MikroTik

jspool

Hi , Anyone how are you ? Today I have a question about Mikrotik OS7 v 7.12 Filtering bgp routes. My connection is iBGP with an ISP. I want to Filter / reject some as-paths. Recently I used this filter. if (bgp-as-path 7XXX) {reject} When I add this filter on the bgp I'm connected to, I check the r...

jspool

IP Spoofing (prevent LAND Attack and others)

If ISP is using OSPF, BGP, BFD,VRRP on any of those interfaces they will need to ensure the rules don't impact those protocols.

jspool

I can max out the 2.5G Ethernet port using speed test to my core router no problem. (I am not using the SFP+ port)

jspool

I have 4 x RouterOS v7 bare metal routers running on Intel E5-2699 CPU.
They load a full Internet BGP table in like 15-20 seconds.
10G both direction (20G aggregate)tcp speedtest in winbox from Mikrotik to Mikrotik (both E5-2699) is 20% load.

jspool

Bare Metal slaughters CHR performance. The key is using the right NICs. Mellanox ConnectX 4,5,6 I find to be solid. That's a myth and might have been true in the old days of virtualization. Mellanox ConnectX Ethernet cards are good, even v3, and most HP server built-in NICs are sufficient as well. ...

jspool

For home or small business a 2004, 5009 or 2116 is fine. But for DC or Edge a decent bare metal stomps the 2116 & 2216. Will it consume more power? Of course that goes without question. Most service providers are not counting watts, They need to be able to run multiple full BGP tables without wa...

jspool

@tareqbd, do yourself a big favour and buy an MT box, or at least skip flaky x86-68 drivers and instead go with ESXi using CHR or a similar option for close-to-bare-metal speed.

Bare Metal slaughters CHR performance. The key is using the right NICs. Mellanox ConnectX 4,5,6 I find to be solid.

jspool

Have you tried putting the clear connection script in the dhcp-client script area?

jspool

We can hope... https://youtu.be/Gb7poHQuMWg?t=8

jspool

sometimes when you open winbox and a window with many elements that consume alot of resources is a matter of clossing that windows and then exit winbox reopen winbox and wait (without opening a window with many elements) some minutes and that 100% core will be gone windows with many elements: simpl...

jspool

I saw that I have this issue once I open ip/route or ipv6/route windows on winbox. If I reboot the router and don't open those windows, I don't have any core at ~100% for routing You are correct. After a reboot it no longer taps out one core. Mikrotik needs to figure out how to optimize Winbox so s...

jspool

This was originally used on XCP-ng Center, If you are using Xen Orchestra it will be similar. Create New VM on XCP-ng host Select "other install media" Select any ISO to continue (It will not be used) Set desired CPU, Disk, Memory parameters Make note of what you name the virtual disk as y...

jspool

[/quote] I suspect that there are no near-future tik plans for a many-ports 100-Gig switch ( or for WhiteBox switch support ). Which is why I have some Sonic 32-port 100-Gig switches on the way to my NOC ( and several more soon after that ) - I can't wait any longer for tik. ** Once you go 100-Gig ,...

jspool

This behavior occurs on baremetal x86 with 22 cores and CCR2116 with 16 cores. I have them set to "alone" BGP stability is good and throughput is good. Just always have a single core 90-100%. Curious what others have observed.

jspool

For those running BGP with full tables on v7 is it normal for one core to be 90-100% almost all the time when BGP is running. tool profile shows it as "routing". This happens regardless of no traffic or high traffic.

jspool

Do you have a script to clear the UDP connections when the ISP change occurs?
/ip firewall connection remove [/ip firewall connection find protocol=udp]

jspool

I reported this bug to Mikrotik on March 27th and they were able to replicate it and have stated it will be fixed in an upcoming version.

jspool

It's not just in Spain, I saw a CCR2116 for almost $2K USD on Amazon last week.

Yeah in the USA I see Flytec is selling the CCR2116 on Amazon for $1699.00

Gouge.png

jspool

A crude but effective method since its your own PBX: On the Mikrotik that is Queueing traffic: You can create a simple queue for all customer to PBX traffic and place it at the top of the simple queue list. PBX traffic will match this queue and all other will not and it will hit their normal queue l...

jspool

Generally the ISP will provide a ONU/ONT (Huawei HG8310M) that will serve as the bridge between their GPON network and their customers router. In this case you would plug the WAN side of the HAP AX3 into the ONU/ONT and you should be good to go. To use the RBFTC11 with your ISP without the Huawei HG...

jspool

Greta, Maybe familiarize yourself with data centers and you will see that most have A+B power. Just because you lack understanding doesn't mean we all should devolve to your level. If everyone felt woke like you the reliability of enterprise networks and the Internet would be greatly diminished due ...

jspool

I use FS.com DAC with generic coding as that is what is recommended for Mikrotik and thy work great at 10G for years. I also have the FSBox to program their DAC cables as well as their optics. It's quite handy to program each side of a DAC to the desired brand.I also use solid-optics.com brand DAC w...

