Community discussions

MikroTik App

Search found 647 matches

by rplant
Thu Apr 24, 2025 2:52 pm
Forum: Beginner Basics
Topic: SMB over VPN extremely slow – looking for suggestions or diagnostics
Replies: 16
Views: 770

Re: SMB over VPN extremely slow – looking for suggestions or diagnostics

Where do you do such clamping? It depends, some VPN types have a setting for it. eg. GRE, also l2tp server profiles Otherwise you would do it in a mangle firewall rule. (You also get more control here) I have one like: /ip firewall mangle add action=change-mss chain=forward comment="clamp mss ...
by rplant
Thu Apr 24, 2025 9:53 am
Forum: MikroTik hardware questions
Topic: CRS 320 PSU issue with UPS
Replies: 5
Views: 471

Re: CRS 320 PSU issue with UPS

It seems maybe a bit flaky.
Perhaps contact your Mikrotik distributor.

(or Mikrotik support)
by rplant
Thu Apr 24, 2025 8:42 am
Forum: Beginner Basics
Topic: SMB over VPN extremely slow – looking for suggestions or diagnostics
Replies: 16
Views: 770

Re: SMB over VPN extremely slow – looking for suggestions or diagnostics

I would try tcp mss clamping matched to below whatever the underlying vpn mtu is.

If in doubt <=1360 might be a good start. (assumes underlying vpn mtu is 1400 ish)
by rplant
Wed Apr 23, 2025 10:52 am
Forum: Beginner Basics
Topic: Route internet traffic through ISP, only VPN traffic through IPSEC
Replies: 1
Views: 248

Re: Route internet traffic through ISP, only VPN traffic through IPSEC

Hi, The default setting when setting up a VPN client in windows is to route all traffic via the VPN. This can be changed. (Following is for Windows 10) Choose Network and Internet settings. Right click on your network adapter image in the notification area, or search for it in settings. Then under a...
by rplant
Wed Apr 23, 2025 5:22 am
Forum: MikroTik hardware questions
Topic: Switching power between PoE and USB
Replies: 5
Views: 473

Re: Switching power between PoE and USB

There is also Mikrotiks RBGPOE-CON-HP 802.3af/at to passive poe converter.
by rplant
Tue Apr 22, 2025 1:48 pm
Forum: SwOS
Topic: 5Gbps link speed
Replies: 5
Views: 2080

Re: 5Gbps link speed

Hi, I think the correct way to connect would be to set the link speed to 10G no Auto negotiation for the 10G RJ45 SFP+ ports in SWOS. edit: Though on further testing (different RJ45 module though), Auto negotiation is also likely ok. And a short ethernet cable, (to make sure that isn't part of your ...
by rplant
Tue Apr 22, 2025 9:14 am
Forum: MikroTik hardware questions
Topic: Netinstall on RM3011 Fails need help (technical questions)
Replies: 25
Views: 1383

Re: Netinstall on RM3011 Fails need help (technical questions)

Following similar lines to @NathanA, Your backup routerboot might well already be at the updated version, so the following will not be helpful. But just in case. You can update your backup routerboot as described in the protected routerboot information linked to earlier. It might then behave better ...
by rplant
Tue Apr 22, 2025 7:31 am
Forum: General
Topic: Reset RouterOS without losing remote access (Winbox/SSH)
Replies: 21
Views: 1331

Re: Reset RouterOS without losing remote access (Winbox/SSH)

If you have other mikrotiks or any the same ethernet ports as the router in question. (And assuming when you reset the mikrotik it doesn't disconnect your access to those other mikrotiks) You will likely be able to login to it from those other mikrotiks using mac telnet. It seems there is also a mac...
by rplant
Tue Apr 22, 2025 7:17 am
Forum: General
Topic: How to setup ikev2 psk on sub routeros behind NAT and main router is routeros?
Replies: 1
Views: 258

Re: How to setup ikev2 psk on sub routeros behind NAT and main router is routeros?

My GUESS is that it is like L2TP, etc with psk. The only way the client can know the server is correct is if it has the right endpoint address, (and the right psk) And a part of the NAT T negotiation is to determine the actual endpoint addresses. What it gets back (192.168.5.4) isn't what the client...
by rplant
Mon Apr 21, 2025 7:33 am
Forum: MikroTik hardware questions
Topic: Using Mikrotik S+RJ10 SFP+ transceiver with RB5009UG+S+IN
Replies: 8
Views: 679

Re: Using Mikrotik S+RJ10 SFP+ transceiver with RB5009UG+S+IN

FS.Com also have 2.5G ones, where max ethernet speed is 2.5G and backend runs at 2.5G.
They should run cooler and are somewhat cheaper.
by rplant
Mon Apr 21, 2025 3:09 am
Forum: MikroTik hardware questions
Topic: Netinstall on RM3011 Fails need help (technical questions)
Replies: 25
Views: 1383

Re: Netinstall on RM3011 Fails need help (technical questions)

Check the protected routerboot option. [admin@450] > system/routerboard/settings/print auto-upgrade: no baud-rate: 115200 boot-delay: 2s enter-setup-on: any-key boot-device: nand-if-fail-then-ethernet cpu-frequency: auto boot-protocol: bootp enable-jumper-reset: yes force-backup-booter: no silent-bo...
by rplant
Sun Apr 20, 2025 1:50 pm
Forum: MikroTik hardware questions
Topic: small VPN for VOIP and other stuff
Replies: 1
Views: 455

Re: small VPN for VOIP and other stuff

Perhaps better asking this question in the beginners, or general forums. If your existing gateway/routers have the option of setting up static routes, I think you can probably just put a Mikrotik inside each of the networks and keep the existing gateways. Perhaps in this case a pair of hex refresh's...
by rplant
Sun Apr 20, 2025 1:24 pm
Forum: MikroTik hardware questions
Topic: Netinstall on RM3011 Fails need help (technical questions)
Replies: 25
Views: 1383

Re: Netinstall on RM3011 Fails need help (technical questions)

Hi,

Perhaps you or someone has enabled protected routerboot at some stage.

https://help.mikrotik.com/docs/spaces/R ... bootloader
by rplant
Sun Apr 20, 2025 8:01 am
Forum: General
Topic: Filter rules to isolate DHCP traffic between specific bridged interfaces
Replies: 3
Views: 514

Re: Filter rules to isolate DHCP traffic between specific bridged interfaces

If bonding is not an option, A possible (but somewhat expensive) solution might be to get an RB5009, and have it connected to the multiple internet WAN ports. With your devices on the CRS326 being on a natted private subnet. Perhaps using the SFP+ port to connect the RB5009 to the CRS326 You have a ...
by rplant
Thu Apr 17, 2025 2:24 pm
Forum: Beginner Basics
Topic: Setting up hAP AC as station for wired connections
Replies: 4
Views: 548

Re: Setting up hAP AC as station for wired connections

My thoughts. Sorry for the amount of text. Assumes a moderately recent router OS. (v6 or v7) 1. If what you mostly want is internet. Use a Routed/Natted wireless connection. This is reliable under almost all conditions. From a default configuration. (Using winbox) If needed you can (carefully) use q...
by rplant
Wed Apr 16, 2025 5:05 am
Forum: Beginner Basics
Topic: PPPOE with static IP
Replies: 20
Views: 1525

Re: PPPOE with static IP

A couple of thoughts. 1. Usually if you are given a static ip address by your ISP, you don't put it in manually. (You case may be different, but unlikely) Your pppoe connection should just keep getting the static IP address from the ISP (while you pay them) You could check your assigned ip addresses...
by rplant
Mon Apr 14, 2025 9:15 am
Forum: Beginner Basics
Topic: Problem with internet access on router
Replies: 6
Views: 819

Re: Problem with internet access on router

You often need to src-nat the port from your ntp-client (So it looks like it's coming from a high port rather than port 123) As ISP's, ntp servers will often block ntp from port 123, (which Mikrotik's ntp client uses). Something like: /ip firewall nat add action=src-nat chain=srcnat out-interface={Y...
by rplant
Mon Apr 14, 2025 6:12 am
Forum: Beginner Basics
Topic: likely hitting software-based routing limits [SOLVED]
Replies: 23
Views: 3459

Re: likely hitting software-based routing limits [SOLVED]

Note: The CRS326 does do hardware L3 offloading. So for internal intervlan switching (Routing) use it may well be ok. You can do some basic intervlan filtering/blocking or allow listing using switch acls. (And a little bit more) The following section of the L3Hardware offload page might be what you ...
by rplant
Mon Apr 14, 2025 2:48 am
Forum: Beginner Basics
Topic: NTP Client triggers max permanent peer count message
Replies: 4
Views: 507

Re: NTP Client triggers max permanent peer count message

Not sure, but the following might help. You often need to src-nat the port from your ntp-client (So it looks like it's coming from a high port rather than port 123) As ISP's, ntp servers will often block ntp from port 123, (which Mikrotik's ntp client uses). Something like: /ip firewall nat add acti...
by rplant
Sun Apr 13, 2025 7:46 am
Forum: General
Topic: Simple Queues with PCQ and Burst
Replies: 4
Views: 2065

Re: Simple Queues with PCQ and Burst

Hi, It works ok. But you need to think about the times, and the thresholds. I don't think 16S is enough to see anything, make it at least a few minutes. If your average speed (over 16S in this case) is >= 5M (burst-threshold) then you are limited to max_limit until it is less than that. It breaks th...
by rplant
Sun Apr 13, 2025 6:48 am
Forum: Beginner Basics
Topic: Help with NAT
Replies: 6
Views: 616

Re: Help with NAT

One thing I checked was:
You want the wireguard interface to be a member of the WAN list, (and very likely don't want it to be a member of the LAN list)
by rplant
Sun Apr 13, 2025 6:41 am
Forum: Beginner Basics
Topic: likely hitting software-based routing limits [SOLVED]
Replies: 23
Views: 3459

Re: likely hitting software-based routing limits [SOLVED]

That seems like it should be running as a basic L2 switch, so should not be using much CPU at all
(given its default configuration usually contains very little)

Perhaps export and post its config.

/export file=anynameyouwish (Edit and remove router serial number, ID, public WANIP info, keys etc.)
by rplant
Wed Apr 09, 2025 6:16 am
Forum: Beginner Basics
Topic: Configuring Separate Ethernet for Wi-Fi [SOLVED]
Replies: 11
Views: 2448

Re: Configuring Separate Ethernet for Wi-Fi [SOLVED]

Hi,
Given the routed configuration you have.

A possible option is:
You could create an ip vrf (eg. vrf5)
And attach to it the interfaces bridge5, wlan2 and ether5.

That might work.
Sorry I know little about vrfs.
by rplant
Mon Apr 07, 2025 3:23 am
Forum: Beginner Basics
Topic: Configuring Separate Ethernet for Wi-Fi [SOLVED]
Replies: 11
Views: 2448

Re: Configuring Separate Ethernet for Wi-Fi [SOLVED]

Based on the original question, You should have NO dhcp (server or client) or ip address on either bridgeWL1 or bridgeWL2. However this does make it difficult to manage. If these 2 bridges and attached interfaces are the ONLY connected interfaces on the router, you can probably add a dhcp client to ...
by rplant
Sun Apr 06, 2025 10:04 am
Forum: Beginner Basics
Topic: Configuring Separate Ethernet for Wi-Fi [SOLVED]
Replies: 11
Views: 2448

Re: Configuring Separate Ethernet for Wi-Fi [SOLVED]

Hi,

You probably shouldn't have ip addresses on these 2 bridges/interfaces.
That should be handled by the modem, which would have a dhcp server on it.
by rplant
Sun Apr 06, 2025 9:56 am
Forum: Beginner Basics
Topic: Is it possible to have multiple mac address in same vlan interface?
Replies: 1
Views: 359

Re: Is it possible to have multiple mac address in same vlan interface?

