Greetings,

sitting with a real strange problem here that I just can't figure out. Sincerely hope you can help.

RB411U with Huawei E156G.

when connecting by the Huawei using my PC and the software provided by the ISP the connection works fine - everything works and speed is good.

When connecting using the RB411U I also get connected and the speed is good. I have good sound quality on skype, I can download / upload to FTP servers with speed above 50 KBps (even using the donmain name for the FTP). I can ping any web site using the domain name. So everything indicates and good connection with good speed and nothing indicates a DNS problem.

The problem is - I can't use my internet browser. when opening the browser and e.g. enter http://www.google.com the respons is "web page found" and then "waiting for google.com". Then nothing more happens, just keep saying transferring data from http://www.....

Everything seems to be fine except the internet browser works.

Please - any ideas. I am just stucked on this one.

rgs Pilgrim

PS. Disabling all firewall rules doesn't change anything.

The picture does not show the entire firewall rules. What is that first "chain=forward action=drop" rule? With the firewall filter, order is important.

Do you have a good default route to the internet set in "/ip route"? I can see the route but not the "reachable" part.

Do you have you localnet masqueraded or src-natted correctly in "/ip firewall nat"? I can see part of the src-nat, but not all.

EDIT: How is the bridge "bridge1" set up? How do you have your ip addresses set? Which interface connects to the internet?

Thanks,

The NAT and DNS seems to work fine when using my FTP client for downloads. It seems only browsing the internet that does not work. The browser, firefox or explorer, all repsonding the same way. The browser finds the website in the URL and is them "waiting for www.....

The details are:

Interfaces:

Flags: D - dynamic, X - disabled, R - running, S - slave
# NAME TYPE MTU L2MTU
0 R ether1 ether 1500 1526
1 R wlan1 wlan 1500 2304
2 R bridge1 bridge 1500 1526
3 R Orange ppp-out 1440


ppp-client:


0 R name="Orange" max-mtu=1500 max-mru=1500 mrru=disabled port=usb2 data-channel=0 info-channel=0
pin="" user="" password="" profile=default phone="*99#" dial-command="ATDT"
modem-init="AT+CGDCONT=1,"IP","internet"" null-modem=no dial-on-demand=no
add-default-route=yes use-peer-dns=yes allow=pap,chap,mschap1,mschap2



Firewall:

0 chain=forward action=drop connection-state=invalid

1 chain=forward action=accept connection-state=established

2 chain=forward action=accept connection-state=related

3 chain=forward action=accept connection-state=new src-address=192.168.0.0/24

4 chain=forward action=log src-address-list=!192.168.0.0/24 dst-address-list=192.168.0.0/24
log-prefix="unwanted"

5 chain=forward action=drop src-address-list=!192.168.0.0/24 dst-address-list=192.168.0.0/24

6 chain=input action=accept protocol=tcp src-address=192.168.0.0/24 dst-port=22

7 chain=input action=log protocol=tcp dst-port=22 log-prefix=""

8 chain=input action=drop protocol=tcp dst-port=22


Nat:

0 chain=srcnat action=masquerade out-interface=Orange



route:

# DST-ADDRESS PREF-SRC GATEWAY-STATE GATEWAY DISTANCE INTERFACE
0 ADS 0.0.0.0/0 reachable 10.112.112.121 1 Orange
1 ADC 10.112.112.121/32 10.192.55.191 0 Orange
2 ADC 192.168.0.0/24 192.168.0.1 0 bridge1




Bridge:

0 R name="bridge1" mtu=1500 l2mtu=1526 arp=enabled mac-address=00:0C:42:4D:40:22 protocol-mode=none
priority=0x8000 auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s
transmit-hold-count=6 ageing-time=5m


Bridge ports:

# INTERFACE BRIDGE PRIORITY PATH-COST HORIZON
0 ether1 bridge1 0x80 10 none
1 wlan1 bridge1 0x80 10 none

the formatting didn't come out well. Details are easier to read in the enclosed txt

route:

# DST-ADDRESS PREF-SRC GATEWAY-STATE GATEWAY DISTANCE INTERFACE
0 ADS 0.0.0.0/0 reachable 10.112.112.121 1 Orange
1 ADC 10.112.112.121/32 10.192.55.191 0 Orange
2 ADC 192.168.0.0/24 192.168.0.1 0 bridge1

Look at entry 1. That pref-src is not in the range of the localnet (/32). Are you certain that assignment is correct? Check you "/ip address" and see if that IP is assigned the correct netmask. Unless it is dhcp from your provider, of course. Then that could be the challenge.

Thanks,

I have another mikrotik connected to a wired PPPoE connection with simlar settings for the PPP and the routing looks similar.

/ip addr pr

# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.0.1/24 192.168.0.0 192.168.0.255 bridge1
1 D 10.128.30.41/32 10.112.112.129 0.0.0.0 Orange

/ip route pr

# DST-ADDRESS PREF-SRC GATEWAY-STATE GATEWAY DISTANCE INTERFACE
0 ADS 0.0.0.0/0 reachable 10.112.112.129 1 Orange
1 ADC 10.112.112.129/32 10.128.30.41 0 Orange
2 ADC 192.168.0.0/24 192.168.0.1 0 bridge1



And this is how is looks on the other router with the PPPoE connection

Wired PPPoE Connection by GTS

# DST-ADDRESS PREF-SRC G GATEWAY DISTANCE IN..
0 ADS 0.0.0.0/0 r 195.168.250.4 1 GTS
1 ADC 192.168.0.0/24 192.168.0.1 0 bridge
2 ADC 195.168.250.4/32 212.81.20.60 0 GTS


Can I check my publich IP without the browerser?

rgs Pilgrim

The formatting really doesn't work for me when pasting. Pls see attached file´for a more readable formatting.

rgs Pilgrim

May I see the "ip addr print" from the router that is working?

