MikroTik

anav

Nope........... Be it a two port or multiport device,

Take the extra port off bridge and do all your configuration from there safely.
give the port an ip address, use the ipv4 settings on laptop to access port and router.

anav

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups.

anav

No worries, there are many here with more patience! Ur in good hands on the forum.

anav

and here I thought holvoe was answering an incontinence question.

anav

If the ISP is blocking wireguard, the fact that you have tried numerous ports tells me that they are checking DPI, into the weeds to see the type of traffic. Therefore suggesting BTH is fruitless. However, if the lack of connection is either a. operator config error b. no access to public IP Then BT...

anav

No worries, you came for help, I asked for the information to make that possible and then you decide magically you know where the problem is (or isnt) and thus I have to question why did you come for help in the first place. I have limited time and your wasting it.

anav

1. The mistake is putting the WAN vlan on the bridge................. 2. You only have three ports active, 3 and two on the bridge 8, and sfp, so what in tarnation is ether6 doing in your config for example or ether4 for example 3. Forgot to tag bridge......... 4. Wrong address EDIT: my mistake crap...

anav

VLANS are not required, although much more flexible and recommended if you run out of ports and need to send multiple subnets out a port to a switch or access point etc.. IP address assign subnetA to ether2 assign subnetB to ether3 assign both to interface list=LAN Then in forward chain firewall rul...

anav

But then that rule (or a similar one) should go in chain forward. Quick recap: 1. chain input=connection to the router 2. chain forward=connection through the router Well stated except that similar rule is also bogus in forward chain as we drop all there as well!! add action=fasttrack-connection ch...

anav

1. Assuming your mikrotik has a public IP and is the SERVER peer for handshake for your devices that need to connect remotely, then this is all that one should see. For some reason you have peer side noise in allowed Ips, which makes me think this was created by using BTH vice manual. Nothing wrong ...

anav

Thanks for the config and continual understanding of the requirements both very helpful Before I delve into the config, output chain is not required to do what you need. One simply needs a firewall rule and routing mechanism to do so, while not conflicting with other traffic. Linking to other sites ...

anav

I really can't see anything When you provide nothing, nothing can be seen. So lets get some clarity. What is the home mikrotik router? model and I assume you have no public IP. Confirm you also have a CHR in the cloud that you use as the wireguard server for handshake. The idea being you as a remot...

anav

First a diagram as I have no idea what you mean about remote servers............ Right now I am assuming you have cloud servers behind a CHR. Second With a full config nothing really useful can be provided, I prefer not to guess. /export file=anynameyouwish (minus router serial number, any public WA...

anav

Lets start with the main router ONLY, it will handle vlans, dhcp and its own local wifi. Capsman will NOT be used............ starts singing Celebrate good times, come on (Let's celebrate) Follow the guidance document as suggested --> https://forum.mikrotik.com/viewtopic.php?t=143620 Create all the ...

anav

No you get rid of it, not required. Its also wasteful, in that all good traffic has to go through that rule before the rest of the rules not efficient. That traffic already captured by the last rule....... Since you didnt answer the question --> what are you afraid of??? You can do want you want, op...

anav

This topic has gotten off the rails. 1. For the OP, most of us dont worry about blocking intervlan traffic because that is just a continuation of the default safe setup MT provides for newbies. Most of use, first thing, is turn the concept of block a few known bad things and allow everything else, T...

anav

The 5009 should be connected to the MODEM The HAP should be connected to the 5009 The HAP should be ideally or most simply setup as an AP/Switch with no dhcp responsibilites ( done on 5009 ) your best tutorial on this is: https://forum.mikrotik.com/viewtopic.php?t=143620 when planning the network en...

anav

As was stated, dont start the config until a. you have a plan for the network ( a network diagram helps ) b. you have identified -- all the users/devices on you network (both external/internal and admin) -- have described the traffic they require to accomplish. Sorry a config cannnot be made in part...

anav

Just to add to that, the managment or trusted vlan is where all attached smart devices should get their LANIP from. So in addition to the data vlans ensure the management vlan also goes through the trunk to the CISCO. Surprized you dont use vlans already by the way. If this is the first time, then e...

anav

Nice, its good to start once you have plan on paper as its much easier to see where things fit together on a config. There should be no issues to the VLANID you use at either router, just MAKE SURE that no two subnets are the same. However we never ask for PCUNITES view of the world for configuratio...

anav

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

Hi Jaclaz, my intention was generic, thanks for pointing that out, in which case the OP only needs to allow local/vpn admin associated IPs to the input chain from the LAN side.

anav

Yeah I /ip firewall address-list add address=192.168.77.X list= Authorized comment="admin desktop" add address=192.168.77.Y list=Authorized comment="admin laptop" add address=192.168.77.Y list=Authorized comment="admin smartphone" /ip firewall filter add action=accept c...

anav

These two rules are almost the same: add action=accept chain=input src-address-list=allowed_to_router add action=accept chain=input in-interface-list=LAN Is an excellent start if the src-address-list is comprised of your LOCAL admin IPs ( wired/wifi/vpn if any) aka only those devices that need acces...

anav

Nice try............. Not the complete config.

Also didnt answer the questioWhat is your intention with this rule.
block WAN access To the router
OR
bloc WAN access to your subnets/LANn.....

What are you afraid of??

anav

I am confused by your explanation, do you mean you have separate WAN connections to the VMIs, and TVs?? I dont see those connections on the diagram Okay I get it now, you think NAT is the mechanism to provide internet to users,,,,,, its actually firewall rules that do so. So to be clear do you mean ...

anav

Reading your first post. Want anyone using ethernet 5, to go out proton wireguard for internet. 1. Wireguarg does not get an IP pool. It simply an interface with a subnet ( it carries traffic from other wireguard address, typically incoming or outgoing and also, router to router it carries subnets)....

anav

{rant on} It amazes me that we are asked to make a definitive call on a question on someones config, and they have the audacity to only show firewall rules. The config is a connected piece of work and thus a partial view is next to useless. {rant off} If your USER rules on input chain never get any ...

anav

Do you understand how the firewall chains work in Router OS. Asking about a single rule, is not going to solve the issue of not understanding how to apply them properly/safely. What is your intention with this rule. block WAN access To the router OR bloc WAN access to your subnets/LAN I think you sh...

anav

Ignore the bad advice above to modify the existing configuration.

The router should not be connected to the internet so remove.
1. use netinstall to upgrade to latest firmware, to be sure you have a non-compromised firmware on the router,
2. Then should have a decent starting point firewall.

anav

The point is you dont have to create a subnet for the WAN traffic, just create a vlan, which will carry the data to the 5009. Untagged port at the switch on the port to the ISP modem, added to the trunk port going to the other switch, added to the trunk port on second switch coming from first switch...

anav

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

You've misunderstood me so I must have not expressed myself clearly............... Other way round! In the old hookup there were two connections coming to the 5009 ( one from ISP modem ) and one from closest switch In the new hookup, there is only one connection available to the 5009 and that is si...

anav

The only example I can think of is if there is some need for a 0.0.0.0/0 allowed IP on the server router, and thus any other needs would require a separate wg interface

anav

It sounds like their equipment may be expecting a specific subnet? 192.168.0.1 or 192.168.1.1 ???
Can you plug one into a pc directly to test?

anav

I think the OP has a bug in his brain!, but to be accurate its a worm.

To upgrade Routerboard, use System --> RouterBOARD that updates

anav

1. Typically UNIFI requires the management or trusted vlan UNTAGGED, and the rest of the data vlans tagged. What is not clear to me is your trusted subnet, is it vlan10 production or vlan20 home.......... Since you have unifi untagged on 10 will assume its production. 2. All your /interface bridge p...

anav

Actually AMMO, you can use a single wireguard interface, and just use a different IP address schema for the road warriors, if you need some granularity over firewall rules.....

anav

You have four vlans but 5 pools is one clue. What was the first tip in my post above!!!
You only have two IP addresses???

Its clear to me you made NO effort to read the vlan link article.
Come back when you put an honest days work into the config.

anav

MT knows, they have not put it high on their priority list to fix I guess? The fix........ one still needs to mangle but add a dst nat rule. - https://forum.mikrotik.com/viewtopic.php?p=1092192&hilit=wireguard+WAN2+dstnat+fix#p1092255 The thread is this one.. https://forum.mikrotik.com/viewtopic...

anav

Regardless, not the config.

anav

Your logic seems very reasonable.

anav

jpegs mean little to me, also hard on my old eyes LOL.

anav

No idea without seeing the config.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, VPN keys etc.)

anav

haha, not pissed, I just speak plainly/factually ;-) You will know for sure if displeased. Consider the config is like the human body, you cannot talk about muscles without discussing nerves that actually trigger muscle movement, you cannot talk about muscles without talking about their food supply ...

anav

I note on beta 7.17.rc - this line......

*) bth - improved stability on system time change;

Has anyone with this problem used the latest beta to see if this change fixes it???
I am 100% convinced these slew of WG bugs were introduced with BTH changes...........just a theory.

anav

You need to decide what is the purpose of AX2 devices. The Ax3 will be your MAIN router terminating the ISP connection( you get a public IP) and create private subnets behind the router. If you use the AX2 devices you will end up with double triple NAT etc, and unless needed for a specific reason sh...

anav

Beyond my scope of knowledge sorry! Hopefully someone else will chime in.

anav

viewtopic.php?t=157048

anav

I purchased an online course that includes a Failover and Load Balancing script. The first two rules prevent packets entering through WAN1 from returning via WAN2. Not sure how those two points are related...... but one can pay through the nose for these rules. ;-) https://forum.mikrotik.com/viewto...

anav

EAP? One unique fingerprint per device. Yay!

