Huawei E3372h-320 no internet from router [SOLVED]

vitaly2016 · December 21, 2024, 7:15pm

There is Huawei E3372h-320 modem with HiLink software.
Main version: 22.001.35.01.03
Hardware: CL4E3372HM
Software: 11.0.1.1(H697SP1C983)
DHCP is on: (range limited to 192.168.8.100-192.168.8.100)
DMZ is off (I tried to set DMZ ON, but no changes)
Web interface is available at IP 192.168.8.1

When I connect this modem to PC (Win10) - internet is working without any problem.

When I connect modem to Mikrotik RB2011 or hEX PoE: LTE interface automatically appears.
I tried default configuration, then made standard steps:
added LTE interface to WAN interface list, add NAT masquerade rule with OUT interface list WAN
DHCP client (created dynamically) successfully gets 192.168.8.100 from modem.

Dynamic route for modem is created too. All seems good, BUT THERE IS NO INTERNET.
As at Mikrotik itself, as at PC connected to Mikrotik.

Mikrotik RB2011 ROS 7.16.2

Here is 8.8.8.8 ping result from Mikrotik

    0 192.168.8.1                                84  64 26ms658us  net unreachable                            
    1 192.168.8.1                                84  64 26ms963us  net unreachable                            
    2 192.168.8.1                                84  64 23ms805us  net unreachable                            
    3 192.168.8.1                                84  64 25ms126us  net unreachable                            
    4 8.8.8.8                                                      timeout                                    
    5 8.8.8.8                                                      timeout

Modem itself is pinged good:

ping 192.168.8.1

    0 192.168.8.1                                56  64 26ms693us 
    1 192.168.8.1                                56  64 26ms994us 
    2 192.168.8.1                                56  64 24ms150us 
    3 192.168.8.1                                56  64 25ms523us

/system resource/usb/print detail

 0   device="1-0" vendor="Linux 5.6.3 ehci_hcd" name="RB400 EHCI" serial-number="rb400_usb" vendor-id="0x1d6b" device-id="0x0002" speed="480" ports=1 usb-version=" 2.00" 
 1   device="1-1" vendor="HUAWEI_MOBILE" name="HUAWEI_MOBILE" vendor-id="0x12d1" device-id="0x14db" speed="480" usb-version=" 2.00"

/interface/lte/print detail

 0  R  default-name="lte1" name="lte1" mtu=1500

ip/route/print detail

   DAd   dst-address=0.0.0.0/0 routing-table=main gateway=192.168.8.1 immediate-gw=192.168.8.1%lte1 distance=2 scope=30 target-scope=10 vrf-interface=lte1 
   DAc   dst-address=192.168.8.0/24 routing-table=main gateway=lte1 immediate-gw=lte1 distance=0 scope=10 target-scope=5 local-address=192.168.8.100%lte1 
   DAc   dst-address=192.168.120.0/24 routing-table=main gateway=bridge immediate-gw=bridge distance=0 scope=10 target-scope=5 local-address=192.168.120.1%bridge

Please help me get this modem to work with Mikrotik. Here is all Mikrotik’s config:

# 1970-01-02 02:07:34 by RouterOS 7.16.2
# software id = PU7I-RXR0
#
# model = RB2011UiAS-2HnD
# serial number = 614A05C4110B
/interface bridge
add admin-mac=E4:8D:8C:23:38:92 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=ukraine default-authentication=no disabled=no distance=indoors \
    frequency=auto mode=ap-bridge ssid=Fangorn wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys supplicant-identity=MikroTik
/iot lora servers
add address=eu1.cloud.thethings.industries name="TTS Cloud (eu1)" protocol=\
    UDP
add address=nam1.cloud.thethings.industries name="TTS Cloud (nam1)" protocol=\
    UDP
add address=au1.cloud.thethings.industries name="TTS Cloud (au1)" protocol=\
    UDP
add address=eu1.cloud.thethings.network name="TTN V3 (eu1)" protocol=UDP
add address=nam1.cloud.thethings.network name="TTN V3 (nam1)" protocol=UDP
add address=au1.cloud.thethings.network name="TTN V3 (au1)" protocol=UDP
/ip pool
add name=dhcp ranges=192.168.120.10-192.168.120.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=lte1 list=WAN
/ip address
add address=192.168.120.1/24 comment=defconf interface=bridge network=\
    192.168.120.0
/ip dhcp-server network
add address=192.168.120.0/24 comment=defconf dns-server=192.168.120.1 \
    gateway=192.168.120.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.120.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=lte1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/lcd interface pages
set 0 interfaces="sfp1,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8\
    ,ether9,ether10"
/system logging
add topics=disk
add topics=lte
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

vitaly2016 · December 21, 2024, 7:41pm

I found similar post here:
@carl0s posted 08 Nov 2024:
http://forum.mikrotik.com/t/ipv6-wan-lte-usb-stick-troubles/179974/1
I have similar situation. As I mentioned above, Internet is working good when modem is connected to PC directly.
But it seems IT REALLY works at PC via IPv6

sindy · December 21, 2024, 8:09pm

As it seemed that @carl0s had lost interest back then, let’s continue here. A wild guess - maybe the modem (or the operator?) provides IPv4 connection via “Dual Stack lite” (RFC6333)? Can you attach a DHCPv6 client to lte1, configure it to request a prefix and/or an address, and sniff the traffic on the lte1 interface, to see whether the DHCPv6 messages from the modem contain Option 64 - AFTR-Name?

If they do, it should be possible to set the DS-lite up on the Mikrotik.

sindy · December 21, 2024, 8:53pm

Sorry, as usually with DHCP, you most likely have to make the client explicitly ask for the Option 64. If no dhcp-options are specified, the Mikrotik IPv6 DHCP client requests just the DNS server address; to make it request also the AFTR name, you must add an option named e.g. optreq, code=6, value=0x00170040 and tell the client to use that option.

vitaly2016 · December 21, 2024, 9:18pm

@carl0s he led me to the solution
The problem was in IPv6 indeed.

The solution is very simple

Go to Huawei modem web interface, Mobile Network
Create NEW profile, Name: INTENET (name INTERNET is already used)
APN name: intenet (internet is already used)
Then the magic: scroll down and additional settings appear ( I even didn’t know they exist):
IP Type: change from IPv6 + IPv4 to IPv4
this is the KEY SETTINGS!
After applying profile, WOW, it works!!!

sindy · December 21, 2024, 9:25pm

I’m pretty sure that it shouldn’t matter whether the same APN name is used in multiple profiles as that field must match what the mobile network expects (so your current mobile operator probably doesn’t care about APN name at all), but other than that, great. I just could not see @carl0s to respond in either topic, do you mean that what he wrote before has pushed you in the righht direction?