will email you to find out the exact time of a big earthquake or the impact of a nuclear weapon.

Wait, you may have shortwave, will give you a call over a repeater LOL

anav

BIG PROBLEM or BAD JOKE < why do you have WANIP addresses that are identical to local LAN VLAN addresses ????? If your wanips are Public IPs and static, just put in X.X.X.X and Y.Y.Y.Y, if they are private you enter them as they are not a security issue. If your wanips are dynamic then you should b...

anav

Post your complete config minus the usual, please, the snippets you show are not useful without context of the rest of the config.
I also have my doubts as to complete success...........

anav

UPDATE JUST REALIZED THAT THIS IS VERSION SIX, So need to adjust ROUTES etc...... So pay close attention to 4.5.6. etc...... (1) Okay to be clear, you can winbox in no problem its just using winbox via IP that is not working? ( or webconfig I suppose ). (2) WAN does not go on bridge! add comment=Fut...

anav

I provided a clean clear config, which you ignored. Thus unable to help further. If you had done all that was asked not just part of the mangles, then we could make progress. Not saying it would be 100%, but we could narrow further the problem areas with some certainty. The config has too many spots...

anav

(1) Why do you have your WAN address down twice ??? Oh I see the first one is disabled! Get rid of it, its garbage that creates confusion. /ip address add address=removed comment=defconf disabled=yes interface=wan-sfpplus1 \ network=removed add address=192.168.88.1/22 interface=bridge1 network=192.1...

anav

Sorry didnt realize ether5 was internet, let me rephrase...... Take any one ethernet port ( not WAN ) that you can temporarily modify ( ether1,2,3,4 ??? ) off the bridge.

So why was ether5 on your bridge ports then if it was the WAN ?????

anav

First thing to fix. Use only one bridge!! https://forum.mikrotik.com/viewtopic.php?t=143620 Simplify your life by defining at least two vlans vlan10 is trusted or home vlan vlan20 is guest wifi vlan you can add if you wish to separate out servers, or multimedia, or video cameras or other equipment t...

anav

To configure without headache do the following. (temporary) Take ether5 off the bridge ( so not identifed on /interface bridge ports or /interface bridge vlans ) Give ether5 its own IP address like 192.168.55.1/24 Change IPV4 settings on desktop or laptop and give it an Ip address of 192.168.55.5 fo...

anav

Sounds like a cult LOL.

anav

What VPN are you connecting to??
If its a thirdparty VPN did they also provide a DNS server address??

anav

Dont use vlan1 use vlan10 for example.......

viewtopic.php?t=143620

anav

Sorry cannot comment without seeing latest config.

anav

What makes you thing you know the relevant lines, if you dont know what the problem is?? Suggest full config is more useful and perhaps a network diagram. I never look at snippets, not worth my time,based on answering 1000s of posts. /export file=anynameyouwish (minus router serial number and any pu...

anav

Yes. 1. Major omission! Without this you will not be able to reach the AP for config purposes through normal networking ( winbox on base vlan etc.......) /interface list member add interface=BASE_VLAN add interface=emergaccess list=ADMIN 2. Minor omission /ip dns set allow-remote-requests=yes server...

anav

Only changes noted: 1. Added wireguard to LAN interface list. 2. Note to remove static DNS default setting. 3. Remove limitation on ICMP, not required and can get in the way of testing etc. 4. Removed blocking dst nat rules on input chain ( also were not in the right sequence anyway ) useless since ...

anav

Before doing anything fancy with wireguard. Lets get port forward working properly. 1. The easiest method which should work is the direct LANIP address that the user uses to reach the server as in their browser or particular application. This occurs at layer2 and is oblivious to firewall rules etc.....

anav

One reason to use webconfig is to see memory leakage?

anav

The only positive thing I can think of for having to go ipv6, is that I will have to go to Italy and get rextended to explain how to config then, whilst enjoying sunshine, coffee wine, pasta and of course cycling around the countryside.

anav

Since you are unable to articulate with more information I will move on.

anav

Getting there.............. So far I dont see any remote users requiring access, all the users are connected to the local router?? If that is the case then.. Assuming you have some servers on the LOCAL router? a. why not access them by direct LANIP. b. if needing to access them by DYDNS URL (represe...

anav

Typically one has the following rules. add chain=input action=accept comment="Admin config access" src-address-list=Authorized ****** add chain=input action=accept comment="users to services: dst-port=53,123 protocol=udp in-interface-list=LAN add chain=input action=accept comment=&quo...

