MikroTik

No that's not true. You can do it by adding only one firewall rule.

for example if internal network is 192.168.0.0/24 :
chain=forward dst-address=192.168.0.0/24 action=reject
reject-with=icmp-network-unreachable

On v2.9.43 it works for me:

/file print file=test;
:delay 1;

:if ([:len [/file find name="test.txt"]]>0) do={
     /file remove [ /file find name="test.txt" ] ;
}

which version are you using, 2.9 or 3.0?

Ah yes if you are using v3.0beta9 then it won't work. On beta9 new variable system was introduced, because of that there are many bugs.

you can read more in this thread:
http://forum.mikrotik.com/viewtopic.php?f=1&t=16173

you must convert to bool

:if ( [:tobool [/interface pptp-client get pptp-out1 running ]] 
= true ) do={ :put "yeee" } else={ :put "grrrr" }

if you need gre, enable pptp helper

... Is it as simple as changing the port number of the 'new' SIP service port to 47?

port and protocol are two completely different things. GRE protocol number is 47 not port number.

Then if i understood you correctly, You can create two EoIP tunnels and run bonding over them. If you need only backup set bonding mode to active backup. This should work.

You can write a scrit that checks your primary pptp link, if it fails - enable backup link.

By default there are no rules that are blocking traffic on ports.
Check firewall filter rules, probably you have added rule that blocks other ports.

you can add one simple queue, specify target address as whole network.

You can get only 2.9.43 and you should use routing-test

1) add pcq queue type for upload and download with rate 64k 2) add simple queue with pcq type 3) add scripts: *) /queue simple enable [/queue simple find name=<your-queue-name> ]; *) /queue simple disable [/queue simple find name=<your-queue-name> ]; 4)add new /system scheduler which will run script...

I'm curious why Mikrotik cannt make a bootable CD like every other linux distributer in the word. h aha ...

Have you ever looked in download section?
http://www.mikrotik.com/download.html

There are available ISO image. Download and burn to disk.

You can use remote logging to file and then write your own parser.

You must use dst-nat

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=x.x.x.x to-ports=xx dst-port=xx in-interface=wifi

This is not exactly true. There are numerous data types in ROS scripting:
* list
* internal number
* number
* IP address
* time
* boolean
* string

You can read manual for more information.
http://www.mikrotik.com/testdocs/ros/2. ... ipting.php

I think it is because find separator was changed from ',' to ';' and foreach still operates on ','.

Separator in beta8 was ; too, this is not a problem. Problem is that, for example, find returns array values inside other arrays, while in beta8 only one array is returned.

Yes it is a bug, foreach sets all value array to i, not just one value from array. Also it happens with disable, enable and remove commands. I hope it will be fixed in next release.

Yes, port is usable for PPP with RouterOS.

Actually there is:
/system logging action add name=email;
/system logging add action=email topics=e-mail

no, license will stay

yes it can. Enable webproxy and cache

http://en.wikipedia.org/wiki/List_of_TC ... rt_numbers
http://www.homenethelp.com/web/howto/ga ... router.asp

with ppp package

It looks like in Ros beta8 supports OpenVPN

you can access it in console:
/interface ovpn-server
/interface ovpn-client

You can reinstall your software via netinstall

Outgoing incoming or whatever link, it doesn't matter, idea is always the same.
I really don't understand where is the problem:
* mark trafiic
* add pcq for download and upload
* add queue

It's so simple.

yes you can

IF you use connection marks before packet marks, it reduces CPU load.

Imran, what is the name of cable company you work for?

I suppose Imran & co

This was discussed many times in this forum. You must add PCQ queues for download and upload. Search the forum and you will find answer.

Yes you can do it on MT.
http://wiki.mikrotik.com/wiki/Policy_Ro ... erOS_2.9.x

you can't add two marks, first mark is overwritten by second

Instead you can use marks something like this : http-donload, p2p-download etc

if you set passthrough to yes packets are passed to next rule, if not they don' t pass further.

If you are using latest wine, then only v2.9.40 and newer will work.

You can fix errors by opening exported script in any text editor and correcting the code.

Also errors happen if you want to import setting to non-installed packages. For example, if PPP package is disabled or not installed, you won' t be able to import any ppp configuration.

