MikroTik

someuser

I guess I was confusing https hotspot with https activitated on a Wireless Access point.

Thanks Normis

someuser

Hi, I have a small hotspot with a customer that wants to do sensitive data access online. He wants to be connected via a secured "https" access point. For the interim, i've given him a wpa2 key. So he is the only one at the moment that can connect. Can one suggest the best way to lock down...

someuser

Thanks again fewi.

someuser

Hi, I'm not clear on how to create an "https://login.hotstpot.com" page. I do have a purchased cert and it's installed on the hotspot router (RB750g), but I don't use it for the "https" login, As I don't have it enabled under the hostpot server profile. I do use the cert. to get ...

someuser

Thanks, So the wireless AP serving clients is the Unifi device by UBNT, I still haven't quite fiigured out whether or not they're actually VLAN functional. They do have the option in the software config, but whether or not they actually work, I'm not sure. Haven't read anybody actually making them w...

someuser

Thanks,
Yeah, I want to run separate hotspots.
To start, So, I do not need a VLAN switch down stream?
The Radio hardware is all VLAN capable.
I'll give it a go tonight, with what you suggested.

someuser

Based on the attached Diagram. If I want to add 2-3 vlan's to the hotspot on Network B so that Wireless customers (laptops) see 3 -4 SSID's with different subnets behind either one of the Wireless AP's? 1, Do I need to add a vlan capable switch behind the RB750G? ? Or is the hardware shown in diagra...

someuser

Interesting, I have exact same problem. Which vendor did you purchase from?
Streakwave by chance?

someuser

Will do...I just need to grab another switch
Yes, examples are good for me.

someuser

Yea.
I left that open, apologize for that open ended question.
But I think I get it now.
Thanks

someuser

OK,
Thanks
So, the config I've got is correct?

someuser

I've got a simple Hotspot setup on a 750g Internet ---> Modem----->(WAN interface1<--->RB750G<--->Interface2)------>(WAP-- 2 SSID's--1VLAN)---->Wireless clients I'm experimenting with my first VLAN setup. I have a wireless AP which has VLAN capability. It is wired to ether 3 or whichever is correct,...

someuser

Can't thank you enough Tim
I'm definitely getting more "closings" now that you've helped with your script.
THANKS Very Much!

someuser

You know what's needed (other than your fix) is a flash timer on the signup page counting down the clock to let customer know they've got to get er done before such and such a time, or their going to be sent directly to Mikrotik support with a pre-filled out form stating they're about ready to .......

someuser

(snip) Who knows how many people just give up and walk away. (snip) And how many internet-savvy users (like me, and probably you) won't pay at all after that? They reason that if you can't even collect their money without a problem, why should they trust the rest of your services? :( Bad news! And ...

someuser

Really an incredible piece of work there SurferTim! You're saving alot of people (if they use this) alot of money. Who knows how many people just give up and walk away. I've been getting quite a few people telling me they can't make the PayPal deposit. I have to add them manually then send them a Pa...

someuser

Oh yeah, I can imagine now, they think they're already on the internet as soon as they get to the PayPal site. Not knowing it's "walled garden". I should probably post something on the login page like; "move right along now folks or you ain't getting on". So, I've yet to load the...

someuser

OK! Now it works with no duplicate dynamic entries, thanks to Maris at support. You can't use "dst-host" and "dst-address" in the same entry in "/ip hotspot walled-garden ip". In V5.x, you will not be able to use both in the same entry. The scripts are in the wiki if y...

someuser

The PC I had my RouterOS 4.11 on crashed (bad motherboard). I took the Hard Drive out and tried installing on a Sony Vaio PC. I reinstalled from CD new RouterOS 4.6 to the hard drive but on reboot. I get "loading O1" and nothing past that. I'm thinking RouterOS doesn't like the Sony chipse...

someuser

Aha,
Thanks.

someuser

Hi, I'm running a fairly standard hotspot on my rb750g. In my firewall connections directory, I have a few IP's (usually only one IP at a time with many, many connections)that don't ping and aren't in my DHCP address list. These are generally the ones with over 100 established connections. It's in t...

someuser

wasting space, deleted.

someuser

I've got a very slow login page with Hotspot.
Is there a cache fix or?

