What’s the local (LAN) and Zerotier IP address on the MikroTik device? Do you want LAN access only from Zerotier or do you want it both ways?
The MikroTik has a ZT address of 10.147.17.100 and its local LAN address is 192.168.1.18
And the other question: Do you want 1) LAN access only from Zerotier, or 2) access in both directions?
Option 1 is easily solved with srv-nat/masquerade on the MikroTik.
Option 2 requires routing to and from the default gateway.
I only need to access my home LAN from my remote device. I don’t need to connect from my home LAN to these mobile devices, but of course two way communication is needed when using RDP? Not sure if that’s option 1 or 2.
Then you only need the following, assuming the Zerotier interface is still named 'zerotier1':
Allow routing from Zerotier to your local network and access to the router.
/interface list member add interface=zerotier1 list=LAN
masquerade all traffic from zerotier to your local network
/ip firewall nat add chain=srcnat src-address=10.147.17.0/24 dst-address=192.168.1.0/24 action=src-nat
Thank you. zt1 is the instance the interface is called zerotier1. I changed that in the first command and ran the second. Both ran okay, but still no luck?
Also, when I ran the second command, in the GUI, I see the address changed to 10.147.17.0/24. Which did not work, so I changed it to the exact address of the MikroTik which is 10.147.17.100 (without the /24), and that also did not work.
Deleting the NAT rule and trying again, I get an error saying failure: to-addresses or to-ports must be specified
Disable the previous src-nat command and try the following. Replace XXXX with the name of your LAN interface, like ether1 or bridge etc.
‘/ip firewall nat add chain=srcnat src-address=10.147.17.0/24 out-interface=XXXXX action=masquerade’
If that doesn’t work, you’ll need to start tracing the traffic using “Tools → Packet Sniffer” .
Wow! That did it! Thank you so much!
Wow! That did it! Thank you so much!
Just of our curiosity, why do I need 10.147.17.0/24 instead of 10.147.17.100? 10.147.17.100 is the ZT address of the MikroTik and that is the only “source” here?
PS - in case this is helpful to others, for the above to work, I had to add a route in my.zerotier.com:
192.168.1.0/24 via 10.147.17.100
I just realized I made a mistake (10.147.17.100/24 instead of 10.147.17.0/24) so that’s probably why the first attempt didn’t work. I’ve corrected the previous posts with 10.147.17.0/24.
But anyhow, 10.147.17.0/24 is intended to match all IP addresses in the entire ZeroTier subnet. The setting ‘192.168.1.0/24 via 10.147.17.100’ in Zerotier Central means that all traffic with destination address 192.168.1.0 will be sent to 10.147.17.100 which is the Mikrotik router.
Yes, just curious why I need all the addresses when only 10.147.17.100 is the only one being used. I tried replacing 10.147.17.0/24 with 10.147.17.100 and it doesn’t work
Check out my previous post, I made some changes.
Yes, adding the route in my.zerotier.com will direct all 192.168.1.0/24 traffic to the MikroTik which is what I want/need.
I’m just trying to understand on the MikroTik side why I need all the source addresses in 10.147.17.0/24 when only 10.147.17.100 is being used. I tried replacing 10.147.17.0/24 with 10.147.17.100 and it doesn’t work.
Thank you again!
Now it’s my turn to be curious. The cruise ship we went on a few years back had incredibly slow internet (ie no starlink at that time). How’s the internet situation on the ship you’re on?
It’s quite good. I can RDP (thanks to you) with very little lag. Almost not noticeable. When I was googling the issue initially, I saw some posts that says it varies ship to ship. I’m on Royal Caribbean which I’ve read uses Starlink. In terms of their blocking certain vpn’s, it also sounds like it varies ship to ship.
Alright, good to know. Have an awesome trip!
Thank you!