MikroTik

Sob

I'd say don't fight it, IPv6 is the future. But it's also true that you'll be able to survive without it for quite some time. Also it's not clear what kind of security you're after. That DNS server seems to be outgoing address of whatever resolver you use. If it's run by someone else, you can't infl...

Sob

... if you take a firewall policy then all defined settings in it are parts of this same rule and you have to be able to see it all because all these parts do matter in similar way. That's why tabs do not work inside the single object. I wouldn't go as far as saying that they don't work. But I have...

Sob

@normis: About making everyone happy, have you thought about support for customization? It's just a rough idea, but I read a bit about Qt and it seems to be heavily customizable (sizes, colors, fonts, ...). It even supports styles using CSS. I'm not sure if WinBox uses exactly that, but some CSS can...

Sob

Since I don't see what exactly you have there, I'd suggest a quick and simple test, if it makes any difference:

/ip firewall filter
add chain=forward src-address=10.100.102.0/24 dst-address=10.100.103.0/24 action=accept place-before=0

Sob

Looks like asymmetric routing. Assuming that you have some "normal" config, client that doesn't know about the other subnet sends packet to main router, from there it goes to tailscale router, and to destination. Response goes to tailscale router, and from there directly to client, because...

Sob

I still don't get it. It's probably true that some people bought MikroTik router by mistake, and it made them unhappy, because they don't know what to do with it. But it wasn't caused by seeing too many weird acronyms in menu, it was because they know nothing about networks. They would have the same...

Sob

Well, it would be more user friendly if it offered existing lists (same as when you add address to address list manually). But I don't remember if it was ever there. I guess not, the whole option is relatively new, they probably just made first version that does something and that's it.

Sob

A light touch on a scroll wheel is almost always faster/easier/better than repositioning you mouse on top of the dialog where the tabs are, potentially scrolling through the tabs, and finally clicking on one of them. It depends. Things being static (always in same place) has advantages too, I alway...

Sob

It probably sends answer to client first, and client is "too quick" to use it, even before router manages to add it to list. It would be simple way how to implement it, deal with DNS request and response as usual, don't do anything special, just add request for address list to some queue, ...

Sob

When there's reboot, does router see ethernet link going down and up again? Or is there anything in log at all?

Sob

Is there a switch in between or something? I'd expect that reboot of gateway would cause link down and up, and dhcp client should notice that and ask again. Also, what exactly happens? Is there old prefix hanging and you get different one when you disable and enable dhcp client?

Sob

There are different things. Crippling "home" devices as horribly as you suggested, that would be really bad. And for what? This is where MikroTik stands out. I can have load of cheap and limited routers, or I can play with something like OpenWRT, or I can get device with RouterOS and have ...

Sob

I for one like MikroTik exactly because they don't do things like this. All users get everything and they're limited only by power of hardware, and it's good.

Sob

If you use WinBox, then DNS resolution happens on client (PC where it runs). It's not clear what it uses as DNS server. But in case the problem really is caused by routing marks, you can always exclude router by adding dst-address=!192.168.90.1 to mangle rule (or dst-address-type=!local to cover all...

Sob

It seems that you're testing this from LAN and that can't work, because all your dstnat rules are limited to WAN (in-interface-list=WAN, in-interface=ether1). You need to replace these conditions with either "dst-address=[PUBLIC IP]" (if it's static) or "dst-address-type=local dst-add...

Sob

It's not possible, connections work only with numeric addresses, they don't see hostnames. Hostname may come later in some protocols, but for NAT it would be too late anyway, even if router understood it.

Sob

Do you have any other config beyond these two rules? If you do, then it's probably something in there. If you don't, it's not possible, or you're expecting something else than I think. What these two rules do is that first one allows any packet from given MAC address. And second blocks everything el...

Sob

If you create only these two rules: /ip firewall filter add chain=forward src-mac-address=xx:xx:xx:xx:xx:xx action=accept add chain=forward action=drop then it won't do what you want (also in ROS6). You need third rule before those two: /ip firewall filter add chain=forward connection-state=establis...

Sob

I would add to my previous suggestion to let the user choose the colors, so it could adapt to our work environment : ) Something like: "custom theme" or "custom color palette" in addition to light and dark mode :) Yes, please. It could certainly help with making everyone happy. ...

Sob

Yes, it just affects what address is used (src-nat = yours, masquerade = router's choice).

Sob

Use action=src-nat to-address=<address> instead of action=masquerade.

Sob

Winbox3 didn't use any kind of font smoothing and ignored operating system settings.

Not exactly true. WinBox 3 uses ClearType, if enabled in system. And doesn't use it when not enabled. WinBox 4 has forced ClearType, regardless of system settings.

Sob

Could be that MT devs started rectifying this by communicating UTF-8 from WB4 towards ROS but handling is not complete? Yes, WinBox 4 seems to save strings in UTF-8 encoding, so that would be the right way forward. Only trouble is that old one didn't handle it at all and just saved "some bytes...

Sob

One bug (or missing feature) that I didn't see mentioned before: old WinBox allowed to redirect storage elsewhere by writing paths in %APPDATA%\MikroTik\WinBox\path and %APPDATA%\MikroTik\WinBox\sessionpath. New one doesn't respect it. Many people already mentioned that lack of tabs is bad, but it s...

Sob

And since "action=dst-nat to-addresses=<router's address>" is equal to "action=redirect" (*), now you understand the whole thing, right?

(*) Not completely true. You get bonus point if you find why.

