MikroTik

TheCat12

Maybe I'm blind but I don't see anything irregular in the configuration you have provided besides the following thing: /interface bridge add add-dhcp-option82=yes admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=\ "LAN bridge" dhcp-snooping=yes name=bridge1 It's probably best to remove it s...

TheCat12

introduction, there are two devices on the Internet with public IPv4, no NAT and masquerading, no local subnets, A masquerade is always needed to access the internet: /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN ipsec-policy=out,none And no local subnets sounds impossi...

TheCat12

For the firewall it's easy - you add two rules allowing input from UDP 500 and 4500 and IPsec ESP on the IPsec server. For the policies it depends what subnets you want to route through the tunnel

TheCat12

The aforementioned policies should be added as additional ones to the template. As to why does the Wireguard get affected, I can't really tell

TheCat12

I forgot that you wanted to route all traffic through IKEv2. Luckily, it's a matter of a few small changes on Router B: /ip ipsec policy add action=none src-address=192.168.95.0/24 dst-address=192.168.95.0/24 add action=encrypt level=unique proposal=ikev2 srx-address=192.168.95.0/24 dst-address=0.0....

TheCat12

On Router A:

/ip ipsec policy
add action=encrypt tunnel=yes proposal=ikev2 src-address=10.0.88.0/24 dst-address=192.168.95.0/24

On Router B:

/ip ipsec policy
add action=encrypt tunnel=yes proposal=ikev2 dst-address=10.0.88.0/24 src-address=192.168.95.0/24

TheCat12

It is possible to route traffic without EoIP with the appropriate policies but an exported config is advisable:

export file=anynameyouwish (minus sensitive info like public IPs, passwords, etc.)

TheCat12

I think the two default routes that are with direct gateways to the ISPs, i.e. the ones without comment, are messing around with the failover. Disable them and try tripping the ISP into switching over again

TheCat12

Looking at the diagram, the following setup would suffice - bridge ether1 with ether4, ether2 with ether5, ether3 with ether6, create an interface list for the bridges and add them to it accordingly and then create the following firewall rule: /ip firewall filter add action=accept chain=forward in-i...

TheCat12

The image of the diagram is a bit broken. Could you repost it somehow? Also, it would be nice to answer @anav's questions whether a fallback scenario (one modem stops functioning) would be needed and whether there'll be incoming VPNs

TheCat12

My suspicions were confirmed: you added on both sides in the allowed-address field a /32 instead of the whole subnet: On Router A: /interface wireguard peers add allowed-address=10.2.200.2/30, 192.168.201.1/32 endpoint-address=\ <code> endpoint-port=59123 interface=wg-fs name=\ fs persistent-keepali...

TheCat12

I think you need a router with more ports or possibly you would have to configure VLANs but would still need an additional switch

TheCat12

Without config there's nothing we can tell...

export file=anynameyouwish (minus sensitive info)

My guess would be that you haven't configured allowed addresses and routes properly but that's just a guess

TheCat12

Since we can't see your configuration through a crystal ball, please post it here:

export file=anynameyouwish (minus sensitive info like public IPs, passwords, etc.)

TheCat12

That is because of the following rule on the AP: /ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN If you disable it, you should be able to access wireless devices from...

TheCat12

Instead of using the "IPsec secret" option in the GRE menu, you can add a custom identity which would be configured with the custom IPsec configuration

TheCat12

Looking at the config, most probably an ISP problem. Only one tip for the firewall: the fasttrack connection rule is a bit too forward for my liking, better put it somewehere after, for example, the "Accept established, related" one

TheCat12

Before suggesting anything, I would like to have a look at the exported config of the server:

export file=anynameyouwish (minus sensitive info like serial numbers, passwords, public IPs etc.)

TheCat12

Maybe I'll have to see the configurations of at least the two L2TP servers just to check what the situation is:

export file=anynameyouwish (minus sensitive info like public IPs, passwords etc.)

TheCat12

Back to the main point, I'll write down a list of all the possible route combinations for each and every router, so that everything is accessible through anything. The OP will decide what is needed and what not # 192.168.98.0/24 router /ip route add dst-address=192.168.99.0/24 gateway=192.168.100.1 ...

TheCat12

It is possible with the help of staric routes but more details are needed - which router(s) is/are L2TP server(s)? How exactly are all the routers connected with each other? A simple diagram would be best

TheCat12

If no MikroTik solution to your problem pops up, may I suggest printing out a QR code instead of an URL?

TheCat12

The default firewall covers security pretty good, but if you want to strengthen it:

https://help.mikrotik.com/docs/spaces/R ... d+Firewall

TheCat12

You're lucky that the addresses are being routed to you because you can manage them however you desire: For the pfsense firewalls you can add public IPs directly on the ports facing them. For the unraid server you can add a route with dst-address=public IP and gateway=natted subnet as well as add th...

TheCat12

It means that if you set a bridge as the interface, on which the hotspot should be running, no WAN ports should be members of the bridge, only LAN ones

TheCat12

These are the default firewall rules which you should have present in the order in which they are posted, i.e. input rules at the top, after that forward rules whereby these three rules: add action=accept chain=forward comment=FTP dst-port=21 protocol=tcp add action=accept chain=forward dst-port=500...