/ppp secret export

you can use export command on any submenu to export its configuration

looks like /file set is available only in v3 beta

what kind of account are you talking about?

/routing bgp instance print
/routing bgp peer print

# create test.txt file
/file print file=test ;
# write content to file
/file set [/file find name=test.txt ] contents="any content you want" ;

#to check that content was written to file
:put [/file get [/file find name=test.txt ] contents ] ;

easy!

:local numSig :tonum [:pick $sig 0 3]

/interface monitor-traffic ether1 do={ :local numBits $"sent-bits-per-second" } once

You can do it easily in v 3.0
:local numBits ( [/interface monitor-traffic ether1 as-value ]->"sent-bits-per-second")

/ip dhcp-server leases add address=x.x.x.x mac-address=xx:xx:xx:xx:xx:xx

uncheck Secure Mode option when connecting to router

This is very simple. There are no more counters. For example to mark every second packet: chain=prerouting nth=2,1 action=mark-packet new-packet-mark=odd passthrough=yes; chain=prerouting nth=2,2 action=mark-packet new-packet-mark=even passthrough=yes; It is very important to set passthrough=yes, ot...

1. Disable that crappy windows firewall.
2. Turn off UAC
3. Disable defender ( this crap isn't doing anything anyway ).

if you run it in script, it won't ask anything

if you are not reading what you are doing, it wont help no matter how many questions

Reboot, yes? [y/N]
y
Are you sure?[y/N]
y
Are you sure that you're sure? [y/N]
YES!!

I don't think that it's a good idea. ROS IS NOT A WINDOWS!!

then try netinstall

yes but this is not possible if you have dynamic IP addresses

only option is v3 beta interface routing

make your current backbone areas as other areas, and link them in one backbone area.

you can do something like this in v3 beta :

:global recBits 0;

:do {
:global recBits  ( [/interface monitor-traffic ether1 as-value ]->"received-bits-per-second") ;

} while=(recBits<=10000);
# now you can execute other script

export on screen:
/export

export to file:
/export file=<filename>

post your mangle rules and queues which. you think, isn't working.

Accept ICMP before drop rule.

You must use routing-test for sure. Any bugs in routing are fixed only in routing-test package. Don't be afraid of "test" it doesn't mean that this package is only for testing

Yes PCQ will do the trick. As it was mentioned in previous post, search the forum, this topic was discussed many times.

VRRP won't work if you have no IP set to interface.
It is correct in your case. You should use 192.168.1.1 as gateway and avoid using .2 and .3

as far as i know it's not possible. Anyway, why would you need that?

/export is only for exporting configuration.
If you want to export counters use print command, it is available printing to file.

this script works on v2.9.42
make sure you typed correct dst address and interface

...
Although searched IP address exists, script returns no value.

Are you looking route or ip address?

/export file=<filename>
/import <filename>

please can you post the configuration!!!

here you go
http://www.mikrotik.com/testdocs/ros/2.9/ip/vrrp.php

1. only numbers can be specified. For example if you want to move rule 3 to first position:
/ip firewall nat move 3 0

2. use find command
/ip fire filter move [/ip firewall filter find comment=rule1] [/ip firewall filter find comment=rule2]

/routing ospf interface is not made for that. /routing ospf network is where you set on which network ospf will work. For example if you have set 192.168.167.4/24 on ether1 and added ospf network 192.168.167.0/24 then ospf will work on ether1. ospf interface should be used only if you need to set sp...

RB150 is RB100 series board, it means that you must use package for routerboard.
As far as i know there are no time limits for upgrading anymore.

IF you have for example set ip address 192.168.0.1/24 on ether1
and added to ospf network 192.168.0.0/24:
/routing ospf network add network=192.168.0.0/24
then ospf will run on ether1.
If you don' t want to run ospf on specific interface, remove it's network from ospf networks.

why are you so afraid of new version? just upgrade and you will see fixed or not.

i have read the mikrotik manual for RouterOS, but still i cant make my RB acts as an internet router

doesn't look like

anyway
http://wiki.mikrotik.com/wiki/MikroTik_RouterOS
there are many examples that you can read and study

you have wlan but no wirelessinterface?

