Two routers, 2 places, 2 internets with CPEs, what is the best way?

shivansps · November 8, 2020, 1:43am

Hi,
im wanted to ask because im in this situacion were i have two places connected with a point to point CPE. What i want to do is to allow for internet sharing so if the internet goes out in one site, it uses the internet of the other one, and to be able to access the the servers on site 1 from site 2 using the CPE link.

I also i want it to be the cleanest as possible and whiout extra nats, for instance, i have the VOIP server on site 1, and phones on site 2, so i really want to avoid having to add a extra nat layer there, the VOIP server needs to be able to reach the phones IP directly.

That is a simplified diagram, there are several vlans on both sites, these networks are the admin networks of these sites, but if i can make it work for these networks i can apply the same to vlans.

I think this is done using diferent subnets? I really dont have much knowledge in that area.

anav · November 8, 2020, 3:30am

Research EOIP!
https://wiki.mikrotik.com/wiki/Manual:Interface/EoIP
https://wiki.mikrotik.com/wiki/Manual:Interface/EoIP
https://mum.mikrotik.com/presentations/MM15/presentation_2962_1445240964.pdf
http://mum.mikrotik.com/presentations/ID16/presentation_3349_1476685149.pdf

sindy · November 8, 2020, 10:10am

This topic is actually a bundle.

So let’s discuss the possible ways of interconnecting the sites first.

My recommendation is to use EoIP only where really necessary. It has its positives, and it has its negatives too - additional CPU load, fragmentation aspects, and some random surprises reported now and then that some never encounter and for others it makes EoIP unusable.

First, are the “CPEs” also Mikrotik ones? If yes, it has become possible some years ago to transport VLANs directly using Mikrotik wireless interface: you set up the wireless interface at one end with mode=ap-bridge, the wireless interface at the other one with mode=station-bridge, both with bridge-mode=enabled, and you make each a member port of the bridge with vlan-filtering=yes whose other member is the Ethernet interface of the “CPE”.

This approach is the simplest one configuration-wise.

The only issue here is the degree of your paranoia. For the traffic which ends up in internet anyway, there is no need to care about security on the wireless link as the traffic may be intercepted anywhere else between your network and the remote server with less effort; for the local traffic between the two sites, you may be concerned about the WPA2 security vulnerabilities, and you may want to additionally cipher the traffic using IPsec, Wireguard, or OpenVPN. On RouterOS 6.x, Wireguard is not available and OpenVPN can only use TCP as transport, which makes it a bad choice for VoIP on a potentially lossy wireless link (and costs you some tiny bit of extra bandwidth even on a lossless one). Otherwise, OpenVPN would be the ideal choice as it supports L2 tunneling directly. On ROS 6.x, it was not possible to combine vlan-filtering=yes with PPP-based L2 tunnels like the OpenVPN one, though - I don’t know whether this will change in ROS 7). IPsec and Wireguard are L3 only, so you have to use EoIP together with these to obtain L2 transparency.

So if security of the inter-site traffic is a concern, or if the radios are not Mikrotik ones and do not support VLAN transparency, you have to consider EoIP (over IPsec).

Regarding the WAN failover, there are other topics on the same (two sites, each with an own internet connection, interconnected using a local link).

In general, you can create one VLAN/subnet solely for the WAN sharing purpose (let’s call it WAN-VLAN), and some simple routing related to it. Monitoring of primary WANs’ transparency all the way to internet is a local job of each router (see the scriptless WAN failover by @Chupaka and others). Src-nat or masquerade would be done only on the “real” WANs.

For Site L to use Site R’s WAN as a backup one, Site L has a preferred default route via its primary WAN, and a backup default route with Site R’s IP addres in the WAN-VLAN subnet as a gateway. As long as LANs on Site L and Site R do not share any IP subnets, Site R has routes to all Site L’s subnets via Site L’s IP address in the WAN-VLAN subnet. For site R to use Site L’s WAN as a backup one, you add a mirrored configuration.

The point you may want to address is that the traffic would not loop between the sites if both “real” WANs are down, as this could exhaust the CPU or the bandwidth of the link between the sites, so local traffic would be affected. If that is an issue, you don’t even need policy routing (using a specific routing table depending on the source address of a packet), firewall rules are enough to prevent traffic from looping - a packet which arrives from Site L cannot be sent back to Site L at Site R and vice versa. So dropping packets whose both in-interface and out-interface is the “WAN-VLAN” is enough to deal with this.

The most complicated thing to address is if you have a VLAN & subnet spawning both sites, devices in this subnet on each site should prefer the local WAN, and you want these devices to use DHCP. If this is your case, the easiest solution would be to prevent DHCPDISCOVER packets in these VLANs from delivery across the inter-site link by means of /interface bridge filter rules; unfortunately, these rules currently do not allow to inspect L3&L4 fields of packets carried by VLAN-tagged frames. So if you need this for more than one VLAN, it requires quite a complex setup with multiple bridges at at least one of the sites.

shivansps · November 8, 2020, 3:38pm

The CPEs are TP-Link but they carry the VLAN-Tagged frames over the wireless link.

So the best way is to have all vlans added to both routers with vlan filtering and send all over the cpe link, and use EOIP interface instead of a vlan for sensitive traffic. Yes i do have conflicting networks and vlans IDs, i would need to fix that.

Thanks, i have a clear idea of how to do it now.

sindy · November 8, 2020, 4:28pm

If you don’t need L2 transparency for the sensitive traffic between the sites, you don’t need EoIP.

