MikroTik

marvin

It shows how to set it BUT I do not see where it shows what is considered to be the MOST EFFICIENT protocal. I want security to be set for the wireless backhaul bridges that are WDS bridged.

marvin

For our wireless backhaul what is the most efficient security protocal for speed and safety? As well as how to setup security in RouterOS 2.9 Winbox? Thanks for the assist.

marvin

Twice from upgrade 2.9rcx to 2.9 final.. Most of the times it works but it failed twice. So can't risk it with the boards on the towers already.

marvin

Well it's been a couple of times when I updated with the routeros-x86 package and I can't trust this update at all. I've gone back to the reliable all packages update because it seems to ignore the wireless that is installed many times and fails to update it at all. Very bad when it requires our tow...

marvin

What would be nice is if the setting was set in the ntp server so when you set it on your main router it would update all the rest. We are already up to around 20+ RouterOS Ap's now and as that grows it's going to be quite the hassle to manually set the offset. But if it could be set on the main one...

marvin

ChangeIP yes we do have daylight savings time here. And now that you mention it I did not see a daylight savings time setting in the Mikrotik OS.

marvin

On the clock I have GMT set to -05:00 but it is 1 hour off. Seems to be doing -04:00 time. I tried several ntp servers and got the same results. Thought it was funny when my logs were an hour off.

marvin

Thanks once I turned on proxy-arp worked beautifully.

marvin

Tried that on the ether1 but failed to work. Do I have to proxy-arp the Bridge itself? And would that cause any issues with the network than?

marvin

I setup a vpn and can connect fine. I can access and ping the vpn router but I am not able to get past the router.. config setup below. VPN Server: Bridge1: wlan1, wlan2, wlan3, ether1 IP Address: Bridge1 192.168.0.70/16 Client Connection: Ip Address: 192.168.0.240/24 Ok the client connects fine but...

marvin

Well I been using the Atheros 400mw with Rc6 with no problem on several AP's now and Bridges. We tried Rc7 with our internal server but it would lose the mac addresses of radio's after a while and everyone connected would have a mac of xx:xx:xx:xx:xx:xx. Tried reinstalling and it did the same so def...

marvin

Well I did a discovery for a new map and none of the devices that scanned are in order at all. BTW when I do a scan with identify I can't tell it NOT to show images it always uses images. So I have to use scan without identify. I would also like more selection in how the scans are shown. For example...

marvin

I would like to be able to sort by ip, device name, ect

marvin

Well on our list of clients the default image view for the client ip structure side of things takes up way too much room. I would like to be able to select multiple devices and set properties all at once. Currently it opens up a window for each and every device

marvin

Got a question for you. Is it possible to get the IP or MAC address of the computer that it finds the known virus on? We only use static ip's for our customers so we would immediately know who it came from and can call or email them informing them a possible virus has been determined from their syst...

marvin

GJS, No the reason we had to use /16 is we have a BMU unit that has seperate class C ip's for Infrastructure, Internal Network, Hotspot Gateway, and Clients. To tie them together the company had to make the BMU a /16 and to keep proper communication for the router to be able to communicate with all ...

marvin

We don't have the entire class C it's just how our provider is routing.. We have a small block of IP's with a subnet of class C tho.

marvin

ok we have a two wan router. Each with it's own block of IP's so I have a static ip set to the router itself 66.15.99.x on wan 2. router wan 2: 66.15.99.192/24 router lan: 192.168.0.1/16 mikrotik router: 192.168.0.70/16 customer needs to get ip 66.15.99.195 as their static. From what I am understand...

marvin

We have this setup. Dual-wan router with a 5 ip block. Mikrotik RouterOS with following bridges below: Bridge1: ether0, wlan1, wlan2, wlan3, wlan4, wlan5 bridge1: 192.168.0.70/16 We need to give external ip's to 3 customers that we will be providing backhaul connections to and they really require no...

marvin

Is it possible to load balance somehow with bandwidth shaping to get desired speeds on each line? Or is it only possible by weight using gateways more than once? We have 3 WAN connections so would be nice if it was possible by speed of each WAN. WAN 1: 5MB/512KB WAN 2: 5MB/768KB WAN 3: 3MB/768KB As ...

