MikroTik

SilverNodashi

What else then? EDIT : i just gave you alternatives RIGHT above your post if you are on a budget ... fs.com S5850 or N5860. i would recommend the N definitely heavier on the price tag than mikrotik but quite solid switches Those switches are 7x more expensive than the MikroTiks :shock:

SilverNodashi

Easy. Don't use mikrotik!

What else then?

SilverNodashi

Interesting....I hadn't seen your thread otherwise I would have piled on in there. In my case I have a pair of CRS326-24S+ switches as a "core" with a pair of CRS328-24p switches below. When everything is on 7.6, the MLAG on the "core" layer works great. Trying to enable MLAG on...

SilverNodashi

Is it possible to force all traffic, in an bonded environment over a specific switch? I have an RB3011 and 2x CRS326+24S setup in an MLAG setup, as per these instructions: https://help.mikrotik.com/docs/display/ROS/Multi-chassis+Link+Aggregation+Group There's 3 servers, each with 2x SFP cables, one ...

SilverNodashi

Have buy this product yesterday. Just try running, remote from ether1 without any traffic. Don't know what wrong with my device https://scontent-sin6-2.xx.fbcdn.net/v/t1.6435-9/252810053_10224074932694652_3510091831797168874_n.jpg?_nc_cat=108&_nc_rgb565=1&ccb=1-5&_nc_sid=730e14&_nc_...

SilverNodashi

Trying to introduce redundancy can create more points of failure, you have to consider carefully what would happen if any device or interconnection fails and what the traffic paths are likely to be. The whole idea is to have two internet paths to each server. This way, if a router / switch / uplink...

SilverNodashi

THe weak chain in the link is a single RB3011~ (assuming the two lines from the router indicate two WAN connections) Right now, this is what I have at my disposal. There's only 1 uplink as well, so a 2nd RB3011 wouldn't make a difference either. The idea is to have 2 routers, each with it's own int...

SilverNodashi

Hi, I have searched the forums but cannot find a good answer. I need to setup a redundant network for a linux VM cluster. - The Linux machines have bonded NIC's with 802.3ad running between 2x MikroTik CRS326-24G-2S+. There's a fiber crossover on the two Mikrotik's SFP ports. This works fine. When e...

SilverNodashi

OK. Next is to dump all your current NAT rules as they are just a heap of random garbage. Keep only add action=masquerade chain=srcnat out-interface-list=WAN If your WAN interface is lte1, then add lte1 to interface list WAN instead of adding another NAT rule. For making LAN to LAN port translation...

SilverNodashi

To do port forwarding for internal lan, you'd have to force all LAN traffic through router ... if all clients are wireless and samba server is wired, then this might be possible by setting /interface bridge settings set use-ip-firewall=yes ... Everything is wireless, except for the LTE router. I al...

SilverNodashi

It is illegal to change the IMEI It's also illegal to transmit with EIRP higher than country limit and yet everybody seems to happily violate that. But to return to OT: probably it's not possible to change IMEI unless one re-flashes LTE card's permanent config area (which is left intact by normal f...

SilverNodashi

On the current LTE routers it's very difficult to remove the SIM cards. Please make the casing a bit bigger to fit your fingers in

SilverNodashi

Can anyone help me with this, please?

SilverNodashi

It is illegal to change the IMEI

SilverNodashi

You need to set the Max Limit on the General tab to 10M or 3M as required That sound like stupid idea but it works :) Thank you a lot. Why does it sound like a stupid idea? Probably because he didnt understand, nor did I, what a Military Rank - "General" has to do with MT queues? :-) I th...

SilverNodashi

You need to set the Max Limit on the General tab to 10M or 3M as required
That sound like stupid idea but it works Thank you a lot.

Why does it sound like a stupid idea?

SilverNodashi

/export hide-sensitive file=yourconfigmar17

That's random.
What other settings are you looking for?

SilverNodashi

I am looking for a similar solution.

Is it possible, with a script (my scripting is very bad) to check the DHCP Active Hostname for a string, say
"android* and assign it to a specific DHCP pool?

SilverNodashi

You need to set the Max Limit on the General tab to 10M or 3M as required

SilverNodashi

Hi, My Andriod media player cannot be rooted so I cannot get Samba working on the default port 139 and 445 so I want to forward traffic on the local LAN from ports 139 to 1139 and 445 to 4455 but it's been unsuccessful. All my LAN devices connect using wireless through a "RouterBOARD cAP Gi-5ac...

SilverNodashi

I wish MikroTik had something similar to this as well. Many people have asked for it over the years, yet nothing seems to be done about it.

