d4fo
April 22, 2013, 10:32am
1
Hi Everyone,
I have never set up a dedicated DSL line and I am having issues with NAT.
I have various nat forwarding rules which work on other identical routers but the traffic is being received but nothing happens with it
I would like to write more but I think it would be easier to dump the config to you all. I am remotely connectected via web interface.
A port scan shows the following result.
http://oi34.tinypic.com/ke8d2p.jpg
For instance there is a nat rule for SMTP and it shows traffic when the port scan is on.
cbrown
April 22, 2013, 11:20am
2
Could you post /export compact ?
d4fo
April 22, 2013, 11:38am
3
I did it from the IP Menu - how’s that? do you need more info?
Any help would be amazing!!
# jan/02/1970 11:29:25 by RouterOS 5.23
# software id = WJUE-35B0
#
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip address
add address=192.168.0.162/24 comment="default configuration" interface=Bridge
add address=192.168.0.210/24 interface=ether4
/ip dhcp-client
add disabled=no interface=sfp1-gateway
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=input dst-port=25 protocol=tcp
add chain=input dst-address=0.0.0.0 src-address=0.0.0.0
add chain=input dst-address=192.168.100.0 src-address=192.168.0.0
add chain=forward dst-address=60.240.155.9 src-address=60.240.155.10
add chain=input dst-port=25 protocol=tcp
add chain=input dst-address=0.0.0.0 src-address=0.0.0.0
add chain=input dst-address=192.168.100.0 src-address=192.168.0.0
add chain=forward dst-address=60.240.155.9 src-address=60.240.155.10
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.0.0/24
add action=dst-nat chain=dstnat comment=SMTP dst-port=25 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=25
add action=dst-nat chain=dstnat comment=HTTPS dst-port=443 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=443
add action=dst-nat chain=dstnat comment="PPTP VPN" dst-port=1723 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=1723
add action=dst-nat chain=dstnat comment=FTP dst-port=20-21 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.3 to-ports=20-21
add action=dst-nat chain=dstnat comment="SMTP Backup" dst-port=25 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=25
add action=dst-nat chain=dstnat comment="HTTPS Backup" dst-port=443 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=443
add action=dst-nat chain=dstnat comment="Backup PPTP VPN" dst-port=1723 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=1723
add action=dst-nat chain=dstnat dst-port=3389 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=3389
add action=masquerade chain=srcnat src-address=192.168.0.0/24
add action=dst-nat chain=dstnat comment=SMTP dst-port=25 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=25
add action=dst-nat chain=dstnat comment=HTTPS dst-port=443 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=443
add action=dst-nat chain=dstnat comment="PPTP VPN" dst-port=1723 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=1723
add action=dst-nat chain=dstnat comment=FTP dst-port=20-21 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.3 to-ports=20-21
add action=dst-nat chain=dstnat comment="SMTP Backup" dst-port=25 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=25
add action=dst-nat chain=dstnat comment="HTTPS Backup" dst-port=443 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=443
add action=dst-nat chain=dstnat comment="Backup PPTP VPN" dst-port=1723 in-interface="TPG Backup" protocol=tcp to-addresses=192.168.0.2 to-ports=1723
add action=dst-nat chain=dstnat dst-port=3389 in-interface="TPG Symmetrical" protocol=tcp to-addresses=192.168.0.2 to-ports=3389
/ip neighbor discovery
set sfp1-gateway disabled=yes
set "Ether1 - Gateway" disabled=yes
set wlan1 disabled=yes
/ip route
add check-gateway=ping comment="Default Route" disabled=yes distance=1 gateway="TPG Symmetrical"
add comment="Backup Route" disabled=yes distance=5 gateway="TPG Backup"
add check-gateway=ping comment="Default Route" disabled=yes distance=1 gateway="TPG Symmetrical"
add comment="Backup Route" disabled=yes distance=5 gateway="TPG Backup"
/ip service
set telnet disabled=yes
set ftp disabled=yes
d4fo
April 22, 2013, 11:48am
4
Any help would be great - it is interesting the result when I do a port scan. Also - the NAT rules get packets but they don’t seem to be going anywhere and the router is on the same subnet/the address is correct etc.
d4fo
April 22, 2013, 12:02pm
5
I keep getting
TPG Symmetrical: rcvd LCP EchoReq id=0x44
In the event log
cbrown
April 22, 2013, 12:12pm
6
What is your WAN interface on this router?
In your rules you show in-interface of TGP Symetrical and TGP Backup but I do not see that interface anywhere. You need to set the in-interface of your current WAN interface in your nat rules.
d4fo
April 22, 2013, 12:20pm
7
What is your WAN interface on this router?
In your rules you show in-interface of TGP Symmetrical and TGP Backup but I do not see that interface anywhere. You need to set the in-interface of your current WAN interface in your nat rules
Ignore the Backup ones for now - I will add those later.
At the moment I have a dedicated DSL line into Ether-1 Gateway. I have the PPPoE interface on that interface and it is connected and listening. Is there anything else you need to make it easier I am really getting a bit desperate here. If I make a test NAT rule for RDP I can see the connection attempts adding packets to the rdp interface, the same when I do a port scan from MXtoolbox on ip http://192.168.0.210/ but it shows as port closed!
cbrown
April 22, 2013, 12:24pm
8
What is the name of your PPPoE interface? I do not see it in your export. Is that a current export?
d4fo
April 22, 2013, 12:27pm
9
[interakt@MikroTik] > interface export compact
/interface bridge
add add-default-route=yes comment=“Failover PPPoE” interface=
