Is it possible to use Static Route on SXT for Bridged network?

Let me try to explain as the subject probably isn’t clear. I have two networks between two houses. I have a pair of SXTs being used to connect the two houses (not for ISP use) just to connect the two networks from a LAN perspective really. Here is a diagram to better explain as this will answer a lot of questions on how its setup.
HouseNetworks-Sanitized2.png
Right now I use Asus Routers at each location to have a static route to point to each other. Example is on 2744 side I have a static route set to the following “Destination 192.168.0.0, Subnet 255.255.255.0, Gateway 192.168.2.50”. So if anything on the 2744 side wants to get to the 192.168.0.x side, the 2744 Asus knows to fwd it to the SXT which has a bridge network setup. Really the same route on the 1750 side, except obviously Destination is different and Gateway is different. Again everything works fine.

What my intent is to essentially remove the Asus Routers, mainly because the Uverse Gigabit comes with a Gateway unit, however that gateway unit doesn’t allow for any static routes. However its a fairly decent unit having 4x4 on the 5ghz side and 2x2 on the 2ghz side and one less unit in front of the LAN. And allows me to eliminate the Asus being on the DMZ plus of the Uverse Gateway. But what I need is the ability for a static route. I noticed the Mikrotik SXT has static route function when using Winbox, but never could get it to work when I tried this the other day. I created a route like mentioned above, but the traffic would not go to the other side.

Is there any way to make this work without the Asus device and a static route on the Asus? Or will I basically need to get a 16port switch maybe that is also layer3 based.

Thought it may help to show my configuration on both sides.

1750 Side

# aug/28/2016 19:29:36 by RouterOS 6.36
# software id = XKW1-VKT1
#
/interface bridge
add mtu=1500 name=1750Bridge
/interface wireless
set [ find default-name=wlan1 ] ampdu-priorities=0,1,2,3,4,5,6,7 band=\
    5ghz-onlyac channel-width=20/40/80mhz-Ceee country="united states" \
    disabled=no frequency-mode=regulatory-domain guard-interval=long mode=\
    station-bridge name=1750WLAN nv2-cell-radius=10 nv2-preshared-key=\
    XXXXXXXX nv2-security=enabled radio-name=1750SXTAC ssid=SPTP \
    tdma-period-size=auto wireless-protocol=nv2
/interface ethernet
set [ find default-name=ether1 ] name=1750Ethernet
/ip neighbor discovery
set "1750WLAN" discover=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=1750Ethernet name=default
/interface bridge port
add bridge=1750Bridge interface=1750Ethernet
add bridge=1750Bridge interface=1750WLAN
/interface bridge settings
set use-ip-firewall=yes
/ip firewall connection tracking
set enabled=no
/interface wireless align
set receive-all=yes ssid-all=yes
/ip address
add address=192.168.0.50/22 comment="default configuration" interface=\
    1750Ethernet network=192.168.0.0
add address=192.168.0.50/22 disabled=yes interface=1750Bridge network=\
    192.168.0.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid interface=\
    1750WLAN
/ip dhcp-server alert
add disabled=no interface=1750Bridge
/ip dns
set allow-remote-requests=yes servers=192.168.0.1
/ip dns static
add address=192.168.0.50 name=router
/ip firewall filter
add action=drop chain=forward dst-port=67 log=yes log-prefix="" protocol=udp
add action=drop chain=forward dst-port=68 log=yes log-prefix="" protocol=udp
add action=drop chain=input dst-port=67 log=yes log-prefix="" protocol=udp
add action=drop chain=input dst-port=68 log=yes log-prefix="" protocol=udp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add distance=1 gateway=192.168.0.1
/system clock
set time-zone-name=America/New_York
/system identity
set name=1750SXT
/system leds
set 0 disabled=yes interface=1750WLAN
/system package update
set channel=release-candidate
/system routerboard settings
set cpu-frequency=720MHz
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=1750Ethernet
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=1750Ethernet
/tool romon port
add
/tool sniffer
set filter-ip-address=192.168.0.30/32

