Destination net unreachable on local network!

RouterOS Beginner Basics
1

Hi guys,

I used a clean install of MikroTik RouterOS 4.17 x86 to setup a hotspot according to the manual:

http://wiki.mikrotik.com/wiki/Hotspot_server_setup and
http://wiki.mikrotik.com/wiki/Manual:IP/Hotspot

The Problem:

Machines on the local network cannot connect to anything on the same local network.
It appears the MT Hotspot is hijacking all the local traffic.

Machines are receiving the message “Destination net unreachable / prohibited” when pinging and also can’t connect to other services (http, https)

on servers in the local network.

Here’s the network diagram:

Here’s an example from PC ‘winxp’. Firewalls are disabled on the machines for the purpose of testing:

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : winxp
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : vmxnet3 Ethernet Adapter
        Physical Address. . . . . . . . . : 00-0C-29-C5-B6-58
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.100.99
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.100.254
        DHCP Server . . . . . . . . . . . : 192.168.100.254
        DNS Servers . . . . . . . . . . . : 192.168.100.254
                                            192.168.100.254
                                            10.10.10.2
        Lease Obtained. . . . . . . . . . : Monday, 28 March 2011 9:36:33 PM
        Lease Expires . . . . . . . . . . : Monday, 28 March 2011 10:36:33 PM

C:\Documents and Settings\Administrator>ping 192.168.100.98

Pinging 192.168.100.98 with 32 bytes of data:

Reply from 192.168.100.98: bytes=32 time<1ms TTL=128
Reply from 192.168.100.254: Destination net unreachable.
Reply from 192.168.100.254: Destination net unreachable.
Reply from 192.168.100.254: Destination net unreachable.

Ping statistics for 192.168.100.98:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Administrator>ping 192.168.100.98

Pinging 192.168.100.98 with 32 bytes of data:

Reply from 192.168.100.254: Destination net unreachable.
Reply from 192.168.100.254: Destination net unreachable.
Reply from 192.168.100.254: Destination net unreachable.
Reply from 192.168.100.254: Destination net unreachable.

Ping statistics for 192.168.100.98:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

If I disable the hotspot1 on the MikroTik the results are normal:

C:\Documents and Settings\Administrator>ping 192.168.100.98

Pinging 192.168.100.98 with 32 bytes of data:

Reply from 192.168.100.98: bytes=32 time<1ms TTL=128
Reply from 192.168.100.98: bytes=32 time<1ms TTL=128
Reply from 192.168.100.98: bytes=32 time<1ms TTL=128
Reply from 192.168.100.98: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.100.98:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

The PCs are trying to reach servers on the local subnet through the routeros gateway!
This makes no sense to me and I don’t know how to troubleshoot the problem.
Why are PCs on the local network using the routeros gateway to connect to servers in the same network segment?

Thanks for any help


Extra Information:

The test environment is created on a vmware ESX4.1 cluster.

CONFIGURATION:

[admin@MikroTik] > / ip address add address=10.10.10.56/24 network=10.10.10.0 broadcast=10.10.10.255 interface=ether1          
[admin@MikroTik] > / ip address add address=192.168.100.254/24 network=192.168.100.0 broadcast=192.168.100.255 interface=ether2
[admin@MikroTik] > / ip route add dst-address=0.0.0.0/0 gateway=10.10.10.254


[admin@MikroTik] > ip address print
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         BROADCAST       INTERFACE
 0   10.10.10.56/24     10.10.10.0      10.10.10.255    ether1
 1   192.168.100.254/24 192.168.100.0   192.168.100.255 ether2


[admin@MikroTik] > ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - 

prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 A S  0.0.0.0/0                          10.10.10.254       1       
 1 ADC  10.10.10.0/24      10.10.10.56     ether1             0       
 2 ADC  192.168.100.0/24   192.168.100.254 ether2             0




[admin@MikroTik] > / ip dns set servers=10.10.10.1,10.10.10.2 allow-remote-requests=yes

[admin@MikroTik] > ip dns print
                servers: 10.10.10.1,10.10.10.2
  allow-remote-requests: yes
    max-udp-packet-size: 512
             cache-size: 2048KiB
          cache-max-ttl: 1w
             cache-used: 5KiB




