That worked! Thank you so much. Now that I have read the wiki for dst-address-type it makes perfect sense. For others searching, here is my complete NAT rules: [admin@MikroTik] /ip firewall nat> pri Flags: X - disabled, I - invalid, D - dynamic 0 ;;; default configuration chain=srcnat action=masquer...

Hello all, I have searched many times, read many posts, read and re-read the wiki page, but I unable to get Hairpin NAT working with a dynamic public IP. This is for a RB2011 with default settings. I disabled the dhcp-client on ether1-gateway and statically assign the IP so it is easier to change du...

So this was my own fault. The client devices are Windows 7 and when it detects the default gateway device has changed it switches to Public network mode. This blocks pings by default. Once the network mode was changed to Home or Work everything is working.

Sorry for the noise.

Thank you,
James

Hi all, I have a Cloud Switch Router CSR125. ether1 is connected to a cable modem with a static IP. I can connect to the router (using ssh, or winbox) from the Internet to the IP on ether1. ether2 is the master port for ether3-ether24. I am unable to ping from winbox to any device connected to ether...

After getting traffic from the WatchGuard (central office) through the tunnel to the RB, I started thinking over my RB setup. In the RB, I have two rules that prevent traffic that should go over the IPSec tunnels from getting NATed. Here are the rules: add action=accept chain=srcnat comment=\ "...

I made a little progress.

I am actually using the 172.20.0.0/16 subnet of the 172.16.0.0/12 network. Just on a whim I tried to change my tunnel config to be 172.20.0.0/16.

After changing both ends, I can ping from the WatchGuard end to the RB end.

Thank you,
James

Yes. Both ends of the tunnel have been updated. The central office is a WatchGuard so the terminology is not the same as MikroTIk devices, but the settings match.

Hello all, I have several RB2011 devices connected to a central office using IPSec in tunnel mode. Each remote site has a 192.168.x.0/24 network. The existing IPSec policy has src-address=192.168.x.0/24 and dst-address=192.168.0.0/16. Using this setup each remote site can communicate through the cen...

So I have it working now!!! Yay! I have two connections to this RB. The one that has been working for sometime is a wireless (using a NetBridge cellular to ethernet bridge) connection on ether2. I added an AT&T DSL modem (in bridge mode) on ether1. My DSL connection had a /28 IP block. 8 IPs tot...

The setup described in my previous post is not correct. The PPPoE connection uses the IP I assigned for the local address, but receives its remote IP from the AT&T PPPoE server. I moved the src-nat rule for pppoe interface above my src-nat rule for the backup connection. As soon as the rules cha...

Thanks for the info lunchboxrts. I am working remotely through a backup connection and do not want to lose it before I am ready to set the default route to the PPPoE connection. Here is my static block x.x.x.176/28 .177 - Router/modem address .178 - First usable .182 - Last usable I tried creating a...

I am having trouble getting my AT&T DSL connection setup correctly. I have a block of static IPs (8 assigned, 5 usable). I have the DSL modem in bridge mode. I created a pppoe client on interface ether1 and it connects just fine. The IP address assigned by AT&T to the pppoe interface is not ...

Can someone comment on setting up AT&T (was BellSouth) pppoe with a block of 8 (5 usable) static IPs? I have a block assigned and I know my pppoe user/password. The modem is in bridge mode. I created a pppoe client on interface ether1. When I activate the pppoe client it connects and receives an...