MikroTik

anav

Not sure if Client settings are correct.
Should just be enabled and try setting the server to 192.168.0.1

Ensure on the upstream router that you have something like
add chain=input action=accept comment="timing" in-interface-list=LAN src-address=192.168.0.21 dst-port=123 protocol=udp

anav

Once you have a solid VLAN network config, then we tackle BTH after.

anav

I would separate out devices as well. For example cameras separate from media. Just in case something funky happens untrusted company x.y.z do not have access to your cameras. Vlans are free cheap and easy so make as many as you need. To be clear you need to block access from these devices to the in...

anav

I dont care about AWS or digital ocean, the CHR as you stated on a cloud server simply works. Stick with that.

anav

What no bridge, I feel nakid!!

I would still use vlans LOL.
Each vlan assigned to each port ;-PPPP

anav

Accessing winbox is done by FIRST connecting VIA wireguard to the CHR on digital ocean. Then use winbox on pc, or winbox app on smartphone From there you can reach a. the MT router behind NAT to config the router b. the subnets behind NAT to access servers. CHR DEVICE: add chain=forward action=accep...

anav

Sure setup up the CHR as the server peer for handshake, and set up the ground router behind nat at the client peer for handshake.
many examples in the forum

anav

No idea what digital ocean is, so your first statement is meaningless. Is this a server on your LAN, is it a server in the cloud that you control, etc etc.. Technically: Why are you port forwarding winbox ports?? Do you not know that winbox is a router service and not a LAn service?? Security : Why ...

anav

Either way works, agreed that separation makes it clearer and more conducive to changes if expected. Normally we are simply talking trunk ports, and one can easily add vlans or remove them without to much fuss.

anav

Looks like somebody has not read the manual. Please stop with the stupid trolling. Hey if that comment is for me, I am actually trying to provide constructive improvements to the guides. It would better inform new persons and also enable the correct and smart rextended's of the world, to respond wi...

anav

So this is just another dyndns type service, nothing more nothing less? Is it free as well?
Sadly cannot be used to replace BTH LOL

anav

confused, you only have one vlan. Suggest expensive switches can be ditched for some basic 5 port TPLINK switches. I will gladly take these overkill devices off your hands. Will send $$ for postage. In other words I see no effort to neither actually read the offered article, nor watch the offered vi...

anav

This is not paid support keep your underwear on, be patient!! A few things, 1. what is this guest network all about, its only defined in firewall address list ?? 2. Allowed IPs is incorrect. if the MT is the Server peer for handshake, the client peers EACH should be assigned as separate peers, with ...

anav

1. Certainly recommend updating the firmware to 7.16.2. If you do it manually (or selecting updates automatically) it will have to be done in two steps first to 7.12.1 and then second to 7.16.2 2. Duplicate Ip address /ip address add address=192.168.55.1/29 interface=OffBridge20 network=192.168.55.0...

anav

PC Steam Warframe If you are playing any steam game you dont need to change anything on the PC or router, it just works. The only time you should need to use funky settings is if port forwarding or using other platforms that are finicky like x-box or nintendo. Steam PC based on my experience has no...

anav

I still dont understand the request.
The router should have a management vlan.
Is your question, how to access the management vlan remotely.............why are you asking here, the answer is via VPN. Surely you know that??

anav

Yes i did and thus made the following suggestion to aid in MT communications and transparency. https://forum.mikrotik.com/viewtopic.php?t=213203#p1114262 I should add another one..... for the CLOUD page: Summary MikroTik offers multiple services for your RouterBOARD devices that are connected to the...

anav

Perhaps a bit of clarity in MT Docs will help! Overview Sub-menu: /ip cloud Packages required: routeros RouterOS version required: v7.12 and newer Hardware requirements: ARM/ARM64/TILE architecture devices Back To Home is a convenient and free feature whose 'uptime' is not 100% guaranteed*** and sho...

anav

Mikrotik DDNS is down.
who is Facing the same problem

HAHA, did you even bother to read the forum threads to find out, there are at least two others noting same.........

anav

There is another way as well to accomplish the same using DNS and probably is the easier method. LAN A - 10.10.10.0/24, unifi controller is 10.10.10.15 LAN B - 192.168.168.1/24, AP1 192.168.168.5, AP2 192.168.168.20 /ip dhcp-server network add address=192.168.168.0/24 dns-server=192.168.168.1 domain...

anav

No worries, I do the same with several gurus......... I saw this on another thread which reminded me of APs trying to talk to controller. This was the way... /ip dhcp-server option add code=43 name=unifi value=0x0104C0A81E02 So I recalled previous work on this front;. This is but an example but shou...

anav

No they need to protect their services with cloudflare and then have the eureka moment of making cloudflare zerotrust an option package on at least ARM routers LOL.

anav

That is correct, the isolated subnet is INDEED isolated as its behind the MT router. What kind of exposure would you like to give the isolated network besides access to the internet?? Not sure but I thought the IP of the switch was 192.168.0.21, not sure why you changed it to .2 ?? Also this is wron...

