The official Mikrotik router thread

Ok, networking seems to be sorted, but when adding the container, I get this:
1711122664794.png

I click ok, then it adds it, but then I get an error status:

1711122696380.png

And the logs aren't really helpful either:

1711122744950.png
Not sure what to make of it :(
 
r00igev@@r said:
I have mine running in nspawn using non-docker mode on a Linux box
I have a Pi 400 that I use as a dedicated workstation for monitoring.
View attachment 1680241
Click to expand...
I have a Pi 3 here somewhere ... might want to use that for the monitoring.

I have email notifications working via scripts, but would like to try something like Google Home notifications
1711261868032.png
 
LandyMan said:
I have a Pi 3 here somewhere ... might want to use that for the monitoring.

I have email notifications working via scripts, but would like to try something like Google Home notifications
View attachment 1680599
Click to expand...
The best notification solution is ntfy and I have actually subscribed to the paid version. However, the free version is good enough for home use.
Strange thing is most businesses don't have insights like this into their systems.
 
Hey guys .... hope that you are all well.

I'm having great difficulty with forwarding my ports in my mikrotik. Yesterday i reset my router do "undo" all that i did and to start over. On Friday night I did something on the router and it took my whole network down including the internet lmao took me ages to figure out how to get back on the webfig\winbox, I had to use the mac address and go from there. Anyway it being working I'm hesitant to just be doing my own thing incase I break it again lol. I even scared to update the routeros lol, but the firmware is up todate

Back to the port forwarding, here is what I have tried;
Port forwarding - RouterOS knowledge base - Support - MikroTik
and
/ip firewall nat add chain=dstnat dst-port="port#" action=dst-nat protocol=tcp to-address="mikrotik webfig ip" to-port="port#"
also
/ip firewall nat add chain=dstnat protocol=tcp port="port#" in-interface=ether1 action=dst-nat to-address="PC LAN IP"

I have read many other sites but it is all pritty much the same, except that very few mention anything about creating filter rules as well because apparently a nat rule is not the only thing to do for it to work.

My fiber goes into ethernet port 1 on the router and is labeled at ether1 in the webfig, there is also bridge. In the dhcp client ether1 has an ip 100.-.-.-/24 but when I go to sites to check my ports they pickup a totally different ip 165.-.-.- which to me seems strange. My dhcp and both dns start with 169.-.-.- , ip and gateway start 100.-.-.- , I'm using afrihost as my isp for my fiber @AfriGuy @AfriFella, can you perhaps explain the ip assignment and is there something on afrihost infrastructure that will effect port forwarding? . I dont know perhaps if I should be using a different interface, maybe pppoe-client ?

I have tried even to enable upnp with bridge internal and ether1 external, but still nothing.

What is even more confusing is that when I go to the port forwarding site and check what ports I have open it even tells me that port 80 is closed o_0 but yet I can browse -- like what the hell ?
am I maybe putting it under or above the wrong filter rules?

My mikrotik is a hAP AC3
 
Hi guys,

Wondering if anyone can assist me... Currently have a Mikrotik RB4011 connected via ether1 (pppoe-out1) to my Telkom ONT.
The rest of the ports are merely handing out IP's to my network via DHCP - stock standard config here.

I'd like to add multi-WAN fail-over with recursive routing using my existing connection mentioned above and ether2, connected to a TP-Link LTE Router using Afrihost Airmobile (this router is also currently setup as a DHCP server).

I've watched the following 2 vids:
Scoop: How to Configure Multi-WAN Fail-over on MikroTik RouterOS
The Network Berg: MikroTik MTCRE - Recursive Routing (Easy Automatic failover even for directly connected networks!)

I follow along but I'm stuck at the initial setup part of adding the TP-Link LTE Router as a secondary WAN interface.

Expert network diagram below of what I'd like to achieve :D

1711285984148.png

Current Config:
Code: 
# 2024-03-24 15:08:13 by RouterOS 7.13.5
# software id = 75ZY-SC1H
#
# model = RB4011iGS+
# serial number =
/interface bridge
add admin-mac=D4:01:C3:07:F5:63 auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes user=\
    [email protected]
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=\
    127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=\
    established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=\
    !dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none \
    out-interface-list=WAN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh port=1234
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 \
    protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=\
    in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=\
    in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" \
    in-interface-list=!LAN
/system clock
set time-zone-name=Africa/Johannesburg
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN



Is anyone able to kindly assist me?

Thanks in advance!
 
Angelus said:
Hey guys .... hope that you are all well.

I'm having great difficulty with forwarding my ports in my mikrotik. Yesterday i reset my router do "undo" all that i did and to start over. On Friday night I did something on the router and it took my whole network down including the internet lmao took me ages to figure out how to get back on the webfig\winbox, I had to use the mac address and go from there. Anyway it being working I'm hesitant to just be doing my own thing incase I break it again lol. I even scared to update the routeros lol, but the firmware is up todate

Back to the port forwarding, here is what I have tried;
Port forwarding - RouterOS knowledge base - Support - MikroTik
and
/ip firewall nat add chain=dstnat dst-port="port#" action=dst-nat protocol=tcp to-address="mikrotik webfig ip" to-port="port#"
also
/ip firewall nat add chain=dstnat protocol=tcp port="port#" in-interface=ether1 action=dst-nat to-address="PC LAN IP"

I have read many other sites but it is all pritty much the same, except that very few mention anything about creating filter rules as well because apparently a nat rule is not the only thing to do for it to work.

