Community discussions

MikroTik App
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Winbox does not find hAP ac

Fri Jan 13, 2023 11:36 pm

Hi, this is my configuration:
The mikrotik is connected to a modem router (router 1) on the wan port and receives the ip from the router 1.(dhcp client)
Another router (router 2) is also connected to the modem via the wan and also receives an ip from router 1.
All devices are in the 192.168.88.0/24 network.
The Mikrotik has its own dhcp server where it manages 192.188.0.1/24
The router 2 has its own dhcp server where i t manages 192.188.1.0/24
I have to use winbox from the router 2 network (192.188.1.0/24) and be able to connect to the mikrotik.
What configuration do I have to do to be able to connect to mikrotik?

Thanks.
P.S. Sorry for my poor english
 
erlinden
Forum Guru
Forum Guru
Posts: 1920
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 12:10 am

As described you would have to make available access on the WAN port of the MikroTik. Just open the Winbox port on the WAN port input chain...that is it.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 12:20 am

another zombie for botnets...
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 10:48 am

As described you would have to make available access on the WAN port of the MikroTik. Just open the Winbox port on the WAN port input chain...that is it.
I opened the input port to the WAN but it doesn't work.
Last edited by superman71 on Sat Jan 14, 2023 1:08 pm, edited 2 times in total.
 
User avatar
broderick
Member Candidate
Member Candidate
Posts: 242
Joined: Mon Nov 30, 2020 7:44 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 12:44 pm

what about exporting your setup file? Hide sensitive data before you post it here
Last edited by BartoszP on Sun Jan 15, 2023 9:35 am, edited 1 time in total.
Reason: no need to quote previos post ... we can follow the stream of discussion
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 1:10 pm

My configuration:
 jan/14/2023 12:01:39 by RouterOS 7.7
 software id = xxxxxx

 model = RB962UiGS-5HacT2HnT
 serial number = xxxxxx
/interface bridge
add name=LAN
/interface wireless
set [ find default-name=wlan2 ] ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk,wpa2-eap mode=dynamic-keys name=xxx \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=xxxxx \
    default-forwarding=no disabled=no mode=ap-bridge security-profile=xxx \
    ssid=xxxxx wireless-protocol=802.11 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=LAN name=dhcp1
/interface bridge port
add bridge=LAN interface=ether2
add bridge=LAN interface=ether3
add bridge=LAN interface=ether4
add bridge=LAN interface=ether5
add bridge=LAN interface=wlan1
/ip address
add address=192.168.1.1/24 interface=LAN network=192.168.1.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=192.168.1.253 comment="xxxxx" \
    mac-address=xxxxxx server=dhcp1
add address=192.168.1.252 comment="xxxxxx=\
    xxxxx server=dhcp1
add address=192.168.1.251 comment="xxxxxx=\
    xxxxxxx server=dhcp1
add address=192.168.1.250 comment="xxxxxx=\
    xxxxxx server=dhcp1
add address=192.168.1.249 comment="xxxxxx" mac-address=\
    xxxxxxx server=dhcp1
add address=192.168.1.248 comment="xxxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.247 comment="xxxxx" mac-address=\
    xxxxx server=dhcp1
add address=192.168.1.246 client-id=1:xxxxxx comment=xxx \
    mac-address=xxxxxxx server=dhcp1
add address=192.168.1.244 comment="xxxxx" mac-address=xxxxxxx \
    server=dhcp1
add address=192.168.1.242 comment="xxxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.240 comment="xxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.239 comment="xxxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.238 comment="xxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.237 comment="xxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.236 comment="xxxxx" mac-address=\
    xxxxxx server=dhcp1
add address=192.168.1.233 client-id=1:xxxxx comment=\
    xxxxx mac-address=xxxxxx server=dhcp1
add address=192.168.1.232 client-id=1:xxxxx comment=Rxxxxx \
    mac-address=xxxxx server=dhcp1
add address=192.168.1.231 client-id=1:xxxxx comment=xxxxx \
    mac-address=xxxxxx server=dhcp1
add address=192.168.1.235 client-id=1:xxxxx comment=xxxxx \
    mac-address=7xxxxxxxx server=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.1.1
/ip firewall address-list
add address=192.168.88.0/24 list=ACCESSO-RB
add address=192.168.0.0/24 list=ACCESSO-RB
/ip firewall filter
add action=accept chain=input comment=ACCESSO-RB dst-port=22,80,8291 \
    protocol=tcp src-address-list=ACCESSO-RB
add action=drop chain=input comment="DROP SERVIZI RB" dst-port=\
    22,80,8291 protocol=tcp
add action=accept chain=input comment="ACCEPT ENSTABIBLISHED RELATED" \
    connection-state=established,related
add action=accept chain=input comment="ACCEPT ECHO REQUEST" icmp-options=8:0 \
    protocol=icmp
add action=drop chain=input comment="DROP EVERYTHING ELSE" in-interface=\
    ether1
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward dst-address-list=192.168.88.0/24 \
    src-address-list=192.168.1.0/24
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.1.0/24
/ip firewall service-port
set irc disabled=no
set rtsp disabled=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=80
set ssh port=22
set api disabled=yes
set winbox port=8291
set api-ssl disabled=yes
/system clock
set time-zone-name=xxxxxxx
/system ntp client
set enabled=yes
/system ntp client servers
add address=pool.ntp.org
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 5:12 pm

