MikroTik

anav

My personal experience with wireguard between two routers both on same ISP network with 1gig connections was in the 300 range.
Also curious as to what others see.

anav

Okay so you want the Switch to act as a router and pass some off the LAN subnets from the router directly to local portson the switch (transparently) and then some local ports to get local DHCP etc........ This is how I would do it. Coming from main router. vlan10 - this translates to the subnet on ...

anav

You forgot to add the address of the device which is provided on the trusted vlan. I usually make this a static lease setting on the main router. Yes getting locked out doing vlan filtering is a problem thats why I came up with this solution years ago.... to avoid vlan filtering hiccups, and to conf...

anav

Talking to a birdie, yes its very much possible to establish a wireguard connection between two hex refreshes, even if one does not have an internet connection. When you said they have to talk to each other do you mean the subnets or at least one subnet on apartment B router has to be able to reach ...

anav

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list.

That would be for remote user access to the config of the router, I thought he was asking for access to the LAN subnets......

anav

Okay here is the way. On your router make a firewall address list like so /ip firewall address-list add 192.168.216.2 list=BTH-to-WAN add 192.168.216.3 list=BTH-to-WAN .... add 192.168.216.XX list=BTH-to-WAN /ip firewall add chain=forward action=accept src-address-list=BTH-to-WAN out-interface-list=...

anav

Not clear what you are trying to accomplish with layer7 rules. I think it could be a total waste of time. I see some dstnat rules attempting to capture some traffic to send to a specific dns server on the LAN.g The users or devices being captured, are they in a specific subnet, or are they a group o...

anav

Now moving to firewall rules...... 1. Dont understand your logic at all. For example why do you include the second rule when the first rule covers everybody already...... Who in the MGMT interface is not already in list VLAN........................ :-) Further, why do you want everybody besides thos...

anav

A warning sign --> have a pretty good handle on VLAN routing, UH OH :-) 1. You should really upgrade to 7.16.2, if you upgrade manually you have to do it in two steps, first to 7.12.1 and then to 7.16.2 2. Why five pools when you only have four VLANS? Ahh I see why, you didnt read the reference give...

anav

/interface bridge port add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether1 add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=16 add bridge=bridge1 ingress-filtering=yes frame-types=admit-only-u...

anav

So your saying that I ping your public IP it will get to you?? In that case why are you even using BTH, I mean if you have a public IP?? So I can reach a server on your LAN easily then. Yes you will. Because BTH is a bit simpler to configure (via app) and should work even if my (IPIP6) tunnel is te...

anav

Concur, wireguard is good for two endoints where both are connecting to the WWW, in your case its only one end that as www access.
Here is a decent vid on macsec --> https://www.youtube.com/watch?v=8A5pt39nFfM&t=760s

anav

Hard to day without seeing what you are doing on your config.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc. )

anav

Hi all,
I came across this and noticed is it still not fixed using hostname as Endpoint.

Could someone direct me to where and how to resolve this please ?

No longer an issue...........

anav

So your saying that I ping your public IP it will get to you??
In that case why are you even using BTH, I mean if you have a public IP??
So I can reach a server on your LAN easily then.

anav

I am not aware of the address range used, so you are saying it starts the first one given to the admin on his smartphone as 192.168.216.2 and the next .3 and so forth. In that case yes, Just go straight to firewall rules. add chain=forward action=accept comment=BTH WAN" src-address-list=BTH-use...

anav

Picky Picky Picky. ( we were talking aps, not switches )
If going to that extreme we should ensure we inform the op that antennas and sfp modules cannot run ROS.

anav

Interesting, ECMP sure is much less complex in terms of sharing the load in case one of the WANs is not available. In load balancing, it can turn into a huge nightmare of extra mangles and routes. I am not convinced your recursive is correct I would do it this way. dst-address=0.0.0.0/0 gateway=ca.n...

anav

1. Which WAN will customers use to acccess your wireguard? 2. your firewall rules need work for example you have two rules that are redundant. --> add action=drop chain=input comment="WANs : protection DNS" dst-port=53 \ in-interface-list=Liste_WANs protocol=tcp add action=drop chain=input...

anav

SUMMARY Wireguard is not the main problem!! 1. Why do you lie about the facts?? Quote: "On the router: 4 vlans with each a specific IP addressing. Bridges are not used . IP/SEC configuration IKE2 is not used." From config: /interface bridge add name=bridge_EURAFIBRE add name=bridge_FREE ad...

anav

Why two bridges instead of one ?

...

