wap LTE Problems with internet

RouterOS General
1

Hello,

i have a Problem with the Internet connection.
I can connectr via VPN to the wap so it looks like i dont have any lte problems
only the internet connection for my LAN and WLAN clients not stable.

can you check my config?

dec/17/2019 16:53:21 by RouterOS 6.45.7

software id = 0YVW-DUP3

model = RouterBOARD wAP R-2nD

serial number = 86C409549322

/interface bridge
add comment="Externe Gast User" name=bridge-extern
add admin-mac=B8:69:F4:11:79:2C auto-mac=no comment="Interne Verteilung" name=bridge-intern
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
add apn=drei.at authentication=pap default-route-distance=1 name=Planet3
add apn=webaut default-route-distance=1 name="HoT Internet"
/interface lte
set [ find ] apn-profiles=Planet3 mac-address=AC:FF:FF:00:00:00 name=lte1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=porfile-intern supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX comment=2,4GHz disabled=no disconnect-timeout=5s frequency=auto mode=ap-bridge
multicast-buffering=disabled multicast-helper=disabled name=wlan-Intern radio-name="LTE Router" security-profile=porfile-intern ssid=LKintern tx-power=19
tx-power-mode=all-rates-fixed wmm-support=required wps-mode=disabled
/interface wireless nstreme
set wlan-Intern comment=2,4GHz
/interface wireless manual-tx-power-table
set wlan-Intern comment=2,4GHz
/interface wireless
add default-ap-tx-limit=56000 default-client-tx-limit=56000 keepalive-frames=disabled mac-address=BA:69:F4:11:79:2D master-interface=wlan-Intern
multicast-buffering=disabled multicast-helper=disabled name=wlan-Gast ssid="Loskrochn Gast" wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool-intern ranges=192.168.0.1-192.168.3.240
add name=pool-extern ranges=192.168.10.1-192.168.15.250
add name=pool_PPTP ranges=192.168.3.241-192.168.3.250
/ip dhcp-server
add address-pool=default-dhcp interface=bridge-intern name=defconf
add address-pool=pool-intern disabled=no interface=bridge-intern name=dhcp-intern
add address-pool=pool-extern disabled=no interface=bridge-extern name=dhcp-extern
/ppp profile
add local-address=192.168.0.1 name=PPTP remote-address=pool_PPTP
set *FFFFFFFE dns-server=192.168.2.1 local-address=192.168.0.1 remote-address=192.168.0.100
/interface bridge port
add bridge=bridge-intern comment=defconf interface=ether1
add bridge=bridge-intern comment=defconf interface=wlan-Intern
add bridge=bridge-extern interface=wlan-Gast
add bridge=bridge-intern interface=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=lte1 list=WAN
add interface=ether1 list=LAN
add interface=bridge-extern list=LAN
add interface=bridge-intern list=LAN
add interface=wlan-Gast list=LAN
add interface=wlan-Intern list=LAN
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.168.0.1/16 interface=bridge-extern network=192.168.0.0
add address=192.168.0.1/16 interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 interface=wlan-Gast network=192.168.0.0
add address=192.168.0.1/16 interface=wlan-Intern network=192.168.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-server lease
add address=192.168.0.95 comment=Kasse mac-address=50:9A:4C:3C:0C:65
add address=192.168.0.90 comment="EC " mac-address=54:7F:54:C8:28:92
add address=192.168.0.200 client-id=1:b8:27:eb:fd:2f:86 comment=Haftungsausschluss mac-address=B8:27:EB:FD:2F:86 server=dhcp-intern
add address=192.168.3.200 client-id=1:0:f:0:53:34:56 comment=Terminal1 mac-address=00:0F:00:53:34:56 server=dhcp-intern
add address=192.168.2.201 client-id=1:0:f:0:4f:ce:e9 comment="Terminal 2" mac-address=00:0F:00:4F:CE:E9 server=dhcp-intern
add address=192.168.2.202 client-id=1:a0:88:b4:9f:c9:c8 comment="Terminal Lapi" mac-address=A0:88:B4:9F:C9:C8 server=dhcp-intern
add address=192.168.0.3 client-id=1:24:18:1d:d9:d:a2 mac-address=24:18:1D:D9:0D:A2 server=dhcp-intern
add address=192.168.0.10 client-id=1:40:9f:38:45:42:85 comment=Lasertag mac-address=40:9F:38:45:42:85 server=dhcp-intern
add address=192.168.0.150 comment=CAM mac-address=00:11:14:15:55:D9
add address=192.168.0.2 client-id=1:74:4d:28:fa:47:3d comment=Switch mac-address=74:4D:28:FA:47:3D server=dhcp-intern
/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=192.168.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf disabled=yes name=router.lan
/ip firewall address-list
add address=192.168.0.151-192.168.3.250 list="Block Internet"
add address=192.168.10.1-192.168.15.250 list="Block Local"
/ip firewall filter
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes log-prefix=
rolle3
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes log=yes log-prefix=icmp protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=127.0.0.1 log=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=reject chain=forward comment="Block Local" disabled=yes in-interface=bridge-intern log=yes log-prefix=block out-interface=bridge-intern
reject-with=icmp-network-unreachable src-address-list="Block Local"
add action=drop chain=forward comment="Block Internet" disabled=yes log=yes log-prefix="Block Internet" src-address-list="Block Internet"
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes log-prefix=rolle12
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes
log-prefix=rolle13
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes
in-interface-list=WAN
/ip firewall mangle
add action=change-ttl chain=postrouting comment="Maske f\EF\BF\BDr Subnetze zu Drei" disabled=yes new-ttl=set:65 out-interface=lte1 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=tcp to-addresses=192.168.0.150 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=udp to-addresses=192.168.0.150 to-ports=8080
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ppp secret
add name=michi profile=PPTP service=pptp
add name=gaigg.alexander profile=PPTP service=pptp
/system clock
set time-zone-name=Europe/Vienna
/system logging
add action=disk disabled=yes prefix=LTE topics=lte
/system ntp client
set enabled=yes server-dns-names=at.pool.ntp.org
/system scheduler
add disabled=yes interval=1d name=Restart on-event="/system reboot" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=
nov/16/2019 start-time=02:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set allowed-number="" port=lte1 receive-enabled=yes

