MikroTik

sid5632

In fact that's probably the main problem with whole WinBox 4. Everything in it is HUGE... I'm still seeing much less info in same space. It's the same problem that almost every new software has. Perhaps it's trying to be touch-friendly, which I'm sure is lovely for people who want it, and I wholehe...

sid5632

It queries the CPU load figures via SNMP. If there's an outage, it always seems to take multiples of 3:30 to recover.

sid5632

So why does 10.10.2.0 not work?

Why did you not specify a subnet mask?

10.10.2.0 is not a valid IP address for a port/interface?

As a blanket statement that is incorrect. It depends what the subnet mask is. For example, 10.10.2.0/22 is perfectly valid.

sid5632

sid5632

the temperature on the units in question wildly fluctuating where it would change from 34C up to 56C and various ranges in between.

I've got one of those that does the exact same thing.

sid5632

You need to add bridge1 to the tagged list for vlan 77 in the bridge vlan table.
Setting a subnet mask on the IP address for that would probably help too.

sid5632

Linux will soon have a native "Winbox"

Linbox?

sid5632

IAs well as a full network diagram.

Your diagram is inconsistent with itself. Mismatched subnets in several places and no indication of which interface pertains to which link.

sid5632

This weekend I had 4 staff members come in for their shift, walk right past a 60" Monitor with the dude displayed on it, completely ignoring 3 tower outages.

That's a layer 8 problem.

sid5632

The CLI and API are not finished (they are barely even started). There is no hope of getting anything out of those and Mikrotik are not interested. The only way to get information out is via Notifications. I use "execute locally" to run something on the machine running the Dude client. It'...

sid5632

I wrote "auto-routing (BGP/OSPF/RIP/IS-IS)". Nobody is using that on their home NAT router

I am. Therefore your statement is false.

sid5632

VLAN doesn't separate at layer 3.

sid5632

Define "communicate".

sid5632

Everything was installed via an image from CD 7.13
I had to roll back to 7.2

So all these 7.x versions show as 6.49.7 do they?

after 1-1.5 it rebooted with an error

1-1.5 what?

What could be the problem?

Between the chair and the keyboard seemingly.

sid5632

It it probably something to do with sunday 2am auto-restart schedule

What is the point of this in the first place? It is completely unnecessary.

sid5632

Use a "Host-only network" and stop messing about with loopback adapters.

sid5632

I expect it's a bug. Ask MikroTik support if you care that much.
An interface name is not a number. Deal with it.

sid5632

You don't need those untagged entries. They can be inferred dynamically from the PVIDs. It is advised to include them for clarity since export will not show default values. When you do specify them, they will be shown and you know what is there. And when you change the PVID on the port, you get ver...

sid5632

v80-modem1 is not a number, is it?
The number is at the start of the line (the # column) and is 0 in this case.

sid5632

/interface bridge vlan add bridge=bridge tagged=ether2,bridge untagged=ether3,sfp1,ether5 vlan-ids=\ 1000 add bridge=bridge tagged=ether2,bridge untagged=ether4 vlan-ids=20 You don't need those untagged entries. They can be inferred dynamically from the PVIDs. /ip firewall filter add action=accept ...

sid5632

The logs were full of "ether1_WAN link down" messages. What was so hard? Obviously a problem with either the cable or a port on one of the ends.

sid5632

It's not hard to work out, is it?
09-22 08:07:51 interface,info ether1_WAN link down
09-22 08:07:51 dhcp,info dhcp-client on ether1_WAN lost IP address 70.106.192.220 - lease stopped locally

sid5632

You already asked this elsewhere. Stop posting the same thing twice.

sid5632

It does it automatically on restart.

sid5632

Stop posting MASSIVE screen shots.

sid5632

Unless you provide some actual error messages and a configuration export, no-one is going to get very far. The DHCP server in red is a huge clue that something is wrong with it. Don't post stupid screenshots. Thanks for offering absolutely nothing of any value to this thread. There's nothing to off...

sid5632

I have an AX3 which shipped with the 2 prong European plug and I've struggled to resolve this with the seller (the store was UK based). They sent me a plug adapter but it is completely unsuitable for long term use.

Who was that then? Presumably not MS Dist or LinITX?

sid5632

Are you trying to hit your public IP address from within your LAN then? It sounds like it, but you've not exactly been explicit about that. If so, it's just a simple "Hairpin NAT" solution that's required. Have you tried it from somewhere off the LAN? Phrases like "when I use the brow...

sid5632

I am unable to browse the Internet or connect to the HEX using Winbox.

