MikroTik

Mesquite

Not putting the untagged ports especially when learning how to setup vlans is not recommended. Even with much experience I still prefer to put them in as whenever I do an export of the config they are visible and easy to cross check with bridge ports. Many times a misconfigured config for vlans is h...

Mesquite

I am going to assume there was no default config with this router?? This is wrong, Where at the bridge ports......... you have it backwards . /interface bridge port add bridge=LAN_BRIDGE interface=LAN More like /interface bridge port add bridge=LAN_BRIDGE interface=bonding1 add interface=LAN_BRIDGE ...

Mesquite

viewtopic.php?t=143620

Well you have one bridge ( and no address assigned to bridge, no dhcp etc)
two vlans with interface bridge.
assign bridge ports
assign bridge vlans
assign firewall rules as required.
done.

Up to you to do the work..........

Mesquite

Its all there, so it must be a config error on your part.

Mesquite

viewtopic.php?t=143620

Also would need to see complete config...

Mesquite

Which part doesnt work the router ports or the switch ports and if its the switch, you failed to mention which router model or switch model??

Mesquite

Moral of story, never load up a 7.X.0 version, always at least wait for 7.X.1 or 7.X.2 :-)

Mesquite

Assigning or forcing vpn out a specific WAN interface, is totally different than assigning the ISP connection to an ethernet port or VLAN.
Apples and Oranges

Mesquite

As stated much more is possible if you switch positions of the routers.

Mesquite

Draw a diagram the explanation is lacking

Mesquite

Darn it,

Sorry, I wear socks, dont know squat about IP socks, guess I havent needed to, so never looked it up.

Mesquite

The first thing you should do is write clear requirements and not try to compress requirements into one line. Secondly communicate is horrible term. In networking its better to talk about, originating traffic to ............. Replies are permitted in firewall rules, and its all about who is allowed ...

Mesquite

There have been reported issues with winbox over the past several months.
If you take a look at the latest firmware just released 7.14, and the winbox fixes, it may be solved............ ??

Mesquite

If the routers were switched, it may be doable as you could VPN into Mikrotik connected to ISPA. Then you would simply make the connection to ROUTERB as WAN2 on router MT getting a private IP on that LAN connection DHCP provided by router2......... One would source nat out WAN2 on the mikrotik and t...

Mesquite

I dont think so, thats a DPI problem that MT is not best suited to intercept. I could be wrong though.

Mesquite

Shock, do you mean VPN connection and if so, yes via wireguard.

Mesquite

Well what is the make model of Router1?? Why is your pC that is supposed to be connected at Router1, not behind the router but on the internet in the cloud reaching router 1 through the ISP?? Also does router 1 have a public IP? If so static or dynamic. Assuming the mikrotk gets a private IP and can...

Mesquite

Read this post ( the config for the attempt at a switch setup ) and pay attention to the corrections!! ( post #2)
viewtopic.php?t=204967

Mesquite

First things is that we need to make all three WANS available on the Main Table. I have no clue about your pppoe connections and dont care, going to focus on the WAN connections. Dont think any mangles required ?? /ip route add check-gateway=ping distance=1 dst-address=0.0.0.0 gateway=current-privat...

Mesquite

So far looks okay..... 1. On two IP main table routes, would add check-gateway=ping. add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=pppoe-out-pishgaman routing-table=main comment=WAN2 add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=192.168.43.1 routing-table=main com...

Mesquite

If they are in the same vlan then they are connected on layer2. Makes no sense.

Unless you reinvent rules, I see you have two bridges, first mistake and then attempt to assign the same vlan IDs to different vlans on the different bridges
Good luck with that.

Mesquite

Are you saying Router 1 is physically connected to the Mikrotik by ethernet cable??
Does either ISPA or ISPB have a public IP address??

Mesquite

So can I conclude that -both sets of users (business and private) are to use WAN1 as their primary source of internet? -if WAN1 is not available, then WAN2 should be used next by business users ONLY -if WAN2 is not available, then WAN3 should be used next by business users ONLY. In other words there...

Mesquite

Well the config was incomplete and thus confusing. Yes everysmart device gets an IP on the managment vlan. Unifi devices as a default (backwards), assume the management vlan comes untagged and all the wifi vlans tagged. Thus you need a hybrid port. X is tagged for data vlans but untagged for the man...

Mesquite

The fastrack rule is NOT a mangle rule its a forward chain filter rule and should be typically the first forward chain rule.
Without seeing the whole config ( less any public IP info ) will be hard to pinpoint the issue

Mesquite

VPN is a router service.
Where have you allowed the handshake in the firewall rules??
On router B the allowed IP should be /interface wireguard peers
add allowed-address=192.168.77.0/24,10.255.255.0/30

However that is not the cause of your issues.

Mesquite

If ether1 goes to the Internet (via modem etc..) then yes its part of the WAN interface list, NOT the LAN interface list.

Mesquite

Its not hard as you already have a wireguard interface, Just assign each router a wireguard IP. On the main router add a line for allowed IPs to each router. ipaddressRouterClient1/32,subnetC,subnetD...... ( either local users going to remote subnet, OR , remote subnets coming into the main router )...