If sensitive traffic uses multiple VLANs, you can use a common EoIP tunnel for all of them, and make the EoIP interfaces member ports of the bridges, but you need to use MSTP on the bridges, as you’ll have two L2 paths between them, one direct and one via EoIP. Permitting one set of VLANs on the CPE-facing Ethernet interface and other set of VLANs on the EoIP one is necessary but not sufficient - RSTP would disable one of the paths. With MSTP, you can have an independent topology for each group of VLANs, so both paths will stay transparent but no L2 traffic will be able to loop.

shivansps · November 9, 2020, 4:02pm

i got stuck in the configuration, the vlans are added to both routers, and assigned to lan list, if i set a dhcp client on any of them i get an ip.

Both routers can ping any device IP on the other site, but i cant make pcs on for example 192.168.90.0/24 on site 1 ping pcs on 192.168.88.0/24 on site 2. They can ping the gateway

And the static route its there so i dont understand. I know about the Windows ICMP issue, its not that.

sindy · November 9, 2020, 4:20pm

As it seems that both subnets are present at both routers, it is possible that the request is routed from 192.168.90.0/24 to 192.168.88.0/24 by router at Site 1, and the response is routed by router at Site 2, so the response arrives through a different interface and thus the firewall on Site 1 doesn’t accept it.

But that’s just one possibility. Post both configurations if the guess was wrong.

mkx · November 9, 2020, 4:41pm

Also: some OSes (most notably Windows) come with firewall which by default blocks any access from any subnet except its “home” subnet. So check end devices’ firewall settings to verify that this is not in your way.

shivansps · November 9, 2020, 5:13pm

Ok i removed a bit of stuff because it was way too long with L2TP and hotspots and some extras.

This is at site 1, it has VLANs from 100 to 140, vlan 200 comes from site 2
Vlan 130 is 192.168.85.0/24

/interface bridge
add admin-mac=C4:AD:34:F2:8C:C6 auto-mac=no name=bridge vlan-filtering=yes

/interface ethernet
set [ find default-name=ether1 ] name=ether1-Modem
set [ find default-name=ether2 ] name=ether2-DVR
set [ find default-name=ether3 ] name=ether3-Admin
set [ find default-name=ether4 ] name=ether4-CPE
set [ find default-name=ether5 ] name=ether5-EAP
set [ find default-name=sfp1 ] name=sfp1-Switch

/interface vlan
add interface=bridge name=vlan2-Empleados vlan-id=110
add interface=bridge name=vlan3-Clientes vlan-id=120
add interface=bridge name=vlan4-Ventas vlan-id=130
add interface=bridge name=vlan5-Servicio vlan-id=140
add interface=bridge name=vlan6-GamingVentas vlan-id=200

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN

/ip pool
add name=admin ranges=192.168.90.10-192.168.90.254
add name=clientes-pool ranges=10.5.50.2-10.5.50.254
add name=ventas-pool ranges=192.168.85.10-192.168.85.254
add name=empleados-pool ranges=192.168.81.10-192.168.81.254
add name=servicio-pool ranges=192.168.88.10-192.168.88.254

/interface bridge port
add bridge=bridge interface=ether2-DVR
add bridge=bridge interface=ether3-Admin
add bridge=bridge interface=ether4-CPE
add bridge=bridge interface=ether5-EAP
add bridge=bridge interface=sfp1-Switch

/interface bridge vlan
add bridge=bridge comment="VLANS DEPOSITO" tagged=\
    bridge,ether2-DVR,ether3-Admin,ether4-CPE,ether5-EAP,sfp1-Switch vlan-ids=\
    100,110,120,130,140
add bridge=bridge comment="VLANS GAMING" tagged=bridge,ether4-CPE vlan-ids=\
    200,210
	
/interface list member
add interface=bridge list=LAN
add interface=ether1-Modem list=WAN
add list=LAN
add interface=vlan2-Empleados list=LAN
add interface=vlan3-Clientes list=LAN
add interface=vlan4-Ventas list=LAN
add interface=vlan5-Servicio list=LAN
add interface=l2tp-out1 list=LAN
add interface=vlan6-GamingVentas list=LAN

/ip address
add address=192.168.90.1/24 comment=Admin interface=bridge network=192.168.90.0
add address=192.168.88.1/24 comment=Servicio interface=vlan5-Servicio network=\
    192.168.88.0
add address=192.168.85.1/24 comment=Ventas interface=vlan4-Ventas network=\
    192.168.85.0
add address=192.168.81.1/24 comment=Empleados interface=vlan2-Empleados \
    network=192.168.81.0
add address=10.5.50.1/24 comment=Clientes interface=vlan3-Clientes network=\
    10.5.50.0
add address=192.168.100.250/24 comment=Claro interface=ether1-Modem network=\
    192.168.100.0
	
/ip dhcp-client
add add-default-route=no disabled=no interface=vlan6-GamingVentas

/ip dhcp-server network
add address=10.5.50.0/24 comment=Clientes gateway=10.5.50.1
add address=192.168.81.0/24 comment=Empleados gateway=192.168.81.1
add address=192.168.85.0/24 boot-file-name=grldr comment=Ventas gateway=\
    192.168.85.1 next-server=192.168.88.2
add address=192.168.87.0/27 comment="Ventas Gaming" gateway=192.168.87.1
add address=192.168.88.0/24 boot-file-name=grldr comment=Servicio gateway=\
    192.168.88.1 next-server=192.168.88.2
add address=192.168.90.0/24 comment=Admin gateway=192.168.90.1

/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related in-interface=!vlan3-Clientes \
    out-interface=!vlan3-Clientes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat

add action=masquerade chain=srcnat comment=WAN ipsec-policy=out,none \
    out-interface-list=WAN

/ip route
add distance=1 dst-address=192.168.87.0/24 gateway=vlan6-GamingVentas

This is a site 2, it has vlans from 200 to 230, VLAN 130 comes from site 1.

