Community discussions

MikroTik App
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

NAT not working routeros 7.2.1

Mon Apr 18, 2022 8:45 pm

Hi guys.

I'm having a problem right now. I have a RB1100AHx4 in a DataCenter, cofigured from zero, but always looking into an old mikrotik (wich is still working) config, trying to respect everything, so the change should be transparent for everyone. I did't do an export/import thing because the old mikrotik has routeros 6.11 and the 85% of the rules inside /ip firewall are useless (this router had more than 10 administrators till I came up, so, as I wanted to do things right, I'm replacing it with a newer one with the last routeros (7.2.1 today) and a bounch set of security configs and optimized rules.

The thing is that when we get this guy into production, all the servers in the DC had internet, the see each other and all that stuff but, some things didn't go as expected.

First of all, the NAT table did't have a single hit, so, when we try to get into some server from out HeadQuarters to the DC, we couldn't. Not hits in any of the rules and don't know why.

Second thing is that there are some webs pages there (the DC) but for some reason, we couldn't access them.

And last of all the problems, WireGuard didn't work as expected also. I should get into some servers using i.e RDP, but we couldn't, nor using ping or whatever you could imagine. I should have said that while I'm doing this in the DC, I'm doing the same thing in the HQ, with the difference that in the office, everything worked perfectly fine, but for some reason, in the DC didn't.

Any magical idea?

Thanks, Leo
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Mon Apr 18, 2022 9:41 pm

Not without
a. network diagram
b. /export file=anynameyouwish

just be sure to blank out any public IPs or public gateway IPs, usually not a problem.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: NAT not working routeros 7.2.1

Mon Apr 18, 2022 9:53 pm

[...]this router had more than 10 administrators till I came up, so, as I wanted to do things right, I'm replacing it with a newer one with the last routeros (7.2.1 today) and a bounch set of security configs and optimized rules.[...]
Any magical idea?
Thanks, Leo
Nope, can't even think what might be wrong in that scenario, besides everything.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Mon Apr 18, 2022 10:07 pm

Hi anav.

What about this...
You do not have the required permissions to view the files attached to this post.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: NAT not working routeros 7.2.1

Mon Apr 18, 2022 10:44 pm

We know that a picture speaks a thousand words, and you can keep one picture, the network diagram.
But please replace the other two with an actual config export.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 12:10 am

Ok ok, so, here's my config.

Please, be nice with your feedback, this is my first time setting up a mikrotik from zero and I've put a lot of effort and time on them.

Thanks guys...
You do not have the required permissions to view the files attached to this post.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 12:12 am

Correct, the network diagram is excellent.
Pictures are good but really for specific questions and would ask for the pictures then.

Since the configs part are often interrelated, its very pertinent to see the rules in context to one another.
Thanks, I will be gentle LOL.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 12:14 am

What is interesting is no bridge and no vlans. I am not used to such a config but it could work.
I will try to concentrate on the essentials. You must know that I dont believe in many firewall rules besides the default ones plus whatever traffic the admin wants to allow.
I put DROP ALL rules at the end of the input and forward chain and not much more is required in reality. So I will ignore the majority of the bloatware as I like to call it.!
No offence meant, just usually what happens when new users spend too much time on youtube etc..

Personally I am not sure how to deal with the fact that ether10 has two IP addressess, so not sure how IP addresses are allocated when a device is attached to the port for example.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 1:42 am

I'm not trying to understand it all, there's too much stuff, but just about NAT:

- rule #3 is the same as #1, so #3 is useless
- #5 is more limited version of #4, so #5 won't be ever used (and if access is supposed to be limited by source in #5, it isn't, because #4 allows it from everywhere)
- #13 (with action=accept) looks like wrong copy of #14
- other dstnat rules seem ok
- srcnat is completely broken, because the unconditional masquerade rule overrides all following, so none of them will be used, and it also masquerades all incoming dstnatted connections

@anav: It's just multiple per-interface LANs, nothing unusual. And there's no problem with two addresses on same interface, connected devices can simply be in both subnets.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 1:48 am

Sob so are there two NIC cards required in the computer, how does one populate two nic cards with one ethernet cable?
You are not explaining my dhcp question......
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 1:55 am

@anav: You didn't mention DHCP before, and if you look in config, there isn't any. So if it's just static config (perfectly plausible for datacenter), it means that if you connect switch to ether10, then to switch you can connect devices configured with both 172.18.1.x/24 and 192.168.22.x/24. And even if there was only one cable and one device, there's still no problem, it can have two subnets on one interface, same as router does.

