Access a device connected to the WAN interface

RouterOS General
1

Access a device connected to the WAN interface from the local network and from outside the network

myconfig.rsc (2.9 KB)

/interface bridge
add name=bridge1 protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name=ether1-Mimosa
set [ find default-name=ether2 ] name=ether2-T_1
set [ find default-name=ether3 ] name=ether3-T_2
set [ find default-name=ether4 ] name=ether4-T_3

/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-Mimosa name=pppoe-out1
user=$$

/ip hotspot profile
add dns-name=net.com hotspot-address=5.5.5.5 login-by=
http-chap,http-pap,mac-cookie name=hsprof1 split-user-domain=yes
use-radius=yes
/ip hotspot
add addresses-per-mac=unlimited disabled=no interface=bridge1
keepalive-timeout=30m name=server1 profile=hsprof1

/ip pool
add name=dhcp_pool1 ranges=93.10.0.2-93.10.0.254
add name=PPPOE ranges=90.10.0.2-90.10.0.254

/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge1 lease-time=10m name=dhcp1
/port
set 0 name=serial0
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=90.10.0.1 name=PPPOE
remote-address=PPPOE wins-server=90.10.0.1

/interface bridge port
add bridge=bridge1 horizon=1 interface=ether2-T_1
add bridge=bridge1 horizon=1 interface=ether3-T_2
add bridge=bridge1 horizon=1 interface=ether4-T_3
add bridge=bridge1 horizon=1 interface=ether5
add bridge=bridge1 horizon=1 interface=ether6
add bridge=bridge1 horizon=1 interface=ether7
add bridge=bridge1 horizon=1 interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=all

/interface pppoe-server server
add authentication=pap,chap default-profile=PPPOE disabled=no interface=
bridge1 max-mru=1492 max-mtu=1492 mrru=1500 service-name=service1

/ip address
add address=93.10.0.1/24 interface=bridge1 network=93.10.0.0
add address=190.100.0.1/24 interface=bridge1 network=190.100.0.0

/ip dhcp-server network
add address=93.10.0.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=93.10.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=accept chain=input dst-port=1812,1813 protocol=udp
add action=accept chain=input disabled=yes dst-port=80 protocol=tcp
add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
/ip firewall nat

add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="PPPOE network" src-address=
90.10.0.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot network"
src-address=93.10.0.0/24
add action=masquerade chain=srcnat out-interface=pppoe-out1

/ip hotspot user
add name=admin

/ip hotspot walled-garden
add comment="place hotspot rules here" disabled=yes
/ip hotspot walled-garden ip
add action=accept disabled=no !dst-address !dst-address-list !dst-port
!protocol src-address=190.100.0.0/24 !src-address-list

2

VPN

If you are looking for a more detailed answer, you may have to give a lot more context.
What device ?
How is wan connection ?
Fixed or dynamic ip ?
...

3

It is just a matter of setting the appropriate routes and maybe firewall rules.
Those are of course difficult to hint without knowing more details.
But I have a VDSL modem connected to my WAN port on a fixed IP address, and over the same WAN port I have PPPoE-in-VLAN for connecting to my ISP (so the PPPoE client is my actual WAN interface).
I can just connect to the VDSL modem by giving its IP address in the browser.

4

Hello
I have a Mimosa device connected to the WAN interface.
I do not have a public address.
I have a connection via PPPoE.

5

Yeah so then you should assign the router an IP address in the same range as the Mimosa and it should be accessible when you use the default firewall.

6

Thanks for the reply.
The Mimosa IP address was previously set to 190.100.0.21, and it is listed on the same range as the bridge.

From within the router, the ping is not found.

7

That is a strange address to use.
Anyway, you should put an address near to that on your ether1 port (190.100.0.20/24) and make sure that the ether1 port is in the list of ports where masquerade is active (will be interface list WAN when using default firewall, where your PPPoE interface is also listed).
Then it should work.

8

Thank you, I added the IP address to interface 1.
The ping command works from a router to Mimosa.
The remaining nat configuration is: Please clarify where to insert interface 1.

nat configuration
add action=masquerade chain=srcnat out-interface=pppoe-out1

9

Ok that is not standard config. But you can add another masquerade rule with out-interface=ether1

10

Thank you very much
It works now after adding the nat configuration