anav

Great service if it was reliable, but since it relies on Mikrotik servers, and since they dont protect their servers, the BTH and IP cloud in general is not fit for business and should only used for home environments, case in point today with Issues, which also are disrupting forum posting and acces...

anav

Yes, and the rest of the IPs follow in order for additional members.

anav

Why do you bother on cloud router, there is no etherport2.
If you dont mean a cloud hosted router then provide a network diagram and in either case
provide both MT configs at each end of the connection
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

OH NO........ its back LOL, and now Mynetname is hosed and of course with that BTH.................
Its high time mikrotik used the services of cloudflare this is ridonkulous.

anav

orange=problem=remove

how are you playing warframe ( pc to steam )? (nintendo switch)??

anav

From my reading, tls 1.3 is a no-brainer.

anav

1. Dont get fancy with interface lists //interface list add name=WiFi add name=WAN add name=LAN 2. Remove WAN from Bridge!! add bridge=BRIDGE interface=ether1-WAN 3. Remove or disable this rule, only for advanced users. /interface bridge settings set use-ip-firewall=yes use-ip-firewall-for-vlan=yes ...

anav

1. The MAIN issue for wireguard internet --> Forward chain firewall rule should work but its not, good question! Try this to see if it fixes it. add action=accept chain=forward comment="VLAN Internet" in-interface-list=VLAN out-interface-list=WAN { this should work as wg is part of vlan in...

anav

For last time...... viewtopic.php?t=213165#p1113997

@AMMO see this thread for your thoughts.. viewtopic.php?t=213177#p1113986

anav

Okay well thats very good to know. That solution was optimal but based on the upstream router being capable of vlans. Since this is not the case, it will be simpler but vlans are still the way to go on the switch. VLANS is better than two bridges. 1. Ensure you use the offbridge approach to config t...

anav

Sorry, no kid gloves here. By the way, after the 1000th person who says they read the article and know what they are doing in vlans, only to trip on their own 3rd leg, it gets old, and thus sometimes I lack patience! I understand the angst of getting locked out. Hence I always do the following --> T...

anav

yeah the first thing I do in every config is blow up capsman and obliterate IPV6. They are like parasites that drain my energy

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc. )

anav

All smart switches come with PVID of 1 on all ports, its removed only when setting up access ports with a different vlan tag. All trunk ports keep pvid1 as untagged, in the background. Normal. 1. Ensure you identify the trusted or management vlan, should not be 1 obviously. This is the vlan where th...

anav

For the fastrack rule. simply add this. /ip firewall filter add action=fasttrack-connection chain=forward connection-state=\ established,related connection-mark=no-mark This avoids the slowdown of the router not behaving well when attempting to fastrack mangled traffic. Now since the majority of tra...

anav

/export file=anynameyouwish (minus router serial number, any public WANIP information,keys etc. )

anav

Without context, and a clear set of requirements it near impossible to fathom your requirements. ( could care less about pinging requirements as that is different from traffic flow ) Its a fools game to attempt to answer your questions without more information. Do you want. 1. Both wans accessible b...

anav

edit- duplicate

anav

As always please post the full and most current config for review.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long assed dhcp lease lists, unecessary and not used IPV6 crapola )

anav

Yes, bit of tongue in cheek there, but concur, lack of resources ;-) to ensure the router is up to date. This is not like wifi7 which entails buying new hardware and adapting etc......... and also waiting for optimal pricing, new kid off the block has highest initial costs until they are mass produc...

anav

teleport is this still an issue with 7.16.2?
timing issues were resolved to my knowledge and if not we should know about it and report to Mikrotik to fix.

anav

So the ubiquiti is the Server Peer for handshake, So why this bizarre setup? Here is the configuration from the Ubiquiti [Interface] PrivateKey = privkey Address = 192.168.9 .2/ 32 DNS = 192.168.9. 1 It should be [Interface] PrivateKey = privkey Address = 192.168.9. 1 /32 DNS = 192.168.9. 1 OR [Inte...

anav

When a company fails to communicate properly, it is left to others to speculate.
This is where MTs marketing and communications director is a complete failure.

my guess --> Lazy
What i hope its not --> lack the technical competence to code it in.

anav

The Server does not pickup the new address, its the client that has to establish the handshake, well if there is a certain gap in time anyway. Post both full configs to see what may be causing the issue. /export file=anynameyouwish (minus router serial number, any public WANIP information, vpn keys ...

anav

Even my brother printer I just bought has tls 1.3 LOL. What a farce.

anav

My personal experience with wireguard between two routers both on same ISP network with 1gig connections was in the 300 range.
Also curious as to what others see.

anav

Okay so you want the Switch to act as a router and pass some off the LAN subnets from the router directly to local portson the switch (transparently) and then some local ports to get local DHCP etc........ This is how I would do it. Coming from main router. vlan10 - this translates to the subnet on ...

anav

You forgot to add the address of the device which is provided on the trusted vlan. I usually make this a static lease setting on the main router. Yes getting locked out doing vlan filtering is a problem thats why I came up with this solution years ago.... to avoid vlan filtering hiccups, and to conf...

anav

Talking to a birdie, yes its very much possible to establish a wireguard connection between two hex refreshes, even if one does not have an internet connection. When you said they have to talk to each other do you mean the subnets or at least one subnet on apartment B router has to be able to reach ...

anav

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list.