Mesquite

(1) Keep single NIC card and LANIP.......... / ip firewall nat add chain=srcnat out-interface=ether1-WAN1 action=masquerade add chain=srcnat out-interface=ether2-WAN2 action=masquerade add action=dst-nat chain=dstnat dst-port=3389 dst-address=StaticWANIP1 protocol=tcp to-addresses=192.168.70.20 add ...

Mesquite

Perhaps this??
add chain=dstnat action=dst-nat src-address=10.20.28.0/22 src-port=8103 dst-address=10.20.28.XX dst-port=7547

Mesquite

Are you saying you wish to connect all the clients' routers to your MT server router via WG? Are they all MT routers? Not much different from roadwarrior setup. No input chain rule (no handshake on client router) Still need IP address Still need allowed IPs ( not 0.0.0.0 likely but something like 19...

Mesquite

Are the public IPs, static or dynamic? Same provider or different provider.

RDP is not secure, dont recommend.
Much better off installing wireguard and have your users securely access the router and then you can have them access any LAN device, including an RDP server from the LAN side.

Mesquite

All smart devices get IP on vlan11. (trusted or management network) Why is ethernet 5 UNTAGGED FOR TWO different vlans. ILLEGAL !!! an access port or Hybrid port can only have one untagged vlan. THus I removed vlan12 as untagged on 5. You have a mismatch between vlans and pools, plus I added a vlan....

Mesquite

You didnt quite grasp the concept of drop all else............( all other rules save invalid traffic need only be accept ). You forgot to use drop all in forward chain??? Also you dont need to create firewall rules for reply traffic, it is already permitted. AKA open vpn user to LAN is good enough, ...

Mesquite

I thought the whole idea of routers and smart switches is that the router is only involved when access to the internet is required or cross vlan traffic ( firewall rules ). Any traffic on the same vlan behind the switch doesn't go to the router, and stay within the wirespeed of the switch regardless...

Mesquite

Nice thanks for the tip as well!! Glad it worked out for you!!

Mesquite

Well if your not going to use the proper vlan filtering method for CRS3Xx switches, you will need to get help from someone that understands doing it whatever way you have decided to use.

Mesquite

First you have to do the work Use this as a basis for all your rules and get rid of any raw ones etc... Then add the additional rules you need for traffic to occur ( all the allow rules you need ) /ip firewall filter {Input Chain} (default rules to keep) add action=accept chain=input comment="d...

Mesquite

Suggest get rid of made up rules, raw or otherwise, stick to default rules. Add wireguard settings THEN flush the proton rule down the toilet you talk about instead use this: add chain=srcnat action=masquerade out-interface=wireguard Also ensure you add this mangle rule to help with any potential MT...

Mesquite

You have a CRS3, switch it should be setup the same as your router basically following https://forum.mikrotik.com/viewtopic.php?t=143620, for the router and similar on the switch, For the switch read this thread and take note of the ap/switch config AND THE CORRECTIONS. https://forum.mikrotik.com/vi...

Mesquite

Easy solution, buy any non-MT wifi router, they come with a built-in guest wifi.

Mesquite

Thanks for the real world example. That unit can also be mounted outside,drill hole through wall for cable, attach a lightning filter (outside - https://mikrotik.com/product/rbgesp ) or two ( and inside - https://ca.store.ui.com/ca/en/collections/unifi-accessory-tech-poe-and-power/products/ethernet-...

Mesquite

viewtopic.php?t=143620 ( for the 5009 )

viewtopic.php?t=204967 Look at this example of ap/switch and (router for that matter) AND THE CORRECTIONs,

ps.. mermaid looks nice, but not free.

Mesquite

With the proper mangling rules of course.................... what have you got so far!

Mesquite

Not required, the additional IP address on the offbridge port does not require dhcp-server/dhcp-server network, but thats your call if you want to avoid putting in an IP via iPV4 settings.

Mesquite

pcunite what software did you use to generate diagrams??

Mesquite

Good day Sir,
In plain english, do you mean you have two WANs conducing load balancing and now you at trying to figure out how to add LAN based servers in the mix............
viewtopic.php?t=204746

Mesquite

OP has mangled decent default settings into a mess.

Mesquite

?????? He has provided updated scripts throughout. ????
best documented work I have seen in some time even indicated if changes were made.
The pics are also germane and excellent.

Exactly what part dont you understand??

Mesquite

Like any server, if its not en encrypted type of connection, you are screwed LOL.
I would get users to wireguard in, then access NAS.

Mesquite

Draw a diagram and nothing is clear. Do you have three pppoe connections, and if so why are you using IP DHCP CLIENT? What type of WAN connections. Is each give you a private or public IP......... Is each from a different provider. Do you have any vpns coming into the router Do you have any servers ...

Mesquite

viewtopic.php?t=204967

See the script and see the comments for the ap/switch

Mesquite

The docs are improving, being kept more up to date, and with more detail but they are not a specific 'your' scenario solutions based.
There are many excellent videos out there ( Network Berg, Network Trip etc.. ), including MT videos, to help with more detail on some scenarios.

