hi I have a Bobcat Miner 300 and its currently in a Relayed status.

My current setup is I have a Mikrotik LHG LTE and a Mikrotik HAP AC Lite all provided by the ISP.

When plugging in the Bobcat Miner 300 it had automatically created the port forwarding of 44158 and I have created a static IP for the Bobcat Miner.

However the Bobcat is still in a state of Relayed and its really frustrating.

Also when using online sites to check if the port forward is successful its saying that port 44158 is closed. What I find strange is the its asking me to input my public IP address however on the port forward done automatically the IP address is that of the HAP AC Lite.

Can anyone help me please and Merry Christmas.

Can you clarify what is not actually working? I don't know anything about Bobcat and what "relayed" means for it

https://docs.helium.com/troubleshooting ... eshooting/

this explains what it means on point number 3.

can anyone help?

Sure but I need two things
Network diagram to understand the topology
and second your config

/export hide-sensitive file=anynameyouwish.

By the way, port showing as closed is normal........... t

basically on my miner I need port 44158 open and at the moment its open on the private IP but its not open on my public IP.

can you help me in getting the public IP to have port 44158 open as well please?

could it be that my ISP is blocking the port 44158 from being fully open?

For the last time
please post the config
/export hide-sensitive file=anynameyouwish

how do I post config?

Sorry my bad.....
You go into winbox
scroll down to terminal
open a terminal and paste in there.....

/export hide-sensitive file=anynameyouwish

The exported file will show up in your FILES MENU selection
Upload that to your desktop, and open in notepad ++
Just ensure that your WANIP or WANIP gateway don't show on any of the lines (IP DHCP CLIENT or IP ROUTES).

T=hen copy and paste into here.
Best to use the code brackets around the paste - ( the white square brackets in the black square on the same line as BOLD, Underline etc..........)

sorry as you probably guess im not tech savvy like you guys.

is there any other way I can help you to see what my issue is?

????
What do you use to configure the router??
The response is on the border line of go buy a linksys instead.................. Select the file name, right click select download and place on your desktop.
Then open in notepad, and paste into a post..................

okay I will download it later.

on another topic…how do I know if I have CGNAT or not on the Mikrotik?

the WinBox wont download on my Macbook, is there another way?

Egads I think folks use the WINE program for macs ?? check on the downloads page from MT website.

In the router enable IP Cloud.
Then check
a. the public IP on IP cloud
b. from brower run whats my IP and see what it gives you for a public IP
c. Check your IP DHCP client settings status etc and see what it says for public IP
d. Check your IP Routes to see what its pulling for your public IP.

If all the same tis good getting a real public IP.
IF not chances are you are getting a private IP.

...

Lets clean up a few things

1. Modify this to look like...................
/interface list member
add comment=defconf interface=lte1 list=WAN
add interface=bridge1 list=LAN

2. Same for this.........
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge1 network=\
192.168.1.0

3. Same
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else"

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN

4. why is uPNP enabled??

Since you probably want port forwarding add this rule as well.

add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="drop all else"

You will need a destination nat rule for port forwarding as well.
Common format

add chain=dstnat action=dst-nat dst-port=xxxxx protocol=tcp \
in-interface-list=WAN to-addresses=IPofServer

uPNP is enabled on default

Disable it then...... not required.

where you've done the Bold remarks...what sub menues do I do the modifications...once again sorry for the newbie comments

Okay for Interface list members
to add use the PLUS "+" symbol to remove highlight and use the minus "-" symbol.

For the firewall rules select IP then submenu selection Firewall to see the options available in the main section.
For input chain and forward chain rules select Filter Rules.
For NAT rules select NAT

okay so I'm at the Interface List menu...what do I have to do exactly?

See these two entries.
add comment=defconf interface=lte1 list=WAN
add interface=bridge1 list=LAN

Keep them dont touch them
remove the two others.......

which ones?

did the screenshot come through okay?

Remove the one with unknown
and remove the one with
ether1 LAN

can you send me a screenshot where I need to add the port forwarding rule please.

thank you.

my public IP address is different to the IP address for the Mikrotik.

is there a way in getting round this issue as the Bobcat Miner needs a static IP address?

will I need to contact my ISP for them to give me a static IP address?

Hmm will try to see if I can get a hold of a mac to run wine, as this is too tedious.
It would be faster to let me have RDP or logmein or team viewer access to your PC.

My suggestion is to become way more familiar with RouteroS because what your asking is not even
what does this config do........but
how do i get to the config ...... no way you should be making any changes at this point

is there a way I could message you privately to sort this out as it would be great if you could access my computer to solve it?

Would love to if you see my profile my email is there,
However kinda busy today, just taking a break with my eggnog and rum, and going back to the fray of opening presents and eating disgusting amounts of food

my public IP address is different to the IP address for the Mikrotik.

is there a way in getting round this issue as the Bobcat Miner needs a static IP address?

will I need to contact my ISP for them to give me a static IP address?

The Mikrotik has multiple addresses, the one you're interested in is the one at the WAN (uplink) interface, assigned by the ISP.

If that one is 10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x, or 100.64.x.x-100.127.x.x, then it is not a public one.

