Router Has No Internet

A structured process for diagnosing why a router can't reach the Internet, from physical link through DNS.

• troubleshooting
• wan
• routing

Work outward from the router itself before assuming the problem is your ISP.

1. Define the problem

Is it every device, or one device? Is it total (no traffic at all) or partial (some sites work, others don’t)?

• Partial failure: Usually points to DNS or MTU issues.
• Total failure: Usually points to the physical WAN link, addressing, or routing.

2. Check physical / link state

Confirm the WAN interface shows a link. No link means a cabling, ONT/modem, or upstream hardware problem — no configuration in RouterOS will fix a broken wire.

CLI Check:

/interface monitor-traffic ether1
# Check if "link-downs" is increasing or if status is not running.

3. Check addressing

Does the WAN interface actually have an IP address?

• DHCP WAN:

  /ip dhcp-client print
  # Ensure the status is "bound" and it has an IP.
  

• PPPoE WAN:

  /interface pppoe-client print
  # Ensure the status is "connected".
  

• Static WAN:

  /ip address print
  # Ensure the IP is assigned to the correct interface.
  

If the router doesn’t have a public IP, the problem is between you and the ISP.

4. Check the default route

Confirm a default route exists and is reachable. A missing or misdirected default route is the most common cause of “no Internet” when the WAN link looks healthy.

CLI Check:

/ip route print
# Look for dst-address=0.0.0.0/0. The gateway should be marked as "reachable".

5. Check NAT

If LAN devices use private addressing (e.g., 192.168.x.x), confirm masquerade (or explicit source NAT) is applied to the correct WAN interface. Without it, your ISP drops the private traffic because it doesn’t know how to route back to 192.168.x.x.

CLI Check:

/ip firewall nat print
# Look for action=masquerade and out-interface=<Your_WAN_Interface>

6. Check the firewall

Confirm the firewall isn’t aggressively dropping valid traffic.

• You need a rule to allow established,related traffic.
• If you drop all forward traffic by default, ensure you have a rule allowing LAN traffic out to the WAN.

CLI Check:

/ip firewall filter print
# Check the packet counters on your Drop rules. If they are skyrocketing when you try to browse the web, your firewall is too restrictive.

7. Check DNS

If you can ping 8.8.8.8 but ping google.com fails, the problem is DNS.

CLI Check:

/ip dns print
# Ensure 'servers' are configured (e.g., 8.8.8.8) and 'allow-remote-requests=yes' is set if the router acts as the DNS server for the LAN.

8. Test end-to-end

Follow this exact sequence from a LAN client (like your laptop):

1. Ping the router (ping 192.168.88.1) -> Success means LAN is fine.
2. Ping a public IP (ping 8.8.8.8) -> Success means Routing and NAT are fine.
3. Resolve a DNS name (ping google.com) -> Success means DNS is fine.

Each step that succeeds rules out an entire layer of the problem. Stop at the step that fails and troubleshoot that specific layer.