/interface bridge
add admin-mac=B8:69:F4:DB:9A:66 auto-mac=no name=bridge vlan-filtering=yes

/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN0
set [ find default-name=ether2 ] name=ether2-CPE
set [ find default-name=ether3 ] name=ether3-SERVICIO/TRUNK
set [ find default-name=ether4 ] name=ether4-SERVICIO
set [ find default-name=ether5 ] name=ether5-VENTAS

/interface vlan
add interface=bridge name=vlan1-Empleados vlan-id=220
add interface=bridge name=vlan2-Clientes vlan-id=230
add interface=bridge name=vlan3-Ventas vlan-id=200
add interface=bridge name=vlan5-DepositoVentas vlan-id=130

/interface list
add name=WAN
add comment=defconf name=LAN
add name=LAN+EMP
add name=WIFI
add name=NOFASTRACK

/ip pool
add name=ADMIN ranges=192.168.89.50-192.168.89.254
add name=EMPLEADOS ranges=192.168.81.10-192.168.81.254
add name=CLIENTES ranges=10.5.50.50-10.5.50.254
add name=VENTAS ranges=192.168.87.50-192.168.87.254
add name=VPN ranges=192.168.82.20-192.168.82.254
add name=CLIENTES-VIP next-pool=CLIENTES ranges=10.5.50.2-10.5.50.49

/ip dhcp-server
add address-pool=ADMIN disabled=no interface=bridge lease-time=5h name=ADMIN
add address-pool=VENTAS disabled=no interface=vlan3-Ventas lease-time=1w3d name=VENTAS
add address-pool=EMPLEADOS disabled=no interface=vlan1-Empleados lease-time=12h name=EMPLEADOS
add address-pool=CLIENTES disabled=no interface=vlan2-Clientes name=CLIENTES

/interface bridge port
add bridge=bridge interface=ether3-SERVICIO/TRUNK
add bridge=bridge interface=ether4-SERVICIO
add bridge=bridge interface=ether5-VENTAS pvid=200
add bridge=bridge interface=ether2-CPE pvid=99


/interface bridge vlan
add bridge=bridge comment=vlan-clientes tagged=ether3-SERVICIO/TRUNK,bridge vlan-ids=230
add bridge=bridge comment=vlan-empleados tagged=ether3-SERVICIO/TRUNK,bridge vlan-ids=220
add bridge=bridge comment=vlan-ventas tagged=ether3-SERVICIO/TRUNK,bridge,ether2-CPE untagged=ether5-VENTAS vlan-ids=200
add bridge=bridge comment=vlan-admin disabled=yes tagged=bridge,ether2-CPE vlan-ids=210
add bridge=bridge comment="VLANS DEPOSITO" tagged=bridge,ether2-CPE vlan-ids=130

/interface list member
add interface=bridge list=LAN
add interface=ether1-WAN0 list=WAN
add interface=vlan3-Ventas list=LAN
add interface=bridge list=LAN+EMP
add interface=vlan1-Empleados list=LAN+EMP
add interface=vlan2-Clientes list=WIFI
add interface=vlan3-Ventas list=LAN+EMP
add interface=vlan1-Empleados list=WIFI
add interface=vlan5-DepositoVentas list=LAN

/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=10.5.50.1/24 interface=vlan2-Clientes network=10.5.50.0
add address=192.168.81.1/24 interface=vlan1-Empleados network=192.168.81.0
add address=192.168.80.1/24 interface=vlan3-Ventas network=192.168.80.0
add address=192.168.87.1/24 interface=vlan3-Ventas network=192.168.87.0
add address=192.168.89.1/24 interface=bridge network=192.168.89.0

/ip dhcp-client
add add-default-route=no disabled=no interface=ether1-WAN0 script=":local newgw [ip dhcp-client get [find interface=\"ether1-WAN0\"] gateway];\r\
    \n:local routegw [/ip route get [find comment=\"FAILOVER WAN0\"] gateway ];\r\
    \n:if (\$newgw != \$routegw) do={\r\
    \n     /ip route set [find comment=\"FAILOVER WAN0\"] gateway=\$newgw;\r\
    \n}"
add add-default-route=no disabled=no interface=vlan5-DepositoVentas

/ip dhcp-server lease
add address=192.168.89.2 comment="SWITCH 3COM" mac-address=00:18:6E:CA:10:89 server=ADMIN
add address=192.168.89.4 client-id=1:68:ff:7b:f6:f2:6f comment=EAP115 mac-address=68:FF:7B:F6:F2:6F server=ADMIN

/ip dhcp-server network
add address=10.5.50.0/24 comment="Clientes Gaming" gateway=10.5.50.1
add address=192.168.80.0/24 comment="Ventas Deposito" gateway=192.168.80.1
add address=192.168.81.0/24 comment="Empleados Gaming" dns-server=8.8.8.8 gateway=192.168.81.1 netmask=24
add address=192.168.85.0/24 comment="DEPOSITO VENTAS" gateway=192.168.85.1
add address=192.168.87.0/24 boot-file-name=grldr comment="Ventas Gaming" dns-server=8.8.8.8 gateway=192.168.87.1 next-server=192.168.80.2
add address=192.168.88.0/24 comment="DEPOSITO ARMADO" gateway=192.168.88.1
add address=192.168.89.0/24 boot-file-name=grldr comment="Admin Gaming" dns-server=8.8.8.8 gateway=192.168.89.1 next-server=192.168.88.2

