MikroTik

sebus

Thanks, that's really handy!

sebus

Isn't it that client certificate SAN needs to have

UPN should be encoded as an "otherName" value in the SAN with a type-id of 1.3.6.1.4.1.311.20.2.3 (Microsoft UPN); not a dNSName.

sebus

I could not say either, but definitely what I see happening

sebus

It only seems to indeed work when device boots, if device is already connected when filter is activated, it does not get stopped (count goes up, but that's it)

sebus

Thanks, I can get data show in statistics, but still device can be accessed and access resources itself

sebus

Come on, we talking kids mobile access control evening hours. Not going silly with creating a solution that is borderline on enterprise...

My solution in post #3 is working "fine"

sebus

WLAN is provided by hardwired Zyxel boxes, so in-interface=ether2-master is correct

But as you see in my post, I was trying on hardwired box with MAC 06-61-61-12-db-43 & no activity shows on bridge filters and device not being stopped

sebus

Sure, I could make yet another SSID (already have 5, but not using Mikrotik for that) and control that. Pseudo MAC is really Random and unless there is something that can be build into RouterOS that does the check, I see no easy way that the fact could be used for "bridge filters matching sourc...

sebus

We do live in strange world indeed...

sebus

Please read carefully, if one tries Time Restrictions then definitely not on a device that one controls physically... So I used this and firewall rule that does use src-address-list= (where the list contains FDQN) That should work... I hope Even if it does, it is very much "poor's man" sol...

sebus

Why that is simply not build in RouterOS?

It is something one would just expect to be there!

Thanks

sebus

sebus

While I can configure it in Mikrotik 6.47.7, Windows 1809 does not get it, neither does any Apple iOS device To make sure I have correct entry, I used this In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\********************** there is no entry in DhcpDomainSearch...

sebus

Used to quite happily restrict kids time using MAC address of the iDevices After upgrade to iOS14, it simply does not work, as the private address changes every 12 hours. So different MAC, different IP from DHCP Is there any other way to do restrictions? Or deny obtaining IP if NOT REAL MAC is used?...

sebus

And that is the answer from Guru...

sebus

Maybe a warning while using Quickset after initial config would make sense.

I also noticed that it randomly removed me a couple of firewall rules for L2TP/IPsec server access

Not being told what will happen, is not the "safest" design.

sebus

sebus

@krafg Thanks, but you did not understand, so the one above it a "better" option. @xvo non-default configuration I assume would be just "blank" OS with zero configuration. Anyway, I would expect some logic build in, so user does not do something that "should not" happen...

sebus

Had to emergency connect 4G router to Mikrotik WAN port - ether1 (because ISP fibre connection died due to cables being cut some place else) As the 4G Huawei router provides DHCP, it was easiest to configure in bridged mode. But I would expect that this would automatically disable DHCP on Mikrotik e...

sebus

Exactly like per title: I need a single list called MyList which contains two separate IPs xx.xx.xx.xx & yy.yy.yy.yy They are not subnets, just two external IPs It is impossible to add in GUI In CLI add list= creates in my case: Flags: X - disabled, D - dynamic # LIST ADDRESS CREATION-TIME TIMEO...

sebus

There was a question here - viewtopic.php?t=64777

Which does not answer anything. Doing it this way creates separate lists with exact the same name (which looks mad to me!)

sebus

sebus

REMOVED

sebus

Gave up on this, and simply configured VPN server on Mikrotik itself using these instructions

sebus

REMOVED

sebus

So did the OP get it working? That should be really simple. All my other NAT rules work (with port forwarding or not) But no matter what I can not connect to Softether VPN server (Windows) behind Mikrotik In log I can see: 500- dstnat: in:pppoe-out1 out:(unknown 0), src-mac xx:xx:xx:xx:xx, proto UDP...

sebus

As little as this: # apr/04/2020 17:03:46 by RouterOS 6.45.7 # software id = AEX8-LSWI # # model = 2011UiAS # serial number = ********* /interface bridge add admin-mac=************* auto-mac=no comment=defconf fast-forward=no \ name=bridge protocol-mode=stp /interface ethernet set [ find default-nam...

