Community discussions

 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 7:36 pm

<t>Hello,<br/>
I am new to Mikrotik, may you help ... ?<br/>
Current Scenario : LAN > ASUS Router {Tomato Firmware in "Router Mode" NOT "Gateway Mode" > SXT LTE > WAN > ISP<br/>
{ASUS provides WIFI & DHCP server & runs Adblock}<br/>
All works good.<br/>
<br/>
Question: Is it possible to replace the ASUS with Mikrotik RB2011UiAS-2HnD-IN with same setup, minus the Adblock (which I can do on a Raspberry PI).<br/>
Thanks in advance,</t>
 
anav
Forum Guru
Forum Guru
Posts: 2731
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 7:42 pm

I dont see why not.
The only queston I have is why choose any particular model for the router, (what are your requirements))
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 7:52 pm

Great.
Requirements - basic small office / home.
Next question, is their a setup guide for this, or what is the equivalent Mikrotik mode to Router mode only, NOT Gateway mode ?
 
anav
Forum Guru
Forum Guru
Posts: 2731
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 8:22 pm

Mikrotik is not a consumer oriented plugNplay router.
It does come with a default setup that is secure and is up and running right away.
Plug your WAN cable into ether1 and your LAN into 2,3,4,5 etc and you are up and running on 192.168.88.1 network.
That is the quickset format and simply works!

Then you will want to start tweaking the setup and you must tread slowly. One area at a time.
There is a safe mode at the top of winbox that I use. whenever I do something that is illegal (would lock me out and have to reset to defaults and start over) the router simply kicks me out and allows me to log back in as if I were at the point before doing the stupid config change.

Yes, please download and use winbox as your front end tool to configure the router.!!!

As for router................ assuming you want it to be a wifi router then the hap ac2 is a decent choice.
If you are a power user the RB4011 is a beast!!

Personally I am not a fan of combining my wifi and router in one because wifi changes more rapidly and I like to put it where it makes most sense for wifi.
For wired home office I would look at the RB450Gx4 router board (plus enclosure and power supply) and again of course the beast RB4011 (non wifi variant).



Depends a lot on expectations and usage................
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 8:57 pm

Thank you for the time you invested in your reply, of which I do not wish to seem disrespectful. Thank you also for the recommendation of "hap ac2", may I ask if you recommend it over the "rb2011UiAS-2HnD-IN" ? I have a wifi LAN only.

However, as I have stated I have a SXT LTE, implying I have used Winbox for my current setup.
What I need is direction as to what tweak to make first to have the new Mikrotik perform as a "router" only ie no NAT and no firewall or is it as simple as un-ticking these boxes ?
I am not asking for babysitter...
 
anav
Forum Guru
Forum Guru
Posts: 2731
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 9:32 pm

Sorry Gerry, I have no experience with SXT so didnt realize you were conversant so to speak.
I gather you are getting internet then from wifi and your router is an ALL IN ONE unit distributing wired and wifi interent to your home/office.
You probably know more than I, so I am probably of no much further help, other than to say I would never setup my router without a firewall.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Sob
Forum Guru
Forum Guru
Posts: 4157
Joined: Mon Apr 20, 2009 9:11 pm

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 9:53 pm

It's a router, it routes by default anything it knows how and where. So if all you need is simple router without NAT and anything, then:
1) Create bridge for LAN and add all interfaces except the one connected to SXT.
2) Addresses and routing:
/ip address
add address=<external address>/<mask> interface=<external interface>
add address=<internal address>/<mask> interface=<internal interface (bridge)>
/ip route
add dst-address=0.0.0.0/0 gateway=<default gateway>
3) Use the helpful "DHCP Setup" button in IP->DHCP Server for nice step-by-step config.
4) Basic wifi AP config is something like:
/interface wireless security-profiles
add authentication-types=wpa2-psk name="My AP" wpa2-pre-shared-key=<wifi password>
/interface wireless
set [ find default-name=wlan1 ] country="<where you live>" frequency-mode=regulatory-domain \
    mode=ap-bridge security-profile="My AP" ssid=<SSID> wireless-protocol=802.11
 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Re: Mikrotik RB2011 in "Router" Mode