Unless you provide some actual error messages and a configuration export, no-one is going to get very far.

The DHCP server in red is a huge clue that something it wrong with it. Don't post stupid screenshots.

sid5632

Why have you got horizon=1 on all the bridge ports?
What do you think this does?

sid5632

This thread is just bizarre. People attempting this should go back to networking school (or even go there for the first time as they are seemingly clueless). Have you guys ever tried to put a huge single tyre on a 4 wheeled vehicle? And then wondered why it's very hard to do, makes no sense, and doe...

sid5632

what else can i do ?

Stop posting massive screenshots.

sid5632

Can you not read?
It's "netinstall" that upsets it. Adding a letter or removing a letter makes it OK.

sid5632

When that integer overflows a segfault will take place actually causing the application to fail, hang, or take down the system all together depending on how things are connected to each other.

Not it won't. What utter rubbish. It'll just go back to 1970.

sid5632

Why don't you post your configuration export instead of stupid screenshots which are virtually useless to most people?

sid5632

Your diagram is in conflict with both itself and the configuration in terms of subnet masks. Then there is the general confusion of which ethernet port is assigned to which VLAN. You don't say whether whatever the devices are are operating tagged or untagged. There is nothing to do any tagging if th...

sid5632

I guess we can all agree this is on the very bottom of the list.

No, it should be top of the list, seeing as it's so absolutely trivial to fix and takes almost no time at all.

sid5632

You need to add the bridge itself as a tagged item in the "/interface bridge vlan" entries. Why have you got a dhcp-client on the bridge? The enable command is just "/interface/bridge/ set "LAN_BRIDGE > SGCSW01" vlan-filtering=yes". And as the guide says, you should be ...

sid5632

For the interface bridge VLAN. Can you please elaborate a bit more for that on me? For the VLAN filtering, I did try following this on their documentation https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching#BasicVLANswitching-CRS3xx,CRS5xxseriesswitches,CCR2116,CCR2216andRTL8367,88E6393...

sid5632

You need to change ether2 to the bridge in the "Interface vlan" section. You need to add an "interface bridge vlan" section. You need to enable vlan-filtering on the bridge. You didn't say what interface was connected to what (so it had to be inferred), nor what device type you h...

sid5632

Hummm ... in specs for cAP ax (and comparison to cAP ac), shouldn't the row be titled "Tx Power (2.4 / 5 Ghz dBm)" rather than "Tx Gain" ? And it's capital "B" in (deci)Bell(miliwatts) ... Hummm ... If you're going to correct, at least get it right: GHz not Ghz Bel not...

sid5632

No, unless it's a CHR.

sid5632

/interface vlan add interface=ether24 name=vlan11 vlan-id=11 add interface=ether24 name=vlan42 vlan-id=42 These should be "interface=bridge". /ip pool add name=dhcp_pool0 ranges=192.168.11.2-192.168.11.254 add name=dhcp_pool1 ranges=192.168.42.2-192.168.42.254 add name=dhcp_pool2 ranges=1...

sid5632

There were three NAT rules to forward ports 8443, 80 and 22 from inbound WAN to my Linux server (10.25.10.10). I disabled them and everything went back to normal. I'm just wondering why these dstnat rules started to mess with everything since they should be applicable for inbound connections only. ...

sid5632

power loss in cable is proportional to current

No, it's proportional to current squared.

sid5632

checksum problem is fixed in v7.7rc4

What about the spelling error in the error message?

sid5632

What an excellent post!

sid5632

You need a dst-nat rule with port 8080 not a src-nat rule. And you need to fix the "drop all from WAN not DSTNATed" rule, which doesn't do what it says it does, presumably because you have modfied it for some reason, and screwed it up. As it is, you have no rule on the forward chain to all...

sid5632

So why doesn't it remove 60GHz devices from the list when you select frequency 5GHz?
It does it the other way round.

sid5632

I've ended up having to fsck the image on an external Linux machine on at least 2 occasions. It's also often happened when changing the size of the 'disk' and RouterOS fails to re-size it properly.

sid5632

The default rule at the ends of the forward and input chains accepts all traffic unless you drop it.
Apart from incoming DNS, you have NO effective filter on the input chain. This is a bad thing (tm).
Not quite sure what your use of that output rule is for.

sid5632

In the Extra Packages .zip

sid5632

Post all of the config. not just that bit.
Nobody can tell without.

sid5632

You need to add the bridge to the list of interfaces that are tagged under /interface bridge vlan
and get rid of all those untagged entries and let them be determined dynamically by the pvid setting.

