MikroTik RB2011 connected to MikroTik RB2011

RouterOS Beginner Basics
1

Hi MikroTIk community,

I want to build the following network:

  ISP
   ↓ ETH1
RB2011 #1 — edge router — with enabled internal Wi-Fi
   ├── ETH5 → RB2011 #2 — homelab router — with disabled internal Wi-Fi
   │             ↓
   │           CSS610 — switch
   │             ↓
   │           cAp ac — access point
   │
   └── ETH2 → wAP — outdoor access point

I prepared 2 configuration scripts,
but when I applied both of them,
I just connected the #2 MikroTik to the #1 MikroTik, and Wi-Fi on the #1 MikroTik gets shocked- it shows and disappears.

The configurations are listed below:

MikroTik #1 - Edge router

##############################################################################
# RB2011 #1 - Edge ROUTER
# RouterOS 7.x
#
# Role:
#   Internet-facing edge router. Terminates PPPoE on ether1 (WAN).
#   Serves a single flat LAN 192.168.10.0/24 on ether2-ether10 + wlan1.
#   Any spare LAN port can be used to uplink RB2011 #2 (homelab) - that
#   port needs no special config here, it's just another LAN port; the
#   double-NAT boundary lives entirely on RB2011 #2's side.
#
# BEFORE RUNNING:
#   1. Reset the router WITHOUT keeping the default (defconf) config:
#        /system reset-configuration no-defaults=yes skip-backup=yes
#      (or reset via the reset button / Netinstall). If you import this
#      on top of the untouched defconf config, you'll get duplicate
#      bridges, DHCP servers and firewall rules.
#   2. Fill in the variables below.
#   3. Upload this file (Files menu) then run:
#        /import file-name=rb2011-1-edge-router.rsc
#   4. Manually check for a RouterOS package upgrade afterwards:
#        /system package update check-for-updates
#      (not scripted here - it needs a reboot and shouldn't run unattended
#      on a box you're not standing in front of).
##############################################################################

:local pppUser "CHANGE_ME_pppoe_user"
:local pppPass "CHANGE_ME_pppoe_pass"
:local adminPass "CHANGE_ME_admin_password"
:local wifiPass "CHANGE_ME_wifi_password"
:local country "poland"
:local lanSubnet "192.168.10.0/24"
:local lanIP "192.168.10.1/24"
:local dhcpFrom "192.168.10.10"
:local dhcpTo "192.168.10.254"

:log info "edge-router: starting configuration";

# ---------------------------------------------------------------------------
# 1. System / access hardening
# ---------------------------------------------------------------------------
/system identity set name="RB2011-EDGE"
/user set admin password=$adminPass
/system clock set time-zone-autodetect=yes
/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh port=22
/ip service set winbox port=8291
/ip cloud set ddns-enabled=auto

# ---------------------------------------------------------------------------
# 2. Interface lists
# ---------------------------------------------------------------------------
/interface list add name=WAN comment="edge: wan"
/interface list add name=LAN comment="edge: lan"

# ---------------------------------------------------------------------------
# 3. LAN bridge - ether2 through ether10
# ---------------------------------------------------------------------------
/interface bridge add name=bridge-lan auto-mac=yes protocol-mode=rstp comment="edge: lan bridge"
:foreach i in={"ether2";"ether3";"ether4";"ether5";"ether6";"ether7";"ether8";"ether9";"ether10"} do={
  /interface bridge port add bridge=bridge-lan interface=$i comment="edge: lan port"
}

# ---------------------------------------------------------------------------
# 4. Wireless - wlan1 as a LAN access point (WPA2/WPA3)
# ---------------------------------------------------------------------------
/interface wireless security-profiles add name=wifi-sec mode=dynamic-keys \
    authentication-types=wpa2-psk wpa2-pre-shared-key=$wifiPass
:local wlanMac [/interface wireless get wlan1 mac-address]
:local ssid ("Edge-" . [:pick $wlanMac 9 11] . [:pick $wlanMac 12 14] . [:pick $wlanMac 15 17])
/interface wireless set wlan1 disabled=no mode=ap-bridge band=2ghz-b/g/n ssid=$ssid \
    security-profile=wifi-sec country=$country installation=indoor wireless-protocol=802.11
/interface bridge port add bridge=bridge-lan interface=wlan1 comment="edge: lan wifi"

# ---------------------------------------------------------------------------
# 5. LAN addressing + DHCP
# ---------------------------------------------------------------------------
/ip address add address=$lanIP interface=bridge-lan comment="edge: lan"
/ip pool add name=dhcp-lan ranges=($dhcpFrom . "-" . $dhcpTo)
/ip dhcp-server add name=dhcp-lan address-pool=dhcp-lan interface=bridge-lan disabled=no
/ip dhcp-server network add address=$lanSubnet gateway=192.168.10.1 dns-server=192.168.10.1,1.1.1.1 comment="edge: lan"
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

