Ping is possible, no internet access (http)

alve89 · Wed Oct 26, 2022 9:58 pm

Hi guys,

I have a RBD52G with default configuration which I wanted to connect to the internet via a Fritzbox.

When I’m in the FBs LAN (192.168.99.0/24) I can access the internet properly.
When I’m in the MTs LAN (192.168.1.0/24), I can ping addresses (from both WiFi client and routers terminal) but I can’t open any website. I also can access my FB

In Quick Set, NAT is activated, so in the firewall section masquerade is enabled on the srcnat chain with out.interface must WAN.

With /tool traceroute on google.com the last shown IP (142.251.209.142) belongs to Google…

[admin@MikroTik] > /tool traceroute
address: google.com
# ADDRESS LOSS SENT LAST AVG BEST WORST STD-DEV STATUS
1 192.168.99.1 0% 319 0.3ms 0.3 0.3 0.9 0.1
2 91.65.154.xxx 0% 319 9.3ms 21.1 8.2 143.5 17.2
3 83.169.179.22 0% 319 12ms 21.2 5.9 128.4 18
4 88.134.193.162 0% 319 8.9ms 22.4 7.9 187.4 19.6
5 145.254.3.196 0% 319 12.9ms 23.9 8.1 171.9 20
6 145.254.2.215 0% 319 16ms 27.1 13.3 99.2 15.7
7 145.254.2.215 0% 319 31ms 27 13.4 121.9 17.5
8 72.14.216.250 0% 319 15.8ms 26.3 12.9 118.1 17.9
9 216.239.63.19 0% 319 18ms 26.9 12.9 144.1 19.3
10 142.251.244.105 0% 319 15ms 26 12.9 97 14.6
11 142.251.209.142 0% 319 16.5ms 26 12 109.2 16.7

So my question is: What do I need to do / configure to be able to access the internet properly?

I’m quite new to Mikrotik and routerOS, so any help is highly appreciated!

Many thanks in advance and best regards
Stefan

anav · Wed Oct 26, 2022 10:04 pm

You are fired quickset is a word most people have set on their forum settings to then ignore all posts from a user...........

Also the lack of a config file is a real turn-off
/export file=anynameyouwish (minus serial number and any public wanip Info)

alve89 · Wed Oct 26, 2022 10:26 pm

Thank you for your very quick (and honest) reply.

Here’s my config:

# oct/26/2022 21:18:49 by RouterOS 6.49.6
# software id = 1758-TR55
#
# model = RBD52G-5HacD2HnD
# serial number = XXXXXXXXX
/interface bridge
add admin-mac=DC:2C:6E:E9:71:DC auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=germany disabled=no distance=indoors frequency=auto installation=\
    indoor mode=ap-bridge ssid=XXXXXXXXX wireless-protocol=802.11 wps-mode=\
    disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=germany disabled=no distance=indoors frequency=\
    auto installation=indoor mode=ap-bridge ssid=XXXXXXXXX wireless-protocol=\
    802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik wpa-pre-shared-key=XXXXXXXXX \
    wpa2-pre-shared-key=XXXXXXXXX
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
    192.168.1.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/Berlin
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

alve89 · Wed Oct 26, 2022 10:34 pm

I found the error - the old DNS gateway was still in use (192.168.88.1). Sorry for this unnecessary issue and a nice evening to all!

Ping is possible, no internet access (http)

Ping is possible, no internet access (http)

Re: Ping is possible, no internet access (http)

Re: Ping is possible, no internet access (http)

Re: Ping is possible, no internet access (http)

Who is online