MikroTik

ConnyMercier

Answer to Question 1: If your Mikrotik-Router has a direct connection to the Internet (no NAT), It is possible to connect to your device from anywhere via the MikroTik app. The default Config from Mikrotik , doesn`t allow this, because of Security concerns. But if you modify the Firewall, you can al...

ConnyMercier

RouterOS ist quite good for VPN, DynDNS, DHCP, Routing, Firewall and Co You have a lot of Hardware to chouse from, depending on your needs (interfaces, Performances, etc..) If you are not sure if Mikrotik /RouterOS is the right solution for you, you can try it out on a Virtual-Maschine for Free (htt...

ConnyMercier

I like "passive PoE detection" Feature, because it removes the Voltage, if the device gets disconnected For Exemple: Preventing us during a troubleshooting Session from blowing up our Laptops :D Until now, we haven`t experienced any of the Problems you mentioned on our Customer-Networks. M...

ConnyMercier

I concur with @millenium7, 802.3af/at standard PoE works every time and absolutely no risk of blowing up Network-device !!! BUT, I work with a lot of old & new industrial Network-Device that don`t support standard PoE IEEE 802.X. Mikrotik passive PoE detection is a WAY, WAY better solution, then...

ConnyMercier

Good Morning,

I don`t understand why it isn`t working .
I will have to do some test in my LAB tonight
and i will get back to you !

ConnyMercier

I think your Link is 1000Mbits. In the Picture you posted, you can see the Parameter "Link Partner Advertising" And 2.5Gbits is missing I looked a bit in the Forum, mikrotik doesn`t have manual 2.5 and 5Gbits at the moment. You can play with Auto-Negotiate and Advertising on both device Un...

ConnyMercier

Everything seams to be O.K !

Good Luck =)

ConnyMercier

The Adapter (SFP+/Ethernet) may be the problem.
Auto-Negotiation doesn`t always work.
You may want to check what speed they negotiate or set it manually .

ConnyMercier

In the Config you send me , the SFP+ interface is disabled.

set [ find default-name=sfp-sfpplus1 ] disabled=yes

Maybe you are connected via a 1Gbits Interface... This would explain the Speed =)

ConnyMercier

Guten Tag, Sorry for the delay , had other problems to take care of =) Try implementing FastTrack in your Firewall. This will relieve your CPU-Workload and give you more Thuput , especially between LAN`s. (https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack) If you need help implementing the rules, j...

ConnyMercier

1. RouterOS Config If possible, please POST the Config of the RB5009 (/export hide-sensitive file=anynameyouwish) 2. Test-Parameters Can you also Post your iPerf-Test parameter P.S: The 7479.1 Mbit/s only works for Transfer of 1518 byte I recommend using 2557.1 Mbps as a real world Reference Value.

ConnyMercier

I used different solutions in the past... Solution 1: Custom Adapter We build for a customer a custom Holder based on the Mikrotik QMP https://mikrotik.com/product/QMP-LHG I you don`t have the tools or Workshop to jerry-rig you own Adapter. Maybe the Mikrotik QMP can be easily modified for the WireC...

ConnyMercier

You will need to configure your device as a Wireless repeater.

https://help.mikrotik.com/docs/display/ ... e-Repeater

ConnyMercier

If RouterOS Ver.6 is installed , you should be able to install and run The Dude-Server

*Dude-Server isn`t availeble at the moment for Ver.7

ConnyMercier

If possible, please POST the Config of both Device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

You will not be able to install the Dude-Server on any MIPSBE-Device.

If you want to Test and / or play with the Dude, i suggest you use someting like the hEX S or CHR

ConnyMercier

"Detect" will only work if Neighbor Discovery Protocol is active. Depending on the Config, this may only be active from a specific Interface / VLAN. If your computer (Winbox) isn`t able to see or detect the device, Try connecting to it via the MAC-Address . This is easy because all Mikroti...

ConnyMercier

Check the Advertise-Speeds on the Interface
Make sure 2.5G is advertise....
For diagnostic purposes maybe only advertise 2.5G and remove everything else.

2022-01-03_02-01-43.jpg

ConnyMercier

You could theoretically segregate the Network physically This methode is sometimes used in very very Small Networks and/or if you don`t want to use VLAN Config-Exemple : Use the RB4011 SFP+ & UniFi 48 Port-Switch for Staff Network Use the RB4011 ether 1-5 & UniFi 16 Port-Switch for Guest Net...

ConnyMercier

A couple of years back (~2018), I bought a wAP LTE
It also had a "Automotive-Connector" with the description
The upper two (AUX) are reserved for future use

2022, The Future hasn`t arrived yet =)

viewtopic.php?t=126294

ConnyMercier

Try this,

/ip firewall connection print count-only interval=1 where dst-address~":1701" || src-address~":1701"

ConnyMercier

Queston 1: how to remove first line output, in this case "geoip.hotstar.com.edgekey.net" from output my script. Answer: :foreach i in=[/ip firewall address-list find where list=geo-ip-hotstar] do={ :if ([typeof [toip [/ip firewall address-list get $i address]]] = "ip") do={ #Ite...

ConnyMercier

Can you elaborate more on how you use the command,
and maybe provide the Script or Scheduler you use it in ?

I quickly tested the command in a script without error on both 6.49.1 and 7.1.1

ConnyMercier

So i did some more Test....
I don`t understand exactly why, but if you delete Fasttrack and Restart the Router it may work

enter this in a CLI and then Reboot

/ip firewall filter remove [find action=fasttrack-connection]

ConnyMercier

@sindy , your are right !
I still testet both DNS-Server .... they work fine !