/ip firewall filter
add action=accept chain=input comment=VPN dst-port=500,1701,4500 in-interface-list=WAN protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=drop chain=forward comment="Bloquear SMB de Servicio a Ventas por SMB3" disabled=yes dst-address=192.168.80.2 dst-port=445,135-139 in-interface=bridge \
    protocol=tcp src-address=192.168.88.0/24
add action=drop chain=forward disabled=yes dst-address=192.168.80.2 dst-port=135-139 in-interface=bridge protocol=udp src-address=192.168.88.0/24
add action=drop chain=forward comment="Bloquear Publico" in-interface=vlan2-Clientes out-interface-list=LAN+EMP
add action=drop chain=forward dst-address=192.168.100.1 in-interface=vlan2-Clientes
add action=drop chain=forward dst-address=192.168.82.0/24 in-interface-list=WIFI
add action=drop chain=forward dst-address=192.168.83.0/24 in-interface-list=WIFI
add action=drop chain=forward comment="Bloquear Empleados" disabled=yes dst-address=192.168.80.2 dst-port=!5095,11125,5101,3306 in-interface=vlan1-Empleados \
    protocol=tcp
add action=drop chain=forward disabled=yes dst-address=192.168.80.2 dst-port=!5095,11125,9000-10999,11130,12000-20000 in-interface=vlan1-Empleados protocol=udp
add action=accept chain=forward disabled=yes dst-address=192.168.88.3 dst-port=445,135-139 in-interface=vlan1-Empleados protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.88.3 dst-port=135-139 in-interface=vlan1-Empleados protocol=udp
add action=drop chain=forward disabled=yes dst-address=!192.168.80.2 in-interface=vlan1-Empleados out-interface-list=LAN
add action=drop chain=forward disabled=yes dst-address=192.168.100.1 in-interface=vlan1-Empleados
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related in-interface=vlan2-Clientes out-interface=\
    vlan2-Clientes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting comment="WAN1 EN CLIENTES" disabled=yes dst-address=!10.5.50.0/24 in-interface=vlan2-Clientes new-routing-mark=POR_WAN1 \
    passthrough=no
add action=mark-connection chain=input comment="ENTRA POR WAN1 Y SALE POR WAN1" disabled=yes in-interface=ether2-CPE new-connection-mark=WAN1 passthrough=no
add action=mark-connection chain=prerouting disabled=yes in-interface=ether2-CPE new-connection-mark=WAN1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN1 disabled=yes new-routing-mark=POR_WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1 disabled=yes new-routing-mark=POR_WAN1 passthrough=yes
add action=passthrough chain=prerouting comment=VOIP dst-address=200.110.216.28
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment=WAN0 ipsec-policy=out,none out-interface=ether1-WAN0
add action=masquerade chain=srcnat comment=WAN1 disabled=yes out-interface=ether2-CPE
add action=masquerade chain=srcnat comment="masquerade hotspot network" src-address=10.5.50.0/24
add action=dst-nat chain=dstnat comment=VOIP dst-port=11125 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=11125 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5095 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5095 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5101 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=9000-10999 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=11130 protocol=udp to-addresses=192.168.80.4
add action=dst-nat chain=dstnat dst-port=12000-20000 in-interface-list=WAN protocol=udp to-addresses=192.168.80.4
add action=dst-nat chain=dstnat comment="CODIGO QR" dst-port=587 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2 to-ports=3306
add action=dst-nat chain=dstnat comment=MYSQL dst-port=6549 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2 to-ports=3306


/ip route
add check-gateway=ping distance=1 gateway=64.233.186.127 routing-mark=POR_WAN1
add check-gateway=ping distance=2 gateway=8.8.4.4 routing-mark=POR_WAN1
add check-gateway=ping distance=1 gateway=8.8.4.4
add check-gateway=ping distance=2 gateway=64.233.186.127
add comment="FAILOVER WAN0" distance=1 dst-address=8.8.4.4/32 gateway=181.47.80.1 scope=10
add comment="FAILOVER WAN1" distance=1 dst-address=64.233.186.127/32 gateway=192.168.90.1 scope=10
add distance=1 dst-address=192.168.85.0/24 gateway=vlan5-DepositoVentas

/system resource irq rps
set ether1-WAN0 disabled=no
set ether3-SERVICIO/TRUNK disabled=no
set ether4-SERVICIO disabled=no
set ether5-VENTAS disabled=no

So the only vlans that are crossing the CPEs right now are the 130 (192.168.85.0) and 200 (192.168.87.0). This is the configuracion that allows both routers to ping every device on the other site, and pcs on 192.168.87.0 to ping 192.168.85.1 and viceversa.

sindy · November 9, 2020, 6:47pm

Removing stuff is always risky because you may remove something you deem unrelated to the issue while it actually is.

For example here, you have removed the /ip dhcp-server table from Router 1.

So you indeed have a non-symmetric routing, devices in 192.168.85.0/24 use Router 1 as their default gateway (192.168.85.1), whereas devices in 192.168.87.0/24 use Router 2 as their default gateway (192.168.87.1). But I cannot see any rule in firewall filters on either router to block the traffic between the subnets.

