Using multiple Mikrotik routers in the LAN, so have to change the subnet for all but one one of them. Much difficulty found.
Specific situation: using Winbox, apparently did change subnet from ..88. to ..55. Notebook directly wired on eth5 of the router receives IP ..55.200, as shown in the network manager on the notebook (openSuse 15.5). Can disconnect eth0 at the notebook and get the same IP when I reconnect. Winbox (in Wine) reports “no route to host” (the router) when attempting to connect to this IP. Notebook has a firewall, but turning it off has no effect.
Winbox doesn’t find router when wired to its eth1 and using the MAC address.
Ideas appreciated.
@ckonsultor
From your description I cannot understand what the issue is.
Winbox, when there is a direct connection to a Mikrotik router, can find the router using its own “special” protocol making use of the MAC of the router, no real need of using an IP or a route.
Ports on the router are called in Mikrotikish ether1, ether2, ether3, etc.
If what you call eth1 is actually ether1 of the router, it usually is part of WAN and as such access from Winbox is (again usually) prevented.
Have you tried other ports?
Sometimes rebooting the router and/or the PC might help in re-discovering a device.
Running Winbox inside Wine is an added layer of complication, but it should not be relevant here.
On the other hand, if you could connect to the router in Winbox “before” and “now” you cannot connect (anymore) it means that you changed something incorrectly in the router setup and you locked yourself out.
You can still reset the router and start again or, in the worse-worse case, there is still the netinstall possibility.
Thanks for the hints, Jaclaz. I have tried both the WAN and LAN ports on the router to wire into the notebook running Winbox. For some reason the Neighbor that Winbox currently finds is on 192.168.88.1 while that same router’s DHCP gives 192.168.55.200 to the notebook. I have rebooted and reset the router more than a dozen times, eventually getting disconnected and locked out as I try to change the subnet. After a factory default reset I can reach the router on ..88.1
One thing I didn’t mention is that the link from the router uses the USB port on the notebook (no Enet port on the notebook), with an in-line adapter. Never occurred to me that might be a problem. Is it?
Went back to Winbox to refresh Neighbors and now there is none. Which prompts my question about your saying Winbox automatically finds attached routers. I’ve not seen that a happen. I have always had to enter an IP or MAC address because Winbox doesn’t find routers, for me. The Credits for Winbox show the last copyright date as 2013. Still current?
Very puzzling and most frustrating.
It’s crucial to be aware that change of IP address used by router requires change in several places:
- /ip/address (ant make sure you define proper subnet mask, e.g. /24, without setting it default is /32, so single-host “network” only)
- possibly /ip/route
- /ip/dhcp-server/pool
- /ip/dhcp-server/network
- possibly in /ip/firewall (al sub menus) if rules refer to statically set IP address of router. Default setup doesn’t, but device’s admin might add rules without consideration of possible IP address change. In particular in /ip/firewall/address-list
Based on symptom description I’m guessing that @OP did the changes in bullet #3 (and possibly in bullet #4) but failed to do the bullet #1 and possibly the rest.
Yes, additionally there can also be issues in attribution of interface lists and mac and mac winbox server, see the section MAC Connectivity Access
https://help.mikrotik.com/docs/display/ROS/First+Time+Configuration
i.e.:
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
There have been reported issues (IMHO a bug) when fiddling with Quick Set:
http://forum.mikrotik.com/t/bug-improvement-suggestion-lost-connection-to-winbox/170903/1
Finally, the “detect internet” sometimes can cause issues, see also here:
http://forum.mikrotik.com/t/lhgs-repeatedly-losing-winbox-connection/170865/1
Check all the above, if you cannot solve the problem, post your whole configuration following these instructions, and someone will hopefully spot the issue:
http://forum.mikrotik.com/t/forum-rules/173010/1
No idea if the USB->Ethernet adapter can be an issue, but, now that you mention it, it could be a possibility, not entirely unlike when you connect a hard disk with an USB adapter something (at low level, not used normally) is lost in translation.
Thanks for the many links/leads, Jaclaz.
The MAC connectivity I attempted on another MT router and quit in frustration–will get back to that one.
Did nothing with Quick Set since the last default reset.
Have not added any ports to the Check for Internet function, so assume they are all at None.
So, again locked out, I reset to factory defaults and exported the config:
# jan/02/1970 00:12:33 by RouterOS 6.48.1
# software id = Q7UY-TG8N
#
# model = RouterBOARD 750 r2
# serial number = 8xxx
/interface bridge
add admin-mac=B8:69:F4:4 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/system identity
set name=demo
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Then I added a subnet 192.168.55.0/24 to Addresses; created an IP pool (poll55); changed the DHCP server to use pool55; after this following capture also added network ..55. to DHCP/Networks. Also increased lease time to 30 min so I had time to extract the config, which is:
# jan/02/1970 00:17:53 by RouterOS 6.48.1
# software id = Q7UY-TG8N
#
# model = RouterBOARD 750 r2
# serial number = 8xxx
/interface bridge
add admin-mac=B8:69:F4:fa auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool55 ranges=192.168.55.250-193.168.55.10
/ip dhcp-server
add address-pool=pool55 disabled=no interface=bridge lease-time=30m name=\
defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 (..88.) comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.55.1/24 (..55.) interface=bridge network=192.168.55.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/system identity
set name=demo
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
While Winbox was connected,
–he IP on the notebook remained in the 192.168.88.0 range. When the leases renewed the IP remained in the ..88.
subnet.
