MikroTik

Pilgrim

I am using the SXT-LTE located a remote machinery to dial in to the office SSTP server. For each client is a defined interface (in PPP) assigned to the user name used in secrets. Most of the time it works fine, but randomly the the server creates a dynamic interface instead of connected to the prede...

Pilgrim

I have set up a sstp server for remote SXT LTE units to dial in to (remote service of industrial equipment). For some reason that I can't figure the server (ROS 6.42.9) generates a dynamic interface instead of connected to the defined interface. It goes without saying that then the traffic is not ro...

Pilgrim

@ Zero Byte Thanks a million, you saved my day. I have been beating around with this issue for days. The filter rules you recommended (/ip firewall filter add chain=forward connection-nat-state=dstnat) works like a charm. I thought I opened everything from LAN side, as I have added a rule to allow a...

Pilgrim

Hi Please could someone point me in the right direction. I have a normal home router setup on a RB750. Everything is working fine, but I can't get the port mapping to work. Normal port forward works fine using dstnat, but if I want to forward e.g. port 8080 (WAN side) to port 80 (LAN side), this I c...

Pilgrim

I had the same problem and replaced the condensators and my 750 is running perfectly again for more months now. The way that the condenstors looked at your picture I would say that you will not get it going again without replacing them. But it is easy done. I used 820uf 6.3V. and bought some extra :...

Pilgrim

I been trying if I could mangle the traffic and set up a rule for 10.0.0.51 -> 192.168.0.0/24 but did not find a good way. The default route in the router providing access to the internet is 0.0.0.0 gw int.1 I want all traffic src IP 10.0.0.51 dest. 192.168.0.0/24 to be routed towards 10.0.1.2 gw 10...

Pilgrim

We have set up an OpenVPN access to our internal file server, but is struggling to get the routing right. For testing purpose we just have one client access for now. We finally got the certificates right with the help of the posting from boen-robot and the client connects to the OpenVPN fine. The LA...

Pilgrim

I got a bit of a break, but still have a long way to go, I am affraid. I am totally new to openvpn. I got access to the units on the server side by changing from IP/TUN to Ethernet/TAP and delete the route in the client config file. So far so good, but I would like to revert back to TUN/IP to have m...

Pilgrim

I sincerely appreciate this help. I spend so much time working on this and now finally got the connection right. We will be using the openvpn to connection to our network from wan side. I now I just need the final step to get the routing right too. In the openvpn client config file I have specified ...

Pilgrim

Please could you elaborate on what is the role of the CRL url. Can this be any IP or must it be the servers IP (public or lan url)?

Pilgrim

Thanks a lot boen for your support.

This worked. I hope mikrotik will see this and update the wiki.

Pilgrim

Thanks Romon, I tried following the video from Pascom and got close, but still no "cigar". https://www.youtube.com/watch?v=hbKmxu3Hk1A I downloaded the version 2.2.2 from Github and tried to create - and sign the certificates (windows version) and some of the steps seems very unlogical e.g...

Pilgrim

I have the same problem. Did anyone succeed to create the certificates using this instruction?

rgs

Pilgrim

Hi I am trying to learn how to work with certificates in Mikrotik routerOS 6.6 and wanted to follow the guide in the wiki, but gets the following error. [admin@QI_main] /certificate> /certificate [admin@QI_main] /certificate> sign template=ca-template ca-crl-host=10.5.101.16 name=myCa expected end o...

Pilgrim

Clipboard01.jpg

Pilgrim

I am struggling with the throughput. I have tried the recommend n setup and all other variants and I am not getting anythin above 24 Mbps – in one set up I had app. 40 Mbps, but I have not been able to re-establish this again. Please could you give me some advice. AP (RB411u w/ R51n): /interface wir...

Pilgrim

Check these videos. It is really great stuff to get an understanding of the basics.

http://gregsowell.com/?page_id=951

rgs Pilgrim

Pilgrim

Just open in winbox and click on interfaces. Here you can enable, disable, renam, etc. each interface individually.

rgs Pilgrim

Pilgrim

Guy's you are the best - Problem solved

Maybe I will run into some issues later, but it seems that it was enough just to open port 1723 (input chain).

Thanks a lot,

Pilgrim

Pilgrim

Hi Guys I am trying to set up a VPN to my network at home, but as so many times before my knowledge goes in in short, so I am again counting on some help from this great board. I tried to follow Gregs's guide http://gregsowell.com/?p=680 and also tried a couple of other guides, but with the same res...

Pilgrim

I wrote an ealier thread as I was not able to get any decent speed on my WDS network. In the meantime I have tried numerous difeerent settings incl. disabling WDS and just set up a AP - Station link and it seems al to boil down to the same problem that have been seen here on the board times before. ...

Pilgrim

Hi I am have set up a RH411 and two RB751 in ap brigde / WDS / Static mesh and I have tried all kind of different combinations, but not able to reach more than 10 -15 mbps throughput. Current configuration is N-only / 2472 MHz / 20/40 MHz HT below. In theory I think this should be able to give at le...

Pilgrim

I think I found the explanation. Station mode does not support L2 Bridging. So I am not trying out the other modes to see what is working.

any advice?

rgs Pilgrim

Pilgrim

I have a RB411 and a RB751 set up as WDS /dynamich-mesh and the WDS network is working fine. I have additionally one RB751 that I want to set up as a station (I don't need any further units in the WDS and I just need a fast and reliable connection to the WDS network) When I set up the RB751 in stati...

Pilgrim

Thanks, good stuff. System now running n-std, WDS statix-mesh and WPA2 with good speed.

Thanks,

Pilgrim

Pilgrim

Thanks, that all makes sense. But I came across another points that I struglle with regarding the WDS and the n-standard. on wiki i founs the following "You MUST use WPA2 authentication with AES encryption only, or use no security at all if you wish to achieve N rates. Anything else is against ...