Sob

On another look, it's also your hairpin rule, to-ports is wrong, it should be dst-port. Or it can be simplified as:

/ip firewall nat
add chain=srcnat src-address=10.1.1.0/24 dst-address=10.1.1.0/24 action=masquerade

And it will cover all other ports you might want to access in future.

Sob

@anav: Would this be better for you (x.x.x.x = any of router's own addresses)? /ip firewall nat add chain=dstnat dst-address-type=local protocol=tcp dst-port=2022 action=dst-nat to-addresses=x.x.x.x to-ports=22 It's the same thing, both action=dst-nat and action=redirect are form of dstnat, differen...

Sob

Are you sure that you don't want src-address=192.168.0.0/24? And also that protocol=icmp is intentional?

Sob

@anav: Try "complete" example: /ip firewall nat add chain=dstnat dst-address-type=local protocol=tcp dst-port=2022 action=redirect to-ports=22 /ip firewall filter add chain=input protocol=tcp dst-port=22 connection-nat-state=dstnat action=accept add chain=input protocol=tcp dst-port=22 act...

Sob

I meant to replace the in-interface option. You most likely don't need it at all, no in-interface means that it works from all. Dst-address should work. Well, at least from LAN. From WAN it wouldn't if MY_EXTERNAL_IP is not directly on this router (NAT 1:1 or something from another router). In WinBo...

Sob

Simpler solution:

/ip firewall filter
add chain=input protocol=tcp dst-port=22 connection-nat-state=dstnat action=accept

Sob

It's because of in-interface=pppoe-out1-fiber-internet in dstnat rule, such rule works only from outside. Replace it with either dst-address=<your public static address> (if you have one) or dst-address-type=local.

Sob

Anyone knows how many other vendors don't support VTI? Because if not too many, that alone is good enough reason to add it. Just one example, last time I set up tunnel with another party (where they were the boss), it took several emails before I was able to explain that I need policy-based IPSec. T...

Sob

Order of rules matters, just put logging after blocking ones.

Sob

Or just route the ones you like to:

/ip arp
add address=x.x.x.43 interface=WAN@MT published=yes
...
add address=x.x.x.46 interface=WAN@MT published=yes
/ip route
add dst-address=x.x.x.43 gateway=y.y.y.y
...
add dst-address=x.x.x.46 gateway=y.y.y.y

(y.y.y.y = MT1)

Sob

If nothing else, you're missing default route (192.168.1.1 is a guess based on configured IP address):

/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1

Sob

So you have working dstnat rules and problem is that this traefik can't reach something. What, where, how? Is it some internal domain name? What DNS servers does it use? Etc..

Sob

Or you can drop it right away: /ip firewall raw add action=drop chain=prerouting dst-address-list=!HomeAssistant src-mac-address=00:00:00:00:00:00 But this only affects routing, so it won't be able to reach internet or other vlans, but will be able to communicate with devices in same network segment...

Sob

It depends. There are different ways, but if all you want is simple protection against stupid bots that blindly scan anything, port knocking is really simple and good enough. Especially if you're used to it from the past when we didn't have WG (which for this purpose is much more pleasant to work wi...

Sob

If you're interested in changing DNS responses, you can already do that: /ip dns static add name=example.com address=127.0.0.1 match-subdomain=yes Regexp works too: /ip dns static add regexp="^(.*\\.)\?example\\.com\$" address=127.0.0.1 Edit: Or if you mean the new adlist, I didn't play wi...

Sob

The point is to inconvenience attacker, not legitimate user. Otherwise it may lead to user choosing something weaker (e.g. shorter sequence) that's not as much annoying. In fact, it seems to me that client side is not really a big problem. I'm sure there are some existing port-knocking tools and eve...

Sob

Think about your rules. For example, packet from 192.168.1.12 to 1.2.3.4 will be ignored by first rule, because the src-address=!192.168.1.12 condition is false. Which means that processing will continue with second rule and connection will get fasttracked, because if destination is 1.2.3.4, then ds...

Sob

My trust in WinBox protocol significantly decreased since that funny incident when router happily provided list of usernames and their plaintext passwords to anyone who asked (meaning unauthorized users). And while I (want to) believe that nothing similar will happen again, I still feel better if Wi...

Sob

Nobody said anything about forward chain, and if the traffic reached *any* srcnat rule, it obviously wasn't stopped in forward, so there shouldn't be any problem there.

Sob

Second rule is same as first rule, with one extra condition => there's no reason why it should catch more traffic than first one. It's the opposite.

@llamajaja: You can have WG clients connecting to router as WG server and then use it to access internet, then their traffic will go out to WAN.

Sob

Well, VPN may be inconvenient if you use random computers, but it's possible to argue that maybe it's not best idea to access anything sensitive (such as router administration) from there. It's also true that ROSv6 doesn't have Wireguard, but perhaps that could be the reason to upgrade? The rest sou...

Sob

If you have IPv6 connectivity and you're not doing anything weird, access to webserver is only accept rule(s) in forward chain, e.g.: /ipv6 firewall filter add chain=forward dst-address=<server's address> protocol=tcp dst-port=80,443 action=accept It may be a bit more complicated if you have dynamic...

Sob

The next hop gateway is indeed a link local address. It was always a link local address previously, but it was being issued as part of the DHCP response. Nope. It may sound weird, but DHCPv6 does not have ability to add default route. The option in RouterOS to do so is MikroTik's non-standard hack,...

Sob

It's just that I don't see any advantage of this 3x1 "multi-WAN simulator" over 1x3 single WAN. And in fact, I don't even see how this fixes the problem. Either there's local-address=1.1.1.x for peer and then only this address should be used as source, or the router still might decide to u...

