Mit zwei Internetzugängen auf MikroTik RB4011iGS+

Hallo zusammen,
ich habe mit der Vorlage von aqui (Mikrotik VLAN Konfiguration ab RouterOS Version 6.41) erfolgreich meinen Router MikroTik RB4011iGS+ mit VLANs programmieren können. Vielen Dank @aqui !!! Nur mit den Internetzugängen hapert es noch. Um ehrlich zu sen, seit einigen Tagen beiße ich mir daran die Zähne aus. :D

An Port 1 vom RB4011iGS+ kommt später ein DrayTek Vigor 2865, der sich vom MT per PPPoE anwählen soll.
Zur Zeit ist am DSL Anschluss noch eine FritzBox, die das alte Netzwerk versorgt. Das soll auch momentan noch solange bleiben, bis ich das neue Netzwerk installiert habe.

An Port 2 vom RB4011iGS+ kommt ein LTE Modem von Teltonika RUTX09. Das Modem kann man nur in den Bridge, oder Passthrough Modus versetzen. Ich habe mich für den Bridge Modus entschieden, da ich mal irgendwo gelesen habe, dass das die bessere Wahl ist.
Das Modem leitet die öffentliche IP an den RB4011iGS+ weiter, wenn die vorher eingegebene MAC-Adresse stimmt.
Das macht es auch, denn die IP ist im MT zu sehen. Genau an der Stelle komme ich nicht weiter. Bis auf die Übergabe der IP bekomme ich es nicht hin, auch nur ein Bit in bewegung zu setzen.
Das Modem arbeitet, das habe ich mit einem Linux rechner getestet.

Könnt irh mir da ein wenig auf die Sprünge helfen, dass das auch mit einem automatischen Failover funktioniert?
Vielen Dank!!!

Als Anhang habe ich die aktuelle Config des RB4011iGS+.