"public" and "static" are two distinct aspects; you can have a dynamic public address, and you can have a static private or CGNAT address.

What you need is

• either a public one directly on the Mikrotik's WAN (and it doesn't matter much if it is dynamic)
• or that the ISP would port-forward the TCP port 44158 on one of its public IPs to the one it assigns to your Mikrotik's WAN, and that it would always use that public IP to NAT all the traffic from your Mikrotik (also here the addresses may be dynamic but I guess it would be too complicated for the ISP to link the two addresses together if they are dynamic)

In any case, an application that requires that your computer accepts incoming TCP connections from anywhere in the internet is suspicious to me.

yeah my IP start by 192.168.

should my WAN IP be the same as my public IP?

Also when I use online sites to check if port 44158 is open or closed it always asks to use my public IP to check.

so should the NAT rule I input have my public IP instead of the router’s IP when I port forward?

Sorry, I haven't noticed before your WAN is the LTE interface. While it is possible to get a public IP on a LTE interface, it is rarely the default behaviour, so you'd have to talk to your ISP to get one.

when I use online sites to check if port 44158 is open or closed it always asks to use my public IP to check

That's logical. Public addresses are the only ones to which other devices can connect across the internet. Since your WAN (LTE) address is a private one, "your" public IP is actually one of the public IPs from the pool your ISP is using to NAT the traffic from the customers, and there may be tens to thousands of other customers behind that single public address. As all the ISPs apply a surcharge for assigning a non-shared public address to a customer (it is a scarce resource so it cannot be given out for free), you may find out you'll spend more on the public IP monthly fee than what you earn by mining.

so should the NAT rule I input have my public IP instead of the router’s IP when I port forward?

No. The NAT rule on the Mikrotik must foward whatever arrives to TCP port 44158 on its WAN (LTE) address to port 44158 on the Bobcat Miner address on the LAN, but that's not enough - you would need that the ISP would forward whatever arrives to port 44158 of the public IP it NATs you to to the WAN IP of the Mikrotik, and mobile operators normally don't do this - they work with large scale deployments with no individual adjustments, as maintenance of these individual adjustments would be a nightmare.

So if you think it is worth it, you may want to hire a virtual machine in some datacenter (as such machines must have a public IP in order to be accessible from the internet), set up a tunnel from your Mikrotik to that machine, and port-forward the TCP port 44158 from that machine's address to your Mikrotik via the tunnel. This may or may not be cheaper than getting a public IP for your Mikrotik from the ISP, but it may also affect the rate you get paid for mining, as it apparently depends on the area where you mine, which may be determined by IP address rather than true geolocation. But I'm no expert here.

so my next step then is to get a public IP from my ISP and hopefully that will solve the issue I take it.

do you happen to know a ballpark figure a typical ISP would charge to give out a public IP?

Also at the moment when my router reboots the IP address also changes, will my IP address remain the same once I receive a public IP from my ISP?

do you happen to know a ballpark figure a typical ISP would charge to give out a public IP?

No idea about the prices in your country. Mine takes about USD 5 per month. But I hesitate to call a mobile operator a "typical" ISP.

Also at the moment when my router reboots the IP address also changes, will my IP address remain the same once I receive a public IP from my ISP?

It depends on the ISP's offering, but usually the public IP is statically linked to a SIM. What is even more important is that the ISP would permit incoming connections to that address - reportedly, some don't, although that somehow makes it pointless to have a public IP.

where it says NAT Type - symmetric...the Bobcat Miner requires this to say none to function correctly.

Also where it says my public IP number xxxxx and Bobcat miner private IP xxxx it says closed/timeout...where they should also say open.

is my understanding right in saying once I receive a public IP from my ISP my problem will be solved with this matter?

is my understanding right in saying once I receive a public IP from my ISP my problem will be solved with this matter?

Yes, provided that the ISP will permit incoming connections to that address, and that you will forward port 44158 to the LAN IP of the Bobcat Miner.

what could be the reason why they wouldn’t permit incoming address to the IP?

I’ve managed to phone my ISP and they have given me the IP address for my modem so im now able to make changes within that.

where can I find the IP address within it?

Also do I need to set the NAT rules for port forwarding within the modem as I’ve been setting it within the router instead?

What address is linked to the LTE interface now in IP -> Addresses? Does it still belong to one of the private/cgnat ranges as stated above or not any more?

Assuming your cell carrier is EE in UK, they don't appear to offer a "publicly routable" IP address:
https://community.ee.co.uk/t5/Broadband ... d-p/895303

Is a Bobcat used to provide ISP services on Helium network? Don't take this personally, but maybe if the setting up the NAT is hard, you think about wanting to get in ISP business with your Bobcat.

yes my broadband is through EE Business account so by reading that I should be okay, is that right?

yes my broadband is through EE Business account so by reading that I should be okay, is that right?

Only they'd know how the LTE is setup. Typically "everywhere" as the APN would get you a CGNAT, and not allow forwarding as you desire. @avnu's suggestions are all correct, so those should work. In the US, you need a business account, plus a $500+ fee/min# lines on the account, etc. - varies by carrier. It's none are one call to enable the "feature" and require specific agreements to be signed. I have no idea about the UK.