TheCat12

If this router is not behind a stronger firewall, then my condolences to you (revert to a default firewall filter because your network is as open as a door in a field). Then we will discuss the matter of the VPNs

TheCat12

https://youtu.be/nlb7XAv57tw?si=4tymKSCFltpFtxRV

TheCat12

Looking at the error - wrong username/password or the PPPoE server has a problem

TheCat12

Without seeing the config I can't tell nothing, so:

export file=anynameyouwish (minus sensitive info)

TheCat12

I'd say quite fast: add a L2TP client with "Use IPsec" enabled: https://help.mikrotik.com/docs/display/ROS/L2TP After that, create a routing table, add a default route pointing to the L2TP interface on both main and newly created routing tables and use routing rules to specify which client...

TheCat12

I'd suggest using src- and dst-nat rules in order to translate all addresses to corresponding VPN ones 1:1 : /ip firewall nat add action=dst-nat chain=dstnat dst-address=99.99.99.6 to-addresses=11.11.11.3 add action=src-nat chain=srcnat to-addresses=99.99.99.6 src-address=11.11.11.3 and so on. Maybe...

TheCat12

One way is the aforementioned one, another way is to create a backup file through the Files menu whose content you cannot view, edit, etc. because it's a binary file

TheCat12

We need to have a look at the configuration because that doesn't sound like normal port forwarding behavior

export file=anynameyouwish (minus sensitive info like serial number, public IPs, passwords, etc.)

TheCat12

Looking at the screenshot, you're trying to add the pool to a secret, not to the profile which is, as correctly suggested by most internet resources, located in the PPP –> Profile section

TheCat12

Then I guess that is the problem since the first address of a subnet is mostly reserved for the gateway, i.e. the GPON

TheCat12

/ip address
[...]
add address=192.168.1.1/24 interface=sfp1 network=192.168.1.0

Shouldn't the address be something other than 192.168.1.1? Maybe .2?

TheCat12

It should also be possible with a RADIUS server (or User Manager for that matter): It is also possible to hand out leases for DHCP clients using the RADIUS server; the supported parameters for a RADIUS server are as follows: Access-Request: NAS-Identifier - router identity NAS-IP-Address - IP addres...

TheCat12

First off, your firewall is a mess to say the very least - misordered rules, redundant rules, etc.

Secondly, I suspect you're missing some NAT port forwardings like 80,443,554

TheCat12

https://en.akinator.com/

or

export file=anynameyouwish (minus sensitive info like public IPs, passwords, etc.)

TheCat12

If you're configuring L2TP over IPsec (which you probably should be) there's an option in the mode configurations named "split-include" but for you to be able to use it you would have to configure the whole IPsec part by yourself instead of just adding IPsec secret under the PPP profile wh...

TheCat12

Probably because the VLAN should also be src-natted:

/ip firewall nat
add action=src-nat chain=srcnat src-address=10.0.100.0/24 to-addresses=188.213.95.249

TheCat12

That is the more fortunate situation because you can do the following: For the server you can add one of the addresses directly on the Ethernet port facing it. For the VLANs and other NATted subnets you could add routes pointing to their gateways with dst-address being a public IP: /ip route add dst...

TheCat12

If that's really the first usable address, it could be that they're routing the /29 block to you and they're using different addresses for the PPPoE link?

TheCat12

Is your ISP the gateway (they have the first usable address of the subnet for their router) or do they route the /29 block to you?

TheCat12

Without an exported config it would be very hard to diagnose the problem: export file=anynameyouwish (minus sensitive info like serial numbers, passwords, etc.) Nevertheless, I'll have a shot in the dark and guess misconfigured NAT masquerading, e.g. the PPPoE interface is not added to the WAN inter...

TheCat12

Does the LTE interface add a default route?

Aside from that, mixing VLAN and non-VLAN traffic on the same interface never leads to anything good. Keep that in mind

TheCat12

Would it not be for the second bit...... ???? /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP1_interface" distance=1 add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.100.1%"ISP2_interface" distance=2 add dst-address=0.0.0.0/0 gateway...

TheCat12

you cant as far as im awear run two isp in to the mikrotik at the same time As a matter of fact you can, but since both ISPs provide addresses from the same address space, the routing part would be a bit tricky. First, the creation of routing tables and mangling which is typical load balancing, sho...

TheCat12

I did this, but I had no luck and how can I grant access only to the printer IP?

May we then have a look at the exported config of the router?

export file=anynameyouwish (minus sensitive info like passwords, etc.)

TheCat12

You still have to answer my question whether both sides of the L2TP tunnel are MikroTik routers because routing will be made on the router with the public IPs

TheCat12

No need for the last two NAT rules, most probably you're missing a route:

/ip route
add dst-address=192.168.18.0/23 gateway=192.168.18.1

TheCat12

You can create address lists and block traffic using only the "forward" chain but you have to enable "Use IP Firewall" and "Use IP Firewall for VLAN" from the bridge settings

TheCat12

The SFP port should be part of the WAN interface list in order for the NAT masquerade rule to work properly:

/interface list member
add interface=sfp1 list=WAN

TheCat12

i want to create a pptp vpn server

Better create a L2TP server here too, because PPTP is deprected.

