Ayuda configurando un Hap-Ac con O2 y RouterOs v7

Buenos dias, Quisiera poder instalarle a mi hermana un Hap-ac que tenía por aquí en un cajón.
Hoy me he aventurado y no consigo que me funcione el teléfono. La compañia es O2
Internet si va , seguramente en un pequeño apartado en winbox que se me pasa por alto.
Subo la config por si alguien ve dónde está el problema. Múchisimas gracias y feliz dia.

Código: 
# dec/28/2021 11:20:38 by RouterOS 7.1.1
# software id = XGDW-6A8U
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8A7C08BA2366
/interface bridge
add admin-mac=CC:2D:E0:C4:58:59 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=spain disabled=no distance=indoors frequency=auto installation=\
    indoor mode=ap-bridge ssid=Noelia wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=spain disabled=no distance=indoors frequency=\
    auto installation=indoor mode=ap-bridge ssid=Noelia \
    wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan3 vlan-id=3
add interface=ether1 name=vlan6 vlan-id=6
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan6 max-mru=1492 max-mtu=\
    1492 name=pppoe-out1 use-peer-dns=yes user=adslppp@telefonicanetpa
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp ranges=192.168.2.10-192.168.2.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/routing rip instance
add afi=ipv4 disabled=no name=rip
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.2.1/24 comment=defconf interface=bridge network=\
    192.168.2.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
add add-default-route=no interface=vlan3 use-peer-ntp=no
/ip dhcp-server network
add address=192.168.2.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.2.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.2.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=set-priority chain=postrouting new-priority=4 out-interface=vlan3
add action=set-priority chain=postrouting new-priority=1 out-interface=\
    pppoe-out1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. voip" out-interface=vlan3
/ip firewall service-port
set sip disabled=yes ports=5060,5070
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/routing rip interface-template
add disabled=no instance=rip interfaces=vlan3 mode=passive
/system clock
set time-zone-name=Europe/Madrid
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
 
knario75 dijo:
Buenos dias, Quisiera poder instalarle a mi hermana un Hap-ac que tenía por aquí en un cajón.
Hoy me he aventurado y no consigo que me funcione el teléfono. La compañia es O2
Internet si va , seguramente en un pequeño apartado en winbox que se me pasa por alto.
Subo la config por si alguien ve dónde está el problema. Múchisimas gracias y feliz dia.

Código: 
# dec/28/2021 11:20:38 by RouterOS 7.1.1
# software id = XGDW-6A8U
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8A7C08BA2366
/interface bridge
add admin-mac=CC:2D:E0:C4:58:59 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
country=spain disabled=no distance=indoors frequency=auto installation=\
indoor mode=ap-bridge ssid=Noelia wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country=spain disabled=no distance=indoors frequency=\
auto installation=indoor mode=ap-bridge ssid=Noelia \
wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan3 vlan-id=3
add interface=ether1 name=vlan6 vlan-id=6
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan6 max-mru=1492 max-mtu=\
1492 name=pppoe-out1 use-peer-dns=yes user=adslppp@telefonicanetpa
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp ranges=192.168.2.10-192.168.2.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/routing rip instance
add afi=ipv4 disabled=no name=rip
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.2.1/24 comment=defconf interface=bridge network=\
192.168.2.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
add add-default-route=no interface=vlan3 use-peer-ntp=no
/ip dhcp-server network
add address=192.168.2.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.2.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.2.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=set-priority chain=postrouting new-priority=4 out-interface=vlan3
add action=set-priority chain=postrouting new-priority=1 out-interface=\
pppoe-out1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. voip" out-interface=vlan3
/ip firewall service-port
set sip disabled=yes ports=5060,5070
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/routing rip interface-template
add disabled=no instance=rip interfaces=vlan3 mode=passive
/system clock
set time-zone-name=Europe/Madrid
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Haz clic para expandir...

Estás usando el hgu por delante del mikrotik? Porque el telefono tiene que ir conectado al HGU, no puedes prescindir del HGU si quieres tener telefono…
 
huzoaaz dijo:
Estás usando el hgu por delante del mikrotik? Porque el telefono tiene que ir conectado al HGU, no puedes prescindir del HGU si quieres tener telefono…
Haz clic para expandir...
Hola @huzoaaz !! Muchas gracias por responderme.
Tengo una Ont, mi hermana tenía hasta ahora un asus 68u conectado a la ont y el teléfono le va bien. mi idea es quitarle el asus, que se le traba a menudo y ponerle el Mikrotik.
Decirte también que ella tiene una pequela centralita de teléfono en su casa, montada con Issabel pbx, y con el asus le va todo bien.
 
La config es correcta. Dale un pantallazo a la tabla de rutas (IP -> Route) que veamos si obtiene la dirección RIP del teléfono (distancia 120)

Saludos!
 
pokoyo dijo:
La config es correcta. Dale un pantallazo a la tabla de rutas (IP -> Route) que veamos si obtiene la dirección RIP del teléfono (distancia 120)

Saludos!
Haz clic para expandir...
Gracias @pokoyo !!!
Aquí va la captura.
Si está todo bien, me da a mi que será cosa de la centralita. Aunque no he cambiado nada. sólo quitar el asus y configurar el Mikrotik.
 

Adjuntos

  • Captura.JPG
    Captura.JPG
    35.5 KB · Visitas: 68
Pues, a nivel de rutas y vlans, lo tienes todo fino. Creo que te falta simplemente la regla de firewall que acepta dicho tráfico en input.
Código: 
/ip firewall filter
add action=accept chain=input comment="voip: allow voip" in-interface=\
    vlan3 src-address=10.0.0.0/8 place-before=\
[find where comment="defconf: drop all not coming from LAN"]

Saludos!
 
Muchísimas gracias a los dos !!! @huzoaaz y @pokoyo !!!! :)
Gracias de verdad, jolines, Uno se emociona al recibir tanta ayuda desinteresada en este grandioso foro.
Gracias de verdad, ya lo tengo todo funcionando, Ahora le implementaré Wireguard y veré la cara de alegría de mi hermana cuando llegue del trabajo.

Un enorme abrazo @huzoaaz y @pokoyo !!!

Feliz semana y mucha mucha salud en estos tiempos tan difíciles !!!! :):love:
 
knario75 dijo:
Muchísimas gracias a los dos !!! @huzoaaz y @pokoyo !!!! :)
Gracias de verdad, jolines, Uno se emociona al recibir tanta ayuda desinteresada en este grandioso foro.
Gracias de verdad, ya lo tengo todo funcionando, Ahora le implementaré Wireguard y veré la cara de alegría de mi hermana cuando llegue del trabajo.

Un enorme abrazo @huzoaaz y @pokoyo !!!

Feliz semana y mucha mucha salud en estos tiempos tan difíciles !!!! :):love:
Haz clic para expandir...
Igualmente majo!

Saludos!
 
Debes estar conectado o registrado para responder aquí.

Similar threads

M
Apertura puertos MikroTik tras IP Fija
Respuestas
3
Visitas
349
pokoyo
E
Bajo rendimiento con 7.1.1
Respuestas
9
Visitas
885
Emulero
J
Os parece excesivo (obsesivo...) mi firewall/filter?
2
Respuestas
26
Visitas
1,458
Canariote82
D
IPTV Movistar Colombia con rb4011 y doble nat
Respuestas
10
Visitas
706
Jordi.Bcn
C
Conf después de sustituir router Pepehone
2
Respuestas
20
Visitas
1,385
pokoyo
Arriba