MikroTik

GlueGuy

Follow on the above.

How does the VLAN priority relate to the DSCP priority? Or does it?

A bit more detail in the documentation would be helpful.

GlueGuy

Would love to be able to configure SwOS with winbox or winbox-like tool that allows L2 access without concern for IP addresses.

GlueGuy

We have installed a total of 3 RB260GS switches, and 2 out of 3 have failed within a month or two of initial installation. In both cases, it appeared to be some kind of internal power problem; no lights of any kind, but the ethernet ports appear to be sending carrier to connected equipment. We are n...

GlueGuy

+1 for me on this too. Would be very helpful. Or at least a "comment" field associated with each port.

GlueGuy

We are using a pair of RB260GS switches to merge several VLANs into a single upstream to a remote router. We have several different "guest" VLANs (VLAN 20, 30 & 40) plus one "business VLAN" (VLAN 10). The traffic on the guest VLANs is quite variable, and sometimes adds unwant...

GlueGuy

Once I set up a few of these, I think I mostly understand how to setup VLANs on these guys.

However....

It would be nice if we could label the ports on RB260GSx devices.

When you have a half-dozen VLANs going, having labels on the ports would help keeping things straight.

GlueGuy

Why do you even have dhcp enabled?

It's a backup link on a PMP subnet.

GlueGuy

Is that on R3? Is there a reason not to use static IP assignments on that router?

That's what broke it, I believe. Switched it to DHCP, and you can set the distance when the static is applied.

GlueGuy

This fixes the problem:

/ip dhcp-client set 0 default-route-distance=200

The thing that was confusing me was that the /routing ospf route table showed the correct route, but was being over-ridden by the default route in /ip routes table.

GlueGuy

Is your default route being flooded from a router not in the picture? Is it being exported as type 2 and not type 1?

We have all the export settings = no (the default setting).

How would I tell if the default route is being flooded?

GlueGuy

Post full /routing ospf export from each Here they are slightly sanitzed. R1 /routing ospf instance set [ find default=yes ] router-id=10.13.0.2 /routing ospf interface add interface=ether8-vpol authentication=md5 authentication-key=<pw> network-type=point-to-point add interface=ether9-hpol authent...

GlueGuy

I think I'm running into an issue with a two-hop path versus a single hop path, but I don't know how to fix it. We're interconnecting the site at R3 with another site with R1 and R2. R1 and R2 are interconnected with 1 Gbps at one location. R2 is connected to R3 with a 490 Mbps microwave link. So th...

GlueGuy

I have a new out-of-the-box RB260GS with a non-functional SFP LED. So is this a hardware problem or a software problem?

GlueGuy

A couple questions about the QRT.

Does it have 1 or 2 ethernet ports?
If 2, does the 2nd port provide passive POE?

GlueGuy

Thanks for the sanity check fewi. It's great to have someone like you to bounce these things off of. We leave rule 10 in place because we have a very small number of private IPs we use at the NOC that actually do come in from the WAN side. Kind of our back(or is it front?) door. The customer does no...

GlueGuy

I think I get it. Since the packets "coming in" were actually on a dynamic "internal" port, I decided to fix this by just allowing incoming traffic from any local port (AKA not the WAN port) which on this router is ether1. The rules now go like this: [admin@XXXX Router] /ip firew...

GlueGuy

I think I fixed it by allowing packets from pptp-in thusly (right after the gre rule):

 9   ;;; Allow incoming from the pptp-in port
     chain=input action=accept in-interface=pptp-in1

Although it's not entirely clear to me why I needed to do this.

GlueGuy

It appears that I am blocking it. When I enable the firewall rule to print packets about to be dropped, I get this: 11:51:32 firewall,info Drop input: in:pptp-in1 out:(none), proto TCP (SYN), 172.16.1.198:56043->172.16.1.1:8291, len 32 I do have port 8291 enabled for services (see below). Do I need ...

GlueGuy

I've set up a PPTP tunnel, and it works up to a point. I am able to ping every device on the subnet, but I am not able to access the router through a local IP (e.g. Winbox). So I figure I am blocking something in the firewall, or I need a proxy ARP or something to get two-way communications actually...

GlueGuy

Thanks for the very quick response. I guess I hadn't tried that variation yet. I did look at another router, where I had it working properly, and sure enough, it didn't have the PPTP conection-type modifier.

When I dropped that, it started working correctly.

GlueGuy

I've got a new RouterOS installation, using my default filter settings that is not allowing VPN access. I set up a filter rule (# 6 below) on the input chain to allow access through the PPTP port (1723), but it's not triggering. Instead it's falling through to the "drop everything else" ru...

GlueGuy

Normis had posted that 4.11 would fix this issue.

However, there is nothing in the 4.11 release notes to indicate that this issue has actually been fixed.

Has anyone downloaded 4.11 to see if it addresses this issue?

