MikroTik

Sob

That would be the first FTP server I ever saw with support for only single passive port (did you try to enter range like 20020-20030?). It's not impossible, but it would limit some features, e.g. transfers between different servers (FXP) would be problematic. But simple client-server should work. An...

Sob

See viewtopic.php?p=952360#p952360

Sob

It's just another tool like many before. It can be used or misused. Now it's new, so everyone is scared/excited/whatever. But we'll manage.

Sob

Reinventing the wheel properly takes time.

And they like to do it a lot, example: viewtopic.php?p=965896#p965896

Sob

Because it was so long ago when such things were used ^*1.

-
^{*1 Individual experiences may differ for each person}

Sob

Before you do something drastic, although I don't think harakiri is the thing in Canada, the thing with WG and localhost is just something that I think I saw mentioned in some thread, but I find it weird and it's entirely possible that I'm mistaken. So be calm, everything is probably mostly fine. ;)...

Sob

FTP establishes new data connection for every single transfer (download, upload, even directory listing). Just one port isn't much to work with. I can't say that it clearly couldn't work, it depends on how server handles it, but it can't hurt to try to configure at least some small range of passive ...

Sob

Add few built-in functions for convenience, find a way to provide more feedback on errors than silent death, and I'll be willing to say that it's ok.

Sob

I think I saw it in some threads that WG supposedly connects to localhost. I didn't examine it myself yet, but I don't see any good reason why it would do it (I'm not saying it's not possible). And you're probably significantly further than 0.3%. How much, that's hard to guess. I wouldn't be sure ab...

Sob

Forums having ranks/titles based on number of posts is common knowledge, everyone learns it eventually. I remember how once someone took info from some forum about military and argued that it MUST be true, because it was written by General and they know their stuff.

Sob

@rextended: I understand your frustration. But you're still missing any way how it could work. You can prohibit it, maybe in rules that nobody reads anyway. And people will still post it, either because they won't know about it, it they will know and not admit it. And you can ban them after, but fir...

Sob

It depends. If it's regular download where one connection transfers a lot of data, you can mark it using connection-bytes, e.g. after 10MB: /ip firewall mangle add chain=forward connection-mark=no-mark connection-bytes=10485760-0 action=mark-connection new-connection-mark=bigtransfer and then use qu...

Sob

What if you drop the routes and use standard /ip address add address=<address>/<mask>? I don't remember if what you have now is supposed to work.

Sob

Well, it makes sense. I just wonder what exactly the client does, it seems that is must use some kind of policy routing.

Sob

For start, how many devices are we talking about? Is it separate router and AP(s), or just single device? If it's more than one, then VLANs allow to have centralized config on router and AP can act as dumb transparent device.

Sob

Oops, sorry, my bad. In that case, it's different problem. You'd need clients to access x.x.x.x via tunnel, but they need to access the same x.x.x.x without tunnel, because it's the VPN server they are connecting to. I'm not sure what exactly OpenVPN client does, but it probably routes whole x.x.x.x...

Sob

Do you see interfaces appearing in vpn-clients list (clients need to reconnect if they were already connected)? It's in Interfaces->Interface List, or "/interface list member print where list=vpn-clients" in CLI.

Sob

The point is whether you have public address (= can have incoming connection from internet) at all. Because it's not automatic, there's shortage of public addresses, so ISPs "hide" their customers behind few public addresses using NAT. Outgoing connections to internet work, but incoming do...

Sob

new-form.png

Sob

Then as I wrote, interface list is your friend: /interface list add name=vpn-clients /ppp profile add <other options you have> interface-list=vpn-clients /ip firewall nat add chain=dstnat dst-address=x.x.x.x protocol=tcp dst-port=7012 in-interface-list=vpn-clients action=dst-nat to-addresses=y.y.y.y

Sob

Regular DNS doesn't have anything like user agent. You can use e.g. Wireshark to check what's in packets, but in short, nothing you could use. But you could use L7 to match queries for .srv TLD:

\x03srv.\x01$

Sob

Most likely not, but I can't wait until spammers discover that it would be perfect for generating hard to detect not-clearly-nonsense posts to establish their presence.

Sob

Anyone can connect if you use only dst-address without any in-interface. If you use dst-address with in-interface=all-ppp, it should be only VPN clients. Unless your internet connection uses PPPoE, I'm not sure about that and I can't test it right now, but it's possible/likely that all-ppp includes ...

Sob

What's the point? Try to share more details. If it's some non-public domain, you could do some filtering on that. But then I'd expect also internal addresses and there would have to be some VPN to access them, so just use it for accessing DNS server too. If it's resolver for regular public domains, ...

Sob

It's not exactly clear. If you want to make webserver publicly accessible, then drop in-interface=bridge. If it should be accessible only to VPN clients, it's probably best if they connect directly to y.y.y.y. But if you insist that they must connect to x.x.x.x, in-interface=all-ppp should work.

Sob

Well, it does seem that even with L2TP server disabled, 1701 is not closed like others, e.g. netmap on unfirewalled device shows: PORT STATE SERVICE 1700/udp closed mps-raft 1701/udp open|filtered L2TP 1702/udp closed deskshare I'm not sure what exactly happens, but you can always use firewall to bl...

Sob

Support is mainly for thing like bugs. There's nothing clearly wrong in your config (firewall rules could use some reordering, but they don't break anything). So, public IP address *1, do you know what it is and are you absolutely sure that you have one directly on your router *2? *1 not 10.x.x.x, 1...