Best regards
Alex

2

Your current Config without not neccessery stuff, core settings to analyze.

/interface lte apn
add apn=drei.at authentication=pap default-route-distance=1 name=Planet3
add apn=webaut default-route-distance=1 name="HoT Internet"
/interface lte
set [ find ] apn-profiles=Planet3 mac-address=AC:FF:FF:00:00:00 name=lte1


/interface bridge
add comment="Externe Gast User" name=bridge-extern
add admin-mac=B8:69:F4:11:79:2C auto-mac=no comment="Interne Verteilung" name=bridge-intern
/interface bridge port
add bridge=bridge-intern comment=defconf interface=ether1
add bridge=bridge-intern comment=defconf interface=wlan-Intern
add bridge=bridge-extern interface=wlan-Gast
add bridge=bridge-intern interface=WAN

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool-intern ranges=192.168.0.1-192.168.3.240
add name=pool-extern ranges=192.168.10.1-192.168.15.250
add name=pool_PPTP ranges=192.168.3.241-192.168.3.250

/ip dhcp-server
add address-pool=default-dhcp interface=bridge-intern name=defconf
add address-pool=pool-intern disabled=no interface=bridge-intern name=dhcp-intern
add address-pool=pool-extern disabled=no interface=bridge-extern name=dhcp-extern

/interface list member
add interface=lte1 list=WAN
add interface=ether1 list=LAN
add interface=bridge-extern list=LAN
add interface=bridge-intern list=LAN
add interface=wlan-Gast list=LAN
add interface=wlan-Intern list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.168.0.1/16 interface=bridge-extern network=192.168.0.0
add address=192.168.0.1/16 interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 interface=wlan-Gast network=192.168.0.0
add address=192.168.0.1/16 interface=wlan-Intern network=192.168.0.0
/ip dhcp-server lease
add address=192.168.0.95 comment=Kasse mac-address=50:9A:4C:3C:0C:65
add address=192.168.0.90 comment="EC " mac-address=54:7F:54:C8:28:92
add address=192.168.0.200 client-id=1:b8:27:eb:fd:2f:86 comment=Haftungsausschluss mac-address=B8:27:EB:FD:2F:86 server=dhcp-intern
add address=192.168.3.200 client-id=1:0:f:0:53:34:56 comment=Terminal1 mac-address=00:0F:00:53:34:56 server=dhcp-intern
add address=192.168.2.201 client-id=1:0:f:0:4f:ce:e9 comment="Terminal 2" mac-address=00:0F:00:4F:CE:E9 server=dhcp-intern
add address=192.168.2.202 client-id=1:a0:88:b4:9f:c9:c8 comment="Terminal Lapi" mac-address=A0:88:B4:9F:C9:C8 server=dhcp-intern
add address=192.168.0.3 client-id=1:24:18:1d:d9:d:a2 mac-address=24:18:1D:D9:0D:A2 server=dhcp-intern
add address=192.168.0.10 client-id=1:40:9f:38:45:42:85 comment=Lasertag mac-address=40:9F:38:45:42:85 server=dhcp-intern
add address=192.168.0.150 comment=CAM mac-address=00:11:14:15:55:D9
add address=192.168.0.2 client-id=1:74:4d:28:fa:47:3d comment=Switch mac-address=74:4D:28:FA:47:3D server=dhcp-intern
/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=192.168.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4