Aside from that, are both sides of the existing L2TP tunnel MikroTik? What do you mean by "distribute the public IPs to clients"? Maybe you meant PPPoE instead of PPTP?

TheCat12

For such a simple setup VLANs would be a pushover in my opinion. Appropriate firewall rules and assigning the wlan1 interface to a bridge to be used for DHCP so that it doesn't show red should be enough

TheCat12

This would be done with the help of firewall rules, of course: /ip firewall filter add action=accept chain=forward connection-state=established,related,untracked add action=drop chain=forward in-interface=bridge1 out-interface=wlan1 add action=accept chain=forward protocol=tcp dst-port=80,443 in-int...

TheCat12

and when I create IP addresses that collide with the upstream router's default VLAN gateway (10.60.0.1) Why do you create addresses that are the same as the DHCP servers' if I understand your lexicon correctly? Since you're running DHCP, why don't let the servers assign such: /ip dhcp-client add in...

TheCat12

Am I missing a reference in the main table for 192.168.9.9, even though it's brought in by the wireguard interface as being reachable on REMOTE1? Possibly, better add the route to roll it out as a probable cause. It could also be of higher distance if ECMP is not desired and one gateway is to be pr...

TheCat12

I have noticed this train of thought on the forum recently and I don't get it. Why presence of a route to a given destination (or even less logically, of a default route) in the main table should be a mandatory pre-requisite for a route to that destination to work in another table? For the followin...

TheCat12

Could it be that they are missing the default route from the custom routing table in the main one?

TheCat12

There is a small detail from the default firewall I forgot about - the rule "Drop all input not coming from LAN". If you edit it, for example, to also allow your main network as src-address, then you should start accessing the RB5009 from behind the hEX S

TheCat12

To be able to use check-gateway you have to disable add-default-route on the primary WAN DHCP client and add a static route pointing to the its gateway manually: /ip route add check-gateway=ping dst-address=0.0.0.0/0 gateway="Primary_WAN_gateway" If you want your failover to be even more r...

TheCat12

Is the bandwidth symmetrical (equal download and upload)? Should only download be allocated or both?

TheCat12

Source NAT, as the name suggests, applies for packets that originate from the NAT-ted network, i.e. your network, whose source address should be change/translate to one specified in the according rule. That's why src-nat rules will apply only on out-interface - the interface from which packets will ...

TheCat12

If everything should be interconnected, then adding a separate DHCP server per interface would be the solution

TheCat12

@TheCat12, your rules rewrite the connection mark (even twice) when handling each packet, what's the point? The very idea of using connection marks when dealing with QoS is to translate complex match conditions into a connection mark only once, when handling the initial packet of a connection, or m...

TheCat12

Something like this should work: /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=!LAN_conn new-connection-mark=Other_conn add action=mark-connection chain=prerouting src-address=*LAN_IP* new-connection-mark=LAN_conn add action=mark-connection chain=prerouting dst-addr...

TheCat12

You're missing a NAT rule on each router to bypass masquerading packets before being encrypted. It should be placed as the first one # Router 1 /ip firewall nat add action=accept chain=srcnat place-before=0 dst-address=192.168.3.0/24 src-address=10.53.2.0/24 # Router 2 /ip firewall nat add action=ac...

TheCat12

That should be quite achievable:

/interface ethernet switch rule
add new-dst-ports=etherx,ethery src-address=x.x.x.x ports=ethera,etherb

TheCat12

Perhaps firewall blocking traffic? If Office A router is also MikroTik, consider exporting its config and posting it here

TheCat12

I can configure VLAN in three places: 1. In the Interface configuration (vlan-mode and vlan-id): [admin@hAP-bedroom] > /interface/wireless/print Flags: X - disabled; R - running 0 R name="telekom-guest" mtu=1500 l2mtu=1600 mac-address=DE:2C:6E:25:88:49 arp=enabled interface-type=virtual m...

TheCat12

Apparently I read your OP too diagonally and didn't see the obvious problems - the bridges. For VLAN to work properly, you need one bridge with all of the ports on which traffic will be tagged/untagged. Also, the VLAN interfaces shouldn't be members of the bridge(s). That's why before we continue, t...

TheCat12

That I'll contribute to address space overlapping - a very broad route which could apply to the remote subnet and to the L2TP one. If you change one of them and add appropriate static routes or use a more specific route (e.g. 192.168.100.0/24 instead of 192.168.0.0/16), it should start working as ex...

TheCat12

Wait a minute, have you added a route pointing to the L2TP subnet on Office A router?

TheCat12

Would you export your config and post it here because it seems that my local fortune teller is on vacation:

export file=anynameyouwish (minus sensitive info)

TheCat12

This part of suggested configuration did not worked: /interface bridge vlan add bridge=bridge tagged=bridge,ether1,wlan1 vlan-ids=10 add bridge=bridge tagged=ether1,wlan3 vlan-ids=20 What is the point behind adding WLAN* interface as tagged? If I understand well, tagging interface means that the in...

TheCat12

Precisely. Only the 88E6393X is capable of mirroring to multiple ports:

https://help.mikrotik.com/docs/display/ ... tMirroring

TheCat12

Since no problems are visible, the full configuration of both routers would be needed: export file=anynameyouwish (minus sensitive info like public IPs, passwords, etc.) Also, would you elaborate on the following quote from your original post: I have a problem with site to site IKEV/IPSEC vpn that I...