You can possibly add a macvlan to the vlan, and then add your new PPPoE client to the macvlan (which has a different mac address).
by rplant
Sat Apr 05, 2025 1:08 pm
Forum: Beginner Basics
Topic: Configuring Separate Ethernet for Wi-Fi [SOLVED]
Replies: 11
Views: 2448

Re: Configuring Separate Ethernet for Wi-Fi [SOLVED]

Assuming near default config. A quick and dirty solution. I would create 2 additional bridges. bridgeWL1 and bridgeWL2 Both with protocol-mode=none (no rstp) Then in bridge ports add ether1 to bridgeWL1 and move WLAN1 to bridgeWL1 and also move ether5 and WLAN2 to bridgeWL2 Remove the ip dhcp-client...
by rplant
Sat Apr 05, 2025 12:25 pm
Forum: General
Topic: RDP gets disconnected randomely
Replies: 7
Views: 852

Re: RDP gets disconnected randomely

A couple of thoughts It is on the local subnet, there should be nothing blocking the traffic between the clients and server. (zero trust/micro segmentation excepted???) Also nothing blocking udp rdp traffic except perhaps rdp server settings. Is there something adjusting or shaping traffic somewhere...
by rplant
Thu Apr 03, 2025 9:02 am
Forum: General
Topic: station v station-bridge mode
Replies: 9
Views: 1226

Re: station v station-bridge mode

Wifiwave 2 drivers only available for (some?) arm based CPU devices.

There were some discussions and workarounds before wifiwave2 had station-bridge as an option.

eg.
viewtopic.php?t=180369
by rplant
Thu Apr 03, 2025 6:11 am
Forum: Beginner Basics
Topic: RB4011iGS+ and Open VPN no routing, no ping etc..
Replies: 4
Views: 4075

Re: RB4011iGS+ and Open VPN no routing, no ping etc..

Hi, I would initially make the ovpn-profile setting have the following settings. interface-list=LAN and dns-server=192.168.90.1 You can tie it down more (perhaps with a OVPN interface list) and appropriate firewall rules when all is working. /ppp profile add change-tcp-mss=yes dns-server=192.168.90....
by rplant
Wed Apr 02, 2025 1:18 pm
Forum: Beginner Basics
Topic: CRS326 powerful enough?
Replies: 12
Views: 1254

Re: CRS326 powerful enough?

I think in very recent versions, a pvid=10 sets the untagged vlan to 10, and you don't need or want anything else. You can't add an ip address to ether23 when it is part of the bridge. (In this case with no other vlan membership you would add the address to the bridge) All ports with the default vla...
by rplant
Wed Apr 02, 2025 5:56 am
Forum: Beginner Basics
Topic: Returning Newbie :) - Optimizing Bandwidth Config
Replies: 9
Views: 1546

Re: Returning Newbie :) - Optimizing Bandwidth Config

I struggle with SwitchOS and find the diagnostics on RouterOS well worth the extra complexity. For a 2 CRS326 scenario, I was thinking perhaps the 2 ports to the TrueNas could be part of the redundancy scheme. If not perhaps a 2 cable etherchannel between the 2 CRS's for when the fibre link between ...
by rplant
Wed Apr 02, 2025 5:08 am
Forum: Beginner Basics
Topic: CRS326 powerful enough?
Replies: 12
Views: 1254

Re: CRS326 powerful enough?

If you have a FB as a gateway firewall router, you may be able to use the CRS326 without any additional routers. You will need to add static routes in the FB so it knows that you have additional IP address ranges inside your LAN. And it should then NAT traffic from these additional IP ranges ok. I a...
by rplant
Mon Mar 31, 2025 3:15 am
Forum: Beginner Basics
Topic: Returning Newbie :) - Optimizing Bandwidth Config
Replies: 9
Views: 1546

Re: Returning Newbie :) - Optimizing Bandwidth Config

Hi, My thoughts as someone who knows virtually nothing about this higher end of the world. In this instance the 2 * CRS504's seem to add very little to the system apart from cost and complexity. Perhaps you could contact your local Mikrotik Distributor maybe they would loan you a couple, (or even th...
by rplant
Mon Mar 31, 2025 2:29 am
Forum: Beginner Basics
Topic: VoIP and Double NAT
Replies: 4
Views: 924

Re: VoIP and Double NAT

Hi, With default firewall rules it should normally work with just the sip alg turned off. However I have noticed (Europe ??) that the voip is often provided over a dedicated vlan. So presumably if your voip traffic is not using that dedicated vlan, the voip will not work/connect. If this is the case...
by rplant
Sat Mar 29, 2025 2:47 am
Forum: General
Topic: upgrade from V6 to V7 question for ccr1036
Replies: 3
Views: 755

Re: upgrade from V6 to V7 question for ccr1036

I think Recent versions of Ros V7 don't have the upgrade from V6 conversion functionality any more. If you upgrade in the Gui from a very recent V6 to V7, it should offer you one of the V7.12.x ROS's. This does have upgrade functionality, (and also sets up for wireless) From 7.12.x you can upgrade t...
by rplant
Fri Mar 28, 2025 3:02 am
Forum: Beginner Basics
Topic: socks 5 to wireguard
Replies: 3
Views: 1021

Re: socks 5 to wireguard

Hi,
It seems difficult.

The following is very similar, and they have some options.

viewtopic.php?t=170694
by rplant
Sat Mar 22, 2025 12:39 am
Forum: Beginner Basics
Topic: AT&T Router Passthrough Setup
Replies: 12
Views: 2001

Re: AT&T Router Passthrough Setup

Hi, A few thoughts. Does the CRS have a gateway IP address? (ie. Did its DHCP client work) Can you ping 8.8.8.8 from the CRS? Do you have the correct ip address, default gateway on your client device? On a slightly different note. The CRS312 is a switch, it can also route but its CPU is quite low po...
by rplant
Fri Mar 21, 2025 11:55 am
Forum: Beginner Basics
Topic: AT&T Router Passthrough Setup
Replies: 12
Views: 2001

Re: AT&T Router Passthrough Setup

Hi, I attempted this config on a hex, it mostly worked. I needed the following slight changes. #Not sure how this was missing, perhaps removed from your export for some reason. /interface bridge add name=bridge #websites wouldn't work without allow-remote-requests /ip dns set servers=8.8.8.8,8.8.4.4...
by rplant
Sun Mar 16, 2025 3:06 am
Forum: Beginner Basics
Topic: 2 LANS over WIFI
Replies: 5
Views: 1309

Re: 2 LANS over WIFI

My thoughts, (and some assumptions) I assume your clients connecting to the MAP might have their default gateway via a wired connection and you might not want to disrupt that. You might not want the industry devices being able to reach back to connect to the LAN devices connecting to them. In additi...
by rplant
Wed Mar 12, 2025 6:52 am
Forum: Beginner Basics
Topic: PPPoE Connection Loss Requires Reboot (Does Not Work Disabling and Re-enabling Interface Only)
Replies: 6
Views: 2056

Re: PPPoE Connection Loss Requires Reboot (Does Not Work Disabling and Re-enabling Interface Only)

Sorry I Don't know but a couple of thoughts. 1. Perhaps you can have a scheduled task to take the link down and then restore it each night at some convenient out of hours time. (Hopefully the next 36 hours starts from this time) 2. Perhaps instead of turning off the pppoe you could disable the under...
by rplant
Mon Mar 10, 2025 9:40 am
Forum: General
Topic: Multi level interconnection
Replies: 4
Views: 1427

Re: Multi level interconnection

Hi, It is not obvious what you want. 2 Options I can think of: Option 1. The endpoints are 192.168.4.1 and 192.168.5.1 The Socks5 proxy is the Mikrotik. Option 2. The endpoints are somewhere completely different, and the Socks proxy's are 192.168.4.1 and 192.168.5.1 Option 1. The endpoints are 192.1...
by rplant
Mon Mar 10, 2025 12:34 am
Forum: Beginner Basics
Topic: Wireguard for Win PC dont work
Replies: 6
Views: 1765

Re: Wireguard for Win PC dont work

Do you have an appropriate allowedips value on your windows client configuration in the [peer] section Something like AllowedIPs = 192.168.1.0/24 (Change as required for your Mikrotik lan range) Perhaps if you want all traffic to go via the VPN (Probably don't use this if your Mikrotik is behind cgn...
by rplant
Sun Mar 09, 2025 6:21 am
Forum: Beginner Basics
Topic: Config check - NTP Client and IPv6 issues
Replies: 3
Views: 1411

Re: Config check - NTP Client and IPv6 issues

faulty ntp is common (for Mikrotik's). You often need to src-nat the port from your ntp-client (So it looks like it's coming from a high port rather than port 123) As ISP's, ntp servers will often block ntp from port 123. Something like: /ip firewall nat add action=src-nat chain=srcnat out-interface...
by rplant
Thu Mar 06, 2025 10:51 am
Forum: General
Topic: Why does FastTrack cause super-slow TCP connections for some devices?
Replies: 13
Views: 2383

Re: Why does FastTrack cause super-slow TCP connections for some devices?

A guess...

You do need to keep the accept rule after the fasttrack rule.
by rplant
Wed Mar 05, 2025 6:38 am
Forum: General
Topic: Dual WAN with public IP forwarding
Replies: 3
Views: 1699

Re: Dual WAN with public IP forwarding

Hi, I am assuming, the 10.10.10.10 routing rule uses Public as its route table. You could try the following routing rule prior to the 10.10.10.10 rule. /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main Unfortunately there appar...
by rplant
Wed Feb 26, 2025 5:09 am
Forum: Beginner Basics
Topic: Selective VPN and bridge mode [SOLVED]
Replies: 9
Views: 9436

Re: Selective VPN and bridge mode [SOLVED]

You can likely do your original request, but it is kind of expensive (on a hex) You need to have one or more bridge nat rules, that match your requirements that redirect to the CPU which effectively kicks the packet to the routing engine, and then to wireguard as required. If the routing engine just...
by rplant
Wed Feb 26, 2025 4:47 am
Forum: Beginner Basics
Topic: Selective VPN and bridge mode [SOLVED]
Replies: 9
Views: 9436

Re: Selective VPN and bridge mode [SOLVED]

BUT what if I create a subnet on Mikrotik on the same segment of the ISP router, with absolutely NO ROUTING AND FIREWALL RULES? Yes you can do this. (But I would probably leave the default config on it, with firewall rules, etc) Make a subnet, eg. 192.168.10.160/28 (A range of 16), with router ip a...
by rplant
Wed Feb 26, 2025 3:50 am
Forum: Beginner Basics
Topic: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492
Replies: 107
Views: 15742

Re: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492

It sort of looks like there are 4 bytes required.

