MikroTik

how your DNS looks like?

Make max udp packet size 4096

set up dns, as i can see you dns looks like blank

It looks like you get your internet through PPPoE. In that case MTU varies between 1480 and 1492 normally. Also, try clamping your mss with your pmtu with a simple rule like this:

Code: Select all

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface="WAN" passthrough=yes protocol=tcp \
    tcp-flags=syn tcp-mss=1361-65535
add action=change-mss chain=forward in-interface="WAN" new-mss=clamp-to-pmtu passthrough=yes protocol=tcp \
    tcp-flags=syn tcp-mss=1361-65535

Also - and this is just a recommendation - give your firewall some love. I saw a bunch of accept rules but no drop rules for the rest of the chain. This is basically the same thing as having no firewall at all.

Please send a screenshot, picture, or more detailed information about the error you are receiving:

For Example:

System Hardware
System OS
Browser Type
MT Router Type

Thanks and good luck, we are here to try and help!

Hallo i am newbie
first, sorry for my english

i have a problem with my Mikrotik routers. some website can't access but i can ping. the error is "this site can't be reached"

whats the problem? with my firewall?

my config:
[Codebox= /ip firewall filter
add action=accept chain=forward comment="allow semua akses internet ke client" dst-address=ip_gateway in-interface=pppoe-out out-interface=bridge1
add action=accept chain=input comment="Allow remot winbox dari public" dst-port=8291 in-interface=pppoe-out protocol=tcp
add action=accept chain=input comment="Allow NTP traffic" in-interface=pppoe-out protocol=udp src-port=123
add action=accept chain=input comment="Allow DNS Traffic" in-interface=pppoe-out protocol=udp src-port=53
add action=accept chain=input comment="Allow ping traceroute trafic" in-interface=pppoe-out protocol=icmp
add action=add-src-to-address-list address-list=spam address-list-timeout=30m chain=input comment="Log IP yang ditolak" connection-state=new in-interface=\
pppoe-out
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input dst-port=1701 protocol=udp
add action=accept chain=input dst-port=500 protocol=udp
add action=accept chain=input dst-port=4500 protocol=udp
add action=accept chain=input protocol=gre
add action=accept chain=input dst-port=1723 protocol=tcp
add action=accept chain=forward dst-port=1883 protocol=tcp
add action=accept chain=input dst-port=3000 protocol=tcp
/ip firewall mangle
add action=mark-connection chain=forward comment=HTB-18SEP17 in-interface=bridge1 new-connection-mark=conn-new passthrough=yes
add action=mark-packet chain=forward connection-mark=conn-new new-packet-mark=packet-new passthrough=no
add action=mark-connection chain=prerouting comment=PING-TIME new-connection-mark=pingtime-conn passthrough=yes protocol=icmp
add action=mark-packet chain=prerouting connection-mark=pingtime-conn new-packet-mark=Ping-Paket passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out
add action=masquerade chain=srcnat comment="NAT L2TP" out-interface=pppoe-out src-address=192.168.11.0/24
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=192.168.90.0/24
add action=dst-nat chain=dstnat dst-address=182.253.31.154 in-interface=pppoe-out protocol=tcp to-addresses=192.168.11.71 to-ports=80
add action=dst-nat chain=dstnat dst-port=3000 protocol=tcp to-addresses=192.168.11.60 to-ports=3000
=Untitled.txt][/Codebox]

Please help me and give me the best answer
thanks