anav

You are forgetting the point, the capacs I set manually, are RARELY CHANGED, so central managment overhead and config is wasted. Plus its far easier to setup. I can guarantee you, that the time he took to setup capsman on the controller and on each capac, was far longer than anytime I will ever spen...

anav

The advantage of netwatch, primarily, is that you can very some variables here to ascertain connectivity with more fidelity!! For example, gateway-ping checks every 10 seconds, after two repetitive nil responses, the connection is deemed not active. For many that is too long and thus netwatch if set...

anav

anav

If you dont have AX wifi, then adding capsman IMHO is a waste of time and config space. Capacs take minutes to setup and dont change very often, so capsman is overhead and complexity for in reality very little if any gain.

anav

Netinstall is sure method. Suggest you take ether5 off bridge, upon entry. Add an IP address to ether5, 192.168.55.1/24 for example. Then change IPV4 settings on desktop or laptop and give it like 192.168.55.5 and you should have access to the router. Do your config from there safely. ( ensure you a...

anav

Sorry, its all opinion until evidence is provided .........facts are needed,

anav

First, be accurate! You no NOT have an ISP modem. It is an ISP modem/router if it its giving you a private IP address on the WAN side. If you want to as much as possible direct traffic to your own DNS server, great, but keep in mind any browser using VPn proxy or whatever it is they use, can bypass ...

anav

First mistake, not using IPV4

( Dark Nate is going to crucify me )

anav

Impossible to state what is going on without seeing the config.......... /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) As holvoe pointed out, there is traffic occurring that may not be wanted, but that is controlled by the config of which you are ...

anav

Also use safemode when implementing config changes. After about 15-20 seconds, without any issues undo safe mode, to keep the changes and then turn it back on.

anav

Glad you got it working!! Last point, if you decide to add more servers, then change the rules accordingly. /ip firewall address-list add address=192.168.88.2/32 list= SERVERS comment="server A" add address=192.168.88.XX/32 list=SERVERS comment="server B" add action=accept chain=...

anav

So to be clear, the user is scanning the 10... something network and by local you mean not on your router, but the SAME network that the ISP provides your WANIP on. In other words scanning the ISPs network?? If thats the case then simply make a firewall rule. add chain=forward action=drop in-interfa...

anav

viewtopic.php?t=173692

anav

First will need both the CHR config and your home config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.). Second are you getting your external users (that need access to the server on your home LAN) to use the public IP of the CHR. dyndnsURL:port# w...

anav

You mean scans the LOCAL LANS on the router or something else??? Why would your service provider care what goes on in the local LANs behind your router??? Do you know which user? How many users do you have......... What if you created some firewall rules limiting ports to 80 and 443 ?? add action=ac...

anav

Recommend using ether2 to configure the device OFF Bridge. Below is an examplle. Change the ipv4 settings on your desktop or laptop to something like 192.168.36.5 gateway 192.168.36.1 /interface bridge add ingress-filtering=no name=bridgegym vlan-filtering=yes /interface ethernet set [ find default-...

anav

Not sure what you mean.
Are you saying that one of the remote users coming into your router is using your internet to conduct port scanning of the internet???

anav

I will send you my bill @Moba. ;-P

anav

The fundamentals are the same for most setups, the extra sauce stems from well communicated traffic requirements. You have two WANS, in the future 3 possibley four wans. You havent specified a clear plan. WHich is primary and which is secondary so assuming WAN1 is primary and WAN2 is backup. If WAN1...

anav

What you need to figure out or tell us, is what is the internet signal coming from? Does the ISP provide a modem or ONT, from which an ethernet cable is used to connection to the RB5009? If so, then the RB5009 can do everything you need and you should throw the second router into the garbage, (or us...

anav

Routers do not aggregate speed. They can provide increased throughput available to all users and provide redundancy in case one ISP is not available. Any single session cannot be more than the highest 'speed' of any one ISP connection. You are thinking of bonding etc...... Suggest your sources that ...

anav

By subnet or IP address, yes, by game type or something else no.

anav

What I didnt understand is your IP routes...... ??? What is the purpose of this config??? Specifically the routes in orange?? Dont think they are needed. Okay I see that they are disabled. Should remove clutter to a config, far less confusing. /ip route add disabled=no distance=1 dst-address=0.0.0.0...

anav

Good news, you only need one wireguard interface to accomplish all your tasks. The key is in the firewall rules for what you allow or not allow. You can put all all admin users in one firewall address list and all the general users in another firewall address list. Another option is to use two diffe...