# jan/02/1970 21:44:12 by RouterOS 7.9
# software id = UGTZ-ZKF4
#
# model = RB4011iGS+
# serial number = HEC08ZB8GFR
/interface bridge
add ingress-filtering=no name=VLAN-Bridge1 vlan-filtering=yes
add name=br-TEST
/interface ethernet
set [ find default-name=ether1 ] name=eth01-PPPoE-DSL
set [ find default-name=ether2 ] name=eth02-PPPoE-LTE
set [ find default-name=ether3 ] disabled=yes name=eth03-
set [ find default-name=ether4 ] name=eth04-MGMT
set [ find default-name=ether5 ] name=eth05-MGMT
set [ find default-name=ether6 ] disabled=yes name=eth06-
set [ find default-name=ether7 ] name=eth07-Bonding1
set [ find default-name=ether8 ] name=eth08-Bonding2
set [ find default-name=ether9 ] name=eth09-Bonding3
set [ find default-name=ether10 ] name=eth10-Bonding4 poe-out=off
set [ find default-name=sfp-sfpplus1 ] name=sfpplus01-Uplink_CRS326
/interface pppoe-client
add add-default-route=yes allow=pap,chap,mschap2 disabled=no interface=eth01-PPPoE-DSL name=PPPoE-WAN-Telekom-DSL user=...XXX...@t-online.de
add allow=pap,chap,mschap2 disabled=no interface=eth02-PPPoE-LTE name=PPPoE-WAN-Telekom-LTE user=XXX
/interface eoip
add disabled=yes mac-address=xx:xx:xx:xx:xx:xx name=eoip-tunnel1 remote-address=0.0.0.0 tunnel-id=0
/interface vlan
add interface=VLAN-Bridge1 name=VLAN1-MGMT vlan-id=1
add interface=VLAN-Bridge1 name=VLAN5-Services vlan-id=5
add interface=eth01-PPPoE-DSL name=VLAN7-Telekom vlan-id=7
add interface=VLAN-Bridge1 name=VLAN20-Main vlan-id=20
add interface=VLAN-Bridge1 name=VLAN25-Guest vlan-id=25
add interface=VLAN-Bridge1 name=VLAN30-Multimedia vlan-id=30
add interface=VLAN-Bridge1 name=VLAN32-Menage vlan-id=32
add interface=VLAN-Bridge1 name=VLAN40-Camera vlan-id=40
add interface=VLAN-Bridge1 name=VLAN50-Server vlan-id=50
add interface=VLAN-Bridge1 name=VLAN55-Photovoltaik vlan-id=55
add interface=VLAN-Bridge1 name=VLAN60-Printer vlan-id=60
add interface=VLAN-Bridge1 name=VLAN70-Studio-System vlan-id=70
add interface=VLAN-Bridge1 name=VLAN74-Studio-Main vlan-id=74
add interface=VLAN-Bridge1 name=VLAN78-Studio-Guest vlan-id=78
add interface=VLAN-Bridge1 name=VLAN80-VoIP vlan-id=80
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool-VLAN1 ranges=120.18.11.195-120.18.11.199
add name=dhcp_pool-VLAN5 ranges=120.18.5.195-120.18.5.199
add name=dhcp_pool-VLAN20 ranges=120.18.20.195-120.18.20.199
add name=dhcp_pool-VLAN25 ranges=120.18.25.195-120.18.25.199
add name=dhcp_pool-VLAN30 ranges=120.18.30.195-120.18.30.199
add name=dhcp_pool-VLAN32 ranges=120.18.32.195-120.18.32.199
add name=dhcp_pool-VLAN40 ranges=120.18.40.195-120.18.40.199
add name=dhcp_pool-VLAN50 ranges=120.18.50.195-120.18.50.199
add name=dhcp_pool-VLAN55 ranges=120.18.55.195-120.18.55.199
add name=dhcp_pool-VLAN60 ranges=120.18.60.195-120.18.60.199
add name=dhcp_pool-VLAN70 ranges=120.18.70.195-120.18.70.199
add name=dhcp_pool-VLAN74 ranges=120.18.74.195-120.18.74.199
add name=dhcp_pool-VLAN78 ranges=120.18.78.195-120.18.78.199
add name=dhcp_pool-VLAN80 ranges=120.18.80.195-120.18.80.199
add name=dhcp_pool16 ranges=10.10.10.2-10.10.10.254
/ip dhcp-server
add address-pool=dhcp_pool-VLAN1 interface=VLAN1-MGMT lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN1
add address-pool=dhcp_pool-VLAN5 interface=VLAN5-Services lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN5
add address-pool=dhcp_pool-VLAN20 interface=VLAN20-Main lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN20
add address-pool=dhcp_pool-VLAN25 interface=VLAN25-Guest lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN25
add address-pool=dhcp_pool-VLAN30 interface=VLAN30-Multimedia lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN30
add address-pool=dhcp_pool-VLAN32 interface=VLAN32-Menage lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN32
add address-pool=dhcp_pool-VLAN40 interface=VLAN40-Camera lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN40
add address-pool=dhcp_pool-VLAN50 interface=VLAN50-Server lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN50
add address-pool=dhcp_pool-VLAN55 interface=VLAN55-Photovoltaik lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN55
add address-pool=dhcp_pool-VLAN60 interface=VLAN60-Printer lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN60
add address-pool=dhcp_pool-VLAN70 interface=VLAN70-Studio-System lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN70
add address-pool=dhcp_pool-VLAN74 interface=VLAN74-Studio-Main lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN74
add address-pool=dhcp_pool-VLAN78 interface=VLAN78-Studio-Guest lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN78
add address-pool=dhcp_pool-VLAN80 interface=VLAN80-VoIP lease-script=dhcp-lease-script lease-time=2m name=dhcp-VLAN80
add address-pool=dhcp_pool16 interface=br-TEST lease-time=10m name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/interface bridge port
add bridge=VLAN-Bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=eth04-MGMT
add bridge=VLAN-Bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=eth05-MGMT
add bridge=VLAN-Bridge1 interface=eth07-Bonding1
add bridge=VLAN-Bridge1 interface=eth08-Bonding2
add bridge=VLAN-Bridge1 interface=eth09-Bonding3
add bridge=VLAN-Bridge1 interface=eth10-Bonding4
add bridge=VLAN-Bridge1 interface=sfpplus01-Uplink_CRS326
/interface bridge vlan
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1 vlan-ids=1
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=5
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=20
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=25
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=30
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=32
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=40
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=50
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=55
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=60
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=70
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=74
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=78
add bridge=VLAN-Bridge1 tagged=VLAN-Bridge1,sfpplus01-Uplink_CRS326 vlan-ids=80
/interface list member
add interface=eth01-PPPoE-DSL list=WAN
add interface=eth02-PPPoE-LTE list=WAN
add interface=VLAN1-MGMT list=LAN
add interface=VLAN5-Services list=LAN
add interface=VLAN20-Main list=LAN
add interface=VLAN25-Guest list=LAN
