Just finished with the setup of my new router. Got everything I need working except one thing. Wireless.
It’s odd, I can connect to the wireless signal with very good reception, I can browse my network fully and ping all my devices with no problem. I cannot however, browse the internet at all. I am assuming this is a simple setting that I am overlooking, but I just cannot seem to find it. I have tried resetting the wireless to its default settings, I have tried removing all wireless configurations and doing it manually and nothing is working here. Any help or insight you guys have would be really appreciated!
If you need any additional information let me know, and I will provide it accordingly. Please bear with me, although I am not new to networking in general, I found this router setup a little more challenging than I anticipated.
Just a comment-
I found that these pretty much will work out of the box. You might try first, backup
your config, reset to factory, and test. This should let you know if the problem is outside the Mikrotik box first,
then, try bringing back in you config step by step.
What is your out WAN port? Is masquerade on or off that port?
Alright, I have tried what you said. I reset to factory defaults and just like before, I connect to the wireless and browse the local network without issue. Still can’t reach the internet on wireless though. Wired still works fine. Thinking about it, I do not believe this is an issue with any of the wireless settings, as it functions perfectly but rather a setting in something else. What that is, I have no idea yet.
My WAN port is the default of ether1. I have a (defualt, already set up) bridge-local which reports that all ports are a part of. In IP>Firewall>NAT there is an entry for masquerade that is set to “enabled” – disabling this does not change anything (as far as wireless goes). Wireless is setup as ap bridge, 2GHZ-B/G/N, Frequency-2412, Channel width-20/40MHz HT above, bridge mode-enabled and no security (I will set up with WPA2 once working).
And, if it is relevant, I am on Comcast with DHCP addressing. If you would like me to upload any snippet of my config, let me know what you need and how to to get it (or at least what you need) nd I’ll do my best to provide
Make sure your wireless interface is joined to the other switchports in a bridge interface…
Please open a terminal window from winbox and run: “export compact” and paste your result.
I am testing the wireless with an Android phone, I CAN ping IP addresses successfully! I just can’t browse websites by there domain name. Also, I can browse my local network completely with no issues (I have a server, NAS, and a couple desktops that I can see).
I have a a bridge interface “bridge-local” that all the ethernet ports and wlan1 are a part of. My WAN port is “ether1-gateway.”
I have the requested output below, something that concerns me is that the routers default IP is 192.168.88.1. I have changed this to 192.168.1.1, but I see below that X.X.88.1 still shows up… what is this, and does it need changed?
I discovered more information! It looks like anything getting an IP via DHCP (wireless, or ethernet) is getting issued a DNS server of 192.168.88.1. This is the problem. The reason I don’t have any issues with my ethernet devices is because they are all currently static IP’s with static, manually set DNS servers as well. When I try to use DHCP I can’t browse online anymore.
So now that I know what the problem is, how do I fix this? I found and replaced all the DNS settings that I could find that have X.X.88.1 with X.X.1.1 but it is still issuing X.X.88.1 to DHCP devices. Help!
EDIT: So I’ve narrowed it down even farther, but I don’t know how to change this. It appears to be one line “dns-server=192.168.88.1” that I can’t seem to change. Here is some output
I have looked through all of the options for “/ip dns” and I can’t seem to find what I need to change. Also, the GUI is of no help for this, all the settings in it show only X.X.1.1.
EDIT 2: I got it solved!!! Turns out, “dns-server=” is found in “/ip dhcp-server network”. Located the setting, changed it to my current X.X.1.1 IP and now everything works fine.
Thank you ALL for your posts… they got me thinking in new ways, this led me to finding the setting I was looking for.
You might consider turning off the DHCP services, if you have another - disable in the GUI menu IP > DHCP Server > DHCP select the server which generally the first one is dhcp0 and disable it, or remove it.
disable in the CLI :
ip dhcp-server print
disable 0 or which ever it is
However, if you have many devices, Mikrotik as your DHCP server is a good choice.
I don’t have any other DHCP servers running. Only the one from MikroTik, and I need to have it for the wireless devices. Otherwise, I would just turn it off.
Thanks again everyone for all your help! It is greatly appreciated, and was incredibly helpful!
I would recommend to remove all the non-used default gateway settings on either ether1 or sfp.
Also I recommend to change the firewall filter rules a little
You now have
/ip firewall filter
add chain=input comment=“default configuration” protocol=icmp
add chain=input comment=“default configuration” connection-state=established
add chain=input comment=“default configuration” connection-state=related
add action=drop chain=input comment=“default configuration” in-interface=
sfp1-gateway
add action=drop chain=input comment=“default configuration” in-interface=
ether1-gatewayConsider changing the last to into something like this
/ip firewall filter
add chain=input action=accept src-address=192.168.1.0/24 in-interface=local-bridge comment=“Allow traffic coming from local bridge”
add chain=input action=drop comment="Drop all remaining traffic"Also create some filter rules in forward chain.
A search on google will lead to a “simple” best practice solution.
I think I understand what you are telling me to do, but I don’t understand why. Can you explain these steps? Please tell me what my current code is (or isn’t) doing, and what the new code would do.
The code you now have is not particularly wrong, besides the not-used sfp-rule, which is doing nothing because the interface is not used.
But as far as I have been taught and handeling most of the traffic on firewalls I have configured is that you allow specific traffic that I would like to pass and block all the rest.
So for that reason my way of building rules is allowing inside traffic to pass through the firewall if it is from an IP address known as my internal network, and it is entering the router from the local network bridge. The IP range is not really needed but gives some more security if there is some uninvited system on the network. I did not specify any out-interface, because if you specify that for instance to be your ether1-gateway, I can not communicate between your internal systems, although that also depends on the bridge setting use-ip-firewall=yes/no.
Here you see my complete set of rules
/ip firewall filter
add action=drop chain=input comment=“Drop invalid connections” connection-state=invalid
add chain=input comment=“Accept established connections” connection-state=established
add chain=input comment=“Accept related connections” connection-state=related
add chain=input comment=“Allow access from local network” in-interface=br-PrivateNetwork src-address=192.168.25.0/24
add chain=input comment=“Allow access from guest network for DNS” dst-port=53 in-interface=br-GuestNetwork protocol=udp src-address=192.168.125.0/24
add action=log chain=input comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop input RR:”
add action=drop chain=input comment=“Drop everything else”
add action=drop chain=forward comment=“Drop invalid connections” connection-state=invalid
add chain=forward comment=“Accept established connections” connection-state=established
add chain=forward comment=“Accept related connections” connection-state=related
add chain=forward comment=“Allow traffic from Local network” in-interface=br-PrivateNetwork src-address=192.168.25.0/24
add chain=forward comment=“Allow Guest network going outside” in-interface=br-GuestNetwork out-interface=pppoe-***** src-address=192.168.125.0/24
add action=log chain=forward comment=“Log everything else” disabled=yes log-prefix= “IPv4 Drop forward RR:”
add action=drop chain=forward comment="Drop everything else"As you can see I have 2 networks. A guest and a private. Both are using a different IP range and since I allow the guest traffic only to my outgoing pppoe interface, guests can not connect to my private systems.
through the wireless connection?