I have a CCR2004-16G-2S+ that I am using as my main router at home and I am wanting to add my tablet to the BTH VPN I have already set up. The device I set it up on is an iPhone 16 Pro Max, and I get to the step of authenticating with the router to add the necessary configuration to add my tablet to the VPN, but I always get a “connection refused” error (attached screenshot - I do have a password for the admin user). I have verified my username and password are correct and I am connected to my home network that the CCR2004 is, I noticed that the log also shows: “denied winbox/dude connect from 192.168.216.3” when trying to authenticate at this step on the app, and I also tried to add a firewall rule to explicitly allow Winbox access for this IP which didn’t help (I tested with the rule at the very top of the list and that made no difference). While the rule does fire, it still gives me the same error in the app and the same log message.
I have also attached my sanitised config in case there is a firewall rule or some sort of bad configuration which could be causing this to happen, I am still rather new to MikroTik and learning as I go so it’s very possible that I did something incorrectly when configuring my router.
You need to ensure you are useing the iphone to add the additional user.
Probaby need to ensure that you are NOT connected by wifi to your home network where the router resides, but only through cellular for example.
Will try myself shortly to add another user to see if it works for me.
++++++++++++
Hmmmm testing so far, using the BTH app, no problems connecting to the router and then accessign the router through the normal mT app, or connecting to my capac either.
You are correct it absolutely refuses to let me connect via the BTH app to MANAGE shares, it refuses the connection outright. To be clear the BTH interface is on my trusted interface list and the subnet is added to the admin firewall address list. Both are required to access the router in input chain and all vlans, and thus why I can reach the router via the MT app or my capac etc… I also have no problems accessing the internet or other devices (switches tp link) through the iphone when connected via the BTH app as a user.
This leads me to think we can only add devices when connected via WIFI, the opposite of my initial thinking so will try that next.
No luck, unable to add users from my iphone, connection refused for managing shares if connected via wifi or via cellular to the router.
Great, thank you for testing it, I’m glad to know that it’s reproducible by others and isn’t just bad configuration on my end keep me updated with the results of the bug report to MT, hopefully it’s something they can reproduce too. BTH is such a nice feature and it’d be great to be able to add more of my devices to it.
I did notice that when trying to access through cellular, I get an “Unable to establish secure connection” message in the BTH app instead but the log on the router still says the same “denied winbox/dude connect” message, even though like you, I am able to connect via the BTH app to the tunnel and connect to the router through the MT app using the same credentials for the BTH user adding process so I know it can’t be that.
Yes there is something fundamental we are not doing, that is not documented or we are just blind, or there is indeed some bug.
It would help actually if you also submitted a bug report and a supout of your router as with more input they are more likely to address sooner and with more accuracy.
You’re right, I have reached out now to MT and hopefully we’ll get a response back soon (SUP-213731). Thanks for trying this out also and confirming I’m not alone on this
I got a response from MikroTik suggesting to add that device’s subnet to IP > Services > Winbox since it wasn’t there before, so I added 192.168.216.0/24 and that fixed it, now the BTH app fully works as expected
I just went to IP > Services > double clicked the Winbox entry, and next to Available From I clicked the down arrow to add a new entry and added my phone’s subnet. It should look like this when done:
That seems like strange advice and the logic is flawed.
THis is not solved.
Think about it, you could access your router from your IPHONE using the MT app.
Which means you didnt need to add anything to the input chain for access.
Which means you didnt need to add anything to the forward chain ( you could access devices).
In other words, the IP address of your iphone 192.168.216.3 already was accepted as an entry to access the router for both input and forward chain. You entered the router via the MT app via IP address, port and username and password not winbox.
Now what we dont know is how the BTH app accesses the router.
We dont even know (not clear) that to manage shares we need to be accessing the router via cellular or we have to do so via WIFI.
It would appear that winbox is involved, and thus I would say that we have to be behind the router to add users for starters as winbox is typically a service we use once safely inside the box so to speak.
If this is true then some things need to be true,
a. if you have limited the applicable tools entry, macserver winbox-mac server to a specific interface list, then the BTH interface must be included in that interface list.
b. for winbox services, if there are no entries ( in “ALLOWED FROM”, by default this means ALL ENTRIES are accepted. Once you add any entry (address or subnet) to the winbox “allowed from area”, then ONLY those entries are valid. In other words if you had no entries previously then it should have worked and MTs advice was incorrect.
If you had an entry, and lets say just to a trusted internal subnet, then MT was correct you had to add the BTH subnet or at least single address.
You should test this out by first, for access, by removing all entries in your ip services winbox subnets entry and you should still be able to access the router internally via winbox. That should prove to you that no entries, means all entries are permissible.
In my case, I have zero entries in my winbox and yet I am able to access day and night via winbox from both internal and also via NORMAL wireguard coming in externally. I tend to use a trusted interface list AND a trusted firewall address list in firewall filter rules.
Thus from my perspective, this is not solved yet!!
Good one, now I lost access to the router from lan, message router refused connection. I thought this cannot be, probably mikrotik is laughing their asses off reading this.
Not the end of the world, have a backup and can always recover, but what a bad advice that was.
Not sure what the problem is but its certainly not the lack of entries in that table entry “allowed” –> here is mine and I access my router with winbox without issue.
Something wrong with your setup if you cannot connect to the router if the “available from” entry box is empty. This means there are no limits by Ip services for entry to winbox. I am stating this is a different issue and not related to BTH.
That’s very true, I did actually remove the entries in winbox’s subnets entry of Services and could still access my router without any problem. I’m wondering whether my phone’s IP changes or something when it’s on the VPN and that’s what causes the 216 address, because when my phone is connected normally to my network, I get an IP of 192.168.88.240 (although I can’t find that 216 address in the phone’s WiFi settings when the VPN is connected).
I’m sorry that it didn’t work for you but I was not trying to share a joke or false answer, it is what MikroTik suggested to me and that is what worked for me.
Agreed, as mentioned before I now have the entries cleared from that “Available From” list in winbox and can access it just fine using IP on my computer(s) and phone.
As anav said, this seems like some sort of issue with your configuration and not a BTH issue since we are both able to access our routers using IP through Winbox without having any subnets specified in Services.
Since it seems like this topic may not actually be solved, I’ve unmarked it as Solved, although it is working for me now. It’s always interesting to read further discussion and maybe I will learn a thing or two as well
to be clear gvn888, your solution was to add the BTH subnet to what was the EMPTY “allowed from” box for winbox?? Which means, if true, that its a bug and they supplied you with a work around.
concur that your iphone when connected normally at home over wifi, will get an internal wlan address.
However to manage shares we need to connect to the router, I think. Then the question becomes what is ones IP address. Since you are now connected via VPN, the only plausible assumption is that your address is now 216.3. Since that is what is recognized by the router.
Why the router is rejecting this address for ONLY managing shares for BTH, but not accessing the router or devices behind the router, makes no sense. There is something we are missing or something MT is not explaining.
a. you have wireguard on the router for this interface
b. you have an address entered in the router
c. you have a routing for this subnet in the router.
Probably I did not explain sufficient. Once I added the BTH IP to the empty box, later lost connection to the router. I DID NOT lost connection to the router when the field was EMPTY.
Hope it is clearer now.
I guess my mistake was to add only the BTH address and not the TRUSTED range as well. Nevertheless, I did not need this workaround, for me BTH works on this router.
