The remote router has 10.33.92.205. I made a static route to 10.1.0.0/24 via 10.33.92.196.
On my side I simple have added a rule, but that’s not enough.
[root@gw1] /ip firewall nat> print
4 chain=dstnat action=accept src-address=10.33.92.205 src-mac-address=remote_mac_addr log=no log-prefix=“”
I know that this is very easy, but just stuck
Thank you in advance.
Are you src-nating? Or does the ISP do that for you?
If you’re on the same subnet and have a src-nat, you’ll may need to exclude his subnet in your dst-address, as well as having your static routes on both routers.
Otherwise you may just need to put an accept of the neighbors subnet into your filters above any blocks from WAN that are there. I wouldn’t think you’d need or want any dst-nat if you’re routers are on the same subnet, let the static routes take care of it.
Если вы с соседом действительно в одной сети, то nat в принципе не нужен.
Нужно на обоих маршрутизаторах исключить внутреннюю сеть из src-nat правила для интернета (если есть) и прописать маршруты на внутренние подсети за маршрутизаторами (ваша это 10.1.0.1/24) с gateway=ip_противоположного_маршрутизатора, т.е. как-то так:
ip rou add dst-address=%подсеть_у_соседа% gateway=10.33.92.205 check-gateway=ping
Unfortunately, does not work
proBagroff:~ danilabagroff$ traceroute 10.1.0.2
traceroute to 10.1.0.2 (10.1.0.2), 64 hops max, 52 byte packets
1 192.168.0.1 (192.168.0.1) 9.087 ms 6.816 ms 6.692 ms
2 10.33.92.196 (10.33.92.196) 6.655 ms 6.904 ms 11.720 ms
3 * * *
My network: 10.1.0.0/24
Neighbor’s network: 192.168.0.0/24
My router: 10.1.0.1, wan: 10.33.92.196
Neighbor’s router: 192.168.0.1, wan: 10.33.92.205
[root@gw1] > /ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 10.33.92.1 1
1 ADC 10.1.0.0/24 10.1.0.1 bridge 0
2 A S ;;; 105 Subnet
192.168.0.0/24 10.33.92.205 1
Most firewalls default to blocking all incoming connections that aren’t initiated from inside your network.
AND all this needs to be checked an replicated (with the opposite IP’s and gateways) on the neighbors router. I don’t read Russian, but sounds like he has a TP-link and configuration may be a little different to remove src-nat, filters, etc.
Also, what kind of machine is the target of the ping? Windows 7’s (and probably up) in a non active-directory environment (home use) default firewall will not respond to a ping request unless it is on the same subnet.
[root@gw1] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; 105 router
chain=input action=accept src-address=10.33.92.205 in-interface=ether1 log=no log-prefix=""
2 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
3 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
4 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
5 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN
6 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
7 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
8 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related
AND all this needs to be checked an replicated (with the opposite IP’s and gateways) on the neighbors router. I don’t read Russian, but sounds like he has a TP-link and configuration may be a little different to remove src-nat, filters, etc.
Your internal translator is better than google ones
Yes, this is what I said to morituruz. Neighbor has TP-LINK Archer with default firmware. I could only add a static route to my(10.1.0.0/24) network via my WAN IP(10.33.92.196). Have no idea how to exclude from srcnat. Honestly, I doubt that there is something similar. In case I’m wrong there is a simulator http://www.tp-link.com/resources/simulator/Archer_C2/index.htm
Also, what kind of machine is the target of the ping? Windows 7’s (and probably up) in a non active-directory environment (home use) default firewall will not respond to a ping request unless it is on the same subnet.
Doesn’t look like you have your firewall blocking any forwarding which is unsecure, but wouldn’t cause any problems with doing this.
The TP-LINK though would block any incoming connections with the SPI. Might be able to use the Access Control section to allow your network in, but I have no experience with TP-Links implementation.
The NAT on the TP-LINK doesn’t look very configurable, so any outgoing connections from him to you would probably look like it’s coming from the router itself. (Might be ok depending on what you need.)
Have your neighbor get a hAP-lite or mini. Or better yet, give one to him.
Set up a GRE tunnel between the 2 public IPs (with IPSEC), put a /30 on either side, then route your private subnets to the /30 address on the “other” side of the tunnel.
Done.
You just need to make sure that the 2 private subnets are not the same. Mikrotik is usually different so this is good.