I have 5 AP's connected to Box with RouterOS4.11. via bridged backhaul.
Once login page loads, everything is fine.

someuser

The most common cause would be that the RADIUS server doesn't have the router correctly configured as a client, and is ignoring access requests for that reason. Sometimes that is due to the router showing up with a different source IP address than you were expecting. Thanks, Got it fixed. Database ...

someuser

I've got hotspot working. Usermanager registers new adds new signups as they login and purchase time via PayPal. But, when user goes to login after purchasing credits. User is not able to login. Error "radius server not responding. Any suggestions as to the standard misconfiguration to cause th...

someuser

2 hour lease time shouldn't be a problem. Look at it in terms of operations per second. DHCP clients renegotiate the lease after half the lease has expired. For 2 hour leases, you will get (3600 seconds / 500 requests) =~ 7 seconds between requests. That is workable, but longer leases would be bett...

someuser

I have a large event which will I will be delivering Wireless Hotspots to @ 500 people over 5 days. People will be sold service for 2 hrs. 4 hours, 1 day, 3 days and 5 days. With basically 6 AP's all on same lan or not? serving wireless clients. Any suggestions as to best way to limit/maximize DHCP ...

someuser

You can. You will have to make the following changes: Make two VLAN interfaces, one for each Hotspot. One gets an IP address of 10.10.0.1/24, the other gets 192.168.88.1/24. You set up the Hotspots as usual but use the VLAN interfaces for them. You need the switch you have to be VLAN capable. Both ...

someuser

Generally speaking VLANs are different networks and can have separate DHCP pools. I'm a little confused by your layout, can you draw a picture? So attached is a pic. I hope that clarifies. So, I want to put 2 hotspots on the one box one interface. I read you generally do that, put 2 hotspots on one...

someuser

With 2 AP's (Wireless hotspots) connected to base AP via bridged wireless connection. Is it correct that one cannot create a vlan with one DHCP pool (subnet) going to the first Wireless AP and the 2nd DHCP pool (subnet) servicing the 2nd Terminal Wireless AP Hotspot via the same bridged connection?....

someuser

In Hotspot login page when user is given options of different prices to puchase time in drop down menu box. the "unlimited" option keeps coming up. I believe this is in either usermanager database or hotspot by default. Presently have created 3 choices: 1. Price X for 4 hours. 2. Price Y f...

someuser

Ahha, thanks.

someuser

UserManager should do what you want. I use FreeRADIUS, but the operation is similar on both. I sell internet access by the day (24 hours) at 384K/1M per connection. I don't care about how many times they login and out, how long they are on during that time, nor how much they upload or download. But...

someuser

I think it is because there is no corresponding entry for session-timeout in the router. UserManager is probably your best bet. You can get support for it from this forum. ADD: You might be able to disable/logout a user account with a scheduled script. Put the session-timeout value in comments and ...

someuser

How about a little help. Am I asking too much?

someuser

In hotspot When a user is alloted an amount of time either via user under "limit uptime" or user profile "session timeout". How does one keep the clock ticking, so that if user logs off time keeps running towards end of users time allotment. e.g. the user purchases 4 hours of tim...

someuser

Budget constraints aren't fun. Still I think VLANs are the way to go. You can pick up a used Dell PowerConnect for $20 and use just one switch for everything, there are other options. Hell, the 250GS from Mikrotik might (should) work for this. As long as the APs can do VLANs and support multiple SS...

someuser

I'm primarily concerned with making things work on the budget I'm on. I have an existing userbase of customers running through the RB750, with level 4 lic. Presently there's @ 10 -20 active users at a time authenticating with UserManager I'm plannng for an upcoming event which will have up to 50-100...

someuser

Will this setup work?
Can I eliminate either switch?
And Use 1 router to pass the 2nd Public IP to 2nd router?
Will it work with 1 AP interfacing to 2 routers each with own hotspot?
Can this be done with one router?
Thanks

topt.JPG

someuser

Your firewall filter forward rules are blocking the access. You need to allow the three ips through before the "action=drop" rule. add chain=customer action=accept src-address=192.168.1.109 add chain=customer action=accept dst-address=192.168.1.109 then do the same for the other two ips. ...

