Begginer help - no internet connection

aldek · May 2, 2026, 4:21am

As i wrote earlier - missed some DNS settings …. and DHCP setting too

Add dhcp pool (and, if exists, delete default one with 192.168.88.10...254)

/ip pool add name=lan-pool ranges=10.10.0.10-10.10.0.254

/ip dhcp-server add add-arp=yes address-pool=lan-pool interface=bridge_lan lease-time=1d name=server1_dhcp_lan

Add DHCP settings for your dhcp clients

/ip dhcp-server network add address=10.10.0.0/24 dns-server=10.10.0.1 gateway=10.10.0.1

Allow access to DNS for LAN clients:

/ip dns set allow-remote-requests=yes

Just remove the weird mix of rules from the firewall and add just a minimum “default” set:

/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP after RAW" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

5. For local devices behind the router to be able to access the internet, local networks must be masqueraded… (see MT doc’s ), so add fw NAT rule:

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN

After that, if you don't make any mistakes, internet access should work.

… and - delete Authorized address list - it`s nonsense, as @raulico noted.

aldek · May 2, 2026, 6:28am

Settings cleared based on previous configuration wishes :

===================

/interface bridge
add name=bridge_lan

/interface ethernet
set [ find default-name=ether13 ] name=ether13_mgmt
set [ find default-name=sfp-sfpplus1 ] name=sfp-sfpplus1_wan

/interface list
add name=WAN
add name=MGMT
add name=LAN

/interface bridge port
add bridge=bridge_lan interface=ether1
add bridge=bridge_lan interface=ether2
add bridge=bridge_lan interface=ether3
add bridge=bridge_lan interface=ether4
add bridge=bridge_lan interface=ether5
add bridge=bridge_lan interface=ether6
add bridge=bridge_lan interface=ether7
add bridge=bridge_lan interface=ether8
add bridge=bridge_lan interface=ether9
add bridge=bridge_lan interface=ether10
add bridge=bridge_lan interface=ether11
add bridge=bridge_lan interface=ether12
add bridge=bridge_lan interface=sfp-sfpplus2
add bridge=bridge_lan interface=sfp-sfpplus3
add bridge=bridge_lan interface=sfp-sfpplus4

Discovery service will be run on the MGMT interface ONLY

This means that only devices connected to this interface will be detected.

see Neighbor discovery - RouterOS - MikroTik Documentation

/ip neighbor discovery-settings
set discover-interface-list=MGMT

/interface list member
add interface=ether13_mgmt list=MGMT
add interface=sfp-sfpplus1_wan list=WAN
add interface=bridge_lan list=LAN
add interface=ether13_mgmt list=LAN

/ip address
add address=10.10.0.1/24 interface=bridge_lan network=10.10.0.0
add address=192.168.77.1/30 interface=ether13_mgmt network=192.168.77.0

/ip dhcp-client
add interface=sfp-sfpplus1_wan name=client1

DHCP addresses pool for LAN clients

/ip pool add name=lan-pool ranges=10.10.0.10-10.10.0.254
/ip dhcp-server
add interface=bridge_lan lease-time=1d name=server1_dhcp_lan address-pool=lan-pool add-arp=yes

DHCP settings (dns and gateway) for LAN client

/ip dhcp-server network add address=10.10.0.0/24 dns-server=10.10.0.1 gateway=10.10.0.1

/ip dns
set servers=8.8.8.8,8.8.4.4,1.1.1.1

Allow LAN clients to be server by the internal DNS server

/ip dns set allow-remote-requests=yes

Minimal default Firewall Rules set

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP after RAW" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN

/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name="RACK - router"
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

TheCat12 · May 2, 2026, 6:55am

Do NOT delete the address list and your firewall rules, since, although a bit of an odd mix, are working as intended. Only allow remote DNS requests and configure the DHCP server:

/ip dns
set allow-remote-requests=yes
/ip pool
add name=pool_lan ranges=10.10.0.2-10.10.0.254
/ip dhcp-server network
add address=10.10.0.0/24 dns-server=10.10.0.1 gateway=10.10.0.1
/ip dhcp-server
set 0 address-pool=pool_lan

If you still don't have internet access, check for missing PPPoE or VLAN settings

jaclaz · May 2, 2026, 9:11am

Like here, right?:

But the address and route from DHCP client look fine:

would that happen if a VLAN or PPPOE setting was needed?

anav · May 2, 2026, 12:27pm

The intent of the authorized firewall address list is simple.
To ensure all users of the router DO NOT have access to config the router.
They only need DNS access……….. Only the admin needs full access on the input chain!!.
That is not foolish that is good practice, shame on you for suggesting otherwise.