I am out of deas....
Imported the Config in a Lab-Router
It is also double NATed

My Laptop and Cellphone are able to connect to Discord and
both the Android-App AND the Website (discord.com) trigger the Filter-Rules

ConnyMercier

Thanks @Sindy for the Backup =)

Could the DNS-Servers be the Problem?

ConnyMercier

So the only cable connected to the Mikrotik is ether1 ? And can you try adding these Firewall Rule, And tell me if the Rules get Traffic , when you are surfing the Web and accessing www.discord.com Thanks! /ip firewall filter add action=passthrough chain=forward comment="TEMP Internet Traffic-C...

ConnyMercier

Q1: Do your device behind the Router have internet?
Q2: What Network-Cable are connected to your Router and where do they go ?

ConnyMercier

That is weird ....
In the Export the DHCP-Client isn`t disabled

/ip dhcp-client
add comment=defconf interface=ether1

ConnyMercier

For some reason or another, the DHCP-Client is still active .....
Can you please reenter this in a CLI

/ip dhcp-client disable [find interface=ether1]

ConnyMercier

ConnyMercier

Can you please Post the latest Config ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you enter this in a CLI, it should rectify your Setup

/ip address set [find address="192.168.66.1/24"] interface=bridge
/ip address set [find address="192.168.88.32/8"] address="192.168.88.32/24"
/ip dhcp-client disable [find interface=ether1]

ConnyMercier

It depends...... Yes, Mikrotik / RouterOS has a Firewall and it`s quite good. For a lot of SME-Environment, the default Mikrotik-Firewall is enough. It always depends on the application and your requirements And of course , don`t expect a 200$ Router to have the same as a High-End 2000$ Firewall wit...

ConnyMercier

Do you need help to rectify the Config?

ConnyMercier

Your Config is....let say Unique =) Problem 1: You have created a Bridge and assigned your Interfaces to the LAN. But for some reason you have assigned IP-Address and in turn DHCP-Server to a "Slave" Interface. This can create Problems Wrong: /ip address add address=192.168.66.1/24 comment...

ConnyMercier

No Problem !

The CCR1009-7G-1C-1S+ is a great Router.
I use them all the time , never had a Problem with them =)

ConnyMercier

Is it possible to Post your Config ?
(/export hide-sensitive file=anynameyouwish)

I am not able to reproduce your Problem in my LAB
As soon as I add your Firewall-Rule, the Address-List gets populated,
as soon as i open the Browser and enter discord.com

ConnyMercier

How do you test your Rules ?
Did you try opening a Web-Browser and entering www.discord.com?

ConnyMercier

Answer to Question 1: Yes you can use PoE-Input and AC-Input simultaneously to provide Power to your Device. Be aware the CCR1009-7G-1C-1S+ need up to 39 Watts. So be sure to choose the proper Power-Supply 12V@3.34A 24V@1.7A 48V@0.84A ** I personnaly would use 24V or higher To keep to AMP`s under 2A...

ConnyMercier

jan/02/2022 14:53:16 by RouterOS 7.1.1 # model = RBD25G-5HPacQD2HPnD ip firewall filter add chain=forward action=add-dst-to-address-list protocol=tcp address-list=discord_ips address-list-timeout=30d dst-port=443 log=yes log-prefix="%%IPLIST-I-" tls-host=*discord.com* comment="Dynamic...

ConnyMercier

I did some quick test ....
It seams the "place-before" argument isn`t ALWAYS working in 7.1.1

probably just a bug...

ConnyMercier

@smyers119, That strange the Mikrotik Website, says something else

2021-12-31_18-38-41.jpg

I don`t know if i can edit the Voltage, but my CRS328 provides 26V & 52V
That would mean,
High-Voltage = 52 V * 450 mA = 23.4 Watts
Low-Voltage = 26 V * 1000 mA = 26 Watts

ConnyMercier

Thank you for the Feedback! I have been keeping an eye on my Audiance.. In normal use i don`t exceed 17 Watts of power. Maybe you have more Clients, longer Cables or a more demanding Config/Setup Mikrotik say the Audiance can need up to 27 Watts :( Even the CRS328-24P-4S+RM can`t provide that kind o...

ConnyMercier

My Test with a Mikrotik-Audiance, concure your Results, After a Reboot, the Scheduler was active and executing Scripts , approximatly 13 seconds before any of the Interfaces where Up-and-Running in RouterOS. I did some Quick test (i am no Scripting-Guru) You can use a Loop to wait for the Interface ...

ConnyMercier

RouterOS ver 7 or higher :global c3 "PC4SEARCH" :foreach i in=[/ip/dhcp-server/lease/find where comment~$c3] do={:put ([/ip/dhcp-server/lease/get $i address])} RouterOS ver 6 :global c3 "PC4SEARCH" :foreach i in=[/ip dhcp-server lease find where comment~$c3] do={:put ([/ip dhcp-s...

ConnyMercier

If you want to Test and/or play with this feature yourself .

You can quite easily use the Mikrotik Bandwidth-Tool to generate Traffic,
to a second Mikrotik-Device or even a Windows-Computer.

