Mikrotik Routing Question

check below

http://wiki.mikrotik.com/wiki/Enable_Disable_Firewall_Rules

For reference: Here is my current configuration (still no access to the 24.153.245.* addresses though)

[admin@MikroTik] > /ip address print detail
Flags: X - disabled, I - invalid, D - dynamic
0   ;;; default configuration
     address=192.168.88.1/24 network=192.168.88.0 broadcast=192.168.88.255
     interface=ether1 actual-interface=ether1

1   address=24.153.244.26/29 network=24.153.244.24 broadcast=24.153.244.31
     interface=ether13 actual-interface=ether13

2   address=24.153.245.1/24 network=24.153.245.0 broadcast=24.153.245.255
     interface=ether12 actual-interface=ether12


[admin@MikroTik] > /ip route print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 A S  dst-address=0.0.0.0/0 gateway=24.153.244.25
        gateway-status=24.153.244.25 reachable ether13 distance=1 scope=30
        target-scope=10

1 ADC  dst-address=24.153.244.24/29 pref-src=24.153.244.26 gateway=ether13
        gateway-status=ether13 reachable distance=0 scope=10

2 ADC  dst-address=24.153.245.0/24 pref-src=24.153.245.1 gateway=ether12
        gateway-status=ether12 reachable distance=0 scope=10

3 ADC  dst-address=192.168.88.0/24 pref-src=192.168.88.1 gateway=ether1
        gateway-status=ether1 reachable distance=0 scope=10




[admin@MikroTik] > /interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
#     NAME                                        TYPE             MTU   L2MTU
0  R  ether12                                     ether            1500  1600
1  R  ether13                                     ether            1500  1600
2     ether11                                     ether            1500  1600
3     ether6                                      ether            1500  1598
4     ether7                                      ether            1500  1598
5     ether8                                      ether            1500  1598
6     ether9                                      ether            1500  1598
7     ether10                                     ether            1500  1598
8  R  ether1                                      ether            1500  1598
9     ether2                                      ether            1500  1598
10     ether3                                      ether            1500  1598
11     ether4                                      ether            1500  1598
12     ether5                                      ether            1500  1598



[admin@MikroTik] > /ip firewall export
# feb/08/1970 10:38:21 by RouterOS 4.15
# software id = 1YYD-2MPF
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
    tcp-close-wait-timeout=10s tcp-established-timeout=1d \
    tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
    tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no

disable this...
/ip firewall connection tracking
set enabled=yes

Disabled connection tracking, but no luck yet...

[admin@MikroTik] > /ip firewall export
# feb/08/1970 11:35:14 by RouterOS 4.15
# software id = 1YYD-2MPF
#
/ip firewall connection tracking
set enabled=no generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
    tcp-close-wait-timeout=10s tcp-established-timeout=1d \
    tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
    tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no

Also, as a note, I can get internet access to a device configured as 24.153.245.100 if i turn masquerade on with src-interface ether13. However, then i am still publicly using the 24.153.244.26 ip address instead of the 24.153.245.100 address, and still don't have access to the 245.100 address remotely.


.....maybe something on Time Warner's side is configured incorrectly?

When a packet arrives at an interface, the NAT rules are applied first. The firewall and routing are applied after the packet has passed the NAT rule set. This is important when setting up firewall rules, since the original packets might be already modified by the NAT.
So you need to verify that NAT is disabled (since you dont need this, then firewall is not active as your request is to permit all)

what you are saying exactly means NAT is incuring...
/ip firewall nat disable

if i am not wrong you have 2 public IP pools,
Pool A /29, configured on WAN
Pool B /24, configured on LAN0 (inside network)
and you want to use 1 ip for internet and you want public IP to use on remote hosts (may be web, terminal server.....) as a DMZ or without firewall inspection.
if all above is correct than what the issue, this should not be a problem.

if i understand wrong ;can you draw a diagram.

Called Time Warner, and after speaking to three different techs, and escalating to a network engineer, they finally seemed to have found the issue on there side.

Thanks for the info to give them, looked like you had it on the money!