Access SFP through Mikrotik WAN

[ghost]

Hi, I got my module working using your instructions, thank you very much :)

I wonder if it is possible to access the modules Web interface (and SSH) when it is plugged in the WAN interface of my mikrotik (RB5009UG+S+).

I already tried adding the IP 10.10.1.2 on the sfp1 interface (including the route to 10.10.1.0/24) and adding a masquerade rule, but I'm not able to even ping it. (I also tried disable all dropping firewall rules)

[PKSpeleo]

Hi, Erik! What do you mean by accessing it? I can access SFP Web module from my PC connected to rb4011 where SFP module used by 10.10.1.1 for Telekom DE connection. What I have:

• IP address 10.10.1.2/24 net 10.10.1.0 interface: sfp-sfpplus1
• Route 10.10.1.0/24 -> spf-sfpplus1
• srcnat masquerade rule for Out sfp-sfpplus1

[ghost]

I would like to do the same thing you can do.

I set it up the way you did (at least I think so), but I'm not able to open the web interface or SSH into it.

This is my config I tried, but still unable to access the web:

/ip address
...
1   10.10.1.2/24      10.10.1.0       sfp1
...

/ip route
...
DAc 10.10.1.0/24       sfp1               0
...

/ip firewall/nat
...
0    chain=srcnat action=masquerade out-interface=sfp1
...

[PKSpeleo]

@develerik I wrote you email with my config and direct contacts;)

[PKSpeleo]

I connected to the router by LAN (not WAN) and reached SFP module. In my case - SFP has its own interface and not connected to WAN list. Is this the reason?

[ghost]

I took a look at your config, but could not find any differences in the important lines. I even tried a downgrade to ros 7.7, but it did not help (at least I could get rid of the annoying PPPoE reconnects I experienced).

My computer is connected via eth1 and I use sfp1->vlan7->pppoe as the WAN interface (sfp1 itself is no included in the WAN list like in your config). I have configured a masquerade rule for pppoe (ISP) and sfp1 (GPON SFP)

[PKSpeleo]

Are you sure that SFP module has a connection? Can you see this:

[ghost]

Yes it's running and link ok:

Also an ARP Ping does find it:

[PKSpeleo]

Then, I think, the problem can be that you maybe have other rules that catch your requests and redirect them to another interface. Try to disable all other rules. When you ping as you showed in the screenshot - you directly specify the interfaces, but when you doing a plain request - something redirects you to another. (Just a suggestion)

[ghost]

besides the ISP<->NAT rule I don't have any. The ping also fails if I don't check the ARP checkbox.

I found that I can see the request from my computer in Torch (but RX Rate stays at 0)

[poshul]

@develerik I wrote you email with my config and direct contacts;)

For those of us who've ended up here having similar problems, is there any chance you could post your config? I can't even get the route to work:

DAd  0.0.0.0/0        192.168.88.1         1
DIcH 10.10.1.0/24     sfp1                 0
DAc  192.168.88.0/24  bridgeLocal          0 

[poshul]

For those of us who've ended up here having similar problems, is there any chance you could post your config? So for breadcrumbs for anyone coming after me, the SFP's router facing interface does not come up until its plugged in to bright fiber.

I still had to manually assign the ARP address.

[ghost]

@poshul With this change, it finally worked. Thank you very much :)

[poshul]

@poshul With this change, it finally worked. Thank you very much :)

FYI it's also possible to just turn on ARP on the interface so that you don't need to manually add it.