This makes it easy to Trigger the Traffic-Monitor

ConnyMercier

I did some quick test,

The Traffic-Monitor can be set to trigger "above" or "below" a certain Threshold.
If you set "Always" it will trigger on both events ( "above" or "below")

ConnyMercier

I don`t have any experience with the Dude-Server , so i can`t help you But here is a Basic Script to print the number of active Ports. # Active Interface Count :local AIC 0 :foreach i in=[interface ethernet find where running=yes] do={:set $AIC ($AIC + 1)} :put message="Active Interface = $AIC&...

ConnyMercier

Almost !!! Very small mistake in the Bridge VLAN-Filtering Here is you mistake: You need to add the bridge-Interface as "Tagged" If you want the Mikrotik-Device to be able to Talk with the VLAN Simply replace or edit this part : /interface bridge vlan add bridge=BR0 tagged=ether1,ether2 un...

ConnyMercier

Mikrotik isn`t known to have the fastest Wireless-Network If "Speed" on a single Devices is important to you, the quick and easy Solution is to upgrade to RouterOS 7.1.1 On the hAP ac³, it is possible to install the WifiWave2 -Package, that offers a new wireless driver, supporting 802.11ac...

ConnyMercier

If you need to protect your device againts electrical Surges over ethernet-Ports, you will need to buy some Ethernet Surge Protectors (It`s recommended to use a surge protector on both ends) Many solutions out there.. Mikrotik offers some Solutions : https://mikrotik.com/product/rbgesp https://mikro...

ConnyMercier

Thanks for the Feedback!

I also updated to the RouterOS 7.1.1
wifiwave2 ist quite stable and performance is awsome

ConnyMercier

My preliminary findings, shows not only an increase in Performance (aka. Speeds) but with RouterOS 7.1.1 an addition in Network Stability (less disconnects , etc..) I experienced an improvement of around 20 to 30% in Speeds (Mbps) But some guys on the Forum have claim up to 50% perfromance increase....

ConnyMercier

The default Mikrotik config will Log event of following "Typics": critical , error , warning and info You can edit what (Rules) and how (Actions) something is to be logged via the Logging-Menu (See attachement) In the Exemple you have provided, the Event was tagged as a "Firewall"...

ConnyMercier

you are welcome and Happy Holidays!

ConnyMercier

Good idea...

Happy Holiday and Guten Rutsch =)

ConnyMercier

@gabacho4

Thank you for trying to help...

FYI :

Watts = Voltage x Amps
PoE+ has a Voltage between 42,5–57V

ConnyMercier

Thanks DAD !

=)

ConnyMercier

Hmmmmm.....
Did you try connecting to the Device via IP-Address AND via MAC-Address?

ConnyMercier

Laptop was able to connect to the Router via the same Wireless-Connection?

lol @holvoetn was quicker =)

ConnyMercier

Yes , that`s the mistake =)

ConnyMercier

Mikrotik has two Android App`s
"Mikrotik Home" and "Mikrotik Pro"

Try the "Mikrotik Pro" app

ConnyMercier

This is how you need to modify your original config for Network "LAN" to be unttagged. The trick is to assign everything to the "bridge1" interface and not a a "bridge1_vlan1" Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create and Assign VLAN /inter...

ConnyMercier

Connie you outdid yourself. No Problem, I had some spare time! i'm glad to help =) LAN uses VLAN1 Its usually "Best Practice" not to mix Untagged and Tagged Networks... Network without tags aka VLAN 1 , will make it more difficult to learn/understand VLANs. But it is possible... Reading m...

ConnyMercier

Solution 1: You can configure both device with the same SSID and Password. The Client will then be able to connect to both AP`s. Solution 2: If you don`t want to manage your Wireless-AP`s separately.. You can use the Capsman-Feature of Mikrotik to manage them centrally. https://wiki.mikrotik.com/wik...

ConnyMercier

However, nothing answers also on 192.168.0.1 Because your Router wasn`t assigned the 192.168.0.1 IP-Address... You have an Error in your Config: /ip address add address=192.168.88.1/24 comment=defconf interface=local network=192.168.88.0 add address= 192.168.0.0/24 interface=guest network=192.168.0.0

ConnyMercier

Step 0: Management Port It`s quite common to lock yourself out, while configuring a Bridge with VLAN-Filtering. So I recommend connection via a PORT, that isn`t being assigned to the bridge and isn`t Block by Firewall and Co. Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create a...

ConnyMercier

Do you need more help?

Do you know how to configure the bridge & VLAN-Filtering..
or do you need a step-by-Step guide?

ConnyMercier

The Quick and dirty explanation ist ,

You will need to create a bridge and assign all LAN-Interfaces to it.
Create and Assign VLAN`s to bridge insteed of ether-Ports

You can use Bridge VLAN-Filtering to limit the VLAN`s to specific Port and/or create Trunk-Ports

ConnyMercier

Good Question.... NEVER , do i improperly shutdown a device, that is "Live" in the Data-Center. I always log in and execute a proper Shutdown. Even if our experience has shown, that nothing bad will happen! I simply , don`t want to tempt fate =) But for non critical devices , i do it all t...

ConnyMercier

You need to break down the issue into three seperate problem. Problem 1: Target Voltage/Current You need to know the Power requirement of your device. Voltage is easy, because you only have 12V.. Current is a bit more tricky... It depends HOW you use the hAP ac³ I think you should consider ~ 18 Watt...

ConnyMercier

But i have to admit, it is somewhat confusing ...

25-12-_2021_14-40-36.jpg

ConnyMercier

I think amazon mean: it uses a OS for Routers
RouterOS isn`t the same thing as Mikrotik RouterOS

Mikrotik RouterOS runs only on Mikrotik device or hostet on x86 Hardware

ConnyMercier

If you need a USB over TCP Solution today ...

I highly recommend W&T -> https://www.wut.de/e-53www-15-inus-000.php
Use there Product all the time in 24/7 environment and they have PoE-Powering options

They are not cheap, but they are very good quality!

ConnyMercier

Don`t forget Porsche and Volkswagen =)

ConnyMercier

You need to remove filter-Rule #4 defconf:fasttrack
(aka. Blue symbole )

ConnyMercier

easy Script to remove all Fasttrack rules :

/ip firewall filter remove [find where action=fasttrack-connection]

ConnyMercier

Remove all "fasttrack connection" filter rule under /ip firewall filter
Restart the router and the "buildin" rules will be gone

ConnyMercier

Something like this ?
Sadly i think "DHCP" is for both Server and Client...

2021-12-22_20-41-56.jpg

ConnyMercier

Export / Import of the config should work without a problem.

Don`t worry !

ConnyMercier

Your house needs a key to enter.
Your car needs a key to use.

I used to live in Canada, i never had to lock my doors , haus or car

Maybe if your Router is in Canada you don`t need a password =P

ConnyMercier

2021-12-22_20-05-09.jpg

You need to take a look under "Packages" to install / activate PPP
After that it should be availeble in the winbox menu,

ConnyMercier

a CRS328 with 2.5Gbps would be awesome

not only for Wifi6-AP`s
more and more Computers have mainboards with 2.5Gbps
For a lot of graphic designer (Adobe and co.) or engineers (Solidworks, Autodesk, etc..)
working off of network resources, it would be a big improvement

ConnyMercier

English please , so everybody can understand and help !

ConnyMercier

Did you rule out a DNS-Problem ?

What happends when you use 10.5.51.1 insteed of ntp.day.ir..

ConnyMercier

I wasn't able to find the root issue, why only the Vodafon-WAN is slower. Did you monitor CPU usage on your device ? Maybe you are achieving the performance limits of your Router? Extra ! Extra ! while looking at your config, saw a posible miss configuration, Firewall: You don`t have any Firewall-Ru...

ConnyMercier

Yes, very nice Question indeed.... I always assumed any number of vWLAN had performance degradation. So for small Networks with the need of multiple Wireless-Networks, I usually use the Access-List to assign them to the Network For exemple: Guest : VLAN100 via default TAG (wireless interface) Camera...

ConnyMercier

Forum wasn`t available for most of the day on Sunday
Forum-Post from the morning aren't there anymore

ConnyMercier

Yes it is possible....

You can set a default VLAN-Tag for all connected device,
on the Wireless-Interfaces on your Mikrotik-Device.
(Exemple: vlan-id=123 vlan-mode=use-tag)

If you need Help with your Setup
Please Post Config of the 951Ui
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

would that achieve the objective of having each subnet using a separate ISP link? The Segregation of Traffic over two separate ISP link, as "nothing" to do with VRRP. You can configure your VRRP-Routers as you would any Router. Mangel & Tag Traffic, use QoS, Firewall, PCC, etc.... In ...

ConnyMercier

You need to configure 2 VRRP 1 for the 192.168.0.0/24 Network 1 for the 172.16.0.0/20 Network With the Paramter "Priority" you can set where the VRRP run's per default In oder words / Exemple: RB3011 VRRP (192.168.0.0/24) Priority=200 RB3011 VRRP (172.16.0.0/20) Priority=100 RB450 VRRP (19...

ConnyMercier

How is the wetter on Mars ? :D like @anav already sayed, Firewall isn`t optimal. The Quick solution to solve your Problem, would be to use an Address-List to Block known Attackers. Something like this : Step 1: Create and populate Address-List /ip firewall address-list add address=78.128.113.66 list...

ConnyMercier

If possible, please POST the Config of your Device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

The Short Answer is YES.

The Device can be powered with 12-57 V and need ~8w of Power.
But you need Battery-Protection : To protect againt over drainage / over-discharge.
And you need LHGG-Protection : To protect againt improper shutdown

ConnyMercier

* I can ping IPs but not names on my existing (parent) segment (10.0.0.0/24 - see below for setup) by IP (Linux says: temporary failure in name resolution). Same results from the RB terminal. You need to enter the DNS-Server of the Parent Network in your Routers DNS-Configuration. In your momentary...

ConnyMercier

Short of hacking your own Router, there isn`t really a Solution.

ConnyMercier

Anyway, I think keeping an HTTP access (on an unusual port), can be a safe measure, if HTTPS ever fails. Take my advice or leave it: I personnaly would try and use some sort of Whitelist (IP or DynDNS), or even something like PortKnocking to limit the "Surface area" that your Router has o...

ConnyMercier

Good Evening, I took a look at your config... The Configuration of both Cap and Capsman isn't very "clean" If the Problem persist, i would advise to go thru your config and cleaning it up. My main concern are: 1. DHCP-Servers Both Cap and Capsman have active DHCP-Servers and I assume the M...

ConnyMercier

If you don`t have access to the Device,
Reset the RB433 via the Reset-Button

It isn`t hard to do, look in the Manual for instruction for more Info
(https://i.mt.lv/cdn/product_files/rb433GL-qg_181013.pdf)

ConnyMercier

I don`t mind creating one for the Mikrotik Comunity.
What kind of Case did you have in mind?
10.5 " Rackmount, 19" Rackmount , Big, Compact, in the form of a CAT =) ?!?