marvin

Well I am running rc6 since rc7 was losing mac addresses and would go all xx:xx:xx:xx:xx:xx for all connected mac's. Problem is tho I have not been ABLE to get SYSLOG working at all. Is it non-functional in 2.9? I have added remote to the logging for critical, system, wireless, and warnings with the...

marvin

I have upgraded some 2.8.27 devices to the 2.9rc6 but now logging with the mikrotik syslog daemon does not seem to work at all. I have added remote to the logging for critical, system, wireless, and warnings with the remote with the IP address of the computer running the syslog daemon but nothing is...

marvin

Well I even tried reinstalling it before I determined it was a bug. Reinstall did not fix so it wasn't a corrupt installation. Secondly after a reboot sometimes the mac's showed up fine from anywheres from a few minutes to a few hours than nobody would have access and the registration table showed e...

marvin

For no apparent reason the rc7 will change all client mac's connected to ap to xx:xx:xx:xx:xx:xx and no access to any of them work. This only happens with rc7. BTW this is a server level 6 routerOS.

marvin

tneumann ok thanks for that advice.

marvin

Ok here's what I added to the firewall. add chain=forward src-mac-address=00:30:F1:10:2E:3C in-bridge-port=bridge1 \ out-bridge-port=bridge1 action=drop comment="" disabled=no But I am still able to ping it's ip address which seems to indicate to me it's not blocking.. Is their something I...

marvin

Well because I am new to the entire Mikrotik Firewall and still learning it. Can you give me the example of how to set it in the bridge firewall?

marvin

Yeah we are in touch with the bandwidth management unit company seems that it's got a bug in latest software update and letting ips that do not match correct mac addresses or those that are not in the system through. But in the meantime we can't seem to figure out where it's comming from or anything...

marvin

since he/she is constantly changing ip's we have to do it by mac address.. What I tried was.... add chain=forward src-mac-address=00:30:F1:10:2E:3C action=reject \ reject-with=icmp-admin-prohibited comment="" disabled=no but it did not seem to work. So how do I need to properly phrase it?

marvin

No we have someone that is ghosting our ip's and causing ip conflicts with customers. We need to block that persons MAC from having access.

marvin

We have a single bridge bridge1 bridging ether1, wlan1, wlan2, wlan3 but how can I create a filter to reject a specific mac address? I tried to create one in winbox but it failed to work.

marvin

Thanks.. Actually the .50 are on the ethernet side just used for giving customer computers that are being worked on. So I'll just add that filter to the ethernet side. Thanks for the help.

marvin

Tom, your right the latter is what I am wanting to do. Block layer 3 ip communication on that 192.168.50.x from the rest of the network. That particular ip only has to communicate with one file server which has it's own 192.168.50.x ip also so if you can explain to me how to block it with the Router...

marvin

We would like to setup dhcp for our internal network for ip ranges 192.168.50.0/24 but be able to block that particular ip range for dhcp from going out across the wireless connection. Setup of primary wireless router: Bridged eth1, wlan1, wlan2, wlan3, wlan4 We use a bandwidth management unit so we...

marvin

Now can someone get me a copy of the older Dude? The new one discovery doesn't work at all and now I have nothing in my network.

marvin

Yeah that is a good idea for the copy feature. Especially when it has several WDS bridges to it.

marvin

Well add network is to add different networks. I have one setup for infrastructure and one setup for our wireless customers. Split the view and you can see both at the same time and the current status of each device. Pretty nice now to check out the new beta 3.3 and reconfigure all again... Will be ...

marvin

Why is the wlan disabled by default? We have to replace one of the radio's in a card and it's disabled by default as well as all our configurations are lost for it and we have to start over from scratch with that particular radio. I am curious why that is? Why it doesn't just use the same settings f...

marvin

Yes it does ping. Just the auto upgrade or purchase of key has problem.

marvin

I have Dude running contanstly and haven't seen that issue at all. Office 2003 no problems with outlook opening up at all very fast. WinXP Sp2 AMD 64 3200+ processor SATA Drive 1 Gig PC3200 DDR Nvidia Ti4400 128Meg Video Card DirectX 9.0c So I wouldn't expect that it's Dude. Maybe try reinstalling y...