jspool

+1 for IS-IS

jspool

ROS v7 bare metal install on Dell R730 with 40G & 50G Mellanox ConnectX-4 series works great. I have not tried any ConnectX-3 series. Thank you very much, I think I should try it, I guess you put two CPUs on the server, and how many threads was each one? The one I am testing has 2 x E5-2680 v3 ...

jspool

ROS v7 bare metal install on Dell R730 with 40G & 50G Mellanox ConnectX-4 series works great. I have not tried any ConnectX-3 series.

jspool

A switch with a mix of PoE+ and PoE++ 802.3bt would be ideal. Most of Ubiquiti's newer switches do this. It would be nice for Mikrotik to also make these. It would also be awesome if Mikrotik made something to compete with their USW-Flex.

jspool

If you consider how the tests are performed then it should hopefully make sense. You can reference the RBM11G and RBM33G also as they are the same processor but with a different port count.

all-port.png

jspool

It wasn't universally working on v6, Support advised me not to use BFD on Tilera. It did work fine on Arm and CHR. How I interpret RouterOS: Beta = Alpha Stable = Beta (following stable releases break previous functionality rendering it more of a beta than a stable) 2024 = Is probably a fair estimat...

jspool

Is there a way to get the below filter to work on 7.1+

/routing filter
add action=accept chain=dynamic-in distance=18 prefix=0.0.0.0/0 prefix-length=0 set-distance=1 set-routing-mark=Starlink

jspool

You would have to drill a couple holes in the case and install SMA to ufl pigtails and connect them to the modems antenna ports. While its not ideal, if done properly it should work.

jspool

Typically most customers issues are with their own providers and rarely with a colo. Not impossible but generally quite rare. Back to your question. Let's say the customer has VoIP phones that register to a provider. This would use their WAN IP to register. So if the customer has a failover situatio...

jspool

As stated you would typically need to have a colo or cloud location that has tunnels back you your office location (One tunnel per ISP) Essentially just using the office WANs as conduits to the colo. Doing it like this you can deliver an IP address that will float between the tunnels using OSPF and ...

jspool

The instances I have seen are from poor password and update policies as well as not limiting management access to the routers. Some had old RouterOS versions that were exploited and the user/pass was obtained and used on other Mikrotik routers that were running newer versions but utilizing the same ...

jspool

Personally I think that real performance will be reached when Mikrotik adopts VPP and DPDK. I use Mikrotik CHR and CCR for core routing and use TNSR for edge routing as the VPP and DPDK are impressive to say the least. The BGP performance is crazy good and it ends up being able to do about 10Gbps pe...

jspool

So the default mode the Quectel's come with is PPP/QMI. Generally to be seen in this mode you have to enable "Ignore DirectIP Modem" in /system/ports and then reboot. Then you should see a PPP interface that you can configure and use for Internet. It is limited in throughput in PPP mode. I...

jspool

Probably near the time when the iPhone 17 is released.

jspool

On most US carriers if you are using a pre-activated SIM just use mangle to set the TTL and it still falls under mobile data.

jspool

At least in North America Mikrotik modems are borderline worthless with their lack of bands and certifications. I question why they even made modems at all considering the amount of time and money it takes to develop & certify the modems on all the carriers everywhere. They are stingy on providi...

jspool

The Cat4 Quectel EC25-V OR the EC25-AF will work fine on v6. I have been using the Cat12 EM12-G in the hAP AC 3 with a mPCIe to M.2 adapter with good results. I don't think it will fit with the adapter in a SXT. Otherwise some have tried taping the USB3 pins on the EP06 with some success. I never re...

jspool

You can get a Quectel EC25-AF on Amazon that supports pretty much every carrier in the US and it is quite easy to lock bands. I used it instead of the R11 and it has been working great.

jspool

We have been advised against using bfd in Mikrotiks by Mikrotik helpdesk. Its been broken for a long time and will not be fixed in 6.x was the answer when I asked again some months ago. BFD typically works fine on CHR, and most ARM based Mikrotik's. I use it with no issue on CHR & RB4011. I hav...

jspool

Approved / Certified device does not mean it will work without a SIM switch. The reason is that the IMEI's are loaded into the carriers database by the final device manufacturer not the modem manufacturer. The modem could be used in a phone, ATA, or Hotspot so the carrier would have no way of knowin...

jspool

Does this happen if you power it with POE?

jspool

Ok, thank you for the information, this is very helpful. I think I will buy one of these to add as a second modem to my LTaP. I currently have two SIMs (AT&T and T-Mobile) but obviously I can only use one at a time with a single modem. I can take advantage of a second modem to simultaneously us...

jspool

Thanks jspool. Do you use these modems on Mikrotik? If I buy one (assuming I do the installation myself), will RouterOS recognize it? If so, I may consider adding one. Mikrotik supports them pretty well. I use the EC25-AF, EC25-V, EC25-A, EP06-A with Mikrotik. The AF model works on about every carr...