/ip firewall address-list
add address=192.168.0.151-192.168.3.250 list="Block Internet"
add address=192.168.10.1-192.168.15.250 list="Block Local"
/ip firewall filter
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes log-prefix=\
    rolle3
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes log=yes log-prefix=icmp protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=127.0.0.1 log=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=reject chain=forward comment="Block Local" disabled=yes in-interface=bridge-intern log=yes log-prefix=block out-interface=bridge-intern \
    reject-with=icmp-network-unreachable src-address-list="Block Local"
add action=drop chain=forward comment="Block Internet" disabled=yes log=yes log-prefix="Block Internet" src-address-list="Block Internet"
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes log-prefix=rolle12
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes \
    log-prefix=rolle13
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes \
    in-interface-list=WAN
/ip firewall mangle
add action=change-ttl chain=postrouting comment="Maske f\EF\BF\BDr Subnetze zu Drei" disabled=yes new-ttl=set:65 out-interface=lte1 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=tcp to-addresses=192.168.0.150 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=udp to-addresses=192.168.0.150 to-ports=8080
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

.
Check this:
.

/interface bridge port
add bridge=bridge-> intern > comment=defconf interface=> ether1
add bridge=bridge-> intern > comment=defconf interface=> wlan-Intern
add bridge=bridge-extern interface=wlan-Gast
add bridge=> bridge-intern interface=WAN

WHY, You should NOT switch/bridge the LAN and WAN into one bridge !!!
.

/ip dhcp-server
add address-pool=default-dhcp interface=bridge-intern name=defconf
add address-pool=pool-intern disabled=no interface=bridge-intern name=dhcp-intern

Why you have two DHCP Server for the same interface ???
.

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods=“” management-protection=allowed mode=dynamic-keys name=porfile-intern supplicant-identity=“”
wpa2-pre-shared-key=> **************
/ppp secret
add name=michi password=> ************** > profile=PPTP service=pptp
add name=gaigg.alexander password=> ************** > profile=PPTP service=pptp
[gaigg.alexander@MikroTik] >

Please use “export hide-sensitive”. Now please edit your post and delete passwords or change it to **************

…

/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.168.0.1/16 interface=bridge-extern network=192.168.0.0
add address=192.168.0.1/16 interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 interface=wlan-Gast network=192.168.0.0
add address=192.168.0.1/16 interface=wlan-Intern network=192.168.0.0

Interface who are inside a Bridge should be not used!! you should use a Bridge !.
wlan-Intern wlan-Gast ether1 → no use it here. You can use many IP Subnets at bridge-intern and bridge-extern

.

/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=192.168.0.1 netmask=16

Wrong concept.
You should have two dhcp network for bridge-intern and bridge-extern. Not one for both.
I think you not use the DHCP Setup button inside WinBox - he is a wizzard and when you select one of LAN Bridge’s then other settings will be set in better way.
.

/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4

If your LTE has Public Ip then please at input disable the DNS traffic. You willbe OpenDNSproxy that way.

The End. I hope you can change this config to better one.

