I want them to be connected to the internet. I was unable to make it work. My approach was to make sure that my firewall wasn’t blocking anything and enabling NAT (srcnat, to ether-port 1).
My first step and question is: What am I doing wrong?
In future, I want to go a lot further, and I would like to use 2 WAN ports, to increase traffic. Moreover, I would like to use 1, or if possible, multiple WireGuard connections, through which I would like to provide internet on my VLANs. If there any examples or resolved issues in this forum, I would love to see them.
do yourself a favour and disable detect internet feature (set detect-internet-list=none)
Why MTU on LAN set to odd value of 1420? It’s going to hurt all LAN communication … possibly to make wireguard a bit faster. It may make sense, but really depends on ratio between wireguard and LAN data volume
if you insist on having the odd MTU value, you have to make all LAN clients aware of it (and ditto on the wireguard peer side). One possibility is to configure DHCP server with option 26, but it seems that some DHCP clients don’t want to use it? (See this thread: http://forum.mikrotik.com/t/dhcp-option-26-mtu-size/98261/1 )
I’ll write this again: don’t go into non-standard MTU value if you don’t know what you’re doing (my feeling is that you don’t know exactly)
completely unset “connection-type” property of the first firewall filter rule. Setting it to empty value is very much different than not setting the property at all.
But the good news is: your masquerade rule is fine for traffic leaving through ether1-WAN interface … for any source VLAN (src-nat doesn’t care about src-address unless it’s used as matcher criteria).
And a general suggestion: have a look at default setup, specially firewall rules. They are pretty good, they are both safe and quite flexible. Probably they’re not flexible enough for your ultimate goal, but you may learn something from them.
(1) I will add dont mix apples and oranges. Once you go vlans, ensure all subnets are vlans, and thus the bridge does no DHCP etc, just bridging.
Okay I see, that is what you have done, bridge ports was misleading…
Prefer… clarity
(2) Besides the ether8 management port access I would consider taking an unused port and making it an off-bridge access for config purposes.
Easy to make changes to the bridge and not be affected by any errors that may occur. Food for thought if interested.
No idea what the purpose of this route is??? /ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.88.1 routing-table=main
suppress-hw-offload=no
Your config is incomplete:
a. as alluded to above, missing firewall rules.
b. sourcenat rule out wireguard as mullvad only expects to see the single IP assigned to you coming from your device
c. any methods to identify what users should go out wireguard and how to force that traffic.
Hi there, thank you soooo much for the feedback. I am still learning all of this and your support is invaluable to me!
So let me answer the point by point, starting with the points made by mkx:
I have disabled that feature now
What is the default? I have used 1500, with no avail.
I don’t insist, but you are right, the idea was to have consistent packet-sizing to improve throughput. I first want to get connectivity out though. I feel that the WireGuard we can always add later.
This is correct, it was a hunge and I am only realizing how “dangerous” it is to play with such settings.
Done!
A question I have to you, mkx, is what do you mean by default setup. Do you mean the default setup as provided by mikrotik when setting up the device?
In regards to the feedback from Anav:
Are you saying that the Bridge itself shouldn’t have a DHCP server or IP address in and on itself? I have removed the IP-Address and DHCP server, and I hope this was correct. Just to validate: is your point that you should setup a default network with Subnets/DHCP, when you actually want to split it out in VLANs? So in this case I would only have DHCP Servers running on my VLAN virtual interfaces?
Excellent point. I was thinking that I should do this with a VLAN too, to ensure that I can also access the other routers that I will have in my network in the future. Should I use a separate Bridge for that?
Lets skip the WireGuard for now, as I think we can start with simply having internet within the VLANs, as I think this would be essential starting point. What do you think?
Consider it removed
5.A. What firewall rules am I missing?
5.B. Lets skip for now
5.C. Lets skip for now
completely unset “connection-type” property of the first firewall filter rule. Setting it to empty value is very much different than not setting the property at all.
We have Internet on the VLANs!!! I guess we are already at the stage that we should discuss the VPN that I want to set up. Should I create a new post? Or can I stick with this one? I will be testing the rest now, to be sure that everything works as it should
Yes, I was talking about config which is available if device is “reset to factory default”.
You can always see it if you open terminal window, log in as administrator and execute /system/default-configuration/print (make that terminal window as wide as possible).
Regarding MTU size: industry standard is 1500 … which happens to be default on ROS as well. Don’t mix this with L2MTU which is maximum ethernet frame size admitted. L2MTU has to be larger than MTU, by how much depends on exact features used in your network (e.g. using VLANs adds some overhead to “usual” ethernet frames).