Sob

By VPN you mean L2TP or PPTP on router? If so, did you have you firewall rules in same order as now when testing? Because that wouldn't work. Rules are checked from top to bottom, so any connection from WAN is blocked by fifth rule and further ones that allow it don't matter. As for different SSTP p...

Sob

Why three WAN interfaces? Why not just one with three addresses? And then for IPSec set local-address=1.1.1.x (which you can do also with your current config).

Sob

If you're installing it, then it looks like x86 version, which is meant for physical hardware. I'd expect it to work anyway, at least previous versions did. But you probably want CHR.

Sob

Truth is, if it's endless, we're not looking forward to it. I might get lost, @anav will probably provide friendly suggestion in his own charming way, to ditch everything and start from scratch. But if you can't find the problem yourself, there's at least a chance that someone else might.

Sob

What's the point of static route on NAS? It's not breaking anything, but if it has default gateway, that 192.168.2.0/29 is already covered.

Sob

That's not exactly what I meant. This is the same small part of config that you already posted, only in different form. But this small part is fine, the problem must be somewhere else. But it's difficult to find where exactly without seeing the rest of config.

Sob

What exactly doesn't work as you want? None of your forwarded ports is configured to work exactly same from both WANs. Ports 80 and 8181 are limited to WAN1 (in-interface=WAN1). And 443 is forwarded to different internal address, depending on used WAN. Btw, SSTP can use any port, it doesn't require ...

Sob

Just add any number of rules according to your needs, for example: /ip firewall nat add chain=srcnat src-address=10.20.30.40 action=src-nat to-addresses=p.p.p.1 add chain=srcnat src-address=10.20.30.0/24 action=src-nat to-addresses=p.p.p.2 add chain=srcnat src-address=192.168.1.0/24 action=src-nat t...

Sob

No problem there. I'll tell you a secret, if instead of screenshots you do export: /export hide-sensitive file=myconfig and then you paste content of resulting myconfig.rsc here in code tags (feel free to censor things like public IP address if you want, but don't overdo it), it's less work and give...

Sob

More detailed explanation of what "nat Vlan 20 behind Vlan 10" means might help.

Sob

In fact, *nothing* in RouterOS really supports anything beyond 7-bit ascii. Sometimes it "accidentally" works, but that's all. RouterOS doesn't understand any encoding, it just sees some bytes and how they display as characters is not consistent. E.g. if I put "ěščřžýáíé" in some...

Sob

Some mistake in your config, perhaps? Showing it to someone might help.

Sob

You should probably write a bit more about what you want to achieve.

Sob

Since there's nothing obviously wrong, just check what exactly happens, if counters increment, if you see packets (using e.g. Tools->Torch), or add some logging like: /ip firewall mangle add chain=prerouting in-interface-list=WAN protocol=tcp dst-port=443 connection-state=new action=mark-connection ...

Sob

If the new srcnat rule helped, then either NAS has invalid or missing gateway (it should be this router's 192.168.100.2), or it doesn't accept connections from non-local addresses (other that 192.168.100.x).

Sob

Try a little packet watching: /ip firewall mangle add chain=prerouting dst-address=192.168.2.2 protocol=tcp dst-port=80 connection-state=new action=mark-connection new-connection-mark=natdebug log=yes log-prefix=newconn passthrough=yes add chain=prerouting connection-mark=natdebug action=log add cha...

Sob

This creates asymmetric routing, which may possily cause some trouble. Try if one of these helps, either exclude this traffic from connection tracking: /ip firewall raw add src-address=192.168.0.0/24 dst-address=10.2.0.0/16 action=notrack and make sure that your firewall filter allows all packets wi...

Sob

I don't think you can. You could limit access to server, but that would affect all users. Problem is, when new connection comes, you don't yet know what user it is. You know it only after authentication and then it's too late, because user is already connected. Checking the source address would have...

Sob

Keep it simple:

/ip firewall nat
add chain=srcnat src-address=10.12.20.0/24 dst-address=10.12.20.0/24 action=masquerade

Sob

In this case, you don't need the firewall rule. If you check default rules, you'll see that forward chain has two rules that could possibly block something. One drops packets with invalid state, that's not it. The other drops new connections from WAN, that could be it, but only when they are not dst...

Sob

Actually, if the new masquerade rule helped, you should check PC2's firewall again and make sure that it allows icmp from anywhere and not just from local subnet. Then this masquerade rule wouldn't be needed. But you would need it for PLC if that really doesn't have any gateway.

Sob

In random order: For solving the mystery, check (on PC2) "ipconfig /all" and "route print". Even if you remove default gateway, it should be there ... somehow. Sorry about the srcnat rule I posted, it's incomplete, it should have action=masquerade. No, address on router doesn't p...

Sob

The problem with missing gateway is that it really can't work without it. If PLC/PC2 has only 192.168.1.0/24 and no gateway, it means that it knows how to reach any 192.168.1.x, but has no idea where packets to any other address should go. If you try to ping PC1's 10.101.54.22, you should get an err...

Sob

My guess would be firewall on PC2 blocking incoming ping requests. Other than that, I probably misunderstood "No Gateway" for PC2, it must have gateway 192.168.1.1, otherwise it wouldn't work at all. Counters not incrementing for PC2->PC1 ping is probably oversight, because it happens only...

