MikroTik

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information vpn keys etc.)

using notepad++ to open and edit and post here, and use the code tags above, on the same line as Bold and Underline the black square with white square brackets.

anav

Is it because in the same LAN scenario, the packet back would be destined directly to the client MAC address as the server has it in its ARP table, and the router would simply switch it back to the client without any processing, Something like that......... the router knows where the originator is ...

anav

Is that your complete config....... you have not defined vlans etc. nor have any firewall rules.
Are you trying to use this device as a switch>?

anav

Its the basic user test, if you cannot get passed the password, you dont quality to use MT products!

anav

1.Upgrade firmware to 7.12 and then to 7.17 ( also routerboard ) 2. Then using ether2 to config....... RB4011 has two switch chips, thus to keep all ports used on the same bridge moving them to 6-10 So first step is to move ether8 to ether2 !! 3. Added management vlan 4. Single Wireguard interface b...

anav

I cannot help, I recommended a different solution for IP routes as noted above, You have provided a routing that is already load balanced based on ECMP and thus is nonsensical. Since you didnt except that change, my providing of recursive wont work either as it wont relate to your current settings.

anav

CHR, well if you are using CHR at home and not in a VPS, cannot help you. The idea of CHR is to acquire a public IP address or at least a public WANIP in a specific geographic location. The key being you no longer need BTH because regular wireguard will work just fine. Good point that it should be i...

anav

Sure but how bout first you get rid of all the noise.
Delete all the unused config as it makes it harder to read and diagnose issues.
Once done repost and will have a look.

anav

First question I have is, how do you propose to setup PCC when you have already setup the pppoe to make routes automatically? If they all have the same distance, you already have ECMP load balancing in effect ??? Not sure what game you are playing, but your config seems focussed on viruses not neede...

anav

Upgrade to 7.17 and see if the behaviour repeats itself. Im pretty sure they are interested in working on bugs based on the latest firmware, as any previous bugs may have been taken care of already.

anav

No the address range provided is fixed, the admins smartphone will get 192.168.216.3, the router 192.168.216.1 address and 192.168.213.2 is reserved for the relay peer. You are correct the default rule allows access to the LAN, so it depends how you have defined your LAN interface list. Further rule...

anav

Decided to try BTH on main router CCR1009 and using 7.17 firmware. All good in terms of using the iphone app on trusted WLAN to create the tunnel. All settings checked on router via winbox 1. Only difference from hapax3 ( acting as a switch ) is that I finally see on the CCR1009 version, the forward...

anav

Is there an echo in here??

anav

Generally speaking if the traffic to the server is mostly across the switch ( users on ports on the switch need access to the server,) then put it behind the switch.

anav

IOS-7?

Perhaps its no longer Riga Operating System and Mikrotik is being bought out by Wipro and the new name is Indian Operating System ???

anav

Disagree, both APs should have both the management or trusted vlan being sent to them ( as that is where AP gets its IP address from).
Additionally all other data vlans ( trusted wifi, guest wifi, iot wifi) etc should be passed to the APs as well.

anav

Same here attempting to do it all from App.

anav

Did some more testing but still no luck. However I have to admit the hapax3 is not setup as a router but simply an AP switch behind a CCR1009 main router, with one primary WAN. So the management vlan is where the hapax3 gets its IP address. When I use my iphone to start the process, I use a WLAN on ...

anav

I am not a zerotier expert, but assuming stating the zerotier interface on the input chain rule was not enough or accurate, perhaps you need to add actual IP address???

anav

A wider rule, that is often prescribed is dst-address=192.168.12.0/24 src=addres192.168.12.0/24
( intent here is if you have more than one server active in the subnet )

anav

You guys are amazing, for me its like reading chinese......incomprehensible.
Some day I need to go to California or Italy for a 2 week scripting camp. ( which would barely scratch the surface ).

anav

What is the management vlan or trusted vlan, and do the capacs and switch get an IP address from this VLAN?
In other words do not see vlan99 above, and it should be going from rb4011 to both capacs as well.

anav

Is the Mikrotik device acting as a router or a switch??
How did you create the BTH VPN in the first place.

Ensure you have access to the input chain for the IP address of your phone when connecting from the trusted WLAN.

anav

Unfortunately you will have to make an effort fail and try again and learn, there are no shortcuts. Before any advice though one needs a complete set of requirements understood, not just one server. Without the below, you cannot have a realistic plan, and a plan before config is essential. a. identi...

anav

Everything was looking normal until you decided to add an undocumented immigrant in your config. Where did vlan16 come from?? Also you stated you want nut client to reach pi...... dmz to lan. however in the diagram it states nut client LISTENing on port 3498, which IMPLIES that the pi is going to co...

anav

If we can be clear on requirements, assistance can be rendered.

a. identify all users/devices, external and internal, and admin
b. identify the traffic the groups above required.
(explain purpose of vlans etc.)