# ---------------------------------------------------------------------------
# 6. WAN - PPPoE client on ether1
# ---------------------------------------------------------------------------
/interface pppoe-client add name=pppoe-out1 interface=ether1 user=$pppUser password=$pppPass \
    disabled=no add-default-route=yes use-peer-dns=yes comment="edge: wan pppoe"

/interface list member add list=WAN interface=pppoe-out1
/interface list member add list=WAN interface=ether1
/interface list member add list=LAN interface=bridge-lan

# ---------------------------------------------------------------------------
# 7. NAT
# ---------------------------------------------------------------------------
/ip firewall nat add chain=srcnat out-interface-list=WAN action=masquerade comment="edge: masquerade"

# ---------------------------------------------------------------------------
# 8. Firewall - IPv4
# ---------------------------------------------------------------------------
/ip firewall filter {
  add chain=input action=accept connection-state=established,related,untracked comment="edge: accept established,related,untracked"
  add chain=input action=drop connection-state=invalid comment="edge: drop invalid"
  add chain=input action=accept protocol=icmp comment="edge: accept icmp"
  add chain=input action=accept in-interface-list=LAN comment="edge: accept from LAN"
  add chain=input action=drop in-interface-list=WAN comment="edge: drop everything else from WAN"
  add chain=forward action=accept connection-state=established,related,untracked comment="edge: accept established,related,untracked"
  add chain=forward action=drop connection-state=invalid comment="edge: drop invalid"
  add chain=forward action=fasttrack-connection connection-state=established,related comment="edge: fasttrack"
  add chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN comment="edge: drop wan traffic that isn't dstnat'd"
}

# ---------------------------------------------------------------------------
# 9. Firewall - IPv6
# ---------------------------------------------------------------------------
/ipv6 firewall filter {
  add chain=input action=accept connection-state=established,related,untracked comment="edge: accept established,related,untracked"
  add chain=input action=drop connection-state=invalid comment="edge: drop invalid"
  add chain=input action=accept protocol=icmpv6 comment="edge: accept icmpv6"
  add chain=input action=accept in-interface-list=LAN comment="edge: accept from LAN"
  add chain=input action=drop in-interface-list=WAN comment="edge: drop everything else from WAN"
  add chain=forward action=drop in-interface-list=WAN comment="edge: drop forward from WAN"
}

# ---------------------------------------------------------------------------
# 10. Misc hardening
# ---------------------------------------------------------------------------
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN

:log info ("edge-router: configuration complete - SSID: " . $ssid);

MikroTik #2 - HomeLab router:

##############################################################################
# RB2011 #2 - HomeLab ROUTER
# RouterOS 7.x
#
# Role:
#   Sits behind RB2011 #1 (edge). ether1 is WAN and gets a DHCP lease
#   from RB2011 #1's LAN (192.168.10.0/24) - this is the double-NAT
#   boundary. Serves a fully isolated homelab LAN 192.168.20.0/24 on
#   ether2-ether10 (+ wlan1, disabled by default).
#
#   Isolation: the firewall drops everything inbound from WAN (i.e. from
#   RB2011 #1's LAN) that isn't a reply to homelab-initiated traffic, so
#   the main LAN cannot reach into the homelab unless you punch a hole
#   (dstnat / port forward) for it.
#
# BEFORE RUNNING:
#   1. Reset the router WITHOUT keeping the default (defconf) config:
#        /system reset-configuration no-defaults=yes skip-backup=yes
#   2. Fill in the variables below.
#   3. Physically plug ether1 into any LAN port on RB2011 #1.
#   4. Upload this file (Files menu) then run:
#        /import file-name=rb2011-2-homelab-router.rsc
##############################################################################

:local adminPass "CHANGE_ME_admin_password"
:local wifiPass "CHANGE_ME_wifi_password"
:local country "poland"
:local lanSubnet "192.168.20.0/24"
:local lanIP "192.168.20.1/24"
:local dhcpFrom "192.168.20.10"
:local dhcpTo "192.168.20.254"

:log info "homelab-router: starting configuration";

# ---------------------------------------------------------------------------
# 1. System / access hardening
# ---------------------------------------------------------------------------
/system identity set name="RB2011-HomeLab"
/user set admin password=$adminPass
/system clock set time-zone-autodetect=yes
/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh port=22
/ip service set winbox port=8291
/ip cloud set ddns-enabled=auto

