MikroTik

joegoldman

Basically my understanding is the OID is assigned when the interface is added using the next index available. This is correct, and Dynamic interfaces are the same but start at a much higher number The correct way is always to walk the whole interface MIB, using the matching name to figure out the i...

joegoldman

However I have these issues and I'm looking for some recommendation to fix it: 1. When the two BGP peers are UP I have two 0.0.0.0/0 routes and ISP 1 its preferred because AS Path is smaller than ISP 2, but I need to force using ISP 2 as gateway for some of my customer segments This is normal. If y...

joegoldman

Yes you can run LetsEncrypt on HAProxy frontend (I have done it) - it is not mikrotik specific and I would suggest asking in a community forum based around those technologies for more in-depth answer. - Make your renew script use local server on custom port - Create backend to that webserver in hapr...

joegoldman

You could do a physical device physically in front of the VMWare Server You could have a RouterOS VM, and set the VM's to a private network that gateways through the RouterOS VM which has an interface both in the private network and a public network. Configuration beyond that would be best asked on ...

joegoldman

In RouterOS its always in 'router' mode, but you can configure things to use the hardware offload. You will definitely want to do this with MLAG, otherwise the little CPU will be processing all the traffic. I have MLAG running on these switches without issue, and it works fine. There are limitations...

joegoldman

They are generally aimed at entirely different segments. A lot of ISPs use Mikrotik but the big boys rarely will because Mikrotik doesn't have a 'proper' support structure (i.e. paid support, warranty, same/next day replacement etc) that big corporate latch onto. Each router on mikrotik's site has b...

joegoldman

Simplest solution is pay the bill so it doesn't suspend. Many of us here being ISP operators probably aren't super keen to help you circumvent ISP suspensions.

Having said that - you could use a netwatch command to change default gateways - not really scripting just run CLI commands on up/down.

joegoldman

OK you have a lot of confusing information. Are office 1 and office 2 in 2 completely different locations? Or are they in same building? If same building, are they plugging into the same NTU (same ISP device) for internet? If they are on separate NTU's - or in different locations, then it is entirel...

joegoldman

Why a single BGP session is providing 2 million routes is concerning - biggest full table I have across sites is just under 1 million, so it seems high. But - if they do not have multiple providers, only one external provider, then generally a default route is a much more efficient way to do things....

joegoldman

Using src-nat instead of masquerade rule, lets you specify which IP you use for outgoing connections (so you'd set to public.ip.12 if thats what you wanted), that will work for NAT and shouldn't affect anything else. The firewall rules are processed in order, so if a packet matches the criteria of a...

joegoldman

WinBox already exist. Yes, hence the pun. The idea was using the aptly named 'winbox' window manager library to make Webfig exist more like Winbox in that you can load more information up side-by-side, vs current webfig annoyance of having to click around different menu items to gather information.

joegoldman

Hey devs, Can you implement WinBox in Webfig? :lol: But seriously I hate webfig for the fact of having to click around everywhere all the time when checking things between 2 sections. The best part of Winbox is having all the data you need displayed at once - if you implemented windows in webfig (li...

joegoldman

Ubiquiti is/has been a big sponsor of theirs, they just grab Mikrotik products because they are cheap and fit different needs (like 100gig where ubiquiti doesn't have anything to compare) On top of that, they have a mish-mash of hardware because they take what they can get for free under sponsorship...

joegoldman

No NAT rule necessarily required, they are doing the ssh session with the mik directly and using it as a port forward via ssh tunnel. To answer your question, you can do firewall filter rules on input tcp port 22, but it'll restrict normal SSH access, there's no way to differentiate between an SSH c...

joegoldman

I'm not sure I am understanding the problem, you are learning the OSPF route via the ovpn tunnel sure, but it comes at higher distance and is not currently Active in your screenshot, so shouldn't be getting used at all. Or does it sometimes become the active route? Either way, you can filter out def...

joegoldman

Moving up a major version in production is a terrible idea, you need to do this in the lab and research what these things mean. In winbox you can hover over the flags and it'll generally tell you what they are in a tooltip. I can't find anything in the docs about H personally though, but my guess wo...

joegoldman

If you're gateway still has 192.168.1.0 in NETWORK setting it may not work. The subnet/network is 192.168.0.0/23, 192.168.1.0/23 is not valid, but an address of 192.168.1.1/23 is valid - best thing to do is probably post your config export so we can see if there's any misconfiguration on your networ...

joegoldman

Email support@mikrotik.com, they should be able to help you.

joegoldman

unfortunately the BSD kernel is often forgotten / lagged behind the linux kernel so it wouldn't surprise me if its close but not working. Perhaps email support directly to try get more specific help. I used to use FreeBSD everywhere and got over the management overhead of generally older binaries or...

joegoldman

You've been given the idea, use documentation to go have a go yourself. If you'd like someone to consult for you reach out to some consulting businesses so they can provide config for you to use.

joegoldman

Hello, You have to pass that vlan also on peerport in order to have that redundancy: see https://help.mikrotik.com/docs/display/ROS/Multi-chassis+Link+Aggregation+Group the example is done with vlan1, but in your situation you can add vlan 10 (it is needed to be tagged) Best Regards, Diego Hrmm you...

joegoldman

It’s not always welcome but when I read scenarios like this I like to raise some questions to make sure that what’s possible is the same as what’s wise. Using cheaper switches (like Mikrotik) to act as port expanders for expensive ASR ports makes sense, but what exactly is the goal of bridging the ...

joegoldman

Hi, Consider the following: Router1->LACP->MLAG->sw1/sw2<-MLAG<-LACP<-Router2 So redundant core, 2 routers MLAG to a set of switches. All ports are in the same one big bridge. The goal is to plug single handoff providers into 1 of the 2 switches. So say ISP1 plugs into sw1, port 5, VLAN10. To access...

joegoldman

It will most definitely be a config issue (or obscure software bug). People are running multi-gig through these boxes.