anav

So you agree, that if an IT person for a university is going to use MT product, he should
a. actually take some MT courses., or
b. get consulting assistance.
( havent even touched upon security as a component of using MT devices)

anav

BTH is supposed to make a dynamic input chain rule for wireguard, completely normal! The forward chain rule you see, I have never seen when making BTH setups, so not sure why you are seeing it. I can only guess is that you didnt select LAN availability for your peers? In any case you can apply firew...

anav

Not at ALL, conceptually not difficult. assuming you did the opensense properly, you have one trunk port to the 328 and at least one trunk port to the 109. The managment vlan must reach the 109 as all switches get an IP address on that subnet. However not interested in your opinion only on facts and...

anav

Nichky, the QR code available at the router is ONLY for the first assignment to the admins smartphon........... When you use Manage Shares from that smartphone,, you can create more qrcodes, links BTH app can use, or standard wireguard export files........

The screenshot from my iphone you mean??

anav

GLuck, then, as you seem to have all well in hand. Not even sure why you posted.

anav

Normally, the WAN need not be part of any bridge.
Depends on the circumstances, and typically in vlan filtering there is only one bridge.

anav

To help us, and to help yourself, the clarity starts with you... a. identify all the users/devices (external, internal and including admin) b. identify all the traffic the above groups must accomplish c. detail the WAN ( how many, public, private static, dynamic etc, if more than one, load balance o...

anav

Well you need to ensure LAN is allowed on bth users ( its the default setting so should be )
You may need to add a forward chain allow rule from BTH to LAN
You may need to add a forward chain rule allow from BTH to WAN

anav

Table refers to Routing Table(s). There is the main table which holds the majority of routes ( associated with IP addresses and subnets ) WAN etc. Special Tables...... not in main, created by admin for the purposes of sending traffic out a different table than the normal routing tables normally used...

anav

As SIndy said, your assuming to much, I have used CHR and have no clue on how to do any such thing on my computer, it was daunting enough to deal with a VPS, which I had no clues on.
As suggested, the recommendation sent --> SUP-176831

anav

CRS328 --> https://www.youtube.com/watch?v=YLtGQAQ8iS0&t=16s / viewtopic.php?t=143620

anav

When you purchase a CHR, you provide a password which MT then bakes into the image prior to sending you the file.
OR
All CHRs come with a random password, part of the purchase is a separate file containing password.

anav

If you actually want to get some answers, and fix the issue, the best place to start is providing your config.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

(ps dont see any cheap RB5009s yet on amazon.com)

anav

If you are in charge of Univerisity IT, this is not the place to get your paid work done.
a. take the proper MT courses
b. if an emergency --> https://mikrotik.com/consultants

anav

Well, we should make some test before upgrading en-masse our devices. I have upgraded only one my personal router that is not critical. The other one in my network are all on the 7.16.2 As a homeowner, I had no issues updating my hapax3, non-critical AP to 7.17. My main router CCR1009 will not get ...

anav

Beginners dont normally need more than 50 addresses, is this a real question or a hypothetical?
If its real then you need to provide a far more detailed explanation of your network, the users and services being provided.

anav

Cannot be that unhappy, you posted on JAN 08, and only getting to it now??? Must have been in the hospital or on vacation.

anav

Last Version ROUTER ( Assuming Office is trusted subnet ) 1. /interface bridge port add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged \ interface=ether2 pvid=100 add bridge=bridge ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged \ i...

anav

??? You dont deploy it ( connect to ISP ) until its setup.

anav

/ip firewall address-list (using static dhcp leases) add address=192.168.1.X list=Authorized comment="admin desktop" add address=192.168.1.Y list=Authorized comment="admin laptop" add address=192.168.1.Z list=Authorized comment="admin smartphone" /ip firewall filter ad...

anav

Accurate but avoidable, I missed this when looking at firewall rules. There is a purpose to using no-track in mangling, which is an aide in discriminating which traffic to identity. but also to KEEP fastrack and not cause any slowdown. From: add action=fasttrack-connection chain=forward comment=&quo...

anav

Support tickets are for bugs in the software mostly, and for suggestions........ It is not designed to help with peoples configs. If we cannot find a source for your issues, after resolving any config issues, then a supout and bug are probably appropriate. This is very simple load balancing so it sh...

anav

1. slight mod /interface bridge port add bridge=bridge ingress-filtering=yes frame-type=admit-only-vlan-tagged interface=trunk-switch1-ether1 add bridge=bridge interface=nuc-ether3 pvid=100 comment="hybrid port" add bridge=bridge ingress-filtering=yes frame-type=admit-only-priority-and-unt...

anav

I wondered how its been used for many years with such a misconfiguration............
Which leads one to conclude we dont have a complete picture as well.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Not a sweet clue of what you are attempting sorry.

anav

I would never rely on NAT and an ISPs modem to provide security. So yes, I think you should add the standard set of firewall rules.