Wed Mar 20, 2019 9:57 pm

No Problem & thanks for trying.
For anyone else - I will detail a little more clear.
Current Setup : ISP > SXT LTE (3G internet connection) > Physical ethernet cable to ASUS Router (running Tomato in "Router Mode" NOT "Gateway Mode" > WIFI internet connection.
Firewall IS running on SXT LTE with enabled DHCP server AND NAT. Firewall is disabled on ASUS, but has enabled DHCP server.
 
anav
Forum Guru
Forum Guru
Posts: 2731
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Mikrotik RB2011 in "Router" Mode

Thu Mar 21, 2019 2:51 am

It may be useful to post your SXT config then, but only if you are having issues down the line.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Re: Mikrotik RB2011 in "Router" Mode

Fri Jun 14, 2019 10:36 pm

Hello (again..) I purchased a hap ac2 (192.168.2.1). To avoid any setup errors - I did a fresh install (routeros-arm-6.44.3) via Netinstall & did not use QuickSet.
I manually set up all as per "https://wiki.mikrotik.com/wiki/Manual:I ... figuration" excluding wifi (I will do later).
I "think" I followed the above instruction (thank you).
I can ping SXT (192.168.88.1).
Problem(s): I cannot ping 1.1.1.1 or do I have internet access.

Any direction as how to narrow the problem is much appreciated,
{The SXT setup works perfect with my ASUS router, so I only wish to change the hap ac2 setup}

SXT LTE Config

Code: Select all

# jun/14/2019 19:40:30 by RouterOS 6.42.1
# software id = Z1Q2-GX3Z
#
# model = RBSXTR
# serial number = 99850980033F
/interface lte
set [ find ] band=20 mac-address=AC:FF:FF:00:00:00 name=lte1 network-mode=\
gsm,3g
/interface bridge
add admin-mac=B8:69:F4:01:34:19 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=hs.vodafone.ie
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=30m name=\
defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
192.168.88.0
/ip dhcp-server lease
add address=192.168.88.251 client-id=1:a0:8c:fd:fe:bf:3 mac-address=\
A0:8C:FD:FE:BF:03 server=defconf
add address=192.168.88.250 client-id=1:60:a4:4c:6c:b:b1 mac-address=\
60:A4:4C:6C:0B:B1 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=Bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\
d this subnet before enable it" list=Bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=Bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=Bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
need this subnet before enable it" list=Bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=Bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
Bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=Bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=Bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=Bogons
add address=224.0.0.0/4 comment=\
"MC, Class D, IANA # Check if you need this subnet before enable it" \
list=Bogons
add address=192.168.2.16 comment="tablets list" list=tablets
add address=192.168.2.15 list=tablets
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
# inactive time
add action=reject chain=forward comment="tablet restriction morning" \
connection-state=established,new fragment=no reject-with=\
icmp-host-unreachable src-address-list=tablets time=\
10h-13h30m,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment="tablet restriction evening" \
connection-state=established,new reject-with=icmp-host-unreachable \
src-address-list=tablets time=15h5m-17h,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment=\
"tablet restriction remove for Adelya to call Russia !" connection-state=\
established,new reject-with=icmp-host-unreachable src-address-list=\
tablets time=17h15m-19h15m,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment="tablet restriction night" \
connection-state=established,new dst-address-type="" hotspot="" \
reject-with=icmp-host-unreachable src-address-list=tablets time=\
20h45m-23h15m,sun,mon,tue,wed,thu,fri,sat
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
Bogons
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="###NAT for 192.168.2.0/24###" \
src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping distance=1 dst-address=192.168.2.0/24 gateway=\
192.168.88.250
/snmp
set trap-interfaces=all
/system clock
set time-zone-name=Europe/Dublin
/system ntp client
set enabled=yes primary-ntp=89.234.64.77 secondary-ntp=193.1.12.167
/system routerboard settings
set silent-boot=no
/tool graphing interface
add interface=lte1
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set port=lte1 receive-enabled=yes
hap ac2 config