someuser

It's hard to say based on a bunch of context free screen shots. 64784 is a Hotspot servlet port that consumes HTTP. A slow web page with lots of resources could explain that, so would a malware infected host scanning web servers. So, I guess before I cut him off, I'll recommend he do some spyware s...

someuser

This might deserve a new thread, but maybe not.
Are these connections legit?
Thanks,

remote.JPG

someuser

That new picture is p2p. The original one was HTTP being consumed by the Hotspot servlet. Here's another pic same guy-(first pic). I think I scared the other guy off. So, What's this fewi? Bad app? This is servlet port? Ok this guy's been on my hotspot for @ 3 months now. He's doing something screw...

someuser

Look at the connection details. It's terminated on the router IP address (192.168.88.1) on port 64874. That's the HTTP servlet of the Hotspot, and only HTTP ports (tcp/80,3128,8080 by the default rules) are redirected to it. That guy's trying to hit a bunch of web sites and keeps on being served a ...

someuser

EXACTLY . C ee U N ext T uesday! is what I'm going to tell him if he keeps it up. Now he's got close to @ 800 connections going.. *&ck him. I do have some bittorrent rules in place. The P2P/bittorrent queues are lighting up. So, he's definitely doing bittorrent. I changed the login page, previo...

someuser

Capture.JPG

Is it pretty safe to bet that if one user has @ 80+ connections, he's doing P2P or?
I've got one guy slowed down to 256k. But he just puts his pc on auto and does his thing.
Here's a pic of some of the ports/connections.

someuser

You don't need more than a level 5 license (that will do 500 active users). Yes, I'd either use three different physical interfaces for three Hotspots, or three VLAN interfaces. If you're standing to make a bunch of money off the deal, and have a PC ready to roll, you might as well spend the $100 t...

someuser

I'm expecting to provide Hotspot services for @ 100-300 users at an upcoming 3-day weekend race event. Presently, I've got a 15/4 pipe into a 750g router/hotspot with never more than 10 users concurrently. I'm also using usermanager/paypal to close the deal. With the large amount of users, should I ...

someuser

Now in the wiki. http://wiki.mikrotik.com/wiki/GPS_text_file_converter_to_Google_Earth/Maps ADD: If you are interested, check back at the wiki now and then. I still must add the position valid check. Wow, incredible piece of work Tim! That has a great many app. possibilites. I'm waiting for Shark W...

someuser

Use a routerboard with ubiquity xr2 in the ground.. and the bullet in the aircraft if you like it. the 2404 or 2406U hiperlink are good, but I don't know if they will work, depending of the height you fly. Hi, I tried your site. Here in the U.S., yet I can't seem to be "allowed to request info...

someuser

hi guys i have my web proxy using 8080 port ive notice there is someone from outside using and exploiting my 8080 port i saw in torch at WAN port and in graph the upstream and downstream is same figure and also consuming upload and download, i decided to change any port and it solved my problem, yo...

someuser

hi guys i have my web proxy using 8080 port ive notice there is someone from outside using and exploiting my 8080 port i saw in torch at WAN port and in graph the upstream and downstream is same figure and also consuming upload and download, i decided to change any port and it solved my problem, yo...

someuser

hi guys i have my web proxy using 8080 port ive notice there is someone from outside using and exploiting my 8080 port i saw in torch at WAN port and in graph the upstream and downstream is same figure and also consuming upload and download, i decided to change any port and it solved my problem, yo...

someuser

/ip firewall filter add chain=forward p2p=all-p2p action=mark-connection new-connection-mark=p2p-traffic add chain=forward connection-mark=p2p-traffic src-address=192.168.1.0/24 action=add-to-address-list address-list-timeout=1w address-list=p2p-users Will add the source IP address of all p2p traff...

someuser

Hi, I know this is a many times repeated thread/request. But, I had a firewall/filter in place which I got from here somewhere. I can't seem to find what I'm looking for anymore. Just, a P2P filter I can install on my RB750G that tells me which IP on my network is abusing/using bittorrent P2P. Then ...

