Unpingable IP's on local network

Nic335 · Tue Sep 29, 2015 6:06 pm

Hi, I am out of idea..

I have two network 192.168.1.0/24 and 192.168.3.0/24
One is on ether=4 and the other on 5

Im trying to have a route that will route trafic so both network can be "pingable"

Im posting my config, hopping someone can help me cause I don't know what do to anymore.

Also maybe this can help, But when I do a tracert from a computer on 3.* network to a 1.* pc
The request go online..

/interface ethernet
set [ find default-name=ether4 ] name=4_FrontDept
set [ find default-name=ether5 ] name=5_IntDept
set [ find default-name=ether9 ] name=9_BellNet
set [ find default-name=ether10 ] name=10_Primus

/ip pool
add name=InternetDept ranges=192.168.3.11-192.168.3.254
add name=FrontDept ranges=192.168.1.11-192.168.1.254

/ip dhcp-server
add address-pool=InternetDept disabled=no interface=5_IntDept name=\
    InternetDept
add address-pool=FrontDept disabled=no interface=4_FrontDept name=FrontDept

/port
set 0 name=serial0

/interface pppoe-client
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 \
    dial-on-demand=no disabled=no interface=9_BellNet keepalive-timeout=60 \
    max-mru=1480 max-mtu=1480 mrru=1600 name=Bellnet_ISP password={PASSWORD} \
    profile=default service-name="" use-peer-dns=no user={USERNAME}
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 \
    dial-on-demand=no disabled=no interface=10_Primus keepalive-timeout=60 \
    max-mru=1480 max-mtu=1480 mrru=1600 name=Primus_ISP password={PASSWORD} \
    profile=default service-name="" use-peer-dns=no user={USERNAME}

/ip address
add address=192.168.3.1/24 interface=5_IntDept network=192.168.3.0
add address=192.168.1.1/24 interface=4_FrontDept network=192.168.1.0

/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.1.1 \
    netmask=24
add address=192.168.3.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.3.1 \
    netmask=24
	
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4

/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=Bellnet_ISP new-connection-mark=Bell
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=Primus_ISP new-connection-mark=Primus
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface=4_FrontDept new-connection-mark=Bell
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface=5_IntDept new-connection-mark=Primus
add action=mark-routing chain=prerouting connection-mark=Primus \
    dst-address-type=!local new-routing-mark=RouteToPrimus
add action=mark-routing chain=prerouting connection-mark=Bell \
    dst-address-type=!local new-routing-mark=RouteToBell
add action=mark-routing chain=prerouting comment=\
    "For DNS Server On MikroTik Will Fetch Through Primus Connection" \
    connection-mark=no-mark disabled=yes dst-port=53 new-routing-mark=\
    RouteToPrimus protocol=udp
	
/ip firewall nat
add action=masquerade chain=srcnat connection-mark=Bell out-interface=\
    Bellnet_ISP
add action=masquerade chain=srcnat connection-mark=Primus out-interface=\
    Primus_ISP
	
/ip route
add distance=2 gateway=Primus_ISP routing-mark=RouteToPrimus
add distance=2 gateway=Bellnet_ISP routing-mark=RouteToBell

Capture.PNG

Capture2.PNG

JJCinAZ · Tue Sep 29, 2015 7:51 pm

You're adding a route mark to all traffic, including that from 192.168.1.0/24 <->192.168.3.0/24. By adding the route mark, you are causing the traffic to only use routing table entries with those route marks and if you look at your routing table, you have no route to 192.168.1.0/24 or 192.168.3.0/24 with route marks of RouteToPrimus to RouteToBell. Once the packets are "route-marked" you restrict the route table entries which can be used to route said packets.

You can simply duplicate the 192.168.1.0/24 and 192.168.3.0/24 routes as static routes with both those route marks or you can adjust your mangle rules to not touch intra-LAN traffic. You can also add some routing rules to handle those intra-lan cases.

To duplicate the local routes, double click on the route for 192.168.1.0/24 in Winbox, press Copy, pick the RouteToPrimus routing mark, adjust the distance to 1 and press OK. Repeat for the 192.168.3.0/24 and again on both for the RouteToBell routing table/marks.

Nic335 · Tue Sep 29, 2015 8:36 pm

Hey, Thanks for your reply!

