Community discussions

just joined
Topic Author
Posts: 2
Joined: Sat Nov 10, 2018 1:34 am

DHCP Server on guest network is invalid - why?

Sat Nov 10, 2018 2:14 am

Can anybody help me investigate why my second DHCP server on virtual, guest WiFi does not work?
"dhcp_guest" gets invalid. Clients connect to the wireless network but do not get an IP address.

Attaching configuration dump:

Code: Select all

[PiC@MikroTik] > export
# nov/10/2018 01:05:34 by RouterOS 6.43.4
# software id = DMMJ-9EXT
# model = 951G-2HnD
# serial number = 5D6105175B23

/interface bridge
add fast-forward=no name=bridge-guest
add admin-mac=E4:8D:8C:82:37:D7 auto-mac=no fast-forward=no name=bridge-local

/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway speed=100Mbps
set [ find default-name=ether2 ] name=ether2-master-local speed=100Mbps
set [ find default-name=ether3 ] name=ether3-slave-local speed=100Mbps
set [ find default-name=ether4 ] name=ether4-slave-local speed=100Mbps
set [ find default-name=ether5 ] name=ether5-slave-local speed=100Mbps

/interface l2tp-server
add name=DOM-vpn-l2tp user=PiC_vpn

/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN

/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=******** wpa2-pre-shared-key=********
add authentication-types=wpa2-psk mode=dynamic-keys name=WPA2+MAC radius-mac-authentication=yes supplicant-identity=MikroTik wpa-pre-shared-key=******** wpa2-pre-shared-key=********
add authentication-types=wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys name=WPA2-guest supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm wpa-pre-shared-key=******** wpa2-pre-shared-key=********

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-eC country=poland default-authentication=no disabled=no frequency=auto mode=ap-bridge security-profile=WPA2+MAC ssid=****** wireless-protocol=802.11
add default-ap-tx-limit=209712 default-client-tx-limit=52424 disabled=no mac-address=E6:8D:8C:82:37:DB master-interface=wlan1 name=wlan2 security-profile=WPA2-guest ssid=GuestNet

/ip ipsec proposal

set [ find default=yes ] enc-algorithms=aes-128-cbc

/ip pool
add name=IPpool_local ranges=
add name=IPpool_vpn ranges=
add name=IPpool_guest ranges=

/ip dhcp-server
add address-pool=IPpool_local authoritative=after-2sec-delay disabled=no interface=bridge-local lease-time=12h name=dhcp_local
add address-pool=IPpool_guest disabled=no interface=bridge-guest name=dhcp_guest

/ppp profile
add bridge=bridge-guest change-tcp-mss=yes dns-server= local-address=IPpool_guest name=profile-guest remote-address=IPpool_guest use-encryption=yes
add bridge=bridge-local change-tcp-mss=yes dns-server= local-address=IPpool_vpn name=profile-local remote-address=IPpool_vpn use-encryption=yes
set *FFFFFFFE bridge=bridge-local dns-server= local-address=IPpool_vpn remote-address=IPpool_vpn

/snmp community
set [ find default=yes ] addresses=

/interface bridge filter
add action=drop chain=forward in-interface=wlan2
add action=drop chain=forward out-interface=wlan2

/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
add bridge=bridge-local interface=ether3-slave-local
add bridge=bridge-local interface=ether4-slave-local
add bridge=bridge-local interface=ether5-slave-local
add bridge=bridge-guest interface=wlan2

/ip neighbor discovery-settings
set discover-interface-list=discover

/interface l2tp-server server
set default-profile=profile-local enabled=yes ipsec-secret=******** use-ipsec=yes

/interface list member
add interface=ether2-master-local list=discover
add interface=ether3-slave-local list=discover
add interface=ether4-slave-local list=discover
add interface=ether5-slave-local list=discover
add interface=wlan1 list=discover
add interface=bridge-local list=discover
add interface=wlan2 list=discover
add list=discover
add interface=DOM-vpn-l2tp list=discover
add interface=ether2-master-local list=mactel
add interface=wlan1 list=mactel
add interface=ether2-master-local list=mac-winbox
add interface=wlan2 list=mactel
add interface=wlan1 list=mac-winbox
add interface=wlan2 list=mac-winbox
add interface=ether1-gateway list=WAN
add interface=bridge-local list=mactel

/interface pptp-server server
set default-profile=profile-local max-mru=1460 max-mtu=1460