TheCat12

If the real source addresses of those who access Office A aren't of importance, add a masquerade rule for all traffic leaving out of the SSTP tunnel. Otherwise, you might want to look into policy based routing and mangling

TheCat12

Have you changed the default Winbox port? If so, edit the rules acceordingly because in theory they should work the way you've created and placed them

TheCat12

I'll have to disappoint you but I don't think the desired setup is possible with your device even though it's a very powerful one. The only one that will work in your scenario, to my knowledge, is the RB5009

TheCat12

On the last firewall rule add an exception for dst-port=8291

TheCat12

I think adding a second Ethernet cable between R1 and R2 would simplify the configuration if possible. Since R1 is in bridge mode it won't matter whether you're receiving PPPoE from one port and DHCP from another or both from the same port. In the case with two Ethernet cables you would need to remo...

TheCat12

/ip/firewall/filter print /ip/firewall/filter print Flags: X - disabled, I - invalid; D - dynamic 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 chain=input action=accept protocol=icmp 2 chain=input action=accept connection-state=established 3 chain=input a...

TheCat12

A question out of pure curiosity - how would the PPPoE work in conjunction with a VLAN aware bridge? Should the PPPoE interface run on top of a VLAN interface or how?

TheCat12

Looking at the NAT masquerade rule, I assume you connect to the internet via PPPoE and some questions arise like: Do you have a default route pointing to it? Have you added the PPPoE interface to the WAN interface list? Do you receive a public IP at all? Should the answer to any of the questions be ...

TheCat12

A bit off-topic but since this is the most viewed topic by MikroTik employees as of now, could somebody from the MikroTik Documentation editors correct the spelling of the following page title:

https://help.mikrotik.com/docs/display/ ... prevention

TheCat12

The solution would be to create the Virtual AP as you probably did, add it to a second bridge and after that continue configuring DHCP (the bridge will be the interface on which it should be running), firewall rules, etc.

TheCat12

How are Router 1 and Router 2 connected? Which router receives what address from the other one as de facto WAN? An export of the configuration of one or both routers would be quite helpful:

export file=anynameyouwish

TheCat12

Could you post an export of your config and one of the IPsec logs?

export file= anynameyouwish (minus sensitive info)
/system logging add topics=ipsec,!debug

TheCat12

Not that I expect it to be the problem, but could you add the following firewall rules somewhere in the beginning:

/ip firewall filter
add action=accept chain=input protocol=tcp dst-port=1723
add action=accept chain=input protocol=47

TheCat12

There is a small hack to use /31 addresses - one address to be the local address and the remote one to be specified as the network. For example, site 1 - address=192.168.1.0 & network=192.168.1.1, site 2 - address=192.168.1.1 & network=192.168.1.0

TheCat12

Port 8080 of the dst-nat rule is a reserved port for other use, so change it to a more obsolete one (e.g. 17680)

And you've leaked your PPTP username and password, elide them PRONTO and change them afterwards!

TheCat12

This makes it sound like it would switch to the second server if pihole goes down but then not switch back when it comes back online as 1.1.1.1 will still be online. I am using pihole for some local DNS addresses that i have not assigned on cloudflare so want it to use that server whenever possible...

TheCat12

For the love of God and your router, please do not use PPTP! It is obsolete, deprecated and insecure! At least use L2TP over IPsec. And please update your router to either 6.49.17 or 7.x

TheCat12

But at least color contrast was fine 😅

Agree. A little more colour won't harm

TheCat12

Most companies tend to lean towards a more modern UI to please and attract new customers but sometimes they overstep the thin line between usability and aesthetics. I called it "a breath of fresh air" not because it still has a lot of issues and complaints which should be heard and fixed b...

TheCat12

Although I'm still a bit overhauled by the new UI, it was a long-awaited breath of fresh air. And the fact that it's also Linux native makes it even better.

+1 to return tabs

TheCat12

Firstly, I want to congratulate you on your configuration - it looks very promising and surely it will work even without the suggestions/answers I'll give you throughout the post. I am running a local DNS on PiHole on 172.23.20.2 and want the router to default to using this DNS server but if it goes...

TheCat12

May I assume that the mANTBox should receive internet on ether1 via DHCP? If that's the case, remove all DHCP server related configuration (/ip pool, /ip dhcp-server, /ip dhcp-server network). If the Mikrotik connects to the internet via the same port otherwise, just remove it from the bridge

TheCat12

Have you tried following @sindy's tip? If it doesn't work, please post a full export of the config:

export file=anynameyouwish (minus senstitve info like public IPs, passwords, etc.)

TheCat12

It would be nice to have a full export of the config to have a general overview of the situation: export file=anynameyouwish (minus any sensitive info) As for your question, you would need to configure a VLAN interface if you will be handling L3 traffic (addresses, DHCP, routing, etc.), and change t...

TheCat12

Is there a way to make strongSwan work without going the certificate route? The only other way is configuring User Manager (your router has a beefy flash, so no worries for installing) which could be or could be not more complicated to set up. But let's try anyway. Here you can read what the prereq...