Post your /export and people can critique the way you've done the load balancing etc to see if you aren't just hitting the limit of 1 connection or something.

joegoldman

I'm 99% sure that will be the fact of the ISP limiting one connection per mac. Good way to test, rather then send one into the switch, plug it directly in to another port on the router (or route the VLAN to another port on the router) so you end up with a different client mac. VLANs don't get their ...

joegoldman

Switching looks fine. It should be untagged on the ingress ports from the ISP's, tagged on the egress port to the router. Are the 3 ISP links using: 1) Same ISP? 2) Same Username? 3) Connecting to the same PPPoE Server somehow like a vISP setup? (Do you get the same service name on each pppoe client...

joegoldman

RB3011 likely OK, RB1100 even better, then start moving into cloud cores. You'll have to do some research on mikrotik.com through the different offerings.

joegoldman

I've been watching the cpu for a long time and it never goes above 40% on any of the cores. I was even doing speed tests on Speedtest.net and it didn't even exceed 60% in any core. You could still be hitting a bottle neck (on a single core). Try backing up your config, or if you have 2nd of same de...

joegoldman

That's a pretty complicated setup in terms of CPU load. When doing your speedtests is your CPU at 100%? You have a lot of mangle and a lot of queues, this means nothing will be going via fastpath and everything will be going via CPU, which will heavily bind your available speed. With a complicated s...

joegoldman

the data in the graph itself appears correct comparing 1:1 (webfig vs basic page), it may just be a visual time bug. I can assume the time is set correctly since webfig looks correct, but maybe try re-setting the time (timezone is correct, us an NTP server) and if that doesn't help see if its still ...

joegoldman

RB4011 wifi model is great home router - use it at my house. Multiple VPN's, a few WAN's totalling about 1.3gbps, complex firewall, mangle, and queue rules. No slowdowns.

joegoldman

As a network professional, you have to realise that there are compromises. Restrict only devices you have full control of OR; understand every block has a workaround. This is a FEATURE. Not a PROBLEM. The same things that help you control devices are what essentially protects private devices. You ca...

joegoldman

blocking VPN on public hotspot is also a bad idea - people use VPN's for legitimate reasons when using public hotspots, for things like banking etc. Best solution if you are afraid of people using too much of the hotspot - is time/data based limits or some kind of PCQ config so one person can't netf...

joegoldman

You can block certain ports, but then SSL VPNs use 443, certain destination addresses but have to maintain an ever changing list etc.

It is a game of whack-a-mole. There's no overall solution without beefy DPI and mitm decryption.

joegoldman

You will need a properly assigned public AS and a properly assigned public IP space from your regions NIC.

joegoldman

/ip dhcp-server network add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24 add gateway=0.0.0.1 add address=192.168.10.0/24 gateway=192.168.10.1 I believe these work in order of operation - and if that rule is first it will catch-all and try give a gateway of 0.0.0.0 - which will never work. M ove th...

joegoldman

There's no IDLE detection on winbox sessions, but you could essentially have a script that enables a firewall rule for the winbox port for x seconds every y minutes - clunky in that you could kick yourself off in the middle of a job, and possibly lock yourself out of winbox (assuming you have a 2nd ...

joegoldman

Not to help your question but also help anav I use pref-src with my loopback IP for most things. Consider my sites are as follows Internet<-->10.0.0.1<-->10.0.1.1<-->10.0.2.1<-->10.0.3.1<-->Customer In a normal scenario of customer tracerouting to internet, you'd see the IP respond on the interface ...

joegoldman

When you open Terminal, it shows as telnet login (in v6, in v7 it's "local"). So it looks like you have saved session with many open terminals. It's definitely this - if you have autosave session on (which it is by default) and as you go instead of looking for your old terminal window beh...

joegoldman

Another thing to consider is that the CCR2216 supports up to 8k NAT entries in hardware offload - where there's 8k+ IP's in a /19, and you want 2 connections per IP being 16k+ NAT entries... ... So once you have to start processing in software, it may limit your ability to reach 100gbps. This might ...

joegoldman

The switch is completely separate vendor and device to the mikrotik and there's no reason the mikrotik would be able to manage the switchports. The switch menu in your mikrotik refers to the 'switch chip' the one ethernet port is using to talk to the CPU etc. You would not be able to achieve what yo...

joegoldman

A PCQ configuration would do what you are after - specifically with a pcq-rate of 0 and max rate of 10mbps, should mean it shares it around equally as more users try to use the queue.

https://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ

joegoldman

No, it will only block traffic that has destination IP in the blackhole route. So a) wouldn't acomplish the intended goal and b) will block all internal traffic Internal traffic being traffic not going to the internet.. Because the routes are the supernets - what will actually happen is if there's ...

joegoldman

RouterOS DNS implementation is purely for relaying, i.e. a client DNS - it caches, you can force some static rules but it is not suitable for nameserver or actual hosting. You could 'almost' hack it by not having any DNS servers configured for it to query, then just static entries, so non-existent e...

joegoldman

Mikrotik can not listen and route on HTTP Headers. The general consensus to do such things is to host a small webserver behind the mikrotik that 80,443 is forwarded to, and that server itself either reverse proxies to the internal resource, or has a redirect with the correct port number. This 'may' ...

joegoldman

The other option is partitions, depending on the model of router you have you can partition the disk and have different versions installed to different partitions (and even different configs), set a primary and a failover partition based on watchdogs etc. I've used it successfully before when worrie...

joegoldman

The downside is that with this scenario I'm not able to manage my ppp connections through pfsense (unfortunately because of the regulations in my country I can't have access to mikrotik router directly so everytime I need to change my ip I should hard reboot the router!). My main goal is to have pp...

joegoldman

Rules are processed in order of placement in the list, but also by chain So if the chains are intermingled think of it as if they were squished together but in the order it shows In your example, the top return rule would jump back to the original chain straight away, you want it to go through the r...

joegoldman

A VRF has its own route table, each route table is technically its own VRF in Mikrotik world. How you use them can be very flexible in Mikrotik world, can use them like standard VRF's or with things like mangle rules to force traffic into the 'VRF' or use different route table (mark routing) by traf...

