Troubleshooting my newbie ax3 setup - No internet access from the wireless networks

RouterOS Beginner Basics
1

I recently purchased a MikroTik Hap AX3 router with the aim of upgrading my internet connection to 500Mbps. While I’m new to this, I’m eager to learn and make the most of it.
Initially, I connected the new router to my existing setup (dhcp router) and everything worked seamlessly. Both wired and wireless devices had internet access, and the NAT configurations were functioning correctly.
However, when I decided to replace my old router with the ax3, I performed a soft reset and attempted to configure the device using the quick setup option. Unfortunately, I’ve run into an issue where my wireless networks no longer have internet access, and I’ve been unable to resolve it despite consulting various online guides and trying different stupid things.
My setup appears to be straightforward, but I’m unable to pinpoint the problem. While I’m relatively new to networking, I’m eager to learn and open to any guidance you can offer. If you require any additional information about my network setup or configurations, please don’t hesitate to ask.

This is the output from /export hide-sensitive:

# jan/02/1970 10:19:11 by RouterOS 7.9.1
# software id = **ELIDED**
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = 
/interface bridge
add admin-mac=<MAC> auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] poe-out=off
/interface wifiwave2
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac .mode=ap .ssid=Mik2 disabled=no name=Mik2 security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac .mode=ap .ssid=Mik5 disabled=no mtu=1500 name=Mik5 security.authentication-types=\
    wpa2-psk,wpa3-psk
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-wan user=qnev14
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=listBridge
/ip pool
add name=dhcp ranges=192.x.x.168-192.x.x.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=7h30m name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=Mik5
add bridge=bridge comment=defconf interface=Mik2
/ip neighbor discovery-settings
set discover-interface-list=listBridge
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=pppoe-wan list=WAN
add interface=bridge list=listBridge
/ip address
add address=192.x.x.1/24 comment=defconf interface=bridge network=192.x.x.0
/ip cloud
set update-time=no
/ip dhcp-server network
add address=192.x.x.0/24 comment=defconf dns-server=192.x.x.1 gateway=192.x.x.1
/ip dns
set servers=8.8.4.4,8.8.8.8
/ip dns static
add address=192.x.x.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=input comment="allow Winbox" disabled=yes in-interface=pppoe-wan port=8291 protocol=tcp
add action=accept chain=input comment="allow SSH" disabled=yes in-interface=pppoe-wan port=22 protocol=tcp
add action=accept chain=input comment="allow 21000@248" in-interface=ether1 port=21000 protocol=tcp
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=pppoe-wan
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=21000 in-interface=ether1 in-interface-list=WAN protocol=tcp src-port=21000 to-addresses=192.x.x.248
add action=dst-nat chain=dstnat dst-port=22002 in-interface=ether1 in-interface-list=WAN protocol=tcp to-addresses=192.x.x.248 to-ports=22
add action=dst-nat chain=dstnat dst-port=22001 in-interface=ether1 in-interface-list=WAN protocol=tcp to-addresses=192.x.x.254 to-ports=22
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2200
set api disabled=yes
set winbox address=192.x.x.0/24
/ip ssh
set strong-crypto=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Sofia
/system note
set show-at-login=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=listBridge
/tool mac-server mac-winbox
set allowed-interface-list=listBridge
2

Under interface bridge port I can see that you have interfaces Mik2 and Mik5, but those are also your SSIDs.

Best thing right now is to restore default configuration to see if wireless is working.

Don’t use quick setup because you can break stuff if you use quick setup and then you start messing with configuration.

And why did you change name on wireless interfaces ?

3

It’s AX3,not AC3.

4

Clearly to get confused while reading the config :slight_smile:

5

Renaming the interface was just one of my stupid ideas. No explanation needed :smiley:

I reset the configuration in winbox and stated form zero.
This time I did not use the quick setup and tried to configure evverything manually, using the official RouterOS Getting started guide.
And I failed again :frowning: No internet on both wireless networks.