anav

@Normis. note: ensured that mac-server win-mac server included Trusted interface note: ensured Trusted interface list included back to home interface. note: ensured input chain rule for BTH subnet allowed ( although have few rules on my hapax3 and no drop all rules) SUPOUT SENT --> SUP-176739 .... I...

anav

The party line:
https://www.youtube.com/watch?v=a_8AV6vIDYQ
https://www.youtube.com/shorts/LEjg54S_C0M

https://www.youtube.com/watch?v=-kNHtlOb5n0&t=52s

anav

One problem is duplication of WAN, either use IP address OR ip dhcp client, NOT both!!! /ip address add address=192.168.1.1/24 interface=lan network=192.168.1.0 add address=192.168.0.200/24 interface=WAN network=192.168.0.0 /ip dhcp-client add interface=WAN Is this device your router? No firewall ru...

anav

Disagree..... ether1 should NOT be part of the bridge ports or related settings, its WAN and nothing to do with bridge. On the other subject. when you create /interface bridge port for access ports and enter the PVID, the router dynamically includes the required untagging on corresponding /interface...

anav

https://forum.mikrotik.com/viewtopic.php?t=143620 On the router side yes, vlans ( interface bridge vlan ) need to be tagged for bridge and for any trunk ports ( and hybrid ports) When using bridge vlan filtering on switches aka 300 series, only the management vlan needs to be tagged on bridge. NO, r...

anav

edit NM. answered a post from page one LOL

anav

Are you familiar with RoS and the use of bridge vlan filtering, as it would be strange to make any assumptions based on limited knowledge?

anav

viewtopic.php?t=143620

anav

There are many examples of such in the forums, and also a ref with examples.
viewtopic.php?t=143620

anav

Sorry for many questions, but just getting deeper into BTH. Why and what traffic is coming in from the dynamic BTH interface that is added? I created BTH on the phone, all works. Then I switch the phone off and would assume no more traffic is coming in/accepted on the input chain. But not the case ...

anav

@ Edpa 1. *) bridge - added interface-list support for VLANs; Does this mean we can now list the bridge as an interface list member and this will include all vlans attached to the bridge? 2. *) bridge - enable faster HW offloading when detect-internet is disabled; Will faster HW offloading also occu...

anav

Understood, no worries. Most are not picky like me.

anav

When you are willing to change your config to the optimal one bridge approach - all vlans associated with bridge, will be happy to assist.
viewtopic.php?t=143620

anav

Do you use netwatch?

anav

So you have servers on one subnet. a. are users coming to the servers from external? b. are users coming from same subnet as servers? c. are users coming from the other subnet (where pi is located) So no traffic ORIGINATED at severs, only responses to incoming requests?? ( except for NUT client orig...

anav

@OP: Still waiting for requirements because I have no clue as to what you mean. As for no-mark, not sure what you mean TDW but that is a separate discussion..........

anav

I dont bother looking at snippets....

anav

Hi Davide, excellent start. A good article to read on setting up single bridge vlan filtering is ( the rb4011 is old and if you are spending money the RB5009 is much better investment ). https://forum.mikrotik.com/viewtopic.php?t=143620 I recommend taking one port not used off the bridge, giving it ...

anav

cannot comment as I dont know what the rest of your config looks like. As a new person be aware that the config is interrelated and parsing out bits is not exactly useful.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long dhcp lease lists)

anav

Define a few devices... a. 5 or less, 5-10, more than 10 ?? b. a whole subnet?? Normally a source address list with mangles is the way to proceed. It may be more optimal to use routing rules depending additionally I don't work from snippets /export file=anynameyouwish ( minus router serial number, a...

anav

Detailed network diagram would help understand.

anav

MT users are not ordinary people.

anav

I do not understand what you mean by avoiding assymetric routing, that is not a requirement that is anxiety and fear configurating. So . a. identify users/devices, external - internal including admin b. identify traffic they require to accomplish In terms of WAN, public/private IP, dynamic/static IP...

anav

Okay when I get home but here is the simple explanation. No BTH on hapax3. Go to IPHONE ensure I am on trusted WLAN that can access router. Open BTH, create new VPN I have to login to do so, and successful login completed and I add name of the tunnel. I close the APP for now. I go to the router and ...

anav

Only implement what you understand, feel free to ask questions.........

anav

A diagram would be helpful but basically, a big I THINK............ a. the mikrotik has a public IP and internet b. an openwrt router gets a private IP on its WAN side from a LAN on the MT. (ETHER1 on OPENWRT, ETHER2 on MT) c. the openwrt connects to a third party provider VPN (could be multiple sit...

anav

My recommendation is that the WG connections at both ends have the same MTU. Then the client peer device (if a router) aka NOT the server peer for handshake, should set the rule you stated. There are two variations to try.. ..... add action=change-mss chain=forward comment="Clamp MSS to PMTU fo...