If I wrote something wrong someone will correct me.
First line is not correct

Looks good to me! ;-PP

anav

Every device runs ROS, so every device can act as a router if that is your question. I would not recommend any product until its clear what the requirements are. a. type of internet connections b. throughput of ISPs c. if WIFI is required, size of location, number of rooms etc... d. any other networ...

anav

Listent to the experts who understand the config process and how they interrlate (vice copy and pasting). On each device use the off bridge process to conduct the vlan filtering configurations, saves one much grief. Update each device to 7.16.2, if you do it manually you need to go to 7.12.1 first t...

anav

No, I’m not using mangle for Wireguard but rather to get DDNS detection to recognize the static IPv4 instead of the one behind my provider’s CGNAT. The static IPv4 is not forwarded via NAT but routed through the IPIP6 tunnel. This has been working flawlessly in manual configuration for years. Yes, ...

anav

@Ammo: does this sound right. Challenge: Allow BTH users to go out internet and LAN. a. Establish BTH network with 5 users plus admin b. Do select NO for lan access initially --> I have a reason. :-) Go to /ip/firewall/address-list and copy down all the user Ip addresses. c. Unselect NO for lan acce...

anav

So do you want to run the new device as a router or as an accesspoint/switch? In either case to avoid vlan filtering hiccups, and to config from a safe spot, recommend you take ether5 off the bridge . /interface ethernet set [ find default-name=ether5 ] name=OffBridge5 /ip address add address=192.16...

anav

You are in good hands with Iwertugrul, moving on.

anav

The only thing I can suggest is a shot in the dark but its the only idea I have. add a firewall address list manually /ip firewall address-list add IPaddress-peer1 list=back-to-home-lan-restricted-peers add IPaddress-peer2 list=back-to-home-lan-restricted-peers However I do not know what that looks ...

anav

The vlans for the wans are created on the router, but do not require any subnet information. They are terminated on either IPDHCP client settings, or pppoe settings or even straight address on the router. The nice thing about splitting the rest of the vlans on a different port is you dont have the m...

anav

IF there was no capsman it would be like so. This is the audience in ap/switch mode and will assume the vlan10 is the trusted vlan where the audience gets its IP address from. /ip interface add name=TRUSTED /ip interface member add interface=vlan10 list=TRUSTED /ip address add address=vlan10(assigne...

anav

Were you by chance having users in the same LAN trying to read the server by WAN IP dyndns URL???
This is alleviated by moving users or server to a different LAN

anav

Adjust mangles. ( in-interface not required on mark routing as its already captured in the mark connection! ) /ip firewall mangle { traffic to the router ) add action=mark-connection chain= input connection-mark=no-mark \ in-interface=ether1-ISPA new-connection-mark= incoming-isp 1 passthrough=yes a...

anav

vlan 1 is the default pvid on EVERY port on EVERY managed switch.
It is removed for all access ports and hybrid ports but remains in the background as an untagged default vlan on trunk ports.
For management of all smart devices use a separate management vlan or a trusted vlan

anav

Keeping with the routing rule theme sindy suggested.. It would look like no mangling and the following routing rules.... TRY THIS FIRST as its much easier. /routing rule add action=lookup-only-in-table min-prefix=0 table=main add action=lookup-only-in-table src-address=10.0.2.0/24 table=ISP1 add act...

anav

For me the error was using capsman jajaajaja. I can do vlans very easily without capsman,,,,,,,,,,, somebody else will have to provide direction.

anav

+1 ....

anav

Very confusing nomenclature, There is no need to change etherport names, but if you must then at least have etherport3 name=LAN-3, and so forth. I would not have thought of using bridges for grouping traffic like you have. Now that its clear you are doing port forwarding, the mangle rules get more c...

anav

Yup each WAN incoming to the switch1 (in room1 ) is an access port to a different vlan. Then trunk port carrying both vlans and any other vlans that need to go to room1, are added to this trunk heading to switch 2 At switch 2, trunk to the router carrying both WAN vlans, any vlans from Room1 and Any...

anav

Also its nice to tells us different requirements, but if you dont post the most update config, we have no idea where things are at. Thus everytime you make changes post the new config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc..) Also state all t...

anav

As requested
/export file=anynameyouwish ( remove router serial number, any public WANIP information, vpn keys etc.)

Should be quick to fix once seen.

anav

You may not see me anymore on the forums. With my wifi7 I will just be a blur if noticed at all.

anav

For anyone later that follows this thread;;;;;;; In this case since there is only one subnet and the prefix rule is basically doing the equivalent to: /routiing rule add action=lookup-only-in-table src-address=192.168.88.0/24 dst-address=192.168.88.0/24 table=main The value in using the min-prefix=0...

anav

what does a print look like of ip routes or a screen shot of the table.

anav

1. I see one change to be made here but since you were consistent it didnt cause any problems. /interface ethernet set [ find default-name=ether1 ] name=ether1-ISPA set [ find default-name=ether2 ] name= ether 1 -ISPB Should be: /interface ethernet set [ find default-name=ether1 ] name=ether1-ISPA s...

anav

Spouse is getting iphone 16, it can handle wifi7. Guess who will be buying a tplink the first sale I see on their wifi7 products.......

anav

publish latest config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

Full config not what you think we need to see............

anav

Think about the logic. One should understand the function of allowed addresses:. On inbound, it checks if the remote source address coming in is on the list! On outbound, it checks in order of the rules as they appear, a. does the destination exist. and b. assign it to the right peer. The first peer...

anav

Not applicable to the AP scenario, was speaking to its router suitability.

anav

Although with wan throughput effectively capped at about 1.1 gigs, the 2.5 has limited utility.

anav

No worries, if macvlan works and is appropriate for your ISP setup.

