Wouldn't it be easier to add a forward rule that accepts traffic from the modem addresses to the LAN ones before the "drop all not coming from LAN"?

Code: Select all

/ip firewall filter add action=accept chain=forward src-address=192.168.1.0/x dst-address=10.0.0.0/y

where x and y are the respective subnet masks of the subnets

You could try the following:

1. Backup your current mikrotik config, because this may not work...

Change the Mikrotik's wan1 interface to be a Lan interface.
(Default config would involve removing from WAN interface list, and adding to LAN interface list)

Change the IP address on the Lan interface to be static 192.168.1.200/32 with a network IP of 192.168.1.1 (The Modem IP ??)
Set default gateway to be 192.168.1.1.

(So Mikrotik now has to go via Modem to connect to rest of 192.168.1.x IP addresses)

With luck this might (mostly) work.

All traffic from the 10.0.x.x side for 192.168.1.x will go via the Modem which will (hopefully) forward it onto the 192.168.1.x network.
And visa versa.

You may not be able to reliably access 192.168.1.200 from the 192.168.1.x network, (but you can probably access its 10.0.x.x ip address)

If this works, Add firewall rules to block access as required.

In that case an exported config would be needed because there could be something else blocking the connection:

/export file=anynameyouwish (minus sensitive information)

Can you try to put, as @TheCat12 mentioned,

Code: Select all

/ip firewall filter 
add action=accept chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/24 in-interface=WAN1

before the rule

Code: Select all

/ip firewall filter
add action=drop chain=forward comment="Drop all other forward"

And then change the rule

Code: Select all

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1

into

Code: Select all

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1 dst-address=!192.168.0.0/24

My guess is the machine you are trying to ping in 10.0.0.xxx has a firewall
Open a terminal on the tick and try ping the machine you are trying to access 10.0.0.???

Code: Select all

ping 10.0.0.??? src-address=192.168.1.200

Also do a traceroute from a machine in the 192.168.1.xxx range wherever it stops is where the problem is.

If setting route on the Huawei device is ineffective, you can still manually add the specific route on your PC devices (route add or ip route add command depending on the OS).

If there are too many devices, or mobile devices with no easy way to add routes, you might try this "crazy" idea: Make the MikroTik device the DHCP server of the 192.168.1.0/24 side. The Huawei device still has the 192.168.1.1 address and still is the gateway. And the MikroTik device still has the 192.168.1.200 address. You turn off DHCP server on the Huawei device. Turn off DHCP client on the WAN interface of the MikroTik device. Still on the MikroTik device, configure static address 192.168.1.200/24 for the WAN interface. Add static default route 0.0.0.0/0 gateway 192.168.1.1. Configure DHCP server on the WAN interface, with network 192.168.1.0/24, Gateway 192.168.1.1, DNS server of your choice. On the MikroTik firewall, chain input, allow incoming request to UDP port 67 (because normally the WAN interface of the MikroTik router blocks incoming traffic).

At this moment, the MikroTik router acts as the DHCP server for the 192.168.1.0/24 LAN of the Huawei device. It still provides the default route information with 192.168.1.1 specified as gateway to the DHCP client. But now you have the ability, with DHCP options, to add additional routes for the DHCP clients. Namely an extra route with destination 10.0.0.0/24 gateway 192.168.1.200, using DHCP option 121 (classless static route). Look at the examples here:

https://help.mikrotik.com/docs/display/ ... CP-Example
https://www.jm.technology/post/mikrotik ... tic_final/

You'll need to specify both the default root for 0.0.0.0/0 gateway 192.168.1.1 and 10.0.0.0/24 gateway 192.168.1.200 using the Hex values as described by the links above. Or you can use this page to build the Hex strings for you:

https://www.medo64.com/2018/01/configur ... te-option/

dhcp-option-121.png

route add 10.0.0.0 MASK 255.255.255.0 192.168.1.200