MikroTik

janisk

normis I wrote clearly that Ralink/tplink/Intel 2915 was CLIENT CARDS working with RB112+SR2 as AP....

someday we all wont be able to read properly

ok, now, how about testing through that RB112 not to or from it?

btw, WPA2 is done in SR2 card - so there should NOT be any diff.

janisk

side note to normis: no, he used RM112 with SR2 card as AP and used different clients to connect to AP (RB112 with SR2) and no boro: when performing BT do it from client to client (wireless client -> AP -> wired client) because RB112 has weak CPU and if you set it to recieve or send packets - result...

janisk

oops

my bad

janisk

set wrap to boot from net and set bootp protocol, if that is not available for you - just install using cdrom. also you have to configure netinstall correclty (set the ip address to set to client to connect to your netinstall station)

janisk

and some torrent client too.

and iTunes music sharing (DAAP)

janisk

of course you can SSH into it, but that is not so handy as in winbox. normis suggestion is also good, if you have spare license, do not know exactly what you need if you want to run windows98 in your virtual PC :roll: or you can run linux with wine :) EDIT: in your virtual PC - so, no licensing prob...

janisk

would stress that - 24 working hours - not a 1 day.

janisk

i looks like a p2p but when i go to IP/Firewall/Connections ... there aren't any connections detected as P2P for this user and i've got this rule in firewall 3 ;;; Drop P2P chain=forward p2p=all-p2p connection-state=established action=drop it seems they have advanced in their technology in hiding f...

janisk

imho you have to use directional antena to see direction where nose exist and use /in wi scan wlan1 and turn around your antenna, also, you have to monitor noise floor to see non-80211 frames.

thats all

janisk

so - now we have answer from MT

if we just knew when this new version comes or when to start to expect - that would be NICE

janisk

you have to know what kind of tunnel he/she uses, if pptp then if you drop GRE protocol - tunnel cannot be created, if l2pt than this is other story. i would suggest you to limit traffic for that customer - and if he/she complaints, that has no speed, than as an answer would be - you have XXXKB/s li...

janisk

how about using radius right now? so every user has to enter login name and password

or set arp=reply-only and everyone who changes its mac is screwed?

janisk

you have to read about basic routing in 2.9 docs.

janisk

in vmware there is IDE option available. that way you can create a raid an virtual machine on top of it and save everything in a virtual file. on the other hand - if you create RAID for router - that this must be web proxy - i would create separate machine for that. and router to work as transparent...

janisk

that was my point - there is no need in BGP in example i mentioned. everything can be easily done using OSPF. BG in this situation is waste of resources. like hunting a rat using dynamite, land mines and tanks. but if you still want to do this that way - open up you wallet. EDIT: example for IT Crow...

janisk

think interference

from your interfaces

janisk · so if you do not need ether1 nterface - RB112 and 2.9.36 is OK

so if you do not need ether1 nterface - RB112 and 2.9.36 is OK

janisk

yes - no farm on OSPF

janisk

as far as i know - there is no limitations.

EDIT:

except - interferance from each device etc. etc.

but you can set up PC with with 5 RB18 totaling n 40 wreless AP's

janisk

about sceduler - try not to use start time: startup, if you do, check if next start date ir correct, if not, recreate the rule with some other time.

janisk

you can crate some program, that handels all that for you in automated way. so you can just plugin boards - and everything else is done by program/scripts in my case - PC (server) connects to router, thats sees connected boards, then infromation is gathered and then set up configuration. i use java ...

janisk

station-wds can be bridged, station cannot due to 802.11 limitations

janisk

chacnging wireless ettings will ALLWAYS chacnge settings on your connection

better - create virtual backup WLAN interface and crate it very secure, and only you know how to use it, and then only when frequency changes on master interface - your connecton will break

janisk

you can try to check weather your confguration is some how changed or check hardware (statical discharge)

janisk

strange it seems p2p programs has been updated

janisk

pleace read here: http://www.mikrotik.com/testdocs/ros/2.9/root/queue.php

about simple queues and bandwidth limiting

janisk

i found OSPF RFC introduction and further.

