Hex: No DHCP IP address acquired on WAN interface

Tried a lot of things, but my Hex does not get an automatic IP from my ISP (Tweak in NL over KPN the fiber network). The configuration is from the default QuickSet to keep it simple. The DHCP client on ether1 shows “Searching…”.

Things I tried:

  • Cloned MAC and WAN IP settings from a working router (static IP): works
  • Installed OpenWRT on the Hex: works out of the box
  • Connected both the WAN cable and the Hex to a managed Layer 2 switch (TP-Link TL-SG108PE): works
  • Tried a TP-Link Archer C7 v2: doesn’t work with factory firmware but does work with DD-WRT installed
  • Debug shows this:
		583	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	dhcp-client on ether1 sending discover with id 177533513 to 255.255.255.255	
		584	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	secs = 38	
		585	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	flags = broadcast	
		586	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	ciaddr = 0.0.0.0	
		587	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	chaddr = <SNIP>
		588	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	Host-Name = "MikroTik"	
		589	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	Msg-Type = discover	
		590	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	Parameter-List = Subnet-Mask,Classless-Route,Router,Static-Route,Domain-Server,NTP-Server,CAPWAP-Server,Vendor-Specific	
		591	Jan/02/1970 00:50:57	memory	dhcp, debug, packet	Client-Id = <SNIP>

Then it stops

Running out of options, so I appreciate some help.

The following post is using a wireless wan, but maybe a similar issue

http://forum.mikrotik.com/t/v7-9-2-stable-is-released/167070/1

What happens is that the client does get connected to the WiFi network, but sometimes the wireless interface does not go to the “up” state. So the DHCP client does not get an address.
It will remain stuck in that condition until the WiFi connection is interrupted for some reason.
This is on RB951G-2HnD devices, so old wireless code.

Which version of ROS do you run on that Hex ?
There have been some recent bug fixes related to DHCP context, might be worthwhile to upgrade to latest stable version in ROS7 chain.
(Hex runs just fine on ROS7, mine does already for several years).

I’m running 7.9.1 now. Tried different versions, same result.

In that case, can you post your config ?
/export file=anynameyouwish

Remove serial number, if needed public WAN IP, passwds, etc.
Then post content between code quotes.

I’m not near the router now, I will return home on Monday. But the default config is not touched, just using QuickSet (which works when I connect to WAN through a L2 switch as mentioned before).

Quickset and default config are not the same.
So monday it is then.

Here is my config

# jan/08/1970 05:54:26 by RouterOS 7.9.1
# software id = UZ6A-3MG3
#
# model = RB750Gr3
# serial number = 6F3907213292
/interface bridge
add admin-mac=64:D1:54:??:??:?? auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Hi,

I had a look nat the Tweak setup page https://www.tweak.nl/support/apparatuur-configureren.html , and for 2 of their
setups, the internet uses vlan 34

You could add a vlan interface to ether1 with a vlan of 34,
Make the new vlan interface a wan (Interfaces interface list)
(leave ether1 as a wan)
move the dhcp client that is on ether1 to the new vlan

See if that helps.

Thanks. I have an Internet Only subscription, which does not use VLAN tagging. I have tried using the VLAN tags anyway, but no luck.

From their support page (translated):

Internet Only
The connection is untagged (so no VLANs).
Use the WAN port of your own router to connect our media converter.
Use DHCP to obtain an IP address.

Latest RouterOS version (7.10) shows the same behavior btw.

Might be something ISP related. What is the eth1 connected to? Have you tried waiting a bit longer?

WAN port (ether1) is directly connected to the media converter of my ISP. I will try waiting a bit longer.

It may be that your ISP has somehow “remembered” the MAC address of the other router and refuses to assign an IP address until the lease for that other MAC has timed out (as a way to prevent that you can get 2 IP addresses on your line).

I have done some experimenting with this (see 1st post), and that does not seem to be the case. It looks like some router OSes (like factory TP-Link and Mikrotik RouterOS) have a different DHCP Client implementation which causes my issue. Or some kind of blacklist at the ISP side. I just don’t get a DHCP reply for my requests.

Currently I’m using a TP-Link C7 with DD-WRT without issues. If I connect my laptop (with a different MAC address obviously) directly to the media converter, that works fine as well (I get a DHCP lease instantly). And OpenWRT on the Hex works as well.

Hi,

Some thoughts:

Try changing the Hostname/Identity of the router.
Maybe they block devices named Mikrotik (due to some issues in the past with poorly configured devices)

Looking at the Mikrotik dhcp client page, it says it requests a few options.

But none of those listed are the CAPWAP-Server or the Vendor-Specific Options which are also requested.
Maybe your ISP’s DHCP server doesn’t like one of these, unfortunately you can’t change them.

Also the vendor-specific option request is sent, but it doesn’t send a Vendor Class Identifier so presumably the DHCP server is supposed to guess what vendor-specific option it wants??

Good one, but changing the hostname was tried earlier as well (inspired by another post). No luck.

Maybe a future release of RouterOS will fix this, but for now I think I’m out of options.

Maybe you could attempt to get your openwrt client to send these additional options and see if it causes the dhcp to break and if so, That might be useful to send to Mikrotik Support. (And maybe also to your ISP)

Perhaps easier. You could ask your ISP tech support and see if they can give you any insight into what is currently happening.

My ISP has its own forum, I have posted this issue a while ago: https://forum.tweak.nl/t/internet-only-geen-ip-op-wan-interface/2444/22 (sorry, in Dutch).

I also called Tweak support, and they said everything looked fine at their side and that they could see my DHCP requests. Maybe good to know: in my area, Tweak ISP uses the KPN fiber network. No support for end users from that party though.

I will try the OpenWRT-with-additional-client-settings route.

More interesting: can they see their DHCP server send replies, and if so: what replies.

What do you see if you packet capture on the WAN interface? Does it capture any reply?