Did you actually turn on the bridge vlan filtering?

sid5632

In most cases the current recommended method is to use a single VLAN-aware bridge, unfortunately there are many blogs and videos on the internet which use the old method, are incomplete, or just wrong. Yes, many are incomplete or just wrong, INCLUDING THIS ONE. Oh the irony. I would dispute the use...

sid5632

For whatever bizarre reason, it's in the Extra Packages .zip file after 6.48.6.

sid5632

sid5632

You clearly didn't read or understand the question then.
There is a syntax difference between V6 and V7. You CAN'T make something that won't fail, except as already stated.

sid5632

You probably need something like this:

:do {[:parse "/system ntp client set enabled=yes primary-ntp=192.168.144.210"]} on-error={}

sid5632

951G-2HnD is Mipsbe.
Why do you think it's going to work when ZT is Arm only, as you already know?

sid5632

Yes.

Use the 'upgrade' channel.

sid5632

I have to keep asking here, as the supplier is unhelpful. He tells me he has not seen this problem before, he just assumed the router was ex factory and said it seemed I did not know what I was doing Clearly this device is used and your 'supplier' is trying to palm you off with a used item as a new...

sid5632

VACUUM do not do already all?

pragma integrity_check;
vacuum;
reindex;

Of course VACUUM does NOT delete valid data in tables, whether or not anybody considers it unwanted.

sid5632

/28 != /24

sid5632

Or do it in one line, like this:

/ppp secret set profile="Profile-B" [find profile="Profile-A"]

although you probably want something similar with "/interface pppoe-client" or "/interface pppoe-server", but your question was too vague to know.

sid5632

Press the Upgrade button and it might become clearer...

sid5632

If you do not know the answer to a simple question you should not respond, as it is more likely someone with knowledge will answer if there are no other answers. The point is that there IS NO ANSWER to your question. What would you expect anyone to say? Nobody can say anything apart from the pointl...

sid5632

Have you tried turning it vertically instead of horizontally? It helps the electrons go round the corners.

Or perhaps you need to sacrifice a goat first.

sid5632

Turn it off and on again.

sid5632

My unit (CRS112-8P-4S r2) works normally at 1Gbps Full-duplex on ether1 (running 6.48.6 currently).

sid5632

It's not "BS" and anyway it was normis who started it in this thread.

sid5632

We have not done work on the Dude for some time now. If it works for you, great, you can use it. But there is no active development on the Dude at the moment. It may resume in the future, it's not known. If MikroTik is not interested any more, please can you just open source it and let the communit...

sid5632

You don't need to shutdown to reboot, fairly obviously. It's always better to shutdown cleanly than not, if you can. It will never make things worse than not doing so. Mikrotik claim it is unnecessary on Routerboard devices. Who knows? On a CHR, it uses normal Linux ext3 filesystem, so while the jou...

sid5632

No.
Have you actually tried listening to it?

sid5632

Much improved version (I found the original very stilted): { :local Beeps { { 659; 150 }; 300; { 659; 150 }; 300; { 659; 500 }; 600; { 659; 150 }; 300; { 659; 150 }; 300; { 659; 500 }; 600; { 659; 150 }; 300; { 783; 150 }; 300; { 523; 400 }; 500; { 587; 75 }; 100; { 659; 950 }; 1200; { 698; 150 }; 3...

sid5632

Maybe I made a mistake with "switch1-cpu" somewhere? The answers are the same as above: /interface ethernet switch egress-vlan-tag add tagged-ports=switch1-cpu,ether1-cAP,sfp12-Uplink vlan-id=100 You are (presumably) missing ether8 from here: /interface ethernet switch ingress-vlan-transl...

sid5632

So, your theory that "ohh, It was just a thing on the download website" is not correct. It's not a "theory". A representative of MikroTik stated this explicitly. If they decided that is stable enough to call it stable inside the software itself, they should correct it also on th...

sid5632

/ip firewall filter remove [find]
/ip firewall nat remove [find]
/ip firewall raw remove [find]
/ip firewall mangle remove [find]
/ip firewall address-list remove [find]
/ip firewall layer7-protocol remove [find]
/ip firewall connection remove [find]

sid5632

You can't redirect HTTPS 'nicely'. That's the whole point of it. It tells you when something dodgy is going on.