Sob

@anav: It might break your heart, but did I mention that I don't know everything?

Sob

You can do something like this: /ip dhcp-server network add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 add address=192.168.88.100/32 dns-server=192.168.123.45 gateway=192.168.88.1 netmask=24 First is defaults for subnet and second is different config for single device (192....

Sob

I like LE for the automation alone. Being free is nice bonus. Paid certificates always required some annoying manual work. It wasn't too bad when they had very long validity (I don't know what was the maximum, but I used to have some five-year ones), but now we're down to one year. And if it goes ev...

Sob

I can't test it now, but doesn't something like this work? /ip dns static add name=lan type=FWD match-subdomain=yes forward-to=<main router> add name=something.more.specific.lan type=A address=<address> add name=another.more.specific.lan type=FWD forward-to=<another resolver> My guess/expectation is...

Sob

Well, this allows your router to be used as DNS resolver. Which is something you may want for your devices in LAN, so not wrong. But if accessible from internet, your router would be open resolver, which is not good, because it really can be used for attacking others. But in OP's case the original c...

Sob

Sorry, one more thing: /ip firewall nat add chain=srcnat src-address=200.151.54.0/24 dst-address=200.151.54.0/24 action=masquerade And about those addresses, it's just that they belong to someone else and it's possible (even though not very likely) that some servers you'd want to access could be usi...

Sob

My guess is that it's something on ISP's side. So I'd ask them. Or do you have access to some ISP's device (modem or something) that you can (are able and allowed to) turn off and on again?

Sob

My idea was whether you're perhaps replacing some ISP-supplied router, it would be possible that ISP allows it but nothing else. Or is it completely new connection that never worked before? Btw, you lost some rules in "/ip firewall filter". Those you previously had with chain=input, you wa...

Sob

So it looks like it's done by ISP's router for some reason. Does it work with some different router or directly connected PC? Could it be e.g. locked to specific device (its MAC address)?

Sob

Your dstnat rule has options in-interface=pppoe-protocol-intercon and in-interface-list=WAN (both useless) and they limit from where it will work. Drop them and it will be better. And those 200.x.x.x addresses, did you also get them from ISP? If not, you shouldn't use them and choose some from priva...

Sob

How do you define "doesn't get Internet"? Regular web browsing doesn't work, but what if you try to open https://1.1.1.1/, does that work? Or ping to some numeric address (e.g. 1.1.1.1 again)? What about ping from router itself (open Terminal and try "ping 1.1.1.1")?

Sob

Aside from seriously outdated system (but that's not breaking it), I don't see anything obviously wrong, it looks like good old default config from 2017. If you look at DHCP client (IP->DHCP Client), what does it say? Does it get any IP address? And you do have ISP's router connected to ether1, right?

Sob

Don't get me wrong, I'm all for letting people decide. If someone wants unencrypted REST, is should be their choice. I'm also big fan of configurable things. Currently you can enable web server and it's all or nothing (WebFig, REST, ...) => not good. Same for current enable-ssl-certificate, it's har...

Sob

It seems mostly fine. In addition to previous (^^^), you can try to add temporary logging rule, either for specific port: /ip firewall mangle add chain=prerouting in-interface=pppoe-out1 protocol=udp dst-port=7777 connection-state=new action=log log-prefix=new-incoming Or a broad one for all: /ip fi...

Sob

How this works exactly? Netinstall still does reset password to blank, right? Or, if the sticker gets lost, will I have not very practical (but secure!) door stopper?

Sob

If self-signed certificate would be enough for you, it's not like it's too difficult to get it now: /certificate add common-name=router.example.net /certificate sign router.example.net it's still inconvenient, because you need to either make the client trust it or ignore it, but it shouldn't be a sh...

Sob

Dstnat is not good, because it redirects everything, without any fallback. If you have at least common TLD (e.g. .lan), then with recent enough RouterOS (v7), you can do this on other routers: /ip dns static add name=lan type=FWD match-subdomain=yes forward-to=<main router> and it will forward *.lan...

Sob

What I meant is that when one would add internal records in public DNS, in order to solve problem with DoH and other ways how devices can bypass local data, they might end up using some resolver that filters records with private addresses. So you solve one problem, but hit another. As for MikroTik's...

Sob

Not from a screenshot, it can hide some things. But based on your description in first post it should be ok. To be sure, try to run this in Terminal:

/export file=myconfig

and then post content of created myconfig.rsc here in code tags.

Sob

I'm not sure what you mean.

Sob

Yes, it's correct and it should work. Even if it wouldn't work completely, you should at least see some incoming packets, counters for dstnat rule (columns Bytes and Packets) should increase. How do you test it?

Sob

It's not needed, even if service on router uses some port and dstnat rule is for same one, dstnat sends packets elsewhere before they can reach service on router.

Sob

Some resolvers may filter private addresses. It's some trouble everywhere you look, we should scrap it all and move to all-public IPv6.

Sob

Is it also language barrier that makes you answer only half of questions?

Now we know that if it start with 91, it's public address. But we still don't know it your router actually has this address. Once again, look in IP->Addresses, is this address there?

Sob

I admit that I wasn't sure, but it seems that except IN it's all long time dead (only bind nameserver supposedly misuses CH to show its version, but I wouldn't be sure about that either, because lately showing versions tends to be avoided).