Pilgrim

I am always struggling to get a good throughput on my wireless. Is there a trade off choosing a multi mode 2"GHz b7g7n" vs "2 GHz only n" i.e. is the n connection slower when in multimode b7g7n? PS. I found this "Only 1 device ever transmits at any given moment on a WLAN. Th...

Pilgrim

@cbrown. Thanks! seems to works perfect now. I don't know if the dynamic setup was the reason for the "holes" but after having set both AP's to AP Brigde and setting up the static WDS, then everything seems to work super.

Thanks,

Pilgrim

Pilgrim

@cbrown Thanks again. I am trying out the AP Brigde / AP Brigde configuration again. But I need a bit more help. The configuration of the repeater pasted has a wlan1 ond a wlan2 and I can't figure out how to repeat this configuration in my RB411U with just one radio. Is it possible to add a wlan2 as...

Pilgrim

To make everything connected to port 2 get an IP from your DHCP/LAN connected to Port 1 you will just need to put these two port in a brigde - in winbox click bridge and add the brigde and then click on the tap called ports and add port 1 and port 2 to the brigde. Or even better just use the build i...

Pilgrim

If in station mode that I would add a virtual AP should I then just use the regular station brigde mode or should I choose Station WDS?

Can the virtual AP be the same SSID, Frequency and WPA?

Thanks, PIlgrim

Pilgrim

Thanks Guys, I tried configure both in AP's as AP Brigde and WDS dynamic. But i seems to really slow down the net down quite a bit. AP2 has unfortunately only one radio, so i think that I can't use the repeater setup described. This was the config tried on AP2. WDS 1.jpg would WDS Slave or WDS mesh ...

Pilgrim

I hope you guys can help me get my head around this. I would like to use the WDS technologi to expand the WIFI range of my network and at the same time i would like the AP to work as a station for my LAN. I have read different articles and wiki proposals for this, but I am not sure that I got it rig...

Pilgrim

Problem Solved.

I had been usin a VPN PRO service from "hidemyass" and the "#¤%¤#!&!! software installed a virtual net adapter called TAP-Win32 Adapter V9 after I removed this, The problem was solved and winbox works perfectly again - and the VPN also works.

Pilgrim

Pilgrim

There is a couple of differences: The system where winbox is working ok: win 7 ultimate /32 bit - avira anitivirus The system where winbox is very slow: win 7 Ultimate / 62 bit - avast internet security. But as mentioned I have tried to disable the avast internet security, which did not help, and it...

Pilgrim

@wrsalasr

No, was not able to solve it yet. I am still trying. It is not hardware, as it works OK when I boot up with the second win 7 installation.

rgs Pilgrim

Pilgrim

PC is connected by cable and I think I have tried all possible combinations and the are all showing the same slow discovery and all times out when trying to connect via mac. The OS's boot independently.

Thanks,

Pilgrim

Pilgrim

I have search and tried everything i could find including including redownload winbox, delete %user%/appdata/mikrotik. Nothin has helped so far. I took a completely new router and on start up I could connect via the IP. I then clicked on "delete default scripte" and restarted winbox again ...

Pilgrim

I am running windows 7 - 64 on the pc that I normally use for the winbox connection to my Mikrotik units. I am not sure how this happend but when opening winbox it is very slow to detect the mikrotik units on my network - even the routet that it is directly connected to take up to a minute to be det...

Pilgrim

Thanks, I will try. I want for sure only the two IPs to go through the tunnel so it will try to see if I can set up routes with the /32 netmask. Alternatively I was wondering if this could work with a routing mark for the tunnel and and lookup / routing policy that says everything with this rouing m...

Pilgrim

I have my router (RB750) set up with two ISP's where the second ISP is set up as a backup line / failover. On my LAN I have two units that i need to set up so that they connect to remote IP thorugh a PPTP tunnel. These two uints does not have any build in VPN client so i need to do this in my RB750....

Pilgrim

I think there must be a standard setup in rb751, Not sure but in rb750 if you make a master reset it would aks if you want to keep the std configuration or if you want to set up your own configuration. otherwise look here http://forum.mikrotik.com/viewtopic.php?f=13&t=60066 http://wiki.mikrotik....

Pilgrim

this is my current firewall excl. port forwards, but including blocking port scanners. I did not do the script for the ports scanners. I took from one of the examples on the wiki, but we tested it and it works really well. /ip firewall filter add action=log chain=forward comment="" connect...

Pilgrim

I have used this as a basic firewall. Just change the lan addresses to what fit your lan and copy & paste into a new terminal window and you have a basic firewall. /ip firewall filter add action=drop chain=forward comment="" connection-state=invalid disabled=no add action=accept chain=...

Pilgrim

Thanks Guys,

Did the upgrade successful now.

rgs Pilgrim

Pilgrim

The installation guide say that I should download the combined package. It seems that the download has been changes and this guide is obsolete. What is the correct way - is that to download the NPk package and then drag and drop that file in the files window?

Thanks,

Pilgrim

Pilgrim

Hotspot server set up in 30 sec.

http://www.youtube.com/watch?v=qVaI3f9CtfY

http://wiki.mikrotik.com/wiki/Hotspot_server_setup

http://www.marlwifi.org.nz/projects/basic-mt-hotspot

Mikrotic basics video tutorial.

http://gregsowell.com/?p=957

rgs Pilgrim

Pilgrim

No, "O2" is just a name that I gave my PPPoE connection (I have adsl from the phone and internet provider O2). If your internet connection is an adsl line or similar and you connect to the internet through a PPPoE connection then you should use whatever name that you have given your PPPoe ...

Pilgrim

I think you need to check two things. 1. Yes, I think you need to specify an in-interface. The example below from my router "O2" is my PPPoE connection. 2. in your IP firewall filter you have to insert a rule that accept the connection from the WAN. The rule be place high in the filter bef...

