WiFi Bridge to Ether ports

[dratak]

Hallo from Mikrotik newbie,

I have existing wifi and want to connect bridge WiFi RB2011 to it and assign static IPs to servers that will be connected to Ether ports with connection to internet.
Current Wifi givving DHCP from 192.168.1.xxx
I have connected wifi successfully , created bridge above wlan1 and ether4 for test.
For Bridge 1 I created DHCP server that should give me 192.168.77.xxx
I can ping defaul GW 192.168.1.1 and also DNS 8.8.4.4 from RouterOS but when I connect to ether4 I get the IP with defalt gw 192.168.77.1 and then have no response to ping to 192.168.1.1 from laptop

Any suggestion what could be wrong in my config?
Thank you

ASUS WIFI - - - - - WiFi - MikrotikRB2011 - Ether 4 ------------------ PC



[admin@MikroTik] > export

jan/29/2019 01:40:18 by RouterOS 6.43.4

software id = 415L-97G0

model = 2011UiAS-2HnD

serial number = 91E109895A96

/interface bridge
add fast-forward=no name=bridge1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name="Praha password"
supplicant-identity="" wpa-pre-shared-key=jandra76 wpa2-pre-shared-key=jandra76
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no frequency=2417 nv2-preshared-key=jandra76 nv2-security=enabled
security-profile="Praha password" ssid=PRAHA
/ip pool
add name=dhcp_pool0 ranges=192.168.77.2-192.168.77.254
add name=dhcp_pool1 ranges=192.168.77.2-192.168.77.254
add name=dhcp_pool2 ranges=192.168.77.2-192.168.77.254
add name=dhcp_pool3 ranges=192.168.77.2-192.168.77.254
/ip dhcp-server
add address-pool=dhcp_pool3 disabled=no interface=bridge1 name=dhcp1 relay=192.168.77.1
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether4
/ip address
add address=192.168.77.0/24 interface=ether4 network=192.168.77.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=bridge1
/ip dhcp-server network
add address=192.168.77.0/24 dns-server=8.8.4.4 gateway=192.168.77.1
/ip dns
set servers=8.8.4.4,8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.77.0/24 src-address-list=""
/ip route
add distance=1 gateway=wlan1
/system clock
set time-zone-name=Europe/Prague
/system routerboard settings
set silent-boot=no
[admin@MikroTik] >

[mkx]

The whole setup is wrong.

1. wlan1, being WAN interface, should not be part of bridge. Only ether ports should be members of bridge.
2. you should run DHCP client on wlan1 interface to get WAN IP address
3. src-nat rule should look like this

add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=wlan1

4. if you don’t trust all hosts on Asus’ network, add some firewall to protect both RB2011 and your LAN

[dratak]

Hi, thank you for feedback.

Target topology is attached.
I managed following

• Define Wifi interface as station
• create DHCP client to get IP from 192.168.1.xxx pool of Asus router
• Assign IPs for PCs in port 0-3 on Mikrotik
• but for some reason I can not ping default GW 192.168.1.1 from any PC in Mikrotik ports 0-3

Question:
Is the NAT rule enough or there should be Routing defined between ports Eth0-3 and Wlan1?
Do I need to define routing on Asus router as well when incoming packets will be routed towards 192.160.2.xxx ?

Thank you

[mkx]

The srcnat rule should be enough to give WAN access to the PCs behind mikrotik … to Asus, all connections will appear to originate from MT itself. Can MT ping asus and internet hosts (try /ping 192.168.1.1 and /ping 8.8.8.8).

There are some other things that might affect the connectivity. Can you post current configuration of RB? (/export hide-sensitive).

Another (not related) matter: is it just a typo or real? Addresses on MT’s LAN network should be in range 192.168.2.x … 192.160.y.z are not from private address space.

[dratak]

Hi,

issue resolved but mistery remains:

• Asus has DHCP server pool 192.168.1.1/25
• Mikrotik gets WiFi Station hooked on DHCP given IP 192.168.1.87
• I've created IP 192.168.2.0/24 in ETH2 interface of Mikrotik
• Assigned IP 192.168.2.233 to my laptop
• Created routing on Asus for 192.168.2.0/24 towards 192.168.1.87 (Mirotik wifi wlan interface IP)
• Defined routing on MK with 192.168.2.0/24 towares ETH2 port where PC was connected.

For some reason the routing did not work until I define specifically 192.168.2.233 -> 192.168.2.233 ETH2 gateway.
Any idea why subnet based routing does not work?
I also noticed it is good idea to disable FW on laptop win OS while trying to ping interfaces
Firewall NAT rule did not have effect on the functionality of the routing.



[admin@MikroTik] > export hide-sensitive

jan/30/2019 23:42:11 by RouterOS 6.43.4

software id = 415L-97G0

model = 2011UiAS-2HnD

serial number = 91E109895A96

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name="Praha password" sup
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no frequency=2417 nv2-security=enabled security-profile="Praha pa
/ip address
add address=192.168.1.128/25 interface=ether1 network=192.168.1.128
add address=192.168.2.0/24 interface=ether2 network=192.168.2.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=wlan1
/ip dns
set servers=8.8.4.4,8.8.8.8
/ip dns static
add address=8.8.4.4 name=Google
/ip route
add distance=1 gateway=192.168.1.1
add distance=1 dst-address=192.168.1.233/32 gateway=192.168.1.233
add distance=1 dst-address=192.168.2.233/32 gateway=192.168.2.233
/system clock
set time-zone-name=Europe/Prague
/system routerboard settings
set silent-boot=no
[admin@MikroTik] >

[mkx]

Address 192.168.2.0/24 is invalid, this is network address. Valid device addresses with that subnet mask are 192.168.2.1-192.168.2.254 inclusively.

Same goes with 192.168.1.128/25.

Router needs a valid IP address to perform properly. After you fix it, fix also clients’ gw setting.