I did what you said, Duplicating routes and marking them with routes mark
but it does not seam to work

Now instead of leaving for internet it just request time out

Capture.PNG

Just to be sure this is what I did

Capture.PNG

Also, I how could I make mangles rules not mark intranet trafic.
I though that

dst-address-type=!local

was doing the trick ?

JJCinAZ · Tue Sep 29, 2015 9:05 pm

I haven't use that selector in the mangle, but I think it only applied to traffic destined for a process on the router. Your intra-LAN traffic is not destined for a process on the router.

Instead of "dst-address-type=!local" you could try "dst-address=!192.168.0.0/16".

Nic335 · Tue Sep 29, 2015 10:45 pm

Okay,.

Now,. For some reason from a device on 1.* I can ping any devices on 3.*

But can't from 3.* to 1.*

I seriously don't understand anymore..

These is my current config now

/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=Bellnet_ISP new-connection-mark=Bell
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=Primus_ISP new-connection-mark=Primus
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
    yes dst-address-type=!local in-interface=4_FrontDept new-connection-mark=\
    Bell
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address=!192.168.0.0/16 in-interface=4_FrontDept new-connection-mark=\
    Bell
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
    yes dst-address-type=!local in-interface=5_IntDept new-connection-mark=\
    Primus
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address=!192.168.0.0/16 in-interface=5_IntDept new-connection-mark=\
    Primus
add action=mark-connection chain=prerouting connection-mark=!no-mark \
    dst-address=192.168.0.0/16 new-connection-mark=no-mark src-address=\
    192.168.0.0/16
add action=mark-routing chain=prerouting connection-mark=Primus \
    dst-address-type=!local new-routing-mark=RouteToPrimus
add action=mark-routing chain=prerouting connection-mark=Bell dst-address-type=\
    !local new-routing-mark=RouteToBell
add action=mark-routing chain=prerouting comment=\
    "For DNS Server On MikroTik Will Fetch Through Primus Connection" \
    connection-mark=no-mark disabled=yes dst-port=53 new-routing-mark=\
    RouteToPrimus protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat connection-mark=Bell out-interface=\
    Bellnet_ISP
add action=masquerade chain=srcnat connection-mark=Primus out-interface=\
    Primus_ISP
/ip route
add distance=2 gateway=Primus_ISP routing-mark=RouteToPrimus
add distance=2 gateway=Bellnet_ISP routing-mark=RouteToBell

I added

add action=mark-connection chain=prerouting connection-mark=!no-mark \
    dst-address=192.168.0.0/16 new-connection-mark=no-mark src-address=\
    192.168.0.0/16

To just in case remove any mark on internal traffic, but it doesn't seam to pickup any

Capture.PNG

Do any one have an idea from were could that problem come from ?
I did a tracert from the 3.* network to 1.* network and I get unlimited request timed out. Maybe thats an indicator for something ?

Capture.PNG

again thanks a lot, for any help I can get.

ulysses · Tue Sep 29, 2015 10:51 pm

You forgot to fix this rule

add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\
    yes dst-address-type=!local in-interface=5_IntDept new-connection-mark=\
    Primus

Nic335 · Tue Sep 29, 2015 11:00 pm

Oh I simply disabled it, so I can try the old rules I had. and tweak.

ulysses · Wed Sep 30, 2015 12:06 am

Oh right, sorry.

Can you please check your firewall filter for an accept on the forward chain for packets from either of the networks?

In general, your rules are really hard to read. You are abusing the connection tracking engine, you don't need it at all in your setup - since you don't provide any failover, networks are statically linked to providers, so simple packet level marks should do

Mangle prerouting:

For packets from interface 5 where dest is not 192.168.0.0/16 set routing mark Primus
For packets from interface 4 where dest is not 192.168.0.0/16 set routing mark Bell

nat srcnat:

masquerade packets flowing out of Bell interface
masquerade packets flowing out of Primus interface

fliter forward:

allow connection state established
allow connection state related
allow source address 192.168.0.0/16

routes:

0.0.0.0/0 via Bell OR Primus - select your default route for packets from the router itself
0.0.0.0/0 via Bell routing mark Bell
0.0.0.0/0 via Primus routing mark Primus
other routes will be dynamic for the connected interfaces

That's all you need IMHO

Nic335 · Wed Sep 30, 2015 3:20 pm

Make sense.

