Community discussions

MikroTik App
 
walkbyfaith
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 80
Joined: Thu May 05, 2011 7:26 pm

Can't Ping Mikrotik's on Same Subnet

Fri Apr 21, 2017 10:09 pm

Hello Everyone,
I have a strange situation. It's not service effecting but, now that I know about it I would like to resolve it. Below is the setup with fake IP's

I have two mikrotik routers. Router A IP is 11.0.0.10 and Router B is 11.0.0.11. They are both on the same subnet which is a /22. The default gateway is 11.0.0.1.
Both Router A and Router B can ping the gateway and the gateway can ping both Router A and Router B successfully. The problem is that Router A cannot ping Router B. When I try to ping from Router A to Router B, i get a timeout. I've checked the ARP table on Router A when trying to ping Router B and the IP for Router B is in the table but no MAC. I tried assigning a static entry in Router A's ARP table but, that didn't work either. I've also looked at the packets via packet sniffer on Router A when trying to ping Router B and there are no ICMP packets showing up. I've made a firewall entry to allow all ICMP input traffic and this did not seem to work either. I've checked the ARP table on the default gateway and it has entries for both Router A and B. I've looked at the routing tables on both Router A and Router B and the dst address of 11.0.0.0/22 is reachable and the gateway on both routers is correct. What am I missing? I have no unusual firewall rules setup and each router can ping URL's and any client connected to either router has internet access. Any help would be greatly appreciated.

Thanks
 
noib
Member Candidate
Member Candidate
Posts: 291
Joined: Fri Jan 25, 2013 6:04 pm
Location: France
Contact:

Re: Can't Ping Mikrotik's on Same Subnet

Fri Apr 21, 2017 10:55 pm

Posting the result if the "ip export" command for both routers might help.
 
walkbyfaith
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 80
Joined: Thu May 05, 2011 7:26 pm

Re: Can't Ping Mikrotik's on Same Subnet

Mon May 01, 2017 7:09 pm

/ip hotspot profile
add dns-name=HUHotSpot.com hotspot-address=10.10.222.2 name=hsprof1 use-radius=yes
/ip hotspot user profile
set [ find default=yes ] shared-users=unlimited
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool4 ranges=10.10.222.10-10.10.222.254
add name=dhcp_pool10 ranges=172.16.20.200-172.16.20.254
add name=dhcp_pool11 ranges=172.16.20.220-172.16.20.254
/ip address
add address=xx.xx.xx.xx/22 interface=ether1 network=xx.xx.xx.xx
add address=10.10.222.2/24 interface=ether2 network=10.10.222.0
add address=10.10.222.3/24 interface=bridge1 network=10.10.222.0
add address=172.16.20.1/24 interface="Public Wifi" network=172.16.20.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server
add address-pool=dhcp_pool4 disabled=no interface=bridge1 lease-time=1d name=dhcp1
add address-pool=dhcp_pool11 disabled=no interface="Public Wifi" lease-time=30m name=dhcp2
/ip dhcp-server network
add address=10.10.222.0/24 gateway=10.10.222.2
add address=172.16.20.0/24 gateway=172.16.20.1
/ip dns
set allow-remote-requests=yes max-udp-packet-size=512 servers=209.244.0.3,209.244.0.4
/ip dns static
add address=10.10.100.1 name=router
add address=xx.xx.xx.xx name=unifi
/ip firewall address-list
add address=10.10.222.0/24 list=MyLAN
/ip firewall filter
add action=log chain=input disabled=yes in-interface=ether1 log=yes protocol=icmp
add action=accept chain=input disabled=yes in-interface=ether1 protocol=icmp
add action=log chain=forward disabled=yes in-interface=ether1
add action=drop chain=input comment="Drop Incoming DNS requests" dst-port=53 in-interface=ether1 protocol=tcp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
add action=drop chain=forward comment="Prevent Public Network from Browsing Private Network" dst-address=10.10.222.0/24 src-address=172.16.20.0/24
add action=drop chain=forward dst-address=172.16.20.0/24 src-address=10.10.222.0/24
add action=accept chain=input comment="allow all LAN connections" src-address-list=MyLAN
add action=accept chain=input comment="accept input new connections" connection-state=new
add action=accept chain=input comment="accept input established connections" connection-state=established
add action=accept chain=input comment="accept input established connections" connection-state=related
add action=accept chain=forward comment="allow all LAN connections to pass thru router" src-address-list=MyLAN
add action=accept chain=forward comment="accept forward new connections" connection-state=new
add action=accept chain=forward comment="accept forward established connections" connection-state=established
add action=accept chain=forward comment="accept forward related connections" connection-state=related
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=drop chain=forward comment="drop invalid forward connections" connection-state=invalid
add action=drop chain=input comment="drop invalid input connections" connection-state=invalid
add action=drop chain=input comment="drop all other connections"
add action=drop chain=forward comment="drops all other connections thru router"
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat comment="masquerade hotspot network" disabled=yes src-address=10.10.222.0/24 to-addresses=0.0.0.0
/ip firewall service-port
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip hotspot
add address-pool=dhcp_pool4 idle-timeout=8h interface=bridge1 name="hotspot-88 Bieber Square #2" profile=hsprof1
/ip hotspot ip-binding
/ip hotspot user
add disabled=yes name=admin password=xxxxxxxxx
/ip proxy
set cache-path=web-proxy1 max-cache-size=none parent-proxy=0.0.0.0
/ip route
add distance=1 gateway=xx.xx.xx.xx

[winbox1] >
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: Can't Ping Mikrotik's on Same Subnet

Mon May 01, 2017 9:16 pm

/ip firewall filter
add action=log chain=input disabled=yes in-interface=ether1 log=yes protocol=icmp
add action=accept chain=input disabled=yes in-interface=ether1 protocol=icmp
Try enabling at least the bottom of these 2 rules. It looks like they are currently disabled causing your test ping traffic to be dropped by the global drop further down in the rule set.