We can use the rommon option, enabling rommon on the main mikrotik router and also on the cpe. Another option would be to have a VPN on the router that has the public one and enter the cpe through that VPN. We could also create a port forwarding nat rule for the cpe on the router that has the public IP.

To access CPE (Customer Premises Equipment) devices that are on different network segments and have different public IP addresses from a central point on a MikroTik network, there are other strategies you can employ.

The choice of strategy depends on the network structure, security policies, and specific computer configuration. Below, we give you some of the most common options:

1. VPN (Virtual Private Network)

Establishing a VPN is a secure way to connect different network segments, allowing you to access CPE devices as if they were on the same local network. MikroTik RouterOS supports several VPN protocols, including OpenVPN, L2TP/IPSec, and SSTP.

• Advantages: Improved security, since traffic is encrypted.
• Considerations: You need to configure both the VPN server on your MikroTik and the VPN clients on the CPE devices.

2. Static or Dynamic Routing

You can configure static or dynamic routing to allow your MikroTik network to communicate with other network segments. This would involve defining specific routes on your MikroTik to the public IP addresses of the CPE devices.

• Advantages: Relatively simple configuration without the need to establish VPNs.
• Considerations: Less secure than a VPN, since traffic is not necessarily encrypted.

3. NAT (Network Address Translation)

If you have control over the routers facing the CPE devices, you can configure NAT rules (specifically DNAT) to redirect certain traffic from the Internet to specific CPE devices.

• Advantages: Allows direct access to specific devices without requiring client-side VPN configurations.
• Considerations: Requires careful management of NAT rules and can present security risks if not configured correctly.

4. EoIP or IPIP tunnels

MikroTik RouterOS allows you to establish Ethernet over IP (EoIP) tunnels or IPIP tunnels that can be used to connect network segments over the Internet.

• Advantages: Works well for joining network segments transparently, allowing broadcast and multicast traffic.
• Considerations: Traffic through these tunnels may not be encrypted, which is a security concern.

Security and Access

Regardless of the method you choose to access CPE devices, it is crucial to implement appropriate security policies. This includes setting up firewalls, using authentication and encryption (especially for VPN connections), and carefully managing access. Security is especially important when accessing devices over the Internet, as exposure to unauthorized traffic can increase the risk of attacks.

Each of these strategies has its own configuration requirements and security considerations. Choosing the best option depends on your specific needs, resources, and the structure of your existing network.