I wanna try the following.
A) I want to act a MT as a station connected to a (pubilc) wlan. That works fine, I get an IP, DNS, NTP, default route by the WLANs DHCP.
B) I want to provide a local WPA2-WLAN for my clients using the network 192.168.54.0/24. That works also fine.
C) I want to route the traffic from the local network through the public WLAN to the internet. That doesn't work.
The config (without the secrets) u find below. The L2TP and IPSec parts are disabled. In a next step I wanna route all traffic through these tunnel.
Code: Select all
# mar/17/2018 23:54:19 by RouterOS 6.41.3
# software id = 31J0-42KJ
#
# model = RouterBOARD 941-2nD
# serial number = 8AFE082826D1
/interface bridge
add fast-forward=no name=private-bridge
add fast-forward=no name=wan-bridge
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk,wpa-eap,wpa2-eap group-ciphers=\
tkip,aes-ccm management-protection=allowed mode=dynamic-keys name=\
access-Yachthafen supplicant-identity="" unicast-ciphers=tkip,aes-ccm
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=private-WLAN supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=access-Peer supplicant-identity=""
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=access-iphone6S supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-eC \
disabled=no frequency=auto name=wlan-to-wan security-profile=access-Peer \
ssid=PMJFC-Gast
add disabled=no keepalive-frames=disabled mac-address=CE:2D:E0:43:93:BB \
master-interface=wlan-to-wan multicast-buffering=disabled name=\
privates-wlan security-profile=private-WLAN ssid=Tor-zur-Welt \
wds-cost-range=0 wds-default-cost=0
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc
/ip pool
add name=PrivateIPs ranges=192.168.54.100-192.168.54.200
/ip dhcp-server
add address-pool=PrivateIPs disabled=no interface=private-bridge name=\
DHCP-private
/ppp profile
set *0 use-encryption=no
/interface l2tp-client
add connect-to=79.212.123.188 name=L2TP-Home profile=default user=\
IPSEC-MT-mobil
/interface bridge port
add bridge=private-bridge interface=ether2
add bridge=private-bridge interface=ether3
add bridge=private-bridge interface=ether4
add bridge=private-bridge interface=privates-wlan
add bridge=wan-bridge interface=ether1
add bridge=wan-bridge interface=wlan-to-wan
/ip address
add address=192.168.54.254/24 interface=private-bridge network=192.168.54.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=wan-bridge
/ip dhcp-server network
add address=192.168.54.0/24 dns-server=192.168.54.254 gateway=192.168.54.254 \
ntp-server=192.168.54.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=drop chain=forward connection-state=invalid
add action=drop chain=input connection-state=invalid
add action=accept chain=forward connection-state=established,related
add action=accept chain=input connection-state=established,related
add action=accept chain=forward src-address=192.168.54.0/24
add action=accept chain=input src-address=192.168.54.0/24
add action=drop chain=forward log=yes log-prefix=drp-forward:
add action=drop chain=input log=yes log-prefix=drp-input:
/ip firewall nat
add action=masquerade chain=srcnat log=yes log-prefix=MASK: out-interface=\
wan-bridge src-address=192.168.54.0/24
/ip ipsec peer
add address=172.17.2.1/32 dh-group=modp1024 disabled=yes enc-algorithm=\
aes-256
/ip ipsec policy
set 0 disabled=yes
add disabled=yes dst-address=192.168.51.0/24 sa-dst-address=172.17.2.1 \
sa-src-address=172.17.2.2 src-address=192.168.54.0/24 tunnel=yes
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=Hafen-ToGo
/system leds
add interface=wan-bridge leds=user-led type=interface-activity
The traffic towards the WAN Bridge is masqueraded, but don't get any connection to the WAN. If I connect directly to the external WLAN with the PC, the internet connection works fine and the routing table looks the same as on the mikrotik.
Does any one has a hint for me?
BR Holger