That would be for remote user access to the config of the router, I thought he was asking for access to the LAN subnets......

anav

Okay here is the way. On your router make a firewall address list like so /ip firewall address-list add 192.168.216.2 list=BTH-to-WAN add 192.168.216.3 list=BTH-to-WAN .... add 192.168.216.XX list=BTH-to-WAN /ip firewall add chain=forward action=accept src-address-list=BTH-to-WAN out-interface-list=...

anav

Not clear what you are trying to accomplish with layer7 rules. I think it could be a total waste of time. I see some dstnat rules attempting to capture some traffic to send to a specific dns server on the LAN.g The users or devices being captured, are they in a specific subnet, or are they a group o...

anav

Now moving to firewall rules...... 1. Dont understand your logic at all. For example why do you include the second rule when the first rule covers everybody already...... Who in the MGMT interface is not already in list VLAN........................ :-) Further, why do you want everybody besides thos...

anav

A warning sign --> have a pretty good handle on VLAN routing, UH OH :-) 1. You should really upgrade to 7.16.2, if you upgrade manually you have to do it in two steps, first to 7.12.1 and then to 7.16.2 2. Why five pools when you only have four VLANS? Ahh I see why, you didnt read the reference give...

anav

/interface bridge port add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether1 add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=16 add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-u...

anav

So your saying that I ping your public IP it will get to you?? In that case why are you even using BTH, I mean if you have a public IP?? So I can reach a server on your LAN easily then. Yes you will. Because BTH is a bit simpler to configure (via app) and should work even if my (IPIP6) tunnel is te...

anav

Concur, wireguard is good for two endoints where both are connecting to the WWW, in your case its only one end that as www access.
Here is a decent vid on macsec --> https://www.youtube.com/watch?v=8A5pt39nFfM&t=760s

anav

Hard to day without seeing what you are doing on your config.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc. )

anav

Hi all,
I came across this and noticed is it still not fixed using hostname as Endpoint.

Could someone direct me to where and how to resolve this please ?

No longer an issue...........

anav

So your saying that I ping your public IP it will get to you??
In that case why are you even using BTH, I mean if you have a public IP??
So I can reach a server on your LAN easily then.

anav

I am not aware of the address range used, so you are saying it starts the first one given to the admin on his smartphone as 192.168.216.2 and the next .3 and so forth. In that case yes, Just go straight to firewall rules. add chain=forward action=accept comment=BTH WAN" src-address-list=BTH-use...

anav

Picky Picky Picky. ( we were talking aps, not switches )
If going to that extreme we should ensure we inform the op that antennas and sfp modules cannot run ROS.

anav

Interesting, ECMP sure is much less complex in terms of sharing the load in case one of the WANs is not available. In load balancing, it can turn into a huge nightmare of extra mangles and routes. I am not convinced your recursive is correct I would do it this way. dst-address=0.0.0.0/0 gateway=ca.n...

anav

1. Which WAN will customers use to acccess your wireguard? 2. your firewall rules need work for example you have two rules that are redundant. --> add action=drop chain=input comment="WANs : protection DNS" dst-port=53 \ in-interface-list=Liste_WANs protocol=tcp add action=drop chain=input...

anav

SUMMARY Wireguard is not the main problem!! 1. Why do you lie about the facts?? Quote: "On the router: 4 vlans with each a specific IP addressing. Bridges are not used . IP/SEC configuration IKE2 is not used." From config: /interface bridge add name=bridge_EURAFIBRE add name=bridge_FREE ad...

anav

Why two bridges instead of one ?

...

If I wrote something wrong someone will correct me.
First line is not correct

Looks good to me! ;-PP

anav

Every device runs ROS, so every device can act as a router if that is your question. I would not recommend any product until its clear what the requirements are. a. type of internet connections b. throughput of ISPs c. if WIFI is required, size of location, number of rooms etc... d. any other networ...

anav

Listent to the experts who understand the config process and how they interrlate (vice copy and pasting). On each device use the off bridge process to conduct the vlan filtering configurations, saves one much grief. Update each device to 7.16.2, if you do it manually you need to go to 7.12.1 first t...

anav

No, I’m not using mangle for Wireguard but rather to get DDNS detection to recognize the static IPv4 instead of the one behind my provider’s CGNAT. The static IPv4 is not forwarded via NAT but routed through the IPIP6 tunnel. This has been working flawlessly in manual configuration for years. Yes, ...

anav

@Ammo: does this sound right. Challenge: Allow BTH users to go out internet and LAN. a. Establish BTH network with 5 users plus admin b. Do select NO for lan access initially --> I have a reason. :-) Go to /ip/firewall/address-list and copy down all the user Ip addresses. c. Unselect NO for lan acce...