sebus

That game used to work, and without any config changes, it just stopped Cannot remember if I might have done OS update at the same time to 6.45.7 from 6.43.x The game only gives an error This thread gives a suggestion to disable QOS During the attempted connection I can see in MK But no amount of Fi...

sebus

In my case, no matter where such rule goes, it never gets a single packet through it (so totally unused & not needed)

sebus

OK, that was easier than expected after all. Used this as a pointer: https://blog.dical.org/?p=22 On Zyxel still created Interface Group & Home Networking new IP address assigned to this Group, but there is no need for Vlan settings (as no Vlans are involved) Then ofcourse on Mikrotik one needs ...

sebus

Directly connected VLANs should not need firewall policy and/or routing (unless one wants to disable access between) Hence I would expect to get a reply at least from withing Mikrotik console itself Anyway, nothing from Zyxel to Mikrotik either, must be something to do with Vlan setup (most likely) ...

sebus

I am trying to get to Zyxel VMG3925-B10B / VMG1312-B10A in Bridge/Modem Only mode from LAN driven by Mikrotik router So the setup is client (wired or wireless) --> Mikrotik Eth1 --> single cable to VMG3925-B10B Eth1 From LAN client (192.168.88.1) I can ping the newly created Vlan2 interface on Mikro...

sebus

It seems that the issue is that between OS versions behavior of master interface changed. I have D-Link managed switch connected to ether3 (to which my devices are connected) With current OS I can get WoL working again, but I had to change my scripts to use ether3 (previously it was working fine wit...

sebus

I hate upgrades, as always something goes wrong (ofcourse other things might have been wrong previously, hence the need for upgrade) This time WOL stopped working in both 6.44.3 & current 6.45.3 It used to work perfectly fine in my old 6.34.x version I can use Depicus WOL GUI tool (and with sett...

sebus

While the script is nice, it only does the upload of already created certificate. But the creation part (for wildcard at least) is a manual process. Or on Windows one can use Powershell to do it like this on Cloudflare Then we only need to parse the string from the terminal output for that required ...

sebus

Same client (same laptop connected to either AP)

AP2 is not an issue, as if I connect Chromecast to it I am in same situation. It is Mikrotik issue
(which I can sort as per first post, but do not think it should be so)

sebus

sebus

I am not assuming anything.
On same AP no data ever travels to the Mikrotik, as it is all on same AP

Swapping the APs makes no difference

Yes, arp is enabled on all interfaces

sebus

sebus

HOW WONDERFUL FOR YOU!

But if you have nothing to add then do not bother to post?

sebus

2 separate Zyxel APs connected to Mikrotik on 2 ports (Eth2 & Eth3) Scenario 1: Chromecast --> Zyxel NWA1123-ACV2 --> RB2011UiAS ETH2 If I connect laptop via Zyxel NWA1123-ACV2 (any SSID, either 5 or 2.4 Ghz) there are no issues to cast (Chromecast is visible & accessible ) Scenario 2: Lapto...

sebus

RouterOS v6.38.5 (did not upgrade, as it does work for me doing all I need, as with every upgrade, something will change, what worked will work differently or not at all and I will again need to spend time to redo my config, not something I need to spend the time on) So I did not upgrade! Connected ...

sebus

As stated in first post linked to the Intel forums: In a browser I can log in website: http://IP:16992/ and I can click Remote Control, mark Turn power on with selection Normal boot, click Send Command and click OK. It works good, but in only one lab we have 10 computers, so I have script like: for ...

sebus

Why? Because you read scary stories about a flaw that was fixed months ago?
If thinking in that categories then one has to disconnect from any network, only way to be safe!