And one more thing about NAT, dstnat rules are for various dst-address=2XX.XX.XX.xxx, but router has only one, 2XX.XX.XX.98/28. And if whole subnet is on WAN like this, ISP's router won't be able to find any other 2XX.XX.XX.xxx. So you probably want all of them on "ether1 - WAN".
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 4:29 am

You are right, clueless about data centers and there are no dhcp servers or dhcp server networks and only 3 pools which connect to I dont know what LOL.......
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 3:59 pm

And one more thing about NAT, dstnat rules are for various dst-address=2XX.XX.XX.xxx, but router has only one, 2XX.XX.XX.98/28. And if whole subnet is on WAN like this, ISP's router won't be able to find any other 2XX.XX.XX.xxx. So you probably want all of them on "ether1 - WAN".
Sob, in your first answer, you are righ, that was a kind of crazy stuff...when things didn't go as expected, I did some new rules based on what I was trying to get working...in the original config, all that double rules were not there. Same as the masquerade...that was another crazy thing because thing weren't going as expected.
Then, you are saying that I should have in my /ip address list, all the range of my public ips? It's not enough to have the first one, with the mask, and assume that the router will know wich are the other ones? I assumed that already, because when I put a net, i.e 192.168.255.1/24 over eth8, nobody mention all the ips under a certain network. But if the problem is that you have to do it when you're talking about public ips, ok, no problem.
Thing is that, when we plugged that router in and put it into production, I had all the publics ips of my range but disabled...seeing that the nat wasn't working, I enabled them but nothing happened. I assume then that that wasn't the problem.

Any more ideas?
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11381
Joined: Thu Mar 03, 2016 10:23 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 5:55 pm

Then, you are saying that I should have in my /ip address list, all the range of my public ips? It's not enough to have the first one, with the mask, and assume that the router will know wich are the other ones? I assumed that already, because when I put a net, i.e 192.168.255.1/24 over eth8, nobody mention all the ips under a certain network. But if the problem is that you have to do it when you're talking about public ips, ok, no problem.

When you set router interface with xx.yyy.zzz.www/mask, you're simply telling router: this is your address and there other addresses in the same subnet and you can reach them directly without using a gateway. Router has no idea about "private" vs. "public" addresses or "LAN" vs. "WAN" interface. So if you configure LAN interface as 192.168.88.1/24, it doesn't mean all the subnet addresses belong to router, rather that there are up to 252 other devices in the same subnet, directly accessible.
Likewise setting public address with some (long, e.g. /29) netmask means that there are other devices accessible through same interface. And if ISP router address is in the same subnet (one of possibilities), then also ISP router will expect that it can deliver packets to any of those addresses directly. For that some device needs to be explicitly set with IP address and that device will then "grab" packets targeting itsown address. If indeed whole subnet belongs to your router, then you have to set all those addresses to WAN interface.

The other possibility is that ISP router has IP address in separate subnet, your router WAN address has to be set to another address from ISP router's subnet and then your router is explicitly used as gateway for public subnet assigned to you and you don't have to set all addresses on WAN interface (not even one), you can use them in any way you want.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 7:00 pm

I just see a bearded clam. It amazes me sometimes, mkx and sob, that you can pull stuff out of the hairy mess.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 8:40 pm

@mkx, ok, so, as it was on the begining, should work just fine (don't know why it didn't).

So, here's an image of my actual NAT table and Adress List.

If you prefer, I can do a print over NAT and /ip address list, edit it and upload it (to avoid uploading the whole configuration again, that is the same as the one that uploaded yesterday, I just edited the NAT and Adress List).

Anything that you see it's missing? Should work everything like this?

