Need a second set of eyes

RouterOS General
1

Hello,

I need a second set of eyes to looks over this. I do not understand where I’m getting blocked.

I added these two entries but no go.
add action=dst-nat chain=dstnat dst-address=104.—.—.51 dst-port=443 protocol=tcp to-addresses=192.168.88.57 to-ports=443
add action=dst-nat chain=dstnat dst-address=104.—.—.51 dst-port=8443 protocol=tcp to-addresses=192.168.88.57 to-ports=443

The server at 192.168.88.57 has the ports open in its firewall and I am able to browse to 443 and 8443 from other machines on the LAN.

The primary WAN IP is the 104.—.—.50. The rules going to .50 are working. Same LAN.

# model = RB5009UG+S+
# serial number = 
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik

/ip pool
add name=dhcp ranges=192.168.88.75-192.168.91.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN

/ip address
add address=192.168.88.1/22 comment=defconf interface=bridge network=192.168.88.0
add address=104.---.---.50/29 interface=ether1 network=104.---.---.48

/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/22 gateway=192.168.88.1 netmask=22
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,1.0.0.1,8.8.4.4,9.9.9.9
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.168.88.0/22 src-address=192.168.88.0/22
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=104.---.---.50 dst-port=443 protocol=tcp to-addresses=192.168.88.5
add action=dst-nat chain=dstnat dst-address=104.---.---.50 protocol=!ipsec-esp to-addresses=192.168.88.5
add action=dst-nat chain=dstnat dst-address=104.---.---.50 dst-port=500 protocol=udp to-addresses=192.168.88.5 to-ports=500
add action=dst-nat chain=dstnat dst-address=104.---.---.50 dst-port=1701 protocol=udp to-addresses=192.168.88.5 to-ports=1701
add action=dst-nat chain=dstnat dst-address=104.---.---.50 dst-port=4500 protocol=udp to-addresses=192.168.88.5 to-ports=4500
add action=dst-nat chain=dstnat dst-address=104.---.---.51 dst-port=443 protocol=tcp to-addresses=192.168.88.57 to-ports=443
add action=dst-nat chain=dstnat dst-address=104.---.---.51 dst-port=8443 protocol=tcp to-addresses=192.168.88.57 to-ports=443

/system clock
set time-zone-name=America/Toronto
/system identity
set name=DC-R01
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Thanks for any help you can provide. Even if not related to the router. I’ll check anything to get this working today.

2

[SOLVED]

With not too much effort analyzing the firewall rules,
.51 is not assigned to any interface (for example: ether1), how you expect than the router can reply with that address?

3

Do I need to have these lines in the config for each of my useable WAN IPs?

add address=104.—.—.51/29 interface=ether1 network=104.—.—.48
add address=104.—.—.52/29 interface=ether1 network=104.—.—.48
add address=104.—.—.53/29 interface=ether1 network=104.—.—.48
add address=104.—.—.54/29 interface=ether1 network=104.—.—.48

4

Just for what IP you want use, if you do not need to distribute the IP on your LANs.

5

Thanks. Added a line for the 51.

Honestly, I’ve never had to provide the address for the additional WAN IP addresses on other routers. I figured since we supply the /29 subnet, the router would know which IPs are available to it.

6

You cut from the export the routing and other parts
If your ISP assign to you 104.168.88.48/29, you can probably use all 8 IPs (48-55),
If 104.168.88.49/29 is the other side of “PTP” link, probably you can use only 104.168.88.50 + 51/52/53/54.


The router do not know anything, you must provide that info,
but about other routers, I do not know how are configured and I can not guess why.

7

Maybe I made mistake when I cut the config, but I meant to only cut IPv6 and IPSEC entries.

Yes, the IPs I can use are from 50-54. 49 is the gateway IP they provided.


The router do not know anything, you must provide that info,
but about other routers, I do not know how are configured and I can not guess why.

I’ve been using cisco routers for many years and only recently started to use Mikrotik. I just need to get used to the different logic being used. Makes sense, but I have a lot to learn.

Thanks for your help. I suspected that I needed to add the second WAN IP but I was worried to try in case I lost my connection. I did not feel like driving to the data center.