MikroTik

anav

I wondered how its been used for many years with such a misconfiguration............
Which leads one to conclude we dont have a complete picture as well.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Not a sweet clue of what you are attempting sorry.

anav

I would never rely on NAT and an ISPs modem to provide security. So yes, I think you should add the standard set of firewall rules.

anav

@Normis. note: ensured that mac-server win-mac server included Trusted interface note: ensured Trusted interface list included back to home interface. note: ensured input chain rule for BTH subnet allowed ( although have few rules on my hapax3 and no drop all rules) SUPOUT SENT --> SUP-176739 .... I...

anav

The party line:
https://www.youtube.com/watch?v=a_8AV6vIDYQ
https://www.youtube.com/shorts/LEjg54S_C0M

https://www.youtube.com/watch?v=-kNHtlOb5n0&t=52s

anav

One problem is duplication of WAN, either use IP address OR ip dhcp client, NOT both!!! /ip address add address=192.168.1.1/24 interface=lan network=192.168.1.0 add address=192.168.0.200/24 interface=WAN network=192.168.0.0 /ip dhcp-client add interface=WAN Is this device your router? No firewall ru...

anav

Disagree..... ether1 should NOT be part of the bridge ports or related settings, its WAN and nothing to do with bridge. On the other subject. when you create /interface bridge port for access ports and enter the PVID, the router dynamically includes the required untagging on corresponding /interface...

anav

https://forum.mikrotik.com/viewtopic.php?t=143620 On the router side yes, vlans ( interface bridge vlan ) need to be tagged for bridge and for any trunk ports ( and hybrid ports) When using bridge vlan filtering on switches aka 300 series, only the management vlan needs to be tagged on bridge. NO, r...

anav

edit NM. answered a post from page one LOL

anav

Are you familiar with RoS and the use of bridge vlan filtering, as it would be strange to make any assumptions based on limited knowledge?

anav

viewtopic.php?t=143620

anav

There are many examples of such in the forums, and also a ref with examples.
viewtopic.php?t=143620

anav

Sorry for many questions, but just getting deeper into BTH. Why and what traffic is coming in from the dynamic BTH interface that is added? I created BTH on the phone, all works. Then I switch the phone off and would assume no more traffic is coming in/accepted on the input chain. But not the case ...

anav

@ Edpa 1. *) bridge - added interface-list support for VLANs; Does this mean we can now list the bridge as an interface list member and this will include all vlans attached to the bridge? 2. *) bridge - enable faster HW offloading when detect-internet is disabled; Will faster HW offloading also occu...

anav

Understood, no worries. Most are not picky like me.

anav

When you are willing to change your config to the optimal one bridge approach - all vlans associated with bridge, will be happy to assist.
viewtopic.php?t=143620

anav

Do you use netwatch?

anav

So you have servers on one subnet. a. are users coming to the servers from external? b. are users coming from same subnet as servers? c. are users coming from the other subnet (where pi is located) So no traffic ORIGINATED at severs, only responses to incoming requests?? ( except for NUT client orig...

anav

@OP: Still waiting for requirements because I have no clue as to what you mean. As for no-mark, not sure what you mean TDW but that is a separate discussion..........

anav

I dont bother looking at snippets....

anav

Hi Davide, excellent start. A good article to read on setting up single bridge vlan filtering is ( the rb4011 is old and if you are spending money the RB5009 is much better investment ). https://forum.mikrotik.com/viewtopic.php?t=143620 I recommend taking one port not used off the bridge, giving it ...

anav

cannot comment as I dont know what the rest of your config looks like. As a new person be aware that the config is interrelated and parsing out bits is not exactly useful.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long dhcp lease lists)

anav

Define a few devices... a. 5 or less, 5-10, more than 10 ?? b. a whole subnet?? Normally a source address list with mangles is the way to proceed. It may be more optimal to use routing rules depending additionally I don't work from snippets /export file=anynameyouwish ( minus router serial number, a...

anav

Detailed network diagram would help understand.

anav

MT users are not ordinary people.

anav

I do not understand what you mean by avoiding assymetric routing, that is not a requirement that is anxiety and fear configurating. So . a. identify users/devices, external - internal including admin b. identify traffic they require to accomplish In terms of WAN, public/private IP, dynamic/static IP...

anav

Okay when I get home but here is the simple explanation. No BTH on hapax3. Go to IPHONE ensure I am on trusted WLAN that can access router. Open BTH, create new VPN I have to login to do so, and successful login completed and I add name of the tunnel. I close the APP for now. I go to the router and ...

anav

Only implement what you understand, feel free to ask questions.........

anav

A diagram would be helpful but basically, a big I THINK............ a. the mikrotik has a public IP and internet b. an openwrt router gets a private IP on its WAN side from a LAN on the MT. (ETHER1 on OPENWRT, ETHER2 on MT) c. the openwrt connects to a third party provider VPN (could be multiple sit...