3

I have change it

thx

4

Hello thx for your Tips,
i have change my config here is the new one

dec/18/2019 14:50:44 by RouterOS 6.45.7

software id = 0YVW-DUP3

model = RouterBOARD wAP R-2nD

serial number = 86C409549322

/interface bridge
add comment="Externe Gast User" name=bridge-extern
add admin-mac=B8:69:F4:11:79:2C auto-mac=no comment="Interne Verteilung" name=
bridge-intern
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
add apn=drei.at authentication=pap default-route-distance=1 name=Planet3
add apn=webaut default-route-distance=1 name="HoT Internet"
/interface lte
set [ find ] apn-profiles=Planet3 mac-address=AC:FF:FF:00:00:00 name=lte1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed
mode=dynamic-keys name=porfile-intern supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX
comment=2,4GHz disabled=no disconnect-timeout=5s frequency=auto mode=
ap-bridge multicast-buffering=disabled multicast-helper=disabled name=
wlan-Intern radio-name="LTE Router" security-profile=porfile-intern ssid=
LKintern tx-power=19 tx-power-mode=all-rates-fixed wmm-support=required
wps-mode=disabled
/interface wireless nstreme
set wlan-Intern comment=2,4GHz
/interface wireless manual-tx-power-table
set wlan-Intern comment=2,4GHz
/interface wireless
add default-ap-tx-limit=56000 default-client-tx-limit=56000 keepalive-frames=
disabled mac-address=BA:69:F4:11:79:2D master-interface=wlan-Intern
multicast-buffering=disabled multicast-helper=disabled name=wlan-Gast ssid=
"Loskrochn Gast" wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=pool-intern ranges=192.168.0.1-192.168.3.240
add name=pool-extern ranges=192.169.0.1-192.169.2.250
add name=pool_PPTP ranges=192.168.3.241-192.168.3.250
/ip dhcp-server
add address-pool=pool-intern disabled=no interface=bridge-intern name=
dhcp-intern
add address-pool=pool-extern disabled=no interface=bridge-extern name=
dhcp-extern
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.1 local-address=192.168.0.1 name=
PPTP remote-address=pool_PPTP use-encryption=yes
set *FFFFFFFE dns-server=192.168.0.1 local-address=192.168.0.1 remote-address=
192.168.0.100
/interface bridge port
add bridge=bridge-intern comment=defconf interface=ether1
add bridge=bridge-intern comment=defconf interface=wlan-Intern
add bridge=bridge-extern interface=wlan-Gast
add bridge=bridge-intern disabled=yes interface=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=lte1 list=WAN
add interface=ether1 list=LAN
add interface=bridge-extern list=LAN
add interface=bridge-intern list=LAN
add interface=wlan-Gast list=LAN
add interface=wlan-Intern list=LAN
/interface pptp-server server
set default-profile=PPTP enabled=yes
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=
bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.168.0.1/16 interface=bridge-extern network=192.168.0.0
add address=192.168.0.1/16 disabled=yes interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 disabled=yes interface=wlan-Gast network=
192.168.0.0
add address=192.168.0.1/16 disabled=yes interface=wlan-Intern network=
192.168.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-server lease
add address=192.168.0.95 comment=Kasse mac-address=50:9A:4C:3C:0C:65
add address=192.168.0.90 comment="EC " mac-address=54:7F:54:C8:28:92
add address=192.168.0.200 client-id=1:b8:27:eb:fd:2f:86 comment=
Haftungsausschluss mac-address=B8:27:EB:FD:2F:86 server=dhcp-intern
add address=192.168.3.200 client-id=1:0:f:0:53:34:56 comment=Terminal1
mac-address=00:0F:00:53:34:56 server=dhcp-intern
add address=192.168.2.201 client-id=1:0:f:0:4f:ce:e9 comment="Terminal 2"
mac-address=00:0F:00:4F:CE:E9 server=dhcp-intern
add address=192.168.2.202 client-id=1:a0:88:b4:9f:c9:c8 comment="Terminal Lapi"
mac-address=A0:88:B4:9F:C9:C8 server=dhcp-intern
add address=192.168.0.3 client-id=1:24:18:1d:d9:d:a2 mac-address=
24:18:1D:D9:0D:A2 server=dhcp-intern
add address=192.168.0.10 client-id=1:40:9f:38:45:42:85 comment=Lasertag
mac-address=40:9F:38:45:42:85 server=dhcp-intern
add address=192.168.0.150 comment=CAM mac-address=00:11:14:15:55:D9
add address=192.168.0.2 client-id=1:74:4d:28:fa:47:3d comment=Switch
mac-address=74:4D:28:FA:47:3D server=dhcp-intern
/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=
192.168.0.1 netmask=16
add address=192.169.0.0/16 dns-server=192.169.0.1,8.8.8.8,8.8.4.4 gateway=
192.169.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf disabled=yes name=router.lan
/ip firewall address-list
add address=192.168.0.151-192.168.3.250 list="Block Internet"
add address=192.168.10.1-192.168.15.250 list="Block Local"
/ip firewall filter
add action=accept chain=forward disabled=yes dst-address=192.168.0.150
dst-port=8080 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.0.150
dst-port=8080 protocol=udp
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked disabled=yes log-prefix=rolle3
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid disabled=yes log=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes log=
yes log-prefix=icmp protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=
127.0.0.1 log=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN"
disabled=yes in-interface-list=!LAN
add action=reject chain=forward comment="Block Local" disabled=yes
in-interface=bridge-intern log=yes log-prefix=block out-interface=
bridge-intern reject-with=icmp-network-unreachable src-address-list=
"Block Local"
add action=drop chain=forward comment="Block Internet" disabled=yes log=yes
log-prefix="Block Internet" src-address-list="Block Internet"
add action=accept chain=forward comment="defconf: accept in ipsec policy"
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes log-prefix=rolle12
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked disabled=yes log-prefix=rolle13
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid disabled=yes log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed"
connection-nat-state=!dstnat connection-state=new disabled=yes
in-interface-list=WAN
/ip firewall mangle
add action=change-ttl chain=postrouting comment=
"Maske f\EF\BF\BDr Subnetze zu Drei" disabled=yes new-ttl=set:65
out-interface=lte1 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=
bridge-intern protocol=tcp to-addresses=192.168.0.150 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=
bridge-intern protocol=udp to-addresses=192.168.0.150 to-ports=8080
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=
out,none out-interface-list=WAN
/ppp secret
add disabled=yes name=michi profile=PPTP service=pptp
add name=gaigg.alexander profile=PPTP service=pptp
/system clock
set time-zone-name=Europe/Vienna
/system logging
add action=disk disabled=yes prefix=LTE topics=lte
/system ntp client
set enabled=yes server-dns-names=at.pool.ntp.org
/system scheduler
add disabled=yes interval=1d name=Restart on-event="/system reboot" policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
start-date=nov/16/2019 start-time=02:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set allowed-number="" port=lte1 receive-enabled=yes