Good luck with your project.

spoke to my 4G broadband provider and they do not offer static IP addresses.

is there any other way around this issue, I have looked on other forums and others have seemed to over come the problem by letting the router pick up address with DHCP server?

https://community.ee.co.uk/t5/Broadband ... d-p/845730

Also on my modem settings I can see this option where it says Static, Automatic, PPPoE.

Is this an option where I can create my own static IP address perhaps?

Also on my modem settings I can see this option where it says Static, Automatic, PPPoE.

Don't confuse causes and consequences. These settings are there just to allow you to set up your router in accord with what your ISP has set up. You cannot affect how the ISP has done it, you can only accommodate to it. If you set anything else on your router than what the ISP side settings require, it will simply not work at all.

If you cannot get a public address directly at the router at your home or office, your only option to get a "direct" rather than "relayed" connection is to run a virtual router somewhere in a datacenter and set up a VPN tunnel from there to your router at home. Whether it is worth it or not depends on the monthly fee spent for the virtual router and the mining fee earned.

how do I go about setting a VPN up to my router so that I get over this issue?

how do I go about setting a VPN up to my router so that I get over this issue?

The simple answer is "follow the example of a 'road warrior' L2TP/IPsec client (your home router) and L2TP/IPsec server (the virtual one running in the datacenter) in the documentation".

But honestly, I think people should not venture into VPNs before understanding firewalls, and you seem to have serious gaps even in mere networking. So if you just take the steps in the manual, which only concentrate on the VPN itself, your systems will end up with serious security holes.

So I'd recommend that you find someone to do that for you or to read and test a lot before setting up the VPN. Unlike the SOHO models like your Mikrotik at home, the virtual Mikrotik (CHR) comes with no preinstalled firewall rules at all. So before connecting its WAN to the internet (or disabling/modifying the firewall provided by the datacenter, if they provide any), you have to set up firewall rules on it.

As always with security, whoever offers you to take care of your security is in the best position to take it away from you (I'd love to find the original author of this but Google doesn't find it for me again). So an external "someone" will get you up and running in less than an hour, but if you do it yourself, you'll know that there is no backdoor (and if you are really serious about security, your home router will be secured against access from the virtual one, as the guys in the data center may be able to get to its configuration).

I understand my knowledge on all this isn’t up to your guys standards and thats the reason why I’ve come on this forum to be educated in knowing this stuff so I need solutions to my issue.

I’ve now come across this and would like some guidance in incorporating this to the Mikrotik router please.

a simple step-by-step would be outstanding.

https://www.aa.net.uk/broadband/l2tp-service/

I understand my knowledge on all this isn’t up to your guys standards and thats the reason why I’ve come on this forum to be educated in knowing this stuff so I need solutions to my issue.

It has nothing to do with any "us guys' standards" - there is just sufficient knowledge to reach your goal safely or an insufficient one.

The service you've found has an advantage as compared to what I've suggested - the "virtual router in a datacenter" part is provided by them. But their "mikrotik-specific" configuration suggestion is outstandingly poor.

So please either confirm that the configuration export you've provided a few posts above is still valid, or provide a current one, so that we could set it up by step by step modifications of the existing configuration.

I will be going for L2TP option so are you able to give me the step by step in getting it configured into the Mikrotik.

many thanks.

I will be going for L2TP option so are you able to give me the step by step in getting it configured into the Mikrotik.

I take this as a confirmation that the configuration hasn't changed.

Your current firewall rules only protect the router itself from access from anywhere itself but its LAN. But this is sufficient for the first step - to verify that the L2TP link comes up and that you get the public IP address.

So just add the L2TP interface with the proper credentials and some extra settings:
/interface l2tp-client add name=aaisp connect-to=l2tp.aa.net.uk add-default-route=no use-peer-dns=no use-ipsec=no disabled=no user=your-username password=your-password

(of course, replace your-username and your-password by those provided by AAISP). If it works, /ip address print should show you a dynamically added item with a public address linked to interface aaisp. If this step succeeds, we can proceed.

their service is currently not available until 4th January so I'm unable to try that option at the moment.

Am I able to port forward using SSH tunnelling through PuTTY, I have PuTTY available and wondering what configurations I need to do there to get port 44158 open?

Am I able to port forward using SSH tunnelling through PuTTY, I have PuTTY available and wondering what configurations I need to do there to get port 44158 open?

If you can connect using PuTTY to a server running on a public address, and the sshd on the server is configured to accept PuTTY's request to forward a "remote" (from PuTTY's perspective) port, then yes, you can use that to tunnel packets arriving to that port on the public address of the server to the PC where you run PuTTY, but I don't know any way to make the PC forward these packets to the Bobcat Miner except having another PuTTY session established towards either the Bobcat Miner or the Mikrotik. Can the Bobcat Miner act as an SSH server with port tunneling allowed?

Update - a single PuTTY session towards the remote server is enough provided that the PC running the PuTTY can reach the Bobcat Miner.

no I dont think the Bobcat can act as a SSH…looks like I’ll have to wait around and try the last option in trying to get this damn thing working!

