I am using WAP LTE Kit (passthrough mode via VLAN) and i am having some issued with DHCP Client.
DHCP Client (default route yes):
DHCP Client (default route no, adding route manually)
Any thoughts what i am doing wrong?
You’re doing something wrong.
Enable default route on DHCP client and see what exactly is set by executing /ip address print detail and /ip route print detail. Then configure it statically and execute same commands. Then compare outputs to see what’s different (except for actual IP addresses). Note also subnet masks used, if you configure IP address with wrong subnet mask things will likely break.
Hi Metod,
thanks for your answer.
Its pretty the same except that i am not adding gateway/dst address and pref. source address due to dynamic WAN (not a static connection) but i need manually route for adding comment and execute some scripts.
How can you possibly add a route without a gateway or destination address??
If you are using LTE passthough to another device, so the WAN address is terminated there, the LTE Mikrotik has no access to the WAN - you have to provide access via the other device.
A sketch showing what you are attempting plus the output of /export hide-sensitive would help.
Sorry my fault.
When i tried to add manual route i choosed the created vlan interface.
My WAP LTE Kit hast 2 VLANs. 1 for managment and 1 for passthrough (LTE ISP).
With default route everything is fine but the static doen’t work for any reason. Here the export:
nov/08/2021 20:40:55 by RouterOS 6.49
software id = GHXD-UPYA
model = RB4011iGS+5HacQ2HnD
serial number =
/interface bridge
add name=bridge
add name=bridge_guests
add name=bridge_vtek
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ]
set [ find default-name=ether3 ] comment=“LTE ISP Failover”
set [ find default-name=ether4 ]
set [ find default-name=ether5 ]
set [ find default-name=ether6 ]
set [ find default-name=ether7 ]
set [ find default-name=ether8 ]
set [ find default-name=ether9 ]
set [ find default-name=ether10 ]
set [ find default-name=sfp-sfpplus1 ] comment=“Switch 10G”
/interface vlan
add interface=ether3 name=vlan-wap-isp vlan-id=777
add interface=ether3 name=vlan-wap-mgmt vlan-id=888
add comment=“Optika Telekom” interface=ether1 name=vlan100 vlan-id=100
/interface pppoe-client
add comment=“Telekom Optika” disabled=no interface=vlan100 max-mru=1492 max-mtu=1492 name=pppoe-out user=xxxxxxxx@htnet-dsl
/interface list
add name=WAN
add name=LAN
add name=VPN
/ip pool
add name=dhcp ranges=192.168.89.21-192.168.89.254
add name=dhcp_guests ranges=90.90.90.2-90.90.90.254
add name=dhcp_vtek ranges=192.168.243.201-192.168.243.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=“dhcp main”
add address-pool=dhcp_guests disabled=no interface=bridge_guests name=“dhcp guests”
add address-pool=dhcp_vtek disabled=no interface=bridge_vtek name=“dhcp vtek”
/system logging action
set 0 memory-lines=10000
/interface bridge port
add bridge=bridge_vtek interface=ether9
add bridge=bridge interface=ether10
add bridge=bridge interface=“wlan 2.4g”
add bridge=bridge interface=“wlan 5g”
add bridge=bridge_guests interface=“wlan 2.4 guests”
add bridge=bridge interface=Synology
add bridge=bridge interface=ether5
add bridge=bridge interface=ether7
add bridge=bridge interface=sfp-sfpplus1
add bridge=bridge_guests interface=“wlan 5g guests”
add bridge=bridge interface=Hackintosh
add bridge=bridge comment=“WAP LTE” interface=vlan-wap-mgmt
/interface detect-internet
set detect-interface-list=WAN internet-interface-list=WAN
/interface l2tp-server server
set authentication=chap,mschap1,mschap2 enabled=yes use-ipsec=yes
/interface list member
add interface=bridge list=LAN
add interface=pppoe-out list=WAN
add interface=vlan-wap-isp list=WAN
/ip address
add address=192.168.89.1/24 interface=bridge network=192.168.89.0
add address=90.90.90.1/24 interface=bridge_guests network=90.90.90.0
add address=192.168.243.200/24 interface=bridge_vtek network=192.168.243.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=5m
/ip dhcp-client
add comment=“LTE ISP” default-route-distance=10 disabled=no interface=vlan-wap-isp use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=90.90.90.0/24 gateway=90.90.90.1 netmask=24
add address=192.168.89.0/24 gateway=192.168.89.1 netmask=24
add address=192.168.243.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.243.200
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.89.1 name=router.lan
/ip firewall address-list
add address=studio.matterhorn-music.com list=“WAN IP”
add address=90.90.90.0/24 comment=“Guest Network” list=Guests
add address=192.168.89.0/24 comment=Private list=Private
add address=cloud.mikrotik.com list=“DDNS Mikrotik”
add address=cloud2.mikrotik.com list=“DDNS Mikrotik”
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defcon: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=forward comment=“defcon: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defcon: accept out ipsec policy” ipsec-policy=out,ipsec
add action=accept chain=forward comment=“defcon: forward accept, established, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defcon: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new disabled=yes in-interface=vlan-wap-isp
add action=drop chain=forward comment=“Guests Drop Matterhorn” dst-address=192.168.89.0/24 src-address-list=Guests
add action=drop chain=forward comment=“Guests Drop Doma” dst-address=192.168.88.0/24 src-address-list=Guests
add action=drop chain=forward comment=“Guests Drop Brela” dst-address=192.168.90.0/24 src-address-list=Guests
add action=accept chain=input comment=IPSEC in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=input comment=“IPSEC 500,1701,4500” dst-port=500,1701,4500 in-interface-list=WAN protocol=udp
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.88.0/24 src-address=192.168.89.0/24
add action=accept chain=srcnat dst-address=192.168.90.0/24 src-address=192.168.89.0/24
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add comment=“ISP OPTICAL” distance=1 gateway=pppoe-out
/tool graphing interface
add interface=ether1
add interface=bridge_guests
/tool graphing resource
add allow-address=192.168.89.1/32
Hi Metod,
any thoughts on my previous post. I would be really happy if you could help me somehow fixing the static route for my LTE DHCP client, Thanks
Do you have any static routes here?