DHCP Server for bridge intern now red at winbox

best regards
alex

5

/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=
bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=> 192.168.0.1> /16 interface=bridge-extern network=> 192.168.0.0

In Pools you use 192.169.. in Address external have the same IP at both interface - wrong.
.
That’s all. I not analyze firewall.

6

Tanks for your Help,

today i will do the firewall config with toturials :slight_smile:

maby you have an best practice tip for me?

best regards

7

TIPSs:

  1. Use this button to add code:
    uASTIIbP6y.png
    .
  2. Before or Later you ask about few WAN together… then learn from this:

Bandwidth-based load-balancing with failover. This presentation also covers Mangle.
This was presented at the MUM (MikroTik User Meeting) in New Orelans, USA.
Tomas Kirnak - YouTube: > https://www.youtube.com/watch?v=67Dna_ffCvc&t=1s
http://mum.mikrotik.com/presentations/US12/tomas.pdf

.
3) Read wiki and practise in GNS3

8 
# dec/19/2019 14:25:52 by RouterOS 6.45.7
# software id = 0YVW-DUP3
#
# model = RouterBOARD wAP R-2nD
# serial number = 86C409549322
/interface bridge
add comment="Externe Gast User" name=bridge-extern
add admin-mac=B8:69:F4:11:79:2C auto-mac=no comment="Interne Verteilung" name=\
    bridge-intern
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
add apn=drei.at authentication=pap default-route-distance=1 name=Planet3
add apn=webaut default-route-distance=1 name="HoT Internet"
/interface lte
set [ find ] apn-profiles=Planet3 mac-address=AC:FF:FF:00:00:00 name=lte1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed \
    mode=dynamic-keys name=porfile-intern supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    comment=2,4GHz disabled=no disconnect-timeout=5s frequency=auto mode=\
    ap-bridge multicast-buffering=disabled multicast-helper=disabled name=\
    wlan-Intern radio-name="LTE Router" security-profile=porfile-intern ssid=\
    LKintern tx-power=19 tx-power-mode=all-rates-fixed wmm-support=required \
    wps-mode=disabled
/interface wireless nstreme
set wlan-Intern comment=2,4GHz
/interface wireless manual-tx-power-table
set wlan-Intern comment=2,4GHz
/interface wireless
add default-ap-tx-limit=56000 default-client-tx-limit=56000 disabled=no \
    keepalive-frames=disabled mac-address=BA:69:F4:11:79:2D master-interface=\
    wlan-Intern multicast-buffering=disabled multicast-helper=disabled name=\
    wlan-Gast ssid="Loskrochn Gast" wds-cost-range=0 wds-default-cost=0 \
    wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=pool-intern ranges=192.168.0.1-192.168.3.254
add name=pool-extern ranges=192.169.0.1-192.169.2.250
add name=pool_PPTP ranges=192.168.3.241-192.168.3.250
add name=dhcp_pool4 ranges=192.168.0.2-192.168.3.254
/ip dhcp-server
add address-pool=pool-extern disabled=no interface=bridge-extern name=\
    dhcp-extern
add address-pool=pool-intern disabled=no interface=bridge-intern name=\
    dhcp-intern
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.1 local-address=192.168.0.1 name=\
    PPTP remote-address=pool_PPTP use-encryption=yes
set *FFFFFFFE dns-server=192.168.0.1 local-address=192.168.0.1 remote-address=\
    192.168.0.100
/interface bridge port
add bridge=bridge-intern comment=defconf interface=ether1
add bridge=bridge-intern comment=defconf interface=wlan-Intern
add bridge=bridge-extern interface=wlan-Gast
add bridge=bridge-intern disabled=yes interface=wlan-Intern
add bridge=bridge-intern disabled=yes interface=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=lte1 list=WAN
add interface=ether1 list=LAN
add interface=bridge-extern list=LAN
add interface=bridge-intern list=LAN
add interface=wlan-Gast list=LAN
add interface=wlan-Intern list=LAN
/interface pptp-server server
set default-profile=PPTP enabled=yes
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=\
    bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.169.0.1/16 interface=bridge-extern network=192.169.0.0
add address=192.168.0.1/16 disabled=yes interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 disabled=yes interface=wlan-Gast network=\
    192.168.0.0
add address=192.168.0.1/16 disabled=yes interface=wlan-Intern network=\
    192.168.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-server lease
add address=192.168.0.95 comment=Kasse mac-address=50:9A:4C:3C:0C:65
add address=192.168.0.90 comment="EC " mac-address=54:7F:54:C8:28:92
add address=192.168.0.200 client-id=1:b8:27:eb:fd:2f:86 comment=\
    Haftungsausschluss mac-address=B8:27:EB:FD:2F:86
add address=192.168.3.200 client-id=1:0:f:0:53:34:56 comment=Terminal1 \
    mac-address=00:0F:00:53:34:56
add address=192.168.2.201 client-id=1:0:f:0:4f:ce:e9 comment="Terminal 2" \
    mac-address=00:0F:00:4F:CE:E9
add address=192.168.2.202 client-id=1:a0:88:b4:9f:c9:c8 comment="Terminal Lapi" \
    mac-address=A0:88:B4:9F:C9:C8
add address=192.168.0.3 client-id=1:24:18:1d:d9:d:a2 mac-address=\
    24:18:1D:D9:0D:A2
add address=192.168.0.10 client-id=1:40:9f:38:45:42:85 comment=Lasertag \
    mac-address=40:9F:38:45:42:85
add address=192.168.0.150 comment=CAM mac-address=00:11:14:15:55:D9
add address=192.168.0.2 client-id=1:74:4d:28:fa:47:3d comment=Switch \
    mac-address=74:4D:28:FA:47:3D
/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=\
    192.168.0.1 netmask=16
add address=192.169.0.0/16 dns-server=192.169.0.1,8.8.8.8,8.8.4.4 gateway=\
    192.169.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf disabled=yes name=router.lan
/ip firewall address-list
add address=192.168.0.151-192.168.3.250 list="Block Internet"
add address=192.168.10.1-192.168.15.250 list="Block Local"
/ip firewall filter
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 \
    dst-port=8080 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 \
    dst-port=8080 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked disabled=yes log-prefix=rolle3
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes log=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes log=\
    yes log-prefix=icmp protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=\
    127.0.0.1 log=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=reject chain=forward comment="Block Local" disabled=yes \
    in-interface=bridge-intern log=yes log-prefix=block out-interface=\
    bridge-intern reject-with=icmp-network-unreachable src-address-list=\
    "Block Local"
add action=drop chain=forward comment="Block Internet" disabled=yes log=yes \
    log-prefix="Block Internet" src-address-list="Block Internet"
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes log-prefix=rolle12
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked disabled=yes log-prefix=rolle13
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new disabled=yes \
    in-interface-list=WAN
/ip firewall mangle
add action=change-ttl chain=postrouting comment=\
    "Maske f\EF\BF\BDr Subnetze zu Drei" disabled=yes new-ttl=set:65 \
    out-interface=lte1 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=\
    bridge-intern protocol=tcp to-addresses=192.168.0.150 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=\
    bridge-intern protocol=udp to-addresses=192.168.0.150 to-ports=8080
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
    out,none out-interface-list=WAN
/ppp secret
add disabled=yes name=michi profile=PPTP service=pptp
add name=gaigg.alexander profile=PPTP service=pptp
/system clock
set time-zone-name=Europe/Vienna
/system logging
add action=disk disabled=yes prefix=LTE topics=lte
/system ntp client
set enabled=yes server-dns-names=at.pool.ntp.org
/system scheduler
add disabled=yes interval=1d name=Restart on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=nov/16/2019 start-time=02:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set allowed-number="" port=lte1 receive-enabled=yes