someuser

The chain is what by default downloads as intermediary.crt for Apache. It links you to Godaddy to a trusted root.

the clincher:

ip service set www-ssl certificate=cert1
did it

Read the manual.

someuser

Import the certificate file, then the private key, then the chain certificate file. Also, the certificate name is arbitrary and can be set in "/certificate". OK thanks, Chain certificate file is? I was issued from Godaddy 2 certificates 1st is "mydomain.com.crt" 2nd is "sf_...

someuser

I've purchased an SSL cert from GoDaddy, I've imported it and it seems to look ok, except that it's "unknown" Any suggestions? [admin@MikroTik] /ip service> print Flags: X - disabled, I - invalid # NAME PORT ADDRESS CERTIFICATE 0 telnet 23 0.0.0.0/0 1 ftp 21 0.0.0.0/0 2 www 80 0.0.0.0/0 3 ...

someuser

The Hotspot should be the layer 3 hop, or you're asking for trouble. The best way to go would be feeding the 750G VLANs on the inside and running separate Hotspot server instances on the VLAN interfaces. Thanks fewi for the response, I read something about the RB750G being minimal as far as Ram goe...

someuser

I have an existing hotspot setup. Internet------>Modem-------->(RB4750g)>PublicIP---Interface1-gateway---->Hotspot-Interface2----->AP bridge-->wireless<--------->Station-bridge----->WirelessAP---->Wireless Hotspot Clients. If I want to add another separate (DHCP group) pool of Wireless clients throu...

someuser

Don't give up now. You are almost there. Try a simple html page, like a html version of "Hello World". No video yet. Add that later. You will need to embed a video player on the html page, just like youtube does. That is what that code above from youtube does. It is a if..then statement. ...

someuser

Yes. ytimg.com needs to be in your walled garden. And that may not be the only other domain required there. I discovered from earlier experiences that the url of the video is contained in a .swf file loaded by the video player. So even tho there looks like a lot of code on that page (even on that o...

someuser

NO, not even.
Here's the link:
This is what I've put in walled garden. But, you already knew this.

http://www.youtube.com/watch?v=juZt0EhG5S8

Not quite sure what your suggesting Tim.
You suggest I should have the ytimg.com in my walled garden?
Tim

someuser

By default there are no filter rules. "Protect router" installs filter rules in the input chain to filter traffic destined to the router itself. "Protect LAN" - I think - installs filters that don't let traffic from WAN to LAN through unless it was initiated by a client on the L...

someuser

I cannot enable a site (video on youtube i created to demonstrate how to signup to my hotspot (for dummies). I've entered IP's in walled garden, the FQDN, everything, I think?, into the walled garden and walled garden IP. Also, I embeded the code created from the youtube video, pasted it into a simp...

someuser

Thanks again. You would be better off to have started a new thread. More people might know about the new subject, but little of the original. The problem is the complexity of youtube. Have you loaded the youtube home page, or any other youtube page for that matter, and looked at the html source cod...

someuser

Thanks for karma. No surf, but there was also no oil, so the flower was delivered. So very cool, for you to do that! :D You're very welcome, Your good karma is evident here and elsewhere. :) I've got a question: Should I start another thread? I cannot enable a site (video on youtube i created to de...

someuser

Hi, I've disabled and re-nabled my Nat selection from the webbox. All the filter rules have disappeared. By default is there nothing in the filter rules? Should I have the either of these enabled? The "NAT" enabled. The "protect router? The "protect lan" Or are these selecte...

someuser

I had a challenge like this a couple years ago. I had my radios (R52H) set for max power. The problem was they could hear my transmitter, but I couldn't hear theirs. I now set my transmitters to 22db and use antennas to increase the gain to max allowed by the FCC. Thanks again, I'll turn my ap down...

someuser

Hi oceanwifi! Is it always the same mac address? Looks like 00:23:12:09:67:0B If the pattern continues with that mac address, you might consider blocking a connection /int wireless access-list add mac-address=00:23:12:09:67:0B authentication=no Hey SurferTim, I have started doing mac filtering on t...

