Community discussions

MikroTik App
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Ping across multiple subnets

Thu Jun 30, 2016 11:19 pm

Greetings!  This is my first attempt at trying to run traffic between multiple subnets on an RB2011UiAS.  Configuration is as follows:
Port 1 goes to the internet via a masquerade.
Port 2 is the LAN port with IP range 192.168.95.x  gateway 192.168.95.254.  2-9 are in a bridge.
Port 10 is on its own and has IP of 172.16.95.253.
From the router's terminal window, I can ping address's in the 172.16.95.X network and receive replies.
From a host in the 192.168.95.X subnet I can ping the 172.16.95.253 gateway but nothing else in that subnet.
Thanks in advance for any insight.
 
cutedrummerboy
Member Candidate
Member Candidate
Posts: 137
Joined: Thu Nov 14, 2013 6:32 pm

Re: Ping across multiple subnets

Fri Jul 01, 2016 8:19 am

check your firewall rule and gateway of that device which you want to ping.

connected routes are by default routed. you don't have to do any special configurations for that.

Sent from my HM 1S using Tapatalk
Device: RB2011UIAS-RM, RB750GL, CISCO SG300-28, UNIFI UAP-LR
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Re: Ping across multiple subnets

Fri Aug 05, 2016 12:38 am

Discovered something interesting today. If I plug a laptop running windows 10 into port 10 and configure with an IP of 172.16.95.254, Mask 255.255.0.0 and gateway of 172.16.95.253,
I can run traffic back and forth between the laptop, the internet and machines connected in the 192.168.95.X subnet. If I remove the laptop and apply the same IP configuration to an AllWorx phone switch, I can ping the allWorx from the terminal window on the router but not from the 192.168.95.X network. What am I missing?

Thanks In Advance,

Aaron
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Ping across multiple subnets

Fri Aug 05, 2016 12:45 am

This sounds like you may be getting subnet masks wrong, or default GWs wrong, or something of that nature.

/ip address export
/ip firewall filter export
/ip firewall nat export
and post the results here.

Obfuscate your public IP addresses, but leave the private ones intact.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Arcee
Member Candidate
Member Candidate
Posts: 267
Joined: Fri Jun 27, 2014 2:33 pm

Re: Ping across multiple subnets

Fri Aug 05, 2016 12:45 am

Firewall rules are what's missing. You need to allow traffic between networks. That won't happen on its own.

Recognize that you will always be able to ping a network host that is physically connected from the terminal.

Sent from my SM-G920I using Tapatalk
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Re: Ping across multiple subnets

Fri Aug 05, 2016 12:55 am

/ip address
add address=192.168.95.254/24 comment="Default LAN Gateway" interface=bridge-local network=192.168.95.0
add address=X.X.X.X/30 comment="WAN Static Gateway" interface=ether1-gateway network=X.X.X.X
add address=172.16.95.253/16 interface=ether10-slave-local network=172.16.0.0
=============================================================================================
/ip firewall filter
add chain=input dst-port=8291 protocol=tcp
add chain=input dst-port=5003 protocol=tcp
add chain=input protocol=gre
add chain=input dst-port=1723 protocol=tcp
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established,related
add action=drop chain=input comment="default configuration" in-interface=ether1-gateway
add action=fasttrack-connection chain=forward comment="default configuration" connection-state=established,related
add chain=forward comment="default configuration" connection-state=established,related
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new \
in-interface=ether1-gateway
==================================================================================================
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway
add action=dst-nat chain=dstnat dst-address=X.X.X.X dst-port=595 protocol=tcp to-addresses=192.168.95.200 \
to-ports=595
==================================================================================================

I don't understand how a firewall rule can be at play on the router when a Laptop configured the same way works fine but the AllWorx box doesn't?