Read my previous post.

the login section of the putty is the router IP address and port 22 is it?

Not of the router, of the remote server with a public IP.

where can I find the remote server IP address?

where can I find the remote server IP address?

When you've mentioned PuTTY, I've thought you have a server somewhere which has a public IP on it and you can connect to it using SSH (PuTTY). If you don't have such a server, there's no point in the whole exercise.

Do you happen to have Telegram, Viber, WhatsApp, or some other instant messenger?

yes whatsapp

As private messages have been disabled here again after a few months of working, you can send me your mobile phone number or e-mail address using this instruction (the method at line 16). After creating the-encrypted-short-file, run openssl base64 -e -in the-encrypted-short-file and paste the output of that here as text. My public key follows:

.pem code

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArauOfFEn3Grb2WhnlKe1
hEG9bwq+7fJiDhFyCK+CcmXwQyGWl4LIop5VCTNUYq/++PSFOAmkoLA1+TMTAN6s
f7ukyVErCxpfUMy+xhutVzsVDHIaAScJFr3QUPmI+544EMplZn70DOWIWgv4Xtac
jeiuqJZ2mExt/8amZTQ2dJ3MHmRaD20gUI+ByJwkQopxUZTOfKAXkhkL/HTcksyO
ORSh+EzFN+ll674084RpbXGKnaDYysAObLSib9UgnHnQ98WLbh+4XZqDc6T82mFW
0BcxLI8pUeITwBaexX8YbDYOFnxskLIlGcRb0F9sRGV8as4H5+zuwlO14K1LDb4Y
suNttQSKYFOZ91G2SOBlGiejO2xf7t3spdv0LurOkvvKJo+wOwAhfz/8zBubUBqd
0jXQyzkQ+WkBMzKBYwOl39YQXUHYHxxGUXMupslSyw1qcyW0QeC91hfM+/GNk+j/
+w+lqLV0So2gc8vD/9mVAcMv9g8eSffvwEKygnXsqlg4QLvjCVNu1TMtYH9NJAgs
2VoBgDaAZrc5id9dk41Zh19L4mYJ+uTiafZ/g/5jx5AEjPdVcsKBsatQVld+RuS5
B+kLTXbPuk8kXRLhKuSOEEBGOvXaCvwqNPdvghNOQSvydVOkVyS6/SL5I0UWOg8s
2B5HsHfn4Ph9gjxDMmiUl1UCAwEAAQ==
-----END PUBLIC KEY-----

If you want it simpler, you can post the number to which the whatsapp account is linked, and then edit it out from the post once I send you a message.

If following that instruction doesnt work out, send me the info on my profile email and I will pass it along.

I have no idea what im meant to do with that message

Copy the text from the -----BEGIN PUBLIC KEY----- row to the -----END PUBLIC KEY----- one, both included, into a text file on your PC, named key.txt. Create another text file, phone.txt, with your phone number in it, in the same directory.
Then open a command line window on Windows, cd to the directory where the two files are stored, and run the following commands:

openssl rsautl -in phone.txt -out phone.enc -pubin -inkey key.txt -encrypt
openssl base64 -e -in phone.enc

And copy-paste the output of the second command here.

Hi, I have the L2TP settings up and running, what next?

So you can see the public address to be attached to the L2TP interface? If so, please confirm that 192.168.1.30 is the IP address of the Bobcat Miner.

yes and yes.

yes and yes.

Ok, so first some firewall filter rules:
/ip firewall filter
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward protocol=icmp action=accept
add chain=forward in-interface=aaisp connection-nat-state=dstnat action=accept
add chain=forward in-interface-list=WAN connection-nat-state=!dstnat action=drop

Next, NAT rules, the one to forward incoming traffic to pu.bl.ic.ip:44158 to the LAN address of the Bobcat Miner, and the one to change the source address of whatever leaves via the L2TP interface to the pu.bl.ic.ip assigned to that interface:
/ip firewall nat
add chain=dstnat in-interface=aaisp protocol=tcp dst-port=44158 action=dst-nat to-addresses=192.168.1.30
add chain=srcnat out-interface=aaisp action=masquerade

Next, an additional routing table consisting of a single route:
/ip route
add gateway=aaisp routing-mark=via-aaisp

And, finally, a routing rule causing whatever the Bobcat Miner sends to be sent via the L2TP, no matter whether it is up or or not:
/ip route rule
add src-address=192.168.1.30 action=lookup-only-in-table table=via-aaisp

That should be it. If it works, try to disable the UPNP unless you desperately need it for something else than the Bobcat Miner.

Next, an additional routing table consisting of a single route:
/ip route
add gateway=aaisp routing-mark=via-aaisp

I can't seem to add these?

If so, have you followed my command to add the l2tp client interface to the letter or have you given the interface some other name than aaisp?

I have followed all your instructions and yes I named in aaisp

It makes no sense to me then... I could add a route this way just fine in 6.47.10, so I can't see why it should be a problem in just 6.47.

Do you add it using a command line (the [Terminal] window) or directly using Winbox/WebFig?

sorry I’ve found it now…

I’ve applied all of these and now I cannot connect to my internet at all?

