[SOLVED] inter-LAN-routing not working on CRS125-24G-S1

RouterOS General
1

Hi, I'm having trouble getting some aspects of our router config to work. (I'm a programmer not a network admin.)
4 weeks of reading the wiki, asking admins and looking around on the net still leave some things unclear.

That is what we are trying to make work:
NetworkTopology.png
We got 5 IPs from the ISP. Those should be "mapped" to 5 LANs.
The LAN-interfaces are set up as 5 switch groups plus a 3 ports which are purely a switch.

The two web-servers need to be accessible from the outside on port 80 and 433.

User1, Office and RemoteUser need to be able to manage/ remote control any of the servers.

The workers need to be able to access the NAS. (to avoid routing in favor of switching, I consider moving it to .2.0)
User1, User2, Office and RemoteUser need to be able to access the NAS.

User1 and User2 are sometimes gaming so need some ports open for that.
RemoteUser should be able to join in old LAN-games. (nice to have)

Office and RemoteUser should connect to the LAN as securely as possible. I would prefer IPsec with certificates and xAuth but could not get that to work yet. OpenVPN with certificates is working.

All of the PCs and laptops, the Controller and the workers run Windows10 Pro, while the web- and db-servers run Linux.

Problem:
While the different LANs can ping the other gateways, they can not reach any computer on another LAN. That also makes my openVPN useless other than to control the router. It seems the packages are not even routed. I disabled the firewall and it had no effect. Rules to log all traffic on the input and forward chains show no packages from the ping attempts. However pings to the gateways do show up in the log. I can ping the machines on all LANs from the router. The funny part is - it did work once for a few hours. Sadly I have no idea if or what I changed. Regretfully I did not make a backup right away.

As a side note. Can some one explain what the difference is between masquerading and src-nat? It seems very similar to me, but I read that for our setup src-net + dst-nat is the way to go.

I also want to get IPsec to work for Windows10 road-warriors but I post that as a separate question later.

[admin@MikroTik] > export

may/01/2016 12:07:57 by RouterOS 6.35.1

software id = 20TM-IYW2

/interface ethernet
set [ find default-name=ether1 ] name=e01-WAN-Master
set [ find default-name=ether2 ] name="e02-Control-Master(Solo)"
set [ find default-name=ether3 ] name=e03-LAN-User1-Master
set [ find default-name=ether4 ] master-port=e03-LAN-User1-Master name=e04-LAN-User1
set [ find default-name=ether5 ] master-port=e03-LAN-User1-Master name=e05-LAN-User1
set [ find default-name=ether6 ] master-port=e03-LAN-User1-Master name=e06-LAN-User1
set [ find default-name=ether7 ] master-port=e03-LAN-User1-Master name=e07-LAN-User1
set [ find default-name=ether8 ] master-port=e03-LAN-User1-Master name=e08-LAN-User1
set [ find default-name=ether9 ] name=e09-LAN-Servers1-Master
set [ find default-name=ether10 ] master-port=e09-LAN-Servers1-Master name=e10-LAN-Servers1
set [ find default-name=ether11 ] master-port=e09-LAN-Servers1-Master name=e11-LAN-Servers1
set [ find default-name=ether12 ] master-port=e09-LAN-Servers1-Master name=e12-LAN-Servers1
set [ find default-name=ether13 ] name=e13-LAN-Workers-Master
set [ find default-name=ether14 ] master-port=e13-LAN-Workers-Master name=e14-LAN-Workers
set [ find default-name=ether15 ] master-port=e13-LAN-Workers-Master name=e15-LAN-Workers
set [ find default-name=ether16 ] master-port=e13-LAN-Workers-Master name=e16-LAN-Workers
set [ find default-name=ether17 ] name=e17-LAN-User2-Master
set [ find default-name=ether18 ] master-port=e17-LAN-User2-Master name=e18-LAN-User2
set [ find default-name=ether19 ] master-port=e17-LAN-User2-Master name=e19-LAN-User2
set [ find default-name=ether20 ] master-port=e17-LAN-User2-Master name=e20-LAN-User2
set [ find default-name=ether21 ] name=e21-LAN-Servers2
set [ find default-name=ether22 ] name=e22-LAN-Switch-Master
set [ find default-name=ether23 ] master-port=e22-LAN-Switch-Master name=e23-LAN-Switch
set [ find default-name=ether24 ] master-port=e22-LAN-Switch-Master name=e24-LAN-Switch
set [ find default-name=sfp1 ] master-port=e01-WAN-Master name=sfp1-WAN
/ip route
add distance=1 gateway=1.2.3.97
/ip pool
add name=dhcp_pool_User1 ranges=192.168.0.100-192.168.0.200
add name=dhcp_pool_Servers1 ranges=192.168.1.100-192.168.1.200
add name=dhcp_pool_Workers ranges=192.168.2.100-192.168.2.200
add name=dhcp_pool_User2 ranges=192.168.3.100-192.168.3.200
add name=dhcp_pool_Servers2 ranges=192.168.4.100-192.168.4.200
/ip dhcp-server
add address-pool=dhcp_pool_User1 disabled=no interface=e03-LAN-User1-Master lease-time=3d name=dhcp-LAN-User1
add address-pool=dhcp_pool_Servers1 disabled=no interface=e09-LAN-Servers1-Master lease-time=3d name=dhcp-LAN-Servers1
add address-pool=dhcp_pool_Workers disabled=no interface=e13-LAN-Workers-Master lease-time=3d name=dhcp-LAN-Workers
add address-pool=dhcp_pool_User2 disabled=no interface=e17-LAN-User2-Master lease-time=3d name=dhcp-LAN-User2
add address-pool=dhcp_pool_Servers2 disabled=no interface=e21-LAN-Servers2 lease-time=3d name=dhcp-LAN-Servers2
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1,212.54.44.54,212.54.40.25 gateway=192.168.0.1
add address=192.168.1.0/24 dns-server=192.168.1.1,212.54.44.54,212.54.40.25 gateway=192.168.1.1
add address=192.168.2.0/24 dns-server=192.168.2.1,212.54.44.54,212.54.40.25 gateway=192.168.2.1
add address=192.168.3.0/24 dns-server=192.168.3.1,212.54.44.54,212.54.40.25 gateway=192.168.3.1
add address=192.168.4.0/24 dns-server=192.168.4.1,212.54.44.54,212.54.40.25 gateway=192.168.4.1
/ip dns
set servers=212.54.44.54,212.54.40.25,8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.10 name=company-web
add address=192.168.1.15 name=company-db
/ip firewall filter