anav

My recommendation is that the WG connections at both ends have the same MTU. Then the client peer device (if a router) aka NOT the server peer for handshake, should set the rule you stated. There are two variations to try.. ..... add action=change-mss chain=forward comment="Clamp MSS to PMTU fo...

anav

I know nothing about multiple WANIPs coming in a single port, but think using srcnat to direct where the servers are sending traffic to is the wrong approach?? Or did I just misunderstand the intent of sourcenat for this niche case??? As i want to also want to have traffic that's leaving that server...

anav

Looks good so far.............. 1. ADDITION /interface list add name=TRUSTED /interface list member add interface=LAN list=TRUSTED add interface=wireguard list=TRUSTED 2. firewall rules: Think about these three rules, the first two are rendered useless by the last rule. add action=accept chain=input...

anav

I am confused. It would appear tthat the two L009 devices are physically connected already?? There is no requirement I can see for them to see each other over wireguard??? Your explanation is weak. Of course you have a public IP, there is no way to reach VPS without one!!! THe public IP may only be ...

anav

Now --> purchase CHR license and rent cloud server ( using wireguard and will allow multiple connections from field devices and you ) Cost of CHR license one time, recurring $7 per month Now --> purchase ARM hex refresh and start accessing devices remotely using the built-in BTH wireguard VPN. $69 o...

anav

No worries,,,,,,,,,, THe only thing I do not understand is the weird networking schema. /ip address add address=192.168.47. 194/27 interface=vlan475 network=192.168.47. 192 comment="trusted vlan" I cannot netmask myself out of a paper bag and if it doesnt look like this, i get easily conf...

anav

The setup I gave you is gold and will work 100%,
Just work from an OffBridgePort to complete the configuration.

anav

I just helped a chap setup his 326 and it works like butta.
Chechito needs stop eating some many chitos LOL, they are preventing synapses from firing.

anav

actually the switch setting is NOT needed, hw offloading happens automagically on the 326 when setting up bridge vlan filtering

anav

maybe in your switch the config end up doing L3 forwarding, if you need that you must configure L3 Hardware Offloading

L3 Hardware Offloading
https://help.mikrotik.com/docs/spaces/R ... Offloading

for a 300 series switch??? What L3............... its all layer 2

anav

The reason I recommend the CHR approach, or BTH VPN for that matter is for privacy. Zerotier is still traffic going through their servers and some companies may be leery of someone tapping into their networks without complete assurances of privacy Disagree with AMMO, CHR is easy peasy and works well...

anav

You will not be able to use wireguard since you dont have a public IP. BTH wireguard a viable solution normally, but wont work either because you need an ARM or tile device. Your best bet and would support ALL the devices you need to monitor is to one time buy a CHR license and then put that on a re...

anav

Sorry not much more I can do until you make changes .......
If you need live assistance contact me on discord

anav

I have a very basic almost nothing firewall on the HapAx3 so shouldnt be an issue, no drop rules etc..
I will entertain a reboot, but not a reset, dont want to monkey with other config settings .................

anav

-Why do you not show spf-sfpplus4 connection on diagram??? -Added ingress filtering to /interface bridge port settings -you have the wrong vlan tagged with the bridge, if 475 is your trusted vlan, then only it needs to have bridge tagged in /interface bridge vlan -not absolutely necessary but add sf...

anav

@NORMIS, what is the trick of connecting to the router itself to create shares?? I can connect via VPN but after hitting manage shares, the login I provide (triple checked) and same one used to create the tunnel in the first place on the phone) is REJECTED ????????

anav

I am trying to follow the MT documents. The method that MT recommends is using the smartphone to generate other remote user accounts and to then pass them the link/url/qrcode via the phone. Trying to do it manually via creating the tunnel on the MT by enabling etc...... defeats the purpose of my tes...

anav

I just deleted and recreated from scratch the tunnel via my iphone. Dynamically created a. the iphone as peer .3 and with ALLOW to LAN yes. b. dynamic sourcnat rule for the tunnel c. dynamic input chain rule for the handshake. d. NO forward chain rule e. NO firewall address list f. dynamic ip addres...

anav

Okay got it. On the person I was assisting the dynamic block rule exists, but we couldnt get rid of it, (not able to delete rule) very weird. I didnt look at the firewall list itself, ran out of time, but I imagine invoking allow LAN or not allow LAN should modify that list ( add or remove peers). I...

anav

The better approach is to allow the MAIN router do its thing a. provide dhcp to all vlans b. provide firewall rules determining which vlans/devices get access to internet and other users/devices c. use the MT device as a switch - gets its IP address from the management vlan - simply passes through t...

anav

If you have the right router arm/tile etc you can use BTHVPN to connect to your network remotely from your smartphone or laptop etc... Looking at your diagram you should replace both switches with manageable switches, and then you can apply vlans throughout your network and isolate all the users/dev...

anav

Someone else will have to answer your zerotier questions as I have little experience.

