MikroTik

Techsystem

Hello My friends..!
so from your long experience, and with alot of method out there to apply Load balancing on mikrotik router, any one try to use Nth method..?
is it more effective than PCC and other..?
what is the down side and also the up side for it ..?
can anyone help..?

Techsystem

Techsystem, if you didnt understand what was done and why it works, then the config might work, but the effort from my perspective is a fail. further our discussion i can say that i understand what happen, and why it work, actually i remebered that i apply such a rule in my old routing LABs but for...

Techsystem

You have no firewall rules so traffic is not being blocked to your lan subnets for incoming wireguard. Did you fix the other items........... (what do the client devices have for allowed addresses for their single peer entry for the main router?) Hello Mr anav this response is dedicated to thank yo...

Techsystem

So you dont have public IPs they are private IPs from some upstream router where port fowarding can be done??

using DMZ rule in routers .. yes that's can be done..!

Techsystem

Well the config bares little resemblance to your first post, so not sure I can help as i dont know what is truth?? Also, on the config, it is unclear what you are doing with the two WANs? Is WAN1 Primary and WAN2 secondary. Is there failover between the WANS, Are there some users that should not us...

Techsystem

Great now provide the export
/export file=anynameyouwish ( minus router serial number and any public WANIP information )

here we are..

Techsystem

i dont have a firewall rule to block login from a public address...also as i mentioned that sometime i login normaly without any problem. You need a rule to allow 8291 on input before any drops. But given you're saying it works sometimes, do you have multiple WANs? Because the router input traffic ...

Techsystem

so if i run a sniffer, what interface will be the target and if i opened using wireshark what i have to look in the sniffer file to identify the problem..? Obviously it'll be WAN interface (if your winbox access is open). And the sniffer contents? Let me google that for you ... lol...very interesti...

Techsystem

First off: it's a bad idea to allow winbox access from WAN. In past there were a few exploits of winbox access. Second: winbox saying "logging in" and nothing more very probably means some device is (silently) dropping packets and winbox is re-trying to establish connection. As you can lo...

Techsystem

Hello For all MT Users and professionals...! i am trying to access my MT router through public IP, so sometime i get this message -(as the picture below)- just logging in and it remain just like that without log in. i dont have a firewall rule to block login from a public address...also as i mention...

Techsystem

I suspect your equipment drinks blood and goes out at night ................. A diagram will help, then instead of rambling sentences that make no sense right down your user requirements with respect to wireguard. Router X ( wg server for initial handshake) Router Y (wg client router for initial ha...

Techsystem

Yes, but then you have to mangle - You create a firewall address list of the 10 people and mangle on that list. 10 people thats only ten rules LOL. Choice is yours. Hello Man..! lol.. just a hint on how can i achieve this .. after creating the address list the rule will be like this -(correct me if...

Techsystem

Hello for all Mikrotik people there ...! so i have two WAN connection -(ISP-1 and ISP-2) and i want to redirect 10 users from my LAN to use ISP-2, is there is a way to do that without using a routing rule for each one..? i mean can i put them in a groub or something like that and redirect them in on...

Techsystem

No I dont see or understand LOL. Please draw a network diagram. Hello Mr.anav ..! so to update my situation .. i canceled the VPN from my network and now i have only isp-1 in ether-1 isp-2 in ether-2 LAN=ether3 in normal situation all range are available but i reliazed that when i put any routing r...

Techsystem

You are not listening, there is nothing wrong with your wireguard settings........... The wireguard traffic reaches the subnets no problem. What happens next with the return traffic from the subnets................................ You have to consider how that traffic is routed, traffic coming from...

Techsystem

If you send traffic from wireguard remote user to one of the subnets, how do you expect the return traffic to be routed back into the tunnel? As I showed, you have routing rules that force all traffic coming from the subnets out one of the two local WANS........... So no wireguard user return traff...

Techsystem

Of course, the router is doing what you told it to do........... Take traffic from ether3 and ether5 and force it out the WAN. How do you expect any return traffic from wireguard will go back into the tunnel? /routing rule ( besides the fact that you have duplicates and redundancy in routing rules....

Techsystem

Hello for all Mikrotik experts here..! so my situation like this : i have a wireguard tunnel built inbetween my mikrotik RB951ui and my windows machine and its working very well except i cant access my mikrotik LAN network from it : what i mean..? so here is my MT config: ether-1 /as a DHCP Client a...

Techsystem

The port should be explicitly be opened on the input chain (there is no port forward necessary), assuming you want to have this service available on the WAN site. And...as soon as you managed to get it to work...close it! Security wise you don't want this...never. Is this what you want to achieve? ...

Techsystem

Hello my friends..! so i came a cross a very weird situation here. i intended to open SSH port just by going to ip==>services and enable the SSH port today when i try to do that the port didn't open, i try to create a port forwarding rule for it but also that didn't work. any one can help me to find...

Techsystem

I'm doing it with routing rules. Different LANs (or VLANs in some cases) use different routing rules to get to teh internet. Hello K6ccc..! Please can you give me more detailed info about how can i do that..? actually its the first time that i do such thing in mikrotik.. what i have to create in th...

Techsystem

Hello My friends..! so i have one Fiber WAN connection from My ISP connected to Huawei Router and this Huawei Router connected to MT RB951ui Router in ether1, i have 3 public ip address on this fiber connection, anyone know how to separate this public ip address from it in mikrotik..? i mean if i wa...

Techsystem

Hello my friends..!
so i have a lot of curious to know how can i use this Routing Filter feature in Mikroitk .. i didn't used before in any LAB or project..!
any one have any idea about it..? or can give me a real life scenario for use it...?

Techsystem

Hello my friends..!
so i want a simple script to swap between two ISP automatically every day.
any one have any idea about how to apply that..?

Techsystem

so please if anyone of you have a deep understanding of Masqurade rule in general if he/she can explain to me this yellow bar ..!? [...] second i didnt understand what they actually mean by leaking local IPs to a public network. i heard about leaking public address but what about leaking local addr...

Techsystem

Hello My friends...! so please if anyone of you have a deep understanding of Masqurade rule in general if he/she can explain to me this yellow bar ..!? they said that if a primary link comes back, routing is restored over primary link...etc so in this case i dont see any different between masqurade ...

Techsystem

Hello For all Mikrotik people there..!
for learning and testing purpose anyone try to use Script in DHCP-Server configuration..?
how it work, when we can use it..?

Techsystem

Techsystem, unfortunately that is not possible......... What is possible so you stop beating your head against the wall is to a. select an SSID and push that wifi down a specific WANIP ( so use that wifi for google ) b. select a specific IP address, to go out a specific WANIP ( so use that device )...

Techsystem

Ok, that is impossible to do...

in my example i want to do this :
in google search when i put Netflix.com i want this website to go through ISP-2
and i dont care about any other website if it goes through ISP-1 or ISP-2
so is this possible..?

Techsystem

No, because you cannot resolve a URL to an IP address. A URL is prococol://hostname/path?parameters. So e.g. https://example.com/sales/order.html You want to direct https://example.com/sales/order.html to one ISP and still direct https://example.com/index.html to another ISP, right? (if NO, then yo...

Techsystem

Make an SSID and vlan for this case. When user wants to visit URL, use the specific WLAN/SSID. if its an HTTPS site, not sure how you can block it. hello anav..! so can we play around with DNS..? i mean can i resolve this URL to IP then make a rule say that any request to this IP go through ISP-2. ...

Techsystem

Hello for all Mikrotik People there..! hope you are all good..! so what i want to achieve is this scenario: i have RB951ui with two ISP ISP-1 with IP address :192.168.10.1 /ether-1 ISP-2 with IP address: 192.168.20.1 /ether-2 LAN: 10.10.1.1/24 anyone from LAN that browse a specific URL, i want to ma...

Techsystem

You can't. You can not mix two ISP to go faster, at least you can balance the requests for multiple devices between the two ISP, but you can not obtain one single connection to a single source with 16Mbps speed. Hello Mr.rextended..! so i get a lot of answers out there from a very professional peop...

Techsystem

This cannot be! With a name like Techsystem, he must be a genius and the worlds expert on configuring the MT just after watching one crappy youtube video. Who is this rextended cat, who thinks he knows better, anyway. Just because he is responsible for writing half the MT scripts on the planet, lik...

Techsystem

You can't. You can not mix two ISP to go faster, at least you can balance the requests for multiple devices between the two ISP, but you can not obtain one single connection to a single source with 16Mbps speed. but i already have one..! previously i used this guy method and it worked well https://...

Techsystem

Hello My friends..!
so i am looking for an efficient way to merge my two ISP internet connection
ISP-1=8M=ether-1
ISP-2=8M=ether-2
=====> LAN=16M=ether-3

anyone can guide me into a link or any file that explain in detail how can i do that..?

Techsystem

Hello My friends..! so i have two ISP connection ISP-1 & ISP-2 connected to RB2011, and i have a wireguard interface on this RB2011 created using the public IP on ether-1 -(i dont have a public IP on ether-2)-. when i disable the ISP-2 -(ether-2)- the wireguard work properly and i can ping my LA...

Techsystem

Hello For all Mikrotik friends here..!! So i see alot of videos out there from a Mikrotik Certified Trainer or other high level Mikrotik people that talking about DDOS Mitigation, and they apply rules different from the preexist default rules on Mikrotik RouterOS, so NOW my question is does that mea...

Techsystem

We can move forward when you address context especially WG, a network diagram would help. Also did you fix the IP address error etc....... Hello Mr. Anav..! so i fixed the ip address error also i replaced the load balancing Based PCC rules with this rule -(LB based on bandwidth)- 0 chain=prerouting...

Techsystem

Why do you quote whole preceding post? Does it help you to answer? Do you repeat what your interlocutor says when you discuss face to face? Just use "Post Reply" button. Hello anav..! mob related to mobile, so its a mobile interface "If you have mangling doing PCC, you have to first ...

Techsystem

It's definitely related to config ... and (part of) config has to relate to hardware. Two questions: 1) how did you configure RB2011? Simply restoring binary backup, made on another device model, doesn't work 2) can you post textual export of running config? Then we'll know what we are actually tal...

Techsystem

Send me a magic crystal ball and all will be resolved, you know the drill , wakeup........

lol.. your right
so if that is the case here is my config, you will notice that i have load balancing in PCC level.however, i disabled all the LB mangle rules but with no avail.

Techsystem

Hello for all .. so i have RB2011iL-RM and i have a wireguard on it, previously when i have one ISP -(one WAN connection)- the wireguard connection is working fine, but when i add another ISP -(so now two WANconnected to my RB2011iL-RM0- the wireguard is not working any more, so i had to disable the...

Techsystem

Hello My friends..! so my problem like this : in my previous devices -(RB951ui)- its normal to ping another device that connected to another interface -(like if my PC connected to ether-2 with IP=192.168.20.100 and my access point connected to ether-3 with IP 192.168.30.100 i could access it from my...

Techsystem

Hello My friends..! so i am trying to setup load balancing on my RB951ui, i used this method from MUM lebanon 2019 https://mum.mikrotik.com/presentations/LB19/presentation_6360_1548749570.pdf but here is what i get -(see the counter parameters in the mangle and the NAT rule in picture below )- so as...

Techsystem

Do you think MikroTik did support it any time?
Think this question should be asked on the OpenWRT forum instead.

this guy here installed on RB750Gr3..!
see this : https://youtu.be/2k1uji4el7c

Techsystem

Hello my friends..! so i couldn't been able to install openWRT on my rb951ui, and when i navigate through openWRT wiki i read this statement below, so what about that..? does Mikrotik stop support this openWRT firmware feature..? also if anyone -(who deal with this openWRT before)- can give me an ad...

