I have used my mikrotik hex s for quite some time but ever since i used it my discord voice calls do not work for some reason.
I largely accepted this, but today i checked and through a bit of digging i found that disabling fasttrack in my ipv4 firewall fixes this issue, or allowing all traffic with dst-addr of my pc works
this seems like an issue with fasttrack to me, however i did not change anything with connection tracking, and it was broken from the start like this for me
i have updated my router os to 7.23 but didn't seem to fix it, am i missing something fundamental here?
# 2026-06-14 19:11:26 by RouterOS 7.22.3
# software id = FM9S-687M
#
# model = RB750Gr3
# serial number = < serial removed >
/interface bridge
add admin-mac=04:F4:1C:69:93:C3 auto-mac=no comment=defconf name=bridge
vlan-filtering=yes
/interface ethernet
set \[ find default-name=ether2 \] advertise=1G-baseT-full
/interface wireguard
add listen-port=51821 mtu=1420 name=wg-herren
add listen-port=51820 mtu=1280 name=wg1
/interface vlan
add interface=bridge name=herren-vlan vlan-id=30
add interface=bridge name=management-vlan vlan-id=10
add interface=ether1 name=vlan1 vlan-id=7
add interface=bridge name=vm-vlan vlan-id=20
/interface pppoe-client
add ac-name=dus1901aihr001 add-default-route=yes allow=pap,chap,mschap2
disabled=no interface=vlan1 name=pppoe-out1 user=
1und1/ui7607-407@online.de
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment="basically everything" name=REACH_INTERNET
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=ether4-pool ranges=10.67.13.10-10.67.13.244
add name=vm-pool ranges=10.69.82.10-10.69.82.254
add name=herren-netz ranges=10.67.12.10-10.67.12.254
add name=management-vlan ranges=10.110.194.10-10.110.194.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
# Interface not running
add address-pool=ether4-pool interface=ether4 name=ether4-server
server-address=10.67.12.1
add address-pool=vm-pool interface=vm-vlan name=vm-server
add address-pool=herren-netz interface=herren-vlan name=herren-vlan
server-address=10.67.12.1
add address-pool=management-vlan interface=management-vlan name=
management-vlan server-address=10.110.194.1
/ipv6 pool
add name="ula pool" prefix=fd24:2c80:5d49::/48 prefix-length=64
/ppp profile
set \*0 on-up="/ipv6 dhcp-client renew \[find interface=pppoe-out1\]"
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf disabled=yes interface=ether4
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=ether5 pvid=10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=ether3 untagged=ether5,ether2 vlan-ids=10
add bridge=bridge tagged=ether3 vlan-ids=20,30
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=pppoe-out1 list=WAN
add interface=ether4 list=REACH_INTERNET
add interface=management-vlan list=REACH_INTERNET
add interface=vm-vlan list=REACH_INTERNET
add interface=herren-vlan list=REACH_INTERNET
/interface wireguard peers
add allowed-address=192.168.87.2/32,fd96:1394:939d::2/128 client-address=
192.168.88.201/24,fd96:1394:939d::2/64 client-endpoint=
<public v6> interface=wg1 name=peer1 public-key=
"QR8M19qfTKv7uJXj5npY/sNK4o3qs/MikkT9sDUAVSQ="
add allowed-address=
10.28.50.1/32,fd45:1b5b:67e6::1/128,10.28.47.1/24,fd45:1b5b:88e6::1/64
endpoint-address=shiori.ptm.icu endpoint-port=4242 interface=wg-herren
name=peer3 public-key="Unt8isfR33RhSDraiNF3ypsCR0JguKcQUENUeCdn320="
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=192.168.87.1/24 interface=wg1 network=192.168.87.0
add address=10.28.50.2/24 interface=wg-herren network=10.28.50.0
add address=10.67.13.1/24 interface=ether4 network=10.67.13.0
add address=10.110.194.1/24 interface=management-vlan network=10.110.194.0
add address=10.69.82.1/24 interface=vm-vlan network=10.69.82.0
add address=10.67.12.1/24 interface=herren-vlan network=10.67.12.0
/ip dhcp-server lease
add address=192.168.88.247 client-id=1:bc:24:11:f1:55:b9 mac-address=
BC:24:11:F1:55:B9 server=defconf
add address=192.168.88.243 mac-address=BC:24:11:25:63:E4 server=defconf
/ip dhcp-server network
add address=10.67.12.0/24 comment=herren-net dns-server=10.67.12.1 gateway=
10.67.12.1 netmask=24
add address=10.67.13.0/24 comment=ether4 dns-server=10.67.13.1 gateway=
10.67.13.1 netmask=24
add address=10.69.82.0/24 comment=vm-network dns-server=10.69.82.1 domain=
servers.<mydomain> gateway=10.69.82.1
add address=10.110.194.0/24 comment=management-vlan dns-server=10.110.194.1
domain=<mydomain> gateway=10.110.194.1 netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
add cname=dualstack.reddit.map.fastly.net name=www.reddit.com type=CNAME
/ip firewall filter
add action=accept chain=forward comment=