GlueGuy

In trying out this "feature" it appears that this does not actually configure the ports as a "switch", but rather as a "hub". IOW - all the incoming traffic on any of the ports is echoed out the other ports that are grouped together. This seems to be more like port mirr...

GlueGuy

just to be clear, you mean the window placement isn't being saved, but the actual graphing data / history is still there. right ? Essentially. The data still gets saved, but the graphs are not only not being placed correctly; they aren't put up at all. For example, I almost always leave the log dat...

GlueGuy

As I stated, I have the "Load Previous Session" box checked in the winbox loader, but the graphs are always lost on the next session.

So is this unique to me, or is this a bug, or is this by design in 3.x?

GlueGuy

make sure you have "load previous session" when you connect via winbox

Do you mean on the winbox settings?

o - Keep Password
o - Secure Mode
o - Load Previous Session

I have all three of these checked. But the graph settings are always lost.

GlueGuy

Back in the 2.9.x days, we would start the graphing resource on several of our Mikrotik routers. We could then logout/exit from that winbox, and when we returned, the graphs would still be there, in the same place, and same size window. However, since upgrading to 3.x, we notice that the graphs are ...

GlueGuy

Thanks Hilton,

We'll give that a try.

GlueGuy

We have an RB532 set up in a small company as their primary router. We are using all three interfaces, ether1 to the WAN, ether2 to the LAN, and ether3 to a remote building (LAN2). A computer in the remote building needed access to their Windows share resources (printers and file shares). So we brid...

GlueGuy

Personally i would not bother to change to much of the network for one user. If you have a special guest network, security might be an issue.... Well the "one user" is actually a sales computer that "belongs" on the Corp LAN. Unfortunately, it's in a different building than the ...

GlueGuy

I think I may be making this more complicated than it needs to be, so perhaps someone that has done this before can help me out. We have a wired network, with two separate LANs: Corp & Guest. We set up the Corp network for the business, and all the Windows machines can see each other. We set an ...

GlueGuy

I have a client that wishes to not allow "the boys" to have access to the "adult" portion of their network, but does want to allow "the boys" to access the internet. It seems that I can simply allow only one-way traffic between the internet port (ether1) and the two loc...

GlueGuy

Thanks for the replies. So it seems (to me) that if we actually route the two interfaces, we should be able to exchange UPNP packets between the two subnets. I think all we have to do is set both ethernet ports to "internal" for UPNP settings. Correct? This way, I can drop new connections ...

GlueGuy

Thanks sergejs,

I looked through the 2.9 manual to find more information about the use-ip-firewall switch, but couldn't find anything.

Is this only on 3.x?

GlueGuy

We have a client that has a special request involving three ReplayTV units that "find" each other via UPNP. This allows them to share the libraries of videos on any Replay unit from any other Replay unit. He has two "public" units; call them RP-A and RP-B that are attached to his...

GlueGuy

This seems to have been fixed in a software update somewhere between 2.9.38 and 2.9.45. I updated from 2.9.38 to 2.9.45 this morning, and it's now been a couple of hours without a single de-auth.

GlueGuy

I'm seeing the same problem with a Senao client bridge (EOC-3220EXT). Every 5 minutes on the group key update, we get this error: 17:33:53 wireless,info 00:02:6F:49:F9:ED@wlan1: disconnected, decided to deauth: group key handshake timeout (16) 17:33:54 wireless,info 00:02:6F:49:F9:ED@wlan1: connecte...

GlueGuy

We ended up putting in a 2' (60 cm) dish with a dual polarity feed (from mWave). Operating on 5.7 H-pol, and 5.2 V-pol. Seems to be working fine. We get about -65 db both ways, and generally run at 54 Mbps radio speed both ways. Our speed tests show fairly consistent 20+ Mbps both ways, full dux. Th...

GlueGuy

So the first three rules' comments should be corrected to something like: add chain=icmp protocol=icmp icmp-options=0:0 action=accept \ comment="Accept ping reply packets" add chain=icmp protocol=icmp icmp-options=3:0 action=accept \ comment="Accept destination/net unreachable packets...

GlueGuy

I was reviewing a new MT installation, with which I had installed the icmp filter chain per the 2.9 manual outline on page 446: add chain=icmp protocol=icmp icmp-options=0:0 action=accept \ comment="drop invalid connections" add chain=icmp protocol=icmp icmp-options=3:0 action=accept \ com...

GlueGuy

We're considering using nstream2 for a PTP backhaul. Current requirement is that it be able to do 10 M bps full duplex, but it is likely going to have to go a bit higher than that (possible up to 25 M bps or so). Currently the link is on a Trango T-link-10, which has been working flawlessly for over...

GlueGuy

I don'[t know that our WRAP-based tiks take a "long" time. It's certainly not a few seconds, but it's also not "several minutes". I'd put in the 45 seconds to a minute range, but I've never timed it. You may just have a miss-match between the baud rate, and other serial port sett...