Techsystem

Why.................. are you the internet police? The router cannot replace being a parent ...... If you are worried about them visiting malware sites, get something like this that blocks most bad sites and is cheap..... https://itexpertoncall.com/additional_info/moabpre.html no i just want to mon...

Techsystem

You could add firewall filter rule which logs any connection established from LAN towards WAN.

Analysing such log is a completely different story.

well i want the second one..! i want to analysing the log activity. can we do that if we playing around DNS..?

Techsystem

Hello My friends...! so here is my situation: i have 20 users connected to RB 951ui MT, and i want to know where everyone of them go in internet -(recording any website or ip requested from those clients devices)- so what i have to do in this case ...? can i do that using Mikrotik...? (if i can do t...

Techsystem

Hello My friends..! so to refresh my situation in this thread and to avoid any misleading conclusion about RB951ui v7.5 login access with zero config. after alot of testing procedure i can say that you can access the unite with zero config using MAC . i tested that using a lot of RB951ui and that's ...

Techsystem

That's just not possible. With zero config, you can use any interface Ether1-5 to connect, but you will have to use the MAC address to connect (neighbor discovery works). No WAN cable needed. Hello Normis..! yes you are right..! but let me explain in another way my situation that i encounter, to hi...

Techsystem

well can you post what it looks like without the default configuration? well i notice something very important -at least for me-.. when you reset the Mikrotik in a normal way -(i mean when the router return to its default setting)- you can access the router without any WAN connection pluged in the ...

Techsystem

Those that know what they are doing can enter the router.......... its an advanced setting..... Hence, not for you. :-0

come on anav ..! we are discussing a real topic here i am not kiding..!!
really i want to know why this happen..!!???

Techsystem

Hello my friends..! so after i reset my RB951ui to its default without default configuration -(system-reset configuration-no default configuration)- i couldn't been able to access my MT anymore using winbox, so i refresh the window again and again but with no ip or any thing appear that indicate tha...

Techsystem

Hello My friends..! Merry Christmas for all of you..! so i am trying to setup a metaROUTERs feature on my RB 951ui v7.5, my router is entirely new with the default configuration on it. so the first step i go to metaROUTER menu and hit the + button too create a metaROUTER, when i hit apply button in ...

Techsystem

Hello my friends..! Merry christmas and happy new years for all ..!! so this is my issue.. i have asus router that already have an iptv accounton it, so i can get the live stream from asus wifi or from any port on it, now if i connect any access point with any port on this asus router i also can get...

Techsystem

Hello my friends..!
so i didnt find the multicast package for my RB951ui in all ackage installation, where i can find it ..?
i download the all package for my RB951ui from this link https://download.mikrotik.com/routeros/ ... be-7.5.zip

Techsystem

Well, there is nothing that we can help with in terms of traffic outbound. Unless you have a rule blocking LAN to WAN, the model will be allowed out to the internet, so no problem there. In addition any return traffic originating from the router out to the internet would be allowed to return throug...

Techsystem

Your asking us basically is my solution of allowing only port 8070 for outbound traffic the answer? , but we dont know the real question. Its not clear whether you want on traffic heading tot he iinternet to be able to use port 8070, OR if you want really to block any incoming traffic that is using...

Techsystem

Hello My friends..! sorry if this sound a silly question.. if i want to open port 8070 for outgoing traffic through my firewall rule, what is the best rule for that..? and where i have to insert..? this is my firewall rules: ip firewall filter add action=accept chain=input comment="allow WireGu...

Techsystem

(1) As stated previously from add address=172.22.0.1 comment=wireguard-Windows interface=wireguard1 \ network=172.22.0.2 TO: add address=172.22.0. 1/24 comment=wireguard-Windows interface=wireguard1 \ network=172.22.0.2 (2) You dont need this......... You are getting a single WANIP on the LAN of th...

Techsystem

Once you have made the changes repost your windows and MT configs, and remove any testing garbage or networks that dont exist etc....
Keep a clean config!!!
so the new config
side note: in my office -(MT router)- i have public ip, yet in my home i dont have one.

Techsystem

Once you have made the changes repost your windows and MT configs, and remove any testing garbage or networks that dont exist etc....
Keep a clean config!!!

so the new config

Techsystem

WINDOWS : (1) Error Allowed IPs . you should be stating the subnets,,,,, 192.168.1. 0/ 24,192.168.10 .0/ 24,192.168.88 .0/ 24,192.168.40 .0/ 24 The allowed IPs on the windows side could be the single entry of 0.0.0.0/0 if you wanted internet access as well. (2) Why do you have 192.168.88.??? and 19...

Techsystem

Hello my Friends..! first of all: a wireguard server is my MT router installed in my office. a wireguard client is my windows machine in my home. so my situation like this .. i already have a wireguard tunnel that worked well with my current configuration, however my problem is that when i establish...

Techsystem

I'm tried to set up set up wireguard VPN on my rb4011, but it didn't work, help needed. Below is the configuration file I download from vpn provider: [Interface] PrivateKey=[int_privatekey=] Address=172.18.x.y DNS=69.25.114.211,69.25.114.213 [Peer] PublicKey=[peer_publickey=] AllowedIPs=0.0.0.0/0 E...

Techsystem

Hello for all Mikrotik people there..!
so i get this messages again and again in my log, anyone know what this message refer to..?

Techsystem

@Sob, @anav, thanks for the mention :) Sorry @Techsystem: in this case it takes too much work ... both to understand what exactly is needed, and to implement it afterwards. dont worry..! if i had my own MT router i wouldnt ask this questions that only need someone to test , hope to have one..:-().

Techsystem

I think more people have this in common. Italian cats seem to like it, but that's some weird exception. I think one needs to be in a very high state of euphoria supported by high quality vino. Hello Mr anav..! so while i am looking around in queue type, i find this CE threshold, so i dont actually ...

Techsystem

You could use passthrough rules as counters, but then you'd need some mechanism to check whether limits are exceeded. Which probably shouldn't be too difficult to do using scripting. But unsolved problem is that if router reboots, counters will reset, so you'd need something else that would periodi...

Techsystem

Hello Mr Buckeye..!
very grateful for you ..! and for every one who share his knowledge to illustrate the idea in this thread..!
well yes i understand what happen now, but also that's make me wounder how nothing i am in comapred with you.

Techsystem

The confusion is his paragraph 2< the written text in the second sentence is wrong. His words are correct in that the device making the request 10.0.0.2, besides being dst-natted (as per the correct first sentence), is also source-natted (by the hairpin nat rule) and is given a new source address o...

Techsystem

It's a bit confusing and also wrong. Response packet from server will first have 10.0.0.3 (real server's address) as source and 10.0.0.1 (router's address) as destination. And after all NAT is undone, it will have source 172.16.16.1 (server's address as seen by client) and destination 10.0.0.2 (cli...

Techsystem

really appreciate every single word here Mr anav..!
how big is this..
but still have a question in the same video, can you tell me in your simple words what you understand from 3:00 to the end of the video..?
still have some confusing about those statement..!

Techsystem

Hello My friends..! so alot of you see the last video by Normis that he was talking about Hairpin NAT https://www.youtube.com/watch?v=1I5FywY6opQ&t=143s please anyone can help me to understand what he meant by the statement in 2:20 minute..? as i know the dst NAT rule doesnt work at all in case ...

Techsystem

Hello my friends..! so is it possible to define a specific amount of data for evey users without using usermanger or hotspot..? i mean i want to give user1 that have the IP address 192.168.10.10/32 = 2 G for month and user2 that have the IP address 192.168.10.11/32= 4G for month is it possible tp ap...

Techsystem

Hello my friends..! so i will apply the forwarding rules and give you the output. i know that i repeated nat rule, that's was my wrong, i didn't notice that..! for load balancing rule i follow this manual when i create it -(https://mum.mikrotik.com/presentations/US12/steve.pdf)-, i find the explaina...

Techsystem

So the setup is working now for load balancing............ if so this means that traffic coming in on WAN2 will depart on WAN2, which is the biggest concern.... Now you only have to setup firewall rules on the router, but they are missing from your config?? you are right i forget to put my firewall...

Techsystem

Hello My friends..! so i have RB951ui and Since i have 3 WAN connection on it, i already set the load balancing on it like this -(see the attached file)- but now i want to setup a port forwarding rule through WAN-2 to open my office camera from outside my LAN. how can i make this rule in this cases....

Techsystem

Hello MT friends...!
so please anyone can explain in deep what is the different between interface and port in Router in general and in MT especially..?

Techsystem

Hello Mr.jvanhambelhium..! so it work well after i enable the DOH option in my firefox browser.
thanks..

Techsystem

ok i agree. but i couldnt open the dns.nextdns.io could you ..?
when i try to connect to it, it give me the not secure connection message like this ..
can you try with your browser..!

Techsystem

Hello my friends..!
so please if anyone of you who see the last video by Normis that talking about Encrpting DNS request.
https://www.youtube.com/watch?v=w4erB0VzyIE
so my question is not all people have digital certificate so in this case how can i get this PEM cert..? is there is another way..?

Techsystem

Why :D ? Can you clarify your goal? well actually i want to hack someone :D to force him to use my firewall security system..! but unfortunately recently i realized that he using RB1100 AH. so step by step i am trying now with my little darling RB951ui. i know that you know Normis, but..well .. i w...

Techsystem

Hello My friends..! so i am trying to forcing my RB951ui to 100% CPU usage by applying a large ping packet size -65500 byte- so i disable my default firewall rule and applied the ping test, but my CPU still around 20-30% so anyone know how to forcing my CPU to 100%. do i have to ping using more than...

Techsystem

Hello My friends ..! so is it preferable to set the subnet mask as /30 in the case i have a WAN up link ..? in more detail : i have huawei router and mikrotik router, the huawei router is as an ISP in this example so the WAN connection from it to mikrotik. is it preferable to reduce the subnet mask ...

Techsystem

Hello my friends..! so i want to Block users from using facebook, by link a facebook domain name with another IPs addresses and advertize these links to the DNS clients using the router as their DNS server. as you know all in windows machine we can link a specific domain name with what ever ip addre...

Techsystem

The new user manager was announced almost 3 years ago. https://forum.mikrotik.com/viewtopic.php?t=185562 Anyway, I can't imagine what shitty services you're giving to clients from that RB951Ui in 2022. Another fine Tech system problem.. so yeah we support clients around the world, if you need suppo...

Techsystem

† User-Manager (v4) R.I.P. 2013-05-XX - 2022-10-XI 7.x = no user-manager, or at least as you know, it worked, so they changed it. Instead of keeping something that worked, they replaced it with something else that didn't do the same things. non ti stare a rompere le balle con la 7.x, l'user-manager...

Techsystem

Hello my friends..! so in the default masquerade rulle in mikrotik they defining the out interface/interfacing list, why mikrotik do that..? so what is the purpose..? as we know if we unselect the out interface -(creating a masquerade rule without defining the out interface)- no thing will change an...

Techsystem

No one will waste their time to help you flog a dead horse (or should not waste their time).

as i mentioned above i just want to make the youtube IPs to appear in my address list, i dont want to blaock it, forget the youtube.. how can i make the address list as a dynamic...?

Techsystem

Dont bother, not practically possible. Why do you want to block youtube?? for a testing purpose, not any thing else. well i saw your replay in a different posts in this forum related to same topic. but i am trying a different steps here, maybe its also not effective, but for now i just want to see ...

Techsystem

Hello My friends..! so i am trying to block youtube users on my RB-951ui Ros, i create this filter rule chain:forward, src address:my LAN IPs, protocol:tcp, port:443, TLS host:*youtube*, action: add dst to add list, timout: 30d 00:00:00 by this rule i am trying to collect most youtube servers in the...

Techsystem

what version ROS installed ?

v7.6

Techsystem

Hello My friends..! so i try alot to access the usermanager menu using my browser to set the rules for my hotspot in my RB951ui, but all attemps was with the same error. - as you see in the picture below- so please anyone have any idea why this hapen ..? in the attached file you can find my mikrotik...

Techsystem

Hello My friends..!
so anyone have any idea about how can i change my router license key from level-4 to 5 , please if there is any link or trusted guide..?
my router is RB951ui.
also how can i enable hotspot on it, there is alot of stuff and video out there but i couldnt find a trusted one..

Techsystem

Hello for all Mikrotik people there...! so i have two question : 1- what is the benefit of this increasing the CPU freq feature in router..? is that mean that the router CPU will became better in its performance..? 2-what is the different between this two type of booting protocol -(see the attached ...

Techsystem

There is no one rule techsystem, except perhaps dont let you configure routers. ;-)) Now that you know that the router has been exposed on the internet in such a manner you need to do the following steps 1. disconnect it from the internet 2. netinstall the lastest stable firmware 3. Keep the defaul...

Techsystem

Scenario 1: LAN1 users go to WAN1 due to lower distance of WAN1, if WAN1 is not available users will go to WAN2. LAN2 user are only allowed to use WAN2. /ip route dst-address=0.0.0.0/0 gwy=ISP1 table=main distance=1 check-gateway=ping dst-address=0.0.0.0/0 gwy=ISP2 table=main distance=2 dst-address...

Techsystem

Like others said, if you configure your own firewall, you can't blame manufacturer for this. You have removed firewall and there is no protection in place, like it is seen in your config. Complete reinstall and then reset to default is the best way. Default config does have firewall. Do not remove ...

Techsystem

The fact that you haven't configured any PPTP tunnel on your Mikrotik doesn't mean that PPTP service does not listen for incoming connections. The log only shows that the unknown address has successfully initiated a TCP session to establish a PPTP control connection, but since it repeats multiple t...

Techsystem

Default config are not perfect, but will make it hard to hack your router. If you do change things, you need to now what your are doing. If you open router to be administrated from a public IP you will be at risk. If you do not upgrade your router you also may be at risk. i don't know why mikrotik ...

Techsystem

Your firewall rules are what play the biggest role there. Which ROS version are you using? Can you provide a sanitized copy of your config?

yes .. sure you can look to it in the last comment .

Techsystem

i don't know why mikrotik enable this default ospf and pptp enterface in Routers . its not the first time that attacker uses this vulnerability to access to mikrotik routers.

Techsystem

Hello My friends.. so i get this repeated message in my mikrotik RB951ui log as you see below TCP connection established from 104.152.52.57 so anyone can explain to me what happen here, i make a search to this IP : 104.152.52.54 and i found that this public ip is from a merica. what i can do in this...

Techsystem

Hello My friends..! First i am new to this ZerTier. and i want to compare it to wireguard, so can i using ZeroTier to access my entire subnet ..? i mean in wireguard if i want to get access to all my devices on 192.168.1.1/24 rang i usually put the allowed ip address like this 192.168.1.1/24, so i c...

Techsystem

I advise you to update your device to the newest version (when you are running v6.xx remain within v6 so install 6.49.7). After that, reset your device to factory defaults. The firewall will then be OK. so that's why i asked you for the specific rule, well there is no way to reset this device. desp...

Techsystem

Depends on your device. What router model do you have? In some devices there is a default firewall which protects you. In other devices (CCR, CHR, RB1100) there is no default firewall and you have to make one yourself. so my router is RB951ui..so the default firewall on it can protect me against su...

Techsystem

When you show is such a screendump of an entire log window you can at least tell us the line numbers of the messages you are worried about! When you do not use IPsec and you still get these messages (which are portscans to find who uses IPsec to use for later attack) your firewall is configured wro...

Techsystem

Hello my friends..! so i have a couble of question here. first when i enter to my mikrotik via winbox i get this error message -(see the figure-1 below the red line: login failuer for user admin from 172.33.0.2)- yet i enter normaly without any password error or any other delay also i get this ipsec...

Techsystem

please anyone have an idea what is the purpose of this hole..

Techsystem

Scenario 1: LAN1 users go to WAN1 due to lower distance of WAN1, if WAN1 is not available users will go to WAN2. LAN2 user are only allowed to use WAN2. /ip route dst-address=0.0.0.0/0 gwy=ISP1 table=main distance=1 check-gateway=ping dst-address=0.0.0.0/0 gwy=ISP2 table=main distance=2 dst-address...

Techsystem

So basically it's: ether1 = WAN1 (DHCP) ether2 = LAN1 (192.168.10.1/24, uses WAN1) ether3 = WAN2 (DHCP?) ether4-5 = LAN2 (?.?.?.?/?, uses WAN2) Correct? yes that's correct ..! ether4-5=LAN2 with ip range 192.168.1.1/24 and it contain only the VPN traffic -ether3 - so all LAN2 traffic pass through e...

Techsystem

Makes even less sense.......... I have no idea how the MT connects to the internet, ISP modem (what is internet and what is ethernet cabling).

ISP modem

Techsystem

here we are..

Techsystem

Hello My friends..! so i have RB951ui and want the LAN 4 + 5 ports on it to use port 3 as the WAN interface like this scenario. the main WAN connection coming to the Mikrotik router from eth-1, the ip address of eth-1 that it get from this WAN DHCP Server is 192.168.1.111. then i set eth-2 to give t...

Techsystem

why sometime i have to enable Legacy mode, inorder to get access to my router and sometimes not ..?
so when i get this message "the router doesn't support secure connection, Please enable leagacy mode. what that mean..?

Techsystem

Hello My friends..! so please anyone know why this invalid entry allow in winbox...??? i spent an hour looking for the problem in my pppoe configuration to realize in the end that i put 0 instead of 1 in my eth-4 port setup. so why Mikrotik allow such entry in first place despite its invalid ..??? w...

Techsystem

Hello My Friends..! so i am new to a CAPsMAN feature in mikrotik and i want to apply it in my RB951ui, can anyone give me a proper way to do that..? my scenario like this.. i have 3 RB951ui i want one of them to be a controller and the other as slaves -(correct me if that's not true)- i try to apply...

Techsystem

How do I know "you" are not a chat bot?

1+1=3

Techsystem

do you have any link or document that explain that..? Are you not aware of how to use the Google search engine? How did you create the bridge? This may offer some insight, if you used /interface bridge port add interface=all Generally dynamic means something that the system has created when you did...

Techsystem

Hello Mr @anav ..!
do you have any idea aabout this topic ..? so what is the difference between static and dynamic interface in Mikrotik Router...?
do you have any link or document that explain that..?

Techsystem

Hello My Friends..!
so anyone know what is the benefit of this Using Services Tag selection here in this picture..?

Techsystem

everything about that u can manage in interface/list/

ok.. i agree but if i but an interface as a dynamic what that mean..? also if i put it as a static.

Techsystem

Hello my friends..!
so in Bridge-Port what it's mean by Dynamic interface as you see in this picture..?

Techsystem

Ensure you let us know what the issue is when you find it please.

i will Mr anav..!

Techsystem

Hello My friends ..! So for everyone who share his advise or opinion in this discussion i want to say very thanksful for you ...! i didn't solve the problem yet. i realised that the problem on my android device so when i create a wireguard interface in another devices with the same router and config...

Techsystem

Yes post COMPLETE config
/export (minus serial number and any public WANIP info)

this is my complete config.

Techsystem

Hello Mr jvanhambelgium..! so clearly enough it seems that i have a DNS problem in my config and i don't know in which side..so please can you clarify more what you mean by this sentence "make sure your Mikrotik is configured correctly then to allow this Wireguard-client to make DNS-lookups,&q...

Techsystem

:You are missing the interface list and interface list members in your config........ otherwise you would not have been locked out. If I had known you were goiing to get rid of all your rules I would have provided additional info Hello Mr anav...so the connection is active again.. if you want to ad...

Techsystem

0.0.0.0/0 is fine, I also have it on my Android phone. (meaning = everything is pushed through the tunnel) but remember, make sure your Mikrotik is configured correctly then to allow this Wireguard-client to make DNS-lookups, make sure it has NAT-config to access internet if the range of wireguard-...

Techsystem

so this is my last config

Techsystem

Nope, did not presume LAN list since the fellow seems to avoid list as you can see I added a wg to internet forward rule, but concur one small change to what I have would be needed. I suppose one should change all WAN interface-list entries to interface=ether1 as well.............. {Input Chain} ad...

Techsystem

Not that it probably makes a difference but the MTU on the android does not match the setting on the MT device. Other than that I dont see the issue in plain sight. the MTU in client side must be lower than server side inorder for this connection to work..! .however, i try alot of different values ...

Techsystem

(1) Why the duplicate pool? /ip pool add name=dhcp_pool1 ranges= 192.168.10.2-192.168.10.200 add name=dhcp_pool2 ranges= 192.168.10.2-192.168.10.200 add name=dhcp_pool3 ranges=192.168.1.100-192.168.1.150 add name=l2tp ranges=192.168.100.1-192.168.100.200 (2) What is the purpose of this rule...........

Techsystem

so this is my MT configuration .. i try all this stuff but until now it seems that there is no traffic between my android device and my mikrotik router
Side Note: when i turn the wireguard tunnel on my android on, i lose the internet connection, as you see in the screen below

Techsystem

Difference I see when I look at my settings in Android (and please provide /wireguard export excluding the keys): MTU left auto Persistent keepalive left empty What you can do (besides above): Check if the firewall filter rule is hit Check if the peer shows on the router i try your setting but stil...

Techsystem

Works fine here. In your screenshots I see counters on both Rx / Tx and "last handshake values so it seems a connection WAS established. I would think THE CONNECTION itself is working, but perhaps DNS not working ? What do you mean "I don't have a connection" ? yes i notice that but ...

Techsystem

Hello My friends..! so anyone try to use wireguard on android phone, and the connection work proberly ..? this is my configuration in both mikrotik and in my phone and until now i don't have a connection . side Note-1: i previously setup wireguard on my pc and the connection work normaly. Side Note-...

Techsystem

moderator note: do not quote preceding post, use "post Reply".

Techsystem

moderator note: do not quote preceding post, use "post Reply". sorry Mr rextended but it seems that i still didn't understand what you mean by that..! However, as you you see, this is all my firewall config -( in the attached file)- and for more info i notice that when i disable all my fi...

Techsystem

so how i can disable this log from appearing..? where is the controlling log center..?
i didn't understand what you mean by this sentence "and as usual with the..we can not even..etc"

Techsystem

Hello my friends..! so what MT router want to tell me by this Reptitive message in log section..? -(as you see in the picture below )- and what code 3 mean..? firewall-2.PNG /ip firewall filter add action=passthrough chain=forward disabled=yes add action=accept chain=input comment="allow WireGu...

Techsystem

so my scenario like this .. i have RB951ui with bridge interface that have 192.168.10.1/22 ip address, so as you see from my subnet i can use more than 1000 ip as a DHCP for clients, so my router installed in a place that have a lot of networking devices -(IPhones-tablet-TVS-normal users...)- so we...

Techsystem

so i ask this question before, but i didn't think that i get the answer that i want . so please for the second time how many Users the RB951ui can handle without any malfunction or glitch..? . You have not gotten an answer because you refuse to tell us what information you are looking for. Read the...

Techsystem

What about them?

hello Mr Znevna, i am asking a bout the maximum number of those clients that RB951ui can handle, so do you have any info..?

