Community discussions

MikroTik App
 
SamusAran
just joined
Topic Author
Posts: 12
Joined: Thu Aug 11, 2022 5:34 pm

Slow external requests

Sun Sep 04, 2022 2:40 pm

Greetings,

For the sake of clarity, here is my current physical configuration:

Main firewall:
WatchGuard Firebox T15

Router (behind the firewall):
MikroTik hEX

The T15 is in a separate network (172.16.0.0), but my LAN is in the range 10.0.0.0.
Interface 01 on the T15 is 172.16.0.1 and is plugged in the LAN port 1 of the MikroTik.
Both the T15 and the MikroTik have a route to communicate with each other (including 0.0.0.0 on the MikroTik).

The DNS is the T15 (172.16.0.1). DNS forwarding is activated on the interface 01.
The DHCP server is the MikroTik (10.0.0.1).
The getaway is the MikroTik (10.0.0.1).

The getaway of anything plugged in the LAN is 10.0.0.1 (the MikroTik). The reason I had to do that is because some devices like my Synology NAS or my Nintendo Switch were not able to access anything external when I used 172.16.0.1 as the getaway (this was working nicely in Windows and my cellphone using the wireless with an AP for example).
I was always receiving DNS errors and the Synology NAS was not accepting a getaway outside of 10.0.0.0.

With the getaway as 10.0.0.1, all external request are very slow, like opening a webpage, accessing anything external apparently.
I do not use the MikroTik as a DNS server, DNS cache is also disabled (allow external requests on the DNS options).

With the getaway 172.16.0.1 (for testing purposes), all external requests seems to behave correctly, any external "requests" is at least 4 to 5 times faster than with the MikroTik as a getaway, but as I said, the Synology NAS cannot access the outside with this getaway (for updates etc.) and the Nintendo Switch, 3DS and such give me DNS errors.

What am I missing?

From my point of view, it seems external requests issues are from the MikroTik, maybe I need a firewall rule, a route or another configuration I completely overlooked.

I saw nothing in the T15 logs about delays or long DNS issues/forwarding.

May you help me out with this please?

Thank you for your time, it is greatly appreciated.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Slow external requests

Sun Sep 04, 2022 2:58 pm

The way you described thing it seems as if you had routing triangle ... LAN device sends packet towards intetnet and uses MT as gateway. MT routes packet towards WG which eventally breaks out to internet. Return packet reaches WG and it manages to deliver it directly to LAN device.

The scenario above is just a hunch, without seeing MT config and (at least routing part of) WG config one can not say for sure.

It also serms like you have a few networking concepts confused. The role of gateway is to be part of a subnet and to serve as gateway towards other networks. If LAN clients are members of 10.0.0.1/24 (or any other sensible subnet mask), then their gateway has to be member of same subnet. 172.16.0.1 is (very likely) not and thus can not be gateway for your LAN subnet (some IP stacks can work around this, but it's against concept and good practice).
Another particularity: one IP (L3) subnet can not span multiple ethernet (L2) subnets (without deploying certain features). The other way around - multiple IP subnets on top of single ethernet subnet - can easily be done, but can bring some misbehaviours due to confusion about which device can communicate with which device and how (directly or via a gateway). So unless there's a solid need for it, it's best to avoid such setup.
The most straight forward way of getting rid of the minor problems you see would be to separate the both subnets you have ... either physically or via VLANs. I'm not going to get into details of either one, you have to think over it first and if you need any help,advice ... just ask.

A conceptual question: why do you need MT? You've got WG (I'm assuming it can also route between your WAN and LAN) ...
 
SamusAran
just joined
Topic Author
Posts: 12
Joined: Thu Aug 11, 2022 5:34 pm

Re: Slow external requests

Sun Sep 04, 2022 3:52 pm

Greetings,

I will try to answer what you asked/said as best as I possibly can:

The way you described thing it seems as if you had routing triangle ... LAN device sends packet towards intetnet and uses MT as gateway. MT routes packet towards WG which eventally breaks out to internet. Return packet reaches WG and it manages to deliver it directly to LAN device.

Is there a way to resolve this? Do you need other information?