Looking at your diagram from the other thread, it would appear you are stuck with switches that dont provide guaranteed vlan performance.
Suggest a pair of hex refreshes are decent cheap managed switches............

anav

1. Do I need to keep the IPV6 addresses, even though I am strictly using IPV4, in other words does MT relay server require that for all devices?? 2. The dynamic firewall rules are flaky. If I, after creating the user, change the LAN allow in IP Cloud settings to NO, it is too late. No firewall rule ...

anav

Just to confirm, can you add vlans to the ISP home router? Brand and model of router??

anav

Proper gaming sites will work just fine such as Steam. If you were running your own gaming site, then yes it would be problematic, but doing so is foolish as it just invites hacking and eventually getting shut down by your ISP. There is a reason why such gaming sites are mainstream and large entitit...

anav

I would look at a. zerotier as its available in RoS for any networking things you want to do........... ( basically puts all joined entities into a layer2 construct together ) b. BTH VPN this would be used for you to remotely configure the router from any device externally ( smartphone, laptop etc.....

anav

The config is what I call in-between. Not properly setup as a router ( missing address for WAN address OR setting for dhcp client, OR pppoe setting ( one of the three required ). No routing either for router setup. No dhcp server for any LAN traffic either. Not properly setup as a switch There is no...

anav

Which is your management vlan. I see you have data vlans 401,402 and 403 on the unifi and then vlan1. Since unifi expects the management vlan untagged, simply do the following. Lets assume on the MIKROK TIK you have a management vlan99. We simply untag this vlan to the unifi on a hybrid port with vl...

anav

/export file=anynameyouwish ( minus device serial number )

anav

The dynamic firewall rules are annoying, They cannot be moved. Also the block list forward chain rule should only show if the ALLOW LAN has not been selected.
Still working my way through this functionality..........

anav

I am still on winbox3, winbox4 is not ready enough for me to use. 1. Only one interface list name is used (TRUSTED) remove /interface list add name=WAN add name=LAN Similarly the interface list members should be modified too ( why are you not implementing changes? ) /interface list member add commen...

anav

Purpose: If its to use internet from a different location there are many that offer wireguard. Purpose: If its for external users to reach your router by using public IP address of a router in a different location, not aware of any............ ( did you consider zerotier ??) (you could rent your own...

anav

No network diagram?
Which vlan is the management or trusted vlan

anav

Well I had no issues starting up IP cloud on my hapax3 and then creating a BTH tunnel so the service seems to be working.

anav

Draw a network diagram, its difficult to understand what you wish to achieve. Based on the linked diagram, it would appear you have a mikrotik behind an ISP router. The Mikrotik gets a private IP as its WAN port is connected to one of the LANs of the ISP router. In other words you want the MT acting...

anav

How to add them?? In winbox on the LHMenu select Interfaces Then in the popup menu select Interface list This is the location to add interfaces to existing interface lists with the PLUS + symbol. Before one can do that one has to add the lists. On the same line as the plus on the far right select th...

anav

What makes sense is specific to your location. How is the printer connected to the router, via ethernet jack at specific location, are there managed switches in between etc etc...... Clearly if all users are in vlan10, why put it on its own vlan. If untrusted users are allowed to use the printer, no...

anav

Washingstate, Maine, Oregon etc. are more than welcome to Join Canada.
Was going to included California, but its dealing with real issues.

I am likely to replace my TPLink products with this.
https://www.tp-link.com/us/business-net ... da-eap770/

anav

All employees have a cell phone......
Send mass text message - internet out restoration time est XX:XX Hrs.

anav

You can put another router like hex refresh between ISP router and first 60HZ device.

anav

Fresh Questions: Observation: One only needs the APP to create the first user ( the smartphone itself ). It automatically turns on BTH VPN, and creates the first two entries! I had thought one needed to manually turn on BTH VPN in ip cloud first. 1. When creating the the tunnel from the phone it wou...

anav

the idea is that 192.168.77.1/30 means only two usable IP addresses 192.168.77.1 and 192.167.77.2 hence plug in your laptop to ether24 and ensure 192.168.77.2 is set manually on the laptops IPV4 settings. This creates a safe spot to do vlan configs on any mikrotik device. You can disable the port af...

anav

Only management vlan has bridge tagged in /interface bridge vlan. .... model = CRS328-24P-4S+ # serial number = /interface bridge add ingress-filtering=no name=Bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether24 ] name=OffBridge24 /interface vlan add comment="\"MG...

anav

# model = RB952Ui-5ac2nD # serial number = /interface bridge add name=bridge1 /interface list add name=WAN add name=LAN /interface list member add interface=ether1 list=WAN add interface=wg1 list=WAN add interface=bridge1 list=LAN /ip pool add name=bridge-pool ranges=192.168.88.2-192.168.88.254 /ip ...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