Techsystem

Moderator edit: Quote removed. Do not quote yourself and preceding post. Use just "Post Reply".

well i am asking about network clients that we can found when we open leases submenu in ip-dhcp section

Techsystem

Moderator edit: Quote removed. Do not quote yourself or preceding post. Use just "Post Reply".

Hello Mr rextended so to refreash this post.. what you mean by 4,000,000

Techsystem

Hello For all My Friends There...!
so i ask this question before, but i didn't think that i get the answer that i want .
so please for the second time how many Network Clients the RB951ui can handle without any malfunction or glitch..? .

Techsystem

Yes:

1) why
2) hide from whom?

Hello Normis..! Please advise how ..?

Techsystem

So try 8.8.4.4

it works ..and that's my DNS server.

Techsystem

Yes.
Either something in your config or your ISP is doing something fishy.

but in same area from other router i can ping 8.8.8.8. and they are from the same provider.

Techsystem

Your internet provider is ahead of its time and banning anything touched by google??? Let me get out my tarot cards, crystal ball, crystal meth, snake oil, divining rod, harry potters wand, and an ouiji board.... OR /export full config (hide serial number and any public WAN IP info) Lol...so here i...

Techsystem

Hello my friends ..! so i just realied that i can't ping 8.8.8.8 from my mikrotik and when i traceroute the ping i get this
the 10.10.0.200 is not my public ip.
but when i ping 1.1.1.1 i get response and my public ip as the first ip in the list.
so anyone have any idea on what may be cause this..?

Techsystem

updating to my situation ... so i get the internet access from VLANs -(V10 and V20)- and i drop the packet between both of them, and that's done by many attemps so i didn't apply a specific steps . i know that i have a very weak firewall but this is the appropriate config for my situation. any comme...

Techsystem

so as far our dicussion goes, and to update my current situation. i could get the ip address from each VLAN as it expected, and also i separate the two VLAN from each other, but untill now i couldn't get internet connection from those VLAN. yet i set the nat rule and the DNS as usual..!

Techsystem

very informative content..! it needs alot of focus ..!
here's my config

Techsystem

Hello Mr anav ..! so i apply your config as you mentioed above but that's not work for me, so maybe you miss something..or maybe i .anyway so this is my config as below can you find the glitch ....? so first as a test i try to separate eth1-to-eth5 in VLAN-10 and eth6-to-eth10 in VLAN-20 in addition...

Techsystem

You need to decide how you want to use your switch. VLans are one way - most common. Port isolation or groups are another way - less used What is important is not the method but the usecases and needs of the users, what they should be able to do and not be able to do. hello Mr anav..! so my situati...

Techsystem

Understand, but you mix Layer 3 NAT with Layer 2... Is not more simple on this case you sumpli create ports groups and on firewall deny communication on forward between the two ports groups? well i didn't really understand what you mean in this sentence, well in my firewall rule i didn't create any...

Techsystem

https://help.mikrotik.com/docs/display/ ... itchgroups

so as you see in the picture Mr rextended i apply this config, but it seems that i miss something. it doesn't work.

Techsystem

Hello My friends..! so i am trying to setup port isolation in my CRS326-24G-2s but until now i coudn't apply that, so please any help..? this is my configuration out interface =eth1 bridge-1 contain eth2-eth3......eth12 nat rule = masqurade and the pictures below explain more so my scenario is to se...

Techsystem

please anyone have a deep understanding about this boot option in Router os ..?
so what is the different between this option ..?

Techsystem

Hello my friends ..! so anyone know how to enable the protected-routerboot feature using winbox not terminal..?

Techsystem

As others have said you can only have a single bridge with hardware offload on your device. The D indicates the port is added dynamically, in this case from /interface bridge port add bridge=B-1 interface=static . This is generally not a good idea, add each port explicitly to the bridge. The only m...

Techsystem

i don't think that i can make VLAN in my current situation .. so the CRS3xx connected with HUAWEI router in ether1 interface. so i setup the eth1 as out interface and the other ports as a bridge as i explain above so is there is a way that i can separate the eth12..to eth24 ports from other ports wi...

Techsystem

Two bridges are for the birds............... Use one bridge and vlans............. AND for the love of god, dont use the bridge to hand out dhcp. your always welcome Mr anav..:-)..! will unfortunately i use it ..:-( so i have two Bridge one is B-1 =192.168.40.1/24 with DHCP on it and the other B-2 ...

Techsystem

how does this intercsect with my problem..? Your device — one of the CRS326 models based on the header of your RSC file — isn't a CRS1xx or 2xx, so you can't have multiple bridges per switch chip. I'm going to guess it's one of the 24G models based on details of your bridge setup. From that, we can...

Techsystem

Hardware offloading only works on a single bridge interface. It's more nuanced than that. The CRS1xx/2xx series allow up to 7 hardware-accelerated bridges. Everything else allows one per switch chip . That qualifier is important, because several of the products in MikroTik's lineup have more than o...

Techsystem

Hello my friends ..! so I create two bridge interface, but when i start adding ports to each bridge i get this -(see the picture below)- so what does this IH-I-DIH-DH. absolutely i know that IH mean inactive HW offload and DIH mean...etc but why B-1 get this I and B-2 get DIH..? side note: the inter...

Techsystem

Will check it out, especially if I can use stuff for some of my guides. Thanks!

Mr anav do you have a trusted link or website or even video to apply load balancing in MT in a professional way..?

Techsystem

please anyone know what this guy is doing in this video -https://youtu.be/MjOFYvMi3GM- the title is "combining 2 internet connection to increase the speed" but didn't understand why he create all this mangle rule. is that make scence...? Dont be so gullible, that video is pcc load balanci...

Techsystem

please anyone know what this guy is doing in this video -https://youtu.be/MjOFYvMi3GM- the title is "combining 2 internet connection to increase the speed" but didn't understand why he create all this mangle rule. is that make scence...?

Techsystem

No, the best any session will be able to have access to is 16Mbps, the advantage is you have more bandwidth to play with overall, so users will share a larger pot and you WOULD have a failover IF, the two ISP connections were from different carriers, like DSL and CABLE for example. hello again Mr a...