So do check the path of the ping request and response and where it breaks: while running a constant ping from 192.168.85.A to 192.168.87.B, run, at both routers, the following command:
/tool sniffer quick ip-protocol=icmp ip-address=192.168.85.A
As no interface is specified, on Router 1, you you should see the ping request on the following interfaces:
sfp1-Switch (tagged with VID 130),
bridge (tagged with VID 130)
vlan4-Ventas (without a VID)
vlan6-GamingVentas (without a VID)
bridge (tagged with VID 200)
ether4-cpe (tagged with VID 200)

The ping response, if it arrives, will take the following path:
ether4-cpe (tagged with VID 130)
(maybe bridge, I’m not sure)
sfp1 (tagged with VID 130)

On Router 2, you should see the request on the following interfaces:
ether2-CPE (tagged with VID 200)
(maybe bridge, I’m not sure)
ether5-VENTAS (without a VID)

The ping response, if it arrives, will take the following path:
ether5-VENTAS (without a VID)
bridge (tagged with VID 200)
vlan3-Ventas (without a VID)
vlan5-DepositoVentas (without a VID)
bridge (tagged with VID 130)
ether2-CPE (tagged with VID 130)

So see where on the above path it breaks.

You can also optimize the firewall a bit for throughput, but it is not relevant to the issue you’re hunting for now.

shivansps · November 9, 2020, 8:27pm

i tried both ways with the same results.

In attaching the full configs.

# model = RB760iGS
/interface bridge
add admin-mac=C4:AD:34:F2:8C:C6 auto-mac=no name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-Modem
set [ find default-name=ether2 ] name=ether2-DVR
set [ find default-name=ether3 ] name=ether3-Admin
set [ find default-name=ether4 ] name=ether4-CPE
set [ find default-name=ether5 ] name=ether5-EAP
set [ find default-name=sfp1 ] name=sfp1-Switch
/interface l2tp-client
add allow-fast-path=yes connect-to=c disabled=no name=l2tp-out1 use-ipsec=yes user=c
/interface vlan
add interface=bridge name=vlan2-Empleados vlan-id=110
add interface=bridge name=vlan3-Clientes vlan-id=120
add interface=bridge name=vlan4-Ventas vlan-id=130
add interface=bridge name=vlan5-Servicio vlan-id=140
add interface=bridge name=vlan6-GamingVentas vlan-id=200
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
add hotspot-address=10.5.50.1 html-directory=flash/hotspot login-by=http-chap name=Clientes rate-limit=5M/50M
/ip pool
add name=admin ranges=192.168.90.10-192.168.90.254
add name=clientes-pool ranges=10.5.50.2-10.5.50.254
add name=ventas-pool ranges=192.168.85.10-192.168.85.254
add name=empleados-pool ranges=192.168.81.10-192.168.81.254
add name=servicio-pool ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=admin disabled=no interface=bridge name=Admin
add address-pool=clientes-pool disabled=no interface=vlan3-Clientes lease-time=1h name=Clientes
add address-pool=empleados-pool disabled=no interface=vlan2-Empleados name=Empleados
add address-pool=ventas-pool disabled=no interface=vlan4-Ventas name=Ventas
add address-pool=servicio-pool disabled=no interface=vlan5-Servicio name=Servicio
/ip hotspot
add address-pool=clientes-pool disabled=no interface=vlan3-Clientes name=Clientes profile=Clientes
/ip hotspot user profile
set [ find default=yes ] address-pool=clientes-pool name=vip rate-limit=10M/100M shared-users=30 transparent-proxy=yes
add address-pool=clientes-pool idle-timeout=30m mac-cookie-timeout=6h name=clientes rate-limit=256k/2M shared-users=200 transparent-proxy=yes
/port
set 0 name=serial0
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=bridge interface=ether2-DVR
add bridge=bridge interface=ether3-Admin
add bridge=bridge interface=ether4-CPE
add bridge=bridge interface=ether5-EAP
add bridge=bridge interface=sfp1-Switch
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge comment="VLANS DEPOSITO" tagged=bridge,ether2-DVR,ether3-Admin,ether4-CPE,ether5-EAP,sfp1-Switch vlan-ids=100,110,120,130,140
add bridge=bridge comment="VLANS GAMING" tagged=bridge,ether4-CPE vlan-ids=200,210
/interface list member
add interface=bridge list=LAN
add interface=ether1-Modem list=WAN
add interface=vlan2-Empleados list=LAN
add interface=vlan3-Clientes list=LAN
add interface=vlan4-Ventas list=LAN
add interface=vlan5-Servicio list=LAN
add interface=l2tp-out1 list=LAN
add interface=vlan6-GamingVentas list=LAN
/ip address
add address=192.168.90.1/24 comment=Admin interface=bridge network=192.168.90.0
add address=192.168.88.1/24 comment=Servicio interface=vlan5-Servicio network=192.168.88.0
add address=192.168.85.1/24 comment=Ventas interface=vlan4-Ventas network=192.168.85.0
add address=192.168.81.1/24 comment=Empleados interface=vlan2-Empleados network=192.168.81.0
add address=10.5.50.1/24 comment=Clientes interface=vlan3-Clientes network=10.5.50.0
add address=192.168.100.250/24 comment=Claro interface=ether1-Modem network=192.168.100.0
/ip dhcp-client
add add-default-route=no disabled=no interface=vlan6-GamingVentas
/ip dhcp-server lease
add address=192.168.90.2 client-id=1:b0:95:75:e6:f3:fa comment="Switch TP-LINK" mac-address=B0:95:75:E6:F3:FA server=Admin
add address=192.168.90.3 client-id=1:d8:47:32:3f:74:76 comment=EAP mac-address=D8:47:32:3F:74:76 server=Admin
add address=192.168.88.2 client-id=1:60:a4:4c:63:18:63 mac-address=60:A4:4C:63:18:63 server=Servicio
add address=192.168.90.10 client-id=1:bc:32:5f:11:a7:ca comment=DVR mac-address=BC:32:5F:11:A7:CA server=Admin
add address=192.168.85.7 client-id=1:0:10:40:b8:ce:6e comment=IMP.LOGISTICA mac-address=00:10:40:B8:CE:6E server=Ventas
add address=192.168.88.4 client-id=1:bc:ba:c2:8e:80:9a comment=Fichador mac-address=BC:BA:C2:8E:80:9A server=Servicio
add address=192.168.90.4 client-id=1:b0:95:75:1:16:bc comment=CPE_DEPOSITO mac-address=B0:95:75:01:16:BC server=Admin
add address=192.168.90.5 client-id=1:3c:84:6a:7f:35:ae comment=CPE_Gaming mac-address=3C:84:6A:7F:35:AE server=Admin
/ip dhcp-server network
add address=10.5.50.0/24 comment=Clientes gateway=10.5.50.1
add address=192.168.81.0/24 comment=Empleados gateway=192.168.81.1
add address=192.168.85.0/24 boot-file-name=grldr comment=Ventas gateway=192.168.85.1 next-server=192.168.88.2
add address=192.168.87.0/27 comment="Ventas Gaming" gateway=192.168.87.1
add address=192.168.88.0/24 boot-file-name=grldr comment=Servicio gateway=192.168.88.1 next-server=192.168.88.2
add address=192.168.90.0/24 comment=Admin gateway=192.168.90.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.90.1 comment=defconf name=router.lan
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related in-interface=!vlan3-Clientes out-interface=!vlan3-Clientes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment=WAN ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masquerade hotspot network" src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment=VPN out-interface=l2tp-out1
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip hotspot user
add name=vip
add name=gaming-city profile=clientes
/ip route
add distance=1 gateway=192.168.100.1
add distance=1 dst-address=192.168.80.2/32 gateway=l2tp-out1
add distance=1 dst-address=192.168.80.3/32 gateway=l2tp-out1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Argentina/Buenos_Aires
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