jspool

In my testing no current Mikrotik modem performs very well in the US due to the fact they lack a good number of the bands in use in the US. Quectel EP06-A (Cat6) or Quectel EC25-AF (Cat4) are the best thus far in my testing. If you are only going for basic connectivity for remote administration and ...

jspool

How are you limiting DHCP leases per customer? I would like to avoid static dhcp leases so that a customer can change their own inside router at will. I do want to ensure only one device can get an IP from the tower router. On the Mikrotik switches they have the port lock feature that seems like a g...

jspool

Also some Cisco switches with SmartPort enabled connected to the LAN that the Mikrotik DHCP is on can cause the "without success" issue with some devices.

jspool

They need to put M.2 modem slots in so we have the freedom to customize the modems as it is unrealistic to have an integrated modem that works well for everyone.

jspool

It's sad that people think they need visual stimulation so they can configure a router. Next they will request a "Good Job!" or "Your Doing Great" messages to pop up after they make a change in the config. Your special only in your needs and not in your abilities.

jspool

Personally I am against dumbing stuff down to meet the lowest intelligence level of a potential user. If it matters to you then learn it and master it. If it is too complicated buy a Netgear.

jspool

When back in stock you might consider: https://www.balticnetworks.com/maxxwave ... ore-router

jspool

Is there any simple method to stop attacks from other countries? This applies to CCR If you only allow trusted networks access to the CCR services with firewall filter input rules you don't have to block by country. Blocking by country has very minimal impact. disable unused services in /ip service...

jspool

I like the look of the Chateau. I would Love to see both SXT and Chateau with M.2 slot so we have the flexibility to use Modems of choice.

jspool

Put it in ECM mode and it will show up as a LTE interface. Wiki has instructions. Essentially you send it an AT command to switch modes.

jspool

Audience LTE without the Modem. Like the SXTR, LHGR & WAPR

jspool

US/T-Mobile.

I import Quectel modems personally. For your application I would use the EC25-AF It's a Cat4 that supports B2/B4/B5/B12/B13/B14/B66/B71 I use it with Verizon, T-Mobile, AT&T with no problems.

jspool

Is there a *good* list of known working LTE mini-pci-e cards that support bands 4/66,12, and ideally 71? I'm only getting partial band support in the existing LTE modems and really need to find something. I could live with a USB modem in some circumstances, but really needing an outdoor device so t...

jspool

I think we will see most new modems will be released with M.2. Most all of the Cat12 and higher modems are already only available in M.2

jspool

They will need a Gigabit interface and a M.2 slot instead of a mPCIe to support the latest and greatest modems.

jspool

It's unlikely a single modem from Mikrotik will suit the needs of everyone in every country. Personally I order the SXTR and LHGR (The ones without an included modem) I then put in the desired modem based on the location or needs and they work flawlessly.

jspool

I would love to see:
RB4011 with M.2 LTE & USB 3 port.
LHG with M.2 LTE slot.
SXT with M.2 LTE slot.

jspool

Hopefully, the OP is a 12 year old flat earther, then it would make sense

.

jspool

1) It is available in the USA and the highest gain product MikroTik currently has available, but may not have the bands you need. See the PDF. 2) Yes, all modems have an IMEI. 3) You can select which bands but I'm not sure if you can set a priority for each band @SiB may chime in with this since he...

jspool

though the problem on how to force 60GHz to be detected as failed when link suffers but doesn't drop remains... would require netwatch or traffic monitor, definitely not the cleanest implementation when OSPF is the tool to cope with link states. Indeed - there is sadly no feedback about how "g...

jspool

You can easily find the performance metrics on the Mikrotik product page. You can then compare to the RB4011 and others to see if it will have the desired throughput for your needs.
https://mikrotik.com/product/crs328_24p ... estresults

jspool

I think it is in closed testing.

Is there any changelog?

I have been testing various LTE modems with v7 and was given access to debug some issues. At the time of download I do not believe there was a changelog.

jspool

It's cold outside? Have the dev's fingers frozen? Seems a new beta hasn't dropped yet and it's been a bit over a month. The monthly cadence is fine for me. Hopefully the next one will have some more meaningful features in it. The only feedback I have is the new CLI is a bit strange to me. They are ...

jspool

Hello, I just have a new SXTR & R11e-LTE6 and plan do some testing with disconnecting the original u.fl connector and do testing with other modem's at few ISP by all Bands with 2xCA and without... I cannot found at mikrotik.com/hardware a replacement for this short pigtail ufl-ufl who is origin...

jspool

Why not install your own CHR ?
Why should it be located in Panama ?

I have many CHR deployed but none in Panama yet. I have a client that has inquired, so I thought I would ask other members if they have deployed any CHR in Panama.

jspool

There is no SIM slot. If you get a mPCIe SIM spacer it then is going to hit the Capacitor and not be able to be seated. Even then I don't know if RouterOS would recognize it.

jspool

I am looking for a CHR in Panama. Does anyone know of a host that offers CHR there?