My guess: check your address list ACCESSO-RB in the first firewall rule
/ip firewall filter
add action=accept chain=input comment=ACCESSO-RB dst-port=22,80,8291 \
    protocol=tcp src-address-list=ACCESSO-RB

As a test: disable that firewall rule, see if it works then. If it works, you know the problem is there.
Check the connection list for winbox access then to see which subnets you need to add.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 5:45 pm

E' tutto un pasticcio...

comunque incolla questo nel terminale:
/ip firewall address-list
add address=192.168.1.0/24 list=ACCESSO-RB
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 6:10 pm

Grazie. Cosa intendi per tutto un pasticcio? Come posso sistemare il tutto? Ho seguito una guida ma il Firewall proprio non riesco a digerirlo.
Last edited by BartoszP on Sun Jan 15, 2023 9:35 am, edited 1 time in total.
Reason: stop quotting whole previos posts ... no need to repeat it
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 6:40 pm

Fatti aiutare da @anav, ha scritto pure una guida, cercala sul forum
Prima che ci riprendano, scriviamo in inglese....
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 7:49 pm

E' tutto un pasticcio...

comunque incolla questo nel terminale:
/ip firewall address-list
add address=192.168.1.0/24 list=ACCESSO-RB
Sorry, but not work.
Could the problem be that it has to connect to the WAN?
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 8:17 pm

Fatti aiutare da @anav, ha scritto pure una guida, cercala sul forum
Prima che ci riprendano, scriviamo in inglese....
Translation your firewall rules SUCK!
Keep the default rules, add user needed rules, drop all else.

From the link - viewtopic.php?t=180838

Recommend:

/ip firewall filter
{Input Chain}
(default rules)
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
(user rules)
add action=accept chain=input src-address=list=Authorized
add action=accept chain=input in-interface-list=LAN dst-port=53,123 protocol=tcp { access to dns and ntp services }
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=udp
add action=drop chain=input comment="drop all else" *****
{forward chain}
(default rules)
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
(user rules)
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat
add action=drop chain=forward


Note1: Where Authorized is a firewall address list for the admin to access the router and consists of
add ip of admin (at desktop) list=Authorized
add ip of admin (at ipad ) list=Authorized
add ip of admin ( remote vpn like wireguard ) list =Authorized

Let me get this straight,
a. you do not have a public IP address.
b. you have two routers attached to the ISPs modem router.
c. R1 which you have access too is the mikrotik hapac2 but the router you are trying to reach it from is a big UNKNOWN and we dont even know if you can access it.??????

Q. WTF model of router is at R2? and if its a mikrotik where is the config..........??? you only provide config of R1.


In any case,..........
Access is predicated by a few things..............
-winbox service allowed addresses, if left blank all addresses are permitted
-mac-winbox setting in the config should include an interface list which may be blocking access depending
-firewall rules in the input chain could be an issue.

So, Your config is missing the settings..........
/tool mac-server mac-winbox
set allowed-interface-list=LAN ** or any interface list you create.................. If missing not sure what the outcome is.............. But it probably defaults to ALL, which is fine in terms its not causing issues in your case.

Finally being in a different subnet with no real linkages, winbox via mac may not find the hapac.............. without some additional help and thats assuming both routers are MT.