If WAN1 is primary,,,,, /routing table add fib name=via-WAN2 /ip firewall mangle add chain=input action=mark-connection connection-mark=no-mark in-interface=WAN2 \ new-connection-mark=incoming-wan2 passthrough=yes add chain=output action=mark-routing connection-mark=incoming-wan2 \ new-routing-mark=...

anav

You cannot successfully take one configuration from one model and import it into another. The best case is copying bits of the config at a time from the /export file and pasting into the new router. Your subnet is all over the map 192.168.88 or 192.168.3 or 192.168.2 LOL Enable your fricken firewall...

anav

Can you post a link to wireguard peer generator. I was unaware that MT had such a tool??
OR
Are you talking about BTH WG vpn??

anav

Without seeing any config, no facts, no evidence, impossible to advise further.

anav

add a firewall address list
add src-address-list=Name of firewall list above to the dsntnat rul

anav

In the case of Primary WAN1 and Secondary or Backup WAN2: In this case all traffic exits the router via WAN1 and one thinks primarily of LAN traffic. However, any external originated traffic arriving at the router will go in the appropriate WAN ( by IP address or dyndns url) but will exit WAN1. To e...

anav

I dont understand the need for step 6. Router B in both BTH and normal wireguard is the client for handshake never the server ????

anav

Okay, repost config if any issues, bound to be few as changes often take few iterations, ops normal.

anav

Config of both required if not resolved ( model of switch )

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

Find the appropriate switch example: viewtopic.php?t=143620
Decent video: https://www.youtube.com/watch?v=YLtGQAQ8iS0

anav

Why vlan1 on the unifi? Unifi typically accepts whatever traffic is coming to it untagged as the trusted or management vlan and the tagged vlans as data vlans. Therefore on the MT suggest you use three vlans and forget about using vlan1 for anything ( it works in the background ) vlan10 - home ( wir...

anav

IMHO quickset should be removed until its actually stable, intuitive and useful.

anav

Brand/Model of Access point?
Config of MT router ( and ap if mt)
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

I suspect you may need the MT to act as a router vice switch/bridge?

anav

Attempt5: " Damn, I forgot the keys in the car! "
Attempt6: " I wonder if these glasses make me look smarter? "

anav

Concur with jaclaz, its a waste of time for us to chase what ifs. Post your latest config that is not working, then we will provide suggestions. If that doesnt work, post that config with the latest config and we will work from that. We can best work from accurate facts presented....... and after re...

anav

Hi Whussup..... I review the config from top to bottom and thus its what I noticed first off. Concur it doesnt effect any of the wifi settings. However since you do have those port in /interface bridge ports, it still appears to the reader/reviewer to be in error for them to be disabled! I know for ...

anav

Rule of Thumb: Use quickset at your own peril.

anav

Yeah nervous that some giant Chinese company will buy MT out and start adding all those nifty features you desire, and of course a hidden back door to the red army.

anav

Mikrotik does not block any outgoing LAN to WAN traffic by default, so why are you assuming the MT is the problem? Further how is one supposed to provide any advice on your configuration if its not provided. /export file=anynameyouwish (minus router serial number, any public WANIP information, passw...

anav

I am confident you will find the problem then. GLuck.

anav

1. Wouldnt call my Bridge "LAN" as LAN is already used on the router for standard nomenclature. Personal choice but at least make it bridge-LAN etc. 2. Why do you have two IP pools but only one subnet ( aka the one you attach to the bridge-LAN )? 3. Highly recommend you set this to NONE< a...

anav

/interface ethernet set [ find default-name=ether1 ] name=ether1-WAN set [ find default-name=ether2 ] disabled= yes name=ether2-LAN set [ find default-name=ether3 ] disabled= yes name=ether3-LAN set [ find default-name=ether4 ] disabled= yes name=ether4-LAN set [ find default-name=ether5 ] disabled...

anav

Where is the full config, firewall rules etc............ Your diagram is confusing is this all on one device the router, or do you show it being attached to a switch (you state uplink and bonding but to what etc...) If connecting to a switch is it an MT switch? Normally one uses a single trunk port ...

anav

I was referring ONLY to the display vlan1, where you only change the port from U to Nothing (no affiliation) for any ports that are untagged (access ports for other vlans). In addition you would need to change the pvid of that port from1 to the untagged port vlan id. For review post pages for each v...

anav

Yes. /ip firewall address-list add address=DYNDNSURL (like mynetname.net) list= MyWAN /ip firewall nat add chain=dstnat action=dst-nat dst-address-list=MyWAN \ dst-port=xxxxx protocol=abc to-address=ServerIP Check for yourself, in the IP firewall address list. you will see it automatically creates a...

anav

MKX you need to watch the psychedelic videos from Viktors!!

anav

What ranges are you getting and speeds, and how does it hold up with heavy rain or snow??
Is the 5ghz backup good, what range??

anav

Do not have or endorse this product but looking at the product page it may be the quick and easy solution. https://mikrotik.com/product/wireless_wire_cube_pro Powering it at the far side will be the challenge but you seem to have some ideas. What I dont like is that within the same website they prov...

anav

But I had 0 problems with new wAP ax so far. They are rock solid

Just to be clear, you are not using them as paperweights?

anav

I am more curious as to what Normands is thinking.....