Thanks!

jspool

I agree that in some cases a separate device is better suited. However all in one devices like those made by Pepwave & Cradlepoint are also popular in many circles.

jspool

Yesterday I also saw this exact DNS hijack at a WISP I have done some consulting with in the past. They came in via Winbox from a Ukraine IP and redirected DNS to a Sweden IP. They came in using a specific users account so I assume it was with a harvested password. And yes their device was not adequ...

jspool

Personally I think a RB4011 or a RB1100AHx4 with a SIM slot and either a M.2 with USB support or a mPCIe would be nice to have for situations where you want to back up a single WAN and no other options are available other than cellular or you want to send SMS easily from the Dude edition.

jspool

RB4011iGS+ 6.44.5 (long-term) I logged in via Winbox and could see the CPU was 25% for no apparent reason, however interface & firewall pages did not load any data. Performed a reboot, and it took 7 minutes for it to fully boot. No Interface link lights until 7 minutes in and it started worki...

jspool

Hello From high-level point of view, there would be little difference between udp. And high stream of large icmp packets would be a red flag on it's own. Furthermore, some networks / routers perform icmp "optimisation" / rate limiting, which would result in high packet loss. So far from s...

jspool

Looks like lightning damage to Port4.

In this case only port 1 and port 6 were used.
WAN=1
LAN=6

Mikrotik has instructed me to RMA so they can inspect it further. Replacement 4011 plugged in the exact same way and configured the same has been working flawlessly.

jspool

I installed a brand new RB4011 at a customer location. Later that same day I started getting alerts that the location was offline. I returned to the site today and the RB4011 was insanely hot and would not boot. It had a power led but no link lights on any port. It was plugged into a surge protected...

jspool

Allow trusted DDNS on VPN server. Script the mAP to update a DDNS record on boot up and then establish the VPN connection. No need to knock on your own door unless you like secret handshakes. You can also make a script in the mAP that updates the DDNS to a non public IP when your done using it in ca...

jspool

Unless you're running AirFiber the wireless links are running half duplex. "were talking wireless not the Ethernet link" multi-hop half duplex wireless backhauls annihilate TCP throughout as it was never designed for latency. Speed test from each end of your network with UDP and then try w...

jspool

I am inquiring as to any of you that have deployed the PTP RBLHGG-60ad at a distance of 200 Meters. My goal is for the link to survive rain fade. Will these have any chance of staying connected with a small layer of ice or snow at 200 Meters? Trying to see if I need to have a 5GHz PTP as a failover....

jspool

I also notice this on some of my VPN clients. Many show "Last Link Up Time" over a month in the future.

jspool

v6.44beta37 will have:

*) gps - added "coordinate-format" parameter (CLI only);

ddmm will be an option.

Thanks Normis!

jspool

https://forum.mikrotik.com/viewtopic.php?f=9&t=137114&p=697697&hilit=gps+api#p697348 When Mikrotik updates the GPS package and enables it to output the location data to a friendly format it should work fine without requiring a middleman server to translate the data. Currently I use Parti...

jspool

External antenna for LtAP GPS works great. I haven't used external antennas for the LTE yet as it seems to work great with the built in antennas for the current application.

jspool

You are right. We already have this in our ToDo, and will try to make it, now that LtAP mini exists.

Excellent news Normis! Supports response via email a while back was not that positive at all. Glad to hear its in the ToDo list.

jspool

Especially after releasing hardware with built in GPS like the LTAP it should be apparent that the GPS package needs some attention. Mikrotik needs to devote a couple hours to the GPS package and output the data in a usable format that does not require a middleman server to convert the Mikrotik data...

jspool

When using L2TP + ipsec you can't be sure, that the packet is not fragmented, even if you specifically restrict fragmentation of the original packet. The original packet first packed into l2tp (that can, by the way, also perform fragmentation and defragmentation, but only if asked to), then it is p...

jspool

When pinging across a L2TP tunnel w/ ipsec enabled I can send packet size of 1450 with no fragmentation.
When I try to do a UDP Mikrotik bandwidth test I have to set Tx size to 1400 to get the max speed of 111Mbps Otherwise with Tx size at 1450 it only gets 19Mbps,

Whats the reason for this?

jspool

Hi we using wapg for last 3 months on 120m and LHG60g on 900m for last month we based in ireland so u can imagine we have lots of fog and rain and after days os alignment they finally working perfect all was down to latest stable version of router os we had rc versions and routers crashed couple of...

jspool

I am curious as to why the LTAP would not have a voltage monitor? It seems like a perfect candidate for use in vehicles and it would be really handy to monitor battery voltage. And the GPS package could really use some love. Output format is not very friendly. Would be nice to upload GPS data direct...

jspool

If its ever been hacked or suspected of being hacked then you need to Netinstall the current RouterOS version. Use a packet capture tool and you should be able to narrow down the source if its not the Mikrotik.

jspool

Does anyone have the depth of the new CRS354-48P-4S+2Q+?

