Community discussions

MikroTik App
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

[Solved] Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 3:28 pm

Hi

i get an interesting bug, if it's a bug, and need help to sort this out.
so i have a WAP AC LTE Kit (ref RBWAPGR-5HACD2HND&R11E-LTE).
Up to date with 7.14.1

on this router, i have :
- a pppoe-client access used as primary wan with IP xxx.xxx.xxx.33
- a LTE access i want to use as backup with IP xxx.xxx.xxx.46


the pppoe access work like a charm.
the LTE is registered correctly

the strange part is: i cannot ping the LTE ip xxx.xxx.xxx.46 from internet.
but, if i do first a ping from the mikrotik to internet using LTE connection, i can then ping back the LTE IP during some time. after a while, it's not working anymore...

the interesting part:
when i try to ping the LTE access xxx.xxx.xxx.46, i see in the LTE graph the packets every 1 second.
but if i add a mangle rule with prerouting to log it, thee is nothing logged, and the packet count is still 0.

Do you have any idea of this mistery ?

see below extract of config
ether1 is the LAN
ether2 is the optical fiber with pppoe-client attached on it
wifi is disabled.
no DHCP server.

# 2024-03-19 14:20:56 by RouterOS 7.14.1
# software id = F6R4-7BGT
#
# model = RBwAPGR-5HacD2HnD
# serial number = HEA08TMX4ZN
/interface bridge
add admin-mac=48:A9:8A:99:6C:2C auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1_LAN
set [ find default-name=ether2 ] name=ether2_FIBRE
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band="" mtu=1400 network-mode=lte sms-read=no
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether2_FIBRE name=pppoe-alpha user=office@office.pouet
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=myapn authentication=pap default-route-distance=10 ip-type=ipv4 use-network-apn=no use-peer-dns=no user=mysuperlogin
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1_LAN queue=fq-codel-ethernet-default
set ether2_FIBRE queue=fq-codel-ethernet-default
/interface bridge port
add bridge=bridge comment=defconf interface=ether1_LAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=pppoe-alpha list=WAN
add interface=ether2_FIBRE list=WAN
/ip address
add address=192.168.11.2/24 interface=bridge network=192.168.11.0
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=log chain=prerouting in-interface=lte1 log-prefix=FROMLTE
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set sip disabled=yes
/ip route
add disabled=no dst-address=8.8.8.8/32 gateway=lte1 routing-table=main suppress-hw-offload=no
/system clock
set time-zone-name=Europe/Paris
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.europe.pool.ntp.org
add address=0.fr.pool.ntp.org
add address=fr.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Last edited by warenbe on Thu Mar 21, 2024 3:52 pm, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19395
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 5:33 pm

Does the LTE provide you with a public IP.
Does the ISP block ICMP pinging.

1. you can remove this default static setting
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan


2. Is bufferbloat that bad.......... its not something to use right away as you can no longer use fastrack so lose performance to gain ?????

3. Biggest problem is that you dont have any tangible definition/plan and corresponding setup for your WANS.
Which one is primary and which one secondary.
Are any used for VPNS?
Any servers on the LAN?

Suggest at least you do not use default route in pppoe settings and use the following.


/ip route
add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=pppoe-alpha routing-table=main
add distance=4 dst-address=0.0.0.0/0 gateway=lte1 routing-table=main


If you want to do recursive routing where the router checks access to internet and not just access to ISP then"

add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=9.9.9.9 routing-table=main scope=10 target-scope=12
add distance=2 dst-address=9.9.9.9/32 gateway=pppoe-alpha routing-table=main scope=10 target-scope=11
++++++++++++++++++++++++++
add distance=4 check-gateway=ping dst-address=0.0.0.0/0 gateway=8.8.4.4 routing-table=main scope=10 target-scope=12
add distance=4 dst-address=8.8.4.4/32 gateway=lte1 routing-table=main scope=10 target-scope=11
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 6:35 pm

Hi
thanks for answering

i get IP from the ISP yes. this is a "real" IP, i mean it's not CGNAT.

1. I will. but it should not be the problem

2. Never heard of this, 'ill do some research. plz notice that appart the pppoe and LTE + IP and few firewall settings, i did not changed anything of the default config.

3. You're right, this is because this is a test device. plz notice that even if i don't set up the fiber connection (so only use LTE) , i'm unable to ping from internet the LTE ip address unless i do some traffic from the router. Weird isn't it ?