Pilgrim

@th0r

No, I would not be the right one to answer that and I am also not sure how the problem could be investigated. I hope that someone else on the board can help. I am also interested in knowing more about this problem.

rgs Pilgrim

Pilgrim

@Th0r, just a word of caution. I think I mentioned it already, but you should be sure that you have the min needed rules in your firewall. Check for example: http://wiki.mikrotik.com/wiki/Dmitry_on_firewalling http://wiki.mikrotik.com/wiki/Home_Firewall (complete script for home firewall) to install...

Pilgrim

I think it may be because that your DHCP server is still just handing out IPs to the ether2. You have to put in the Bridge.

check ip/dhcp server and clik on the DHCP server listed and check the interface set. Must be the bridge, I think.

rgs Bjarne

Pilgrim

I asume that you use ether 2 as your LAN 192.168.1.xxx interface where your devices are connected. If you want your wireless devices to connect to the same LAN 192.168.1.xxx and act as any other device that you have connected to your LAN then you should not give your wlan1 any IP address. You just n...

Pilgrim

Keep the out-interface to pppoe-out1. This is for sure the right setting in NAT. If you by local devices mean your own devices on your LAN i.e. use the router as a home router. The that is exactly what I do too in order to have a better router at home and have more control. However, for that purpose...

Pilgrim

Is it correct that the RB751U-2HnD have 1 radio and 2X2 MIMO antennas. Is it possible to use the RB751U-2HnD as a range extender assigning one set of antennas as client and the other as AP?

rgs Pilgrim

Pilgrim

you need to have NAT enabled in the AP brigde and the out-interface need to be you PPPOE connection - not the physical interface like ether 1 or wan if you renamed it to like WAN. If the name for you PPPOE connection is e.g. DSL then that has to be you outinterface in the NAT mine for examples is a ...

Pilgrim

Min. firewall - Try this for starters. IP firewall filter 0 chain=forward action=drop connection-state=invalid 1 chain=forward action=accept connection-state=established 2 chain=forward action=accept connection-state=related 4 chain=forward action=accept protocol=tcp dst-port=20-21 (this is for port...

Pilgrim

There is already a good deal of help available of different sources. http://gregsowell.com/?p=957 http://wiki.mikrotik.com/wiki/Manual:Initial_Configuration You need the setup with NAT / masquerade. http://www.mikrotik.com/documentation/manual_2.7/Basic/Basic.html make a search on the board here for...

Pilgrim

Thanks, Ditonet. I didn't know about this page. I downloaded and ran the benchmark with interesting result.

rgs Bjarne

Pilgrim

I have two ISP's and have setup up two static default routes with distance 1 and 2 in order - and two srcnat. The purpose is to make a failover. Everything seems to be working and the only thing I am struggling with is the DNS. I have disabled the "use peer DNS" and have entered the DNS ma...

Pilgrim

Thanks, Ditonet, don't know what I was thinking, but you are of course right.

Thanks,

Pilgrim

Pilgrim

I have a RB250 switch after my router RB750. On the RB750 Ether2 through Ether4 is for my lan (Ether2 is master) with the RB250 connected to Ether3 winbox is able to see both the RB750 and the RB250, but I am not able to acces RB250 through winbox regardless if I try to access using the MAC Addr or ...

Pilgrim

I think you need to set up the Thompson in a brigde mode, so you only use dsl modem. RB750G comes with a standard set up, but be aware that the firewall is very simple and should be enhanced. Look for some standard set up here on the board. rgs Pilgrim http://gregsowell.com/?page_id=951 http://route...

Pilgrim

It's difficult to understand exactly what it is that you want to achieve. But if the DHCP server is connected to ether 1 I assume that you have another router connected to your RB750. A router after a router is a difficult thing. If the RB750 is not your main router, then what is it that you want th...

Pilgrim

I was looking at the same thing and had post on the forum here asking for the same and I don't think it is possible just to be bonding those two connections. What you can do is to make some load balancing - or make a static route so specific IP's on your lan use the second internet connection as gat...

Pilgrim

Thanks, fewi and Janisk. That makes sense. But difficult to know. I read the article suggested last night but was not able to see that this rule would in fact work the same way as a mangle rule.

Thanks,

Pilgrim

Pilgrim

Thanks, That is exactly my point. The rules are working, so the routing mark must be added somewhere. But when I checked ip/firewall/mangle i could not find any mangle rule adding the "isp2" routing mark - Guaranteed! I made an export of the whole setup to notepad and search for "isp2...

Pilgrim

I'm not sure I understand what the problem is.

The two cable modem - is these for ADSL connection to the internet. Do you have two wan connections?

Looking at the past it seems that your NAT is disabled. you will need a src-nat or masquerade to acces the internet through the router.

rgs pilgrim

Pilgrim

Read in the Mikrotik manual that the routing table is automticly created when referred to. so I asume that the ISP2 routing table is then created be this gateway referring to the rule. Capture 2.JPG I read above as everything with the routing mark = isp2 goes through this gateway. But I still do not...

Pilgrim

I am trying to understand this rule. My ISP set up a second wan I Asked the guy to hep me setup my Router for my private LAN so that all traffic from 192.168.0.100 would go through the new wan. He did this adding a new static route, a new gateway where all traffic with routing mark=pe3ny would go th...

Pilgrim

Is it possible to bond two wan interfaces simply by adding them as slaves to a bonded interface?

Thanks,

Pilgrim

Pilgrim

If you do not have a specific purpose with the brigde other than just put ether 2, 3, 4, and 5 into a switch. The consider using the Switch facility in RB750G. The difference is that traffic going from e.g. from a unit on Ether2 to a unit on ether3 will be handled by the CPU and thereby consume a lo...

Pilgrim

@sohongratana Be aware that if you do not set up a firewall too, your system will be completely open to the outside world. The minimum firewall would be something like this. Open new terminal in winbox and paste code. Replace 192.168.0.0 with the correct network IP for your LAN. /ip firewall filter ...

