MikroTik

Posted: **Fri May 06, 2016 2:05 pm**

Just for fun and testing I setup a CentOS webserver (192.168.0.2) behind RB1100AHx2 on a HyperV, but I cant connect to it from LAN but WAN no problem.
First I tried with Hairpin NAT but that didn't solve it, so I got the idea to ping the server but I get a Destination host unreachable.
Router can ping all devices connected on the different subnets.

Centos is on switch2 ether 5 at the moment most traffic is on switch 1ether 7, which has Ubiquti ThoughSwitch connected and 2 Ubiquti AP and some IP CAMs configured with VLAN - WAN spare before I hat 2 ISP.

This is my 3 week with RouterOS and I am having a good time will playing with it, how else to learn, so maybe some of the config below is stupid

  0    ether3       1500 4C:5E:0C:3F:03:82 enabled    non
 1  S ether4       1500 4C:5E:0C:3F:03:83 enabled    eth
 2 R  ether5       1500 4C:5E:0C:3F:03:84 enabled    non
 3    ether6       1500 4C:5E:0C:3F:03:85 enabled    non
 4 R  ether7       1500 4C:5E:0C:3F:03:86 enabled    non
 5  S ether8       1500 4C:5E:0C:3F:03:87 enabled    eth
 6 RS ether9       1500 4C:5E:0C:3F:03:88 enabled    eth
 7  S ether10      1500 4C:5E:0C:3F:03:89 enabled    eth
 8    ether11      1500 4C:5E:0C:3F:03:8A enabled    non
 9    ether12      1500 4C:5E:0C:3F:03:8B enabled    non
10    ether13      1500 4C:5E:0C:3F:03:8C enabled    non
11 R  ;;; WAN 
      internet     1500 4C:5E:0C:3F:03:80 enabled    non
12    ;;; WAN spare
      internet...  1500 4C:5E:0C:3F:03:81 enabled    non

VLAN configured:

 0 R  VLANSecurity             1500 enabled        175 ether7                     
 1 R  VLANServer               1500 enabled         75 ether5                     
 2 R  VLANWiFi                 1500 enabled        125 ether7                     
 3 R  VLANWiredData            1500 enabled        100 ether7                     
 4 R  VLANguestWiFi            1500 enabled        150 ether7

DHCP are working fine, CentOS has been given a static IP but DHCP worked.

0   firstDHCP ether7                         first-pool        1d        
 1   guestW... VLANguestWiFi                  guest-WiFi-pool   6h        
 2   firstW... VLANWiFi                       first-WiFi-pool   12h       
 3   server... ether5                         server-pool       1w

IP Address from ISP is set with DHCP client

0   192.168.1.1/24     192.168.1.0     ether7                                    
 1 D X.X.X.X/24   X.X.X.X    internet                                  
 2   192.168.4.1/24     192.168.4.0     VLANguestWiFi                             
 3   192.168.3.1/24     192.168.3.0     VLANWiFi                                  
 4   192.168.2.1/24     192.168.2.0     VLANWiredData                             
 5   192.168.0.1/24     192.168.0.0     ether5

NAT number 2 and 3 (Hairpin) on 3filter I tried with address list where I have a list with all internal IP:

0    chain=srcnat action=masquerade out-interface=internet log=no log-prefix="" 

 1    chain=dstnat action=dst-nat to-addresses=192.168.0.2 protocol=tcp 
      in-interface=internet dst-port=80 log=no log-prefix="" 

 2    chain=srcnat action=masquerade protocol=tcp dst-address=192.168.0.2 
      src-address-list=Interne_IP out-interface=ether7 dst-port=80 log=no 
      log-prefix="" 

 3    chain=srcnat action=masquerade protocol=tcp src-address=192.168.1.0/24 
      dst-address=192.168.0.2 out-interface=ether5 dst-port=80 log=no 
      log-prefix=""

Filter Rules

 0    ;;; Adgang til Router fra Interne IP
      chain=input action=accept src-address-list=Interne IP log=no log-prefix="" 

 1    ;;; Allow ICMP echo (ping) replies to the router
      chain=input action=accept protocol=icmp icmp-options=0:0-255 log=no 
      log-prefix="" 

 2    ;;; Allow ICMP echo (ping) requests from LAN to the router
      chain=input action=accept protocol=icmp src-address-list=Interne IP 
      icmp-options=8:0-255 log=no log-prefix="" 

 3    chain=input action=drop protocol=icmp in-interface=internet 
      icmp-options=8:0-255 log=no log-prefix="" 

 4    ;;; Blocked Netflix 
      chain=forward action=drop src-address=192.168.1.201 
      dst-address-list=Blocked Netflix log=no log-prefix="" 

 5    ;;; Adgang til swich fra WAN
      chain=forward action=drop dst-address=192.168.1.254 
      src-address-list=Interne_IP in-interface=internet log=no log-prefix=""