+++++++++++++++++++++++++++
Consider rejigging your setup, why use three routers......
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sat Jan 14, 2023 10:09 pm

Let me get this straight,
a. you do not have a public IP address.

My public ip is provided to me by the isp router.

b. you have two routers attached to the ISPs modem router.

Yes.

c. R1 which you have access too is the mikrotik hapac2 but the router you are trying to reach it from is a big UNKNOWN and we dont even know if you can access it.??????
I have three routers.
1. Isp 2. Mikrotik 3. Fritzbox
I have access to all

My network was split with two cascading routers from the ISP to split the home network (PCs and phones) with Fritzbox, and from an external IoT network Mikrotik.
IoT network just needs to connect to the internet.
But I need to reach some IPs in the Fritzbox router network via Netwatch.

From the internal network of the Fritzbox I need to connect to the Mikrotik via the winbox.

The fritzbox and the mikrotik are connected to the WAN towards the ISP.
Do you think this is possible?

In the meantime, I change the firewall configuration. Thanks for everything.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 1:11 am

Okay then the confusion is your use of Modem Router, it is not a router and ONLY a modem which can spit out more than one public IP. If it was also a router you would get private IPs from the Router.

The fritz has its own public IP and the MT had its own public IP.

You wish to reach some fritzbox IPs from the MT.

Sadly this is only possible if configured at the fritz box is my understanding.......
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 11:24 am

Okay then the confusion is your use of Modem Router, it is not a router and ONLY a modem which can spit out more than one public IP. If it was also a router you would get private IPs from the Router.
No, I have only one public IP and the ISP modem router has it.
The Mikrotik and the Fritzbox are in the local network with the modem router.
The modem router have a DHCP server. 192.168....
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 11:32 am

Make a drawing please indicating what is where.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2865
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 11:33 am

Suggestion: one picture is sometimes worth more than thousends words.
 
User avatar
broderick
Member Candidate
Member Candidate
Posts: 242
Joined: Mon Nov 30, 2020 7:44 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 12:15 pm

It must be probably something like this:

Image

But I am at loss as to put the right IPs in the diagram.
superman71 should be a bit clearer about that.
You do not have the required permissions to view the files attached to this post.
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 12:22 pm

Attached is my network configuration
You do not have the required permissions to view the files attached to this post.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 1:53 pm

With all due respect but that drawing doesn't match AT ALL with the info in the first post ...
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Winbox does not find hAP ac  [SOLVED]

Sun Jan 15, 2023 2:40 pm

With all due respect but that drawing doesn't match AT ALL with the info in the first post ...
The way I understand both first post and schema they are in full agreement.

@superman71: you'll have to add rule for chain=input allowing connections with dst-port=8291, protocol=tcp and src-address=<fritz WAN IP>. This assumes that fritz does SRC NAT for traffic from its own LAN. And you definitely need to narrow down on source address for winbox access, otherwise somebody from internet might be able to connect (depending on ISP modem configuration). If fritz' IP address changes, then this presents a security threat (as you can't narrowly limit access to winbox). Note that every device from fritz' LAN will be able to connect because MT can not distinguish between them (after fritz does SRC NAT).
You'll have to push new firewall rule above rule which drops all traffic not from LAN.

And a note: winbox will not be able to "find" MT. Discovery is done via broadcast packets which don't pass routers. You'll have to type in MT's (WAN) address manually.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 3:13 pm

Mkx, two requirements can be parsed.

a. from PC behind fritz box using winbox reach hapac2
b reach some MT users/devices from fritzbox.

Neither is possible for me to discuss fully because both may require configuration of the fritzbox which I know nothing about and the ISP modem router may block traffic as well.

However,
As you pointed out winbox is out, to reach the hapac for configuratiion purposes, one has to use the WANIP ( private IP given to MT by the ISP router ).
Normally one wouldnt do this over the WWW but since this will be contained within the ISP router and not go external then something like
add chain=input action=accept in-interface-list=WAN src-address=FritzWANIP dst-port=winboxport protocol=tcp

As far as the fritz reaching the MT users/devices and I think the way to do that may be port forwarding.......... As if the Fritz was like any other external incoming traffic.???
add chain=dstnat action=dst-nat dst-address=fixedWANIPof MT dst-port=XXXX protocol=yyy
to-addresses=IPofServer source-address=fixedwanip of fritz


Since the ISP router is aware of both of the private IPs within its lan subnet ( wanips to the MT and fritz ) traffic should pass between the two routers without issue.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 3:49 pm

Mkx, two requirements can be parsed.

a. from PC behind fritz box using winbox reach hapac2
b reach some MT users/devices from fritzbox.
In first post, @OP wrote:
I have to use winbox from the router 2 network (192.188.1.0/24) and be able to connect to the mikrotik.

