First off I have been trying to use this equipment for almost two years but sadly I am pretty bad in networking. Hope some gurus can help me out here. Originally I wanted this to serve as a wireless access bridge (gave up on that) but now I am trying to do the most simple plain vanilla of setups. That is the CRS125 is to act as a Wireless Router similar to those off the shelf Netgear types.
Currently I have the ISP ----> ISP provided modem ----> Mikrotik which serves as the DHCP server & has two wlans (one for internal and the other for guests, but currently unused)
The main problems I have is that within the network I cannot ping or access the other devices (but I understand this is prob a hairpin NAT issue) but even when I am on another network (I have two fixed IPs and internet subscriptions) I am unable to SSH into the server attached to the Mikrotik even with Port Forwarding.
My guess is that perhaps because the modem has the Public IP and whereas the Mikrotik does not have the Public IP.
So where my Public IP is say 138.199.181.222
My ether1-gateway is 138.199.180.1
This is because I set the Address Acquisiton under QuickSet as automatic. Should I be using Static or PPOE?
Within the network all my devices are 192.168.88.X and I have set them to static IPs to prevent them from changing.
Appreciate any insights on how to troubleshoot this.
You can do port forwarding only with public address, because that’s what you can connect to from internet. If it’s on your modem and not on router, you need to do something with modem first. Either switch modem to some transparent (bridge) mode that would allow your router to get public address. If it’s not possible, then you need to configure modem to forward ports to your router, either just selected ones, or everything (usually called DMZ). And then you can forward what you need further in LAN.
Checked with my ISP and they say my Fiber modem does not have an interface, it does not have any DHCP server as well and there is no way to set it into bridge mode. Everything should be controlled by the router.
If this is the case, what is the best way to troubleshoot the port forwarding? I believe the IP is on the router but perhaps not the right interface/port?
Don’t believe, be sure. If you check some online service like whatismyip.com, is the same IP address on your router? If so, it should work (only the linked guide is not compatible with hairpin NAT, but you can solve it later).
Add your dstnat rule, ask Google for “online port scan”, choose some you like and use it to test your rule (enter your public address and used port). Ideally it should tell you that the port is open. But even if it doesn’t, check packet counter of your rule if it increases when you do the test, at least that should happen (it could mean that either packets are not passing through router, or the internal device doesn’t accept them).
First off, I dont think the rules order matters, my srcnat rule is before my dstnat rules… Hopefully someone can confirm.
The only question is what is the purpose of the FW rule below??
@anav: Order matters within same chain. But when you see multiple chains in same window (dstnat and srcnat in NAT, input and forward in Filter, etc..) you can have one before the other, other way around, interleaved, anything. Only same chain matters.
And regarding the current problem, I’d like to direct attention to my previous message. In all modesty, I think there were some good suggestions. So step one, check the IP address. Step two, test it from outside and check counters on dstnat rules.
I figured as much but it doesnt look like what is standard…
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
I don’t think the bold above is standard but can be wrong, for me personally though, my default drop rule drops all, irrelevant if from WAN, LAN, VPN, etc as with security, majority of incidents is from inside
Haha okay, point well taken, not sure where I got that, now that I think about it.
But do please, if you are brave enough, to show us your … input drop rule!!