Pilgrim

Thanks m4rk0, I think I understand the lines setting up the gateways with distance 1 and 2. Distance 1 will be the primary gateway and 2 the fail over. I would like to use my 411U with the G3 modem as my backup connection to the internet. So RB750 is my primary router and the DSL connection my prima...

Pilgrim

Please could you point me in the direction how I could make a simple fail over for the system as show in the diagram in this thread?

http://forum.mikrotik.com/viewtopic.php ... it=pilgrim

Thank you very much in advance,

Pilgrim

Pilgrim

@WiFiTech Thanks for your comments. The modem is a Huawei E170 and it is not on the list as far as I could see. The modem does however work on my older RB411U and the issue was that I could not get it to work on a new RB411U, that I just recently bought. The problem is in the meantime solved. After ...

Pilgrim

This is what I have set up - but still not able to connec to the internet through GW 192.168.0.203 [admin@MikroTik] > interface pr Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE MTU L2MTU 0 R lan ether 1500 1526 1 R O2 ppp-out 1500 [admin@MikroTik] > ip add pr Flags: X - disabl...

Pilgrim

I am trying to do the same. But I cant get the routing to work. when the RB411U is used as a stand-alone and set up with a DHCP server I can use it as a normal router and browse the internet. My aim is to use 192.168.0.203 as a failover gateway if the DLS line goes down. But I can't get the routing ...

Pilgrim

These are my mangle rules.

rgs Pilgrim

Pilgrim

Agree

but check out this one.

http://www.tiktube.com/index.php?video=247
http://www.tiktube.com/index.php?video=214

rgs Pilgrim

Pilgrim

I learned that there are several things that you would like to give high priority e.g. your DNS lookup, VOIP, etc. and then there is medium high like http traffic. I think it good practice to organice your priorities in groups and in order not to loose overview it is a good idea to make a overview l...

Pilgrim

When I tried first couple of times this morning it still failed to connect. A couple of hours later I tried again and without having changed anything the modem connected. I tried to downgrade the new RB411U to RouterOS 3.20 and reinstalled the backup from my other RB411U running RouterOS 3.18 and it...

Pilgrim

I have two RB411U - one with routerOS 3.18 and a newer with RouterOS 4.11, now upgraded to 4.16. I am using the routerboards with a Huawei USB moden to establish a 3G connect. Everything works fine in the old RB411U, but with same set up in the new board I have the problem that it just repeating the...

Pilgrim

Please, could you point in the direction of how to use the SNMP remote access. Do I need a SNMP client, or is it possible to get remote access using just a web browser?

Thanks,

Pilgrim

Pilgrim

I know how you feel :-) I was also struggling with the most basic things e.g. uploading scripts. Maybe you solved it already, but if not, then just open a new terminal window in winbox and paste the scripts or - selected parts of the script. The script can be altered in any editor and then pasted. O...

Pilgrim

@Feklar Thanks, that makes a lot of sense now. I will try to uncheck the passthrough option. Is it possible to set up a rule at the end of the mangle chain of rules that will catch all traffic not matching any of the previous mangle rules i.e. just to make a check how much traffic is not mangled by ...

Pilgrim

I have set up my QoS and mangle rules following the guidelines I could find around on the forum and in the Manual. Thus, first marking the connection and the mark all packet belonging to this connection. My question concerns the passthorugh option (not the action "pass Through", but the ch...

Pilgrim

@Surfertim, Thanks for a good explanation. It's really annoying to walk around not getting the logic in place. But that is clear now.

Thanks

Pilgrim

Pilgrim

When using torch to check the traffic on the LAN side I can't get my head around why the Tx rate is reported the way it is. e.g. Say a PC 192.168.0.10 on the LAN is running a download from an FTP with a speed app. 800 KB/s and I torch the LAN interface. The the torch shows the PC IP 192.168.0.10 as ...

Pilgrim

check this one too.

http://gregsowell.com/?p=1076

Pilgrim

@spooling I may have misunderstood the setup you wanna do, but just for the record. If you already have a LAN running with another router distributing the IP's to your lan clients. And you only want to use the RB as an AP, then it is very simple. you just delete all rules in the RB e.g. by doing a m...

Pilgrim

@dssmiktik Thanks, that rule could be very helpful for my setup. I am trying to understand how the rule and I just can't get my head around it. It just seems to me that any packet UDP with dest. port 53 and an address outside the LAN is being redirected to dest. port 53 (it was already dest port 53)...

Pilgrim

You were right about the provider is blocking the incoming traffic. I talked to O2 and it turns out that everything is blocked in the standard subscription, but they were able to offer another APN where incoming raffic is open. They changed my subscription (same price and condition, they just change...

Pilgrim

Thanks Grzegorz. Seems that everything is blocked. I tried to change the ports to 7xxx and the result is the same. I will try to get hold of O2 today to see if they can confirm if incoming traffic is blocked. In case that the incoming traffic is really blocked, is there then a workaround? Thanks, Pi...

Pilgrim

The provider is O2 telefonica in the Czech Republic. Ip has changed a couple of times since i connected an now it is 85.162.17.xxx. Seems to belong to Eurotel.cz, which I believe is the company telefonica aquired. The ports is need to open is are two port for a server that I am hosting the ports are...

Pilgrim

Thanks, Guy's

Got something to work with again.

rgs Pilgrim

Pilgrim

Problem is that my ADSL line is down and I need to set up a GSM/Edge line up until the ADSL is up again. In the RB411U with the Huwaei /O2 modem I have succesfully connected to the internet and everything is working except the server. All connection from outside seems to be blocked. I have oppened t...

Pilgrim

Thanks Ibersystems, I have been experimenting a bit with both rules. chain=prerouting action=mark-connection new-connection-mark=Other-Low-Conn passthrough=yes protocol=tcp src-address=192.168.0.0/24 src-port=21 connection-type=ftp chain=prerouting action=mark-packet new-packet-mark=Other_Low passth...

Pilgrim

mark related connections too.