Sob

Feel free to enlighten me, but DNS query packet ends with two bytes for type followed by two bytes for class. In type there's 001C, 00 gets dropped, so we're looking for 1C (lowercase \x1c is fine). Class could in theory be 0x0000-0xFFFF, but does anything we might care about use anything else than ...

Sob

Ok, I lied. Not intentionally, I probably got misled by RIP and overlooked the obvious. If you want to access something connected to public-ip-lan interface from outside, of course you need to allow it (this will allow full unlimited access, you may or may not want to limit it in some way): /ip fire...

Sob

For start, your "my isp ip" is public (not 10.x.x.x, 100.64-127.x.x, 172.16-31.x.x, 192.168.x.x) and directly on your router (you can see it in IP->Addresses), correct?

Sob

It doesn't seem very clear, so I'm just guessing... Do you mean local hostnames like workstation1.site1.lan on one router, server1.site2.lan on another, etc? Proper solution would be to run real DNS server(s), i.e. not something RouterOS can do. It could also work with FWD records (not real records ...

Sob

There are two things: - IP->Services - services that run on router - IP->Firewall->Service Ports - protocol helpers for firewall, for services that need extra care (e.g. FTP has one main connection that this helper watches and automatically recognizes related connections, so that they could be allow...

Sob

In that case I would simply use 10.2.0.2/24 for IP address on the router. Address as /30 is very limiting.

The point being? If they gave you /32, you should use /32, you won't gain anything by using something else.

Sob

I can't say about RIP part, I don't know much about that. Only in firewall, when you drop all incoming packets on pppoe-out1, then allowing something after that is useless, because it will never get there (so you need to swap those rules). Other than that, I don't see any problem.

Sob

Learning yourself is fun. When I found RouterOS, I knew some basics in Linux, network config, bit of iptables, etc. With RouterOS (and especially WinBox) I was like fish in a water. I'm not saying that I knew everything overnight, but most of it was pretty intuitive. Don't look down on WinBox, it's ...

Sob

Try similar logging rule in srcnat. Use some other condition like source address to match only testing traffic. And check if it shows the right outgoing interface, or if it's another unknown one.

Sob

Several things in there are weird. For start, I don't see any NAT rule with IP address you could be updating. But I do see default route that might need it (gateway), which is unusual, because normally you just let DHCP client add dynamic default route. Also to have both DHCP servers and clients on ...

Sob

Ability to upload with BT or speed of it doesn't have much to do with ability to accept incoming connections. It just makes connecting between clients easier, but it doesn't mean that it would be impossible without it.

Using VPN does need some extra config, which depends on what kind of VPN it is.

Sob

@anav: There can be different results, and there's also difference between tcp and udp. In case there wouldn't be any firewall, tcp connection that reaches target host always gets something back, either ack (when something listens on that port = it's open) or rst (when nothing listens there = it's c...

Sob

It all depends on what you want. Even with multiple subnets, you can use dst-address=!192.168.0.0/16 to exclude all internal addresses from this range. Or you can simply not exclude some. E.g. if you have primary LAN and separate LAN for guests, and you want to use WebFig from main LAN only, then if...

Sob

There's difference between DNS resolution: - in Terminal it's done by router - in WinBox it's done by machine it runs on - I'm not sure about WebFig Normally if machine with WinBox uses same router as its DNS resolver, there wouldn't be any difference. But depending on what static records you add, i...

Sob

The action=masquerade is your friend (instead of action=src-nat).

Sob

You need to understand what it does. There may be misleading wording about checking for open ports. But it's actually checking if it's able to connect to something. It knows nothing about your router and its config, and has no means to discover anything about that. Either it will be able to connect ...

Sob

Generally no extra routes should be needed, but it's possible that in your case they are, it depends on how everything is configured.

Sob

There's always the simple and (almost) foolproof dst-address-type=local. The "almost" part is when you use it with port that you also use to manage router, e.g. 80 when you use WebFig on default port, that will lock you out. But you can combine it with dst-address=!192.168.69.1 to exclude ...

Sob

I mean, when you're using port checker, at that moment, is there any software running on internal device and listening on that port? It must be, otherwise there will be no reponse. You can't open port "for later" without something actively using it and have it shown as open.

Sob

Are you sure that on your 10.10.22.241 device something definitely listens on tcp port 65472, it's not blocked by device's own firewall, device has this router as its default gateway, etc?

Sob

L7 strips zero bytes, so you can't work with them at all. You can take 1c from type and 01 from class and look for them at the end:

/ip firewall layer7-protocol
add name=dns-aaaa regexp="\\x1c\\x01\$"

Sob

If we're talking about single NAT, this is best suited for ancient/dumb/ignorant client. "If I connect to some server and tell it that I'm alive, then server sees my address and port I'm using, and if I'm listening on that, then anyone who server tells it to can connect to me, right? What? My r...

Sob

Automatic stuff, if it means that mapping created by outgoing connection also serves for new independent incoming connections, comes from this NAT type itself and doesn't need anything else. That's why it's in both srcnat and dstnat chains. The one in srcnat can be exactly same as existing masquerad...

Sob

I wouldn't say it's complicated. It's slightly different. If you have only IPv4, then with typical setup you have one public address on router, so it's one hostname and it covers all internal servers you might have. MikroTik's DDNS works and it's just few clicks. If you add IPv6, then every device h...

