Hello All,
I am unable to access internet from LAN.
Basic setup: ISP - MikroTik - PC
Ping google from router works.
Config:
/interface bridge
add admin-mac=censored auto-mac=no comment=defconf name=\
"bridge - LAN"
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - WAN"
/interface vlan
add interface="ether1 - WAN" name="vlan31 - WAN" vlan-id=31
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp_pool2 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool2 interface="bridge - LAN" lease-time=1d name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge="bridge - LAN" comment=defconf disabled=yes interface=\
"ether1 - WAN"
add bridge="bridge - LAN" comment=defconf interface=ether2
add bridge="bridge - LAN" comment=defconf interface=ether3
add bridge="bridge - LAN" comment=defconf interface=ether4
add bridge="bridge - LAN" comment=defconf interface=ether5
add bridge="bridge - LAN" comment=defconf interface=ether6
add bridge="bridge - LAN" comment=defconf interface=ether7
add bridge="bridge - LAN" comment=defconf interface=ether8
add bridge="bridge - LAN" comment=defconf interface=ether9
add bridge="bridge - LAN" comment=defconf interface=ether10
add bridge="bridge - LAN" comment=defconf interface=ether11
add bridge="bridge - LAN" comment=defconf interface=ether12
add bridge="bridge - LAN" comment=defconf interface=ether13
add bridge="bridge - LAN" comment=defconf interface=ether14
add bridge="bridge - LAN" comment=defconf interface=ether15
add bridge="bridge - LAN" comment=defconf interface=ether16
add bridge="bridge - LAN" comment=defconf interface=ether17
add bridge="bridge - LAN" comment=defconf interface=ether18
add bridge="bridge - LAN" comment=defconf interface=ether19
add bridge="bridge - LAN" comment=defconf interface=ether20
add bridge="bridge - LAN" comment=defconf interface=ether21
add bridge="bridge - LAN" comment=defconf interface=ether22
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus1
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus2
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/interface detect-internet
set internet-interface-list=WAN
/interface list member
add interface="ether1 - WAN" list=WAN
add interface="bridge - LAN" list=LAN
add interface="vlan31 - WAN" list=WAN
/ip address
add address=192.168.88.1/24 interface="bridge - LAN" network=192.168.88.0
/ip dhcp-client
add interface="vlan31 - WAN"
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 \
netmask=24
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=Europe/Vienna
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Any help appreciated.
Here's how to use search to find info
Start with the default config, your router has no firewall (other than nat masquerade).
See @mkx answer in first link above and @mszru 's follow up
Unlike most people owning MikroTik gear, I’m really not that much into network terminology.
I’ve been using a hap ac2 for the past few years because it’s a great little router and have used it pretty much configured “out of the box”.
I did change a couple of things like SSID and channels etcetera but basically that’s it.
I do keep Router OS and the firmware up to date though.
Now I was forced to choose a different ISP because the company I was subscribed to was bought by some other company.
…
Amm0
August 29, 2025, 12:14am
3
The config looks mostly right AFAIK, assuming WAN via ether1 is coming via VLAN 31. You have a masquerade rule for WAN, and your /interface/vlan is in that list.
Now you have several issues:
detect-internet is not going to help, and may be the source of why internet is not working on LAN:
Change this to none. What's happing is a 2nd "dynamic" DHCP client is being used on ether1 untagged traffic. S Ince you're saying internet is via a VLAN...you do not want detect-internet adding an /ip/dhcp-client for untagged traffic – which is what you're settings are doing.
There other issue is you have no /ip/dns servers set. The DHCP client from WAN may be providing them... But IMO it's better to explicitly set DNS servers in /ip/dns.
Another suggestion be to remove ether1 from /interface/bridge/port - rather than just disable it. This is not technically an issue, but for hygiene if the bridge had nothing to do with ether1/vlan that be cleaner/safer.
Now there is no firewall, which may be a larger but different problem. Your model may not come with a default firewall, or you just excluded that in config. But you likely need some firewall configuration.
What's odd on firewall - other than the lack of one – is you have use-ip-firewall...=yes - this is confusing setting generally, especially without any firewall.
Now I'm not sure why that would cause the WAN not to be forwarded. But unless you really understand MikroTik's firewall logic, this settings may not be desired. Now you do need a some firewall for them to have an effect - so that's your bigger problem here.
Currently, your router tells its DHCP clients in the LAN to use 192.168.88.1 (which is the router itself) as DNS resolver. However your IP -> DNS settings does not have "Allow Remote Requests" enabled. As a result the client devices can't resolve domain names.
Enable that checkbox. But then search for the default MikroTik firewall rules on this forum (there's a post from @rextended ) and apply it.
search tag # rextended default firewall rules
WARNING: default WAN and LAN interface list must be defined
WARNING: if you do not know what you are doing, you probably lose control of your device
MikroTik RouterOS 6.49.19 default firewall rules
for IPv4 must be also created interface lists, remember to correct assign interfaces inside lists and bridge.