I hope I get at least 20 tries before getting locked out ( counting my toe prints)

anav

ASSUMING VLAN10 is the trusted VLAN where all managed devices should get their IP address from!! On Router 1. MINOR From: /interface bridge port add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=10 add bridge=bridge frame-types=admit-only-untagged-and-priori...

anav

You can source nat both WANS or use Sourcenat on WAN interface list. No mention of port forwarding before>>> This is what I call scope creep. I am not interested in chasing. If you have a network plan, then provide a network diagram. then list the requirements. a. identify all the users/devices incl...

anav

Instead of a supout for people to view, use the export function in CLI commands in winbox menu entry NEW TERMINAL.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys )

anav

Just to be clear you get a block of WANIPs from your ISP provider which is connected/terminated on ether1, using one of the WANIPs.
You wish to use the remainder of WANIPs to pass on to clients on ether 2,3,4 ???

anav

If not interested in forum help,,,,,,,,, there is always --> https://mikrotik.com/consultants

anav

Stand by computer user, when viewing unwanted information, place blindfold on computer user. No need for expensive routers.

anav

Therefore I was wondering the best way to expose these service ports in a secure way. This leads me to thinking you may want to try Zerotier, which basically joins participants as if they were in a layer 2 network ( my simpleton view ). Another thought is cloudflare zero trust, which is a way to ha...

anav

Concur Holvoe........ The post made is nonsensical, based on the experience on this forum I have seen all manner of setups and none of the threads examples seem out of place compared to that of which one is exposed to here. The intent of the article is to help users navigate through implementing vla...

anav

Good time to learn. Tips --> once you use vlans, take bridge off any dhcp etc.. and take the home LAN and make it another vlan. get rid of vlan interface list group, not required, and add a TRUSTED interface list. If you do have a spare port or can spare one during the bulk of the configuration, hig...

anav

I want to know more about this line............ In case of going through relay, speed could be limited. Clearly we have limits on client end for ISP, and limits at Router end from its associated ISP connection and then there are losses due using VPN. So are they saying on top of that there may be ad...

anav

So in summary, its transparent to the end user, and hence why both apps can be used.

anav

I like the suggestion of powerline, especially for the two bedrooms.......
https://www.tp-link.com/ca/home-network ... a7517-kit/

What I would personally use --> https://www.devolo.global/magic-2-wifi-6

anav

jajajajaja, I will stick to any errors that pop from the most basic of settings!!

For all those wireguards coming in on ISP1 and ISP2, where be the mangling required to ensure handshakes go back out correct WAN??
Cool one can bypass that with OSPF, I may have to learn it after all.

anav

Because the destination and source addresses are kept up to date by Wireguard ROS at either end, so MT ensures that if there is a direct connection that the client uses the direct dst IP address instead of the DDNS one. I am assuming that in the traffic back to the client, the BTH connection sends t...

anav

All is possible. You can a. have all traffic go over ether1, and when that fails switch to ether3 b. load balance traffic between the two connections c. have some users or subnets go out ether1 and some users or subnets go out ether3 For basic failover ( primary and backup ) /ip route add check-gate...

anav

Think of it as the native vlan, should not be used for data and should not be used as trusted or management. Its transparent in the background.

anav

As AMMO stated, the magic is the DDNS part of the BTH user config ( allowed IPs ). I am assuming this sends the user to the MT server. The server keeps track if the Mikrotik Router has a direct type of connection and then rejigs the destination/source address type information such that the BTH Users...

anav

1. Only need one bridge. Using multiple bridges may seem like an easy go to but its not recommended. Use VLANs and vlan-filtering. 2. Add a safe port to continue config for vlans from a port NOT connected to the bridge. We give it an IP address 192.168.55.1/30. Plug your PC into port 5, give your PC...

anav

network diagram would help as well.

anav

I am working on that bit ( improving docs ) and is why I am being nitpicky in my understanding.
I forget, where do the firewall rules show up that allow a USER to access the WAN and possibly the LAN???

anav

Okay so its just a convenience APP for the users second to infinity. The only critical use of the BTH app is for the first user ( admin ) as that account on that phone is the only one where the APP has MANAGE shares capability. The PRIMARY config loaded! You know its very annoying that your right ;-)

anav

There is never a perfect world. But for certain device types, cloud provisioning these days is leading the way. There also needs to be local management. If we cloud provision, the device info and network/device password would be saved at an administrative level. We copy password and use it to acces...

anav

Okay to be clear, it seems what you are saying is that you can take a wireguard config generated by the admin on the admins smartphone, for another user, using the Manage Shares approach, and it can be applied to any normal WIREGUARD APP, aka on smartphone or PC etc. ( stating that the BTH app is NO...

anav

Stuffing a wet noodle up a straw request.

anav

IF all your allowed is one device, then why place it right away inside four walls. If anything I suspect a ceiling mount would be better (guessing)
However, you should really have posted in the wifi forum as keen wifi folks hang out there ......
...

