Access modem behind mikrotik

RouterOS Beginner Basics
1

Sorry for such a dumb question. I saw multiple threads here, tried multiple solutions and none of them worked for me (or maybe I didnt imlement them properly). I’m quite a newbie in mikrotik.
I have a Modem which is in Bridge mode (on port 4). Modem’s network is 192.168.1.0/24 and the modem is accessible on 192.168.1.254 if plugged in any other modem’s port (1-3)
Mikrotik is connected to modem bridged port (4). Mikrotik is getting public address which is getting set on ether1. Internet is working fine. LAN network of the mikrotik: 10.0.0.0/24
I want to be able to access the modem (192.168.1.254) from LAN (10.0.0.0/24)
p.s. I can ping (ARP ping only specifying ether1 interface) from mikrotik to modem. NOT ARP ping gets the “timeout”.
p.p.s. Adding 192.168.1.x/24 address to ether1 interface doesnt help

/interface bridge
add admin-mac=18:FD:74:C1:8F:81 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=10.0.0.30-10.0.0.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=8h name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=10.0.0.1/24 comment=defconf interface=bridge network=10.0.0.0
/ip arp
add address=192.168.1.254 interface=ether1 mac-address=1C:57:3E:79:16:8F
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.0.0.0/24 comment=defconf dns-server=10.0.0.1 gateway=10.0.0.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=10.0.0.50,1.1.1.1
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=input comment="defconf: drop ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

Thanks in advance for help

2

You will need to add the 192.168.1.x/24 network on the Mikrotik bridge interface, not ether 1.

Also remove the

/ip arp
add address=192.168.1.254 interface=ether1 mac-address=1C:57:3E:79:16:8F

Then you should be able to login/ping the modem from the 10.0.0.0/24 network

3

Thank you for such a quick reply, just tried and unfortunately that didn’t help.

4

That suggestion is wrong!
You need to set an IP address in the modem subnet on ether1. And you should not need that fixed ARP entry.
Problem of course is that you also want ether1 to be a DHCP client.
So you will have to be careful about source address selection…
Often in scenarios like this, the actual internet traffic is over a tagged VLAN and the modem listens for untagged traffic for management.
Can you configure that in the modem? That would be better.

5

unfortunately on the modem beside bridge mode and lan network is not possible to configure anything else. I will check again, but would appreciate any other solution. I assume there is also an option to additionally connect mikrotik to any lan port (1-3) of the modem (beside bridged one: 4). I guess will need some additional configuration on the mikrotik part for that

6

Yes, there is a solution: put a 192.168.1.1/24 address on ether1 and arrange that the routing will not be fouled up.
Maybe it will just work. In general it is no problem to have more than one IP address on an interface but source address selection could go wrong.
Check in your routing table if the proper source address is present in the default route.