/interface sstp-server server
set default-profile=default-encryption

/interface wireless access-list
add ap-tx-limit=2097152 client-tx-limit=524288 comment="Wszyscy goscie moga sie tu laczyc. Ograniczenie down=2Mbs up=512Kbs" interface=wlan2
add comment="Laptop HP Izabela " mac-address=20:10:7A:01:94:F8
add comment="Moja Nokia Lumia 735 " mac-address=48:50:73:0E:83:14
add comment="telefon Izabeli - Samsung Galaxy Trend Plus" mac-address=00:73:E0:A9:B6:A7
add comment="Tablet Izabelci" mac-address=08:D8:33:64:65:27
add comment="HTPC WiFi" mac-address=C4:E9:84:8D:F4:B6
add comment="Przemus Laptop - HP EliteBook 840" mac-address=AC:7B:A1:97:A1:8F vlan-mode=no-tag
add comment="Huawei Print Server" disabled=yes mac-address=00:24:D2:1A:5F:82 vlan-mode=no-tag
add comment="Telefon Mamy (Nokia Lumia 635)" disabled=yes mac-address=48:86:E8:15:F5:98 vlan-mode=no-tag
add comment="Drukarka Brother DCP-9015CDW" mac-address=70:77:81:A5:97:FC vlan-mode=no-tag
add comment="Telefon Izabeli LG Q6" mac-address=10:F1:F2:01:0B:0E vlan-mode=no-tag
add comment="Kamera IP Foscam C2" mac-address=AC:83:F3:59:F4:95 vlan-mode=no-tag
add comment="DELL Izabeli" mac-address=38:DE:AD:7C:FB:78 vlan-mode=no-tag

/ip address
add address= comment="default configuration" interface=ether2-master-local network=

/ip cloud
set ddns-enabled=yes

/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1-gateway

/ip dhcp-server lease
add address= client-id=1:ac:83:f3:59:f4:95 comment="Foscam IP Camera - static IP" mac-address=AC:83:F3:59:F4:95
add address= client-id=1:C4:E9:84:8D:F4:B6 comment="HTPC - static IP" mac-address=C4:E9:84:8D:F4:B6
add address= client-id=1:70:77:81:A5:97:FC comment="Drukarka Brother DCP-9015CDW - Static IP" mac-address=70:77:81:A5:97:FC

/ip dhcp-server network
add address= comment="default configuration" dns-server= gateway= netmask=24
add address= dns-server= gateway=

/ip dns
set allow-remote-requests=yes

/ip dns static
add address= name=router

/ip firewall filter
add action=reject chain=input comment="PiC - disable acess to winbox from Internet" dst-port=8291 in-interface=ether1-gateway protocol=tcp reject-with=icmp-network-unreachable
add action=drop chain=forward comment="Block SSL Certificate issuer: pudelek" protocol=tcp tls-host=*
add action=drop chain=input comment="Rule to allow Web Proxy to block sites" dst-port=8080 in-interface=ether1-gateway protocol=tcp
add action=accept chain=forward comment="Access to printer from GuestNet" dst-address= src-address= src-address-list=""
add action=reject chain=forward comment="PiC - Disables connectivity of GuestNet to local resources" dst-address= reject-with=icmp-network-unreachable src-address= src-address-list=""
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="PiC - to allow vpn" protocol=gre
add action=accept chain=input comment="allow sstp" disabled=yes dst-port=443 protocol=tcp
add action=drop chain=input comment="default configuration" in-interface=ether1-gateway
add action=accept chain=forward comment="default configuration" connection-state=established,related
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add action=accept chain=input comment=UDP protocol=udp

/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="masq. vpn traffic" disabled=yes dst-address= src-address=
add action=redirect chain=dstnat comment="Transparent Proxy to allow blocking sites" dst-port=80 protocol=tcp to-ports=8080
add action=dst-nat chain=dstnat comment=eMule disabled=yes dst-port=39311 protocol=tcp to-addresses= to-ports=39311
add action=src-nat chain=srcnat comment="VPN access to IP Camera" dst-address= src-address= to-addresses=

/ip proxy
set cache-administrator="Zly Dziubang" enabled=yes parent-proxy= src-address=

/ip proxy access
add action=deny dst-host=*
add action=deny dst-host=*
add action=deny dst-host=*

/ip route
add disabled=yes distance=1 gateway=

/ppp l2tp-secret
add address= comment=to_co_zawsze_cyfrowo_+_+_to_co_zawsze_cyfrowo secret=********
add address= secret=********