This is the curent config:

# sep/16/2023 19:32:26 by RouterOS 7.9.1
# software id = 
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = 
/interface bridge
add name=local
/interface wifiwave2
set [ find default-name=wifi1 ] channel.band=5ghz-ax .mode=ap .ssid=Mik5 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel.band=2ghz-n .mode=ap .ssid=Mik2 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 user=qnev14
/interface list
add name=listBridge
add name=WAN
/ip pool
add name=dhcp ranges=192.x.x.162-192.x.x.254
/ip dhcp-server
add address-pool=dhcp interface=local lease-time=7h30m name=dhcp1
/interface bridge port
add bridge=local interface=ether2
add bridge=local interface=ether5
add bridge=local interface=wifi1
add bridge=local interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=listBridge
/interface detect-internet
set internet-interface-list=all
/interface list member
add interface=local list=listBridge
add interface=pppoe-out1 list=WAN
/ip address
add address=192.x.x.1/24 interface=local network=192.x.x.0
/ip cloud
set update-time=no
/ip dhcp-server lease
add address=192.x.x.254 client-id=1:74:56:3c:4a:c5:4b mac-address=74:56:3C:4A:C5:4B server=dhcp1
add address=192.x.x.248 client-id=ff:b6:22:f:eb:0:2:0:0:ab:11:9f:4:ca:c:1b:3b:cc:38 mac-address=10:60:4B:7A:47:0D server=dhcp1
/ip dhcp-server network
add address=192.x.x.0/24 dns-server=192.x.x.1 gateway=192.x.x.1
/ip dns
set servers=1.1.1.1,1.0.0.1
/ip firewall filter
add action=accept chain=input comment="accept established,related" connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="allow ICMP" in-interface=pppoe-out1 protocol=icmp
add action=accept chain=input comment="allow Winbox" in-interface=pppoe-out1 port=8291 protocol=tcp
add action=accept chain=input comment="allow 21000" in-interface=pppoe-out1 port=21000 protocol=tcp
add action=accept chain=input comment="allow 22001-22010" in-interface=pppoe-out1 port=22001-22010 protocol=tcp
add action=accept chain=input comment="allow SSH" in-interface=pppoe-out1 port=22 protocol=tcp
add action=drop chain=input comment="block everything else" in-interface=pppoe-out1
add action=fasttrack-connection chain=forward comment="fast-track for established,related" connection-state=established,related \
    hw-offload=yes
add action=accept chain=forward comment="accept established,related" connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment="drop access to clients behind NAT from WAN" connection-nat-state=!dstnat connection-state=new \
    in-interface=pppoe-out1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat in-interface=pppoe-out1 port=3389 protocol=tcp to-addresses=192.x.x.254
add action=dst-nat chain=dstnat dst-port=22001 in-interface=pppoe-out1 protocol=tcp to-addresses=192.x.x.254 to-ports=22
add action=dst-nat chain=dstnat in-interface=pppoe-out1 port=8248 protocol=tcp to-addresses=192.x.x.248
add action=dst-nat chain=dstnat in-interface=pppoe-out1 port=21000 protocol=tcp to-addresses=192.x.x.248
add action=dst-nat chain=dstnat dst-port=22002 in-interface=pppoe-out1 protocol=tcp to-addresses=192.x.x.248 to-ports=22
/ip service
set telnet disabled=yes
set ftp port=21000
set www disabled=yes
set ssh port=2200
set api disabled=yes
set winbox address=192.x.x.0/24
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=Europe/Athens
/system note
set show-at-login=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=listBridge
/tool mac-server mac-winbox
set allowed-interface-list=listBridge
6

Oh my god… update that router right now… 7.9 was the worst version for wireless… :laughing: You can put 7.12beta7.

Also, restore default configuration and then work from there especially if you are new to networking and Mikrotik. This is not default configuration.

7

/interface pppoe-client

Does your ISP use PPPoE? Not all do. A good many use plain DHCP instead. Perhaps the reason your wired clients are working is that they’re doing the DHCP directly and getting the one-and-only IP allowed by your ISP per client, stealing it from the router.