ADD: The one that is working is not on private IPs. 195.x.x.x is not private. 212.x.x.x is not private.

Corret, GTS is a public ISP

The router that is working (wired PPPoE with adding default route selected)

[admin@MikroTik] > ip addr pr
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.0.1/24 192.168.0.0 192.168.0.255 bridge-1
1 D 212.81.20.60/32 195.168.250.4 0.0.0.0 GTS
[admin@MikroTik] > ip route pr
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY-STATE GATEWAY DISTANCE INTERFACE
0 ADS 0.0.0.0/0 reachable 195.168.250.4 1 GTS
1 ADC 192.168.0.0/24 192.168.0.1 0 bridge-1
2 ADC 195.168.250.4/32 212.81.20.60 0 GTS
[admin@MikroTik] >

Connecting using the USB port in the PC the connection is good and is using the following IP's

Using the USB port in RB411U I get the following connection with the default profile. FTP download and skype is working, but no internet browser works. DNS is working and I get positive respponse on pings to domain names.

Does this indicate that I need to specify an IP in the profile? I simply have no clue where the problem is.

rgs Pilgrim

Hi Pilgrim,

I am almost out of ideas for you. Are you using a web proxy setup? Seems strange that other protocols are working (FTP, DNS, ICMP, etc.), but not HTTP.

I hope someone else comes along and sees something here I don't. Can't figure out what we are missing...

ADD: You might see if any dynamic filter or nat rules are affecting your setup. Try:
/ip firewall filter print all
/ip firewall nat print all

Hi Surfertim

Thanks again. It is really a very strange problem. I am not using a proxy, but I may be that Orange is using one on their side. I don't know what impact that have on the setup. But right know all traffic is working except the HTTP. I tried to open a HTTPS site and it identified the site and requested me to download a certificate and allow the exemption, which I all did, but still the page wouldn't load.

In the mean time I found out that Orange SK has fixed APN (internet) and IP, DNS WINS area all dyn. Which matcheds my setup, I think.

A friend adviced me to try and lower the MTU. The max MTU is 1500, when checking status I can see that the actual connection is MTU 1440, so it seems that this is also covered.

Would it be an idea if you could try to connect to my pc using teamviewer.com?

rgs Pilgrim

It prompts you to download a secure site certificate? I use IE and Firefox, and neither prompts for a certificate. What web browser are you using?

ADD: Or do you mean it gives you the "You are going to a secure site. Continue?" prompt?

ADD2: Are you using the computer that has the modem software installed on it? The same that connects directly to the modem and works ok? If so, can you try the router setup with a computer that does not have the modem software installed?

I am using the same browsers - firefox and explorer

It was a https site. You probably read it as http.

Yes, I am using the USB modem (Huawei E156G) in both cases I just pull it out of the RB411U and put it in my PC and connect using the software provided by Orange sk (mobile partner).

I tried to connect my laptop to the RB411U (RB411U connected to the internet using the USB Modem), but the problem is the same. I could also try the USB Modem in my laptop, but I think I would need some software like the "Mobile Partner" to connect.

rgs Pilgrim

Good point Surfertim, I just uninstalled the orange software and created a dial up connection in windows with the same APN, dial up and initialization string as used in the RB setup. And the pc connects without problems and everything is working-------- so what is it in my setup in the RB411U that blocks the HTTP traffic???


rgs Pilgrim

Just to be clear...can you go to a FTP site with your browser? Or are you using FTP software?

I was using filezilla. I didn't try using the browser. I will make a test.

rgs Pilgrim

Since it works with Filezilla, then if it does not work with your browser, I would suspect a browser configuration challenge. Firefox is "edit/preferences/advanced/network". IE is in "Tools".

FTP worked without any problems using the browser. It really seems only tp be the HTTP traffic. Please don't give up on me. I really have no idea any longer where this problem is rooted.

rgs Pilgrim

I cannot think of anything else. If you don't get a suitable response here on the forum, may I suggest sending a report to Mikrotik with a description of the challenge. This is how:
http://www.mikrotik.com/testdocs/ros/2. ... upport.php

Surfertim,

Thanks, The same here. I will try to sent it to Mikrotik support. I will keep you informed.

rgs Pilgrim

@surfertim, Thanks a million for your support. Turns out that the problem was in mangle.

When connecting to orange using the RB411U/Huawei E156G one rule was automatically added in mangle. The rule is changing the MSS for all outbound TCP traffic. The mistake - or the problem is that no rule was added for the inbound traffic. When adding the same rule for the inbound traffic everything works fine.

Credit to my friend from CZ for solving this problem. That was a real tough one.

rgs Pilgrim

Greetings,

sitting with a real strange problem here that I just can't figure out. Sincerely hope you can help.

RB411U with Huawei E156G.

when connecting by the Huawei using my PC and the software provided by the ISP the connection works fine - everything works and speed is good.

When connecting using the RB411U I also get connected and the speed is good. I have good sound quality on skype, I can download / upload to FTP servers with speed above 50 KBps (even using the donmain name for the FTP). I can ping any web site using the domain name. So everything indicates and good connection with good speed and nothing indicates a DNS problem.

The problem is - I can't use my internet browser. when opening the browser and e.g. enter http://www.google.com the respons is "web page found" and then "waiting for google.com". Then nothing more happens, just keep saying transferring data from http://www.....

Everything seems to be fine except the internet browser works.

Please - any ideas. I am just stucked on this one.

rgs Pilgrim

PS. Disabling all firewall rules doesn't change anything.

Presentation1.jpg

I have exactly the same problem with you
the problem is not the setting but the modem firmware mikrotik
I have been able to fix the problem, the modem firmware upgrade