add interface=VLAN30-Multimedia list=LAN
add interface=VLAN32-Menage list=LAN
add interface=VLAN40-Camera list=LAN
add interface=VLAN50-Server list=LAN
add interface=VLAN55-Photovoltaik list=LAN
add interface=VLAN60-Printer list=LAN
add interface=VLAN70-Studio-System list=LAN
add interface=VLAN74-Studio-Main list=LAN
add interface=VLAN78-Studio-Guest list=LAN
add interface=VLAN80-VoIP list=LAN
/ip address
add address=120.18.11.254/24 interface=VLAN1-MGMT network=120.18.11.0
add address=120.18.5.254/24 interface=VLAN5-Services network=120.18.5.0
add address=120.18.20.254/24 interface=VLAN20-Main network=120.18.20.0
add address=120.18.25.254/24 interface=VLAN25-Guest network=120.18.25.0
add address=120.18.30.254/24 interface=VLAN30-Multimedia network=120.18.30.0
add address=120.18.32.254/24 interface=VLAN32-Menage network=120.18.32.0
add address=120.18.40.254/24 interface=VLAN40-Camera network=120.18.40.0
add address=120.18.50.254/24 interface=VLAN50-Server network=120.18.50.0
add address=120.18.55.254/24 interface=VLAN55-Photovoltaik network=120.18.55.0
add address=120.18.60.254/24 interface=VLAN60-Printer network=120.18.60.0
add address=120.18.70.254/24 interface=VLAN70-Studio-System network=120.18.70.0
add address=120.18.74.254/24 interface=VLAN74-Studio-Main network=120.18.74.0
add address=120.18.78.254/24 interface=VLAN78-Studio-Guest network=120.18.78.0
add address=120.18.80.254/24 interface=VLAN80-VoIP network=120.18.80.0
add address=10.10.10.1/24 interface=br-TEST network=10.10.10.0
/ip dhcp-client
add add-default-route=no interface=eth02-PPPoE-LTE use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=8.8.8.8 gateway=10.10.10.1
add address=120.18.5.0/24 dns-server=8.8.8.8 gateway=120.18.5.254
add address=120.18.11.0/24 dns-server=8.8.8.8 gateway=120.18.11.254
add address=120.18.20.0/24 dns-server=8.8.8.8 gateway=120.18.20.254
add address=120.18.25.0/24 dns-server=8.8.8.8 gateway=120.18.25.254
add address=120.18.30.0/24 dns-server=8.8.8.8 gateway=120.18.30.254
add address=120.18.32.0/24 dns-server=8.8.8.8 gateway=120.18.32.254
add address=120.18.40.0/24 dns-server=8.8.8.8 gateway=120.18.40.254
add address=120.18.50.0/24 dns-server=8.8.8.8 gateway=120.18.50.254
add address=120.18.55.0/24 dns-server=8.8.8.8 gateway=120.18.55.254
add address=120.18.60.0/24 dns-server=8.8.8.8 gateway=120.18.60.254
add address=120.18.70.0/24 dns-server=8.8.8.8 gateway=120.18.70.254
add address=120.18.74.0/24 dns-server=8.8.8.8 gateway=120.18.74.254
add address=120.18.78.0/24 dns-server=8.8.8.8 gateway=120.18.78.254
add address=120.18.80.0/24 dns-server=8.8.8.8 gateway=120.18.80.254
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid  
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp  
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1  
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN  
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec  
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec  
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes  
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked  
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid  
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN  
/ip firewall mangle
add action=accept chain=prerouting in-interface=eth01-PPPoE-DSL
add action=accept chain=prerouting in-interface=eth02-PPPoE-LTE
add action=mark-connection chain=prerouting dst-address-type=local new-connection-mark=WAN1-DSL passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 src-address=\
    10.10.10.0/24
add action=mark-connection chain=prerouting dst-address-type=local new-connection-mark=WAN2-LTE passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 src-address=\
    10.10.10.0/24
add action=mark-routing chain=prerouting connection-mark=WAN1-DSL new-routing-mark=main passthrough=yes src-address=10.10.10.0/24
add action=mark-routing chain=prerouting connection-mark=WAN2-LTE new-routing-mark=main passthrough=yes src-address=10.10.10.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN  
add action=masquerade chain=srcnat out-interface=eth01-PPPoE-DSL src-address=10.10.10.0/24
add action=masquerade chain=srcnat out-interface=eth02-PPPoE-LTE src-address=10.10.10.0/24
/ip route
add disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=eth02-PPPoE-LTE pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10  
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=PPPoE-WAN-Telekom-DSL routing-table=main suppress-hw-offload=no
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.10.10.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10  
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6  
add address=::1/128 comment="defconf: lo" list=bad_ipv6  
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6  
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6  
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6  
add address=100::/64 comment="defconf: discard only " list=bad_ipv6  
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6  
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6  
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6  
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid  
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6  
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp  
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10  
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp  
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah  
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp  
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec  
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN  
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked  
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid  
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6  
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6  
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6  
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6  
add action=accept chain=forward comment="defconf: accept HIP" protocol=139  
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp  
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah  
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp  
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec  
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN  
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key