marvin

butche I like that idea I remember before microsoft took over visio that visio use to that feature and would practically draw out the entire network for you. Was a very nice feature that was sorely missed in later versions of Visio.

marvin

Well anyone had luck with them SR 2 radios? We were about to purchase quite of few of these radios to replace our old outdated 2.4g infrastructure with all new 5.8g infrastructure. Planning to use the new Routerboard 532 with the SR 2 radios.

marvin

Well that was after I attempted to disable and re-enable the dst-nats to get it to work. I finally got it to work maybe it's a fluke with the beta because all I end up doing was deleting my src-nat, dst-nats than rebooting.. than recreating the nats and it worked. So seems it might be a bug or error...

marvin

I am not able to get dst-nat to work at all. Seems only one dst-nat will work. If I turn on say the web server even port 2004 will take me to the web instead of the remote software and vice versa. / ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="" disabled...

marvin

1. Took me many tries to get map to load in IE 6 it would get to loading and than hang. Possibly part of the time out issue. 2. The web times out too fast. Open up the web to see the current network status and it times out in just a minute or two. Since time out is so fast I am not able to determine...

marvin

I'm just curious how did this become a mikrotik thread? BTW am I the only one that has any suggestions for The Dude? Isn't anybody interested in this software at all? I think it has alot of potential and will most likely have a reasonable price tag on it unlike some of the software out there and int...

marvin

Well things are really slow on the Dude software interest it seems. But features I would like to see are. 1. Auto SNMP query to auto add device name and address 2. Auto arrange button to arrange the devices so they are not overlapping 3. Parent / Child relationship so it can build them into a tree t...

marvin

Ok well until 2.9 is final HOW do I change the http port in tools? We are using port 82 for winbox since we already have port 80 being redirected to a single web server. I tried the following but I must of done something wrong because it does not work for me. There's way to make it :) 1. Add new too...

marvin

I was trying to use the upgrade license key but I keep getting the error message.

Failed to resolve http://www.mikrotik.com, check your dns settings

I went and set a primary dns and secondary dns server under IP > DNS but I still get this message.

marvin

Yeah I always have my STP enabled so it wasn't that.

marvin

Thanks for that tip Wildbill

marvin

I was trying to get a WDS connection established and was having difficulties so I set the wds to dynamic. Now that was a big mistake I was suddenly spammed with wds connections all from a mac address with nothing but x's and I immediately hit disable wlan 2 connection but it was already stuck in a l...

marvin

Hmm.. Ok I see in log file that I setup that I am getting attacked. How do I tell log to dump itself when it's full? I'm getting a ton of emails saying log full.. Apr/30/2005 01:02:27 TearDrop Attack Detect src:64.224.17.144:53065 dst:68.202.46.225:48818 Packet Dropped Apr/30/2005 01:02:27 TearDrop ...

marvin

Sten, I was saying that it was spamming so fast that it didn't even have a chance to be disconnected by the system. I see normal messages like that everyday but it takes a few seconds to reconnect and be disconnected. This was a so fast that the lines just flew by and the last time it happened it wa...

marvin

Yes we do have a competitor and no he's not use FS but he could be intentionally trying to kill our AP since he doesn't use FS himself but he is an asshole and won't play nice. So it's very possible he's intentionally doing this. He doesn't like us because we don't charge $60/month for the service a...

marvin

Possible cause their is a mac address that is connecting and disconnecting so fast that the log file is full of nothing but it within a minute. I believe it's happening so fast that eventually it locks up. How can we stop this? I put it in the authorization table that mac not to authenticate or forw...

marvin

I have this filter in my firewall settings from the howto. Any other suggestion to see if it's an ip type of problem? /ip firewall rule input add connection-state=invalid action=drop \ comment="Drop invalid connections" /ip firewall rule input add connection-state=established \ comment=&qu...

marvin

Ok for residential for NAT and firewalling but businesses have their own solution and when they purchase pay for a static ip they want a true static ip and not a natted one.

marvin

Because the corporate customer WANTS a true static ip. And most any corporate businesses want this as well as NO NATTING on any side but theirs. As well as no firewall on their side.