I am curious if it will fit into some customer wall mount racks.

jspool

I'm more excited that they are hiring Android & iOS programmers as well as mobile application WEB application programmers. Some native management apps would be very nice. https://darbs.mikrotik.com/darbs/ When they are ready they will release the newer RouterOS. Their new building is more conduc...

jspool

It sounds like more of a configuration problem vs a hardware problem. If you cant determine the cause of latency now then changing hardware wont be accomplishing anything. tool profile allows you to see the routers resource usage to determine if its being overloaded in some way. Too many firewall ru...

jspool

Why bother with DAC? Transceivers are not much these days.

I use Intel X520 SR1 (comes with Intel transceiver)connected to CRS317-1G-16S (MW-SX+MM-US transceiver) using an actual fiber patch cable as it was intended.

jspool

Funny how people are so quick to post an issue without bothering to check to see if its already been discussed. Anyone exposing management ports to the public facing Internet deserves whatever comes their way. Attacks from LAN to router and from WAN to router are easily prevented by only allowing tr...

jspool

Can't tell why I have been running the old version. Wasn't aware that there have been issues with the old version, and the units have just worked well..... If you have management services enabled on public facing devices its not even a question as to if one should stay up to date. If you aggressive...

jspool

Was it running a vulnerable RouterOS version? If so you probably got locked out by the attacker. viewtopic.php?f=21&t=134776

jspool

You have used the scan feature right? it shows nearby wireless devices. But I think you may be after something else

For everything else you can use Kali Linux or utilize a https://www.wifipineapple.com/pages/tetra

jspool

If you have anything Internet facing you must be vigilant. Definition of vigilant : alertly watchful especially to avoid danger It is truly surprising that so many are: 1. Not up on the current threat landscape. 2. Fail to implement basic firewall restrictions on management services. 3. Show surpris...

jspool

That would be interesting to know if they plan on adding PPS.

According to the Wiki:

Note: The time is not stratum 1 as RouterBOARD devices do not have PPS implemented

jspool

the original power cable suddenly broke after few power outage Well the cable wont physically break due to a power outage. So maybe you had a power surge that fried your power supply. In that case try powering with another power supply of the same voltage and amperage and see if it will work. If it...

jspool

PCI scans are such a joke. Just setup port scan detection and block them as they attempt to scan. They love to find any open port and consider it a fail and charge the customer more for being out of "compliance".

jspool

Are the capacitors shot? Are they raised or leaking from the tops? Have you tried powering with a different method? It should support POE as well as the DC plug.

jspool

Have you tried the latest release candidate RouterOS? *) lte - use "/32" address for the Passthrough feature when R11e-LTE module is used;

jspool

We are working on a system management tool that would have this feature.

John
Will this management system be released along with RouterOS v.7 software?

https://www.youtube.com/watch?v=izQB2-Kmiic

jspool

Ubiquiti has such a tool and it would be awesome to have for Mikrotik hardware.

HA feature without having to use scripting would be very nice as well.

jspool

Most LTE connections give you an IP in the 100.64.0.0/10 range. This is actually a non public IP that is used with CGNAT. As already stated the only way this typically works is if your device is setup with a VPN client that connects to a VPN server that has a publicly accessible IP address.

jspool

SIM cards don't plug into the MiniPCI-e slot. They go into the Sim card slot. Assuming you are using a supported Modem plugged into the MiniPCI-e slot you should see the device in interface LTE.

jspool

Assuming you mean "Ubiquiti" Also the RB433 has MiniPCI slots. If you would take the time to familiarize yourself with the XR9 and maybe even use the search feature you would get your answer in less time then it took to write your post. https://forum.mikrotik.com/viewtopic.php?t=30828 http...

jspool

On both current and release candidate the bridge does not show any tx traffic and it appears that ether1 is displaying the bridge tx traffic. I emailed support and provided a supout. Not sure if anyone else is seeing this as well. a8668bcbab49e364aa923e3fdebb01df.png Updated: Support says: "Thi...

jspool

For the first time I can use my RBM11G w/ R11e-LTE-US with Verizon! The latest release candidate (6.43rc11 ) resolved the issue preventing it from being able to route out via the LTE connection.

jspool

@pe1chl So do the firewall filter rules apply to all routing tables by default?

jspool

Are both sides using the same RouterOS version? I recently had a problem with l2tp between 6.40.8 and 6.42.1. Once I updated both to 6.42.1 it worked. Not sure if it has any bearing in your case.

jspool

I saw that now I can download automatically the new RB firmware with "Auto upgrade", there's also a way to auto reboot?
Also there was talk of perhaps suppressing the firmware reboot message if not needed.