SilverNodashi

Hi, I have a RouterBOARD cAP Gi-5acD2nD with an LTE router connected to ether1 as primary internet gateway, and another LTE router (with another ISP) connected to ether2. Routing internet over ether1 works fine, as expected. But routing internet over ether2 doesn't work at all. I have searched the f...

SilverNodashi

If you want to exclude some domains from the limits, you can put them in the walled garden: https://wiki.mikrotik.com/wiki/Manual:I ... led_Garden

SilverNodashi

I am having the same issue with a RB951Ui-2HnD, acting as "home AP. The wireless devices connect at 150Mbps yet they only get about 1Mbps internet speed on a 30Mbps fiber link. When plugging my laptop directly into the RB951Ui-2HnD LAN ports I get about 18Mbps download and 30Mbps (http://www.sp...

SilverNodashi

Ok, so I tried this tool and it seems quite handy. Is there a way to see though which websites / services any of the IP's access? i.e. can I see if 192.168.1.107 access facebook.com, for example, and how much data is being downloaded from facebook.com?

SilverNodashi

Is there this tool for Linux? (Service & Viewer)

Thanks.

I would also prefer a Linux version, but I guess this is what it is.

SilverNodashi

I think I find the solution... disable the fasttrack rule in the firewall. In which scenario should/can I use a fasttrack rule?

This doesn't make any sense. The manual suggest that fasttrack would improve performance, not slow it down: https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

SilverNodashi

I see a few curious settings in your config relevant to this thread: * "speed=100Mbps": are these manually set to 100mbps I think this is a MikroTik design flaw? The interface stats show 1Gbps, as per the screenshots * "hw=no" you mentioned it before, but it's preferred to be en...

SilverNodashi

* do you get errors / fault on these ports Where exactly should I look? => Statistics on each interface: tabs Rx stats & Tx stats. ok, so no errors there. * what if you try to transfer to/from CRS? I am not sure I understand the question? Buying new switches are not an option. => try transferri...

SilverNodashi

No it doesn't, but it's not a configuration with any future... With regards to switching, few ideas: * is the switch/bridge HW offload active/enabled HW offload is unticked on all the ports. I had it ticked but it didn't make any difference. * do you get errors / fault on these ports Where exactly ...

SilverNodashi

CRS is not a core router, but a core switch with routing functionality. it's main purpose is to switch. You have the wrong hardware. get a hex r3 (or better) in front as the router and use CRS as switch only

That doesn't explain the very poor network throughput on the switch.

SilverNodashi

Hi, I am trying to diagnose slow internet connectivity. We have a 100Mbs 1:1 Fiber line but I can't ever seem to get it running at full speed. When connecting a PC directly to the ISP's Cisco fiber router, speedtest.net reach about 120Mbps, but with the Mikrotik connected I get a max of about 16Mbps...

SilverNodashi

Can anyone help, please?

SilverNodashi

I also want to add that our internet is extremely slow. Our LTE is capable of 40Mbps, and I have, when connected directly to it with a LAN cable, on different occasions, been able to test about 35Mbps on www.speedtest.net. Going through the wireless, I get about 1.5Mbps at the moment. http://www.spe...

SilverNodashi

Hi, I hope someone can help me. All our laptops, cellphones and tablets are wireless, hence only using a RouterBOARD cAP Gi-5acD2nD. Copying data from one laptop to another is excruciating slow. I am lucky if I get about 620KB/s. I used Teracopy to measure this. Browsing network folders on another l...

SilverNodashi

Did you ever get a solution to this problem?

SilverNodashi

Small towers fixed on the rocks with steel rods or galvanized iron piles, We use them for small POPs in the rural areas of Sardinia (IT). Very often in the hills it is not possible to have electricity, so we use 24V photovoltaic panels and batteries. The low power consumption of MT devices allows f...

SilverNodashi

Is it possible to use a solar tower in country like India?

Is it possible to have a forum without spammers?

SilverNodashi

According to changelog it is fixed

What's new in 6.40.8 (2018-Apr-23 11:34):

!) winbox - fixed vulnerability that allowed to gain access to an unsecured router;

So why would they post this again if it was fixed in April?

SilverNodashi

The IP subnets I got from the description in your original post The 3 main subnets are: home: 192.168.10.0/24 HQ: 192.41.100.0/24 Remote Office: 192.168.6.0/24 The home and remote sides looks ok. There are 2 different route prints for HQ, not sure why. Also, if I follow the route numbers, there see...