# model = RB750Gr3
/interface bridge
add admin-mac=B8:69:F4:DB:9A:66 auto-mac=no name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN0 speed=100Mbps
set [ find default-name=ether2 ] name=ether2-CPE speed=100Mbps
set [ find default-name=ether3 ] name=ether3-SERVICIO/TRUNK speed=100Mbps
set [ find default-name=ether4 ] name=ether4-SERVICIO speed=100Mbps
set [ find default-name=ether5 ] name=ether5-VENTAS speed=100Mbps
/interface vlan
add interface=bridge name=vlan1-Empleados vlan-id=220
add interface=bridge name=vlan2-Clientes vlan-id=230
add interface=bridge name=vlan3-Ventas vlan-id=200
add interface=bridge name=vlan5-DepositoVentas vlan-id=130
/interface list
add name=WAN
add comment=defconf name=LAN
add name=LAN+EMP
add name=WIFI
add name=NOFASTRACK
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] hotspot-address=10.5.50.1 html-directory=flash/hotspot login-by=http-chap name=CLIENTES rate-limit=3M/40M
/ip pool
add name=ADMIN ranges=192.168.89.50-192.168.89.254
add name=EMPLEADOS ranges=192.168.81.10-192.168.81.254
add name=CLIENTES ranges=10.5.50.50-10.5.50.254
add name=VENTAS ranges=192.168.87.50-192.168.87.254
add name=VPN ranges=192.168.82.20-192.168.82.254
add name=CLIENTES-VIP next-pool=CLIENTES ranges=10.5.50.2-10.5.50.49
/ip dhcp-server
add address-pool=ADMIN disabled=no interface=bridge lease-time=5h name=ADMIN
add address-pool=VENTAS disabled=no interface=vlan3-Ventas lease-time=1w3d name=VENTAS
add address-pool=EMPLEADOS disabled=no interface=vlan1-Empleados lease-time=12h name=EMPLEADOS
add address-pool=CLIENTES disabled=no interface=vlan2-Clientes name=CLIENTES
/ip hotspot
add address-pool=CLIENTES disabled=no idle-timeout=none interface=vlan2-Clientes name=CLIENTES
/ip hotspot user profile
set [ find default=yes ] address-pool=CLIENTES-VIP name=VIP rate-limit=5M/50M shared-users=30
add address-pool=CLIENTES idle-timeout=30m mac-cookie-timeout=6h name=CLIENTES rate-limit=256k/2M shared-users=200 transparent-proxy=yes
/ppp profile
add dns-server=8.8.8.8 local-address=192.168.82.1 name=VPN remote-address=VPN use-encryption=required
/interface bridge port
add bridge=bridge interface=ether3-SERVICIO/TRUNK
add bridge=bridge interface=ether4-SERVICIO
add bridge=bridge interface=ether5-VENTAS pvid=200
add bridge=bridge interface=ether2-CPE pvid=99
/ip neighbor discovery-settings
set discover-interface-list=*2000013
/interface bridge vlan
add bridge=bridge comment=vlan-clientes tagged=ether3-SERVICIO/TRUNK,bridge vlan-ids=230
add bridge=bridge comment=vlan-empleados tagged=ether3-SERVICIO/TRUNK,bridge vlan-ids=220
add bridge=bridge comment=vlan-ventas tagged=ether3-SERVICIO/TRUNK,bridge,ether2-CPE untagged=ether5-VENTAS vlan-ids=200
add bridge=bridge comment=vlan-admin disabled=yes tagged=bridge,ether2-CPE vlan-ids=210
add bridge=bridge comment="VLANS DEPOSITO" tagged=bridge,ether2-CPE vlan-ids=130
/interface l2tp-server server
set allow-fast-path=yes authentication=mschap2 default-profile=VPN enabled=yes use-ipsec=yes
/interface list member
add interface=bridge list=LAN
add interface=ether1-WAN0 list=WAN
add interface=vlan3-Ventas list=LAN
add interface=bridge list=LAN+EMP
add interface=vlan1-Empleados list=LAN+EMP
add interface=vlan2-Clientes list=WIFI
add interface=vlan3-Ventas list=LAN+EMP
add interface=vlan1-Empleados list=WIFI
add interface=vlan5-DepositoVentas list=LAN
/interface sstp-server server
set authentication=mschap2 certificate=cert_export_server-certificate.crt_0 default-profile=VPN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=10.5.50.1/24 interface=vlan2-Clientes network=10.5.50.0
add address=192.168.81.1/24 interface=vlan1-Empleados network=192.168.81.0
add address=192.168.80.1/24 interface=vlan3-Ventas network=192.168.80.0
add address=192.168.87.1/24 interface=vlan3-Ventas network=192.168.87.0
add address=192.168.89.1/24 interface=bridge network=192.168.89.0
/ip dhcp-client
add add-default-route=no disabled=no interface=ether1-WAN0 script=":local newgw [ip dhcp-client get [find interface=\"ether1-WAN0\"] gateway];\r\
    \n:local routegw [/ip route get [find comment=\"FAILOVER WAN0\"] gateway ];\r\
    \n:if (\$newgw != \$routegw) do={\r\
    \n     /ip route set [find comment=\"FAILOVER WAN0\"] gateway=\$newgw;\r\
    \n}"
add add-default-route=no !dhcp-options interface=ether2-CPE script=":local newgw [ip dhcp-client get [find interface=\"ether2-WAN1\"] gateway];\r\
    \n:local routegw [/ip route get [find comment=\"FAILOVER WAN1\"] gateway ];\r\
    \n:if (\$newgw != \$routegw) do={\r\
    \n     /ip route set [find comment=\"FAILOVER WAN1\"] gateway=\$newgw;\r\
    \n}"
add add-default-route=no disabled=no interface=vlan5-DepositoVentas
/ip dhcp-server lease
add address=192.168.89.2 comment="SWITCH 3COM" mac-address=00:18:6E:CA:10:89 server=ADMIN
add address=192.168.89.4 client-id=1:68:ff:7b:f6:f2:6f comment=EAP115 mac-address=68:FF:7B:F6:F2:6F server=ADMIN
/ip dhcp-server network
add address=10.5.50.0/24 comment="Clientes Gaming" gateway=10.5.50.1
add address=192.168.80.0/24 comment="Ventas Deposito" gateway=192.168.80.1
add address=192.168.81.0/24 comment="Empleados Gaming" dns-server=8.8.8.8 gateway=192.168.81.1 netmask=24