There was also talk of v7

jspool

Yes that would be a safe procedure to update it in-place. Now that it already has been "destroyed" you can netinstall it immediately to 6.42.1 and indeed upgrade routerboot as well. The above procedure should be followed when you have other devices with such old software you want to updat...

jspool

Mikrotik is Linux based and Linux has support for multiple routing tables and routing rules. A VRF attaches the connected interface route to an alternative routing table so that you can have overlapping routes. Yes, this is what I know and that is why I think it works like you describe! The part ab...

jspool

Once a system is compromised you must Netinstall to ensure you have a uninfected system. Netinstall, secure it properly and commit it to a learning experience.

jspool

That's why Its important to whitelist trusted traffic before the blacklist drop rule.

jspool

Even if the DDNS was compromised the attacker would have no clue what equipment you have that watches that record. I agree that compromising the DDNS itself could reveal something useful only if the VPN "server" would query the DDNS server directly. But if you update the DDNS from the hot...

jspool

Downgrading a RB1100AHx2 from 6.42.1 to 6.40.8 bricked it. Will have to make a trip to the mountain to fix that one. At least I had a backup router in place!

jspool

Port knocking seems like a decent approach to add an additional level of security. I used it when I first started using Mikrotik products but have since migrated to other methods. 1. DDNS (My management gear has DDNS client that updates the dynamic DNS record with the IP of the management equipment....

jspool

After about 6 hours, I finally got the Routerboot menu. I'm not sure why I was never prompted (press any-key...) before. I ended up getting a stopwatch and power strip. I was powering the router and timing how long to press the reset. It ended up needed to be pressed for no less than 15 minutes. (w...

jspool

Tried that.. They said it's past their coverage and to contact Mikrotik.

Mikrotik products are great when they work and if they stop working your soon in a pin ball machine being bounced around aimlessly. Perhaps things will improve with v7

jspool

You will have to Netinstall your router. If you are not being able to do that, then provide serial console output which would be made during Netinstall process.

I think if you read the whole thread you will see his console output and the fact that netinstall is not working.

jspool

That's unfortunate. Crazy that its possible to brick the unit doing that. Its doubtful they include any JTAG ability. Their default response is to contact your supplier and arrange a RMA. On a side note I am curious what you think of the x4 aside from the current issue.

jspool

Using a 24V power supply on a RBM11G My R11e-LTE-US consumes 50ma at peak. Board pulls 60ma idle and 110ma when modem is tx/rx

jspool

So the 15 second hold of the reset button during power up does not engage ether13 for netinstall?

jspool

I assume you already tried the backup loader? -from the manual - If you start holding the Reset button before applying power, it will also load the backup RouterBOOT loader, in addition to the above actions. This may help to solve RouterBOOT issues and give you the opportunity to downgrade/ upgrade ...

jspool

I doubt Greg is including trojans in his files. Most likely a false positive. upload it to https://www.virustotal.com/#/home/upload and see what it finds.

jspool

Anyone else ran into the following? LTE scan does not show RSSI in Winbox or terminal. It would be nice to be able to perform site surveys of carrier and signals to ascertain viability of adequate coverage for sites. R11e-LTE-US on RBM11G still does not work on Verizon unless its set to passthrough....

jspool

I find that CHR runs great on XenServer.

jspool

I understand the use case for port knocking but I prefer using DDNS clients on mobile management devices. Set your routers to allow "ddnshostname.domain.com"

jspool

My question: Where is such a big difference in suggested price, if in the WiFi coverage graph shows that the hAPac2 has better WiFi performance? Thank you for a good laugh. I truly needed that. In all seriousness those new to Mikrotik (This includes those that have possessed a Mikrotik but never re...

jspool

The original hAP AC works quite well. Mixed reviews on the the hAP AC 2. Mikrotik WiFi performance is as sindy stated good but not great. Personally I use two UniFI AC access points at home and use a CCR1009 with passive cooling so I don't hear a fan.

jspool

Netinstall the version you desire.

viewtopic.php?t=130715

jspool

Good catch. Will be interesting to get more details. Unfortunately vulnerabilities are a fact of life these days. For the last ten years I only allow trusted IPs access to Winbox & SSH. Its never a good idea to expose unnecessary things to the Internet in hopes that they will be resilient enough...

jspool

It is an interesting question for sure. Perhaps they could integrate a simplified hotspot feature to limit the session time in a 24 hour span. You should post it in the feature request section.

jspool

I think hotspot is probably the method that's tweakable to your needs. But making your argument based on LED's and Graphs begs the question what are they displaying? LED blinks when there is network activity. This means any activity not specific activity. Traffic graphs also display traffic. Check o...

jspool

I have a RBM11G & a R11e-LTE-US and it doesn't get the correct IP address from Verizon. It takes the gateway IP as its own and as a /32 which obviously doesn't work. It sets the default gw to the lte interface but its gets no Internet since it took the gateway IP and is not sending the default ...

jspool

I have a RBM11G & a R11e-LTE-US and it doesn't get the correct IP address from Verizon. It takes the gateway IP as its own and as a /32 which obviously doesn't work. It sets the default gw to the lte interface but its gets no Internet since it took the gateway IP and is not sending the default r...

jspool

A hAP AC with encryption offloading is my dream. I don't expect it to be cheaper in price or of lower build quality as it is a higher end item and not your average consumer needs encryption offloading. Historically I have learned to avoid any product that has the word "Lite" if I want a po...

jspool

Powered devices connected to a network are generally communicating on the network in varying degrees. How would the router know if your kid is using it or if its a background process using the network? Run a packet capture on your network and visualize the traffic. Generally network traffic is prett...

jspool

Does the script run as the ftp user that uploaded it? If so does the ftp user have the needed permissions to execute all aspects of the script?

jspool

Can you paste your firewall rules? Its hard to help without seeing your rules.