Fix the the routing rule and see what happens.
Post config again after changes.

Note the only change on routes is I added recursive but not necessary.
also no need to make main route have distance anything but the default of 1.

anav

The router is a Mikrotik RouterBoard RB951Ui-2nD hAP. It is brand new.

So you bought a new betamax ???

I hope your ISP provides a throughput of less than 200Mbps............

anav

Also add this rule.
/ip neighbor discovery-settings
set discover-interface-list=LAN

anav

Possible yes, a good idea probably not.
Why?
It only has 10/100 ports.

So it can at best serve your clients with 100mbps and of course can only handle 100Mpbs coming from any ISP.
We have no information as to the WAN connections available or to the expectation and uses of clients.

anav

Orbi mesh WIFI? Doubt that will play nice with mikrotik wifi. My advice is to look at the new hex refresh router for the main router and use oRBi products as APs only. Its good for an ISP up to 500Mbps, but if you need or anticipate getting a 1 gig connection in the next five years. the suggestion o...

anav

The easiest way to provide access to a third party wireguard service is via WIFI. Simply make a virtual WLAN just for internet access to nord......... If you have the option one can dedicate a vlan and ensure those needing access at their desks, have a managed switch next to the PC ( old hexes are g...

anav

1. Your pool is add name=dhcp ranges=10.0.0. 150 -10.0.0. 240 Why is any device getting a LANIP of .130 ? ??? 2. Routes look messed u ( or maybe I dont understand how to apply ecmp ) Should be...... at least for Version 7. Assumes ecmp is the primary and a few need to go out pppoe8 ( Edit, now I rea...

anav

If by IP you have to add the port, so 192.168.1.1 :winboxPort# Your routes are a mess ( also dont use same ip dns addresses in recursive routers so changed them) This is correct. /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway=8.8.4.4 scope=10 target-scope=12 comment="WAN 1"...

anav

This rule is a simple default rule for the home user not making any changes etc.. Once you start making changes one of the first things I do is: From 14 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN TO ad...

anav

Another option is to create a second wireguard interface except this one is live all the time on wan2. Assuming you want a faster migration to a working VPN, then waiting for the router to tell the client hey my WANIP has changed use this one now.

anav

Well would have to see the MT config to comment constructively. Yes there should be no need to reach the config from the client network??? Why?? The management network is there for that purpose. The only other access is via ether8 direct on site. /export file=anynameyouwish (minus router serial numb...

anav

No worries, do what you want, I will be assisting others that are more compliant. One can easily setup all the WIFI and SSIDs, without the vlans as the last step in the connecting the dots is done on /interface bridge port and /interface bridge vlan. However you wont have any traffic flowing but you...

anav

To ensure there are no other items on your config that may be contributing to the issue.
Basically to look at the evidence and facts, vice just heresay.

anav

/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc._

anav

No the 5009 need not have any wifi settings. It runs the vlans, on the wifi device we associate the wlans to the vlans via / interface bridge port/bridge vlan

anav

I would run the wapax as an AP/switch not a router. I would create and distribute all the vlans required from the RB5009

anav

So you have another mikrotik router at a different location that you are trying to connect to the unifi?
Like I said nothing is clear, no diagrams provided.

anav

Yup, following, as per my post there, cannot grasp the logic yet......

anav

So I have gotten a public IP via DHCP from Starlink. Setup DDNS on the Unifi GW. Also have options for setting up Wireguard server or client on GW, have successfully connected phone and desktop First, I was not aware that starlink provided public IPs, can you confirm? Also, its getting messy regard...

anav

Almost caught up. Just trying to follow the traffic flow starting at the controller. My logic is missing something in these steps. :-( 1. How does the controller know to look for a machine at 192.168.200 or 192.168.201. 2. Assuming it knows for some reason, following the bouncing ball........... Sin...

anav

Sweet pic, nice !!!

anav

Most of us simply connect via mac address, just click on the mac address and done.
if you want to use IP address ensure you also put in the port number for winbox. If let to default not required, but I never use the default LOL

anav

I will look at the entire config only, a working config is the sum of its parts, only showing a section is not conducive to success.