My fiber goes into ethernet port 1 on the router and is labeled at ether1 in the webfig, there is also bridge. In the dhcp client ether1 has an ip 100.-.-.-/24 but when I go to sites to check my ports they pickup a totally different ip 165.-.-.- which to me seems strange. My dhcp and both dns start with 169.-.-.- , ip and gateway start 100.-.-.- , I'm using afrihost as my isp for my fiber @AfriGuy @AfriFella, can you perhaps explain the ip assignment and is there something on afrihost infrastructure that will effect port forwarding? . I dont know perhaps if I should be using a different interface, maybe pppoe-client ?

I have tried even to enable upnp with bridge internal and ether1 external, but still nothing.

What is even more confusing is that when I go to the port forwarding site and check what ports I have open it even tells me that port 80 is closed o_0 but yet I can browse -- like what the hell ?
am I maybe putting it under or above the wrong filter rules?

My mikrotik is a hAP AC3
Click to expand...
Your isp is doing nat too on your ip. You need to ask afrihost to disable it before you worry about setting up port forwarding.
 
Angelus said:
thanks for the reply

meh I thought it was something else lol I will talk to them tomorrow @AfriGuy @AfriFella pm me please
Click to expand...
Yeah it sux. It's called carrier grade nat, used by isps.

That 100.x is what is called shared ip space. All isps can use it. So it's not unique on the internet, only unique to your isp. Thats why your router show your ip as 100.x but the ip lookup show 165.x

165 is a public ip, but the 100.x ip is basically private, like or similar to 192.x


Not rfc1918 though, another rfc
 
Tinuva said:
Yeah it sux. It's called carrier grade nat, used by isps.

That 100.x is what is called shared ip space. All isps can use it. So it's not unique on the internet, only unique to your isp. Thats why your router show your ip as 100.x but the ip lookup show 165.x

165 is a public ip, but the 100.x ip is basically private, like or similar to 192.x


Not rfc1918 though, another rfc
Click to expand...
right , got ya :-) thanks
 
Mzezman said:
Anything you can share on the group for others?
Click to expand...
From what I recall, it was basically to:
  • Remove Ether2 from the bridge (where LTE router is connected),
  • Add a new entry into the Addresses table for the LTE Router
  • Add a new firewall rule to masquerade the traffic on out interface for the LTE connection
  • Add a new route to routes table with the LTE router (Dst. Address 0.0.0.0/0; gateway 192.168.2.1) and then check the gateway via ping. Distance set to 2, scope 30, target scope 10.
There's barely any noticeable delay in the connection change one of the interfaces is disabled so it 100% works.

Here's the config:
Code: 
# model = RB4011iGS+

# serial number = 12345678
/interface bridge

add admin-mac=D4:01:C3:07:F5:63 auto-mac=no comment=defconf name=bridge

/interface ethernet

set [ find default-name=ether2 ] name="LTE Internet"

/interface pppoe-client

add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes [email protected]

/interface list

add comment=defconf name=WAN

add comment=defconf name=LAN

/ip pool

add name=default-dhcp ranges=192.168.88.10-192.168.88.254

/ip dhcp-server

add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf

/port

set 0 name=serial0

set 1 name=serial1

/interface bridge port

add bridge=bridge comment=defconf interface=ether3

add bridge=bridge comment=defconf interface=ether4

add bridge=bridge comment=defconf interface=ether5

add bridge=bridge comment=defconf interface=ether6

add bridge=bridge comment=defconf interface=ether7

add bridge=bridge comment=defconf interface=ether8

add bridge=bridge comment=defconf interface=ether9

add bridge=bridge comment=defconf interface=ether10

add bridge=bridge comment=defconf interface=sfp-sfpplus1

/ip neighbor discovery-settings

set discover-interface-list=LAN

/interface detect-internet

set detect-interface-list=all

/interface list member

add comment=defconf interface=bridge list=LAN

add comment=defconf interface=ether1 list=WAN

add interface=pppoe-out1 list=WAN

/ip address

add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0

add address=192.168.2.2/24 interface="LTE Internet" network=192.168.2.0

/ip dhcp-client

add comment=defconf disabled=yes interface=ether1

add comment=defconf disabled=yes interface=ether1

/ip dhcp-server network

add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1

/ip dns

set allow-remote-requests=yes servers=1.1.1.1

/ip dns static

add address=192.168.88.1 comment=defconf name=router.lan

/ip firewall filter

add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked

add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid

add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec

add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes

add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked

add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked

add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid

add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec

add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes

add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked

add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat

add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

add action=masquerade chain=srcnat comment="LTE Internet" out-interface="LTE Internet"

/ip route

add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.2.1 pref-src="" routing-table=main suppress-hw-offload=no

/ip service

set telnet disabled=yes

set ftp disabled=yes

set ssh port=1234

set api disabled=yes

set api-ssl disabled=yes
 
Ok so my ip has been changed to 165-…-…-… I havnt done any forwarding yet but I can browse lol am I not supposed to open everything ?
 
Feedback on the Uptime Kuma (via ntfy) vs email directly from the router:

I prefer the email :) Very customisable, where the notification to ntfy from uptime Kuma is a bit limited in terms of wording, etc ... unless I just need to play around with it some more
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X