sid5632

And ether24 and sfp1 seem to be slugged for some reason.
I would tidy up all these back to the default values (and set the 100 Mbps stuff to 1 Gbps on the ether ports, even though auto is set and overrides them) unless there is a good reason not to.

sid5632

How is anybody supposed to guess unless you provide a configuration export?

sid5632

I was always under the impression that it did make a difference to the router what order the packets were in in terms of if the majority of packets were to have to go through the forward chain, and you had the forward chain last, more cpu cycles would have to be used to go through the input and out...

sid5632

Any thoughts or feedback on whether the script should work as expected or any glaringly obvious problems / errors? The glaring stuff is this: /interface bridge add admin-mac=00:00:00:00:00:00 auto-mac=no name=RB-5009_Bridge vlan-filtering=no MAC address like this is never going to work. /interface ...

sid5632

Presumably you just need to set a static route on each of the MikroTiks to tell them to send traffic for 192.168.111.0/24 (I presume, seeing as you haven't given any details of the subnet masks) to the PFSense device. At the moment the default route on them is sending out on the LTE because they hav...

sid5632

to enable such settings you need to briefly press the button

Press what button?

sid5632

That's not what you said.
In any case, there are several reasons to prefer RouterOS to SwOS, except apparently speed of reboot.

sid5632

A CRS210 is a switch.

sid5632

would you be more kind in your answer? I'm afraid not, certainly where that person is concerned. I can't abide his mega-posting quantity about every subject going, from a position of his own admitted ignorance a lot of the time. I kill-filed him a long time ago, as I suspect did many others. I stro...

sid5632

So thats something like
192.168.3.1 to 192.168.258.1 (and you only want 192.168.3.1 to 192.168.5.1 I think........... a

Yeah right. 192.168.258.1 Are you serious? Can't you ever keep your mouth shut about anything?

sid5632

Clearly Anav doesn't understand subnetting (like so many other things), and nor do you. The only ones that are going to work instead of /16 with those weird ranges are /20 and /21. 192.168.0.0/22 gives 192.168.0.0-192.168.3.255 - it does NOT cover 192.168.5.xxx 192.168.4.0/22 gives 192.168.4.0-192.1...

sid5632

Fairly obviously, the subnets overlap. You need to fix the /16 subnet mask to something else less greedy.

sid5632

["name="ether1"]

That doesn't look right...

sid5632

I'm using ntp1.neology.co.za everywhere....

Why don't you use something that actually works then, instead of whatever this thing is?

sid5632

Look in System, Packages first. Then come back to System, Routerboard once you've upgraded there.

sid5632

Running Dude on devices should simply be removed as a feature

Where should it be run then? MikroTik have stated that they don't recommend running it on CHRs (with V6 anyway - maybe they'll fix it in V7 (if the underworld doesn't freeze first)).
Back to the Windows version, like 3.6?

sid5632

So I picked up a RB951Ui-2HnD and slapped a basic config on from some guides. A 951Ui with Lora and an LCD? Seems unlikely. Have you just slapped every package you can find on to it, or what? Why don't you just start from the default configuration instead of some random guide(s), which are usually ...

sid5632

Do a "/export" to file and search for it.
I don't have any tools to read exported ".backup" file.

It's NOT a .backup file.

sid5632

Interesting too that export still uses spaces rather than '/' as the delimiter in the command.
One might have expected it would say "/system/scheduler/add ...".

sid5632

If you create that in Winbox and then do an export, you get this: /system scheduler add name=test2 on-event="/system script;\r\ \n/ip route;\r\ \n" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=sep/11/2021 start-time=11:42:24 which is weird and doesn't ...

sid5632

Do a "/export" to file and search for it.

sid5632

I don't know. There's no guarantee your PSUs are the same as ours anyway, as the router's a slightly different model.

sid5632

If 6.49 is declared a dead-end I am in trouble, because I can't go back to 6.48 due to no working backup available in 6.49 and not forward to v7 because the config coversion is not on the radar. If you can't get out of it, then you shouldn't have gone in to it in the first place. If it's that impor...

sid5632

We've had to change 3 capacitors in the power supplies of both of our CCR1036-12G-4S units. The 2 year old device failed in service (crash/boot looping, with odd LED indications). The 4 year old device was still OK but the capacitors were not in the best of health once removed and measured. Accordin...

sid5632

Is the DHCP client dynamic? Turn off detect-internet on all interfaces.
And don't put IP addresses on interfaces that are also bridged (wlan1).
And clean up those DHCP pools.

