MikroTik

vetusa2

help please !

vetusa2

hello rulers of Mikrotik planet just wondering here if there is a method or script to block any range of mac addresses by vendors let say i want to block all tp-link or all d-link or all belkin mac addresses to lower the risk of anyone connecting with these devices to my network,is it possible ? can...

vetusa2

hello rulers of Mikrotik planet just wondering here if there is a method or script to block any range of mac addresses by vendors let say i want to block all tp-link or all d-link or all belkin mac addresses to lower the risk of anyone connecting with these devices to my network,is it possible ? can...

vetusa2

how to make a layer7 rule that can resolve hostnames of port 443s and 80s connections and then block specific ones in the firelwall ?

vetusa2

use longer security keys with WPA2 and AES ciphers. It was compromised for shorter keys

how long ?!

and how to do it ?

can you give me an example please.

vetusa2

things got different lately

any comments about this :

http://null-byte.wonderhowto.com/how-to ... g-0148366/

https://www.youtube.com/watch?v=wP47B2fHRZQ

vetusa2

Quote "we bounced the user off their own AP, and now when they re-authenticate, airodump-ng will attempt to grab their password in the new 4-way handshake."

what to do to stop users on my network from getting bounced and get the deauth ?

vetusa2

how to set diff amount of "addresses per mac" for each user?

vetusa2

vetusa2

you talk well.....you are o.k.

can you provide me a direct link for that ?

vetusa2

LOL

i knew it

i wanted to hear it from an expert "Guru" to connect the dots

i just wonder now if they use the CALEA package

ho ho ho

did my isp bought hundreds of licenses of the mikrotik v6.5 from you guys ?!

vetusa2

i see no experts talking about this issue

comon guys

vetusa2

my router ip range is 100.0.0.0/24 this ip 192.168.15.1 is over a maximum of 30 hops it means it is not on my network ! did i mention that my public ip starts with 41.xx.xx.xx and i use opendns ips for dns which are Primary DNS 208.67.222.222 Secondary DNS 208.67.220.220 i checked the router log 100...

vetusa2

check this out guys i ran a traceroute from my 3com router's GUI and recieved this Tracing route to 192.168.15.1:33435 over a maximum of 30 hops, waiting timeout 5000 ms: 1 100 ms 100 ms 100 ms 163.121.170.34 2 * * * Request timed out. 3 * * * Request timed out. 4 100 ms 100 ms 100 ms 10.37.243.185 ...

vetusa2

i use 3Com router code 3CRWDR101A-75 Software version 1.12.04.A (10 Sep 2010 17:19:34) the router has 4 ports and a wifi ,i use 2 ports for 2 mikrotik servers and the wifi for a belkin with ddwrt firmware and an LG smart TV now forget all that and focus there is a weird IP that doesn't belong to any...

vetusa2

i have mikrotik 3.30 with 2 tp-link wireless cards dhcp server is runing with range 10.0.0.0/24 i made a logical bridge from the bridge menu then added the 2 wireless interfaces in ports menu i made first and second tp-link cards with different ssid names i have a web server runing and connected to ...

vetusa2

yeah! smart idea to block by ip but what if it is a secure link for some ads on youtube.com....you think if i block by ip my users will be able to access youtube.com ?

and for Chupaka i say to him when i said i know how to bock regular http links, i mean "it is a hint"

vetusa2

help please!

vetusa2

i know how to block http links

but...

how to block ((( https ))) links in mikrotik?!

vetusa2

that is what i want to ask about

in the hotspot server we put address per mac =1

but is it possible to have this option (addresses per mac) different for each user?

vetusa2

Different address per mac for each user???

how?

can it be done?

vetusa2

i can't do it man even when i read it

look all i want to do is to block https://www.facebook.com/ads/

vetusa2

in simple words : i want to block these links ....how? https://www.youtube.com/subscribe_widget?adformat=2_2_1&p=SpKWMSmL8m-0XXqaPGtQKw&render=video_wall_companion it will be perfect to block anything under "https://www.youtube.com/subscribe_widget?adformat=" also https://ads.ak.fa...