someuser

Hi all, Everynow and then My Hotspot AP will seem to stop giving out leases, seemingly because of an accumulation of 1 or 2 clients being offered leases and not getting one. The AP keeps trying to hand out leases to the one or two clients. The other clients seem to have IP's but the CCQ is non exist...

someuser

Only on the Putty software use port 8099. The remote router stays on 22. Thanks, Tim. So, Rtricer got it changed for me. Really super nice of him, as he remote'd in and did exactly what you just described. Actually he added another port: 9099 and forwarded to 22 on the AP and that was it. funny how...

someuser

I think you are missing the srcnat rules to convert the ports back. /ip firewall nat add chain=srcnat action=src-nat src-address=192.168.88.98 src-port=80 protocol=tcp to-addresses=98.173.*.28 to-ports=8099 Move the rule just after the dstnat for that ip/port. Same with the other dstnats. Otherwise...

someuser

Thanks. Yes, 5 years ago this coming Friday. If there is not a lot of oil in the water, I will paddle out Friday and take her a flower. I do every year.

That's really really sweet.

someuser

Oh yeah, I remember you guys coming down to try and surf my beach (Wind n Sea). Of course there was nothing to worry about. Just surfed circles around you. :lol: We called you all speed bumps, cause we had to slow down to surf over you. :lol: I don't think you'll be surfing over me. I know it isn't...

someuser

I don't understand what you mean by externally and remotely. Can you get a ssh login prompt if you use port 8089 from the internet? Did you change the port on the srcnats and dstnats from 80 to 22? No oil yet. Could be any day. :( I know about SoCal surf. I'm a transplant. I attended the same high ...

someuser

I think you are missing the srcnat rules to convert the ports back. /ip firewall nat add chain=srcnat action=src-nat src-address=192.168.88.98 src-port=80 protocol=tcp to-addresses=98.173.*.28 to-ports=8098 Move the rule just after the dstnat for that ip/port. Same with the other dstnats. Otherwise...

someuser

Am I missing someting in the firewall rule, or not using the correct interface, porting incorrectly, or? Hard to say without you posting the actual rules you configured. Also post how you bypassed the APs in the Hotspot. Generally speaking it would be a better idea to separate the customer address ...

someuser

Am I missing someting in the firewall rule, or not using the correct interface, porting incorrectly, or? Hard to say without you posting the actual rules you configured. Also post how you bypassed the APs in the Hotspot. Generally speaking it would be a better idea to separate the customer address ...

someuser

Hi, I'm able to get to my devices which are inside of my Hotspot and are NAT'd, have different ports forwarded to each AP or Station behind my RB750G. So, to get to my AP from outside, I just use my Public IP or domain name on Wan interface of router: http://domain_name.com:1234. My problem is tryin...

someuser

ID is not needed, when you are not using it. For the old User Manager customer prefix is explained here, http://wiki.mikrotik.com/wiki/User_Manager/User_sign_up So, I'm using 4.10 package. You consider 4.10 to be the old user manager, correct? I was under the impression anything newer as far as Use...

someuser

Thanks guys, Really appreciate the info/help. This is really a great hardware/software package, RB750G with a UBNT radios, haven't tried any MT radios. I'm now about 95% finished (need SSL cert.) getting the User Manager/PayPal working well with the HotSpot package. It really is a bit of a learning ...

someuser

radius-location-id (text) - Raduis-Location-Id attribute value to be sent to the RADIUS server radius-location-name (text) - Raduis-Location-Name attribute value to be sent to the RADIUS server Specific attributes to be used by RADIUS server. So why would one need to send location Id to Radius serv...

someuser

Hey Sergejs I GOT IT!!! YYYYYYEEEEEEEEEEEEEESSSSSSSSSSSSSSSSS!!!!!!! I had been using the first part of my domain name in the Location ID and Location name spot. I thought for whatever reason, something needed to be in there. I took them out and bam... It works. Wow.. what a relief. So, what is that...

someuser

Use 127.0.0.1 for /tool user-manager router and /radius client configuration. What do you have at /radius configuration? Here's the configs for User-manager router and radius client config. I've tried 127.0.0.1 on the radius client but not on user-manager router. As you can see I'm using the static...