I’ve applied all of these and now I cannot connect to my internet at all?

Give me the current /export hide-sensitive, and tell me how the PC is connected - I was assuming there is a switch between the LHGR and the PC, so the PC gets an own address from 192.168.1.x... is it otherwise? Is the PC connected via the Bobcat Miner?

.,,

Man, you are dangerous to yourself. What has made you make AAISP a member of the interface list LAN? By doing that, you have allowed all the internet to access your Mikrotik via the L2TP interface. And to nail it, you have published the public IP in the export. Leaving aside that you've added more rules than I've told you to.

I literally just noticed that...how do I solve this?

I literally just noticed that...how do I solve this?

Remove AAISP from interface list LAN.

How can you "just notice" something you have actively done???

You forgot the exclamation mark in the last rule in chain forward (the idea is to drop whatever comes in via WAN and is not dstnated, but without the exclamation mark, you only drop what is dstnated).

Youve configured the route via AAISP twice, but none of the two has the routing-mark=via-aaisp; you've set the route rule to use routing table main rather than the via-aaisp one.

And you haven't answered how the PC that cannot access internet is connected.

in the Routing Mark box the only option there is main it does not give me the option of via-aaisp.

my internet is fine now after removing the AAISP from the interface.

in the Routing Mark box the only option there is main it does not give me the option of via-aaisp.

Sure, because for the first time you must type it in manually - either when creating/modifying the route or when creating/modifying the route rule, whichever you do first. When adding the other item, it will be in the list.

my internet is fine now after removing the AAISP from the interface.

That makes little sense to me. Do you mean removing interface AAISP from the interface list named LAN?

That makes little sense to me. Do you mean removing interface AAISP from the interface list named LAN?

yes

I've now added those Route/rules

just checked to see if the ports have been opened on the Bobcat and they still remain closed?

have we missed anything else?

Give me the current export (with the public IP edited out, and also edit it out from the previous post) and tell me from where you check whether the port is open (if you test it from a PC connected to the LAN side of the LHGR, it doesn't show you the reality).

...

I'm using ping.eu with port check to see if 44158 is open and also I can check the status on the Bobcat itself where it also says the port 44158 is closed.

The export seems OK.

BTW, when doing a traceroute to the public address you've leaked from various places in the world, I am getting "network unreachable" from multiple intermediate subnets. It appears to me that the L2TP tunnel is not completely transparent all the way to the internet, which would also explain why, when the route via L2TP was put in routing table main, you've lost internet connection.

So run the following commands in the terminal window:

ping 8.8.8.8 routing-table=main count=3

ping 8.8.8.8 routing-table=via-aaisp count=3

and show me their output.

this is the info off the Bobcat settings which shows it

jan/02/2022 21:49:38 system,error,critical login failure for user admin from 192.168.1.50 via web
[admin@MikroTik] > ping 8.8.8.8 routing-table=main count=3
SEQ HOST SIZE TTL TIME STATUS
0 8.8.8.8 56 113 78ms
1 8.8.8.8 56 113 36ms
2 8.8.8.8 56 113 26ms
sent=3 received=3 packet-loss=0% min-rtt=26ms avg-rtt=46ms max-rtt=78ms

[admin@MikroTik] > ping 8.8.8.8 routing-table-=via-aaisp count=3
expected end of command (line 1 column 14)
[admin@MikroTik] > ping 8.8.8.8 routing-table=via-assisp count=3
input does not match any value of routing-table
[admin@MikroTik] > ping 8.8.8.8 routing-table=via-AAISP count=3
SEQ HOST SIZE TTL TIME STATUS
0 90.155.53.19 56 64 96ms admin prohibited
1 90.155.53.19 56 64 34ms admin prohibited
2 90.155.53.19 56 64 36ms admin prohibited
sent=3 received=0 packet-loss=100%

OK, so as suspected, your account at AAISP is not yet activated or what. You cannot get outside, and nothing can get inside. The address reporting "admin prohibited" is from the same subnet like the one telling me "network unreachable" when I try to traceroute your public IP from outside.

That's about all for now. Once you sort that out with AAISP, try the pinging again, you should get a normal response also when using routing-table=via-aaisp then, and once you do, the Bobcat Miner should be happy too.

ah right okay...thank you so much for your help...you don't know how much I appreciate it.

Either is possible, no way to find out. If it was only rejecting connections from the internet, it could be that they reject them selectively (e.g. only accept them from British IP addresses), but if you cannot even get out, it's not that.

From the outside (internet), the last hop still reports "network unreachable", what has AAISP support told you?

what do I need to ask them as in how shall I word my question?

I would write 'I'm connected to your service via another ISP using L2TP. The L2TP tunnel is up and my Mikrotik got assigned a public IP address x.x.x.x. However, when I ping 8.8.8.8, I'm getting "admin prohibited" from 90.155.53.19; when someone else in the internet pings x.x.x.x, they are getting "network unreachable" from 90.155.53.50. Is something administratively wrong? What am I required to do to make the service start working?'
Replace x.x.x.x with the actual address you've got from them.

thank you, messaged sent and im awaiting a response.

they've sorted it...can you test it now to make sure?