vetusa2

your idea is good when any user on the network visit a website,but what if his pc contacted an infected website silently?

vetusa2

how to send warning ads messages to users infected with pseudo-random domains that is blocked by names in the mikrotik's webproxy? if a random user's pc on the network keeps connecting to a well known infected website that is blocked by mikrotik sever's webproxy ,why not block that website from the ...

vetusa2

The Conficker worm can also disable important services on your computer. Blocking Conficker Domain Names: Will It Work? One important effort to try and stop the Conficker worm from being activated by its creators on April 1 and beyond is blocking the domain names that it may use for… Read full vers...

vetusa2

Seventh shot /ip proxy access add action=deny comment="" disabled=no dst-host=*ebudlmohn.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*cjgjzi.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*grupobhl.info* redir...

vetusa2

thanks richinuk for the good info some networks have some careless users and therefor i intend to blacklist these domains on mikrotik website you said 50 000 domain names ,can you provide me with a link to the list? the question is how the hackers registered all of these domain names and where are t...

vetusa2

well... what about normal people not expert people?! i mean comon how can you block a conficker worm and protect your users on a the local network even when you ask them to block the well known ports for it too? i have seen people with closed ports getting it too,it just changes it self everday and ...

vetusa2

fifth shot /ip proxy access add action=deny comment="" disabled=no dst-host=*ehexndwn.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*czbpfbsbv.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*evjmnnplfjt.info* re...

vetusa2

no one is perfect especially these days!

vetusa2

Fourth Shot /ip proxy access add action=deny comment="" disabled=no dst-host=*bkdpqnxrwx.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*bhbxwbfoifb.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*bnwmdze.info* r...

vetusa2

Third Shot /ip proxy access add action=deny comment="" disabled=no dst-host=*lqechrmw.net* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*wrrtrjolr.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*swinvavm.net* redirec...

vetusa2

here is a Second Shot with different servers /ip proxy access add action=deny comment="" disabled=no dst-host=*hcpckvlo.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=no dst-host=*grpdkzm.info* redirect-to=127.0.0.1 add action=deny comment="" disabled=n...

vetusa2

how to force your users to watch youtube in 240p? is it a script or a layer7 + mangle ? i want my users when they go to watch anything on youtube to watch it at 240p then they can choose from the youtube drop down menu button any other quality ! or just redirect every high quality videos on youtube ...

vetusa2

Impact in Europe Intramar, the French Navy computer network, was infected with Conficker on 15 January 2009. The network was subsequently quarantined, forcing aircraft at several airbases to be grounded because their flight plans could not be downloaded. The United Kingdom Ministry of Defence report...

vetusa2

i wonder why they did it this way

thx m8

vetusa2

i believe you said

"Now, if you want to force ALL PAGES to be HTTPS... then you can do that in the facebook settings for each individual facebook user. Then, EVERYTHING is SSL."

okay!
so can it be done from mikrotik proxy by redirecting some facebook links or any other way?

vetusa2

can you give any reference page on how to "block MAC-ID ranges"

or one or two examples?

second question...is the mac-id the same so called client-id in the dhcp lease?

thx

vetusa2

will this answer your question and make you believe?!

vetusa2

not from my location!

in my location it is http://www.facebook.com

vetusa2

how about pictures and comments and even email addresses and most important http passwords?

vetusa2

are you sure?

not even sniffing

vetusa2

is there any way or even a scheduled mikrotik script to reset the mac address of all joined users by returning its values to factory defaults,and not related to dhcp scripts? is there an html script that can be run as ads in the mikrotik server to reset the mac address of all joined users by returni...

vetusa2

lol

let me type in your language then

i want them to be working on https://www.facebook.com and not on http://www.facebook.com !

vetusa2

is it possible to block a range of macs by vendor?

lets say i want to block people with androids from connecting to my server or even people with iphones?

can it be done?

vetusa2

is there any working solutions then?

vetusa2

echo!

vetusa2

can you provide me with the layer7 script?

vetusa2

didn't work !

vetusa2

hello!