Perhaps the pppoe comes on a vlan (quite common)
Or perhaps they are adding a priority vlan header.

Can you manually set the l2mtu of the interface to something higher than 0
eg. 1504

Perhaps via webfig/winbox/cli if you can't do it from the mobile.
by rplant
Sat Feb 22, 2025 12:36 pm
Forum: General
Topic: How do I ping link local IPv6 address?
Replies: 1
Views: 2934

Re: How do I ping link local IPv6 address?

1v73 looks wrong.
by rplant
Fri Feb 21, 2025 9:15 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 3294

Re: VRF suggestions

Isn't there any chance to get this working via dynamic routing protocols?
Sorry, I don't know.

You can probably add a ping check to the 2 static routes, so if that link fails, it will fall back to
dynamic routing.
by rplant
Fri Feb 21, 2025 4:27 am
Forum: Beginner Basics
Topic: C52iG-5HaxD2HaxD After hardware reset the wifi is off
Replies: 1
Views: 3099

Re: C52iG-5HaxD2HaxD After hardware reset the wifi is off

Hi, It's possible you have cleared the routers config. You should be able to run winbox on your computer, and find the router, (You need to be on the same subnet as the router, eg plugged into it directly. It might take a little while). It will likely have an ip address of 0.0.0.0 Login using its ma...
by rplant
Thu Feb 20, 2025 6:20 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 3294

Re: VRF suggestions

An ordinary static route should be fine on the 2116 end.

/ip route
add disabled=no dst-address=10.0.81.0/24 gateway=10.0.3.1 routing-table=main suppress-hw-offload=no
by rplant
Thu Feb 20, 2025 5:11 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 3294

Re: VRF suggestions

Hi, By my thought would be to use some routing rules at both ends. (Though your environment looks complicated) Assuming vlan502, 10.0.3.0/30 is your direct path. For wg_roadwarrior On the 2004 Something like: /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disa...
by rplant
Tue Feb 18, 2025 1:49 am
Forum: General
Topic: Block client MAC only on 2nd Wifi AP
Replies: 9
Views: 6533

Re: Block client MAC only on 2nd Wifi AP

Hi, Pretty sure you can disable access in the access list tab. Put in the mac address and untick authentication and maybe forwarding. You could perhaps put in a signal strength range say -120..-70 (So if the device gets quite close it will actually connect) It might also be that for some reason it c...
by rplant
Mon Feb 17, 2025 6:28 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2669

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Yet another option might be to have dhcp hand out /32 ip address ranges.
So everything IP has to be routed.

(Likely not well handled by older devices)
by rplant
Sun Feb 16, 2025 2:11 am
Forum: Beginner Basics
Topic: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492
Replies: 107
Views: 15742

Re: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492

For me with v7 it just chose 1492 with v6 it always chose 1480.

However as @tdw mentioned, you need to set both mru and mtu to 1492.
by rplant
Sat Feb 15, 2025 4:08 am
Forum: SwOS
Topic: 10Gb SFP+ to RJ45 Modules
Replies: 4
Views: 4991

Re: 10Gb SFP+ to RJ45 Modules

Hi, The Wiitek 10Gb SFP+ to RJ45 will require its backend to run at 10G (which it should automatically do) It will run hot, and also likely to drop packets. (Because its front is running at 2.5G, which the switch doesn't know about) You are probably better to get a 2.5G sfp+ to 2.5G rj45 that requir...
by rplant
Sat Feb 15, 2025 3:43 am
Forum: Beginner Basics
Topic: Port mapping issue
Replies: 3
Views: 2617

Re: Port mapping issue

Hi,

You need hairpin NAT, there is plenty of examples through the forums.

One I just found: viewtopic.php?t=172380

You can also search for hairpin in the following help topic

https://help.mikrotik.com/docs/spaces/R ... 211299/NAT
by rplant
Fri Feb 14, 2025 10:00 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2669

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Another simpler option if (it works at all) is to enable local proxy arp.
(Without changing original config)
Not quite sure where you would apply this, on the bridge, or the actual interfaces??

Then maybe all ip traffic would get routed.
by rplant
Fri Feb 14, 2025 8:59 am
Forum: General
Topic: Traffic Shaping for 1000+ users as well as AP & Backhauls
Replies: 5
Views: 2715

Re: Traffic Shaping for 1000+ users as well as AP & Backhauls

I was able to figure it out so I'm all set.
I don't currently need to know this, but I would like to for if/when I do need it (please) :)
by rplant
Fri Feb 14, 2025 8:49 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2669

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Hi, Somewhat of a guess You need to have 2 ip address ranges to get things to route. With the device sending its packet at the router, not at the other device. You could perhaps split the 172.16.16.0 range into 2 /25 ranges. with side 1 having 172.16.16.0/25 gateway 172.16.16.1, side 2 having 172.16...
by rplant
Thu Feb 13, 2025 1:22 am
Forum: General
Topic: Still fighting with Ecobee (and losing)
Replies: 14
Views: 4672

Re: Still fighting with Ecobee (and losing)

Is dhcp snooping enabled on any of the ubiquiti gear, it might cause this.
(Apparently it may be a default in some of their gear)
by rplant
Tue Feb 11, 2025 7:42 am
Forum: General
Topic: Router reaches the Internet, subnets do not
Replies: 13
Views: 3574

Re: Router reaches the Internet, subnets do not

Hi, The following are my changes to the configuration. (Sorry, It is not a complete configuration @anav is much better at this...) You will need to apply it slowly piece by piece. You will also need to remove your old multi bridge configurations. #xxx.yyy.zzz.11 <--> 10.11.0.0/22 [ether2] #xxx.yyy.z...
by rplant
Mon Feb 10, 2025 3:24 am
Forum: Beginner Basics
Topic: Unable to get inter-VLAN routing to work despite proper IP services [SOLVED]
Replies: 2
Views: 7601

Re: Unable to get inter-VLAN routing to work despite proper IP services [SOLVED]

I tried your config, and it seemed to work ok. (I was connecting to another mikrotik) Also when plugged into the trunk it supplied the 3 ip ranges to the Mikrotik via vlans. Perhaps the devices you were connecting too had a firewall on them, and didn't like being accessed from another subnet. or had...
by rplant
Sat Feb 08, 2025 1:29 am
Forum: General
Topic: Router reaches the Internet, subnets do not
Replies: 13
Views: 3574

Re: Router reaches the Internet, subnts do not

Hi, As far as I can see the only usable LAN subnet you actually have is 192.168.88.0/24, and I think it likely should work. (It may need a specific NAT rule per @TheCat12) The other subnets you list and attach to bridges are all on the router only, and there is only a single active address for each ...
by rplant
Sat Feb 08, 2025 12:54 am
Forum: General
Topic: Still fighting with Ecobee (and losing)
Replies: 14
Views: 4672

Re: Still fighting with Ecobee (and losing)

Hi, I know nothing about these, but my (only) guess is that it might have something to do with DHCP. Perhaps if it fails to get an IP it eventually stops asking, or something. Check none of the delay options are configured on the dhcp server. Set up a script/netwatch to periodically ping/arp ping on...
by rplant
Tue Feb 04, 2025 4:22 am
Forum: General
Topic: Storm control on egress
Replies: 2
Views: 2851

Re: Storm control on egress

Probably doable using hw offloaded qos. https://help.mikrotik.com/docs/spaces/ROS/pages/189497483/Quality+of+Service Possibly special handlers already exist for multicast (and??) broadcast. Otherwise you can perhaps use switch rules to map the packets you want restricted to a specific traffic class....
by rplant
Mon Feb 03, 2025 7:10 am
Forum: SwOS
Topic: Switch allows DHCPDISCOVER but drops DHCPOFFER
Replies: 3
Views: 6879

Re: Switch allows DHCPDISCOVER but drops DHCPOFFER

Perhaps there is some dhcp snooping configuration defined somewhere that needs to be reviewed.
by rplant
Mon Feb 03, 2025 2:25 am
Forum: General
Topic: Feature requests
Replies: 1810
Views: 857695

Re: Feature requests

I would like a refresh version of the hap ac2. Pretty much exactly the same as current. Exactly the same Case, pcb and components, except the RAM is replaced with a 256M unit, and the Flash is replaced with a 32M Unit. (Possibly by now cheaper than the current smaller devices) I would also like a (c...
by rplant
Sun Jan 26, 2025 7:12 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 7070

Re: Starlink Packet Loss Troubleshooting

I don't know that I can help further, but I found the following couple of posts elsewhere that you may have already seen. https://www.reddit.com/r/Starlink/comments/1eyndnu/high_packet_loss_in_bypass_mode/m672h96/ https://www.reddit.com/r/Starlink/comments/17h2f99/solved_issue_with_bypass_mode_slown...
by rplant
Fri Jan 24, 2025 10:34 am
Forum: Beginner Basics
Topic: Multisite Multicast Nat
Replies: 2
Views: 3679

Re: Multisite Multicast Nat

I am quite possibly completely misunderstanding here, but anyway. I would imagine that 192.168.1.x on R1 would register for a particular multicast with its router. That Router R1 would then register for multicast with something closer to the source. The identity of the original requesting device won...
by rplant
Fri Jan 24, 2025 10:25 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 7070

Re: Starlink Packet Loss Troubleshooting

Also its often worth graphing your wan interface traffic.

Perhaps something like:

/tool graphing
set store-every=24hours

/tool graphing interface
add allow-address=YOUR_COMPUTER_IP_ADDRESS interface=ether1

Then you can look at the graph(s) in winbox/webfig
by rplant
Fri Jan 24, 2025 5:33 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 7070

Re: Starlink Packet Loss Troubleshooting

From winbox or webfig have a look at your wan/ether1 interface traffic. (traffic tab) Is it as expected? I would initially disable ipv6, because if its sort of working but sort of not it can be painful. Once network is working well with only ipv4, you can look at this further. You may need to discon...
by rplant
Mon Jan 20, 2025 12:44 pm
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10979

Re: L3 HW Offloading

Another slight possibility, I don't know if this will work at all, it depends a lot on the L3 switch. You could reconfigure the DHCP server on the 5009 to point the default route of the LAN network at the L3 switch IP Address. Then the devices would send their packets to the switch (for both interne...
by rplant
Mon Jan 20, 2025 6:38 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10979

Re: L3 HW Offloading

Hi, A little off topic now maybe. I trialled a much simplified version of this system on a Hex (much slower/smaller), to verify some things I thought I knew... It turns out as mentioned by @lurker888, marking the packets as notrack does seem to mean they can't be fasttracked. (under ip settings you ...
by rplant
Mon Jan 20, 2025 2:59 am
Forum: Beginner Basics
Topic: Setting up connection between 2 routers over the WiFi [SOLVED]
Replies: 2
Views: 9683

Re: Setting up connection between 2 routers over the WiFi [SOLVED]

I think one possible set of changes is likely to be: Add wifi2 to the bridge, and change its mode to "Station Bridge" Optional: You could/should also put a dhcp-client on the bridge if you don't have one on it already so the hapac2 also gets an IP address from the Audience. (if you have a ...
by rplant
Sun Jan 19, 2025 10:47 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10979

Re: L3 HW Offloading

Hi, I think your current problem is that you are getting triangular routing. (which is probably why hardware offload is good, as it is likely not stateful) From Device on 192.168.1.x network to 10.0.0.0/8 likely goes from device to 5009 then to Switch then to 10.x.x.x device. (Hopefully often the 50...
by rplant
Sun Jan 19, 2025 12:33 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10979

Re: L3 HW Offloading

You seem likely to have done all of this already but just in case... Remove sfp+ from bridge Give sfp+ an IP address, and switch port/vlan? at other end an IP address. Make the sfp+ interface a member of the LAN interface list. But if you need lots of gigs of intervlan routing, it isn't going to do ...
by rplant
Sun Jan 19, 2025 12:03 am
Forum: General
Topic: asymmetric routing
Replies: 13
Views: 5096

Re: asymmetric routing

Another possible option is to mark the packets more carefully.

eg. in interface list not WAN (or in interface not WAN-2)
by rplant
Sat Jan 18, 2025 5:24 am
Forum: General
Topic: asymmetric routing
Replies: 13
Views: 5096

Re: asymmetric routing

Hi, In 7.2.2(ish) the routing was changed, so that if you route mark a packet, and a matching route with that route mark exists in the route table it will use that route entry. It then processes the routing rules table, and finally the route table (again). Previously routing rules occurred first, an...
by rplant
Sat Jan 18, 2025 4:43 am
Forum: Beginner Basics
Topic: Turn Off CDR
Replies: 2
Views: 3193

Re: Turn Off CDR

Do you perhaps mean CDP?

