Hi, i have a problem whit a configuration in my RB4011iGS+RM, i have a Bridge whit two networks, 192.168.2.0/24 and 192.168.1.0/24. My problem is that i have internet by the network 192.168.2.0/24 but the network 192.168.1.0/24 haven’t internet. what is the problem?.
Sorry my english is bad. in spanish:
Esta es la configuración
[XXX@RB4011iGS+RM] /ip address> print
0 ;;; SALIDA_INT_CLIENTEBR_LAN BR_LAN
“BR_LAN is the name of the Bridge interface
[XXX@RB4011iGS+RM] > ip firewall nat print
15 chain=srcnat action=masquerade src-address=192.168.1.0/24 out-interface=sfp-sfpplus1 log=no log-prefix=“”
16 chain=srcnat action=masquerade src-address=192.168.2.0/24 out-interface=sfp-sfpplus1 log=no log-prefix=“”
[XXXX@RB4011iGS+RM] > interface bridge print
sindy
November 13, 2019, 5:57am
2
Always export the complete configuration (see my automatic signature right below for a howto), as the mistake is always in the part of the configuration which you don’t show because you think it is not important.
My wild guess is that you haven’t configured a row in /ip dhcp-server network for the 192.168.1.0/24, so the clients in that network do not get the gateway and DNS server addresses.
anav
November 13, 2019, 2:49pm
3
Hola Senor
It will show up in your files in winbox, simply download to your desktop open with notepad+++ and then paste here in a post.
Always export the complete configuration (see my automatic signature right below for a howto), as the mistake is always in the part of the configuration which you don’t show because you think it is not important.
My wild guess is that you haven’t configured a row in /ip dhcp-server network for the 192.168.1.0/24, so the clients in that network do not get the gateway and DNS server addresses.
Hi Sindy, the clients on the 192.168.0.1/24 network use static IP so I don’t have a DHCP server configured for them,
sindy
November 13, 2019, 7:02pm
5
In that case, any of (the gateway IP, the netmask, the DNS server) may be wrong in the manual IP configuration of the clients (I guess it is not the case, I’m just trying to list all possible reasons), or some firewall rules may be blocking the traffic, or some bridge rules, or some routes may be wrong, or there may be an IPsec policy stealing the packets from 192.168.1.0, or some rules before the action=masquerade ones in dstnat chain may prevent the packets from getting masqueraded… There’s so many things which may hide in the part of the configuration you wrongly assume to be unrelated
So as you don’t want anyone else to show you the exact place in your configuration, run /tool sniffer quick ip-address=9.9.9.9 on the Tik, and start pinging 9.9.9.9 from one of the clients in 192.168.1.0/24. If everything worked, you would see the echo request to come via etherX or wlanX and via bridge (as this way you sniff on both the member port of the bridge and on the bridge) with a source address of 192.168.1.?, and then leave through sfp1 with the source address of the WAN. Then, you would see the responses to come back via sfp1 towards the WAN IP, and to be forwarded via bridge and then etherX or wlanX with the destination address of 192.168.1.?. Depending on where this ideal picture breaks, you can look into bridge rules, ip firewall rules, routing rules, routes, ipsec policies…
Esta configurado tu regla de NAT para las 2 redes?..
Is your NAT rule made for both of your networks?
In that case, any of (the gateway IP, the netmask, the DNS server) may be wrong in the manual IP configuration of the clients (I guess it is not the case, I’m just trying to list all possible reasons), or some firewall rules may be blocking the traffic, or some bridge rules, or some routes may be wrong, or there may be an IPsec policy stealing the packets from 192.168.1.0, or some rules before the action=masquerade ones in dstnat chain may prevent the packets from getting masqueraded… There’s so many things which may hide in the part of the configuration you wrongly assume to be unrelated
So as you don’t want anyone else to show you the exact place in your configuration, run /tool sniffer quick ip-address=9.9.9.9 on the Tik, and start pinging 9.9.9.9 from one of the clients in 192.168.1.0/24. If everything worked, you would see the echo request to come via etherX or wlanX and via bridge (as this way you sniff on both the member port of the bridge and on the bridge) with a source address of 192.168.1.?, and then leave through sfp1 with the source address of the WAN. Then, you would see the responses to come back via sfp1 towards the WAN IP, and to be forwarded via bridge and then etherX or wlanX with the destination address of 192.168.1.?. Depending on where this ideal picture breaks, you can look into bridge rules, ip firewall rules, routing rules, routes, ipsec policies…
Hi Sandy, this is the config.
/interface bridgefacebook.com ).$"speedtest.net ). $”rymcommunications@gmail.com port=587
Hola si claro, las dos redes están configuradas para salida a internet, si asigno una de las dos a una interfaz individual me da internet por las dos redes, sin embargo cuando asigno las dos redes a la BRIDGE solo me da internet por la red 192.168.2.0/24. aqui esta la configuracion.
/interface bridgefacebook.com ).$"speedtest.net ). $”rymcommunications@gmail.com port=587
sindy
November 13, 2019, 11:00pm
9
No need to post the configuration twice
I cannot see anything except that you use hotspot on the bridge, and although you’ve set the exception for 192.168.1.2-192.168.1.254, it may not work as you expect. Check the firewall rules dynamically created by the hotspot. I never use the hotspot functionality so I do not feel competent to advise on it.
Other than that, your firewall is terribly leaky.
No need to post the configuration twice
I cannot see anything except that you use hotspot on the bridge, and although you’ve set the exception for 192.168.1.2-192.168.1.254, it may not work as you expect. Check the firewall rules dynamically created by the hotspot. I never use the hotspot functionality so I do not feel competent to advise on it.
Other than that, your firewall is terribly leaky.
What do you advise me to improve the firewall?
sindy
November 14, 2019, 11:28am
11
See this recent post on the same subject. Ask related questions here if any remain.
Specifically for your setup, PPTP is a parody on a VPN these days (the security mechanisms used are far too weak). Clients which support PPTP also support L2TP over IPsec and although the setup is equally simple at both ends (Tik and the Windows/Android/MacOS client), the level of security is much higher.
See this recent post on the same subject. Ask related questions here if any remain.
Specifically for your setup, PPTP is a parody on a VPN these days (the security mechanisms used are far too weak). Clients which support PPTP also support L2TP over IPsec and although the setup is equally simple at both ends (Tik and the Windows/Android/MacOS client), the level of security is much higher.
Hi Sandy, at this moment the 192.168.1.0/24 network has access to the internet but I have not made any changes to the configuration