It might be due to the fact beither @OP nor I are native English speakers, but out of options you enumerated I can only choose option a.

I know I'm stretching things here a bit, but I think it's pretty safe to assume that Fritz is configured more or less in typical SOHO manner, which means NAT. I'm also assuming ISP modem to be yet another typical SOHO crap which won't interfere with traffic on its LAN side.
And if this assumptions are true, then the rest is a smooth ride.

If my assumptions (and recipe) turn out to be wrong, then I'm sure @OP will come back with additional information, your questions are invaluable
aide to get usable info from user asking questions.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 4:01 pm

Reasons for my remark:
nowhere on that drawing subnet 192.188.0.1/24 nor 192.188.1.0/24 is to be seen.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 4:16 pm

Pdf attached to post #19, has 192.168.x.y/24. And I, being shortsighted, read it as being the same. And I, as person with vivid imagination, assume @OP did a typo when typing addresses in early posts.

But then we might better bore @OP to death by nitpicking ....
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 4:48 pm

Assumptions are #1 reason for mistakes 8)
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 5:10 pm

He came here for help not us mkx, conclusion, mkx likes assumptions and thus makes many mistakes ;-))
 
User avatar
broderick
Member Candidate
Member Candidate
Posts: 242
Joined: Mon Nov 30, 2020 7:44 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 6:20 pm

The pdf supplied by OP seems pretty clear and straightforward to me.

Now, @superman71 should let us know if what mkx suggested him to do works.
 
superman71
just joined
Topic Author
Posts: 17
Joined: Fri Sep 13, 2013 8:05 pm

Re: Winbox does not find hAP ac

Sun Jan 15, 2023 8:30 pm

With all due respect but that drawing doesn't match AT ALL with the info in the first post ...
The way I understand both first post and schema they are in full agreement.

@superman71: you'll have to add rule for chain=input allowing connections with dst-port=8291, protocol=tcp and src-address=<fritz WAN IP>. This assumes that fritz does SRC NAT for traffic from its own LAN. And you definitely need to narrow down on source address for winbox access, otherwise somebody from internet might be able to connect (depending on ISP modem configuration). If fritz' IP address changes, then this presents a security threat (as you can't narrowly limit access to winbox). Note that every device from fritz' LAN will be able to connect because MT can not distinguish between them (after fritz does SRC NAT).
You'll have to push new firewall rule above rule which drops all traffic not from LAN.

And a note: winbox will not be able to "find" MT. Discovery is done via broadcast packets which don't pass routers. You'll have to type in MT's (WAN) address manually.
Yessss!!! It works thanks!!!!
First of all, sorry for my lack of knowledge of mikrotik, and poor english.. I promise that I will read all the guides @anav and understand how it works.

Now I'm trying to recap my network, I saw that there were some inaccuracies of mine due to imperfect knowledge of the subject.
Modem router ISP = It allows me to connect to the internet, it has its own firewall to open ports to the internet, it has a public IP and above all it has a dhcp server with 192.168.88.0/24. I connected Mikrotik and the Fritrzbox to him. Clearly both the Mikrotik 192.168.88.10 and the Fritzbox 192.168.88.11 acquire the ip from the modem router via the WAN port.

The Mikrotik must manage an IoT network where I want whoever is connected to it must only be able to go to the Internet.
The Miktrotik has its server dhcp 192.168.1.0/24
However, the Mikrotik must monitor two local IP addresses of the Fritzbox network (192.168.0.1/24) with the Netwatch service.

The Fritzbox also has its own dhcp server which manages the local network 192.168.0.1/24.
It has its own firewall that allows you to open ports to an ip on its network.
With the Mikrotik rule recommended by I can now connect with winbox to the Mikrotik from the Fritzbox network.

Sorry again for the mess created, thank you very much to all!!!

Who is online

Users browsing this forum: AtomikRoach and 54 guests