Mesquite

Not even going to try............ Its like, please tell me how to use my betamax player ;-P Without looking BRIDGE no vlans for everything guest WLAN port NOT on bridge assign WLAN port IP address directly. Article need not be any longer..... ;-P I recently attended the mkx school of brevity. :-)

Mesquite

ROUTER 1- MISSING ~~ You have five vlans - missing vlan99 pool - missing vlan99 dhcp server - missing vlan99 dhcp server-network - at least you do have the iP address LOL......... 2- INCORRECT Sloppy!!! add bridge=LAN_BRIDGE comment="HOME Access Port , access port" frame-types=\ admit-only...

Mesquite

AP SWITCH CHANGES 1- Should only have one vlan entry /interface vlan add comment="Management" network" interface=LAN_BRIDGE name=MGMT_VLAN vlan-id=99 2 - Should only have one entry. /interface list add name=MGMT_LIST 3 - REMOVED ETHER3 from bridge ports. As you defined it: set [ find ...

Mesquite

What happened to all the firewall rules and interface lists??

Mesquite

@hightechlab, no worries, the important is not to copy and rule stick it in and move on!!.

THe key is understanding that the handshake is TO the router. Such traffic is handled in the input chain.

Mesquite

Nice article, what caught my eye, was the comment ......why is MT using such old switch chips..... I read the MT product info and all it says --> the amazing Marvell 98DX226S switch-chip I go to the marvell website, and put in 98DX226S and I get NOTHING.......... I also notice that the AX3 router ha...

Mesquite

hahahah, you make me laugh, there should be a first post process period, ONE solution for all the littly bitty ideas you guys come up on so many posts, please do this, please do that, you should do this, you should do that....... There is a way. No one supported me. ;-P

Mesquite

1 Main issue - you didnt turn on VLAN filtering yet. /interface bridge add name=BR1 protocol-mode=none vlan-filtering= no 2. I gather all your bridge ports save ether8 are trunk ports going to smart devices and thus would make some minor modifications. /interface bridge port add bridge=BR1 interface...

Mesquite

Not sure what your saying. 1-The request was simple, you wanted to make use of check-gateway=ping. 2-To do that you need to create a manual route instead of dhcp client ( add default route=yes). 3-We did that, however your ISP does not work using ether5 as the interface, which does in some cases but...

Mesquite

I am still trying to add up the math...... ;-) quote: "DarkNate @jaclaz 1. Nobody is asking for a Juniper MX2020 from MikroTik. 2. MikroTik HARDWARE isn't the problem. In last 10 years of MikroTik, 1/10 are hardware issues. 3. MikroTik SOFTWARE is the problem. In last 10 years of MikroTik, 10/1...

Mesquite

It is not clear what you want, and unlike Erlinden I don't see any point on running around like a chicken with its head cut off. Please clearly state what requirement or requirements you are attempting to communicate. ( describe the traffic flow required in terms of users, use a diagram if necessary...

Mesquite

Buy a plane ticket!

Mesquite

Hi Goodbye, I would hope that MT is not making claims of 1gig at 200 meteres, in filtered or sterilized air '=) Even worse, results in a vacuum chamber!! If you look at their brochure for the wireless wire, it even shows the diagram of both antennas pointing at each other through windows. Certainly ...

Mesquite

To be honest, the geniuses are behind me, I am just channeling great advice I have gotten from others over the years. Glad its working well. You may want to play with PCC settings aka both addresses and ports as that combo is said to be the optimal for spreading connections among the WANs, but poten...

Mesquite

I would say the DNS approach, is favoured by my favourite gateau, rextended............. He swears by it. ( orange cat is a close second by the way ). Somewhat similar in concept to what you have offered, but since I dont understand it at all,,,,,,, just putting it out there. I don't even think you ...

Mesquite

I do upgrades to required version (I never let it stay at factory version), then reset to default configuration.
And then I begin config ...

Nice but not a wipe in my books, perhaps a gentle cleansing.

Mesquite

Okay no problem so using a manual route using gateway IP set to ether5 did not WORK. Thats okay! Next step is to do the following. Reading the IP DHCP client settings, STATUS TAB, get the current gateway IP. THen go to your manual route and remove ether5 and put in the current actual gateway IP and ...

Mesquite

Remember he has an upstream router with a dynamic public IP.
Hence he uses a dyndnsurl to reach the upstream router, which forward the incoming trafffic with destnation port to the lanip 192.168.100.100.
This is also the WANIP of the MT device.

Mesquite

Nope would need to update it to vers7,
Wireguard is well supported on MT, openvpn has never been completely supported.

Mesquite

+1 Concur with gotsprings. What could be easier then a wifi switch, on a diff spectrum from all the other 2.4 and 5ghz noise.

Mesquite

Hey MTNICK. (1) The hairpin nat rule is port/protocol agnostic. Not required. He has the correct rule. (2) The dstnat (port forwarding rules) can very much so have a different dst port, the one hitting the router, and a to-port the one hitting the server. Its called port translation. If your ISP blo...