It also serms like you have a few networking concepts confused. The role of gateway is to be part of a subnet and to serve as gateway towards other networks. If LAN clients are members of 10.0.0.1/24 (or any other sensible subnet mask), then their gateway has to be member of same subnet. 172.16.0.1 is (very likely) not and thus can not be gateway for your LAN subnet (some IP stacks can work around this, but it's against concept and good practice).

I completely agree with you there, I never intended to use 172.16.0.1 as a getaway, I only did it for testing purposes. I do understand that a getaway is the way "out" of a subnet.

Another particularity: one IP (L3) subnet can not span multiple ethernet (L2) subnets (without deploying certain features). The other way around - multiple IP subnets on top of single ethernet subnet - can easily be done, but can bring some misbehaviours due to confusion about which device can communicate with which device and how (directly or via a gateway). So unless there's a solid need for it, it's best to avoid such setup.

Right now, this is a lab, I had the devices and also wanted to use both, the goal was to setup a firewall in a different subnet than the LAN, while still being able to access both easily, without needing to change my IP configuration or actually switching cables. I do understand it might not be "conventional", I am also not a network expert, but my goal is to learn, hence why I set myself some "uncommon" objectives.

The most straight forward way of getting rid of the minor problems you see would be to separate the both subnets you have ... either physically or via VLANs. I'm not going to get into details of either one, you have to think over it first and if you need any help,advice ... just ask.

Physically would mean to have them both having WAN access completely separated right? Like both using the WAN interfaces with a separate cable? This is the setup I was trying to avoid in the first place, mostly for management and as I said earlier to access both devices for configuration purposes. As for VLANs, I had a project to set one up in the MikroTik after finishing the whole WAN/LAN to learn them, the project is to se one up for IP cameras and eventually a security door system, using RFID or NFC tags.

A conceptual question: why do you need MT? You've got WG (I'm assuming it can also route between your WAN and LAN) ...

Mostly to learn both devices, also, as I said, I had both and wanted to do something with both as a lab. It is also a way to reproduce setups I have seen in enterprises a few times and to get familiar with it.

As you can see, I am not an expert, the goal is to learn how things work and get a better understanding of the concepts. Also to challenge myself with different setups.

Also, here are the routes I have:

T15:
Kernel IP routing table
Destination     Gateway         Genmask         Interface       Flags   Metric
0.0.0.0         69.70.245.89    0.0.0.0         eth0            UG      5
10.0.0.0        0.0.0.0         255.255.0.0     eth1            U       0
10.0.0.0        172.16.0.1      255.0.0.0       eth1            UG      1
69.70.245.88    0.0.0.0         255.255.255.252 eth0            U       0
127.0.0.0       0.0.0.0         255.0.0.0       lo              U       0
172.16.0.0      0.0.0.0         255.240.0.0     eth1            U       0
192.0.0.0       0.0.0.0         255.0.0.0       eth2            U       0

Note;
- 10.0.0.254 is the IP the T15 uses to be able to access the MikroTik subnet.
- You can ignore eth2 completely, I do not use it/have nothing plugged in it right now.

MikroTik:
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 A S  0.0.0.0/0                          10.0.0.254                1
 1 ADC  10.0.0.0/8         10.0.0.1        bridge                    0
 2 A S  172.16.0.0/12                      10.0.0.254                1

Thank you for your time and help again, it is greatly appreciated.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Slow external requests

Sun Sep 04, 2022 10:27 pm

You'll have to get things in line on both devices.

Seems like T15 has address 10.0.x.y/16, MT has route towards 10.0.0.0/8 via T15.
Seems as if MT doesn't have 172.16.x.y set on bridge ... it has route towards 172.16.0.0/12 via gateway but should be showing connected route via interface, just like it has it for 10.0.0.0/8.

About the routing triangle: problem is that MT has both addresses set to same interface. Which triggers it to send out ICMP redirect messages with new gateway address - it'll send T15's address from 10.0.0.0/8 subnet to 172.16.0.0/12 clients ... some of clients will know how to desl with it, some will choke.
Since it's your lab setup, you're welcome to experiment. I highly doubt it'll work the way you'd like as long as both networks share L2 networks.

Who is online

Users browsing this forum: Bing [Bot], Google [Bot], RogerWilco and 99 guests