SilverNodashi

You will need the following routes at: HQ: 192.168.6.0/24 via PPTP-1 (To Remote) 192.168.10.0/24 Via PPTP-2 (To Home) Home: 192.168.1.0/24 via PPTP-1 (To HQ) 192.168.6.0/24 via PPTP-1 (To Remote via HQ) Remote: 192.168.1.0/24 via PPTP-1 (To HQ) 192.168.10.0/24 via PPTP-1 (To Home via HQ) I have the...

SilverNodashi

traffic towards 192.168.6.20 should be routed to 172.16.16.106, not 172.16.16.1
change your static routing at home router

That doesn't make sense. 172.16.16.106 sits on the other network and cannot be reached from 1921.168.10.1 directly. Even adding it as a route shows it as unreachable

SilverNodashi

Hi, Can someone please help? The setup is as follows: We use PPTP VPN on internal IP range 172.16.16.0/24. My house IP range is 192.168.10.0/24. The HQ is on 192.41.100.0/24 and the other on 192.168.6.0/24. I setup NAT and routing on both ends, but cannot connect to PC's and printers on the 192.168....

SilverNodashi

I'm from South Africa. We have Vodacom, MTN, Telkom and CellC in the country. I love your SXT LTE, the devices are fantastic. Small issues with finding the network here and there, seems somewhat delayed from time to time, but in general excellent. PLEASE make a dual sim SXT-LTE. Its easy to see at ...

SilverNodashi

Hi, I wonder if someone can help me. My wireless network consists of a MT 951Ui-2nD as the main router and a 951-2n to extend the wireless coverage to another part of the house, and give LAN access to some PC's on that side. An LTE Router is connected to the 951Ui-2nD for internet usage. Over time, ...

SilverNodashi

Another nice feature on the Ubiquity, which I which was on MT, is the bandwidth management. You can quickly see who uses how much bandwidth and easily limit them very quickly. The torch feature om MT also work very well. What I usually do is I create a script that would automatically create a simpl...

SilverNodashi

You say "network cable" is not present, but I would assume their are phone lines ran through out the building? You could very well buy a used VDSL DSLAM off of ebay or something and push 200mbs+ links to a remote AP plugged into a DSL modem. Or even have one DSL modem per floor handling a...

SilverNodashi

I would love to see an enterprise wireless option from MikroTik as well. The ubiquity devices are nice, but it's not MT ;) My biggest problem with MT, is that in a large office it simply doesn't have enough range to cover a big area, whereas the Ubiquity Unify AP Long Range can cover a 200m radius. ...

SilverNodashi

You should filter by DNS.

L7 will not help against HTTPS, because the traffic is encrypted. Just redirect all DNS requests to your router and set some filters in the DNS static list.

How would you get all porn site's IP's? There are literally hundreds and thousands of them.

SilverNodashi

Layer 7 or DNS regexp mb.

Отправлено с моего iPhone используя Tapatalk

Layer 7 will use quite a lot of memory. How would you block porn with DNS regexp?

SilverNodashi

If you put the DHCP server on the east link, and the east link goes down, the DHCP server also goes down with it.

In this scenario you need to enable the DHCP server on the west link as well. Use different IP pool to avoid IP conflicts

SilverNodashi

I found that when I bound the DHCP server to a bridge it didn't work. Therefore I assumed it was a requirement to bind all DHCP servers to interfaces. I see that this may no longer be a limitation with newer firmware. My testing was a few versions ago. I'll have to try again with the latest version...

SilverNodashi

Ok Thanks... I'm using ExpressVPN also and Using PPTP for this. but I think OVPN is better than PPTP. we will wait for mikrotik

I want to sign up with a VPN provider too. Can you please confirm, could you connect to the ExpressVPN through your MikroTik? Either with PPTP or OpenVPN?

SilverNodashi

Just found here...

viewtopic.php?t=73287

Thanx.

I am still looking for a way to know which WAN / route was used to establish the connection.

SilverNodashi

Ok, that makes things a bit clearer, but I don't know yet, why you want to work with your WAN-IP. If you have VPN-Clients which want to connect to the Mikrotik you can use it's DNS-name I think. Like I said, there's 2 WAN's and I need to change some stuff when the WANS's change, based on which WAN ...

SilverNodashi

Hi, for what you want to use the WAN-IP information? In IP -> Cloud you can find the Mikrotik-DNS Name and your WAN-IP - maybe this will help you out. Oh, yes, I should have said. I have a dual WAN setup, with a remove VPN. So the MikroTik can establish a VPN connection regardless of which WAN conn...

SilverNodashi

Hi,

I wonder if anyone can help me.

I have a MikroTik RB2011UiASM, with a Hauwei LTE router on IP 192.168.8.1. The MikroTik is on 192.168.8.2.

