Hello, we switched to a CCR2116 router. We were previously using v6, and access to clients and access points was possible when adding the management VLAN and local IPs to the rules. However, access is now blocked. Is there a different method in v7? How can I enable clients to access devices and access points?
172.10 VLAN group
172.16 local IP address (as received by clients)
By the way, I'm using load balancing; we combined 5 lines.
Without seeing the config, it would only be guessing, and I have no time for that
/export file=anynameyouwish (minus router serial number, public WANIP information, keys, dhcp lease lists)
It is weird in that firewall rules should not be affected, so suspect the mangling/routes is the issue but will know when we actually see evidence, anything else is noise.
/interface bridge
add name=bridge_Local
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] name=Local
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether3 ] name=WAN3
/interface pppoe-client
add disabled=no interface=ether4 max-mtu=1500 name=Modem4 user=turktelekom
add disabled=no interface=ether5 max-mtu=1500 name=Modem5 user=turknet
add interface=ether6 name=Modem6 user=wqerw
/interface wireguard
add comment=back-to-home-vpn listen-port=44551 mtu=1420 name=back-to-home-vpn
/interface vlan
add arp=local-proxy-arp interface=bridge_Local name=Mgmt_VLAN224 vlan-id=224
add interface=WAN1 mtu=1480 name=Modem1_Vlan vlan-id=35
add interface=WAN2 mtu=1480 name=Modem2_Vlan vlan-id=35
add interface=WAN3 mtu=1480 name=Modem3_Vlan vlan-id=35
/interface pppoe-client
add disabled=no interface=Modem1_Vlan name=Modem1 user=aaa@aaa
add disabled=no interface=Modem2_Vlan name=Modem2 user=aaa@aaa
add disabled=no interface=Modem3_Vlan name=Modem3 user=aaa@aaa
/ip pool
add name=hs-pool-1 ranges=172.16.0.2-172.16.0.254,172.16.1.2-172.16.1.250
add name=dhcp_vlan ranges=172.10.0.3-172.10.1.250
add name=dhcp ranges=192.168.1.10-192.168.1.100
/ip dhcp-server
add address-pool=dhcp_vlan interface=Mgmt_VLAN224 name=dhcp1
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes local-address=172.16.0.1 name=PPP remote-address=\
hs-pool-1
add change-tcp-mss=yes local-address=172.16.0.1 name="8 MBPS" only-one=yes \
rate-limit=800k/1096k remote-address=hs-pool-1
add change-tcp-mss=yes local-address=172.16.0.1 name="24 MBPS" only-one=yes \
rate-limit=4096k/24576k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="16 MBPS" only-one=yes \
rate-limit=5096k/18384k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="10 MBPS" only-one=yes \
rate-limit=3072k/18288k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="50/20 MBPS" only-one=yes \
rate-limit=10240k/52160k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="32 MBPS" only-one=yes \
rate-limit=4096k/32576k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="20/10 MBPS" only-one=yes \
rate-limit=10240k/20576k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="500 MBPS" only-one=yes \
remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="32/10 MBPS" only-one=yes \
rate-limit=10240k/35576k remote-address=hs-pool-1 use-compression=yes
add change-tcp-mss=yes local-address=172.16.0.1 name="1000/1000 MBPS" \
only-one=yes rate-limit=1024000k/1024000k remote-address=hs-pool-1 \
use-compression=yes
/routing table
add fib name=to_Modem1
add fib name=to_Modem2
add fib name=to_Modem3
add fib name=to_Modem4
add fib name=to_Modem5
add fib name=to_Modem6
/certificate settings
set builtin-trust-anchors=not-trusted
/interface bridge port
add bridge=bridge_Local interface=Local
add bridge=bridge_Local interface=ether12
add bridge=bridge_Local interface=ether11
/interface pppoe-server server
add default-profile=PPP disabled=no interface=bridge_Local \
one-session-per-host=yes service-name=service1
/ip address
add address=172.10.0.1/23 comment="hotspot network" interface=Mgmt_VLAN224 \
network=172.10.0.0
add address=172.16.0.1/23 interface=bridge_Local network=172.16.0.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes ddns-update-interval=10m
/ip cloud back-to-home-user
add allow-lan=yes comment="Erdogan-Merkez2 | CCR2116-12G-4S+" name=\
"Galaxy S25 Ultra" private-key=\
"fjdfkdjfkdjf=" public-key=\
"sdjsdkjsdksdjsk="
add allow-lan=yes comment="Erdogan-Merkez | CCR2116-12G-4S+ - Share 1" \