What Czen needed to do which he failed twice, so my advice was not thorough enough.
He needs to identify the devices which are the LAN, that belong to him, presumably the admin.

a. desktop
b. laptop
c. smartphone
d. tablet/ipad
e. remote admin devices through wireguard, if any
f. emergency access through port 13.

Note: for iphone/ipad one has to disable the default private MAC address the devices use when connecting to the home AP for access. IN that regard the admin will then be able to set static (in dhcp leases ) all his admin devices so those LANIPs are fixed and the firewall address list is pertinent.

Czez, my apologies if things are getting confusing. If you prefer one on one, help through discord for example that can be arranged.

TheCat12 · May 2, 2026, 12:52pm

My theory is that the IP address Czeczenski receives via DHCP is only used for PtP connection (quite a small netmask for a gateway, don't you think?), and that they need to authenticate themselves one way or another for full internet access

aldek · May 2, 2026, 2:12pm

… What can they do with DNS-access-only? Without other Internet services…

and dhcp server without right dhcp pool, clients with ip from dhcp but without gateway and dns settings…

I am sure it is useless to give advice without understanding the network structure, as well as the purpose and functionality of the clients.

anav · May 2, 2026, 3:12pm

This forum structure is useless because it doesnt provide the new user with any education on how to formulate a decent issue.

aldek · May 2, 2026, 3:50pm

I completely agree with you.

However, I doubt it is possible to enforce a strict formula on all beginners—description of environment, statement + configuration, and problem description. Experience shows that many people do not read the documentation or wiki; “The Problem” becomes their top priority, and they expect someone knowledgeable to solve it immediately.

Creating a structured, relevant knowledge base requires immense effort, with no guarantee of adoption by newbies.

So the current situation is simply a reality we must accept.

And from the communication on the forum, it is clearly seen that there are different types of beginners: those who want to understand and learn, those who came just to solve a problem without understanding what happened, and those who need it done Urgently-Right-Now-Without-Any-Explanations.

DuctView · May 2, 2026, 6:57pm

Such is life. I don't think it is the responsibility of any forum to manage this. Posters can be assumed to be adults ... I gave up at

I can ping both from terminal, but none from [TOOLS → PING]

as I had not a clue as to what terminal where and I don't think it is my responsibility or the responsibility of the forum to jump on people who use [more commonly] unreferenced pronouns or [in this case] insufficiently specific nouns.

mozerd · May 2, 2026, 7:53pm

@Czeczenski

Let’s build a clean, fully segmented, VLAN‑based architecture you can actually paste and adapt.

I’ll give you:

A clear design

A RouterOS v7 config skeleton (CCR2116‑12G‑4S+)

Clean firewall model that won’t silently kill your traffic

Target design

Physical:

WAN: sfp-sfpplus1 → ISP (DHCP)

LAN bridge: bridge_lan with VLAN filtering

Access ports:

ether1 → MGMT (untagged VLAN 10)

ether2 → Users (untagged VLAN 20)

ether3 → Servers (untagged VLAN 30)

ether4 → Guest (untagged VLAN 40)

Trunk ports:

sfp-sfpplus2 → downstream switch (tagged VLANs 10/20/30/40)

Logical VLANs:

VLAN 10 – MGMT: 10.10.10.0/24, gateway 10.10.10.1

VLAN 20 – USERS: 10.10.20.0/24, gateway 10.10.20.1

VLAN 30 – SERVERS: 10.10.30.0/24, gateway 10.10.30.1

VLAN 40 – GUEST: 10.10.40.0/24, gateway 10.10.40.1

Base interfaces and bridge with VLAN filtering

/interface ethernet
set [ find default-name=sfp-sfpplus1 ] name=sfp-sfpplus1_wan
set [ find default-name=sfp-sfpplus2 ] name=sfp-sfpplus2_trunk

/interface bridge
add name=bridge_lan vlan-filtering=yes

/interface bridge port
add bridge=bridge_lan interface=ether1 pvid=10
add bridge=bridge_lan interface=ether2 pvid=20
add bridge=bridge_lan interface=ether3 pvid=30
add bridge=bridge_lan interface=ether4 pvid=40
add bridge=bridge_lan interface=sfp-sfpplus2_trunk

/interface vlan
add name=vlan10_mgmt interface=bridge_lan vlan-id=10
add name=vlan20_users interface=bridge_lan vlan-id=20
add name=vlan30_srv interface=bridge_lan vlan-id=30
add name=vlan40_guest interface=bridge_lan vlan-id=40
VLAN table on the bridge

/interface bridge vlan

VLAN 10 – MGMT

add bridge=bridge_lan vlan-ids=10 tagged=bridge_lan,sfp-sfpplus2_trunk untagged=ether1

VLAN 20 – USERS

add bridge=bridge_lan vlan-ids=20 tagged=bridge_lan,sfp-sfpplus2_trunk untagged=ether2

VLAN 30 – SERVERS

add bridge=bridge_lan vlan-ids=30 tagged=bridge_lan,sfp-sfpplus2_trunk untagged=ether3

VLAN 40 – GUEST

add bridge=bridge_lan vlan-ids=40 tagged=bridge_lan,sfp-sfpplus2_trunk untagged=ether4

IP addressing and DHCP

/ip address
add address=10.10.10.1/24 interface=vlan10_mgmt  comment="MGMT"
add address=10.10.20.1/24 interface=vlan20_users comment="USERS"
add address=10.10.30.1/24 interface=vlan30_srv   comment="SERVERS"
add address=10.10.40.1/24 interface=vlan40_guest comment="GUEST"

/ip pool
add name=pool_mgmt  ranges=10.10.10.100-10.10.10.199
add name=pool_users ranges=10.10.20.100-10.10.20.199
add name=pool_srv   ranges=10.10.30.100-10.10.30.199
add name=pool_guest ranges=10.10.40.100-10.10.40.199

/ip dhcp-server
add name=dhcp_mgmt  interface=vlan10_mgmt  address-pool=pool_mgmt
add name=dhcp_users interface=vlan20_users address-pool=pool_users
add name=dhcp_srv   interface=vlan30_srv   address-pool=pool_srv
add name=dhcp_guest interface=vlan40_guest address-pool=pool_guest

/ip dhcp-server network
add address=10.10.10.0/24  gateway=10.10.10.1  dns-server=10.10.10.1
add address=10.10.20.0/24  gateway=10.10.20.1  dns-server=10.10.20.1
add address=10.10.30.0/24  gateway=10.10.30.1  dns-server=10.10.30.1
add address=10.10.40.0/24  gateway=10.10.40.1  dns-server=10.10.40.1

/ip dns
set servers=8.8.8.8,1.1.1.1 allow-remote-requests=yes

WAN via DHCP and routing

/interface list
add name=WAN
add name=LAN
add name=MGMT

/interface list member
add interface=sfp-sfpplus1_wan list=WAN
add interface=vlan10_mgmt list=MGMT
add interface=vlan10_mgmt list=LAN
add interface=vlan20_users list=LAN
add interface=vlan30_srv list=LAN
add interface=vlan40_guest list=LAN

/ip dhcp-client
add interface=sfp-sfpplus1_wan use-peer-dns=no use-peer-ntp=yes add-default-route=yes
Firewall and NAT (clean, predictable)

/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN comment="NAT: LAN->WAN"

