Routing between 2 Devices

RouterOS Beginner Basics
1

Hi, I am very new to networking and I have been having an issue trying to correctly set-up my router to allow for me to access a Nokia device from my PC. Eventually I will expand the system to access 3 different devices, but they all have the same IP address hence the need for a router.

Anyway, I am currently able to ping my PC and the Nokia device from the router. I tried added a route, but I am not able to ping the Nokia device from my PC. Is adding a route all I need to do, or is there another step I am missing. If not it is likely I do not have the route parameters setup correctly since as I mentioned this is my first time doing something like this. Any help would be greatly appreciated.

2

network diagram to explain what you are attempting to do
NETWORK DIAGRAM APPS:
https://nulab.com/cacoo/
https://online.visual-paradigm.com/diagrams/solutions/free-network-diagram-software/
https://www.lucidchart.com/pages/
https://drawio-app.com/product/
https://www.diagrams.net/ (its older sibling soon to be discontinued https://drawio-app.com/product/)
( Other links for diagrams.net - https://www.youtube.com/watch?v=P3ieXjI7ZSk & https://www.youtube.com/watch?v=mpF1i9sfEJ0 )
https://sourceforge.net/projects/dia-installer/
https://www.yworks.com/products/yed (and icons for yed → https://github.com/danger89/yEd_cisco_network_icons )
https://www.libreoffice.org/discover/draw/

http://kilievich.com/fpinger/ - has a simple drawing program but not its main intent.





and config

/export file=anynameyouwish ( minus router serial number, any public WANIP information etc.)

3 
# 2023-11-06 14:30:27 by RouterOS 7.11.2
# software id = QJ3Q-99Z9
#
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip address
add address=192.168.255.126/24 interface=ether1 network=192.168.255.0
add address=10.1.1.1/24 interface=ether2 network=10.1.1.0
/ip route
add disabled=no dst-address=192.168.255.126/32 gateway=10.1.1.2 \
    routing-table=main suppress-hw-offload=no
add disabled=no distance=1 dst-address=10.1.1.2/32 gateway=192.168.255.129 \
    pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/system note
set show-at-login=no

networking.png

4

What is the purpose of the MT device,
If it was a router both subnent would be local and getting dhcp from the router and you just need firewall rule connect them.
However your configuration is almost nothing, so hard to say what you mean to do…

Is there a real upstream router tied to the i nternet??

5

Currently you would be correct in that there is no real purpose for the MT device. The final build will be like the attached image, where there are 3 Nokia devices I am trying to talk to but they all have the same IP address that cannot be changed, and in this case the router would be needed because of the design requirement where the IP address of the Nokia devices is the same. The router is not and will not be tied to the internet.

My idea was to try and talk with a single nokia device first, then once that is working I would work on the router config to talk to all 3 nokia devices.
networking.png

6

They have to be on a different physical port or VLAN and apparently its complicated… and outside my knowledge sphere…

7

They all will be on different physical ports the pc will be connected to ether1, and the other 3 devices on ether 2-4. The issue I was describing above is just for a single nokia device, since if I cannot get this to work with one device I will not be able to get it working for 3.

8

Your first drawing and posted configuration do not match (IP addresses).

Getting one to work should be very simple. As long as the PC knows that the router is it’s gateway, it will just work. Remember, it’s a router - it routes unless you tell it not to.

Getting three devices with the same IP to work would be more complex - and beyond my knowledge…

9

Id guess the Nokia doesn’t know how to respond to 10.1.1.2

There’s a few assumptions:

Nokia is a fixed IP and it’s gateway isn’t 192.168.255.126. the only thing you can do here is a source nat rule to masquerade to 192.168.255.126 then the Nokia will see requests from this up and not 10.1.1.2.

This gets very difficult when you have 3 devices with the same IP. Experience tells me I’d be “tunneling”. Issues with the router will be over lapping subnets. It just doesn’t make sense off the bat.

So I’d get 2 more routers, and be defining the same masquerade technique but using port forwarding.

Pc would now be requesting 10.1.1.1:8080 on router 1 port forwarding for Nokia 1

Router 2 would be 10.1.2.1:8080 on router 2 port forwarding for Nokia 2 etc.

Again assuming a web page of some description.

10

http://forum.mikrotik.com/t/failover-between-2-isps-using-gateways-with-same-ip-was-nat-traffic-to-vrf/170381/1

Just reading through this and it’s kind of the same problem, but not the same. 2 gateway’s with the same IP.

11

Your assumptions are correct, the Nokia IP is fixed. In terms of the Gateway I am not sure what it is. Normally when I connect it directly to my pc I use an IP address if 192.168.255.126 mask: 255.255.255.0 Gateway:192.168.255.129, not sure if this information helps in anyway. And yes 3 routers would definitely be the simplest way to go. I will try some of this and get back to you.

Thanks!

12

But a part of that solution (the one with vrf’s) is inspired by this article:
https://sudonull.com/post/96901-Mikrotik-VRF-NAT-Manage-devices-with-the-same-IP-addresses-from-one-host

which seems exactly like the same problem of the OP

And this should be another possible solution without using vrf’s:
http://forum.mikrotik.com/t/access-multiple-devices-with-same-ip-address/106788/1

In the configuration posted by networkingNoob7 (for a single device) it seems to me (but I am also a beginner) that what is missing is a NAT, either src-nat or masquerade should do:

/ip firewall nat
add  chain=srcnat action=masquerade out-interface=ether2

From the little I have understood if using src-nat the address of the out interface needs to be specified:

/ip firewall nat
add chain=srcnat action=src-nat to-addresses=192.168.255.126 out-interface=ether2 src-address=10.1.1.0/24

I am still trying to understand these features, though.

An old thread with a reference to anav’s Beginner Basics
http://forum.mikrotik.com/t/masquerade-or-src-nat-to-addresses/9384/1
point H:
https://forum.mikrotik.com/viewtopic.php?t=191442

13

Using some of the articles and tips in here I ended up with this config, but again still no luck. Note: this is a freshly reset HEx router, and I changed some connections around.

ether5 is my pc to router
ether4 is nokia device to router

/ip address
add address=172.16.0.1/24 interface=ether5 network=172.16.0.0
add address=192.168.255.100/24 interface=ether4 network=192.168.255.0

/ip firewall address-list
add address=10.0.0.1 list=translate-to-dev

/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=10.0.0.1
new-connection-mark=dev01 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=dev01 new-routing-mark=dev01 passthrough=no

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether4
add action=dst-nat chain=dstnat dst-address-list=translate-to-dev to-addresses=192.168.255.126

/ip route
add distance=1 dst-address=192.168.255.0/24 gateway=ether1 routing-mark=dev01

14

Have you got a second computer?

You could try putting that computer and turning firewall off in 192.168.. subnet that rules out any funky stuff happening with the Nokia.

You should be able to ping from the router to Nokia at all times too. (Winbox, Terminal → ping 192.168…)

15

I do have a second computer, and I have been able to ping the Nokia device from the router the whole time. I am not sure what you mean by turn off the firewall, are you referring to the firewall rules added to the router, or the firewall on the PC itself?

16

I figured it out I was able to get it working by just adding a masquerade rule. The issue I did not see was I did not realize my computer needed a route added to direct traffic to the router when I was trying to access 192.168.255.0/24 network