issues with PSN

RouterOS Beginner Basics
1

Hello,
I am new to RouterOS and Mikrotik in general,
I Have LHG 5 mikrotik wifi connection, I have a public IP and I have opened all ports to my PS4.
everything is fine .. until it’s not :neutral_face:

what happens is that sometimes at a random time my PS4 stops logging in into the PSN network. this problem happens for a while and then it resolves it self after sometime.
sometimes for more than 24 hours.
I recently discovered that a friend of mine who’s using the same equipment and same ISP does have the same issue and it happens to him at the exact same time as me and it get resolved at the same time. I contacted my ISP but they don’t seem to understand, they check if my IP address isn’t banned by Sony, and if I have a good signal and if the ports are properly forwarded and do nothing to resolve the issue ..

can anybody help me with that? I’ll provide screen-shots of my settings if needed.
Thanks in advance.

2

What are you using for DNS? This is a common theme which pops up every couple of months.

Make sure you are NOT using the Mikrotik locally for DNS by your PlayStation, try manually setting an alternative or handing off your ISP/chosen 3rd party for DNS via DHCP. Should work.

3

@ Steveocee
Thank you for your reply.
for my PS4 I setup DNS manually and I use google DNS.
and the Mikrotik DNS settings looks like this;
http://image.prntscr.com/image/c646b31c553448ababa2db2ff406b7ef.png
the problem is that it’s grayed out and I can’t change it.

I didn’t understand this part.
“handing off your ISP/chosen 3rd party for DNS via DHCP.”

4

He said to take off the DNS IPs from ISP and that you must use DNS of 3rd party, like Google, OpenDNS, etc.
The gray are dynamic DNS obtained from dhcp/ppp connections. If you set some static DNS, they are queried first than the dynamic ones.

5

thank you for your reply MR. null31
I didn’t know that Static DNS gets queried first. thanks for letting me know.
I’ll try setting up a Static DNS then.

6

I forgot to say before.

Change the DNS IP which is sent to DHCP Clients.
IP > DHCP Server > Networks.
Can be any IP of static dns you had set.

Edit:

I made a test to show to you how is the order of DNS queries using a firewall filter rule to log the packets. Of course the query timeout I reduced to low value to test easily.
You can view from the red line.
Screenshot_2017-04-18_23-02-12.png

7

Apologies for my vagueness. In short, do not use the MikroTik as a local DNS. Ensure your Playstation is going directly to an external DNS and that fixed the problem we had for multiple clients.

8

Hello again,
I’ve done all the things you guys recommended but sadly I still have the same issue.
it happened today again at random, and it still persist.

can it be anything else other than DNS issue?

9

Same here, I can’t get my PS4 to get connected to the internet.
It says Internet Connection: Failed and when you try to use the browser on PS4, it will say that it can’t resolve so I’m guessing it’s a DNS related issue.

Tried a number of setting changes such as:

  • Port forwarding all 1-65535 ports (tcp/udp) to PS4
  • Enabling UPnP (with and without the port forward settings above)
  • Enabling IPv6
  • Manually setting DNS settings on PS4 to 8.8.8.8/8.8.4.4
  • Changing DNS server provided by DHCP to 8.8.8.8/8.8.4.4
  • Changing MTU of PS4 to 1450
  • Upgrading Mikrotik firmware to 6.38.5
  • Releasing my global IP (Had to change my uplink port to do this..)
    None of the above worked with the latest PS4 firmware as of today.
    Now, when I connect PS4 directly to the modem (bypassing Mikrotik and PS4 getting a global IP), it works like a charm.
    But I don’t want to disconnect my whole house from the internet when I want to play PS4 so it’s either trashing Mikrotik or giving up internet on PS4.

Any clues..? Here’s the full config as of this moment:

# apr/23/2017 20:40:27 by RouterOS 6.38.5
# software id = 904R-XX2I
#
/interface bridge
add admin-mac=11:11:0A:02:FF:01 auto-mac=no name=brmgmt
add admin-mac=11:11:0A:02:01:01 auto-mac=no name=bruser
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
/ip neighbor discovery
set ether1 discover=no
set ether5 discover=no
/interface wireless security-profiles
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=REMOVED supplicant-identity="" wpa2-pre-shared-key=REMOVED
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=ap-bridge security-profile=REMOVED ssid=REMOVED wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=ap-bridge security-profile=REMOVED ssid=REMOVED wireless-protocol=\
    802.11
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=pool-mgmt ranges=10.2.255.10-10.2.255.254
add name=pool-user ranges=10.2.1.10-10.2.1.254
/ip dhcp-server
add address-pool=pool-user disabled=no interface=bruser name=dhcp-user
add address-pool=pool-mgmt disabled=no interface=brmgmt name=dhcp-mgmt
/interface bridge port
add bridge=bruser interface=ether2
add bridge=bruser interface=sfp1
add bridge=bruser interface=wlan1
add bridge=bruser interface=wlan2
add bridge=brmgmt interface=ether1
/ip address
add address=10.2.1.1/24 interface=bruser network=10.2.1.0
add address=10.2.255.1/24 interface=brmgmt network=10.2.255.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether5
/ip dhcp-server lease
add address=10.2.1.250 always-broadcast=yes mac-address=BC:60:A7:FD:6C:FB
/ip dhcp-server network
add address=10.2.1.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.2.1.1
add address=10.2.255.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.2.255.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether5
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether5
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether5
add action=dst-nat chain=dstnat comment=PS4-TCP dst-port=1-65535 in-interface=ether5 protocol=tcp to-addresses=10.2.1.250
add action=dst-nat chain=dstnat comment=PS4-UDP dst-port=1-65535 in-interface=ether5 protocol=udp to-addresses=10.2.1.250
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/ip upnp
set show-dummy-rule=no
/ip upnp interfaces
add interface=ether5 type=external
add interface=bruser type=internal
/ipv6 address
add from-pool=comcast6 interface=bruser
/ipv6 dhcp-client
add add-default-route=yes interface=ether5 pool-name=comcast6 prefix-hint=::/60 request=address,prefix use-peer-dns=no
/ipv6 firewall filter
add chain=input protocol=icmpv6
add chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add chain=forward protocol=icmpv6
add chain=forward connection-state=established,related
add chain=forward connection-state=new in-interface=!ether5
add action=drop chain=forward connection-state=invalid
add action=drop chain=input connection-state=new in-interface=ether5
add action=drop chain=forward connection-state=new in-interface=ether5
/ipv6 nd
set [ find default=yes ] disabled=yes
add interface=bruser other-configuration=yes ra-delay=5s ra-interval=5s-30s
/system clock
set time-zone-name=America/Los_Angeles
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bruser
add interface=brmgmt
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bruser
add interface=brmgmt
10

It’s very difficult to figure for me because I didn’t get any issue about this but I try my best. Hope this source will definitely help you.

11

I still have the same issue this time it persist for 4 days on row.

the error code I have : (CE-33987-0)
My setup :
Mikrotik LHG 5 (winbox ver 6.34.2) connected to a Netis Router (bridge mode) then connected to my PS4 via Lan Cable.
I have static public IP, Upnp is on and forwarding all the ports I need.
I’ve setup a static DNS server (Open DNS).
and I set the same DNS on my PS4.

still nothing is working.

12

a friend of me had the same problem.

he couldn’t log in, after trying everything, a password change of the psn account helped.



Gesendet von meinem SM-G930F mit Tapatalk

13

tried that as well just yesterday, still can’t log in through the PS4.
btw when I used a free VPN as a test I managed to log in, but had another set of problems ;

games wont sign in ..
can’t start or join a party ..

in other word .. useless :frowning:

14

Just a follow up on my own post.
I managed to solve my issue by spending few hours looking at port mirror of PS4 device.
As it turns, PS4 device didn’t like the MAC address set on the Mikrotik device:

/interface bridge
add admin-mac=11:11:0A:02:FF:01 auto-mac=no name=brmgmt
add admin-mac=11:11:0A:02:01:01 auto-mac=no name=bruser

On Wireshark, I was able to see that PS4 was constantly sending out ARP Requests for the gateway.
I checked the ARP Reply from the Mikrotik device and noticed that the MAC address was a reserved MAC address and had a warning that said:

Expert Info (Warn/Protocol): Source MAC must not be a group address: IEEE 802.3-2002, Section 3.2.3(b)

I managed to fix the issue by changing the MAC address of the bridge interface to something else like 00:aa:bb:01:02:03.

15

Note that there are “private” MAC address ranges available that would be a little safer than what you used.

Most references seem to indicate the following are safe for private use (though I have found a few that indicate otherwise so do some reading on this).

x2:xx:xx:xx:xx:xx
x6:xx:xx:xx:xx:xx
xA:xx:xx:xx:xx:xx
xE:xx:xx:xx:xx:xx

16

I have problem
i set vpn in my mikrotik when i try to connect my ps4 to internet everythings allright except PSN , it shows me FAILED But when i Disable VPn in Router PSN connect successfuly , What is the Problem ?

17

sakujo , would you like to tell me whats goal of opening the port for your PS4? I thing you shout enable upnp protocol. (from presentation)