Sob

But why!? (@Sob!) Just because you can or is fun to have?? Bring us the real problem! What did I do? I'm just explaining and discussing interesting technical thing. Because it's just that, interesting. I'm not saying that MikroTik should drop everything else and add this, not even necessarily add i...

Sob

@Znevna: I agree that it's slightly weird. I suppose you can see the possible problem and how this solves it *1 , right? The weird part is, how is it actual problem, unless we're talking about some software from pre-NAT times? Because anything aware of NAT must assume that direct incoming connection...

Sob

Don't overthink it, it's just a tool, it's up to you how you use it. Take the netfilter module from first post (https://github.com/Chion82/netfilter-full-cone-nat). If it was in RouterOS, you could do e.g: /ip firewall nat add chain=srcnat src-address-list=consoles protocol=udp out-interface=WAN act...

Sob

There are different levels. Routing needs a route (but in this case even default one is enough). With proxy ARP I'm not completely sure, there were some changes, possibly bugs, but route pointing to different interface than LAN should be sure bet. It's even possible that it's not needed and default ...

Sob

Because IPSec carries only IP packets (= L3). You can have L2 with EoIP, but then you'll have to deal with different problems, at least some DHCP isolation would be required if each site should have own server. If you stick with IPSec, for proxy ARP to work, you'll need routes to remote sites. As fo...

Sob

Correct. But with <whatever_it_would_be_called> NAT being dynamic and creating incoming dstnats for each outgoing connection, one public address would be good enough for several consoles.

Sob

But why? You won't have L2 connectivity anyway. And if it's only L3, you might as well go with clean and simple separate subnets. But if you insist, it should be possible. Currently you have problem on site A, because e.g. 192.168.10.200 has /24, so it thinks that even remote 192.168.10.10 is local....

Sob

as you can see RouterOS also maps to the same inside global ip and port for all streams. Yes. But now when 3.3.3.3 tries to connect to x.x.x.x:12345, will it reach 192.168.88.115:12345? No, because RouterOS will correctly see it as new unsolicited connection. But this <whatever_it_would_be_called> ...

Sob

Check VRF and hidden interfaces. I was under impression that it's already fixed/handled, but maybe not everywhere? I think I didn't test NAT myself.

Sob

Who decided that everything in web browser is the right way? I for one say it's not. Don't touch my toys!

Sob

It's definitely not that RouterOS couldn't handle port forwarding. Slighly wrong VLAN and IP config shouldn't do it either. Same goes for seemingly unnecessary proxy ARP. But what if you forget about dual WAN for a moment (disable DHCP client on ether10) and try with only single connection, does it ...

Sob

Well, it's confusing. I mistakenly read it as "Works fine as long as my internet supplier does not change addresses IP addresses." Looking at OP's older threads (and I participated there too, who would have thought :)), that's not the case ("My internet provider does not change the pr...

Sob

Short answer: NO Long answer: Maybe. It would work with transparent proxy and requests that could be intercepted this way, e.g. HTTP (but not HTTPS). So in practice it's NO again. Other way would be to make clients aware of proxy. Manual config would be impractical, but there may be some chance with...

Sob

MAC addresses alone are not that big problem, it may look weird at first, but VRRP hack works.

Sob

@anav: Be careful with untrusted others. UPnP's problem is lack of security. You can help it a bit, e.g. you can control who uses it (or more precisely who can control it), by allowing access only from some devices (firewall filtering by IP or better MAC address) or interfaces. So you can allow acce...

Sob

UPnP should be solution (for single NAT) for everything that supports it. That should be any non-ancient game. Unless authors were too progressive and went only with more modern PCP. It wouldn't be wisest choice to support only that without UPnP as backup, but if you wanted, you could partially blam...

Sob

On 7.7, yes. Just go in IPv6->Addresses and it should be there. You have to accept RAs first:

/ipv6 settings
set accept-router-advertisements=yes

And also reboot to make it work, because in v7 the change no longer applies immediatelly, which is most likely bug.

Sob

It shouldn't be difficult, luckily I don't need it myself, so my experience is limited, but at first sight there are different tools ready for the job (e.g. ddclient). And if you're using own domain (as it seems you do), then if there's some API for its DNS, you can do it without relying on any othe...

Sob

Admittedly unhelpful advice: The only proper solution is to tell ISP to stop doing stupid things and keep static addresses.

DDNS is just hotfix with various problems. But if it's unavoidable, it's probably best/easiest to use some independent DDNS on server itself.

Sob

At home it's 6to4 instantly crashing system (SUP-97719). I need it to work, because it's still my source of IPv6 (ISP didn't yet manage to provide native IPv6 and I don't like third party tunnels). It might be useful indicator of v7 maturity. Given its low popularity, when they fix this, they probab...

Sob

Current bytes = 0 means that nothing is sent or received. But if you're pinging from router, it's expected, you need to set source address, because it's choosing wrong one:

/ping src-address=192.168.55.1 address=192.168.7.1

Sob

Well, the definition by itself is not completely clear. For full cone it says that "all requests from the same internal IP address and port are mapped to the same external IP address and port ", but that's not necessarily same internal and external port number. So i.i.i.i:1234 always mappe...

Sob

Central place and API for updating sounds best to me. It would require some programming, but you could choose any language you like (= much better than suffer with RouterOS scripting; just personal opinion, not objective fact).

