Hi!
I’m fairly new to MT and would like to ask your help to get a fairly basic, static routing scenario to work on a hap AC. There are two directly connected networks:
192.168.33.0/24 - bridge with 3 switch ports and one wifi interface.
192.168.34.0/24 - one switch port leading to a super secure network segment. Access will be restricted later - out of scope for now.
Ping works from 192.168.33.0/24 to 192.168.34.0/24, but not vice versa. So let’s assume that 192.168.34.1 wants to ping 192.168.33.1. Ping request arrives at 192.168.33.1, which sends an icmp echo back. The icmp echo arrives at the Mikrotik router, but is not routed back to 192.168.34.1.
The same goes for other protocols, not just for icmp. The configuration of the hap AC is attached.
Thanks for any input!
Cheers,
Csabi
# apr/07/2020 14:29:15 by RouterOS 6.44.5
# software id = S1GZ-KBKR
#
# model = RB952Ui-5ac2nD
# serial number = BEB80B62A393
/interface bridge
add admin-mac=C4:AD:34:59:BA:77 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether4 ] name=ether4-sec
set [ find default-name=ether1 ] name=wan
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=2 band=2ghz-g/n channel-width=20/40mhz-XX country=austria disabled=no distance=indoors frequency=auto frequency-mode=regulatory-domain installation=indoor mode=ap-bridge ssid=canweeat wds-default-bridge=bridge wds-mode=\
dynamic wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] antenna-gain=2 band=5ghz-n/ac channel-width=20/40/80mhz-XXXX country=austria distance=indoors frequency=auto frequency-mode=regulatory-domain installation=indoor mode=ap-bridge ssid=canweeat wireless-protocol=802.11 wps-mode=disabled
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=CanweeatDatapath
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/caps-man configuration
add country=austria datapath=CanweeatDatapath datapath.bridge=bridge datapath.client-to-client-forwarding=yes datapath.interface-list=all datapath.local-forwarding=yes installation=any mode=ap name=CanweeatConfig security.authentication-types=wpa2-psk \
security.encryption=aes-ccm ssid=canwecap
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=dynamic-keys name=guest-profile supplicant-identity=primary
/interface wireless
add arp=reply-only default-forwarding=no disabled=no mac-address=C6:AD:34:59:BA:7C master-interface=wlan1 name=wlan3 security-profile=guest-profile ssid=guest wds-default-bridge=bridge wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.33.100-192.168.33.200
add name=dhcp_pool1 ranges=192.168.35.100-192.168.35.200
add name=dhcp_pool2 ranges=192.168.34.100-192.168.34.199
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=50m name=defconf
add add-arp=yes address-pool=dhcp_pool1 disabled=no interface=wlan3 name=dhcp2
add address-pool=dhcp_pool2 disabled=no interface=ether4-sec name=dhcp1
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=bridge
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=CanweeatConfig slave-configurations=CanweeatConfig
/interface bridge filter
# in/out-bridge-port matcher not possible when interface (wlan3) is not slave
add action=drop chain=forward in-interface=wlan3
# in/out-bridge-port matcher not possible when interface (wlan3) is not slave
add action=drop chain=forward out-interface=wlan3
# no interface
add action=drop chain=forward in-interface=*A
# no interface
add action=drop chain=forward out-interface=*A
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=*A
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=wan list=WAN
add interface=ether4-sec list=LAN
/interface wireless cap
set bridge=bridge caps-man-addresses=192.168.33.254 discovery-interfaces=bridge interfaces=wlan1
/ip address
add address=192.168.33.254/24 comment=defconf interface=ether2 network=192.168.33.0
add address=192.168.35.254/24 comment="Guest wifi" interface=wlan3 network=192.168.35.0
add address=192.168.34.254/24 comment="Link to the secure network segment" interface=ether4-sec network=192.168.34.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=wan
/ip dhcp-server lease
add address=192.168.33.190 address-lists=sa client-id=1:84:b8:b8:bd:a7:6c comment="tablet1" mac-address=84:B8:B8:BD:A7:6C server=defconf
add address=192.168.33.117 client-id=1:ac:d1:b8:4f:1a:7 comment=Printer mac-address=AC:D1:B8:4F:1A:07 server=defconf
add address=192.168.33.111 address-lists=sa comment="telefon1" mac-address=38:78:62:E7:38:E3 server=defconf
add address=192.168.33.189 address-lists=sa client-id=1:c:51:1:c5:2a:d0 comment="tablet2" mac-address=0C:51:01:C5:2A:D0 server=defconf
add address=192.168.33.113 address-lists=sa client-id=1:c0:d0:12:c2:89:a7 comment="telefon2" mac-address=C0:D0:12:C2:89:A7 server=defconf
/ip dhcp-server network
add address=192.168.33.0/24 comment=defconf dns-server=8.8.8.8 gateway=192.168.33.254 netmask=24
add address=192.168.34.0/24 comment="Secure segment - SS" dns-server=8.8.8.8 gateway=192.168.34.254
add address=192.168.35.0/24 comment="Guest wifi" dns-server=8.8.8.8 gateway=192.168.35.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.33.254 name=router.lan
add address=192.168.33.254 name=primary
add address=192.168.33.252 name=secondary
add address=192.168.33.253 name=rpi
add address=192.168.33.200 name=webcam
add address=192.168.33.9 name=hue
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="No inet for hue" out-interface=wan src-address=192.168.33.9
add action=drop chain=forward comment="Only inet for guests" in-interface=wlan3 out-interface=!wan
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=1194 in-interface=wan protocol=udp to-addresses=192.168.33.253 to-ports=1194
add action=dst-nat chain=dstnat dst-port=22 in-interface=wan protocol=tcp to-addresses=192.168.33.253 to-ports=22
/ip service
set winbox disabled=yes
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=primary
/tool graphing interface
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN