I am new to this community, so please excuse if this is an easy question.
I want to use the Mikrotik RouterOS platform as a pure routing platform, with no firewall capabilities. I am looking to route all IP traffic between two different subnets.
I have a virtual machine with two interfaces that have been correctly identified by the OS - ether1/ether2
I have properly assigned an IP address to each interface:
ether1 - 192.168.210.101
ether2 - 192.168.21.1
I have setup a default gateway under the IP → Routes.
I am able to ping from machines to machines in the opposite subnet successfully in both directions (ether1 ↔ ether2)
I am able to pass traffic from ether1 to ether2.
My problem is that I cannot pass traffic back from ether2 to ether1. Whenever I try to do a connection, it times out, and when I do a port scan, my result is always “Filtered”.
As far as I can tell, the Firewall is disabled.
Can someone please provide me some instructions on how I can make this platform run as a pure router?
I seem to be routing packets just fine, because I can ping boxes from 192.168.21.0 and 192.168.210.0 subnets respectively and vice versa. Upon further testing, it looks like the RouterOS is treating ether2 as a WAN port still, as if it was a firewall.
As far as I can tell, the firewall is disabled, but the RouterOS is still “filtering” requests from the 192.168.21.0/24 subnet to the 192.168.210.0/24 subnet.
Look in the filters section of IP Firewall for entries in the forwarding chain. With no entries RouterOS will route anything to anywhere. I suspect that you have entries which are restricting the routing function. Also remember that the target must also know a route back to the ping originator. If there is not a default route to provide that return oath then it needs to be an explicit route.
I went in through the terminal and did a dump of the filter section. I don’t see any rules listed.
[admin@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
[admin@MikroTik] /ip firewall filter>
And this is my routing table:
[admin@MikroTik] /ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 192.168.210.1 1
1 ADC 192.168.21.0/24 192.168.21.1 ether2 0
2 ADC 192.168.210.0/24 192.168.210.101 ether1 0
[admin@MikroTik] /ip route>
I can also ping from 21.0 subnet:
C:\Users\Administrator.TEST3\Desktop\PortQryV2>ping 192.168.210.121
Pinging 192.168.210.121 with 32 bytes of data:
Reply from 192.168.210.121: bytes=32 time<1ms TTL=126
Reply from 192.168.210.121: bytes=32 time<1ms TTL=127
Reply from 192.168.210.121: bytes=32 time<1ms TTL=126
Reply from 192.168.210.121: bytes=32 time<1ms TTL=127
Ping statistics for 192.168.210.121:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
but a port query fails to the same IP address
C:\Users\Administrator.TEST3\Desktop\PortQryV2>PortQry.exe -n scom02.test.domain -e 5723
Querying target system called:
scom02.test.domain
Attempting to resolve name to IP address...
Name resolved to 192.168.210.121
querying...
TCP port 5723 (unknown service): FILTERED
C:\Users\Administrator.TEST3\Desktop\PortQryV2>
No… 192.168.210.121 is not running any kind of firewall software. Windows Firewall has been disabled by Group Policy.
Latest update, I have not tinkered with it much since the weekend, but I have noticed that communication is intermittent to the 210.0 subnet. On my continuous port scans, I am getting mostly filtered results, however I did get one “LISTENING” result. Weird thing is I had not made any configuration changes to the router, and was just doing one port scan after another, and eventually one got through.
I will have to continue to try and figure this one out.
Try using Torch in Winbox and look at ether1 (i.e. the interface that the router connects to the 5723 on). Click on all the option boxes including port and set the timeout to longer than the default 3 seconds - say 30 seconds.
Now try your ping test - you should see the ICMP traffic both tx and rx on Ether1. Now try your port test. If you see tx destined for port 5723 on the target and little/no rx then the problem is on the System Center side of things - the router is forwarding as expected.
I think I figured the source of my anguish, and it has nothing to do with RouterOS. it has to do with my firewall, which is pfSense firewall.
I have all my hosts on the 192.168.210.x network pointed to pfSense as its default gateway. Instead of creating routes to the 192.168.21.x subnet on every host on the network, I created one default route back from the firewall. Once I took the firewall out of the picture by creating a route directly from the host, everything worked smoothly, and no ports were getting filtered.