Screenshot 2024-11-26 233758.jpg

anav

Not sure what you mean. Data flow is two way. If you mean can you have a dual WAN setup. Two modems, lets say cable from rogers, and fibre from bell, the answer is yes. Typically one uses the etherport for the WAN client, 3 common options. 1. pppoe setup 2. Dynamic public IP 3. Static public or priv...

anav

Not sure what you mean. If a user (not admin) uses the BTH app to setup a BTH tunnel after receiving the QR code, or URL link or export config file generated on the admins smartphone, then the user access is done through the BTH app, not the standard wireguard app. Now what has not been explained at...

anav

Got it, you host a bunch of users that you would like to push out the internet at some other location via Wireguard. Are these hotspot users on their own subnet? Can you separate your home or private use on a different subnet or would like to Do you want the ability to use wireguard to reach your ro...

anav

Not clear it sounds like only one subnet is going through wireguard??
Do you have control over the other end??

need config!!

anav

So to be clear you want to use the far router for DNS when the wireguard tunnel is up and to allow local WAN access and local DNS when the tunnel is down. Is this for a single subnet, all subnets, some users??? Will need to see full config /export file=anynameyouwish (minus router serial number, any...

anav

Post both latest configs for review

anav

Did the ISP provided you with a static WANIP with its associated gateway? If so then simply add this as an address entry ( and disable the ip dhcp client entry ) /ip address add address=ISP_provided_IP/24 gateway=ISP_provided_gateway-IP network=ISP_provided_network ( typically if IP is 192.168.55.1/...

anav

It's WG, so all are peers. The app and /ip/cloud just always create ONE peer upon enabling it. If you need more, you need the "managed shared" (or /ip/cloud/back-to-home-users). On the "shared" ones, there is the additional option to allow-lan= so that the only difference AFAIK....

anav

You are in charge, not the MT device LOL. You decide based upon requirements. What I see is a two vlan requirement spanning 5009 to HAPAX3 (setup as an AP/switch) It is the logical choice. The only reason I would make the hapax3 as a router is if I wanted to use it for wireguard and not the 5009

anav

anav

Post your own thread instead of hijacking this one! ;-PPP

anav

First off, well done, the safest way to access home servers is coming in on VPN and then accessing the server from behind the router. Second, if your request was to do something similar using standard port forwarding, a proxy server would not be required. For example, if you wanted users to come in ...

anav

Wont say you are wrong, I would rather use obtuse! ;-) First though, I would agree that the associated MT router probably receives the new peer information UPON creation on the admin's smartphone. My assumption was that the router gets populated upon first hookup attempt. However after reading your ...

anav

I quite agree with you that native windows VPN app is very limited but as well as Mikrotik has some limitations to achieve this scenario. Not at all. MT as per normal wireguard protocol assigns a unique IP address to each peer. Further it has firewall rules to assign permissions as required for eac...

anav

Sorry, but ASSUME is not in my vocabulary............................
I have one size HAMMER............... it works 95% of time................ the other 5%, is when you and mkx get lucky first, on the whackamole game you like to play.

anav

If you provide jpegs of all vlan setting pages on TP link switch ( at least two, maybe three if pvid is a separate setting page ) Full config of hex. /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) It should be fairly quick to straighten out. ++++++...

anav

While my two esteemed colleagues, okay they are professionals, Im just the floor washer in their office, jump around like frogs, please provide the config. /export file=anynameyouwish (minus router serial number, any public WANIP info, keys etc.. ) Also if you are wireguarding to another device, als...

anav

To be clear.
What is the purpose of wireguard in this setup.

For you as admin to reach the router while away from the main site?
Something else??

anav

I just use LANIP ;-P
Another option is to use DNS settings to point all internal users, aiming at webserver be redirected to LANIP.

anav

Wow, such trick phuckery. I also need to see the final config, as to try and understand, the magical fairy wizard dust Sindy contrived.

Basically, will help better solidfy ones understanding of some basic stuff, power of ip address, dst-nat and source-nat.

anav

Here is the problem, you want the hapax to be a simple AP switch, but then you try to add a second network behind the router. This is not possible be it assigning a subnet to a WLAN, creating a second bridge etc.............. The fact of the matter is you only have one subnet reaching the hapax3.......

anav

Not necessarily. Lets say each user has to login into the PC. Lets say each user has their own wireguard APP on the PC. Lets say each user gets a different wireguard IP address on the MT ROuter wireguard subnet (in fact we will actually make the subnet different for each user but attached to same wi...

anav

anav:1 ammo:0 ( but whose counting) - by the way it looks my advice after inauguration day will cost 25% more jajajaja ( ps dont worry only applies to USA, rest of the world, same free advice, quality not guaranteed until reviewed by mkx/sob and a few others.......... ) Edit................... Damn ...

anav

Hi Normis, Understood, the One Time user available on the ROUTER itself, is for the ADMIN, to use. I presume this is meant to be put on the admins phone and from there he can easily generate additional qr codes or configs to send to as many clients as he/she,it,they,them etc desires. I also understa...

anav

Diagram please detailing the wans etc.... It could be a well known wireguard routing issue but a diagram will help orient me to your network.

anav

1. Is this router BEHIND the RB5009, in double NAT, or acting as a switch/AP OR Is this router in front of the Rb5009 and public IP facing. 2. Why is this error showing?? /interface bridge port add bridge=bridge comment=defconf interface=*6 internal-path-cost=10 path-cost=10 3. Why do you have two b...

anav

okay hopefully NORMIS will provide his usual clarity. :-) :-)

anav

Belgian chocolate makes one smarter, apparently. Screenshots are hard on my eyes so I try to avoid them.

anav

Thank you emarj, I misunderstood your question and gave you a duff answer, now I understand that additional BTH config, and will be able to assist others more accurately down the line. Thanks to @Normis, for clearing that up................... Suggest you add it to the MT document section on BTH so ...