TheCat12

@TheCat12, on top of the above, the case brought in by @johnb175a is very different from the other two. Guilty. :( When I looked at the config and the IPsec exports and everything seemed normal, I had to call you in as an IPsec expert. As for the OP's problem, I think I might have found the culprit...

TheCat12

Also, I am missing the confic which basically says "all wifi1 users are using the routing table use-WG". How does wifi1 know which routing table to use? The following line from @anav's configuration should answer your question: /routing rule add action=lookup-only-in-table src-address=192...

TheCat12

I don't see anywhere in the configuration you provided that VLAN filtering is turned on: /interface bridge set bridge1 vlan-filtering=yes Also, a better option for management access to the router is to remove one port from the bridge and assign it an IP address instead on the whole bridge and when y...

TheCat12

I replicated the setup and everything works as expected. Maybe it's worth opening a ticket to MikroTik support because it could be a bug

TheCat12

In this case neither firewall rules and routes, nor use-ip-firewall=yes is needed because a blank firewall allows everything by default, dynamic routes are added when you add an address to an interface and the traffic is not between two bridged ports

TheCat12

Perhaps you have a typo in the ether1 address?

TheCat12

I think it's due to the usage of action=masquerade , which can cause leakages in your scenario, instead of action=src-nat , which in your case is the preferred way because the IP of the router is static: /ip firewall nat add action=src-nat chain=srcnat to-addresses=192.168.6.1 out-interface=ether2 A...

TheCat12

Unfortunately I'm out of options. That's why I'll once again ask @sindy to have a look at your case

TheCat12

Since your Mikrotik is currently acting as a switch, you won't be able to perform routing with it. You'll have to configure a DHCP server and deal with double NAT or find another Mikrotik (e.g. hAP ac²) and put it in place of your home router, if possible and your budget allows it, because you'll ha...

TheCat12

Because you're dealing with Layer3 traffic you would have to add the bridge interface as a tagged port to the appropriate bridge VLAN table entry:

/interface bridge vlan
add bridge=bridge tagged=\
combo1,sfp1,sfp2,sfp3,sfp18,sfp-sfpplus1,sfp-sfpplus2,bridge untagged=sfp19 \
vlan-ids=10

TheCat12

Now that I think of it, the problem may be that ether24 is in the same broadcast group as the VLAN, yet it has a different IP from the rest of the subnet, of which the router couldn't know, hence no src-nat. That's why you should remove the port out of the bridge, assign it the 192.168.19.41 address...

TheCat12

Easiest way would be to create a routing table, add a default route with gateway the OVPN to it and use routing rules: /routing table add fib name=through_VPN /ip route add dst-address=0.0.0.0/0 gateway="OVPN_interface" routing-table=through_VPN /routing rule add action=lookup-only-in-tabl...

TheCat12

You're missing firewall rules on both sites to allow traffic between the subnets: /ip firewall filter add action=accept chain=forward src-address=192.168.43.0/24 dst-address=192.168.44.0/24 place-before=8 add action=accept chain=forward dst-address=192.168.43.0/24 src-address=192.168.44.0/24 place-b...

TheCat12

I forgot about a selector called "out-bridge-port". That could do the trick

TheCat12

The NAT rule won't work because "Use IP Firewall for Bridge" should be enabled: /interface bridge settings use-ip-firewall=yes use-ip-firewall-for-vlan=yes After that, the src-nat rule should work: /ip firewall nat add action=src-nat chain=srcnat protocol=udp to-addresses=192.168.19.41 src...

TheCat12

May I inquire what the component is that is sending broadcast messages and why the broadcast messages should be limited only to a specific Ethernet port and, by that, src-natted?

TheCat12

No need, I could answer that with ease - leave the WAN interface out of the equation, i.e. remove it from the bridge and remove all VLAN configurations from and associated with it. If you do that, all of your VLANs will have by default internet access which you can then limit with the help of firewa...

TheCat12

Should I assign the IP to lo or create a bridge-loopback and assign it there? It's one and the same. The lo interface was exposed precisely to eliminate the need for a loopback bridge It's so strange that this all worked without all these changes a while back. Although I am not sure if it was worki...

TheCat12

I get "input does not match any value of interface". I see a lo interface, but not a lo1.

So the name is lo:

/ip address
add address=192.168.10.1/24 interface=lo

TheCat12

Unfortunately, I can't tell what the problem could be but I can think of a temporary/permanent solution - setting up VLANs after you undo the port isolation. In your case, it could be done from the same menu, from which you set up port isolation, to take advantage of hardware offloading. The VLANs w...

TheCat12

Also, I don't see a policy template:

/ip ipsec policy group
add name=ikev2-policies

/ip ipsec policy
add dst-address=192.168.10.0/24 group=ike2-policies proposal=proposal1 src-address=0.0.0.0/0 template=yes

TheCat12

You're missing a loopback address:

/ip address
add address=192.168.10.1/24 interface=lo1

*lo1 should be the name of recently exposed loopback interface, if not, please change "interface=" correspondingly

TheCat12

Your PPPoE connections are not running. Could your ISPs be using VLANs or maybe only the ISP devices authenticate via PPPoE and you only need DHCP clients on the hEX

TheCat12

1) Yes-ish, because there is no need of the mangle rules (the routing rule does the same) and the nat rule (the default one already does the same) 2) No need, because action=lookup on the routing rule means that routing decisions will fall back to the main table if the route, specified in the wg-nor...