Your suggestion is basically what i'll do to use LTE as backup data plan. but i also want to be able to access router from LTE while fiber connection is OK. currently this is impossible. i need to first do some traffic from the router to internet, and then i'm able to access it.
i still don't know if it's a mikrotik bug or ISP weird configuration...
i tried using a low budget 4G modem and i'm able to ping it, but i suspect the modem to do some traffic on internet even when idling (some kind of ping or firmware check perhaps).

i still can do a script that ping an address with a specific route using LTE every XX seconds to "keep the LTE working", but that's more a hack than a fix.

but if nobody on this form has this issue, maybe it's a carrier related bug... i need to test with another 4G Provider perhaps.
Are any used for VPNS?
Any servers on the LAN?
vpn: nope. not right now. but might be in the future (openvpn/wg)
servers on the LAN: sure, lot of !
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19395
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 6:44 pm

that is the crux of the problem, knowing what you want, creating a diagram etc. prior to touching the config- called a plan!!

State your requirements FULLY...
a. identify all users/devices
b. identify what traffic flow they all require

Then we can design the config optimally,
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 6:51 pm

sorry if i'm not clear in what i search to find.

I understand what you mean, but the problem is not accessing something behind the router, but the router itself :).
currently it's only test unit. so there is even no server behind.

we noticed on another setup that we were not able to access mikrotik routeur from LTE while optical fiber was connected. We though it was a problem of config.
so we setup the config on a test unit using as few settings as possible, and we noticed the same issue.
we first though it was a firewall issue, but with a so small configuration, it was strange...

and then we found that LTE access from internet was not working until we made few ping from mikrotik.
I mean accessible router using winbox. or even ping the router from internet
i wonder in fact if this is a bug in mikrotik LTE interface, or ISP issue.

the goal of this topic is not to build a complete configuration with d-nat or things like that (we already get this working) but to find if something in our config/firmware is the reason of this strange behavior.

i hope it's more clear :)
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19395
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Tue Mar 19, 2024 7:11 pm

Yup, will move on. The MT config is an integrated OS, and thus looking at it in snippets is really not fruitful.
 
User avatar
Amm0
Forum Guru
Forum Guru
Posts: 3505
Joined: Sun May 01, 2016 7:12 pm
Location: California

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 2:39 am

The OP is using just "route failover". But to allow incoming traffic on the "backup" / inactive LTE route, you need to follow the "Failover with Firewall Marking" approach: https://help.mikrotik.com/docs/display/ ... allMarking
The docs show that "src-nat" with "to-address=" — that isn't going to work in your case, so leave the masquerade rule in NAT as is — but the rest of the firewall and routing table stuff be needed.

Outbound "ping" works because masquerade NAT will track the route selection to allow incoming via LTE. This does not work in inbound, since, essentially, the active default route in the "main" routing table say to use PPPoE/ether2.

If need is ONLY to steer traffic outbound via LTE when not active route that can work in the basic "route failover" using /ip/route like OP has done with 8.8.8.8.
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 11:18 am

Hi all
thanks for answering

@anav: sorry , it's not easy to understand some of your sentences when not english speaking native

So, the problem is the main route?
strangely i would think that a prerouting rule would at lease works but it's not the case. if i set a prerouting with in. interface = lte it does not catch anything. that's weird as i though it would be checked before routes...
Image

Also yesterday i tried to solve this by tagging connection on input/forware with "fiber" and "4g" tags and did some routing rules to force taged packets to go to correct connection. it did not help.

So based on all your answers here and some reading of doc, i did the config below.

am i right when i say i cannot ping LTE connection when pppoe is working because route is not active, and using this https://wiki.mikrotik.com/wiki/Manual:U ... attributes i can set the lte route active ?