Techsystem

Hello My friends..! so is it possible to merge Two ADSL network Line in one so to get a single line with double speed. in more simple way, my scenario like this: i have ADSL line -1 carries 16 Mbit internet speed and it's cnnected to dlink router-1 also i have ADSL line-2 that also have 16 Mbit inte...

Techsystem

i have four ethernet port. eth1 is out interface, eth2 is data interface eth3 is wifi interface and eth4 is pbx interface and i want to separate all eth2 & eth3 &eth4 interface using VLANs. in my current situation now all this interfaces is separated using Firewall so i drop in and out ping...

Techsystem

hi sob..! depending on my understand of VLANs -( maybe this is wrong so please correct me)- ""when we create VLAN1 and VLAN2 forexample we can't reach VLAN1 from VLAN2 and visa versa until we introduce a gateway between two VLANS. so this two VLANs is completely separated from each other, ...

Techsystem

hello Mr Buckeye..! so yes it seems that i couldn't explain what i really want clearly enough... yet in my first comment i try to explain what is the exact behavior that i want to achieve in my 951ui rb, and for the second time and in more simple way that's whatn i want : i want to separate three in...

Techsystem

but as you know by default the traffic processing is in CPU not in this chip as far you are not using any bridge, or didn't setup an bridge interface for traffic...!

Techsystem

A bridge is not required, vlans are not required, its up to you. If you have single Subnet going to single ports, just assign them individually Ether1-wan ether2- subnet1 ether3-subnet2 ether4-subnet3 ether5-subnet4. When at least two ports will use the same subnet (such as 2,3) then it makes sense...

Techsystem

What was wrong with your previous thread about same subject ? Question two, what's your understanding of VLANs? Do you perhaps use that term just to refer to some isolated networks and not "real" VLANs? Because so far it doesn't seem that you'd need the latter. Just remove ports from brid...

Techsystem

Hello for all ...! so i see a lot of video out there talking a bout VLANs and How to setup VLANs , but all this video talking about VLANs in two or more device, So what if i have only one MT router and i want to separate eth3 and eth4 forexample using VLANs what i have to do in this case..? anyone t...

Techsystem

No worries, I dont have a clue what you are doing now LOL, but if it works for you great!! Glad you resolved it.

thanks anav..! my regards..!

Techsystem

How so? What did you change?? so it's all about MTU, i keep changing MTU in peer side until i get the proper connection that's i want The most important I could find on the latest config is your wireguard initial connection on the MT router would not be possible if this rule is disabled. Also did y...

Techsystem

hello for all my friends there ..!
so the problem solved for the wireguard, thanks for every single replay here..
i appreciate all.

Techsystem

Okay so you have a private IP on the mikrotik. Im assuming you have an ISP modem router of some sort before the mIKROTIK and you are forwarding the wireguard port to 192.168.2.2 (the likely wan IP of the mikrotik) Post the entire mikrotik config for further assistance. /export ( minus serial number...

Techsystem

hello again my friends ..! so i solved the internet connection problem, i just change the allow address to contain only my wireguard and local LAN ip address -like the picture below-. and in this case i get internet connection and access to my local network through wireguard.however, when i try to c...

Techsystem

Two thoughts, a. try dns server as the IP address of the wireguard address on the router (as per the MT wireguard youtube video). b. What are your IP routes on the mikrotik router. hello again Mr anav ..! the first method didn't work. 2-see the picture below: this is my ip address and routing table.

Techsystem

Hello my friends..! So i setup my wireguard on my router normaly and also on my Windows machine, However. When i establish a connection the connection work fine and i can ping my router and all devises on my network. Yet i dont have Internet access in my pc that running windows. So what may cause su...

Techsystem

I checked your export file you should remove your software id and serial number from your export
don't worry i chang it
.

so what about my l2tp config ,,? is there is any problem on it

Techsystem

Hello again Mr own3r1138..! so this is my MT config.

Techsystem

@Techsystem Simply open your terminal and type "export hide-sensitive". Copy& paste it into the text editor. Then, remove any public IP address or sensitive data. It's ready to be published. As Anav said you have two main options. I like the first option the most if it's possible. Als...

Techsystem

Forget DMZ, its not a wise security move What you need to do is port forward the applicable ports from the DLINK router to 192.168.2.2 For example if you were using wireguard it would be the wireguard port, if it was L2TP it would be port 1701 etc........... On the mikrotik you need to add access t...

Techsystem

Yes i want to access to my server that's connected to my mikrotik 951ui from outside - (different LAN) - It's best to share a network diagram , and export config (remove any public IP, sensitive data) It should be your public IP at least till I know more about your "different LAN" Hello M...

Techsystem

Very thanksful for the second time..! The problem that i encounter that i don't know in the client side - my pc-what ip address i have to put my public ip or my out interface ip on my mikrotik router or what..? This issue is still fuzzy for me. Well its the first time that i try to setup a vpn on m...

Techsystem

but what this address 172.17...represent..? do i have to have a docker in my case ..? also can you please send your config on your windows pc..? Keep in mind that my setup is a bit different from what you want to do my server acts as a VPN server like any third-party VPN service. There is no LAN at...

Techsystem

MT official DOC
2022-09-07_12-08-56.jpg

Firewall
2022-09-07_12-10-14.jpg

very thanksful Mr own3r1138 for your replay..!
but what this address 172.17...represent..? do i have to have a docker in my case ..? also can you please send your config on your windows pc..?

Techsystem

hello for all my Friends here...! so i tried alot to setup a tunneling protocol between My Windows 10 machine and Ros951ui -(i am talking about L2TP protocol)- but with no avail . i don't know if i miss something but well... i apply a lot of configuration out there in youtub , google...etc.but all t...

Techsystem

hello my friends ..! very very thanksful for all this replies and advises ..!
really appreciate every single replay here..

Search found 251 matches