/ip firewall filter

1. INPUT chain – protect router itself

add chain=input action=accept connection-state=established,related comment="INPUT: established,related"
add chain=input action=drop   connection-state=invalid comment="INPUT: drop invalid"

Allow ICMP to router

add chain=input action=accept protocol=icmp comment="INPUT: allow ICMP"

Allow DHCP from ISP

add chain=input action=accept in-interface-list=WAN protocol=udp dst-port=67,68 comment="INPUT: DHCP from ISP"

Allow MGMT subnet to manage router

add chain=input action=accept in-interface=vlan10_mgmt comment="INPUT: MGMT access"

Drop everything else to router

add chain=input action=drop comment="INPUT: drop all else"

2. FORWARD chain – traffic through router

add chain=forward action=accept connection-state=established,related comment="FWD: established,related"
add chain=forward action=drop   connection-state=invalid comment="FWD: drop invalid"

Allow LAN -> WAN

add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="FWD: LAN to WAN"

Inter‑VLAN policy (examples)

MGMT can reach everything

add chain=forward action=accept src-address=10.10.10.0/24 comment="FWD: MGMT to all"

USERS can reach SERVERS, but not MGMT

add chain=forward action=accept src-address=10.10.20.0/24 dst-address=10.10.30.0/24 comment="FWD: USERS to SERVERS"
add chain=forward action=drop   src-address=10.10.20.0/24 dst-address=10.10.10.0/24 comment="FWD: block USERS to MGMT"

GUEST: internet only, no internal

add chain=forward action=drop src-address=10.10.40.0/24 dst-address=10.10.0.0/16 comment="FWD: block GUEST to internal"

Default: drop everything not explicitly allowed

add chain=forward action=drop comment="FWD: drop all else"

Management access (Winbox/SSH)

/tool mac-server mac-winbox
set allowed-interface-list=MGMT

/ip service
set winbox address=10.10.10.0/24
set ssh    address=10.10.10.0/24

DuctView · May 2, 2026, 8:49pm

Let's wait until OP has established basic internet connectivity before establishing a fully segmented vLAN based architecture. Or am I just dumbing things down by wanting to break it down into simple steps?

anav · May 3, 2026, 12:11am

Yeah we need a better understanding of requirements and also some ISP info.

mozerd · May 3, 2026, 4:58am

The OP is a beginner, so I provided a detailed step by step approach that shows the OP the correct approach, as a learning guide, to his Internet connectivity issue … my approach is adaptable to his exact needs.

DuctView · May 3, 2026, 6:32am

Step 1 is to get basic internet connectivity established, no?

So either OP gets that working or we concentrate on making it work, The rest can wait until that step is done, rather than not have that step work and possibly accumulate more issues to cloud everything.

OP is a beginner and needs a step by step approach, right?

mozerd · May 3, 2026, 7:30am

And that is exactly what I laid out for the OP …

A clear design

A RouterOS v7 config skeleton (CCR2116‑12G‑4S+)

Clean firewall model that won’t silently kill your traffic

Czeczenski · May 3, 2026, 7:45am

Sorry to be here so late, but I was on duty.

I have separate mgmt line connected to eth/boot (eth13) on router, so I don’t need separate connection right now.

No one in my house knows anything about the network, I take care of everything, so there's no risk of anyone breaking anything.

I'll continue working on the problem today. I just wanted to point out that I started by studying the basics and YouTube tutorials, but after a few unsuccesses, I came up with the idea to write here. I'm very grateful for all the help.

CGGXANNX · May 3, 2026, 8:04am

This is unnecessary because the IPv4 DHCP client and server in RouterOS completely bypass the IP firewall.

Znevna · May 3, 2026, 8:06am

The LLM that he used doesn't know that, yet.

mozerd · May 3, 2026, 8:34am

You are correct … but the rule does not have a negative impact and is used as a logical teaching instrument — I provided a Skelton framework that ia easily adaptable … BTW, in using ipv6 this rule would be required under the ipv6 Firewall …

/ipv6 firewall filter add action=accept chain=input comment="accept DHCPv6-Client prefix delegation" \
protocol=udp dst-port=546 src-address=fe80::/10