anav

Nice to see you Sob!!

anav

Okay to do this as smoothly as possible I config OFF BRIDGE. By that I mean on the HAP AC2 for example, take one port off the bridge, give it an IP address and then attach desktop/laptop to that port by ethernet and modify ethernet card IPV4 settings. Since you use ether5 to connect to the mini, we ...

anav

Yeah scratching my head to understand WHY. Why would anyone have such a setup? Also the communication is not clear, its ONE LAN, some users have dhcp assigned, the rest are fixed. He wants the dhcp users, sent to WAN1, and fixed LANIPs sent to WAN2 Also assuming users being on the same LAN should st...

anav

The only block rules you need in firewall are
invalid traffic ( both input and forward chain)
and
last rule in each chain (everything else)

All other firewall rules should be about allowing traffic ( default rules + admin traffic desired )

anav

You do not need BTH.
Just configure Wireguard manually/properly.

For example, you have no ALLOWED IPs setup that I can see.

Also do you have the particulars of the setup of remote peer clients??

anav

Well if you try to access the camera via the LANIP address of the camera it should work fine. If you are trying to use the same DYNDNS URL there could be problems. If users are in the same LAN as the Server then it will not work without modifications. Easiest is to move users or server to different ...

anav

Just to be sure I understand. Your router has a non--public IP address. The wan is either like CGNAT or a private IP from an upstream ISP router (which you cannot forward a port on). What you want to do is while away from home remote into the router, via wireguard, and access the LAN, and most likel...

anav

Clearly 'hiding' the true mac address............ Perhaps you prefer

"FU:FU:FU:FU:FU:FU" "=)

anav

You didnt answer any of llamajama's questions, so if you want help.............

anav

The function of sourcenat is not ROUTING, so cat is bang on. This is a simple case of subnet A should use WAN1 and subnet B should use WAN2. questions. 1. the majority of traffic will be through WAN X ?? 2. What happens when WANA is not available do you want all traffic to go to WANB 3. What happens...

anav

Network diagram please, I have no idea what your doing,

anav

1. vlan-filtering on bridge not turned on. add admin-mac=xx.xx.xx.xx name=bridge vlan-filtering= yes Then it goes downhill............ 2. How can you have 7 VLANS but 10 Pools, 8 DHCP servers, 8 IP addresses, 8 dhcp server networks, some pools seem to overlap (192.168.41.......) 3. Firewall wall are...

anav

post your latest.

anav

Well when you have to have a consistent config, and plan.
You are stuck between assigning subnets to ports, and having vlans.
Suggest if you are considering doing vlans, drop subnets to ports.
If not, then drop vlans.

Let me know which way you go as I dont want to waste time.

anav

What I hear is that you have 3 wan connections that you could use to server all LAN users. Separately you have some layers of further requirements - use WAN2 for external users to reach LAN servers Its one router so there is no separate router concept. One uses the functionality and tools available ...

anav

Do not tie ISPs to ports, so inflexible an approach and is not based on requirements but not understanding how networking actually works.
ONLY need to
a. identify user/device or groups of users/devices
b. what traffic flow they required

anav

Thanks for the answer, my question was poor.
Assume my question has nothing to do with the APP, personally never have.
My question is regarding the router! I have never turned it on and it does not prevent my access via iphone.

anav

WAP1 /interface bridge add name=Bridge1 protocol-mode=none vlan-filtering=yes /interface w60g set [ find ] disabled=no mode=bridge name=wlan60-1 password=PASSWORD put-stations-in-bridge=Bridge1 ssid=SSID /interface list add name=TRUSTED /interface list members add interface=VLAN100 list=TRUSTED /int...

anav

Hey Ammo, I use an Iphone and have not used this functionality. How would it make the experience better???

anav

You will need to change the Routing Rule on Router B, the action option......... to just lookup /routing rule src-address=LANIP action= lookup table=useWG The current rule will prevent the router from using any other routing. In other words, you DO NOT NEED any script to enable local use of the WAN ...

anav

Is BTH programming, interfering with normal wireguard use? BUG? Unable to successfully mangle traffic coming in on WAN2, back out WAN2 for wireguard handshake, when WAN1 is a primary WAN. Return traffic appears to be sent out WAN1 instead, iaw connection-tracking and inability to access config from...

anav

Well mozerd there are two different things at play here. The connection coming in to the Peer ( server for handshake), on WAN2, getting marked connections, should then result in return traffic from the wireguard module, also with marked connection and go out WAN2. IF there are NECESSARY BTH connecti...

anav

The big change on Router B seeing as you want internet access but out Router A is changing Allowed IPs........... Many other small changes............... read line by line Simplified firewall rules!!!! For single subnets avoid interface lists............ in general. interface bridge add name="L...

anav

Basically a cloud server operated by Mikrotik, connects the two ends, so that they can punch out of a connection they have which is not public and reach other.

anav

BTH is for the scenario where both ends of the MT tunnel do not have a publicly accessible WANIP ( either on the MT device, or can port forward from the upstream ISP router )

anav

Yee of little faith LOL.

