MikroTik

dima1002

Here I was also given great help by Mikrotik Support. The script now sends an email if the temperature is higher than X. What to note is that the CPU load is quite high. But we only use the knot to monitor a server room when the air conditioning fails. That is completely sufficient for that. # POSIX...

dima1002

Many thanks to Mikrotik Support, they helped me a lot. Thanks Here's how it works: # Input MAC address of the tag within "" :local addressRegex "AC:2C:6E:13:05:9E" # POSIX regex for filtering Bluetooth advertisements based on their data. Same # usage as with 'addressRegex'. :loca...

dima1002

Yes, it looks better there. Is that normal?

T4.JPG

T3.JPG

dima1002

Here:

T2.JPG

T1.JPG

Try removing all bridge vlan interfaces except the management interface VLAN_99 and test again.

where do i do that?

dima1002

I'll buy you a device if you help me

dima1002

HW is on for all ports. The script was wrong there.
Yes, then I also think that it may be the many VLANs.
It's really a pity, although hardly any data is flowing, the CPU is always at 40-60%
Thanks for the analysis

dima1002

Yes, the TG-BT5-OUT has a temperature sensor. I would like to use this to monitor a server room. For example, if it is more than 40 degrees, then an SMS or e-mail should be sent. Wouldn't that be an interesting project?

dima1002

I'm sorry. But can anyone really help me with this topic? Or does someone know a support?

dima1002

Hello, I installed DDOS in my firewall. But it happens again and again that my telephone system or my DNS server is blacklisted. Why? Here is my Firewall: # jan/12/2023 10:52:40 by RouterOS 7.6 # software id = S11F-7CCV # # model = RB4011iGS+ # serial number = HD30857WKJ4 /ip firewall address-list a...

dima1002

Hello, my switch is very slow. CPU is always at 70-100% why? # jan/02/1970 00:40:44 by RouterOS 7.6 # software id = X7HI-QAK7 # # model = CRS112-8P-4S # serial number = HBB07S30KDM /interface bridge add name=BRIDGE protocol-mode=none /interface vlan add comment=MGT interface=BRIDGE name=VLAN_99 vlan...

dima1002

no, how does it work with signal?

dima1002

Thanks, I had already looked at some.
Is there possibly also support for money? or can one inquire there somewhere?

dima1002

does this also work with whatsapp or pushover?

dima1002

Hi,

is it possible for me to receive an e-mail if, for example, it reaches 30 degrees Celsius?
If yes how? Many Thanks

dima1002

this works for me when tilt or impage, unfortunately not yet if you only move it [admin@Knot] > /system/script/export # dec/12/2022 06:01:20 by RouterOS 7.4 # software id = LMW4-2MB9 # # model = RB924i-2nD-BT5&BG77 # serial number = F5750ECE0D59 /system script add dont-require-permissions=no nam...

dima1002

I didn't want to start a fight here and I didn't want to be uncooperative either. I understand that it is not good if some only post half scripts. But the topic here was really only about the firewall. I also see the serial number and Cloud DDNS as a danger. But my example above must be sufficient f...

dima1002

I'm sorry. I didn't want to be uncooperative.
I thought too much information would bother me, so I deleted that.

Why is the serial number or something important at all?
Should I always post everything with "/export compact" ?

dima1002

Before venturing into configuration of vlan filtering by switch chip, make sure you create a backup of your current configuration in the non-volatile part of the disk of the router (I don't know whether 3011 has a flash/ partition or whether all files survive reboot) and download it to an external ...

dima1002

You didnt provide the full config.........
/export file=anynameyouwish ( minus router serial number and any public WANIP information )

I thought you shouldn't do that at all. Why should you do that?

dima1002

My firewall was an example. Couldn't everyone just post your firewall? Or is there a kind of basic firewall summarized from the examples: https://help.mikrotik.com/docs/display/ROS/Building+Advanced+Firewall https://help.mikrotik.com/docs/display/ROS/Bruteforce+prevention https://help.mikrotik.com/d...

dima1002

Can anyone help me with this or have a suggestion for improvement? Security is very important to me.

dima1002

We usually have little traffic between the individual VLANs. But it can happen that we take the backup from a server into its own VLAN, for example. Then we have several terabytes of data between the VLANs. So I would like to do it right with the hardware. That means I have to switch on VLAN-filteri...

dima1002

I always prefer hardware. That's faster than software, isn't it?
That means I can't turn on VLAN filtering for hardware VLAN, right?

or what would you recommend to me?

dima1002

I tested a lot, why the chaos.