joegoldman

the endpoints of ppp are defined inside the protocol itself and the /32 installed (whether you install a default route to the other end is up to the client though) having said that, Mikrotik can install the route via interface declaration vs endpoint IP - which although they have same endpoint IP wh...

joegoldman

That UUID is OS specific and not used in network connectivity - it is actually specific to NetworkManager package and not all systems assign UUID's to connections - that is a unique identifier used for that piece of software to link to the connection and is for internal use only on the machine. It m...

joegoldman

Which UUID are you trying to find? In network world, "UUID"'s are different per layer of the network stack, Layer 2 = MAC, Layer 3 = IP etc If you are looking for the devices MAC you'd need to look in the ARP table (or DHCP Lease table if you are running DHCP server) Otherwise you'd need t...

joegoldman

Each entry counts towards total entries, so the "Duplicates" count each one, it has to build ARP entries for every VLAN as they are each considered a separate LAN

joegoldman

The PPPoE connection actually establishes the IP's on the router so you don't have to physically run any of the IP's for Local (or Remote) in /ip address as they'll get dynamically added when the PPP establishes. You can have 1 profile 1 Pool Then 1 'PPPoE Server' per interface When users dial-in, P...

joegoldman

The management services in a VRF is only a new addition, its likely they haven't done RADIUS yet and might be something they do in a future release. They call 7.1 a stable release but it is not fully featured yet. The better recommendation is to run management via vrf 'main' and use extra vrfs for c...

joegoldman

hello
mainly i want to sync all ppp from mikrotik to mysql using php and mikrotik api
thanks

What is the end-goal you are trying to achieve? your explanation so far leads many different ways without context, post your ultimate goal so we can help with the ultimate solution.

joegoldman

Yes, you can already do all of the above from the Winbox loader File -> Save As Tools -> Move sessions folder You can even keep the folder on some dropbox and load it from multiple PCs Thats a fundamental difference to my request, that moves just the .viw files not the actual 'Managed' tab database...

joegoldman

The VDSL SFP cards duxtel sells are NBN compatible (even with the new DLSAM firmware rollout I believe, you may need to manually flash it though) Alternatively you could potentially run the TP-Link in bridge mode so it just does the demodulation and passes the L2 link through to an ethernet port on ...

joegoldman

So i know that you can export/import winbox databases. This is not that. There are a few aspects of the idea: 1) Define where the database lives - this allows a central filesystem location that we can sync with things like Dropbox, Onedrive, Nextcloud etc - This woul dbe good so I can add a router o...

joegoldman

Half of Mikrotik staff using MacOS and Linux, and yet is there still only Windows version, I don't get it, I don't get it at all... Because it would require a full re-write, for something that works perfectly fine in WINE, also offering WebFig which is OS independent GUI. If they ever got to a poin...

joegoldman

According to this compatibility matrix it is only partially supported, but the new documentation system does not seem to have any section for v7 configs. My guess is the config is CLI only and only some features may be working. My suggestion would be to stick with v6.x until v7.x reaches feature par...

joegoldman

I have template scripts that do the bulk of the work for new provisioning, but updates etc tend to be winbox gui - just really helps for multi tasking and having visual reference to objects and things you are doing in different parts of config like bridging and interfaces side by side or ppp and que...

joegoldman

Your best bet for this is wait until docker is stable and you move to ROSv7 - run a full DNS server in a docker container.

joegoldman

I dont understand why talking about a product is bad after all this is a forum to discuss its not about promoting here its about discussing issues and questions so making a statement like i will never trial your service is ridiculous and forgive me if I’m wrong but brand awareness is key A thread h...

joegoldman

Yes it should be technically possible - although the time to realise one connection is dead still might be enough to kill 'connections' in the sense of active open connections - but to the world you'll always be 1 public IP address (the CHR)

I can certainly help if you'd like to provide me a contact.

joegoldman

News letter has a typo - OSFP at one point - looks like its just as QA'd as ROSv7 :D

I'll be waiting a fair few releases before even considering this. Its not even up to feature parity with v6 correct?

joegoldman

So I tried this. I am now advertising a /24 to Pineapple and the full /22 to Lemon. Yet, Upstream traffic goes via Pineapple, Downstream traffic comes in via Lemon. It is entirely possible that Lemon summary route back to customer routes, or don't accept customer prefixes in at all via Pineapple/IX...

joegoldman

No. you said 45.45.0.0/16 is Lemon so not sure why you are filtering them. If you are 46.46.46.0/22, you'll want to have: 1) Filter to lemon, that only allows your 46.46.46.0/22 route at prefix length 22 (or don't define prefix length) 2) Filter to pineapple, that allows your 46.46.46.0/22, with pre...

joegoldman

Just good practise - for the one time you do accidentally expose it or some kind of attacker makes it on the trusted side of the network. More like security through obscurity. But I can't deny that to some extent it works. Security is like a puzzle - every little piece comes together to make the fu...

joegoldman

Btw, what's the point of changing WinBox port when it's not exposed? I get it when it is, it's cheap trick that helps to not get attacked by botnets almost immediatelly. But over VPN, when it's not reachable anyway? Just good practise - for the one time you do accidentally expose it or some kind of...

joegoldman

Ultimately you can not control how other networks route traffic from your network. In general, a provider will always prioritise customer routes highest, then IX, then transit. In this case, you are customer, so you would be higher priority than the IX routes. It also commercially makes sense becaus...

joegoldman

Can you go a post WITHOUT mentioning your own product(s)?