Now the next step is ensuring LAN from Router B, goes out the WAN of ROuter A for internet ( via the wireguard tunnel)??

anav

You have got to be kidding!!

DO NOT Use VLAN1 for management, its already in use in the background by RoS.
Use any other vlan for management and data.
example..
viewtopic.php?t=143620

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Understood, but for me adding extra rules like mangling can interfere with testing other things, especially if you have errors in the mangle. (compoundinig), not that there is,, just sayin. Your first attempt at correction isnt right on both accounts......... attention to detail please!!! Router A. ...

anav

Not very useful, those "I don't understand why you would want that, so you should not want that!" replies.= read again, and then one more time............ its not dont want, its cant because dont understand, so need different wording. very few people here actually word requirements in cle...

anav

Suggest provide a network diagram to help visualize the equipment/devices and ISPs involved etc... EDIT: I see link above now........... thanks You have three Devices, only shown partial config of one need to see all three /export file=anynameyouwish (minus router serial number, any public WANIP inf...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Login using the mac only? Without the config, not much one can advise.

anav

Network diagram often helps understand what you are doing,
need full config
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

-Disable ipv6 and remove all associated fw rules if not using ipv6. -FIrewall rules are a bloated mess concerned with blocking things more than allowing only needed traffic, but not the issue here. Your wireguard is configured incorrectly. Allowed IPs is used to decribe the remote side ( either subn...

anav

Which WAN, A or B has a public IP, static or dynamic that is reachable. If neither does, does one of them have an upstream ISP router that you can forward a port on? If both have a publicly reachable IP, which one do you want to act as initiation peer ( client for handshake) and which one do you wan...

anav

Rplant. I am not using packet marking. I am using mark connections.

anav

Where is the rest of the config, firewall rules, NAT, etc.....

anav

Your config is wrong, more advice if you provide network diagram and configs of both routers.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys )

anav

Your explanation makes little sense especially these lines and because you dont provide complete config, hard to figure it out. -- FW address-list for WAN is "RB5009" on both routers. -- FW address-list for LAN is "RB5009-LAN" on both routers. -- FW address-list for WAN is "...

anav

Not interested you use multiple bridges and vlan id of 1.

viewtopic.php?t=143620

anav

Is your device a router or a switch ( model and firmware ) and normally the setup is one bridge.......... https://forum.mikrotik.com/viewtopic.php?t=143620 would also need to see config to comment further /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys et...

anav

terminal in winbox

/export file=anynameyouwish

Find it files and download to your PCC.
open in notepad++

Remove the router serial number and any public WANIP information with X.x.x.x
Remove any keys aka wireguard, and no need to include long dhcp lease lists either.

anav

Playing the one million block subnets game is a waste of time and energy. Simply change the default rule that comes with the router. All subnets are blocked immediately at L3, and all one needs to do ( and should do ) is focus on the traffic that is allowed!! From: add action=drop chain=forward comm...

anav

So the CRS310 is acting as a router getting its WANIP from pensense and then creating other vlans???
Cant do this on fritz box or opensense??

anav

Network diagram, config etc............. dont know the scope of what we are dealing with here.

anav

That is correct, the mangles, dont work as the traffic coming from wireguard is not connection marked and thus must be originated by the wireguard module.

anav

No idea what you are talking about rplant. There is no such thing as wireguard port. What I would like explained is the first routing rule you have, what is its purpose and what does it do?? +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ By the way, since we believe its wireguard ...

anav

post current config
/export file=anynameyouwish ( minus router serial number, any public WANIP, keys etc. )

anav

The router is not doing anything wrong, but it seems that wireguard is doing something unexpected!
Interesting comment about routing rules........... not sure one could help in this scenario but you do have me thinking, but in the end, there is no port
to make use of in routing rules so a dead end.

anav

One bridge, connect the wifi and ssid to a subnet, aka a vlan.
Then using routing rules push that traffic out WAN2.