anav

I know nothing about multiple WANIPs coming in a single port, but think using srcnat to direct where the servers are sending traffic to is the wrong approach?? Or did I just misunderstand the intent of sourcenat for this niche case??? As i want to also want to have traffic that's leaving that server...

anav

Looks good so far.............. 1. ADDITION /interface list add name=TRUSTED /interface list member add interface=LAN list=TRUSTED add interface=wireguard list=TRUSTED 2. firewall rules: Think about these three rules, the first two are rendered useless by the last rule. add action=accept chain=input...

anav

I am confused. It would appear tthat the two L009 devices are physically connected already?? There is no requirement I can see for them to see each other over wireguard??? Your explanation is weak. Of course you have a public IP, there is no way to reach VPS without one!!! THe public IP may only be ...

anav

Now --> purchase CHR license and rent cloud server ( using wireguard and will allow multiple connections from field devices and you ) Cost of CHR license one time, recurring $7 per month Now --> purchase ARM hex refresh and start accessing devices remotely using the built-in BTH wireguard VPN. $69 o...

anav

No worries,,,,,,,,,, THe only thing I do not understand is the weird networking schema. /ip address add address=192.168.47. 194/27 interface=vlan475 network=192.168.47. 192 comment="trusted vlan" I cannot netmask myself out of a paper bag and if it doesnt look like this, i get easily conf...

anav

The setup I gave you is gold and will work 100%,
Just work from an OffBridgePort to complete the configuration.

anav

I just helped a chap setup his 326 and it works like butta.
Chechito needs stop eating some many chitos LOL, they are preventing synapses from firing.

anav

actually the switch setting is NOT needed, hw offloading happens automagically on the 326 when setting up bridge vlan filtering

anav

maybe in your switch the config end up doing L3 forwarding, if you need that you must configure L3 Hardware Offloading

L3 Hardware Offloading
https://help.mikrotik.com/docs/spaces/R ... Offloading

for a 300 series switch??? What L3............... its all layer 2

anav

The reason I recommend the CHR approach, or BTH VPN for that matter is for privacy. Zerotier is still traffic going through their servers and some companies may be leery of someone tapping into their networks without complete assurances of privacy Disagree with AMMO, CHR is easy peasy and works well...

anav

You will not be able to use wireguard since you dont have a public IP. BTH wireguard a viable solution normally, but wont work either because you need an ARM or tile device. Your best bet and would support ALL the devices you need to monitor is to one time buy a CHR license and then put that on a re...

anav

Sorry not much more I can do until you make changes .......
If you need live assistance contact me on discord

anav

I have a very basic almost nothing firewall on the HapAx3 so shouldnt be an issue, no drop rules etc..
I will entertain a reboot, but not a reset, dont want to monkey with other config settings .................

anav

-Why do you not show spf-sfpplus4 connection on diagram??? -Added ingress filtering to /interface bridge port settings -you have the wrong vlan tagged with the bridge, if 475 is your trusted vlan, then only it needs to have bridge tagged in /interface bridge vlan -not absolutely necessary but add sf...

anav

@NORMIS, what is the trick of connecting to the router itself to create shares?? I can connect via VPN but after hitting manage shares, the login I provide (triple checked) and same one used to create the tunnel in the first place on the phone) is REJECTED ????????

anav

I am trying to follow the MT documents. The method that MT recommends is using the smartphone to generate other remote user accounts and to then pass them the link/url/qrcode via the phone. Trying to do it manually via creating the tunnel on the MT by enabling etc...... defeats the purpose of my tes...

anav

I just deleted and recreated from scratch the tunnel via my iphone. Dynamically created a. the iphone as peer .3 and with ALLOW to LAN yes. b. dynamic sourcnat rule for the tunnel c. dynamic input chain rule for the handshake. d. NO forward chain rule e. NO firewall address list f. dynamic ip addres...

anav

Okay got it. On the person I was assisting the dynamic block rule exists, but we couldnt get rid of it, (not able to delete rule) very weird. I didnt look at the firewall list itself, ran out of time, but I imagine invoking allow LAN or not allow LAN should modify that list ( add or remove peers). I...

anav

The better approach is to allow the MAIN router do its thing a. provide dhcp to all vlans b. provide firewall rules determining which vlans/devices get access to internet and other users/devices c. use the MT device as a switch - gets its IP address from the management vlan - simply passes through t...

anav

If you have the right router arm/tile etc you can use BTHVPN to connect to your network remotely from your smartphone or laptop etc... Looking at your diagram you should replace both switches with manageable switches, and then you can apply vlans throughout your network and isolate all the users/dev...

anav

Someone else will have to answer your zerotier questions as I have little experience.