This forum isn't your personal sales pitch. In fact, your shameless posting and baiting viewers to your site has influenced my decision to NEVER trial or use your product.

joegoldman

To answer the more real question - as the same problem exists for l2tp (my logs fill up all the time people trying to connect) You can definitely put a whitelist on using an address-list for accepted clients, then only allow connections on TCP/1723 from src-address-list of that whitelist. Or what I ...

joegoldman

i have no mikrotik device

This is mikrotik forum, go ask vendor or users of the devices you own.

joegoldman

We can't tell you the specifics of your network - this is for your network administrator to help you with. In a basic sense, whatever IP's are given out by this new mikrotik either needs to be NAT to your main or 'parent' network, or your router on your parent network needs to have a route back to t...

joegoldman

Without a full export/supout to know how you are marking packets and how you are using the tables... its likely an inbound packet is using the main table, and whatever the default route is and/or its pref-src is set to, is what it'll respond with. You have to create mangle rules to also tag packets/...

joegoldman

This looks more like a switch config - routers are very different. SwitchOS has similar style of VLAN management. RouterOS has very flexible options and management interfaces (winbox, webfig, cli etc), and GUI's like this are very restrictive to keeping that common style between the management inter...

joegoldman

Get the ranges property and extrapolate from that, detect if its CIDR notation or x-y notation and then you can do the maths from then to figure out pool size.

joegoldman

always.take.backups.

Reboot might help if the management interface just gone wonky.

You might be able to pull a config through the boot menu but I don't think you can.

You'll likely have to reset and reconfigure.

joegoldman

Antenna's and enclosures are almost always about specific dimensions and shape for rated performance - there will 100% be a reason for it to stick out like that, to help shape the beam either for transmit or receive. It might 'work' without such a big cover but it might not work as well.

joegoldman

A mandatory pre-requisite for this to work is that none of the ISPs cares about source IP addresses of packets coming from the client...snip In this particular instance using NAT only this is not my experience - I agree it could/would happen this way in non NAT situations but essentially as the con...

joegoldman

Thats funny, never seen load balancing for dual wan setups or more, without mangling. I use my example without mangles just fine, even for a national ambulance service headquarters. I use mangle for inbound establishment (port forwards, VPN etc) to make sure return traffic remains on the same WAN -...

joegoldman

But I need this limit only for one user...rule number 1 will limit all users...

Adjust the rule to suit your needs.

joegoldman

You won't be able to get one user able to use 35mbps without a LOT of work/costs and varied results. If you just want to load-balance, use both at once, its simple - you can add your default route with multiple gateways in an "ECMP" style like this: /ip route add check-gateway=ping distanc...

joegoldman

See the NAT Wiki using the connection-limit option - a bit of syntax explanation can be found in this thread . May take some tinkering to get exactly what you want and using a multitude of rules you should be able to set rules 1) dst-address 0.0.0.0/0 with connection-limit=5,32 meaning it only allow...

joegoldman

You might be able to use filters to adjust distance on one vs the other imported route - as changing the interface cost will affect both. Alternatively, deliver both PE's on a separate ports, or if it must remain single port, split it out in VLANs, this way you can adjust the cost of PE2 slightly hi...

joegoldman

it is likely to be /ip cloud service - disable all of that and you should see it go away.

joegoldman

That is based on what the client sends back to the DHCP server, you have no real control on it on the server side - if you have control over the devices, you should see about configuring them correctly to give the hostname in response. Most I see in general do but some definitely don't. What you can...

joegoldman

He provided only example rules, it would require you to modify them to suit your situation.

You'd likely need to post your full config and provide extra information so someone can craft the rules specifically for you.

Use /export hide-sensitive to provide your config.

joegoldman

ALL the interfaces? Including physical ethernet ones? If so - if it is a device with console access, you'd have to go through that. Failing that, capture netinstall/routerboot menu usually through ether1 (again this depends on model) which may let you pull the config but without console access to re...

joegoldman

This Wiki will tell you how the filters work.

BGP routes do not carry 'hops', but using bgp-as-path-length you can calculate the how many AS's in the routes path and filter based on that.

joegoldman

Do you mean Netflow by always exporting file and looking what happend in the past? Am I asking to much to allow Tools/Graphs for IP adress? Why mikrotik never thought about it????? Why only ethers are allowed to see the graphs?? I dont know how they think.... Because you are now asking them to buil...

joegoldman

Mikrotik management services listen on all addresses by default.

What will be stopping access is either IP ACL on the service or username itself
OR
Firewall rules blocking access to anything but specific IP's

Post /export hide-sensitive so we can help determine what the issue is.

joegoldman

You can definitely do this on torch for real time, use the interface that the LAN gateway IP resides (usually bridge or master port), and untick everything except dst address (or src address depending on flow of traffic) and you can see the cumulative data used by each IP in instant real time. You w...

joegoldman

Place either the transit or management on a separate vlan so their packets aren't captured in the bonding interface, but rather processed on the separate sub-if.

joegoldman

I have wanted for a long time to be able to move winbox working dir - I'd like to figure out a way to sync my managed lists database between devices without scripts or copying (using something like Dropbox or Nextcloud. THe session folder is just the .viw files so unfortunately is of little help.

joegoldman

You can use ppp profiles to create on-up and on-down scripts. on-up script has a variable passed in for Local Address (Address assigned to the interface) as '$local-address' So it'd be something similar to this (untested): /ip firewall nat set [ find comment="PPTP UPDATE" ] to-address=$loc...

joegoldman

Bildschirmfoto_2021-10-03_11-59-20.png So that looks fine at least, right? The config is fine - its obviously being set by ntp - but the curious point the other poster was making is that the boot time is always the same to ~2 days ago, all your 'reboot without proper shutdown messages' default back...

joegoldman

What I need is that in On down the secret of the user is disabled for 20 seconds. Something like: /ppp secret disable ; Timeout 20s ; / ppp secret enable . But I don't know how to do it so that it applies only to the user who logged out. I gave you that script (just without testing) in my post abov...

joegoldman

Have you applied a license? I believe CHR will only route 1mbps or something very low without an applicable license added.

joegoldman

The problem is that many ont's restart up to 10 times in 1 minute filling the mikrotik with pppoe requests, I would like to make the secret of the user when detected in DOWN state is disabled for 10 to 20 seconds until it is valid again. I mean a script on the pppoe server. But I do not know how to...

