Now that my tunnel is working...
I am using the MikroTik RouterBOARD 952Ui-5ac2nD to provide stand-alone access to a remote mesh. For this purpose I really only need the Mikrotik node to be reachable vie wired ethernet. For simplicity, I'd prefer to just connect to the Mijkrotik on its WAN (Internet) interface which appears on my LAN. All of this works just fine.
The problem I have run into is connecting to remote mesh nodes through the Mikrotik and the tunnel. I have created a route on my desktop computer (MacOS) that sends all traffic for the 10 network to the Mikrotik's "WAN" address. I can test that with traceroute, and see the route goes to the Mikrotok, but dies there:
$ traceroute to 10.240.37.49 (10.240.37.49), 64 hops max, 52 byte packets
1 192.168.5.77 (192.168.5.77) 0.552 ms 0.439 ms 0.359 ms
2 192.168.5.77 (192.168.5.77) 0.314 ms 0.406 ms 0.502 ms
Similarly, if I ssh into the Mikrotik the same traceroute fails.
$ traceroute 10.240.37.49
traceroute to 10.240.37.49 (10.240.37.49), 30 hops max, 38 byte packets
1 *^C
FWIW, the routing table shows:
default via 192.168.5.1 dev eth0
10.0.0.0/8 dev eth1.2 scope link src 10.219.44.57
10.0.0.0/8 dev wlan1 scope link src 10.218.44.57
10.209.97.200/29 dev eth1.0 scope link src 10.209.97.201
172.31.166.16/30 via 172.31.166.18 dev tun60
172.31.166.16/30 dev tun60 scope link src 172.31.166.17
192.168.5.0/24 dev eth0 scope link src 192.168.5.77
Did I miss something?
Thank you for the 5GHz WiFi AP connection reminder. That fixed another problem I was having.
-Damon K9CQB
Also, I would like to not only come up with a solution I like, but I'd like to learn why what I am trying to do does not work.
BTW, note the 5gHz option only seems to work on the nightly builds. At the moment I am on 3.18.9.0 because I was trying to resolve a tunnel problem, though I may switch back.
deleted for wrongness
Make sure you have broken out VLAN 1 for the Internet using a managed Ethernet switch, then plug your LAN (which is assumed to have Internet access on it) into the managed switch on the port you configured. Switch configuration info is provided under the Software tab.
Andre, K6AH
It doesn't work because the node's firewall and routing tables do not have entries that do this. The are multiple firewall rules/chains and multiple routing tables on the node. The firewall rules and routing tables order are different depending if the traffic comes from a process on the node or traffic coming in over a given interface (WAN, LAN, DTDLink, wifi, tunnel). Traffic coming in over the WAN interface, by design, is intended to block and not allow intrusion or attack -- it's a common NAT Masquerade boundary. It's working as intended to interface with a foreign un-trusted network. Your purpose is very different.
Joe AE6XE