I’m using a Mikrotik Router connected to a Zyxel VMG3006-D70A Modem to connect to Deutsche Telekom.
PPPoe Client has been configured to use the necessary VLAN ID 7. This part seems to work, as the client establishes the connection and gets an IP address. After establishing connection the default routes do also exist. NAT rule to masquerade outgoing traffic is also defined.
Unfortunately I am still unable to ping any internet adress from the router or any of its ports.
I’ve been trying to solve that for some hours now. Unfortunately without luck. I still have no Idea what’s wrong.
If anybody could help it would be appreciated.
The current configuration (RouterOS 7.16.2) is shown below.
Adding eth1, pppoe and vlan7 interface to list=WAN does not change behavior. Still unable to ping any internet address. Ping on local addresses works like a charm.
if it’s working - then you need to track down how to secure that !lan
2 D 79.224.52.103/32 62.155.242.73 pppoe-t-vdsl
and that pppoe was inside vlan 7. you don’t have ip address for your vlan hence your bridge can’t reach your pppoe.
before you give vlan 7 ip address - just try to ping your pppoe address from your lan - not from the router. if it’s working - then try to traceroute to mikrotik.com and see at which point it fails.
Code: Select all
chain=input action=drop in-interface-list=!LAN log=no log-prefix=“!LAN”
that part - try to change its action=accept.
Changing action to accept didn’t change behavior → still no ping possible (from router and LAN)
Code: Select all
2 D 79.224.52.103/32 62.155.242.73 pppoe-t-vdsl
and that pppoe was inside vlan 7. you don’t have ip address for your vlan hence your bridge can’t reach your pppoe.
I assigned IP adress from local subnet to VLAN7. → Now I can ping pppoe from within the router and from LAN.
Traceroute from LAN PC to mikrotik.com fails (because of dns not working without internet). If I traceroute from LAN PC to IP 8.8.8.8 instead, I get stuck on the router.
No ping to internet addresses possible from router
I see no default route 0.0.0.0/0 pointing to the next hop?!
Default route gets added when pppoe is connected and points to pppoe, so that is why it is not part of the initially exported config,
ip route print on router shows the following result
Flags: D - DYNAMIC; X - DISABLED, I - INACTIVE, A - ACTIVE; c - CONNECT, s - STATIC, v - VPN
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY DISTANCE
0 Xs 192.168.178.0/24 ether2 1
DAv 0.0.0.0/0 pppoe-t-vdsl 1
DAc 62.155.242.73/32 pppoe-t-vdsl 0
DAc 192.168.174.0/24 ether2 0
;;; route to 176
1 As 192.168.176.0/24 192.168.174.1 1
DAc 192.168.177.0/24 bridge 0
;;; route to 178
2 As 192.168.178.0/24 192.168.174.1 1
3 As 192.168.200.0/24 192.168.174.1 1
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN add interface=pppoe-t-vdsl list=WAN
Do not use same names for different parts of the config AND REMOVE SERVER ADDRESS it does not belong here!! /ip dhcp-server
add address-pool=WTC_PRIV interface=bridge lease-time=4h name=WTC_PRIVserver-address=192.168.177.1
so change name of dhcp server to: /ip dhcp-server
add address-pool=WTC_PRIV interface=bridge lease-time=4h name=WTC_SERV server-address=192.168.177.1
you have given ether2 a separate IP address, and therefore either REMOVE the address for ether2, or REMOVE ether2 from the bridge and add dhcp server, dhcp server network and IP pool for ether2. More than likely you just forgot to get rid of ether2 from default settings. There is something amiss with this unknown subnet??
You can do one better…
From: add action=accept chain=input comment=“Allow access from LAN” in-interface-list=LAN
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN log=yes log-prefix=
!LAN
TO: add action=accept chain=input comment=“Allow access from LAN” in-interface-list=LAN add action=drop chain=input comment=“drop all else”
Modify from this add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
add action=drop chain=input comment=“drop everything else” log=yes log-prefix=DROP
TO the clearer: add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
Why do you have a hairpin NAT rule if you have no dst nat or port forwarding in the mix???
You have three routes to NOTHING… there is only one subnet on your router 192.168.77.0/24, where are the other three coming from???
from the router with src addr of your pppoe ip. if succeed then,