I was wondering my mikrotik cann’t send log to my syslog daemon, found out that mikrotik cann’t ping(timeout) neither access the lan, i am connecting through ppoe-client.
[Solaris@Gateway] /ip address> pr
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; Workstation Usage
192.168.77.1/28 192.168.77.0 Workstation
1 D WAN_IP/32 WAN_GATEWAY ppoe_out
[Solaris@Gateway] /ip route> pr
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 WAN_IP 1
1 ADC WAN_IP/32 WAN_GATEWAY ppoe_out 0
2 ADC 192.168.77.0/28 192.168.77.1 Workstation 0
[Solaris@Gateway] /ip firewall nat> pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=ppoe_out
[Solaris@Gateway] /ip firewall filter> pr
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Allow limited pings
chain=input action=accept protocol=icmp limit=50/5s,2
1 ;;; From our LAN
chain=input action=accept src-address=192.168.77.0/28
in-interface=Workstation
2 ;;; Accept established connections
chain=input action=accept connection-state=established
3 ;;; Accept related connections
chain=input action=accept connection-state=related
8 ;;; Drop invalid connections
chain=input action=drop connection-state=invalid
9 ;;; Log everything else
chain=input action=log log-prefix="DROP INPUT"
10 ;;; NMAP FIN Stealth scan
chain=input action=add-src-to-address-list
tcp-flags=fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w
11 ;;; SYN/FIN scan
chain=input action=add-src-to-address-list tcp-flags=fin,syn protocol=tcp
address-list=port scanners address-list-timeout=2w
12 ;;; SYN/RST scan
chain=input action=add-src-to-address-list tcp-flags=syn,rst protocol=tcp
address-list=port scanners address-list-timeout=2w
13 ;;; FIN/PSH/URG scan
chain=input action=add-src-to-address-list
tcp-flags=fin,psh,urg,!syn,!rst,!ack protocol=tcp
address-list=port scanners address-list-timeout=2w
14 ;;; ALL/ALL scan
chain=input action=add-src-to-address-list
tcp-flags=fin,syn,rst,psh,ack,urg protocol=tcp address-list=port scanners
address-list-timeout=2w
15 ;;; NMAP NULL scan
chain=input action=add-src-to-address-list
tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w
16 ;;; UDP
chain=input action=accept protocol=udp
17 ;;; Drop excess pings
chain=input action=drop protocol=icmp
18 ;;; Drop everything else
chain=input action=drop
I haven’t play around with mikrotik for a while so any helps appreciated.