Hi all. I need to replace my home RB450G with something that can be neatly rack mounted and has more ports so I’ve bought a CRS125-24G-1S-RM.
I’m having trouble getting the CRS125-24G-1S-RM working correctly as a PPPoE client sharing an internet connection with the LAN. The configuration is very similar to what works on my RB450G but, apart from the hardware differences, the RouterOS versions are different 5.10 vs. 6.20.
IPv4 LAN clients can browse the internet but not ping any hosts. The router can ping hosts. IPv6 LAN clients can ping hosts but not browse the internet.
I suspect I have routing and/or firewall issues.
Here’s my ethernet setup:
/interface ethernet
set [ find default-name=ether1 ] name=ether1-master-local
set [ find default-name=ether2 ] master-port=ether1-master-local name=ether2-slave-local
set [ find default-name=ether3 ] master-port=ether1-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether1-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether1-master-local name=ether5-slave-local
set [ find default-name=ether6 ] master-port=ether1-master-local name=ether6-slave-local
set [ find default-name=ether7 ] master-port=ether1-master-local name=ether7-slave-local
set [ find default-name=ether8 ] master-port=ether1-master-local name=ether8-slave-local
set [ find default-name=ether9 ] master-port=ether1-master-local name=ether9-slave-local
set [ find default-name=ether10 ] master-port=ether1-master-local name=ether10-slave-local
set [ find default-name=ether11 ] master-port=ether1-master-local name=ether11-slave-local
set [ find default-name=ether12 ] master-port=ether1-master-local name=ether12-slave-local
set [ find default-name=ether13 ] master-port=ether1-master-local name=ether13-slave-local
set [ find default-name=ether14 ] master-port=ether1-master-local name=ether14-slave-local
set [ find default-name=ether15 ] master-port=ether1-master-local name=ether15-slave-local
set [ find default-name=ether16 ] master-port=ether1-master-local name=ether16-slave-local
set [ find default-name=ether17 ] master-port=ether1-master-local name=ether17-slave-local
set [ find default-name=ether18 ] master-port=ether1-master-local name=ether18-slave-local
set [ find default-name=ether19 ] master-port=ether1-master-local name=ether19-slave-local
set [ find default-name=ether20 ] master-port=ether1-master-local name=ether20-slave-local
set [ find default-name=ether21 ] master-port=ether1-master-local name=ether21-slave-local
set [ find default-name=ether22 ] master-port=ether1-master-local name=ether22-slave-local
set [ find default-name=ether23 ] master-port=ether1-master-local name=ether23-slave-local
set [ find default-name=ether24 ] name=ether24-gateway
set [ find default-name=sfp1 ] master-port=ether1-master-local name=sfp1-slave-local
DHCP and such seems to be working too:
/ip neighbor discovery
set ether24-gateway discover=no
/ip pool
add name=default-dhcp ranges=10.0.1.10-10.0.1.200
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=ether1-master-local lease-time=3d name=default
/ip address
add address=10.0.1.1/24 comment="default configuration" interface=ether1-master-local network=10.0.1.0
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no interface=ether24-gateway
/ip dhcp-server network
add address=10.0.1.0/24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.0.1.1 name=router
PPPoE client is setup and connects correctly:
/ppp profile
set 0 use-encryption=yes
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 \
default-route-distance=1 dial-on-demand=no disabled=no interface=\
ether24-gateway keepalive-timeout=disabled max-mru=1450 max-mtu=1450 \
mrru=disabled name=pppoe-out password=***** profile=\
default-encryption service-name="" use-peer-dns=yes user=\
*****@*****.net
/ip neighbor discovery
set pppoe-out discover=no
Firewall and NAT look ok, I think:
/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="default configuration" in-interface=pppoe-out
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out
On the IPv6 side of things:
/ipv6 address
add address=2001:44b8:****:****::2 from-pool=ipv6-pool interface=ether1-master-local
/ipv6 dhcp-client
add interface=pppoe-out pool-name=ipv6-pool
/ipv6 firewall filter
add chain=forward connection-state=established in-interface=pppoe-out
add chain=forward connection-state=related in-interface=pppoe-out
add chain=forward in-interface=pppoe-out protocol=icmpv6
add chain=forward dst-port=22 in-interface=pppoe-out protocol=tcp
add action=drop chain=forward in-interface=pppoe-out
add chain=input in-interface=pppoe-out protocol=icmpv6
add chain=input dst-port=546 in-interface=pppoe-out protocol=udp
add action=drop chain=input in-interface=pppoe-out
add action=drop chain=input in-interface=ether24-gateway
/ipv6 nd
set [ find default=yes ] advertise-dns=yes other-configuration=yes
So my questions are:
- What should I change to get IPv4 pings to work from LAN clients?
- What should I change to get IPv6 web traffic working?