this config basically check the route by pining some host, so it solve my problem by setting the route as active right ?
# 2024-03-20 10:15:04 by RouterOS 7.14.1
# software id = F6R4-7BGT
#
# model = RBwAPGR-5HacD2HnD
# serial number = HEA08TMX4ZN
/interface bridge
add admin-mac=48:A9:8A:99:6C:2C auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge ssid=MikroTik-996C2E wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX distance=indoors frequency=auto installation=outdoor \
    mode=ap-bridge ssid=MikroTik-996C2E wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] name=ether1_LAN
set [ find default-name=ether2 ] name=ether2_FIBRE
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band="" mtu=1300 network-mode=lte sms-read=no
/interface pppoe-client
add disabled=no interface=ether2_FIBRE name=pppoe-alpha user=anothersuperlogin
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] add-default-route=no apn=telcomobile.com authentication=pap ip-type=ipv4 use-network-apn=no use-peer-dns=no \
    user=mysuperlogin
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge lease-time=10m name=defconf
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1_LAN queue=fq-codel-ethernet-default
set ether2_FIBRE queue=fq-codel-ethernet-default
/routing table
add disabled=no fib name=4G
/interface bridge port
add bridge=bridge comment=defconf interface=ether1_LAN
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=pppoe-alpha list=WAN
add interface=ether2_FIBRE list=WAN
/ip address
add address=192.168.11.2/24 interface=bridge network=192.168.11.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9,8.8.8.8
/ip firewall address-list
add address=xxx.xxx.xxx.xxx comment=free list=OFFICE
add address=yyy.yyy.yyy.yyy comment=orange list=OFFICE
add address=zzz.zzz.zzz.zzz3 comment=alpha list=OFFICE
add address=www.www.www.www comment=olivier list=OFFICE
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input dst-port=8291 log=yes log-prefix=winbox-ipc protocol=tcp \
    src-address-list=OFFICE
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=reject chain=forward comment="Rejette les packets sortant par la fibre mais tagu\E9s en 4G" connection-mark=4G \
    out-interface=pppoe-alpha reject-with=icmp-network-unreachable
add action=reject chain=forward comment="Rejette les paquets sortants par la 4G mais tagu\E9s en fibre" connection-mark=FIBRE \
    out-interface=lte1 reject-with=icmp-network-unreachable
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new \
    in-interface-list=WAN
/ip firewall mangle
add action=log chain=prerouting in-interface=lte1 log-prefix=PING4G protocol=icmp
add action=mark-connection chain=output connection-mark=no-mark connection-state=new new-connection-mark=FIBRE out-interface=\
    pppoe-alpha passthrough=yes
add action=mark-routing chain=output connection-mark=FIBRE new-routing-mark=main passthrough=yes
add action=mark-connection chain=output connection-mark=no-mark connection-state=new new-connection-mark=4G out-interface=lte1 \
    passthrough=yes
add action=mark-routing chain=output connection-mark=4G new-routing-mark=4G passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set sip disabled=yes
/ip route
add check-gateway=none disabled=no distance=1 dst-address=0.0.0.0/0 gateway=pppoe-alpha pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=lte1 pref-src="" routing-table=4G scope=30 suppress-hw-offload=no \
    target-scope=10
add disabled=no dst-address=8.8.8.8/32 gateway=pppoe-alpha routing-table=main scope=10 suppress-hw-offload=no
add disabled=no dst-address=8.8.4.4/32 gateway=lte1 routing-table=main scope=10 suppress-hw-offload=no
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=main suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=8.8.4.4 pref-src="" routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=8.8.4.4 routing-table=4G suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=4G suppress-hw-offload=no \
    target-scope=11
/system clock
set time-zone-name=Europe/Paris
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.europe.pool.ntp.org
add address=0.fr.pool.ntp.org
add address=fr.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19395
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 1:53 pm

Okay, the easy explanation is that your ping hits the LTE connection and reaches the router but the router responds via the other WAN as the fiber WAN is primary in terms of routes.
To ensure your traffic for WAN2 is responded to via WAN2, you need to mangle.
There is no need to do this for WAN1 as its the primary WAN and does not suffer this consequence..............

I cannot comment on your method, doesnt look right and way too complex for what is needed, but i will provide what I would use.

/routing table add fib name=useWAN2

add chain=prerouting ( or chain=input both are valid ) action=mark-connections connection-mark=no-mark \
in-interface=lte1 new-connection-mark=incoming-WAN2 passthrough=yes

add chain=output action=mark-routing connection-mark=incoming-WAN2 \
new-routing-mark=useWAN2 passthrough=no


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Looking at your routes...... They are messed up. The first two routes are NOT required plus they are not separated by distance so you confuse your router as there would be no ryhme or reason as to which WAN would be selected. Recursive routes are missing target scope. The additional route we create for WAN2, to ensure router services to WAN2 go back out WAN2 does not require anything special ( basic route setup ). Note the DNS sites we use to reach should not overlap with those identifed in IP DNS, so I have put in others..........

See below:

/ip route
add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=208.67.222.222 scope=10 target-scope=12
add distance=2 dst-address=28.67.222.222 gateway=pppoe-alpha scope=10 target-scope=11
++++++++++++++++++++++++++++++++++
add distance=4 check-gateway=ping dst-address=0.0.0.0/0 gateway=94.140.14.14 scope=10 target-scope=12
add distance=4 dst-address=94.140.14.14 gateway=lte1 scope=10 target-scope=11
+++++++++++++++++++++++++++++++++
add dst-address=0.0.0.0/0 gateway=lte1 routing-table=useWAN2