2744 Side

# aug/28/2016 19:37:26 by RouterOS 6.36
# software id = AIGX-5380
#
/interface bridge
add name=2744Bridge
/interface wireless
set [ find default-name=wlan1 ] ampdu-priorities=0,1,2,3,4,5,6,7 band=\
    5ghz-onlyac channel-width=20/40/80mhz-Ceee country="united states" \
    disabled=no frequency-mode=regulatory-domain guard-interval=long mode=\
    bridge name=2744WLAN nv2-cell-radius=10 nv2-preshared-key=XXXXXXXX \
    nv2-security=enabled radio-name=2744SXTAC ssid=SPTP \
    tdma-period-size=1 wireless-protocol=nv2
/interface ethernet
set [ find default-name=ether1 ] name=2744Ethernet
/ip neighbor discovery
set "2744WLAN" discover=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed mode=dynamic-keys name=Test supplicant-identity="" \
    wpa2-pre-shared-key=XXXXXXXX
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=2744Ethernet name=default
/interface bridge port
add bridge=2744Bridge interface=2744Ethernet
add bridge=2744Bridge interface=2744WLAN
/interface bridge settings
set use-ip-firewall=yes
/ip firewall connection tracking
set enabled=no
/interface wireless align
set receive-all=yes ssid-all=yes
/ip address
add address=192.168.2.50/22 comment="default configuration" interface=\
    2744Ethernet network=192.168.0.0
add address=192.168.2.50/22 interface=2744Bridge network=192.168.0.0
/ip dns
set allow-remote-requests=yes servers=192.168.2.1
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=drop chain=forward dst-port=67 log=yes log-prefix="" protocol=udp
add action=drop chain=forward dst-port=68 log=yes log-prefix="" protocol=udp
add action=drop chain=input dst-port=67 log=yes log-prefix="" protocol=udp
add action=drop chain=input dst-port=68 log=yes log-prefix="" protocol=udp
add action=drop chain=input disabled=yes dst-port=85 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-port=85 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-port=37777 log=yes log-prefix=\
    "" protocol=tcp
add action=drop chain=output disabled=yes dst-port=37777 log=yes log-prefix=\
    "" protocol=tcp
add action=drop chain=input disabled=yes dst-port=37777 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-port=37778 log=yes log-prefix=\
    "" protocol=udp
add action=drop chain=input disabled=yes dst-port=37778 log=yes log-prefix="" \
    protocol=udp
add action=drop chain=forward disabled=yes dst-port=443 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=input disabled=yes dst-port=443 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-port=554 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=input disabled=yes dst-port=554 log=yes log-prefix="" \
    protocol=tcp
add action=drop chain=input disabled=yes dst-port=554 log=yes log-prefix="" \
    protocol=udp
add action=drop chain=forward disabled=yes dst-port=554 log=yes log-prefix="" \
    protocol=udp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add distance=1 gateway=192.168.2.1
/system clock
set time-zone-name=America/New_York
/system identity
set name=2744SXT
/system leds
set 0 disabled=yes interface=2744WLAN
/system package update
set channel=release-candidate
/system routerboard settings
set cpu-frequency=720MHz
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=2744Ethernet
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=2744Ethernet
/tool sniffer
set filter-ip-address=192.168.0.115/32

The reason this isn’t working for you is that if you remove the Asus routers, your packets from your devices are getting routed directly to the ATT Uverse (the default gateway for your computers), and if it can’t do static routes, then it is not helpful. You do need some kind of router in there that can handle static routes, so it is not feasible to remove the Asus without replacing it with a similar unit.

Ok maybe Im not following, but if the SXT is on the same 16port, wouldn’t it get packets from that switch and know what to do with it?

If Im not getting this right, then if I need a routable device, Im assuming a layer3 16port switch could in theory solve this right?

Dixit

Correct, but from your post, it also sounds like you want to use the wireless on the ATT Uverse. Any devices connected wirelessly to the Uverse would not pass through a layer 3 switch and therefore would not be able to connect to the other house. Unless your devices on wireless do not need to be able to connect to the other house?

Ok Im following you a bit more now. So wireless off the UVerse gateway would not know where to go. So that may not be an option (unless I lead the Asus there and turn it into an AP only mode (like my other devices in the house).

Ok but to be clear, if I didn’t use the UVerse as a wireless client (and just as the gateway device), would my current 16port switch suffice or I still need a layer3 based switch? Im assuming yes, because when I originally tested this, I had a server off the same 16port switch and the SXT is off that and still didn’t work when I added the static route on the SXT itself.

Dixit

Also, you are misunderstanding the point of the static route on the SXT.

By putting in the static route on the SXT on house #1, you are making it possible for the SXT itself to be able to send packets to any device in house #2, but not receive anything back. By putting the static route on the SXT in house #2, you are making it possible for the SXT itself in house #2 to be able to send packets to any device in house #1, but not receive anything back.

Adding the static routes does allow the SXT’s to fire packets at any device at either house. But the remaining issue is that the devices in the houses receive the packet but have no proper route to reply, and will try to send the reply to the ATT Uverse, which will likely simply try forwarding it out to the Internet where it will get dropped at some point.

Also, all of your traffic from devices in home #1 to home #2 is bridged through the radios, rather than routed, so adding a static route on the SXT has no effect on those packets since they are not being routed by the SXT, it is bridging them. Adding those static routes would allow RouterOS itself on the SXT radio to send SNMP traps or syslog log messages to any device in any house but doesn’t do anything beyond that due to those problems. I do not think it is very likely that you care about whether RouterOS can send SNMP traps or syslog messages to your smart fridge or whatever, and it is more likely that you want to provide connectivity between the devices in the two houses.

Yes, if you didn’t use the Uverse as a wireless client, it will work, but you would need a layer 3 switch - you need something to do the routing, and a layer 2 switch can’t do that.

As a follow-up, you COULD configure the SXT’s to do routing. However, the problem for reaching the other home becomes how to let the devices in house #1 know that the SXT is a router and has a route to house #2. This would entail programming the static route manually on all individual devices in both homes, or giving all devices the route through DHCP options which is rather complicated because you have to convert the static route to a hexadecimal pattern. Adding these rare DHCP options probably isn’t even supported by your UVerse if it doesn’t support static routes to begin with. If you can switch off the DHCP server on the Uverse and run a DHCP server on something else, it is possible, but still will be difficult to configure and some more specialized devices might ignore these DHCP options and not have a route to the other home.

Ok, so really best option is going to be to probably just leave the Uverse Gateway and the Asus Router behind it as the DMZPlus.

I could do the option of changing out the 16port with a layer3 16port switch (was planning on getting a PoE version anyways) and then would still need the Asus turned into an AP since you mentioned wireless clients off the Uverse Gateway wont know how to get to the other house.

Dixit

Yes, I would probably leave the Asus there if you are otherwise happy with it.