TheCat12

I'd suggest looking at the following MUM presentation to gain insights on how to configure IKEv2 site-to-site:

https://youtu.be/n5_Af2vllOA?si=OQnzMSIWeViM8xhs

For the Quantum Spark side:

https://youtu.be/jccJI89Xkfk?si=DHNISCrWNEwWJnRo

TheCat12

@johnb175a, in your case, the VPN tunnel establishes, so the problem is somewhere else. That's why I would additionally need a full export of the config:

/export file=anynameyouwish (minus sensitive info)

TheCat12

Let me go to my local Madame Esmeralda because, unlike @Anav, I do not possess any psychic supplies

or

/export file=anynameyouwish (minus sensitive info)

(Sorry for the sarcasm, Mikrotik not adding a first-time poster manual is at fault for it, not you)

TheCat12

I think this address is causing you problems:

add address=192.168.170.0/28 interface=openmetallab-management-vlan170 \
    network=192.168.170.0

It should be 192.168.170.1/28

TheCat12

I think you need to change your concept of VLANs a little bit, so please read the following first and after that come back to discuss a possible solution:

viewtopic.php?t=143620

TheCat12

Not sure what exactely you are referring to, but from the wiki: WiFi CAPsMAN only passes wireless configuration to the CAP, all forwarding decisions are left to the CAP itself - there is no CAPsMAN forwarding mode. To get it to work through the switch, you have to add VLAN ID 1 to the switch config...

TheCat12

Something like that should do the trick: 1. On the L009 add ether1 to the LAN bridge remove DHCP, etc. and add static address 2. On the RB5009 add the following configuration: /routing table add fib name=to_ISP1 /ip route add distance=1 dst-address=0.0.0.0/0 gateway="L009_static_IP" set [ ...

TheCat12

Perhaps it's an arising conflict between VLAN 1 and 51 because they both have analogous configuration (same ports, none of which has untagged traffic) and at least one common MAC address is learned by both of them

TheCat12

Unless you configure management VLAN on the RB4011, the RB960PGS and the APs, VLAN1 as a mean of access to the APs should suffice. As a side note, please consider enabling ingress-filtering and configuring frame-types on the RB4011 ports as follows: frame-types=allow-only-vlan-tagged for trunk ports...

TheCat12

Based on previous experience with setting up IKEv2 on Windows, I suspect that encryption methods can't be negotiated between the parties. To troubleshoot that we will need apart from an exported config a log print with IPsec logging turned on:

/system logging
add topics=ipsec,!debug

TheCat12

Before configuring VPN, I highly, very highly suggest you set up VLANs, at least for the sake of network desaturation if I may say so. If you're not familiar with it, I suggest reading this:

viewtopic.php?t=143620

TheCat12

Local forwarding should be enabled on the datapaths because the AP is not directly connected to the CAPsMAN

TheCat12

Personally, I use sha1, sha256, aes-256 and pfs-group=none for proposals and sha256, aes-256, modp1024 and modp2048 for profiles and it works for my native Android VPN client although I see that the OP uses the same configuration and it doesn't work for him, which is very odd. Perhaps an Android or ...

TheCat12

If somebody could enable IPsec logging and post the log here, I would be glad to help:

/system logging
add action=memory topic=ipsec,!debug

TheCat12

If you configure the Zyxel in bridge mode, i.e. all ports are bridged and it doesn't distribute addresses of its own, then the port forwarding will be done on the Mikrotik, else on the Zyxel

TheCat12

You would need to add an IPv6 loopback address, use an IPv6 pool for the mode-config or use static addressing, add an IPv6 IPsec policy and use IPv6 LAN addresses to access resources.

Please refer to the following topic:

viewtopic.php?t=204321

TheCat12

Proof for VPNv6 support:
https://help.mikrotik.com/docs/display/ ... l+Overview

TheCat12

I think they are adding it as a feature because it can be seen as an AFI on the CLI only

TheCat12

Your configuration is a bit tricky bacause it is better to use the Switch menu for VLANs yet the wifi interfaces cannot be used in it because they are not physical ports. With respect to that the following should be done: 1. The VLAN interfaces should be assigned to the bridge itself and not the tru...

TheCat12

You should either have routes or IPsec policies that tell the traffic how to get to the remote LAN. IMO it is better to use IPsec policies: # Site A /ip ipsec policy add tunnel=yes src-address=192.168.1.0/24 dst-address=172.16.2.0/24 action=encrypt proposal="Site_A_proposal" # Site B /ip i...

TheCat12

Because ether1 is the trunk port, shouldn't the PVID 1500 be set on ether2? That way you'll have access to the management VLAN through the aforementioned port

TheCat12

Your VLANs are messed up and you are missing CAPsMAN configuration: /interface bridge port set [ find interface=ether3 ] pvid=1 set [ find interface=ether4 ] pvid=1 /interface vlan set [ find interface=ether5 ] interface=bridgeLocal /interface ethernet switch port set 2 vlan-header=leave-as-is set 3...