/export file=anynameyouwish ( minus router serial number, any publicWANIP information, vpn keys etc. )

anav

neki is bang on. it you wanted to give the 2011 a fixed IP address, then simply use IP address with interface vlan64 and not use IP DHCP client. Assuming Ether1 is the trunk port, and dont setup ports for people to access if not desired ( for example lets say only ether2 is used for home ! Also on s...

anav

edit, no l onger requred

anav

Wifi 7 devices.

anav

Step back one. Remember port forwarding is based upon a destination port. So I use the public IP of the connection as the destination address and the dst port/protocol. When that arrives at the main router, the router looks at the NAT rules and sees a corresponding dstnat (port forwarding) rule, the...

anav

Good news. Public IP on main router allows many things. a. remote road warrior or you as admin to access Main router via wireguard b. remote machine behind private IP can reach wireguard (using LTE as wireguard client router) +++++++++++++++++++++ via the main router c. admin while remote can reach ...

anav

Hola, That is a very good plan. I often suggest the same, as its very easy for users to decide which country they want to access internet from ( or remote LAN devices ) by use of SSID ( different wlans ). Very easy to setup!, once you get the device setup in spain, I can assist via skype/discord/tea...

anav

1. remove router serial number from initial post of config 2. need firewall rules 3. probably should upgrade to 7.16.2 latest firmware 4. probably should use vlans (https://forum.mikrotik.com/viewtopic.php?p=1111667#p1111667) 5. use normal pool setups Summary your vlan and pools and setup is a colos...

anav

Understood, your parents are getting ripped off. They should provide a router with 2.5gb output on a single port. The only thing to do here is use three of the four output ports on the ISP router as three WAN inputs ether1,2,3 on the 5009 Load balance them as three different inputs and you will have...

anav

AX3 is much better value IMHO, but of course its your budget. Both are capable of hosting wireguard. Since you require the opposite from normal, need internet out of client peer router, what I would do is create two wireguard tunnels. ONE JUST for the internet, for users on spain LAN to go out inter...

anav

Correct, the way BTH works in a nutshell. Concept. Mikrotik provides relay servers that both the router and devices reach out too. The relay server connects them. DONE. Doesnt matter if your behind an ISP router or CGNAT or starlink etc......... a. On the hex refresh router, enable IP cloud and enab...

anav

MISSING!! Besides the disabled=yes error, where is the interface? designated on that rule. Try /ip firewall mangle add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn...

anav

What model of mikrotik routers do you have in Venezuela and Espana?

anav

Basically a typo. From this: /interface list add name=VPN-WG /interface wireguard add listen-port=13232 mtu=1420 name=wireguard1 /interface list member add interface=wireguard1 list=VPN-WG /ip firewall address-list add address=10.19.99.0/24 list= WG-VPN TO /interface list add name=VPN-WG /interface ...

anav

The wireguard settings look correct to me. The extra routing rules to find the non local subnet are bang on. The firewall rules allow traffic from one subnet to another. Mystery at this point. You do have weird DHCP settings, that I have never seen and you have all kinds of funky DNS settings that I...

anav

HOME ROuter - again I dont see any issue here other than rearranging order of forward chain rules. see if that helps at all. Other than that, since I despise capsman will blame it LOL. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked"...

anav

Could not find any major on PERSTORP Firewall forward chain rules have to be moved in the order, and remove the old ones!!! /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked /ip firewall ...

anav

Many assumptions and questions from an inadequate initial explanation. Assuming that the ISP is not putting out 2.5ghz to either the ONT/modem or the ISP Router after the ONT `is based on the OP assuming the ports on the Router are only gigabit capable. We dont have a model # / Make and the OP may h...

anav

How are you keeping the client devices endpoint address updated - aka what is it pointed at???

anav

I would suggest wireguard BTH but that is not possible with your old and discontinued router. Suggest the new HEX refresh with ARM processor, is an excellent low cost device, that will handle your router needs and can conduct BTH wireguard, which is designed to use mikrotik relay servers so that you...

anav

Based on your input, you want the L1009 to act as a router on the company network. The first thing is to ask your IT department if this is permitted as normally personal devices on a company network are not permitted. If you are in the IT department then I suppose its a request for some separate LAN...

anav

Its a phuckng PILE of CWAP........ The new config for wifi reminds me of 10 years ago getting tools for kids from china, where the written instructions in english are so bad its comedy material.
The MT wifi config is NOT intuitive and borders on stewpid, and is no laughing matter.

anav

Great, network diagram so we know the topology, and both configs.......
/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys etc.)

Use code blocks around export ( black square with white square brackets on same line as Bold and Underline ).

anav

In over my head......but where is vlan102 in IP DHCP client settings???

/ip dhcp-client
add add-default-route=special-classless default-route-distance=100 \
dhcp-options=vendor-class-identifier interface=vlan-altibox-voip \
use-peer-dns=no use-peer-ntp=no

anav

Recommend moving to 7.16.2.