joegoldman

If you are trying to avoid one username logging in multiple times (-1,-2 interfaces) then you can use 'One Session Per Host' option in PPPoE Server, so if there is an active user with that username logged in already (or still timing out) then they will be refused login. Alternatively on the ppp prof...

joegoldman

It looks as though it is a hotspot login for anonymous user / guest user when guest/trial accounts aren't enabled. If its still in your buffer, open it in webfig or winbox and get the other topics listed on the log to know where its coming from, but generally a services login says failed to login vi...

joegoldman

cAP uses 4W max, meaning max 4 x 21 per switch. That is about 84W + losses, which I factor in as 20% max on a good wire, so ~ 100W. Yes, the older 2.4ghz only cAP only uses 4W, if that is the model you are implementing then 100% your calculations are correct - mine above are with accounting for 13W...

joegoldman

I use ubiquiti EdgeSwitch as a decently priced alternative - however 20+ cAP's on a single switch has a max power draw of over 500W (not including the power the switch needs), you can obviously account for much less continuous but if you are playing safe you'd have to go up to 48 port 750W versions ...

joegoldman

The services bind to 0.0.0.0 - meaning any IP address locally on the device (sans IP's in different VRF - which is annoying but totally separate issue) Your problem here appears to be two-fold - in the current export you've provided, you only have 2 IP addresses: /ip address add address=192.168.2.99...

joegoldman

You can never truly control how traffic gets to you, if you provide multiple paths - but the more successful way is definitely via more specific prefixes. You say you have a /21 - so advertise 2x /22's via ISP A and just the /21 via ISP B - a more specific route in pretty much any route table takes ...

joegoldman

is that on backbone area?
As far as i know filters doesn't work on that area

Yes it all runs on a single area.

Why wouldn't filters work on backbone thats weird - i use ospf-in extensibly to re-write the pref-source without issue - do you have source on this? I can't find it in the wiki.

joegoldman

Is https://hub.docker.com/r/frrouting/frr supported? Because it supports protocols that RouterOS doesn't? As someone else alluded to - it runs contained so it won't affect the RouterOS routing table directly, but you could use a diff protocol to talk between your router and container, then the cont...

joegoldman

I printed it years ago before switching off the server due to office reorganization. It was standard small factor form desktop, not a "server beast", sitting under the desk on a box of drawers. This piece of memories is still on my pin board. If we going server / non mik uptimes - my bigg...

joegoldman

Hi forum, I have a router that gets a connected route via ppp which is pretty standard. The issue is its redistributing that route (as connected route so lower cost) to other peers - its just a router ID so it does not affect customer traffic but causes weird issues and traceroutes when we monitor b...

joegoldman

HAHA omg the first docker im going to use is likely to be.... ....unifi controller! This is actually super handy. Clients can have unifi controller in the router - maybe small pbx if required Bottom of tower can have local nagios,cacti or other monitoring tools Self hosted dynamic hotspot login webs...

joegoldman

The bridge is not needed. Each port has it's own network... if you may, amigo. how do I get rid of hEX ports 3-5 from slavery? is there a special script to convert them to nothing or something away and send them to their freedom? this is 2021 for heavens! If they are not part of a bridge port - the...

joegoldman

What does your NMS say? You should be able to look at your netflow stats to determine what the excess traffic is, or just torch the interface see whats happening that is not being forwarded to ether4. Likely dropped/queued packets or traffic to unused IP's in a subnet you are using but not actively ...

joegoldman

Hmmm... no answer? Impossible? You can have multiple servers - but if both are required for 'wireless' i'm not sure you can specify which wireless network uses which server. My solution - if NPS supports it (have only used it a little bit) if all rules / policies fail/dont apply on the new server ,...

joegoldman

When you have a larger link and a smaller one, just make point-to-point VLAN on the larger link, put IP, advertise the network in OSPF and it will do ex 75 / 25 Thanks for the tip - seems hacky and annoying (and will waste IPv4 since i still use that on my ptp links, but might change this to privat...

joegoldman

I answered this for myself with a solution that I didn't think would work based on an article i read. Basically matching the cost at the originating router will automatically trigger ECMP (50/50 split), my understanding was it also took into account router hops for ECMP but it doesn't, just cost - s...

joegoldman

Current highest in my network is 465 days. Its in a site we are not allowed to get easy access to - but it is firewalled out the wazoo (running 6.45.5) - most of my others have been rebooted either due to upgrades or power issues I think the next highest is about 100d.

joegoldman

No, you can't control what IP it has if its not listening for DHCP, so you could try broadcasting DHCP and see if it picks one up?

You can add an IP in common subnets and do an IP scan to see if it shows (ICMP or ARP)

You can google the device and see if its noted down anywhere its default details.

joegoldman

There are many options - depending on how you want to use your resources. You can setup a LAN, using gw address in the block and hand the rest out having all the 3rd party routers in that LAN You can use a system like PPPoE and hand them out on the ppp interface You can use private IP addresses to '...

joegoldman

Hi Forum Say I have a triangle of sites - internet comes in to Site A and distributes it to Site B and Site C Site C and Site B also have a link between them in case a primary link goes down. Site B is significantly larger than Site C - so we are using a lot of bandwidth on Site A <-> Site B - I'd l...

joegoldman

I keep hoping that one day MikroTik will put all winbox functionality in webfig so that we can maintain our routers without having to install winbox. A separate service program (available for Windows and also native for Linux and MacOS) would serve as a relay for MAC access and Netinstall functions...

joegoldman

Thank you, yes the CSR is kind of already coming to its knees with just 200mb of traffic. I would have actually used port isolation if it was port, but this being VLAN i cannot use that. I want to test the VLAN under bridge, is there any example related to what I want, I tried looking but nothing s...

joegoldman

Only worth moving to v7 if there's a feature you absolutely NEED for some reason - even then its a silly idea. I'll be on 6.x LT releases for probably quite a while (like 7.10 stable) - as also with the fundamental changes in a lot of the logic and objects, it'll be a 'whole network migration' plan ...