Attempt1: I forgot my schnapps in the car.........
Attempt2: I always have my hand in my pocket to protect my manhood.....
Attempt3: Where is the bathroom?
Attempt4: Why did I volunteer to attend this event for Viktors......

anav

Why would you want to hinder progress on cloudflare ????

anav

Ahh that makes sense! Understand good plan still to netinstall fresh firmware 7.16.2 prior to do anything else. Then install a basic firewall setup. Then connect to the internet. On the router, in the wireguard setting, establish a listening port ( this is an accurate word in the case of the device ...

anav

The only times that one needs to use a hybrid port is if the offending attached device a. accepts ONLY the untagged data for the main connection and a tagged connection for other connections. ( an internet phone where the untagged data is for the phone and the tagged data is for a connected PC ) b. ...

anav

To be picky its the hap ax lite LTE6

What do you have at home? MT router? Public IP, or ISP router that can forward port to MT router??

anav

Wireguard does not support multicast, and mDNS needs multicast... so not possible. The mDNS support in 7.16 is just an "mDNS repeater", so the resulting "repeated" multicast can not be forwarded over WG. And why I've long argued that /ip/dns should act as mDNS/DNS-SD "Disco...

anav

One bridge,
identify all the data vlans required and one management vlan ( unless you intend to use one of the data vlans as a trusted vlan)

viewtopic.php?t=143620

anav

viewtopic.php?t=143620

anav

Corporate IT should be able to assist.

anav

To setup vlan filtering on both RB4011 and CAP products use this guide: --> https://forum.mikrotik.com/viewtopic.php?t=143620 Recommend for each MT device you do the config from a safe location, namely an off bridge port. So in case of Caps, use ether2 off bridge, on RB4011 use ether8 and remove fro...

anav

Read the reference again and watch the video again.......
viewtopic.php?t=143620
https://www.youtube.com/watch?v=YLtGQAQ8iS0

Devices (switches APs) should only get IP addresses from the trusted vlan ( for their own IP )

anav

Maybe there are two admins??? So you have an unknown VPN on your router??
I would disconnect from the internet and netinstall the latest firmware to be on the safe side.

anav

In plain english, the recursive checks if you can actually reach the WWW.
We have to go through the closest hop as that is what we know. what in between is immaterial.
The key is can the route reach the www, if not switch to WAN2 etc....

anav

Seems okay on a quick look. what is not currently working???

anav

Well if you ever need me to ping your router and let you know its not available let me know LOL
Just make sure to give me a non-MT dyndns URL LOL, seems like the MT ecosystem is vulnerable to shenanigans.

anav

Tongue in cheek Chaos, of course you guys (real IT and not homeowners) are stuck with dealing with such stupid setups such as below: A use-case for such functionality would be for example when having two uplinks (eg DSL modem/routers) with conflicting IPs, that you cannot control/change their subnet...

anav

Was just poking you in the eye LOL.

anav

Hi Mozerd, I believe that is what the OP has done in fact. Each pair of routers A,B A,C A,D A,E and A,F have their own wireguard connection but are able to initiate a connection in both directions so each has endpoint address, endpoint port and keep alive set. I would assume each of the interfaces h...

anav

Well the default setup out of the box is secure so, its not a matter of not locking it down you undid something that caused the router then become open. I hope you used netinstall to put 7.16.2 on the router, and if not, not interested in assisting until a clean version of firmware is installed in t...

anav

I would ditch Bruno and simply use Wireguard on the MT device. Its adding a layer of complication for no reason.

anav

Okay AMMO how does your router send you an email when your WAN goes down ;-PP

anav

masquerade rule already exists above with out-interface-list=WAN. You do not need another masquerade rule is the point, unless you have a specific VPN outgoing that needs to be masqueraded. ONLY the to-port can be removed if same as dst-port. ( the dst-port is mandatory LOL, the router reads the dst...

anav

BTW: No one is more astounded, perplexed, and disoriented by the persistence of NYC's desireability than me (lifelong, multi-generational NYC'er). That's my soap-box response to your coffee comment. That is to say, coffee (and everything) is much better elsewhere. Nonetheless, anytime you're in the...

anav

What type of ISP connection is the primary......... Recursive allows one to verify www connectivity General format: /ip route add checkgateway=ping distance=1 dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=main scope=10 target-scope=12 add checkgateway=ping distance=2 dst-address=0.0.0.0/0 gate...

anav

Hosting your own mail server is a very bad idea......I suspect that may the cause of people getting shut down by their ISPs abuse on port 25. Port 25 is often used to spam email and ISPs shut it down. Work arounds, dont attempt to be everything. Have your mail server set to something else..............