Thanks Ibersystems, I am not sure how to do this. I left the "connection state" open, so I thought it would then cover all connection states. Should I add a second rule special for "related connections"?

Thanks,

Bjarne

Clipboard01.jpg

Pilgrim

I am stucked with this and not able to get my head around how this FTP traffic. I am trying to set up my queues so that the FTP will have lowest priority. But I can't mark the traffic. How can this traffic: Clipboard01.jpg bypass this rule. The traffic is not marked or skipped by any of the other ma...

Pilgrim

@bigguns Setting up the firewall you can choose different approaches e.g. "allow everything and then block what you don't want" - or - "block everything that you have not explicitly allowed" and the rule set above is for the last one - "block everything that you have not exp...

Pilgrim

To make a very basic protection of your LAN you may use something like this. Rule 4 is disabled here and can be enabled if you want to log unwanted traffic to your LAN. If you have any ftp or other server that should be accessable from outside your lan then you need to add a rule to accept this traf...

Pilgrim

Yes, I would see it this way too. Doing 1 + 2 will count all packages going in both directions. As 2 will mark all packages belonging to the connection "lan_conn" regardless which direction they are travelling. For the incoming traffic I guess you don't want to receive any traffic unless t...

Pilgrim

Interesting question. I often get the same doubts when things are not working out for me. My believe is, that if the packet originating from a unit on your LAN travelling toward an address on the internet then the eth0 (wan interface) must be the out-interface. I think best practice is to mark the c...

Pilgrim

I use opendns, but without proxy. Just made the free opendns account and entered this rule in NAT. This will send all DNS lookup's to the opendns server.

2 ;;; Open DNS
chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=53
protocol=udp src-address=192.168.0.0/24 dst-port=53

Pilgrim

have tried both from different pc on the lan and from the router using tools/ping.

Pilgrim

Thanks Guys for you support. I still haven't figured it out yet. So far I tried: disable all "drop" s in my firewall. I also reset the counters and could see that with the rules enabled. The firewall filter does not drop any packets when i execute a ping. I tried to enable all services und...

Pilgrim

I have a RB750 set up as a SOHO router for my network at home and have set up my firewall and services according to the guidelines on wiki and Greg's video tutorial. I haven't had the need to ping ping anything outside my router for a long time and now I suddenly find that this is not possible anymo...

Pilgrim

mine look like this GTS is my PPPoE connection to the internet. Recommend to make the diagram not to loose the overview of what you want to acheive. rgs /ip firewall mangle add action=mark-packet chain=prerouting comment="" disabled=no dst-port=53 new-packet-mark=High_Priority passthrough=...

Pilgrim

I have the following rules in my firewall filter to do this for the SSH connections to my router and I guess you could do the same for the winbox connection just adding the winbox port. The 1st. rule accept the connection if it comes from within my LAN. The 2nd. rule logs the cconection attempt if i...

Pilgrim

my RB750 is set up pretty much like a standard small office router. Helping me setting up my mangle / queues rules I have been using the torch tool to check the traffic and I just can't get me head around the logic. Everything seems upside down. I my setup I named my PPPoE connection "GTS"...

Pilgrim

@Tom

Good point. I don't use my modem that often, so I didn't think much about it. I cleaned it up a bit and I think this is better.

Pilgrim

I did a simple set up on my RB411U like this. -s et up the PPP connection - set up NAT - Create a bridge and add Ether1 and Wlan1 - Set up Pool and DHCP server - Set up a simple firewall You may want to open a new terminal window in winbox and paste below lines. The you can check the setup in winbox...

Pilgrim

or this

http://wiki.mikrotik.com/wiki/How_to_Co ... _xDSL_Line

Pilgrim

slightly different, but explains the nat setup.

Pilgrim

Guess I havn't quit figured out yet your set up. Why do you want the mikrotik-WLAN to be different network from your mikrotik LAN port?

Please make a drawing or something so we can see the infrastructure you want to build.

Pilgrim

I think you need to explain your infrastructure a bit more in detail and what it is that you want to do. It can be very problematic with a router-after-router. Are you intending to have more networks on the same LAN? - or is your intention just to connect everything to the same network e.g. 192.168....

Pilgrim

Sorry to hear about all these problems. That seems to some serious hardware problems. I hope someone else on the board can give you some advice how to go about finding out the extend of the damage. I think you need to start a new thread and break down the questions one by one.

rgs Pilgrim

Pilgrim

so that when i get connected through wifi to my network i should first go to my hotspot page and login then it should take me to my isp's hotspot page i should login and then i am browsing on my isp;'s I don't think it works this way. You can always setup a wireless security like mac filtering, WEP...

Pilgrim

I think I see what you wanna do. But I am still a bit confused about your connection. is it like a standard household connection? Your "hotspot" is probably a PPPoE connection (The POE you mentioned has nothing to do with this - POE just means power-over-ethernet i.e. just another way to p...

Pilgrim

If you just want to pass through the IP addresses then you just put all three interfaces into a brigde. If your interface to your ISP is wireless then you just set up the connection and include this interface in the the brigde too. What RB are you using and how is your set up? when you speak about c...

Pilgrim

for the DHCP server: goto IP/pool to set up the rage of IP the DHCP server will pick the IP's from. The go to IP/DHCP server to set up the server - as for interface you must enter a bridge or your master interface for ether2 and 3. for the DHCP client: Just go to IP/DHCP to set up the client and ent...

Pilgrim

Thanks Fewi, I am embarrassed. I guess I was just tired yesterday, But I actually tried with serveral IP's on my network all with the same results. Nevertheless trying again this morning after reading your answer it worked. I don't know, maybe I simply made the same mistake copying the first part of...

Pilgrim

Clipboard04.jpg

Pilgrim

I just can't find the logic - or a solution to this. Please help. When I set up the the following rule and log the traffic I can see in the log - and on the counters that there is traffic to dest. 192.168.0.101 on my lan. Clipboard01.jpg Clipboard02.jpg Clipboard03.jpg However, when I insert the the...