Sob

You have dstnat rules with in-interface-list=WAN, they can't work for requests that are not from interfaces in WAN list. I didn't study everything in detail, but you probably need something like: /ip firewall address-list add list=dstnat-addresses address=192.168.1.150 add list=dstnat-addresses addr...

Sob

Placing an action=log rule with the server list after all the accept rules would log even the allowed connections, which isn't helpful.

No, it wouldn't. Once the packet is accepted by a rule, processing stops there, following rules are not checked.

Sob

*) 6to4 - make "remote-address" parameter mandatory; In other words, you're dropping support for RFC 3056. Because that needs unspecified remote address. Is it intentional? I know that the whole thing is not very popular. Accompanied RFC 3068 is even deprecated. I'm probably one of the fe...

Sob

It's not blocked by your firewall, since you don't have any. Srcnat on WAN doesn't have any conditions, so that's not breaking it. Mangle rules won't touch it, so no problem there either. It seems to me that if VPN client 192.168.89.x tries to route internet traffic via this router, it should work. ...

Sob

Good news! If you have server in LAN1 (one subnet) and clients in LAN2 (another subnet), then the problem that's solved by hairpin NAT doesn't occur. So you don't need hairpin NAT. Your problem (aside from non-existent firewall filter section, but that's another story) is the mangle rule that marks ...

Sob

I'd use what I wrote before: /ip firewall nat add action=srcnat chain=srcnat out-interface=ether4-sat to-addresses=192.168.1.20 add action=srcnat chain=srcnat out-interface=ether5-fwa to-addresses=192.168.55.20 But the main point was that if you thought it was working, it couldn't. And it's not just...

Sob

Well, NAT does work (= is able to change source of tunnel's packets), but not exactly as expected. I can force tunnel to use link-local address as source, if I keep default route (with link-local gateway) and disable all global addresses. I assume something like that might be happening on your route...

Sob

Sorry to ruin it for you, but no.

If nothing else, now you have two unconditional srcnat rules. So the first one will be used for anything passing through router and nothing will ever get to second one.

Sob

I think I see it, the two PCC rules need to have passthrough=yes.

Sob

Unfortunately, I don't see anything obviously wrong that could cause what you were describing. And that description, that's really weird behaviour.

All VRRP masters are on same router, right?

Sob

Addresses on VRRP interfaces should have /32 masks: /ip address add address=192.168.10.20/32 interface=vrrp1-LAN add address=192.168.1.20/32 interface=vrrp2-SAT add address=192.168.55.20/32 interface=vrrp3-FWA Then outgoing interfaces will be parent ones, and even though masquerade should have the s...

Sob

tcptraceroute = not the same thing as traceroute

And allowing any port won't help, because they are all allowed already. Look at forward, not input, there's no drop in forward.

Sob

PCC with VRRP, I don't see why not. But it's probably good idea to share more info about what exactly you have (at least definition of interfaces and IP addresses; or just post whole config). You seem to have VRRPs on LAN and both WANs. But one weird thing I see, if srcnat is intended to be there an...

Sob

What about other config? Is there perhaps fasttrack in /ip firewall filter?

Sob

It's perfectly reasonable. When you have this "remote public address" that you use to forward ports from there to devices in your LAN, then the router possibly being one of those devices is not any far fetched idea. I can't come with with any good analogy right now, but trust me, it makes ...

Sob

If it's ROSv7, you can also try NAT.

Sob

@anav: You missed the "afcourse via accelerators like IDM", i.e. instead of downloading one file using one connection from beginning to end, there are multiple connections, each downloading different part of that file. It may not work with everything, but when it does, you can get maximum ...

Sob

Yes, original post was about forwading ports to another device behind router, and you don't need the output rule for that. But it's related, so why not cover even possible future needs right away? Worst case, it won't be used. Maybe after seeing how great these forwarded ports work, next requirement...

Sob

Setting local address seems as obvious choice for workaround. As simple as possible if it's static, a bit more annoying if not, but should be doable.

Sob

Traffic coming from tunnel can be to: a) some device behind router -> route marking for responses is done in prerouting b) router itself -> route marking for responses is done in output As for different variants of the rules, don't overthink it. You need one to mark incoming connections and you can'...

Sob

Few things: - If in rtr1 table you still have route to 0.0.0.0/0, as you did in first post and it was correct, then adding any other route there with same gateway is pointless, because the first one already covers any possible destination. - Same for the rule to look up destination for packets with ...

Sob

If the target is router itself, then output chain (instead of prerouting) is the right one for handling response packets, that's correct. It should just work without any extra routes. That's if you need to deal only with incoming connections. First rule in prerouting marks incoming connections (you ...

Sob

It's really simple. Imagine that you have certificate with encrypted private key and you want to import it. Don't think about why there's password, perhaps you got it like that from someone else. It doesn't matter. Don't you think that RouterOS should be smart enough to ask for the password if you d...

Sob

Almost there. You need to limit the route marking rule, because this one applies also to incoming packets. As a result, they will be sent back, because route marks have maximum priority in ROS. Either that, or you'd need routes to local destinations in rtr1 table. The former is probably easier/simpl...

Sob

What can I say, you know what you're doing. Gentle push was enough.

@anav: It's when you don't have public IP address from your ISP, but you want one. So you get it elsewhere (VPS) and then forward ports from there.

Sob

Masquerade on server side will have to be removed, of course. But that alone would break it and it wouldn't work at all. With this config it will. It's the good old "forwarding port through VPN", you know that.

Sob

You're looking for something like this: /routing table add name=wg fib /ip route add dst-address=0.0.0.0/0 gateway=wireguard1 routing-table=wg /ip firewall mangle add chain=prerouting in-interface=wireguard1 connection-mark=no-mark action=mark-connection new-connection-mark=wg-conn add chain=prerout...

