Hello, I’m trying to connect 2 lan through mikrotik in order to apply firewall rules, but something strange is happening.
Starting from scratch:
PC: 172.30.0.1/24 GW 172.30.0.254 DNS 172.30.0.254 (Mikrotik GW)
Mikrotik:
Address List
ether1 - LAN - 172.30.0.254/24
ether2 - RLAN - 219.7.221.252/24
Route List
219.0.0.0/8 GW 219.7.221.254 “Reachable ether2”
Filter Roules
Forward accept
At this point if i make a ping (ex: 219.100.0.1) on the mikrotik console, I already have an answer, but if it is from the PC I don’t get an answer, if I make a trace, go to the mikrotik and don’t go any further.
If I change to:
NAT
srcnat - masquerade
I can already ping the PC, the tracert also advances to the destination, but I cannot establish connections, ex: RDP
I’ve been trying to solve this for days, what will be escaping me?
Thank you for your help
Since you only gave a few details, the most obvious issue is your 219 subnet on the router is /24, and it is trying to communicate with devices outside that subnet IP range. Other than that, you did not give enough details. Export and post your config. If there are more devices involved, a network drawing would be helpful.
Maybe you can try a VLAN config
LAN: Bridge
Make sure there is no other LAN on the Interface list
Make 2 VLANs with separate VLAN ID
Mount each VLAN to its own ether port on the Interface option box
Add both VLANs to the main bridge as ports
Configure what ever is connected to each ether port with a VLAN ID you used on that ether port of the router
Make sure in addresses that the Bridge has an IP address and is the main IP for the router
After you set up all the VLAN IDs respectively to the ether ports that is connected to each other
You can remove ether1 and ether2 as ports of the Bridge, just remember if you remove the ether1 and ether2 before you set up the VLAN IDs you gonna lose contact with the router
LAN: Bridge
VLAN1: Interface - ether1 / VLAN ID - 500 <— add this VLAN and/or VLAN ID to what ever port/device connects to ether1
VLAN2: Interface - ether2 / VLAN ID - 501 <— add this VLAN and/or VLAN ID to what ever port/device connects to ether2
Bridge Ports: VLAN1 and VLAN2, remove ether1 and ether2 after every thing has VLAN and/or VLAN IDs
Addresses: What ever IP/IPs to the Bridge
It sounds to me like you are trying to connect 2 separate and isolated networks together that is running their own Bridge each. That can cause you to set up DHCP clients across the bridges. Even if they are connected, the bunch of bridges is not reading each others routing tables.
With this configuration within the mikrotik I can ping the 219 network, but from the PC it dies in the mikrotik.
With tracert leaves the PC to MK and dies there.
I’ll assume the network subnets are real even if IP addresses aren’t. So … there are two potential problems:
Does router 219.7.221.254 have static route towards 128.136.0.0/16 via 219.7.221.252?
Does router 219.7.221.254 run stateful firewall? You are possibly creating routing triangle between mikrotik, devices in 219.7.221.0/24 and said router where packets from 128.136.0.0/16 towards that /24 subnet will be set directly from mikrotik to devices, return packets might go via router 219.7.221.254 (if devices don’t use mikrotik directly as first hop on way back) … stateful firrewalls burp if they don’t see all packets of connection traveling in both directions
Same consideration applies to side of 128.1360.0.0/16.
Neither of problems applies to mikrotik itself as it will (by default) use own address “closest” to the destination address when establishing connection.
So in other words, there is a router attached to all the computers on one subnet and another router attached to all the computers on the other subnet and you want to add a third router in between to get the LANS to see each other for some purposes not clearly defined.
In other words, your network diagram and explanation are incomplete. Where is the internet for both LANs coming from?
If the answer is through the mikrotik as the MT has ether1 going to ISP1 and ether2 going to ISP 2, then all makes sense for firewall rules and routing etc…
