[MikroTik CCR2116] Geen internet :-(

[martijndierckx]

Ik geraak er echt niet uit... En hoop dat jullie me kunnen helpen.
Kopietje van mijn vraag op het Mikrotik forum en aan Mikrotik support (zonder antwoord voorlopig) hieronder:

---

Ik heb net een CCR2116 gekocht waarmee ik mijn pfSense-router wil vervangen.

• primaire WAN (dhcp) is nog niet verbonden (sfp1-xgspon)
• backup WAN (dhcp) is verbonden met ether3 (Technicolor DOCSIS-modem voor Orange ISP)
• LAN is verbonden via een trunk op 2 geaggregeerde poorten ether1 en ether2 met mijn unifi-switchnetwerk

Wat zou mogelijk moeten zijn:
Clients op VLAN10 en VLAN9 zouden de enige VLAN's moeten zijn die toegang hebben tot internet.

Wat ik heb opgemerkt:

• DHCP-client werkt voor WAN. Default route wordt aangemaakt.
• Inter-VLAN-routering werkt.
• MACVLan-regels voor mdns werken ook
• De router kan internet pingen en DNS resolven
• Clients op vlan10 kunnen DNS resolven met de router als dns-server
• Clients op vlan10 kunnen geen toegang krijgen tot internet (http/https) en kunnen ook niet 1.1.1.1 pingen. Maar ze zouden dat dus wel moeten kunnen …
• Ik kan de beheerpagina van de modem op 192.168.100.1 openen
• Wanneer ik probeer verbinding te maken vanaf het internet naar mijn HTTP/HTTPS-server, nemen de dstnat-rule stats toe. Maar ik krijg geen antwoord, dus er wordt geen webpagina weergegeven.

Wat ik geprobeerd heb:

• alle drop-regels op de firewall uit te schakelen
• rechtstreeks naar de ether3-interface te verwijzen in plaats van de WAN-interfacelijst te gebruiken
• upgraden naar 7.17beta2. Nu weer op 7.16
• Het Mikrotik forum bevraagd https://forum.mikrotik.com/viewtopic.php?p=1102509
• Support bevraagd
• Ik heb zelfs aan chatgpt gevraagd wat er mis was met de config...

Please help…


Config:

code:

/interface bridge
add name=bridge priority=0 vlan-filtering=yes
add name=bridge-mdns protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name=ether1-lag-trunk
set [ find default-name=ether2 ] name=ether2-lag-trunk
set [ find default-name=ether3 ] name=ether3-wan-backup
set [ find default-name=ether13 ] name=ether13-localmanagement
set [ find default-name=sfp-sfpplus1 ] name=sfp1-xgspon
set [ find default-name=sfp-sfpplus4 ] name=sfp4-server-trunk
/interface vlan
add interface=bridge name=vlan1-management vlan-id=1
add interface=bridge name=vlan5-iot vlan-id=5
add interface=bridge name=vlan6-cameras vlan-id=6
add interface=bridge name=vlan9-iotonline vlan-id=9
add interface=bridge name=vlan10-lan vlan-id=10
add interface=bridge name=vlan15-wifiguests vlan-id=15
/interface macvlan
add interface=vlan5-iot mac-address=6A:95:4C:51:4D:B0 mode=private name=macvlan5-iot
add interface=vlan6-cameras mac-address=8E:33:47:CE:8C:E3 mode=private name=macvlan6-cameras
add interface=vlan9-iotonline mac-address=6E:FB:2B:AE:07:E5 mode=private name=macvlan9-iotonline
add interface=vlan10-lan mac-address=4E:CD:E3:3E:B1:FF mode=private name=macvlan10-lan
/interface bonding
add mode=802.3ad name=lag-trunk slaves=ether1-lag-trunk,ether2-lag-trunk
/interface list
add name=LAN
add name=ManagementAllowed
add name=WAN
/ip dhcp-server option
add code=43 name="Unifi adopt" value=0x0104c0a805d2
/ip pool
add name=pool-lan-dhcp ranges=192.168.10.2-192.168.10.99
add name=pool-iot-dhcp ranges=192.168.8.2-192.168.8.99
add name=pool-cameras-dhcp ranges=192.168.6.2-192.168.6.99
add name=pool-wifiguests-dhcp ranges=192.168.15.2-192.168.15.99
add name=pool-iotonline-dhcp ranges=192.168.9.2-192.168.9.99
add name=pool-management-dhcp ranges=192.168.5.2-192.168.5.99
add name=pool-ipsec-dhcp ranges=192.168.20.2-192.168.20.99
/ip dhcp-server
add address-pool=pool-lan-dhcp interface=vlan10-lan lease-time=2h name=dhcp-vlan10-lan
add address-pool=pool-iot-dhcp interface=vlan5-iot lease-time=2h name=dhcp-vlan5-iot
add address-pool=pool-cameras-dhcp disabled=yes interface=vlan6-cameras lease-time=2h name=dhcp-vlan6-cameras
add address-pool=pool-wifiguests-dhcp interface=vlan15-wifiguests lease-time=2h name=dhcp-vlan15-wifiguests
add address-pool=pool-iotonline-dhcp interface=vlan9-iotonline lease-time=2h name=dhcp-vlan9-iotonline
add address-pool=pool-management-dhcp interface=vlan1-management lease-time=2h name=dhcp-vlan1-management
/port
set 0 name=serial0
/interface bridge filter
add action=accept chain=forward comment="1. Allow mDNS queries from vlan10-lan" dst-address=224.0.0.251/32 dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF dst-port=5353 in-interface=\
    macvlan10-lan ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns src-port=5353
add action=accept chain=forward comment="2. Allow mDNS replies to vlan10-lan" dst-address=224.0.0.251/32 dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF dst-port=5353 in-bridge=\
    bridge-mdns ip-protocol=udp mac-protocol=ip out-interface=macvlan10-lan src-port=5353
add action=drop chain=forward comment="3. Drop mDNS queries from other VLANs" disabled=yes dst-address=224.0.0.251/32 dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF dst-port=5353 \
    in-bridge=bridge-mdns ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns src-port=5353
add action=accept chain=forward comment="Allow mDNS only" disabled=yes dst-address=224.0.0.251/32 dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF dst-port=5353 in-bridge=bridge-mdns \
    ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns src-port=5353
add action=accept chain=forward comment="1. Allow SSDP queries from vlan10-lan" dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1900 in-interface=\
    macvlan10-lan ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=accept chain=forward comment="2. Allow SSDP replies to vlan10-lan" dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1900 in-bridge=\
    bridge-mdns ip-protocol=udp mac-protocol=ip out-interface=macvlan10-lan
add action=drop chain=forward comment="3. Drop SSDP queries from other VLANs" disabled=yes dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1900 \
    in-bridge=bridge-mdns ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=accept chain=forward comment="Forward SSDP" disabled=yes dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1900 in-bridge=bridge-mdns \
    ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=accept chain=forward comment="1. Allow Sonos queries from vlan10-lan" dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1902 \
    in-interface=macvlan10-lan ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=accept chain=forward comment="2. Allow Sonos replies to vlan10-lan" dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1902 in-bridge=\
    bridge-mdns ip-protocol=udp mac-protocol=ip out-interface=macvlan10-lan
add action=drop chain=forward comment="3. Drop Sonos queries from other VLANs" disabled=yes dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1902 \
    in-bridge=bridge-mdns ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=accept chain=forward comment="Forward Sonos" disabled=yes dst-address=239.255.255.250/32 dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF dst-port=1902 in-bridge=bridge-mdns \
    ip-protocol=udp mac-protocol=ip out-bridge=bridge-mdns
add action=drop chain=forward comment="Drop all other L2 traffic" in-bridge=bridge-mdns out-bridge=bridge-mdns
/interface bridge nat
add action=src-nat chain=srcnat comment="mDNS - SNAT to Primary VLAN bridge" dst-mac-address=01:00:5E:00:00:FB/FF:FF:FF:FF:FF:FF to-src-mac-address=F4:1E:57:3D:AA:E5
add action=src-nat chain=srcnat comment="SSDP - SNAT to Primary VLAN bridge" dst-mac-address=01:00:5E:7F:FF:FA/FF:FF:FF:FF:FF:FF to-src-mac-address=F4:1E:57:3D:AA:E5
/interface bridge port
add bridge=bridge interface=sfp4-server-trunk
add bridge=bridge interface=lag-trunk
add bridge=bridge interface=ether12
add bridge=bridge interface=ether10 pvid=10
add bridge=bridge interface=ether9 pvid=9
add bridge=bridge interface=ether8 pvid=5
add bridge=bridge interface=ether6 pvid=6
add bridge=bridge interface=ether5 pvid=5
add bridge=bridge-mdns interface=macvlan5-iot
add bridge=bridge-mdns interface=macvlan6-cameras
add bridge=bridge-mdns interface=macvlan9-iotonline
add bridge=bridge-mdns interface=macvlan10-lan
/ip neighbor discovery-settings
set discover-interface-list=ManagementAllowed
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge tagged=lag-trunk,bridge,sfp4-server-trunk untagged=ether10 vlan-ids=10
add bridge=bridge tagged=bridge,lag-trunk,sfp4-server-trunk untagged=ether5 vlan-ids=5
add bridge=bridge tagged=bridge,lag-trunk,sfp4-server-trunk untagged=ether6 vlan-ids=6
add bridge=bridge tagged=bridge,lag-trunk,sfp4-server-trunk untagged=ether12 vlan-ids=1
add bridge=bridge tagged=bridge,lag-trunk,sfp4-server-trunk untagged=ether9 vlan-ids=9
add bridge=bridge tagged=bridge,lag-trunk,sfp4-server-trunk vlan-ids=15
/interface ethernet switch
set 0 l3-hw-offloading=yes name=switch
/interface list member
add interface=bridge list=LAN
add interface=vlan10-lan list=ManagementAllowed
add interface=vlan1-management list=ManagementAllowed
add interface=ether13-localmanagement list=ManagementAllowed
add interface=ether3-wan-backup list=WAN
add interface=sfp1-xgspon list=WAN
/interface ovpn-server servers
add mac-address=FE:CB:7E:18:7D:DE name=ovpn-server1
/ip address
add address=192.168.5.1/24 interface=vlan1-management network=192.168.5.0
add address=192.168.8.1/24 interface=vlan5-iot network=192.168.8.0
add address=192.168.9.1/24 interface=vlan9-iotonline network=192.168.9.0
add address=192.168.10.1/24 interface=vlan10-lan network=192.168.10.0
add address=192.168.15.1/24 interface=vlan15-wifiguests network=192.168.15.0
add address=192.168.6.1/24 interface=vlan6-cameras network=192.168.6.0
/ip cloud
set update-time=no
/ip dhcp-client
add default-route-distance=2 interface=ether3-wan-backup use-peer-dns=no use-peer-ntp=no
# Interface not active
add interface=sfp1-xgspon use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.5.0/24 dhcp-option="Unifi adopt" dns-server=192.168.5.1 gateway=192.168.5.1
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1
add address=192.168.8.0/24 dns-server=192.168.8.1 gateway=192.168.8.1
