IP Passthrough issue on wAPR-2nD after upgrade

RouterOS General
1

Hello,

I am currently using a MikroTik wAPR-2nD as a remote antenna.

The IP Passthrough feature allows me to forward the public IP address received on the antenna to a Cisco router connected behind it (WAN interface).

Behavior observed in version 7.14.2

The Cisco router correctly receives a public IP address through passthrough.

However, it is assigned with a /8 subnet mask (45.0.0.0/8).

As a result, the Cisco router considers the entire 45.0.0.0/8 range as directly connected:

C 45.0.0.0/8 is directly connected, GigabitEthernet0/0/0.10

This prevents communication with other addresses within the same public range, since the router tries to reach them locally.

It is worth noting that the supervision (management) IP configured on the Cisco remains reachable from the Internet (via the route provided by the ISP), indicating that the MikroTik properly forwards traffic to the Cisco router.

Behavior observed in version 7.20.2

The subnet mask issue has been fixed:

C 45.X.X.X/29 is directly connected, GigabitEthernet0/0/0.10
L 45.X.X.X/32 is directly connected, GigabitEthernet0/0/0.10

However, the Cisco management IP is no longer reachable from the Internet.

A packet capture on the Cisco shows that traffic to this IP never reaches the router, meaning it no longer passes through the wAPR-2nD.

I did not notice any configuration changes during the upgrade from version 7.14.2 to 7.20.2, nor did I make any manual modifications that could explain this behavior.

Additional information

  • The firewall rules on the wAPR-2nD were not modified between the two versions.

  • As a precaution, I also disabled the firewall completely (using a permit any any rule), but the issue persisted.

  • The problem therefore seems related to the Passthrough behavior in version 7.20.2, which no longer correctly forwards all incoming traffic destined for the Cisco router.

  • My routing is fully functional, as everything works correctly in version 7.14.2.

  • The issue appears to have been present since the LTE updates prior to version 7.20.2.

Has anyone experienced a similar issue or found a workaround for this behavior?

Thank you in advance for your help.

2

Hi,

Seems to be problem of CISCO configuration as /8 subnets are ... let's say "unusual".

Sharing config of Mikrotik would help a little.

3

Thank you very much for your quick reply.

I don’t think this behavior is related to the Cisco configuration, as I’ve reproduced exactly the same issue with other brands of routers connected behind the antenna - including Keenetic and Zyxel devices.
In each case, the same problem occurs.

Below is the MikroTik configuration.
Please note that the "X" characters are used only to mask sensitive information (such as IP addresses and MAC addresses).

[admin@Test] > export

2025-10-27 07:33:19 by RouterOS 7.20.2

software id = WPP1-DU0P

model = wAPR-2nD

serial number = xxxxxxxxxxxxx

/interface bridge
add admin-mac=D4:01:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
add comment=loopback name=loopback protocol-mode=none
/interface wireless
set \[ find default-name=wlan1 \] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge ssid=MikroTik-D8E75E wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan99-mgmt vlan-id=99
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set \[ find default=yes \] use-peer-dns=no
add add-default-route=no apn=XXXX ip-type=ipv4 name=linkt passthrough-interface=ether1 passthrough-mac=auto use-peer-dns=no
/interface lte
set \[ find default-name=lte1 \] allow-roaming=no apn-profiles=linkt band=""
/interface wireless security-profiles
set \[ find default=yes \] authentication-types=wpa2-psk comment=defconf disable-pmkid=yes mode=dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge name=defconf
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
/snmp community
set \[ find default=yes \] addresses=198.X.X.X/X,198.X.X.X/X authentication-protocol=SHA1 encryption-protocol=AES name=NMSUser security=private
/interface bridge port
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=vlan99-mgmt list=LAN
add interface=loopback list=LAN
/interface ovpn-server server
add mac-address=FE:F0:XX:XX:XX:XX name=ovpn-server1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.99.1/30 comment="MGMT VLAN99" interface=vlan99-mgmt network=192.168.99.0
add address=198.X.X.X interface=loopback network=198.X.X.X
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set servers=8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes in-interface-list=WAN
add action=accept chain=forward dst-address=0.0.0.0 in-interface-list=WAN out-interface-list=LAN src-address=0.0.0.0
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set sip disabled=yes
/ip hotspot profile
set \[ find default=yes \] html-directory=hotspot
/ip ipsec profile
set \[ find default=yes \] dpd-interval=2m dpd-maximum-failures=5
/ip route
add dst-address=192.168.5.0/24 gateway=192.168.99.2
add dst-address=0.0.0.0/0 gateway=192.168.99.2
/ip service
set ssh address=192.168.88.0/24,192.168.99.0/30,198.X.X.X/X
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/snmp
set enabled=yes trap-generators=interfaces trap-version=3
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=Test
/system note
set note="--------------------------------------------------------------------------\\
TEST

\\n"

show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=X.X.X.X
add address=X.X.X.X
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-interface=all filter-ip-protocol=icmp
4

That is your default route which sends all packets to 192.168.99.2 @ MGMT VLAN network.

Where is the WAN address?
Is MGMT VLAN the WAN?
What that rule is supposed to do?

add action=accept chain=forward dst-address=0.0.0.0 in-interface-list=WAN out-interface-list=LAN src-address=0.0.0.0
5

Thanks for the follow-up.

About this route:

add dst-address=0.0.0.0/0 gateway=192.168.99.2

This is intentional. With IP Passthrough, the public IP lives on the downstream router (Cisco), not on the wAPR-2nD.

To keep managing the MikroTik itself, I built a /30 MGMT link (VLAN 99) between the MikroTik and the Cisco. The default route on the MikroTik points to the Cisco (192.168.99.2) so the MikroTik’s own management/loopback traffic can exit to the Internet via the Cisco.

So to answer your questions:

  • Where is the WAN address? On the Cisco (via Passthrough).

[admin@test] > ip route/print

Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC

Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE

# DST-ADDRESS GATEWAY ROUTING-TABLE DISTANCE

0 As 0.0.0.0/0 192.168.99.2 main 1

DAc 45.X.X.X/29 ether1 main 0

1 As 192.168.5.0/24 192.168.99.2 main 1

DAc 192.168.88.0/24 bridge main 0

DAc 192.168.99.0/30 vlan99-mgmt main 0

DAc 198.X.X.X/32 loopback main 0

  • Is MGMT VLAN the WAN? No. vlan99-mgmt is a point-to-point management/backhaul, not the WAN. The actual WAN bearer is LTE; Passthrough hands the public IP to the Cisco.

  • What is the rule supposed to do?
    add action=accept chain=forward dst-address=0.0.0.0 in-interface-list=WAN out-interface-list=LAN src-address=0.0.0.0

    That was a temporary test to be 100% sure the firewall wasn’t blocking anything on the MikroTik side. In practice it’s not required; the loopback/MGMT interface is in the LAN list, and the default accept rules already allow it. Firewall isn’t the root cause here.

Traffic flow (intended):

Internet ⇄ Cisco (public IP via Passthrough, first loopback for cisco router)
⇄ VLAN99 /30 (192.168.99.0/30)
⇄ MikroTik wAPR (second loopback mgmt for mikrotik, default route → 192.168.99.2)

  • Cisco has a static route back to the MikroTik loopback via 192.168.99.1.

  • MikroTik sends its own outbound mgmt traffic to the Internet via the Cisco (default gw 192.168.99.2).

Happy to share any extra snippets if that helps.

6

Hi,

Does LTE modem is able to process all ip packets even if it is not IP obtains by PDP session ?

Regards,