"/export terse" is much easier to read as well.

sid5632

When I prepare rules like above, hosts from list: access-host don't have internet connection. Why ?

Where do you think the return traffic from the internet goes?

sid5632

You almost certainly want the CCR to be the root bridge, by setting the priority to say e.g. 0x7000 instead of 0x8000. This will then show two designated ports, to each of your CRS access switches. The root port will then show on each CRS. You can't have a root port on a root bridge. SW-1F is obviou...

sid5632

Aside from the IP address on ether1 thing already mentioned, why are you putting wlan2 into the WAN interface list and then bridging it with all the interfaces you've put in the LAN interface list? Have you any idea what you are actually doing, or are you just guessing? I always assumed Beginner Bas...

sid5632

Also, tried to remove SFP1 from bridge -> no internet /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0 /ip dhcp-client add comment=defconf disabled=no interface=bridge The answer is of course staring you in the face. Put the dhcp-client on sfp1 after you...

sid5632

It means what it says. I can see packets incoming on eth1 using the "/tool sniffer quick" command on the console, but nothing goes out of eth1. It stops responding to Ping, and to everything else of course. A device that only receives traffic and doesn't transmit anything is not much use. ...

sid5632

After nearly 4 months of backwards and forwards between me and them, trying to pin down why CHR was stopping transmitting, their final answer in SUP-43326 was: " Hello, We will try to resolve this problem when will be working on improvements and fixes regarding The Dude service. For now, we rec...

sid5632

MikroTik support don't recommend running Dude on CHR at all.
I know, crazy ain't it...

sid5632

Take the hyphen out of those names.

psu1-volt() reads as psu1 - volt()

No wonder it can't parse it. It's a bit stupid that GUI doesn't prevent stupidity like this in names, but it doesn't.
Multiplying things by 1 is also rather pointless.

And you're a trainer???

sid5632

I can conclude that the issue is with the Mikrotik / routerOS device rather that the ESP devices. A very strange conclusion. Maybe you would do better to look at the ridiculously short lease-time setting that you have (5 minutes) and compare what it is on the Billion (probably 24h) and then take th...

sid5632

Why are you using nmap to test .88.1 when you are trying to NAT to .88.3?
Post configuration exports, not stupid massive screenshots.
Your blobbing of the dest. address is also pointless, as it is there for all to see, twice, in the screenshots.

sid5632

You need to add bridge1 to the tagged list for VLAN 2. You don't need to set all those untagged ports either - they are implicitly (dynamically) defined as untagged by virtue of setting the PVID. (ether22 is missing from your trunk ports tagged list for VLAN 20 - I don't know whether this is what yo...

sid5632

I'm afraid Dude is just buggy and Mikrotik don't see fixing it as a priority.

sid5632

I think it sounds stupid, but I just want to double confirm.

By double-posting in two different forum sections?

sid5632

Ask yourself this question: How does it work out where to route the WAN1/2 outbound traffic in the first place?
Src-nat happens at the very end of the chain, if you look at the packet routing diagram, so obviously a routing decision needs to be made earlier somehow.

sid5632

Try turning it off. That will solve the CPU usage problem.

sid5632

What you have is just as safe...

sid5632

I just run this:

:delay 10
:resolve freedns.afraid.org
:delay 20
/tool fetch url="http://freedns.afraid.org/dynamic/update.php\?key-goes-here" keep-result=no

in the PPP profile script, substituting "key-goes-here" for the real update key.

sid5632

Mine has 12.7 used with 6.47.9, but I haven't Netinstalled it, just upgraded it from factory 6.45.9 without any problems.

sid5632

When I enter a wrong password, I get an error. When I enter the right password, it hangs. It's in legacy mode. (was working before upgrade) I can indeed access the sstem as I was using it the day before. The fiver guy says it stuck without user code?? Am I really forced to reset it and loose my con...

sid5632

Is there any way to downgrade firmware on Mikrotik devices below the factory firmware?

No.

sid5632

When I close session with Dude Settings window opened, then IP Settings window is opened after relogin to WinBOX.