:D hmm thats very interesting

Try upgrading to latest version as there are some routing fixes. Probably this will fix your issue.

:put will output info to current session. this is available only in v3.0
And you can easily run scripts by names (by names is more preferable)

ports for gre and pptp are not needed, they should stay empty

Download the latest version (currently 2.9.42) probably this will help

Download the latest version (currently 2.9.42) probably this will help

check http://www.mikrotik.com/testdocs/ros/2. ... erlist.php
probably chipset is not supported.

chain=forward protocol=icmp icmp-options=11:0 action=drop

As i understood, you are trying to send packets bigger than 1500 bytes. You won't be able to do that.

you should contact support

there are some syntax differences in v3Beta. If you will post your script then probably we could solve the problem.

Yes you should upgrade to latest version, and it is preferred that all routers has the same version.

leonj:
ROS will detect network type automatically ( at least it will try to do

). There is no need to set network type on each interface running OSPF unless you need specific network type.

Is the same happens if you do it in console?

about batman

http://open-mesh.net/batman

there is a driver fix since 2.9.41
we experienced some issues too, but since 2.9.41 was released, everything works fine, even VLANs.

hm that's interesting, have you tried the same setup on other pc?

I am using latest wine-0.9.33, winbox runs fine, no issues.

I am using latest wine-0.9.33, winbox runs fine, no issues.

you need only one masquerade rule

Masquerade

http://www.mikrotik.com/testdocs/ros/2.9/ip/nat.php

[quote="xxiii"]... Doing a packet capture reveals that it has the area ID backwards; .../quote]

already fixed in beta7

correct code would be:

:log info ( "Dynamic IP Update Via Mail: Attempting to Send Updated IP " . $dip-ip )

and it works.

new terminal
/log print

you can find many firewalling examples here http://wiki.mikrotik.com/wiki/Firewall

also there are some examples in manual on how to do certain things

mangle add chain=prerouting protocol=tcp dst-port=1863 action=mark-connection new-connection-mark=msn passthrough=yes add chain=prerouting connection-mark=msn action=mark-packet new-packet-mark=msn-packs passthrough=no add chain=prerouting protocol=tcp dst-port=80 action=mark-connection new-connecti...

you need only one interface for web-proxy.

pptp server must be reachable. if you can ping it from remote destination, then you are able to set up pptp tunnel

You can filter out unneeded external routes.
/routing filter add chain=ospf-in prefix="192.x.x.x" prefix-
length=0-32 action=discard invert-match=yes

Hrm..
I do want to filter external routes... in-between areas.

ROS 2.9.x does not support inter-area filtering, and it looks like it is not planned in ROS 3.0 either. Just keep your OSPF clean and don't redistribute stuff into OSPF that is not needed. This will keep things simple.

Everything works fine for me

What is your ospf configuration?

do not try to forward https to proxy, you would have problems with signing in to email or bank account. But for FTP, you could try, but you need to increase the maximum cache size of your proxy

As it was mentioned before MT does not support transparent FTP in v2.9

https is using port 443. You must redirect port 443 traffic in order to pass https to web-proxy.

you don't need to put web proxy before GW.

....ISP
......|
......|
....GW--------PROXY
......|
......|
...Clients

Just redirect all tcp port 80 traffic to webproxy server, that's all

Could you be so kind and post script that isn't working?

mangle and queue tree

http://www.mikrotik.com/testdocs/ros/2.9/ip/mangle.php
http://wiki.mikrotik.com/wiki/Bandwidth ... and_Queues

:global aaa " " - define variable aaa
:global aaa - remove variable from environment

in your script :local traf; is not needed, because it does nothing, the same as :global mytext;

set initial valoe to global variable

:global mytext " ";

and everything should work

have you set allow remote requests in dns settings?

Put 2.9.38

Put 2.9.38

There are some known bugs in 2.9.40 you will have to wait until 2.9.41 is out

There are some known bugs in 2.9.40 you will have to wait until 2.9.41 is out

have you set out filter for bgp peer?

isp1...... isp2
..|..........|
MT router
......|
......|
...switch-----------proxy-PC
......|
......|
..other pc's

MT can dial through ppoe, too. So there is no need for other D-Link router. Connect both ISPS to MT and redirect TCP port 80 traffic to proxy as shown in diagram above . That's it.

