Manual

Behind two routers

Browsing works, but port forwards, VPN and game consoles act strangely. There is probably another router in front of you.

Ordinary browsing is fine. But a port forward does nothing, your VPN cannot be reached from outside, a game console complains about a "strict" network type, and video calls always take the long way round. Those are the symptoms of two routers in a row: your provider's modem is still doing NAT, and your MikroTik does it again.

This is not an outage. Everything that starts from the inside works. Only things that have to start from the outside get stuck at the first box, because it does not know who to hand them to.

The quick checks, in this order

  1. What kind of address does your WAN port have? /ip address print. A good answer: a public address. Starting with 192.168., 10., or 172.16 through 172.31 means you are behind a router, yours or the provider's. Starting with 100.64 through 100.127 means you are behind the provider itself.
  2. Where does your default route point? /ip route print. A good answer: a gateway in the same public range as your WAN address. A gateway on 192.168.2.254 is the modem.
  3. How many hops are in front of you? /tool traceroute 1.1.1.1. A good answer: the first hop is an address of your provider. A private first hop is the modem.
  4. What does the outside world think your address is? Switch on IP Cloud DDNS in the Management access section and then run /ip cloud print. A good answer: the address at public-address is the same one as on your WAN port. If they differ, there is NAT in between.

Two of those four are enough. If your WAN address is private and the public address is something else, the diagnosis is done.

The usual causes, and what to do

  • The modem is still routing. Put it in bridge. That is the real fix: your router then gets the public address and everything works as intended. How you do it differs per provider and sometimes per box; the provider presets in the WAN section say per line what belongs to it.
  • Bridge is not possible. With some subscriptions that include TV or telephony the modem cannot be bridged. Then you have to forward in the modem as well, to your MikroTik's WAN address, and then again in the MikroTik to the device inside. Two layers that both have to be right. Give your MikroTik a fixed address in the modem, or the first layer stops matching after a reboot.
  • You are behind CGNAT. An address in 100.64.0.0/10 means the provider is sharing: you have no public IPv4 address of your own and there is nothing to forward. Ask for a public address, use IPv6, or have the connection set up from the inside with a VPN.
  • You put two routers there yourself. An old router meant as a switch that still does NAT gives exactly the same picture. Turn it into a real switch: no WAN, a fixed address, a gateway to the real router.

What the configurator does about it

Honestly, not much, and it cannot: which address your WAN port gets only becomes clear once the cable is in. The tool runs in your browser and never sees your line.

What it does have: the provider presets fill in the right combination for known providers and say what has to happen to the modem. The Management access section has IP Cloud DDNS, which makes your router report its public address to MikroTik, and that is also the way to see what the outside world sees of you. And if you pick a role for a device without a WAN, the tool assumes an existing router in front and asks for a gateway instead of an uplink.

For the case where you cannot get through, there is a better route than forwarding: a WireGuard tunnel set up from the inside. That needs a public address on one side only, and it does not have to be yours.

So what the tool does not do is warn that a static WAN address falls in a private range or in 100.64.0.0/10. That check exists for LAN addresses, not for the uplink.

When it is not your router

  • The provider no longer gives a public address. That is policy, not a setting. Calling sometimes helps; with some providers it is a paid option.
  • The modem has a firewall of its own. Even in bridge mode some modems hold back certain ports.
  • IPv6 does go straight through. Many lines with CGNAT on IPv4 hand out proper IPv6. Offering the service over IPv6 is then the shortest route. See IPv6.

Further reading: Opening a port, Moving off your provider's router and What NAT does.

Want to try it right away? Open the configurator