Sob

The config in first post got somehow shorter and useless to see the problem, but original version had this: /ip firewall filter add action=jump chain=forward comment="USER FORWARD CHAIN" jump-target=USERforward ... add action=accept chain=USERforward dst-address=192.168.16.126 out-interfac...

Sob

No, this, as I understand it, solves it. Imagine some udp-based game or another system with p2p communication. If it was ideal NAT-less internet: - client A sends packet from a.a.a.a:aaa to remote server - client B sends packet from b.b.b.b:bbb to remote server - server tells these addresses with po...

Sob

If you mean forwarding port ranges to different devices, it wouldn't really work, would it? Not without some configuration on those devices that would force them to use these ports as source. If I'm dstnatting e.g. 1000-1999 to device A and 2000-2999 to device B, then if device A uses e.g 1500 as so...

Sob

Those blue unreachable routes to remote subnets (on both routers) are wrong. Right now I'm not sure (temporary brain outage ;)) they are breaking it, I think they shouldn't. But you don't need them, so they can be removed. You can also check if IPSec counters are increasing (in IP->IPSec->Installed ...

Sob

/system logging add topics=dhcp And then in log: 18:56:32 dhcp,debug LAN received discover id 3870440748 from 0.0.0.0 '1:0:c:29:e0:d9:dd' 18:56:32 dhcp,debug,packet secs = 58 18:56:32 dhcp,debug,packet ciaddr = 0.0.0.0 18:56:32 dhcp,debug,packet chaddr = 00:0C:29:E0:D9:DD 18:56:32 dhcp,debug,packet...

Sob

If something doesn't work for you, it's usually good idea to post more details. Someone might want to try to reproduce it. Or they might point some possible mistake of yours. In any case, if you're looking for any useful feedback, it can't hurt.

Sob

I think you can't: - You can have NAT 1:1, but that's only for one internal device (or more, if you have multiple public addresses, but who has enough?) - You can forward ports manually, but that's missing the "just works without user interaction" part - You can use UPnP, but it's again no...

Sob

Do you perhaps have firewall that uses fasttrack (https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack; which is not compatible with IPSec)?

Sob

Why oh why do you do these things? ;) From the new DNS docs: If DNS static entries list matches the requested domain name, then the router will assume that this router is responsible for any type of DNS request for the particular name. For example, if there is only an "A" record in the lis...

Sob

Try this:

/ip firewall filter
add action=accept chain=USERforward connection-nat-state=dstnat

Sob

It could be the problem with 7.7 erroneously returning NXDOMAIN for AAAA records (or others, but these are most likely to get queried by clients) if you define only A. That was fixed in 7.8 (currently only RC, but otherwise probably not worse than 7.7).

Sob

It depends on client, it's pretty easy with CHR I used.

Sob

Doesn't your RouterOS have Block Access checkbox like mine does? Or:

/ip dhcp-server lease
add server=<server> mac-address=xx:xx:xx:xx:xx:xx block-access=yes

Sob

So in other words, it's basically alternative to UPnP that works automatically without requiring client to do anything. And the key part is that it can work for multiple clients sharing same public address (unlike mrz's NAT 1:1, which is otherwise fine, but it needs one public address for each inter...

Sob

Certificates are not a problem if you don't have any. Otherwise, unfortunately, yes, because export doesn't include them.

Sob

Says the king of hijackers.

Mine was just a quick note that no, official tutorial with multiple routing tables is not necessarily broken.

Sob

I didn't study it in detail, but @anav's examples seem to be simple fixed-role primary/backup. So ISP1 is always primary and ISP2 is used only when ISP1 fails. One routing table is enough for that. Multiple routing tables would be needed if you'd want to have group of devices using ISP1 and ISP2 as ...

Sob

It seems overcomplicated. You probably don't need mode config and extra addresses, just simple static tunnel between subnets. Also plain IPSec is different from L2TP, it doesn't give you any new interface and doesn't use routes the same way. Instead if defines what should go to tunnel using policies...

Sob

So it works for some but not all? Then it means that RouterOS is doing something and it would need a closer look (e.g. catch and examine some packets) to see what's wrong.

Sob

From quick look it seems that VPN provider uses Wireguard. So see section (7) in viewtopic.php?t=182340 to get started. If you'd want to use VPN only for selected source devices and/or destinations, it's possible too.

Sob

Yes it will. It has to, otherwise it wouldn't work. It tries to keep original port if the mapping (newsrcaddr:srcport<->dstaddr:dstport) is free, but if not, it will change srcport.

Sob

1.1 Yes and no. You can skip certificate, set verify-doh-cert=no and it will work. But the point of certificates is to ensure that nobody between you and target server can read or change what you both send and receive. If you don't verify certificates, anyone on the way can fiddle with your data. Yo...

Sob

Firewall supports "content" matcher. Only if I remember correctly and nothing changed, any unprintable characters have to be entered using CLI (e.g. content="\01\20\ff") and they will show as garbage in GUI.

Sob

@Miguelin: It's not like they broke everything, it still mostly works. You should probably open new thread and post (much) more info about your problem.

Sob

In RouterOS you can simply create VLAN interface:

/interface vlan
add interface=<physical interface> name=<name of vlan interface> vlan-id=<vlan number>

Sob

The problem with multi WAN is that you need to send responses back the same way the requests came from, but it doesn't happen automatically. You'll need new routing tables (one for each WAN), mark connections based on incoming interface, and then mark routing for responses. See e.g. this example: ht...