–a new windbox could not display any neighbors when refreshed.
This time, after winbox quit I could execute it again and connect to ..88.1 with an IP in that subnet given to the notebook. Still no neighbor detected.
I don’t understand.
You have:
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
the DHCP server will lease on 88, the netbook will gett a 88 address, no surprise here?
You have:
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
and:
/ip neighbor discovery-settings
set discover-interface-list=LAN
and:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
anything connected to ether1 (WAN) won’t be detected/accessible by Winbox, no surprise here?
Sorry about not pulling a new config last night, I was fading fast.
Here’s the current config, with the 55 subnet in DHCP networks:
# jan/02/1970 17:20:56 by RouterOS 6.48.1
# software id = Q7UY-TG8N
#
# model = RouterBOARD 750 r2
# serial number = 8Bxxx
/interface bridge
add admin-mac=B8:69:F4:xxx auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool55 ranges=192.168.55.250-193.168.55.10
/ip dhcp-server
add address-pool=pool55 disabled=no interface=bridge lease-time=30m name=\
defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.55.1/24 interface=bridge network=192.168.55.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.55.0/24 gateway=192.168.55.1 netmask=24
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/system identity
set name=demo
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Date not current, no internet access as I’m working off-line.
To correct
anything connected to ether1 (WAN) won’t be detected/accessible by Winbox,
should I add this?
/tool mac-server mac-winbox
set allowed-interface-list=WAN
Winbox on the bridge still doesn’t see this router as a neighbor.
It seems to me like you have conflicting addresses in setup, from what I understand you have still in many places both the 55 and the 88 subnets.
This is likely to confuse the router or the Winbox or both, I have seen (only as an example, not necessarily relevant in your case) that sometimes when two addresses are given to an item, like you have on your bridge both 192.168.88.1 and 192.168.55.1, Winbox “prefers” the lower one, 192.168.55.1 in your case, but other parts of the Os (or of WInbox itself) may “see” (or “remain hooked to”) 192.168.88.1.
What I would personally do (not necessarily a good idea, mind you) would be:
- reset (again) the router
- export/save the default configuration
- print it, highliighting all occurences of the .88 subnet addresses
- remove one port from the bridge (let’s say ether5), add it in the /interface list member as LAN, assign to it a static IP address in a completely different subnet, let’s say 10.0.0.1/24
- assign to the PC a static IP 10.0.0.2/24
- try connecting to the the Mikrotik on ether5, this way you will have removed any possible conflict with DHCP, other ports on the bridge, and what not
- if the connection via ether5/static works, you can proceed replacing the 88 with 55 or disabling the 88 entry and making a new similar 55 one (without adding a 55 to the existing 88 like you are doing now).
- then try again to connect to one of ether2/3/4 with the PC with the DHCP enabled
As a side-side note, philosophically 
this is wrong:
/ip dhcp-server
add address-pool=pool55 disabled=no interface=bridge lease-time=30m name=\
defconf
You should never change a “defconf” tagged entry, rather disable it (or delete it, you can always recreate it afterwards copying and pasting from the copy of the exported configuration, just take a note about the deletion) and create a new one with a different (meaningful) name or comment.
Otherwise at the third revision, or in three months time, whichever comes first, you won’t be able anymore to distinguish “defconf” which is actually defconf from “defconf” that is actually your nth change…
I’m embarrassed I didn’t know about ‘defconfig’ comments. Glaringly good idea.
Your post describes a procedure much different from the one I’ve been following, from a forum post:
To make sure your transition to another subnet runs smoothly, I recommend doing it this way:
First, add the new IP to your LAN-facing interface (Let´s say 172.17.100.1/24 for example)
Then add 172.17.100.0/24 with the appropriate new info to dhcp/networks
Add a fresh pool to /ip/pool, probably 172.17.100.50-172.17.100.200
change your default dhcp-server pool from “default” to the new pool.
Make sure to check your firewall rules, especially NAT, to cover both networks.Go ahead with your local devices having a static IP configured and change it to the new range.
Wait until all old dhcp leases in 192.168.88.0/24 have expired
Remove 192.168.88.1 from your LAN-facing interface.
Remove 192.168.88.0/24 from your firewall rules.Done.
That process left the old networks entered in the config until after the subnet changed; you seem to say to delete the default addresses when adding the new. Correct? Will try your way asap.
The general idea is to have (at least temporarily) a specific, separate port/interface with fixed address (and all authorizations of a LAN port) dedicated to accessing the Mikrotik device via Winbox.
This way, unless you do something really catastrophic, you can play with all the (other) settings without risking to be kicked out/prevented access (which is common enough when you modify settings related to the bridge and you are connected to the bridge).
Once the device is configured correctly AND you can access the device from the bridge you can (if you need it) re-add the “separated” port to the bridge and remove/disable the added fixed IP, if you don’t need to use that port, leaving it separated from bridge may be a good idea as a possible emergency access.
In theory, in any moment you should be able to access the device either from the separated port with a fixed address of your PC or from one of the ports on the bridge with the PC with DHCP enabled, in practice, when experimenting it is easy to do a mistake affecting all the ports in the bridge at the same time, i.e. all LAN, and the ether1 is on WAN so it does not have in default configuration access allowed via Winbox.