ConnyMercier

Please Export and Post your Config for both Capsman and CAP
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you need more help with your Setup
Please Export your actual Config:
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

1. Queues If you are unable to Control the devices on your Network, then Queues are usually the only ways to manage Bandwidth / QoS. This allows you to, for exemple 1. prioritise the PS4-Traffic (like you normally would for exemple VOIP) 2. reserve Bandwidth for PS4-Traffic 3. Limit Non-PS4 Traffic,...

ConnyMercier

Good Morning, 1. PoE-Overload I did some Test yesterday... I wasn`t able to reproduce the PoE-Overload on any of my Mikrotik PoE-Output devices. The Mikrotik website states a Max power consumption of 21Watts (30W for LTE version) During my quick tests , i wasn*t able to exceed 14.5 Watts. I would tr...

ConnyMercier

The Firewall-Rules don`t necessarily conflict with each other, but ... 1. Info When the Mikrotik communicates with other Devices on a Network If usually gets a Answer! But if you don`t allow this, communication becomes impossible. For Exemple : Requesting an IP from a DHCP-Server, Making a DNS-Reque...

ConnyMercier

Did you already try with a different / shorter Cable?

ConnyMercier

ah you mean CRS328-24P-4S+RM ?

I dind`t find the CRS328-24G-4S-RM...
I thought is was an older Model
with 24G (24 gigabit non PoE )

ConnyMercier

Like CRS326-24G-2S+RM but with 4 instead of 2 SFP+ slots. This would be a solution if CRS326-24S+2Q+RM is too big. How about the : CRS328-24P-4S+RM Are there any plans for products with following features? Like CRS326-24G-2S+RM but with 8 GE ports instead of 24. This would be a solution if CRS326-2...

ConnyMercier

I got almost 20% more thruput after updating to 7.1+ Wave2 =) How do you Power your Audiance ? You need a 802.3at Type 2 PoE (PoE+) I power my Audiance via a CRS328-24P-4S I did some Quick Power test (CAT-6a Cable ~20m 51V) Laptop and phone during Low-Traffic ~ 6W of Power is needed, Laptop and phon...

ConnyMercier

Good Morning, Did you configure the wlan1-Interface ? I edited my Step-by-Step Guide to include this now ... (edited Step 8 and 9 for the Audiance) If it is not working, maybe there is still a small mistake somewhere.. Simply post the config of the Mikrotik device and we will Check-It (/export hide-...

ConnyMercier

Ok... This is how i solved it in the LAB(Step-by-Step) Step 1: Create Bridge /interface bridge add comment="Office A" name=bridge1 add comment="Office B" name=bridge2 add comment="Printer" name=bridge3 Step 2: Assign IP-Addresses /ip address add address=192.168.1.200/24...

ConnyMercier

Sorry Anav...
I somehow skipped your #4 post while scrolling...

Didn`t want to make things more complicated ! =)

ConnyMercier

Step-by-Step Guide Step 0: Secure your Router -> Password for "admin" -> Firewall -> limit sevices -> ect... Step 1: Create Bridge /interface bridge add name=bridge1 vlan-filtering=yes Step 2: Create VLAN-Interfaces /interface vlan add comment="Shared Resources" interface=bridge1...

ConnyMercier

Step-by-Step RB4011 This is a Guide how I would configure the Device If i had to Set it up from scratch. Step 0: Securing your Router -> Give your user "admin" a password -> Firewall -> limit Services -> etc.... Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Assign Interf...

ConnyMercier

Step-by-Step Audiance This is a Guide how I would configure the Device If i had to Set it up from scratch. Step 0: Securing your Router -> Give your user "admin" a password -> Firewall -> limit Services -> etc.... Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Assign IP-A...

ConnyMercier

So i installed ubuntu on a RPI4 Installed and configured vsftpd Created a file with some random Text named testfile.txt Mikrotik RouterOS 6.49.1 /tool fetch address="ubuntu" src-path="/testfile.txt" user=ubuntu mode=ftp password="123456789" dst-path="/home/ubuntu/D...

ConnyMercier

O.K !

ConnyMercier

Short Answer: YES!

But in both RouterOS ver.6 and ver.7,
some Options/ Feature are only available over CLI.

ConnyMercier

What are you trying to PING, the ROUTER ?
or something in the Internet ?

Did you think of NAT ?
If not try this :

/ip firewall nat
add action=masquerade chain=srcnat

If you need more Help, please POST your Config
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

Could you please POST your Config,
so we can better understand how your device is configured ?
(/export hide-sensitive file=anynameyouwish)

Thanks !

ConnyMercier

Are you running SwitchOS or RouterOS on your Devices? I know RouterOS ver.7+ Supports MLAG. SWOsS i don't know ! To answer your original Question: No , you don't have to use identical Models. Even in the Wiki, they don't use identical models for their Exemple =) (https://help.mikrotik.com/docs/displ...

ConnyMercier

Having multiple Network on a Router with the same IP-Range, is always going to be a PAIN in the A**! Is it really necessary? If yes, may i also know why ? (just curious) I think it's possible to "mark" via Mangle so the Router/Swtich knows from which "Bridge" a Request came from....

ConnyMercier

Question 2: SSH as being immune to timing issues ? I never had a Problem with Mikrotik and timing. Even when the Device think it`s still 1970 =) Question 3: Suggest using some other tools (Wireguard, OVPN, ...)? In the context of a Productive and/or Business Environment , i think it is "Best Pr...

ConnyMercier

Did you Post the Full Export ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you can Update via Winbox...
Yes

Or do you mean something else ?

ConnyMercier

RB5009 (ca. 2557.1 mbps Routing capacity) is a great device... Sadly it doesn`t have any Wireless-Interfaces (yet) .... So it isn`t a direct replacement for your hAPac... If you want a "all-in-one" device maybe the RB4011iGS+5HacQ2HnD-IN (2,560.8 mbps) or even the Audiance (912.6mbps)could...

ConnyMercier

So i took a look at your Config, and maybe it is possible to tickel a bit more Performance out of the Device.. But it won`t be much....(a couple a mbits ) Like i posted earlier , The device itself can only handel around 300 mbits without Fast Path And your device also handels other services like Cap...

ConnyMercier

If you expect / want more than 318 mbits
You will need to buy a more powerfull device !

Could you Export the full Configuration ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

My suggestions : Setup Audiance : I would configure the Audience as your Main Router. Use one of the wlan-Interfaces to connect to the ISP-Router as "station". Configure the needed Services on it like DHCP-Server, DNS, Firewall, NAT, etc... Bridge all remaining Interfaces together for your...

ConnyMercier

It isn`t a Perfect Solution,
But at least Mikrotik allowes you to upgrade back to the 6.48.6 (Long-term) or 6.49.2 (Stable).

Maybe there will be a Solution in the Future !

ConnyMercier

How does the Script assign IP-Address and Co...?
Is there a Logic* behind it or a File ?

Logic = if vlan100 then IP= 10.1.100.1

ConnyMercier

Hmmm.. very similar to these Threads/ Posts :

viewtopic.php?t=181038#p896720
viewtopic.php?p=882867#p882867

ConnyMercier

Many Hypervisors can be used,
- ESX
- Hyper-V
- Qemu
- Xen
- VirtualBox
- ect...

Look at the Wiki for Instruction :

https://help.mikrotik.com/docs/pages/vi ... d=18350234

ConnyMercier

Good Evening Kris,

I wasn't able to reproduce the Error...
I was able to connect to the "unsecure" Network and get an IP-Address

Could you maybe Export the Configuration again ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

That`s a good question ... Posible Reason 1: The Bridge-Interface has a default PVID-Parameter. A dynamic VLAN-Filtering Rule is created, if no Static rule is defined for this vlan-ID. Posible Reason 2: You only need to add the bridge, if the Device itself need to communicate with the VLAN. So for a...

ConnyMercier

You also need to add the "Bridge" to the Tagged VLAN-Filtering rules

Basic-Exemple:

/interface bridge vlan
add bridge=bridge-LAN tagged=ether8,bridge-LAN untagged=ether10 vlan-ids=105
add bridge=bridge-LAN tagged=ether8,bridge-LAN untagged=ether9 vlan-ids=117

ConnyMercier

I am personally tooo Chicken to have a Public-Router without an active Firewall (Input-Chain)
But i see a lot of Mikrotik-Devices configured like yours... and they don`t report any Problems !

But maybe other Forum-Users can give they opinion !!

ConnyMercier

Did you Post the Full-Export ?
If yes, your Device is not Secure.

You may want to add Firewall, limit "/ip services" etc...

ConnyMercier

Maybe one of the following Paramters is the Problem on the Wireless-Interface...
Can you maybe temperary deactivate them and Test ?

wmm-support=enabled
multicast-helper=dhcp

ConnyMercier

Godd Morning again, This is wrong : add country=hungary datapath.bridge=bridge datapath.vlan-id=10 datapath.vlan-mode=use-tag name=hotspot security.authentication-types="" The export should be : add country=hungary datapath.bridge=bridge datapath.vlan-id=10 datapath.vlan-mode=use-tag name=...

ConnyMercier

Do you Heard a humming or clicking sound from the Capacitor ?

overheated, bad cap or simply Old.... in any case,
If you are able, I would recommand replacing the cap

And see what happends !

ConnyMercier

Is it posible to post the config of the Mikrotik device ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

I'm glad it finally worked !

You will need some Foward Firewall-Rules to restric trafic between VLAN's
Be carefull not to Lock yourself out ! (maybe use Safe-Mode)

ConnyMercier

The Question is what is Working ?

Do the Devices in the Network get an IP-Address on any of the VLAN ?

ConnyMercier

You need to include the "bridge" in the Tagged-List...
If you don't , the "Device" can't communicate with the VLAN

Exemple:
add vlan-ids=10 tagged=bridge,ether2_ap_iroda_lelkeszi,ether3_ap_iroda_titkarsag,ether14_ap_out,ether18_sw_church bridge=bridge

ConnyMercier

Tipp / Trick : If you decide to segregate your Network with VLAN's, I recommend you also have a Network / VLAN dedicated for a Administration-Network. It's usually considered "Best-Practice" and add another Layer of security* to your Network. You can then use this "Administration-Netw...

ConnyMercier

FYI -> ether4_ap_pince isn´t assigned to the Bridge

ConnyMercier

Additional Information about VLAN`s

viewtopic.php?t=143620
https://help.mikrotik.com/docs/display/ ... NFiltering
https://help.mikrotik.com/docs/display/ROS/VLAN
https://help.mikrotik.com/docs/display/ ... VLAN+Table

ConnyMercier

You are missing the Bridge-VLAN and the Bridge-Port PVID Step 0: Untagged-Traffic In your current Configuration, Untagged-Traffic will be assigned a default VLAN-ID of 1 This can be changed in the Bridge-Configuration or your can assign a Tag for each Port individually via "/interface bridge po...