Search on the forum or yuoutube many examples of dual wan.

anav

Both cases will use main. Mangle has no effect in either case is what I'm saying as WG in kernel already processed it. e.g. it not just keepalives that use only main. Did this setup work in some older versions (e.g. before BTH)? Not 100% sure. I have never stumbled across it before, or at least rec...

anav

It happens with persistent keep alive OFF on both ends....... ( whats left BTH shenanigans )

anav

Sadly I may have run into what you are talking recently. --> viewtopic.php?t=206511
I;m convinced (without proof really) that its due to BTH coding as I could have sworn it worked before on version 7 early days!!

anav

I would agree, use the main primary WAN for the majority of traffic in this case your WAN2 would be primary, WAN1 secondary and used for VPN.
Do you have specific subnets going out the VPN,,,,,,, what are the use cases for it...........

anav

I have a regular scenario where WIREGUARD should come in WAN2, despite WAN1 being the primary Route. Case in point, an AX3 as peer (client for handshake) to a CCR2004 peer ( server for handshake ) Easily handled by basic mangling and table and route. /ip mangle add chain=input action=mark-connection...

anav

Too much for me. I like the on and off button.

anav

Nix on that,,,,,, if the clamp rule doesnt work next try
add action=change-mss chain=forward new-mss=1380 out-interface=Wireguard protocol=tcp tcp-flags=syn tcp-mss=1381-65535

anav

I wouldnt lower the mtu right away, instead I would keep both ends at the default 1420 and add a mangle rule to the french side. / ip firewall mangle add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=Wireguard passthrou...

anav

Because if you have lots of users, its easier to give them and have them remember a name than a number.

blowbluckeye.orgasm:69 for example, unforgettable.

anav

okay machine by machine basis means you have to mangle in most cases.....
Thus use of firewall address list makes sense. If it was just a few, routing rules would work.......

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

send Normis booze. Perhaps if he is drunk enough he will approve it.

After all it was released in 2018 !!!!

https://www.a10networks.com/glossary/ke ... d-tls-1-3/

anav

So mkx, The user on teh browswer sends hit request. The router B DST-NAT rule intercepts the request and changes the destination IP from a.dyndns.com resloved IP, TO the local server on device A. Transparent to the user. The router know that the traffic for that subnet needs to go out wireguard inte...

anav

Besides the usual bloat of filtering to block traffic instead of simply allowing needed traffic and drop everything else.... I am curious, as to how you separate those needing access to the tunnel. Firstly which router is server for handshake Which end needs to access the internet of the other. Are ...

anav

Hi Chechito not sure hairpin or what applies here, I get muddled trying to work my way through it.

anav

Persistent keep alive is required on the client ( for handshake ) peer and not on the Server (for handshake) peer.

anav

Amen brother!

anav

Are your devices internet facing, with such sparse rules??

anav

Sorry both are kind of either wrong or confused LOL...... You have a static Private IP set on IP address for ether1 and you have IP DHCP client turned off. I think what you mean is that you actually have a private WAN IP address provided by the upstream ISP modem/router (via its LAN subnet) and the ...

anav

Two options.
budget: hap AX3, just disable wifi if dont need, it. Will handle a 1 gig WAN connection
Better: RB5009, good for up to a 2.5 gig WAN connection
PRO: 2116, mouthwatering performance

anav

Well either their ethernet results failed to include performance via L3HW offload and this is a brilliant router replacement, or their ethernet results are good and no one should fool themselves into thinking these are viable 1gig ethernet router capable, is all I am saying. Perhaps someone with a 3...

anav

I will see if there is more uptodate L3HW offload video available................... I just want to make sure advice is accurate and not a guess or wrong.......

anav

Yes I know HW offloading is available on some routers and now edumecated that L3HW offloading is also available on at least one router. But it just proves my point, you were unable to answer the thrust off this and may other threads where people are using switches to do routing and wondering why L3H...

anav

So, it seems that my devious plan is foiled mainly by the fact that I want to bridge native VLAN with other VLANs . I can create a VLAN interface with id=1, that's for sure. But it appears that it's either not capturing traffic, or outputting traffic with tag present with vlan id set to 1, or both....

anav

Very nice MKX, you missed the boat and the barn, as we are talking about switches, and you bring up a ROUTER, not a switch.
None of the CRS3XX series of switches then has L3HW offloading if I had to base it on ethernet test results ( very slow ).
So once again I am searching for some truth and facts.