marvin

Ok I got a serious problem according to proxy-arp documents. Even if I add a fourth nic into the system for a dmz section here is where the problem comes in. Clients IP range: 192.168.60.0/24 router: wan1: 24.73.65.14/32 wan2: 66.15.99.192/24 eth0: 192.168.0.1/24 eth1: 66.15.99.193/24 Switch <---> e...

marvin

Well that is a problem than because I needed to proxy-arp a customers external static ip instead of using the DMZ from Xincom. So how can I proxy-arp without ip conflicts all over? We have a corporate customer that needs to have an external ip right now it's natted but that is not the solution they ...

marvin

No the problem started as soon as we put the Mikrotik Router online in place of our dual wan Xincom router. The problem ended as soon as we removed the Mikrotik Router offline and put the Xincom back online.

marvin

No current setup. Mikrotik Wireless AP: Wan1 Wan2 Wan3 Ether1 Bridged IP: 192.168.0.70 Gateway: 192.168.0.1 Proxy-Arp enabled Mikrotik Router Wan1: x.x.x.x/32 Wan2: x.x.x.x/24 Ether: 192.168.0.1 Gateway: Wan1, Wan2 Proxy-Arp Enabled Internal IP: 192.168.0.0/24 Wireless Clients IP: 192.168.60.0/24 Wi...

marvin

Yeah did that.. I tried something else for a test and it worked. I changed the port to a non-standard ftp port. Seems for some reason in that beta it didn't want to let me in on port 21. On the upgraded version it's working fine on port 21.

marvin

I had 2 ethernet cards one for dsl and one for cable. 1 Ethernet for the internal side. eth1 x.x.x.x/32 cable eth2 x.x.x.x/24 dsl eth3 192.168.0.1/24 ethernet Using masquerading. No other ips but our wireless mikrotik router which has bridged with customers on 192.168.60.x had every single customer ...

marvin

I have enabled the ftp service but ftp is denied and I am not able to ftp into the routerOS at all to upgrade it. How am I suppose to upgrade this? Even tried sticking the files in 2.8.26 routeros to transfer files but the files are not recognised so that I can upgrade the beta.

marvin

wlan2 - sector: lost node, excessive data retries, <mac address here>

why would I get this message?

marvin

GJS Thanks for the reference I'll read up on it.

marvin

We have an AP not sure if someone is got a trojan/worm or if someone is trying to hack it which won't work because we have a central BMU at the office that will allow them to access the internet. Problem is every night sometime it starts disconnecting everyone and won't let them re-connect due to ex...

marvin

How many non-overlapping channels are their in say the 5.8ghz range?

marvin

Could someone direct me to the right documentation? I can only find load balancing on linux sites for upload but not for download. I require 2 way load balancing as you can see from our two very different connections.

Thanks

marvin

Seen this with Karlnet. If one karlnet had a semi-poor connection it retransmitting would cause delays causing all the others to retransmit alot also. We have been moving away from karlnet because of this issue we had some with over 25% retransmit rates. Replacing with mikrotik we have been seeing t...

marvin

Wouldn't Arp-proxy work for his situation? Were replacing our Xincom Dual-Wan router with a Mikrotik and going to go the arp-proxy route to assign our clients the real static external ip.

marvin

Winbox loader does not scroll if you have several devices listed. A scrollbar needs to show up here instead of manually trying to drag window down enough to find the device.

marvin

How do I do load balancing with bonding by bandwidth? We got a 6mb/384kb wan1 connection and a 3mb/768kb wan2 connection. I know to use balance alb for this but not how to set bandwidth like Xincom uses percentage so above example would be set like 33% wan1 67% wan2 based on upload and differently f...

marvin

Well I can receive or do both way transfer. But not able to do just a transmit test since .26. Otherwise it is partially working.

marvin

GJS Great post. So if I had two hops.. after the mikrotik router.. one being a bridge all I need to do is proxy-arp enable the bridge correct? This is exactly what I been looking for and sounds much more efficient than doing a 1:1 NAT giving the customer a true external ip. Thanks for the tutorial l...

marvin

I too would like to know more about proxy-arp. Thanks

marvin

Well they call it a multi-dmz actually in xincom.. just their name for it. I did a 66.15.99.196 <---> 192.168.5.150. The MT Router is strictly a transparent bridge no routing. I'm beginning to expect the problem is the xincom won't see a different ip like 192.168.5.x even tho it's on a class B. So w...