anav

So do you want to run the new device as a router or as an accesspoint/switch? In either case to avoid vlan filtering hiccups, and to config from a safe spot, recommend you take ether5 off the bridge . /interface ethernet set [ find default-name=ether5 ] name=OffBridge5 /ip address add address=192.16...

anav

You are in good hands with Iwertugrul, moving on.

anav

The only thing I can suggest is a shot in the dark but its the only idea I have. add a firewall address list manually /ip firewall address-list add IPaddress-peer1 list=back-to-home-lan-restricted-peers add IPaddress-peer2 list=back-to-home-lan-restricted-peers However I do not know what that looks ...

anav

The vlans for the wans are created on the router, but do not require any subnet information. They are terminated on either IPDHCP client settings, or pppoe settings or even straight address on the router. The nice thing about splitting the rest of the vlans on a different port is you dont have the m...

anav

IF there was no capsman it would be like so. This is the audience in ap/switch mode and will assume the vlan10 is the trusted vlan where the audience gets its IP address from. /ip interface add name=TRUSTED /ip interface member add interface=vlan10 list=TRUSTED /ip address add address=vlan10(assigne...

anav

Were you by chance having users in the same LAN trying to read the server by WAN IP dyndns URL???
This is alleviated by moving users or server to a different LAN

anav

Adjust mangles. ( in-interface not required on mark routing as its already captured in the mark connection! ) /ip firewall mangle { traffic to the router ) add action=mark-connection chain= input connection-mark=no-mark \ in-interface=ether1-ISPA new-connection-mark= incoming-isp 1 passthrough=yes a...

anav

vlan 1 is the default pvid on EVERY port on EVERY managed switch.
It is removed for all access ports and hybrid ports but remains in the background as an untagged default vlan on trunk ports.
For management of all smart devices use a separate management vlan or a trusted vlan

anav

Keeping with the routing rule theme sindy suggested.. It would look like no mangling and the following routing rules.... TRY THIS FIRST as its much easier. /routing rule add action=lookup-only-in-table min-prefix=0 table=main add action=lookup-only-in-table src-address=10.0.2.0/24 table=ISP1 add act...

anav

For me the error was using capsman jajaajaja. I can do vlans very easily without capsman,,,,,,,,,,, somebody else will have to provide direction.

anav

+1 ....

anav

Very confusing nomenclature, There is no need to change etherport names, but if you must then at least have etherport3 name=LAN-3, and so forth. I would not have thought of using bridges for grouping traffic like you have. Now that its clear you are doing port forwarding, the mangle rules get more c...

anav

Yup each WAN incoming to the switch1 (in room1 ) is an access port to a different vlan. Then trunk port carrying both vlans and any other vlans that need to go to room1, are added to this trunk heading to switch 2 At switch 2, trunk to the router carrying both WAN vlans, any vlans from Room1 and Any...

anav

Also its nice to tells us different requirements, but if you dont post the most update config, we have no idea where things are at. Thus everytime you make changes post the new config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc..) Also state all t...

anav

As requested
/export file=anynameyouwish ( remove router serial number, any public WANIP information, vpn keys etc.)

Should be quick to fix once seen.

anav

You may not see me anymore on the forums. With my wifi7 I will just be a blur if noticed at all.

anav

For anyone later that follows this thread;;;;;;; In this case since there is only one subnet and the prefix rule is basically doing the equivalent to: /routiing rule add action=lookup-only-in-table src-address=192.168.88.0/24 dst-address=192.168.88.0/24 table=main The value in using the min-prefix=0...

anav

what does a print look like of ip routes or a screen shot of the table.

anav

1. I see one change to be made here but since you were consistent it didnt cause any problems. /interface ethernet set [ find default-name=ether1 ] name=ether1-ISPA set [ find default-name=ether2 ] name= ether 1 -ISPB Should be: /interface ethernet set [ find default-name=ether1 ] name=ether1-ISPA s...

anav

Spouse is getting iphone 16, it can handle wifi7. Guess who will be buying a tplink the first sale I see on their wifi7 products.......

anav

publish latest config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

Full config not what you think we need to see............

anav

Think about the logic. One should understand the function of allowed addresses:. On inbound, it checks if the remote source address coming in is on the list! On outbound, it checks in order of the rules as they appear, a. does the destination exist. and b. assign it to the right peer. The first peer...

anav

Not applicable to the AP scenario, was speaking to its router suitability.

anav

Although with wan throughput effectively capped at about 1.1 gigs, the 2.5 has limited utility.

anav

No worries, if macvlan works and is appropriate for your ISP setup.

Fix the the routing rule and see what happens.
Post config again after changes.

Note the only change on routes is I added recursive but not necessary.
also no need to make main route have distance anything but the default of 1.

anav

The router is a Mikrotik RouterBoard RB951Ui-2nD hAP. It is brand new.

So you bought a new betamax ???