add address=192.168.9.0/24 dns-server=192.168.9.1 gateway=192.168.9.1
add address=192.168.10.0/24 dns-server=192.168.10.210 gateway=192.168.10.1
add address=192.168.15.0/24 dns-server=192.168.15.1 gateway=192.168.15.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip firewall address-list
add address=192.168.9.160 list=sonos
add address=192.168.9.161 list=sonos
add address=192.168.9.162 list=sonos
add address=192.168.9.163 list=sonos
add address=192.168.9.164 list=sonos
add address=192.168.9.165 list=sonos
add address=192.168.8.145 list=tuya
add address=192.168.8.146 list=tuya
/ip firewall filter
add action=fasttrack-connection chain=forward comment="fast-track for established,related" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=drop chain=input comment="drop blacklisted IPs" connection-state=new in-interface-list=WAN src-address-list=pwlgrzs-blacklist
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=forward comment="Allow forwarded HTTPS port 443" connection-nat-state=dstnat dst-port=443 in-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="Allow forwarded HTTP port 80" connection-nat-state=dstnat dst-port=80 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=input comment="allow Winbox" in-interface-list=ManagementAllowed port=8291 protocol=tcp
add action=accept chain=input comment="allow SSH" in-interface-list=ManagementAllowed port=22 protocol=tcp
add action=accept chain=input comment="allow mikrotik api" in-interface-list=ManagementAllowed port=8728 protocol=tcp
add action=accept chain=input comment="allow mikrotik api" in-interface-list=ManagementAllowed port=8729 protocol=tcp
add action=accept chain=input comment="allow ftp" in-interface-list=ManagementAllowed port=21 protocol=tcp
add action=accept chain=input comment="allow telnet" in-interface-list=ManagementAllowed port=23 protocol=tcp
add action=accept chain=input comment="allow web admin" in-interface-list=ManagementAllowed port=80 protocol=tcp
add action=accept chain=forward comment="Allow TCP for Sonos 3400" dst-address=192.168.10.0/24 dst-port=3400-3401 protocol=tcp src-address-list=sonos
add action=accept chain=forward comment="Allow TCP for Sonos 445" dst-address=192.168.10.0/24 dst-port=445 protocol=tcp src-address-list=sonos
add action=accept chain=forward comment="Allow TCP for Sonos 3500" dst-address=192.168.10.0/24 dst-port=3500 protocol=tcp src-address-list=sonos
add action=accept chain=forward comment="Allow UDP for Sonos 319" dst-address=192.168.10.0/24 dst-port=319-320 protocol=udp src-address-list=sonos
add action=accept chain=forward comment="Allow UDP for Sonos 6969" dst-address=192.168.10.0/24 dst-port=6969 protocol=udp src-address-list=sonos
add action=accept chain=forward comment="Allow UDP for Sonos 49152-65535" dst-address=192.168.10.0/24 dst-port=49152-65535 protocol=udp src-address-list=sonos
add action=accept chain=forward comment="Allow 192.168.5.180 to 192.168.10.210 on TCP port 3493 for UPS" dst-address=192.168.10.210 dst-port=3493 protocol=tcp src-address=192.168.5.180
add action=accept chain=forward comment="Allow 192.168.5.180 to 192.168.10.199 on all protocols and ports" dst-address=192.168.10.199 src-address=192.168.5.180
add action=accept chain=forward comment="Allow all traffic from vlan10-lan to other VLANs" src-address=192.168.10.0/24
add action=accept chain=forward comment="Allow internet access for vlan10-lan" out-interface-list=WAN src-address=192.168.10.0/24
add action=accept chain=forward comment="Allow internet access for vlan9-iotonline" out-interface-list=WAN src-address=192.168.9.0/24
add action=accept chain=forward comment="Allow access to NTP on the internet from vlan5-iot" dst-port=123 protocol=udp src-address=192.168.8.0/24
add action=drop chain=forward comment="Block traffic from other VLANs to vlan10-lan" dst-address=192.168.10.0/24
add action=drop chain=forward comment="Block traffic from vlan1-management to other VLANs" src-address=192.168.5.0/24
add action=drop chain=forward comment="Block internet access for all other VLANs" out-interface-list=WAN
add action=drop chain=forward comment="Deny Internet access from Tuya list" out-interface-list=WAN src-address-list=tuya
add action=drop chain=forward comment="Block TCP DNS from vlan5-iot" dst-port=53 protocol=tcp src-address=192.168.8.0/24
add action=drop chain=forward comment="Block UDP DNS from vlan5-iot" dst-port=53 protocol=udp src-address=192.168.8.0/24
add action=drop chain=forward comment="Deny DNS from Tuya list" dst-port=53 protocol=tcp src-address-list=tuya
add action=drop chain=forward comment="Deny DNS from Tuya list" dst-port=53 protocol=udp src-address-list=tuya
add action=accept chain=forward comment="Allow TCP DNS from vlan10-lan" dst-port=53 protocol=tcp src-address=192.168.10.0/24
add action=accept chain=forward comment="Allow  UDP DNS from vlan10-lan" dst-port=53 protocol=udp src-address=192.168.10.0/24
add action=accept chain=forward comment="Allow TCP DNS from vlan9-iotonline" dst-port=53 protocol=tcp src-address=192.168.9.0/24
add action=accept chain=forward comment="Allow UDP DNS from vlan9-iotonline" dst-port=53 protocol=udp src-address=192.168.9.0/24
add action=accept chain=forward comment="Allow TCP DNS from vlan15-wifiguests" dst-port=53 protocol=tcp src-address=192.168.15.0/24
add action=accept chain=forward comment="Allow UDP DNS from vlan15-wifiguests" dst-port=53 protocol=udp src-address=192.168.15.0/24
add action=drop chain=forward comment="Block traffic from vlan5-iot to other VLANs" src-address=192.168.8.0/24
add action=drop chain=forward comment="Block traffic from vlan6-cameras to other VLANs" src-address=192.168.6.0/24
add action=drop chain=forward comment="Block traffic from vlan9-iotonline to other VLANs" src-address=192.168.9.0/24
add action=drop chain=forward comment="Block traffic from vlan15-wifiguests to other VLANs" src-address=192.168.15.0/24
add action=drop chain=forward comment="drop access to clients behind NAT from WAN" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Internet access" out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Forward port 80" dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=192.168.10.210
add action=dst-nat chain=dstnat comment="Forward port 443" dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=192.168.10.210
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec mode-config
add address-pool=pool-ipsec-dhcp address-prefix-length=32 name=vpn-ipsec-ikev2
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set telnet address=192.168.10.0/24,192.168.5.0/24
set ftp address=192.168.10.0/24,192.168.5.0/24
set www address=192.168.10.0/24,192.168.5.0/24
set ssh address=192.168.10.0/24,192.168.5.0/24
set www-ssl address=192.168.10.0/24,192.168.5.0/24
set api address=192.168.10.0/24,192.168.5.0/24
set winbox address=192.168.10.0/24,192.168.5.0/24
set api-ssl address=192.168.10.0/24,192.168.5.0/24
/ip smb shares
set [ find default=yes ] directory=pub
/ip ssh
set strong-crypto=yes
/system clock
set time-zone-name=Europe/Brussels
/system health settings
set fan-min-speed-percent=10%
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=europe.pool.ntp.org
/system package update
set channel=testing
/system routerboard reset-button
set enabled=yes
/system routerboard settings
set enter-setup-on=delete-key
/system scheduler
add interval=1w name=dl-mt-blacklist on-event=pwlgrzs-blacklist-dl policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2000-01-01 start-time=00:05:00
add interval=1w name=ins-mt-blacklist on-event=pwlgrzs-blacklist-replace policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2000-01-01 start-time=00:10:00
/system script
add dont-require-permissions=no name=pwlgrzs-blacklist-dl owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/tool fetch url=\"https://raw.githubusercontent.com/pwlgrzs/Mikrotik-Blacklist/master/blacklist.rsc\" mode=https"
add dont-require-permissions=no name=pwlgrzs-blacklist-replace owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
    "/ip firewall address-list remove [find where list=\"pwlgrzs-blacklist\"]; /import file-name=blacklist.rsc; /file remove blacklist.rsc"
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=ManagementAllowed
/tool mac-server mac-winbox
set allowed-interface-list=ManagementAllowed