Thanks everybody...

PS: I assume (I couldn't confirm it yet) that the public ip that finishes with .97 it's from my ISP, so, it's my gateway, so, that range covers ips from .97 to .110 and I can use ips from .98 to .110
You do not have the required permissions to view the files attached to this post.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 9:02 pm

It's like this:

- your router has only 2XX.XX.XX.98/28
- ISP's router has 2XX.XX.XX.97/28 (which is used as gateway by your router)
- ISP's router receives packet for 2XX.XX.XX.99
- it knows that .99 is in connected subnet
- it sends ARP request saying "hey, tell me, who got 2XX.XX.XX.99?"
- your router receives the request and thinks to itself "not me, that's for sure"
- ISP's router gets no response, so it gives up and sends ICMP host unreachable to original sender

If you prepare it in advance while not being connected in final location, it's really easy to test these things, just use another router (I'm sure you have some), configure it as ISP's router (with 2XX.XX.XX.97/28), connect it to this one, then connect your PC to another subnet behind this testing router, and you can test all public addresses, dstnat rules and everything. You can see rules getting hit (or not). If you want to be absolutely sure, you can connects other testing devices in all those internal subnets, and see if it gets to them.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Tue Apr 19, 2022 11:51 pm

It's like this:

- your router has only 2XX.XX.XX.98/28
- ISP's router has 2XX.XX.XX.97/28 (which is used as gateway by your router)
- ISP's router receives packet for 2XX.XX.XX.99
- it knows that .99 is in connected subnet
- it sends ARP request saying "hey, tell me, who got 2XX.XX.XX.99?"
- your router receives the request and thinks to itself "not me, that's for sure"
- ISP's router gets no response, so it gives up and sends ICMP host unreachable to original sender
Let me know if I'm correct. You're saying that my router says "not me, that's for sure" if I've only enable the address 2XX.XX.XX.98/28, right? In case it's enabled like it's right now, everything should work just fine, right?

Do you/somebody see any problem in the actual NAT/Address list right now?

The new router it's just connected to a server right now...waiting for its moment to shine! If nobody sees nothing that may fall into a problem when we put it into production, on Thursday morning I'll give it another oportunity to shine. I'll just wait for your comments to be a bit more sure that everything should work.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 12:04 am

It should be better. But if you want to be sure, test it (see my previous post), then you won't have to wait until the final moment to see whether it shines or blows.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 3:43 pm

Ok, great.

So, I have to set up another mikrotik (I think I have a 951 over here) and just set the 2XX.XX.XX.97/28 in the address list for its eth1, for example, and connect eth1 from this 951 to the WAN of the big one, right? Then, connect a pc/laptop to another eth of the 951 and try to reach some public ips of the big one and see if there are any hits in the nat table, right? If that is how I think you said, I'll be doing it in a few hours and then, post the results.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 6:58 pm

If you prepare it in advance while not being connected in final location, it's really easy to test these things, just use another router (I'm sure you have some), configure it as ISP's router (with 2XX.XX.XX.97/28), connect it to this one, then connect your PC to another subnet behind this testing router, and you can test all public addresses, dstnat rules and everything. You can see rules getting hit (or not). If you want to be absolutely sure, you can connects other testing devices in all those internal subnets, and see if it gets to them.
If I got you right, it should be like this, right?
You do not have the required permissions to view the files attached to this post.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 8:02 pm

That's the way. Now if you connect something to 951's bridge (while keeping it otherwise disconnected from real internet), you can test your public addresses and see if everything works. Well, it won't work completely, if you don't have all those devices connected behind the other router, but at least you'll see that rules gets some hits. Or you can add even those (one by one) if you want.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 8:12 pm

@Sob, I'll connect a real server to the big Mikrotik, so, I've added a new rule to the NAT, and, if everything works as it shoulds, the notebook of the diagram should reach the server with rdp protocol. I've a partner going to the DC right now to connect everything and then I'll do the test. I'll post how it was everything in a few minutes...
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 8:28 pm

I thought the idea was to test it before you connect it for real.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Wed Apr 20, 2022 8:55 pm

Yes, and in fact, it's a test. Nothing was connected to the router but an eth of a server (that I really don't care much about it). The fact is that the Nat is getting hits right now! We couldn't manage to RDP to that server, but at least, all NAT roules now are dancing nicely.