TheCat12

I think what you're looking for is this:

https://help.mikrotik.com/docs/display/ ... einterface

TheCat12

I think your problem corresponds to the following one: https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration#Layer2misconfiguration-VLANfilteringwithsimplifiedbridgeVLANtable The solution to it is adding a separate Bridge VLAN entry for every VLAN ID in the bridge VLAN table. You could ...

TheCat12

Shouldn't your network in the IP/Address entry be 10.10.0.0 because what you have wirtten is the netmask which you could specify with a /24 after the address

TheCat12

Could you post your ocnfig the following command:

/export file=anynameyouwish

That way it'll be better readible and will have more details about the configiuration which are not visible in your format

TheCat12

also sorry for maybe dumb questions but im still quite new to thee VPNs in mikrotik.

No need to be, IPsec on MikroTik and overall is a bit finicky

TheCat12

I meant that you could scratch the following policy on client side: /ip ipsec policy add dst-address=10.22.22.1/32 peer=ike2-peer proposal=IKEv2 src-address=10.22.22.2/32 tunnel=yes And add a template in place of it: /ip ipsec policy add group=MyGroup peer=ike2-peer proposal=IKEv2 template=yes After...

TheCat12

I think the main problem is in the VLAN part of the configuration (misconfiguration and mismatched vlan-ids) and not in the OSPF part, so good thing you posted here. Now to the VLAN - I would bridge all of the VLAN200 ports (except one so you don't lock yourself out during the setup) and assign the ...

TheCat12

It looks like a combination of Vincent van Purr and Claude Meowet

TheCat12

Instead of creating a tunnel between the VPN addresses of the tunnel on client side, you could use a policy template. As for the communication between the LANs, it should be quite an easy fix: # Server /ip ipsec policy add action=encrypt proposal=ike2-proposal src-address=192.168.200.0/24 dst-addres...

TheCat12

I have nothing to add. Even if the code is bad-shaped, which it is not, what matters most is that it works.

P.S. For your information, what you have achieved between the routers is not a L2TP tunnel but rather an IPsec tunnel

TheCat12

I wouldn't classify the topic as "Beginner Basics" but who am I to judge?
Anyway, is the router part of the backbone or a different area? Do the timers match?

An exported config would help finding the cause of the problem:

/export file=anynameyouwish (minus sensitive info)

TheCat12

Without config we can't tell anything...

/export file=anynameyouwish

TheCat12

Someone was in a hurry to fix it:

Screenshot_20240724_200744_Samsung Internet.jpg

TheCat12

I'd suggest using the following IPsec policy on the local router:

/ip ipsec policy
add action=encrypt src-address=192.168.1.0/24 dst-address=171.11.153.20

And one with swapped source and destination addresses on the remote party

TheCat12

1. Your firewall filter is a self-hazard - better use the default one than this open door for attacks, malware and what not 2. The accept mangle rules aren't necessary 3. You're missing two routes: /ip route add dst-address=0.0.0.0/0 gateway=100.94.144.1 routing-table=main add dst-address=0.0.0.0/0 ...

TheCat12

Because I forgot that a route should be added on Site A:

/ip route
add dst-address=192.168.1.116 gateway=<l2tp client interface>

TheCat12

Just one question - is a default route to the gateway needed? As the AP de facto acts as a switch, shouldn't routing be handled by the gateway?

TheCat12

Don't forget to assign the DHCP client on the bridge and not on ether1 or better yet, assign the address that is currently on ether1 on the bridge and don't add a DHCP client and:

7. Delete or disable all default routes if there are such existent

TheCat12

In the dst-nat rule you haven't specified dst-address (i.e. your static public IP), against which the packets should be matched so that their destination address is accordingly translated. Also, port 22 is SSH, so you better change your dst-port (the more obscure, the better)

TheCat12

/routing table
add fib name=through_VPN
/ip route
add dst-address=0.0.0.0/0 gateway="remote tunnel IP"
/routing rule
add src-address=192.168.1.116 action=lookup-only-in-table table=through_VPN

TheCat12

If we consider the default bridge as WAN and the IoT as LAN, change the default bridge to be part of the WAN interface list and remove out-interface=ether1 from the masquerade rule: /interface list member set [ find interface=bridge ] list=WAN /ip firewall nat set [ find out-interface=ether1 ] out-i...

TheCat12

Could you export the config of the hAP ax³ and post it here?

/export file=anynameyouwish (minus sensitive info)

TheCat12

And make sure not to run a DHCP server for the 172.17.0.0 range on the branch office router as it may lead to undesired effects

TheCat12

It probably happens because the addresses of local and remote LAN are the same. I think that could be overcome with the help of an EoIP tunnel spanned over the L2TP tunnel but that would require a static address for the branch office router instead of a random one from the VPN pool: # Head office /p...

TheCat12

I can try to help you with that problem too - firstly you have to turn on IP firewall for the bridge: /interface bridge settings set use-ip-firewall=yes After that add a firewall to drop all forward for the PBX address except for in-interface-list=PPP: /ip firewall filter add action=drop chain=forwa...

TheCat12

You could also remove the add-dst-to-address-list rules because they should be covered by the mangle

TheCat12

Yes, quite a nice and proper correction

TheCat12

For the firewall filter just add the following rule before the drop all input not from LAN and remove from the latter connection-state=established : /ip firewall filter add action=accept chain=input ipsec-policy=in:ipsec And please try to implement my new revision of the mangle rules and give me a f...