vetusa2

i would like to force my network users for their own protection to use to https://www.facebook.com instead of http://www.facebook.com

how???

vetusa2

to protect my network

vetusa2

how?!

vetusa2

thx to you siprox i started to use it already but i am limited with 5 users only while using that software ,any better software ?

vetusa2

simple question

how to browse the proxy cache ??

i mean how to be able to run exe files located in the mikrotik server cache,open cached jpeg ,watch cached movies or copy entire mikrotik cache folder to my local pc?

vetusa2

any reasons for that?

vetusa2

hello!

echo!!!

anybody there?!

vetusa2

RouterOS v5.14 do support Alfa AWUS036NHA

but...

does RouterOS v5.18 support AWUS036NHA as well?

also is there any hope for RTL8188RU chips to work with any routerOS version?

vetusa2

Changing Specific Freq to another one by time

how?

is there any script for mikrotik server to let the wireless cards auto change between 2 or more specific frequencies on certain date or time or both ?

vetusa2

i respect talented people

vetusa2

So much lols zomg BTW that youtube vid of WPA hacking.. is a joke, lmao have you used backtrack or cain correctly? this is just the simple use for users with simple passwords,there are more methods but kept for self use http://www.irongeek.com/videos/airpcap-cain-wpa-cracking.swf just learned 6 mon...

vetusa2

what could be the problem guys?!

vetusa2

the script is correct which is # DNSoMatic automatic DNS updates # User account info of DNSoMatic :global maticuser "user" :global maticpass "password" :global matichost "Yourhost" # No more changes need :global previousIP # Print values for debug :log info "DNSoMa...

vetusa2

suddenly my dnsomatic stopped working 2 days ago,as i investigated the issue i found that the script depending on dnsomatic to update opendns failed for some reasons one of them is because of the line checkip.dyndns.org requests checkip.dyndns.org shows local ip instead of the public ip i need an ad...

vetusa2

i add my request too

vetusa2

may be in Brazil there are lots of criminals ,but in our situation we need that option to limit users that are not on our network from trying get the identity of the network runing in the air.

vetusa2

/ip firewall layer7 add name=ip regexp="your Real IP" /ip firewall filter add action=drop layer7-protocol=ip But this code have problen, not all browser can open websites content your ip firewall chain is forward correct? can i use the true static ip address"bla.bla.bla.bla" ins...

vetusa2

vetusa2

lets do it for the decrypted then !

vetusa2

i am sure that a script can do the job ,just remember guys everything is possible in the pc world,just how to do it,or how it can be done? i am thinking to redirect codes that include the the word "your ip address" into a local page with some scary words about safety! can it be done? http:...

vetusa2

how to hide the public ip address from network users so if any user visited google or any websites like let say "whatismyip.com" he gets his local ip on the network. i don't know how to do it and not sure if it can be done by a script or the proxy of the mikrotik server. in simple english ...

vetusa2

thank you fewi "I HAVE DONE IT!" just came back to tell you and without too much talking and in short words steps are: 1- a full working primary mikrotik hotspot server to handle all http requests from a slave mikrotik server with enabled (ap bridge) b/g mode wireless cards with automatic ...

vetusa2

why not leave the hotspot but instead of it redirecting people to the mikrotik ftp's login page it redirect them to an external html page on a local webserver ?

vetusa2

is it possible for anyone to be able to connect to my wireless mikrotik hotspot without seeing the login page and automatically gets connected to the internet without me using a bypassing command since the users will be with unknown mac and dunamic ips? without even using the trial hotspot in plan t...

vetusa2

can it be done without the existence of external router or external dns? i mean dhcp can use pool range 10.0.0.0/24 only ,also static dns can be used and no need to creat a hotspot login pages i guess only a redirect html page of free trial with direct link to to 10.0.0.10 in mikrotik's ftp what do ...

vetusa2

all i want is when people join my network via wireless access that is controlled by mikrotik server,when they open there browser mikrotik direct them to the webserver with or without a login page

vetusa2

while eating my dinner i asked myself a question "is it possible to let mikrotik be a gateway for an internal webserver only?" in simple words i want to broadcast a webserver as a hotspot in my area without offering internet access....so if it is possible then how? the webserver ip is 10.0...