Sob

added a "vrf" interface for testing, now I cannot delete it. It doesn't even show up in the terminal if you export the config... looks like a bug to me The bug is probably that you're able to add them at all. These interfaces are the previously hidden ones that are automatically created w...

Sob

It's for doing src/dstnat with router's own traffic. It wasn't available in old versions. When it's forwarded traffic, you have: prerouting/dstnat -> forward -> postrouting/srcnat But for router's own traffic (to/from router) you have: prerouting/dstnat -> input output -> postrouting/srcnat So you c...

Sob

Fun with interfaces, 2023 edition. Original version, shows how it's processed internally, but hides names of interfaces: prerouting: in: guest out:(unknown 0), 192.168.82.1->192.168.82.123 prerouting: in: (unknown 22) out:(unknown 0), 192.168.82.1->192.168.82.123 input: in: (unknown 22) out:(unknown...

Sob

That would be the first FTP server I ever saw with support for only single passive port (did you try to enter range like 20020-20030?). It's not impossible, but it would limit some features, e.g. transfers between different servers (FXP) would be problematic. But simple client-server should work. An...

Sob

See viewtopic.php?p=952360#p952360

Sob

It's just another tool like many before. It can be used or misused. Now it's new, so everyone is scared/excited/whatever. But we'll manage.

Sob

Reinventing the wheel properly takes time.

And they like to do it a lot, example: viewtopic.php?p=965896#p965896

Sob

Because it was so long ago when such things were used ^*1.

-
^{*1 Individual experiences may differ for each person}

Sob

Before you do something drastic, although I don't think harakiri is the thing in Canada, the thing with WG and localhost is just something that I think I saw mentioned in some thread, but I find it weird and it's entirely possible that I'm mistaken. So be calm, everything is probably mostly fine. ;)...

Sob

FTP establishes new data connection for every single transfer (download, upload, even directory listing). Just one port isn't much to work with. I can't say that it clearly couldn't work, it depends on how server handles it, but it can't hurt to try to configure at least some small range of passive ...

Sob

Add few built-in functions for convenience, find a way to provide more feedback on errors than silent death, and I'll be willing to say that it's ok.

Sob

I think I saw it in some threads that WG supposedly connects to localhost. I didn't examine it myself yet, but I don't see any good reason why it would do it (I'm not saying it's not possible). And you're probably significantly further than 0.3%. How much, that's hard to guess. I wouldn't be sure ab...

Sob

Forums having ranks/titles based on number of posts is common knowledge, everyone learns it eventually. I remember how once someone took info from some forum about military and argued that it MUST be true, because it was written by General and they know their stuff.

Sob

@rextended: I understand your frustration. But you're still missing any way how it could work. You can prohibit it, maybe in rules that nobody reads anyway. And people will still post it, either because they won't know about it, it they will know and not admit it. And you can ban them after, but fir...

Sob

It depends. If it's regular download where one connection transfers a lot of data, you can mark it using connection-bytes, e.g. after 10MB: /ip firewall mangle add chain=forward connection-mark=no-mark connection-bytes=10485760-0 action=mark-connection new-connection-mark=bigtransfer and then use qu...

Sob

What if you drop the routes and use standard /ip address add address=<address>/<mask>? I don't remember if what you have now is supposed to work.

Sob

Well, it makes sense. I just wonder what exactly the client does, it seems that is must use some kind of policy routing.

Sob

For start, how many devices are we talking about? Is it separate router and AP(s), or just single device? If it's more than one, then VLANs allow to have centralized config on router and AP can act as dumb transparent device.

Sob

Oops, sorry, my bad. In that case, it's different problem. You'd need clients to access x.x.x.x via tunnel, but they need to access the same x.x.x.x without tunnel, because it's the VPN server they are connecting to. I'm not sure what exactly OpenVPN client does, but it probably routes whole x.x.x.x...

Sob

Do you see interfaces appearing in vpn-clients list (clients need to reconnect if they were already connected)? It's in Interfaces->Interface List, or "/interface list member print where list=vpn-clients" in CLI.

Sob

The point is whether you have public address (= can have incoming connection from internet) at all. Because it's not automatic, there's shortage of public addresses, so ISPs "hide" their customers behind few public addresses using NAT. Outgoing connections to internet work, but incoming do...

Sob

new-form.png

Sob

Then as I wrote, interface list is your friend: /interface list add name=vpn-clients /ppp profile add <other options you have> interface-list=vpn-clients /ip firewall nat add chain=dstnat dst-address=x.x.x.x protocol=tcp dst-port=7012 in-interface-list=vpn-clients action=dst-nat to-addresses=y.y.y.y

Sob

Regular DNS doesn't have anything like user agent. You can use e.g. Wireshark to check what's in packets, but in short, nothing you could use. But you could use L7 to match queries for .srv TLD:

\x03srv.\x01$

Sob

Most likely not, but I can't wait until spammers discover that it would be perfect for generating hard to detect not-clearly-nonsense posts to establish their presence.

Sob

Anyone can connect if you use only dst-address without any in-interface. If you use dst-address with in-interface=all-ppp, it should be only VPN clients. Unless your internet connection uses PPPoE, I'm not sure about that and I can't test it right now, but it's possible/likely that all-ppp includes ...

Sob

What's the point? Try to share more details. If it's some non-public domain, you could do some filtering on that. But then I'd expect also internal addresses and there would have to be some VPN to access them, so just use it for accessing DNS server too. If it's resolver for regular public domains, ...

