Can't access to RB960PGS in bridge mode (latest 6.44)

RouterOS Beginner Basics
1

Hello,

I’m setting up a brand new RB960PGS (hEX PoE).
I intend to use it as a switch.
After unboxing, I uploaded latest 6.44 using QuickFig web app.
I then selected Bridge mode with using QuickFig.

Just after doing this, I can’t access the box anymore:

  • the box replies to pings (100% sure),
  • but I can’t either connect through SSH nor Webfig nor whatever (nmap even replies “Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn”) though any Ethernet port.

If my memory serves me right, I didn’t observed this with 6.43.8 and another RB960PGS unit.

  1. Has anyone seen something similar ?
  2. I can connect to the RB960PGS with Winbox (and box MAC address) but how can I display or copy its config (/export file=allconfig works but I copy this file from a remote box) ?
  3. Suggestions ?

Best regards

2

The exported config file should be visible under Files menu … and you should be able to download it from there.

3

I could insert a USB key in RB960PGS and export a file there.

Anyway, when IP communications are broken and you don’t have any USB key or slot at hand, how would you proceed to download/upload anything strictly using Winbox ?

4

Huh, I’ve always though you can transfer a file also when using MAC winbox connection. Are you saying it doesn’t work?

5

Not exactly: after searching in Winbox GUI, I couldn’t find a way to do it.
Either this feature doesn’t exist anymore, or I simply didn’t find it.

6

Summary:
With a 6.44-powered RB960PGS, as soon as I apply Bridge mode:

  • I cannot access to the RB960PGS through its web app and any Ethernet port
  • I can connect to it with Winbox and its MAC address
  • the box replies to pings.

Here is the (anonymized) config (/export file=/disk1/allconfig).
What shall I change bellow to access to its management app again ?

# mar/07/2019 18:31:04 by RouterOS 6.44
# software id = VYAX-AUIA
#
# model = 960PGS
# serial number = A5150922222
/interface bridge
add admin-mac=B8:69:F4:AA:AA:86 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set ipsec-secret=mysecret use-ipsec=yes
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
/interface sstp-server server
set default-profile=default-encryption
/ip address
add address=192.168.64.88/24 comment=defconf interface=ether2 network=\
    192.168.64.0
add address=192.168.64.88/24 disabled=yes interface=ether1 network=\
    192.168.64.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=bridge
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.64.125
/ip dns static
add address=192.168.64.88 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
    protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    192.168.89.0/24
/ip route
add distance=1 gateway=192.168.64.253
/ppp secret
add name=vpn password=mysecret
/system clock
set time-zone-name=Europe/Paris
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
7

A couple of things that might make a difference or not:

Remove ether1 from WAN interface list, add it to LAN interface list. Add bridge to LAN interface list.
Move IP address from ether2 to bridge.

Probably most of firewall rules are not needed any more or should be reworked (I see a ppp interface there).

8

These recommendations make sense: I’ll try these ASAP and report here.

My understanding of the whole purpose of so-called Router or Bridge in QuickSet was to pack sensible settings together.
If I’m not mistaken, current 6.44 Bridge mode introduces very surprising settings..

9

In recent history there were a few ROS releases that didn’t have very sensible default settings (noticed in firewall filter section) … which don’t become obvious if on only upgrades older ROS (as settings are kept). So one can wonder if weird settings are intended or a mis-step …