GlueGuy

Thanks for all the help guys. The answer is NO. The POE in via the ether1 interface is NOT directly connected to the J9 power input jack. They each have (apparently) separate reverse polarity protection diodes. So the power coming in via the POE does NOT appear on the J9 jack. Likewise the reverse i...

GlueGuy

We would like to run an RB133 via POE. No problem, this can go in via the LAN1 port. However, we also want to run another device (about 6 watts) and connect in through the LAN2 port. I know the LAN2 port doesn't have power on it. However, would the power from the POE be available from the power jack...

GlueGuy

I thought the rule: ;;; Allow established connections chain=forward in-interface=LAN2 connection-state=established action=accept would only pass connections that are already "established". so... new connections (ones that are being established (e.g. new connections), would not match this r...

GlueGuy

Not sure what you mean there. Are you saying to make it like this?: ;;; Drop invalid connections chain=forward in-interface=LAN2 connection-state=invalid action=drop ;;; Allow only 40 connections chain=forward in-interface=LAN2 protocol=tcp tcp-flags=syn connection-limit=40,24 action=reject reject-w...

GlueGuy

We have LAN2 on our MT set up for guest access. We want to limit the total number of connections for all the clients on LAN2. It's not clear to me whether this rule limits "per client" or globally on the LAN2 interface: ;;; Drop invalid connections chain=forward in-interface=LAN2 connectio...

GlueGuy

This is somewhat weird, and I can't say that I've ever seen anything like it before. Installed an RB532A with 2.9.38 on it today. As I was showing the user around the interface, we were looking at the DHCP leases, and noticed that their Windows 2000 server had leases on about 6 or 7 IP addresses (ac...

GlueGuy

Hear! Hear! My sentiments exactly! The manual is a reference manual for someone that already knows and understands a lot of the special word usage. However, there is little or no context about many of the concepts used in the manual; and too few examples to put a lot of it together. It took me quite...

GlueGuy

Until someone explained to me the difference between the different chains, specifically the INPUT, OUTPUT, and FORWARD chains, I was pretty much clueless about how this works (no thanks to THIS particular forum). For the co-clueless, it helps a lot to know that the above mentioned chains work like t...

GlueGuy

Hi, We have a RB532a with three ethers; WAN, LAN1, & LAN2. WAN goes to the public internet LAN1 is internal, private network LAN2 is the "guest" network The desired result is to give the guest (LAN1) network access to the WAN, but NOT LAN1, EXCEPT for one computer that is on LAN2 that ...

GlueGuy

Well... I _thought_ it was a good question, complete with an ascii drawing. Sure there is a way to make this work with a couple of mT routers, one at the main building, and another at the remote building. Set up a VPN for the one computer over there to tunnel into the main network. However, because ...

GlueGuy

nudge

GlueGuy

What's the deal? Have I got you all stumped?

GlueGuy

So this is either too easy or too hard?

Which?

GlueGuy

We have a customer that has a "remote" building in which they provide fee-based network access for their customers. Because of the distance, we set them up with a VDSL connection to this building over one of their own in-house twisted pairs. Works pretty good, the VDSL provides up to 16 Mb...

GlueGuy

Hmmm. This is for our office router, so all the clients on the LAN side go through the MT. As it is, I have the DNS on the MT set as follows: Primary DNS: 65.xx.24.xx Secondary DNS 65.xx.16.xx Allow Remote Requests: YES Cache Size: 2048 When I look at an individual (office) client via ipconfig, the ...

GlueGuy

Ah. So it actually allows the cache to be useful? So if I understand it correctly, with the Remote Requests switch _off_ , the cache is by-passed, and client requests go directly to the actual DNS servers that are configured? And with the switch _on_ , the MT will act as a mini-DNS server for items ...

GlueGuy

I've scanned the manual, and browsed the forum, but I'm still cloudy on one of the options for DNS. Under /IP DNS, there is a setting labeled "Allow Remote Requests". What exactly does this do? I've currently got this option checked and I also have our provider's two DNS entries in the ava...

GlueGuy

Yah.

I bit the bullet and loaded it up on a 128MB CF. Lots of elbow room because I'm only using a few packages (no wireless, or any of the oddball stuff)...

Thanks for the help.

bp

GlueGuy

We limit all our customers to a total of 40 connections; 20 inbound and 20 outbound. The only time we see a problem with this is when they are over-running connections using some p2p application like bittorrent, or if they have a virus-infected PC. Even the most aggressive "normal" user ra...

GlueGuy

How much space does this require for the CF? I think I read somewhere on the web site that the RouterOS requires at least 128 MB, but I notice that the CD image is only a little over 14 MB. It seems reasonable that the CD image is compressed, but I'm wondering if it's reasonable to utilize an old 16...

Search found 62 matches