I’m new to mikrotik. I’ve been trying for two hours now but how the hell do you add a simple LAN → WAN static route on this OS? This is very simple on Cisco, Fortigate and pfsense but somehow very hard to do on mikrotik.
I suppose it should be under IP → Routes but I have no idea what to fill in.
I can ping google from the built in ping tool on eth1 however running a traceroute from a pc connected to the eth2 port it stops at the eth2 gateway. I already set up a simple firewall rule.
Chain: Forward
In. Int: eth2
Out. int: eth1
TBH I find mikrotik incredibly hard to understand. The interface is all over the place and the way things are named makes it hard to understand what you are supposed to configure. Documentation is rather poor and not much use either.
2. IP left menu; click on left IP menu option then click on routes option
a. click on “+” sign to add new route;
b. at dst-address field fill in network range or lan adress that you want to be routed ( in our example, 192.168.0.0/24 );
c. at gateway field type public wan ip, if you have one, or just select ether1 from drop-down list;
d. hit OK button; that’s all.
b. masquerande entire lan network range 1. new terminal ( suppose your wan interface is ether1 )
/ip firewall nat
add action=masquerade chain=srcnat comment="NATing lan network" out-interface=ether1
2. IP left menu; click on left IP menu option then click on firewall option
a. go to NAT tab;
b. click on “+” sign to add new rule;
c. in General tab, on chain field select srcnat;
d. then in Out Interface option, select drom drop-down list “ether1”;
e. move to Action tab and on Action option select from drop-down list “masquerade”;
f. hit “OK” button from left; that’s all.
But no internet access. I can ping the wan (eth1) interface.
Firewall is set to any any forward.
For what its worth I got routeros running inside a vm. The wan (eth1) port is bridged to my physical nic and lan (eth) is bridged to the MS loopback adapter. Shouldnt be a problem, I got the same setup running in pfsense.
Oops, I copied that one without thinking about it. But RouterOS complains about wrong address with helpful messagein both WinBox and CLI, so no one can actually use it.
Okay deleted all settings and started over and looks like its working now.
I’m not sure what changed, routing and firewall rules are exactly the same. The only difference is that instead of relying on DHCP on the eth1 (WAN) interface I now set a static IP.
Anyway its working, now its time to set up some basic firewall rules and a hotspot. Lets see how it goes.
I don’t know what you’re looking at, but RouterOS basic network configuration is exactly the same as in Windows, Linux (RouterOS is actually based on Linux), and basically anything I’ve ever seen.
If you configure WAN using DHCP, you should not need to add default (0.0.0.0/0) route, it should come from DHCP server. In case your external DHCP server is not configured to give out default route, you’d need to add one, but not with gateway being WAN interface, it should be IP address (10.0.0.1 in your case, it seems). Then you need to either add NAT to hide internal network behind 10.0.0.100, or configure static route on your gateway to internal 192.168.5.0/24. Firewall is easy too, everything is allowed by default, no rules means no blocking. So if you have doubts, start with that and when basic routing works, play with firewall as next step.
and host unreachable (10.0.0.100).