Do you simply mean that the second device is connected to the first device by ethernet cable and you want to us the second device as an AP/switch ??

anav

What is the purpose of this thread??
Links to unknown sites are not recommended

anav

Closest looks like Thailand or Vietnam

anav

Impossible to define requirements.......and thus OP should a. identify all users/devices ( internal/externals and admin) b. identify all traffic they require without referring to any config speak. Also details on your wans separately How many. Public or private IP, static or dynamic, Detail which wa...

anav

A plan is a great start, ensure you capture all the traffic requirements such as vlan to vlan, shared printer etc, ( external incoming, any port forwarding or vpns --> at least wireguard so you as admin can remote in to the router ) You need either a trusted vlan ( home ) or create one specific just...

anav

What I do when configuring vlans is take one port off the bridge!! /interface ethernet set [ find default-name=eth8 ] name=OffBridge8 /ip address add address=192.168.77.1/30 interface=OffBridge8 network=192.168.77.0 /interface list member { only need one interface list on this device } add interface...

anav

Strange ask but I guess you dont want anyone with access to be able to manually set 1-24 Assuming your IP address is set to 192.168.88.254 interface=bridge network=192.168.88.0 I would create a firewall address list of 192.168.88.25-192.168.88.253 list=ALLOWED /ip firewall filter add action=accept c...

anav

If you have level enterprise control over the browser, then that is possible. My experience at the enterprise level is that the whole YOUTUBE is just not accessible.

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions.......... Or, Mikrotik fixes their implementation to work like the rest of RouterOS. That is my first choice too! Why wireguard is allowed to deviate from standard Mangle practices is be...

anav

the config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

The point being is that 7.16 has most of the vers7 bugs worked out and has all the latest security improvements and most access to newest features. Its the way to go for sure at this point. If one has a business or provides services to businesses, the recommendation always is to test new firmware in...

anav

Concur, confusing explanation is an understatement.......... Need a least a detailed diagram to sort out context.
Impossible to define requirements.......and thus OP should
a. identify all users/devices ( internal/externals and admin)
b. identify all traffic they require

anav

Unless solving really means overcome brain fart..............

anav

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions..........
Perhaps other vendors handle wireguard differently so that its not a problem for the more complex routing subnets?

anav

Why the question asking the question?
Typically the LTS is acutally the most stable version available, who doesnt want that (rhetorical question)!
However, I have moved off vers6 on my main router recently to ver 7.16, as an LTS for ver7 seems unlikely.

anav

Hi Jaclaz, so the switch and LANA would be on the same private LAN subnet ( provided by the isp modem router) as the HEX? If this is the case then all users on LANB will be able to reach LANA. With sourcenat outgoing, all LANB user traffic would appear to come from router itself, so return traffic i...

anav

That has nothing to do with the router!
The router does not change ports on outbound, and thus its your server that is doing that ( changing the destination port when leaving the server )

anav

niche in the sense that its for experts only doing more complex configs and they are not trivial nor a small number of cases.
As for a broken config, that is the reason for the hack!!
If the hack doesnt work for a more complex case, then stop being lazy and come up with a better hack.

anav

Dont forget to install at least the common firewall rules on the 5009, probably have to do it manually. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=accept chain=input com...

anav

How many bridges do you have............ I know some have used the fact of two chips on the unit to allow two bridges ports 1-A and B-Last port.
But other than that you should only use one bridge normally.

anav

And the horse you rode in on AMMO. I never said that other than multiwan setups on the main routing tables was trivial.............. There is a need for multiple approaches for the very basic through to BGB/OSPF VRP etc.......... Nor did I say that Mikrotik focussing on either home users or advanced...

anav

Nope........... Be it a two port or multiport device,

Take the extra port off bridge and do all your configuration from there safely.
give the port an ip address, use the ipv4 settings on laptop to access port and router.

anav

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups.

anav

No worries, there are many here with more patience! Ur in good hands on the forum.

anav

and here I thought holvoe was answering an incontinence question.

anav

If the ISP is blocking wireguard, the fact that you have tried numerous ports tells me that they are checking DPI, into the weeds to see the type of traffic. Therefore suggesting BTH is fruitless. However, if the lack of connection is either a. operator config error b. no access to public IP Then BT...

anav

No worries, you came for help, I asked for the information to make that possible and then you decide magically you know where the problem is (or isnt) and thus I have to question why did you come for help in the first place. I have limited time and your wasting it.

anav

1. The mistake is putting the WAN vlan on the bridge................. 2. You only have three ports active, 3 and two on the bridge 8, and sfp, so what in tarnation is ether6 doing in your config for example or ether4 for example 3. Forgot to tag bridge......... 4. Wrong address EDIT: my mistake crap...

anav

VLANS are not required, although much more flexible and recommended if you run out of ports and need to send multiple subnets out a port to a switch or access point etc.. IP address assign subnetA to ether2 assign subnetB to ether3 assign both to interface list=LAN Then in forward chain firewall rul...

anav

But then that rule (or a similar one) should go in chain forward. Quick recap: 1. chain input=connection to the router 2. chain forward=connection through the router Well stated except that similar rule is also bogus in forward chain as we drop all there as well!! add action=fasttrack-connection ch...

anav

1. Assuming your mikrotik has a public IP and is the SERVER peer for handshake for your devices that need to connect remotely, then this is all that one should see. For some reason you have peer side noise in allowed Ips, which makes me think this was created by using BTH vice manual. Nothing wrong ...

