I have a hap ac router. My ISP run internet and IPTV on VLAN. I configured mikrotik run pppoe on VLAN on eth1 which is connect to LAN port of the GPON modem, GPON modem turn in to bridge mode. The IP address of 2 devices are:
Mikrotik: 100.10.10.0/24
GPON Modem: 192.168.1.1
Now I want to access GPON modem from my PC which is connect directly to Mikrotik router. I tried several config from NAT rule, Routing but I don’t know if I make something wrong there.
At the moment, If I want to config my GPON modem, I must hook my PC to the modem and manually config ip of the PC to 192.168.1.x for the access. BTW, my ISP use GPON modem from DASAN, I believed. The model is H646ew.
You don’t want to allow discovery on isp-pppoe … so remove this one:
/interface list member
add interface=isp-pppoe list=discover
Addressing seems OK, so RB should be able to access GPON modem. You can verify by running command /ping 192.168.1.1 on router itself. If it is, then modem should be accessible already also to LAN clients as your masquerade rule is quite permissive (it masks everything that happens to pass router, I’d restrict it by adding out-interface=isp-pppoe … but this really depends on topology of your network). If you do restrict your current masquerade rule, then you have to add another one to make GPON modem reachable from the rest of your LAN:
Your firewall needs some reworking … if your internet access is over isp-pppoe, then firewall filter rules should refer to that port. For example the following rule:
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed"\
connection-nat-state=!dstnat connection-state=new in-interface=isp-pppoe
My advice would be to use interface lists … in case WAN interface gets changed, it’s not needed to redo many firewall rules, enough is to update WAN list membership.
You might want to restrict access to GPON modem subnet to a few select LAN clients. Without additional FW rules every LAN (and guest) client will be able to connect to GPON modem.
Thank you for your help, but I still can’t ping the 192.168.1.1. Everything I did, I suppose it to work already but it still not. Most of my firewall rule is the default from Factory. I use mikrotik for home only since my linksys EA3500 wifi fault. My network is simple:
GPON modem (bridge) --- Mikrotik hap ac (pppoe + iptv + dhcp) --- cAP (eth5 POE from hap ac)
192.168.1.1 gateway: 100.10.10.1 capsman
internet: PPPOE
Oh, I forgot to say. My PC is connected to the dump EA3500 works as switch (eth3 on hap ac), I still can login to mikrotik so I suppose it is not a problem. When I tried your nat rule toward gpon, the log saying this:
I don’t get what unknown 0
BTW, I can’t access mikrotik forum for the last 12 hours because sql errors. And I just figured out the queue limit is not working with ip settings allow fast path. I remembered the limit thing can be done in the interface list without queues limit and not need so much config.
Can you ping GPON modem from hAP ac? Until you can, nothing else will work …
Firewall rules in your setup are slight mess … so I suspect they come from a fairly old version of ROS. You might want to consider re-configuring hAP ac from scratch (export config using /export file=exported_config.rsc, copy resulting file off router, upgrade ROS to latest stable (6.44.1 as of today), perform reset to factory default, and change some bits and pieces as needed (VLAN settings, PPPoE details, …).
I can’t ping from hAP ac. BTW, my gpon modem DHCP is on, so I tried to setup DHCP client on mikrotik eth1 but it won’t have the IP. If I connect my PC with GPON wifi, it get an IP.
You are right, my configuration is a messed. I think I should spend sometimes with it.
Can you offer me some good firewall rules for home user?
Default firewall configuration on recent ROS versions is quite decent one. It only needs some minor tweaking (e.g. some port forwarded), but basics are sound.
If you can’t ping GPON modem from router, then it might be due to some config on GPON modem itself. I can imagine config where if modem is set to bridge mode, it won’t answer to IP on wired interface. Or something completely different…
[edit] Just struck me … I can see that you’re running PPPoE client on vlan interface. Try to move 192.168.1.2 IP address from ether1-WAN to vlan35 interface and see if this makes any difference.
Let’s try to help you,
First, connect a port of your hap ac to the GPON, a new port, not the one that you are using for PPPoE.
Second, on that port put a IP from the range of the GPON Modem:
/ip address add 192.168.1.2/24 interface=etherX
Try to ping the GPON modem from Mikrotik
/ping 192.168.1.1
If ping works, now create a NAT Firewall rule to your LAN PC reach the modem
/ip firewall nat add chain=srcnat dst-address=192.168.1.1 action=src-nat to-address=192.168.1.2
My GPON have 4 ethernets, but the first 2 ports has it own config from ISP, and I can only reach 70% my internet speed with them. So I assume these 2 ports for iptv. The last 2 ports is good for internet. Thanks for your suggestion, but I’m not gonna do that because I will waste one of my port for that management. Right now, my hAP ac have 2 reserve ports that I planned for NAS and another access point.
So, you could try to put the IP 192.169.1.2/24 on the Ethernet where you connect for pppoe. It probably works too, but be careful to not put the IP on the interface pppoe, it need to be on the Ethernet interface
I’ve been resetting my hAP ac to default configuration of ROS v6.44.1. Figured out there is a bunch of new thing in here, took me quite a while to figure thing out. Finally I found that the problem is not with Mikrotik, but with ONU modem. ISP didn’t send DHCP over ethernet port. Instead only wifi will get IP address. If I plug my PC directly and config the IP to match, it still doesn’t have access to ONU. So I tried port mapping here and there, ONU completely block me out cause of my stupid mapping. Reset the ONU is a pain with me.
