MikroTik

anav

Another case of MT staff dont use the equipment they sell, should have been discovered long ago.
OR
Their test process is flawed, take your pick.

anav

Missing IP pool for the two vlans. Why do you have the bridge doing dhcp?? You need dchp server and dhcp server network for all three vlans! /ip pool add name=dhcp ranges=192.168.7.101-192.168.7.199 add name=pool-8 ranges=192.168.8.101-192.168.8.199 add name=pool-9 ranges=192.168.9.101-192.168.9.199...

anav

No idea, dont use chains as I rarely have an actual need, the concept of chains is very nice agreed, but rare to see. Well mostly see it in garbage firewall rulesets. /ip firewall filter { default rules to keep } add chain=input action=accept connection-state=established,related,untracked add chain=...

anav

sounds like your issues are all wifi........................ simple solution

anav

Standard config view please.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

This is the defacto bible on explaining the setup ...........
viewtopic.php?t=143620

anav

Not sure on your diagram, It would appear that you have the hapac wired directly to the ISP router ( the hapac is also setup as a router ). I am assuming that the ISP router gets a public IP and that you can forward the wireguard port from the ISP router to the MT router?? So need to confirm that an...

anav

Separate from jaclaz question, why not consider VRRP as a way to create a seamless connection from the client (lan) perspective, or will not work in your zooom example. ????

anav

Nice feedback AMMO. Conceptually, I like the idea. basic failover, - first step when learning how to use two wans Recursive failover - If concerned that the ISP is flaky and want to confirm connectivity to WWW ( seems many do ) Netwatch failover - If not happy with 20 seconds before any action is ta...

anav

Next lets look at other rules..... 1. CHANGE THIS TO /ip settings set max-neighbor-entries=8192 rp-filter= loose 2. DECIDE!!! Either use IP DHCP client for ether9 OR assign an IP address but not both !!! Since its a static IP, setting the IP address makes sense and I ssuspect you just entered a gene...

anav

The first thing to do in mangling is to ensure traffic heading for WAN2 is sent back out via WAN2. This should direct all VPNs coming on WAN2 to go back out WAN2. Of course one must have standard sourcenat rule in place as well Your wireguard rule seems to be deleted not sure why............ in anyc...

anav

So is your thinking that when one connection goes down for whatever reason, the netwatch setup is very good in terms of detecting and switching the users to the backup, however the problem is users sessions interrupted mid-stream are left hanging? Isnt that partially taken care of by using masquerad...

anav

Besides network diagram any advice has to be predicated upon a thorough understanding of the requirements, not parts thereof.
A, identify all the devices, users including the admin
B. identify the traffic they need to be able to execute

anav

no no no..................... ask about http3 support, by the time they implement 2, the draft for http4 will be out .

anav

Clearly Holvoe, Mikrotik staff use apple products and zyxel networking equipment and not MT products, as that kind of oversight only happens when you dont actually use the equipment for real.

anav

The explanation of your WAN is confusing. You state an ISP modem is feeding the MT router but then you state the MT is getting a DMZ IP..........?? If its a modem, the MT router would get a public IP, would it not?? If its a modem/router then getting a private IP for WAN would make more sense..... W...

anav

My question was for the OP, the originator, didnt realize it was you that had answered..........

anav

When you become more forthcoming with requirements an optimal config can be designed. What is wireguard on demand mean. ( your using a third party provider? you have wireguard vPS in the cloud? your MT is acting as a wireguard server and you as the admin login from away ? ) Which WAN is used for por...

anav

As I tried to explain your concept of forward chain and traffic is flawed. There is such a beast as WAN to LAN traffic. All traffic is not destined necessarily for the input chain. The dstnat rule, the default rule EVEN Tells you there is............... It says block all WAN to LAN traffic EXCEPT FO...

anav

Draw a diagram as your network design is very confusing when you try to explain it.....................

a. is the mikrotik connected to an upstream ISP router or Modem?
b. does the mikrotik get a public IP or a private IP from the upstream device?

anav

Well to help me understand I have created a recursive ruleset and a netwatch ruleset for the basic setup of TWO WANS. Most LAN users (single subnet /23) should use WAN1. Rest of users identified by firewall address list should use WAN2 Each WAN should be used as backup of the other. See result recur...

anav

Here is my attempt at using netwatch LOL. No promises and hopefully somebody can point out if there are errors. /ip route { WAN1 } add dst-address=0.0.0.0/0 gateway=ether1 routing-table=main add dst-address=1.1.1.1/32 gateway=ether1 routing-table=main add distance=2 dst-address=1.1.1.1 black-hole=ye...

anav

Going to take the easy way out. All traffic will go out WAN1, by default and thus we only have to 'force' business traffic out WAN2. First fix the mistake already noted: /interface list member add comment=defconf interface=bridge list=LAN add comment=Three interface=ether1 list=WAN add interface=ICU...

anav

With VPNs to the router involved mangling is required.
Since you didnt state otherwise, it would appear you have no port forwardings involved.