Looking at your diagram from the other thread, it would appear you are stuck with switches that dont provide guaranteed vlan performance.
Suggest a pair of hex refreshes are decent cheap managed switches............

anav

1. Do I need to keep the IPV6 addresses, even though I am strictly using IPV4, in other words does MT relay server require that for all devices?? 2. The dynamic firewall rules are flaky. If I, after creating the user, change the LAN allow in IP Cloud settings to NO, it is too late. No firewall rule ...

anav

Just to confirm, can you add vlans to the ISP home router? Brand and model of router??

anav

Proper gaming sites will work just fine such as Steam. If you were running your own gaming site, then yes it would be problematic, but doing so is foolish as it just invites hacking and eventually getting shut down by your ISP. There is a reason why such gaming sites are mainstream and large entitit...

anav

I would look at a. zerotier as its available in RoS for any networking things you want to do........... ( basically puts all joined entities into a layer2 construct together ) b. BTH VPN this would be used for you to remotely configure the router from any device externally ( smartphone, laptop etc.....

anav

The config is what I call in-between. Not properly setup as a router ( missing address for WAN address OR setting for dhcp client, OR pppoe setting ( one of the three required ). No routing either for router setup. No dhcp server for any LAN traffic either. Not properly setup as a switch There is no...

anav

Which is your management vlan. I see you have data vlans 401,402 and 403 on the unifi and then vlan1. Since unifi expects the management vlan untagged, simply do the following. Lets assume on the MIKROK TIK you have a management vlan99. We simply untag this vlan to the unifi on a hybrid port with vl...

anav

/export file=anynameyouwish ( minus device serial number )

anav

The dynamic firewall rules are annoying, They cannot be moved. Also the block list forward chain rule should only show if the ALLOW LAN has not been selected.
Still working my way through this functionality..........

anav

I am still on winbox3, winbox4 is not ready enough for me to use. 1. Only one interface list name is used (TRUSTED) remove /interface list add name=WAN add name=LAN Similarly the interface list members should be modified too ( why are you not implementing changes? ) /interface list member add commen...

anav

Purpose: If its to use internet from a different location there are many that offer wireguard. Purpose: If its for external users to reach your router by using public IP address of a router in a different location, not aware of any............ ( did you consider zerotier ??) (you could rent your own...

anav

No network diagram?
Which vlan is the management or trusted vlan

anav

Well I had no issues starting up IP cloud on my hapax3 and then creating a BTH tunnel so the service seems to be working.

anav

Draw a network diagram, its difficult to understand what you wish to achieve. Based on the linked diagram, it would appear you have a mikrotik behind an ISP router. The Mikrotik gets a private IP as its WAN port is connected to one of the LANs of the ISP router. In other words you want the MT acting...

anav

How to add them?? In winbox on the LHMenu select Interfaces Then in the popup menu select Interface list This is the location to add interfaces to existing interface lists with the PLUS + symbol. Before one can do that one has to add the lists. On the same line as the plus on the far right select th...

anav

What makes sense is specific to your location. How is the printer connected to the router, via ethernet jack at specific location, are there managed switches in between etc etc...... Clearly if all users are in vlan10, why put it on its own vlan. If untrusted users are allowed to use the printer, no...

anav

Washingstate, Maine, Oregon etc. are more than welcome to Join Canada.
Was going to included California, but its dealing with real issues.

I am likely to replace my TPLink products with this.
https://www.tp-link.com/us/business-net ... da-eap770/

anav

All employees have a cell phone......
Send mass text message - internet out restoration time est XX:XX Hrs.

anav

You can put another router like hex refresh between ISP router and first 60HZ device.

anav

Fresh Questions: Observation: One only needs the APP to create the first user ( the smartphone itself ). It automatically turns on BTH VPN, and creates the first two entries! I had thought one needed to manually turn on BTH VPN in ip cloud first. 1. When creating the the tunnel from the phone it wou...

anav

the idea is that 192.168.77.1/30 means only two usable IP addresses 192.168.77.1 and 192.167.77.2 hence plug in your laptop to ether24 and ensure 192.168.77.2 is set manually on the laptops IPV4 settings. This creates a safe spot to do vlan configs on any mikrotik device. You can disable the port af...

anav

Only management vlan has bridge tagged in /interface bridge vlan. .... model = CRS328-24P-4S+ # serial number = /interface bridge add ingress-filtering=no name=Bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether24 ] name=OffBridge24 /interface vlan add comment="\"MG...

anav

# model = RB952Ui-5ac2nD # serial number = /interface bridge add name=bridge1 /interface list add name=WAN add name=LAN /interface list member add interface=ether1 list=WAN add interface=wg1 list=WAN add interface=bridge1 list=LAN /ip pool add name=bridge-pool ranges=192.168.88.2-192.168.88.254 /ip ...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

If WAN1 is primary,,,,, /routing table add fib name=via-WAN2 /ip firewall mangle add chain=input action=mark-connection connection-mark=no-mark in-interface=WAN2 \ new-connection-mark=incoming-wan2 passthrough=yes add chain=output action=mark-routing connection-mark=incoming-wan2 \ new-routing-mark=...