when have some understanding about - what it is - start configuring and read uncertain places in RFC. hope some other guy can actually suggest some book. but intro was readable

everything else was good read before sleep

janisk

i have seen configs with 40 clients, bunch of VLANs and BGP routing

so they will need to reconfigure their network usiing OSPF

and thats all.
as OSPF is internal and BGP more like external routing protcol (if talking about AS)

janisk

then there is only one solution - make configuration where you can clearly see ghosting, make supout.rif and contact support. if you *realy* are alone with poblem, check your configuration. if other ppl will report problem and mikrtoik can reproduce problem - then it *will* (not *might*) be fixed ED...

janisk

ask google about spamassassin

and this is NOT routeros related.

janisk

check if everything is ok with RB hardware (no configuration BT tests, check miniPCI cards) also you can try replacing connectors roll:

janisk

you see small traffic going through or you see small useful traffic going thorugh?

baybe STP or RSTP can help you?

just a thought.

janisk

pleace see packet flow and understand, the you should be able to create what you need

janisk

as in "The IT Crowd" -
1st option: is it plugged in?
2nd option: have you tried to restart it?

3rd: if first 2 does not work than theres should be error in configuration
4th: if there is no error in configuration - cheeck 3rd option
5th: try reset

janisk

you can read here about bandwitdh limiting - actualy it is good - but thingbefore implementing
http://www.mikrotik.com/testdocs/ros/2.9/root/queue.php

janisk

maybe when askiking if you realy want to shut down and answers are - YES|NO set to SHUTDOWN|NO or even make it changable so person can set to "CLIMB 100M tower to startit"|no and if person sets this feature to NO|NO he actualy cannot shutdown this router EDIT: actauly there is even better ...

janisk

here you can read about basic wireless configuration on mikrotik

http://www.mikrotik.com/testdocs/ros/2. ... reless.php

janisk

if you havent changed logs - then id router relay tries to send e-mail but fails log says why. it is very brief, but still a message.

you could try sending mail through any other smtp server (atleast try)

and post - what log say if you have info topic (alone) enabled after your attempt fail.

janisk

it should set default route only if you set so in your client to set default route through pptp

pleace read this -> http://www.mikrotik.com/testdocs/ros/2. ... e/pptp.php

carefully and you should be able to create pptp tunnel if router is pingable and noone is dropping GRE and some TCP port

janisk

in proxy settings set widnows update site to allow access dirrectly

janisk

whatever poolcount you want on one DHCP server - just route your network right. and everything will work as it should.

janisk

sorry, my bad - i misunderstood you.

do not know if it is very good idea - but you can create vlan for PC2 and PC3 in VLAN that PC1 cannot see (like PPTP tunnel with diferent ip addresses)

http://www.mikrotik.com/testdocs/ros/2. ... e/pptp.php

janisk

if you do as normis described then you have one active and one fully redundant, buy if you want to increse your available bandwith - you have to loadballance them and read everything about loadballancing in forums - here are lots of good topics abot loadballancing and wiki page here: http://wiki.mik...

janisk

maybe try to fill more fields like to, from, server, subject, body.

check if you can ping server from router, check if you have no firewall filters

janisk

here in manual you can read some simple configuration examples:
http://www.mikrotik.com/testdocs/ros/2. ... diolan.php

in wiki:
http://wiki.mikrotik.com/wiki/Transpare ... o_Networks

janisk

hope that helps:
http://www.mikrotik.com/testdocs/ros/2.9/ip/mangle.php

oh, you can do pptp or pppoe tunnel to your MT router and you will be inside

janisk

i would create one big happy LAN uzing bridges on MTs - so everyne can see everyone

janisk

you have to set policy routing for you - that you have to route traffic to you through one GW using routig marks, atleast i would try that.

janisk

about OSPF
http://forum.mikrotik.com//viewtopic.php?t=11904

janisk

manual routing or OSPF and fingers crossed

janisk

using in 6 router test setup to test OSPF.

