SRC-NAT issue with wAP R AC

RouterOS General
1

Hello everyone,

I'm using exclusively Mikrotik for all my client, as an endpoint ISP I have all the option I need on Mikrotik Router. While I often use Chateau LTE6 which is all-in-one LTE+ethernet sometimes I need to use other LTE product like SXT/ATL/wAP.

And as my reseller had issue with delivery, I bought 3 wAP ac LTE6 kit who is named RBwAPGR-5HacD2HnD instead of router I already used.

I kindly copy-this pasta-that my template, the lte session on my custom APN work, I see ping between my 2 private IP with my backbone. Then I decide to SRC-NAT with my IPv4 public address. As an ISP I provide internet... And I save the client public IP Address like that.

My configuration is like :

/interface bridge
add comment=defconf name=bridge port-cost-mode=short protocol-mode=none
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=FQDN.PRIVATE authentication=pap ip-type=ipv4 use-network-apn=no user=Valid_UserName
/interface lte
set [ find default-name=lte1 ] allow-roaming=yes apn-profiles=APN1 band=""
/ip pool
add name=dhcp_pool0 ranges=192.168.1.20-192.168.1.120
/interface bridge port
add bridge=bridge comment=defconf interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
/ipv6 settings
set disable-ipv6=yes forward=no max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=lte1 list=WAN
/ip address
add address=192.168.1.254/24 interface=bridge network=192.168.1.0
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=yes interface=bridge name=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.1.1
/ip dns
set servers=8.8.8.8,1.1.1.1
/ip firewall address-list
#Some address list for my rules
/ip firewall filter
add action=accept chain=input comment=AC dst-port=161 protocol=udp src-address-list=XXX
add action=accept chain=input dst-port=51022 protocol=tcp src-address-list=XXX
add action=accept chain=input dst-port=51021-51023 protocol=tcp src-address-list=XXX
add action=accept chain=input dst-port=51021-51023 protocol=tcp src-address-list=XXX
add action=accept chain=forward out-interface-list=LAN
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=src-nat chain=srcnat out-interface-list=WAN to-addresses=PUBLIC_IP_ADDRESS
/ip firewall service-port
set sip disabled=yes

And as long as my /ip/firewall/nat for the output has the action "SRC-NAT" I never see the packet reach my backbone. First I believed I missed something on my configuration on the endpoint, I check my backbone. I changed 3 times my SIM card, I changed the router, still the same issue with the same configuration.

So i decided to use another product, with the same configuration... same SIM card... and what a suprise, it work. With action src-nat my router can his packet out and he is able to talk with internet.

I'm sure that those product have an issue, at least for my usage which worked initially. And I did open a ticket (SUP-219238), with supout.rif, print screen, conf.rsc... but support told me I must have a configuration issue. Not software/hardware... How do I open my ticket with element that make Mikrotik happy and make them searching on this issue ?

Thank you, regards,

Nathan

2

Have you tried without defconf script ?

From what we see, you've set up your configuration on top of defconf

RouterOS is globally the same software on all routers from MikroTik, the main thing that differs is the defconf

I would look into that first

Also, if your lte1 interface has the public IP, I would prefer "masquerade" instead of "src-nat" and setting up manually the public IP in the rule, but that is my personal preference,

Hope it helps,

3

Hello,

I still have some part I consider usefull from the defconf, and even if I do disable/remove all filter rules, still the same issue. I have tried it, and I have more than 200 router in the wild with the same conf. This product is however not working with src-nat.

I have a main router with a fiber with a rfc1918 IP adress, and my lte router with another rfc1918 and some VRRP between. So I can't masquerade as my backbone can't have the same peer on 2 different interfaces. Src-Nat is mandatory in my case.

As I said, I checked for over 20hour my configuration, gone back to default conf then add my src-nat. And everytime a Chateau LTE6 work, and this product didn't. But I'm about to surrend and use them as door-blocker...

Regards,

4

What address is correct?

This:

or this one:

5

You are right, I did /export and edit the part where IP Pub where involved. I had a /31 on my bridge, I didn't edit it correctly. Still that I try from router to ping 8.8.8.8 not from the lab where I had my fake-client.