post your config on what you have so far....
/export file=anynameyouwish ( minus router serial number, any publicWANIP information, keys etc. )

anav

[quote=jaclaz post_id=1102129 time=1728390315 user_id=224177 -Tab -> Down /ip route enable [find comment=LTE-Failover] [find dst-address=0.0.0.0/0 and gateway=192.168.1.250] -Tab -> Up /ip route disable [find comment=LTE-Failover] [find dst-address=0.0.0.0/0 and gateway=192.168.1.250] [/quote] Just ...

anav

Do you have any VPNs ( such as wireguard ) in the mix via a specific WAN, and also any port forwarding to servers --> on either LAN??..........

anav

Remember, that each link is still peer to peer. There is hub and spoke network! However we set up the routes and firewall rules such that desired connectivity can be reached. Because each device is on the same wireguard subnet and each client peer has either 0.0.0.0/0 in allowed IPs OR 172.17.17. 0/...

anav

a roadmap would be nice (*wishful thinking*)

Easy Peasy just become a valued investor. ;-)

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.) To be clear what you want is NORMAL ( no sharing ) LAN1 to use WAN1 for all traffic LAN2 to use WAN2 for all traffic. Failover ( share available WAN ) If WAN1 is down, LAN1 should use WAN2 if WAN2 is do...

anav

What is your comfort level programming MT routers? The configuration is not a copy and paste exercise, you should understand what you are doing and how the different sections are related. routing, firewall rules, wireguard protocol and processes etc..... That said, wireguard is by far the easiest VP...

anav

Absolutely no ports are needed for call of duty, when using steam or other game sites.
If you are trying to run your own gaming server, good luck with that.

anav

You do not need a secondary router to segment yournetwork. Simply create as many vlans as you need and attach them to the bridge. one for home/trusted one for servers one for iot one for guests etc............. You have four ports to distribute the vlans. If you have more ports required to ensure al...

anav

As noted you are confused about the chains. WAN TO the ROUTER is input chain, think of a. vpn connection to the router b. Configuring the router WAN to LAN ( through the router) a. port forwarding normally from the www. b. upstream router subnets to NATTED mikrotik router ( aka subnets on upstream r...

anav

The default firewall rules are for the sole purpose of an individual connecting to his ISP and using the internet. Once you start changing the network it is advised to revisit the firewall rules and modify accordingly. As you have found out, the default rules are not all that clear for the beginner....

anav

Prior to using capsman, it was quite easy to setup up vlan per SSID or vlan per USER group (and assign both SSIDS to same VLAN) and have them fully separated at layer2 by vlans, at layer 3 by firewall rules and then through wifi settings decide whether or not wifi users should be able to see others ...

anav

MTs are actually very cost effective, flexible and powerful devices, just needs a brain and some patience and they work just fine.
For anybody else,, aka with a lobotomy and the attention span of gnat, yes, Asus is better.

& Kisses!

anav

Without a specific subnet to differentiate, then its more complicated as you will need to mangle and use a firewall address list to identify the IPs that are considered business. If you have the business on a different subnet, then the routing rule method is more viable. What is keeping you from add...

anav

Very reasonable request. Couple of questions........ Assuming the PPOE is a public IP?? if not is WAN1 a public IP Do you port forward to any servers on family LAN? Do you have any VPNs required ............ If not, you should consider at least wireguard vpn so that you can access your router config...

anav

It will be a complicated setup but assuming you have port forwarding to servers on WAN2 and VPNS coming into WAN2, Simply make two routes, WAN1 PRIMARY WAN2 Secondary Mangle traffic to the router, ( vpns ) Mangle traffic through the router ( port forwarding ) Send all return traffic back out WAN2 th...

anav

Depends, If you are assigned a static WANIP, its often easier just to set the IP yourself. If assigned a dynamic WANIP a dhcp client setting can make sense for route, but it depends on the ISP provider. Same with ppppoe type connection... Typically if doing something funky with routes its often bett...

anav

You should get around 300Mbps on the 5009, I suspect your config, besides wireguard is not optimal either. Most of your setup is non-standard starting with adding a vlan to bridge setup, weird dhcp settings etc... Crappy firewall rule setup etc etc.. Crappy mangling setup etc etc.. Wireguard missing...

anav

Nothing is 'normal, there are default rules for the very basic setup and the rest are ADMIN decisions.

anav

anav

Certainly, assumed you were doing wireguard that you already had basic MT setup and use under your belt.
Not a good plan if not had some practical experience

anav

What ts a white IP..............