[admin@MikroTik] > / ip hotspot setup
Select interface to run HotSpot on 

hotspot interface: ether2
Set HotSpot address for interface 

local address of network: 192.168.100.254/24
masquerade network: yes
Set pool for HotSpot addresses 

address pool of network: 192.168.100.51-192.168.100.99 
Select hotspot SSL certificate 

select certificate: none                    
Select SMTP server 

ip address of smtp server: 0.0.0.0
Setup DNS configuration 

dns servers: 192.168.100.254      
DNS name of local hotspot server 

dns name: mttest.test
Create local hotspot user 

name of local hotspot user: admin
password for the user: xxxx




[admin@MikroTik] > ip hotspot print
Flags: X - disabled, I - invalid, S - HTTPS 
 #   NAME                                  INTERFACE                                 ADDRESS-POOL                                 PROFILE        

                         IDLE-TIMEOUT
 0   hotspot1                              ether2                                    hs-pool-2                                    hsprof1        

                         5m




[admin@MikroTik] > ip pool print
 # NAME                                                                                                                                          

      RANGES                         
 0 hs-pool-2                                                                                                                                     

      192.168.100.51-192.168.100.99




[admin@MikroTik] > ip dhcp-server export
# mar/28/2011 10:38:10 by RouterOS 4.17
# software id = D1KX-CN8P
#
/ip dhcp-server
add address-pool=hs-pool-2 authoritative=after-2sec-delay bootp-support=static disabled=no interface=ether2 lease-time=1h name=dhcp1
/ip dhcp-server config
set store-leases-disk=5m
/ip dhcp-server network
add address=192.168.100.0/24 comment="hotspot network" gateway=192.168.100.254




[admin@MikroTik] > ip pool export
# mar/28/2011 10:38:29 by RouterOS 4.17
# software id = D1KX-CN8P
#
/ip pool
add name=hs-pool-2 ranges=192.168.100.51-192.168.100.99




[admin@MikroTik] > ip dhcp-server print 
Flags: X - disabled, I - invalid 
 #   NAME                                        INTERFACE                                       RELAY           ADDRESS-POOL                    

                   LEASE-TIME ADD-ARP
 0   dhcp1                                       ether2                                                          hs-pool-2                       

                   1h




[admin@MikroTik] > ip firewall nat print 
Flags: X - disabled, I - invalid, D - dynamic 
 0 X ;;; place hotspot rules here
     chain=unused-hs-chain action=passthrough 

 1   ;;; masquerade hotspot network
     chain=srcnat action=masquerade src-address=192.168.100.0/24




[admin@MikroTik] > ip firewall export
# mar/28/2011 10:42:10 by RouterOS 4.17
# software id = D1KX-CN8P
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-

timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="masquerade hotspot network" disabled=no src-address=192.168.100.0/24
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
2

Can you please post a network diagram?
How do clients get an IP address? If it’s DHCP, can you please post the output of “/ip dhcp-server export” and “/ip pool export”, wrapped in

 tags?
3

Hi fewi,

Thanks for the reply.

I edited the original post to give better detail.

4

I meant a picture of how things connect. Does the traffic between hosts flow through the router?
Do you have proxy ARP enabled, or are you running a Hotspot?

5

Hi fewi,

Thanks for the reply.

I edited the original post to give better detail.

6

That is outstanding detail, thanks for an excellent post.

The Hotspot is ARP poisoning your network as it wants to draw all traffic to it. I will lab this out today, but try turning off the Universal NAT function by setting the address pool on the Hotspot to ‘none’. Universal NAT works by pretending to be any IP address for any client by answering to ARP requests for anything and then NATing the misconfigured client to a valid IP address. Great when you have a lot of mobile users that you have no control over (selling WiFi at a public Hotspot), but unnecessary for you. Turning off the pool to NAT to turns off universal NAT, and may turn off the ARP poisoning you’re seeing. I’ll try to confirm later, I am not sure if it does. If it doesn’t the only solution would be to turn the Hotspot off. Can I ask what you need the Hotspot for?