Mesquite

Better off doing wireguard IMHO.

Mesquite

netinstall.

Mesquite

"Scissors"
Run With Naked!
"Fork"
Stabbed in Eye!
"First MT Post"
1000 cuts just add iodine!

Mesquite

Nm........... First take note in ip dhcp client STATUS tab of the wanip and gateway IP. Two Options if the Modem is doing all the work and you simply get client via ETHER5 then simply a. DO not use default route b. add an IP route manually, add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gat...

Mesquite

Sorry, but I am outta here, good luck with assistance. Reason - contradictory statements. Intro Post: The Core router CCR1009-8G-1S-1S+ (tile), has no NAT rules , no Mangle rules , simple static default route. There is a simple Firewall rule list (CCR): [/b] Latest Post: My CCR works as a primary Co...

Mesquite

Stated differently, what is it doing there............. Not needed ????

Mesquite

Perhaps what AI bots are outputting these days for answers??

Mesquite

You will have to wait for netgear,tplink, etc to start making prosumer 2.5 gig smart switches LOL.

Mesquite

1. Okay separate NTP server, not sure why you bother as the router already provides this, and thus all devices including the router are in the same sync. 2. The invalid rule ensure that any new traffic is caught and discarded before hitting any other rules. 3. Every time a connection is new, it is n...

Mesquite

Agreed, one should not be configuring from scratch on IOS app. Its mean really for tweaking a config or adding wg peer etc............
Not for complex changes to the config.

Mesquite

Interesting, so you dont use LTE settings on the chateau?? Just IP DHCP client?

Mesquite

All good, thanks for letting me know. Yup the rule is disabled, should have noticed. I am of the ilk of removing rules not used, so IF i see it, assume its working. Okay, So one last time by MYIP If it contains ONLY DOMAIN name a. external users like you on your cell phone Do NOT reach the servers! ...

Mesquite

If not using IPV6 you can disable it AND REMOVE all the firewall address lists and firewall rules associated.

Mesquite

Can you confirm the upstream router correctly port forwards traffic to port 8000 to 192.168.100.100 (jpeg)?? I think I see one problem, you didnt remove a rule, when it was replaced by three other rules. ( AS STATED CLEARLY in post #2 ) I am not sure it will change anything, but please see if extern...

Mesquite

Yes, but my understanding is that it may be used in the background for other things, but not clearly stated anywhere.

Mesquite

/ip firewall filter add action=accept chain=input comment="Allow Estab & Related & untracked" connection-state=established,related,untracked add action=drop chain=input comment="drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: a...

Mesquite

/routing table add fib name=to-dorm /routing table add fib name=to-LTE /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark \ dst-address-type=!local in-interface-list=LAN new-connection-mark=LTE2 \ passthrough=yes per-connection-classifier=src-address-and-port:3/0...

Mesquite

+1 johnson' Only change I would make is add the internal loopback, the router uses for various functionalities behind the scenes. add action=accept chain=input comment=defcon: accept to local loopback" dst-address=127.0.0.1 after the ICMP rule. (only very minor quibble would be to change wordin...

Mesquite

Is that what a resurrected cat looks like

Mesquite

add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.86.1 routing-table=2then3 ............ comment="ISP2-ST" add dst-address=0.0.0.0/0 gateway=192.168.85.1 routing-table=2then3 distance=3 comment="ISP3-ST" ( missing distance=2 but would work as the default is 1 lol ) Th...

Mesquite

Please print your latest config, so I can see where we are going wrong.

Mesquite

What? the new switch is $999 us.

Mesquite

After rereading, I understand. You use the use default route route (YES) offered in dhcp client but the settings do not provide check-gateway=ping. My recommendation is to uncheck the default route and add a manual one. add distance=1 check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP-gateway-IP r...

Mesquite

Interesting question.......... Maybe try out-interface-list=WAN? Although your should have covered it, if it was to every work.

Mesquite

Trust me, you have gotten this far faster than I................ and your attention to detail is very good!!

Mesquite

Well think about it, the reason to do this last change was to spread out the new connections 1 to one ISP, then to the next ISP then to the next ISP, vice the first two connections to wan1, the next two etc.............. Therefore logically one has to not move the 6/0 from whatever is the first rule...

Mesquite

The missing letter was simply a typo.... You moved the rules around perfectly, but the point was not to move the 6/0 etc numbering, which as the rest should be in order 6/0 through 6/5, they dont follow the rule they were with previously. Correct for the routing mark rules, they dont change. Correct...

Mesquite

Why did you remove the SPECIFIC Table routes?
The clue is if you kept them in the tables listing created, you should be using them!
Remember this is for server traffic so you should use them............

Mesquite

Okay I see one error in the last PCC mark connection...... add action=mark-connection chain=prerouting connection-mark=no-mark \ connection-state="" dst-address-type=!local in-interface-list=LAN \ new-connection-mark= 3then1 _conn passthrough=yes per-connection-classifier=\ src-address-and...