Thanks

Aaron
 
User avatar
docmarius
Forum Guru
Forum Guru
Posts: 1223
Joined: Sat Nov 06, 2010 12:04 pm
Location: Timisoara, Romania
Contact:

Re: Ping across multiple subnets

Fri Aug 05, 2016 1:30 am

Your phone switch probably refuses to answer pings from sources outside its own subnet as a security measue (the switch's own firewall).
You could need a masquerade or src-nat on ether10 to get it working:

/ip firewall nat add action=masquerade chain=srcnat out-interface=ether10-slave-local
Last edited by docmarius on Fri Aug 05, 2016 1:42 am, edited 2 times in total.
Torturing CCR1009-7G-1C-1S+, RB450G, RB750GL, RB951G-2HnD, RB960PGS, RB260GSP, OmniTIK 5HnD and NetMetal 922UAGS-5HPacD + R11e-5HnD in my home network.
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Re: Ping across multiple subnets

Fri Aug 05, 2016 1:38 am

It's actually the AllWorx switch itself. But why can the router itself ping the allWorx and get a reply? I have been told that pinging from the terminal window avoids the firewall rules which would lead
me to believe its a firewall issue in the Mikrotik but if that's the case then why do the current firewall rules work okay when a Windows 10 laptop configured with the same IP configuration and attached to the same port works fine?

Thanks for all the input. Really trying to get a better understanding of how this is supposed to work.
 
User avatar
docmarius
Forum Guru
Forum Guru
Posts: 1223
Joined: Sat Nov 06, 2010 12:04 pm
Location: Timisoara, Romania
Contact:

Re: Ping across multiple subnets

Fri Aug 05, 2016 1:40 am

Because pings from the router originate with the local interface IP, while pings from the network have an IP from that other subnet.
Windows10 accepts icmp from any source, while your switch doesn't.
Just try the src-nat rule :-)
/ip firewall nat add action=masquerade src-address=192.168.95.0/24 chain=srcnat out-interface=ether10-slave-local
Last edited by docmarius on Fri Aug 05, 2016 1:54 am, edited 1 time in total.
Torturing CCR1009-7G-1C-1S+, RB450G, RB750GL, RB951G-2HnD, RB960PGS, RB260GSP, OmniTIK 5HnD and NetMetal 922UAGS-5HPacD + R11e-5HnD in my home network.
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Re: Ping across multiple subnets

Fri Aug 05, 2016 1:54 am

Perfect! The Src-nat fixed it right up!.

Thanks A million for the solution and the insight as to why it works.
 
User avatar
docmarius
Forum Guru
Forum Guru
Posts: 1223
Joined: Sat Nov 06, 2010 12:04 pm
Location: Timisoara, Romania
Contact:

Re: Ping across multiple subnets

Fri Aug 05, 2016 1:58 am

Have fun! :D
Torturing CCR1009-7G-1C-1S+, RB450G, RB750GL, RB951G-2HnD, RB960PGS, RB260GSP, OmniTIK 5HnD and NetMetal 922UAGS-5HPacD + R11e-5HnD in my home network.
 
ahbutler
newbie
Topic Author
Posts: 27
Joined: Sat Sep 06, 2014 1:45 am

Re: Ping across multiple subnets

Fri Aug 05, 2016 2:01 am

Still don't have a firm grip on what the Src-nat rule is doing exactly but I suspect it is masquerading the source IP to appear as if it is coming from 172.16.X.X?
 
User avatar
docmarius
Forum Guru
Forum Guru
Posts: 1223
Joined: Sat Nov 06, 2010 12:04 pm
Location: Timisoara, Romania
Contact:

Re: Ping across multiple subnets

Fri Aug 05, 2016 2:09 am

Exactly, you got it right.
For sources in your 192.168.95.0/24 network going out to ether10, it will substitute the source address of all packets with 172.16.95.253 (the interface's IP). It will track the connections, and replies will have the response destination substituted back to their original ones.
All traffic from 192.168.95.0/24 will appear as if originated from the router itself on ether10.
Outgoing connections, together with their associated replies will be unaffected, because they are tracked, too.
Torturing CCR1009-7G-1C-1S+, RB450G, RB750GL, RB951G-2HnD, RB960PGS, RB260GSP, OmniTIK 5HnD and NetMetal 922UAGS-5HPacD + R11e-5HnD in my home network.

Who is online

Users browsing this forum: mohkhalifa and 139 guests