expires="2026-03-26 17:13:56" name="Galaxy S25 Ultra - " private-key=\
"djskdksdsds+dsdsdsdsdsd=" public-key=\
"dsdsdsdsdsds/cmE="
/ip dhcp-server network
add address=172.10.0.0/23 comment="hotspot network" gateway=172.10.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem1_conn \
per-connection-classifier=both-addresses-and-ports:6/0
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem2_conn \
per-connection-classifier=both-addresses-and-ports:6/1
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem3_conn \
per-connection-classifier=both-addresses-and-ports:6/2
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem4_conn \
per-connection-classifier=both-addresses-and-ports:6/3
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem5_conn \
per-connection-classifier=both-addresses-and-ports:6/4
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
yes in-interface=bridge_Local new-connection-mark=Modem6_conn \
per-connection-classifier=both-addresses-and-ports:6/5
add action=mark-routing chain=prerouting connection-mark=Modem1_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Modem2_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Modem3_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem3 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Modem4_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem4 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Modem5_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem5 passthrough=no
add action=mark-routing chain=prerouting connection-mark=Modem6_conn disabled=\
yes in-interface=bridge_Local new-routing-mark=to_Modem6 passthrough=no
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat out-interface=Modem1
add action=masquerade chain=srcnat out-interface=Modem2
add action=masquerade chain=srcnat out-interface=Modem3
add action=masquerade chain=srcnat out-interface=Modem4
add action=masquerade chain=srcnat out-interface=Modem5
add action=masquerade chain=srcnat disabled=yes out-interface=Modem6
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
src-address=192.168.1.0/24
add action=dst-nat chain=dstnat comment="Turan Akyil Uzak Masaustu" dst-port=\
3389 protocol=tcp to-addresses=172.16.1.253 to-ports=3389
add action=dst-nat chain=dstnat comment=erdogan dst-port=3389 protocol=tcp \
to-addresses=172.16.1.255
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
src-address=172.10.0.0/23
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
src-address=172.16.0.0/23
add action=dst-nat chain=dstnat dst-port=8000 protocol=tcp to-addresses=\
172.16.1.254 to-ports=8000
add action=dst-nat chain=dstnat comment="Uzak Masaustu" dst-port=3389 \
protocol=tcp to-addresses=172.16.1.251 to-ports=3389
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem1 routing-table=\
to_Modem1 scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem2 routing-table=\
to_Modem2 scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem3 routing-table=\
to_Modem3 scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem4 routing-table=\
to_Modem4 scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem5 routing-table=\
to_Modem5 scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Modem6 routing-table=\
to_Modem6 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=Modem1
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=Modem2
add disabled=no distance=3 dst-address=0.0.0.0/0 gateway=Modem3 routing-table=\
main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=4 dst-address=0.0.0.0/0 gateway=\
Modem4 routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping distance=5 dst-address=0.0.0.0/0 gateway=Modem5
add check-gateway=ping distance=6 dst-address=0.0.0.0/0 gateway=Modem6
add disabled=no dst-address=172.16.65.1/32 gateway=10.100.100.254 \
routing-table=main suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp aaa
set interim-update=5m use-radius=yes
/ppp secret
add disabled=yes name=erdogan profile=PPP service=pppoe
add name=benimo profile=PPP service=pppoe
add name=muratsezen profile="24 MBPS" service=pppoe
add name=cinarberk profile="1000/1000 MBPS" service=pppoe
add name=admin profile=PPP service=pppoe
add name=abdulhamit profile="8 MBPS" service=pppoe
add name=cihat profile="8 MBPS" service=pppoe
add name=test profile="8 MBPS" service=pppoe
add name=ravza profile="8 MBPS" service=pppoe