anav

Thanks for the config and continual understanding of the requirements both very helpful Before I delve into the config, output chain is not required to do what you need. One simply needs a firewall rule and routing mechanism to do so, while not conflicting with other traffic. Linking to other sites ...

anav

I really can't see anything When you provide nothing, nothing can be seen. So lets get some clarity. What is the home mikrotik router? model and I assume you have no public IP. Confirm you also have a CHR in the cloud that you use as the wireguard server for handshake. The idea being you as a remot...

anav

First a diagram as I have no idea what you mean about remote servers............ Right now I am assuming you have cloud servers behind a CHR. Second With a full config nothing really useful can be provided, I prefer not to guess. /export file=anynameyouwish (minus router serial number, any public WA...

anav

Lets start with the main router ONLY, it will handle vlans, dhcp and its own local wifi. Capsman will NOT be used............ starts singing Celebrate good times, come on (Let's celebrate) Follow the guidance document as suggested --> https://forum.mikrotik.com/viewtopic.php?t=143620 Create all the ...

anav

No you get rid of it, not required. Its also wasteful, in that all good traffic has to go through that rule before the rest of the rules not efficient. That traffic already captured by the last rule....... Since you didnt answer the question --> what are you afraid of??? You can do want you want, op...

anav

This topic has gotten off the rails. 1. For the OP, most of us dont worry about blocking intervlan traffic because that is just a continuation of the default safe setup MT provides for newbies. Most of use, first thing, is turn the concept of block a few known bad things and allow everything else, T...

anav

The 5009 should be connected to the MODEM The HAP should be connected to the 5009 The HAP should be ideally or most simply setup as an AP/Switch with no dhcp responsibilites ( done on 5009 ) your best tutorial on this is: https://forum.mikrotik.com/viewtopic.php?t=143620 when planning the network en...

anav

As was stated, dont start the config until a. you have a plan for the network ( a network diagram helps ) b. you have identified -- all the users/devices on you network (both external/internal and admin) -- have described the traffic they require to accomplish. Sorry a config cannnot be made in part...

anav

Just to add to that, the managment or trusted vlan is where all attached smart devices should get their LANIP from. So in addition to the data vlans ensure the management vlan also goes through the trunk to the CISCO. Surprized you dont use vlans already by the way. If this is the first time, then e...

anav

Nice, its good to start once you have plan on paper as its much easier to see where things fit together on a config. There should be no issues to the VLANID you use at either router, just MAKE SURE that no two subnets are the same. However we never ask for PCUNITES view of the world for configuratio...

anav

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

Hi Jaclaz, my intention was generic, thanks for pointing that out, in which case the OP only needs to allow local/vpn admin associated IPs to the input chain from the LAN side.

anav

Yeah I /ip firewall address-list add address=192.168.77.X list= Authorized comment="admin desktop" add address=192.168.77.Y list=Authorized comment="admin laptop" add address=192.168.77.Y list=Authorized comment="admin smartphone" /ip firewall filter add action=accept c...

anav

These two rules are almost the same: add action=accept chain=input src-address-list=allowed_to_router add action=accept chain=input in-interface-list=LAN Is an excellent start if the src-address-list is comprised of your LOCAL admin IPs ( wired/wifi/vpn if any) aka only those devices that need acces...

anav

Nice try............. Not the complete config.

Also didnt answer the questioWhat is your intention with this rule.
block WAN access To the router
OR
bloc WAN access to your subnets/LANn.....

What are you afraid of??

anav

I am confused by your explanation, do you mean you have separate WAN connections to the VMIs, and TVs?? I dont see those connections on the diagram Okay I get it now, you think NAT is the mechanism to provide internet to users,,,,,, its actually firewall rules that do so. So to be clear do you mean ...

anav

Reading your first post. Want anyone using ethernet 5, to go out proton wireguard for internet. 1. Wireguarg does not get an IP pool. It simply an interface with a subnet ( it carries traffic from other wireguard address, typically incoming or outgoing and also, router to router it carries subnets)....

anav

{rant on} It amazes me that we are asked to make a definitive call on a question on someones config, and they have the audacity to only show firewall rules. The config is a connected piece of work and thus a partial view is next to useless. {rant off} If your USER rules on input chain never get any ...

anav

Do you understand how the firewall chains work in Router OS. Asking about a single rule, is not going to solve the issue of not understanding how to apply them properly/safely. What is your intention with this rule. block WAN access To the router OR bloc WAN access to your subnets/LAN I think you sh...

anav

Ignore the bad advice above to modify the existing configuration.

The router should not be connected to the internet so remove.
1. use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
2. Then should have a decent starting point firewall.

anav

The point is you dont have to create a subnet for the WAN traffic, just create a vlan, which will carry the data to the 5009. Untagged port at the switch on the port to the ISP modem, added to the trunk port going to the other switch, added to the trunk port on second switch coming from first switch...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

You've misunderstood me so I must have not expressed myself clearly............... Other way round! In the old hookup there were two connections coming to the 5009 ( one from ISP modem ) and one from closest switch In the new hookup, there is only one connection available to the 5009 and that is si...

anav

The only example I can think of is if there is some need for a 0.0.0.0/0 allowed IP on the server router, and thus any other needs would require a separate wg interface

anav

It sounds like their equipment may be expecting a specific subnet? 192.168.0.1 or 192.168.1.1 ???
Can you plug one into a pc directly to test?

anav

I think the OP has a bug in his brain!, but to be accurate its a worm.