/ip route print detail

code:

Flags: D - dynamic; X - disabled, I - inactive, A - active; 
c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp 
   DAdH  dst-address=0.0.0.0/0 routing-table=main gateway=XXX.XXX.192.1 immediate-gw=XXX.XXX.192.1%ether3-wan-backup distance=2 scope=30 target-scope=10 
         vrf-interface=ether3-wan-backup 

   DAcH  dst-address=XXX.XXX.192.0/19 routing-table=main gateway=ether3-wan-backup immediate-gw=ether3-wan-backup distance=0 scope=10 target-scope=5 
         local-address=XXX.XXX.205.39%ether3-wan-backup 

   DAcH  dst-address=192.168.5.0/24 routing-table=main gateway=vlan1-management immediate-gw=vlan1-management distance=0 scope=10 target-scope=5 
         local-address=192.168.5.1%vlan1-management 

   DAcH  dst-address=192.168.6.0/24 routing-table=main gateway=vlan6-cameras immediate-gw=vlan6-cameras distance=0 scope=10 target-scope=5 
         local-address=192.168.6.1%vlan6-cameras 

   DAcH  dst-address=192.168.8.0/24 routing-table=main gateway=vlan5-iot immediate-gw=vlan5-iot distance=0 scope=10 target-scope=5 
         local-address=192.168.8.1%vlan5-iot 

   DAcH  dst-address=192.168.9.0/24 routing-table=main gateway=vlan9-iotonline immediate-gw=vlan9-iotonline distance=0 scope=10 target-scope=5 
         local-address=192.168.9.1%vlan9-iotonline 

   DAcH  dst-address=192.168.10.0/24 routing-table=main gateway=vlan10-lan immediate-gw=vlan10-lan distance=0 scope=10 target-scope=5 
         local-address=192.168.10.1%vlan10-lan 

   DAcH  dst-address=192.168.15.0/24 routing-table=main gateway=vlan15-wifiguests immediate-gw=vlan15-wifiguests distance=0 scope=10 target-scope=5 
         local-address=192.168.15.1%vlan15-wifiguests

/ip firewall nat print

code:

Flags: X - disabled, I - invalid; D - dynamic 
 0    ;;; Internet access
      chain=srcnat action=masquerade out-interface-list=WAN log=no log-prefix="" 

 1    ;;; Forward port 80
      chain=dstnat action=dst-nat to-addresses=192.168.10.210 protocol=tcp in-interface-list=WAN dst-port=80 log=no log-prefix="" 

 2    ;;; Forward port 443
      chain=dstnat action=dst-nat to-addresses=192.168.10.210 protocol=tcp in-interface-list=WAN dst-port=443 log=no log-prefix=""

/ip firewall nat print stats

code:

Columns: CHAIN, ACTION, BYTES, PACKETS
# CHAIN   ACTION       BYTES  PACKETS
;;; Internet access
0 srcnat  masquerade  73 882    1 088
;;; Forward port 80
1 dstnat  dst-nat         75        1
;;; Forward port 443
2 dstnat  dst-nat          0        0

/ip firewall filter print

code:

Flags: X - disabled, I - invalid; D - dynamic 
 0  D ;;; special dummy rule to show fasttrack counters
      chain=forward action=passthrough 

 1    ;;; fast-track for established,related
      chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related log=no log-prefix="" 

 2    ;;; accept established,related,untracked
      chain=forward action=accept connection-state=established,related,untracked log=no log-prefix="" 

 3    ;;; accept established,related,untracked
      chain=input action=accept connection-state=established,related,untracked log=no log-prefix="" 