Code: Select all

RBD52G-5HacD2HnD
# serial number = B4A00A0DD983
/interface bridge
add name=bridgeall_exceptSXT
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
set [ find default-name=wlan2 ] ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.2.2-192.168.2.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridgeall_exceptSXT name=\
dhcp1
/interface bridge port
add bridge=bridgeall_exceptSXT interface=ether2
add bridge=bridgeall_exceptSXT interface=ether3
add bridge=bridgeall_exceptSXT interface=ether4
add bridge=bridgeall_exceptSXT interface=ether5
add bridge=bridgeall_exceptSXT interface=wlan1
add bridge=bridgeall_exceptSXT interface=wlan2
/ip address
add address=192.168.88.1/24 interface=ether1 network=192.168.88.0
add address=192.168.2.1/24 interface=bridgeall_exceptSXT network=192.168.2.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.2.0/24 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-address=192.168.88.1 \
to-addresses=192.168.2.0/24
add action=src-nat chain=srcnat disabled=yes src-address=192.168.2.0/24 \
to-addresses=192.168.88.1
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add check-gateway=ping distance=1 gateway=192.168.88.249
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 1229
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Randburg
Contact:

Re: Mikrotik RB2011 in "Router" Mode

Sat Jun 15, 2019 1:23 pm

I am not really sure you are successfully pinging the SXT (192.168.88.1) as both devices have that same IP config on ether1 interfaces, so your config seems totally incorrect .

You already have a "router / firewall / DHCP / etc" in the SXT, why not make the Hap AC2 a "switch+AP" only device?

See topic below, @vecernik87 even provided a cool script to do all the config for you, for this exact model device you have, Hap AC2.

viewtopic.php?f=2&t=149144
MTCNA, MTCTCE, MTCRE & MTCINE
 
Gerry123
just joined
Topic Author
Posts: 7
Joined: Wed Nov 14, 2018 9:14 pm

Re: Mikrotik RB2011 in "Router" Mode

Mon Jun 17, 2019 4:57 pm

Thank You for direction. It was incorrect. I did think something was wrong with the ping time, it was also incorrect.
I believe its fixed. Working for one day with no issue...
Thank you for the alternative suggestion, but if I did that I would learn less...

@Sob by using DHCP client "add address=<internal address>/<mask> interface=<internal interface (bridge)>" was done automatically. Is this correct ?

General question: I have set-up static ip addresses in the DHCP server & they work as expected.
When a device requests a static ip (that it is free) it gets it & works as expected.
However it does not display this static ip in the DHCP server / Leases. Is it possible to display them here (they appear under Torch).

hapac2 -

Code: Select all

# jun/17/2019 14:23:23 by RouterOS 6.44.3
# software id = QHJT-8N12
#
# model = RBD52G-5HacD2HnD
# serial number = B4A00A0DD983
/interface bridge
add name=BridgeAllExceptSXTP1
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=3 band=2ghz-b/g/n country=\
ireland disabled=no frequency-mode=regulatory-domain mode=ap-bridge ssid=\
MikroTik24
set [ find default-name=wlan2 ] antenna-gain=3 band=5ghz-a/n/ac country=\
ireland disabled=no frequency-mode=regulatory-domain mode=ap-bridge ssid=\
MikroTik50
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
dynamic-keys supplicant-identity=MikroTik wpa2-pre-shared-key=Adelya1234
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.3.2-192.168.3.100
/ip dhcp-server
add address-pool=dhcp disabled=no interface=BridgeAllExceptSXTP1 name=Mydhcp
/interface bridge port
add bridge=BridgeAllExceptSXTP1 interface=ether2
add bridge=BridgeAllExceptSXTP1 interface=ether3
add bridge=BridgeAllExceptSXTP1 interface=ether4
add bridge=BridgeAllExceptSXTP1 interface=ether5
add bridge=BridgeAllExceptSXTP1 interface=wlan1
add bridge=BridgeAllExceptSXTP1 interface=wlan2
/interface list member
add interface=ether1 list=WAN
add interface=BridgeAllExceptSXTP1 list=LAN
/ip address
add address=192.168.3.1/24 interface=BridgeAllExceptSXTP1 network=192.168.3.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.3.2 client-id=N300A-IP mac-address=7C:2F:80:FC:FE:98 \
server=Mydhcp
add address=192.168.3.16 client-id=1:38:2d:e8:b7:64:22 comment=Adelyas_Tablet \
mac-address=38:2D:E8:B7:64:22 server=Mydhcp
add address=192.168.3.15 client-id=1:48:88:ca:49:6f:4e comment=MJTablet \
mac-address=48:88:CA:49:6F:4E server=Mydhcp
add address=192.168.3.17 comment=gerry-Latitude-E5430-non-vPro mac-address=\
3C:A9:F4:4C:23:4C server=Mydhcp
add address=192.168.3.18 client-id=1:b8:81:98:ac:bb:c9 comment=\
Gerry_Adelya-HP mac-address=B8:81:98:AC:BB:C9 server=Mydhcp
add address=192.168.3.20 client-id=1:54:27:1e:4b:7:a4 comment=htpc \
mac-address=54:27:1E:4B:07:A4 server=Mydhcp
/ip dhcp-server network
add address=192.168.3.0/24 dns-server=192.168.3.19 gateway=192.168.3.1
/ip dns
set allow-remote-requests=yes servers=192.168.3.19
/ip dns static
add address=192.168.3.1 name=router.lan
/ip firewall filter
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=ether1 \
out-interface-list=all
/system clock
set time-zone-name=Europe/Dublin
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
SXT Lte

