MikroTik

Hey Guys

Ive got a routing problem that has been perplexing me for months, wonder if anyone can help. I am a relative MT Newbie

About my MT and network environment:

- RB2011L
- Running 6.43 (Stable)
- Eth 9 is LAN with networks 192.168.1.0 - 192.168.6.0
- Eth6 is WAN to ISP
- Eth1 has a non-external but routable IP of xxx.xxx.xxx.233/29 and is ethernet connected to an ASUS RT87U wireless Router (see below)

The purpose of the RT87U is it does OVPN with a VPN service over UDP.

- The RT87U has a static WAN address of xxx.xxx.xxx.234 (incremental to the above) and does NAT for the 192.168.7.0 network. Note the xxx.xxx.xxx.233 address on eth1 on the MT serves as the Gateway for the ASUS router.

The problem:

Pinging the 192.168.1.0 network from a client that is connected to the ASUS router i.e. (192.168.7.xxx), works without issue due to static routing on the ASUS router and a firewall rule on the MT allowing the xxx.xxx.xxx.234 address into my MT LAN (Eth9).

However, Pinging from the 192.168.1.0 network to any client on the ASUS Router does not work

Things I have tried:

- Obviously a static route entry in my MT:
a) xxx.xxx.xxx.232/29 GW:Eth1 pref source xxx.xxx.xxx.233
b) 192.168.7.0/24 GW:Eth1 no pref source

Pings I have tried to narrow down the problem:

- MT can ping xxx.xxx.xxx.234 (ASUS Router WAN Side)
- MT Cannot Ping xxx.xxx.xxx.233 eth1 port or gateway for Asus router
- MT can ping 192.168.7.0

Client on 192.168.1.0:

- Can Ping xxx.xxx.xxx.233 which is the MT eth1
- Cannot ping xxx.xxx.xxx.234
- Cannot ping 192.168.7.1

All firewalls have been disabled on the ASUS router

The reason I am doing all this is because the MT doesn’t do OVPN over UDP.

I hope this makes sense and would really appreciate any help

Thanks

As Asus is doing NAT, whole subnet 192.168.7.0/24 is not reachable from the other side of Asus. The other way around works not because of static routing on Asus but rather because of NAT on Asus. As MT is default gateway for Asus, its NAT will cover Asus' subnet as well.

If you want to have full connectivity between your subnets, you have to disable NAT on Asus and do the routing properly (e.g. you can't set route on MT as "/ip route add address=192.168.7.0/24 gateway=ether1" because ether1 is not a point-to-point link). You have to set asus' "external" IP address as gateway. On Asus, having MT as default gateway is enough.