Manual

No internet after applying

You pasted the script and nothing gets out any more. This is the order to look in.

You pasted the script, the device rebooted, and nothing reaches the outside world. No website, no app, no update. Devices in the house can usually still see each other.

This chapter is about the case where everything is without internet. If one VLAN is cut off and the rest is fine, go to One VLAN without internet. If some sites load halfway, it is not a matter of internet but of packet size: see Websites stall while loading. If addresses work and names do not, it is DNS: see Names do not resolve.

The quick checks, in this order

Work from the outside in. Every step has a command that proves it, so you never have to guess.

  1. Does the WAN port have an address? /ip address print. A good answer: an address on your WAN port or on pppoe-out1, next to the address on the bridge. If all you see is 192.168.88.1/24 on the bridge, nothing is arriving from outside and the rest of the list does not matter yet.
  2. Is the DHCP client bound? /ip dhcp-client print. A good answer: status: bound with an address behind it. searching... means nobody is answering on that cable.
  3. With PPPoE, is it logged in? /interface pppoe-client print. A good answer: status: connected. dialing or an authentication failure means the credentials or the VLAN tag are wrong.
  4. Is there a default route? /ip route print. A good answer: a 0.0.0.0/0 line with the flags A S or A D, so active. If it is marked X or missing altogether, the router does not know where outside is.
  5. Can the router itself get out? /ping 1.1.1.1. If that works and your laptop does not, the problem is between LAN and WAN, not at the provider.
  6. Is traffic being NATed? /ip firewall nat print. A good answer: a srcnat rule with action=masquerade and out-interface-list=WAN. Then check with /interface list member print that the WAN list holds the interface that actually carries the address.

Those last two belong together. Masquerade matches on the interface list, not on a port name. If the address ended up on ether1-vlan6 while ether1 is in the list, the rule never matches: nothing gets out even though the router pings the internet perfectly well.

The usual causes

  • The cable is in the wrong port. The script uses the WAN port you picked in the tool, which is not always the port the cable was in. Check with /interface print which port is running.
  • The uplink needs a VLAN tag. Many fibre connections deliver the internet on a tagged VLAN. Without that tag the DHCP client keeps searching. The WAN section has the field VLAN id on the WAN port for this.
  • The PPPoE credentials are wrong. A typo in the username is the most common one. The password is in your script in plain sight, so you can compare it.
  • Nothing is NATed. The Firewall section has NAT to the internet. Set to No NAT, the router expects you to have public addresses behind it. For an ordinary connection this should be Masquerade.
  • The WAN port is disabled. That happens when you let the tool disable unused ports and the port was not recognised as in use.

What the configurator does about it

Three checks catch this before you paste. With no uplink filled in, the tool says No WAN defined; the router has no internet. If you disable a port that is also the WAN port, you get A disabled port is also a WAN port: no internet comes in there. And if you draw the internet cloud onto a switch on the network board, the site check points out that the device does not route; see Checks about cabling.

The link between a tagged uplink and the masquerade rule is handled for you: give your uplink a VLAN id and the VLAN interface goes into the WAN list instead of the port. Nothing to do there, but it is the place to look if you edited the script by hand.

What the tool does not know is whether your provider really speaks DHCP or wants PPPoE. Only your provider knows that. The WAN section therefore offers a list of provider presets that fill in the right combination for you.

When it is not your router

If the DHCP client keeps searching and the PPPoE client keeps dialling, the problem is probably in front of your router.

  • The modem is still routing. You do get an address, but from a private range. See Behind two routers.
  • The modem remembers the old MAC address. Some providers tie the line to it. Power the modem off for a few minutes, or fill in Clone MAC address in the WAN section with the address of whatever was connected before.
  • The line is down. Check the link light on the modem itself before you dig any further in RouterOS.

Further reading: WAN and internet, Firewall and NAT and When something goes wrong.

Want to try it right away? Open the configurator