This is done under ip neighbors
by rplant
Sat Jan 11, 2025 5:42 am
Forum: Beginner Basics
Topic: Checking the Portspeed with with an SFP+ has connected
Replies: 3
Views: 3824

Re: Checking the Portspeed with with an SFP+ has connected

Hi, The CPU on the CRS317 isn't super fast. (eg. a hap ac2 is faster) See: https://mikrotik.com/product/crs317_1g_16s_rm#fndtn-testresults The commonly used value for routing performance comparison is 25 ip filter rules, 512 byte packets. However it does do some fairly good L3 hardware offloading, b...
by rplant
Fri Jan 10, 2025 9:06 am
Forum: MikroTik hardware questions
Topic: CCR1009-7G-1C-1S+ 2.5G Compatible?
Replies: 7
Views: 6501

Re: CCR1009-7G-1C-1S+ 2.5G Compatible?

Note however if you use something like a S+RJ10 in the sfp+ port,
it can negotiate 2.5G with remote end while sfp+ is running at 10G,
(so Mikrotik thinks it is running at 10G) it runs hot.

You will likely need some traffic shaping (queue) to limit outbound traffic to <2.5G.
by rplant
Fri Jan 10, 2025 8:59 am
Forum: Beginner Basics
Topic: Checking the Portspeed with with an SFP+ has connected
Replies: 3
Views: 3824

Re: Checking the Portspeed with with an SFP+ has connected

I assume you are using one of the SFP+ to RJ45 adapters. The following has some info on the Mikrotik one. https://mikrotik.com/product/s_rj10 They have 2 versions, and the first version did not report the link speed correctly. I would not be surprised if many other brands also have very limited link...
by rplant
Thu Jan 02, 2025 12:10 pm
Forum: Beginner Basics
Topic: inter connect two subnets
Replies: 2
Views: 4204

Re: inter connect two subnets

Hi, The 2 subnets should already be connected, you don't need the add action=accept chain=forward comment="enable interconnect lan subnets" rule. You should be able to connect to the various devices in the other subnet. There may be a couple of issues. 1. You may be expecting to see these ...
by rplant
Mon Dec 30, 2024 2:16 am
Forum: General
Topic: VXLAN over WireGuard weird packet size issue over VDSL - Have I found a bug?
Replies: 1
Views: 1901

Re: VXLAN over WireGuard weird packet size issue over VDSL - Have I found a bug?

Not sure. You may have already tried this. I would try using a separate ethernet interface for the wireguard connection into the 2nd router from the CCR. With an mtu of 1492, and different IP address range to the lan. You may need a routing rule to get the wireguard traffic to exit via this separate...
by rplant
Thu Dec 26, 2024 4:58 am
Forum: General
Topic: Wireguard behind NAT
Replies: 2
Views: 1809

Re: Wireguard behind NAT

My Guess is that the devices on your LAN are receiving a packet from 192.168.100.1/24 and sending their reply back to the main gateway. (Which also doesn't know where 192.168.100.1/24 is) One simple(ish) option might be to masquerade packets leaving your Wap-ax with source address of 192.168.100.0/2...
by rplant
Fri Dec 20, 2024 10:35 am
Forum: MikroTik hardware questions
Topic: Expanding the storage capacity of CRS520 [SOLVED]
Replies: 4
Views: 19854

Re: Expanding the storage capacity of CRS520 [SOLVED]

You could look at Mikrotik's rose storage.
by rplant
Thu Dec 19, 2024 1:08 pm
Forum: General
Topic: Mikrotik Reset Password Without Loosing Configurations
Replies: 7
Views: 2896

Re: Mikrotik Reset Password Without Loosing Configurations

My guess is that these devices are probably a bit like a ccr, with no default firewall rules except for a masquerade rule :( The following rules are for a hex, (they are usually all very very similar, except when they have none) And you should be able to copy and paste them in. I think they are quit...
by rplant
Tue Dec 17, 2024 11:15 am
Forum: General
Topic: When the WAN network card is bound to multiple IPs, there is an issue with the source IP for system remote logging
Replies: 6
Views: 1833

Re: When the WAN network card is bound to multiple IPs, there is an issue with the source IP for system remote logging

The fact that logging has the option of a source IP address, and ignores it seems like a bug. Though it might be your config. (Given Wan interfaces usually have some sort of src-nat/masquerade) Do you have a src-nat rule for the wan interface that might apply in this case. You could put in a specifi...
by rplant
Tue Dec 17, 2024 8:23 am
Forum: Beginner Basics
Topic: Swith ACL redirect-to-cpu question [SOLVED]
Replies: 3
Views: 7901

Re: Swith ACL redirect-to-cpu question [SOLVED]

You possibly also need a bridge nat rule to kick the packet into the routing section of the device.

Something like:

/interface bridge nat
add action=redirect chain=dstnat disabled=no dst-address=192.168.88.88 ip-protocol=tcp dst-port=22 log=yes mac-protocol=ip
by rplant
Fri Dec 13, 2024 12:50 am
Forum: General
Topic: How to fix IPv4 neighbor Table Overflow
Replies: 2
Views: 1338

Re: How to fix IPv4 neighbor Table Overflow

Hi,
V7.16.1

IP Settings.
There are 2 items, the max neighbor entries and Arp Timeout
You could increase the max neighbor entries value or possibly decrease the Arp Timeout value.
(The current default Arp Timeout value appears to be 30S, I would not go below that)
by rplant
Fri Dec 13, 2024 12:37 am
Forum: General
Topic: 2 WAN active at the same time [SOLVED]
Replies: 19
Views: 3741

Re: 2 WAN active at the same time [SOLVED]

A few points: The following assumes a config sort of based on default (for SOHO type routers, not CCR, etc which have no firewall rules). I am assuming you have nat. In this case an incoming connection on Wan1 must then also leave by Wan1. (Same for Wan2) Otherwise it just doesn't work. (Often true ...
by rplant
Mon Dec 09, 2024 1:14 am
Forum: Beginner Basics
Topic: Wan to Wan routing and setup
Replies: 1
Views: 3449

Re: Wan to Wan routing and setup

Hi, The following was made on a hex, based on its default configuration. But should be applicable to many/most Mikrotiks. I removed all the firewall rules (so fastpath is active) Disabled all admin services except winbox Moved ssh and winbox access to a new vrf vrfAdmin, active on ether5. (So you ca...
by rplant
Sat Dec 07, 2024 10:40 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

It will block people/devices on the internet from attempting to login to your router. (Or using other services your router may provide, that you haven't provided a rule to allow) The default on a Mikrotik is to allow (input, and also forwarding), you should normally block access you don't specifical...
by rplant
Sat Dec 07, 2024 10:32 am
Forum: General
Topic: Logs showing Public IP as gateway IP
Replies: 4
Views: 1199

Re: Logs showing Public IP as gateway IP

Or maybe someone or something is somehow logged into or has a vpn into your gateway router, working on the next step.
by rplant
Sat Dec 07, 2024 12:04 am
Forum: General
Topic: Logs showing Public IP as gateway IP
Replies: 4
Views: 1199

Re: Logs showing Public IP as gateway IP

This kind of looks like what you would get, if your gateway was also a Mikrotik, and it had hairpin nat enabled for a SSH port forward/dst-nat connection to the internal router. (With attempted logins from inside)
by rplant
Fri Dec 06, 2024 11:56 pm
Forum: General
Topic: Droping packets base on mac address is not working
Replies: 5
Views: 1220

Re: Droping packets base on mac address is not working

Yes, drop by mac address doesn't work at the router stage. You could connect only the Reolink to a specific ethernet port on the router, and block based on port. You could give the Reolink a static lease from the DHCP server, and block based on IP address. (From winbox, go to ip dhcp server, the lea...
by rplant
Fri Dec 06, 2024 11:38 pm
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 2001

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

One other thought

If you have an interface that is not part of the bridge, but has an IP address on it, it will route using hw offload.
However if you have a vlan on this interface with an IP address on it, the vlan will use the CPU.
by rplant
Fri Dec 06, 2024 11:27 am
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 2001

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

Perhaps try the following commands to see if L3 offload is not present somewhere. With 400+ routes, you might want to write it to a file, so you can examine it in a text editor or similar. /ip route print [file=somefilename] Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, o - OSPF, d - DHCP; H - HW-OFF...
by rplant
Fri Dec 06, 2024 6:09 am
Forum: General
Topic: mDNS VLAN Setup Help
Replies: 7
Views: 2040

Re: mDNS VLAN Setup Help

I was thinking something like. /ip firewall nat add action=masquerade chain=srcnat comment="Nat lan to wan tvs" out-interface=VLAN_TVs You could also filter by src-ip address, or src ip address list. On review, I notice you have a bunch of bridges on this system. And assorted vlans connect...
by rplant
Fri Dec 06, 2024 5:55 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 2059

Re: Shaping /Qos Policy

I was thinking of something like. /queue type add kind=pcq name=pcq-upload-24 pcq-classifier=src-address pcq-dst-address-mask=24 pcq-src-address-mask=24 It just groups each /24 lan subnet together so the large upload machines get lumped together. On testing, you may find the pcq-upload-default works...
by rplant
Thu Dec 05, 2024 12:37 pm
Forum: General
Topic: mDNS VLAN Setup Help
Replies: 7
Views: 2040

Re: mDNS VLAN Setup Help

You could perhaps see if configuring source nat on packets leaving the LAN for the VLAN_TVs helps.
by rplant
Thu Dec 05, 2024 12:23 pm
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 2001

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

Are the MTU's on all the interfaces the same.
The switch might fragment packets in software.
My CRS305 does that...
by rplant
Thu Dec 05, 2024 11:58 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, I changed the firewall filter rules, and while I still don't like them much, the ikev2 now should work. They appear to be based on a very old routeros version. The ipsec policy rules have to go above the fasttrack rule. (They seem to work below it when pinging things, but fail when actually tryi...
by rplant
Wed Dec 04, 2024 10:32 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Perhaps time for: Thanks @mkx Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireless PSK, etc.) and copy-paste it ...
by rplant
Tue Dec 03, 2024 8:50 am
Forum: General
Topic: PPPOE on upload disconnecting!
Replies: 4
Views: 1275

Re: PPPOE on upload disconnecting!