6

if you are going to access the Internet via the WAN interface of this device, then the default gateway should be 192.168.1.254

/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.1.254

or vise-versa: :slight_smile:

/ip address
add address=192.168.1.1/24 interface=bridge network=192.168.1.0

/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.1.1
7

If i want to go to the internet i have first to have my packet going out of the router with i do Src-nat... he don't, its not a Lan related issue.

8

So, do you have from the IPS a dedicated fixed public Ip address linked to your installed SIM?

9

On my backbone router, i have a PPP session mounted with the private IP i define with a freeradius and the route i want. If I want i could do : ip 192.168.12.12 and route on it 9.9.9.9 - which i don't own so i might break a part of my backbone. Then the router on the LTE interface receive the packet destinated to 9.9.9.9.

10

for what this rule?

remove it.

11

Where is APN1 defined? the default APN (as referenced by[ find default=yes ]) is called 'internet'

What is the output of /ip address print and /ip route print ?

12

This is beyond my understanding within the available information.

I'd better go herding cats.:upside_down_face:

13

Still another mistake when i copied and anonymised the conf.
here you have a working RBwAPR-2nD :

[admin@NAME] /ip/route> pr
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, m - MODEM
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
DST-ADDRESS        GATEWAY  ROUTING-TABLE  DISTANCE
DAm 0.0.0.0/0          lte1     main                  2
DAc IP_PUBLIC/31  bridge   main                  0
DAc 192.18.1.27/32     lte1     main                  0
[admin@NAME] /ip/address> pr
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE

ADDRESS            NETWORK         INTERFACE

0   IP_PUBLIC/31  	   IP_PUBLIC_less_1  bridge
1 D 198.18.1.27/32     198.18.1.27     lte1

[admin@NAME] /ip/firewall/nat> pr
Flags: X - disabled, I - invalid; D - dynamic
0    ;;; accept tcp input
chain=dstnat action=accept protocol=tcp src-address-list=LIST in-interface-list=WAN dst-port=51022

1    ;;; accept tcp input
chain=dstnat action=accept protocol=tcp src-address-list=LIST in-interface-list=WAN dst-port=51021

2    ;;; accept tcp input
chain=dstnat action=accept protocol=tcp src-address-list=LIST in-interface-list=WAN dst-port=51023

3    chain=srcnat action=src-nat to-addresses=IP_PUB src-address=!IP_PUBLIC_less_1 out-interface-list=WAN log=no log-prefix=""

And here my non-working RBwAPGR-5HacD2HnD :


[admin@NOMROUTEUR] /ip/route> pr
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, m - MODEM
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
    DST-ADDRESS      GATEWAY  ROUTING-TABLE  DISTANCE
DAm 0.0.0.0/0        lte1     main                  2
DAc 192.168.1.0/24   bridge   main                  0
DAc 198.18.0.185/32  lte1     main                  0


[admin@NOMROUTEUR] /ip/address> pr
Flags: I - INVALID; D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE, VRF
#    ADDRESS            NETWORK         INTERFACE  VRF 
0    192.168.1.1/24     192.168.1.0     bridge     main
1 I  IP_PUBLIC/32       IP_PUB  		veth1      main
2  D 198.18.0.185/32    198.18.0.185    lte1       main

[admin@NOMROUTEUR] /ip/firewall/nat> pr
Flags: X - disabled, I - invalid; D - dynamic 
 0    chain=srcnat action=src-nat to-addresses=IP_PUBLIC out-interface-list=WAN log=no log-prefix=""

FYI I use veth to handle the IP_Public, so my router answer on this IP. And ofc my backbone have route like :

198.18.15.10 dev ppp015009 proto kernel scope link src 198.18.0.0

192.168.120.0/24 dev ppp015009 scope link
14

The /ip/address has the I (invalid) flag so the interface is likely not running.

The usual method of creating a loopback interface for additional routed addresses was to use a bridge with no members, e.g. /interface bridge add name=local protocol-mode=none then /ip address add address=IP_PUBLIC interface=local

Now the loopback interface has been made accessible you can just use that, e.g. /ip address add address=IP_PUBLIC interface=lo