vetusa2

that is true it blocks some ad webpages known for infecting people with viruses and spywares and on some porn websites it injects trojans. you should read more about doubleclick ,rad.msn and macromedia flash injections if you need help just go to: http://www.youtube.com/watch?feature=player_embedded...

vetusa2

VTS means Virus Trojan Spyware

vetusa2

/ip proxy access
[REMOVED: FOR NOT INDEX/LINK ON SEARCH ENGINES MIKROTIK WITH ALL THIS WEBSITES...]

vetusa2

lol

i knew you'd say that

correct me if i am wrong

on the wireless adaptor only ,MFP is to protect RouterOS to RouterOS from deauth attack but not to protect RouterOS to end users from MAC address cloning issue or deauth attack.

vetusa2

Hacker can use same MAC address as legitimate user, so blocking by MAC address is not very good solution. i agree with you ,same as the mikrotik hotspot user account too it uses mac auth +username+pass+ip address by the way.. any good news on the mac duplications issue as you call it "MAC addr...

vetusa2

but still 00:00:00:00:00:00 mac address is a risk for being not able to block it from attacking the network! at least you can block any other macs...correct? just remember running a hotspot with a log in page will be useless this way! i am with you that using WPA-EAP is a way arround the problem i l...

vetusa2

just to let you know,lately they use the PCI Express video cards GPU's to break passwords in 2-3 days instead of months with regular CPUs.

vetusa2

just an example but not the way

we want to protect our self not to spread the words

http://www.youtube.com/watch?v=Bkj3TBu0ZV4

vetusa2

Dear kirshteins 00:00:00:00:00:00 mac address is a security hole in Mikrotik exactly when someone trys to take it either to do an ip scan on the network to get mac addresses of all users or to lunch a dns poisoning attack,you guys should add an option to be able to block any single user from taking ...

vetusa2

of course anytime m8.

yours
Sam

vetusa2

oh boy oh boy! MikroTik Support asking me how to block by mac i will tell you how i do it on the wireless network as a beginning from the access list of the wlan adapter add by mac then uncheck both forwarding and Authentication then create any fake private keys this will block any unwanted visitors...

vetusa2

as we all know when we try to change our ip address to use a static ip address in microsoft windows we go for the network connection properties,we also know that entering a new ip address is under some rules and conditions. microsoft windows will refuse letting you put in the first octet any number ...

vetusa2

adslgate link is down!!

just say it in easy way so everybody understand you.

vetusa2

lol radar detection you mean ? wrong answer DFS with radar detect will change the frequency only when it identify a military radar in it's frequency but not another AP in first case scenario the AP continues searching for the next available channel which is with the lowest so imagine you are in the ...

vetusa2

is there any Script or a any way or anything to let Mikrotik server chooses the best or strongest wifi channel or even change to it automatically?

i suffer from people around me with too many wifi devices and keep changing channels to work just fine back again!

vetusa2

then i will go for the PIM option

but i have a question first

IGMP v1: RFC 1112

IGMP v2: RFC 2236

IGMP v3: RFC 3376

which is the best version to use with mikrotik servers to get the best QOS and best streaming speed?

vetusa2

just to remind you guys

all i wanted is to be able to broadcast using ip 10.0.0.255 or to be able to multicast from ether2 to the entire network including wlan 1 and 2

i use dvbdream and vlc to stream from ip 10.0.0.1

vetusa2

here is my configs http://up.arab-x.com/Oct11/NC303397.jpg /ip firewall address-list add address=172.16.0.0/12 comment="" disabled=no list=illegal-addr add address=192.168.0.0/16 comment="" disabled=no list=illegal-addr add address=192.168.0.0/16 comment="" disabled=no ...

vetusa2

i chose the broadcast solution i allowed the igmp service from the firewall and the udp protocol too. i went into igmp proxy and chose the nic card that is hooked to the pc with the satellite card as upstream with alternative subnet as 0.0.0.0/0,then i entered the second nic card connected to the se...

