QUOTE(Gaara92 @ Nov 2 2021, 04:27 PM)
try exporting your firewall configuration and paste it here. Use this command on mikrotik terminal
CODE
/ip firewall filter export hide-sensitive
CODE
/ip firewall nat export hide-sensitive
CODE
[admin@MikroTik] > /ip firewall filter export hide-sensitive
# nov/02/2021 14:45:25 by RouterOS 6.49
# software id = 17RT-CD2Q
#
# model = RBD52G-5HacD2HnD
# serial number =
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
CODE
/ip firewall nat
# no interface
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=Unifi
add action=dst-nat chain=dstnat dst-address=!192.168.88.253 dst-port=53 protocol=udp src-address=!192.168.88.253 to-addresses=192.168.88.253
add action=dst-nat chain=dstnat dst-address=!192.168.88.253 dst-port=53 protocol=tcp src-address=!192.168.88.253 to-addresses=192.168.88.253
add action=masquerade chain=srcnat dst-address=192.168.88.253 dst-port=53 protocol=udp src-address=192.168.88.0/24
add action=masquerade chain=srcnat dst-address=192.168.88.253 dst-port=53 protocol=tcp src-address=192.168.88.0/24
192.168.88.253 is Pihole IP
This post has been edited by wong_86: Nov 2 2021, 04:44 PM