Sob

One way to solve it would be it they added confirmation at boot. It would require access to physical or virtual console, i.e. something that any attacker wouldn't have, so it would be safe. User would enable containers and do regular reboot. While booting, system would ask if they really want it (wi...

Sob

It depends. Raw happens right at the beginning, so you can deal with something before any heavy processing starts. Especially if you're going to drop something anyway, doing it in raw should be more efficient. But don't ask about details, I don't have any numbers to show how much.

Sob

You successfully neutralized your firewall (by disabling #6 and #14 you now allow pretty much everything; probably not the best plan), but other than that, it's hard to tell. The image doesn't seem very clear. Is the server behind second (blue) router or not? Its LAN is connected to it, but its WAN ...

Sob

And regarding the actual port forwarding, you can't forward it to 256 addresses at once, you need to-addresses=<single address>.

Sob

That's not it. You can use IP address as gateway, but WG doesn't really care, it decides itself where to send packets, based on peers' allowed-address. E.g. if you'd have WG interface with 10.0.0.1/24 and two peers: - peer1, allowed addresses 10.0.0.2, 192.168.2.0/24 - peer2, allowed addresses 10.0....

Sob

Correction, it's Tools->Layout. And even Undo button works. So I wonder if before it didn't or I somehow missed it.

Sob

He's not selfish and wants everyone to have same fun.

Sob

I think it's those "Item alignment" buttons at the top. As I remember, the result wasn't too bad. I mean at first. But later, after you fine tune it by moving different things and accidentally press it again, it's tragic.

Sob

Yes, lately it's breaking a bit too much. As in my example, there was default (and actually the only) behaviour since forever, and everyone relied on it, knowingly or accidentally. It's one thing to change default, it can be annoying, but sometimes it's inevitable. But not even an option to get the ...

Sob

But it never really worked anyway. Or did it? I mean properly, without certificate errors. Any client should be aware that hotspots exist and try to detect them automatically. If that doesn't work with your hotspot for some reason, it's probable best to try to find why. Because it should, and then y...

Sob

*) dns - query upstream DNS servers for other record types even if static entry exists; This change, while not necessarily wrong, is not great either. Previously when I set record of any type, it took over the whole name, i.e. it blocked all other types from upstream. Simple example, public server ...

Sob

Perhaps it's a puzzle for fans, to let them discover new features in some more exciting way than just reading the docs. Or it's some cunning plan how to discover what people want, by watching what they try to do with it, without asking them directly. Or just whoever is in charge of documentation is ...

Sob

AFAIK the only failover for FWD that ever sort of worked is: /ip dns static add type=A name=myns.tld address=x.x.x.x add type=A name=myns.tld address=y.y.y.y add type=FWD name=example.net match-subdomain=yes forward-to=myns.tld It's far from perfect, because it's dumb round robin. First query goes t...

Sob

Your rules don't use destination addresses, the only condition related to that is in-interface-list=WAN. Possible explanation is that your WAN list contains parent interface, but not the VRRP one. But since that one is seen as incoming interface for packets to x.x.x.3, it doesn't work. But you proba...

Sob

That's not what it's for. It doesn't get addresses from list, it adds addresses to list. For more details see: viewtopic.php?p=952360#p952360

Sob

No, it's RouterOS. The whole thing is basically like an early alpha version that leaked out prematurely. It's fine as techdemo, but not actually usable yet. You can get one certificate, it works, and that's it. It doesn't even renew, at least not automatically. You can't request another one (for dif...

Sob

Now that we have containers, it may be time to leave some things in the dust (like SMB server, proxy, hotspot, and apparently also DNS resolver) and focus on routing again. I'd rather if they didn't. It's my fear of containers, that they could serve as excuse for MikroTik to not implement some thin...

Sob

Now once you add an A or AAAA entry, both A and AAAA records are handled by static entries. We will discuss this internally once more and will decide how to proceed. Unless you use DoH: /ip dns set allow-remote-requests=yes use-doh-server=https://1.1.1.1/dns-query /ip dns static add name=forum.mikr...

Sob

Some declarations just turn out to be premature.

troy.jpg

Sob

Actually... viewtopic.php?p=780986#p780986

Sob

That's not what I meant. First, out of the three hostnames, only one could possibly make sense, acme-v02.api.letsencrypt.org is the one LE client is connecting to, acme-staging-v02.api.letsencrypt.org is testing (non-prodution) version of that, and letsencrypt.org is just for public website. But as ...

Sob

I'm not sure it's supposed to work, see:

https://letsencrypt.org/docs/faq/#what- ... web-server

Sob

Use WinBox to connect to router's MAC address. And when you get in, check 1) in viewtopic.php?p=956630#p956630

Sob

Sorry about late response, open tab got burried among other stuff. It doesn't seem correct at all, "/ip firewall nat" is for changing sources or destinations. For blocking and allowing stuff there's "/ip firewall filter". Since you currently don't have any, you may want to get so...

Sob

It depends, what's your problem with double NAT? I'm not saying it's great, it isn't, but for many things it isn't too bad either. If you have public address and want incoming connections, you can set it as NAT 1:1 and it will work for many/most things. It's true that it can change behaviour of some...