janisk

im using routing-test

janisk

in wireless you can limit OSI lvl2 but in wireled connections, think - not

but maybe im wrong

janisk

could yo have some bridging there? and thats maybe is creating loop, try rstp or stp if this is the case

janisk

you said - that everything plugged = 5 MBit up/down you have available 15MBit you have 150 wireless clients so, clients get arond 100KBit/s each that nuber is ok if they do just webbrowsing, e-mails, some casual downloads. IMHO it is good, that there is 5MBit/s left for you to use. :roll: or you men...

janisk

what happens if clients are at about same distance?

janisk

as normis have said - this is not download related, period.

if it was download realted, then after few hours it would be ended... but it is not.

janisk

i suggest you to use 2 interfaces if that distance is that BIG due to - al clients will work with max ACK time. if it is not outruled by Nstream

janisk

as far as i know RouterOS is not supporting IPv6.

janisk

this post was one year old, or even more.

janisk

if i got you correctly then RJ45 (a bit shorter than standart ethernet connector)

janisk

as in previos post - CPU POWER

janisk

try to tur off connection tracking you may get better results, but suggest you to have mroe powerfull PCU there to do Nstream

janisk

if ask me - i allways disable windows netbios protocol and use ip address, and never.

on the other hand bridge should forward all ports and stuff through, check your firewall for settings that could disable netbios

janisk

set this windowsupdate or whatever you want to pass your proxy by allowing it to connect directly.

this new MT proxy allows it. don't know about old package

janisk

1)if you use OSPF whitch is for big local autonomous sstems (AS) then you might want to use diferent subnets, also you can set more than two or routers in same subnet. you will not see any diference - OSPF will work for you if you configure OSPF correctly, if you create one big subnet, then you are ...

janisk

ok then im wrong, and have to study some more

janisk

WPA requires quite large amount of CPU power. i think that would be problem if you set it up on RB112, on the other hand - that might be enough for stable link

janisk

first, is suggest you to test firewall rules on tet client.
second, try droping not in forward but input chain. i think that would help

janisk

oh, and there is that webbrows, let me remember - ahh, firefox, on whitch you can set al that information like operating system, webbrowser name etc. etc. and konqueror where all that can be done, and if i remeber correcly, than, you caould even set on what page show what info. and as normis metione...

janisk

sorry, couldn find anything interesting and new in this document. all they where talking about was - how bad that p2p exists and users share music, movies etc etc. and usage is so intensive, that it brings your netowrk ifrasturcture to its knees. yeah, that is bad, that is wrong. but all this can be...

janisk

you have to learn some networking basis, then using RouterOS you can configure your network that way that none will ever seen anything suspicios.

IMHO your isp is cheating you, OR yo have bad (incomplete) configuration of your router.

janisk

and disable SNMP

valens said correct answer but you didnt even check what he said.

and reand - how to prevent portsacnning using

/ip firewall filter

janisk

tehre is forward queue which is not blocked, so, you just disabled ability to connect to router through port 23 not disabled connections through router on port 23.

janisk

RED means that user is reached the limit and if there were any traffic available user would use it.

so - RED is - users uses all what he paid for

if you want to turn them into green, you have to make your connection wider in means of traffic throughput.

janisk

n masquarade set what interfaces should be masquaraded, in this case - wireless and only wireless. that way all the other will no be masquaraded and will be dropped elsewhere

janisk

i am blocking that port. and many other popular ports, but you have to inform client, that these ports are beeing blovked due to security reasons. if you consider blocking.

janisk

is your configuration optmised? allmost as perl - one thing can be done in many ways. or you can screw things maney ways - same here with ROS you can create rules for each user or for user groups, maybe some more optimisation can be done in configuration. when crating a configuration you have to thi...

janisk

it would be good to look at mikrotik WIKI and read what topics about wireless there.

then you will have more understandng about what is posible and what you can achieve.