Routes

0 ADS  0.0.0.0/0                          X.X.X.X              0
 1 ADC  X.X.X.X/24    X.X.X.X   internet                  0
 2 ADC  192.168.0.0/24     192.168.0.1     ether5                    0
 3 ADC  192.168.1.0/24     192.168.1.1     ether7                    0
 4 ADC  192.168.2.0/24     192.168.2.1     VLANWiredData             0
 5 ADC  192.168.3.0/24     192.168.3.1     VLANWiFi                  0
 6 ADC  192.168.4.0/24     192.168.4.1     VLANguestWiFi             0

Posted: **Fri May 06, 2016 9:02 pm**

Are you doing any policy routing, such as load balancing multiple ISPs?
If so, then add all of your local ranges to IP route rules with action set to lookup-in-specified-table table=main

It could be other things, but this is common among load-balance users...

Also, you only need the hairpin srcnat/masquerade rule if the src address is on the same LAN as the server.
LAN2 -> server LAN can work just fine with the public IP dstnat rule and no hairpin because the src address is still beyond the router from the server's point of view.

Posted: **Fri May 06, 2016 10:45 pm**

Are you doing any policy routing, such as load balancing multiple ISPs?
If so, then add all of your local ranges to IP route rules with action set to lookup-in-specified-table table=main

It could be other things, but this is common among load-balance users...

Also, you only need the hairpin srcnat/masquerade rule if the src address is on the same LAN as the server.
LAN2 -> server LAN can work just fine with the public IP dstnat rule and no hairpin because the src address is still beyond the router from the server's point of view.

No policy routing i only have one ISP at the moment - and i am still fare away from that chapter, but eventually i will get there that is the plan

.

Yea you are right about hairpin, but i just tried it just to try something.

Does it matter webserver is on switch2. ether7 where internal traffic is coming from now is on switch1 and master ?

Posted: **Sat May 07, 2016 1:58 am**

Yea you are right about hairpin, but i just tried it just to try something.

Does it matter webserver is on switch2. ether7 where internal traffic is coming from now is on switch1 and master ?

In general, no it shouldn't matter which switch the various interfaces are on... as long as the master/slave behavior of ports is part of your design.
If you bridge the two switches together with the CPU bridge, for instance, then undestand that you're potentially not going to be able to get wire speed between hosts of switch1 and switch2, and that traffic between hosts on the two switches will consume CPU cycles just as it would if being routed between subnets (obviously routing and bridging aren't exactly the same resource requirements, but in general, you can think of them in similar terms as far as capacity planning goes - check the performance benchmarks on routerboard.com to see what a given model is capable of doing in each regime).

If hosts on switch 1 and on switch 2 are in the same IP network and can both reach the Internet, then the switchs are bridged properly.
IF the hosts are in different IP ranges, then it doesn't matter which one is on which switch because communication between these hosts must go through the router for IP forwarding anyway.

If you don't have policy routing, then the most likely culprit is your forward chain in IP firewall.

Posted: **Sat May 14, 2016 3:19 pm**

If you don't have policy routing, then the most likely culprit is your forward chain in IP firewall.

I have tried disabling all rules no changes.

I have now moved from hyper-V to a Atom based, but still cant ping 192.168.0.0 net.

I have putted in an extra NIC a dual port GIG, the onboard NIC 192.168.1.41 (switch2) ping no issue, 1 port on NIC 192.168.1.42 on switch2 no issue, second port on NIC 192.168.0.34 (DHCP) no ping switch1.

And the ping is done from Routerboard.

Posted: **Mon May 16, 2016 5:36 pm**

post a diagram of your network.

(if possible, do it at the VLAN layer because I suspect that you've got layer-2 issues)

Posted: **Mon May 16, 2016 10:02 pm**

post a diagram of your network.

(if possible, do it at the VLAN layer because I suspect that you've got layer-2 issues)

Really frustrated I read all the post I already had read in here, I saw a post where a guy ha same issue with no ping, but his error was in the ip adresses where he did funny stuff with netmask, so I ran through all my netmasks..

An c voila there where the monkey buried

in the DHCP scopes I had been a jack*** and and put in 16 as netmask, but with a print:

# ADDRESS            GATEWAY         DNS-SERVER      WINS-SERVER     DOMAIN                                
 0 192.168.0.0/24     192.168.0.1     84.200.69.80   
                                      84.200.70.80   
                                      64.6.65.6      
                                      64.6.64.6      
 1 192.168.1.0/24     192.168.1.1     84.200.69.80                    gimlesnet.local                       
                                      84.200.70.80   
                                      64.6.65.6      
                                      64.6.64.6      
 2 192.168.2.0/24     192.168.2.1     84.200.69.80                    gimlesnet.local                       
                                      84.200.70.80   
                                      64.6.65.6      
                                      64.6.64.6      
 3 192.168.3.0/24     192.168.3.1     84.200.69.80                    gimlesnet.local                       
                                      84.200.70.80   
                                      64.6.65.6      
                                      64.6.64.6      
 4 192.168.4.0/24     192.168.4.1     84.200.69.80   
                                      84.200.70.80   
                                      64.6.65.6      
                                      64.6.64.6