Hello again,
i have done all changes but the dhcp-intern wont work, in winbox it is red :-/
now i create a second virtual WLAN like wlan-intern and put them in the bridge intern it works
but why?
new code

# dec/19/2019 19:41:06 by RouterOS 6.45.7
# software id = 0YVW-DUP3
#
# model = RouterBOARD wAP R-2nD
# serial number = 86C409549322
/interface bridge
add comment="Externe Gast User" name=bridge-extern
add admin-mac=B8:69:F4:11:79:2C auto-mac=no comment="Interne Verteilung" name=bridge-intern
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
add apn=drei.at authentication=pap default-route-distance=1 name=Planet3
add apn=webaut default-route-distance=1 name="HoT Internet"
/interface lte
set [ find ] apn-profiles=Planet3 mac-address=AC:FF:FF:00:00:00 name=lte1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=porfile-intern supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX comment=2,4GHz disabled=no disconnect-timeout=5s frequency=auto hide-ssid=yes mode=\
    ap-bridge multicast-buffering=disabled multicast-helper=disabled name=wlan radio-name="LTE Router" security-profile=porfile-intern ssid=LKintern1 \
    tx-power=19 tx-power-mode=all-rates-fixed wmm-support=required wps-mode=disabled
add default-ap-tx-limit=56000 default-client-tx-limit=56000 disabled=no keepalive-frames=disabled mac-address=BA:69:F4:11:79:2D master-interface=wlan \
    multicast-buffering=disabled multicast-helper=disabled name=wlan-Gast ssid="Loskrochn Gast" wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=BA:69:F4:11:79:2E master-interface=wlan multicast-buffering=disabled name=wlan-intern security-profile=\
    porfile-intern ssid=LKintern wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface wireless nstreme
set wlan comment=2,4GHz
/interface wireless manual-tx-power-table
set wlan comment=2,4GHz
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=pool-intern ranges=192.168.0.1-192.168.3.254
add name=pool-extern ranges=192.169.0.1-192.169.2.250
add name=pool_PPTP ranges=192.168.3.241-192.168.3.250
add name=dhcp_pool4 ranges=192.168.0.2-192.168.3.254
/ip dhcp-server
add address-pool=pool-extern disabled=no interface=bridge-extern name=dhcp-extern
add address-pool=pool-intern disabled=no interface=bridge-intern name=dhcp-intern
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.1 local-address=192.168.0.1 name=PPTP remote-address=pool_PPTP use-encryption=yes
set *FFFFFFFE dns-server=192.168.0.1 local-address=192.168.0.1 remote-address=192.168.0.100
/interface bridge port
add bridge=bridge-intern comment=defconf interface=ether1
add bridge=bridge-intern comment=defconf disabled=yes interface=wlan
add bridge=bridge-extern interface=wlan-Gast
add bridge=bridge-intern interface=wlan-intern
add bridge=bridge-intern disabled=yes interface=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=lte1 list=WAN
add interface=ether1 list=LAN
add interface=bridge-extern list=LAN
add interface=bridge-intern list=LAN
add interface=wlan-Gast list=LAN
add interface=wlan list=LAN
/interface pptp-server server
set default-profile=PPTP enabled=yes
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge-intern network=192.168.88.0
add address=192.168.0.1/16 interface=bridge-intern network=192.168.0.0
add address=192.169.0.1/16 interface=bridge-extern network=192.169.0.0
add address=192.168.0.1/16 disabled=yes interface=ether1 network=192.168.0.0
add address=192.168.10.1/16 disabled=yes interface=wlan-Gast network=192.168.0.0
add address=192.168.0.1/16 disabled=yes interface=wlan network=192.168.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-server lease
add address=192.168.0.95 comment=Kasse mac-address=50:9A:4C:3C:0C:65
add address=192.168.0.90 comment="EC " mac-address=54:7F:54:C8:28:92
add address=192.168.0.200 client-id=1:b8:27:eb:fd:2f:86 comment=Haftungsausschluss mac-address=B8:27:EB:FD:2F:86
add address=192.168.3.200 client-id=1:0:f:0:53:34:56 comment=Terminal1 mac-address=00:0F:00:53:34:56
add address=192.168.2.201 client-id=1:0:f:0:4f:ce:e9 comment="Terminal 2" mac-address=00:0F:00:4F:CE:E9