anav

So brand up wifi AP up top ( is it smart or dumb, brand/model )
Switch to far right ( managed??? brand/model )
wifi bridge device bottom (brand/model)
wifi APs very bottome smart or dumb (brand/model)

anav

Note: Routing rules works well for a small group of IPs........... or entire subnets,
however if the number grows to big, then mangling will be used to replace routing rules.

anav

Sure thats very logical. THe problem is how to do that depends on the current setup. If it was connect to router A via wireguard and then over existing tunnels go to any other device or any other LAN on any device is TOO easy. This assumes device A is the server for handshake, and device B,C,D,E,F a...

anav

Well it all depends doesnt it. Do you wish to be able to reach all devices by accessing one MT device in particular, or do you want to be able to reach all the configs when connecting to any device. The hub and spoke method you didnt use, makes connecting to all device stupid simple as one connects ...

anav

Thx for the clarification. By the way, could you find a smart way to add rules such add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=udp to-address=198.18.0.1 add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=tcp to-address=198.18.0.1 But inste...

anav

Other routers?? Can you provide a network diagram to see what is in play!

anav

post the latest config, so that one can investigate.

anav

Because its a function of ensuring the path through the 3rdparty provider from the single PC to the Www is working properly MTU wise. Nothing to do with bridge. Also note an improvement on the schema already provided:\ /ip nat add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 proto...

anav

Can you forward a port from the ISP router to the mikrotik.

anav

Your answer is too vague to be of any use.

Describe the traffic,
USER A,USER B, USERC< from external wants to do what!!
Identify users and describe traffic needed.

- config 750
- config RB5009
- reach servers on LAN of 750
- reach servers on LAN of RB5009

anav

To prevent leaking is difficult as the rest of the router goes out the normal local WAN. To accomplish no leaking try this.......... Option1: If 3rd party provided a DNS address to use........ /ip nat add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=udp to-address=198.18....

anav

Can you confirm what the 3rd party provider gave you for information Apparently besides endpoint address and endpoint port and private key to use ( so same public key is generated for their end etc...) Specifically ip address of 100.96.1.09 was given, DID they provide anything else? I see you have n...

anav

What is the purpose of the LAN on the CHR?? Are you using the CHR as WAN2 for the RB750 ??? Are you port forwarding to servers on the RB via the CHR connection ( through the wireguard tunnel between the two devices ) Are you using the wireguard tunnel to remotely connect to both RB750 and RB5009 for...

anav

Concur jac, that learning is important. If the OP takes the time to understand each line of the completed config and what it does, the learning will come. 1. In terms of the config the offbridge settings are in three places ( plus remove from bridge ) a. name the ethernet port ( OffBridge4 ) b. add ...

anav

As per my recent post above, cat, was working on it this morning and got caught up doing other things... I am avoiding using the prefix thing for several reasons. a. there is a bug when you do modifications after the fact to the prefix rules that do not actually stick on the router ( what is shown i...

anav

What is the purpose of Wireguard? Is it for your remote devices to access the router and LAN while away or are you connecting to some third party vpn to access internet somewhere else.?? Will assume the latter case!! Fixes: 1. EDIT, nm this is okay 2. These rules make no sense the first rule says --...

anav

This is basic vlan filtering........ Read the bible (has examples for both switch and router) --> https://forum.mikrotik.com/viewtopic.php?t=143620 A decent video for switch -- > https://www.youtube.com/watch?v=YLtGQAQ8iS0 I will hold you responsible for reading and applying the above knowledge. :-)...

anav

Can you forward ports from ISP modem/router to the mikrotik??
What is at the other end of the VPN connection? You have some unknown local brun device whatever it is handling some sort of VPN behind the MT.
Is it a router, or what? what kind of VPN does it have.

anav

It would appear the zerotier network assumes default port number which does not appear changeable as that may be set on zerotier servers?? However they also communicate on two other ports, a random high number port based somewhat on zerotier address and also another high random port number if you pe...

anav

1. Establish basic requirements a. one subnet for HOME b. one subnet for HOME wifi c. one subnet for IOT (such devices should be separate from home users ) d. one subnet for guest wifi (obviously should be isolated from rest )' It would appear that you need three vlans ( as home wired and home wifi ...

anav

Hi Cat, Sort of, note that one should be accurate when possible and for example for traffic to the router we dont even use prerouting --> input chain and output chain PCC traffic is coming from the LAN marking connections (forward chain) THe mark routing is YES, prerouting chain Similar to traffic t...

anav

Fixed thanks! ALso this: I only want to access those ports from lan, not for internet where I didn't make an entry, for example samba share. You still need the same structure as the rest of the dstnat rules! If you want to limit to LAN only, then add a qualifier. add chain=dstnat action=dst-nat dst-...

anav

post your config if you want it reviewed/improved /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. ) The reference is good follow it for success. One other thing I do for configuring vlans and bridge is to take a port off bridge lets say ether8 /inter...

