I recently bought an RB5009UG+S+IN for my office network. There’s nothing very special to manage—8 PCs, 1 virtualization server, some IP phones, and a bunch of IoT devices.
Actually, I’ve never configured a RouterOS device before, but after reading some documentation and watching a few tutorials, I think I can handle the basics (or maybe not!).
After configuring a LAN bridge for all the ports (except eth1 for WAN), I created a DHCP server using the wizard (with a pool, and so on…), set up a DHCP client for my eth1 (WAN), and set up NAT masquerading for it. I assumed this would allow internet access.
Right now, I’m in a test setup where I have my ISP router connected to the WAN and one PC connected to eth2.
The PC correctly receives an IP from the DHCP server.
The WAN receives an IP from the ISP router.
The RB5009 can reach the internet (I tested with a ping and a system upgrade, both worked fine).
However, there is no internet connection on the PC.
Looking at the Ethernet card status on the PC, I think something is wrong with the DNS or gateway settings.
Can someone help me figure out the issue?
How can I show you the full configuration of my RB5009?
While waiting for replies, I tried resetting all the configurations and using the default one. It works like a charm.
It’s similar to my bare minimum configuration, with some differences, of course!
In the configuration I posted earlier, I deleted all the firewall rules just for testing purposes—you know, to check if the lack of connectivity was related to incorrect rules, but obviously, it wasn’t.
Now, thanks for your help! I’ll continue configuring by adding my PPPoE connection to my ONT and hope it works fine. Of course, I now have all the default firewall rules active!
Next, I’ll need to add some port forwarding and hope I can manage it!
Again, sorry for the newbie questions, but this is my first attempt at exploring this new world!
If I may, it is not a good idea to connect a router to internet without a proper set of firewall rules.
You should first thing add these (they are the default ones from Mikrotik for other devices, adapted for your case):
When fiddling with a Mikrotik with only an interface as WAN all the rest in a LAN bridge it is extremely easy to get locked out by the firewall filter rules or from some other limitations, so the usual advice is to take a port (let’s say ether8 in your case out of the bridge and categorize it as MGMT, besides LAN.
This snippet “categorizes” interfaces and explicitly allows Winbox on the LAN bridge and ether8 ( later ether8 will become only MGMT interface).
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment=defconf name=MGMT
/interface list member
add interface="ether1 -WAN" list=WAN
add interface="bridge- LAN" list=LAN
add interface=ether8 list=LAN
add interface=ether8 list=MGMT
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
though personally I would get rid of the space (and of the double quotes) in the names of interfaces, ether1_WAN and bridge_LAN remain perfectly readable.
Then the basic default firewall filter rules:
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
Then I would add an address like 192.168.88.1/24 to ether8, so that you can manually connect to it sertting your PC to 192.168.88.2, Winbox should be able to connect to it via MAC no matter the IP address.
Be careful when doing these changes, try first them in Safe mode and check that you still have connection to the RB5009.
If you have doubts, ask before making them.
Two things, always use safemode when configuring the router. Basically invoke it, make changes, wait 5 seconds and if the router doesnt blow up, unselect safe mode, which captures the config (saves it) and then continue. If you do something while in safe mode it will go back to the last step before selecting safe mode!!
Second thing, to do vlans its safest to do so from a port OFF the bridge.
So take like port 9 off the bridge, give it its own IP address and access the router from there for all configuring.
/interface ethernet
set [ find default-name=ether9] name=OffBridge9
i think i make all the steps right, and after that router terminal can ping 1.1.1.1 whitout problem, but…no connectivity in my PC on eth2, and i noticed the status “Sercing…” in the DHCP Client on eth1WAN
This does not look good at all.
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=192.168.88.1 interface=ether8 network=192.168.88.1
If your plan was to use ether8 as a safe place to config,
a. it needs to be removed from the bridge ( which you have done, super!_
b. get a different non-overlapping ip address from the bridge. use something like 192.168.65.1/30
Did you not read the post I made on this subject???
Actually, my plan was to use it, after completing all the configuration, in my office network (192.168.1.0). So my brain automatically said, “It’s fine to use 192.168.88.0 for the safe eth8 interface.” However, to avoid any doubts, I’ve now changed it to your suggested 192.168.65.0.
This morning, I switched my ISP modem to the RB5009, connecting it directly to the ONT. It works like a charm—everything is running smoothly for all the PCs and other devices. Thank you so much for your help!
Now it’s time to set up some port forwarding for my server services.
Only as a note, maybe you haven’t noticed it, but it is important that you understand this for other future configurations.
I originally suggested to have ether8 as 192.168.88.1**/24**(assuming that you would have changed the same range set on the bridge to your local lan one).
BUT what you implemented (accidentally) was 192.168.88.1**/32** (i.e. network 192.168.88.1).
Anav correctly (to resolve the conflict on 192.168.88.1) suggested 192.168.65.1**/30**.
When you input an address in RoS, you should remember to specify the CIDR network mask, and Ros will automatically set the “network” parameter for you, i.e.
/ip address
add address=192.168.88.1 interface=ether8
will result in (as seen in your export):
/ip address
add address=192.168.88.1 interface=ether8 network=192.168.88.1
whilst the (suggested) command would have been:
/ip address
add address=192.168.88.1/24 interface=ether8
which would have come out in export as:
/ip address
add address=192.168.88.1/24 interface=ether8 network=192.168.88.0
same goes for the the /30, do check that you have now:
/ip address
add address=192.168.65.1/30 interface=ether8 network=192.168.65.0
After that, I feel ready for my final step: port forwarding for my servers. Nothing special, just nginx, Home Assistant, and Docker.
However, I ran into an issue! I decided to follow the video guide from the official MikroTik YouTube channel and created the rules like this:
That is correct, what you did was employ loopback NAT or hairpin NAT. This can be solved by simply moving users or server to a different subnet/vlan. Since these cost nothing, it something I would certainly do. LIke a shared printer, I put those on their own vlan for best security.
However, the rule you made is overcomplicated, please change to. add action=masquerade chain=srcnat dst-address=192.168.1.0/24 src-address=192.168.1.0/24 comment=“hairpin nat”
IF one attempts to use the WANIP of the router to reach the server and the user is in the same subnet as the server, that extra rule is required.
Correct, the format for DSTNAT rules is indeed( fixed static wanip) /ip firewall nat add action=dst-nat chain=dstnat dst-address=MyFixedIP dst-port=XXX protocol=YYY to-address=IPofServer
Note: to-ports is only required if different from the external incoming dist-port ( aka for port translation ).
If you know the external WANIPs that are hitting your server you can create a source address list to limit access and to hide ports from scans.