Yes, I have noticed the same problem too.

sid5632

Mine fails to boot too. My message is slightly different though:

Load system

Resizing disk(GPT)...
ERROR: could not mount disk!
Please attach it somewhere else.

sid5632

Its not irrelevant. To solve problem its good to have as much information as possible.

It IS irrelevant. The problem is to do with scripting and variables not any other use they may be put to. Answer the question as posed or don't bother answering at all.

sid5632

Why do you like to store this on the router?

That's irrelevant. Just answer the question as posed. Don't try and tell someone to do something else.

sid5632

You're not going to get any (sensible) reply unless you provide a configuration export.

sid5632

First correct this to add switch1-cpu as a tagged port: /interface ethernet switch egress-vlan-tag add tagged-ports=switch1-cpu,ether7 vlan-id=4 Then you need to create a vlan interface on the bridge: /interface vlan add interface=bridge1 vlan-id=4 name=vlan4 And put the IP address on the VLAN inter...

sid5632

You need to Src-nat it e.g. something like this:
/ip firewall nat add action=src-nat chain=srcnat dst-address-list=myvpnlist src-address-type=local to-addresses=a.b.c.d
filling in as appropriate.

sid5632

Have you told whatever the Router/Wifi device is about subnet 192.168.2.0/24 and how to get to it?
You haven't even mentioned it until now.

sid5632

Established/related etc are states between WAN - LAN etc. not from VLAN to VLAN.

You need to go back to Networking school, because you are wrong.

sid5632

What's the DNS set to from the PC's point of view? And how is it set? Static or DHCP? If the former, then you set it like that, so you can change it. If the latter, then change the DHCP server's configuration to give 0.33 instead of 0.1 as the DNS. (It also helps readability and understanding if you...

sid5632

1- is it possible to run mpls on RB941 ? won't have any problem with it's license ?

Yes and no, respectively.

sid5632

People just ignore idiots who don't at least post version information.

sid5632

Which package do I need to use for Mikrotik CHR?

The ones listed under Cloud Hosted Router on the website's Downloads page. I'm sure this is not a terribly difficult concept.
e.g. https://download.mikrotik.com/routeros/6.47.8/all_packages-x86-6.47.8.zip

sid5632

Why are you trying to deploy mipsbe packages to a CHR?
And why are you trying to do it on one where the trial license has expired and thus prevents upgrades?

sid5632

There is only one bridge and all ports are switched together. This is obviously not true as your config. snippet includes bridges "bridge" and "bridge-net". Remove everything in the /interface bridge vlan and /interface ethernet switch egress-vlan-translation sections as they ar...

sid5632

You need the egress to include the switch1-cpu port as tagged: /interface ethernet switch egress-vlan-tag add tagged-ports=trunk1,switch1-cpu vlan-id=10 I'm not sure whether having ether23 and ether24 as bridge ports is right or not. It feels wrong and you might consider removing them and adding tru...

sid5632

Why don't you link to this from https://mikrotik.com/download instead of burying it away on the Wiki?

sid5632

And move the IP address that's on ether2 onto the bridge (why's it even on ether2 in the first place, which isn't mentioned in the diagram?).
And create a firewall rule on the input chain that allows access from VLAN_987654321 otherwise its DHCP server isn't going to work.

sid5632

Why is it strange when you look what he's doing with the port 53 traffic? In fact the whole configuration is bizarre (to me).

And defining mikrotik.com is not a lot of use when (I think) it's licence.mikrotik.com and upgrade.mikrotik.com that are needed.

sid5632

Is this a typo.:
dhcp-option=domain-search-option
when you earlier had:
name=domain-search-list

sid5632

Ah apologies. So it should be like this? /interface bridge port add bridge=bridge1 interface=ether1 hw=yes comment=WiFi add bridge=bridge1 interface=ether2 hw=yes comment=WiFi add bridge=bridge1 interface=ether3 hw=yes comment=WiFi add bridge=bridge1 interface=ether4 hw=yes pvid=10 comment=NAS add ...

sid5632

The data in the database is just a big blob, and nobody knows the format (outside of MikroTik, obviously, and they aren't telling).
So the answer is no.

sid5632

Got a CRS125-24G-1S router

It's a switch, with some low-powered routing capability.