Need config of the router
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Did you turn off queues to establish that wasnt the issue??

anav

Hi Steve, he wants to hit 10Gigs with his ISP provider. Why dont you check which routers are capable of routing 10gigs to the ISP for starters, not the CCR1009 ;-) I have an older CCR1009, I would like to replace with a newer CCR router that can handle the following: 1 uplink via Fiber 10G to my ISP...

anav

Concur with erlinden, pull the router netinstall new clean firmware and redo your setup.
Start with the default settings and for gods sake dont open up the winbox port to the internet!!

anav

Without seeing your config, its not possible to comment. Most of the time its admin error.

anav

They are not access points, those are old wifi routers that could be used as access points. However these are dumb devices, there is no vlan capability and no real management capability. You can provide one subnet per port ( and thus per AP ) on the router and thats probably the extent of the separa...

anav

Once cannot copy, suggest start fresh and clean and build config slowly. Starting with a network diagram to identify all the users/devices on the network as well as switches Aps etc.. Also, if you didnt know, Mikrotik has a website with all the details you seek. Have a look and pick which one has th...

anav

Instead of blindly posting bits of a config and asking is the config okay, Start from the beginning. a. network diagram b. identify all users ( devices, users (external, internal, admin) c. identify all the traffic they should be able to execute d. provide enough details on wan side for type of ISP,...

anav

What is the purpose of connecting without a bridge????
Easy to assign ports to a single subnet no bridge, but what is the fun in that??

anav

1. Although not blocked I would probably add an explicit allow rule in forward chain, prior to the last rule. add chain=forward action=accept src-address=192.168.88.0/24 out-interface=wireguard-inert 2. This rule is NOT required add action=masquerade chain=srcnat out-interface=wireguard-inet src-add...

anav

From a basic perspective, a single subnet and bridge work well to allow use of ones wired and wifi ports on one network. There is no need to use IP Bridge filtering here. USE NORMAL FIREWALL RULES to separate traffic at layer 3. If you had two subnets one for the bridge and most wired and wifi ports...

anav

The only guarantee is that you are the one responsible for the admin of the router and thus do things properly.
If not the admin, there is no way of knowing. I hope that makes you feel better.
Its the same with any router.

anav

Complete mikrotik config please.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Sorry I dont comment on partial configs as all parts are related, and yes your firewall rules need work.

anav

Yeah clickbait title threads I normally dont answer other than to point out the garbage title.

anav

I dont use official documentation or anyones documentation if it doesnt make sense to me. If the official documentation says jump off a cliff I am afraid we may not see you any longer. ;-) For the OP, please describe the requirements more fully before deciding on any config. Do you have any VPNs com...

anav

Your config has many errors in it, but more importantly your config also doesnt seem to match your intentions.
What are the requirements for pihole, should all vlans use it, only one vlan, what is the purpose of pihole on your network.

anav

Exactly, which I suggested above...
ROS without config should not have internet access because of exposed services.

On that we can agree LOL.

anav

Concur, not in this case but its often true, the more described up front in understanding the requirements that lead you to two wireguard interfaces, means a solution will be holistic and ensure all use cases are thought of/included.

anav

or just apply script... It seem logic is here - more stupid people are ones which cannot for any reason remove SIM than ones that don't know that lte1 needs to be enabled to have internet access (if is mitigated like that) Go ahead and rely on scripts the rest of the "real" IT human race ...

anav

Looking to see your config, to see what you are missing.

anav

Genius, brilliant! Solution of the century. So basically remove the invisible cable wire.... who would of thunk it.........

anav

Im sorry jaclaz, but you clearly missed the boat.
The OP has two subnets, one for the home lan and one for the guest wifi.
Two vlans makes much sense to me.

As for the OP, good luck, advice not followed, your in good hands with jaclaz, out.

anav

Perhaps if you were more honest about the config it would be helpful. You didnt mention why you have two wireguard interfaces for example????? There are many parts of the config, that I dont like but in terms of wireguard, you clearly do not understand how wireguard works. Your allowed IPs for being...

anav

Would it not be for the second bit...... ???? /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP1_interface" distance=1 add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP2_interface" distance=2 add dst-address=0.0.0.0/0 gateway=...

anav

1. You are attempting to have two different subnets assigned from the single bridge. There are several approaches, two bridges but not advised or two vlans, very much advised. You already have two pools.......... just complete the config...... and first add the vlans to the bridge. /interface vlan a...

anav

Why? SSH is not required if you have a wireguard connection??
Also is there a reason not to use the wireugard on the router itself?

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP info, keys etc..)

anav

For me, a detailed network diagram would help illustrate effectively what you are trying to accomplish. In general if you have a main router and then other sub-set routers connected ( creating double nat ) communication from the main router to the secondary router is easily handled by adding static ...

anav

The logic is NOT to connect to the internet until firewall rules are in place and admin information/access to router has been changed from default and secured. Relying on default anything in the router is the wrong approach. Just dont attach the cable or sim card etc, until the router is ready to be...

anav

https://www.youtube.com/watch?v=i1L2UAqrQZM

anav

So your thinking is that a client Wireguard HOST ( seeing as you are using a third party VPN provider and thus server is at the other end ) on your network vice using the router as the client itself is of course very possible. NOt sure that performance will be any better, but its a matter of appropr...

anav

Yes, if the upstream ISP or farther up line providers cannot prevent it, there is no chance in heck that RoS is going to do anything fruitful.

anav

Instead of trying to shove a wet noodle up a straw, come clean and state your USER requirements in a clear manner without discussing any actual configuration on wireguard. User X must be able to User Y must be able to User X must not be able to User Y must not be able to etc.... hypotheticals on wha...

anav

400Mbps is actually quite good!

