Hello everyone,
I am currently experiencing an issue with Internet connectivity on my MikroTik router. My local network works fine, but I am unable to access the Internet from any device connected to this network. I am running the latest version of the MikroTik software.
Problem Description:
- Internal Pings: Work correctly. Example: ping 192.168.10.1 responds successfully.
External Pings from Network Devices: Fail. Example: ping 8.8.8.8 does not receive any response and indicates 100% packet loss.
DNS Resolution from Router: Works fine. Pinging external DNS servers ( e.g., 8.8.8.8 ) from the router itself works.
Network Configuration Details:
Firewall NAT Rules:
Flags: X - disabled, I - invalid; D - dynamic
0 X ;;; defconf: accept all that matches IPSec policy
chain=srcnat action=accept log=no log-prefix="" ipsec-policy=out,ipsec
1 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN log=no log-prefix=""
Routes:
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE
DST-ADDRESS GATEWAY DISTANCE
DAd 0.0.0.0/0 ********* 1
DAc ***********/21 br-wan 0
DAc 192.168.10.0/24 br-lan 0
DHCP Leases:
Flags: D, B - BLOCKED
Columns: ADDRESS, MAC-ADDRESS, HOST-NAME, SERVER, STATUS, LAST-SEEN
# ADDRESS MAC-ADDRESS HOST-NAME SERVER STATUS LAST-SEEN
0 D 192.168.10.199 ******* ******** LAN bound 1m36s
Firewall Filter Rules:
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept ICMP after RAW
chain=input action=accept protocol=icmp log=no log-prefix=""
2 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=""
3 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix=""
4 ;;; defconf: accept all that matches IPSec policy
chain=forward action=accept log=no log-prefix="" ipsec-policy=in,ipsec
5 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related log=no log-prefix=""
6 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=""
7 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=""
8 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix=""
9 ;;; defconf: drop bad forward IPs
chain=forward action=drop src-address-list=no_forward_ipv4 log=no log-prefix=""
10 ;;; defconf: drop bad forward IPs
chain=forward action=drop dst-address-list=no_forward_ipv4 log=no log-prefix=""
Bridge Ports:
Flags: H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, PATH-COST, INTERNAL-PATH-COST, HORIZON
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST INTERNAL-PATH-COST HORIZON
0 vlan832-internet br-wan 1 0x80 10 10 none
1 H ether2 br-lan yes 1 0x80 10 10 none
(Note: Currently, only ether2 is in the LAN bridge as part of a test. Eventually, all interfaces will be added to the LAN bridge.)
Steps Taken:
- Verified the internal network is functioning correctly.
Confirmed that DNS resolution works from the router.
Implemented firewall rules recommended on the MikroTik site.
Any help to resolve this issue would be greatly appreciated!
Thank you.