anav

Your firewall rules are over the top complex and simplifying them will enable troubleshooting to some extent. However far more worrisome.......... if assuming 8295,8296 are something to do with accessing winbox and your router is public facing, you are asking to be hacked . Also without seeing the F...

anav

Just to be clear, ether1 and ether2 are WAN links Ether 3 reserved ---> what I would do NOW, is to make this an OFF BRIDGE access for doing all the vlan configuring, much safer , trust me !! /interface ethernet set [ find default-name=ether3] name=OffBridge3 Ether4-10 would be on the bridge. Create ...

anav

Okay my bad, I read so many posts, I can easily get confused........ may also be an old brain thing :-) So you have you own private VPN server hosted in the cloud. That is super so assuming you want to use it for a myriad of things a. users to come in and access your game servers b. for you to remot...

anav

Read the docs y.......... Connect to router Enable DDNS Cloud service: `/ip/cloud/set ddns-enabled=yes` Enable Back To Home: `/ip/cloud/set back-to-home-vpn=enabled` Print tunnel configuration: `/ip/cloud/print` Scan QR Code (`vpn-wireguard-client-config-qrcode`) or Copy config (`vpn-wireguard-clien...

anav

No understood. Here is the point If you have public IP then you dont need nordvpn wireguard Be advised NordVPN is NOT for people coming to you. Its strictly outgoing traffic from your side, usually to avoid local WANIP restrictions etc... As noted your best bet is a. Rent a cloud server, get a CHR l...

anav

So on this HAP device, a. you have a public WANIP ?? and b. you have nordguard vpn............ WHY you can access your router as admin or guests or another router via Wireguard without nordvpn. c. Perhaps you want users to go out a different internet public IP then your own and that is the reason? d...

anav

You know the drill Post the config of the MT router ( assuming its acting as peer Server for handshake )? Since you have a public IP this should be fairly easy to fix. If you have multiple WANs, then provide a detailed diagram for clarity as well as config. /export file=anynameyouwish (minus router ...

anav

You cannot do it with a mikrotik device,
You need an $$router with a $$subscription service.
Your School IT staff would know this,,,,,,,

If this is a single school with little resources, not much you can do.
However, students shouldnt be on their cell phones in the classroom anyway.

anav

I think @ToTheFull refers to the requirement that one has to be "active" on the forum in order to maintain their official consultant status. But the particular kind of activity is not specified. I guess it would be complicated to verify conformance to a more specific requirement, like &qu...

anav

No problem at all. You haven't stated what kind of VPN service, do you mean a third party VPN provider or something else? By the way, if the third party Cloud is hosting it, it cant be as per your title is HOME SERVER Hosting LOL Im assuming two things forcing you to a VPN provider. a. no public IP ...

anav

Screw MT, what is important is that you are feeling better!!!

anav

You get what you measure...

Hi Ammo, cant recall did it long ago but on a 1gig connection on either end same city same provider, rb4011 to RB450G maybe,????? while ago....
I got around 300Mbps or so........... Sorry havent tested in a while.
Perhaps I should test with holvoe sometime.

anav

Well the instructions are not difficult.
Open BTH app on smartphone and import QR code.
It will be up to you to make easy follow instructions for users.
Suggest you try it a couple of times to figure out how best to describe it to users

anav

Well here is the scoop to use wireguard NORMAL, manual config, or port forwarding for that matter you need a. a public IP address OR b. an upstream router/modem, usually the iSP one, with a public IP AND the ability to forward ports. If you have the above then you dont need to use BTH. +++++++++++++...

anav

IPSec has its place in the enterprise world, but here in home soho user land, wireguard is easier to setup and reasonably fast and secure. Sure it takes a hit but looking at IPSEC stats on the MT routers, its not a shining star either. I trust mozerd, who deals with a wide variety of NON enterprise,...

anav

I still don't understand your setup. Typically the Router has a public WANIP, either static or dynamic. OR if not a Private IP from an upstream router for example. Behind the router is a DIFFERENT private subnet, so not sure what you are doing or what kind of network you have. It would appear you ne...

anav

The listen port is a horrible name I will agree. It only pertains to a wireguard router that is server for handshake. In the case of a client that port (typically identified under Wireguard Interface) is simply the outgoing port the initial connection uses to reach the Server etc......... So in a cl...

anav

Detailed diagram please.

anav

Draw a detailed network diagram as your explanation is NOT understandable

anav

1. You forgot to include your 5ghz wifi WLAN in /interface bridge port settings /interface bridge port add bridge=Bridge-LAN interface=ether2-LAN add bridge=Bridge-LAN interface=ether3-LAN add bridge=Bridge-LAN interface=ether4-LAN add bridge=Bridge-LAN interface=ether5-LAN add bridge=Bridge-LAN int...

anav

@Mesquite - remember Your kind words the next time you ask for help at a car repair shop, or at a birthday present, or when painting your room...