anav

Well I took a look at the config and your dstnat rules are all over the place. If you are using a DYNDNS name to describe your WANIP, why not use mynetname from IP cloud. In any case if using a DYNDNS name one does NOT also use in-interface-list=WAN ( one or the other ) a. in much of the dstnat rule...

anav

Note the config added in post #10. Look at the entire config first, then go line by line and write down any questions you have for posting. I am not 100% sure of the syntax for the IP static DNS... The idea being that anyone putting www.schoolweb.com in their browser would get directed to the server...

anav

That is how MT works.
Any port forwarding will show up on scans but will have status as closed. ( NORMAL! )
Any port forwarding with also a source address or source address limitation on the dstnat config will be invisible on scans.

anav

Hmmm,,,,,,,, I suppose as long as the config contains the endpoint address and endpoint port for the Cloud relay. Manual in any case.

anav

You cannot. The BTH feature is for individual devices only ( smartphones, ipads, laptops, PCs ) If you have two wireguard devices that you wish to connect together, then, a. change one of the ISPs so that you can get a public IP either on the MT itself or at least on the ISP modem/router where it ca...

anav

MikroTik is just acting as a switch between router and the AP. No wifi on the MikroTik itself. I tried to follow the configuration in the reference post and it just turns off internet access on all the ports so that's why my configuration is the way it is now. Just that the access point is only abl...

anav

Remove router serial number and switch serial number from posts made of configs. SWITCH model = CRS328-24P-4S+ # serial number = DNACHSOS4 /interface bridge add admin-mac=08:55:31:20:4A:06 auto-mac=no comment=defconf \ ingress-filtering=yes name=bridge vlan-filtering=yes /interface vlan add interfac...

anav

ROUTER: model = RB4011iGS+ In summary sort out why the subnets you use in various places dont match the address subnets ???] Not sure why you show ether2 being tagged for both vlans, You never noted what is connected to ether2 ???? I will asssume for now its some other kind of smart device and not a...

anav

The switch should tag the traffic coming from comcast on a single vlan and carry it through to the trunk port to the router. The router simply needs to terminate this vlan on the WAN settings be it DHCP server, or pppoe etc.... On the trunk port between them are also a. the management or trusted sub...

anav

What do you mean ether4 is connected to LAN, one port serves the whole school, every cable spliced off a single cable???
Or is LAN a brand name for a managed switch??

anav

Due to the lack of network diagram and overall clarity. Is the mikrotik device simply between the main router and the AP. ( a switch only, no WIFI) So the mikrotik gets a trunk port on the router with lets say 3 vlans, managment, homewifi guest wifi etc... Or is it doing wifi as well. THere should b...

anav

Really for proper security they can OPT IN, and in a few easy steps compared to all other methods have access to the internal school info while at home or NOT and have to go to school to access. WHat router is it that you will have for real ( model, firmware )............ how many ports? What is eth...

anav

Well from a security perspective http is a very bad idea. In that at some point you have to login...... then you probably have a simple username and password login which in 2025 is not the way to go. So it depends if you have third party authentication etc........... How that is done, is the key. ??...

anav

Some clarification required. f. Is it one office PC that needs to be static or one printer that needs to be static. And the reason give doesnt make sense, 'due to scanning of printer' Do you mean the printer is also a scanner? Do you meant the printer initiates a search?? Do you mean the printer nee...

anav

As noted, if its a switch why are you configuring it like a router ( no pools required )
The only vlan that needs to be defined is the management or trusted vlan where the mT gets its IP address from.
Find the appropriate example here --> viewtopic.php?t=143620

anav

Its not a matter of like or dislike, its a matter of meeting requirements.

anav

There is no need to use hybrid ports unless dealing with ubiquiti etc.. Classic error, once you go vlans, DONT mix bridge with DHCP. Whatever subnet you have there just assign it as a vlan and then complete the config. Ingress filtering should be yes on every port and frame types be either vlan tagg...

anav

You need to disconnect from the internet and implement at least the default firewall ASAP because now you're an open door to the world. After that we can talk about port forwarding (allowing access to internal service through public IP) That is the intent of CO-PILOT, to CO-OPT every mikrotik new u...

anav

Very doable we help users all the time achieve success, As noted, please post config for starters. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long assed dchp lease lists etc.) I would not comment further also without knowing the requirements in more...

anav

Three other considerations. Do you want the guest users on 2.4 to see other guest users on 2.4 Do you want the guest users on 5ghz to see other guest users on 5 ghz Do you wan the guest users on 2.4 to see guest users on 5ghz. IF NO. a. on wifi create datapath1 and check client isolation. then on wi...

anav

Changes to your config. 1. You have guest wifi but no subnet for the guest network so that has been added. 2. Recommend to not use bridge filters to control traffic, use standard ip firewall filter rules (bridge filters are for advanced users for niche cases). 3. So the solution is one of two choice...