# ---------------------------------------------------------------------------
# 2. Interface lists
# ---------------------------------------------------------------------------
/interface list add name=WAN comment="homelab: uplink to edge router"
/interface list add name=LAN comment="homelab: isolated lan"

# ---------------------------------------------------------------------------
# 3. LAN bridge - ether2 through ether10
# ---------------------------------------------------------------------------
/interface bridge add name=bridge-lan auto-mac=yes protocol-mode=rstp comment="homelab: lan bridge"
:foreach i in={"ether2";"ether3";"ether4";"ether5";"ether6";"ether7";"ether8";"ether9";"ether10"} do={
  /interface bridge port add bridge=bridge-lan interface=$i comment="homelab: lan port"
}

# ---------------------------------------------------------------------------
# 4. Wireless - wlan1, disabled by default (flip disabled=no if you want it)
# ---------------------------------------------------------------------------
/interface wireless security-profiles add name=wifi-sec mode=dynamic-keys \
    authentication-types=wpa2-psk wpa2-pre-shared-key=$wifiPass
:local wlanMac [/interface wireless get wlan1 mac-address]
:local ssid ("Homelab-" . [:pick $wlanMac 9 11] . [:pick $wlanMac 12 14] . [:pick $wlanMac 15 17])
/interface wireless set wlan1 disabled=yes mode=ap-bridge band=2ghz-b/g/n ssid=$ssid \
    security-profile=wifi-sec country=$country installation=indoor wireless-protocol=802.11
/interface bridge port add bridge=bridge-lan interface=wlan1 comment="homelab: lan wifi (disabled by default)"

# ---------------------------------------------------------------------------
# 5. LAN addressing + DHCP
# ---------------------------------------------------------------------------
/ip address add address=$lanIP interface=bridge-lan comment="homelab: lan"
/ip pool add name=dhcp-lan ranges=($dhcpFrom . "-" . $dhcpTo)
/ip dhcp-server add name=dhcp-lan address-pool=dhcp-lan interface=bridge-lan disabled=no
/ip dhcp-server network add address=$lanSubnet gateway=192.168.20.1 dns-server=192.168.20.1,1.1.1.1 comment="homelab: lan"
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

# ---------------------------------------------------------------------------
# 6. WAN - DHCP client on ether1 (uplinked into RB2011 #1's LAN)
# ---------------------------------------------------------------------------
/ip dhcp-client add interface=ether1 disabled=no add-default-route=yes use-peer-dns=no comment="homelab: wan dhcp from edge router"

/interface list member add list=WAN interface=ether1
/interface list member add list=LAN interface=bridge-lan

# ---------------------------------------------------------------------------
# 7. NAT - second NAT layer, this is the double-NAT isolation boundary
# ---------------------------------------------------------------------------
/ip firewall nat add chain=srcnat out-interface-list=WAN action=masquerade comment="homelab: masquerade"

# ---------------------------------------------------------------------------
# 8. Firewall - IPv4
# ---------------------------------------------------------------------------
/ip firewall filter {
  add chain=input action=accept connection-state=established,related,untracked comment="homelab: accept established,related,untracked"
  add chain=input action=drop connection-state=invalid comment="homelab: drop invalid"
  add chain=input action=accept protocol=icmp comment="homelab: accept icmp"
  add chain=input action=accept in-interface-list=LAN comment="homelab: accept from LAN"
  add chain=input action=drop in-interface-list=WAN comment="homelab: drop everything else from WAN (incl. edge LAN)"
  add chain=forward action=accept connection-state=established,related,untracked comment="homelab: accept established,related,untracked"
  add chain=forward action=drop connection-state=invalid comment="homelab: drop invalid"
  add chain=forward action=fasttrack-connection connection-state=established,related comment="homelab: fasttrack"
  add chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN comment="homelab: block edge LAN from initiating into homelab"
}

# ---------------------------------------------------------------------------
# 9. Firewall - IPv6
# ---------------------------------------------------------------------------
/ipv6 firewall filter {
  add chain=input action=accept connection-state=established,related,untracked comment="homelab: accept established,related,untracked"
  add chain=input action=drop connection-state=invalid comment="homelab: drop invalid"
  add chain=input action=accept protocol=icmpv6 comment="homelab: accept icmpv6"
  add chain=input action=accept in-interface-list=LAN comment="homelab: accept from LAN"
  add chain=input action=drop in-interface-list=WAN comment="homelab: drop everything else from WAN"
  add chain=forward action=drop in-interface-list=WAN comment="homelab: drop forward from WAN"
}

# ---------------------------------------------------------------------------
# 10. Misc hardening
# ---------------------------------------------------------------------------
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN

:log info ("homelab-router: configuration complete - SSID: " . $ssid . " (wifi disabled by default)");

If you have any questions or advice, please do not hesitate to contact me.