Mesquite

Wow, very impressive, you nailed it. I am going to start asking you todo all my configs!!. You kept the original recursive routes on the main table as required. you kept the tables and mangles and the specific table routes to ensure server traffic was not entangled with PCC traffic. you correctly se...

Mesquite

Very good question.
So external users can access the server no problem with they dyndns URL pointing the public IP of the upstream router,
but the internal servers are unsuccessful using the same?
However if they simply use 192.168.100.100:8000 they are successful?

Mesquite

OK, time to stop playing around.

Ur Killen me!!!
Where were you when I said MT should have an initial posting process LOL...........
Do'n't know whether to laugh or cry, but seeing you all flail around like chickens with your heads cutoff can be rather amusing.......

Mesquite

I would only invoke other rules like raw, if you get issues........... With drop all, you shouldnt need raw.
By the way, the router cannot really prevent flooding etc.......... that is the job of the upstream providers.......

Mesquite

Can you confirm more information.

Do you get an actual IP address as /32 (single IP)
OR
Do you get some other mask.................

AND
Do you ever get the gateway IP information.

Mesquite

Sorry I didnt see where you said it was up and running. Thus you do have an interface right.

Does it not show up on the interface tab ?
Does it show up anywhere for selection on any rules?? ie the name LTE1 ???

Mesquite

I would have to look at the config to assess but the only thing missing from the initial discussion is a forward chain rule allowing all vlans permisssion to reach the adguard Ip address ( destination address ). So that if sent there by other means, it will be allowed. I dont see the need to mangle??

Mesquite

Concur, the 310 is CRS3XX series and thus setting up vlans is like vlan bridge filtering in routers and works great.
If one asked their spouse to spend $$ on IT, none of us would be here!!

Mesquite

I will see what I can do.

Mesquite

The essentials remain the same, the problem seems to be how to setup LTE, forget about load balancing at the moment, on the chateau. Did you find the LTE interface tab I displayed? Did you try and select LTE APN and insert the information provided by the provider ( or perhaps the MODEM ) not sure th...

Mesquite

Relaxing watch: https://www.youtube.com/watch?v=BSJrplxIs6w
https://help.mikrotik.com/docs/display/ ... tupexample
...

lte.jpg

Mesquite

Okay so b. b for bogus, there is no special requirment for people to access the OTHER WAN. Since both will be available thru PCC we dont care about b. Since each will failover to the other we dont care about b. Now for the tough question. Can you forward any ports on the dorm server router to your r...

Mesquite

Please define NEXT GEN - using cute buzz words means nothing to me. If you looking for DPI and IDP subscription services, your barking up the wrong tree here. Again, being vague is not helpful. Stating "relatively cheap" is another bogus statement that has no real meaning. WHat is your bud...

Mesquite

Dont understand your network, provide a diagram
Cannot comment on the MT without seeing the config. Post the config ( minus router serial number, public WANIP information, keys )

Mesquite

Wireguard is far easier, if the config didnt work it was simply not setup properly.
However, it would seem you would prefer the IPSEC approach, nothing wrong with that, enjoy!!

Mesquite

What does this have to do with Mikrotik?

Mesquite

So you need to allow VLAN to VLAN traffic, but have a mandate to restrict by IP and port?
If so, what you are doing seems reasonable in terms of rules and efficiencies.

Mesquite

Any reason you decided not to try wireguard vpn between the routers?

Mesquite

What is the throughput of your ISP? The number of concurrent users, for anything other than checking email and browsing the net, and the "lite" router you have are not a good mix for performance.

Mesquite

What routers do you have, recommend Wireguard, much easier to accomplish same.

Mesquite

Something like that yes.......
Why would you think order of rules is not important?
Also the organization of chains together is for easy reading/understanding and supportive of troubleshooting.

Mesquite

Definitely a problem in your config........

Mesquite

From where? If you mean a computer on your LAN, and you want to use ip address then its 192.168.1.1 : winboxport# If rules dont work, then its likely due to your firewall rules. Suggest go back to defaults and focus on needed traffic vice blocking traffic. Something like this where all traffic not s...

Mesquite

post config (less router serial number, any public wanip info )

Mesquite

Maybe you spoke to soon, read above again LOL new info.

Mesquite

Sweet!! Looking good! Now for the icing on the cake!!! Have each WAN, when it fails, spread its traffic evenly to the two remaining ISPs vice just one. Step One: Increase the PCC mangles. The idea is is not to have 1/3 of the traffic go to each WAN, but 2/6 of the traffic go to each WAN and thus whe...

Mesquite

Thats because your rule is not correct. Lets work through the logic! a. the input chain rule for wireguard permits the handshake and makes the tunnel happen between the android phone and the MT. Once connected think of the phone basically parallel to the LAN............ b. to allow the phone to subn...

Mesquite

Accept winbox from the LAN only and if you know which IPs, use a source address list to narrow it down.
The LAN users still need access for DNS services by the way.
Also if you need remote access add the wireguard address to the allowed source address list noted above.

Mesquite

Lets look at the facts. 1. Defining wg interface - great! add comment="My wireguard Server on RB4011" listen-port=15445 mtu=1420 name=\ wireguardRB 2. Defining peer client device - great! ( currently only one, could be phone, could be laptop, phone is easier to check with cellular connecti...