Technically speaking you dont need check-gateway=ping on the recursive route for the backup lte ( the second one). Logically if WAN1 goes down, and you are switched to WAN2, but then WAN2 becomes unavailable, then there are no alternatives to switch too. Keep in mind, in that case, if WAN2 were to come back on its own, then the router would use that and at anytime if WAN1 was to come back online, regardless of the status of WAN2, it would be selected and used. However I prefer to keep it in case you ever have a vpn through WAN2, or even a server that you want to reach via WAN2

Whenever I require distance on routes you will note I always leave a space before and after, in case I ever wanted to add any routes before or after a current routing............. hence i dont use 1,2, I use 2,4 etc......
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 4:33 pm

Hi

ok
so based on your last message, i reseted the config and applied exactly this config from scratch (only default config was applied after reset)
and it seems to work. i still need to test fully the failover, but at least i can access mikrotik from lte when pppoe is working :)
# set IP
/ip address
add address=192.168.11.2/24 interface=bridge network=192.168.11.0

# DNS
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9,8.8.8.8

# Misc
/system clock set time-zone-name=Europe/Paris
/system ntp client set enabled=yes
/system ntp client servers
add address=0.europe.pool.ntp.org
add address=0.fr.pool.ntp.org

# Rename interfaces
/interface ethernet
set [ find default-name=ether1 ] name=ether1_LAN
set [ find default-name=ether2 ] name=ether2_FIBRE

# remove ether2 from bridge
/interface bridge port remove [ find interface=ether2_FIBRE ]

# disable default dhcp server, no need it
/ip dhcp-server set [ find name=defconf ] disabled=yes

# add pppoe connection
/interface pppoe-client
add disabled=no interface=ether2_FIBRE name=pppoe-alpha password=xxxxxxxxxxxx user=yyyyyyyyyyyyyyyyyyyyyyy

# set lte pin + mtu
/interface lte
set [ find default-name=lte1 ] allow-roaming=no band="" mtu=1300 network-mode=lte pin=0000 sms-read=no

# set lte apn
/interface lte apn
set [ find default=yes ] add-default-route=no apn=telcomobile.com authentication=pap ip-type=ipv4 password=vvvvvvvvvvvvvvvvv use-network-apn=no use-peer-dns=no user=bbbbbbbbbbbbbbbbbbbbbb

# add specific routing table for LTE
/routing table
add disabled=no fib name=4G

# add pppoe and lte to WAN
/interface list member
add interface=pppoe-alpha list=WAN

# add some IP to address-list
/ip firewall address-list
add address=aaa.bbb.ccc.ddd comment=free list=OFFICE
add address=aaa.bbb.ccc.ddd comment=orange list=OFFICE
add address=aaa.bbb.ccc.ddd comment=alpha list=OFFICE
add address=aaa.bbb.ccc.ddd comment=olivier list=OFFICE

# Set firewall rules
/ip firewall filter add place-before=3 action=accept chain=input comment="Acces winbox" dst-port=8291 protocol=tcp src-address-list=OFFICE

# set mangle rules
/ip firewall mangle
add chain=prerouting action=mark-connection connection-mark=no-mark in-interface=lte1 new-connection-mark=from4G passthrough=yes
add chain=output action=mark-routing connection-mark=from4G new-routing-mark=4G passthrough=no

# remove ALG
/ip firewall service-port 
set sip disabled=yes

# routes
/ip route
add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=208.67.222.222 scope=10 target-scope=12
add distance=2 dst-address=208.67.222.222 gateway=pppoe-alpha scope=10 target-scope=11
add distance=4 check-gateway=ping dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=4 dst-address=1.0.0.1 gateway=lte1 scope=10 target-scope=11
add dst-address=0.0.0.0/0 gateway=lte1 routing-table=4G

 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 5:56 pm

And i even added more DNS server to test, so if 1 server is unreachable and other works, i don't immediatly go to LTE connection :)
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19395
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Wed Mar 20, 2024 8:28 pm

Glad its working for you now!

(1) Incomplete
# add pppoe and lte to WAN
/interface list member
add interface=pppoe-alpha list=WAN
add interface=lte1 list=WAN


(2) If what I suspect src-address-list=office is public WANIPs, then you should consider a different approach to reach the router for config purposes remotely.
Add wireguard for remote users to safely access the router for configuration purposes.
 
warenbe
newbie
Topic Author
Posts: 42
Joined: Fri May 19, 2017 9:02 pm

Re: Cannot use LTE without doing outbound traffic first on WAP R AC

Thu Mar 21, 2024 1:56 pm

Hi

1) yep i added it after :)

2) well, it should be more secure with WG yes.

Who is online

Users browsing this forum: ips, jaclaz and 51 guests