marvin

Ok... Xincom is a dual wan router.. load balancing Wan1: 24.73.65.14/30 Wan2: 66.15.99.193 - 196/24 Lan: 192.168.0.1 BMU: 192.168.0.20 (bridged bandwidth unit with bridged ip's) Ip2: 192.168.15.1/24 (used for signup for hotspot) Ip3: 192.168.5.1/24 (infrastructure ip class) Ip4: 192.168.60.1/24 (cus...

marvin

Actually we have to give the customer a static IP for their billing server setup. So we have to 1:1 NAT that ip to the customer. I have learned that the problem tho is another issue that we are looking into replacing and that is that the powernoc bmu is blocking multi-dmz and natting from getting th...

marvin

I have this setup.. NAT router: Wan Ip: 66.15.99.192 1:1 NAT: 66.15.99.196 <--> 192.168.0.70 Mikrotik: Bridge1 Ip: 192.168.0.70/24 and 192.168.5.26/24 Wireless bridges are all on 192.168.5.x ip addresses. Now I need to redirect that 1:1 NAT to 192.168.5.38. How would I do this? Since it's already be...

marvin

Please any help on this problem? It is starting to cost us customers

What could cause lockup when rebooting?

marvin

I can't get PPTP to work at all.. Since we are using a Bandwidth Management Solution that relies on mac/ip authentication. I can't figure out how the hell to bypass the protection to allow me access to the wireless radios since the server still seems to go thorugh the gateway (bmu) before allowing m...

marvin

I have two other boards connected to each other by crossover. One side has AP level 5 for AP and the other has AP level 4 for bridge. All interfaces are bridged with a single IP on each board, but when I boot either one the entire board locks up and fails to reboot. We have to manually go and pull t...

marvin

Yeah been reading the manual. But the problem with the manual it's all text command lines and not the winbox configuration so they are hard to duplicate and follow.

marvin

We have a corporate customer that we need to guarantee bandwidth for. Ok that is in the manual simple queuing but I am wondering if I should do something a little more advanced? Setup below. Corporate customer application uses ports: 80, 443, and 1494 for Citrix. Several questions I have are. 1. Whe...

marvin

It is when you want to connect from public ip's to your various mikrotik systems. Right now it will only connect to the main one behind the router. This is bad for trying to manage all our Mikrotik systems. I need to be able to get to each and everyone to see what is happening from home which curren...

marvin

After the update from .25 to .26 I am now finding all my port forwarding is not working. Example what I have setup and was working in prior version in router is. ap: 192.168.5.26:226 bridge: 192.168.5.36:236 bridge: 192.168.5.36:237 but everytime I connect now it redownloads plugins and connects me ...

marvin

Ok thanks will do that

marvin

I got an AP in the area that keeps trying to connect to our AP. It's really hard to see anything in the registration table when it keeps going up and down.. How can I stop that from being able to try to connect or from showing in the registration table?

marvin

yeah I understand that. What I want to know is their some setting or change that can be made to make it more roaming capable without jumping off to the next one so quickly. When your on a cell phone you don't just start hopping around but yet they have sectors with a single SSID themselves.. or cour...

marvin

But I wouldn't want to create a WDS bridge when connecting roaming laptop pcmcia cards to our various AP's would I? I didn't think PCMCIA orinoco type cards could do WDS.

marvin

a radio for each sector all with same SSID but different channels..

wlan2: channel 1
wlan3: channel 6
wlan4: channel 11

marvin

Basic orinoco 2.4ghz radios having problems connecting many times. I am wondering could this because it's a 3 sector AP using the same SSID? Should I be using seperate SSID's with a Virtual AP with a common name for wireless roaming? How should I set this up so that wireless can roam around but work...

marvin

What are general good wisp settings that you have found to be effective? 1. Is it a good idea as a wisp to using ip packing? And if so with packing or without? 2. dns cache? good or bad idea? like does it use alot of resources that make it impractical for wisp? or does it help keep actual traffic do...