You cant see it, as I am learning more and more I am using terminal, but adding the detail I got the answer:

0 address=192.168.0.0/24 gateway=192.168.0.1 netmask=16 
   dns-server=84.200.69.80,84.200.70.80,64.6.65.6,64.6.64.6 wins-server="" ntp-server="" caps-manager="" 
   dhcp-option="" 

 1 address=192.168.1.0/24 gateway=192.168.1.1 netmask=16 dns-server=84.200.69.80,84.200.70.80,64.6.65.6,64.6.64.6 
   wins-server="" ntp-server="" caps-manager="" domain="gimlesnet.local" dhcp-option="" 

 2 address=192.168.2.0/24 gateway=192.168.2.1 netmask=16 
   dns-server=84.200.69.80,84.200.70.80,64.6.65.6,64.6.64.6 wins-server="" ntp-server="" caps-manager="" 
   domain="gimlesnet.local" dhcp-option="" 

 3 address=192.168.3.0/24 gateway=192.168.3.1 netmask=16 
   dns-server=84.200.69.80,84.200.70.80,64.6.65.6,64.6.64.6 wins-server="" ntp-server="" caps-manager="" 
   domain="gimlesnet.local" dhcp-option="" 

 4 address=192.168.4.0/24 gateway=192.168.4.1 netmask=16 
   dns-server=84.200.69.80,84.200.70.80,64.6.65.6,64.6.64.6 wins-server="" ntp-server="" caps-manager="" 
   dhcp-option=""

Changed it and now ping is working - I haven't got any file sharing across subnet, so that didn't gave it away.

ZeroByte thank you for your efforts I appreciate your inputs.

Posted: **Tue May 17, 2016 2:22 am**

Changed it and now ping is working - I haven't got any file sharing across subnet, so that didn't gave it away.

ZeroByte thank you for your efforts I appreciate your inputs.

Heh - facepalm moment.

I never set the mask explicitly because it seems to me that it learns properly from the network prefix itself (unless I'm going mad and remembering things all wrong).

Good job catching it - stupid netmask being wrong on the clients. . .

Posted: **Tue May 17, 2016 8:38 pm**

Heh - facepalm moment.

I never set the mask explicitly because it seems to me that it learns properly from the network prefix itself (unless I'm going mad and remembering things all wrong).

Good job catching it - stupid netmask being wrong on the clients. . .

I think the mistake was I started up with Winbox, and reading the Wiki where examples is done with terminal.
In winbox you see more settings than you need to care about, so I cared about it to much

An example:

ip dhcp-server network add address=10.0.0.0/12 gateway=10.10.0.1 dns=4.2.2.2

Should be enough to get going, lets see that in Winbox - that netmask box is screaming "FILL ME SEYMOUR FILL ME ALL NIGHT LONG

:

CaptureWinbox.PNG

Posted: **Tue May 17, 2016 10:14 pm**

I'm having a similar problem with this. I can ping things...sometimes. It'll go through 5 times then request timeout the next 5. I can get on the internet but it's obviously pretty slow. Any ideas?

Posted: **Tue May 17, 2016 11:20 pm**

I'm having a similar problem with this. I can ping things...sometimes. It'll go through 5 times then request timeout the next 5. I can get on the internet but it's obviously pretty slow. Any ideas?

I dont think we have similar issue, I could not ping another subnet at anytime.

But I guess you should create a new post and remember to paste your sonfiguration, I have marked this post as solved.

Posted: **Tue May 17, 2016 11:46 pm**

Should be enough to get going, lets see that in Winbox - that netmask box is screaming "FILL ME SEYMOUR FILL ME ALL NIGHT LONG :

Son, be a dentist! You have a talent for causing things pain, SO be a dentist.
People will pay you to be inhumane.

Posted: **Wed May 18, 2016 5:46 am**

I'm having a similar problem with this. I can ping things...sometimes. It'll go through 5 times then request timeout the next 5. I can get on the internet but it's obviously pretty slow. Any ideas?
I dont think we have similar issue, I could not ping another subnet at anytime.

But I guess you should create a new post and remember to paste your sonfiguration, I have marked this post as solved.

Thank you !

MikroTik

SOLVED! Subnets different ports cannot connect/ping

SOLVED! Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: SOLVED! Subnets different ports cannot connect/ping

Re: SOLVED! Subnets different ports cannot connect/ping

Re: Subnets different ports cannot connect/ping

Re: SOLVED! Subnets different ports cannot connect/ping