I think that tomorrow morning (it's 14.53 here now) will put into production and see if it works as it should!

I'll post whatever it's going on, I hope that only good news now!

If all NATs works well, I hope that WireGuard do the same and behaves as it should...
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Thu Apr 21, 2022 3:49 pm

And yet another day with the same issue. Almost not nat at all. I'm going to investigate a little bit more the old router (wich is the one that is running right now) and do some diagrams to expain with a little more of detail the infra that we have in the DC and where did we got some hits in the nat and where just not and don't know why. 10 minutes to 10 a.m. here, so, the day it's in its very beginnings. In an hour or so I'll upload the diagram with details and some explanation, and then, wait for your feedback.

Read you later...
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Thu Apr 21, 2022 10:42 pm

Well, the day turn out bad. 5 and a half hours later I could finish with the Visio to show you some thing. At 10 a.m. I had a lot of thing in mind with that drawing but in the end we had so many problems to solve that I can't remember what I was thinking at 10 a.m., so, down here you'll se the diagram and here in the post I'll explain some things that happened.

First of all we only disconnect eth1 and 6 from the old router and connect them to the new one to ports 1 and 7 respectively (because of different configurations between the old and the new one).
That eth7 it's connected (like the rest of the eth, besides eth1 of course) to a switch, and that switch goes to the eths of one esxi, right? Well, "under" that eth7 it's the 254.0/24 subnet, so, from "My PC" in the office I tried to connect to some servers that are in the 254.0/24 subnet, but couldn't, AND AGAIN, nothing was happening in the NAT table. As I stayed at the office (because if the new router worked as it should, I would proceed to replace the Mikrotik of the HQ) a partner went to the DC with a laptop and I told him to plug that laptop into eth11...made some rules to get that laptop src nated to use the 2XX.XX.XX.98 to reach out internet, then, made another rule, a dst-nat one that said that, for my 2xx.xx.xx.98:5555, forward all to the laptops IP, port 3389 and then I tried to connect through RDP to that laptop and couldn't BUT NAT RULE WAS RECEIVING HITS! Firewalls laptop was disabled just in case, but I couldn't connect to it. I really didn't care to much, because I wanted to connect to the servers, not to a laptop. So I disabled all the drop rules that I have in Filter and Raw and tried to connect again to 3 different servers, but again, couldn't, and yet again, Nat wasn't registring any hit at all. That laptop was receiving internet through a hotspot wifi from a smartphone and I could connect to that laptop using AnyDesk, so, when I was inside that laptop using anydesk I tried to connect to all the servers that were in the 254.0/24 subnet using private and public IP and, yes, I could...obviously, it was connected directly to the router, so, no surprise there.
So, after trying this and that, I couln't connect to any server. Knowing that It wouldn't work, tried to connect to the rest of the servers using "their" public IP just to see if any nat rule registered any hit, but nothing happens.
The only rule that registered some hits by its own, was one that it's a dst-nat and said that, for 2XX.XX.XX.100 ports TCP 21,80,3306,3389, action was dst-nat to 192.168.250.11. That server is one of the servers with more use of the company I think...it has a program developed by some other partners and it's consulted by almost every machine of the company, so, I guess that those hits were for its port 80, and don't know why, that rule registered hits almost continuosly.
I don't know if there's something wrong with some src-nat or what. I really don't have a clue right now where the problem is.

Any ideas?

Thanks
You do not have the required permissions to view the files attached to this post.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Fri Apr 22, 2022 12:35 am

How much sure are you that you correctly transfered even the basic network config from old router to new one? I mean, take all those public addresses for example, does old router have them all assigned like this? If it does, did you just overlook them by mistake when you were creating first config? That would be strange. Or is it that the old router doesn't have them like this and it works in some different way?
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Fri Apr 22, 2022 1:04 am

When I was setting up the new router, I had the old router in a winbox on my left screen and the new one in the right screen, so, as I didn't do an export and import from one to another (because the old routers has so many thing that shouldn't be or no longer exist) I was very careful when I was setting up everything, and looking at least twice each rule, config or whatever. Even after the first attempt, when things went more or less like today, I spent 2 or 3 days just looking into every single detail to not come into a mistake again.