marvin

When I tried to edit comment of a client connected to the AP I got the message 'Couldn't change AP client <mac address> - std failure: not implemented (3)(3)'. What does this error message mean? Would be nice to be able to give clients a name so it's quick and easy to see who is connected.

marvin

Thanks I didn't realize it would be under a pull down menu I was looking in tools and systems to no avail.

marvin

Thanks for that info. Now is there a place to do the same thing in winbox? Or only through the terminal? I would like to be able to see this info with a refreshing so I can monitor connections over a short period of time to see how they are doing. I notice one client keeps dropping connection and ju...

marvin

In other AP's I have a method to see who is connected by mac address.. But how do I do that with Mikrotik?

marvin

One method we have seen and liked were CBT courses by level. Instead of a few hundred dollar sum up front they sell them my Level for around $60/level. They get more money that way but we can purchase them cheaper initially this way completely go through level 1 than purchase the next level when we ...

marvin

Even Cisco has CBT software that is much cheaper than a class. As well as it's easily able to refer back to it when stuck trying to accomplish something new. I never expected free but I do expect something more reasonable for small companies. Cost of flying to class, cost of hotel, cost of meals and...

marvin

How do I make NStreme work over WDS bridging? I have tried one set to bridge and one set to station wds.. the one side will connect and show the WDS but the other does not so neither can ping. Using RouterOS 2.8.24 ALSO I'm beating my head against the wall trying to configure an Nstreme2 so I can ge...

marvin

Would using the new Atheros chipset feature Radar Detect be good thing to use in an AP like this? It's hard for us on a couple of towers to do non-overlapping because wireless business ap for office have sprung up all over around us and these two towers have alot of noise from others in the area.

marvin

I setup the AP using radar detect but all 3 radios in the AP show up on the same channel. Since this is going to be our first tri-sector AP that we have done always used Omni's in the past is it ok to let them all be on the same channel? Or should they be on seperated channels? 3 - 120 degree sector...

marvin

Actually I could get no listing on ftp with 3 different ftp clients.. passive on, passive off, alternative download, alternative upload, use site ip for passive connection, use stat -l to list directories, site does not support FEAT command, show hidden files, disable force active mode for this IP.....

marvin

What are the pro's and cons of queues? Queueing I already learned causes latency and after changing the default queues my ping time has improved greatly. So what are the advantages of using queues? Especially since they are a default setting already in RouterOS.

marvin

hard to drop packets on an ftp on the same lan switch. I don't know why but 3 different clients did not show any files. But also showed no errors either. SmartFTP, FlashFXP and a free one all showed same results.

marvin

Already tried all them settings.. I'm not a newb to ftp.. And tried 2 other ftp clients and neither worked. Seems something funny with the routeros and many ftp clients. OH well just means I have to use browser for ftp which is a real pain but it gets job done.

marvin

Ok thanks for the manual reference. For some reason when I did a search for package in the pdf manual in acrobat it found no references.

marvin

FTP doesn't want to work with ftp client. I see their is an upgrade package sources but I see no reference to how to use that or set it up in the actual manual. So what is the best method for upgrading?

marvin

Strange actual ftp clients seem to be blocked but ftp into the system from browser works completely fine. Anyone have any idea why that would be?

marvin

I use flashfxp very reliable and well known one.

marvin

Yes I can view it with file print and see the files.

marvin

I am not able to retrieve sup-output for support because all ftp attempts show a blank directory!

marvin

I have setup...

ether1: 192.168.5.26
wlan1: 192.168.5.29

problem is when I ping them they both show the ether1 mac address. I need to pass all mac addresses for our WISP billing and management unit hardware behind the mikrotik. How do I do this?

marvin

Than that is totally strange. I did the full CD Image install and I tried to connect many times and until I tried the :80 the connection could not connect.

marvin

Well finally figured out the problem.. manual says connect to port 3986 but winbox required me to connect to port 80.. so I typed in 192.168.0.70:80 and it connected perfectly.

marvin

I setup an ip on the routerOS system and I can ping it but when I try to connect with winbox I get this error message. Could not fetch /winbox from 192.168.0.70 (port 3986): disconnected How do I resolve this problem? Is their something that needs to be initially configured in the RouterOS? We know ...

Search found 119 matches