anav

Ahh I think I get it.... Your dstnat dst-address-list=a.dyndns.org dst-port=81 to-address=addressofserver on Device A. Then the router sees the to-address on a known remote subnet with the following existing route add dst-address=subnetofRouterA gateway=wireguard routing-table=main. Nice!! Just want...

anav

nm duplicate

anav

No wireguard is not a regular subnet and has no etherPorts associated to it.

anav

one ssid per vlan, thus depending upon which SSID they sign into determines which vlan they get connected to.

anav

Two good references for some background.
DRY: viewtopic.php?t=143620
VID: https://www.youtube.com/watch?v=YLtGQAQ8iS0&t=414s

anav

Nice setup. Clearly the problem is the pfsense. Its butt ugly and capricious ;-) Assuming you have a. a management vlan where all smart devices get their IP address from. b. trunk port carrying all vlans (tagged) to first 310 switch, this is a piece of torte. c. the below example applies to all thre...

anav

Sirbyran, lets make it real, ..................... OP Quote: " ...... i have internet working right now for my AT&T Business Fiber internet, but i'm not getting the full gigabit up and down i'm supposed to be getting MT SPECS reality.jpg ...... WITH NO Rules, the OP will only achieve at bes...

anav

Yes, you dont need DDOS on your router, it is the responsibility of upstream providers to do such work. More than likely a misconfigured config is causing issues. Get rid of the bloat and life will be easier. /export file=anynameyouwish ( minus router serial number, public WANIP information, keys et...

anav

4. Why so many management ports on hapaC?? take ether5 off bridge and also make this an emergency access port. 5. /interface bridge port add bridge=BRIDGE ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether1 comment="trunk from Router" add bridge=BRIDGE ingress-filteri...

anav

You can always push VPN tunnels ( EOIP/gre or IPIP/ip-encap with ipsec word, or wireguard etc..) through the 60ghz link

anav

RoS feature I would quietly retire.

anav

The quality of the response is directly proportional to the quality of information provided to elicit a response. Its not your fault, that the MT barons, do not have a quality standard of posting, avoiding first posts bereft of facts. To better understand your situation, it would be best to provide ...

anav

Why would you use a switch for routing? Quick answer, No!

anav

Dont make promises to clients you cannot keep. Unless the client wants to spend a shit ton of money on a very expensive router and and expensive subscriptions...........

anav

Correct, since maybe 7.12??? not sure when but there is no longer a need to do this on the client (for handshake) peer to re-establish connectivity with the Server ( for handshake ) peer.

anav

viewtopic.php?t=206376#p1067396

anav

emunt please stop, this is not a guessing game. we provide advice based on facts/evidence.
Cat is bang on, we need to see the config to ascertain potential problem area(s).
A config is integrated and thus needs to be seen from the 'whole' perspective.

anav

/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1

/ip dns
set allow-remote-requests=yes servers=1.1.1.1

anav

SPINE: /interface wireguard add listen-port=13299 mtu=1420 name=wireguard-S /ip address add address=172.16.0.100/24 interface=wireguard-S network=172.16.0.0 /interface wireguard peers add allowed-address=172.16.0.200/32,10.20.100.0/24 interface=wireguard-S public-key=\ "sxxxxxdfsd" comment...

anav

Easy to do, why not do it on the main router. Do you have a network diagram to share?
Also is the WANIP on the upstream router publicly accessible??

anav

??????????? There is no DHCP in wireguard, its not a regular type of subnet, its really an IP address and an interface. (1) Allowed IPs on spine are incorrect, a. you need to put the actual IP assigned to the leaf peer ( and any remote subnets local users are visiting, or any remote subnets visiting...

anav

How are they all connected, at least provide a diagram.
Are all devices (acting as clients at handshake) connected to a MAIN router ( server for handshake), if so then we need to see its config.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys,, etc.)

anav

Lets see the config please, without facts its just an opinion.

anav

Will need to think if there is anything required for incoming wireguard traffic, but not at the moment. I dont believe you have outgoing wireguard traffic, just traffic to the router for config purposes or do you also reach LAN devices. If so many, need access to all ???

anav

I gauge discipline and attention to detail to get a sense of the OPs, capabilities and focus. So far not doing so well. Not surprized no improvements yet. (1) This is still not fixed. (should be NONE ) /interface detect-internet set internet-interface-list= WAN lan-interface-list= LAN wan-interface-...