Good luck!

janisk

Sofia, pogledni http://www.hellspawnbg.homeip.net tam ima ICQ nomer shte se radvam da ti pomogna ako imash vuprosi :) in other words: take a look at http://www.hellspawnbg.homeip.net where you could find ICQ number, and that he could help you with some answers ;) i hope that this is still true if y...

janisk

maybe hotspot with mySQL

janisk

i suggest you 3 things

1) http://www.mikrotik.com/docs/ros/2.9/interface/wireless for wireless configuration
2) http://www.mikrotik.com/docs/ros/2.9/guide/basic basic router configuration
3) learn some english

good luck!

janisk

you can group your users into.. amm... groups and if there are less rules to process less work for CPU...

janisk

later - at the end of year, when MT is actyulay starting to sell the item. or im mistaken again?

janisk

cmit is right,

after demo licence time expires only available option is to reinstall ROS, all configuration everything is lost.

janisk

you can do it already - if u use packetmarks, than mark traffic from cache to clients diferently than traffic from everywhere, and limit that last traffic not your local cache traffic. i think it is doable. ok, it iwll be more than 2 clicks and a lot of brainwork if it is not working that easy as i ...

janisk

try

/system logging

to set logging options you need., and where to log.

set up what topics to log.

hope that was helpful

janisk

set IP addresses as you have done already

then in /ip route set gateways to diferent subentowrks through addresses you have set each in needed direction. as suggested above by exebug

like

 /ip route add gateway=1.1.1.1 dst-address=10.10.10.0/24

in console or do same in winbox.

janisk

could you explain your problem in detail? and drop what connections?

janisk

you can allways google for BGP RFC and nail MT if they make something diferently, atleast you can ask them to stick with RFC. as far as i know they are sticking with RFC

janisk

so you see what router "sees" around it, like other routers. and it is for dude also, imo

and, if router has no configuration then yo can access "see" it and access via mac

janisk

is it /interface pppoe serer print?

janisk

maybe create backup file before reset? that would be very hady - if someone resets configuration unintentionaly

and if nothing hapens for 30 minutes set configuration back

janisk

default routes.

think you have to NAT outgoing connections, so that both networks can see eachother.

janisk

you can drop common ports, that are used bu viruses.
you have to chekc new connections only.

and you can never be sure - if one of your customers is infected?

only thing that can be done - educate your users.

janisk

just a thought - PC PSU is thought to work on all lines +3.3v +5V +12V and use them all, if u use only one line you will eeventualy damage your PSU

janisk

maybe developers think, that people can actualy read - not guess what is written

or i should write:
mbyae deloverps tihnk, that popele can acutaly raed - not guses what is witrten

janisk

hotspot autentification?

janisk

secure ftp or http?

janisk

only your personal pref. how much you are willing to give

janisk

use scripting to get what ip address is on interface and then set configuration in where you need it.

janisk

check your configuration for any flaws. maybe some where you cna do something a bit diferent. like queues not for each users but for user groups etc.

janisk

example to find

/interface wireless set [find] disabled

to disable all wireless interfaces...

this is only find i know of.

janisk

btw, mikrotik will not give anyone older versions of ROS

janisk

do as eguene suggested.

on the other hadn you can set a netwach that does a skript that enables/disables neede routes on ping results from your default GW, no need to do manualy things you can do automaticaly - lasiness is what made us so smart

janisk

it seems that guy does not see ANY difrence.

pleace read about netowrking about OSI levels.

you have to need basic understanding about networking to operate succesfully MT box.

manual is your friend.
http://www.mikrotik.com/docs/ros/2.9/

janisk

you can do hat already

/sy ssh 192.168.25.2 user=user port=45345

have no problems at all using this...

janisk

everything works on linux for me using pptpconfig whre you can set whtever settngs you wish. and as i said - everythin happens on clients side... so - windows to go

janisk

and what about autentification in hotspot - no login no internet

janisk

did not get it - which is default GW wich is not

IMHO you just have to set routes correclty, like where is default GW and where to got to get to addditional network. just set correct signs where to transfer packets allong the route.

janisk

write your own

or just manage your ROS security so that only from trusted locations you can login
thats what i do

janisk

yes ROS can do that

here

janisk

router is NOT a PC - sure you can install it on PC, but it is still a ROUTER not an ordinary PC. firewall allso can be installed standalon on PC but that will not be PC - it is firewall - all it does is filter junk out of your datastream. BETTER talk to your ISP and ask if they would be happier if y...