Pilgrim

Thanks negge, That is really interesting. I also read the article and to me this is completely new angle on QoS.

Great job in implementing this on the mikrotik platform and like it was already mentioned it would be really nice if this could be turned into an article on the wiki.

rgs Pilgrim

Pilgrim

Thanks Negge, Great piece of work. Just want to add a question concerning your comments on the download. You cannot apply QoS on the downlink because you have no way of controlling how much data is being sent to you. If you want to prioritize VPN just mark packets with IPsec traffic and give them hi...

Pilgrim

As far as I could see it is possible to add more VLAN to one interface. http://wiki.mikrotik.com/wiki/VLAN http://www.mikrotik.com/documentation/manual_2.7/Interface/VLAN.html But I don't know how to add the NIC's to the interface list in RouterOS if installed on a server. Someone else will need to ...

Pilgrim

I understand that you want to install RouterOS of your server and use the server as Router - Is that correct? I have no experience with using a PC/Server as router, but I think I would go for a RB750 instead. You should be able to make the split mentioned in just one RB750. You can assign two of the...

Pilgrim

Thanks, Greg, really great stuff again.

rgs Pilgrim

Pilgrim

I learned a lot from Greg's video on the subject.

http://forum.mikrotik.com/viewtopic.php?f=13&t=37338

Pilgrim

Awesome great stuff.

Thanks,

rgs Pilgrim

Pilgrim

:-) :-) Got it. That worked :-) Thanks a lot nest for your help with this. Maybe the Mikrotik guys should have a look at this. Because the interface I specified is identical default gateway interface. In this case LAN1_Mater - or have I misunderstood this? # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 A...

Pilgrim

Even with the laptop sending the package connected to the router it works.

laptop -> RB750 -> switch1 -> switch2 -> PC

Starts perfectly on WOL using

Clipboard02.jpg

But still no luck sending tha package using winbox and the tool in RouterOS.

Pilgrim

Maybe a bit closer now. I tried both suggestions in 2. Connecting the PC directly to the RB did not work and execute the magic packet from winbox did not work. Clipboard01.jpg However, Connecting the to PC's with just one switch in between worked. I will try to take my laptop and connect it to direc...

Pilgrim

Upgraded to v4.3. This solved the syntax problem, but still not able to start my pc by WOL. Motherboard is an ASUS M2N-E

any ideas?

Pilgrim

The NIC leds are on and the card seem to be powered and alive. I took a looong cable and got the pc connected directly to the RB. and for safety I added the / But still no cigar I will try to upgrade to v4.2 to see if this will help. Something must be wrong since it does not accept the same syntax t...

Pilgrim

Thanks a lot, nest, That is exactly was I was looking for. Now I just need to make it work and I just can't figure out why it is not functioning. The network adapter is set up to accept wol on magic packet. BIOS is set up with wol enabled. I had the whole system power down and up again - switched of...

Pilgrim

Is there a facility to execute a wake-on-lan from the winbox. I have been trying with the magic packet software, but I can't get it to work. I have tried to monitor the traffic on the port defined for the magic packet, but it doesn't seem to even get to my router. Not succeeding with the magic packe...

Pilgrim

Thanks SurferTim. I will try to test it and see if I can make it work.

Any ideas how I can setup the 411 so that it will dial in, when the gateway is switched?

rgs Pilgrim

Pilgrim

could someone point me in the direction of setting up my RB411U as internet fail over. I have a DSL / RB750 as my main router/internet connection. Then I have a RB411U with a 3G USB Modem. The DSL is not always that stable here and I need to set up a solution, so I have a backup in case the DSL goes...

Pilgrim

I have no experience with Bullet and / Nanostation, but both are from Ubquiti and seem to be using the same firmware "AirOS" The setting you mentioned seems to be the default setting. There is a pretty good resource here. http://wiki.ubnt.com/wiki/index.php/Image:25a-Network-Bridge.png You...

Pilgrim

I guess that if you know the ports used by the virus, then you could just set up a line in your firewall to log all traffic through these ports.

Pilgrim

I don't have any experience with the nanostation, nor the bullet. But the unit you connect to your RB450 as AP should be in AP-Brigde mode - or similar. Be sure that they are connected with an IP belonging to your LAN. Ideally as DHCP clients and then make a IP reservation in your mikrotik to ensure...

Pilgrim

I checked the manual and couldn't find the settings for a bridge mode. I would change the device to a modem without wifi and which can be set up in a bridge mode. Alternatively the best shoot is probably to disable DHCP and firewall and choose a network different from your LAN after the RG450 and pu...

Pilgrim

@john The firmware license is stored in the Router. By two machines - do you mean the SMC and the RB450, or do you mean two PC's? Could you make a small drawing on how you want to connect your hardware. Something simple like this. Then we can go through it step by step. Maybe it will be easier just ...

Pilgrim

Thanks roc-noc. My mistake. Are all ports on the RB450G - GB ports?

rgs Pilgrim

Pilgrim

In winbox next to the "connect to" click on the "....." icon and you should see a mac address then just connect to the mac address. In RB450 there is no switch. To connect the other interfaces to your lan interface you will need to set up a brigde. NB! the traffic that will go th...

Pilgrim

RB750 IP Pool.jpg

Just saw a mistake in the screen dump showing the IP pool for the DHCP server

Should look like this.

The DNS IP Addresses shown in the screen dump is added automatically, Just be sure that "allow remote request" is enabled

Pilgrim

RB 750 address and route list.jpg finally, this is how the route and address list should look like. most of the rules are added automatically (don't forget to tick off "add default route" in your PPPoE connection. I can't remember which rules needs to entered by hand, so set up this as th...

Pilgrim

DHCP, DNS, NAT see attached xls. for firewall I would suggest below as a min. /ip firewall filter add action=drop chain=forward comment="" connection-state=invalid disabled=no add action=accept chain=forward comment="" connection-state=established disabled=no add action=accept ch...

