Please change the firewall rule from 8921 to 8291. Alternatively change the Winbox service port to 8921 in IP/Services and leave your current firewall rule.

in addition to the port issue: for most 4G connection, you are either behind a NAT or any incoming connection (originated from the WAN) is blocked.
you can tell if you use uplookup and then check against what you get on the LTE interface, if they are different. you are behind NAT.

you either need a static IP
or dial VPN from car Mikroitk to your office, and then you can access the car Mikroitk on the remote IP of the VPN tunnel.

Most LTE connections give you an IP in the 100.64.0.0/10 range. This is actually a non public IP that is used with CGNAT. As already stated the only way this typically works is if your device is setup with a VPN client that connects to a VPN server that has a publicly accessible IP address.

semi detailed steps:
1. set up VPN from car Mikroitk to your office. make sure it's connected. but add without "Add Default route option" . many simple tutorial online and wiki can help you. try this PPTP VPN
https://mikrotik.com/testdocs/ros/3.0/vpn/pptp.php
(asuming your office router accept this type of VPN, otherwise use whatever is available)

2. once connected. you will get a IP address on the VPN tunnel connection. On the car Mikrotik, check the status of your VPN inerface, It is the Local address. in my set up, it is 192.168.89.9
2a: without Adding default route option, you need to add static route. For example

Code: Select all

add distance=1 dst-address=192.168.2.0/24 gateway=192.168.89.1

where 192.168.2.0/24 should be changed to the ip range of your office network, 192.168.89.1 should be changed to the remote address of your VPN connection.

3, you should be able to ping any IP on the office network, and from a office PC, you should be able to ping the Local address. in my case, office PC canping 192.168.89.9.
(if office router is also Mikroitk, you need to masquerade VPN network range as well)

4. finally, accept port 8291 on input chain of your car Mikroitk, you should be able to winbox into it from the office.

PS: it is the office router that gives you the VPN address and typically it will be in the same range as the office LAN IP. but not always, in my case, the office network is 192.168.2.0/24 but the VPN network in office is 192.168.89.0/24

semi detailed steps:
1. set up VPN from car Mikroitk to your office. make sure it's connected. but add without "Add Default route option" . many simple tutorial online and wiki can help you. try this PPTP VPN
https://mikrotik.com/testdocs/ros/3.0/vpn/pptp.php
(asuming your office router accept this type of VPN, otherwise use whatever is available)

2. once connected. you will get a IP address on the VPN tunnel connection. On the car Mikrotik, check the status of your VPN inerface, It is the Local address. in my set up, it is 192.168.89.9
2a: without Adding default route option, you need to add static route. For example

Code: Select all

add distance=1 dst-address=192.168.2.0/24 gateway=192.168.89.1

where 192.168.2.0/24 should be changed to the ip range of your office network, 192.168.89.1 should be changed to the remote address of your VPN connection.

3, you should be able to ping any IP on the office network, and from a office PC, you should be able to ping the Local address. in my case, office PC canping 192.168.89.9.
(if office router is also Mikroitk, you need to masquerade VPN network range as well)

4. finally, accept port 8291 on input chain of your car Mikroitk, you should be able to winbox into it from the office.

PS: it is the office router that gives you the VPN address and typically it will be in the same range as the office LAN IP. but not always, in my case, the office network is 192.168.2.0/24 but the VPN network in office is 192.168.89.0/24

WOW! What an amazing effort to help me thank you very much. I'll get started now and see what happens.

@Solar77, how do you PM on this forum?

@RussellRSA, I am also in good old RSA, give me a shout if need assistance

...
@CZF - that's amazing thanks... you aren't by any chance in CT?

...
@CZF - that's amazing thanks... you aren't by any chance in CT?

I wish, northern part of JHB

...
for all these work above, you could just use a Unifi Access Point, even a entry level one, then all cloud access is taken care for you by the Unifi controller which is free.
an UAP AC Lite or AC Mesh will do the job nicely or a basic UAP at £48.98 exc. VAT which only gives you 2.4GHz wifi but should be enough for what you need.

...
PS: just wondering, why do you need access to the car Mikroitk? just to check status of your hotspot users?
...

...
PS: just wondering, why do you need access to the car Mikroitk? just to check status of your hotspot users?
...

I think it is a "Party Bus" and not his car, and he wants to access some cameras in bus remotely...

@CZfan

just checked and I am not sure...something I'd consider a standard feature but never actually used.

oh well, party bus sounds good.

power hopefully is not an issue if it is a bus. event the USP mesh is only 8.5 W but normally it would run at 3.5-4 W. 24V POE or 802.3af .

8w is nothing when there is already cameras, laser lights, Hi-Fi systems etc. Sorry if I am not thinking about the right kind of bus...

Cameras these days would have cloud management anyway...