Basic internet config

MikeM45 · August 10, 2024, 10:00pm

Hi

LHGG LTE6 not used for 1 year:

I have reset router to factory settings
I have downloaded latest Winbox and reset passwords
I have updated the router software to latest version
I am using a Vodafone UK sim

I am getting a signal but cannot get connected to the internet - I have attached a screenshot of my Quick Set settings and a picture of the LED’s on the aerial/router

Please can someone have a quick look and tell me if any of my settings are batantly wrong or if I need to check a box that is unchecked( I am not technical and have got this far using Google and Youtube! )

Many thanks
Mike

jaclaz · August 11, 2024, 11:22am

Unfortunately that screenshot shows only a small part of the configuration.
Follow the instructions in this post:
http://forum.mikrotik.com/t/forum-rules/173010/1
and post your full configuration.

MikeM45 · August 11, 2024, 4:19pm

Hi Jaclaz

Many thanks for your help, hopefully I’ve done this right

# aug/10/2024 21:21:39 by RouterOS 6.49.17
# software id = 
#
# model = RBLHGGR
# serial number = 
/interface lte
set [ find ] allow-roaming=no name=lte1 pin=0000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=wap.vodafone.co.uk
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=ether1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
add list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
    192.168.88.0
add address=10.20.248.246 interface=lte1 network=10.20.248.246
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

jaclaz · August 11, 2024, 5:50pm

Yep, the export is fine.

You seemingly have the LTE IP address set manually:

/ip address
...
add address=10.20.248.246 interface=lte1 network=10.20.248.246

Are you sure-sure that this is what you need/want?

AFAIK in LTE connection the address of the LTE interface is automatically assigned by the ISP, and there is not an explicit assignment of it when doing an export.

You seem in a situation very similar to the one here:
http://forum.mikrotik.com/t/mikrotik-lhg-lte6-kit-lte-is-disconnecting/170914/1

Try disabling that address.

I am sure it can be done also in the GUI, but it is easier/faster if you open a terminal window and try running in it:
/ip address print
/ip address disable [find address=“10.20.248.246”]

Explanation:
When you run the first print command it will show the current IP addresses assigned, with a number besides them, very likely the 192.168.88.1/24 is #0 and the 10.20.248.246 is #1, but I cannot be sure from here, if this is the case the command:
/ip address disable 1
is simpler and will work the same, but the previous one should work and risk not disabling the “wrong” address.

Then run again:
/ip address print
that IP address should be marked as disabled.

infabo · August 11, 2024, 6:04pm

I like that. Mike forgot to mention he set an IP address manually. Mikrotik jeopardy

MikeM45 · August 11, 2024, 6:21pm

Hi jaclaz
I have done exactly as you said but don’t think it disabled it
IP disable.png
I will try using disable 1

MikeM45 · August 11, 2024, 6:32pm

Hi
/ip address disable 1 worked
IP Disable2.png

MikeM45 · August 11, 2024, 6:48pm

I have rebooted but still no internet- 1 blue LED and 2 greens ( see attached)

MikeM45 · August 11, 2024, 6:55pm

Lol… if I did, I have absolutely no idea how I did it!!

MikeM45 · August 11, 2024, 7:10pm

Configuration after disabling IP address and reboot

# aug/11/2024 20:07:03 by RouterOS 6.49.17
# software id =
#
# model = RBLHGGR
# serial number = 
/interface lte
set [ find ] allow-roaming=no name=lte1 pin=0000
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=wap.vodafone.co.uk
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=ether1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
add list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
    192.168.88.0
add address=10.20.248.246 disabled=yes interface=lte1 network=10.20.248.246
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

MikeM45 · August 11, 2024, 7:39pm

Working now, thanks for the help jaclaz

jaclaz · August 11, 2024, 8:17pm

Good.
I forgot to say that you should have rebooted to see the effects.
Very likely disabling and then reenabling the LTE interface would have been enough, but rebooting is actually better as it is already a “test” of what will happen next time you lose power or need to reboot for other reasons.

@infabo
I suspect that in certain circumstances (Ros upgrade? Quickset run more than once?) the IP can remain “sticky” (actually loses the Dynamic flag and thus becomes static.
I also suspect that this happens more often than what is reported on the forum because the problem only occurs if the IP that becomes static is lower than the dynamic one, as RoS seems to “prefer” the lowest address when an interfaces has multiple ones.

@MikeM45
Now you can safely delete (remove) the disabled address.

The command probably didn’t work as It should have been:

/ip address disable [find address=“10.20.248.246/32”]

The /32 must be somehow implied when exporting but the actual entry has it (and print shows it).

Try:

/ip address remove [find address=“10.20.248.246/32”]