An obvious configuration error, change:
/ip address add address=10.0.1.1/24 interface=ether16 network=10.0.1.0
to:
/ip address add address=10.0.1.1/24 interface=bridge1 network=10.0.1.0

sid5632

Looking forward to 6.47.4 on Monday then... :-)

sid5632

I guess there is a hardware defect in some way, which causes it to forget its config. - that's probably why it was being sold, so try returning it.

sid5632

I've definitely heard that before. I think it's the noise it makes when it's applying the default configuration i.e. when new, or after Netinstall.

sid5632

This whole thread seems a bit pointless, because you really don't want to be running an unencrypted protocol with poor security open to the world in the first place.
Unless you want to get hacked or have information stolen of course...

sid5632

IPTV arrives at CRS112 in vlan 675, then traffic is to go directly to the connected STBs without tagging.

Which interface is which?

sid5632

I mean everywhere on every device.
Look at your config. export on the MikroTik.

sid5632

Yes.
You obviously need to change your /24 to /23 everywhere else too.

sid5632

You are running untagged on the switch-CPU link currently. There is an implicit "untagged=bridge1" on your bridge vlan statement by virtue of setting the pvid on the bridge itself. If you want to run tagged on the link, then you need to set "tagged=bridge1,ether48" on the bridge ...

sid5632

Thanks for the reply - however this is not working. What is not working? And what does "not working" mean anyway? The reason for hardware offload is that the CRS cannot handle 1Gbps tagging/untagging without it. Indeed. Adding a VLAN to the bridge, so far as I know, will cause all hardwar...

sid5632

Restore is only valid on the exact same device it was backed up from.
Not even the same device type is valid.
Different device type... forget it.

Configure the new one using the export from the old one as a guide.

sid5632

If you're completely new to this, then why are you using an ancient version of Winbox (3.0rc6) and where/when did you get it?
Something doesn't quite ring true...

You didn't mention which version of CHR you're trying to use either.

sid5632

Look up in-interface= and out-interface= on the Wiki
Presumably you only need to protect against DoS from the incoming internet interface (whatever that is).
Then your outgoing connections to Speedtest shouldn't be affected.

sid5632

You just set up an internet VLAN in the same way as your other VLANs. There is nothing magic about it. Do not create another bridge. It is unnecessary and you will lose hardware offload.

sid5632

You probably ought to add some interface matchers to those rules.

sid5632

NatRule.get(comment='RDP')[0]["id"]

sid5632

Delete the IP address from the bridge and add something like: /interface vlan add interface=bridge name=vlan40 vlan-id=40 /ip address add address=192.168.88.1/24 interface=vlan40 I also add the equivalent of this (presuming ether2,4,8,10,20 are trunk ports): /interface ethernet switch set drop-if-in...

sid5632

The first post clearly mentioned MNDP, not LLDP, so why muddy the waters with the latter?

sid5632

A bridge should not "pass" Neighbor-Discovery packets

Says who? And why not?

sid5632

Monitor what?
It's difficult to monitor anything if it doesn't respond.
Usually Ping works in the same subnet.

sid5632

/interface ethernet switch ingress-vlan-translation add customer-vid=0 new-customer-vid=10 ports=ether2,switch1-cpu add customer-vid=0 new-customer-vid=20 ports=ether3,switch1-cpu It all looks OK. The only thing I would change is this: /interface ethernet switch ingress-vlan-translation add custome...

sid5632

"unable to connect" doesn't exactly convey much information.

sid5632

It affects most if not all windows.

sid5632

I'd really like The Dude client to stop crashing, and to be able to continue using it normally, again.

Wouldn't we all...
But there's seemingly zero interest from the only people who can fix it.

sid5632

I've never looked at an 1100, but I'd have thought you'd want to change this: /interface ethernet switch port # ether1,ether2,ether3,ether4,ether5,switch2-cpu set 0 default-vlan-id=2 vlan-header=always-strip vlan-mode=fallback # error here? /interface ethernet switch vlan add independent-learning=ye...

sid5632

So you want to use connection tracking to avoid using connection tracking?

sid5632

Yes, but the performance will be terrible as everything goes via the weak CPU. So don't do it. Stick to the old way.

sid5632

When hell freezes over.

sid5632

Just create the interfaces as static objects. Then you can join them with a real link using any interface you like.

sid5632

Wrong. Vlan switching can be handled in hardware. Vlan routing not. Ok, then you can take a look at the manual https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Hardware_Offloading CRS1xx/CRS2xx series do not support Hardware offloading along with VLANs... Only CRS3xx series do... No, i...

sid5632

Here is my non working configuration:

Not surprising seeing as you didn't enable bridge vlan-filtering.

sid5632

Logs are written asynchronously

Why? That makes problems a lot harder to diagnose and you can never be sure what is a cause and what is an effect.

sid5632

You need to change the Settings for the Discovered Network's Router object on the client.

sid5632

Also the last (and most important one) line of the log is very hard to read - it almost always stay "between" lines, auto scroll doesn't always work.