joegoldman

You are essentially creating a CPU bridge and plopping the 3 physicals and the 3 VLANs into one 'broadcast' bridge together - this requires CPU access and is more a router functionality (of which the CRS series has very basic routing power) You want to only add the physical interfaces to a single br...

joegoldman

This is a great update! Being able to re-organise columns and the new column selector is a godsend! Along with the windows option for those busy busy troubleshooting sessions. I have asked this before, and had it previously working - but is it possible in the main winbox view to have 'show categorie...

joegoldman

If its a default config device - then you'd log in with admin and <blank> password (i.e. nothing) If its an already setup device, you would need a username/password that works to login and change the password of another user (or your own). If neither of those options are available to you, then you w...

joegoldman

I ment why does OP want to deliver not using the /29 Ah ok. Because it would be wasteful. /29 has 8 addresses 1x Network 1x Broadcast 1x Gateway = 5 Usable addresses He would then need to bridge all customers to use same gateway assuming they'll all connect to same router - or extend L2 to other si...

joegoldman

Why? Depending on the situation and config - it is possible that one of the routers will respond with the private addressing and if you are outside of that network, you won't receive that reply as its not 'routeable' to you - its small, and just shows a blank spot within the traceroute (traceroute ...

joegoldman

You can split the /29 into /30's - but you'll only be able to serve 2 customers that way with network and broadcast addresses. You can kind of use /31's very hackabout - but again still only 4 customers. You can use a point-to-point protocol like PPPoE to establish it You can use private addressing ...

joegoldman

Yes possible, using 'dst-limit' on the 'new' connection state in ip firewall filter or an old, long way is to create staged address-lists with short timeoutes. Management stuff - as rextended suggested, is much better over VPN with maybe some kind of port-knock system to get in - in those rare insta...

joegoldman

Work on 6.x has stagnated, and work on 7.x is a BIG job. It'd be hard having your development resources split between 2 large projects. Alongside that - real world issues like you linked along with chip shortages and pandemic in general causes the whole world to slow down realistically. 6.X is mostl...

joegoldman

Given its age - i think your better option is to backup the configurations and rebuild it fresh - Given the age I'd say there's a few steppings you'd likely need to take as latest might not support full conversion from something so old. If you understand the config enough then I would take the expor...

joegoldman

What does the Andy-out filter look like, do you have an allow rule for the default route or a deny rule that'd count it out?

joegoldman

more along the line of the dimensions 90x60x20mm. At that size - no. Not without looking at the bare boards and finding/making your own enclosure. That said - if hAP Mini serves your purpose - just turn the wifi off. The standard hEX case is used by many models and is their default 'compact' case a...

joegoldman

What does your ip route show for that particular route ? Does it specificy a bad src-address? Torch the interface without a src-address and see what src/dst its trying to use.

joegoldman

In any case, the comment was made in response to the claim up-thread that "the EXE will have to contain the username and password". The SSH executable doesn't contain user names or passwords, and as we've seen, there are ways to protect its external key. The ultimate idea behind the comme...

joegoldman

Thanks. Not very hopeful on it being any time soon since v7 has been in the works for years now :'( Mikrotik spent years putting the groundwork in place, building the framework for the new routing engine to ensure it would scale and be easy to maintain. They also hired a bunch more developers. You ...

joegoldman

Thank you. I'll try that. I'm still curious why my way did not work. Is that address reserved for them? Did it pull a new address from DHCP before midnight? What does the rest of the rule say? Might be some other matcher. Use /export (or /ip firewall filter export) to get the exact config of the ru...

joegoldman

Depending on the devices you need to support, you could always base it on /system routerboard model - from which you can pre-program on what to do for that model. This could be a bit more tedious if you are supporting a LARGE amount if different models but if its between 2 or 3 then its not bad.

joegoldman

There's unlimited number of port configurations. You'll almost always never get the exact port config you need - but why would you ? what about growth? What if your 2 camera system turns into 4? Or VoIP phones wanting PoE? You have a minimum requirement - and you should look at a future minimum requ...

joegoldman

My goal with the wide netmask is to be able to identify devices by IP address quickly. I want to assign my WAPs and my gateway router: 10.0.1.1, 10.0.2.1, 10.0.3.1, etc. In conjunction with this, I would like to assign IP addresses via DHCP depending on the WAP that the host attached to. So if it a...

joegoldman

If you lose connection, how do you expect safe mode to remain activated? We are asking for a way to 'resume' safe mode by reconnecting after loss of connection. A more simple example: Say you are helping configure a remote CPE with new username and password in PPPoE, you are connecting via the WAN....

joegoldman

How are these last packets routed once delivered to these equal-distance default route ? Whichever route is currently Active - and likely it is the first to be installed assuming all same distance, scope etc. There is a way to do ECMP by having the gateways in the SAME route if that is what you are...

joegoldman

My main guess would be - is traffic building up overtime causing congestion on the link? MIkrotiks can run a vast array of services if not secured correctly will end up being used for amplify attacks and other things. A copy of your config may help us - but I'd be checking throughput on the ppp inte...

joegoldman

Home app - goes thorugh nothing to do with WAN setup. What if its PPPoE? Does this just purely rely on a DHCP WAN? For any kind of funky setups, surely you need the normal MikroTik app, where a lot more options are available. This is for home users with no configuration needs. PPPoE is still widely...

joegoldman

You can use ppp interface instead where it uses interface name - you can cross reference session by caller ID from ppp active via ppp interface to get interface name then reference that to simple queues.

Best way to do it depends on what you are trying to achieve.

joegoldman

Home app - goes thorugh nothing to do with WAN setup.