Have a nice day!

--
Regards,
Mateusz

2

You want us to review AI-like-made configurations?

It would have been more honest if you wrote something like
"I visited site x.y.z and didn't understand how to use these scripts. Can you help me understand them?"

instead, NOT, "I prepared 2 configuration scripts", implying that you wrote them, and knew what you were doing.

With lies and dishonesty from the very beginning, you get nowhere.

3

And In any case, those two script you have posted are the "input", i.e. what you attempted to run on the two machines, not the current configuration on them (which is the relevant part).

Use the instructions here:
Forum rules - #5 by gigabyte091
to make two exports of what is actually running.

4

Hi @rextended,

Thank you for your reply.

No, not exactly. I just want help finding a place where I could find information on how to configure MikroTik devices connected to each other.

Yes, you are right. I used AI to help me prepare these scripts,
but before I did it, I was looking for any thread on the forum which help me build my infrastructure, but unsuccessfully.

I also reset both devices to their default factory configurations. Manually made the required changes, but it did not help either.

Why do you think I came to this forum to tell lies and be dishonest?
Does the fact that I am using artificial intelligence to help me solve my issue anger you?

Have a nice day! ; )

5

Hi @jaclaz ,

Thank you for your reply.

This is a good point of view.

I will export it and post it here tomorrow when I visit my homelab ; )

6

No, it didn't solve them. This is your illusion that it solves them; in reality, it creates them.
The reality is that you're here writing that something doesn't work... Have you tried asking AI to "help you solve your issue"?

7

No, it's not that, but the fact that you've lost empathy using AI,
otherwise you would have clearly understood that "You want us to review AI-like-made configurations?"
means that you shouldn't treat us as revisors of AI hallucinations...

As you can see from other posts, people are willing to help,
but when they're treated as second choice, as idiots and inferior to artificial intelligence,
nothing gets done.

8

Have you tried asking AI to "help you solve your issue"?

Before I ask it to do anything, I describe the whole situation:

  • role
  • perspective
  • configuration
  • infrastructure
  • devices
  • connections

After that, I ask it to prepare a scripts.

9

And indeed, all that effort, and then nothing.

AI is only there to chat, agree with you, make things up, it's addictive and accustoms you to seeing everything in a distorted way.

10 
/system routerboard print

on both devices, please?

11

So much effort and time lost to describe it to an AI.

Could you just write what you expect as a result?
Do we deserve such info?

Do not say what you did or rather what AI suggested to do to fulfill your expectations , it not helps.

12

No, it's not that, but the fact that you've lost empathy using AI,

Thank you for this point of view. I try to stay human and respect other people.
Just like in this situation: our talk via the MikroTik forum - I don't know you, but I respect you.

13

MikroTik #1

[admin@RB2011-EDGE] > /system routerboard print
       routerboard: yes            
             model: RB2011UiAS-2HnD
     serial-number: _   
     firmware-type: ar9344         
  factory-firmware: 3.22           
  current-firmware: 7.4        
  upgrade-firmware: 7.21.4         
[admin@RB2011-EDGE] >

MikroTik #2

[admin@RB2011-HOMELAB] > /system routerboard print
       routerboard: yes            
             model: RB2011UiAS-2HnD
     serial-number: _   
     firmware-type: ar9344         
  factory-firmware: 3.22           
  current-firmware: 7.4            
  upgrade-firmware: 7.21.4         
[admin@RB2011-HOMELAB] >
14

If you are in a home environment, and you are confident that no one will touch the equipment, this is also fine.

15

Upgrade to ROS and firmware to 7.24.1 .
Wirmware needs the second reboot after you upgraded it.

16

Yes, you can upgrade this to 7.24.2 that is just published.

17

7.4 is old (if not ancient).
Upgrading to a more recent version like 7.21.4 (as the device itself suggests) would be a good idea.
7.21.4 is a recent [long term] release, latest is 7.21.5, though due to the mixed up Mikrotik naming of releases there are no particular guarantees that it has not issues.

Personally I would upgrade to 7.20.8 (a previous long term version).

18

From ISP 1 the connectivity is by pppoe, vlan, dhcp client or other?

19

The ideal would be this: (yes, is the model without wireless)

[admin@RB2011UiAS] /system/routerboard> pri
       routerboard: yes         
             model: RB2011UiAS  
     serial-number: 51F3046E37FE
     firmware-type: ar9344      
  minimum-firmware: 7.19.3      
  current-firmware: 7.24.2      
  upgrade-firmware: 7.24.2
20

From ISP 1 the connectivity is by pppoe, vlan, dhcp client or other?

PPPoE authorization with VLAN