WhatsApp would be much more efficient for this troubleshooting... I'm not getting "network unreachable" any more, but when I try to establish a TCP session to port 44158 at your address, I get no response. So either something is still wrong with AAISP, or with the settings of the Mikrotik, or maybe the Bobcat Miner is not connected, no idea. If you try again the ping 8.8.8.8 routing-table=via-aaisp command, do you get normal responses or some error messages again?

I was getting no errors on the ping test but I’ve checked if port 44158 is open but it remains closed, did we miss anything else?

the settings ‘anav’ has told me to do earlier in this thread…do they still need to be in place or not?

I don't won't lose time to analyze history - give me the current export.

# jan/04/2022 18:42:05 by RouterOS 6.47
# software id = RTPD-F59M
#
# model = R
# serial number =
/interface lte
set [ find ] name=lte1
/interface bridge
add name=bridge1
/interface l2tp-client
add connect-to= disabled=no keepalive-timeout=disabled name=AAISP \
user=
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=everywhere
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 name=defconf
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge1 interface=ether1
/interface list member
add comment=defconf disabled=yes interface=ether1 list=LAN
add comment=defconf interface=lte1 list=WAN
add disabled=yes list=LAN
add interface=bridge1 list=LAN
add disabled=yes list=LAN
/ip address
add address=/24 comment=defconf interface=ether1 network=\

/ip arp
add address= interface=bridge1 mac-address=:AA
/ip dhcp-client
add
/ip dhcp-server lease
add address=30 client-id=:aa mac-address=\
:AA server=defconf
/ip dhcp-server network
add address=24 comment=defconf gateway=netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!LAN
add action=accept chain=forward connection-state=established
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward protocol=icmp
add action=accept chain=forward connection-nat-state=dstnat in-interface=\
AAISP
add action=drop chain=forward connection-nat-state=!dstnat in-interface-list=\
WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address= dst-port=44158 \
in-interface=AAISP protocol=tcp to-addresses=192.168.1.30 to-ports=44158
add action=masquerade chain=srcnat out-interface=AAISP
/ip proxy
set port=1080
/ip route
add distance=1 gateway=AAISP routing-mark=via-AAISP
/ip route rule
add action=lookup-only-in-table routing-mark=via-AAISP src-address=\
192.168.1.30/32 table=via-AAISP
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=lte1 type=external
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

In the single /ip route rule, remove the routing-mark=via-AAISP and leave only the table=via-AAISP in place.

You can also remove to-ports=44158 from the action=dst-nat rule in /ip firewall nat and keep only the dst-port=44158, but it is not critical.

Just for security reasons, disable the /ip proxy unless you know exactly why you have enabled it.

If it still doesn't work, give me a new export.

n the single /ip routing rule, remove the routing-mark=via-AAISP and leave only the table=via-AAISP in place.

I'm getting 'invalid' once I remove Routing Mark and just leaving the table=via-AAISP in place.

Just for security reasons, disable the /ip proxy unless you know exactly why you have enabled it.

this might had been set by my ISP for some reason.

> ping 8.8.8.8 routing-table=via-AAISP count=3
SEQ HOST SIZE TTL TIME STATUS
0 8.8.8.8 56 121 31ms
1 8.8.8.8 56 121 33ms
2 8.8.8.8 56 121 26ms
sent=3 received=3 packet-loss=0% min-rtt=26ms avg-rtt=30ms max-rtt=33ms

I'm getting 'invalid' once I remove Routing Mark and just leaving the table=via-AAISP in place.

That sounds like Winbox or ROS 6.47 bug to me, or a mistake. Show me the screenshot of the Winbox window.

just tried it again and its now allowed the Routing Mark to be removed, don't know why it said invalid earlier.

connected| yes |",
"|dialable | yes |",
"|nat_type |symmetric|",
"| height | 1161110

I'm still getting nat type symmetric on my Bobcat where it should read 'none'

also TCP port 44158 is still closed

I can't believe the Bobcat thing would indeed require to have a public IP directly on itself, as that would significantly reduce the number of people who could deploy it in their networks, especially since the Bobcat team declares that it is enough to have TCP port 44158 open for normal operation and TCP port 22 for remote support if required. There's no real reason why the presence of NAT should impose any limitation on the operation of the device - it can establish outgoing connections anywhere it wants to, and it is able to accept incoming connections arriving to the public IP thanks to the port forwarding.

It should possible to hack it around to put the public IP up at the Bobcat Miner itself, but it is too complicated to set it up this offline way, and I cannot imagine why it should be necessary. Can you post a link to the page which says NAT must be "none"?

Also, open a command line window in Winbox, make it as wide as your screen allows, run /tool sniffer quick port=44158 in it, and run your check whether the port is open.

• if you cannot see any packet at all, AAISP is blocking access to "high" ports for some security reasons;
• if you can see the request packet (with dst-port 44158) to come in via the AAISP (L2TP) interface but not to leave via the bridge and ether1 interfaces, something is wrong about the port forwarding at Mikrotik
• if you can see the request packet to leave via ether1 but no response packet (with src-port 44158) to come in via ether1 and bridge, the Bobcat Miner doesn't respond
• if you cannot see the response packet to leave via AAISP, something is wrong about the routing rule or route
• if you can see the response packet to leave via AAISP but with source address 192.168.1.30, something is wrong with the masquerade rule.

how do I run WinBox on Mac?

or is there another way?