To upgrade Routerboard, use System --> RouterBOARD that updates

anav

1. Typically UNIFI requires the management or trusted vlan UNTAGGED, and the rest of the data vlans tagged. What is not clear to me is your trusted subnet, is it vlan10 production or vlan20 home.......... Since you have unifi untagged on 10 will assume its production. 2. All your /interface bridge p...

anav

Actually AMMO, you can use a single wireguard interface, and just use a different IP address schema for the road warriors, if you need some granularity over firewall rules.....

anav

You have four vlans but 5 pools is one clue. What was the first tip in my post above!!!
You only have two IP addresses???

Its clear to me you made NO effort to read the vlan link article.
Come back when you put an honest days work into the config.

anav

MT knows, they have not put it high on their priority list to fix I guess? The fix........ one still needs to mangle but add a dst nat rule. - https://forum.mikrotik.com/viewtopic.php?p=1092192&hilit=wireguard+WAN2+dstnat+fix#p1092255 The thread is this one.. https://forum.mikrotik.com/viewtopic...

anav

Regardless, not the config.

anav

Your logic seems very reasonable.

anav

jpegs mean little to me, also hard on my old eyes LOL.

anav

No idea without seeing the config.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, VPN keys etc.)

anav

haha, not pissed, I just speak plainly/factually ;-) You will know for sure if displeased. Consider the config is like the human body, you cannot talk about muscles without discussing nerves that actually trigger muscle movement, you cannot talk about muscles without talking about their food supply ...

anav

I note on beta 7.17.rc - this line......

*) bth - improved stability on system time change;

Has anyone with this problem used the latest beta to see if this change fixes it???
I am 100% convinced these slew of WG bugs were introduced with BTH changes...........just a theory.

anav

You need to decide what is the purpose of AX2 devices. The Ax3 will be your MAIN router terminating the ISP connection( you get a public IP) and create private subnets behind the router. If you use the AX2 devices you will end up with double triple NAT etc, and unless needed for a specific reason sh...

anav

Beyond my scope of knowledge sorry! Hopefully someone else will chime in.

anav

viewtopic.php?t=157048

anav

I purchased an online course that includes a Failover and Load Balancing script. The first two rules prevent packets entering through WAN1 from returning via WAN2. Not sure how those two points are related...... but one can pay through the nose for these rules. ;-) https://forum.mikrotik.com/viewto...

anav

EAP? One unique fingerprint per device. Yay!

I hope I get at least 20 tries before getting locked out ( counting my toe prints)

anav

ASSUMING VLAN10 is the trusted VLAN where all managed devices should get their IP address from!! On Router 1. MINOR From: /interface bridge port add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=10 add bridge=bridge frame-types=admit-only-untagged-and-priori...

anav

You can source nat both WANS or use Sourcenat on WAN interface list. No mention of port forwarding before>>> This is what I call scope creep. I am not interested in chasing. If you have a network plan, then provide a network diagram. then list the requirements. a. identify all the users/devices incl...

anav

Instead of a supout for people to view, use the export function in CLI commands in winbox menu entry NEW TERMINAL.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys )

anav

Just to be clear you get a block of WANIPs from your ISP provider which is connected/terminated on ether1, using one of the WANIPs.
You wish to use the remainder of WANIPs to pass on to clients on ether 2,3,4 ???

anav

If not interested in forum help,,,,,,,,, there is always --> https://mikrotik.com/consultants

anav

Stand by computer user, when viewing unwanted information, place blindfold on computer user. No need for expensive routers.

anav

Therefore I was wondering the best way to expose these service ports in a secure way. This leads me to thinking you may want to try Zerotier, which basically joins participants as if they were in a layer 2 network ( my simpleton view ). Another thought is cloudflare zero trust, which is a way to ha...

anav

Concur Holvoe........ The post made is nonsensical, based on the experience on this forum I have seen all manner of setups and none of the threads examples seem out of place compared to that of which one is exposed to here. The intent of the article is to help users navigate through implementing vla...

anav

Good time to learn. Tips --> once you use vlans, take bridge off any dhcp etc.. and take the home LAN and make it another vlan. get rid of vlan interface list group, not required, and add a TRUSTED interface list. If you do have a spare port or can spare one during the bulk of the configuration, hig...

anav

I want to know more about this line............ In case of going through relay, speed could be limited. Clearly we have limits on client end for ISP, and limits at Router end from its associated ISP connection and then there are losses due using VPN. So are they saying on top of that there may be ad...

anav

So in summary, its transparent to the end user, and hence why both apps can be used.

anav

I like the suggestion of powerline, especially for the two bedrooms.......
https://www.tp-link.com/ca/home-network ... a7517-kit/

What I would personally use --> https://www.devolo.global/magic-2-wifi-6

anav

jajajajaja, I will stick to any errors that pop from the most basic of settings!!