I hope your ISP provides a throughput of less than 200Mbps............

anav

Also add this rule.
/ip neighbor discovery-settings
set discover-interface-list=LAN

anav

Possible yes, a good idea probably not.
Why?
It only has 10/100 ports.

So it can at best serve your clients with 100mbps and of course can only handle 100Mpbs coming from any ISP.
We have no information as to the WAN connections available or to the expectation and uses of clients.

anav

Orbi mesh WIFI? Doubt that will play nice with mikrotik wifi. My advice is to look at the new hex refresh router for the main router and use oRBi products as APs only. Its good for an ISP up to 500Mbps, but if you need or anticipate getting a 1 gig connection in the next five years. the suggestion o...

anav

The easiest way to provide access to a third party wireguard service is via WIFI. Simply make a virtual WLAN just for internet access to nord......... If you have the option one can dedicate a vlan and ensure those needing access at their desks, have a managed switch next to the PC ( old hexes are g...

anav

1. Your pool is add name=dhcp ranges=10.0.0. 150 -10.0.0. 240 Why is any device getting a LANIP of .130 ? ??? 2. Routes look messed u ( or maybe I dont understand how to apply ecmp ) Should be...... at least for Version 7. Assumes ecmp is the primary and a few need to go out pppoe8 ( Edit, now I rea...

anav

If by IP you have to add the port, so 192.168.1.1 :winboxPort# Your routes are a mess ( also dont use same ip dns addresses in recursive routers so changed them) This is correct. /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway=8.8.4.4 scope=10 target-scope=12 comment="WAN 1"...

anav

This rule is a simple default rule for the home user not making any changes etc.. Once you start making changes one of the first things I do is: From 14 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN TO ad...

anav

Another option is to create a second wireguard interface except this one is live all the time on wan2. Assuming you want a faster migration to a working VPN, then waiting for the router to tell the client hey my WANIP has changed use this one now.

anav

Well would have to see the MT config to comment constructively. Yes there should be no need to reach the config from the client network??? Why?? The management network is there for that purpose. The only other access is via ether8 direct on site. /export file=anynameyouwish (minus router serial numb...

anav

No worries, do what you want, I will be assisting others that are more compliant. One can easily setup all the WIFI and SSIDs, without the vlans as the last step in the connecting the dots is done on /interface bridge port and /interface bridge vlan. However you wont have any traffic flowing but you...

anav

To ensure there are no other items on your config that may be contributing to the issue.
Basically to look at the evidence and facts, vice just heresay.

anav

/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc._

anav

No the 5009 need not have any wifi settings. It runs the vlans, on the wifi device we associate the wlans to the vlans via / interface bridge port/bridge vlan

anav

I would run the wapax as an AP/switch not a router. I would create and distribute all the vlans required from the RB5009

anav

So you have another mikrotik router at a different location that you are trying to connect to the unifi?
Like I said nothing is clear, no diagrams provided.

anav

Yup, following, as per my post there, cannot grasp the logic yet......

anav

So I have gotten a public IP via DHCP from Starlink. Setup DDNS on the Unifi GW. Also have options for setting up Wireguard server or client on GW, have successfully connected phone and desktop First, I was not aware that starlink provided public IPs, can you confirm? Also, its getting messy regard...

anav

Almost caught up. Just trying to follow the traffic flow starting at the controller. My logic is missing something in these steps. :-( 1. How does the controller know to look for a machine at 192.168.200 or 192.168.201. 2. Assuming it knows for some reason, following the bouncing ball........... Sin...

anav

Sweet pic, nice !!!

anav

Most of us simply connect via mac address, just click on the mac address and done.
if you want to use IP address ensure you also put in the port number for winbox. If let to default not required, but I never use the default LOL

anav

I will look at the entire config only, a working config is the sum of its parts, only showing a section is not conducive to success.

/export file=anynameyouwish ( minus router serial number, any publicWANIP information, vpn keys etc. )

anav

neki is bang on. it you wanted to give the 2011 a fixed IP address, then simply use IP address with interface vlan64 and not use IP DHCP client. Assuming Ether1 is the trunk port, and dont setup ports for people to access if not desired ( for example lets say only ether2 is used for home ! Also on s...

anav

edit, no l onger requred

anav

Wifi 7 devices.

anav

Step back one. Remember port forwarding is based upon a destination port. So I use the public IP of the connection as the destination address and the dst port/protocol. When that arrives at the main router, the router looks at the NAT rules and sees a corresponding dstnat (port forwarding) rule, the...

anav

Good news. Public IP on main router allows many things. a. remote road warrior or you as admin to access Main router via wireguard b. remote machine behind private IP can reach wireguard (using LTE as wireguard client router) +++++++++++++++++++++ via the main router c. admin while remote can reach ...

anav

Hola, That is a very good plan. I often suggest the same, as its very easy for users to decide which country they want to access internet from ( or remote LAN devices ) by use of SSID ( different wlans ). Very easy to setup!, once you get the device setup in spain, I can assist via skype/discord/tea...