If its running v7, use a cake queue that should (hopefully) allow you to near fill the uplink, while also giving everything else in your network a bit of bandwidth rather than being starved out because of the fat upload.

V6, probably a pcq queue.
by rplant
Tue Dec 03, 2024 8:42 am
Forum: General
Topic: RDP HELP!
Replies: 31
Views: 7472

Re: RDP HELP!

I would perhaps actively block udp to and from 3389, (if only to see if it changes anything)
by rplant
Mon Dec 02, 2024 12:39 pm
Forum: General
Topic: Wireguard is blocked by ISP any other solution
Replies: 20
Views: 4993

Re: Wireguard is blocked by ISP any other solution

ikev2 (ipsec) is well supported, and there are fairly good examples around. https://help.mikrotik.com/docs/spaces/ROS/pages/11993097/IPsec#IPsec-RoadWarriorsetupusingIKEv2withRSAauthentication This is more industrial, so perhaps less likely to be dropped. But if your ISP doesn't want you running VPN...
by rplant
Mon Dec 02, 2024 9:30 am
Forum: Beginner Basics
Topic: UDP Port forwarding [SOLVED]
Replies: 6
Views: 6314

Re: UDP Port forwarding [SOLVED]


Another possibility:
Some special handling may be required if you have multiple public ip addresses on the router.
Ignore this, mine seems to handle this fine.
by rplant
Mon Dec 02, 2024 6:04 am
Forum: Beginner Basics
Topic: UDP Port forwarding [SOLVED]
Replies: 6
Views: 6314

Re: UDP Port forwarding [SOLVED]

One possibility. Seems unlikely, but you do have a wanIP as an address list. If you have multiple wan interfaces, and the packet is coming in from one interface, and leaving via another (the wan interface with the lowest metric). This could occur. You would need to mark your packets (or similar) so ...
by rplant
Mon Dec 02, 2024 4:26 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 2059

Re: Shaping /Qos Policy

One other thought, (Somewhat more like my original thought) You could perhaps make a new pcq type queue, based on pcq-upload-default, but with a 24 mask. (So everything from 10.0.1.x will be counted together) Then back to no marking, and fast track allowed. The low rate lans will be prioritised over...
by rplant
Mon Dec 02, 2024 2:17 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 2059

Re: Shaping /Qos Policy

Sorry, I should read things a bit more thoroughly. Unfortunately, the 3011 seems to not be great under v7. Perhaps what you have will be good. Though I do not understand why you have a limit of 100M on the backup traffic. You will likely need to add all the packet marks to the parent (WAN-Shaper) so...
by rplant
Sun Dec 01, 2024 7:49 am
Forum: General
Topic: Feature requests
Replies: 1810
Views: 857695

Re: Feature requests

It would be very functional to be able to add a description for each connection that you save and thus identify more quickly to which mikrotik equipment I want to connect I am assuming you a speaking of the managed tab in winbox. In tools at the top, there is and advanced mode you can select, and a...
by rplant
Sun Dec 01, 2024 7:35 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 2059

Re: Shaping /Qos Policy

As a start, I would be inclined to just put a single cake queue attached to the WAN interface, to see how well (or not) it works. (With no packet marking for shaping) Set it up for 500M, and a bucket size of 0.005-0.01, (or your settings) and see how it goes. You will need to create a new queue type...
by rplant
Sun Dec 01, 2024 3:50 am
Forum: General
Topic: Disable Voice VLAN on specific Ports
Replies: 3
Views: 1245

Re: Disable Voice VLAN on specific Ports

Some possible options: If you make a custom interface list and add all the ports you want (but not the bridge) to this list, you can make ip discovery use this list and it will only target those ports. So no discovery on the ports missing from the list. Another option might be to use a switch chip r...
by rplant
Fri Nov 29, 2024 11:34 pm
Forum: Beginner Basics
Topic: Setup mAP in reverse config from default
Replies: 18
Views: 4879

Re: Setup mAP in reverse config from default

2. Yes and no Since the device is now a (dumb) switch it has no way to filter anything. The input firewall chain still works. However by default the bridge is a LAN interface and input is allowed from LAN interfaces, ie. All ports. (Input is disallowed from all except LAN interfaces) You can add (a...
by rplant
Fri Nov 29, 2024 6:23 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, I have added the following rules near the top of a default config. (after accept icmp) /ip firewall filter ... add action=accept chain=input comment="allow 500,4500 ipsec in" dst-port=500,4500 protocol=udp add action=accept chain=input comment="allow ipsec-esp in (no nat)" pr...
by rplant
Thu Nov 28, 2024 9:26 am
Forum: General
Topic: RouterOS blatantly ignores pref-src. Can this really be a bug?
Replies: 92
Views: 9380

Re: RouterOS blatantly ignores pref-src. Can this really be a bug?

Hi, My observations: Actually wireguard in mikrotik does attempt to use the IP address that the incoming packet was sent to. Looking at the packet on the output chain is too late. It has already gone through the routing process, and had it's ip address changed, probably also natted. If you use routi...
by rplant
Thu Nov 28, 2024 1:55 am
Forum: Beginner Basics
Topic: Secure Remote Access - QuickSet VPN
Replies: 17
Views: 6173

Re: Secure Remote Access - QuickSet VPN

but am struggling to get an IP address on the wireguard peer much less an internet connection You have to setup the ip address on each peer manually. It is attached to the wg interface associated with that peer. wg interface <ip address> peer - allowed ip addresses peer - allowed ip addresses Stric...
by rplant
Thu Nov 28, 2024 1:26 am
Forum: Beginner Basics
Topic: Why can I not use static ip_
Replies: 13
Views: 3901

Re: Why can I not use static ip_

Hi, My guess is that you need to run dhcp, so the ISP gets the MAC address of your router, so it can send packets to it. It may not use arp discovery, the dhcp mac address possibly gets recorded into the radius server, and that is where the routers packets get sent too. (I believe Mikrotik's do this...
by rplant
Wed Nov 27, 2024 6:03 am
Forum: Beginner Basics
Topic: L2TP/IPsec VPN clients can't access LAN
Replies: 1
Views: 2819

Re: L2TP/IPsec VPN clients can't access LAN

Some thoughts. 1. Don't use L2TP at all, use wireguard, its easier/better. (L2TP is slowly being discouraged) Wireguard: You only need 1 port. You usually don't have to fight much with the ISP router. You don't have to fight much with the client OS. Perhaps a little less good if you are somewhere wh...
by rplant
Wed Nov 27, 2024 3:08 am
Forum: General
Topic: SFP+ interface compatibility with 1G optical transceivers
Replies: 2
Views: 1105

Re: SFP+ interface compatibility with 1G optical transceivers

Also Mikrotiks support for assorted sfp's has varied a lot over the routeros versions.
and not always for the better in newer versions it seems.
by rplant
Wed Nov 27, 2024 3:03 am
Forum: General
Topic: SFP+ interface compatibility with 1G optical transceivers
Replies: 2
Views: 1105

Re: SFP+ interface compatibility with 1G optical transceivers

Hi, I had sort of thought that auto-negotiation is a combination (max) of -The speeds the sfp port is capable of. -The configured auto-negotiate speeds in the ethernet tab. -The speeds that are advertised as acceptable by the sfp devices ROM. Though your experience seems to indicate otherwise. One p...
by rplant
Wed Nov 27, 2024 2:23 am
Forum: Beginner Basics
Topic: Secure Remote Access - QuickSet VPN
Replies: 17
Views: 6173

Re: Secure Remote Access - QuickSet VPN

If you have some device/network in your control with a static ip address that you can login to these devices from, you can (as a short term solution) add this ip address to an address list in ip firewall. (eg. admin2) Then change the firewall rule that allows 8291 to only allow 8291 with src-address...
by rplant
Mon Nov 25, 2024 3:55 am
Forum: General
Topic: Any advice for further debugging handshaking failed on wireguard roadwarrior setup?
Replies: 13
Views: 2550

Re: Any advice for further debugging handshaking failed on wireguard roadwarrior setup?

Hi, I am finding it difficult to understand what you are saying, but I will assume the mikrotik has 3 public ip addresses on it. And the incoming wg packets all come into the mikrotik via either the 2.249 or 2.253 interfaces but directed at the .210 address. Normally for this, I would use routing ru...
by rplant
Sun Nov 24, 2024 1:24 pm
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

I found this also, which might help.

add action=accept chain=input comment="Allow IKEv2 Traffic" src-address=\
172.17.153.0/24

Change 172.17... for the IP address range from your ikev2 pool.

viewtopic.php?t=190096
by rplant
Sun Nov 24, 2024 1:09 pm
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6925

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, ikev2: If your hap lite is not the internet gateway, you will possibly need to put some sort of NAT on it, so vpn connections to devices on the local network get masqueraded. (The devices on the local network will likely try to reply to the main gateway rather than the Mikrotik). Otherwise, not ...
by rplant
Sat Nov 23, 2024 3:48 am
Forum: General
Topic: L3HW: Nexthop HW table FULL
Replies: 3
Views: 997

Re: L3HW: Nexthop HW table FULL

Another thought The arp table can get very big these days. There is an arp timeout value on interfaces and bridges. (Not defined by default) You could perhaps see how big your arp table is and see if it might be the problem. And see if setting the arp timeout to some value (seconds, minutes, hours, ...
by rplant
Fri Nov 22, 2024 5:32 am
Forum: General
Topic: same subnet
Replies: 6
Views: 1383

Re: same subnet

Hi, I suspect it should be possible using vrf's. But I am not sure, and don't know how too, sorry. I had a trial of putting another mikrotik (a hex) in front of a similarly configured setup, and this appears to work ok. If your main router is a high end expensive CCR or similar, this is probably not...
by rplant
Wed Nov 20, 2024 6:17 am
Forum: General
Topic: L3HW: Nexthop HW table FULL
Replies: 3
Views: 997

Re: L3HW: Nexthop HW table FULL

Perhaps the following might be useful in this case. To make all packets go through the CPU first, and offload only the Fasttrack connections, disable l3hw on all ports but keep it enabled on the switch chip itself: /interface/ethernet/switch set 0 l3-hw-offloading=yes /interface/ethernet/switch/port...
by rplant
Wed Nov 20, 2024 5:59 am
Forum: Beginner Basics
Topic: Sufficient power to run multi crs305 via RB4011 ?
Replies: 1
Views: 2204

Re: Sufficient power to run multi crs305 via RB4011 ?

Hi, I am not quite sure what you are asking, but here are some answers. The RB4011 is not powerful enough to route 10G (and doesn't have the ports to do it really) From the test results section of the RB4011 page: https://mikrotik.com/product/rb4011igs_rm#fndtn-testresults From these results the 512...
by rplant
Wed Nov 20, 2024 5:23 am
Forum: Beginner Basics
Topic: Troubles with configuring hairpin NAT
Replies: 11
Views: 6838

Re: Troubles with configuring hairpin NAT

Hi,

There is an mdns repeater setup on recent routeros versions.