TheCat12

I'll once again try to rewrite and rearrange your mangle rules so that hopefully everything works after that. In my previous posts I was pretty sloppy about the order of the rules on which I emphasized earlier that it is of importance (shame on me) and probably that's the reason why you lost remote ...

TheCat12

Perhaps the problem is in the firewall. That's why it's not good to work with sniplets of config. Would you export your whole config and post it here?

/export file=anynanmeyoulike (minus sensitive information like serial numbers, public IPs, etc.)

TheCat12

One minor suggestion - remove the dst-address-lists of the "X only VPN" rules (rules no. 12,13,14) so that all traffic originating from the VPN can be matched against them, not only destined to the addresses in the lists. Also you could combine rules no. 15-20 by using in-interface-list=LA...

TheCat12

I see that you've reverted to the old naming convention for the routing tables and marks. That's why I'll suggest once more to change it as in the previous sniplets of configuration. Bear in mind that you should not only change the names of the routing marks but also that of the routing tables to ma...

TheCat12

Perhaps exactly that is the problem - the ports that should be used to access the server are changed so that the outside users don't know the original ones

TheCat12

I think that there is no need for egress-vlan-translation and that is causing the problem: When an entry is created under /interface ethernet switch ingress-vlan-translation , then the switch chip will add a VLAN tag on ingress frames on the specified port. To remove the VLAN tag on the same port f...

TheCat12

The VLAN is a side note.

However, I just saw that you haven't specified the to-ports parameter in the dstnat rules. Maybe that is the cause

TheCat12

More likely what @karlisi suspected - you're behind the ISP's NAT which doesn't have full port forwarding enabled, hence no access to the server from the outside

P.S. Your VLAN is not configured properly

TheCat12

For the firewall filter rules I forgot that the order in which they are is of importance baecause the matching is dome sequentially. That's why the drop input expecr from LAN should be after all other input rules and analogously for the drop forward from WAN except dst-nated rule. As for the three s...

TheCat12

Use action=src-nat in the srcnat rule so that you can specify to which port should the IP address be sourcenatted: /ip firewall nat add action=src-nat chain=srcnat protocol=tcp src-port=5060 src-address=192.168.7.100 to-addresses=222.222.123.2 to-ports=5060 Just make sure to put the rule before any ...

TheCat12

The only thing you should change from the screenshot config is to remove in-interface=bridge . If you have a static public IP, you could use it in dst-address instead of in-interface-list=WAN. If the rule still doesn't work, maybe you're behimd carrier-grade NAT and you should ISP to create a full p...

TheCat12

Your firewall still lacks some essential rules, for example dropping all input not coming from LAN (a default config rule): /ip firewall filter add action=drop chain=input in-interface-list=!LAN Another one is drop all forward from WAN not dstnat-ed: /ip firewall filter add action=drop chain=forward...

TheCat12

1) Remove WiFi interface list and add ether11-WiFi to the LAN interface list (you'll see why short after): /interface list add name=WAN add name=LAN add name=WiFi /interface list member add interface=ether5 list=WAN add interface=ether9 list=WAN add interface=ether1 list=WAN add interface=ether12-LA...

TheCat12

Use address-pool=static-only on the DHCP server and that should do the trick

TheCat12

You're mixing apples with oranges and your VLAN config is a complete mess. You either use VLANs all the way or don't use them at all, hybrid setups don't work as expected. 1) Remove or change pvid of vlan bridge to 20 and remove frame-types if you don't want to lock yourself out: add comment=VLANTES...

TheCat12

One way would be to use a DNS record - for example the one from IP/Cloud, which you could add in an address list and use dst-address-list instead of a dst-address. Another way is the one you mentioned - create a DHCP lease script. There is no better or worse way

TheCat12

For the UPnP to work, you need to add interfaces: /ip upnp interfaces add interface=ether1 type=external add interface=bridge type=internal enable 0,1 Otherwise all ports are open by default, to forward ports you need to add dstnat rules: /ip firewall nat add action=dst-nat chain=dstnat protocol=udp...

TheCat12

Perhaps it is missing NAT?

/ip firewall nat
add action=masquerade chain=srcnat out-interface=sfp-sfpplus1

Also, remove sfp-sfpplus1 from the bridge as well as from the bridge VLAN table and VLAN 1 from the latter, and everything should be fine

TheCat12

Could you export your config and post it here to have a look what could be going wrong?

/export file=anynameyouwish (minus sensitive info)

TheCat12

I'd suggest using IPsec policies on both routers - on local router policies with src-address the streaming devices, which should be routed through the tunnel, and on the remote router the other way around. Only exception on the remote router is that in this case policies with action=none shpuld be a...

TheCat12

Maybe to better understand what you try to achieve a simple network diagram would be needed. Also, does VLAN 30 arrive at the Mikrotik as .1Q tunnel and which are/should be its inner VLANs?

TheCat12

One of the problems may be that your LAN network's addresses overlap with those handed out by the Starlink because, if I remember correctly, it is CGNAT. Nevertheless, an export of the config is advisable for us to be able to help you:

/export file=anynameyouwish (minus sensitive info)

Search found 433 matches