Another way to do what? How do you configure the Tik now, using Web interface? If so, no need to use Winbox, it's just my experience that most users who don't use command line use Winbox, but there are just a few features that are available in Winbox but not in WebFig.

If you have in mind opening the terminal window in order to run /tool sniffer ... , do it the same way you did for the pinging.

There are people here on the forum who managed to run Winbox on MAC using some Windows emulator, I've never needed that myself.

[admin@MikroTik] > run / tool sniffer quick port=44158
bad command name run (line 1 column 1)
[admin@MikroTik] > run /tool sniffer quick port=44158
bad command name run (line 1 column 1)
[admin@MikroTik] >

command not recognised?

The "run" is not part of the command, that's why I always give the command itself in italics. Not my fault that the commands are in English and the forum is in English as well, so the instructions cannot be distinguished from the commands by alphabet.

okay I've ran that command and once again I have no idea what I'm looking at I'm afraid

Copy the output of the command into an editor. Replace any occurrence of your own public IP with my.my.my.my, and replace any occurrence of any other IP address except 192.168.1.30 with out.out.out.out. Post the result.

I cannot see the AAISP IP address anywhere there

That's interesting, but one less thing to worry about. How many distinct IP addresses are there?

[admin@MikroTik] > / tool sniffer quick port=44158
I TIME NUM DI SRC-MAC DST-MAC VLAN SRC-ADDRESS DST-ADDRESS PROTOCOL SIZE
e 45.636 8556 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
b 45.636 8557 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
l 45.636 8558 -> AC:FF:FF:00:00:00 00:D1:E6:E6:E6:E6 in in in in:44158 out out out out:2154 ip:tcp 66
l 45.73 8559 <- 00:D1:E6:E6:E6:E6 AC:FF:FF:00:00:00 in in in in:2154 out out out out:44158 ip:tcp 156
b 45.73 8560 -> 48:8F:5A:1B:03:DA E8:78:29:54:91:AA in in in in:2154 192.168.1.30:44158 ip:tcp 156
e 45.731 8561 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
b 45.731 8562 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
l 45.731 8563 -> AC:FF:FF:00:00:00 00:D1:E6:E6:E6:E6 in in in in:44158 out out out out:2154 ip:tcp 66
l 45.765 8564 <- 00:D1:E6:E6:E6:E6 AC:FF:FF:00:00:00 in in in in:44158 out out out out:44158 ip:tcp 66
b 45.765 8565 -> 48:8F:5A:1B:03:DA E8:78:29:54:91:AA in in in in:44158 192.168.1.30:44158 ip:tcp 66
e 45.766 8566 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:44158 ip:tcp 66
b 45.766 8567 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:44158 ip:tcp 66
l 45.766 8568 -> AC:FF:FF:00:00:00 00:D1:E6:E6:E6:E6 in in in in:44158 out out out out:44158 ip:tcp 66
l 45.947 8569 <- 00:D1:E6:E6:E6:E6 AC:FF:FF:00:00:00 in in in in:44158 out out out out:44158 ip:tcp 66
b 45.947 8570 -> 48:8F:5A:1B:03:DA E8:78:29:54:91:AA in in in in:44158 192.168.1.30:44158 ip:tcp 66
l 48.242 8571 <- 00:D1:E6:E6:E6:E6 AC:FF:FF:00:00:00 in in in in:2154 out out out out:44158 ip:tcp 156
b 48.242 8572 -> 48:8F:5A:1B:03:DA E8:78:29:54:91:AA in in in in:2154 192.168.1.30:44158 ip:tcp 156
e 48.243 8573 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
b 48.243 8574 <- E8:78:29:54:91:AA 48:8F:5A:1B:03:DA 192.168.1.30:44158 out out out out:2154 ip:tcp 66
l 48.243 8575 -> AC:FF:FF:00:00:00 00:D1:E6:E6:E6:E6 in in in in:44158 out.out.out.out:2154 ip:tcp 66

The window is probably not wide enough as the interface names are reduced to a single letter, l for lte, b for bridge, and e for ether1.

This means that something does not work, as the packets sent by the Bobcat itself are not routed via the L2TP interface. But I cannot see the reason from the configuration export. As there was some doubt, post the output of

/ip route rule export

add action=lookup-only-in-table routing-mark="" src-address=192.168.1.30/32 table=via-AAISP

Grrr....

run the following command:

/ip route rule unset [find] routing-mark

and then run the sniffer again as above.

I can now see my IP address

I can now see my IP address

Because back then, you've removed the value of the routing-mark rather than the complete match condition (routing-mark=via-AAISP), so the rule was supposed to act on an empty value and thus it became inactive.

So what does the Bobcat diagnostic show now?

it still shows nat type as symmetric and the port 44158 on the public IP still says closed.

why do you think it still says nat type symmetric instead of none like the Bobcat user manual suggests it should be?

