Hello!
I would like to ask for some help, but unfortunately I’m giving up, I can’t figure out what the problem could be.
The following would be it, I have brought 2 IP addresses to MikroTik, via a gre tunnel, and it has 2 IP addresses loaded in the bridge network, and I added the IP address to proxmox, everything works, but unfortunately the IP address gets stuck on the internal lan network, but I can reach IP addresses from the external network - where proxxmo runs.
And I tried to do a tracert, there is an IP address on the bridge gateway.
But this error only occurs within the lan.
For example:
Bridge network:
192.168.1.0/24
77.77.77.77/30
Ip address MikroTik:
172.16.0.0/24
192.168.1.50 (proxmox server)
Works with Proxmox:
Ip address 77.77.77.77
Gateway 172.16.0.1
And inside the LAN it gets stuck: 192.168.1.1 I do this with tracert.
How could I modify the firewall inside the LAN to allow it?
/interface bridge
add name="bridge - LAN"
/interface gre
add !keepalive name=GRE3 remote-address=77.77.77.50
/interface bonding
add lacp-rate=1sec mode=802.3ad name=bond0 slaves=ether2,ether3 transmit-hash-policy=layer-3-and-4
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp_pool0 ranges=192.168.1.111-192.168.1.199
/ip dhcp-server
add address-pool=dhcp_pool0 interface="bridge - LAN" lease-time=10m name="dhcp - LAN"
/routing table
add fib name=GRE3
/disk settings
set auto-media-interface="bridge - LAN" auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge="bridge - LAN" interface=ether4
add bridge="bridge - LAN" interface=ether5
add bridge="bridge - LAN" interface=wifi1
add bridge="bridge - LAN" interface=wifi2
add bridge="bridge - LAN" interface=bond0
/interface list member
add interface=pppoe-out list=WAN
add interface="bridge - LAN" list=LAN
/interface wifi capsman
set package-path="" require-peer-certificate=no upgrade-policy=none
/ip address
add address=192.168.1.1/24 interface="bridge - LAN" network=192.168.1.0
add address=172.16.0.1/24 interface="bridge - LAN" network=172.16.0.0
add address=10.170.10.2/24 interface=GRE3 network=10.170.10.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-server lease
add address=192.168.1.100 comment="Linux g\E9p" lease-time=10s mac-address=90:DE:80:80:E1:C1 server="dhcp - LAN"
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes in-interface="bridge - LAN" out-interface=pppoe-out
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes in-interface=pppoe-out out-interface="bridge - LAN"
add action=drop chain=input connection-state=invalid
add action=accept chain=input dst-port=8291 protocol=tcp
add action=accept chain=input connection-state=established,related
add action=drop chain=input
add action=drop chain=forward connection-state=invalid
add action=fasttrack-connection chain=forward hw-offload=yes
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward in-interface=GRE3 out-interface="bridge - LAN"
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=22 protocol=tcp to-addresses=192.168.1.100 to-ports=22
add action=dst-nat chain=dstnat dst-port=25 in-interface=pppoe-out protocol=tcp to-addresses=192.168.1.100 to-ports=25
add action=dst-nat chain=dstnat dst-port=80 in-interface=pppoe-out protocol=tcp to-addresses=192.168.1.100 to-ports=80
add action=dst-nat chain=dstnat dst-port=4000-8010 in-interface=pppoe-out protocol=tcp to-addresses=192.168.1.100 to-ports=4000-8010
add action=masquerade chain=srcnat comment="Internel Hairpin NAT" dst-address=!192.168.100.1 src-address-list=LAN
add action=dst-nat chain=dstnat dst-address-type=local dst-port=4000-8010 protocol=tcp src-address-list=LAN to-addresses=192.168.1.100 to-ports=4000-8010
add action=dst-nat chain=dstnat dst-address-type=local dst-port=22-25 protocol=tcp src-address-list=LAN to-addresses=192.168.1.100 to-ports=22-25
add action=dst-nat chain=dstnat dst-address-type=local dst-port=80 protocol=tcp src-address-list=LAN to-addresses=192.168.1.100 to-ports=80
add action=masquerade chain=srcnat dst-address=77.77.77.77/30
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add disabled=no distance=1 dst-address=77.77.77.77/30 gateway="bridge - LAN" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=GRE3 routing-table=GRE3 scope=30 suppress-hw-offload=no target-scope=10
/routing rule
add action=lookup disabled=no interface="bridge - LAN" src-address=77.77.77.77/30 table=GRE3
set allowed-interface-list=LAN