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Ahh okay I didnt realize you had a small internet connection, the switch should be good for up to 300 down or so.

anav

No point in resetting anything as you have no idea why this happened and thus it will happen again.
Do you a copy of the config prior to hacking to show...........

Netinstall is the only viable method of putting a clean load, if the device is accessible.

anav

Post your config for review.

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

What router will you be using?

anav

Well generally speaking do not use vlan1, change that to vlan10 for your sanity. There should be no issue have the hapax3 running capsman but be aware the configuration when using it to run capsman is different than before when it wasnt. Too complex for me but search some threads in the wifi forum a...

anav

Rhetorical question, the answer is YES, remove work-arounds where possible. In this case, the cost/effort to remain compatible with major cloud providers is important in the support of the their CHR product line. To be fair, they cannot be on top of every issue and I am confident they will jump on t...

anav

(1) I will add dont mix apples and oranges. Once you go vlans, ensure all subnets are vlans, and thus the bridge does no DHCP etc, just bridging. Okay I see, that is what you have done, bridge ports was misleading..... Prefer......... clarity /interface bridge port add bridge=Bridge ingress-filterin...

anav

There are two options, the one that was stated as well as:
add action=change-mss chain=forward new-mss=1380 out-interface=wg-nordvpn protocol=tcp tcp-flags=syn tcp-mss=1381-65535

anav

Where is the the rest of the router config, firewall rules etc............ Would seem you need to just follow the pdf real close. Connected networks etc... The only real change I see is the special table routes. The rest seems to be close to good as is. /ip route add gateway=192.168.10.1 distance=1 ...

anav

Because............ they must be different in some way. Why not have a look at the configs and see what the difference is.........

anav

Get your hands dirty using the equipment, that will take a year, and then perhaps you will be ready to write something.
Nothing we can tell you will make a lick of sense without practical experience. Sorry have to write your own paper.

anav

The op was not asking for PCC, but more load balancing in the traditional way.
Yes you can somewhat load balance on PCC but its not as good at the pdf method which is more geared towards LB but a tad more complicated.

anav

No I dont need to tell myself on each config who is client for handshake and who is server for handshake. I am the admin I know what I have setup and can add comments if required.
These settings should only be required perhaps for BTH settings, certainly not normal wireguard setups......

anav

REMOTE OFFICE CONFIG 2. Based on Allowed IPs, assume you want the remote office to be able to use the internet of the Primary Office ??? ( as well as access subnets on the Main Office ). No, it must use its own internet and Wireguard for access to subnets on the Main Office 3. Your WAN setup is inc...

anav

For someone who is supposed to be adept at writing software requirements, concur it was a piss poor effort. I am thinking that the person is really someone who eats a lot and has developed processes that effectively allow him to get softer faster........... ( nothing to do with code at all ) Alterna...

anav

hoelvo, I cannot wait for you to ask another 100 hunt and peck questions! ;-PPP

Please post config, so we have a sense of your config.....
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

I have not played with the new settings yet but I will attempt to keep it cleaner and thus less confusing. SERVER for initial handshake allowedIPs=10.20.30.2/32,subnetA,subnetB interface=wg1 comment="client peer1 Hex home Router" public-key="key1" allowedIPs=10.20.30.3/32 interfa...

anav

Good to hear, and if you run into future issues, please post both configs /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) Allowed IPs describe three things 1. THE WIREGUARD NETWORK PORTION a. the wireguard subnet 0/24 ( at the client device peer at ...

anav

More space between units and between units and walls of enclosure and air circulating through, its not complicated.
Furthermore, look at at a portable air conditioner unit for the ambient air if you have no control over the room.
Electronics like cool but also DRY air.

anav

YOUR REMOTE OFFICE CONFIG 1. Fix error in config from: /ip address add address=172.16.46.1/24 comment=defconf interface =ether2 network=\ 172.16.46.0 TO: /ip address add address=172.16.46.1/24 comment=defconf interface =bridge network=\ 172.16.46.0 2. Based on Allowed IPs, assume you want the remote...

anav

Of course the foundation of the pdf is solid, and one only need to tweak it for RoS changes. I dont see the current config of the router to understand the setup you have vis-a-vis any subnets, firewall rules and existing routes. /export file=anynameyouwish ( minus router serial number, any public WA...

anav

Since you used chatgpt, does that mean you understand the config, or really dont have a clue??

anav

Dont agree, the 5ghz allows the flexibility required to deal with how the site provided wifi internet signal. If on 2ghz, then distribute to devices in the room with 5ghz and of course the reverse. If using LTE to capture signal, then having the option to deal with crowded wifi spectrum in the immed...

anav

Regarding the TOPIC
We have updated the manual with the Share function info (APP side) https://help.mikrotik.com/docs/display/ROS/Back+To+Home

Much thanks for these efforts!