ConnyMercier

The RB951G isn´t the most Powerful Router of the World... You can expect around 244 Mbps of Routing capacity (without FastPath) Solutions.... - Firewall / NAT Optimisation - Fast Path utilisation - QoS / bandwidth-Limitation If you need more help, please post the config of the Mikrotik device (/expo...

ConnyMercier

@andkar, Thanks for the Feedback!

I did a Quick Test with a Fluke at work and a hap ac2
I wasn`t able to get Port-ID on both RouterOS 6.49.2 and 7.1

ConnyMercier

To disable the Access-List Funktion via the Wireless-Interface you need to both enable default Authentication and Fowarding (Access-List is used for both Parameters / Features) Basic-Exemple for wlan2: /interface wireless set wlan2 default-authentication=yes /interface wireless set wlan2 default-for...

ConnyMercier

Basic Exemple: (Disable All)

 /interface wireless access-list disable [find]

Tried it via SSH, Telnet and Console(winbox)
RouterOS ver. 6.49.1

ConnyMercier

Glad i could Help !

The new Mangle-Rule basicly says :

Every Client-IP listed under "under_nordvpn" schould go thru the VPN,
EXCEPT if the Destination-IP is listed under "LAN_List"

ConnyMercier

You need an exception to your Mangle-Rule. Many ways to solve this Problem.. You can add an address-list with the IP`s and/or IP-Ranges you would like to exclude from NORDVPN For exemple "LAN_List" and include add 10.10.0.0/24 /ip firewall mangle add action=mark-connection chain=prerouting...

ConnyMercier

, BTW, doesn't work on my linux workstation.

Look at that.... lerned something new !!
Thanks =)

ConnyMercier

... if clients are to cache answer indefinitely, how does one force clients to get fresh value in case record changes?

Answer: ipconfig /flushdns

ConnyMercier

Did they remove this release from the download now?

Jap , it´s not available anymore

ConnyMercier

The Mikrotik Wiki is a bit hazy...
(https://help.mikrotik.com/docs/display/ ... +discovery)

I have a Fluke lying around at Work...
I will try and make some Test.

But maybe some other Forum-User has more experience with Mikrotik and CDP/LLDP

ConnyMercier

If i am not mistaken, When you add a Static-DNS entry It will stay in the Static-DNS-List forever or untill deleted. Exemple : /ip dns static add name=test address=1.1.1.1 The TTL-Value (default 24h) are for the Client asking for the Domain. If you want your Clients to cache DNS-Entries for longer, ...

ConnyMercier

Take a look at Dot1X

https://help.mikrotik.com/docs/display/ROS/Dot1X

ConnyMercier

I use the CRS328-24P-4S+RM for everything =) Answers to your Question 1. desirably unit 19 inch case; Yes , its 19" Rackmount 2. desirably LCD; No, most if not all new Mikrotik Switches don't have LCD's anymore. 3. fully hardware processing switching; I don't know what "fully" hardwar...

ConnyMercier

Try this :

http://192.168.2.1/webfig/#Terminal

ConnyMercier

Answer 1 Is this because the CCR2004-1G-12S+2XS does not have a switch chip? Short Answer.. NO! Most, if not all Cloud Core Router (CCR) from Mikrotik don't have a Switch-Chip They are usually optimize for Routing over CPU Answer 2 Is there something wrong? I never owned a CCR2004-1G-12S+2XS, but I ...

ConnyMercier

I Factory-Reset and updated my RB4011 from 6.49.1 to 7.1
I wasn't able to reproduce the Error.

Did you try disabling the Web-Service and restarting the Router (/ip service set www disabled=yes)
After the Reboot, try to re-enable the Web-Services and connecting to it.

ConnyMercier

We need more Information to help you.

1. Can you please Post a Screenshot of Queues in RED-Color

2. Can you please post the config of the Mikrotik device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

You are not alone, a couple of guy's had problem updating to ROSv7.1 on x86
Usually Mikrotik doesn't help restoring lost Licences...

try contacting support directly
-->> support@mikrotik.com

ConnyMercier

It isn't possible, the Mikrotik hAP ac³ only supports up to 28v.
You will need a PoE-Injector or PoE-Switch

Some other devices like the hEX s supports up to 57v,
and because of this, it is possible to Power 802 devices thru the PoE-Out.

ConnyMercier

I recommend to configure Router A ( RB3011) and Router B (RB450) before even starting with the VRRP-Setting. Step 1: Configure Basic LAN-Network (IP-Address) Router A: ether10 --> 172.16.15.251/20 Router B: ether5 --> 172.16.15.252/20 Step 2: Configure Main-ISP Configure Router A and Cable-ISP Confi...

ConnyMercier

To add to @holvoetn ... I also think it is a good idea! Especially for consumer oriented Network-Devices... Don't forget in some EU-Contries like Germany, You are responsible for your Network and what appends on it So if someone uses your Network for exemple to download illigal Music / Movies YOU as...

ConnyMercier

I understand, you need at least 2 vlan to test/learn bridge filtering Here is a very basic exemple on the hEXs with 2 vlans Network A vlan111 10.10.111.0/24 Network B vlan222 10.10.222.0/24 Step 1: Create bridge /interface bridge add name=bridge1 Step 2: Create VLAN'S /interface vlan add interface=b...

ConnyMercier

I am not a 100% sure i understand your needs... This will always keep your DNS-Record up to date with the actual Internet IPv4 address. /ip cloud set ddns-enabled=yes ddns-update-interval=20m If you want your DNS-Record to contain the local IP-Adresse use the following : /ip cloud set ddns-enabled=y...