add name=erdoganev profile=PPP service=pppoe
add name=ubnt profile=PPP service=pppoe
/radius
add address=172.16.65.1 require-message-auth=no service=ppp,hotspot timeout=3s
/radius incoming
set accept=yes port=1700
/routing rule
add action=lookup disabled=no dst-address=192.168.216.1/24 table=main
add action=lookup disabled=no dst-address=172.16.1.179/32 table=main
add action=lookup src-address=172.16.0.1 table=to_Modem1
add action=lookup src-address=172.16.0.2 table=to_Modem2
add action=lookup src-address=172.16.0.3 table=to_Modem3
add action=lookup src-address=172.16.0.4 table=to_Modem4
add action=lookup src-address=172.16.0.5 table=to_Modem5
add action=lookup src-address=172.16.0.6 table=to_Modem1
add action=lookup src-address=172.16.0.7 table=to_Modem2
add action=lookup src-address=172.16.0.8 table=to_Modem3
add action=lookup src-address=172.16.0.9 table=to_Modem4
add action=lookup src-address=172.16.0.10 table=to_Modem5
add action=lookup src-address=172.16.0.11 table=to_Modem1
add action=lookup src-address=172.16.0.12 table=to_Modem2
add action=lookup src-address=172.16.0.13 table=to_Modem3
add action=lookup src-address=172.16.0.14 table=to_Modem4
add action=lookup src-address=172.16.0.15 table=to_Modem5
/system clock
set time-zone-name=Europe/Istanbul
/system identity
set name=jskdjsdsdjs
/system package update
set channel=long-term
/system routerboard settings
set auto-upgrade=yes enter-setup-on=delete-key
/system script
add dont-require-permissions=no name=script1 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":l\
ocal baseNet \"172.16.\"\r\
\n:local counter 0\r\
\n\r\
\n:for i from=0 to=1 do={\r\
\n :for j from=0 to=255 do={\r\
\n\r\
\n :if (\$j != 0) do={\r\
\n\r\
\n :local ip (\$baseNet . \$i . \".\" . \$j)\r\
\n :set counter (\$counter + 1)\r\
\n :local modem (\$counter % 5)\r\
\n\r\
\n :if (\$modem = 1) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem1\r\
\n }\r\
\n\r\
\n :if (\$modem = 2) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem2\r\
\n }\r\
\n\r\
\n :if (\$modem = 3) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem3\r\
\n }\r\
\n\r\
\n :if (\$modem = 4) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem4\r\
\n }\r\
\n\r\
\n :if (\$modem = 0) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem5\r\
\n }\r\
\n\r\
\n }\r\
\n\r\
\n }\r\
\n}"
add dont-require-permissions=no name=script2 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":l\
ocal baseNet \"172.16.\"\r\
\n:local counter 0\r\
\n\r\
\n:for i from=0 to=1 do={\r\
\n :for j from=0 to=255 do={\r\
\n\r\
\n :local ip (\$baseNet . \$i . \".\" . \$j)\r\
\n\r\
\n :if (\$j != 0) do={\r\
\n\r\
\n :set counter (\$counter + 1)\r\
\n\r\
\n :local modem (\$counter % 3)\r\
\n\r\
\n :if (\$modem = 1) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem1\r\
\n }\r\
\n\r\
\n :if (\$modem = 2) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem2\r\
\n }\r\
\n\r\
\n :if (\$modem = 0) do={\r\
\n /routing rule add action=lookup src-address=\$ip table=to\
_Modem3\r\
\n }\r\
\n\r\
\n }\r\
\n\r\
\n }\r\
\n}"
/tool romon
set enabled=yes
I usually like to rectify facts……. You state 5 WANs, I count 6???
Plus only one vlan when there should be at least two, one LAN, one MGMT
Even worse you have three subnet pools and yet only one dhcp server and one dhcp server network???
So far, nothing makes sense as I go through the config.
No firewall filter rules…………….. and thus I will not consider giving any advice, until rules are in place.
No comments on /interface bridge ports and no indication what used for (incomplete config).
Missing /interface bridge vlan settings and vlan-filtering on the bridge is not enabled???
It would appear you use BTH, as admin to monitor the networ, as none of the ISPs you have provide a public IP address??
If you dont have a public IP address, then how are you doing port forwarding???
Why are you masquerading both subnets???
I am not sure I understand your load balancing efforts between the config and the scripts you have made.
It would appear that you are attempting to take one subnet and then distribute individual members through some sort of pppoe hotspot, to different routes………..
A better of explanation of the requirements or intentions will help sort out an optimal load balancing wan usage plan.