Source
r/mikrotik•
bootkiller

Help configuring network

I'm trying to configure a RouterBOARD 750UP r2, network is as follows:

  • Ether 1 - Internet with dhcp
  • Bridge with ports 2-4 | ip: 192.168.0.1 | range: 192.168.0.0/16
  • Ether 5 - ip: 10.0.0.1 | range 10.0.0.0/8

My problem is I cannot make the different LAN's talk to each other.

Both LAN's have internet access.

I can ping clients on different LAN's from the router console.

But I can't make clients on different LAN's ping each other. Any help would be appreciated.

Config Export

Posted Jan 26, 2020, 9:01 PM UTC

214
freebsd_guy•

You shouldn’t actually need those firewall rules to allow traffic between the lans as the default firewall isn’t configured to block lan to lan traffic. (At least nothing at a glance looks like it would be stopping it)

Have you added those two routes? You shouldn’t need any manual routes on this router as it’s directly connected to all the networks involved.

There’s nothing really obvious that would be stopping these devices talking. Make sure the devices themselves don’t have firewalls for a start. (I think windows might block any traffic that isn’t from the local lan by default for example)

The next thing I would be is see if any drop rules are clocking up matches when you try to connect between the lans, although I can’t see any obvious rule that would be blocking this traffic.

2
bootkillerOP•

You shouldn’t actually need those firewall rules to allow traffic between the lans as the default firewall isn’t configured to block lan to lan traffic. (At least nothing at a glance looks like it would be stopping it)

I was just making sure they were allowed through, it does report packets being passed.

Have you added those two routes? You shouldn’t need any manual routes on this router as it’s directly connected to all the networks involved.

I've added them in trying to make this work, I know I probably shouldn't need them.

Make sure the devices themselves don’t have firewalls for a start. (I think windows might block any traffic that isn’t from the local lan by default for example)

I know, I have all sharing and discovery options turned on.

The next thing I would be is see if any drop rules are clocking up matches when you try to connect between the lans, although I can’t see any obvious rule that would be blocking this traffic.

I'll check that.

On the connections tab, it does report both machines sending pings to each other, but with no reply.

1
zombieroadrunner•

/interface list member

You've added the bridge interface but not ether5. because of this, line 41 sees anything from ether5 as not being from a LAN interface list member and drops it.

2
bootkillerOP•

I've added it, but still can't ping clients to each other. I'm able to ping the other LAN's gateways, but not the clients.

Edit:

Solved by additional adding:

add action=masquerade chain=srcnat dst-address=10.0.0.0/8 out-interface=ether5

add action=masquerade chain=srcnat dst-address=192.168.0.0/16 out-interface=\
bridge

Thanks for the help.

1
djgizmoMTCNA, MTCRE•

But why are you masquerading between two local subnets?

2
bootkillerOP•

Is there a better way to get this to work?

1
djgizmoMTCNA, MTCRE•

Yes. If you’re testing with windows pc’s, TURN OFF THE WINDOWS FIREWALL first.

(Sorry for the caps)

2
djgizmoMTCNA, MTCRE•

Also, there’s no need to add static routes when the router has a leg on each network. It already knows how to get to each local network.

2
[deleted]•

[deleted]

1
djgizmoMTCNA, MTCRE•

How are you testing this connectivity / communication issue

1
bootkillerOP•

I was using 2 PC's, one on each LAN, trying to ping each other.

I managed to get everything working. Thanks for the interest.

1
[deleted]•

[deleted]

1