Pilgrim

The modem you have in front of your RB750 should be set up in a bridge configuration, so you don't have a router-on-router situation. This set up (see attached file) of the PPPoE connection works for me in my RB750 (@Mikrotik - compliments, the RB750, is simply a great router). I can sent you the re...

Pilgrim

Marking traffic would work this way. I am using this rule to mark all HTTP traffic. Once you have marked the traffic, in this case all packet are marked "medium" you should then be able to direct all that traffic through your WAN2 using the IP/route. Instead og marking traffic going throug...

Pilgrim

Is it possible to open UPnP for just one IP on the LAN?

I logged the traffic through UDP 1900 and TCP 2828 when the dynamic rule is added was added by UPnP to the NAT, but i could only see TCP traffic on 2828, there was no traffic on UDP traffic on port 1900.

rgs Pilgrim

Pilgrim

@john, how are you doing?

Let me know if you need some help with the basic stuff. I am not an expert, but I can give a hand with the basics.

rgs Pilgrim

Pilgrim

I am not sure I understand exactly what the problem is, but to get a small system going using the RB450G and the NANOSTATION2 as a AP you would need to: Set up your SMC in a bidge configuration, so it works only as a straight through modem. Connect and set up your RB450G as the main router (set up i...

Pilgrim

I think I got a hint why it does not work - but I am not sure. I was listening to the presentation by Megis (QoS Prague 2008) and the setup does not work under masquerade. PCQ will not work for upload Because HTB is after scr-nat and will not be able to separate the upload by clients as the client I...

Pilgrim

Hmmm, you are right. The mangle rule mark all traffic initiated from 192.168.1.0/24 and the queue tree rules also looks right to me. Having said this. Then I also need to say that I do not have that much experience with PCQ and it would be good if someone would also comment. To me it looks like if t...

Pilgrim

I did a similar AP using the RB411. I just set up a DHCP client for Ether1, created a brigde and added ether1 and Wlan1 to the bridge. The brigde will forward the DHCP request.

NB! don't forget to clear the default configuration of the RB411 first.

rgs Pilgrim

Pilgrim

It seems that you have set up mangle so that all traffic initiated from LAN side will have the same mark. This way you will not be able to set any limits / priorities per user. If you have many users on the router then probably you should think about PCQ Check this http://www.tiktube.com/?video=247 ...

Pilgrim

It may just be me and then just take it down as an attempt to highlight a couple of points concerning the wiki that seems to me good improve the user friendliness of the wiki for average users like myself. 1. There is a lot of good material on the wiki. It is sometimes really hard to find. for examp...

Pilgrim

When you open winbox and click on "...." to browse for mikrotik / routerOS devices on the LAN then you should see a list of the mikrotik devices with both the mac addr and the IP. If the IP is not shown, then the interface you are connected to has not been assigned and IP.

rgs Pilgrim

Pilgrim

Thanks drnitinarora, I think the key to succes with mangling/HTB/QoS is to fully understand the packet flow in the mikrotik router. This video helped me a lot. http://www.tiktube.com/?video=214 http://wiki.mikrotik.com/wiki/HTB http://wiki.mikrotik.com/wiki/Packet_Flow But, even in small network lik...

Pilgrim

Hi drnitinarora, you were too modest in your intro in the first post. I thought you were new to this and it turns out you have a lot more experience then me :-) I better move a bit a side here so someone more experienced then me can help you. I think you have already tried all the suggestions I woul...

Pilgrim

The client must be in station mode. I thnik this set up is much easier than the other issues that yoy have involving the TP-Link's, since in this application you Mikrotik in both ends. There is a perfect example on the wiki that you can use as model for your setup. http://wiki.mikrotik.com/wiki/Tran...

Pilgrim

In mikrotik terms then your TP link2 should be in "station mode" but the terminology is different in the standard consumer products. Please let me know which TP link model you are using. Is tp-link1 just bridging between the 411 and tp-link2 - or will students also connect to tp-link1? rgs...

Pilgrim

Currently your Nokia both act as as modem and router. Your Nokia connects to the DSL connection and provides the NAT and DHCP server to the LAN side. You can keep it this way and then simply set up your 411 as an AP. That will get you going so that your students can access the internet and also the ...

Pilgrim

I am trying to understand how your network is connect and how you want the Mikrotik to work. What routerboard do you have 411, 433 .....? Have you connected ether1 to your nokia router/modem. Do you want your mikrotik just to act as a secure AP for your clients or a hotspot (where they will have to ...

Pilgrim

Just building on the answer from kimis. in the simple queue for VLAN1 set max-limits to full bandwidth as allowed in the parent queue (queue for ether1) i.e. 2M upload and 50M download and under the advanced tab set limit-at to the min. bandwidth that you want to guarantee VLAN1 e.g limit-at target ...

Pilgrim

I asume that the 450 is already setup with a dhcp server, so that clients connection receive an IP.

then just setup the 411 like this.

Setup a dchp client for ether1
setup wlan1 as ap-bridge
create a brigde and under ports add ether1 and wlan1

that's all

rgs Pilgrim

Clipboard01.jpg

Pilgrim

I don't agree. CRB / IRB is not even mentioned in the 700 pages manual on RouterOS. We are in the beginners forum and it is honestly a bit difficult to relate the description available on CCO to the examples given in the mikrotik wiki and then tell what works and what does not. I read the examples a...

Pilgrim

There is a very similar setup here: http://wiki.mikrotik.com/wiki/Transparently_Bridge_two_Networks So if the radio in the AP (the mikrotik in your set up hosting the PPPOE server) is servicing only the station (the mikrotik in the middle) Then is think above link would work. If the AP is servicing ...

Pilgrim

I can't say about the bridge, but in case the the problem is rooted in the wireless set up, this may help. I got the following advice from one of the experts always to disable the running check in order to keep the wireless connection active at all time. This script should do the it: :foreach card i...

