unable to connect to one of routers

RouterOS General
1

all the network is connected to each other by OSPF, using RB’s and PS5

There is no problem to access the routers across the network.

i just installed another router and i can’t remember what i had for OSPF and that is the only router i can’t connect.

layout

network routers >---------------------->RB-00

RB-00 >-------> (connected to 2 routers “RB-A” and “RB-B”)

I had time and did great focus on RB-A and i am fine to access RB-A from (network routers)
maybe i forgot something to do on RB-B and can’t connect to it

looking at RB-00 I can see both routers RB-A and RB-B got their IP’s fine.

but I can’t access RB-B

RB-B was setup and complete however i can’t access it and I think it had to do something with OSPF.

RB-B is at a remote location so if i can access it from the city is better for me please.

What static route or address list I must add so can connect to it from the WAN side of RB-00

Note: RB-00 is 433 so if ping to RB-B from it’s attached eth is fine, but not from the WAN.

thanks,

2

Any hope so i don’t have to drive to that remote location?

I really hope I can winbox it from distant.

thanks,

3

If RB-00 can reach RB-B as per your post, just make a NAT rule so that RB-B thinks it’s talking to RB-00 when it’s actually a client further away. Assuming that the interface on RB-00 that is facing RB-B is called “blah”, add the following on RB-00, making sure the rule is in a sensible position in the rule set (when in doubt move it to the top):

/ip firewall add chain=srcnat protocol=tcp dst-port=8291 out-interface=blah action=masquerade

If your client doesn’t have a route to RB-B add static routes, or also use destination NAT on RB-00 to port forward a request to its own IP to RB-B. You haven’t posted enough details for a more specific guide on that.

If you need more help post a network diagram and the output of “/ip address print detail”, “/ip route print detail”, “/interface print detail” and “/ip firewall export” from RB-00. Make sure the network diagram includes the client’s location in the network, and as much information about RB-B as you know - at a minimum its IP address that RB-00 can talk to. Also wrap all CLI output in

 tags.
4

RB-00

[admin@MikroTik] > /ip address print detail
Flags: X - disabled, I - invalid, D - dynamic 
 0   address=10.50.40.254/24 network=10.50.40.0 interface=PRI-24 actual-interface=PRI-24 

 1   address=10.50.50.254/24 network=10.50.50.0 interface=PRI-58 actual-interface=PRI-58 

 2 D address=10.20.20.253/24 network=10.20.20.0 interface=PUB actual-interface=PUB




/ip route print detail
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit 
 0 ADS  dst-address=0.0.0.0/0 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=0 scope=30 target-scope=10 vrf-interface=PUB 

 1 ADo  dst-address=10.10.10.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=30 
        ospf-type=intra-area 

 2 ADo  dst-address=10.10.20.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

 3 ADo  dst-address=10.10.30.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=30 
        ospf-type=intra-area 

 4 ADo  dst-address=10.10.40.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=30 
        ospf-type=intra-area 

 5 ADC  dst-address=10.20.20.0/24 pref-src=10.20.20.253 gateway=PUB gateway-status=PUB reachable distance=0 scope=10 

 6 ADo  dst-address=10.20.40.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

 7 ADo  dst-address=10.20.50.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

 8 ADo  dst-address=10.30.40.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=40 
        ospf-type=intra-area 

 9 ADo  dst-address=10.30.50.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=30 
        ospf-type=external-type-2 

10 ADo  dst-address=10.40.40.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=40 
        ospf-type=intra-area 

11 ADo  dst-address=10.40.50.0/24 gateway=10.20.20.254 gateway-status=10.20.20.254 reachable PUB distance=110 scope=20 target-scope=10 ospf-metric=40 
        ospf-type=intra-area 

12 ADC  dst-address=10.50.40.0/24 pref-src=10.50.40.254 gateway=PRI-24 gateway-status=PRI-24 reachable distance=0 scope=10 

13 ADo  dst-address=10.50.41.0/24 gateway=10.50.40.253 gateway-status=10.50.40.253 reachable PRI-24 distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

14 ADo  dst-address=10.50.42.0/24 gateway=10.50.40.253 gateway-status=10.50.40.253 reachable PRI-24 distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

15 ADo  dst-address=10.50.43.0/24 gateway=10.50.40.253 gateway-status=10.50.40.253 reachable PRI-24 distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

16 ADo  dst-address=10.50.44.0/24 gateway=10.50.40.253 gateway-status=10.50.40.253 reachable PRI-24 distance=110 scope=20 target-scope=10 ospf-metric=20 
        ospf-type=intra-area 

17 ADC  dst-address=10.50.50.0/24 pref-src=10.50.50.254 gateway=PRI-58 gateway-status=PRI-58 reachable distance=0 scope=10




 /interface print detail
Flags: D - dynamic, X - disabled, R - running, S - slave 
 0  R  name="PUB" type="ether" mtu=1500 l2mtu=1526 

 1  R  name="PRI-24" type="ether" mtu=1500 l2mtu=1522 

 2  R  name="PRI-58" type="ether" mtu=1500 l2mtu=1522




 /ip firewall export
# may/23/2011 02:41:52 by RouterOS 5.2
# software id = IHNQ-WP20
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
    tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=\
    10s
/ip firewall filter
add action=drop chain=input disabled=no src-address-list="port scanners"
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=\
    fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=\
    fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=\
    fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=1w3d chain=input disabled=no protocol=tcp tcp-flags=\
    !fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=forward disabled=yes protocol=icmp
/ip firewall nat
add action=masquerade chain=srcnat disabled=no dst-port=8291 out-interface=PRI-58 protocol=tcp
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no

RB-00 = 10.20.20.253
it provides ip’s to
RB-A = 10.50.40.253
and
RB-B = 10.50.50.253

I can access RB-A fine but not RB-B. even after the firewall nat you told me to add, I am still not able so.

thanks,

5

Where do you connect into the network when trying to access RB-B? Does your client send its packets to RB-00? If yes, there’s something severely wrong with RB-B and in my opinion you will have to physically go work on it. If not make sure your client goes through RB-00 and try again. The NAT rule should work unless you block access requests from 10.50.50.0/24 on RB-B.