janisk

if you connect from outside - mac address that will show up in router WILL allways be the same - closes device in oter network - so i i actualy do not see ANY reason to do some mac restricions. and f you want some authentifications PPPoE is your way - or a simple DHCP. AND you can do some port knock...

janisk

so doublechekc your settings, and if everything looks ok, jsut contact your ISP and explain sitoation, tat his is your wirless AP that enables you wireless netowrking in your home.

pl chekc if your MT router can ping IP addresses outside, maybe there is some problems with DNS?

janisk

and remember that ppl like sergejs and normis do not represent MT here, they are on their own.

or this is what they say

anyways

janisk

do you have ano other (non SR) card?

thry that. if no results, then try t contact your reseller.
i have RMA in my mind

janisk

MK says that their programmers are working hard to solve these OSPF problems...

and anyway - ospf is allmost running (some tweaks andworkaraounds on the fly and everything is working again).

and after restart it allways comes back to last state, atleast for me.

janisk

http://wiki.mikrotik.com/wiki/Tunnels
maybe helps

janisk

you cans et logins+passwd and limit ip-pool used for ppp server

janisk

usualy there is no such privilige as reboot

janisk

some times i used a workaround - in system logging set logging lines to 1 and then back to 100

janisk

it sounds that this drivrs is more alpha then beta now

janisk

indeed - 2.6 kernel in ROS from now on

janisk

http://www.mikrotik.com/docs/ros/2.9/interface/vlan

and remember - manual is your friend - not your enemy

janisk

actauly it is bad idea to use diferent subnets

but for PCQ - you shoud set target as netowrk so everyone in network will be affected by queue.

and PCQ divides bandwith equaly to all affected ip. just configure it right

and to seperate your LAN suers you can sue VLAN.

janisk

OFFTOPIC on:

shootgun and address of attacker could be useful at this situation

OFFTOPIC off

there is not much you can do with DDoS jsut detect and silently drop.

janisk

on my home natted network i do marking that way / ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=all_traffic passthrough=yes \ comment="mark all traffic" disabled=no add chain=prerouting in-interface=ether1 connection-mark=all_traffic action=mark-packet ...

janisk

BGP routing filters
http://www.mikrotik.com/docs/ros/2.9/routing/filter

janisk

here you can read about queues http://www.mikrotik.com/docs/ros/2.9/root/queue there ou can find a lot of info about queue types and when they are more suitable than other types :) good luck. and the simplest configuration for you to make "invisible" other clients set each of them in difer...

janisk

172.16.0.57 and 172.16.0.1 on diferent ports on router?

if so - then here you go.

janisk

there are 4 main kinds posible for encryption: 1) NONE 2) WEP (static keys) 3) WPA personal and enterprise 4) WPA2 personal and enterprise chose wich of these four are ou going to use? and try to explain your problem deeper. i understood that you want WPA or WPA2 without key... that just does not ma...

janisk

IMHO when you are doing magnle and liminting this is hapeneing in prerouting, but when you are using torch you see incoming packets and outgoing packets.

correct me if im wrong

janisk

using routing-test and ospf some routes does not appear in /ip routing somehow all routes missig goes through wireless. i think it is momehow connected to link weight. pls can anyone confirm this? in my test setup i have 6 routers. here is netowk diagram all wired links are 10 all wireless are 20 ht...

janisk

so if packet originates from your client and you see src-address is your client address and you limit what size goes from that IP you are limiting users upload speed. if you limit by destination and dst addresses arent your client addresses you will also limit upload speed, but per connection basis ...

janisk

better do no mess with manual tx settings

janisk

yes it is. refer to manual HTTP proxy
and read about queues

http://www.mikrotik.com/docs/ros/2.9/

janisk

could be fine if that could be done on event that lease is assigned.

if logging is enabled, then any lease that gets assignes is logged, so maybe it could be done that way?

just a thought

janisk

you can register dyndns name (think it is free) and with little scripting get the IP everytime you need it.

