Hello,
I'm hoping someone can help me determine if I am setting up my router correctly.
I am installing my 1st MikroTik router and have run into a problem that I think may be caused by incorrect provisioning by my new ISP. I am switching service from a large national cable/internet provider to a local fixed wireless provider. I ordered a static IP from the new provider primarily so I can support a VoIP PBX. After installing my new hAP ac2 router I am able to reach the internet, but online What's My Public IP services are reporting a completely different IP than what I was assigned by my new ISP.
I did not find any examples of setting RouterOS with a single static IP and most search references were for setting static routes between 2 MikroTik routers. As a test and for practice I set up the router behind a cable modem/router with DHCP. I got everything set as I wanted and working (although, because of not having a public IP I did not test inbound connections). I then brought the router on site and changed from DHCP to Static IP as follows based on my best-educated guess.
Given to me by the new ISP:
IP: abc.de.f.38
GW: abc.de.f.37
Mask: 255.255.255.252
DNS: 8.8.8.8, 1.1.1.1
In Winbox ...
/IP>DHCP Client / disable DHCP Client interface (ether1)
/IP>Addresses / add stactic IP address, abc.de.f.38/30 to address list (ether1)
/IP>Routes / enter gateway address, abc.de.f.37 (ether1)
/IP>DNS / DNS servers already set up from my previous testing configuration
The new interfaces show up as reachable.
With this setup, I am able to browse the internet from a PC connected to a LAN port or wireless. But I can not set up my PBX with my VoIP providers.
Did I miss something, or get it completely wrong?
Some notes
An IP Lookup of abc.de.f.38 returns no information.
An IP Lookup of the rouge IP that is reported from WhatsMyIP shows as registered and owned by my new ISP.
Thanks for your help.
Re: Bad Provisioning from ISP Or Misconfigured hAP ac2?
Check whether the IP the ISP has asked you to set up at ether1 doesn't fit into the 100.64.0.0-10.127.255.255 range. If it does, it is not a public one but a CGNAT one. I suppose you'd notice yourself if it was a private one (192.168.x.y, 172.16.0.0-172.16.31.255.255, 10.a.b.c).
If you've got a public IP from them, as seems to be the case given that they gave you a /30 subnet, they simply forgot to exclude your account from their generic treatment, so its outgoing connections get NATed, and incoming connections to your public IP are either not routed to it or are firewalled at the ISP.
What sounds suspicious to me is that the address you've got is not shown as registered with them. If you can traceroute from somewhere else to that address and to the one which whatsmyip shows, are the final hops of the paths identical?
In any case, your own configuration on the WAN interface is correct (dhcp client off, statically configured own & gateway IPs, internet access works), and you have to talk to the ISP to fix this.
If you've got a public IP from them, as seems to be the case given that they gave you a /30 subnet, they simply forgot to exclude your account from their generic treatment, so its outgoing connections get NATed, and incoming connections to your public IP are either not routed to it or are firewalled at the ISP.
What sounds suspicious to me is that the address you've got is not shown as registered with them. If you can traceroute from somewhere else to that address and to the one which whatsmyip shows, are the final hops of the paths identical?
In any case, your own configuration on the WAN interface is correct (dhcp client off, statically configured own & gateway IPs, internet access works), and you have to talk to the ISP to fix this.