anav

I would not comment on a config without knowing the requirements a. identify all the devices/users, groups of users, external and internal users including the admin b. identify the traffic they all require c. be sure to cover any port forwarding or VPN traffic. d. detail WAN setup, how many type ( s...

anav

You can also ask Admiral for support they are supposed to be expert at applying their platform on mikrotik appliances.

anav

No there is a little pull out tab on the ax3 if I recall correctly.

anav

This --> You can even combine the approaches, where rules in raw drop packets whose source address matches an address list, and rules in other tables populate that address list Speaks to creating lists of addresses to block. I prefer knowing the incoming source address but you did give me additional...

anav

I think you are confused...... Either the item is a switch or a router MAKE UP YOUR MIND. If its a switch the only thing the device can do is point to the gateway of the trusted vlan to get NTP itself, the MT device. Getting Time to devices on vlans is the responsibility of the main router. Do you h...

anav · Re: Trunking a vlan ,,,,,,,,,,,,,, Screenshot 2025-01-03 122746.jpg

,,,,,,,,,,,,,,

Screenshot 2025-01-03 122746.jpg

anav

What do you mean exactly?? ETher1 is simply capturing the internet traffic stuffing the untagged traffic into vlan187 through the hex and bringing it to your router to be terminated as vlan187 traffic. VLAN 18 is your managment subnet and also your main subnet. The hex gets its address from here. Yo...

anav

Why, network better -- dont create overlapping subnets............
Wireguard works just fine, if done properly.
(caveat home user, dont support real work)

anav

I agree nichky, seems like people just dont know how to use wireguard properly

Truth be told I havent used VRF but I think thats a BGP issue. Attempting to use BGP and wireguard VPN .........

As to my first statement, dont use overlapping subnets ;-PPP

anav

Draw a diagram of what you wish to achieve! There are so many what ifs in your description, its hard to pick out facts from fiction.

anav

If you can point out where the mistakes were or where the corrections were made it will help others.

anav

sure if you do it thru the router, will take you to 7.12 first, if you do it manually go to 7.12 first, then 7.16.2.

anav

I only know so much, more to learn.

anav

cat12 are you better than AI>>> COpilot copying does not equal learning!!

anav

We cannot change how RoS works..... As for filtering the forward chain typically should have a rule like. add chain=forward action=accept comment="port forwarding" connection-nat-state=dstnat There is no security settings done typically in dstnat rules. However, if you wish to limit extern...

anav

Remove serial number from your posted config!! Ether3 has to be a trunk port carrying all vlans between hex switch and Router. Ether1 and Ether5 are access ports, untagged as required when leaving the port. I dont understand this nomenclature add address=10.87.2.28 /28 interface=MGMT_VLAN network=10...

anav

You have yet to respond??? As this made no sense to me I had to assume some NAT on the fortigate and thus the config of the two mikrotiks will link the two fortigates as you requested. Its simply a matter of proper configuration of the two Fortigates to ensure the traffic arriving at the Fortigates ...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Sure, get the AX3 router and use the hex as a switch, or if just looking for an AP only choose between capax (indoor) and wapax (indoor or outdoor).
If you want wifi7, keep the hex and look at tplink wifi7 products.

anav

Clearly the OP wants some degree of separation between the subnets and a way of accessing the APs from a management perspective.
I am of course leaning towards vlans to do so.

Before going down any path, are these smart or dumb APs.......... ( brand and model )

anav

Yup there are going to be some hicckups along the way for sure.........
Now time to go to 7.16.2 LOL

anav

Before fixing the config, Is the ISP giving you two WANIPs ??? WHY the second router doing pppoe. ( why do you need it, all could be done via hex for example ) Is the hex acting as a switch or router? I am thinking without a proper understanding of the setup and your intent, this could be a chasing ...

anav

At least they had the decency of NOT calling it "Mikrotik 365" :wink: . Luv it! If I was a betting man, I would say its been orchestrated by Cloudflare, for what purpose I do not know, but I swear I did not bribe them to do so, in order to get MT to capitulate and put zerotrust cloudflare...

anav

It’s a lucky dip if it’s online when I come on here. Brings a bit of excitement and variation to my day.

Did you buy a boat yet............ I hear all the excitement one needs is the free water Brits are getting.

anav

Actually mostly asking cause it pains me to see Sindy guessing. ;-) @sjoram has been around for a while, so I figure he enjoys the journey as much as the goal, so I play along. Yes, thats why I thought a round of jousting would be entertaining. But not around for that long, the lad looks to be abou...

anav

It was asked nicely to see the full config to make a proper assessment using facts and evidence. Like it or not, MT config elements are interrelated. No one is asking to see anything revealing. /export file=anynameyouwish (minus router serial number, any public WANIP information, keys, long assed dh...

anav

Still could help to have a look at that topic.

Amen to that brother, a vlan is a vlan except when using RoS and then mysteriously people get confused.

Search found 22402 matches