I will try that configuration tonight actually.
I did all that configuration not very knowing what I was doing and only by looking at PCC example that people was referring to me

Could you explain what does the following rules though?

fliter forward:

allow connection state established
allow connection state related
allow source address 192.168.0.0/16

ulysses · Wed Sep 30, 2015 5:02 pm

this is a method of allowing forwarding for packets that are part of session initiated from within your network.

If someone from WAN sends a packet with your local network as a destination, then the router with an ALLOW forward policy will simply forward it. This is bad because someone may attack devices in your home network.

On the other hand, such forwarding is needed for simple internet access.

So the solution is to only allow forwarding for packets that are already part of a communication session (established, related) or those that originate from your local network. This way your internal computer can always initiate a session and then response packets will flow through because they are part of an established connection.

For a simple test setup you may always allow forwarding, but in real life you should apply policies, and better to use in-interface as the method to detect locally originated packets rather than src-address field (because it can be easily spoofed)

Nic335 · Wed Sep 30, 2015 8:48 pm

Okay, now I updated my config like you said.
But I still have that ping issue

It is very very weird to me

For example I can't ping 1.12,1.41 or 1.111 and when I am connected to the same interface as these I can ping all these.
Same thing for tracert If i tracert any of these address I have the same "Timeout" on hop 2

Capture.PNG

now the weird thing is ( as you can see in the last picture ) I can ping and tracert 1.20
Even wierd-er! ,If I ping 1.12 it doesn't work, But I can access a security camera server on that 1.12:5150
And I can ping every devices on 3.* from the 1.* interface..

Any one again..

have an idea ?

Now the following is my literal configuration ( except I removed username and password )

/interface bridge
add name=TmpInternet
/interface ethernet
set [ find default-name=ether4 ] name=4_FrontDept
set [ find default-name=ether5 ] name=5_IntDept
set [ find default-name=ether9 ] name=9_BellNet
set [ find default-name=ether10 ] name=10_Primus
/ip pool
add name=InternetDept ranges=192.168.3.11-192.168.3.254
add name=FrontDept ranges=192.168.1.11-192.168.1.254
/ip dhcp-server
add address-pool=InternetDept disabled=no interface=5_IntDept name=InternetDept
add address-pool=FrontDept disabled=no interface=4_FrontDept name=FrontDept
/port
set 0 name=serial0
/interface pppoe-client
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 \
    dial-on-demand=no disabled=no interface=9_BellNet keepalive-timeout=60 \
    max-mru=1480 max-mtu=1480 mrru=1600 name=Bellnet_ISP password={PASSWORD} \
    profile=default service-name="" use-peer-dns=no user={USERNAME}
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 \
    dial-on-demand=no disabled=no interface=10_Primus keepalive-timeout=60 \
    max-mru=1480 max-mtu=1480 mrru=1600 name=Primus_ISP password={PASSWORD} \
    profile=default service-name="" use-peer-dns=no user={USERNAME}
/interface bridge port
add bridge=TmpInternet interface=ether1
add bridge=TmpInternet interface=ether2
add bridge=TmpInternet interface=ether3
add bridge=TmpInternet interface=ether6
add bridge=TmpInternet interface=ether7
/ip address
add address=192.168.3.1/24 interface=5_IntDept network=192.168.3.0
add address=192.168.1.1/24 interface=4_FrontDept network=192.168.1.0
/ip arp
add address=192.168.3.101 interface=5_IntDept mac-address=6C:62:6D:98:3D:78
add address=192.168.3.100 interface=5_IntDept mac-address=00:24:21:14:02:80
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1,8.8.8.8,8.8.4.4 gateway=\
    192.168.1.1 netmask=24
add address=192.168.3.0/24 dns-server=192.168.3.1,8.8.8.8,8.8.4.4 gateway=\
    192.168.3.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.3.41 name=bv
/ip firewall filter
add chain=input comment="WinBox Wan Administration" dst-port=8291 in-interface=Primus_ISP \
    protocol=tcp
add action=drop chain=forward comment=\
    "Block All Trafic for Computer in warehouse ( virus ) Except Remote Desktop" dst-port=\
    !3389 protocol=tcp src-address=192.168.1.20
add chain=forward connection-state=established,related
add chain=forward src-address=192.168.0.0/16
add chain=forward disabled=yes dst-address=192.168.0.0/16 src-address=192.168.0.0/16
/ip firewall mangle
add chain=prerouting dst-address=192.168.0.0/16
add action=mark-routing chain=prerouting comment=\
    "Pass Traffic From Front Department To Bell" dst-address=!192.168.0.0/16 in-interface=\
    4_FrontDept new-routing-mark=RouteToBell
add action=mark-routing chain=prerouting comment=\
    "Pass Traffic From Internet Department To Primus" dst-address=!192.168.0.0/16 \
    in-interface=5_IntDept new-routing-mark=RouteToPrimus
/ip firewall nat
add action=masquerade chain=srcnat out-interface=Bellnet_ISP
add action=masquerade chain=srcnat out-interface=Primus_ISP
/ip route
add distance=2 gateway=Primus_ISP routing-mark=RouteToPrimus
add distance=2 gateway=Bellnet_ISP routing-mark=RouteToBell
add distance=2 gateway=Primus_ISP
/lcd
set backlight-timeout=never default-screen=stat-slideshow
/lcd interface pages
set 0 interfaces="sfp1,ether1,ether2,ether3,4_FrontDept,5_IntDept,ether6,ether7,\
    ether8,9_BellNet,10_Primus"
/system clock
set time-zone-name=America/Toronto
/system identity
set name=2WanRouter