It is in ip dns.
You add the interfaces you want mdns to be repeated between.

or by cli (example)

/ip dns
set mdns-repeat-ifaces=ether1,ether2
by rplant
Wed Nov 20, 2024 12:31 am
Forum: General
Topic: Traffic Shapping from ISP
Replies: 7
Views: 1856

Re: Traffic Shapping from ISP

Sorry for the delay, forum didn't seem to work for me. /ip firewall mangle # (remove/disable this rule) add action=mark-packet chain=postrouting out-interface=ether1 new-packet-mark=shaped-packets passthrough=no /queue tree add name="WAN-Shaper" parent=ether1 packet-mark=no-mark max-limit=...
by rplant
Sun Nov 17, 2024 11:32 am
Forum: General
Topic: Traffic Shapping from ISP
Replies: 7
Views: 1856

Re: Traffic Shapping from ISP

A few things. 1. The RB3011 isn't really fast. 2. It is quite a bit slower using Rosv7 3. You can't fast track simple queues. (not fast track is much slower) 4. You need to set a lower bucket size on the queues. You can show system resources and watch the cpu when you run traffic through the link. T...
by rplant
Sun Nov 17, 2024 4:54 am
Forum: General
Topic: Change the routing table for OVPN connections dynamically on a MikroTik router
Replies: 4
Views: 1310

Re: Change the routing table for OVPN connections dynamically on a MikroTik router

Hi, A couple of things. I would put a routing rule like: add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main before your existing routing rules. So only for traffic that needs to go via a default gateway will use Table_ISP1 or Table_ISP2. I wo...
by rplant
Sun Nov 17, 2024 4:32 am
Forum: General
Topic: Wireguard/RouterOS issue
Replies: 7
Views: 1112

Re: Wireguard/RouterOS issue

My guess is that perhaps the end devices don't know how to (or don't want to) route back to the wireguard IP address range.

You could add a source nat rule that if the ip address is the wireguard range, it gets masqueraded and see if that works.
by rplant
Sat Nov 16, 2024 8:25 am
Forum: Beginner Basics
Topic: Troubles with configuring hairpin NAT
Replies: 11
Views: 6838

Re: Troubles with configuring hairpin NAT

Hi, From your listing. The 2 rules below are not required, the last filter rule will allow (actually let fall through to default allow) connections allowed by your dst-nat rules Rule: add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface="ether8[ISP]"...
by rplant
Thu Nov 14, 2024 9:57 am
Forum: Beginner Basics
Topic: AP Speed Static IP Vs DHCP
Replies: 1
Views: 2185

Re: AP Speed Static IP Vs DHCP

You could check the ip route table with dhcp and static and see if there is any differences. I think your masquerade rule should have an interface (out-interface) on it. Presumably bridge1. Though perhaps only if it is coming from the 10.2.2.0/24 network. Not quite sure why you have ether1 attached ...
by rplant
Thu Nov 14, 2024 5:36 am
Forum: Beginner Basics
Topic: Mysterious SSTP VPN Certificate issue
Replies: 2
Views: 2686

Re: Mysterious SSTP VPN Certificate issue

You could maybe try hitting it with a web browser, and see what it thinks about it,
(The mikrotik might have web over tls enabled??)
by rplant
Wed Nov 13, 2024 12:27 am
Forum: Beginner Basics
Topic: CRS354-48P-4S+2Q+RM Performance Issues with Light Load
Replies: 5
Views: 2470

Re: CRS354-48P-4S+2Q+RM Performance Issues with Light Load

You do mention you have a gateway router. So does this router do the firewalling from the internet that your network requires. If so, the CRS354 may be ok. (Otherwise as @anav mentioned, a RB5009 in front might be good) In switch settings, you can enable L3 HW Offload for the switch chip. Then under...
by rplant
Mon Nov 11, 2024 2:38 am
Forum: General
Topic: Routing between VLANS not working - CRS305 [SOLVED]
Replies: 3
Views: 1271

Re: Routing between VLANS not working - CRS305 [SOLVED]

Hi, It seems to work for me. Though having only 2 ip addresses in the dhcp server pools seems wrong. It could be the devices you are connecting too on the .200.x and/or 178.x vlans don't have the CRS305 as their default gateway. (eg. Not configured by the crs dhcp server) Could also be firewall rule...
by rplant
Sat Nov 09, 2024 1:24 am
Forum: General
Topic: 2.5Gbps on SPF+ ports broken
Replies: 3
Views: 2707

Re: 2.5Gbps on SPF+ ports broken

As mentioned by yourself a better option, get a 2.5G ethernet sfp to plug into the router.
Much cheaper and cooler than the 10G device.

fs.com have them.
by rplant
Sat Nov 09, 2024 1:13 am
Forum: General
Topic: 2.5Gbps on SPF+ ports broken
Replies: 3
Views: 2707

Re: 2.5Gbps on SPF+ ports broken

Given the routers are fairly powerful. For the outbound traffic, you can probably attach some sort of queue to the sfp+ interface. Queues based on cake are usually easy, perhaps fqcodel might be better in this case but I am no expert on queues. (I have had success with red queues in the past) Set it...
by rplant
Sat Nov 09, 2024 12:46 am
Forum: Beginner Basics
Topic: R.OS v7.15.2 PPPoe Client - Connected Without Internet
Replies: 2
Views: 2145

Re: R.OS v7.15.2 PPPoe Client - Connected Without Internet

Sorry, this isn't an answer, but the following may be worthwhile looking at. The following video shows a (fairly long) presentation on setting up something maybe similar (also on a 1036) using dhcp. From 2018 MUM in Melbourne, (unfortunately, there seems to be no printable version) https://www.youtu...
by rplant
Fri Nov 08, 2024 8:33 am
Forum: General
Topic: Issues with bandwidth [SOLVED]
Replies: 19
Views: 2257

Re: Issues with bandwidth [SOLVED]

One thought. You need to do your bandwidth test between 2 devices with the switches in between them. eg. A fast desktop/laptop/server ideally with a 10G port on it, to another desktop/laptop/server with a 10G port on it. Perhaps easier, 1G ports to start with. When the bandwidth test is running thro...
by rplant
Fri Nov 08, 2024 3:07 am
Forum: General
Topic: Issues with bandwidth [SOLVED]
Replies: 19
Views: 2257

Re: Issues with bandwidth [SOLVED]

Hi, Some comments: You have no firewall rules, so it should (if enabled) run in fastpath which is notionally faster than fasttrack. (I am kind of wishing there was a quickset that would apply a default set of firewall rules) These switches will do what I will call L3 switching, and do it really well...
by rplant
Mon Nov 04, 2024 12:40 pm
Forum: General
Topic: CRS3xx Bridge horizon vs Switch port isolation
Replies: 2
Views: 668

Re: CRS3xx Bridge horizon vs Switch port isolation

Perhaps because horizon has been around for a long time and works on all platforms (I believe)

Switch port isolation not so much. Use Switch port isolation if available.
by rplant
Mon Nov 04, 2024 12:15 pm
Forum: Beginner Basics
Topic: CG-NAT lab assistance [SOLVED]
Replies: 2
Views: 3316

Re: CG-NAT lab assistance [SOLVED]

Below is wrong on router1
(Needs to be .144.1)

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=65.58.144.2
by rplant
Mon Nov 04, 2024 8:51 am
Forum: General
Topic: Issue: Dual WAN Routing for HTTPS Access with Connection Mark and NAT Challenges
Replies: 5
Views: 1136

Re: Issue: Dual WAN Routing for HTTPS Access with Connection Mark and NAT Challenges

Hi, It isn't indicated in your listings, but if the default fasttrack rule is in place, it will break marked packets. You could put an accept rule just prior to the fasttrack rule, with a connection-mark=!no-mark (Or add connection-mark=no-mark to the fasttrack rule) Your 2 dst nat rules are identic...
by rplant
Fri Nov 01, 2024 6:27 am
Forum: General
Topic: Sluggish web browsing via Wireguard on Mikrotik [SOLVED]
Replies: 2
Views: 948

Re: Sluggish web browsing via Wireguard on Mikrotik [SOLVED]

My thought is to disable the fasttrack rule and see if that helps.

Fast tracked traffic does not get packet/routing marks applied.

If it helps, you might be better off with routing rules.
As they should continue to work with/without fasttrack.
by rplant
Wed Oct 23, 2024 8:03 am
Forum: Beginner Basics
Topic: Can't figure out port forwarding
Replies: 12
Views: 2040

Re: Can't figure out port forwarding

Rules look ok. Some guesses Does the mikrotik have the same internal ip address as the old router? Presumably .100 and .102 are set up with static ip configurations. Perhaps static arps have been configured somewhere Can .100 and .102 connect to the internet? Traceroute from these to 8.8.8.8 does it...
by rplant
Mon Oct 21, 2024 4:39 am
Forum: General
Topic: Is PtMP possible with NetBox 5AX ?
Replies: 2
Views: 493

Re: Is PtMP possible with NetBox 5AX ?

Yes.

It has license level 4, so can act as an ap for multiple devices.
(license level 3 only allows a single device)
by rplant
Thu Oct 17, 2024 9:02 am
Forum: Beginner Basics
Topic: Problem with switches behind Mikrotik
Replies: 5
Views: 1267

Re: Problem with switches behind Mikrotik

Hi, My guess(es) is that it might be something to do with Spanning tree, or more likely Vlan configuration. I would expect spanning tree to begin to work after a minute or so (worst case scenario) Perhaps the switch port you have plugged the router into is on a different vlan to the port the device ...
by rplant
Tue Oct 15, 2024 7:33 am
Forum: General
Topic: Asking for help: Setting Up a Multi-Site in-house Wireguard network [SOLVED]
Replies: 10
Views: 1676

Re: Asking for help: Setting Up a Multi-Site in-house Wireguard network [SOLVED]

Normally Wireguard uses a private key and public key, where the public key is not wrapped in a certificate. Assuming a client/server type configuration. If the clients have a peer (the only one in client/server) with the server's public key, it will trust and can connect to the server with the corre...
by rplant
Fri Oct 11, 2024 1:12 am
Forum: Beginner Basics
Topic: Connection Timeouts UDP / UDP Stream / SIP
Replies: 11
Views: 3298

Re: Connection Timeouts UDP / UDP Stream / SIP

RDP connection dying was one thread
viewtopic.php?p=992900
by rplant
Fri Oct 11, 2024 12:56 am
Forum: Beginner Basics
Topic: Simple Queues question
Replies: 3
Views: 1043

Re: Simple Queues question

Have you disabled fasttrack for the affected/all traffic.

Simplest though blunt option is to disable the default fasttrack forward rule.
CPU usage will increase a lot.

Also, having limit-at on just one queue is probably bad. (Means it is guaranteed 50M, the others are Guaranteed nothing)
by rplant
Wed Oct 09, 2024 10:10 am
Forum: Beginner Basics
Topic: Configure a Single Switch (CRS305-1G-4S+) and ISP Router
Replies: 8
Views: 1634

Re: Configure a Single Switch (CRS305-1G-4S+) and ISP Router

I think this might be basically doable, so long as the ISP router can be configured with static routes on it. ie. 10.0.0.x/24 via 192.168.1.2 (the IP address I have assigned to the CRS) If a device on the main ISP LAN wants to connect to a device on your new LAN, it will send the packet to the ISP r...
by rplant
Tue Oct 08, 2024 1:34 pm
Forum: General
Topic: IPsec VPN Mikrotik - Sonicwall not using full internet speed
Replies: 8
Views: 1608

Re: IPsec VPN Mikrotik - Sonicwall not using full internet speed

You could perhaps try you iperf (I assume iperf3) With the -V and -M options.