vetusa2

i think using a dns service like Opendns.com is a solution,the paid for membership not the free one which allow to add a big list of websites to be blocked or to be reported or to use a 3com officeconnect router with updated spyware and parasites/hijackers/adware/spyware list.

vetusa2

that's true

i have a usb nic card and didn't stand long

i think a usb virus in the server cache is the reason

vetusa2

RouterOS only supports ATHEROS wireless chipsets. So, no. does it means that alpha usb wifi adaptor model AWUS036NHA with AR9271 chipset will work ? http://www.alfa.com.tw/in/front/bin/ptdetail.phtml?Part=AWUS036NHA&Category=0 i took a look in http://wiki.mikrotik.com/wiki/Supported_Hardware it...

vetusa2

alpha usb wifi adaptor model AWUS036NH (chipset RT3070)

specs
http://www.alfa.com.tw/in/front/bin/ptd ... ory=105463

mikrotik+AWUS036NH

can it be done?

vetusa2

you should read this to understand what i am trying to do http://www.bestsupertech.com/2010/04/lan-how-to-stream-using-dvb-dream-and.html after reading that how to make mikrotik passes broadcast stream from a regular pc with ip 10.0.0.1 to ip 10.0.0.255 on a small local area network which is control...

vetusa2

so from what you guys said i should be runing mikrotik server on a strong cpu and lots of ram, then enter the parasites list one by one?

i think there is a way but we need to think deeper

where to enter the parasites list in the mikrotik?

firewall or proxy?...or may be somewhere else?

vetusa2

how to make mikrotik block all this Parasites list?

http://winhelp2002.mvps.org/hosts.txt

vetusa2

i finished reading and became more confused! igmp asm 239.0.0.0/8 ssm 232.0.0.0/8 PIM-SM Sender -- (subnet I) --> Router A -- (subnet II) --> Router B -- (subnet III) --> Receiver yukkkkkkkkkkkkkk sorry for that but all i need is Sender with dvbdream--> 1 Mikrotik Router --> Receiver with vlc client...

vetusa2

thanks but i am kinda confused please give me some commands to put it directly in new terminal so i can understand our network config is: 10.0.0.0/24 our mikrotik dhcp server ip is 10.0.0.254 our subnet is 255.255.255.0 our default gateway is 192.168.100.1 our dns servers are 192.168.100.2 and 192.1...

vetusa2

after i set the adaptive noise immunity option to none everything worked okay!

it was on for both ap and client

vetusa2

let say i want to do this for any other reasons

can it be done?

vetusa2

comon guys can we do it?

vetusa2

i know how to use the vlc streaming options but the mikrotik server is not allowing the multicasting!

vetusa2

we have a working satellite dish card connected to a pc in our network that is controlled by mikrotik pc server the pc is using a program called dvbdream to navigate between satellite channels which also include an option to stream live to the local network using a protocol called UDP ts on port 123...

vetusa2

our network range is 10.0.0.0/24

every time i try to stream a video to all my network members throught ip 10.0.0.255 using vlc player's streaming option my pc gets blocked from internet access!

how to allow vlc player's rstp protocol to work without issues?

vetusa2

what about them using the same account info with a small diff

first letter in the second account is capitalized

ho ho ho

vetusa2

yes if you want to avoid overflow in some chineese pc parts or to give it some time to cool down or to get more lifetime.

vetusa2

how to put mikrotik server in sleep mode for 30 min only then starts by itself after that just to give the hardware a rest?

vetusa2

dear mikrotik staff a week ago many people on my wireless network started to suffer from a power surge windows warning messages other people complained too that their laptop wireless network cards became very very hot as soon as they connect to my network one female user on my wireless network calle...

vetusa2

both hotspot & ppp users of course

comon guys the question is for pro people only, they will have the answer without wasting time.

vetusa2

my question is for the Prof people only

How to allow over 2 pcs to work using the same user account and or with one condition

only one user can work at the time

same like msn messenger user login and AOL

vetusa2

what about me?

it worked but the download speed from the webserver is at 15kb only!

please help

Search found 119 matches