What if its PPPoE? Does this just purely rely on a DHCP WAN?

joegoldman

I assume you are using L2TP because you are traversing many networks and want to create a single-hop tunnel? If so - the performance issues could very well be any network from source to endpoint of the L2TP tunnel - and may not reflect a configuration issue at all. Is the poor performance also shown...

joegoldman

It probably needs some testing - it isn't clear if that setting adds a realm / user domain if none is present in the username, and/or will direct requests for a realm / user domain to a particular server. It adds it as an extra domain attribute for Windows servers that require domain validation (fr...

joegoldman

Mikrotik supports RADIUS. FreeRADIUS talking to G Suite is not in Mikrotik's purview - if there is a problem, and you know that FreeRADIUS to G Suite is working, you need to debug why Mikrotik to FreeRADIUS is not - you can set Mikrotik logs down to debug level for Radius and see the raw radius pack...

joegoldman

What people tend to forget - VPN interfaces are L3 interfaces not L2 - dialing in is not the same as plugging into the local network, the L2 protocols are largely lost. Things like proxy-arp help, so the router is doing the work for you, but beyond using tech like vpls or eoip, you have to consider ...

joegoldman

Hi this is your personal google service: https://wiki.mikrotik.com/wiki/Manual:Queue There are two different ways how to configure queues in RouterOS: /queue simple menu - designed to ease configuration of simple, everyday queuing tasks (such as single client upload/download limitation, p2p traffic ...

joegoldman

Looking at the repo its just running winbox.exe in wine anyways - just seems another step in the process (or you might find it easier for you). Winbox runs pretty much perfect in WINE - there's little to no reason to port it to a cross-compatible library for *nix. There's also WebFig if you struggle...

joegoldman

If the ISP says no, then no. Sure there may be technical compatibilities - but more goes into it then that. Their provisioning and other network tools may be based around using their own GPON device (GPON on NBNCo in Australia, the national network, requires their ONU for provisioning and then hande...

joegoldman

https://prnt.sc/12vfby3 https://prnt.sc/12vfcdd https://prnt.sc/12vfd0w https://prnt.sc/12vfdb3 When i make for example port 800 i can ofcors enter webpages normal but my host is like xxxxx.ddns.net:800/owncloud Read my post above - this is a web server configuration error. You say yourself the sit...

joegoldman

@joegoldman are you using foxpass? No I am using Radiator on a cloud hosted Dedicated Server in a different country from most of my routers. You can run debug radius log to get the packets being sent and any received to really drill down into the problem (And do the same level on the cloud end) thi...

joegoldman

What are you trying to use the radius client for? Hotspot, PPP, Local Auth etc? Provide an /export (or at least /radius export and config of the service you want using it) so we can help. Personally I connect all our mikrotiks to a 'cloud hosted' Radius server in a different country for ppp auth wit...

joegoldman

I wanna finish with "myddnsname.somethink" now its work on myddnsname.somethink/owncloud This is to do with your Raspberry Pi / OwnCloud installation. It is not recognizing the URL as a host-header to point to /var/www/owncloud (or wherever its located on your Pi), but likely being caught...

joegoldman

A multitude of reasons:

https://wiki.mikrotik.com/wiki/Manual:I ... AN_tagging

joegoldman

Another option is port security depending on what switching you are using - where you restrict MAC down to the physical port on the switch, so they'd need to spoof and repatch/move desks.

joegoldman

You can use simple arithmetic operators on returned values i.e. bytes -> kilobytes is divide bytes by 1024 (( [bytes] / 1024) for instance), where 5120 bytes becomes 5kilobytes, continue up the chain by dividing 1024 t o get to desired value bytes / 1024 = kilobytes kb / 1024 = megabytes mb / 1024 =...

joegoldman

Mikrotik supports OVPN server - but only supports certain parts of the spec, so you'll need to read through both documentations to get configuration right.

joegoldman

the master does not have connections synced from the backup router yet! Great post and explanation! THis is the #1 reason I had in my head why it would be that way but great to get confirmation. To address OP's situation -w hich I assume is NAT Even though the connections are synced to the 2nd rout...

joegoldman

as some of the users in the home where this is being used complain about their internet suddenly going out, which tracking might help a little with.

No - tracking won't really help a notice-able amount. I'd fore-go it and use preemptive mode.

joegoldman

Mikrotik explicitly state that pre-emption mode must be off for connection sync as it currently stands - unknown if this is a temporary limitation or not. But - it looks like you should still be able to use priorities etc to force master back to being master (which I thought was VRRP default anyways...

joegoldman

IDM is still just a downloader - it may just chunk it out and try get multiple streams going - which can help depending on features of your firewall or ISP in what they might do for rate limiting (PCQ etc) A lot of variables at play here, and you'd need to isolate down to which device/port/portion i...

joegoldman

If you have Static IP hand-off, you could try pinging your gateway as netwatch, which shouldn't be pingable if internet was to swap to other router The problem with this is, the gateway would always be powered up and pingable even when the internet is down (hurricane knocks out outdoor fiber lines)...

joegoldman

You'd have to put some checks and balances in there. This is why I said it is setup specific. If you have PPPoE - you could try using on/off scripts in the ppp profile section so a script is run as PPPoE Client goes online and offline. If you have Static IP hand-off, you could try pinging your gatew...

joegoldman

While the Mikrotik template comes with an interface graph - you can use the cacti inbuilt NET-SNMP templates for interface counters too which do include Megabits per second (in 64bit as well). All my interfaces are using the default cacti SNMP graphs - and I use the Mikrotik template to get stats fo...

joegoldman

Depending on how your internet works - probably a Netwatch script that then modifies VRRP priorities to force the other one to take over Master

joegoldman

Out of curiousity, how are the "real pro" handling this when you have hundreds of devices to maintain ? All by custom, self developed scripting ? I have self-developed scripts to help with management - but I wouldn't be closed to an application like Cloutik that you linked - but my requir...

joegoldman

You could do the same, by essentially running a VPS and having all your mikrotiks VPN back to it or send info / run scripts. Its putting control (And a lot of information) in someone elses hands If you are having large outages - then its useless Cost is not great - website is poorly made which doesn...