I thought the 3011 with the chipset QCA8337 doesn't work with VLAN filtering?
https://help.mikrotik.com/docs/display/ ... NFiltering

dima1002

forward and input always drop at the end? except once the ping. Is that so bad?

VPN is not always possible, but with input via Winbox we solved this via the address list.

With NAT, I want to receive my emails on the go, i.e. I'm always on the move with dynamic IPs. How to limit that?

dima1002

2FA for VPN
https://www.miniorange.com/two-factor-a ... krotik-vpn
or
https://www.notakey.com/2021/11/12/mikr ... th-script/

dima1002

Hi, our uplink into the network would be the SFP. We have a bridge and all ports are in there. Now how can I add port 5 or port 6 untagged in VLAN 100 or VLAN200? /interface bridge add name=BRIDGE /interface vlan add comment=MGT interface=sfp1 name=VLAN_99 vlan-id=99 add comment=COMPANY interface=sf...

dima1002

Hi, what do you think about this firewall? 1. I would like to move what is possible to the Chain RAW. 2. Port scanner, internally and externally 3. SSH, Winbox Blacklist 4.What else would increase security? ### Telephone /ip firewall mangle add action=mark-connection chain=forward dst-address=192.16...

dima1002

can nobody help here?

dima1002

Thank you

Now I understand the problem. That's why I prefer to always stick to the 27 letters of the alphabet and don't use any special characters.

I wanted to have a script that sends me a push message, e.g. with 10 failed logins.

dima1002

I understand something like "/system/export"

but what kind of ASCI order is that? What is this needed for? or can you translate that too?
\00\01\02\03\04\05\06\07\08\09\0A\0B\0C\0D\0E\0F

what does that have to do with logging in?
Can someone please provide a complete script?

dima1002

Yes, this is a pity. Check out the Mikrotik Knots. The technique is really interesting.

Can someone else help us? For example, here are some scripts.
https://help.mikrotik.com/docs/display/ ... nt+formats

dima1002

Can I also be notified if in the log e.g. a Mikrotik reboots or someone logs in failure 10 times?

dima1002

Hello,
I'm looking for a script that notifies me by email when I move TG-BT5-IN by X or Y axis. is that possible?
E.g. if someone opens the server room door, we would like to be notified.

dima1002

Hi,

I want the links / uplink to be set automatically via SNMP? is that possible?
I would like to know which access point is connected to which switch port or, for example, which switch is behind which switch.

SNMP.JPG

dima1002

Yes, I had something similar in mind. How do you know?

dima1002

When I start Winbox, I see the same access point 5 times because it has 5 VLANs. If I am in the company VLAN, I only want to see the IP addresses or MAC addresses of the access point from the company network. What does the winbox actually have to do with neighbors? Under /ip/neighbours, it's ok if I...

dima1002

OK thanks, the script works perfectly.
But I have a logic error.

I need a scheduler that runs once on startup and then disables itself.
or a scheduler script that is only executed once at boot.

dima1002

VLAN filtering is only available with CRS3XXX, but I have a Mikrotik 962 HAP AC

Here is the table:
https://wiki.mikrotik.com/wiki/Manual:I ... Offloading

or am I not understanding something here?

dima1002

I would like to continue using the Neighbors. Just per vlan. How can you configure it then?

dima1002

Hello Rextended,

1. I want one Script
2. One after the other
3. I would like to query a status, if the status is not the same, a script should be deactivated and then a reboot