7

A quick test confirms that if you leave the address pool on the Hotspot empty (disabling Universal NAT) the Hotspot no longer ARP poisons the network.

8

Thanks, fewi

I set the ‘Address Pool’ field in Hotspot Server ‘hotspot1’ to ‘none’, rebooted and the hotspot is no longer ARP poisoning the network.
I am using the hotspot to allow internet access at a venue.

Thanks again for helping me solve the problem, and thanks for a well priced great product.

9

Hi,
Destination Net Prohibited ping reply coming in LAN form Hotspot gateway.

It is not allowing to other network address to ping or communicate with hosts as per attached diagram.

Here my requirement is to communicate with hosts network address (192.168.100.0/24 & 192.168.1.0/24) & hotspot (IP-10.5.6.1/23) from Ubuntu PCs.


Please advice how to communicate with hosts using IP address range 192.168.100.100-192.168.100.110/24 &
192.168.1.5-192.168.1.10/24

so that I can ping & remote access to Access points & Optical line terminator.
Please find the attachment of diagram & ping report.





susanta@DT1:~$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:21:9b:29:9e:8f brd ff:ff:ff:ff:ff:ff
inet 180.87.201.70/29 brd 180.87.201.71 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::221:9bff:fe29:9e8f/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 48:ee:0c:bb:43:c7 brd ff:ff:ff:ff:ff:ff
inet 10.5.6.30/23 brd 10.5.7.255 scope global eth1
valid_lft forever preferred_lft forever
inet 192.168.100.101/24 brd 192.168.100.255 scope global eth1
valid_lft forever preferred_lft forever
inet 192.168.1.6/24 brd 192.168.1.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::4aee:cff:febb:43c7/64 scope link
valid_lft forever preferred_lft forever
4: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 54:27:1e:4a:2d:93 brd ff:ff:ff:ff:ff:ff
susanta@DT1:~$ ping 10.5.6.1
PING 10.5.6.1 (10.5.6.1) 56(84) bytes of data.
64 bytes from 10.5.6.1: icmp_seq=1 ttl=64 time=0.173 ms
64 bytes from 10.5.6.1: icmp_seq=2 ttl=64 time=0.165 ms
64 bytes from 10.5.6.1: icmp_seq=3 ttl=64 time=0.162 ms
64 bytes from 10.5.6.1: icmp_seq=4 ttl=64 time=0.218 ms
64 bytes from 10.5.6.1: icmp_seq=5 ttl=64 time=0.161 ms
^C
— 10.5.6.1 ping statistics —
5 packets transmitted, 5 received, 0% packet loss, time 3997ms
rtt min/avg/max/mdev = 0.161/0.175/0.218/0.027 ms
susanta@DT1:~$ ping 192.168.1.100
PING 192.168.1.100 (192.168.1.100) 56(84) bytes of data.
From 10.5.6.1 icmp_seq=2 Destination Net Prohibited
From 10.5.6.1 icmp_seq=3 Destination Net Prohibited
From 10.5.6.1 icmp_seq=4 Destination Net Prohibited
From 10.5.6.1 icmp_seq=5 Destination Net Prohibited
From 10.5.6.1 icmp_seq=6 Destination Net Prohibited
^C
— 192.168.1.100 ping statistics —
6 packets transmitted, 0 received, +5 errors, 100% packet loss, time 4999ms

susanta@DT1:~$ ping 192.168.100.151
PING 192.168.100.151 (192.168.100.151) 56(84) bytes of data.
From 10.5.6.1 icmp_seq=2 Destination Net Prohibited
From 10.5.6.1 icmp_seq=3 Destination Net Prohibited
From 10.5.6.1 icmp_seq=4 Destination Net Prohibited
From 10.5.6.1 icmp_seq=5 Destination Net Prohibited
From 10.5.6.1 icmp_seq=6 Destination Net Prohibited
From 10.5.6.1 icmp_seq=7 Destination Net Prohibited
From 10.5.6.1 icmp_seq=8 Destination Net Prohibited
^C
— 192.168.100.151 ping statistics —
8 packets transmitted, 0 received, +7 errors, 100% packet loss, time 6999ms