/ip firewall filter export

jspool

The new ltap coming out would probably suit your needs as it has GPS and LTE.
https://www.balticnetworks.com/docs/Mik ... lte_ds.pdf

Maybe Mikrotik will list official AT commands. I have found that quite a few normal AT commands work fine with the R11e-LTE

jspool

The service is something that is either running or not. If a service is disabled then nothing can connect to the router using that service. Also the info from JB172 would drop the traffic from the bot or person that is currently attacking your router. However those rules do not protect you router fr...

jspool

Disable unneeded services & properly setup your firewall. There are many articles that explain the steps. All you have to do is use the search function on this forum or Google it. Basic setup from https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router /ip firewall filter add action=accept ch...

jspool

Verizon SIM pulled from working Pepwave Max BR1 placed in the RBM11G shows up and connects fine. The problem is that its appears to be getting a /32 from the carrier. The Pepwave gets a /30 from Verizon. Both are using the VZWINTERNET APN. When using a /32 the default gw is just pointed to the lte1 ...

jspool

/interface eoip print
check for a "R" by the interface number

Running does not mean its connected to the other side or that traffic can pass. Typically I use OSPF with BFD across the EoIP and it will go up or down depending on the link state.

jspool

/system routerboard upgrade.

jspool

Last I knew it was not possible to SSH from a RouterOS script. You will find other threads regarding this by using the search feature.

jspool

Its always smart to make a backup before upgrading or downgrading. However downgrading or changing version doesn't wipe anything.

jspool

Downgrade to bugfix and see how it works. Current doesn't always mean stable.

jspool

CHR with good server specs & Use src nat instead of masquerade.

jspool

Not sure what a VLAN has to do with anything? Any capable router supports creating a VLAN. You are referring to Cisco Unified Communications which is more of their PBX. Mikrotik does not have a built in PBX. There are tons of OpenSwitch or Asterisk based PBX solutions out there.

jspool

Your latest post clarifies a considerable amount. While Mikrotik can do what you require it wont be point and click like some other brands. Mikrotik is very flexible buy requires patience and time to learn how it works, understand its limitations and then learn scripting to supplement the non native...

jspool

Normally one would utilize BGP blackhole or null route with your upstream provider. also dropping offending traffic in raw table so its dropped before connection tracking.

jspool

You might consider hiring a consultant. You essentially are asking others to do work that anyone qualified would be able to figure out. The forums have lots of relevant data for those willing to learn. You would know the answer to most of your questions if you took the time to search through the for...

jspool

/system leds
set 0 interface=ether1 type=interface-status
set 1 interface=ether2 type=interface-status
set 2 interface=ether3 type=interface-status
set 3 interface=ether4 type=interface-status
set 4 interface=ether5 type=interface-status

jspool

I don't think using the serial number .sn.mynetname.net is a particularly great method either. People wanting to target Mikrotik devices could pound the name servers with DNS request generators and probably successfully generate the serials with the tools that are available for pen testing. It proba...

jspool

If its a metered data plan maybe he can get a different IP. But mobile networks are not likely to offer blackhole routing for such problems. OP needs to understand that he cannot control what traffic is sent to him. That's like yelling at the sky for raining on you. Try a new IP address and run Wire...

jspool

Perhaps your could netinstall it without default config and see if that resolves it.

jspool

Can you try with a switch? Maybe try connecting from another computer running W7 to see if they connect fine.

jspool

I would say drop that IP in the RAW firewall table but from the screenshot you must be using an old RouterOS if you don't have RAW.

jspool

Generally there is not much point in using the local ISP DNS servers. Just set Google or OpenDNS servers or whatever you decide and it will work regardless of which WAN you route the traffic out.

jspool

Have you tried connecting with an Ethernet switch between the computer and the Groove?

jspool

You could use an ASUS router as the OpenVPN client and either use it as router or just route your traffic to the ASUS from the Mikrotik. When Mikrotik finally makes the jump to UDP it will be a milestone. Hopefully UDP will still be around then.

jspool

At times it will heat nearly into the 80C range just from the sunlight, and I currently have no other method of keeping the box cool. Low tech is, sometimes, better. If most of the heat comes from sunlight, why not put it in a shade? It's just light - even a thin white plastic covering it, like an ...