anav

1. remove router serial number from initial post of config 2. need firewall rules 3. probably should upgrade to 7.16.2 latest firmware 4. probably should use vlans (https://forum.mikrotik.com/viewtopic.php?p=1111667#p1111667) 5. use normal pool setups Summary your vlan and pools and setup is a colos...

anav

Understood, your parents are getting ripped off. They should provide a router with 2.5gb output on a single port. The only thing to do here is use three of the four output ports on the ISP router as three WAN inputs ether1,2,3 on the 5009 Load balance them as three different inputs and you will have...

anav

AX3 is much better value IMHO, but of course its your budget. Both are capable of hosting wireguard. Since you require the opposite from normal, need internet out of client peer router, what I would do is create two wireguard tunnels. ONE JUST for the internet, for users on spain LAN to go out inter...

anav

Correct, the way BTH works in a nutshell. Concept. Mikrotik provides relay servers that both the router and devices reach out too. The relay server connects them. DONE. Doesnt matter if your behind an ISP router or CGNAT or starlink etc......... a. On the hex refresh router, enable IP cloud and enab...

anav

MISSING!! Besides the disabled=yes error, where is the interface? designated on that rule. Try /ip firewall mangle add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn...

anav

What model of mikrotik routers do you have in Venezuela and Espana?

anav

Basically a typo. From this: /interface list add name=VPN-WG /interface wireguard add listen-port=13232 mtu=1420 name=wireguard1 /interface list member add interface=wireguard1 list=VPN-WG /ip firewall address-list add address=10.19.99.0/24 list= WG-VPN TO /interface list add name=VPN-WG /interface ...

anav

The wireguard settings look correct to me. The extra routing rules to find the non local subnet are bang on. The firewall rules allow traffic from one subnet to another. Mystery at this point. You do have weird DHCP settings, that I have never seen and you have all kinds of funky DNS settings that I...

anav

HOME ROuter - again I dont see any issue here other than rearranging order of forward chain rules. see if that helps at all. Other than that, since I despise capsman will blame it LOL. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked"...

anav

Could not find any major on PERSTORP Firewall forward chain rules have to be moved in the order, and remove the old ones!!! /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked /ip firewall ...

anav

Many assumptions and questions from an inadequate initial explanation. Assuming that the ISP is not putting out 2.5ghz to either the ONT/modem or the ISP Router after the ONT `is based on the OP assuming the ports on the Router are only gigabit capable. We dont have a model # / Make and the OP may h...

anav

How are you keeping the client devices endpoint address updated - aka what is it pointed at???

anav

I would suggest wireguard BTH but that is not possible with your old and discontinued router. Suggest the new HEX refresh with ARM processor, is an excellent low cost device, that will handle your router needs and can conduct BTH wireguard, which is designed to use mikrotik relay servers so that you...

anav

Based on your input, you want the L1009 to act as a router on the company network. The first thing is to ask your IT department if this is permitted as normally personal devices on a company network are not permitted. If you are in the IT department then I suppose its a request for some separate LAN...

anav

Its a phuckng PILE of CWAP........ The new config for wifi reminds me of 10 years ago getting tools for kids from china, where the written instructions in english are so bad its comedy material.
The MT wifi config is NOT intuitive and borders on stewpid, and is no laughing matter.

anav

Great, network diagram so we know the topology, and both configs.......
/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc.)

Use code blocks around export ( black square with white square brackets on same line as Bold and Underline ).

anav

In over my head......but where is vlan102 in IP DHCP client settings???

/ip dhcp-client
add add-default-route=special-classless default-route-distance=100 \
dhcp-options=vendor-class-identifier interface=vlan-altibox-voip \
use-peer-dns=no use-peer-ntp=no

anav

Recommend moving to 7.16.2.

Do you simply mean that the second device is connected to the first device by ethernet cable and you want to us the second device as an AP/switch ??

anav

What is the purpose of this thread??
Links to unknown sites are not recommended

anav

Closest looks like Thailand or Vietnam

anav

Impossible to define requirements.......and thus OP should a. identify all users/devices ( internal/externals and admin) b. identify all traffic they require without referring to any config speak. Also details on your wans separately How many. Public or private IP, static or dynamic, Detail which wa...

anav

A plan is a great start, ensure you capture all the traffic requirements such as vlan to vlan, shared printer etc, ( external incoming, any port forwarding or vpns --> at least wireguard so you as admin can remote in to the router ) You need either a trusted vlan ( home ) or create one specific just...

anav

What I do when configuring vlans is take one port off the bridge!! /interface ethernet set [ find default-name=eth8 ] name=OffBridge8 /ip address add address=192.168.77.1/30 interface=OffBridge8 network=192.168.77.0 /interface list member { only need one interface list on this device } add interface...

anav

Strange ask but I guess you dont want anyone with access to be able to manually set 1-24 Assuming your IP address is set to 192.168.88.254 interface=bridge network=192.168.88.0 I would create a firewall address list of 192.168.88.25-192.168.88.253 list=ALLOWED /ip firewall filter add action=accept c...

anav

If you have level enterprise control over the browser, then that is possible. My experience at the enterprise level is that the whole YOUTUBE is just not accessible.

