Hi, new to Mikrotik and I have a LTE router with Hap Ac Lite and I have a big issue straight away that I dont have any access to the internet, Netflix etc.
I dont have much experience in knowing what to do so im hoping you guys can get me out of a pickle!
thank you.
model = RB952Ui-5ac2nD
# serial number = C55F0B6xxxx
/interface bridge
add admin-mac=C4:AD:34:B5:A9:B4 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
country="united kingdom" disabled=no distance=indoors frequency=auto \
installation=indoor mode=ap-bridge ssid= wireless-protocol=\
802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country="united kingdom" disabled=no distance=indoors \
frequency=auto installation=indoor mode=ap-bridge ssid= \
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
Thank you for uploading the configuration. Without it, we’re guessing…
For future reference, when uploading click the code display icon in the toolbar above the text entry (the code display icon is the 7th one from the left and looks like a square with a blob in the middle). Then paste the text from the file in between the two code words in brackets. Makes it easier to deal with on the forum.
no problem will remember next time…are you able to help?
That’s a really straight forward config…
Confirm that the LTE “router” is connected to port 1 of the hAP via a cable, and you are plugging in the computer you are using for test into any other port on the hAP? The test computer should be set for DHCP and should therefore get an IP address in the 192.168.88.x range. If all this is true, you should be able to communicate with the hAP via IP address 192.168.88.1
Since you were able to capture the config of the hAP, I am assuming for the moment that the hAP is getting an IP address on port 1 (being used as the WAN port). Can you confirm if the hAP is getting an IP address on the WAN interface (port 1)? If yes, can try tools on the hAP and try to ping 8.8.8.8. Do you get a response?
Are you using WinBox, WebFig, or a text based command port to communicate with the hAP?
Hi, yes connections to the Hap are correct in the way you said.
I was only able to post the terminal script by using a hotspot on my phone, however for some reason I can now connect through my Hap using the IP address 192.168.1.1 but before I was only able to access the LTE via IP address 192.168.88.1…but now I can’t access the LTE address.
any suggestions?
My suggestion for using a cable rather than a WiFi connection is it is a known and eliminates the WiFi as being part of the problem…
I was only able to post the terminal script by using a hotspot on my phone, however for some reason I can now connect through my Hap using the IP address 192.168.1.1 but before I was only able to access the LTE via IP address 192.168.88.1…but now I can’t access the LTE address.
That statement is confusing. Almost sounds like you were connecting via WiFi to the LTE router and not the hAP. What is the LTE router, and how is it configured?
I was assuming it was operating essentially as a cellular modem and providing a wired internet connection to the hAP. Sounds like there is more to it.
right essentially what I’ve done is left an ISP who had pre-configured my Mikrotik equipment the LTE and the Hap and I’ve since left them and now have a cheaper tariff using a SIM only deal.
What they told me to do was to factory reset the Hap and that has since wiped out the previous configurations and I’m left in this mess so that’s the situation I’m at and I’m at a loss of what to do hence being new to the Mikrotik world, hope that makes sense.
so the situation at the moment is that I’m only able to login to the LTE via 192.168.88.1 but once I try and enter 192.168.1.1 I’m unable to do this.
Also I’m able to access the internet on my mobile phone no problem but everything else such as laptop, Netflix, TV’s there is nothing at the moment.
I’ve got to run, but it sounds like the LTE router is another Mikrotik and it is also trying to have a LAN address range of 192.168.1.n. Therefore, the WAN side of hAP and the LAN side of the hAP are both in the same address range - which will not work right. Are you trying to use the hAP just as a switch and leave all the router functions in the LTE router, or leave teh LTE router as dumb as you can make it and use the hAP for all your “router” functions?
And what is the LTE router?
Hi, yes the LTE is also a Mikrotik brand and its purpose is to give the best possible signal and its located externally and the purpose of the Hap is to act as the router.
How do I go about configuring in the way its meant to do its job correctly without both devices conflicting the IP addresses?