Mesquite

Awesome, I need we could get there, the journey is the fun part!

Mesquite

If you have multiple WANS, it is likely the haplite is not the best option, doable of course.
How many WANS and throughput of each??
Amount of traffic anticipated??

Mesquite

Good day atais. After some sobering thought and discussion with someone who knows better........ There are TWO methods that users should use to reach the server. A. Directly is the most foolproof for internal users 192.168.88.253:8000 B. Through the DYNDNS URL you are using, be it from a free or pai...

Mesquite

Dont know your current setup but this is the basic default rule setup with the switch done. Block all, use accept rules to add traffic to be allowed ( just before the drop all rule ). Stops vlan to vlan traffic cold. /ip firewall filter {Input Chain} ( default rules to keep ) add action=accept chain...

Mesquite

You are LOL. Oh holy crap! I went back and read and wow. I've got no excuse other than I'm an idiot. Clearly my guidance would have been different, and in line with yours, had I had the literacy of a 2 yr old. I'll administer a self beating that would make a Canadian like you proud Mesquite. My uno...

Mesquite

Don't use hide sensitive. Default ROS7 is to hide most (not all) sensitive info. Just use /export file=anynameyouwish Edit that file. There shouldn't be too much sensitive info in there. Concur, remove router seriaal number, any keys public private etc, any public WANIP info or WAN gateway IP info,...

Mesquite

I still have no idea what you were trying to do LOL. but if its working great!

Mesquite

Modifying MTU on mikrotik devices, when the mikrotik is CLIENT, is often done connecting to third party servers. Not the reverse.

You could try setting the MTU the same on android and Mikrotik to 1500 or other higher and lower variants than the default, and see if one work for all.

Mesquite

Conceptually speaking,,,,,,, LTE is roughly double that of dorm wrt throughput. Thus would PCC 3 connections to provide a 2:1 type ration.. session X goes to LTE session X +1 goes to dorn session X+2 goes to LTE rinse and repeat. ++++++++++++++++++++++++++++++++++++ If you want partition some traffi...

Mesquite

Okay so this a Chateau unit with an LTE module/capability. 1. Got it you get LTE of unknown type and thus dont know if the ISP provides a fixed IP, or a dynamic IP that changes? 2. Dont know if the LTE IP is actually public, or cgnat type, either ?? Can you call them and ask?? 3. Can you confirm tha...

Mesquite

Post the complete config ( less public WANIP info, router serial number, any KEYS ) to see what is going on.

Mesquite

Because your Port Forwarding rule is incorrect. You still have the in-interface part in there, should be removed. From: add action=dst-nat chain=dstnat comment=http dst-address=192.168.100.100 \ dst-port=8000 in-interface-list=all protocol=tcp to-addresses=\ 192.168.88.253 What do you mean by specif...

Mesquite

Negative if all three ISPs, when rebooted, provide the proper gateway IP in IP routes we are good to go.

Mesquite

Try this iteration......... for the three scripts.......... should work. :if ($bound=1) do={ :local gw $"gateway-address" /ip route set [ find comment="ISP1-MainTable" gateway!=$gw ] gateway=$gw /ip route set [ find comment="ISP1-SpecificTable" gateway!=$gw ] gateway=$g...

Mesquite

standard export is fine.........i use notepad++

Mesquite

Remove /24 from what you still havent stated that ALso why are you removing dns-server entry??? My bad on dst port rule please adjust too ( I didnt hoist in that your wanip is fixed static ) /ip firewall nat add action=dst-nat chain=dstnat dst-port=3000 protocol=tcp dst-address=staticWAN-ip \ log=ye...

Mesquite

Post your complete config please, it should work well?

Mesquite

Its probably your chateau configuration.

Mesquite

Okay will have to sort out proper syntax............ its like working through mud!!
I am assuming that you are using the letters instead of the actual number showing correct to keep wan information private???
gateway=ISP3-GW-IP

Mesquite

Can you poste your IP ROUTES protecting the actual WANIPs of course.
Im looking for the line with distance of 255 especially, should be three of them in blue ( possibly withe Dd as the first entry column)

Mesquite

Sorry you are not making any sense.
Where above was there advice to remove a /24 and put in a /32 ???

Your input about DHCP and DNS, seems out of the blue as well........... what is the issue here?

Mesquite

It does not work because 192.168.88.1 is nonsensical. Nobody uses the interface address of the subnet to reach a server...... Either you are connect to the ROUTER WANIP, like you were coming in externally and get port forwarded to the router. dst-address=actual WANIP for static, in-interface=WAN for...

Mesquite

Thats weird, okay I must have overlooked something.............. Post the complete config for me to review.................. NM, found the issue............... Okay, so the public IP is that of the upstream router and not your own WANIP 192.168.100.100. That makes a huge difference my apologies, for...

Mesquite

Yup, when there is a need. I currently only have a cap and an ax3 both as wifi devics with a CCR1-1009 router and a mixed bag of other vendor consumer APs..........So no need for roaming as I dont have two of the same anything.