anav

Very confusing without a diagram.
Do you mean you setup CHR in the cloud on some service??

anav

Concur, go back to basic config. Dont attempt to use RDP on your router, even enterprises have stopped using RDP with all their edge router firewalls and fancy protections etc........most if not all have moved to citrix like setups. As intimated, if you need to provide secure access, wireguard ( or ...

anav

Without seeing the main router (server for handshake ) settings, hard to say.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

I think i have one hap ax lite lte somehwhere, i will test it. If it works that is great. Mikrotik wifi is now rock solid... So WPA3 and PM is the issue here... I have an ax3 setup as a router and AP in the basement, its pretty decent with WPA2 only..... However the capac also in the basement is at...

anav

Well if you go by the title of the thread it does intimate what erlinden is suggesting, ( a wireguard server on the NETWORK, not on the router ).

anav

Along with leaked usernames which sindy pointed out, your firewall rule has an unsafe rule! Note: You have queues on both routers, this may cause slowdown if fastrack is turned on, but not 100% sure if your simple queue inputs affect fasttrack. I would test with queues on and then removed to see if ...

anav

Good to hear! Assuming that the persistent keep alive settings are only there to identify what is set on the peers themselves...... In terms of the router setup the only thing I would likely change is the access by admin. You have two separate accesses setup, and I would merge into one. There is no ...

anav

Connecting to the internet prior to having at least the requisite firewall rules in place is a fools game, unless one is into gambling.

anav

/export file=anynameyouwish ( minus router serial number, any public wanip information, keys, etc. )

anav

Two things I would change, (1) On the Client for handshake change the allowed IPs from 10.1.38.1/32 to: 10.1.38.0/24 (2) The allowed Ips cannot include 10.0.0.0/8 on both routers! It is ONLY to identify either a. remote subnet that local users need to reach OR b. remote subnet whose users need to ac...

anav

My rules of thumb
DISABLE IPV6
Ensure there are only two IPV6 firewall rules....
add chain=input action=drop
add chain=forward action=drop

That way if somehow you inadvertently enable IPV6, or an update enables it, your ass is covered.

anav

Yes, its amazing how clearly you can articulate the facts, with so few words. :-) Simply port forwarding the incoming wg port to the lanip of the wireguard server ON THE NETWORK . Confusion stems as the OP stated he is running the wireguard ON THE 5009 In any case you can port forward to any IP addr...

anav

Hi Holvoe perhaps you understand the requirement a bit better. 1. Is the OP trying to have clients attempt to reach Server at Router B via the public IP of Router A, and then have that traffic enter a wireguard tunnel and travel to Router B where the server resides?? OR 2. Is the OP trying to force ...

anav

Sorry on vacation. Still a problem??

anav

Zyxel doesnt do wireguard??

anav

Provide a diagram as you are unable to articulate clear requirements in writing.
Also recommend stating requirements NOT in config speak but in terms of use cases and users traffic that needs to be executed.

anav

Post both configs to see what is going on. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.). Conceptually once a wireguard connection is established, both ends keep the other end up to date on the relevant WANIP. Hence if the main router changes its ...

anav

1500 vpn endpoints,,,,,,,,,,,,, I would not use wireguard as you want something more enterprise.....
Look at cloudflare options or some sort of enteprise ipsec offering.

anav

Conceptually I understand you have a third party VPN provider (proton) of which you want to send ONE IP address out the wirguard for external internet. This is easily accomplished without any Mangling. Instead use Routing Rules. 1. Table add fib name=useProton 2. Route add dst-address=0.0.0.0/0 inte...

anav

Why not host wireguard on RB3011 directly??

anav

thanks khaaleex, Im ipv6 illiterate so any help in that regard is greatly appreciated. I suppose the OP thought his brainwaves were powerful enough that we knew he was using IPV6.

anav

My bad I missed that connection point, need glasses LOL.
in that case will only work if the APs are managed and can pass vlans.

anav

Sure I understand how it works, and its simple in terms of what is allowed or not allowed, and it appears you have made it way more complex than required. When a remote user comes in you simply allocate firewall rules accordingly on the incoming side, for good security.......... Examples: wg subnet ...

anav

CHR 1. Missing local network..........in address /ip address add address=10.0.123.1/24 interface=wireguard_CHR network=10.0.123.0 add address=192.168.130.1/24 interface=bridge network=192.168.130.0 2. Adjust, simplify NAT, too messy.......... /ip firewall nat add action=masquerade chain=srcnat out-i...

anav

Treat the capac as an AP not a router......... Assuming vlan20 is the trusted subnet. There is a clue in the error in your bridge port settings *A Assuming ether1 is trunk port to Router, will use ether2 as an off bridge backup or easy management access. Remove the IP dns static setting...... /ip dn...

anav

Wrong again, many people have wired connections between APs. Very common if one is using a AP based router as an AP/switch. Even my capac has two ports so that I can wire in from the main router and yet feed another smart or dumb device from the other connection. Depends on the type of AP and the re...

