This is a weird one, but I bet someone here knows RouterOS well enough to help me debug this. I’ll try to provide a lot of detail, but happy to add more as needed.
I have a Mikrotik router rb5009. It is using the standard network 192.168.88.1 for its address and its network. It has the SFP+ port and in this port is a small embedded device that presents a management web UI on 192.168.1.1. So I want to add rules in order to see it. I do the following actions in the Mikrotik router.
/ip address add address=192.168.1.2/24 interface=sfp-sfpplus1 comment="access SFP stick"
Now on the router itself, this will load the page with this tool, I can see some HTML come back:
/tool/fetch url="``http://192.168.1.1/admin/login.asp``" mode=http output=user
But it does not work when I try to access with my laptop which is on the other network with IP 192.168.88.229
So I add a srcnat masquerade like this:
/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.1.0/24 to-addresses=192.168.1.1 out-interface=sfp-sfpplus1 action=masquerade comment="to access ONU stick UI"
The above rule allows me to see the stick UI on my laptop so it appears to be working now. I can see the web UI in my browser, yay!
BUT: Now I want to work on shifting my outgoing WAN connection over to come through the SFP stick. I have an Internet connection through vlan1 attached to interface ether1 that is in the interface list "WAN" that is online the entire time I do the above. However, I need to take down this connection because I want to eventually have the connection come through the stick device, but I need to be able to see the stick device web UI the entire time.
So, when I run this /ip dhcp-client disable [find interface=vlan1] then I lose the ability to access the web UI from my laptop. In summary, when the above DHCP connection is “down”:
- Using
fetchon the router to the 192.168.1.1 address is still able to show me HTML. - The web UI doesn’t load on my laptop anymore. Using
curl -4 -v --noproxy '*' ``http://192.168.1.1/admin/login.aspjust hangs. - The laptop CAN get ICMP ping replies back.
I tried to do some basic debugging with AI tools that try to implicate “fasttrack” and stuff, but they’re all incorrect and eventually try to blame the client configuration. But my Mac can still access the router OS, so I feel like this has to be a router issue.
One more data point is that when I run /tool/torch interface=bridge ip-protocol=tcp port=80 in the “DHCP up” scenario I see packets flowing to 192.168.1.1 from my laptop. In the “dhcp down” scenario I do not see them.
These are the diagnostic commands when the DHCP/Internet connection is online, which I think is quote a standard default config.
/ip firewall filter print
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
2 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
3 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
4 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept src-address=127.0.0.1 dst-address=127.0.0.1 in-interface=lo
5 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN
6 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
7 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
8 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related
9 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked
10 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid
11 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN
/ip firewall nat print
Flags: X - disabled, I - invalid; D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none
1 chain=dstnat action=dst-nat to-addresses=192.168.88.2 to-ports=32400 protocol=tcp in-interface-list=WAN dst-port=32400 log=yes log-prefix=""
2 ;;; to access ONU stick UI
chain=srcnat action=masquerade to-addresses=192.168.1.1 src-address=192.168.88.0/24 dst-address=192.168.1.0/24 out-interface=sfp-sfpplus1
/ip firewall nat print stats
Columns: CHAIN, ACTION, BYTES, PACKETS
CHAIN ACTION BYTES PACKETS
;;; defconf: masquerade
0 srcnat masquerade 296 218 1 402
1 dstnat dst-nat 0 0
;;; to access ONU stick UI
2 srcnat masquerade 256 4
/ip firewall address-list print
(no output)
/interface list member print
Columns: LIST, INTERFACE
LIST INTERFACE
;;; defconf
0 LAN bridge
;;; defconf
1 WAN vlan1
/interface/bridge/port/print
Flags: I - INACTIVE; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, HORIZON, TRUSTED, FAST-LEAVE, BPDU-GUARD, EDGE, POINT-TO-POINT, PVID, FRAME-TYPES
INTERFACE BRIDGE HW HORIZON TRUSTED FAST-LEAVE BPDU-GUARD EDGE POINT-TO-POINT PVID FRAME-TYPES
;;; defconf
0 H ether2 bridge yes none no no no auto auto 1 admit-all
;;; defconf
1 H ether3 bridge yes none no no no auto auto 1 admit-all
;;; defconf
2 IH ether4 bridge yes none no no no auto auto 1 admit-all
;;; defconf
3 IH ether5 bridge yes none no no no auto auto 1 admit-all
;;; defconf
4 IH ether6 bridge yes none no no no auto auto 1 admit-all
;;; defconf
5 IH ether7 bridge yes none no no no auto auto 1 admit-all
;;; defconf
6 IH ether8 bridge yes none no no no auto auto 1 admit-all