Mesquite

Any reason you have to stick to RoS 6. Can be done in both vers6 and vers7

Mesquite

Recursive works fine,...........just dont select default route on the pppoe client settings as were are doing its routes manually!! One WAN, two different DNS addresses to ensure the ppoe wan is reaching the internet. /ip route add distance=1 check-gateway=ping dst-address=0.0.0.0/0 gateway=1.1.1.1 ...

Mesquite

I agree with you. My point is that drawing lines is highly subjective.

Concur, personally, I have steered clear of capsman and still have all my hair!!

Mesquite

GO to my IP tab upper left on winbox, select IP and near the top select CLOUD. Enable DDNS, hit apply. Soon a DNS name should show up near the bottom. This is the tried and true method of setting this up. I cannot recommend in-interface-list=ALL as a solution, mainly because I dont know if there are...

Mesquite

You are braver than I. I actually looked at your config and I am surprized anything is working........ First of, if you are going to use vlans across more than one port as well as other subnets, its best too create vlans for each subnet. Then we are dealing with apples and apples and everything is c...

Mesquite

Did you raise any supouts for bugs detected ??

Mesquite

This is a known issue happening to many many people. Its seemingly random and happens on all my devices from time to time, no rhyme or reason but started for me at some iteration of version 7............. probably also after the last major winbox update as well. Try logging in and out of winbox, unp...

Mesquite

Also if not using IPV6, disable it and remove all the firewall address lists and firewall rules......
https://www.youtube.com/watch?v=4Z32oOPqCqc&t=787s

Mesquite

So, well, that was my usual way of testing that it works... And later I'd test it works outside of my network. Quite correct, most have that built-in, whereas the MT RoS is very configurable if one knows networking, even when I used consumerPRO zyxel models, they had a simple checkbox for this, thi...

Mesquite

Check for any traffic on the wg interface using Winbox Tools -> Packet Sniffer. If not, there might be a mismatch in the wg peer configuration, either with the keys or the allowed addresses. ........how could that be?? Oh right, you have introduced another private-pair key coupling into the mix.......

Mesquite

1. A clue as to improper config.............. symbols and number in your rules where not applicable!!! From: /interface list member add list=LAN { empty entry you need to get rid of } add interface= *F list=WAN add interface=bridge1 list=LAN add interface=ether1 list=WAN add interface= *10 list=WAN ...

Mesquite

hahaha, obviously we need to have few beers together to discuss!!!
I promise to have an open mind and be patient as it may take awhile for you to see the better way........

Mesquite

So you are attempting to get fancy by reachin an internal server by using the public IP address as if you were coming in from externally. Boggles my mind, why not just use the LANIP address LOL. In any case you are running into hairpin NAT. 1. Solved partially by adding this sourcenat rule put at th...

Mesquite

LARSA, you complicate life LOL. You doth go too far....... Simply solved by adding the appropriate firewall rules............. No need to create ANOTHER INTERFACE However, I can play your silly game and UPSELL you on a better approach Simply create another IP Address associated to the interface. Ens...

Mesquite

The good news is that a. you have a working device in place, b. the old one netinstalled and reconfigged, can be in a box ready to plug in and take over next time there is an issue.

Mesquite

We will receive many examples but what you said highlights the need for a. to understand each variation of wifi first (before using another layer of complexity - capsman) b. in this case both devices are not the same vintage.... @op, I gave you both the generic setup of the cap you have and the swit...

Mesquite

Firewall forward chain of the receiving router is a good spot to put such rules. Assuming your rules look like this.... add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related hw-offload=yes add action=accept chain=forward comment=&...

Mesquite

No it makes little difference, perhaps more items for the CPU to keep track of. I personally like the differentiation as its really different traffic we are marking, the similarity is we push that traffic to the same routes, via using the same table. So the PCC is working, great news!! As for mangle...

Mesquite

@Quantam Alfa, its time you did some work here ....... I provided very clear instructions on what needed to be setup on both routers. I also provided links to good videos. Take the configs you have now, pulled from both routers, and work on them in notepadd++ and then present here for review. I unde...

Mesquite

I feel like I'm taking crazy pills. You are LOL. The OP stated early on........ Quote:" I want to take advantage of wireguard VPN. . " unquote. Then cat interjected incorrectly stating the OP had to use BTH and nevermind normal wireguard VPN, further the hex cannot do BTH not being arm/ar...

Mesquite

its been awhile since ive looked at your config.
Post the complete config again and state clearly what you are attempting to do.

Mesquite

Okay upon review, I erred in the first half of second set of mangle rules...................... The initial PCC rules..... FROM: add action=mark-connection chain= forward comment=\ "divide traffic into three groups" connection-mark=no-mark \ connection-state="" disabled=yes dst-a...

Mesquite

Okay, the IP Routes Table is exactly correct. If one was to follow the main table, traffic would get routed out WAN1 as its primary (and working hence black). The two farther distance routes wan2 and wan3 are blue because they are not being used in the main table at the moment ( on-standby) The spec...