For example like this
( [get xxxx] != [get xxxx] ) do={ SCRIPT DISABLE AND system reboot }"

dima1002

Hello, I see every access point in all VLANs in the Winbox. Why? mikrotik_vlan.jpg Here is the configuration of an access point /interface bridge add name=BRIDGE protocol-mode=none /interface wireless # managed by CAPsMAN # channel: 2437/20/gn(17dBm), SSID: DM, local forwarding set [ find default-na...

dima1002

Hi,

I want to run 2 scripts in a loop. How can this work?

do={ /system/scheduler/disable test AND /system reboot }"

dima1002

According to the wiki, the Mikrotik 3011 has no VLAN filtering. Or am I wrong? Where do I have to configure the 3011 untagged? /interface bridge port ? or here /interface ethernet switch vlan? is this better? ether 10 should be an access port # model = RB3011UiAS /interface bridge add name=BRIDGE pr...

dima1002

I was able to solve the Problem with.

/tool fetch https://127.0.0.1/ dst-path=backup/mikrotik

Thank you

dima1002

Hello, how do i get port 10 to an accessport? or untagged? # model = RB3011UiAS /interface bridge add name=BRIDGE protocol-mode=none /interface ethernet set [ find default-name=ether2 ] name=WAN2 set [ find default-name=sfp1 ] auto-negotiation=no /interface vlan add comment=FIRMA interface=sfp1 name...

dima1002

I would like my backup in a subfolder. However, because of the variable, an error always occurs. How can one solve it? /system backup save name= /backup/ $backupName local name [/system identity get name]; :local date [/system clock get date]; :local day [ :pick $date 4 6 ] :local month [ :pick $dat...

dima1002

Hello,

1. I have a 48 port switch, how do I get all ports in one bridge with a script?

2. We have VLANS on the bridge, can you use all or dynamic?

dima1002

Hello,
Is it better to configure the VLAN ID on the SFP interface or on the BRIDGE? E.g. with a CRS3XXX or MIkrotik 3011?

dima1002

cat ./system.sh | ssh -p22 test@10.99.0.187 system.sh #! /bin/bash /user group add name=system policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,rest-api /user add name=sys address=10.99.0.0/16,192.168.111.0/24' group=sys password='TEST1TEST...

dima1002

Yes I had seen that. After that I did it didn't I?

dima1002

Is this so ok? /caps-man channel add band=5ghz-n/ac control-channel-width=20mhz extension-channel=XX \ frequency=5180,5200,5220,5240,5745,5765,5785,5805,5825 name=5Ghz-Channels \ skip-dfs-channels=yes add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled \ frequency=2412,2437,2462...

dima1002

Hello, I would like to run the script remotely. Why isn't this working? ssh root@192.168.1.162 < ./mikrotik_backup.sh mikrotik_backup.sh :local filename ([/system identity get name] . "-" . [:pick [/system clock get date] 7 11] . [:pick [/system clock get date] 0 3] . [:pick [/system clock...

dima1002

Is it correct? Having problems with the Capsman. Should the VLAN be in the bridge? I have a routerBOARD 3011UiA We use the following services: WAN1, WAN2, WAN3 = Internet SFP1 = uplink to switch Capsman I'm not sure whether I have to bridge over the switch or bridge. QCA 8337 chipset says it is reco...

dima1002

Oh, yes is see the difference :lol: Is so better? Client: /radius add accounting-backup=no accounting-port=1813 address=192.168.155.254 authentication-port=1812 called-id="" certificate=none disabled=no domain="" protocol=udp realm="" service=\ ppp,login,hotspot,wireles...

dima1002

Is so ok? Server: /user-manager/print enabled: yes authentication-port: 1812 accounting-port: 1813 certificate: *0 use-profiles: no Client: /radius add accounting-backup=no accounting-port=1813 address=192.168.155.254 authentication-port=1812 called-id="" certificate=none disabled=no domai...

dima1002

is that better? Anyone have an idea why that doesn't work?

dima1002

You allow 127.0.0.1 on firewall??? Isn't 127.0.0.1 always allowed? I changed it to 192.168.155.254. Still doesn't work Client /user add comment="system default user" group=full name=admin /user aaa set default-group=full interim-update=10m use-radius=yes /radius add accounting-backup=no ac...

dima1002

I have the Radius server and user manager on the router.
I would to loggin on a Mikrotik access point.
Unfortunately that does not work. does anyone know why?