If LTE is simply passing a public IP to the hapac, shouldnt be conflict.
More likely LTE is getting the public IP and then through its LAN passing the traffic to the HAPAC.
The problem is the HAPAC probably has the same LAN IP subnet as the LTE,
So k6ccc is stating change the default LANIP structure on either of the two MT devices to something else.
Hi, do you mind going through exactly what I need to do in the settings and how to change these values if you don’t mind.
any help guys?
You have to do the work LOL, its the only way to learn the router.
What i suggest is you take an unused port on the hapac ether X.
And you should be able to login into winbox.
Then you can play with changing the settings of the bridge without fear of locking yourself out.
Will take some steps.
but mainly
(1) change the IP pool of the bridge first
from 192.168.88.XX - 192.168.88.YYY (to your new subnet)
To: 10.10.88.XX - 10.10.88.YYY
(2) change the IP address assigned to the lan to 10.10.88.1/24
(3) DHCP server ( should require no change )
(4) change the dhcp server-NETWORK to 10.10.88.0/24 gateway 10.10.88.1 and dns-server 10.10.88.1
That should be close to see if you have a better experience with the two devices interacting…
# jan/02/1970 00:39:32 by RouterOS 6.49.7
# software id = XZJM-ETQG
#
# model = RB952Ui-5ac2nD
# serial number = C55F0B6C8136
/interface bridge
add admin-mac=C4:AD:34:B5:A9:B4 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
country="united kingdom" disabled=no distance=indoors frequency=auto \
installation=indoor mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country="united kingdom" disabled=no distance=indoors \
frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik \
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
192.168.1.0
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.1.1 netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/code]
/interface bridge
add name=bridge1
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band=""
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=everywhere ip-type=ipv4 passthrough-interface=
bridge1 passthrough-mac=auto use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=dhcp interface=bridge1 name=defconf
/interface ppp-client
add apn=internet name=ppp-out1 port=usb1
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add fib name=via-AAISP
/interface bridge port
add bridge=bridge1 ingress-filtering=no interface=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=lte1 list=WAN
add disabled=yes list=LAN
add interface=bridge1 list=LAN
add disabled=yes interface=ppp-out1 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge1 network=
192.168.1.0
add address=192.168.88.1/24 interface=ether1 network=192.168.88.0
/ip arp
add address=192.168.1.30 interface=bridge1 mac-address=E8:78:29:54:91:AA
/ip dhcp-client
add disabled=yes interface=*1
/ip dhcp-server lease
add address=192.168.1.30 client-id=1:e8:78:29:54:91:aa mac-address=
E8:78:29:54:91:AA server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=forward connection-state=established
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward protocol=icmp
add action=drop chain=forward connection-nat-state=dstnat disabled=yes
in-interface=!*4
add action=drop chain=forward connection-nat-state=!dstnat disabled=yes
in-interface-list=WAN
add action=fasttrack-connection chain=forward disabled=yes dst-port=53
hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward disabled=yes dst-port=53
hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward disabled=yes dst-port=53
hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward disabled=yes dst-port=53
hw-offload=yes protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-address=81.187.83.242
dst-port=44158 in-interface=*4 protocol=tcp to-addresses=192.168.1.30
add action=masquerade chain=srcnat disabled=yes out-interface=*4
/ip proxy
set port=1080
/ip route
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=*4 pref-src=""
routing-table=via-AAISP scope=30 suppress-hw-offload=no target-scope=10
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=lte1 type=external
/routing rule
add action=lookup-only-in-table disabled=no src-address=192.168.1.30 table=
via-AAISP
/system clock
set time-zone-name=Europe/London
/system identity
set name="MikroTik LTE"
Hi guys, I’ve now got no internet access at all…this is turning into a very steep learning curve…can any of you good people get me back online.
thanks.
any help?
Help with what??
The advice provided was that likely you had the same LAN subnet on both devices and therefore there would be conflict.
Tell us what you attempted, because we have no clue to what you had, what you changed and what you want to do???