Anyway, that was your opinion, not an answer to the question...

sebus

Once Intel ME (ISM/AMT) is enabled, then legacy WoL no longer works. So such machine cannot be WoL powered on, but instead one would go to http(s)://host:16992(3) & power on from the menu. On Windows there are ie Powershell options, on Linux there is ie amttool But RouterOS does not seem to have...

sebus

NO, nothing gets marked as youtube when accessing youtube.com with above! (all counters stay on 0)
And as nothing is marked, I can not process it in firewall (in any way)

sebus

Hence it is drastic.
But the only one that works.
There are plenty of Guides on Internet for "How To Block HTTPS websites on Mikrotik Router"
and using L7, none of which I could make work (with any regex for YT)

sebus

sebus

Drastic, but does work. Could not get anything else working for https YT, although I would prefer something more specific to DNS entries only (ie youtube.* etc)

sebus

I can not add even single value:

EDIT:
It needs the Value field to be:

'208.67.222.222''208.67.220.220'

Rather "unfriendly' error

/ip dhcp-server option
add code=6 name=OpenDNS value="'208.67.222.222'"

sebus

MTBackup does indeed save pure text config (which is very handy)

sebus

It does correctly auto negotiate to 100Mb FD on Gig ports

sebus

sebus

Anyboidy?

sebus

sebus

Anybody?

sebus

sebus

Or are we likely to get the issue patched?

sebus

sebus

That is just bad design from start!

Who would think that it makes any sense to behave like that?

sebus

Nobody?

sebus

Or use the magic rule

/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat

sebus

Looking for the same

No luck in that thread: viewtopic.php?t=117369

Thanks

sebus

sebus

That is a bugger... DHCP is rather useful...

Can you share the script?

sebus

sebus

RouterOS does not have application firewall

sebus

Most likely he wants to setup PPTP VPN ON internal Windows Server, so only NAT should be required (with correct FW rules)

Which ports to unblock for VPN traffic to pass-through?

sebus

Was that fixed in the end?

Or ECI still gives problems for default Eth1 port on RB2011 devices?

sebus

sebus

You should use either ONLY Quickset, or ONLY the other menus. You can't use both, most of the time.

Thanks, but that is still bad design, especially that when using QS one still needs to use other menus for other settings

sebus

Hi,

@sebus, calm down man, andriys,macsrwe and jarda have explained very well purpose of Quick Set.

Now, back to your situation.

Thanks for pretty pictures, I hope they might help somebody asking that question again ( I am good)

sebus

I see now of you see the point. Quickset being what it is, it does not matter. But once the changes are made elsewhere it does show plain rubbish (Bridge not Router) It is just BAD design, that is all! That is all Also do not forget that different people buy Netgear/D-link & different people buy...

sebus

Anything ever came out of it?

sebus

sebus

Of course the is no WAN port, what are we to call it then? OK, shall we call it then DHCP client enabled port that connects to ISP ? Come on, it is WAN designated port after all Of course one can route whatever to wherever (that is the purpose of a router), but in home use it is most likely routing ...

sebus

Good design would be to just show what the user chose to be the WAN IF user did make the change.
Really simple. It would be good for either condition then. Or disable QuickSet IF user made changes elsewhere.

As it is now, it simply looks confusing

sebus

@jarda, how can you asses my knowledge? From a single question that there is no clear answer to? Just use search & see how many people asked same question over the years... To me it is a bug/bad design, no matter what you think. Could you also consider that is the user that decides what is or no...

sebus

I am sorry, but if that is the case then it is a bug (at least in interface!) I do know what to change, but none of the changes do get reflected in QuickSet (which obviously is wrong) Again, WAN port swap should be really basic step, as most users would need it (or change the defaults in firmware) E...

sebus

All I need to do is make "WAN" port being Eth9. There is NO need to waste Gig port for WAN connection (that is at most 72Mb) - hence this should be easily user changeable! So I can change DHCP client/NAT/FW rules/neighbour discovery/master on Eth 9, but in QuickSet window there is still ON...

sebus

That is something that just about everybody faces, yet I can not find logical "How to..."

Anybody?

sebus

Search found 67 matches