Community discussions

 
tmp
just joined
Topic Author
Posts: 10
Joined: Sat Mar 21, 2015 7:34 pm

Router can't access internet/PING/DNS - Clients are able to connect!

Sat Jun 18, 2016 6:07 pm

Hi,

I set up my Mikrotik hap lite a few months ago and I'm quite happy with it - except for one thing.
I'm using the device as a home-router with PPPOE. The clients can access the internet without any problem but the router itself isn't able to connect to the internet until
I disable the "drop all" rules. So I believe I have a mistake in my firewall config.
Here is my current config (ROS 6.34.6 (bugfix)):

/ip firewall filter
add chain=input connection-state=established connection-type=""
add chain=input connection-state=related connection-type=""
add chain=input in-interface=bridge-local
add action=drop chain=input connection-state=invalid connection-type=""
add action=drop chain=input
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=forward dst-address=!192.168.88.0/24 in-interface=bridge-local
add action=drop chain=forward
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
    out-interface=pppoe-out1
/ip firewall service-port

Can someone please tell me what I need to configure so that the router is able to connect to the internet itself?

Thanks in advance,

tmp
 
flynno
Member Candidate
Member Candidate
Posts: 241
Joined: Wed Aug 27, 2014 8:11 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Sat Jun 18, 2016 8:20 pm

/ip firewall nat
add action=masquerade chain=srcnat comment="bridge configuration" \
    out-interface=bridge-local
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Sun Jun 19, 2016 7:36 am

Check that the router has valid DNS servers configured in /ip dns menu.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tmp
just joined
Topic Author
Posts: 10
Joined: Sat Mar 21, 2015 7:34 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Wed Jun 22, 2016 7:16 pm

Thanks for your quick answers! The DNS-Servers are set correctly (to OpenDNS) and I also added the new NAT-rule but it still doesn't work.
If I disable the marked firewall rule, both ping and DNS works:
Image


 Do you have another suggestion?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Wed Jun 22, 2016 9:54 pm

The screenshot of your rules doesn't show enough information.
Some columns such as "connection-state" are not shown by default, and the default firewall rule set uses these fields.

Instead of posting a screenshot, open a terminal window and issue the command:
/ip firewall filter export compact

Copy and paste the results (and feel free to redact the public IP addresses that may appear with x.x.x.x)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tmp
just joined
Topic Author
Posts: 10
Joined: Sat Mar 21, 2015 7:34 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Sun Jun 26, 2016 10:01 pm

[admin@MikroTik] > /ip firewall filter export compact
# jun/26/2016 20:58:36 by RouterOS 6.34.6
# software id = XXXXX
#
/ip firewall filter
add chain=input connection-state=established connection-type=""
add chain=input connection-state=related connection-type=""
add chain=input in-interface=bridge-local
add action=drop chain=input connection-state=invalid connection-type=""
add action=drop chain=input
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=forward dst-address=!192.168.88.0/24 in-interface=bridge-local
add action=drop chain=forward
Here are my firewall settings. Thanks again!
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Sun Jun 26, 2016 11:50 pm

You have set 'connection-type' to "" on the established/related rules so they don't match the established/related connections.

Through winbox, just edit the established/related rules and click on the arrow next to the 'Connection Type' field so that it will get gray.
Screenshot_1.png
You do not have the required permissions to view the files attached to this post.
 
tmp
just joined
Topic Author
Posts: 10
Joined: Sat Mar 21, 2015 7:34 pm

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Mon Jun 27, 2016 8:16 pm

Cha0s, thanks a lot, this was the mistake I made while configuring the device. Everything works fine now!
 
User avatar
ahmadzai
just joined
Posts: 11
Joined: Wed Sep 02, 2015 8:35 am
Location: Kabul
Contact:

Re: Router can't access internet/PING/DNS - Clients are able to connect!

Sat Dec 03, 2016 8:47 am

i am also facing the same problem some time its ping is working some time its not is there any solution for it.
Best Regards

Atiqullah Ahmadzai
Network Technical Manager | Easy Connect ISP
IT (Network, VoIP, WISP, CCTV, Fiber-Optic, Telecom)
Contact: (+) 93 792 99 00 19 / (+) 93 787 45 35 75
Email Add: atiqullah.ahmadzai@easyconnect.af
Skype ID = alu14581

Who is online

Users browsing this forum: MSN [Bot] and 29 guests