/interface list
add name=WAN comment=defconf
add name=LAN comment=defconf
/interface list member
add list=WAN interface=ether1 comment=defco…
Also disable the Use IP Firewall on the bridge setting as @Amm0 mentioned above.
anav
August 29, 2025, 1:55am
5
/interface bridge
add admin-mac=censored auto-mac=no comment=defconf name=\
"bridge - LAN"
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - WAN"
/interface vlan
add interface="ether1 - WAN" name="vlan31 - WAN" vlan-id=31
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp_pool2 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool2 interface="bridge - LAN" lease-time=1d name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge="bridge - LAN" comment=defconf interface=ether2
add bridge="bridge - LAN" comment=defconf interface=ether3
add bridge="bridge - LAN" comment=defconf interface=ether4
add bridge="bridge - LAN" comment=defconf interface=ether5
add bridge="bridge - LAN" comment=defconf interface=ether6
add bridge="bridge - LAN" comment=defconf interface=ether7
add bridge="bridge - LAN" comment=defconf interface=ether8
add bridge="bridge - LAN" comment=defconf interface=ether9
add bridge="bridge - LAN" comment=defconf interface=ether10
add bridge="bridge - LAN" comment=defconf interface=ether11
add bridge="bridge - LAN" comment=defconf interface=ether12
add bridge="bridge - LAN" comment=defconf interface=ether13
add bridge="bridge - LAN" comment=defconf interface=ether14
add bridge="bridge - LAN" comment=defconf interface=ether15
add bridge="bridge - LAN" comment=defconf interface=ether16
add bridge="bridge - LAN" comment=defconf interface=ether17
add bridge="bridge - LAN" comment=defconf interface=ether18
add bridge="bridge - LAN" comment=defconf interface=ether19
add bridge="bridge - LAN" comment=defconf interface=ether20
add bridge="bridge - LAN" comment=defconf interface=ether21
add bridge="bridge - LAN" comment=defconf interface=ether22
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus1
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus2
/interface detect-internet
set internet-interface-list=none
/interface list member
add interface="ether1 - WAN" list=WAN
add interface="bridge - LAN" list=LAN
add interface="vlan31 - WAN" list=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip address
add address=192.168.88.1/24 interface="bridge - LAN" network=192.168.88.0
/ip dhcp-client
add interface="vlan31 - WAN"
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow remote requests servers=1.1.1.1
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
add action=accept chain=input comment="Lan users to services" in-interface-list=LAN
add action=drop chain=input comment="drop all else" { put this rule here but last of all rules to do }
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet" in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=Europe/Vienna
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thank you very much for your help.
The issue was caused by the fact that I had ISP router plugged into my MikroTik router.
ISP - MikroTik - PC
|
ISP Router
My PC was somehow getting IP from wrong dhcp server.
Anyway I incorporated all your suggestions into my configuration like so:
# 2025-08-29 09:01:02 by RouterOS 7.19.4
# software id = G1B1-6CEN
#
# model = CRS326-24G-2S+
/interface bridge
add admin-mac=censored auto-mac=no comment=defconf name="bridge - LAN"
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - WAN"
/interface vlan
add interface="ether1 - WAN" name="vlan31 - WAN" vlan-id=31
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp_pool2 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool2 interface="bridge - LAN" lease-time=1d name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge="bridge - LAN" comment=defconf interface=ether2
add bridge="bridge - LAN" comment=defconf interface=ether3
add bridge="bridge - LAN" comment=defconf interface=ether4
add bridge="bridge - LAN" comment=defconf interface=ether5
add bridge="bridge - LAN" comment=defconf interface=ether6
add bridge="bridge - LAN" comment=defconf interface=ether7
add bridge="bridge - LAN" comment=defconf interface=ether8
add bridge="bridge - LAN" comment=defconf interface=ether9
add bridge="bridge - LAN" comment=defconf interface=ether10
add bridge="bridge - LAN" comment=defconf interface=ether11
add bridge="bridge - LAN" comment=defconf interface=ether12
add bridge="bridge - LAN" comment=defconf interface=ether13
add bridge="bridge - LAN" comment=defconf interface=ether14
add bridge="bridge - LAN" comment=defconf interface=ether15
add bridge="bridge - LAN" comment=defconf interface=ether16
add bridge="bridge - LAN" comment=defconf interface=ether17
add bridge="bridge - LAN" comment=defconf interface=ether18
add bridge="bridge - LAN" comment=defconf interface=ether19
add bridge="bridge - LAN" comment=defconf interface=ether20
add bridge="bridge - LAN" comment=defconf interface=ether21
add bridge="bridge - LAN" comment=defconf interface=ether22
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus1
add bridge="bridge - LAN" comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add interface="ether1 - WAN" list=WAN
add interface="bridge - LAN" list=LAN
add interface="vlan31 - WAN" list=WAN
/ip address
add address=192.168.88.1/24 interface="bridge - LAN" network=192.168.88.0
/ip dhcp-client
add interface="vlan31 - WAN"
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
add action=accept chain=input comment="Lan users to services" in-interface-list=LAN
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=internet in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=Europe/Vienna
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
anav
August 29, 2025, 1:05pm
7
The important part is having a decent basic firewall in place!!