anav

Yes, I unchecked it for both. Not sure what that does but seeing as I am using it as backup config access to wireguard, maybe not so critical?? I mean its only for the connection not other traffic.
More straightforward than SSTP actually. I like it.

anav

Hi Ammo, I was able to establish an IPIP with ipsec secret with one fixed WANIP and one dynamic Wanip ( and gain access to config via winbox ).
Dont have any cgnat to test however.

anav

Successful connection between one static and one dynamic IP using IPIP and ipsec secret.
I established a winbox connection over the link!

anav

viewtopic.php?t=143620
viewtopic.php?f=2&t=173692

anav

Suggest a diagram which details equipment being used, subnets in play, internet source, port usage etc..........
Suggest a set of requirements to:
a. identify all the users and devices, including the admin
b. identify all the traffic the users/devices need.

anav

Not sure what you mean............. The bad situation is where the connection to the ISP is up but the ISP is not connected to the WWW. In this case the router has no idea. If the connection to the ISP is down, the router will see that and make the route inactive and your backup will be utilized. It...

anav

Serious, even the CR2004 cannot do 2gigs with fastrack disabled.
Okay, I just sent a suggestion to MT, to add 25 filter rules fastrack-off LINE to results so people can match up expectations and purchase an appropriate router.

anav

Please ignore quickset so we can focus on a working config. Unless your a squirrel :-) (1) Added back NAS on port 443 to the config. (2) This had no meaning.......... /interface bridge port add bridge=BridgeLAN ingress-filtering=no interface=BondingNAS \ internal-path-cost=10 path-cost=10 add bridge...

anav

Lan interface is not a bridge port by the way........... Also cannot make heads or tails of this dstnat rule. add action=dst-nat chain=dstnat comment="NAS Channel" dst-address=\ 61.219.84.108 in-interface=sfp2 log=yes protocol=tcp to-addresses=\ 192.168.88.220 to-ports=0-65535 You want you...

anav

Your config makes no senses, its a patchwork of nothing that fits together.
You need to make a coherent plan way before starting a config.

anav

Correct, the Rb5009 is capable of handling up roughly 3gigs. Surprizing it loses so much steam by turning fast track off.
Its fair to say that MT should include another line entry in their results pages
25 filters (fasttrack off)

anav

What if you wanted to do EoIP on top of wireguard and add RoMON?

anav

quickset=quicksand

anav

Question not answered, why do you have three WANs??
If you dont have a priority WAN and the other two being backkup what is the thinking?
If you want Lan users to be able to use all three WANs then that is a load sharing setup for the wans.

anav

Okay, same gateway three different WANIPs, from same provider. 1. what should be the priority of WANS? ( all used equally or one only etc and the rest are backups in terms of normal outgoing LAN traffic....) 2. you have servers, and they are to be accessible by different wans correct........ 3. any ...

anav

Dont feed the trolls.

anav

There is nothing weird going on, the router is simply working in accordance with the rules you have made.
To comment further
/export file=anynameyouwish ( minus router serial number, any real public WANIP info, keys etc.)

anav

Would need to see both MT FULL configs............ the first and second MTs. Do you have a management vlan organized on the First Router ( or trusted subnet) where all ( both MTs should get their Ip address from ). /export file=anynameyouwish ( minus router serial#, any public WANIP information, key...

anav

Post both configs
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long dchp lease lists etc..)

anav

What use case for traffic flow are you trying to describe. In other words what user needs their traffic flow so contorted??

anav

Again, not clear. Do you mean the ISP has a modem router and has a lan subnet, and thus gives the first MT router a private IP on that subnet and you wish to also have that subnet reach a second MT device.? Meaning the First MT device is acting as a router with some of its own DHCP subnet but also o...

anav

So you can program only through controllor software, is there a user guide for that??

anav

Of course not! The problem seems to be not having a concrete plan and understanding of the requirements before implementing No idea of your topology, network diagram not provided. ( gives us a visual feel for the plan ) No clue as to where internet comes from, which device is routing etc etc..... Fi...

anav

Of course the WG tunnels would always be active. YOur work or home router would serve as the Server for handshake and all the client devices would have persistent keep alive set. You dont even need a separate wireguard interface for all your devices either. You can separate them by IP address..........

anav

I would get rid of the unifi switch and get a real one. A plain jane cheapo TPlink managed switch works better or more sanely that the unifi. Or get a CRS3XX switch from mikrotik or send me a copy of the switch User Guide ( I cannot find one ) and then I can figure out how to setup it so it works pr...