anav

You cannot successfully take one configuration from one model and import it into another. The best case is copying bits of the config at a time from the /export file and pasting into the new router. Your subnet is all over the map 192.168.88 or 192.168.3 or 192.168.2 LOL Enable your fricken firewall...

anav

Can you post a link to wireguard peer generator. I was unaware that MT had such a tool??
OR
Are you talking about BTH WG vpn??

anav

Without seeing any config, no facts, no evidence, impossible to advise further.

anav

add a firewall address list
add src-address-list=Name of firewall list above to the dsntnat rul

anav

In the case of Primary WAN1 and Secondary or Backup WAN2: In this case all traffic exits the router via WAN1 and one thinks primarily of LAN traffic. However, any external originated traffic arriving at the router will go in the appropriate WAN ( by IP address or dyndns url) but will exit WAN1. To e...

anav

I dont understand the need for step 6. Router B in both BTH and normal wireguard is the client for handshake never the server ????

anav

Okay, repost config if any issues, bound to be few as changes often take few iterations, ops normal.

anav

Config of both required if not resolved ( model of switch )

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

Find the appropriate switch example: viewtopic.php?t=143620
Decent video: https://www.youtube.com/watch?v=YLtGQAQ8iS0

anav

Why vlan1 on the unifi? Unifi typically accepts whatever traffic is coming to it untagged as the trusted or management vlan and the tagged vlans as data vlans. Therefore on the MT suggest you use three vlans and forget about using vlan1 for anything ( it works in the background ) vlan10 - home ( wir...

anav

IMHO quickset should be removed until its actually stable, intuitive and useful.

anav

Brand/Model of Access point?
Config of MT router ( and ap if mt)
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

I suspect you may need the MT to act as a router vice switch/bridge?

anav

Attempt5: " Damn, I forgot the keys in the car! "
Attempt6: " I wonder if these glasses make me look smarter? "

anav

Concur with jaclaz, its a waste of time for us to chase what ifs. Post your latest config that is not working, then we will provide suggestions. If that doesnt work, post that config with the latest config and we will work from that. We can best work from accurate facts presented....... and after re...

anav

Hi Whussup..... I review the config from top to bottom and thus its what I noticed first off. Concur it doesnt effect any of the wifi settings. However since you do have those port in /interface bridge ports, it still appears to the reader/reviewer to be in error for them to be disabled! I know for ...

anav

Rule of Thumb: Use quickset at your own peril.

anav

Yeah nervous that some giant Chinese company will buy MT out and start adding all those nifty features you desire, and of course a hidden back door to the red army.

anav

Mikrotik does not block any outgoing LAN to WAN traffic by default, so why are you assuming the MT is the problem? Further how is one supposed to provide any advice on your configuration if its not provided. /export file=anynameyouwish (minus router serial number, any public WANIP information, passw...

anav

I am confident you will find the problem then. GLuck.

anav

1. Wouldnt call my Bridge "LAN" as LAN is already used on the router for standard nomenclature. Personal choice but at least make it bridge-LAN etc. 2. Why do you have two IP pools but only one subnet ( aka the one you attach to the bridge-LAN )? 3. Highly recommend you set this to NONE< a...

anav

/interface ethernet set [ find default-name=ether1 ] name=ether1-WAN set [ find default-name=ether2 ] disabled= yes name=ether2-LAN set [ find default-name=ether3 ] disabled= yes name=ether3-LAN set [ find default-name=ether4 ] disabled= yes name=ether4-LAN set [ find default-name=ether5 ] disabled...

anav

Where is the full config, firewall rules etc............ Your diagram is confusing is this all on one device the router, or do you show it being attached to a switch (you state uplink and bonding but to what etc...) If connecting to a switch is it an MT switch? Normally one uses a single trunk port ...

anav

I was referring ONLY to the display vlan1, where you only change the port from U to Nothing (no affiliation) for any ports that are untagged (access ports for other vlans). In addition you would need to change the pvid of that port from1 to the untagged port vlan id. For review post pages for each v...

anav

Yes. /ip firewall address-list add address=DYNDNSURL (like mynetname.net) list= MyWAN /ip firewall nat add chain=dstnat action=dst-nat dst-address-list=MyWAN \ dst-port=xxxxx protocol=abc to-address=ServerIP Check for yourself, in the IP firewall address list. you will see it automatically creates a...

anav

MKX you need to watch the psychedelic videos from Viktors!!

anav

What ranges are you getting and speeds, and how does it hold up with heavy rain or snow??
Is the 5ghz backup good, what range??

anav

Do not have or endorse this product but looking at the product page it may be the quick and easy solution. https://mikrotik.com/product/wireless_wire_cube_pro Powering it at the far side will be the challenge but you seem to have some ideas. What I dont like is that within the same website they prov...

anav

But I had 0 problems with new wAP ax so far. They are rock solid

Just to be clear, you are not using them as paperweights?

anav

I am more curious as to what Normands is thinking.....