Sob

It's not exactly clear. If you want to make webserver publicly accessible, then drop in-interface=bridge. If it should be accessible only to VPN clients, it's probably best if they connect directly to y.y.y.y. But if you insist that they must connect to x.x.x.x, in-interface=all-ppp should work.

Sob

Well, it does seem that even with L2TP server disabled, 1701 is not closed like others, e.g. netmap on unfirewalled device shows: PORT STATE SERVICE 1700/udp closed mps-raft 1701/udp open|filtered L2TP 1702/udp closed deskshare I'm not sure what exactly happens, but you can always use firewall to bl...

Sob

Support is mainly for thing like bugs. There's nothing clearly wrong in your config (firewall rules could use some reordering, but they don't break anything). So, public IP address *1, do you know what it is and are you absolutely sure that you have one directly on your router *2? *1 not 10.x.x.x, 1...

Sob

@anav: It might break your heart, but did I mention that I don't know everything?

Sob

You can do something like this: /ip dhcp-server network add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 add address=192.168.88.100/32 dns-server=192.168.123.45 gateway=192.168.88.1 netmask=24 First is defaults for subnet and second is different config for single device (192....

Sob

I like LE for the automation alone. Being free is nice bonus. Paid certificates always required some annoying manual work. It wasn't too bad when they had very long validity (I don't know what was the maximum, but I used to have some five-year ones), but now we're down to one year. And if it goes ev...

Sob

I can't test it now, but doesn't something like this work? /ip dns static add name=lan type=FWD match-subdomain=yes forward-to=<main router> add name=something.more.specific.lan type=A address=<address> add name=another.more.specific.lan type=FWD forward-to=<another resolver> My guess/expectation is...

Sob

Well, this allows your router to be used as DNS resolver. Which is something you may want for your devices in LAN, so not wrong. But if accessible from internet, your router would be open resolver, which is not good, because it really can be used for attacking others. But in OP's case the original c...

Sob

Sorry, one more thing: /ip firewall nat add chain=srcnat src-address=200.151.54.0/24 dst-address=200.151.54.0/24 action=masquerade And about those addresses, it's just that they belong to someone else and it's possible (even though not very likely) that some servers you'd want to access could be usi...

Sob

My guess is that it's something on ISP's side. So I'd ask them. Or do you have access to some ISP's device (modem or something) that you can (are able and allowed to) turn off and on again?

Sob

My idea was whether you're perhaps replacing some ISP-supplied router, it would be possible that ISP allows it but nothing else. Or is it completely new connection that never worked before? Btw, you lost some rules in "/ip firewall filter". Those you previously had with chain=input, you wa...

Sob

So it looks like it's done by ISP's router for some reason. Does it work with some different router or directly connected PC? Could it be e.g. locked to specific device (its MAC address)?

Sob

Your dstnat rule has options in-interface=pppoe-protocol-intercon and in-interface-list=WAN (both useless) and they limit from where it will work. Drop them and it will be better. And those 200.x.x.x addresses, did you also get them from ISP? If not, you shouldn't use them and choose some from priva...

Sob

How do you define "doesn't get Internet"? Regular web browsing doesn't work, but what if you try to open https://1.1.1.1/, does that work? Or ping to some numeric address (e.g. 1.1.1.1 again)? What about ping from router itself (open Terminal and try "ping 1.1.1.1")?

Sob

Aside from seriously outdated system (but that's not breaking it), I don't see anything obviously wrong, it looks like good old default config from 2017. If you look at DHCP client (IP->DHCP Client), what does it say? Does it get any IP address? And you do have ISP's router connected to ether1, right?

Sob

Don't get me wrong, I'm all for letting people decide. If someone wants unencrypted REST, is should be their choice. I'm also big fan of configurable things. Currently you can enable web server and it's all or nothing (WebFig, REST, ...) => not good. Same for current enable-ssl-certificate, it's har...

Sob

It seems mostly fine. In addition to previous (^^^), you can try to add temporary logging rule, either for specific port: /ip firewall mangle add chain=prerouting in-interface=pppoe-out1 protocol=udp dst-port=7777 connection-state=new action=log log-prefix=new-incoming Or a broad one for all: /ip fi...

Sob

How this works exactly? Netinstall still does reset password to blank, right? Or, if the sticker gets lost, will I have not very practical (but secure!) door stopper?

Sob

If self-signed certificate would be enough for you, it's not like it's too difficult to get it now: /certificate add common-name=router.example.net /certificate sign router.example.net it's still inconvenient, because you need to either make the client trust it or ignore it, but it shouldn't be a sh...

Sob

Dstnat is not good, because it redirects everything, without any fallback. If you have at least common TLD (e.g. .lan), then with recent enough RouterOS (v7), you can do this on other routers: /ip dns static add name=lan type=FWD match-subdomain=yes forward-to=<main router> and it will forward *.lan...

Sob

What I meant is that when one would add internal records in public DNS, in order to solve problem with DoH and other ways how devices can bypass local data, they might end up using some resolver that filters records with private addresses. So you solve one problem, but hit another. As for MikroTik's...

Sob

Not from a screenshot, it can hide some things. But based on your description in first post it should be ok. To be sure, try to run this in Terminal:

/export file=myconfig

and then post content of created myconfig.rsc here in code tags.

Sob

I'm not sure what you mean.

Sob

Yes, it's correct and it should work. Even if it wouldn't work completely, you should at least see some incoming packets, counters for dstnat rule (columns Bytes and Packets) should increase. How do you test it?

