I have two PPPoE connections from two modems and use the Mikrotik to bond two lousy speeds to one tolerable one.
I have a NAS device on my LAN which can be accessed via WAN and Upnp but it wants to recognise an external interface with an external IP address and I have two with that same external IP.
Any way I can make this work. Can I set up a bridge with ports WAN1, WAN2 and LAN?
Thanks
I need a bit more info. Can you post your export and maybe a diagram? Are the interfaces actually bonded?
[admin@SikroTik] > /export compact
/interface bridge
add l2mtu=1598 name=bridge1
/interface ethernet
set 4 master-port=ether2
/interface wireless
set 0 band=2ghz-b/g/n country="united kingdom" disabled=no frequency=2457 l2mtu=2290 mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm wpa-pre-shared-key=xxxxxxxx wpa2-pre-shared-key=xxxxxxxx
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip pool
add name=dhcp ranges=192.168.1.11-192.168.1.254
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge1 name=dhcp1
/ppp profile
add name=ADSL use-compression=no use-encryption=no use-mpls=no use-vj-compression=no
/interface pppoe-client
add allow=pap,chap disabled=no interface=ether1 max-mru=1492 max-mtu=1492 name=A&A1 password=xxxxxxxxxx profile=ADSL use-peer-dns=yes user=xxxx@a.1
add allow=pap,chap disabled=no interface=ether3 max-mru=1492 max-mtu=1492 name=A&A2 password=xxxxxxxxxx profile=ADSL use-peer-dns=yes user=xxxx@a.2
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wlan1
/ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
add address=192.168.1.0/24 interface=wlan1 network=192.168.1.0
/ip dhcp-server lease
add address=192.168.1.86 client-id=1:0:23:69:ac:62:12 mac-address=00:23:xx:AC:xx:12 server=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=217.169.20.20,217.169.20.21
/ip firewall address-list
add address=192.168.1.0/24 list=support
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you need this subnet before enable it" disabled=yes list=bogons
add address=127.0.0.0/16 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you need this subnet before enable it" disabled=yes list=bogons
add address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C # Check if you need this subnet before enable it" disabled=yes list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment="MC, Class D, IANA # Check if you need this subnet before enable it" disabled=yes list=bogons
/ip firewall filter
add chain=input protocol=icmp
add chain=input connection-state=established
add chain=input connection-state=related
add action=drop chain=input in-interface=ether1
add action=drop chain=input in-interface=ether3
add chain=input protocol=icmp
add chain=input connection-state=established
add chain=input connection-state=related
add action=add-src-to-address-list address-list=Syn_Flooder address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except to support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT ADDRESS LIST" disabled=yes dst-port=8291 protocol=tcp src-address-list=!support
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=3h chain=forward comment="Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 protocol=tcp src-address-list=spammers
add chain=input comment="Accept DNS - UDP" disabled=yes port=53 protocol=udp
add chain=input comment="Accept DNS - TCP" disabled=yes port=53 protocol=tcp
add chain=input comment="Accept to established connections" connection-state=established protocol=tcp
add chain=input comment="Accept to related connections" connection-state=related protocol=tcp
add chain=input comment="Full access to SUPPORT address list" src-address-list=support
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED" disabled=yes
add chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 limit=1,5 protocol=icmp
add chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp
add chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp
add chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=icmp
add chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP protocol=icmp
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add action=drop chain=input disabled=yes dst-port=53 in-interface=A&A1 protocol=udp
add action=drop chain=input dst-port=53 in-interface=all-ppp protocol=udp
add action=drop chain=input dst-port=53 in-interface=all-ppp protocol=tcp
add action=drop chain=input disabled=yes dst-port=53 in-interface=A&A1 protocol=tcp
add action=drop chain=input disabled=yes dst-port=53 in-interface=A&A2 protocol=udp
add action=drop chain=input disabled=yes dst-port=53 in-interface=A&A2 protocol=tcp
/ip firewall mangle
add action=mark-packet chain=prerouting new-packet-mark=ONE nth=2,1 src-address=192.168.1.0/24
add action=mark-packet chain=prerouting new-packet-mark=TWO nth=2,2 src-address=192.168.1.0/24
add action=mark-routing chain=prerouting new-routing-mark=ONE packet-mark=ONE passthrough=no
add action=mark-routing chain=prerouting new-routing-mark=TWO packet-mark=TWO passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=A&A1 to-addresses=0.0.0.0
add action=masquerade chain=srcnat disabled=yes out-interface=A&A2 to-addresses=0.0.0.0
add action=masquerade chain=srcnat out-interface=all-ppp to-addresses=0.0.0.0
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=9091 protocol=tcp to-addresses=192.168.1.89 to-ports=9091
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=15000 in-interface=all-ppp protocol=tcp to-addresses=192.168.1.89 to-ports=15000
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=1412 in-interface=all-ppp protocol=tcp to-addresses=192.168.1.89 to-ports=1412
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=15004 in-interface=all-ppp protocol=udp to-addresses=192.168.1.89 to-ports=15004
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=1412 in-interface=all-ppp protocol=udp to-addresses=192.168.1.89 to-ports=1412
add action=dst-nat chain=dstnat dst-address=81.187.xx.xx dst-port=51413 protocol=tcp to-addresses=192.168.1.89 to-ports=51413
/ip route
add check-gateway=ping distance=1 gateway=A&A1 routing-mark=ONE
add check-gateway=ping distance=1 gateway=A&A2 routing-mark=TWO
add check-gateway=ping distance=2 gateway=A&A1,A&A2
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set www-ssl disabled=no
/ip upnp
set allow-disable-external-interface=no enabled=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=ether5 type=internal
add interface=A&A2 type=external
add interface=A&A1 type=external
/system clock
set time-zone-name=Europe/London
/system identity
set name=SikroTik
/system leds
set 0 interface=wlan1
/system logging
add topics=firewall
add topics=pppoe
add topics=interface
[admin@SikroTik] >