Attempt1: I forgot my schnapps in the car.........
Attempt2: I always have my hand in my pocket to protect my manhood.....
Attempt3: Where is the bathroom?
Attempt4: Why did I volunteer to attend this event for Viktors......

anav

Why would you want to hinder progress on cloudflare ????

anav

Ahh that makes sense! Understand good plan still to netinstall fresh firmware 7.16.2 prior to do anything else. Then install a basic firewall setup. Then connect to the internet. On the router, in the wireguard setting, establish a listening port ( this is an accurate word in the case of the device ...

anav

The only times that one needs to use a hybrid port is if the offending attached device a. accepts ONLY the untagged data for the main connection and a tagged connection for other connections. ( an internet phone where the untagged data is for the phone and the tagged data is for a connected PC ) b. ...

anav

To be picky its the hap ax lite LTE6

What do you have at home? MT router? Public IP, or ISP router that can forward port to MT router??

anav

Wireguard does not support multicast, and mDNS needs multicast... so not possible. The mDNS support in 7.16 is just an "mDNS repeater", so the resulting "repeated" multicast can not be forwarded over WG. And why I've long argued that /ip/dns should act as mDNS/DNS-SD "Disco...

anav

One bridge,
identify all the data vlans required and one management vlan ( unless you intend to use one of the data vlans as a trusted vlan)

viewtopic.php?t=143620

anav

viewtopic.php?t=143620

anav

Corporate IT should be able to assist.

anav

To setup vlan filtering on both RB4011 and CAP products use this guide: --> https://forum.mikrotik.com/viewtopic.php?t=143620 Recommend for each MT device you do the config from a safe location, namely an off bridge port. So in case of Caps, use ether2 off bridge, on RB4011 use ether8 and remove fro...

anav

Read the reference again and watch the video again.......
viewtopic.php?t=143620
https://www.youtube.com/watch?v=YLtGQAQ8iS0

Devices (switches APs) should only get IP addresses from the trusted vlan ( for their own IP )

anav

Maybe there are two admins??? So you have an unknown VPN on your router??
I would disconnect from the internet and netinstall the latest firmware to be on the safe side.

anav

In plain english, the recursive checks if you can actually reach the WWW.
We have to go through the closest hop as that is what we know. what in between is immaterial.
The key is can the route reach the www, if not switch to WAN2 etc....

anav

Seems okay on a quick look. what is not currently working???

anav

Well if you ever need me to ping your router and let you know its not available let me know LOL
Just make sure to give me a non-MT dyndns URL LOL, seems like the MT ecosystem is vulnerable to shenanigans.

anav

Tongue in cheek Chaos, of course you guys (real IT and not homeowners) are stuck with dealing with such stupid setups such as below: A use-case for such functionality would be for example when having two uplinks (eg DSL modem/routers) with conflicting IPs, that you cannot control/change their subnet...

anav

Was just poking you in the eye LOL.

anav

Hi Mozerd, I believe that is what the OP has done in fact. Each pair of routers A,B A,C A,D A,E and A,F have their own wireguard connection but are able to initiate a connection in both directions so each has endpoint address, endpoint port and keep alive set. I would assume each of the interfaces h...

anav

Well the default setup out of the box is secure so, its not a matter of not locking it down you undid something that caused the router then become open. I hope you used netinstall to put 7.16.2 on the router, and if not, not interested in assisting until a clean version of firmware is installed in t...

anav

I would ditch Bruno and simply use Wireguard on the MT device. Its adding a layer of complication for no reason.

anav

Okay AMMO how does your router send you an email when your WAN goes down ;-PP

anav

masquerade rule already exists above with out-interface-list=WAN. You do not need another masquerade rule is the point, unless you have a specific VPN outgoing that needs to be masqueraded. ONLY the to-port can be removed if same as dst-port. ( the dst-port is mandatory LOL, the router reads the dst...

anav

BTW: No one is more astounded, perplexed, and disoriented by the persistence of NYC's desireability than me (lifelong, multi-generational NYC'er). That's my soap-box response to your coffee comment. That is to say, coffee (and everything) is much better elsewhere. Nonetheless, anytime you're in the...

anav

What type of ISP connection is the primary......... Recursive allows one to verify www connectivity General format: /ip route add checkgateway=ping distance=1 dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=main scope=10 target-scope=12 add checkgateway=ping distance=2 dst-address=0.0.0.0/0 gate...

anav

Hosting your own mail server is a very bad idea......I suspect that may the cause of people getting shut down by their ISPs abuse on port 25. Port 25 is often used to spam email and ISPs shut it down. Work arounds, dont attempt to be everything. Have your mail server set to something else..............