anav

To be clear, users do not have direct access to this off site other company server. Your Routers fixed WANIP is whitelisted so as to be able to reach that server. First you need to establish local router access to this whitelisted server ( aka from your LAN ). If you can do this, then remote wiregua...

anav

Last I checked, there's plenty of vpn or equivalent sneaky ways to get a MT to bypass a state based vpn block, that doesnt require some 'magic' plugin for MT that "would work", but other existing mechanisms already onboard dont... Please enlighten us as most States have ways of detecting ...

anav

The connection from your 5009 to the switch via proper direct trunk port works fine. If you attempt to connect two smart devices in between some dumb devices, results are never guaranteed. Suggest your connection points include small managed switches if neeed be so it looks like 50009 -----> small m...

anav

Very similar in some regards......... one needs an input chain rule to allow the wireguard port to hit the router itself. As long as the dyndns rule resolves to the public IP of your router, you are golden. If the public IP is given to the ISPs upstream device ( aka modem ) you will need to be able ...

anav

As erlinden intimates, the requirement is not clear. Wireguard is its own separate entity and needs no VLAN. Through wireguard allowed IPs and firewall rules one can direct users coming in and going out as needed. There is no wireguard network on a vlan perse..... You can have users coming in throug...

anav

All three routers have to have WAN connections to reach each other. If one router goes down, then it is no longer in play period. The other two can still reach each other. The exception to the above, which may be a possibility in your case ( vague diagrams ), is if two routers of the routers can be ...

anav

Im going to slap an electron carbon tax fine on you for a waste of a post ( or awful humour ) take your pick ;-P

anav

In zyxel vernacular this one was one to one NAT............
I think in MT lingo you want to research NETMAP

anav

Just to note, on the first page of the article you stated you had already read............... PCUNITES vlan bible. quote: Native, Base, & MGMT (management) VLAN: As you create your VLANs and pick VLAN IDs for each one, understand that the base network that you used to initiate your first connect...

anav

The good news is that soon there will be a useable MAC and linux version of winbox. RIght now its a beta, not ready for beginners IMHO, heck I am not using it either. Infabo, put yourself in the shoes of newbie regarding usability and you will come to a different conclusion. By that I mean, dont ass...

anav

Remove your serial number from your post above! Is an AP so all router crap for the most part is removed. Ether 2 on the capax will be used as a SAFE off bridge port to configure or access the AP. ****** Remove client from AP, you have set correctly the AP to get a static set IP of 192.168.88.2 outs...

anav

What is the purpose of joining the two routers, clearly stated requirements drive the config.
In other words describe the user traffic that needs to be executed.

anav

Not sure what you mean.
Do you have two PPPOE WAN connections ( aka the router is a client to the ISP)

Same ISP, two different PPPOE logins?
Two different ISPs????

anav

No idea what mess you have without the configs of both routers. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, etc. ) One has to ensure the correct allowed addresses in wirguard setting, matching with ip routes if required for remote subnets and finally...

anav

The rule of thumb when controlling both ends IS to match MTU, I think the default is 1420 not 1500 on the MT.
In any case, if one know the MTU setting at the other end, the first thing to try is matching it on the MT.
Then the rules above.

anav

Sorry I coudnt get you there, the WAN situation was a bit over my head for sure.

anav

My understanding is, at least for wireguard, if your router is the client for handshake, typically to 3rd party providers, then one can use either of these two settings, and depending upon the provider one may work better than the other. I have not heard of adding this setting to the Server (for han...

anav

Knowing which Netgear router would help....... Knowing which MT AP would also help. In general the idea is that the netgear gives each AP a different IP address. Each AP has a basic setup as follows..... ( yours may have less LAN ports for example ) ( assuming the Netgear subnet is 192.168.1.0/2 and...

anav

Correct! Wireguard on WAN2 will not work at the moment. PUt in the following dstnat rule and it should work... /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN add action=dst-nat chain=dst-nat dst-address-type=local in-interface=l2tpBouyg-4G dst-port=13232 protocol=udp to-a...

anav

From the first link above............ Check it out. Simple Network Interface WireGuard works by adding a network interface (or multiple), like eth0 or wlan0, called wg0 (or wg1, wg2, wg3, etc). This network interface can then be configured normally using ifconfig(8) or ip-address(8), with routes for...

anav

In a nutshell, allowed IPs is the key to success, The server router (for handshake) denotes each peer individually by its /32 address. DO NOT DEVIATE. Each client typically for max flex denotes the server by the subnet address............ especially true and germane for client routers for handshake....

anav

Just to be clear everything except wireguard is working fine? Can you connect on wireguard ORG that is coming through on WAN1 fine? Only issue is not being able to connect directly on WAN2 ? If so that makes sense as the config seems fairly correct in terms of wireguard. The only problem should be f...

anav

You clearly do not understand how wireguard works, Its a peer to peer connection. That means you cannot on the server assign 0.0.0.0 .............................where is the peer to peer Furthermore, ALL traffic from the router (be it originating outbound over the tunnel or return traffic, will NEV...