Using custom/reduced MSS settings to see if it is perhaps something to do with reduced MTU at one end due to pppoe.
And add an appropriate mss adjustment rule if it helps
by rplant
Mon Oct 07, 2024 2:03 am
Forum: Beginner Basics
Topic: Connection Timeouts UDP / UDP Stream / SIP
Replies: 11
Views: 3298

Re: Connection Timeouts UDP / UDP Stream / SIP

The current default is 30S, it was 10S for quite a few versions, but there were plenty of people having issues with the 10S value.
by rplant
Fri Oct 04, 2024 3:03 am
Forum: Beginner Basics
Topic: Can't import the TLS key for OpenVPN
Replies: 2
Views: 3220

Re: Can't import the TLS key for OpenVPN

Hi, The tls auth thing is not a certificate. From: https://help.mikrotik.com/docs/display/ROS/OpenVPN OVPN client supports tls authentication. The configuration of tls-auth can be added only by importing .ovpn configuration file. Using tls-auth requires that you generate a shared-secret key, this ke...
by rplant
Thu Oct 03, 2024 10:04 am
Forum: MikroTik hardware questions
Topic: SFP transceivers to connect L009 & RB5009
Replies: 21
Views: 19948

Re: SFP transceivers to connect L009 & RB5009

Hi, From the MikroTik wired interface compatibility page. S+RJ10 devices Use these modules only in 10G SFP+ ports with auto-negotiation enable I am fairly sure the S+RJ10 devices need the SFP Port actually running at 10G (10.3G?) for the somewhat complex base T conversion electronics which likely ne...
by rplant
Sun Sep 29, 2024 3:05 am
Forum: General
Topic: Wanted feature in logging or info about logging issue.
Replies: 3
Views: 735

Re: Wanted feature in logging or info about logging issue.

Hi, I have found script diagnostics leave a bit to be desired. You can put something like: :log info "script scriptname starting" (perhaps also logging parameters if available) and perhaps a similar entry near the scripts exit point(s) With luck the most recent starting log entry will be a...
by rplant
Fri Sep 20, 2024 10:35 am
Forum: Beginner Basics
Topic: correct order of interfaces for PPPoE/VLAN-ISP connections? [SOLVED]
Replies: 3
Views: 1750

Re: correct order of interfaces for PPPoE/VLAN-ISP connections? [SOLVED]

Hi, I would suggest you start off with the default mikrotik config. Then Interface <ether1> contains <VLAN7> <pppoe-out1> is attached to <VLAN7> Enable dns client on <pppoe-out1>, (review settings of pppoe-out1) <dhcpv6-client> is running on <pppoe-out1> ** Changed ** <VLAN7> and <pppoe-out1> both m...
by rplant
Wed Sep 18, 2024 5:55 am
Forum: Beginner Basics
Topic: Upgrading router, Wireguard not working
Replies: 4
Views: 1288

Re: Upgrading router, Wireguard not working

Perhaps the following on the server /interface detect-internet set detect-interface-list=none /interface list member add comment=defconf interface="WG VPN" list=LAN You may want to eventually restrict it a bit more than giving it full LAN access, but in the short term... Client: Only if th...
by rplant
Sat Sep 14, 2024 6:32 am
Forum: Beginner Basics
Topic: Network two LAN-s through WireGuard
Replies: 3
Views: 2869

Re: Network two LAN-s through WireGuard

If you do want full l2 connectivity, perhaps you should investigate ZeroTier
(which is supported by Mikrotik)
I have not tried it, but I believe it will do this.
by rplant
Fri Sep 13, 2024 3:43 pm
Forum: Beginner Basics
Topic: Network two LAN-s through WireGuard
Replies: 3
Views: 2869

Re: Network two LAN-s through WireGuard

Some thoughts. A rough outline of what I would do. To hopefully create an approximation to what you appear to want. (Sorry there will likely be errors in this) This assumes somewhere near default config of the Mikrotiks. With a LAN interface list. The 192.168.169.0/24 is broken up into a bunch of /2...
by rplant
Fri Sep 13, 2024 3:33 am
Forum: Beginner Basics
Topic: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?
Replies: 9
Views: 2047

Re: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?

Hardware: Optical: If you can use prebought optical patch cables or DAC cables things are ok. As soon as you need to make stuff it gets very expensive for the tooling. And yes, copper cables are much more durable. But 10G copper seems to run very hot, so you need fan cooled switches, etc. dac cables...
by rplant
Thu Sep 12, 2024 1:39 pm
Forum: General
Topic: VLANs unable to do DNS lookup [SOLVED]
Replies: 5
Views: 2359

Re: VLANs unable to do DNS lookup [SOLVED]

Hi, You have the following rule before your allow dns to vlans. add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN Perhaps put all the input rules together and forward rules together. Sorry there may be other issues, that's just the one I s...
by rplant
Thu Sep 12, 2024 1:47 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1521

Re: Poor upload speeds with baby jumbo frames?

Not sure, seems like something dubious. One hack possibility (for tcp) might be to clamp the mss of your internal devices to 1452, while letting the outside devices stay at 1460. So your devices upload with shorter packets. /ip firewall mangle add action=change-mss chain=forward comment="clamp ...
by rplant
Wed Sep 11, 2024 10:14 am
Forum: Beginner Basics
Topic: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?
Replies: 9
Views: 2047

Re: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?

Sorry, not much of an answer but. 2. The speed of the switch mostly does not depend on the type of router. However, broadcast and similar packets will likely cause slowdowns as they have to go to everywhere including the slow bits on the lan segment. Would recommend you minimise the number of slower...
by rplant
Wed Sep 11, 2024 9:53 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1521

Re: Poor upload speeds with baby jumbo frames?

You could try something like the following from the mikrotik, and see if it replies (and the size at which it stops) /ping size=1500 8.8.8.8 do-not-fragment And with luck some indication of where it stops. (You can also use /tool/traceroute with size and do-not-fragment) Note: Traditionally 8.8.8.8 ...
by rplant
Wed Sep 11, 2024 4:46 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1521

Re: Poor upload speeds with baby jumbo frames?

You could try an mtu on the vigor of 1508 (to include the pppoe header) or even 1512 (to also include the vlan) and see if that helps.
by rplant
Sat Sep 07, 2024 1:22 pm
Forum: General
Topic: Windows btest.exe super-duper slow
Replies: 3
Views: 1691

Re: Windows btest.exe super-duper slow

You have to type in a speed, and it will try to get to that speed.
(You can't leave it at 0)

eg. 1M 10M 100M
by rplant
Sat Sep 07, 2024 1:04 pm
Forum: Beginner Basics
Topic: Help bridging L2TP to port with external IPs
Replies: 2
Views: 790

Re: Help bridging L2TP to port with external IPs

Hi,
The following topic is very similar to what I think you want (except they were getting the address via pppoe)

viewtopic.php?p=1070581#p1070581
by rplant
Thu Sep 05, 2024 6:45 am
Forum: MikroTik hardware questions
Topic: 2.5 gig RJ45 SFP for L009 router
Replies: 2
Views: 7438

Re: 2.5 gig RJ45 SFP for L009 router

The following has their tested items MikroTik wired interface compatibility https://help.mikrotik.com/docs/pages/viewpage.action?pageId=263749679 Pretty much all their 10G optical SFP's and Dac cables are indicated to work in an L009 (in forced 2.5G mode). For low power/temperature/cost You could us...
by rplant
Mon Sep 02, 2024 10:44 am
Forum: Beginner Basics
Topic: Problem with accessibility of sites through WG
Replies: 7
Views: 1458

Re: Problem with accessibility of sites through WG

Perhaps something like the following in the central router. /ip firewall filter #existing rules ... #following rules just before existing invalid rule. #(Put them in via terminal, then move them using winbox/webfig) add action=accept chain=forward comment="allow traffic between wg and lan"...
by rplant
Mon Sep 02, 2024 6:41 am
Forum: Beginner Basics
Topic: Problem with accessibility of sites through WG
Replies: 7
Views: 1458

Re: Problem with accessibility of sites through WG

My Guess Assuming the internet gateway is a Mikrotik and is using something similar to the default config, asymmetric routing that might be the issue. Wg -> Lan Device and Lan Device -> MainGateway -> Wg If it is this, there are a at least a couple of options: 1. On the WG mikrotik enable masquerade...
by rplant
Sun Aug 25, 2024 2:14 pm
Forum: General
Topic: CRS310-8G+2S+ is choking my internet bandwidth
Replies: 5
Views: 1090

Re: CRS310-8G+2S+ is choking my internet bandwidth

It looks like the CRS310 won't do nat or fasttrack connections in hardware, so mostly good for inter vlan routing maybe using some access lists, much less good as an internet gateway, with Nat, Stateful Firewalling, etc. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOff...
by rplant
Sun Aug 25, 2024 3:54 am
Forum: Beginner Basics
Topic: Forwarding 1 interface to another
Replies: 6
Views: 1710

Re: Forwarding 1 interface to another

Hi, I would also include the first routing rule below. It allows devices on your wifi subnet to connect to other local devices, and only internet bound traffic goes via the vpn. (Order matters, put it before the other rule) Note: If using winbox, you likely should have still been able to connect to ...
by rplant
Sun Aug 25, 2024 3:40 am
Forum: Beginner Basics
Topic: hEX on Switch should manage access to printer [SOLVED]
Replies: 20
Views: 2447

Re: hEX on Switch should manage access to printer

You need two or more different vlan's on the hex. The hex needs to have an IP address assigned to it for each vlan. The devices on each vlan need to have the hex as their default gateway. (Alternatively each vlan's default gateway/router could have a static route for the other vlan(s) pointing to th...
by rplant
Sat Aug 24, 2024 8:49 am
Forum: Beginner Basics
Topic: Microtik hotspot with Wavlink AC1200 in mesh mode
Replies: 5
Views: 1913

Re: Microtik hotspot with Wavlink AC1200 in mesh mode

If the mesh router has the option to disable it's dhcp server, you could do that.