Router:

2.jpg

Client:

1.jpg

Winbox:

3.jpg

dima1002

Is PVID urgently needed at Bridge? or when do i need it?
A few devices do not receive an IP address in the bridge.
I do not know why

dima1002

I still have problems with the switch. What is wrong here? The switch does not see the other switches. /interface bridge add name=BRIDGE /interface vlan add interface=BRIDGE name=MGMT vlan-id=99 /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /port set 0 n...

dima1002

I found the Manual. We have a 3011 This is my configuration. /interface bridge port add bridge=bridge_FIRMA disabled=yes ingress-filtering=no interface=vlan99 add bridge=bridge_FIRMA disabled=yes ingress-filtering=no interface=ether7 add bridge=bridge_FIRMA ingress-filtering=no interface=ether6 add ...

dima1002

ok i found it myself. But how do I configure that with a C3XXX model? /interface ethernet switch ingress-vlan-translation add ports=ether6 customer-vid=0 new-customer-vid=200 here is my config. And i cant ping from vlan 100 zu vlan 200 /interface bridge port add bridge=BRIDGE ingress-filtering=no in...

dima1002

how do I configure that?

dima1002

I have now activated VLAN filtering. I have now deleted the old bridge. Now there is only one bridge left.
I set the PVID to 1 again on all ports.
Now everything works.
I'll do a network diagram later when I have time.

How can I ping from VLAN A to VLAN B?

dima1002

Hello, I have now adjusted all bridges to VLAN and have massive problems. Does anyone know why? # jul/06/2022 13:26:38 by RouterOS 7.3.1 /interface bridge add name=BRIDGE /interface ethernet set [ find default-name=sfp-sfpplus1 ] advertise=\ 10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-ful...

dima1002

Is that so right? SFP is Uplink and Ports 2,3,4 Untrunk Ports in VLAN 100........ /interface bridge add name=BRIDGE /interface bridge port add bridge=BRIDGE interface=ether2 hw=yes /interface bridge port add bridge=BRIDGE interface=ether3 hw=yes /interface bridge port add bridge=BRIDGE interface=eth...

dima1002

No, we have CRS328, CRS326, CRS226, CRS112.....
CPU usage is around 70-100%. But so far they are all built with bridges.
I'll try to rebuild everything tonight, let's see how it turns out.
Do you have me an example of VLAN for CRS1xx/2xx devices?

dima1002

Why 1 and not 10Gbps ?

With 1 GB the flapping was less. Unfortunately, the flapping is not just on one port. But in the whole network, on different switches. I.e. there can be no MiniGbic module defect and also no cable. Can something like RSTP possibly be the reason?

dima1002

Yes is better. Is it better to put the bridge in each VLAN? or just management? What can trigger the SFP flapping? Everything worked until 6.48.6. We've only had problems since the update. With other networks, however, everything works with the same hardware. We only have CRS3xxx and S+85DLC03D, aut...

dima1002

Is so better? /interface bridge add ingress-filtering=no name=BRIDGE vlan-filtering=yes /interface ethernet set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no set [ find default-name=sfp-sfpplus3 ] auto-negotiation=no set [ find defa...

dima1002

OK thanks.
But my bigger problem are the crashes from the SFP. Could the problem be in the bridges? or what else can I do?

dima1002

Is that ok, can you switch it on in live mode?

Bridge1.JPG

dima1002

SFP Problems, we have many Link Downs. With version 6 everything still worked.