anav

Did you make the changes I have provided in the last two posts yet??
When you do, then repost the config for viewing please.

anav

Apparently ARP is a very viable method of what you are doing with it. Similar to ping and the only difference is ARP would not be used recursive routing which is where I am used to it being used. As was explained to me, Ping is checking to see if if something is UP or ON, while ARP is checking if so...

anav

In terms of firewall.......... You have given access to configure the router to the ENTIRE LAN so all users could potentially access the config of the router....... Normally we do not do so as they have no need. We only give permission to the admins YOu can do that by source address list hence the b...

anav

I see red lines on your mangle rule so will start there....... Did you put the red colors in or did the router?? Why do you have the word add?? its not part of the config???? Get rid of icmp protocol........... Should be: /ip firewall mangle action=mark-connection chain= input connection-mark=no-mar...

anav

Network diagram and configs of both routers
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

I did, your allowed IPs are wrong. I gave you an example of how to fix them. The remote laptop and android phone, should now be able to reach any LAN subnet or your router for config purposes if your firewall rules permit that. No special dstnat or sourcenat rules required at all for wireguard in th...

anav

Whats your point.............. Send a supout if youve found a bug.

anav

Sweet shouldnt take too long to fix up then.. Sadly capsman screws up my knowledge of vlans and how they are supposed to be configured but will attempt anyway I find it strange that you do not have pool for vlan TH ?? I find it very strange that you do not have dhcp-server for TH ?? Why you are hidi...

anav

reviewing Just to be clear a. You are setting up this device as ROUTER not only a switch b. The ATT router gets a public IP address ****** c. You can forward ports on the ATT device to the LANIP of the Mitkrotik device. ( on the lan subnet of the ATT ) ****** your IP cloud setting shows the public I...

anav

Sounds like your firewall rules are the problem...... use something like the default rule set with proper modifications /ip firewall address-list { dhcp leases set statically } add address=adminIP1 list=Authorized comment=adminPC add address=adminIP2 list=Authorized comment=adminlaptop add address=a...

anav

Draw a diagram, your explanation is more confusing than helpful.
and post complete config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

If this is an internet facing router your firewall rules suck.
Side note: If you have a vlan fully open to another vlan ( two way comms), perhaps it should just be one vlan?

anav

Traffic flow is directed by the /interface bridge ports and /interface bridge vlans. In other words they instruct where VLANX goes in and out of ports and whether or not its flowing out of a port tagged or untagged and whether or not its tagged coming into a port etc.. The firewall rules are there t...

anav

What most do is simply have a rule at the end of the forward chain for example add chain=forward action=drop comment=Drop all Else Thus unless you have rules above this allowing traffic, EVERYTHING else is blocked. So typcially one has allow LAN interface list to WAN interface list for internet allo...

anav

1. In your config I see this... Which indicated an error that needs to be resolved. /interface pppoe-server server add interface= *B service-name=service1 AND /ip address add address=100.0.41.1/20 disabled=yes interface= *B network=100.0.3 2.0 AND add address=10.14.0.2/16 disabled=yes interface= *15...

anav

Yeah my bad, there is no script for DHCP server its just one long winded DHCP Client script LOL.

Looking at your routes........
What is check-gateway=arp not familiar with that usage............ how does it compare to ping........ or more accurately , why using arp?

anav

It is fine for the basic generic setup the OP was looking for in terms of: TAKING the default firewall set of rules and a. make them efficient b. change concept to block all and identify needed traffic above block all rule. If its good for your scenario, if different from a single subnet one bridge ...

anav

Lists within lists is not possible.
What is your requirement exactly that would require such a functionality for home or even small business..........
That cannot be solved via existing interface list and firewall address list. ???????????

anav

..............................

yup.jpg

anav

To assist, you need to detail all the requirements clearly since there is a lot going on a. identify each user/device, groups of users/devices including admin and external users b. identify what traffic they need to accomplish. Discuss what each WAN is expected to be used for. Part of PCC group of W...

anav

Yes, that would be the best way.
Another method is to rent a Server and setup CHR MT instance in the cloud, they can be had for around $8 a month.

anav

/export file=anynameyouwish ( minus router serial number, any public wanip information, keys, etc.)

anav

Complete rewrite! ip firewall filter {input chain} add action=accept chain=input connection-state=established,related,untracked add action=drop chain=input connection-state=invalid add action=accept chain=input protocol=icmp +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ add action=accep...

anav

Wow, glad you managed that, I would have been lost in that WAN setup. Changes/additions only. Not asking you to delete any config, just modify existing config or add config. # model = CCR1036-12G-4S /interface list add name=WAN add name=LAN /interface list members add interface=ether2-MGTM list=LAN ...

anav

What is the purpose of FOUR routes, I was only expecting two?? /ip route add comment="To connect ORG srv" dst-address=10.42.0.0/24 gateway=10.42.17.121 add comment="To connect to Bouygue srv" dst-address=89.81.69.0/24 gateway=10.223.130.120 add comment="Default route via Ora...

anav

Okay, all good info, yes it should load balance any connection coming from vlan7,ether10. I dont understand the purpose of your complex scripts.......... Why are they needed especially the dhcp server???? You seem to have two sets, DHCP server and DHCP clients etc.... THe dhcp client assuming ISP......

anav

Okay, much clearer thanks!!