RouterOS - RouterOS - MikroTik Documentation

plus rules to open ports for some games, DNS, IPsec, openVPN is on port 433

/ip firewall nat
add action=src-nat chain=srcnat out-interface=e01-WAN-Master src-address=192.168.0.0/24 to-addresses=1.2.3.98
add action=src-nat chain=srcnat out-interface=e01-WAN-Master src-address=192.168.1.0/24 to-addresses=1.2.3.99
add action=src-nat chain=srcnat out-interface=e01-WAN-Master src-address=192.168.2.0/24 to-addresses=1.2.3.100
add action=src-nat chain=srcnat out-interface=e01-WAN-Master src-address=192.168.3.0/24 to-addresses=1.2.3.101
add action=src-nat chain=srcnat out-interface=e01-WAN-Master src-address=192.168.4.0/24 to-addresses=1.2.3.102
add action=dst-nat chain=dstnat comment="HTTP to Webserver1" dst-address=1.2.3.99 dst-port=80 in-interface=e01-WAN-Master protocol=tcp to-addresses=192.168.1.10 to-ports=80

plus a few more to forward other ports

/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=e03-LAN-User1-Master type=internal
add interface=e17-LAN-User2-Master type=internal
add forced-ip=1.2.3.98 interface=e01-WAN-Master type=external
add disabled=yes interface=e04-LAN-User1 type=internal
add disabled=yes interface=e05-LAN-User1 type=internal
add disabled=yes interface=e06-LAN-User1 type=internal
add disabled=yes interface=e07-LAN-User1 type=internal
add disabled=yes interface=e08-LAN-User1 type=internal

IPsec and openVPN settings omitted to make it not any longer than it already is

can provide those if needed

>
2

Masquerade means that the router should choose an appropriate source IP itself, usually based on the preferred source IP value of the route it’s following to reach the destination. (i.e., if the default gateway route says preferred-source=x.x.x.34, then that is the IP that will be used by masquerade).

Using src-nat as an action requires that you specify the translated source IP. This is required in your situation because you want to map specific LANs to specific WAN addresses. If you used masquerade, then all LANs would get masqueraded to the actual interface IP of the router itself.

3

Almost certainly, your firewall filter rules are the reason that your lan-to-lan connectivity is broken.

Firewall configurations such as the one you reference are not “basic” in my opinion, and I’ve seen many threads here posted by people with little experience in IP network/firewall administration who are having problems managing such a thing.

As a programmer, you might be able to follow it reasonably well since it’s much like a programming language - but several knowledge items you need to do it well come from IP networking, so some results/behaviors might not be clear to you.

Perhaps you should start with a simple firewall and then add functions to it incrementally, so that you know everything’s working and it’s easy to know what changes break things.

First of all, be careful using a bogon list posted on a static wiki entry like this - the list changes over time. (there is an actively maintained bogon list at Team Cyrmu: http://www.team-cymru.org/bogon-reference-http.html)

Here’s a basic firewall setup that allows outbound, but not inbound. You’ll need to insert your specific ports/protocols for your situation:

/ip firewall filter
add chain=input connection-state=established,related action=accept
add chain=input protocol=icmp action=accept
add chain=input protocol=tcp dst-port=x,y,z action=accept (those necessary for OpenVPN and any on-the-router services you wish to allow from the Internet)
add chain=input protocol=udp dst-port=x,y,z action=accept (same for UDP)

add chain=forward connection-state=established,related action=fasttrack-connection
add chain=forward connection-state=established,related action=accept
add chain=forward out-interface=WAN action=accept
add chain=forward in-interface=!WAN action=accept (allow all lan-side interfaces to originate new connections)
add chain=forward connection-nat-state=dstnat action=accept
add chain=forward action=drop

This is a very basic setup but will work reasonably-well for a starting point.

If this works well, then start adding all of the scan detection bells and whistles that you like. If you want an IP blacklist, then put a drop rule for addresses in that list, and add it before the rules that accept/fasttrack established,related. (so adding an address or range to the blacklist will also drop packets from established connections- effectively pulling the plug on them)

4

Hi ZeroByte,

thank you for your answer and suggestions for the firewall.

I had been busy with other stuff so it took me a while to really try it all out.

Turns out it was nothing on the router. I just did not know that Windows 10 (Win 8+ or is it even Win7+) has a default firewall rule to block replying to ping request which do not come from the network the PC is connected to. At some point I had a hunch and looked for some thing like this. Added the LANs I want to ping from to the accepted remote hosts and it works.

I feel a bit foolish now but well. Its like with programming. Always something small one overlooked since the big things would have stuck out.

Well thanks again.