WOL not working on subnet

RouterOS General
1

I have a rather strange setup and suspect that it may contribute to the fact that I can’t get WOL to turn on a computer. (I have confirmed its turned on in the computers bios)

On a Hex S I have ether1 connected to Wan, ether2-ether4 connected to the standard bridge on the 192.168.50.0/24 subnet (with none actually being used), and ether 5 connected to the computer on a special VPN-bridge on the 10.39.26.4/30 subnet. The router has an address of 192.168.50.1 and 10.39.26.5 on the respective subnets, and the computer has an address of 10.39.26.6. Try as I may I can’t get the computer to turn on using the WOL tool on the MikroTik.

router export:

/interface bridge
add name=VPN-bridge
add admin-mac=hidden auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-256 name=VPN-profile
add dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 name=MGMT-profile
/ip ipsec peer
add address=hidden exchange-mode=ike2 local-address=hidden name=MGMT-peer port=4501 profile=MGMT-profile
add address=hidden exchange-mode=aggressive local-address=hidden name=VPN-peer profile=VPN-profile
/ip ipsec proposal
add enc-algorithms=aes-256-cbc lifetime=1d name=VPN-proposal
add enc-algorithms=aes-256-cbc lifetime=1d name=MGMT-proposal pfs-group=modp2048
/ip pool
add name=default-dhcp ranges=192.168.50.10-192.168.50.254
add name=VPN-pool ranges=10.39.26.6
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add address-pool=VPN-pool disabled=no interface=VPN-bridge name=VPN-dhcp
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=VPN-bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=VPN-bridge list=LAN
/ip address
add address=192.168.50.1/24 comment=defconf interface=bridge network=192.168.50.0
add address=hidden comment=VPN-autogen-public interface=ether1 network=hidden
add address=10.39.26.5/30 comment=VPN-autogen-private interface=VPN-bridge network=10.39.26.4
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=10.39.26.4/30 comment=VPN-autogen-dhcp-network dns-server=10.39.26.5 gateway=10.39.26.5
add address=192.168.50.0/24 comment=defconf gateway=192.168.50.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=10.39.80.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input src-address=10.39.26.0/24
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add chain=srcnat comment=VPN-autogen-srcnat dst-address=10.0.0.0/8 src-address=10.39.26.4/30
add chain=dstnat comment=VPN-autogen-dstnat dst-address=10.39.26.4/30 src-address=10.0.0.0/8
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip ipsec policy
add action=none dst-address=10.39.26.4/30 src-address=0.0.0.0/0
add dst-address=10.39.26.248/30 peer=MGMT-peer proposal=MGMT-proposal sa-dst-address=hidden sa-src-address=hidden src-address=10.39.26.4/30 tunnel=yes
add dst-address=10.0.0.0/8 peer=VPN-peer proposal=VPN-proposal sa-dst-address=hidden sa-src-address=hidden src-address=10.39.26.4/30 tunnel=yes
/ip route
add distance=1 dst-address=10.0.0.0/8 gateway=VPN-bridge pref-src=10.39.26.5
2

But have You verified that the computer is responding to the WOL? I had one, using the Asus M5A97LE motherboard, that NEVER woke up. All the others computers worked - but not this one.

Yes, I turned it on. Yes, I updated the BIOS. No, it never worked.

So, before anything else: did You verify that the WOL on this computer in fact work? I have it working with a simple setup and an RB750Gr3. I use a very simple script, but its just for convenience. It is a one line script:

/tool wol mac=XX:XX:XX:XX:XX:XX interface=bridge1

Did not test with 6.47.1 - but it worked with 6.46.something.

3

I have more than 15 of these exact systems setup. I’ve tested 4 systems so far but have only been able to get WOL working on one of them. The one that it worked on had a slightly different setup wherein ether2-ether5 are all on the standard 192.168.50.0 bridge, the computer got a 192.168.50.x address and the 10.39.26.x connection was natted to it. This is what made me suspect that it may just be due to the router configuration.

4

Ok. I’m not sure that WOL will work over VLANs - never tested it.

Have You declared the VPN bridge as the interface?

/tool wol mac=XX:XX:XX:XX:XX:XX interface=VPN-bridge

5

It’s actually not a VLAN. And I’ve tried bridge, VPN-bridge and ether5.

6

Sorry about it. Never answer something still sleeping! :smiley:

Have You tried a sniffer, to see if the packet is going somewhere? I don’t know if the Mikrotik implementation uses UDP or an ethernet frame. It is possible that your IPSec policy isn’t matching the WOL packet.

7

I did as you suggested and the WOL packets are in fact getting through, at least while the system is powered on. I guess it may not be a router issue, but something due to the software/hardware on the computer. Its very frustrating since these machines are obviously remote and I don’t have physical access to them, so if they’re off I can’t turn them on to adjust settings to fix this. Thanks Paternot

8

As I said, I had this problem with the Asus motherboard, M5A97LE. Funny thing is: with a PCIe NIC it worked, but not with the onboard one. Go figure…

9

So I modified every suggested setting in Windows, but still couldn’t get it to work.
Pulling up the stats for ether5, when the machine is on and I send a WOL packet, I can clearly see the Tx Broadcast increment. When the machine is off though there are no packets sent and no stats increment. So I’m back to step one where I think that it might have something to do with the Mikrotik. I have one of the machines in my office but its connected to a switch. When the computer is off, the switch shows it still connected but at 10mbps. The Stats for ether5 on the remote machine however seem to indicate that there is no connection at all. I’m not really sure what to do.

10

Figured it out. It had nothing to do with Mikrotik and everything to do with windows. The motherboard I was using was an Asus with an integrated Intel l211-AT NIC. The default drivers that come for windows don’t actually enable WOL so the the NIC was turning off after shutting down from Windows (It would actually work properly if shutdown from the bios). All I had to do was download the drivers provided directly from Intel and enable the WOL settings in the device properties of the NIC.

11

with that i have issues for the last 6 years.
WOL it working well until you unplug/plug the cable.
One you do that WOL stops to work