Weird IP's coming from Mikrotik box

RouterOS Beginner Basics
1

Hi all,

I have a broadband modem/ruter/wifi combo that is providing internet. I got a RB411 connected as client to wifi (with static ip of 192.168.0.5 on WAN, and 192.168.88.1 on LAN). In modem management page I can see who is connected to my wifi. So, I see RB411’s MAC address and IP of 192.168.0.5. However, after a while I noticed some strange public IP addresses showing up:

https://imgur.com/a/Xg82h

Network looks like this:

Internet — Modem w/ WiFi —)))) RB411 —UTP cable—TPlink router/AP —)))

RB411 is doing NAT (double nat actually, because I cannot turn my modem into bridge), so I thought it might be related to that. But then, I would see RB411’s address 192.168.0.5 right? Actually, I do see it, but after a while this strange IP’s start showing up with MAC of Mikrotik box. Most of devices that connect to Mikrotik are mobile phones, but I think this also happens when no device is connected (not sure). Do I have a malware infected device behind Mikrotik, have I misunderstood something concerning networking, or there is something strange with this RB411?

Thanks all

2

I can’t see your picture.

3

Sorry, I posted a bit in a hurry. I corrected the link.

4

First question: is your wifi secured? WPA2?

If so, some providers with specialised modems for local install, also provide / allow access to other customers of theirs over 2nd virtual wifi, with a different ssid.
Maybe that’s the case for you too?

5

Yes, network is secured with WPA2. No, I don’t think that’s the case because I configured the modem myself, and my house is far away from anybody else to use it, save from my neighbors.
But even if that was the case, why would public IP’s show up on LAN?

6

I you see carefully, the public ips have the same MAC address. Can you block with firewall the MAC address in your modem/router ?

7

Well, that’s the thing - that’s RB411’s MAC address. :slight_smile: So, it is kinda weird that these public IP’s show up from behind LAN… Maybe my network topology is a bit unclear. Let’s give it another shot:
Gateway = WiFi Modem (192.168.0.1)
Client = Mikrotik (192.168.0.5, LAN is at 192.168.88.0)
Modem clients get dhcp in range 192.168.0.0, clients behind Mikrotik get dhcp leases in range 192.168.88.0

Internet
|
|
WiFi Modem -)))	(((- Mikrotik
			|
			|
			TP-link AP -)))		((( wifi-clients

Mikrotik is setup as client, and is connected to wifi modem’s wireless network. Mikrotik is doing NAT. TP link is connected via cable to Mikrotik and is serving as AP for clients.
So, when I login into modem management page, I see connected clients; their IP’s and MAC’s. When I turn on Mikrotik it connects to network and I can see it is connected as 192.168.0.5. However, after a while that IP changes every two seconds or so to a public IP. Off course, MAC stays the same.
So, my question is, is this somehow related to NAT? I should see only 192.168.0.5, as that is Mikrotik’s “WAN” side.