Down1.JPG

I know about the VLAN. With version 6 it still worked.
I don't know how to change this in live mode. Have about 40 switches in a network.
Do you have any advice for me?

dima1002

We have a CRS354-48P-4S+2Q+ and updated from 6 to 7.3.1. Since then we have massive problems with SFP. We disabled autosense, it's been a little better since then. But the CPU runs almost permanently at 100%. What can we do? I have already tested with these values, but any change. SNMP or /interface...

dima1002

We have problems with the mini gbic modules. Can this be seen here?

dima1002

We have a CRS354-48P-4S+2Q+ and updated from 6 to 7.3.1. Since then we have massive problems with SFP. We disabled autosense, it's been a little better since then.
But the CPU runs almost permanently at 100%. What can we do?

dima1002

thank you very much, it works perfectly

dima1002

Hello,

how can I NOT remove the default route here if WAN1 is found?

if ([/interface get WAN1]) do={/ip route remove [/ip route find dst-address=0.0.0.0/0]}

dima1002

Yes.
But I would also like to know in general how to write such scripts?

dima1002

Hello,

how can I write here e.g. from line 1 to 100?

e.g.
/system/logging/remove numbers= 1-100

dima1002

Hello, how can I download the latest version of the router on the switch? that does not work :global platform [/system resource get architecture-name]; /tool fetch url="sftp://192.168.111.254/routeosVERSION.npk" dst-path="routeosVERSION.npk" user="test" password="t...

dima1002

Yes we use the services. I have now shortened and optimized the firewall. Is that better now? /ip firewall mangle add action=mark-connection chain=forward dst-address=192.168.141.171 dst-port=5060 new-connection-mark=sip-connection protocol=tcp add action=mark-packet chain=forward connection-mark=si...

dima1002

Hello, can somone help me adjust the script? I want a Script with Dyndns with netcup. https://www.netcup-wiki.de/wiki/API_Clients#Dynamisches_DNS https://github.com/hazzl/netcup-ddns :global DOMAIN = "DOMAIN" :global CUSTOMERNO = "NUMBER" :global APIKEY = "KEY" :global ...

dima1002

also no ddos protection?
What does your firewall look like?

dima1002

Sorry I forgot to delete it while copying.

Now it worked.
/ ip firewall raw add action = drop chain = prerouting comment = "Drop DDOS" src-address-list = ddoser

This is also described in the Mikrotik Wiki. Can I take it that way?

thanks

dima1002

where can I do that in the Winbox switch off? and how automatically? / ip firewall connection tracking set enabled = yes if I insert the rule like this I get an error. / ip firewall filter raw add action = drop chain = forward chain = prerouting comment = "Drop DDOS" connection-state = new...

dima1002

Hi there, Unfortunately I always have problems. Can someone check my firewall, please? Could I improve something? or do I have errors in the firewall? /ip firewall address-list add address=192.168.141.8 list=INTERN add address=192.168.141.0/24 list=local add address=172.16.4.0/24 list=local add addr...

dima1002

is that better? # BEGIN SETUP :local scheduleName "MikrotikLoginAlert" :local emailAddress "login@dasds31.com" :local emailAddressto "login@dasds31.com" :local startBuf [:toarray [/log find message~"logged in" || message~"login failure"]] :local remo...

dima1002

Hello, The script always sends empty emails. Does anyone know why? \_BEGIN SETUP\r\ \n:local scheduleName \"MikrotikLoginAlert\"\r\ \n:local emailAddress \"login@dasds31.com\"\r\ \n:local emailAddressto \"login@dasds31.com\"\r\ \n:local startBuf [:toarray [/log find mes...

dima1002

Hello all,

how can i disable a IP from address-list? or enable?

thanks :-)

dima1002

does nobody use the script?

dima1002

Hello,

is there a reboot script? That sends an e-mail when the router loses power?
But I do not always want to install the NTP package.

dima1002

Hello, where is the mistake? [admin@router] > # BEGIN SETUP [admin@router] > :local scheduleName "LoginAlert" [admin@router] > :local emailAddress "mikrotik@f3sdfd.com" [admin@router] > :local startBuf [:toarray [/log find message~"logged in" || message~"login fail...

Search found 94 matches