RTFM
http://www.mikrotik.com/testdocs/ros/2. ... ipting.php

there you will find almost all commands, script syntax and variable definitions.

ROS has its own built-in scripting language

check out manula:
http://www.mikrotik.com/testdocs/ros/2. ... ipting.php

/ppp profile

and check out rate-limit field of profile you are using for secrets

here you go

http://wiki.mikrotik.com/wiki/Load_Balancing

Unfortunately I can't do this on the router, I know that will be better solution, i can do this only on the windows box.

ROS supports both L2TP and pptp.

first of all look at the date of his post

:D

http://wiki.mikrotik.com/wiki/Nth
here is detailed explanation

Try upgrading to Beta6. Downgrade from Beta6 to 2.9.40 works fine.
If it does not help, you can format NAND and then netinstall 2.9

no, as far as i know it's not true, license will be kept

Hrm..

[admin@xxxxxx] routing ospf> /routing ospf status lsa print external
no such command or directory (status)

Yes it's for v3, sorry

format NAND from bios, license is not affected

http://www.mikrotik.com/testdocs/ros/2. ... nstall.php

tHERE IS NO NEED FOR THAT

winbox works, perfectly on linux, if you don't know how to use wine on linux, then use windows

Please read documentation, it's all there
http://www.mikrotik.com/testdocs/ros/2.9/ip/mangle.php

just set in prerouting in-interface to ether1 and dst-address to your gateway address

only external routes can be filtered

list of routes that can be filtered is here:
/routing ospf status lsa print external

open console and type:
sudo apt-get install wine

You can open Winbox using wine.

I hope it will be fixed in new release

OSPF works only if you have beta6 on all routers.

just set interval to 24 hours

you have to set interval for sys scheduler rules. In your case it runs only
once
jan/01/2007 01:00:00 and
jan/01/2007 06:00:00

first of all you need web server up and running

then create your custom denied page, upload it to server .

after that set rules in access list:

/ip proxy access add action=deny redirect-to="web_servers_ip/
denied.html"

One method is not to deny but redirect to custom page on your web server

it should work fine

/system logging action set remote remote=[remote_ip_address_here]
/system logging add topics=[topic_needed] action=remote

It's not gonna work

ip proxy access enable mpg

as enable command expects item number

To enable all entries in access list use:

/ip proxy access enable [f]

And to disable use:

/ip proxy access disable [f]

PCQ. SFQ or whatever type does not work on parent queues. It works only on child queue.

sure you have to reboot, because upgrade process is executed after service shutdown. If you simply unplug power cable nothing will happen.

I don't know where are you looking, but here it is...

http://www.mikrotik.com/download/netinstall-2.9.40.exe

I already said that in one post. Set PCQ rate to 0.

/queue type set PCQ_download pcq-rate=0
/queue type set PCQ_upload pcq-rate=0

This will divide all bandwidth equally among users.

you can try serial console

set pcq-rate to 0, i suppose you have set pcq-rate to 64000

Yes, mrz your link is good. But mr wissammohamed says that he want to flexible his connection.. ex : 10 connextion or 20 connection, the entire network must have the equal bw. Can anyone suggest the script for this??, coz i didn't understand about how to script.... :lol: You don't need scripts at a...

I think pcq is what you need

http://wiki.mikrotik.com/wiki/PCQ_Examples

wireless QoS ?? I don't get it. You can do QoS on wireless interfaces even in 2.9.xx

try upgrading to 2.9.40 also it's impossible to catch all p2p traffic

try upgrading to 2.9.40
also it's impossible to catch all p2p traffic

you can drop all p2p traffic in firewall filters
or limit p2p traffic using queues

Target- Upload is incoming raffic
Target-Download is outgoing trafiic

to get 1M you should set
limit-at=128000/64000 max-limit=1000000/128000

For me personally is not a problem I figured out a solution myself.
If someone is intrested I can publish it!

I'm interested in your solution, could you please post it?

Search found 7052 matches