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions.......... Or, Mikrotik fixes their implementation to work like the rest of RouterOS. That is my first choice too! Why wireguard is allowed to deviate from standard Mangle practices is be...

anav

the config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

The point being is that 7.16 has most of the vers7 bugs worked out and has all the latest security improvements and most access to newest features. Its the way to go for sure at this point. If one has a business or provides services to businesses, the recommendation always is to test new firmware in...

anav

Concur, confusing explanation is an understatement.......... Need a least a detailed diagram to sort out context.
Impossible to define requirements.......and thus OP should
a. identify all users/devices ( internal/externals and admin)
b. identify all traffic they require

anav

Unless solving really means overcome brain fart..............

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions..........
Perhaps other vendors handle wireguard differently so that its not a problem for the more complex routing subnets?

anav

Why the question asking the question?
Typically the LTS is acutally the most stable version available, who doesnt want that (rhetorical question)!
However, I have moved off vers6 on my main router recently to ver 7.16, as an LTS for ver7 seems unlikely.

anav

Hi Jaclaz, so the switch and LANA would be on the same private LAN subnet ( provided by the isp modem router) as the HEX? If this is the case then all users on LANB will be able to reach LANA. With sourcenat outgoing, all LANB user traffic would appear to come from router itself, so return traffic i...

anav

That has nothing to do with the router!
The router does not change ports on outbound, and thus its your server that is doing that ( changing the destination port when leaving the server )

anav

niche in the sense that its for experts only doing more complex configs and they are not trivial nor a small number of cases.
As for a broken config, that is the reason for the hack!!
If the hack doesnt work for a more complex case, then stop being lazy and come up with a better hack.

anav

Dont forget to install at least the common firewall rules on the 5009, probably have to do it manually. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=accept chain=input com...

anav

How many bridges do you have............ I know some have used the fact of two chips on the unit to allow two bridges ports 1-A and B-Last port.
But other than that you should only use one bridge normally.

anav

And the horse you rode in on AMMO. I never said that other than multiwan setups on the main routing tables was trivial.............. There is a need for multiple approaches for the very basic through to BGB/OSPF VRP etc.......... Nor did I say that Mikrotik focussing on either home users or advanced...

anav

Nope........... Be it a two port or multiport device,

Take the extra port off bridge and do all your configuration from there safely.
give the port an ip address, use the ipv4 settings on laptop to access port and router.

anav

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups.

anav

No worries, there are many here with more patience! Ur in good hands on the forum.

anav

and here I thought holvoe was answering an incontinence question.

anav

If the ISP is blocking wireguard, the fact that you have tried numerous ports tells me that they are checking DPI, into the weeds to see the type of traffic. Therefore suggesting BTH is fruitless. However, if the lack of connection is either a. operator config error b. no access to public IP Then BT...

anav

No worries, you came for help, I asked for the information to make that possible and then you decide magically you know where the problem is (or isnt) and thus I have to question why did you come for help in the first place. I have limited time and your wasting it.

anav

1. The mistake is putting the WAN vlan on the bridge................. 2. You only have three ports active, 3 and two on the bridge 8, and sfp, so what in tarnation is ether6 doing in your config for example or ether4 for example 3. Forgot to tag bridge......... 4. Wrong address EDIT: my mistake crap...

anav

VLANS are not required, although much more flexible and recommended if you run out of ports and need to send multiple subnets out a port to a switch or access point etc.. IP address assign subnetA to ether2 assign subnetB to ether3 assign both to interface list=LAN Then in forward chain firewall rul...

anav

But then that rule (or a similar one) should go in chain forward. Quick recap: 1. chain input=connection to the router 2. chain forward=connection through the router Well stated except that similar rule is also bogus in forward chain as we drop all there as well!! add action=fasttrack-connection ch...

anav

1. Assuming your mikrotik has a public IP and is the SERVER peer for handshake for your devices that need to connect remotely, then this is all that one should see. For some reason you have peer side noise in allowed Ips, which makes me think this was created by using BTH vice manual. Nothing wrong ...

anav

Thanks for the config and continual understanding of the requirements both very helpful Before I delve into the config, output chain is not required to do what you need. One simply needs a firewall rule and routing mechanism to do so, while not conflicting with other traffic. Linking to other sites ...

anav

I really can't see anything When you provide nothing, nothing can be seen. So lets get some clarity. What is the home mikrotik router? model and I assume you have no public IP. Confirm you also have a CHR in the cloud that you use as the wireguard server for handshake. The idea being you as a remot...

anav

First a diagram as I have no idea what you mean about remote servers............ Right now I am assuming you have cloud servers behind a CHR. Second With a full config nothing really useful can be provided, I prefer not to guess. /export file=anynameyouwish (minus router serial number, any public WA...

