I have a mikrotik RB2011u with two WAN with different ISP.
WAN1 - Dynamic (192.168.1.x/24) on Ether1 WAN2 - Static (129.x.x.x/24) on Ether2 Every other port and Wlan - Bridge (192.168.8.x/24)
NAT
i have two firewall NAT:
CHAIN-srcnat outinterface-ether1 action-masquerade
CHAIN-srcnat outinterface-ether2 action-masquerade
and Routes with ether1 with distance=1 and ether2 distance=2
but for reason, if i type my ip address 129.x.x.x from an outside network i keep getting this page cannot be reached.
but i can reach it from any device on the bridge.
I’m try to get the bridge to access the internet through Ether1 (dynamic WAN isp) which works fine, and access from an outside network should come in through Ether2 (static WAN isp) which is the main problem.
While pointing out that it might not be the best idea, because trust in security of WinBox has been shaken, it wasn’t exactly friendly response, you know?
You should on your router setup a VPN that connects to a sentral site.
The you connect from the sentral site trough your VPN to your router using WinBox.
But if that is not an option, take care if you open WinBox on the outside IP.
Use a good and very strong username/password
Make sure routerOS is updated to latest version
Do not use default port 8291, use another.
Use port knocking (search forum on how to do it)
Send all you logs to an external server (see my signature on how to use Splunk with Mikrotik RouterOS
Do think once again if you really need the Winbox port open
Many many RouterOs has been hacked due to weakness in older RouterOS software.
Hi Sob, sorry mate, I call it as I see it. I am no politician, its the same person that will come back and claim that MT doesnt secure their device properly…
As for Jotne, comments like yours keeps myths alive and for Sobs sake I will continue my forthright tone!!
Please delete your last sentence it is NOT accurate or incur some well deserved anti-accolades.
The Only weakness has been complete effing morons claiming to be IT admins that do not secure access to the Router via winbox from external access via proper methods.
Sob, just pretend we are in a bad movie, you are the good cop and I am the bad cop.
Lets practice…
Me
“If the OP is offended, he can go cry to his momma.”
You
"Don’t listen to him, he is still learning routerOS and is frustrated but means well. All you have to do to forward your router to hackers and North Koreans is to
publish your WANIP your gateway IP here and then create the following very easy and simple rules:
input chain rule as your first rule
add chain=input action=accept in-interface=WAN, and then
in your forward chain as the first rule
add chain=input action=accept in-interface=WAN
You and everyone else will be happily able to access your router, servers and pc without any difficulty.
OP
Oh thank you Sob you are my new BFF!!
Do you have a gofundme page I can donate too?
Hahaha Not quite right, change it to this… and bend to my will!!
"Many many RouterOs have been hacked due to weaknesses in older RouterOS software, that were exploited when admins failed to configure their routers in a secure manner.
Well, that’s what MikroTik said, but it’s not entirely accurate. Sure, it’s safest to block everything, but if you need some access to router, you have to open something. And whether it’s port for WinBox or your favourite VPN protocol, it’s the same in principle, any of those can have exploitable bugs. VPN is/should be probably a little safer, because it’s at least standard protocol and if it’s designed well, only implementation can be messed up. With own secret protocol (as WinBox uses) there can be mistakes in both implementation and design. And even though standard (open) protocol can have design flaws too, more people inspect it and there’s higher chance to find them.
And about being nice, I’m just saying that if someone’s new here, it’s better to explain things and reasons, rather then jump to lobotomy comments. Think about it, would we enjoy your company here now, if we welcomed you like this?
I would have gotten the point right away instead of trying to figure out truth from politically correct nonsense LOL.
Yes, I could have chosen more pleasant words! Thanks for the reminder to be civil. Next time I will have a coffee first then wake up and then type.
Thanks for the reply, i have done all from the post but i notices i can only access the router from an outside network id the outside network is only behind a Mikrotik.
Otunmusa, by default the Mikrotik won’t remember which ISP your outside request came in on. So you connect to the IP of ISP2, and your port forwarding rules forward to your web server. Then your webserver replies, but the Mikrotik will send the packets out on ISP1. This is a broken connection.
You have to create mangle rules.
When a new-connection comes in on ISP2 (in-interface=ether2), then action=mark-connection, connection-mark=ISP2
When the server replies, packets come in on the bridge1 interface. At this point they will go out on ISP1… So Create another mangle rule that says:
When connection-mark=ISP2 and in-interface=bridge1, set routing-mark=ISP2.
This will mark each packet.
Finally, you need to have a default route setup for ISP2 that says when packets match 0.0.0.0/0, it should send to your ISP2 gateway. In the route, you can specify a routing mark, set it to ISP2.
When the Mikrotik chooses which route to send packets out, it will choose the most restrictive route. So now, packets belonging to a connection that is established on ISP2 will also go out ISP2.
Next would be to Torch bridge1, youd should see packets forwarding to your webserver. If not, check your NAT (Port forwarding) rules.
On the same Torch, you should see packets coming from your webserver. If not, check firewall rules on the PC, are they LAN only, or any connection filter rules in your webserver.
Next run Torch on ISP2 again, if the reply packets aren’t going out, then run Torch on ISP1. If you see the packets going out there, then check your mangle rules, routing marks and routes.
@Otunmusa: If you think you configured connection and route marking correctly, but it still doesn’t work and you don’t see what’s wrong, you can export and post your config.
What i have tried:
proxy was enabled, so when i disabled it, i was able to access my router from winbox from an outside network for that day.
But some devices connect to the bridge couldn't access the internet while some could. Then the day after that i could no longer access the router from an outside network.
How do i get devices on the bridge to access the internet through WAN1 alone and only request to the router and the port forwarding ip use the WAN2.
I would like to ask which would be the best way to access the router remotely? I’m currently using OVPN but it still seems that the option isn’t secure when the port is open? Am I right?