Pilgrim

I checked a similar port forwarding in my setup and I can't see why it should not work. The setup in my router would look like below. I am sure that you already have considered that the filter rule must be placed high in the list before any rule that might drop the package e.g. a rule dropping all n...

Pilgrim

Hi Igor Try to use winbox instaed. 1. Check in winbox / system / License that your current RouterOS is upgradeable to the version that you want to upgrade to 2. Download the combined package from http://www.mikrotik.com/download.html 3. open winbox and click on files in the left menu to open the fil...

Pilgrim

I think your ISP needs to check his router setup and allow VPN passthrough.

rgs Pilgrim

Pilgrim

@myxylplyx

Wired - or wireless?

rgs Pilgrim

Pilgrim

My Public: 216.1.1.1

Sounds like a very odd public addr. Did you check e.g. http://www.whatismyip.com/

rgs Pilgrim

Pilgrim

Just a wild guess, but could it be the IP lease that expires and your PC has to renew the IP?

rgs Pilgrim

Pilgrim

The router can't do anything from scratch. You need to do a setup up first. It's not like a normal consumer router, that is preconfigured from the factory. However setting up 411 as a simpel AP is easy. But to tell you the whole process step by step is not possible here I think. Download enclosed zi...

Pilgrim

If RouterOS is installed - and I assume it is - the router board probably came with the RoterOS preinstalled. Connect your PC directly to the router using a LAN cable. Launch winbox and at the "connect to" click on the "...." tab and wait a second and wait a second. Then you shou...

Pilgrim

@roc-nok.com, mrz

Thank you very much. Without this information I would just have setup Ether 2 through 5 in a bridge loosing the benefit of the switch.

Thanks,

Pilgrim

Pilgrim

I just ordered the RB750 to replace my current mini router. In an much earlier thread I saw Normis mentioning that the onboard switch-chip can be switched on and off all depending on the setup you want on the router. Probably a lame question, but is the switch switched on automatically when defining...

Pilgrim

I am trying the use state "related" and type "ftp" to indentify the FTP, but this rule is in most cases not working. add action=mark-connection chain=prerouting comment="" connection-state=\ related connection-type=ftp disabled=no new-connection-mark=ftp-conn \ passthro...

Pilgrim

Are your lan behind a srcnat masquerade? What is your firewall setup? If you have set up a firewall, then make sure that you open for the port in the firewall first. and then do the forward in the dst-nat. It should look like this: /ip firewall filter add action=accept chain=forward comment="&q...

Pilgrim

This is what i put in. I later found out that it only work in some case. I am not sure about the reason. So I would be very interested in hearing about your experience too. rgs Pilgrim Mangle: add action=mark-connection chain=prerouting comment="" connection-state=related connection-type=f...

Pilgrim

For what purpose are you going to use the router? If it is for home use and you want to set it up with 1 wan and 4 lan interfaces, then the procedure would be. Name ether1 as the wan interface and set up the ISP connection on this interface. Bridge interface ether2 ....ether5 in one brigde. set DHCP...

Pilgrim

I couldn't see anything about your IP firewall filter, so this may potentially be totally beside the point. But just to be sure. These rules work for me for the forward to my FTP. I am connected to the internet by a PPPoE connection. In below named as "GTS" rgs Pilgrim In the IP/firewall/f...

Pilgrim

Thanks a lot SurferTim, working perectly now

rgs Pilgrim

Pilgrim

I would like to down prioritize the FTP traffic on my network, but is facing difficulties mangling the traffic as FTP passive mode seems to use all kinds of different ports and some server are set up for communication in other ports than 20/21. Are there a good way to identify the FTP traffic? rgs P...

Pilgrim

It may not be a hardware issue. I think the purpose would be to logon through the serial interface to reconfigure - alternatively reinstall the router if needed in order to make the ether port work again.

rgs Pilgrim

Pilgrim

Does this mean that none of the 4 routerboards are working for you? You didn't offer much information in your post concerning your setup. I have have not misunderstood your post, then it sounds more like a setup issue. You need to enable the interfaces and set them up with the settings you want e.g....

Pilgrim

@surfertim, Thanks a million for your support. Turns out that the problem was in mangle. When connecting to orange using the RB411U/Huawei E156G one rule was automatically added in mangle. The rule is changing the MSS for all outbound TCP traffic. The mistake - or the problem is that no rule was add...

Pilgrim

Surfertim,

Thanks, The same here. I will try to sent it to Mikrotik support. I will keep you informed.

rgs Pilgrim

Pilgrim

FTP worked without any problems using the browser. It really seems only tp be the HTTP traffic. Please don't give up on me. I really have no idea any longer where this problem is rooted.

rgs Pilgrim

FTP using browser.jpg

Pilgrim

I was using filezilla. I didn't try using the browser. I will make a test.

rgs Pilgrim

Pilgrim

Good point Surfertim, I just uninstalled the orange software and created a dial up connection in windows with the same APN, dial up and initialization string as used in the RB setup. And the pc connects without problems and everything is working-------- so what is it in my setup in the RB411U that b...

Pilgrim

I am using the same browsers - firefox and explorer It was a https site. You probably read it as http. Yes, I am using the USB modem (Huawei E156G) in both cases I just pull it out of the RB411U and put it in my PC and connect using the software provided by Orange sk (mobile partner). I tried to con...

Pilgrim

Hi Surfertim Thanks again. It is really a very strange problem. I am not using a proxy, but I may be that Orange is using one on their side. I don't know what impact that have on the setup. But right know all traffic is working except the HTTP. I tried to open a HTTPS site and it identified the site...

Pilgrim

If firewall and NAT is handled by your Zyxel router and you just need a Bridged AP, then it is very easy. You do not need to define any addresses or routes. Just create a bridge and put ether1 and the vlan1 into this brigde like shown in http://forum.mikrotik.com/viewtopic.php?f=13&t=34476 rgs P...

Search found 265 matches