How can I get the WAN IP address, using a script? I have searched the forum but cannot find anything that works?

SilverNodashi

That's a shame.

The FTP client is sorely lacking in features, and it would be really handy if I could use the samba client to limit the client to a particular folder and then use fetch to download from that folder.

I have been looking for an SMB client on the MikroTik as well...

SilverNodashi

Can you post the syntax error and script error here?

SilverNodashi

Note also that when I get everything up and running I will want the capability for dual WANs; my current ISP offers decent speed but their reliability has been less than stellar. The phone company can't match their speed, but when I was using their service I almost never, ever suffered an outage. P...

SilverNodashi

I think what I'm asking for is the ability to bind a dhcp server to a bridge.

Have you tried it? I see it can be done on Version 6.40.2, and possibly some of the earlier ones as well.

SilverNodashi

Check the Queues, both the Simple Queues and Queue Tree, it's probably set there.

SilverNodashi

The router is probably choosing wrong source address. Set the right one 192.41.100.x (I assume .1) using src-address parameter for ping.

How can it probably choose the wrong source address? I only specified one subnet

SilverNodashi

A vpn has certain limits over portocols and features. Like not all the vpn are offering PPTP or Openvpn protocols. But PPTP is a protocoll that is built in in every vpn service. I would advice to use a new vpn for remote locations . That isn't possible at this stage. I don't have control over the u...

SilverNodashi

Hi, Is it possible, at all, to force a PPPTP VPN over a given interface? Let me explain the scenarion: A remote branch (to far to get to quickly) has a VPN over ADSL connection which is very slow. So I told them to buy a LTE router and use that to re-route some of the traffic over the LTE, and thus ...

SilverNodashi

The rules connected to the active WAN are black and the WAN that is not active the color is red. If you want to colour then colour the background and not the text, Yes, I know those colors exist. But that's it. More colors could make life a bit easier. Here's another example, how about being able t...

SilverNodashi

I think it would be a great idea if you could color an interface, firewall rule, route, etc. For example, if I want to quickly see everything related to the WAN interface,I could color it blue. And the backup WAN interface could be yellow, or whatever color. But this would quickly stand out in Winbox

SilverNodashi

Can you please help me once more? The remote office installed a Hauwei HUAWEI B315s-936 LTE router onto the MikroTik, with IP address 192.168.4.4. I can ping it from the remove MikroTik router (IP address 192.168.4.1), but not from our local LAN, 192.41.100.0. I didn't see any way to specify a defau...

SilverNodashi

E.g. this on one router and reverse on another (swap src and dst) should do the trick:
Code: Select all
/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.41.100.0/24 src-address=192.168.4.0/24

Great, thanx for the help

SilverNodashi

Has this feature ever been implemented?

SilverNodashi

no one?

I am guessing the "Other" traffic is traffic that isn't defined. i.e. it's not HTTP / SMTP / FTP / SSH / etc, etc traffic, perhaps IGMP or IPV6 traffic, etc

SilverNodashi

Yes, NAT can probably help you. If you add masquerade rule for traffic from remote site (tunnel) to local, everything will appear as comming from router's internal address, i.e. from local LAN.

Thanx, I guessed as much, but honestly don't know what NAT rule to put in.

SilverNodashi

Hi, I wonder if someone can help me. Two remote sites are connected to each other via a MetroLAN VPN (i.e. an ISP has their own VPN for the two sites) Site1 is on 10.1.1.1 and site2 is on 10.1.1.2 Site1 LAN IP's are 192.41.100.0/24 Site2 LAN IP's are 192.168.4.0/24 I can ping both routers from both ...

SilverNodashi

It is a very bad idea to stop upgrades from taking place. You are placing your users under risk from all possible attacks. This will end up causing you more problems. Instead, why don't you configure cache or maybe even a local Windows update service on Windows Server? https://technet.microsoft.com...

SilverNodashi

/ip firewall layer7-protocol
add name=MicrosoftUpdates regexp="^.+(update.microsoft|windowsupdate|download.microsoft|wustat|ntservicepack).*\$"
[/quote]


Is there an updated list for 2017?

SilverNodashi

Using layer7 to block facebook causes a lot of problems. It is better to block facebook via IP addresses like this. /ip firewall filter add action=drop chain=forward comment="Block Facebook" dst-address=\ 74.119.76.0/22 add action=drop chain=forward comment="Block Facebook" dst-...

SilverNodashi

Hi,
Can someone please tell me, do I add these rules to the bottom, or the top of the Firewall list? Or does it not matter?

Search found 77 matches