anav

To be clear you have a block of IPs from your provider and you want to use one for the first router and another for the second router??

anav

yes, but in your example the input chain rule (traffic from the other public IP), limits by protocol GRE..........
In the case of IPIP, are you saying simply let a public IP address access the input chain, without port or protocol limitation ?????

anav

Regardless, a trusted homesubnet works just fine!! No need to create extra work for nothing really. Just ensure all smart devices get their IP from trusted subnet. Why you cannot reach the capac from behind the draytek is most bizarre but the issue is probably still the switch Negative on the dumb d...

anav

Ahh so fast path may be fine for IPIP then. All I want to do is a poor mans version of wireguard to access the router for config purposes as the other end, with least amount of fuss. assuming I can do that by lets say 172.16.0.1/30 is IPIP of main device with public IP and 172.16.0.2/30 is ip addres...

anav

On an MT router it would be easy to make a firewall rule. add action=accept chain=forward src-address=lanip of your pc (static lease set) dst-address=192.168.0.0/24 On draytek probably a similar filter rule is possible. DIRECTION: LAN to LAN SOURCE: SourceIP --> your PC LANIP DESTINATION: VLAN2 Subn...

anav

You might see a slightly better (marginal at best) roaming experience but its not fully fledged as its the older drivers which are missing some of that capability so not worth it IMHO.
Feel free to pull your hair out though!

anav

Nice!!! questions already asked there..

anav

Okay got it thanks.......... I specifically want to avoid the extra overhead of GRE, if possble, but will acquiesce if not possible. Also one can go into the default ipsec config and improve the security settings, for example would change the DEFAULT PROFILE SETTINGS TO a. HASH proposal (from SHA1) ...

anav

AMMO, can you test with IPIP instead or at least tell me how to do so beyond the standard settings. aka. for client site with no static public IP --> what do I put for local address?>> aka. for server site with public IP --> what do I put for remote address?? What additional firewall rules are requi...

anav

Since its older wifi from MT, simply recommend setting up just like the first one. It will take only minutes and it will b up and working right away. I avoid capsman because its a quagmire of frustration and complexity. If I had multiple AX wifi devices all using the same new drivers, I might consid...

anav

The management vlan is 2, so thats a problem right there........ You need to properly configure the switch, for example it should have its own address as 192.168.0.XX in the vlan2 subnet!!!

I cannot ffind an easy link that shows the management/setup of the software on the switch.......

anav

Hahahah, so you have a unifi switch in between.
What is the setup for the UNIFI then,
What is the managment vlan on the UNIF etc.......

anav

Figured as much. Just to let you know. If all the vlans are coming as trunk to Mikrotik device, all your vlans should be working on the capac now. Just confirming the only problem is reaching the capac wired behind the draytek using winbox????. Lets do a test! Modify one of the wifis lets say CHANGE...

anav

Y:ou have to be more clear than that sir, I have no idea what you mean by this ..... But still need use the CGNAT'ed remote address on the "static IP" side Take as many sentences as you need so the layperson (me) understands what you mean. Also any reason why I should not be able to do sam...

anav

Id be interested in your only one side needs public IP teaser. Please elaborate!!!

anav

That is correct the CAPACs address is on the BASE or management vlan. The capac is set correctly. Winbox on a the same LAN behind the draytek should see that IP and you should be able to ping that IP. If not, the issue is with the draytek setup. why does your LAN 1 have Vs hard coded instead of chec...

anav

Dont forget to tick the ipsec security otherwise you are creating an open hole at both ends.....

anav

How long does power go out? A UPS may be better.

anav

post config not snapshots
/export file=anynameyowish (minus router serial #, any public WANIP information )

anav

Yes buy a plugnPlay Asus router LOL

anav

I would use EOIP or IPIP before SSTP, but both of those require two publicly reachable IP addresses at both ends, which removes about 95 of use cases, I run up against.

anav

Not the same situation at all, you are using the hex mainly as a switch it appears so would need to know whats coming into the trunk port on the hex ( which vlans etc ) and see the config of the hex as well.

anav

Add manually by mac address

anav

Yeah but without certificate how safe is it................. As for IPIP sounded better, more secure than SSTP without certificate BUT, a big BUTT, is that it appears BOTH sides need to have publicly reachable WANIPs ( and maybe even static ones ). All the clowns at MT and youtube always show the ea...

anav

Interesting proposal I always used SSTP ( mt to mt approach ) without certificates as my preferred Mt to Mt backup to wireguard.

Search found 19522 matches