someuser

Hi, I've setup Hotspot on RB750G and cannot get UserManager to authenticate. I can login with any of the users in the Hotspot database but can't get any of the users created in UserManager to login. I keep getting "radius server not responding". I've enabled Subscriber, Customer, credits, ...

someuser

Well done! Muchisimas Gracias :D Last question fewi (hopefully) To get each separate Hotspot to work properly with Paypal. Do I make the "return url" for which paypal gateway uses, the url of the ONE central Usermanager which does all authenticating? Is this IP configured on each Hotspot, ...

someuser

In my opinion the best deployment model is to create an individual Hotspot at each broadcast domain barrier, and use central authentication (RADIUS) as well as central login pages (allow that server in walled garden, use meta refresh redirects in the HTML on the router itself to point to the extern...

someuser

Got it, Thanks

someuser

Hi, I'm building a small network of Hotspots each with their own different physical locations and IP's. I have one central authentication server/UserManager. Is it ideal to create a Vlan with EoIP to manage the different hotspot lans by creating one virtual subnet? The benefits being? My question be...

someuser

Hi, I have a simple setup with a box configured with routerOS 4.9 I've previously gotten DHCP (public IP's) on all the boxes (with Hotspot) and all was fine. Now I've been given a static IP 72.214.*.44. I can't figure out how to properly add this to get out to internet. Modem is directly into ether1...

someuser

Thanks Sergejs,
Thats what I had thought but not yet implemented. You must have answered this one a few times.

someuser

I have Hotspot and User manager running on a box with RouterOS 4.9. which is behind a Netgear router. I've got ports forwarded to proper local ip's and everything but User manager can not be accessed remotely Which port should be forwarded on the Netgear router to enable the User manger remote acces...

someuser

Thanks,
/system reset-configuration did it.
Don't think I'll be playing with the beta webfig and disabling etho port 3 again.
That got it back to familiar settings.

someuser

Very clearly written fewi, U da man.
I've got same planned scenario as this guy
After struggling through a little html and UserMan... and now... I get it.
Thanks

noob wanna be

someuser

Hi, Everything seems to working fine. I recollect seeing different interface names, before the reset. 1st port was, "gateway ether1", now it's simply ether1. 2nd port was "master ether2, now simply ether2. 3rd port was slave? ether3. 4th port was slave ether4. 5th port was slave ether...

someuser

Hi, I had to reset the rb750g as I locked myself out by disabling the ethernet interface I was locally connected to. Now, I don't seem to have the same ethernet ports. i.e. 1-gateway, 2 master ethernet, 3-slave ethernet, 4 slave ethernet. I reloaded routerOS 4.9 but can't seem to see the same defaul...

someuser

Three things: 1. Go to web interface of user manager and select 'profiles' from the tab list on the left. Go to the 'limitation' tab and create a speed limitation to apply for 8am to 9pm e.g 256k/512k. Give it a name. 2. Still under profiles, go to the 'profile' tab and create a profile with validi...

someuser

[/attachment] /radius monitor 0 also, if it's on your local router, maybe use 127.0.0.1 instead of 192.168.88.1?.. Hi, I've changed IP to 127.0.0.1. Still nothing new. Here's an export (/radius monitor 0) from a different but similar setup with RouterOS (box not RB750G). [admin@MikroTik] /radius> mo...

someuser

Hi, I've configured my RB750G to authenticate with Usermanager. I can't get it to work. HotSpot works fine, Yet I can't seem to get Radius Server (usermanager) to take over. If I create users in usermanager and and use a created account, I'm able to get on internet, only after logging in with "...

someuser

Anybody recognize this as either a real threat or harmless script kiddy? Are there firewall implementations to drop the ip? ------------------------------------------------------------------------------ 010 Apr 19 19:24:50 [Lee Valley Router] [kernel] SYN-FLOOD IN=LAN OUT=WAN SRC=192.168.103.44 DST=...

someuser

A friend of mine is having an issue with a user on his net. Anybody point me to a script to drop this user or perpetrator trying to cause a Denial of service. Script kiddy? or real threat? ------------------------------------------------- 010 Apr 19 19:24:50 [Lee Valley Router] [kernel] SYN-FLOOD IN...

Search found 102 matches