 4    ;;; drop invalid
      chain=input action=drop connection-state=invalid log=no log-prefix="" 

 5    ;;; drop blacklisted IPs
      chain=input action=drop connection-state=new src-address-list=pwlgrzs-blacklist in-interface-list=WAN log=no log-prefix="" 

 6    ;;; accept ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 7    ;;; Allow forwarded HTTPS port 443
      chain=forward action=accept connection-nat-state=dstnat protocol=tcp in-interface-list=WAN dst-port=443 log=no log-prefix="" 

 8    ;;; Allow forwarded HTTP port 80
      chain=forward action=accept connection-nat-state=dstnat protocol=tcp in-interface-list=WAN dst-port=80 log=no log-prefix="" 

 9    ;;; drop all from WAN not DSTNATed
      chain=input action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix="" 

10    ;;; allow Winbox
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=8291 log=no log-prefix="" 

11    ;;; allow SSH
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=22 log=no log-prefix="" 

12    ;;; allow mikrotik api
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=8728 log=no log-prefix="" 

13    ;;; allow mikrotik api
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=8729 log=no log-prefix="" 

14    ;;; allow ftp
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=21 log=no log-prefix="" 

15    ;;; allow telnet
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=23 log=no log-prefix="" 

16    ;;; allow web admin
      chain=input action=accept protocol=tcp in-interface-list=ManagementAllowed port=80 log=no log-prefix="" 

17    ;;; Allow TCP for Sonos 3400
      chain=forward action=accept protocol=tcp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=3400-3401 log=no log-prefix="" 

18    ;;; Allow TCP for Sonos 445
      chain=forward action=accept protocol=tcp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=445 

19    ;;; Allow TCP for Sonos 3500
      chain=forward action=accept protocol=tcp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=3500 

20    ;;; Allow UDP for Sonos 319
      chain=forward action=accept protocol=udp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=319-320 log=no log-prefix="" 

21    ;;; Allow UDP for Sonos 6969
      chain=forward action=accept protocol=udp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=6969 

22    ;;; Allow UDP for Sonos 49152-65535
      chain=forward action=accept protocol=udp dst-address=192.168.10.0/24 src-address-list=sonos dst-port=49152-65535 

23    ;;; Allow 192.168.5.180 to 192.168.10.210 on TCP port 3493 for UPS
      chain=forward action=accept protocol=tcp src-address=192.168.5.180 dst-address=192.168.10.210 dst-port=3493 

24    ;;; Allow 192.168.5.180 to 192.168.10.199 on all protocols and ports
      chain=forward action=accept src-address=192.168.5.180 dst-address=192.168.10.199 

25    ;;; Allow all traffic from vlan10-lan to other VLANs
      chain=forward action=accept src-address=192.168.10.0/24 log=no log-prefix="" 

26    ;;; Allow internet access for vlan10-lan
      chain=forward action=accept src-address=192.168.10.0/24 out-interface-list=WAN log=no log-prefix="" 

27    ;;; Allow internet access for vlan9-iotonline
      chain=forward action=accept src-address=192.168.9.0/24 out-interface-list=WAN log=no log-prefix="" 

28    ;;; Allow access to NTP on the internet from vlan5-iot
      chain=forward action=accept protocol=udp src-address=192.168.8.0/24 dst-port=123 log=no log-prefix="" 

29    ;;; Block traffic from other VLANs to vlan10-lan
      chain=forward action=drop dst-address=192.168.10.0/24 log=no log-prefix="" 

30    ;;; Block traffic from vlan1-management to other VLANs
      chain=forward action=drop src-address=192.168.5.0/24 log=no log-prefix="" 

31    ;;; Block internet access for all other VLANs
      chain=forward action=drop out-interface-list=WAN log=no log-prefix="" 

32    ;;; Deny Internet access from Tuya list
      chain=forward action=drop src-address-list=tuya out-interface-list=WAN log=no log-prefix="" 

33    ;;; Block TCP DNS from vlan5-iot
      chain=forward action=drop protocol=tcp src-address=192.168.8.0/24 dst-port=53 log=no log-prefix="" 

34    ;;; Block UDP DNS from vlan5-iot
      chain=forward action=drop protocol=udp src-address=192.168.8.0/24 dst-port=53 log=no log-prefix="" 

35    ;;; Deny DNS from Tuya list
      chain=forward action=drop protocol=tcp src-address-list=tuya dst-port=53 log=no log-prefix="" 

36    ;;; Deny DNS from Tuya list
      chain=forward action=drop protocol=udp src-address-list=tuya dst-port=53 log=no log-prefix="" 

37    ;;; Allow TCP DNS from vlan10-lan
      chain=forward action=accept protocol=tcp src-address=192.168.10.0/24 dst-port=53 log=no log-prefix="" 

38    ;;; Allow  UDP DNS from vlan10-lan
      chain=forward action=accept protocol=udp src-address=192.168.10.0/24 dst-port=53 log=no log-prefix="" 

39    ;;; Allow TCP DNS from vlan9-iotonline
      chain=forward action=accept protocol=tcp src-address=192.168.9.0/24 dst-port=53 log=no log-prefix="" 

40    ;;; Allow UDP DNS from vlan9-iotonline
      chain=forward action=accept protocol=udp src-address=192.168.9.0/24 dst-port=53 log=no log-prefix="" 

41    ;;; Allow TCP DNS from vlan15-wifiguests
      chain=forward action=accept protocol=tcp src-address=192.168.15.0/24 dst-port=53 log=no log-prefix="" 

42    ;;; Allow UDP DNS from vlan15-wifiguests
      chain=forward action=accept protocol=udp src-address=192.168.15.0/24 dst-port=53 log=no log-prefix="" 