Viele Grüße Jörg

Bitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben

Content-ID: 7265065162

Url: https://administrator.de/forum/mit-zwei-internetzugaengen-auf-mikrotik-rb4011igs-7265065162.html

Ausgedruckt am: 06.04.2025 um 15:04 Uhr

5 Kommentare

Neuester Kommentar

Gibt hier ein paar Threads zu der Thematik:
2xWAN 2xLAN EIN Gateway an EINEM Mikrotik Router
Policy based Routing mit Mikrotik 750
Zweites Gateway erreichbar machen
Diverse YouTube Filmchen
https://www.youtube.com/watch?v=zi0mX0BiFAA
https://www.youtube.com/watch?v=p2XliQ2nf8M
usw. usw.
Oder die offizielle Doku...

Das Modem kann man nur in den Bridge, oder Passthrough Modus versetzen.

Das ist stimmt so nicht, denn der Teltonika ist primär immer ein Router und kein Modem!! Du kannst ihn also auch als normalen Router am WAN Port des MT kaskadieren. Wenn auch er im Bridge oder Passthrough Mode arbeitet umso besser, dann erspart man sich die Frickelei mit dem doppelten NAT und doppeltem Firewalling. Siehe zu der Thematik auch hier.

Einfach nachmachen
https://help.mikrotik.com/docs/pages/viewpage.action?pageId=26476608

Gruß

Hallo Ultramatic,
vielen Dank für den Link, damit habe ich es ans laufen bekommen.
Zusätzlich habe ich noch ein kleines Script in die beiden DHCP-Clienten eingesetzt, das bei einem Wechsel der IP das Gateway anpasst.

Gibt es da auch eine Möglichkeit ein VLAN (VoIP) aus dem Failover heraus zu nehmen und einem WAN fest zuordnen?
Eine Registrierung bei den VoIP-Servern ist über LTE nicht möglich.

viele Grüße Jörg