anav

Lets start with the main router ONLY, it will handle vlans, dhcp and its own local wifi. Capsman will NOT be used............ starts singing Celebrate good times, come on (Let's celebrate) Follow the guidance document as suggested --> https://forum.mikrotik.com/viewtopic.php?t=143620 Create all the ...

anav

No you get rid of it, not required. Its also wasteful, in that all good traffic has to go through that rule before the rest of the rules not efficient. That traffic already captured by the last rule....... Since you didnt answer the question --> what are you afraid of??? You can do want you want, op...

anav

This topic has gotten off the rails. 1. For the OP, most of us dont worry about blocking intervlan traffic because that is just a continuation of the default safe setup MT provides for newbies. Most of use, first thing, is turn the concept of block a few known bad things and allow everything else, T...

anav

The 5009 should be connected to the MODEM The HAP should be connected to the 5009 The HAP should be ideally or most simply setup as an AP/Switch with no dhcp responsibilites ( done on 5009 ) your best tutorial on this is: https://forum.mikrotik.com/viewtopic.php?t=143620 when planning the network en...

anav

As was stated, dont start the config until a. you have a plan for the network ( a network diagram helps ) b. you have identified -- all the users/devices on you network (both external/internal and admin) -- have described the traffic they require to accomplish. Sorry a config cannnot be made in part...

anav

Just to add to that, the managment or trusted vlan is where all attached smart devices should get their LANIP from. So in addition to the data vlans ensure the management vlan also goes through the trunk to the CISCO. Surprized you dont use vlans already by the way. If this is the first time, then e...

anav

Nice, its good to start once you have plan on paper as its much easier to see where things fit together on a config. There should be no issues to the VLANID you use at either router, just MAKE SURE that no two subnets are the same. However we never ask for PCUNITES view of the world for configuratio...

anav

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

Hi Jaclaz, my intention was generic, thanks for pointing that out, in which case the OP only needs to allow local/vpn admin associated IPs to the input chain from the LAN side.

anav

Yeah I /ip firewall address-list add address=192.168.77.X list= Authorized comment="admin desktop" add address=192.168.77.Y list=Authorized comment="admin laptop" add address=192.168.77.Y list=Authorized comment="admin smartphone" /ip firewall filter add action=accept c...

anav

These two rules are almost the same: add action=accept chain=input src-address-list=allowed_to_router add action=accept chain=input in-interface-list=LAN Is an excellent start if the src-address-list is comprised of your LOCAL admin IPs ( wired/wifi/vpn if any) aka only those devices that need acces...

anav

Nice try............. Not the complete config.

Also didnt answer the questioWhat is your intention with this rule.
block WAN access To the router
OR
bloc WAN access to your subnets/LANn.....

What are you afraid of??

anav

I am confused by your explanation, do you mean you have separate WAN connections to the VMIs, and TVs?? I dont see those connections on the diagram Okay I get it now, you think NAT is the mechanism to provide internet to users,,,,,, its actually firewall rules that do so. So to be clear do you mean ...

anav

Reading your first post. Want anyone using ethernet 5, to go out proton wireguard for internet. 1. Wireguarg does not get an IP pool. It simply an interface with a subnet ( it carries traffic from other wireguard address, typically incoming or outgoing and also, router to router it carries subnets)....

anav

{rant on} It amazes me that we are asked to make a definitive call on a question on someones config, and they have the audacity to only show firewall rules. The config is a connected piece of work and thus a partial view is next to useless. {rant off} If your USER rules on input chain never get any ...

anav

Do you understand how the firewall chains work in Router OS. Asking about a single rule, is not going to solve the issue of not understanding how to apply them properly/safely. What is your intention with this rule. block WAN access To the router OR bloc WAN access to your subnets/LAN I think you sh...

anav

Ignore the bad advice above to modify the existing configuration.

The router should not be connected to the internet so remove.
1. use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
2. Then should have a decent starting point firewall.

anav

The point is you dont have to create a subnet for the WAN traffic, just create a vlan, which will carry the data to the 5009. Untagged port at the switch on the port to the ISP modem, added to the trunk port going to the other switch, added to the trunk port on second switch coming from first switch...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

You've misunderstood me so I must have not expressed myself clearly............... Other way round! In the old hookup there were two connections coming to the 5009 ( one from ISP modem ) and one from closest switch In the new hookup, there is only one connection available to the 5009 and that is si...

anav

The only example I can think of is if there is some need for a 0.0.0.0/0 allowed IP on the server router, and thus any other needs would require a separate wg interface

anav

It sounds like their equipment may be expecting a specific subnet? 192.168.0.1 or 192.168.1.1 ???
Can you plug one into a pc directly to test?

anav

I think the OP has a bug in his brain!, but to be accurate its a worm.

To upgrade Routerboard, use System --> RouterBOARD that updates

anav

1. Typically UNIFI requires the management or trusted vlan UNTAGGED, and the rest of the data vlans tagged. What is not clear to me is your trusted subnet, is it vlan10 production or vlan20 home.......... Since you have unifi untagged on 10 will assume its production. 2. All your /interface bridge p...

Search found 22073 matches