ulysses · Wed Sep 30, 2015 11:19 pm

OK.

Before i dive into config parsing, first thing I usually do in such cases:

/tool sniffer
set filter-interface=all filter-ip-address=192.168.0.0/16 filter-ip-protocol=icmp filter-direction=any filter-port="" 
quick

Then i start ping and observe the flow or packets in real time. Please do that and post the two cases: working and not working. Don't need to port hundreds of them, just one-two roundtrips of the ping

ulysses · Wed Sep 30, 2015 11:37 pm

well for now the only problem I see with your config is

add action=drop chain=forward comment=\
    "Block All Trafic for Computer in warehouse ( virus ) Except Remote Desktop" dst-port=\
    !3389 protocol=tcp src-address=192.168.1.20

This rule doesn't work as it should by the comment, as it will not match (i.e. will allow) any traffic that is not tcp. The task should be accomplished with two rules, in this order
* one matching tcp port 3389 from192.168.1.20 and accepting it,
* and the other blocking everything from 192.168.1.20

Interestingly enough, this is the same address that you can ping.

something that stroke me right now: the machine you are using for ping test, does it have a static ip address? Cause if so, it may be an address from 192.168.1.0/24, that's why it would work when you ping 3* from 1*

Nic335 · Thu Oct 01, 2015 7:01 pm

No, All machine are dynamic except mine and 5 other, Those who are static are from 3.100-3.106, I am 3.101

Also, I did the snifing, It look like there is no route, Or that the packet is just being drop

ping 1.20 from 3.101 ( this ping work )

Capture.PNG

ping 1.12 from 3.101

Capture2.PNG

ping 1.41 from 3.101

Capture3.PNG

ulysses · Fri Oct 02, 2015 12:45 pm

No, All machine are dynamic except mine and 5 other, Those who are static are from 3.100-3.106, I am 3.101

First of all, you have to be careful with this setup to not plug yourself in the wrong interface, cause then you will observe problems.

Secondly, what I see from the sniffed packets looks like 1.14 and 1.21 don't have proper routes set up. Are you sure they have their gateway set properly to 1.1? If you have access to those machines, check their network config and routes, and use sniffer like wireshark to see where the responses go.

Nic335 · Fri Oct 02, 2015 8:50 pm

Yeah every IPs are connected to the right port.

Also I did go see every of these computer and they are correctly setted up as dhcp, and they all have ip of there own network and the gateway is setted up as 1.1

For routes I think they are okay since from all IPs that i can't ping, They all seam to be able to ping any device on 3.*

Capture2.PNG

Capture3.PNG

From my understanding here, Route 0.0.0.0 to gateway 192.168.1.1 should make a packet with dst-adr go to 192.168.1.1 and from there the router should redirect it to interface 5 right ?

And Here this is the wire shark result from that computer (192.168.1.41) when im pinging on it

Capture.PNG

I don't get what does no response mean

ulysses · Fri Oct 02, 2015 10:22 pm

Whoa, that's indeed strange

Please examine the firewall settings on the workstations, if they only allow for ICMP on the local network. Just turn the firewall off for the sake of testing

Unpingable IP's on local network

Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Re: Unpingable IP's on local network

Who is online