Troubleshooting Internet Connectivity Issues in MikroTik

Troubleshooting Internet Connectivity on MikroTik

"The Internet is down" is the most common complaint in any network. Before calling your ISP, work through this structured diagnostic process to determine if the problem is in your router, your ISP connection, or further upstream.

Step 1: Verify the WAN Interface Has an IP

/ip address print

If your WAN interface (ether1, pppoe-out1) has no IP address, the ISP link is down or misconfigured.

For DHCP WAN:

/ip dhcp-client print

For PPPoE:

/interface pppoe-client print status

Step 2: Check the Default Route

/ip route print where dst-address=0.0.0.0/0

Without an active (A) default route, the router has no path to the Internet. Check if the WAN interface is up.

Step 3: Ping the ISP Gateway

/ip route print  # note the gateway IP
/ping 203.0.113.1  # ping the gateway

If the gateway doesn't respond, the problem is on the ISP link — modem, fiber ONT, or the ISP's router. Try power-cycling the modem and waiting 2 minutes.

Step 4: Ping a Public IP (Bypassing DNS)

/ping 8.8.8.8

If the ISP gateway responds but 8.8.8.8 doesn't, your ISP may be filtering or routing is broken upstream. Contact your ISP.

Step 5: Test DNS Resolution

/resolve google.com

If step 4 (ping by IP) works but resolve fails, DNS is broken. Check:

/ip dns print

Ensure servers has valid IPs. Try manually resolving with a different server:

/resolve google.com server=8.8.8.8

Step 6: Check Client Connectivity Separately

If the router itself has Internet, but clients don't:

# From a client, can it reach the router?
/ping 192.168.10.1  # from client

# Can clients reach the router's LAN IP?
/ping 192.168.10.50  # from router to a client

If clients can reach the router but not Internet: check NAT masquerade and the firewall forward chain.

/ip firewall nat print
/ip firewall filter print

Step 7: Check for Firewall Blocking

The firewall might block traffic from clients going out:

/ip firewall filter print where chain=forward

Missing "established/related" accept rule is a common issue after firewall edits.

Common Root Causes Summary

Work top-down: WAN physical → WAN IP → routing → NAT → firewall → DNS. Most issues are found in the first three steps.