anav

So brand up wifi AP up top ( is it smart or dumb, brand/model )
Switch to far right ( managed??? brand/model )
wifi bridge device bottom (brand/model)
wifi APs very bottome smart or dumb (brand/model)

anav

Note: Routing rules works well for a small group of IPs........... or entire subnets,
however if the number grows to big, then mangling will be used to replace routing rules.

anav

Sure thats very logical. THe problem is how to do that depends on the current setup. If it was connect to router A via wireguard and then over existing tunnels go to any other device or any other LAN on any device is TOO easy. This assumes device A is the server for handshake, and device B,C,D,E,F a...

anav

Well it all depends doesnt it. Do you wish to be able to reach all devices by accessing one MT device in particular, or do you want to be able to reach all the configs when connecting to any device. The hub and spoke method you didnt use, makes connecting to all device stupid simple as one connects ...

anav

Thx for the clarification. By the way, could you find a smart way to add rules such add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=udp to-address=198.18.0.1 add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=tcp to-address=198.18.0.1 But inste...

anav

Other routers?? Can you provide a network diagram to see what is in play!

anav

post the latest config, so that one can investigate.

anav

Because its a function of ensuring the path through the 3rdparty provider from the single PC to the Www is working properly MTU wise. Nothing to do with bridge. Also note an improvement on the schema already provided:\ /ip nat add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 proto...

anav

Can you forward a port from the ISP router to the mikrotik.

anav

Your answer is too vague to be of any use.

Describe the traffic,
USER A,USER B, USERC< from external wants to do what!!
Identify users and describe traffic needed.

- config 750
- config RB5009
- reach servers on LAN of 750
- reach servers on LAN of RB5009

anav

To prevent leaking is difficult as the rest of the router goes out the normal local WAN. To accomplish no leaking try this.......... Option1: If 3rd party provided a DNS address to use........ /ip nat add chain=dstnat action=dstnat src-address=192.168.88.5 dst-port=53 protocol=udp to-address=198.18....

anav

Can you confirm what the 3rd party provider gave you for information Apparently besides endpoint address and endpoint port and private key to use ( so same public key is generated for their end etc...) Specifically ip address of 100.96.1.09 was given, DID they provide anything else? I see you have n...

anav

What is the purpose of the LAN on the CHR?? Are you using the CHR as WAN2 for the RB750 ??? Are you port forwarding to servers on the RB via the CHR connection ( through the wireguard tunnel between the two devices ) Are you using the wireguard tunnel to remotely connect to both RB750 and RB5009 for...

anav

Concur jac, that learning is important. If the OP takes the time to understand each line of the completed config and what it does, the learning will come. 1. In terms of the config the offbridge settings are in three places ( plus remove from bridge ) a. name the ethernet port ( OffBridge4 ) b. add ...

anav

As per my recent post above, cat, was working on it this morning and got caught up doing other things... I am avoiding using the prefix thing for several reasons. a. there is a bug when you do modifications after the fact to the prefix rules that do not actually stick on the router ( what is shown i...

anav

What is the purpose of Wireguard? Is it for your remote devices to access the router and LAN while away or are you connecting to some third party vpn to access internet somewhere else.?? Will assume the latter case!! Fixes: 1. EDIT, nm this is okay 2. These rules make no sense the first rule says --...

anav

This is basic vlan filtering........ Read the bible (has examples for both switch and router) --> https://forum.mikrotik.com/viewtopic.php?t=143620 A decent video for switch -- > https://www.youtube.com/watch?v=YLtGQAQ8iS0 I will hold you responsible for reading and applying the above knowledge. :-)...

anav

Can you forward ports from ISP modem/router to the mikrotik??
What is at the other end of the VPN connection? You have some unknown local brun device whatever it is handling some sort of VPN behind the MT.
Is it a router, or what? what kind of VPN does it have.

anav

It would appear the zerotier network assumes default port number which does not appear changeable as that may be set on zerotier servers?? However they also communicate on two other ports, a random high number port based somewhat on zerotier address and also another high random port number if you pe...

anav

1. Establish basic requirements a. one subnet for HOME b. one subnet for HOME wifi c. one subnet for IOT (such devices should be separate from home users ) d. one subnet for guest wifi (obviously should be isolated from rest )' It would appear that you need three vlans ( as home wired and home wifi ...

anav

Hi Cat, Sort of, note that one should be accurate when possible and for example for traffic to the router we dont even use prerouting --> input chain and output chain PCC traffic is coming from the LAN marking connections (forward chain) THe mark routing is YES, prerouting chain Similar to traffic t...

anav

Fixed thanks! ALso this: I only want to access those ports from lan, not for internet where I didn't make an entry, for example samba share. You still need the same structure as the rest of the dstnat rules! If you want to limit to LAN only, then add a qualifier. add chain=dstnat action=dst-nat dst-...

Search found 22451 matches