When a MikroTik router shows a live WAN connection but clients still can’t reach the internet, the fault is usually in NAT, routing, or DNS configuration rather than the physical connection itself.
Common Symptoms
- WAN interface shows connected/running
- Router itself can ping external IPs, but LAN clients can’t
- LAN clients get an IP address but no internet access
Possible Causes
- Missing or disabled NAT masquerade rule
- Incorrect default route
- DNS not configured or not forwarded to clients
- A firewall rule inadvertently blocking forwarded traffic
Before You Begin
From the router itself (via Winbox or terminal), ping an external IP like 8.8.8.8 — if that fails too, the problem is upstream of the router (ISP/WAN), not the LAN configuration.
Method 1 — Verify the NAT masquerade rule exists
Check NAT rules
Open IP → Firewall → NAT and confirm a masquerade rule exists for the WAN interface (see command below if it’s missing).
Method 2 — Check the default route
Review routes
IP → Routes — confirm a default route (0.0.0.0/0) exists pointing to your WAN gateway, and that it’s marked active.
Method 3 — Confirm DNS is reaching clients
Useful Commands
/ip firewall natnadd chain=srcnat out-interface=ether1 action=masqueradeping 8.8.8.8Verify whether the problem affects every device on the LAN or just one — a single-device issue points to that device’s own network settings, not the router.
Frequently Asked Questions
Why can the router ping out but clients can’t?
This is the classic signature of a missing NAT masquerade rule — the router itself uses its own WAN IP directly, while LAN clients need NAT translation to reach the internet.
Conclusion
A missing NAT rule or default route accounts for the large majority of “connected but no internet” MikroTik problems — check both before assuming an ISP-side issue.
Related Articles