Your post makes no sense, suspect language barrier, try google translate next time.

anav

Hi Ammo reading the docs there is only one qr/code one can generate from the router itself, the rest if I read this right, is that you can easily create and manage additional Qr codes and send them all from the admin smartphone.

anav

As per https://mikrotik.com/consultants . Additionally, as a consultant we expect you to participate in the MikroTik Forum and attend the MUM events in your country as a presenter conducting RouterOS case studies or workshops. @muaazteladia - Wow, one post in DEC 2022 and now a few posts today out ...

anav

From my understanding, one uses your smartphone to create an initial tunnel while behind the router. Then one can use the smartphone BTH app ( under MANAGED SHARES) to generate qr codes or config files for other smart phones/laptops etc...... (laptops use the wireguard app itself). THe router is cap...

anav

The MT router can provide 1 QR codes or config file for that special client that is remote. I believe but not certain, the way to create multiple accounts ( Qr codes or config files) is from the BTH app on your smart phone. Step1: Create a BTH tunnel on your smartphone while behind the MT router aka...

anav

Trying to understand BTH some more. It would appear that it does not function as I thought. One cannot create QR codes for all remote users and send them each their own QR code, at which time the BTH app on android or Iphone could then simply use to setup their end. It would appear this can only be ...

anav

Okay I added a bunch more questions above,,,,,,that need answering. You only need one wireguard network now that I know your wireguard requirements but only when two things happen. a. you fix your guest VPN and bridge setup. recommend create vlan for bridge subnet, put both vlans on same bridge as p...

anav

Okay will see what I can figure out, just confused why you have two different WIREGUARD NETWORKS??? Can you provide network diagrams for each side, its very confusing due to all the extra subnets showing that are not complete subnets. For Example. Router A has a Bridge network of 192.168.88.0/24 But...

anav

1. Remove serial number from post. 2. DO NOT USE bridge firewall rules, this is an advanced setting for specific cases, use normal firewall rules for most needs. 3. Clean up pools 4. Fixed up /interface bridge port and bridge vlan 5. Wireguard settings are incorrect. It would appear that the MT is a...

anav

I asked for config at both ends? Which Router is supposed to be the Server for wireguard handshake?? Missing the wireguard address in allowed addresses ( depends upon if server or client for handshake what it should be). Why do you limite wg to /30 at least make it /29 so you can as admin remotely c...

anav

Not sure but if the answer is YEs, I will be sure to make recommendations except for Alex from Malaysia

anav

Need a coherent plan.
Provide a network diagram detailing what is supposed to travel over ports, from that, takes 2 minutes to configure okay maybe 5

anav

1. Remove vlan and datapath from wifi setting, we will apply it on the bridge ports/interface settings. 2. Only need one bridge 3. I am not sure if this is LEGAL. your slave WLAN for wireguard has a different BAND from the master. Is this allowed, I know the frequency and such is copied over...........

anav

MikroTik and CloudFlare business relationship would be a good idea. Even on a limited level with ClouldFlare Free plain. It would be a start.

Would require open minds and forward thinking business planning! Will see if both exist.

anav

Please post config at both ends.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Utah and North Pole have spoken. Cloudflare or bust!

anav

Assuming you are talking about segregating users when they are coming on ether8 or that AP, when they are on the same SUBNET as other users???
If so, why not simply create a separate vlan for those users....

anav

Most of us turn internet detect to NONE, as it can have bad effects.

anav

Great.
When done post config of both devices for review.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

anav

We would need to set forum.mikrotik.com DNS to be handled by CloudFlare (or any other 3rd party service). We don't want to pay for that.. Fixed for accuracy. :-) For the really unspoken....... We would need to set forum.mikrotik.com DNS to be handled by CloudFlare (or any other 3rd party service). ...

anav

The hidden point here, is that before you start configuring anything have a plan.
The plan should start with a detailed network diagram ( and in this case would have shown the issue prior to changes on the router).

anav

Awesome!!!

anav

Now, @anav: what was you question in the post above?

Oh no question, I was giving you the FACTS, the bible so to speak.
I was hoping for you to state where I was dead wrong........
Apparently, I speak truth.

anav

I think he might get the picture if you stick those fangs into him..............

anav

1 Persistent Keep alive is not required at SITE A wireguard. THe client for handshake requires it, not the server at handshake. 2.Normally client (for handshake) peer devices usually more than one, are identified by singular IP address .. 3. ONLY one dhcp client interface is valid, I suspect its the...

anav

1. The listening port on the wireguard interface does not have to match the endpoint of the server router, there is no direct correlation. 2. 192.168.50 is a local subnet, allowed addresses is for REMOTE addresses (those local user may have as dst address, or that may be coming into the local router...

anav

inside joke there wfburton, but yes anything at this point.

anav

Or use cloudflare in between WWW and server. Now if only cloudflare zerotrust was available as an options package on at least ARM routers and newer.......!!!

anav

As for SWOS barn switch. Keep in mind, the trusted vlan is 20 and thus all smart devices should get an IP address on this vlan, preferably by taking mac address and asssiging a static DHCP lease on the RB router. Port - VLAN MODE / VLAN RECEIVE / VLAN ID SFP1 - strict / allow only tagged frames / de...

anav

Okay so basically on the router one uses IP DCHP client
/ip dhcp-client
add interface=ether1 use-peer-dns=no
add interface=WAN_VLAN use-peer-dns=no

and remove IP address for WAN_VLAN.