janisk

connect through winbox to your router and go to ip ->DHCP server and then hit Setup button, and you will be able to complete the configuretaios as this wizard will gauide you through configuration and ask whatever is neded. then you can study what and where was set and try do do it by yourself (but ...

janisk

you need to set RB to boot form ethernet, then hook up that to PC with running netinstall and everything else you have to do will happen on your netinstall window.you have to configure netinstall accordingly

good luck

janisk

set in logging to log in MT device and same thing go to remote, and check if something happens to be logged

baybe that helps you out

janisk

in latvia - let me think... hmm - any brewed liquid

(hope - well brewed)

janisk

if ISP agve you that URL to proxy (lets refer to it as Proxy address or address) you can set this address in your web browsers proxy congiuration and hapely use your ISPs provide web proxy, if you wnat make something like transparent proxy, you can configure MT to use parnet proxy but that is not so...

janisk

ifyopu set up RADIUS login, you can make whatever you need on router webpage.

janisk

MT double posting

janisk

configure your nat to do not natting for these addresses, and check on routing in MT manual, thats all what you need

janisk

pleace be resonable - RouterOS is ment to route traffic not to host FTP server or support you with some office programs

janisk

your router should not ask himslef to resolve address, as if router knew ip of an address then it should not ask himslef.

configre your DNS correctly

janisk

this must not be a router problem but on the client side.

i have Fujitsu-siemens build centrino laptop M3438G (wich is faulty) and have the same problem, while my wife with fujitsu-siemens laptop, but with broadcom wirless card have no problems at all.

janisk

it loogs ok, jsut add another rule to do same for dst-address too so all packets are going to be dropped.

janisk

up there where pretty decent answers - but thoreticaly about 2007 if i recon correcly

50 is OK if speed is none of you concerns

and what hardware are you going to use? if RB500 then that abowe

janisk

at the deauth time other clients working well?

pleace check if that laptop has no glitches or something.

as i have Fujitsu-Siemens Amilo M3438 laptop - that deauth every 30 minutes. as this is buggy laptop, pleace check if that device is working well on another AP.

janisk

WDS mesh and OSPF?

janisk

ofcurse i would suggest MikroTik equipment with nstream

but if you look in wireless part or use search you might find useful answers

wireless part of forum:
http://forum.mikrotik.com/viewforum.php?f=7

janisk

have you centralised RADIUS server, or there are several AP's with same number of diferent hotspots configured?

janisk

there are also such people that just searches for proxy servers and tries to connect to them. there are several programs that automate this process. think you are beeing victim to those serches. and as you have sisabled access to your proxy they cannot use that.

janisk

try tunneling (PPTP, EoIP etc.)
read more on the topic here:
http://www.mikrotik.com/docs/ros/2.9/#V ... Networking

shoose what seems better for you

janisk

think, only port based if default is used ports 447 and 80 if i recon' correctly

janisk

dont forget that there are encrypted p2p traffic, and that type cannot be detected sue to encryption - that way you need un decrypt it to detect weather it is or is not p2p packet. for example torrent p2p networks now widely use clients that encrypt traffic, but client can choose weather it uses onl...

janisk

antenna polarisation maybe? (just guessing)

janisk

if you still ahve problems, make your configuration backup and do /system reset and then try. that must be configuration problem

janisk

1) you cane use safe settings (more can find on forums)
2) if you have fast access to router - you dont have to be afraid - you cannot disable yourself, and if you see that nothign is working (for your test) you can try to search other way round

janisk

have you set passive connections settings for FTP client on your client PC's?

janisk

what versionare you using, maybe try to upgrade if it is not newest one

janisk

do you mean - bridge?

janisk

24hour key has no limitations but 24 hour limit, otherwise this is fully functional

janisk

for testing better use 24hour trial period.

janisk

pleace consider implementing PCQ

janisk

you have to chose correct chain - imput chain is incoming data TO ROUTER, if you want to filter data going through you have to choose forward chian.

janisk

if you have to bock something completely then filter is place to go.