So is the purpose of the two separate wireguard interfaces is to have both up at all times, one for WAN1 and one for WAN2.. makes sense to me.
Which is primary WAN and which is secondary WAN?

anav

Why use all these complicate code, when you can just go to IP Cloud and turn it on. Then router does everything for you. To get the IP address in code: :put [/ip cloud get public-address] Jotne, I want to put the dynamic wanip in a dstnat rule. Note the comment for identification/location purposes....

anav

Remove serial number above. To be clear. a. are you using the MT as a server for handshake for two wireguard interfaces. b. are you using the mT as client for handshake for two wireguard interfaces. c. are any of your WANIP addresses public? d. if No, can you forward the wireguard port to your MT ro...

anav

So is the mikrotik AX3 not the server for your wireguard network??? If it is, which I conclude as you have the input chain rule to accept the handshake, then your allowed IPs are incorrect. Each road warrior needs their specific config line. Its peer to peer VPN, thus one rule for all makes no sense...

anav

Until I see the config, I am unable to comment further

/export file=anynameyouwish (minus router serial number, any public wanip information, keys etc. )

anav

Okay that is excellent progress!
Now you only want to load balance vlan7 to all the ISPs correct?
Your laptop you want to use a specific ISP?
What is on etherports 5,6 ??
What is the purpose of SFP and which ISP should it use......

anav

On routerB, the allowed IPs entry for routerA then require only one entry 0.0.0.0/0 as it covers all possible IP addresses. If you intend to ask a million followup questions simply post both configs when you do. /export file=anynameyouwish (minus router serial number, any public wanip information, k...

anav

With clarity and truth, comes better discussion and solutions!!! In this case there is no difference to anything Ive said thus far. No need to mangle for WAN1 as its primary. For WAN2, again no change for what Ive stated, but the only difference is the addition of a wireguard work around rule due to...

anav

viewtopic.php?t=210523#p1094206

anav

Yes, that should work........ /interface bridge ports add bridge=bridge1 ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether2 pvid=10 comment="home subnet" add bridge=bridge1 ingress-filtering=yes frame-types=admit-priority-and-untagged interface=WLAN5ghz pvid=10 ...

anav

The diagram is extremely helpful if nothing else to point to as a reference. It would seem that the logical config entails the following 1. R1 is the SERVER for handshake on WAN1 for all routers. Thus R1 is a wireguard server on WAN1 FOR: R2 (client peer), R3 (client Peer), R4 (client peer ). 2. Via...

anav

I would assume that he ordered initially a switch but needed a router ???

anav

Why are you complaining here instead of simply asking for assistance, like normal people do??

anav

Regarding use of the routing table action.......... a. lookup --> basically means use the preferred table but if not available router can look at main table for an alternative active route --> out the local WAN for example. b. lookup-only-in-table ---> means if the preferred table is not available t...

anav

examples of firewall rules
viewtopic.php?t=153581#p855249

simply in the forward chain, prior to the last rule ( Drop all else )
Add in the traffic required device A to Subnet B or Subnet C to device D for example.........

anav

examples of firewall rules
viewtopic.php?t=153581#p855249

simply in the forward chain, prior to the last rule ( Drop all else )
Add in the traffic required device A to Subnet B or Subnet C to device D for example.........

anav

A provided full config, for review would be helpful (minus router serial Number, and any public WANIP information )

anav

When I saw that rules and you have your chains mixed up, I threw up and left for awhile.
Just came back to say, put chain rules together, makes it much easier to read and troubleshoot issues, as rules are processing within a chain, in the order they are presented and order is important.

anav

In general, and to keep it SIMPLE, for the main router with DHCP, all vlans are tagged with bridge.
For MT devices not being the primary router, aka acting as an AP/Switch, ONLY the management VLAN needs to:
a. be identified as a vlan
b. be tagged on the bridge.

anav

1. Did you forward port 45586 on the upstream router to the LANIP of the mikrotik router?? Easy to do if you go the path I suggested /ip address add address= 192.168.xx.yy interface=ether1 network=192.168.xx.0 Vice this........ /ip dhcp-client add interface=ether1 +++++++++++++++++++++++++++++++++++...

anav

Anything is possible, but in isolation I would be leery of providing any advice before understanding the complete config. /export file=anynameyouwish (minus router serial#, any publicWANIP info,keys, etc.) WHy for example do you not have table main routes for all three WANs?? in addition to any requ...

anav

Yes! The problem is the traffic reaches the server but the return traffic does not!! Its being forced to WAN2 by the routing rule!!! Think about it if you have: /routing table add fib name=useWAN2 /ip route add dst-address=0.0.0.0/0 gwy=ISP2 routing-table=useWAN2 AND the appropriate routing rule: /r...

Search found 21168 matches