add address=192.168.85.0/24 comment="DEPOSITO VENTAS" gateway=192.168.85.1
add address=192.168.87.0/24 boot-file-name=grldr comment="Ventas Gaming" dns-server=8.8.8.8 gateway=192.168.87.1 next-server=192.168.80.2
add address=192.168.88.0/24 comment="DEPOSITO ARMADO" gateway=192.168.88.1
add address=192.168.89.0/24 boot-file-name=grldr comment="Admin Gaming" dns-server=8.8.8.8 gateway=192.168.89.1 next-server=192.168.88.2
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.80.78 name=gamingsaas
/ip firewall filter
add action=accept chain=input comment=VPN dst-port=500,1701,4500 in-interface-list=WAN protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=drop chain=forward comment="Bloquear SMB de Servicio a Ventas por SMB3" disabled=yes dst-address=192.168.80.2 dst-port=445,135-139 in-interface=bridge protocol=tcp src-address=192.168.88.0/24
add action=drop chain=forward disabled=yes dst-address=192.168.80.2 dst-port=135-139 in-interface=bridge protocol=udp src-address=192.168.88.0/24
add action=drop chain=forward comment="Bloquear Publico" in-interface=vlan2-Clientes out-interface-list=LAN+EMP
add action=drop chain=forward dst-address=192.168.100.1 in-interface=vlan2-Clientes
add action=drop chain=forward dst-address=192.168.82.0/24 in-interface-list=WIFI
add action=drop chain=forward dst-address=192.168.83.0/24 in-interface-list=WIFI
add action=drop chain=forward comment="Bloquear Empleados" disabled=yes dst-address=192.168.80.2 dst-port=!5095,11125,5101,3306 in-interface=vlan1-Empleados protocol=tcp
add action=drop chain=forward disabled=yes dst-address=192.168.80.2 dst-port=!5095,11125,9000-10999,11130,12000-20000 in-interface=vlan1-Empleados protocol=udp
add action=accept chain=forward disabled=yes dst-address=192.168.88.3 dst-port=445,135-139 in-interface=vlan1-Empleados protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.88.3 dst-port=135-139 in-interface=vlan1-Empleados protocol=udp
add action=drop chain=forward disabled=yes dst-address=!192.168.80.2 in-interface=vlan1-Empleados out-interface-list=LAN
add action=drop chain=forward disabled=yes dst-address=192.168.100.1 in-interface=vlan1-Empleados
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related in-interface=vlan2-Clientes out-interface=vlan2-Clientes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting comment="WAN1 EN CLIENTES" disabled=yes dst-address=!10.5.50.0/24 in-interface=vlan2-Clientes new-routing-mark=POR_WAN1 passthrough=no
add action=mark-connection chain=input comment="ENTRA POR WAN1 Y SALE POR WAN1" disabled=yes in-interface=ether2-CPE new-connection-mark=WAN1 passthrough=no
add action=mark-connection chain=prerouting disabled=yes in-interface=ether2-CPE new-connection-mark=WAN1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN1 disabled=yes new-routing-mark=POR_WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1 disabled=yes new-routing-mark=POR_WAN1 passthrough=yes
add action=passthrough chain=prerouting comment=VOIP dst-address=200.110.216.28
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment=WAN0 ipsec-policy=out,none out-interface=ether1-WAN0
add action=masquerade chain=srcnat comment=WAN1 disabled=yes out-interface=ether2-CPE
add action=masquerade chain=srcnat comment="masquerade hotspot network" src-address=10.5.50.0/24
add action=dst-nat chain=dstnat comment=VOIP dst-port=11125 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=11125 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5095 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5095 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=5101 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=9000-10999 in-interface-list=WAN protocol=udp to-addresses=192.168.80.2
add action=dst-nat chain=dstnat dst-port=11130 protocol=udp to-addresses=192.168.80.4
add action=dst-nat chain=dstnat dst-port=12000-20000 in-interface-list=WAN protocol=udp to-addresses=192.168.80.4
add action=dst-nat chain=dstnat comment="CODIGO QR" dst-port=587 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2 to-ports=3306
add action=dst-nat chain=dstnat comment=MYSQL dst-port=6549 in-interface-list=WAN protocol=tcp to-addresses=192.168.80.2 to-ports=3306
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip hotspot user
add name=vip
add name=gaming-city profile=CLIENTES
/ip route
add check-gateway=ping distance=1 gateway=64.233.186.127 routing-mark=POR_WAN1
add check-gateway=ping distance=2 gateway=8.8.4.4 routing-mark=POR_WAN1
add check-gateway=ping distance=1 gateway=8.8.4.4
add check-gateway=ping distance=2 gateway=64.233.186.127
add comment="FAILOVER WAN0" distance=1 dst-address=8.8.4.4/32 gateway=181.47.80.1 scope=10
add comment="FAILOVER WAN1" distance=1 dst-address=64.233.186.127/32 gateway=192.168.90.1 scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=186.12.155.255/32,192.168.88.0/24,192.168.90.0/24
set api-ssl disabled=yes
/radius incoming
set accept=yes
/system clock
set time-zone-name=America/Argentina/Buenos_Aires
/system resource irq rps
set ether1-WAN0 disabled=no
set ether3-SERVICIO/TRUNK disabled=no
set ether4-SERVICIO disabled=no
set ether5-VENTAS disabled=no