Sob

It's not needed, even if service on router uses some port and dstnat rule is for same one, dstnat sends packets elsewhere before they can reach service on router.

Sob

Some resolvers may filter private addresses. It's some trouble everywhere you look, we should scrap it all and move to all-public IPv6.

Sob

Is it also language barrier that makes you answer only half of questions?

Now we know that if it start with 91, it's public address. But we still don't know it your router actually has this address. Once again, look in IP->Addresses, is this address there?

Sob

I admit that I wasn't sure, but it seems that except IN it's all long time dead (only bind nameserver supposedly misuses CH to show its version, but I wouldn't be sure about that either, because lately showing versions tends to be avoided).

Sob

Feel free to enlighten me, but DNS query packet ends with two bytes for type followed by two bytes for class. In type there's 001C, 00 gets dropped, so we're looking for 1C (lowercase \x1c is fine). Class could in theory be 0x0000-0xFFFF, but does anything we might care about use anything else than ...

Sob

Ok, I lied. Not intentionally, I probably got misled by RIP and overlooked the obvious. If you want to access something connected to public-ip-lan interface from outside, of course you need to allow it (this will allow full unlimited access, you may or may not want to limit it in some way): /ip fire...

Sob

For start, your "my isp ip" is public (not 10.x.x.x, 100.64-127.x.x, 172.16-31.x.x, 192.168.x.x) and directly on your router (you can see it in IP->Addresses), correct?

Sob

It doesn't seem very clear, so I'm just guessing... Do you mean local hostnames like workstation1.site1.lan on one router, server1.site2.lan on another, etc? Proper solution would be to run real DNS server(s), i.e. not something RouterOS can do. It could also work with FWD records (not real records ...

Sob

There are two things: - IP->Services - services that run on router - IP->Firewall->Service Ports - protocol helpers for firewall, for services that need extra care (e.g. FTP has one main connection that this helper watches and automatically recognizes related connections, so that they could be allow...

Sob

In that case I would simply use 10.2.0.2/24 for IP address on the router. Address as /30 is very limiting.

The point being? If they gave you /32, you should use /32, you won't gain anything by using something else.

Sob

I can't say about RIP part, I don't know much about that. Only in firewall, when you drop all incoming packets on pppoe-out1, then allowing something after that is useless, because it will never get there (so you need to swap those rules). Other than that, I don't see any problem.

Sob

Learning yourself is fun. When I found RouterOS, I knew some basics in Linux, network config, bit of iptables, etc. With RouterOS (and especially WinBox) I was like fish in a water. I'm not saying that I knew everything overnight, but most of it was pretty intuitive. Don't look down on WinBox, it's ...

Sob

Try similar logging rule in srcnat. Use some other condition like source address to match only testing traffic. And check if it shows the right outgoing interface, or if it's another unknown one.

Sob

Several things in there are weird. For start, I don't see any NAT rule with IP address you could be updating. But I do see default route that might need it (gateway), which is unusual, because normally you just let DHCP client add dynamic default route. Also to have both DHCP servers and clients on ...

Sob

Ability to upload with BT or speed of it doesn't have much to do with ability to accept incoming connections. It just makes connecting between clients easier, but it doesn't mean that it would be impossible without it.

Using VPN does need some extra config, which depends on what kind of VPN it is.

Sob

@anav: There can be different results, and there's also difference between tcp and udp. In case there wouldn't be any firewall, tcp connection that reaches target host always gets something back, either ack (when something listens on that port = it's open) or rst (when nothing listens there = it's c...

Sob

It all depends on what you want. Even with multiple subnets, you can use dst-address=!192.168.0.0/16 to exclude all internal addresses from this range. Or you can simply not exclude some. E.g. if you have primary LAN and separate LAN for guests, and you want to use WebFig from main LAN only, then if...

Sob

There's difference between DNS resolution: - in Terminal it's done by router - in WinBox it's done by machine it runs on - I'm not sure about WebFig Normally if machine with WinBox uses same router as its DNS resolver, there wouldn't be any difference. But depending on what static records you add, i...

Sob

The action=masquerade is your friend (instead of action=src-nat).

Sob

You need to understand what it does. There may be misleading wording about checking for open ports. But it's actually checking if it's able to connect to something. It knows nothing about your router and its config, and has no means to discover anything about that. Either it will be able to connect ...

Sob

Generally no extra routes should be needed, but it's possible that in your case they are, it depends on how everything is configured.

Sob

There's always the simple and (almost) foolproof dst-address-type=local. The "almost" part is when you use it with port that you also use to manage router, e.g. 80 when you use WebFig on default port, that will lock you out. But you can combine it with dst-address=!192.168.69.1 to exclude ...

Sob

I mean, when you're using port checker, at that moment, is there any software running on internal device and listening on that port? It must be, otherwise there will be no reponse. You can't open port "for later" without something actively using it and have it shown as open.

Sob

Are you sure that on your 10.10.22.241 device something definitely listens on tcp port 65472, it's not blocked by device's own firewall, device has this router as its default gateway, etc?

Sob

L7 strips zero bytes, so you can't work with them at all. You can take 1c from type and 01 from class and look for them at the end:

/ip firewall layer7-protocol
add name=dns-aaaa regexp="\\x1c\\x01\$"

Sob

If we're talking about single NAT, this is best suited for ancient/dumb/ignorant client. "If I connect to some server and tell it that I'm alive, then server sees my address and port I'm using, and if I'm listening on that, then anyone who server tells it to can connect to me, right? What? My r...

