Community discussions

MikroTik App
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

New Config will not allow access to certain public IPs.

Thu Sep 30, 2010 4:26 am

I am new to RouterOS config. I have setup a 750G with basic config and it works properly except for the following. I cannot ping a few specific public IPs by number or DynamicDNS. The name is resolved correctly but the it seems the ping dies at the interface. Traceroute seems to confirm this. Firewall settings are defaulted and a disable of the last "deny" rule does not help. I can ping outside IPs such as google or yahoo by name or address. I can also access the Inet. The setup is as follows:

Cable Modem--WAN(Static Assigned)--LAN(DHCP Disabled)--3 remaining ports disabled

I would appreciate any advice.
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 5:31 pm

I have yet to make this work and it makes remote management of the router impossible without a RDP session into a PC within LAN. I am wondering if it might be some routing confusion within the static IPs and subnet given by our cable company. Any thoughts?
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 5:52 pm

How is you wan ip set? DHCP or static assignment? I think default is dhcp client on the first port. If you have a static ip assigned to your wan port, disable "/ip dhcp-client" on your wan interface.
Check "/ip address" just to check.
Are all the other ports still in a switch? Still 192.168.88.1/24?
Insure in "/ip firewall nat", the masquerade/srcnat is correct.
Insure "/ip dns" is set correctly. Both server ips and "allow-remote-requests=yes".

ADD: Did I mention to check "/ip route" for a default gateway? (dst-address=0.0.0.0/0)
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 6:09 pm

I have a static with DHCP-Client disabled. IP is correct. I generally disable all unused ports. This particular setup has a Wan interface and a LAN interface only. Masquerade is correct. I am going to check on the DNS and allow remote requests. Thanks for your reply.
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 6:11 pm

Just to insure you saw the addition to the last post.
Check "/ip route" for a default route. I forget that more than anything!
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 7:42 pm

There is a default route. The boxes are up and running, many with site to site vpns. The problem is remote management.
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 8:11 pm

What are you using for remote management? Do you access this router from the same ip or subnet? That way I can help make it a bit more secure. Can you post your "/ip firewall filter"?
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 11:34 pm

IP Firewall print:
0 ;;; default configuration
chain=input action=accept protocol=icmp

1 ;;; default configuration
chain=input action=accept connection-state=related in-interface=WAN

2 ;;; default configuration
chain=input action=accept connection-state=established in-interface=WAN

3 ;;; default configuration
chain=input action=drop in-interface=WAN
DNS settings were correct. Here's the deal. Let's say I'm at home pulling DHCP from my cable modem, I can ping the MK's public IP but cannot winbox in. Now, let's say I'm at work. My work's static IP is in the same subnet as the MK's static. From work I receive no ping response and cannot winbox in.
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Nov 20, 2010 11:39 pm

To clear up that muddy response just posted:
Work PC and router works off a static IP distributed by our local cable company.
Offsite MK also has a static from the local cable company.
To access offsite MK, I have to RDP in through second Cisco router to a term serv session that allows access to the local LAN address on MK. If Cisco ever dropped, I'd be back to sneakernet.
 
bburley
Frequent Visitor
Frequent Visitor
Posts: 80
Joined: Thu Nov 18, 2010 7:22 am
Location: Alberta, Canada

Re: New Config will not allow access to certain public IPs.

Sun Nov 21, 2010 3:20 am

I am not an expert but it sounds like this is what you need;

http://wiki.mikrotik.com/wiki/Hairpin_NAT
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: New Config will not allow access to certain public IPs.

Sun Nov 21, 2010 12:02 pm

Enter this with x.x.x.x replaced with your remote ip or subnet that you want to access it from:
/ip firewall filter
add chain=input action=accept src-address=x.x.x.x
Then move this above the "action=drop" rule
move 4 3
If you access it from more than one location, repeat as necessary.

If you need to access it from different locations, you can use "port knocking" to allow access from almost anywhere. A little tricky to set up, but I use it to access my routers from my Blackberry phone.
 
jbabbtech
just joined
Topic Author
Posts: 20
Joined: Thu Sep 30, 2010 4:17 am

Re: New Config will not allow access to certain public IPs.

Sat Apr 30, 2011 6:01 pm

This problem appeared on another installation as well. Then a few weeks ago my ISP made some sort of change and I can connect. I believe it had something to do with routing amongst the ISP's selected Public range. Go figure..