joegoldman

You can just disable ALL rules in /ip firewall filter - as a stop gap to disable any and all firewall rules related to blocking access. Disabling all shouldn't be an issue - but RouterOS also has a safe mode (For every management type except API) where by you can make these changes and if you are ki...

joegoldman

Please post full /export (hide any info you feel you need to) so people can review it

joegoldman

You would have to provide an /export output for us to even begin to try and help.

joegoldman

You would have to provide an /export output for us to even begin to try and help.

joegoldman

Its not so much a bug as it is just a missing feature. The filter list in winbox gui only allows the order of the command one way - set out by the way the fields are set out i.e. "where address in 1.2.3.4" vs the opposite way that you actually want "where 1.2.3.4 in address" So t...

joegoldman

You can also set default cost under instance - which will be the cost given to 'Dynamic' interfaces (entries under routing -> ospf -> interfaces created dynamically due to network statements etc) - to set individual cost per interface you'll have to move them to being a static entry.

joegoldman

Ideally you can't - if trial is available then registered users could potentially use the trial period over and over - or you could move to something like MAC based auth/cookies to help avoid it - but then any secondary devices etc may need their own account - or in cases like iphones where they cha...

joegoldman

Hi Team, I applied an IP address (in a /30) to a downed interface on an RB1100x4 (running long-term 6.47.9) - the route was listed as DC (not active), the whole /24 that this IP happens to be in is routed to this router, but before the cable was plugged in the IP started responding to ping - i.e. th...

joegoldman

Hope this makes sense - and happy to learn of some possible solutions. This might be a solution for you: https://www.computerweekly.com/tip/Scale-your-backbone-with-core-MPLS-BGP-on-the-edge The article is old but the information is still correct. Thats a pretty big network wide change -we have pla...

joegoldman

Hi Forum, Not sure I worded the title right - but looking for a solution to my issue. Consider a WISP network map of various towers linked together (not a 'FULL MESH' but rather random PtP links to create some triangles / loops etc) We run OSPF between all these sites - and it runs quite well - and ...

joegoldman

If it needs a separate default route and you can't use NAT or other rules for OOB to 'trick' it - then you'll need to use VRFs Keep in mind that management services DO NOT listen in VRF's - so you'll need to make the 'main' route table your management one, and create a separate vrf for normal/custom...

joegoldman

pretend is long cable but virtual.

joegoldman

If there is no static entry in OSPF interface configuration, then parameters are taken from "all" entry. So you can adjust priority there to have all dynamic interfaces needed priority,

Would be good if we could make rules based on interface lists ;)

joegoldman

https://en.wikipedia.org/wiki/Virtual_private_network Pseudowire on there refers more to old technologies (such as ATM) but same principal applies (and is kind of in the name) pseudo - not genuine; spurious or sham So psuedo wire is 'not a real wire' meaning it emulates as if you had a direct connec...

joegoldman

L2TP VPN is a PPP style protocol in which the IP handed out is not a subnet but a /32 technically - so no broadcast and ARP learning exists, and the client machine does not generally enable a route for the remote subnet. If you clear use remote default gateway - you'll need to add routes specificall...

joegoldman

Someone on here successfully modified winbox in a hex editor to change default port - you could potentially modify the default database path and run one unmodified and one modified Beyond that - keeping your databases separate and import the right one each time you wanna swap between them is the onl...

joegoldman

Only suggestion (which shouldn't change much) dont specify a prefix length on your default route accept rules - currently it appears to be '0' but try it with nothing specified / that field disabled (can't remember how to do this CLI but can change that on Winbox/Webfig) Other than that it'd require...

joegoldman

Is this on a laptop using a trackpad?

If so - does the problem still happen if you plug in a mouse and try that way?

joegoldman

Are you using it on windows? Or another OS with WINE? Never had the problem with Windows - but have had 'similar' problems on WINE based installs (such as on my Ubuntu laptop) - nothing as bad as your describing - but generally updating WINE to the latest stable tends to help especially if you haven...

joegoldman

Depends what you mean by dynamic in OSPF - a dynamic interface can be created within OSPF based on Network addition (including physical interfaces) - is this the dynamic interface you mean? If so you will need to move the physical interfaces to 'static' and add your path cost etc. If you are talking...

joegoldman

No, it should not... If you try to ping "internet" from your broadcast address it works! Hrmm - can depend on vendor - some simply won't pass traffic to the defined network or broadcast address when actually configured as that subnet. If x.x.x.248/29 was actually routed via an interconnec...

joegoldman

You'd need to show your export (of at least /routing (including bgp and filters)) for us to start to understand what and why it should happen - and why it may not be. You may be filtering it out. You may have peer config slightly off. In a general scenario - Tower3 should still install a default rou...

joegoldman

You can also use MAC address to determine - lowest will be first port, highest will be last port. But I find it better practice to have a naming scheme - where ether1 is the port - change it to 'ether1-WAN' or 'ether1-ISP' or 'ether1-Haus' - or some combo of the same to keep the interface type and n...

joegoldman

because people don't come 'from' DNS - i suppose sure you could put DNS record in there and have it resolve forward at a specific time or in intervals - or its possible to have it perhaps lookup PTR on an IP to see if it matches that field - but this is used primarily as a 'firewall' to stop auth fr...

joegoldman

I believe its an internal tool used by the staff - it is a self-hosted 'dropbox' style program where staff can give unique, expirable links etc for quick links to test versions or other files in the course of support tickets etc. I use something similar for my personal stuff using Nextcloud - not su...

joegoldman

We would need to see an export of your /routing bgp and /routing filters to start to help. Are you using summary routes? BGP Networks tab? Does the /22 exist in your route table? Does the /24 exist in your route table? If the /24 is learned by other BGP, does your instance have redistribute other BG...

joegoldman

I hope that Mikrotik will unlock more frequencies for LHG60, considering that the frequencies that are at 70 GHz have considerably less attenuation of radio waves in dB/km. And it is possible to achieve a more stable link at greater distances. The better frequencies are also generally reserved for ...

Search found 763 matches