Sob

Automatic stuff, if it means that mapping created by outgoing connection also serves for new independent incoming connections, comes from this NAT type itself and doesn't need anything else. That's why it's in both srcnat and dstnat chains. The one in srcnat can be exactly same as existing masquerad...

Sob

I wouldn't say it's complicated. It's slightly different. If you have only IPv4, then with typical setup you have one public address on router, so it's one hostname and it covers all internal servers you might have. MikroTik's DDNS works and it's just few clicks. If you add IPv6, then every device h...

Sob

But why!? (@Sob!) Just because you can or is fun to have?? Bring us the real problem! What did I do? I'm just explaining and discussing interesting technical thing. Because it's just that, interesting. I'm not saying that MikroTik should drop everything else and add this, not even necessarily add i...

Sob

@Znevna: I agree that it's slightly weird. I suppose you can see the possible problem and how this solves it *1 , right? The weird part is, how is it actual problem, unless we're talking about some software from pre-NAT times? Because anything aware of NAT must assume that direct incoming connection...

Sob

Don't overthink it, it's just a tool, it's up to you how you use it. Take the netfilter module from first post (https://github.com/Chion82/netfilter-full-cone-nat). If it was in RouterOS, you could do e.g: /ip firewall nat add chain=srcnat src-address-list=consoles protocol=udp out-interface=WAN act...

Sob

There are different levels. Routing needs a route (but in this case even default one is enough). With proxy ARP I'm not completely sure, there were some changes, possibly bugs, but route pointing to different interface than LAN should be sure bet. It's even possible that it's not needed and default ...

Sob

Because IPSec carries only IP packets (= L3). You can have L2 with EoIP, but then you'll have to deal with different problems, at least some DHCP isolation would be required if each site should have own server. If you stick with IPSec, for proxy ARP to work, you'll need routes to remote sites. As fo...

Sob

Correct. But with <whatever_it_would_be_called> NAT being dynamic and creating incoming dstnats for each outgoing connection, one public address would be good enough for several consoles.

Sob

But why? You won't have L2 connectivity anyway. And if it's only L3, you might as well go with clean and simple separate subnets. But if you insist, it should be possible. Currently you have problem on site A, because e.g. 192.168.10.200 has /24, so it thinks that even remote 192.168.10.10 is local....

Sob

as you can see RouterOS also maps to the same inside global ip and port for all streams. Yes. But now when 3.3.3.3 tries to connect to x.x.x.x:12345, will it reach 192.168.88.115:12345? No, because RouterOS will correctly see it as new unsolicited connection. But this <whatever_it_would_be_called> ...

Sob

Check VRF and hidden interfaces. I was under impression that it's already fixed/handled, but maybe not everywhere? I think I didn't test NAT myself.

Sob

Who decided that everything in web browser is the right way? I for one say it's not. Don't touch my toys!

Sob

It's definitely not that RouterOS couldn't handle port forwarding. Slighly wrong VLAN and IP config shouldn't do it either. Same goes for seemingly unnecessary proxy ARP. But what if you forget about dual WAN for a moment (disable DHCP client on ether10) and try with only single connection, does it ...

Sob

Well, it's confusing. I mistakenly read it as "Works fine as long as my internet supplier does not change addresses IP addresses." Looking at OP's older threads (and I participated there too, who would have thought :)), that's not the case ("My internet provider does not change the pr...

Sob

Short answer: NO Long answer: Maybe. It would work with transparent proxy and requests that could be intercepted this way, e.g. HTTP (but not HTTPS). So in practice it's NO again. Other way would be to make clients aware of proxy. Manual config would be impractical, but there may be some chance with...

Sob

MAC addresses alone are not that big problem, it may look weird at first, but VRRP hack works.

Sob

@anav: Be careful with untrusted others. UPnP's problem is lack of security. You can help it a bit, e.g. you can control who uses it (or more precisely who can control it), by allowing access only from some devices (firewall filtering by IP or better MAC address) or interfaces. So you can allow acce...

Sob

UPnP should be solution (for single NAT) for everything that supports it. That should be any non-ancient game. Unless authors were too progressive and went only with more modern PCP. It wouldn't be wisest choice to support only that without UPnP as backup, but if you wanted, you could partially blam...

Sob

On 7.7, yes. Just go in IPv6->Addresses and it should be there. You have to accept RAs first:

/ipv6 settings
set accept-router-advertisements=yes

And also reboot to make it work, because in v7 the change no longer applies immediatelly, which is most likely bug.

Sob

It shouldn't be difficult, luckily I don't need it myself, so my experience is limited, but at first sight there are different tools ready for the job (e.g. ddclient). And if you're using own domain (as it seems you do), then if there's some API for its DNS, you can do it without relying on any othe...

Sob

Admittedly unhelpful advice: The only proper solution is to tell ISP to stop doing stupid things and keep static addresses.

DDNS is just hotfix with various problems. But if it's unavoidable, it's probably best/easiest to use some independent DDNS on server itself.

Sob

At home it's 6to4 instantly crashing system (SUP-97719). I need it to work, because it's still my source of IPv6 (ISP didn't yet manage to provide native IPv6 and I don't like third party tunnels). It might be useful indicator of v7 maturity. Given its low popularity, when they fix this, they probab...

Sob

Current bytes = 0 means that nothing is sent or received. But if you're pinging from router, it's expected, you need to set source address, because it's choosing wrong one:

/ping src-address=192.168.55.1 address=192.168.7.1

Search found 9242 matches