For all those wireguards coming in on ISP1 and ISP2, where be the mangling required to ensure handshakes go back out correct WAN??
Cool one can bypass that with OSPF, I may have to learn it after all.

anav

Because the destination and source addresses are kept up to date by Wireguard ROS at either end, so MT ensures that if there is a direct connection that the client uses the direct dst IP address instead of the DDNS one. I am assuming that in the traffic back to the client, the BTH connection sends t...

anav

All is possible. You can a. have all traffic go over ether1, and when that fails switch to ether3 b. load balance traffic between the two connections c. have some users or subnets go out ether1 and some users or subnets go out ether3 For basic failover ( primary and backup ) /ip route add check-gate...

anav

Think of it as the native vlan, should not be used for data and should not be used as trusted or management. Its transparent in the background.

anav

As AMMO stated, the magic is the DDNS part of the BTH user config ( allowed IPs ). I am assuming this sends the user to the MT server. The server keeps track if the Mikrotik Router has a direct type of connection and then rejigs the destination/source address type information such that the BTH Users...

anav

1. Only need one bridge. Using multiple bridges may seem like an easy go to but its not recommended. Use VLANs and vlan-filtering. 2. Add a safe port to continue config for vlans from a port NOT connected to the bridge. We give it an IP address 192.168.55.1/30. Plug your PC into port 5, give your PC...

anav

network diagram would help as well.

anav

I am working on that bit ( improving docs ) and is why I am being nitpicky in my understanding.
I forget, where do the firewall rules show up that allow a USER to access the WAN and possibly the LAN???

anav

Okay so its just a convenience APP for the users second to infinity. The only critical use of the BTH app is for the first user ( admin ) as that account on that phone is the only one where the APP has MANAGE shares capability. The PRIMARY config loaded! You know its very annoying that your right ;-)

anav

There is never a perfect world. But for certain device types, cloud provisioning these days is leading the way. There also needs to be local management. If we cloud provision, the device info and network/device password would be saved at an administrative level. We copy password and use it to acces...

anav

Okay to be clear, it seems what you are saying is that you can take a wireguard config generated by the admin on the admins smartphone, for another user, using the Manage Shares approach, and it can be applied to any normal WIREGUARD APP, aka on smartphone or PC etc. ( stating that the BTH app is NO...

anav

Stuffing a wet noodle up a straw request.

anav

IF all your allowed is one device, then why place it right away inside four walls. If anything I suspect a ceiling mount would be better (guessing)
However, you should really have posted in the wifi forum as keen wifi folks hang out there ......
...

Screenshot 2024-11-26 233758.jpg

anav

Not sure what you mean. Data flow is two way. If you mean can you have a dual WAN setup. Two modems, lets say cable from rogers, and fibre from bell, the answer is yes. Typically one uses the etherport for the WAN client, 3 common options. 1. pppoe setup 2. Dynamic public IP 3. Static public or priv...

anav

Not sure what you mean. If a user (not admin) uses the BTH app to setup a BTH tunnel after receiving the QR code, or URL link or export config file generated on the admins smartphone, then the user access is done through the BTH app, not the standard wireguard app. Now what has not been explained at...

anav

Got it, you host a bunch of users that you would like to push out the internet at some other location via Wireguard. Are these hotspot users on their own subnet? Can you separate your home or private use on a different subnet or would like to Do you want the ability to use wireguard to reach your ro...

anav

Not clear it sounds like only one subnet is going through wireguard??
Do you have control over the other end??

need config!!

anav

So to be clear you want to use the far router for DNS when the wireguard tunnel is up and to allow local WAN access and local DNS when the tunnel is down. Is this for a single subnet, all subnets, some users??? Will need to see full config /export file=anynameyouwish (minus router serial number, any...

anav

Post both latest configs for review

anav

Did the ISP provided you with a static WANIP with its associated gateway? If so then simply add this as an address entry ( and disable the ip dhcp client entry ) /ip address add address=ISP_provided_IP/24 gateway=ISP_provided_gateway-IP network=ISP_provided_network ( typically if IP is 192.168.55.1/...

anav

It's WG, so all are peers. The app and /ip/cloud just always create ONE peer upon enabling it. If you need more, you need the "managed shared" (or /ip/cloud/back-to-home-users). On the "shared" ones, there is the additional option to allow-lan= so that the only difference AFAIK....

anav

You are in charge, not the MT device LOL. You decide based upon requirements. What I see is a two vlan requirement spanning 5009 to HAPAX3 (setup as an AP/switch) It is the logical choice. The only reason I would make the hapax3 as a router is if I wanted to use it for wireguard and not the 5009

Search found 22025 matches