jspool

How long before somebody tries out water cooling a Mikrotik? :D Hm... But also why not try to use heat pipes for removal of part of heat to metallic case of the router? Personally I use the https://mikrotik.com/product/CCR1009-8G-1S-1SplusPC at home which pipes the heat to the rear heatsink. The pa...

jspool

You could probably make a script that monitors your Tx/Rx Bytes and when it reaches the max bandwidth it switches to the secondary.

jspool

Did you netinstall to the msata and then try booting your device? Its likelihood of working probably depends on if RouterOS has the needed drivers for the hardware.

viewtopic.php?t=96883

jspool

So your LTE provider gives you static IP's for your modems?
Do they use CGNAT?

jspool

Why do you have to use OpenVPN? Are you connecting site to site?

jspool

Does disabling WiFi Assist in Settings, Cellular make any difference?

jspool

RDP on a publicly accessible port is spooky. I typically set people up with a VPN and then they can RDP to the local IP of the Windows machine. If the remote party has a DDNS updater app on their device you could port forward only allow trusted DDNS hostnames.

jspool

How long before somebody tries out water cooling a Mikrotik?

jspool

I think you will find that quite a few use public DNS servers and not the ones from their local provider. In that scenario it doesn't matter what route your taking. If allow remote request is enabled on the router the DNS server in dhcp server networks can be the local IP of the router and the route...

jspool

+1 Please

jspool

So discovery is messed up but if you are on the same network and enter the IP address of the Routerboard in Winbox can you log into it?

jspool

While it's nice of Mikrotik to offer such features there are a plethora of DDNS scripts that work perfectly. he.net has free DNS including dynamic records. Setup the DDNS script and place it in dhcp-client script area so that it triggers on DHCP changes and boom its done and its in your control.

jspool

Can this new Windows 7 computer detect any other Routerboards?

jspool

Hope you get it working!

jspool

Its really not that hard to script. I have a configuration server for each model of router. The routers periodically check the version from the device page and if it is different that what they have it fetches the file from the server and installs it. Each router has an onboard script that checks to...

jspool

Anyone tested throughput with IPsec? Curious to see some real world hardware accelerated goodness.

jspool

I would update the PC and retry. Sometimes generic network drivers are replaced with the proper drivers when updated. I have only seen: Windows firewall, virtualbox network drivers, third party firewalls from Antivirus installation & generic network drivers cause issues.

jspool

I know when using the Radius Framed-Pool attribute it work backwards when grabbing IPs from the pools. It would be cool if the IP-Pool had an order preference that everything would obey.

jspool

You think that they make a non barebones that does that natively?

https://mikrotik.com/product/RB435G

jspool

GENERAL TAB
chain:forward
protocol:6(tcp)
dst.port:3389
ACTION TAB
Action:accept
And my remote desktop still not works:( thanks in andvance for help.
Add same rule with chain INPUT -put this rule to the top on filter section !

You don't need to add input rules for dst nat to work...

jspool

Would it not be better to use https to connect???

Save that for the next thread where his router gets hacked and needs to get back in

But seriously glad to hear you got it working and sure its a basic question but we all started out similarly whether we want to admit it or not!

jspool

If you can access it fine externally and not internally that's generally a masquerade issue Typically the default settings will masquerade the LAN traffic leaving ether1. However if you temporarily remove the ether1 from the rule and apply it my guess is that it will work fine. If so you should be a...

jspool

If you mark the traffic from and to your countries IPs using mangle and run it through a queue tree you should see the traffic. then you could mark traffic not going to your countries IPs and queue it to a different queue and you would see that traffic as well. It would be additional overhead for yo...

jspool

Assuming that you have the latest network drivers for your Ethernet card and the firewall is allowing Winbox or is disabled it should work fine. The latest Winbox I believe is 3.12. Sometime pending Windows updates will mess stuff up until you reboot and apply them as well.

jspool

Is your Windows 7 network set to public? If so you can either set you network to private or make an exception to allow Winbox on both public and private. Do you have some virtual network drivers installed on the windows 7 machine? I have seen in the past some network drivers installed by virtualbox ...

jspool

Just setup the desired topics and send them to a remote syslog server. Tons of data out there on syslog.

jspool

Thanks Dave! Its always a battle protecting ones network. The people that use free antivirus would likely be the ones that expect such a service free and the people that understand that you get what you pay for would support a paid service. Personally I prefer a BGP based solution. Since there isn't...

jspool

Is that due to current RouterOS limitation or Mikrotik not embracing blackhole routing for IPv6? It's a little bit of both IMHO. IPv6 in MikroTik is generally very barebones compared to the features they have implemented for IPv4. Yes sir I do believe you are correct. With the volume of IPv6 addres...

jspool

This, - ethernet over powernet connection (500 Mb/s network) Are you using power line adapters to connect to the router? If so your issue is most probably in the connection between you and the router He already stated ---> "Wireless and ethernet cable via the router have the same problem."

Search found 462 matches