43    ;;; Block traffic from vlan5-iot to other VLANs
      chain=forward action=drop src-address=192.168.8.0/24 log=no log-prefix="" 

44    ;;; Block traffic from vlan6-cameras to other VLANs
      chain=forward action=drop src-address=192.168.6.0/24 log=no log-prefix="" 

45    ;;; Block traffic from vlan9-iotonline to other VLANs
      chain=forward action=drop src-address=192.168.9.0/24 log=no log-prefix="" 

46    ;;; Block traffic from vlan15-wifiguests to other VLANs
      chain=forward action=drop src-address=192.168.15.0/24 log=no log-prefix="" 

47    ;;; drop access to clients behind NAT from WAN
      chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix=""

/ip firewall filter print stats

code:

Flags: D - DYNAMIC
Columns: CHAIN, ACTION, BYTES, PACKETS
 #   CHAIN    ACTION                  BYTES  PACKETS
;;; special dummy rule to show fasttrack counters
 0 D forward  passthrough            68 421      161
;;; fast-track for established,related
 1   forward  fasttrack-connection  155 809      885
;;; accept established,related,untracked
 2   forward  accept                155 809      885
;;; accept established,related,untracked
 3   input    accept                783 897    8 088
;;; drop invalid
 4   input    drop                   10 411       94
;;; drop blacklisted IPs
 5   input    drop                        0        0
;;; accept ICMP
 6   input    accept                 42 576       33
;;; Allow forwarded HTTPS port 443
 7   forward  accept                      0        0
;;; Allow forwarded HTTP port 80
 8   forward  accept                     75        1
;;; drop all from WAN not DSTNATed
 9   input    drop                    5 257       56
;;; allow Winbox
10   input    accept                     64        1
;;; allow SSH
11   input    accept                      0        0
;;; allow mikrotik api
12   input    accept                      0        0
;;; allow mikrotik api
13   input    accept                      0        0
;;; allow ftp
14   input    accept                      0        0
;;; allow telnet
15   input    accept                      0        0
;;; allow web admin
16   input    accept                      0        0
;;; Allow TCP for Sonos 3400
17   forward  accept                      0        0
;;; Allow TCP for Sonos 445
18   forward  accept                      0        0
;;; Allow TCP for Sonos 3500
19   forward  accept                      0        0
;;; Allow UDP for Sonos 319
20   forward  accept                      0        0
;;; Allow UDP for Sonos 6969
21   forward  accept                      0        0
;;; Allow UDP for Sonos 49152-65535
22   forward  accept                      0        0
;;; Allow 192.168.5.180 to 192.168.10.210 on TCP port 3493 for UPS
23   forward  accept                      0        0
;;; Allow 192.168.5.180 to 192.168.10.199 on all protocols and ports
24   forward  accept                      0        0
;;; Allow all traffic from vlan10-lan to other VLANs
25   forward  accept                 19 526      279
;;; Allow internet access for vlan10-lan
26   forward  accept                      0        0
;;; Allow internet access for vlan9-iotonline
27   forward  accept                    380        7
;;; Allow access to NTP on the internet from vlan5-iot
28   forward  accept                    380        5
;;; Block traffic from other VLANs to vlan10-lan
29   forward  drop                        0        0
;;; Block traffic from vlan1-management to other VLANs
30   forward  drop                       76        1
;;; Block internet access for all other VLANs
31   forward  drop                       40        1
;;; Deny Internet access from Tuya list
32   forward  drop                        0        0
;;; Block TCP DNS from vlan5-iot
33   forward  drop                        0        0
;;; Block UDP DNS from vlan5-iot
34   forward  drop                        0        0
;;; Deny DNS from Tuya list
35   forward  drop                        0        0
;;; Deny DNS from Tuya list
36   forward  drop                        0        0
;;; Allow TCP DNS from vlan10-lan
37   forward  accept                      0        0
;;; Allow  UDP DNS from vlan10-lan
38   forward  accept                      0        0
;;; Allow TCP DNS from vlan9-iotonline
39   forward  accept                      0        0
;;; Allow UDP DNS from vlan9-iotonline
40   forward  accept                      0        0
;;; Allow TCP DNS from vlan15-wifiguests
41   forward  accept                      0        0
;;; Allow UDP DNS from vlan15-wifiguests
42   forward  accept                      0        0
;;; Block traffic from vlan5-iot to other VLANs
43   forward  drop                        0        0
;;; Block traffic from vlan6-cameras to other VLANs
44   forward  drop                        0        0
;;; Block traffic from vlan9-iotonline to other VLANs
45   forward  drop                        0        0
;;; Block traffic from vlan15-wifiguests to other VLANs
46   forward  drop                        0        0
;;; drop access to clients behind NAT from WAN
47   forward  drop                        0        0

/interface list member print

code:

Columns: LIST, INTERFACE
# LIST               INTERFACE              
0 LAN                bridge                 
1 ManagementAllowed  vlan10-lan             
2 ManagementAllowed  vlan1-management       
3 ManagementAllowed  ether13-localmanagement
4 WAN                ether3-wan-backup      
5 WAN                sfp1-xgspon

/ip address print

code:

Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
#   ADDRESS           NETWORK       INTERFACE        
0   192.168.5.1/24    192.168.5.0   vlan1-management 
1   192.168.8.1/24    192.168.8.0   vlan5-iot        
2   192.168.9.1/24    192.168.9.0   vlan9-iotonline  
3   192.168.10.1/24   192.168.10.0  vlan10-lan       
4   192.168.15.1/24   192.168.15.0  vlan15-wifiguests
5   192.168.6.1/24    192.168.6.0   vlan6-cameras    
6 D XXX.XXX.205.39/19  XXX.XXX.192.0  ether3-wan-backup

/ip dhcp-client print detail

code:

Flags: X - disabled, I - invalid, D - dynamic 
 0   interface=ether3-wan-backup add-default-route=yes default-route-distance=2 use-peer-dns=no use-peer-ntp=no dhcp-options=hostname,clientid status=bound address=XXX.XXX.205.39/19 
     gateway=XXX.XXX.192.1 dhcp-server=XXX.XXX.36.17 primary-dns=XXX.XXX.129.90 secondary-dns=XXX.XXX.129.94 primary-ntp=XXX.XXX.138.215 secondary-ntp=XXX.XXX.173.74 expires-after=54m39s 

 1 I ;;; Interface not active
     interface=sfp1-xgspon add-default-route=yes default-route-distance=1 use-peer-dns=no use-peer-ntp=no dhcp-options=hostname,clientid

edit: post van engels naar nederlands vertaald

[rens-br]

@martijndierckx zou je je openingspost naar het Nederlands willen vertalen? We zijn een Nederlands forum en de voertaal is dan ook Nederlands.

[martijndierckx]

rens-br schreef op maandag 14 oktober 2024 @ 09:33:
[mbr]
@martijndierckx zou je je openingspost naar het Nederlands willen vertalen? We zijn een Nederlands forum en de voertaal is dan ook Nederlands.
[/]

done

[lier]

Vooropgesteld, ik heb geen ervaring met mDNS. Hierbij mijn 2 centen:

Firewall:

• Gebruik geen VLAN ID=1
• Sorteer je rules, eerst input, dan forward chain
• Sluit een chain af met "drop all else" en definieer alleen wat toegestaan is

code:

add action=accept chain=forward comment="Allow internet access for vlan10-lan" out-interface-list=WAN src-address=192.168.10.0/24

Mooier om hier of een interface list of een VLAN interface te definiëren.
Is minder foutgevoelig en komt dan overeen met het comment.

code:

add action=accept chain=forward comment="Allow TCP DNS from vlan10-lan" dst-port=53 protocol=tcp src-address=192.168.10.0/24
add action=accept chain=forward comment="Allow  UDP DNS from vlan10-lan" dst-port=53 protocol=udp src-address=192.168.10.0/24

Aangezien je DNS server 192.168.10.210 is, zel deze rule niet geraakt worden.

Overigens nog geen antwoord waarom Internet niet werkt (werkt Internet wel op een ander VLAN?).

Ben benieuwd, zal ook eens op het MikroTik forum kijken. Ben benieuwd of anav al gereageerd heeft...

[martijndierckx]

Merci alvast om effe mee te kijken!

VLAN1 ... moet ik eens werk van maken.
Maar afgezien van 'het is niet recommended', mag het toch absoluut niet bijdragen aan het issue?

Volgorde-> dus:
Input fasttrack
Input allow
Input deny
Forward fasttrack
Forward allow
Forward deny

Of is het?:
Input fasttrack
Forward fasttrack
Input allow
Forward allow
Input deny
Forward deny

De dns server op vlan10, zit op het 10.0/24 netwerk, dus zou toch van die regel moeten kunnen profiteren?
Los daarvan, die is ingesteld om DoH te gebruiken.

Het internet probleem is echt een mindfuck van jewelste.
Ik staar er mezelf al een week blind op.

Ik had al poorten op de router toegewezen aan de vlans om rechtstreeks te testen.
Maar ik moet het opnieuw eens checken... Ik weet niet meer of ik dat al gedaan had.

[lier]

Het gebruik van vlan id 1 kan tot vreemd gedrag leiden.

Ga voor wat betreft de firewall uit van de default filter rules. Pas de laatste rule aan (naar een block everything else op die chain) en ga vervolgens toevoegen wat mag. Even terug naar de basis.

De dns server op vlan10, zit op het 10.0/24 netwerk, dus zou toch van die regel moeten kunnen profiteren?

Is in hetzelfde subnet, dus dat verkeer komt niet langs de firewall.

[martijndierckx]

Ik kijk eens of ik hier gemakkelijk van die VLAN1 kan afgeraken. Ik vrees dat ik raar gedrag ga krijgen als ik dat wil wijzigen ... maar misschien moet ik het er maar op wagen

Wat betreft de dns:
Clients gaan inderdaad rechtstreeks naar die dns server, maar als die server upstream wil gebruik maken van 1.1.1.1 op tcp/udp 53, dan lukt dat normaal wel langs die regel he ...?

[lier]

martijndierckx schreef op maandag 14 oktober 2024 @ 14:23:
Ik kijk eens of ik hier gemakkelijk van die VLAN1 kan afgeraken. Ik vrees dat ik raar gedrag ga krijgen als ik dat wil wijzigen ... maar misschien moet ik het er maar op wagen

Maak een export voordat je begint. Kan je altijd terug naar die situatie.

Wat betreft de dns:
Clients gaan inderdaad rechtstreeks naar die dns server, maar als die server upstream wil gebruik maken van 1.1.1.1 op tcp/udp 53, dan lukt dat normaal wel langs die regel he ...?

Klopt. En clients kunnen (als ze bijvoorbeeld ingebakken DNS servers hebben) ook direct naar de publieke DNS server.

[MasterL]

Eens met @lier je firewall rules zijn voor mij bijna onleesbaar.. Allow wat je wil (consolideer zoveel mogelijk) en een algemene block als laatste (alles wat niet "allowed is). Ik zou persoonlijk alleen niet de "input" rules bovenaan zetten, Mikrotik en IPtables renderen hun rules van boven naar beneden. Dus rules die bijna nooit gebruikt worden zoals je API/ICMP/SSH/ etc etc worden elke keer geanalyseerd bij elke pakketje van het internet of intravlan routing wat onnodige CPU load oplevert. Ik zet de rules met de meeste hits bovenaan zodat de er geen andere rules onnodig gecheckt moeten worden. De rule processing stopt namelijk bij de eerste hit. Daarom ze je de fasttrack/established,related rules ook bovenaan.