Code: Select all

# jun/17/2019 14:24:43 by RouterOS 6.42.1
# software id = Z1Q2-GX3Z
#
# model = RBSXTR
# serial number = 99850980033F
/interface lte
set [ find ] band=20 mac-address=AC:FF:FF:00:00:00 name=lte1
/interface bridge
add admin-mac=B8:69:F4:01:34:19 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=hs.vodafone.ie
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=30m name=\
defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
192.168.88.0
/ip dhcp-server lease
add address=192.168.88.250 client-id=1:60:a4:4c:6c:b:b1 mac-address=\
60:A4:4C:6C:0B:B1 server=defconf
add address=192.168.88.100 client-id=1:74:4d:28:41:ca:49 mac-address=\
74:4D:28:41:CA:49 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=Bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\
d this subnet before enable it" list=Bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=Bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=Bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
need this subnet before enable it" list=Bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=Bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
Bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=Bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=Bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=Bogons
add address=224.0.0.0/4 comment=\
"MC, Class D, IANA # Check if you need this subnet before enable it" \
list=Bogons
add address=192.168.2.16 comment="tablets list" list=tablets
add address=192.168.2.15 list=tablets
add address=192.168.3.15 list=tablets
add address=192.168.3.16 list=tablets
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
# inactive time
add action=reject chain=forward comment="tablet restriction morning" \
connection-state=established,new fragment=no reject-with=\
icmp-host-unreachable src-address-list=tablets time=\
10h-13h30m,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment="tablet restriction evening" \
connection-state=established,new reject-with=icmp-host-unreachable \
src-address-list=tablets time=15h5m-17h,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment=\
"tablet restriction remove for Adelya to call Russia !" connection-state=\
established,new reject-with=icmp-host-unreachable src-address-list=\
tablets time=17h15m-19h15m,sun,mon,tue,wed,thu,fri,sat
# inactive time
add action=reject chain=forward comment="tablet restriction night" \
connection-state=established,new dst-address-type="" hotspot="" \
reject-with=icmp-host-unreachable src-address-list=tablets time=\
20h5m-23h15m,sun,mon,tue,wed,thu,fri,sat
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
Bogons
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="###NAT for 192.168.2.0/24###" \
src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="### NAT for 192.168.3.0/24 ###" \
src-address=192.168.3.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping comment=tomato distance=1 dst-address=192.168.2.0/24 \
gateway=192.168.88.250
add check-gateway=ping comment="hap ac2" distance=1 dst-address=\
192.168.3.0/24 gateway=192.168.88.100
/snmp
set trap-interfaces=all
/system clock
set time-zone-name=Europe/Dublin
/system ntp client
set enabled=yes primary-ntp=89.234.64.77 secondary-ntp=193.1.12.167
/system routerboard settings
set silent-boot=no
/tool graphing interface
add interface=lte1
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set port=lte1 receive-enabled=yes
 
Sob
Forum Guru
Forum Guru
Posts: 4157
Joined: Mon Apr 20, 2009 9:11 pm

Re: Mikrotik RB2011 in "Router" Mode

Thu Jun 20, 2019 2:48 am

Yes, DHCP client does add address.

And I don't understand the part about static leases. They are in same list as dynamic ones. So if you defined them and they work, they can't be there more than they already are. There's probably some misundestanding here.

Who is online

Users browsing this forum: No registered users and 17 guests