Access mikrotik router behind a modem

RouterOS Beginner Basics
1

Hi, im not sure if this was already asked but i have a problem accessing my rb750 (via winbox) if my pc is connected to the modem.

ISP Modem gateway is 192.168.1.1 and wan port of MT is set as 192.168.1.2. My config is just simple, I made a new network (192.168.20.0/24) for ports 2-5 (bridge).
When i connect my pc to ports 2-5, i can access winbox of course, but the other pc that is hardwired to the modem (with IP: 192.168.1.3) cannot access MT via winbox.
Do I have to add static route in the ISP modem? I have tried putting a static route in my MT but still can’t log-in via winbox.
Can anyone help? This is basic but I’m having a hard time understanding the IP>Routes and IP>Firewall>NAT.

2

Firewall does not allow Winbox access through the WAN port by default.

As this WAN port is behind an ISP modem it is relative safe to open the Winbox access.
If all is secured on the ISP modem … you can add things like this, early in the Firewall rules (8291=winbox, 21=telnet, 80/443 is http/https)

add action=accept chain=input comment=“allow mgmt input” dst-port=8291,21 protocol=tcp
add action=accept chain=input comment=“allow mgmt input” dst-port=80,443 protocol=tcp

3

No luck here. here’s my simplified network diagram:
https://imgur.com/a/vsP1rka
tried also,
/ip firewall filter
add action=accept chain=input dst-port=8291 in-interface=ether1-WAN protocol=tcp
still, no luck.



4
  • You’re connecting to address on router’s WAN port, i.e. 192.168.1.2 and not some 192.168.20.x, right?
  • Can you ping this address from PC 192.168.1.3?
  • Order of rules matters, they are processed from top to bottom, so did you put the new one somewhere before the one that blocks access from WAN?
5

To answer your questions:

  1. yes
  2. i can’t ping 192.168.1.2 and of course, 192.168.20.0 network.
  3. I put my filter rule just above the first “drop” rule. I believe that by default, you cannot access winbox via a WAN port (correct me if i’m wrong on this one.)

for now, i just use remotewinbox. but if there is a workaround to access winbox without using vpn, then i’m all for it. guess i have to keep reading.

6

Post full config of your router … execute /export hide-sensitive and copy-paste results here (inside [__code] [/code] environment for better readability). It could well be some other firewall rule which is interfering and it’s hard to tell without seeing it all.