anav

Thats like asking to use a rowboat to sail to the moon. Hah, thanks for putting it in perspective. I don't have the experience to know if I just need a different approach. I guess if I upgraded the switch to a router, even the same RB2011 model, it would make things quite a bit simpler. Perhaps tha...

anav

Now for the RB device.... /interface bridge add comment="main bridge" ingress-filtering=no name=local port-cost-mode=\ short protocol-mode=none vlan-filtering=yes /interface vlan add interface=local name=HOME_VLAN vlan-id=10 /interface list add name=WAN add name=VLAN add name=BASE /ip dhcp...

anav

Thats like asking to use a rowboat to sail to the moon. The switch is not a router but a very simple managed switch. Your router should be setup to to vlan filtering with one bridge.... Decide on either a separate management LAN or perhaps use one of the VLANs as a trusted vlan for this purpseose le...

anav

We need a more granular understanding of the relationship between the controller and devices. A. Who initiates traffic. --> does the controller reach out first and state any devices here ---> do the devices reach out first, is there any controller out there. B. How does the controller know which dev...

anav

Well everything is setup properly it looks like in terms of treating the port as a hybrid port.
management vlan comes in untagged vlan10 and the other vlan guest goes in tagged.

Suggest review unifi setup to ensure its not setup for some other condition.

anav

Always a good topic to discuss....... I feel like DNS is like one of the key enzymes in the human body!! Forgetting about static for now to keep it simple....... To use for pointing out all my wrong assumptions and incorrect thinking and for general discussion. What I understand. CASE A: Remote Requ...

anav

99.999 percent over my head, but I thought that when one leased a server for CHR, part of the deal was redundancy so that if the server failed, the CHR would automatically be migrated to another server etc....... ?? ex.... https://www.vultr.com/company/sla/ https://docs.vultr.com/high-availability-o...

anav

Normis is practically minded, just sometimes in the wrong direction.

anav

Its clear the cat rules the house!! Nice pic.

anav

I meant before MT gives in and adds a third-party DDoS protection service.
Ah. This we agree upon: it's past time they shove it behind some Cloudfare or whatnot.

+1

anav

This is nothing but a disguised attempt to decrease the use of this forum........ and its eventual closure, as the discord channel is so much better ( holds nose ).

anav

I wonder if related to two submerged sea comm cables getting cut, I read about in the news.

anav

Not necessarily, but without seeing the config, its impossible to know how badly you mucked things up!

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

anav

I apologize for the delay in responding. Had other fires to extinguish, ha. By adding 10.116.12.128/28 to the Judah MK, resolved the issue. I didn't realize that was necessary for the NAT process. It makes total sense. I really appreciate you slapping me and telling me the simple fix! haha Too funn...

anav

Bots still there but forum is back to being zippy. Normis must have come back from holiday!

anav

Nope, you dedicate one vlan to be connected to the VPN at all times.
Users can join that VLAN by accessing an SSID for that purpose ( A WLAN connected to the VLAN ) or they connect to a port on a switch ( and join same vlan )

anav

That is why STEAM exists, and why folks should not attempt to host games at home. Bots will be knocking on the door day and night. Suggestions 1. Limit users by source-address-list a. users must have a static WANIP address b. users must have a dynamic WANIP address ( and they must create a dydndns U...

anav

If you have a dynamic private IP address for your WANIP, then you will not be able to port forward. If you can access your upstream ISP router and IT HAS a public IP ........ AND........... you can forward ports from the ISP router to your MT device ( either yourself accessing the menu or asking ISP...

anav

You need to post your complete config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.) Problems 1. If using pPPOE it usually provides a dynamic WANIP. So if using PPPOE interface, one should not use IP address to define the WANIP. 2. You need public ...

anav

Interesting the OP stated that he is connecting to a private server. I did ask what DNS the private server was using.......... No idea when the idea of using 10.255.255.3 popped into the head?????? Firstly set DETECT INTERNET TO NONE, ,,,,,,,its known to cause issues. +++++++++++++++++++++++++++++++...

anav

1. Adjust /interface bridge port to /interface bridge port add bridge=BR1 interface=ether2 pvid=10 comment="hybrid port - UNIFI" add bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=10 add bridge=BR1 ingress-filtering=yes frame-type...

anav

The only reason for capsman is for roaming between devices, the other APs are tp links not to worry........not going down capsman sinkhole anytime soon
I also despise the armada controller, all done on the device!!

anav

Okay, I loaded new drivers into the capac. After a time, or a few times anyway, I finally got the hang of it. I will say again, tis the worst wifi configuration process anyone has to experience, they must enjoy torture as a recreational activity in Latvia ;-) Not even sure if I have it right but it ...

anav

Silly me!!
This is the problem
/ip pool
add name=dhcp ranges=10.0.0.100-10.0.0.200

SHould be:
/ip pool
add name=dhcp ranges=10.0.0.100-10.0.1.200

Or perhaps you need to express it like so
add name=dhcp ranges=10.0.0.100-10.0.0.254,10.0.0.1-10.0.0.254

anav

Grasping at straws myself.. 1A. Lets clean up DNS a bit. From /ip dhcp-server network add address=10.0.0.0/23 comment=defconf dns-server=10.0.0.21,1.1.1.1,8.8.8.8 \ gateway=10.0.0.1 netmask=23 TO: /ip dhcp-server network add address=10.0.0.0/23 comment=defconf dns-server=10.0.0.1 gateway=10.0.0.1 (n...