/ppp secret
add disabled=yes name=vpn password=********
add name=PiC_vpn password=******** profile=profile-local
add name=Guest_vpn password=******** profile=profile-guest

/system clock
set time-zone-name=Europe/Warsaw

/system leds
set 0 interface=wlan1

/system ntp client
set enabled=yes primary-ntp=

/system routerboard settings
set auto-upgrade=yes silent-boot=no

/system script
add dont-require-permissions=no name="Fix Broken Wireless Following an Upgrade" owner=PiC policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/interface wireless\
\nreset-configuration 0\
\nreset-configuration 1\
\nset 0 name=\"wlan1\" mtu=1500 l2mtu=1600 mac-address=E4:8D:8C:82:37:DB \\\
\n arp=enabled mode=ap-bridge ssid=\"********\" \\\
\n frequency=auto band=2ghz-b/g/n channel-width=20/40mhz-eC \\\
\n scan-list=default wireless-protocol=802.11 vlan-mode=no-tag vlan-id=1 \\\
\n wds-mode=disabled wds-default-bridge=none wds-ignore-ssid=no \\\
\n bridge-mode=enabled default-authentication=no default-forwarding=yes \\\
\n default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=yes \\\
\n security-profile=WPA2+MAC compression=no \
\nset 1 name=\"wlan2\" mtu=1500 l2mtu=1600 mac-address=E6:8D:8C:82:37:DB \\\
\n arp=enabled master-interface=wlan1 \\\
\n ssid=\"GuestNet\" vlan-mode=no-tag vlan-id=1 wds-mode=disabled \\\
\n wds-default-bridge=none wds-ignore-ssid=no bridge-mode=enabled \\\
\n default-authentication=yes default-forwarding=yes \\\
\n default-ap-tx-limit=2097152 default-client-tx-limit=524288 hide-ssid=no \\\
\n security-profile=WPA2-guest\
\n/interface wireless\
\nenable 0\
\nenable 1\

/tool mac-server
set allowed-interface-list=mactel

/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
Last edited by czernekp on Sat Nov 10, 2018 8:05 pm, edited 1 time in total.
Posts: 44
Joined: Sat May 05, 2018 11:55 am

Re: DHCP Server on guest network is invalid - why?  [SOLVED]

Sat Nov 10, 2018 6:19 pm

No IP address assigned to bridge-guest
/ip address
add address= interface=bridge-guest
That should fix DHCP leases, guest devices might be able to perform DNS lookups as you have specified dns= rather than for /ip dhcp-server network and the bridge filter forwards apply to traffic being forwarded through the bridge rather than IP stack (wlan2 traffic will go through the bridge input/output chains, not forward, to the mikrotik itself).

You don't really need a bridge-guest if the only member will be wlan2 - you could apply the DHCP server and any firewall rules directly to wlan2, otherwise best practice would be to use a new-style VLAN aware bridge.

Also, the existing LAN IP address is on one of the bridge-local members rather than the bridge itself (address= interface=ether2-master-local should be address= interface=bridge-local), this may have been the automatic master-port to bridge update not completely working.
just joined
Topic Author
Posts: 2
Joined: Sat Nov 10, 2018 1:34 am

Re: DHCP Server on guest network is invalid - why?

Sat Nov 10, 2018 8:50 pm

Thank you, thank you, thank you! Not only have you sent a prompt reply, it was also correct, valid and understandable. You brought me the faith in the communities' answers back.
1. Yes, adding "address= interface=bridge-guest" solved my problem. I wish I saw some relationships diagram between Router OS entities.
2. I presume I should change "dns=" to "dns=" - not really understood why, but I've changed it to and still works OK (when trying to resole my problem myself, I just saw somewhere on this forum that someone had a shared dns IP over few networks - just gave it a try...).
3. I had to create bridge-guest because DHCP server would not get created on wlan2 directly - I get an error from Mikrotik "Couldn't change DHCP Server <dhcp_guest> - can not run on slave interface (6)".
4. I wish I knew (and understood) how new-style VLAN aware bridge could be setup. Is there a step-by-step instruction for newbies on Mikrotik's wiki for this?
5. And yes, you are 100% right about "address= interface=ether2-master-local" - it must had been an initial wizard's setup. I had corrected that to "address= interface=bridge-local".
Thank you again!

Who is online

Users browsing this forum: No registered users and 11 guests