/ip route
add comment="ISP OPTICAL" distance=1 gateway=pppoe-out
Is the only route you have?
As I wrote: show exact output of /ip route print and /ip address print (print command shows actual running values which is different than export which shows configuration … in case of dynamic stuff export won’t show much). And we need to see output for both DHCP and static case so we can compare them.
Because “pretty same” is not good enough, the devil hides in details.
Hi attached the printed address and routes.
And, please, copy-paste text outputs (inside [__code] [/code] environment for better readability). You can obfuscate public IP address (but do it in same way in both outputs, e.g. 89.172.x.y and make sure ‘x’ are the same in both cases, ditto ‘y’).
Hi Metod i hope i did it right.
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S ;;; ISP OPTICAL
0.0.0.0/0 pppoe-out 1
1 DS 0.0.0.0/0 178.160.xx.yyy 10
2 A S ;;; Route Studio Zagreb to Brela VLAN10
10.10.10.0/24 50.50.50.1 1
3 ADC 30.30.30.2/32 30.30.30.1 <l2tp-mikrotik_... 0
4 ADC 50.50.50.1/32 50.50.50.3 l2tp-brela 0
5 ADC 90.90.90.0/24 90.90.90.1 bridge_guests 0
6 ADC 172.29.xxx.yy/32 93.138.xx.yyy pppoe-out 0
7 ADC 178.160.xx.yyy/30 178.160.xx.yyy vlan-wap-isp 0
8 A S ;;; Route Studio Zagreb to Doma Zagreb
192.168.88.0/24 30.30.30.2 1
9 ADC 192.168.89.0/24 192.168.89.1 bridge 0
10 A S ;;; Route Studio Zagreb to Brela
192.168.90.0/24 50.50.50.1 1
11 ADC 192.168.243.0/24 192.168.243.200 bridge_vtek 0
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; default configuration
192.168.89.1/24 192.168.89.0 bridge
1 90.90.90.1/24 90.90.90.0 bridge_guests
2 192.168.243.200/24 192.168.243.0 bridge_vtek
3 D 178.160.xx.yyy/30 178.160.xx.yyy vlan-wap-isp
4 D 93.138.xx.yyy/32 172.29.xxx.yy pppoe-out
5 D 30.30.30.1/32 30.30.30.2 <l2tp-mikrotik_doma>
6 D 50.50.50.3/32 50.50.50.1 l2tp-brela
I’ll assume the info you posted is when DHCP adds default route. So the relevant bits are:
/ip address print
3 D 178.160.xx.yyy/30 178.160.xx.yyy vlan-wap-isp
/ip route print
1 DS 0.0.0.0/0 178.160.xx.yyy 10
7 ADC 178.160.xx.yyy/30 178.160.xx.yyy vlan-wap-isp 0
(somehow I doubt that in route line 7 both addresses are exactly the same, only the first one suffixed with /30 netmask, I’d guess the yyy in second address is larger than yyy in first address by 1 but that’s just guessing).
So if you want manually handle the routes via vlan-wap-isp interface, you have to add exactly the same two routes: the route towards 178.160.xx.yyy/30 subnet with gateway set to VLAN interface (line numbered 7 from your route print) and route towards everything (dst-address=0.0.0.0/0 via gateway on 178.160.xx.yyy/30 subnet (line 1 from your route print).
This connected route is added automatically from the IP address and netmask assigned to the interface (line numbered 3 from the /ip address print)
If the LTE service is similar to ones I’ve used the IP address is usually completely different after any disconnect and reconnect, not sticky to a particular cell tower, so it is impossible to add a manual static route as you have no idea what the interface address and gateway will be.
Thanks for your reply and your help. I found a solition with DHCP client script (with default route=yes). The script add the distance, gateway information (in case isp change it) and another route for routing mark). For now it works ok.