anav

https://www.youtube.com/watch?v=jC6MJTh9fRE
https://www.youtube.com/watch?v=2QOFNTF4nyU
https://www.youtube.com/watch?v=MmwF1oHOvmg

anav

Your post has nothing to do with this thread, start a NEW thread.
a. post network diagrams
b. complete config /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

anav

Cannot be done with Mikrotik routers. You would need very expensive routers and then pay a subscription fee on top, for that IDS/IDP service on the router.

anav

1. First try rebooting the router. 2. Everything looks good so far, did you enter in netmask manually or did it simply popup?? Go back and re-enter this 10.0.0.0/24 for address dns-server=10.0.0.21,1.1.1.1,8.8.8.8 and gateway=10.0.0.1 and ensure netmask is not filled in ( then hit apply ) 3. Remove ...

anav

Like this? Forgive me if i'm totally wrong lol /ip firewall nat add action=masquerade chain=srcnat comment="WG masquerade" in-interface=wg0 Thanks for the guess. That a wild assed stab at nothing. Remove that line if entered. THe traffic is from client 10.88.0.2 to the router and is setup...

anav

1. No pool / dhcp-server / dhcp-server network for BASE VLAN? 2. Modify some rules......... ( + remove connection-state=new, not required) add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes add action=accept chain=...

anav

1. Your approach to Bridge and VLANs is incorrect. - ASSIGN all vlans to interface bridge. - ASSIGN all vlans addresses - Add bridge ports/wlans - Add bridge vlan IDs DO NOT assign any subnets to bridge, its unnecessary and adds confusion /interface vlan add interface=bridge-lan name=HomeLAN vlan-id...

anav

Super and my bad on the rule it was supposed to be accept.
add chain=forward action=accept comment="internet traffic in-interface-list=LAN out-interface-list=WAN

Post latest rendition of config and I will relook;

anav

Based on your feedback and TWO comments 1. DO not use a public IP address to define the servers local subnet. use 192.168 / 172.16. / 10.0.0 but NOT 192.0.0. 2. Also regarding the first mangle rule the correct way, apologies for confusion is to state it like this: /ip firewall mangle { ACCEPT RULES ...

anav

Understood! 1. modify /interface bridge port add bridge=bridge1 interface=ether5-MGMT pvid=20 TO /interface bridge port add bridge=bridge1 ingress-filtering=yes frame-types=admit-prioirity-and-untagged interface=ether5-MGMT pvid=20 2. Remove this rule, it means nothing. /interface bridge vlan add br...

anav

From my learning experience, I tend to generally (although they are a bit connected ) think of /interface bridge ports as the INGRESS identifier...... /interface bridge vlan as the EGRESS identifier..... MT is unique in its setup but regardless of tools, the /interface bridge port line either has a ...

anav

Did you try a non-standard wireguard port like 15678 or even 443 for that matter. I cannot see a cruise ship being that capable of blocking wireguard............

anav

They are probably several cloudflare versions behind in their own account!

anav

No POINT in working on config for finesse of routing until fix the main issues! 1. WRONG change to. /interface vlan add interface=bridge1 name=MGMT_VLAN vlan-id= 20 2. IS WRONG, The main point being is that vlans should NOT be identified as bridge ports!! would change from: /interface bridge add fra...

anav

Were you ever able to port forward games from your ISP, on this or a previous router?? Quick check, do these results provide the same answer. 1. Browser check --> whats my IP = ???? 2. IP cloud check >>> public IP = ??? 3. IP DHCP client if used --->IP address = ??? or Assigned static IP address = ?...

anav

So Sindy, the rule is not a problem if we remove the check-gateway=ping? Or are you saying its still causing issues and its better simply to define the local subnets that need to be reached (old method using dst-address=subnet)

anav

In short once you assign vlans to the bridge, then dont use the bridge for dhcp of any subnets. In terms of interface list members, once the bridge is off the hook and just does bridging, it should not be used on interface list members, BUT all vlans if applicable should be identified as LAN membersl

anav

I am always open to new information, but due to your initial approach, I am closed to any information from you.

Your loss and I guess some folks can't handle the truth. I find honest no BS answers refreshing and they are irrefutable when back up by technical acumen.

anav

Good pickup, missed that entirely

(

anav

... /32 for wireguard addresses ... For routed links work: # 2024-11-15 16:42:06 by RouterOS 7.12.1 # /interface wireguard peers add allowed-address[color=#008000][b]=10.254.10.34/32,0.0.0.0/0 ... add allowed-address=10.254.10.35/32,0.0.0.0/0 ...[/b][/color] # There is no point in putting 0.0.0.0/0...

anav

Yeah, that “help” doesn’t do much to stop real DDoS attacks. Pretty sure MT staff mentioned this in the forum too. A must-read for the MT team: ” Distributed denial-of-service (DDoS) protection ” https://www.cloudflare.com/en-ca/network-services/products/magic-transit/ Only pennies every nanosecond...

Search found 21909 matches