"accept everything for my sweet little pc" dst-address=10.110.194.10
add action=accept chain=input comment="allow from management vlan"
in-interface=management-vlan
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="allow router access via wireguard"
in-interface=wg1
add action=accept chain=input comment="\[EMERGENCY\]" in-interface=ether4
add action=accept chain=input comment="REACH_INTERNET (allow DNS)" dst-port=
53 in-interface-list=REACH_INTERNET protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=accept chain=forward comment="allow network access from wireguard"
in-interface=wg1
add action=accept chain=forward comment="route ether -> wg-herren"
in-interface=ether4 out-interface=wg-herren
add action=accept chain=forward comment="route wg-herren -> ether4"
in-interface=wg-herren out-interface=ether4
add action=accept chain=forward comment="\[EMERGENCY\]" in-interface=ether4
add action=accept chain=forward comment="REACH_INTERNET -> INTERNET"
in-interface-list=REACH_INTERNET out-interface-list=WAN
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=
pppoe-out1 protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ipv6 route
add disabled=no distance=1 dst-address=fd45:1b5b:88e6::/64 gateway=wg-herren
pref-src="" routing-table=main
/ipv6 address
add address=::6f4:1cff:fe69:93c3 from-pool=oben-prefix interface=bridge
add address=fd96:1394:939d::1/48 advertise=no interface=wg1
add address=::1:0:0:0:1 advertise=no from-pool=oben-prefix interface=
pppoe-out1
add from-pool="ula pool" interface=bridge
add address=fd45:1b5b:67e6::2 interface=ether4
add address=fd69:ac59:bd21:: interface=herren-vlan
add address=fd2d:e872:1b0d::1 interface=management-vlan
add address=0:0:0:2:: from-pool=oben-prefix interface=management-vlan
add address=0:0:0:3:: from-pool=oben-prefix interface=vm-vlan
add address=0:0:0:4:: from-pool=oben-prefix interface=herren-vlan
/ipv6 dhcp-client
add accept-prefix-without-address=no add-default-route=yes allow-reconfigure=
yes default-route-tables=main interface=pppoe-out1 pool-name=oben-prefix
pool-prefix-length=64 prefix-hint=<public v6> rapid-commit=no
request=prefix use-peer-dns=no
/ipv6 dhcp-server
add address-pool=oben-prefix interface=bridge name=x prefix-pool=oben-prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=<v6> list=zettamox
add address=dualstack.reddit.map.fastly.net list=reddit
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=input comment="allow incoming wireguard" dst-port=
51820 protocol=udp
add action=accept chain=input comment="allow from wireguard" in-interface=wg1
add action=accept chain=input comment="management vlan -> router"
in-interface=management-vlan
add action=accept chain=input comment=wireguard-herren dst-port=51821
protocol=udp
add action=accept chain=input comment=REACH_INTERNET dst-port=53
in-interface-list=REACH_INTERNET protocol=udp
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=forward comment=
"Accept traffic from ISP given prefix" src-address=<v6>
add action=accept chain=forward comment="allow traffic to zettamox \[TCP\]"
dst-address-list=zettamox dst-port=22,80,443,6969 protocol=tcp
add action=accept chain=forward comment="allow to zettamox \[UDP\]"
dst-address-list=zettamox dst-port=5520,443,80 protocol=udp
add action=accept chain=forward comment="allow wireguard to kuhlerkasten"
disabled=yes dst-address=<v6>
dst-port=51820 protocol=udp
add action=accept chain=forward comment="allow to pass through" disabled=yes
dst-address=<v6> dst-port=51820 protocol=udp
add action=accept chain=forward comment="allow from wireguard" in-interface=
wg1
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="wg-herren -> ether4" in-interface=
wg-herren out-interface=herren-vlan
add action=accept chain=forward comment="ether4 -> wg-herren" in-interface=
herren-vlan out-interface=wg-herren
add action=accept chain=forward comment="\[allow from management-vlan\]
\\n" in-interface=management-vlan
add action=accept chain=forward comment="REACH_INTERNET -> INTERNET"
in-interface-list=REACH_INTERNET out-interface-list=WAN
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/ipv6 firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=
pppoe-out1 protocol=tcp tcp-flags=syn
/ipv6 nd
set \[ find default=yes \] advertise-dns=yes interface=bridge
managed-address-configuration=yes other-configuration=yes ra-preference=
high
add advertise-dns=self interface=herren-vlan
add advertise-dns=self interface=management-vlan
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set file-name=discord filter-interface=pppoe-out1 filter-ip-protocol=udp
filter-operator-between-entries=and