If you want, tomorrow I can upload the config of the actual ("old") mikrotik and you can see how everything is setted up and try to understand this malfunction, to call it in some way.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Fri Apr 22, 2022 5:42 am

I picked addresses as example for a reason. It's easy to make a mistake if you're redoing big firewall. But it shouldn't happen with few addresses that you shouldn't be changing at all, if you're just replacing previous router. Does the old router have them all on WAN or not? Because if this config is correct, then there isn't much that could block access to these addresses. It could be blocked in "/ip firewall raw" (I don't see any obvious mistake there), but if not, dstnat rules must get hits (even if it wouldn't work completely, because something else would be wrong after that).

You can post the old config. I don't think I'll be able to check everything (there's too many unfamiliar subnets and rules even in your new optimized one), but at least some basic stuff, or maybe someone else will have more patience.

Btw, I found why WG didn't work as expected, it conflicts with IPSec policies, they apply (and filter packets) even when peer is disabled.
 
leobmw320
newbie
Topic Author
Posts: 25
Joined: Fri Apr 30, 2021 11:44 pm

Re: NAT not working routeros 7.2.1

Fri Apr 22, 2022 7:22 pm

@Sob, yes the Old router has them all in eth1, you can check it here. And, yes in one of the attempts, when I tried to get it started, as I could do the WG to start trafficking, I tried to set up the IPSEC and well, it doesn't work, of course.

Well, after more than 3 hours of editing, I have the export-compact file of the "old" router, the one that is working in the DC.

I've deleted a lot of lines in Nat, Filter, etc, that were disabled or misconfigured. So I started up with a 1279 lines file and ended up with a 300 lines file.

I hope that someone can read it and detect the explanation of why this old router is working and why the new one doesn't.

Thanks everyone...
You do not have the required permissions to view the files attached to this post.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: NAT not working routeros 7.2.1

Sun Apr 24, 2022 2:30 am

Nope, I don't see it. If you added all those public addresses the same way as old router has them, i.e. the new one now has:
/ip address
add address=2XX.XX.XX.98/28 interface="ether1 - WAN" network=2XX.XX.XX.96
add address=2XX.XX.XX.99/28 interface="ether1 - WAN" network=2XX.XX.XX.96
...
add address=2XX.XX.XX.110/28 interface="ether1 - WAN" network=2XX.XX.XX.96
Then they must be reachable. You must be able to ping them and dstnat rules must get hits when you try to connect to their addresses and ports. Two things could prevent it. One is something wrong in "/ip firewall raw", but I don't see it. You can avoid that either by enabling this rule:
/ip firewall raw
add action=accept chain=prerouting comment="defconf: enable for transparent firewall" disabled=yes
Or just by disabling all raw rules. Another thing could be some communication problem between this and ISP's router, but no idea what could it be. I'm sure that trial & error, testing different things, can get you to the final goal, but I understand that it's not good trying that in production without knowing how long will it take. If you could connect both routers at the same time and give the new one only one or few less important address(es) (after disabling them on old router) that can have some outage, it would help, you could debug what happens with those.
Last edited by Sob on Sun Apr 24, 2022 3:56 am, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: NAT not working routeros 7.2.1

Sun Apr 24, 2022 2:40 am

I would scratch all the bloatware firewall rules and focus on only the real things needed for connectivity (that includes disabling raw rules as well, as suggested for troubleshooting).
- port scanners etc...

Not sure why you resort to port knocking and other things.........

_ I would be tempted to setup two routers, an edge router and then the main router.........
and move all bloat ware to the edge router........... divorced from all the real traffic flow vice the blocking flow at the edge.

Use something like https://itexpertoncall.com/promotional/moab.html as well on edge router.

Who is online

Users browsing this forum: FlowerShopGuy, johnson73, loloski and 82 guests