The wording in the manual regarding NAT and "relayed" status is full of "may" and "can", whereas the link on how to make NAT say "none" links leads to a page that recommends to configure dst-nat and states "After waiting for hours, the Relay status disappeared."

The essence is such that the concept requires that the access points (Bobcats & others) could talk to each other directly, without any proxy (aka relay), as the proxy requires some resources, can become a bottleneck etc. That's why you earn less for running a "relayed" access point as compared to a directly accessible one. But the forwarding of TCP port 44158 from the public address, to which the other APs can connect, to the AP running on a private address is sufficient to fulfil that goal - the existence of NAT as such complicates nothing if the port forwarding works.

I can now establish a TCP session to your Bobcat and it even sends a propmt, so other APs can establish connections with it - the port is indeed not closed any more.

So I'd suggest to do what that weird link says - wait a few hours, the Relayed status will likely disappear once the network management processes find out that your machine has become directly reachable.


Now it's time to fix my mistake - there is a rule in /ip firewall filter that says

action=accept chain=forward connection-nat-state=dstnat in-interface=AAISP

There's not much danger, but nevertheless change it to

action=drop chain=forward connection-nat-state=!dstnat in-interface=AAISP

(in plain words - add the exclamation mark to the in-interface value and change the action from accept to drop). I was too fast when composing the rules.

Regarding the /ip proxy being added by your ISP - there is no reason why an ISP should set it.

where the setting for proxy I cant seem to find it

Actually, you can forget it. I never use it, so I was surprised to find it in the export, but in fact it is only there because the port value is set to 1080 rather than the default 8080. But enabled is set to the default value no, so everything is fine. If you want, use a command

/ip proxy set port=8080

and the /ip proxy section will disappear from the export.

So I'd suggest to do what that weird link says - wait a few hours, the Relayed status will likely disappear once the network management processes find out that your machine has become directly reachable.

So few hours have passed - any change of the "Relayed" status?

YEESSSSSS!!!

you are an absolute legend…thank you ever so much!!!

@sindy: Have you been officially nominated for saint already, or should I do it (if I find out how it's done)?

Have you tried to connect any LoRa devices to the Bobcat? Specifically have you tried to see if something like the KNOT works with it? Be curious to know the Bobcat's LoRa performance in this configuration...

Be curious to know the Bobcat's LoRa performance in this configuration...

As compared to what? To other models of Helium hotspots, to Bobcats with relayed connection, something else?

I'm myself more ambitious - I'd like to know how many people have obtained the Bobcat in order to help improve the LoRa coverage in their neighborhood and how many have obtained it just to earn $HNT

Be curious to know the Bobcat's LoRa performance in this configuration...

As compared to what? To other models of Helium hotspots, to Bobcats with relayed connection, something else?

Kinda curious for $500 would thing work, without Helium, to connect a Mikrotik LoRa device to it. And, does the Mikrotik's connect at the distance the Helium network has calculated as the expected range (e.g. does it overshoot or undershoot the Helium networks coverage calculations).

I'm myself more ambitious - I'd like to know how many people have obtained the Bobcat in order to help improve the LoRa coverage in their neighborhood and how many have obtained it just to earn $HNT

But, yeah, I think that was my underlying curiosity. WRT to Helium, I'm just left with who are the actual eventual customers on the Helium network? Maybe just old. That obviously, eventually, effect the value of HNT, I think. But, by the same token, clearly OSS/community-based solutions haven't displaced large incumbent carriers... so will a land grab for a cybercurrancy work – just dunno...

I actually have Band48/CBRS license in US, eNB and FreedomFi (and SDRs too) – all work Mikrotik LTE (with Telit modem), outside Helium. So theoretically could put up a 5G helium hotspot. But just seems the whole mining think seems to be focus of Helium – rather than creating an useable/operational/reliable network – so kinda curious if something like the Bobcat "just works" to provide a network (without all the things a normal WISP worry about.)

And, I guess, curious if @Sparky16 will make any money from actual users, vs just mining a coin. That I think is my real underlying question. Not a WISP myself, but if Helium requires only tuning an antenna to reach further, that makes being a WISP more attractive than worrying about actual service quality or finding customers.

For me, being a WISP is something completely different from being a LoRa access network provider. The way I understand the Helium concept is that the company rolls out a continuous LoRa coverage required to provide country-wide IoT services by means of giving (selling) people not interested in LoRa/IoT at all a device that provides them (or at least promises them) a passive income if they place it "properly" - both geographically (most needed to improve the LoRa coverage) and from the point of view of of reachability from the backbone network (the internet). Hence the differentiation of the earnings depending on the number of radio neighbors and depending on the uplink connectivity (i.e. hotspots directly listening on a public IP earn more than those proxied (relayed) by another node).

The bandwidth the hotspot occupies on its internet uplink is negligible even if it actually delivers the LoRa traffic due to the low throughput of the LoRa radio itself, isn't it? So the "operator of a single hotspot" doesn't care about the actual IoT customers - these customers pay to Helium for the service and the only thing they are interested in is that it works wherever they need it (vehicle and cargo tracking being the most demanding applications here). And Helium redistributes part of the actual customers' payments in the form of $HNT to their "contractors".