add address=192.168.2.202 client-id=1:a0:88:b4:9f:c9:c8 comment="Terminal Lapi" mac-address=A0:88:B4:9F:C9:C8
add address=192.168.0.3 client-id=1:24:18:1d:d9:d:a2 mac-address=24:18:1D:D9:0D:A2
add address=192.168.0.10 client-id=1:40:9f:38:45:42:85 comment=Lasertag mac-address=40:9F:38:45:42:85
add address=192.168.0.150 comment=CAM mac-address=00:11:14:15:55:D9
add address=192.168.0.2 client-id=1:74:4d:28:fa:47:3d comment=Switch mac-address=74:4D:28:FA:47:3D
/ip dhcp-server network
add address=192.168.0.0/16 dns-server=192.168.0.1,8.8.8.8,8.8.4.4 gateway=192.168.0.1 netmask=16
add address=192.169.0.0/16 dns-server=192.169.0.1,8.8.8.8,8.8.4.4 gateway=192.169.0.1 netmask=16
/ip dns
set allow-remote-requests=yes cache-max-ttl=2d servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf disabled=yes name=router.lan
/ip firewall address-list
add address=192.168.0.151-192.168.3.250 list="Block Internet"
add address=192.168.10.1-192.168.15.250 list="Block Local"
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=accept chain=input in-interface-list=LAN
add action=log chain=input disabled=yes
add action=drop chain=input
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=192.168.0.150 dst-port=8080 protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes log-prefix=\
    rolle3
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes log=yes log-prefix=icmp protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=127.0.0.1 log=yes
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=reject chain=forward comment="Block Local" disabled=yes in-interface=bridge-intern log=yes log-prefix=block out-interface=bridge-intern \
    reject-with=icmp-network-unreachable src-address-list="Block Local"
add action=drop chain=forward comment="Block Internet" disabled=yes log=yes log-prefix="Block Internet" src-address-list="Block Internet"
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes log-prefix=rolle12
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes \
    log-prefix=rolle13
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes \
    in-interface-list=WAN
/ip firewall mangle
add action=change-ttl chain=postrouting comment="Maske f\EF\BF\BDr Subnetze zu Drei" disabled=yes new-ttl=set:65 out-interface=lte1 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=tcp to-addresses=192.168.0.150 to-ports=8080
add action=dst-nat chain=dstnat disabled=yes dst-port=8080 in-interface=bridge-intern protocol=udp to-addresses=192.168.0.150 to-ports=8080
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ppp secret
add disabled=yes name=michi profile=PPTP service=pptp
add name=gaigg.alexander profile=PPTP service=pptp
/system clock
set time-zone-name=Europe/Vienna
/system logging
add action=disk disabled=yes prefix=LTE topics=lte
/system ntp client
set enabled=yes server-dns-names=at.pool.ntp.org
/system scheduler
add disabled=yes interval=1d name=Restart on-event="/system reboot" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=\
    nov/16/2019 start-time=02:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set allowed-number="" port=lte1 receive-enabled=yes
[gaigg.alexander@MikroTik] >
9

Those 2x codes are the same.
Please compare codes/exports in https://text-compare.com/ - this help you in versioning of changes.

The red in DHCP tab is when the interface is disabled. He can have IP adressation but interface is not running itself. You can see that name of interface is ITALIC
11EeFuZaZP.png

10

Hello now is the new Code in it
new with working dhcp
old dhcp intern not working

11

I see your changes what you done with change names, change in firewall etc.
I not understand what this settings change from red to normal operation in dhcp. In both config bridge have got internal network and it should work before and after.

Currently the internet is works in both SSID and ineternal and external network?
Can I help you with stg. additional?

12

Hello and thx for your replay,

after i have change the Internal WLAN to an Virtual AP it works in the bridge
now i hav set them back to the master interface it also works

i think with me changes i got an bug in config

now it works

thanks for you help