Did you mention something about the two routers being involved in the routing, there is other way to do it?

shivansps · November 10, 2020, 4:04pm

It looks like the traffic is getting dropped right were it should be going to the VLAN that goes out, but im not really sure why.

sindy · November 10, 2020, 4:40pm

Try to disable the chain=forward action=drop connection-state=invalid rule. I never tried whether a ping response for which no request was seen is considered connection-state=invalid but it is the most likely explanation.

A softer way to test the same is to place an action=accept protocol=icmp rule right before the “drop invalid” one, instead of disabling it.

Check this, I’ll write more later.

shivansps · November 10, 2020, 4:57pm

Yeah its that, disabling the drop invalid makes everything start working, ping, file share, etc… Any idea of why the routers consider this traffic to be invalid?

A easy fix for this would be to add the crossing vlans on both routers into a list and use the “while is not in the list” in the invalid rule. Not sure if that would be the correct fix.

sindy · November 10, 2020, 7:51pm

Routers don’t; firewalls do.

A stateful firewall tracks the individual connections; for some (like UDP), the state of the connection at protocol level doesn’t exist, whereas for others (like TCP or ICMP echo), there is a clearly defined sequence of packets with certain properties which the endpoints must exchange in proper order to initiate a new connection, and the stateful firewall (connection tracking module) watches for these packets and only considers a packet valid if it comes at proper position within that sequence. So since the ping request is just bridged, not routed, by Router 2, Router 2’s IP firewall doesn’t see it, and the first packet it can see is the ping response, which can not be the initial packet of a connection, so it classifies it as invalid.

Depending on the role of the two routers, you may or may not want them to act as firewalls between the subnets.

If you don’t need them to act as firewalls between those subnets, you can add an action=notrack rule matching on an in-interface-list and out-interface-list listing all the internal VLANs into chain prerouting of /ip firewall raw. The “accept established,related,untracked” rule will then let these packets through regardless their role in the connection, as they will bypass connection tracking completely.

If you need them to act as firewalls, and at the same time you really need to have devices in the same subnet/VLAN at both sites, you’ll have to use VRRP on the interfaces representing these subnets. VRRP ensures that while the inter-site link is up, only one of the routers does all routing between the subnets which are present on both of them. If the inter-site link goes down, each router will route between these subnets on its own, until the link operation resumes.

shivansps · November 10, 2020, 11:46pm

Got it, thanks, you have been very helpfull.