Inhoudelijk..Je routing lijkt oke.. Wat als je terug gaat naar de basis?

1: Config een interface (4?) en geef deze een uniek ip/range.
2: Plaats op nummer 1 een firewall rule: Source uniek ip/range > allow > 0.0.0.0,out-interface.
3: Sluit een laptop aan op interface (4?) en ga testen.

Geen bridge/filter configs niks gewoon basic.

[Thralas]

Waarom gebruik je macvlans? Waarom volstaat enkel het vlan niet?

Ik vraag me ten zeerste af of je configuratie überhaupt wel klopt zo, volgens mij zijn macvlans bedoeld om bovenop fysieke interfaces te functioneren, maar jij zet ze op een vlan interface. Ik betwijfel of dat hoort te werken, al was het maar vanwege onderstaande:

quote: https://help.mikrotik.com/docs/display/ROS/MACVLAN

A MACVLAN interface can only receive broadcast packets, packets addressed to its own MAC address, and a limited number of multicast addresses. If the physical interface has a VLAN configured, the MACVLAN interface cannot receive packets from that VLAN.

Je config is nu te complex voor mij om te beredeneren of dat is wat je hier parten speelt: ik stel voor dat je al je macvlans er eens tussenuithaalt (en al die bridge filter rules ook disablet) en dan bekijkt hoe het gaat.

En werkt dat niet, dan wat hierboven gesuggereerd wordt (beginnen met een héle simpele NAT-config, en dan stap voor stap lagen toevoegen).

[martijndierckx]

Ok, bedankt voor de vele reacties!

Ik heb intussen VLAN1 buitengezwierd. Deze wordt nu niet meer gebruikt. Stond al lang op mijn lijstje, maar nooit toe gekomen.

• Management zit nu op VLAN5, mooi gelijklopend met de ip range 5.0/24
• IOT zit nu op VLAN8, mooi gelijklopend met de ip range 8.0/24

Maar dat verandert niets aan de behaviour...

@MasterL
Ik heb ether4 rechtstreeks een ip adres gegeven, dus zonder vlans/bridge: 192.168.44.1/24
Ik heb een dhcp server opgezet op die poort: 192.168.44.2-192.168.44.99
Ik heb 2 regels helemaal bovenaan toegevoegd in de firewall:

code:

1    ;;; DEBUG: Allow all
      chain=input action=accept src-address=192.168.44.0/24 log=no log-prefix="" 

 2    ;;; DEBUG: Allow all
      chain=forward action=accept src-address=192.168.44.0/24 log=no log-prefix=""

Maar ... vanop mijn Mac, aangesloten op ether4 (wifi uit voor de zekerheid), krijg ik zelfde behaviour:
Ik krijg een IP, ik kan dns resolven, maar ik kan niet 1.1.1.1 pingen


@Thralas
Ik gebruik MACVLANs om multicast trafiek toe te laten tussen de vlans.
Daar vind je hier een postje van: https://forum.mikrotik.com/viewtopic.php?t=204025
Lijkt ook erg mooi te werken. Ik heb echter eerder, in 1 van mijn attempts reeds geprobeerd om al die dingen uit te schakelen, zonder resultaat


Ik zal nog eens proberen om helemaal van scratch te beginnen, voor de 3de keer.
En enkel bovenstaande simpele config toe te passen.

Andere ideeën zijn welkom :-)
HW offloading kan toch zeker geen parten spelen he?

[Kabouterplop01]

Ik zou als ik jouw was die log eens op yes zetten, want nu werkt het "toch" niet.
Je moet toch even debuggen en zonder die log doe je dat eigenlijk niet.
(Ik heb het over je start config)
desnoods met 1 ip adres om mee te beginnen.
Begin met je ping en/of trace 1.1.1.1 (dan heb je laag 3 getest en toets je je eigen routering, maar ook op ISP nivo. Je verwacht niet dat het niet werkt met een d.m.v. een dhcp gekregen ip adres op je WAN)
En dan met ping hostname om te resolven.
Als dat werkt "Heb je internet".

[MasterL]

Ik snap er oprecht niks van...
Worden deze twee rules überhaupt "gehit"?

chain=forward action=accept src-address=192.168.44.0/24 log=no log-prefix=""
/ip firewall nat
add action=masquerade chain=srcnat comment="Internet access" out-interface-list=WAN

Lijkt wel als of je NAT niet functioneert o.i.d.

[martijndierckx]

@MasterL Effe wat testjes gedaan ... Als ik vanaf dat debugging netwerkje op ether4 probeer te pingen:

• Pingen naar 1.1.1.1 increased nergens stats. Dus geen firewall of NAT regel die geraakt wordt. Het pingen lukt niet.
• Pingen naar het adres van de router op een VLAN (bv 192.168.10.1), doet wel de stats increasen van de debug regels die ik had toegevoegd (zie hierboven). De NAT regels worden niet geraakt. Het pingen lukt ook effectief.

[martijndierckx]

EUREKA!

Issue was HW offloading.
Door HW offloading uit te schakelen op de WAN interfaces, werkt het :-)

[Thralas]

[b]martijndierckx in "[MikroTik CCR2116] Geen internet :-("martijndierckx schreef op dinsdag 15 oktober 2024 @
@Thralas
Ik gebruik MACVLANs om multicast trafiek toe te laten tussen de vlans.
Daar vind je hier een postje van: https://forum.mikrotik.com/viewtopic.php?t=204025
Lijkt ook erg mooi te werken.

Aha. Dat is wel een enorme hack..

In v7.16 en nieuwer zit een mDNS repeater ingebouwd (zie changelog en datzelfde topic - mogelijk had je dat al gezien). Als dat je use case dekt is dat stukken netter..