taske
June 30, 2024, 6:53pm
1
Hello,
i looked thru a few threads already and tried various solutions but i’m having no success. I apologize in advance i realize my question is very basic but im very new to networking and mikrotik in general.
The phone connects fine via the wireguard but im getting no traffic to WAN
What rules must i set up if i want to be able to connect to the NAS with phone (via VLC for video streaming) - if im on local home wifi i have no issues connecting via ftps, smb etc.
Pasting the entire config below:
/interface bridge
/ip pool
/ip addressname=upgrade.mikrotik.com
/ip ipsec policy
/ip service
anav
June 30, 2024, 8:43pm
2
(1) Change this from/interface list add name=LAN
(2) Change this from/interface list member /interface list memberadd interface=ether1 list=WAN
(3) This is the other end of your error.interface=8 network=20.30.40.0
(4) What is the purpose of this???/ip dns staticname=upgrade.mikrotik.com
(5) What is the purpose of a private address list entry here, which doesnt exist on your network??/ip firewall address-list
(6) CLEANING UP your firewall rules:/ip firewall filter add action=accept chain=input connection-state=established,related,untracked add action=accept chain=input comment=“allow wireguard” dst-port=13231 { put this rule in last so you dont lock yourself out }add action=fasttrack-connection chain=forward connection-state=established,related add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
(7) Fix NAT ( I only see the need for two rules, if you think differently tell me why! )/ip firewall natadd action=masquerade chain=srcnat out-interface=ether1 add action=dst-nat chain=dstnat dst-port=1107 in-interface=ether1
(8) As far as your wireguard client settings the only thing required for allowed IPs is 0.0.0.0/0
taske
June 30, 2024, 9:03pm
3
(1) Change this from - done /interface list add name=LAN
(2) Change this from - Done /interface list member /interface list memberadd interface=ether1 list=WAN
(3) This is the other end of your error. - This is a remnant of an old config i was toying with, i’ve removed it now. interface=8 network=20.30.40.0
(4) What is the purpose of this??? - honestly i forgot what this was about, i believe i had some issues with upgrading the firmware and this was proposed somewhere. /ip dns staticname=upgrade.mikrotik.com
(5) What is the purpose of a private address list entry here, which doesnt exist on your network?? - remnant of an old IPSec i had configured but havent deleted fully, removed it now. /ip firewall address-list
(6) CLEANING UP your firewall rules: - Done /ip firewall filter add action=accept chain=input connection-state=established,related,untracked add action=accept chain=input comment=“allow wireguard” dst-port=13231 { put this rule in last so you dont lock yourself out }add action=fasttrack-connection chain=forward connection-state=established,related add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
(7) Fix NAT ( I only see the need for two rules, if you think differently tell me why! ) - Done /ip firewall natadd action=masquerade chain=srcnat out-interface=ether1 add action=dst-nat chain=dstnat dst-port=1107 in-interface=ether1
(8) As far as your wireguard client settings the only thing required for allowed IPs is 0.0.0.0/0 - Done
Wireguard setting on Android are: IpAddresses : 192.168.33.15/32
Still no WAN traffic when connected over WG nor do i see the NAS files via VLC
/interface bridge
/ip addressname=upgrade.mikrotik.com
anav
June 30, 2024, 9:32pm
4
You didnt make any changes from my recommendations… Suspect you posted your old config??
taske
June 30, 2024, 9:44pm
5
Im confused.
I’ve fixed the Interface lists, NAT rules and edited the FW rules, cleaned up the old IPSec settings and redundant ip addresses. am i missing something?
anav
June 30, 2024, 11:04pm
6
Well for starters you didnt answer ANY of my questions.
WTFrig are you attempting to do with this subnet ???
Which you failed to disclose???
What is the purpose of this???/ip dns staticadd address=159.148.172.226 name=upgrade.mikrotik.com
What is the purpose of a private address list entry here, which doesnt exist on your network??/ip firewall address-list
Change this from/interface list member /interface list member
ON your new config you have this…/interface list memberadd interface=ether2 list=LAN
Your firewall rules are out of order, you have extra rules not required according to your config and requirements. and you allow winbox from the internet which is a no no regardless if you think you are limiting to IP address,
taske
July 1, 2024, 4:59am
7
My formatting might have been poor, sorry. I’ve tried to answer your questions in bold format in the quoted part of your reply.
I believe things should be how you specified but im still getting no internet traffic nor LAN NAS access
/interface bridge
/ip address
/ip firewall filter