Sob

If you also have two distinct marks (you do, right?), then srcnat conditions should match, source should get changed to one address or another, and then the right IPSec policy should apply. Right now I don't know what could be the problem. If you export and post your config, maybe someone will see s...

Sob

It's normal to have "copy" of static records in cache. I'm not sure about TTL, it used to show the same value as defined for static record. I guess it can be some internal thing, but I can't tell what exactly it could be. But external queries get responses with full TTL, so that's correct.

Sob

If you use addresses from each tunnel in distinct part of LAN and you can identify source even without using addresses (e.g. by interface), then you could use mangle rules the same way as for incoming connections. Marking connection in forward is possible, but it won't help you with outgoing ones, b...

Sob

Not tested, but routing rules should do the trick, without any mangling: /routing rule add action=lookup dst-address=<he-subnet>/48 table=main add action=lookup dst-address=<6rd-subnet>/56 table=main add action=lookup src-address=<he-subnet>/48 table=he add action=lookup src-address=<6rd-subnet>/56 ...

Sob

@Świętopełek: Dstnat is just one step. Even if you redirect everything to router, if requests came from internet, they already had your router's address as their destination, so nothing much changed there. What happens still depends on your firewall filter (chain=input).

Sob

The problem is that ipsec-policy looks for policy that matches current src/dst address combination, in whatever chain it is. Forward chain sees packets from <real local address> to <remote address>, but your policy is for <virtual local subnet> <-> <remote subnet>, so it can't match and packet is al...

Sob

True, it's more logical. But then clients depend on Pi-hole and if it happens to not work for any reason, nothing works for clients (at least it seems that way to them). If everything goes to router, it can be easily and automatically (using Netwatch of scheduled script) redirected to somewhere else...

Sob

You need to look closely at what happens. Tools->Netwatch, logging rules in right places, ... find out where exactly it goes wrong. Step by step, see incoming packets in prerouting, verify in postrouting that nothing blocked them, watch for responses, etc..

Sob

There's RFC for it, mentioned in this thread, about how CPE devices should handle changing prefixes (advertise old one with zero lifetime). It doesn't seem difficult to add built-in support for that.

Sob

You're either trying to fix someone else's mistake, or you're making one yourself: a) If authoritative server says that www.example.net has address 1.2.3.4 and sticks an hour long TTL to it, then it's their responsibility to keep 1.2.3.4 alive for at least that long. If it fails sooner, too bad. But...

Sob

So the bridge is something you want, but don't actually have yet? Because I was wondering how it works. :) It would be simple if you got two IP addresses from ISP, but otherwise I'm not sure how it could be done, at least not in any simple and straightforward way, without changing something on main ...

Sob

RouterOS should definitely handle this, changing prefixes is valid config. After all, D in DHCP means dynamic and not necessarily only "not assigned manually", prefix can change too. But that forcibly changing prefixes for customers "just because" is horrible idea, that's also tr...

Sob

Original config should work for VPN->GRUPPO_DISPOSITIVI_VOIP connections, but not for GRUPPO_DISPOSITIVI_VOIP->VPN connections, because route marking rule requires connection mark that's only assigned to VPN->GRUPPO_DISPOSITIVI_VOIP connections.

Sob

It should work, any connection to 192.168.4.254:53 should be allowed. If you have rules at the beginning as shown, there's nothing to stop this traffic.

Sob

Is there any srcnat involved? Meaning that tunnel wouldn't be for addresses in Office list but for some other virtual address/subnet and srcnat would change source to that. The ipsec-policy in forward couldn't work in such case, because srcnat happens only after forward.

Sob

If you look at generated IPSec policies, are there two different local addresses?

Sob

You can use same SSID and IP range, but it won't help you, because they will be on wrong device, so anything connected to that won't have access to main network when it's online. If it's just about reconnecting to another AP being annoying, you could use Netwatch to monitor whether main router is al...

Sob

You can either let Pi-hole do it (https://docs.pi-hole.net/guides/dns/cloudflared/), or if you'd want to use router's DoH, it would be possible too, but only if clients won't be using its DNS cache (which you may or may not want, depending on how exactly your Pi-hole fits in).

Sob

If you don't have MT router and want to play with RouterOS, you can use (free) CHR.

Sob

Exactly as you have it, but only half of them. :) Second rule changes your 10.0.0.x to 10.168.10.x when connecting to their 10.14.x.x, that's what you want. First one matches if their 10.14.x.x tries to connect to your virtual 10.168.10.x, but it doesn't do anything useful with it. To handle such in...

Sob

If I undestand correctly, it's two subnets behind same router, which has 1.1.1.1 as public address and some port(s) should be forwarded to server 10.11.110.200. And it should work from both internet and other LAN subnet 10.10.10.0/24. It that's the case, it should work, you just need correct dstnat ...

Sob

Yep, it's broken. Already reported as SUP-97719.

Sob

I think more people have this in common. Italian cats seem to like it, but that's some weird exception.

Sob

@BartoszP: That's related, sometimes it's like manufacturers are thinking "oh well, so we can't limit what customers do with hardware, but at least we can still screw them with software!" ;) I'm not saying that it's MikroTik's intention, not with their otherwise fair approach, unlimited up...