ConnyMercier

@simsrw73: May I ask why you are so keen to use the "bridge vlan filtering" Feature ?

Because, For a small SOHO-Network this Feature isn't necessary, when
the Guest-Network is only provided over Wireless & Vlan.
The Step-by-Step guide i gave you works just fine...

ConnyMercier

Many ways to create and assign Clients to a "Guest" Network. In this exemple a used a "Virtual" Wireless-Interface with a dedicated SSID Wireless Access-Point (Mikrotik wAP ac) Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create Security-Profile for Guest /int...

ConnyMercier

Here you go..... I basic Step-by-Step guide assuming Guest-Network is vlan-id 111 Main Router (Mikrotik HEX s) Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create VLAN-Interfaces /interface vlan add interface=bridge1 name=vlan111 vlan-id=111 Step 3: Assign IP-Address /ip address ...

ConnyMercier

It's a BUG in ROS7
Both HEX and HEX s are affected

Mikrotik know's about it...
.> viewtopic.php?t=180465&hilit=hex#p892682

ConnyMercier

Can you please post the config of the Mikrotik device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

Can you please post the config of the Mikrotik device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

I don`t have the PowerBOX Pro in my LAB, so i can`t test it and/or make Foto`s..

Usually you can mount a piece of DIN-Rail ( not included with Device) on a Flat-Surface
Mount the DIN-Rail mounting HW (included with device) on the Device
After that the Device can be "Cliped" in

ConnyMercier

But my main guestion is still unanswered: Do i need just change interface from ether1 to SFP+ port and all will be working? OR i will need to configure something else to swtich to optic... :) Yeah, you will most likely only have to change the ether1-Reference to SFP+ for firewall, NAT, DHCP-Sclient...

ConnyMercier

You can screw a DIN-RAIL on a Wall , with no problem.

If you buy DIN-Rail in "Bulk" they are usually fitted with hole, so you can mount them on a Flat surface.

ConnyMercier

The CRS326-24G-2S+IN shouldnt have any problem Routing 50/50 ISP Speeds.

The Problem with Response-time / Latency may solves itself with the new ISP (Optic fiber),
But may also be because of the Config / Performance of the Network or Mikrotik-Device

ConnyMercier

You can simply use the DIN rail itself , to mount it on the Wall

ConnyMercier

If you don't get an answer via the Forum in the next couple of days.

Ask your distributer or Mikrotik Support directly

ConnyMercier

I don't have the Electronics knowledge to answer this question... I don't know if you need to change something before connectiong the LTE-Antenna I just know one of my German supplier wrote under the Chateau "Sie können 2 externe LTE-Antennen" translated-> You can connect 2 LTE-Antenna (ht...

ConnyMercier

What do you not understand about ----> I don't know the login for either of them!!!

He added / edited his Post this after i postet =)

ConnyMercier

Yes the cAPac gets very very HOT...
The enclosure is printed in PETG and it has enough holes not to melt =)

use it every day since the beginning of Corona...
No problem yet ...

ConnyMercier

I used the cAPac insteed of the hAPac because of the PoE Bypass. Why? 1. It gives me the posibility to connect and power an IP-Phone or other small PoE-Device 2. Sometime i connect the Router between existing devices (like switch and existing IP-Phone) because no other Cable is free or working (like...

ConnyMercier

I also make some 10.5" Rackmount enclosures for Mikrotik and other Devices. It's designed to be easy to print on a Std Sized 3D-Printer and you can even attach two together to mount in 19" Rack. I can't show actual Picture of Data-Center where i implemented them.. But I attached some Pictu...

ConnyMercier

Your wish is my command

If here there is a need for this kind of "Produkt"
i'll gladly refine the Design and make it available

https://ibb.co/hXHm9X1
https://ibb.co/28yMDGn

ConnyMercier

Do have LLDP/CDP active on your Mikrotik-Device ?
You can check under

/ip neighbor discovery-settings print

ConnyMercier

I had something similar in the Past
I wasn't able to recover from it !

ConnyMercier

Good Morning, I did some quick Test and I can confirm your Problem.... I found two Solutions to your Problem... Solution 1: Netwach When Netwatch detect the Pihole-Server is back online, it will reset the Static- DNS-Server and Flush all DNS-Cache entries. The Static-Server will be #1 again!! In the...

ConnyMercier

Can you please post the config of the Mikrotik device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

mAPLite is a very good Travel-Router! I have 3 of them and one is always in my Laptop-Bag It's Compact and you can power it with your laptop or Power-Bank, everyone should have one =) I do a lot of Job-Hopping... And realised most company's have a PoE-Network So my Main Travel-Router at the moment i...

ConnyMercier

I use the Mikrotik-API + Powershell for some projekts.
It's not perfect, but i didn't have any problems yet!

ConnyMercier

Glad i could help !

Good Luck and don't forget to backup before changing anything =)

ConnyMercier

Solution A: DOT1X provide port-based network access control via a Radius-Server (https://help.mikrotik.com/docs/display/ROS/Dot1X) Solution B: DHCP If you don't want to border with complex Radius-Server and Co.... You could set the DHCP-Server to only give IP-Addresse to known devices (Static-Leases...

ConnyMercier

Incomming RDP ?
Where Client via the Internet connects to PC's and Server's
in your Local Network

or Outgoing RDP ?
Where the PC's in your Local Network connect to
Server's in the internet

Search found 726 matches