janisk

allways follow to what are you setting by default there is /32 netmask

and allways set up some backup user to get in anyways.

janisk

use transparent proxy - forward all the requests to 80 to your proxy and do there anything you want and nobody can bypass you, except they conenct on other port

janisk

configure box 1 to search your other netowr on the correct destination

from box 2 try to ping anything deeper inside the box1 network - i think you wont be able to

janisk

pleace check if with other wireless devices you have same behavior.

i had allmost same expierence with Fujitsu-siemens Amilo M3438G - endless reauth-deauth

set in router logging config - wireless,debug and report back what you see

janisk

same as inncom, just do not set in interface.

create 2 rules for tcp and udp and forward ptckets to port wherever you want

janisk

use search
but you can read here
Load Balancing

janisk

prioritise icmp protocol

janisk

obios - your users are using encrypted p2p, so you see only packets to create connection, if you are seeing these rare packets, then you have p2p traffic - encrypted torrent for example

janisk

if you use diferent versions of RouterOS then every thime you connect to routeros box correct ddls are downloaded from router to work correclty with winbox.

janisk

maybe access right misconfiguration

so noone can access the folder - might be M$ error

janisk

about trfic control read this

and other topics to read from manual

Mangle
Bandwith control
Filter
NAT

janisk

/ip route add gateway=10.255.239.149 dst-address=vpn-server

vpn-server is ip to vpn server
and default gw will be set by vpn as it is now.

janisk

so VPN server is in other network, if so, set this static inet GW to that network but leave 10.10.150.1 as default

janisk

what about fridge

let the router do the routing, but virus cacheing leave to other

janisk

do you realy need that one default gw through inet interface?

as i thought that default should be through vpn, isnt it so?

janisk

what happens if you set masquarade to that tunnel?

imho then ti should work.

Intel interface is only for making vpn tunnel.. and all traffic goes through tunnel

janisk

satelite vill have big pings anyway

and if your routing configuration is OK then everything should be ok

janisk

you can try to bridge rb112 and that way users will get their dhcp leases

janisk

you can try to incorporate virusscaning server. but remember - you cannot check encypted traffic, that can too be malicous. so there is nothing you can realy do to protect your customers 100% from virus attacks. and RouterOS is powerfull while talking about routing and firewalling - this is what it ...

janisk

about wireless access point configuration pleace read this

you should be able to configure everyting you need

good luck

janisk

you can do that way: on accessing router to ssh port add user to 1st_try group in /ip firewall address-list with timeout of 10 minutes, then if there is another connection from that ip to that port add to 2nd_try address-list with timeout of, say, 20 minutes and after 3rd try in timout time you drop...

janisk

loading via bandwith-test - means that someone without knowledge about your users tried to run BT. default settings require authentification.

do as posted above - restrict unwanted access to input chain, disable all services you do not need.

janisk

about older versions read this post.

janisk

less queues will work better then more. because apcket is beeing mached against all the rules in the queue list, so - packet to last queue will go through as many maches as queues in the list - it becomes very unpleasant if you have more than 600 to 1000 queues. better use PCQ and create user groups...

janisk

my spam you mean - e-mails???

if so what it has to do with router at all?

use some spamassasin or other spam killer of your choice

janisk

you can limit p2p that way - set bandiwth for http, ftp and other well known protocols and for the rest of traffic set harsh limits

so - any unknown protocol will be limited - ares, encrypted bittorent etc.

janisk

:D Drop all incoming traffic (in input table) from addresses that are not welcome, and you soved the problem. And answer to your question: YES, this is brute force bot... allow only trusted ip's to login via ssh i suggst you to do same for ftp too. or use port pinging for allowing connections it is...

janisk

yes this is posible

use search in this forum and you will find how to do this.

http://wiki.mikrotik.com/wiki/Routing

janisk

it is not prefered to make 2 simultanoes connections to same network form one device. in case you amge that - device gets confused - if you have bridgetd wlan end eth - set stp or rstp to manage loops in network, that it hsoudl work ok, but will use only one connection to connect.

Search found 6251 matches

RouterOS 2.9.24 is out