Mesquite

All very doable, the hex connects to the RB4011 as a wireguard client and that tunnel then allows local users at the RB to reach the HEX as well as any users reaching the RB via wireguard.

Mesquite

Hopefully the OP will respond soonest so the additional support can be provided. If I ever see a thread where BTH is the answer I know who to call, I am brain dead on that functionality. What I find awkward is someone having to deal with weird BTH menus when trying to setup basic (normal) wireguard,...

Mesquite

Easiest (and only) solution would be to buy another router which supports BTH VPN
Complete Baloney Sandwich

Own it and move on, weaseling like a politician is unbecoming.

Mesquite

The hex doesnt have BTH nor needs BTH, it can connect to the RB just fine using standard wireguard setup. Concur, great new functionalities have been added by MT to allow this punching through non-public IP addresses, when necessary. Telling the OP they should spend money when there is a perfectly g...

Mesquite

https://help.mikrotik.com/docs/display/ROS/WireGuard This covers the road warriors ( aka single devices well, windows, ubuntu.) https://www.youtube.com/watch?v=CH10spRyGpU&t=80s Road warrior google play store: https://www.youtube.com/watch?v=jcNkytR_G4g&pp=ygUZd2lyZWd1YXJkIG1pa3JvdGlrIGlwaG9...

Mesquite

Great then wireguard it is.......
https://help.mikrotik.com/docs/display/ROS/WireGuard

https://www.youtube.com/watch?v=CH10spRyGpU&t=80s

Mesquite

The RB has a public IP , there is no need for BTH. Or another router! Am I missing something the OP said?? Quote:" Home A : Router : RB4011iGS+ firmware : v6.49.10 Internet : Dynamic public IP - but stays same for months unless I turn off modem for 3 - 4 days. "unquote" Setup the RB a...

Mesquite

I would actually use one bridge and two vlans and then queue the single vlan. as for the ruleset would do this... accept the vlan traffic prior to fastrack rule...... Thus the fastrack rule will not be reached or seen and thus NOT executed for queued traffic but will work fine for the other vlan tra...

Mesquite

For the switch ....... /interface bridge add name=bridgeSW vlan-filtering=yes /interface ethernet set [ find default-name=ether2 ] name=offbridge-2 /interface vlan add interface=bridgeSW name=mgmtVLAN vlan-id=99 /interface list add name=management /interface bridge port add bridge=bridgeSW ingress-f...

Mesquite

For the cap ( wifi is representative of wifi5, so not to be used verbatim). ..... /interface bridge add ingress-filtering=no name=bridgecap vlan-filtering=yes /interface ethernet set [ find default-name=ether2 ] name=offbridge-access /interface vlan add interface=bridgecap name=mgmt-VLAN vlan-id=99 ...

Mesquite

I am of the ilk that first you get a solid config with the network up and running and then you tweak. In the long run, I would tend to agree if both wifi setups are of the same vintage and it will benefit roaming, capsman may be a logical goal to reach for. Its all going to work just fine without it...

Mesquite

Please confirm if the internet traffic coming into the switch is not already on a vlan ( what type of connection is it?) Please confirm the router provides vlan DHCP for all vlans Please confirm this is the only wan connection coming into the switch ( not multiple wans ) What subnet or vlan are the ...

Mesquite

Android devices support wireguard, which is recommended
As per the next post.... Confirm what type of Public IP you get from your provider.

Mesquite

Post a config of a NON-working mt router and will sort it out.........

Mesquite

Will depend, its either a trunk port to the UNIFI carrying all vlans and the management vlan ( the one that the UNIFI should get its IP address from ) could be one of the existing vlans if its considered TRUSTED, or, it would need to be a hybrid port.

Mesquite

Its up to you to figure out how the UNIFI can work or the managed switch you have. All I know is that, at least for the MIkrotik device. /interface bridge port An access port or hybrid port require the PVID of the single subnet(vlan) traversing the port and leaving the port untagged, and return traf...

Mesquite

A couple of things to think about once we get the rudimentary setup working properly. Did you want recursive routing, meaning check the connectivity not from router to ISP but from router do public DNS on the web. Rare to happen but its possible the router and the ISP talk but the ISP to the interne...

Mesquite

Can you confirm your unifi AP wants by default to accept the mangement vlan untagged into the router and all the data vlans as tagged (over the port leading from MT)??

Mesquite

Okay, well since you have servers in the mix External traffic to LAN, then we have to account for that traffic to ensure its goes back out the same WAN it came in. Since you have no external traffic to the router itself,VPN etc, there is no need to mangle that traffic. 1. The other thing I noted is ...

Mesquite

We should have TLS1.3 as an option to select when............... YESTERDAY.
I believe that protocol makes perfect forward secrecy mandatory when selected so that will create additional firmware work to implement.
It would be nice if MT actually stated approx when its expected to hit the road map.

Mesquite

Can you confirm that ISP1,2,3 are providing static fixed WANIPs, or dynamic WANIps
Are they all from the same provider?
Do you have any external traffic going to the router itself (aka wireguard handshake for example)
Do you have any LAN servers that external traffic expects to hit...........

Search found 423 matches