Sob

But it's also true that OpenVPN suggests that certfificates should be created with specific usage: https://openvpn.net/community-resources/how-to/#important-note-on-possible-man-in-the-middle-attack-if-clients-do-not-verify-the-certificate-of-the-server-they-are-connecting-to But still, it shouldn't...

Sob

I'm afraid not. RouterOS scripting doesn't like me. I can manage to produce something when I need it, but I always suffer while doing it, so otherwise I tend to avoid it. :) If you're at least a bit into programming, you can check official docs: https://help.mikrotik.com/docs/display/ROS/Scripting h...

Sob

Routes seem ok, only if those subnets are only reachable via 192.168.2.1, you don't need check-gateway=ping, because they should point there whether it's up or not. As for ping, if you were able to ping 192.168.2.2 from 192.168.2.1, then communication between them is clearly working. Not being able ...

Sob

You could use passthrough rules as counters, but then you'd need some mechanism to check whether limits are exceeded. Which probably shouldn't be too difficult to do using scripting. But unsolved problem is that if router reboots, counters will reset, so you'd need something else that would periodic...

Sob

To me, "works with original OpenVPN" is pretty good argument why it should work with RouterOS too...

Sob

It could be that people are not exactly sure what you want. More details could help. Maybe tell us how it was done in old days, and we'll see if present day technology can handle it or not.

Sob

They added match-subdomain (which is great thing) in 7.5 and so far it's CLI-only, so it's easy to miss. Previously subdomains required use of regexp. Then they broke FWD records in 7.6 and later, but fortunately it seems that it's not intentional. So it's going in right direction, but slowly and so...

Sob

It depends on what local addresses (for your end of tunnel) you get from them. If they are different ones, it should work (most likely). But if it happens to be same address, it wouldn't work.

Sob

Given the right interface, I could change license level ten times a minute. Can you do the same with car engine? There really is huge difference. :) And about licenses, I'm not sure that it's really MikroTik's main business. It made sense at the beginning with x86 licenses that you'd buy for your ow...

Sob

Hey, sometimes different words help. And yes, sometimes it's waste of time.

Sob

It doesn't seem likely that something would require IPv6 and wouldn't be able to work without it. Such service would be inaccesible to 2/3 users (global average).

Sob

@anav is not completely correct, you can route traffic to selected destinations identified by hostnames, it's just that reliability depends on other factors. It's easy if you have specific hostname (www.example.net) with static or mostly static IP address, the site hosts everything on www.example.ne...

Sob

Suggestion, don't do car analogies, they don't work. MikroTik made the same mistake when explaning why you can't upgrade license levels ("Just like you can't easily upgrade your car's engine from 2L to 4L just by paying the difference, you can't switch license levels as easily."), and it's...

Sob

It's connection tracking. If there's connection from x.x.x.x:x to y.y.y.y:y, router remembers that and knows that response from y.y.y.y:y to x.x.x.x:x belongs to same connection. That's the simple case without NAT. When there's NAT (srcnat, dstnat or both), it's the same principle, only with changed...

Sob

You can create static interface for user and that one won't disappear:

/interface l2tp-server
add name=<interface name> user=<user name>

Sob

I don't know if Windows domain has any special requirements, but can't you simply split it into two "independent" parts? 1) VPN for clients that will allow them to access 192.168.0.0/24 2) domain-joined devices that are either in different subnet (could be VPN as well as just another subne...

Sob

No. If you're able to connect using WinBox, it's in normal running mode. Netinstall mode is when it boots from network and waits for being installed. You probably haven't mastered the art of button pressing and only reset it. :) I don't know what this device defaults to, generally there are several ...

Sob

It depends on your requirements. See https://wiki.mikrotik.com/wiki/Manual:T ... _v6/Probes, if that covers what you need, then probably yes. Just remember that Dude is currently not developed and there's no guarantee that it will change. So if it does all you need, fine. If not, you're out of luck.

Sob

I'd start with WinBox and try to connect to device's MAC address.

Sob

Mangle rules, connection gets wan1_cnx mark and then WAN1 routing mark, but there's no route to 192.168.6.1 in WAN1 table, so it goes to internet. Don't mark it when it's from IPSec tunnel.

Sob

PTR records are created automatically when you add static A/AAAA, but that may not be what you want. Other than that, recent v7 can do this: /ip dns static add name=20.172.in-addr.arpa type=FWD forward-to=192.168.2.1 match-subdomain=yes add name=21.172.in-addr.arpa type=FWD forward-to=192.168.2.1 ma...

Sob

There's some weird stuff like DHCP clients on all interfaces (why?), but there's no firewall or anything else that would block access between interfaces. If ether2-p2p is connected to another network where devices have default gateway other than this router, that could be a problem if there's no rou...

Sob

Regular static route, where gateway is link-local (fe80:...) address of target machine.

Sob

It's a bit confusing and also wrong. Response packet from server will first have 10.0.0.3 (real server's address) as source and 10.0.0.1 (router's address) as destination. And after all NAT is undone, it will have source 172.16.16.1 (server's address as seen by client) and destination 10.0.0.2 (clie...

Sob

Pointing out mistakes in what you did works better when we can see it, the real thing with everything that can influence it. See Step2 in viewtopic.php?t=182601

Sob

Rules are processed in order from top to bottom. If some rule accepts packet, no further rules will be able to touch it. So you're excluding packets to listed destination subnets from futher processing.

@anav: You know the answer, it can't do any good with dst-address-type=local.

Search found 9229 matches