Yes, I'm seeing that too. Most irritating.

sid5632

Your description and config. don't match the diagram for Wi-Fi Disc. It would be useful if you referred to VLAN10 and VLAN20 instead of VLAN1 and VLAN2. /interface bridge vlan add vlan-ids=10 tagged=bridge,ether1 add vlan-ids=20 tagged=bridge,ether1 You don't need to specify the untagged ones - they...

sid5632

I'm still getting this flip-flopping of window sizes when starting winbox64.exe (on Wine under Linux Mint 19): creating Window Class routeros_null creating Window Class routeros_connect DPI=100 EMS=13 ERROR: bad bmp format id=2329 biPlanes=1, biBitCount=1, biCompression=0 ERROR: bad bmp format id=33...

sid5632

Read post #3 and understand it.

sid5632

He never got the chirping sound. Read carefully.

sid5632

vortex,

IIMHO i's time to stop increasing your post counter.

That's anav and vortex in the kill file then. Perhaps it's the same person.

sid5632

Add something like this as well:

add action=masquerade chain=srcnat dst-address=192.168.0.2 dst-port=22,80,161,443 protocol=tcp src-address-list=OnlyFromHere

sid5632

Is your ? key stuck?

Put the server on the bridge or take the port out of the bridge.

sid5632

Actually, now I tried it multiple times, it alternates between DPI=100 mode and DPI=120 mode.
It doesn't matter whether "wine" or "wine64" is used.
Also, it shrinks the window every time (relative to the previous time it picked the same DPI mode). This is quite irritating.

sid5632

I found "wine winbox64.exe" produced this to standard output: creating Window Class routeros_null creating Window Class routeros_connect DPI=100 EMS=13 ERROR: bad bmp format id=2329 biPlanes=1, biBitCount=1, biCompression=0 ERROR: bad bmp format id=3329 biPlanes=1, biBitCount=1, biCompress...

sid5632

It's an off-by-one type bug in the Dude which seems to cause it to attempt to poll 4.29G services (4.29G being -1 as a unsigned number). It's been reported many times but MikroTik do nothing about it (nor about any other bugs in the Dude). You can temporarily cure it by deleting the device and then ...

sid5632

You need to add switch1-cpu to the VLAN table:

/interface bridge vlan add bridge=bridge1 tagged=bridge1,ether5,switch1-cpu vlan-ids=100

Ugh, confused myself by mixing switch chip and bridge config. (and I don't have a 4011!).
Switch VLAN table is non-functional anyway on these devices.

sid5632

Are you sure you aren't just being hammered by unsolicited traffic causing things like DNS amplification attacks?
Your firewall protection is non-existent.
I would suggest you start from scratch with the default configuration and customise (with sanity checks) from there.

sid5632

restart your router to get new IP Did he say he was on a dynamic address? No. So it's not the most sensible suggestion. Did he say he is on static? So you can take you comment and shove it He didn't, but has now, so that makes you look like a complete jerk doesn't it? A rude, ignorant jerk, who mak...

sid5632

sorry no idea

So why exactly did you reply to this particular 20 day old thread to add that gem of uselessness?
At least you didn't post any spam links this time.

sid5632

restart your router to get new IP

Did he say he was on a dynamic address?
No. So it's not the most sensible suggestion.

sid5632

Because that's what it says here:
https://forum.mikrotik.com/viewtopic.php?f=1&t=152006

Send them an email referencing this thread. Not hard is it?

sid5632

Anyway, other boxes with 6.46 does not crash with mask /24 on vrrp interface

Agreed, but you need to report it to MikroTik support.

sid5632

Address on VRRP interface should be a /32 not a /24.

sid5632

I would actually discourage setting "untagged=etherx" for any /interface bridge vlan - leave it unset, and set the correct PVID for the etherx port in /interface bridge port and that etherx port will also be added dynamically as an untagged port for that /interface bridge vlan without you...

sid5632

I don't quite understand, due to your poor English, but assume it to be this:
/ppp secret set caller-id=ACTIVE [find disabled=no]

Search found 563 matches