I have a main router that connects to the ISP and also has few computers connected to it...
I connected Mikrotik Hap AC2 as an additional router to this one, using first port on the Mikrotik.
Main router has a subnet like 192.168.1.1
Mikrotik router has a subnet like 192.168.2.1
I noticed that ports/services like the web interface of the Mikrotik cannot be accessed by devices from the other / main subnet, unless I change the "eth1" interface list to "LAN" (from the default "WAN").
- Is that correct / normal ?
- What does that do ? Does it automatically change some firewall rules ?
- Also, with this configuration, it is correct to use mask 255.255.255.0 on main router under "network > lan" ? It doesn't need 255.255.0.0, correct ?
Not important: I also set static "routes" on main router telling devices on main router to find Mikrotik's subnet using Mikrotik's ip from main router.
Two routers and two subnets on local network
Last edited by adrianTNT on Thu Jan 14, 2021 4:35 am, edited 1 time in total.
// looks like I am not smashing my router after all 
Thanks to Sob, anav, mkx, etc
Thanks to Sob, anav, mkx, etc
Re: Two routers and two subnets on local network [SOLVED]
Yes, it's normal. In default firewall, some rules reference interface lists. The idea behind that is to not have interfaces hardcoded in firewall rules, so if you change something (use different WAN port, add another LAN, etc), you update only interface list and don't have to touch firewall rules.
WAN port is normally connected to internet and you don't want anyone from there connecting to services on router. If in your case it's connected to another LAN, and you trust it as much as you trust the other LAN behind router, then moving ether1 from "WAN" list to "LAN" list is correct. If you'd like different rules for this LAN, you can add another list ("LAN" and "WAN" are just names, you can have any other you like), put the interface in there and then add firewall rules for this list.
If first LAN should have addresses 192.168.1.x and second one 192.168.2.x (with x = 1-254), then 255.255.255.0 is correct.
And static route to second LAN on main router is not "not important". You need it for devices in first LAN to be able to reach the other LAN.
WAN port is normally connected to internet and you don't want anyone from there connecting to services on router. If in your case it's connected to another LAN, and you trust it as much as you trust the other LAN behind router, then moving ether1 from "WAN" list to "LAN" list is correct. If you'd like different rules for this LAN, you can add another list ("LAN" and "WAN" are just names, you can have any other you like), put the interface in there and then add firewall rules for this list.
If first LAN should have addresses 192.168.1.x and second one 192.168.2.x (with x = 1-254), then 255.255.255.0 is correct.
And static route to second LAN on main router is not "not important". You need it for devices in first LAN to be able to reach the other LAN.
Excessive quoting is useless and annoying. If you use it, please consider if you could do without it.
Re: Two routers and two subnets on local network
Thank you.
I meant "not important" for the question, but as you confirmed, it is critical for the first subnet to see the other.
One more: On Mikrotik's end, the routes to the other subnet were added automatically from what I can tell (and marked as "Dynamic");
How did it do that ? Is it because it got an IP from the DHCP of the main router ?
I meant "not important" for the question, but as you confirmed, it is critical for the first subnet to see the other.
One more: On Mikrotik's end, the routes to the other subnet were added automatically from what I can tell (and marked as "Dynamic");
How did it do that ? Is it because it got an IP from the DHCP of the main router ?
// looks like I am not smashing my router after all Thanks to Sob, anav, mkx, etc
Thanks to Sob, anav, mkx, etcWho is online
Users browsing this forum: Bing [Bot] and 93 guests