Mikrotik Hotspot Bypass/Exclusion for Subnets

RouterOS General
1

I have setup a hotspot on an interface that has 2 IP ranges programmed.

  • HotSpot range 192.168.16.0/24
  • IP Camera range 172.19.0.128/27

I’m trying to exclude the second range from being caught by the Hotspot.

For this i have done an IP Binding with “bypassed” as the field. This is however not working. Bypass only seems to work on the 192.168.16.0/24 network

See below the firewall rules that get created by the hotspot

See below my IP binding with bypassed

2

Have you tried disabling the hotspot universal NAT?

/ip hotspot
set 0 address-pool=none

If 0 is not the line number of your hotspot, change that.

3

Hi Tim

thanks for your advise, i have changed the address pool to none but it is still blocking the IP Camera range

4

I’m guessing you are way past this, but did you add an IP address to that shared interface for the camera IP subnet to use as a gateway (e.g. 172.19.0.1), and do you have a route for same?

I have a similar setup with several hotspot access points on a subnet different from the range used by the hotspot. When those addresses are bypassed just as you did, I can ping a host on the Internet using a tool that is part of the access point. So it is possible.

5

Yes the cameras have a seperate gateway of 172.19.0.129 (172.19.0.128/27).

6

In the picture of the firewall rules it looks like you made modifications to accomodate the special 172.19.0.x subnet. In my case I did not make any changes to the default rules configured by the hotspot setup.

Also, my IP bindings are different. I list only Address, Server, and Type. I leave MAC address and To Address blank.

7

You will see the “D” tag on the left, this is a rule automatically created by the hotspot. IF i disabled the hotspot they dissapear.

8

Also, add the 172.19.0.128/27 network to the Walled Garden IP List of your Hotspot.

9

Thanks ill try that.

10

I realised why the rules 172.19.0.128/27 were automatically added by the hotspot. Its becuase i had already aadded them to the Walled Garden IP List.

Both SRC and DST of those Subnets.

Still blocks my connections :frowning:

11

Have your tried to connect a computer to your camera network ?
If yes, does hotspot login page comes up? (it souldn’t), if not maybe something else blocking your connections…
The 172.19.0.129 gateway, how it’s connected to your mikrotik device?

12

Unfortunately i am remote from the site ±600km away.

13

Try in your IP binding to delete all data from “Mac Address” and “To Address”