Then plug the mikrotik's LAN port into one of the lan ports of the router, and see if devices connect to the Mikrotik.
(You may need later to change the ip address of the mesh router as well)
by rplant
Fri Aug 23, 2024 2:34 am
Forum: General
Topic: HELP Tried the PCC load balancing from mikrotik YouTube vid but it doesn't work for me I might be doing something wrong
Replies: 20
Views: 3536

Re: HELP Tried the PCC load balancing from mikrotik YouTube vid but it doesn't work for me I might be doing something wr

You have to ensure that the appropriate packets don't go via fasttrack. Either by having an accept statement for these packets prior to the fasttrack rule or by disabling the fasttrack rule. One possible option (just prior to fasttrack rule) add action=accept chain=forward comment="accept estab...
by rplant
Wed Aug 21, 2024 7:52 am
Forum: Beginner Basics
Topic: hAP ac3 NAT forwarding issues [SOLVED]
Replies: 9
Views: 4086

Re: hAP ac3 NAT forwarding issues [SOLVED]

Hi, A couple of points, The screenshot doesn't really show what you are doing. Mikrotik doesn't do hairpin nat by default, so it might work from outside but not from inside your network. You could open a terminal window (from webfig, up the top near rhs), and export the entire config, or just the fi...
by rplant
Wed Aug 14, 2024 4:46 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 3042

Re: lot of sites dont load on the first try

In another thread @mkx mentioned that adjust mss will probably not work if the connection is fasttracked.
You could try and disable the fasttrack rule briefly.
by rplant
Mon Aug 12, 2024 9:12 am
Forum: General
Topic: CCR 1016-12G 2Gbit upgrade recomendation
Replies: 6
Views: 1370

Re: CCR 1016-12G 2Gbit upgrade recomendation

Likely you are going to have to go for a ccr with at least 1 SFP+ port, and perhaps 2. eg. CCR1036-8g-2s+ if you can find one. Then how does your ISP provide you with 2Gbe, it seems like a non-standard value. If over a 2.5Gbe ethernet connection, none of the CCR 10xx series supports this directly. Y...
by rplant
Mon Aug 12, 2024 8:48 am
Forum: General
Topic: Wireguard issues; can connect but can't access hosts
Replies: 5
Views: 1037

Re: Wireguard issues; can connect but can't access hosts

Have you added 10.0.2.3/32 as an allowed IP address in the Peer setting on the Mikrotik?

When you look at the peer setting on the Mikrotik are you getting updated Tx, Rx and Last Handshake values.
by rplant
Fri Aug 09, 2024 1:09 pm
Forum: General
Topic: UPnP / NAT-PMP question
Replies: 4
Views: 1184

Re: UPnP / NAT-PMP question

Upgrade the ccr2116 to the latest beta version,
generate a supout.rif while working, and another when broken.
(Assuming it's not fixed)

And submit them in the ticket.
Support are quite good, and it is one of their flagship products you are having issues with...
by rplant
Thu Aug 08, 2024 2:07 am
Forum: General
Topic: EoIP+bridge Over WAN
Replies: 8
Views: 1333

Re: EoIP+bridge Over WAN

One thought,
Do you have appropriate firewall rules to allow gre protocol in from the remote peer?

The default rules cause Traffic wrapped in ipsec to be allowed.
by rplant
Wed Aug 07, 2024 7:59 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 3042

Re: lot of sites dont load on the first try

Yet another possibility is broken dns.

If on windows open a command prompt,
type nslookup

And try a few sites (including some you haven't recently used)
does it return immediately with a result?

Is the dns server nslookup is using correct?
by rplant
Wed Aug 07, 2024 7:55 am
Forum: Beginner Basics
Topic: Slow speed - basic settings
Replies: 1
Views: 854

Re: Slow speed - basic settings

You appear to have different wireless protocols at each end.
by rplant
Wed Aug 07, 2024 4:34 am
Forum: Beginner Basics
Topic: Hybrid ports and VLAN for tagged and untagged connections.
Replies: 10
Views: 1903

Re: Hybrid ports and VLAN for tagged and untagged connections.

A problem is that out of your switch, every port has both the tagged and the untagged vlans coming out of it and going into it. One Possible option would be to make vlan 1 something else other than 1. eg. 10 Then you could have vlan 20 as the untagged vlan, and vlan 10 as the tagged vlan going to th...
by rplant
Wed Aug 07, 2024 2:29 am
Forum: General
Topic: EoIP+bridge Over WAN
Replies: 8
Views: 1333

Re: EoIP+bridge Over WAN

Sorry, not an answer but.

Pretty sure the ipsec is going to be hardware offloaded, so it is going to take minimal cpu.
by rplant
Wed Aug 07, 2024 2:25 am
Forum: General
Topic: Steps to configure CRS326-24S+2Q+RM as a L3 Switch wihtout Router-on-a-stick
Replies: 23
Views: 2908

Re: Steps to configure CRS326-24S+2Q+RM as a L3 Switch wihtout Router-on-a-stick

Mostly the Gui is similar to the way the cli is laid out.
The switch menu is a bit different. It is a top level menu in the Gui.
by rplant
Wed Aug 07, 2024 2:16 am
Forum: General
Topic: 4011 2.5Gb SFP Module
Replies: 1
Views: 850

Re: 4011 2.5Gb SFP Module

I have tried (a few times) and also failed to get a 2.5g connection working on an RB4011 :(

**edit:** Note my RB4011 is an old one, I believe they have had a couple of versions of RB4011.
by rplant
Tue Aug 06, 2024 2:44 am
Forum: General
Topic: RB2011uiAS upgrade backup-routerbooot
Replies: 12
Views: 4694

Re: RB2011uiAS upgrade backup-routerbooot

In the wiki version it notes

The backup RouterBOOT version can not be older than v3.24 version.

So presumably given yours is newer than this, you don't need an upgraded backup routerboot. (so it won't let you upgrade it perhaps)
by rplant
Mon Aug 05, 2024 2:23 am
Forum: MikroTik hardware questions
Topic: How to intentionally make cable that will negotiate at 10 mbps?
Replies: 16
Views: 7413

Re: How to intentionally make cable that will negotiate at 10 mbps?

A possibility is to split the pairs and run it over a few meters, it will give lots of crosstalk and poor performance, but whether it is enough I don't know. eg. Pairs 1,4 2,3 5,8 6,7 or 1,3 2,4 5,7 6,8 (Cable terminated same at both ends) The cables will test as a simple straight cable (with a very...
by rplant
Sun Aug 04, 2024 7:23 am
Forum: General
Topic: question about "wireguard responder"
Replies: 15
Views: 5660

Re: question about "wireguard responder"

It used to (at minimum) stop a lot of annoying log messages on the server, I assume it still might.
by rplant
Sun Aug 04, 2024 7:19 am
Forum: General
Topic: How to setup 10GBit/s copper TP-Link SFP+ modules for CCR2004-16G-2S+.
Replies: 4
Views: 1182

Re: How to setup 10GBit/s copper TP-Link SFP+ modules for CCR2004-16G-2S+.

Try it in both negotiated and non negotiated mode, with each of the 3 (current) 10G settings.
10G base T
10G BaseCR
10G BaseSR LR

And see if any of them work.
by rplant
Sun Aug 04, 2024 7:06 am
Forum: Beginner Basics
Topic: Is this vlan setting correct? [SOLVED]
Replies: 9
Views: 5006

Re: Is this vlan setting correct? [SOLVED]

Some minor changes. # cisco interface Ethernet0/0 description trunk from mikrotik switchport trunk encapsulation dot1q switchport trunk allowed vlan 10,20 switchport mode trunk #mikrotik # (Use bridge instead of ether1) /interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge...
by rplant
Sun Aug 04, 2024 6:35 am
Forum: Beginner Basics
Topic: Basic Router setup on CRS310-1G-5S-4S+
Replies: 8
Views: 1469

Re: Basic Router setup on CRS310-1G-5S-4S+

As a switch it will have plenty of speed between your devices. However connections to the internet via your ISP will need routing with firewalling and presumably Nat. For 2.5G you will need a reasonably powerful router performing this task. If your ISP provided a router you can use it for that task ...
by rplant
Fri Aug 02, 2024 6:11 am
Forum: General
Topic: RB2011uiAS upgrade backup-routerbooot
Replies: 12
Views: 4694

Re: RB2011uiAS upgrade backup-routerbooot

look at the protected bootloader section of the above document
by rplant
Fri Aug 02, 2024 5:39 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 3042

Re: lot of sites dont load on the first try

Another thought, Partially working ipv6 can cause similar problems.

Try turning off ipv6 on the router.

From winbox
ipv6 settings tick the disable ipv6 box and wait a short while.
(May need to reboot PC if want it to update faster)
by rplant
Thu Aug 01, 2024 2:48 am
Forum: General
Topic: Post 7.13 incompatible station bridge versions
Replies: 2
Views: 1015

Re: Post 7.13 incompatible station bridge versions

Yes, you could have used the wireless package, and the map could then connect in station bridge. Wifi package does have some niceish features though. Other options: Use Station-Pseudo bridge mode. Ok when it works, need to turn off RSTP. If you go this way and it's not behaving it is worth searching...
by rplant
Wed Jul 31, 2024 8:19 am
Forum: MikroTik hardware questions
Topic: RB5009UG+S+IN dual power power [SOLVED]
Replies: 15
Views: 29345

Re: RB5009UG+S+IN dual power power [SOLVED]

Yes,
If you use poe as an alternate power source, it must be passive/forced on poe or the Mikrotik may lose power when main/other power is lost. (Usually briefly but...)
by rplant
Tue Jul 30, 2024 3:43 am
Forum: Beginner Basics
Topic: Trouble Loading RSC File
Replies: 4
Views: 1242

Re: Trouble Loading RSC File

A couple of options. 1. Reset the mikrotik with no default config, (but perhaps keep users), and then try to import the file. 2. Open the file in notepad or similar and copy and paste a section at a time into the terminal. You might be wise to compare the current default config to the config you wan...
by rplant
Mon Jul 29, 2024 5:51 am
Forum: General
Topic: Upgrading Rooterboot factory software
Replies: 25
Views: 10448

Re: Upgrading Rooterboot factory software

I think documentation means devices with version 7 factory firmware, but less than 7.6 get upgraded to a v7.6 factory firmware with protected router boot function. Devices with older (v3, v6) factory firmware get an updated factory firmware (not v7) which has the new protected router boot function. ...
by rplant
Sun Jul 28, 2024 2:31 pm
Forum: Beginner Basics
Topic: help creating "allow" rule via switch ACL
Replies: 5
Views: 1390

Re: help creating "allow" rule via switch ACL

You can probably enable dhcp relay on the appropriate switch vlans.
And have your dhcp server managing the vlan (remotely).
by rplant
Sun Jul 28, 2024 2:19 pm
Forum: Beginner Basics
Topic: help creating "allow" rule via switch ACL
Replies: 5
Views: 1390

Re: help creating "allow" rule via switch ACL

You could set it up with the CRS317 as the gateway for both VlanA and VlanB The CRS ROUTES packets from vlanA and vlanB to the router. (and between vlan A and vlan B) No firewall rules needed on CRS for internet traffic, so should be L3WH offloaded, (with very few if any ACL's) Rules/ACLs, mostly fo...
by rplant
Sat Jul 27, 2024 11:21 am
Forum: General
Topic: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]
Replies: 6
Views: 5473

Re: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]

A couple of thoughts, The following statement doesn't really seem helpful given your current results, but anyway: Mikrotik doesn't by default do hairpin Nat (you need to add the appropriate src-nat rule), so if you are testing from inside your network it will likely not work. You could download tcpr...
by rplant
Sat Jul 27, 2024 8:20 am
Forum: General
Topic: VPN IPSEC
Replies: 1
Views: 481

Re: VPN IPSEC

Hi,
License wise:
Not sure there is a limit for raw ipsec.
There is a 500 user one for l2tp.

However, the processor on the RB2011 doesn't do ipsec hardware encryption, and does not have much Ram.
So really only a couple maybe. You would be better off with wireguard with the 2011.
by rplant
Sat Jul 27, 2024 8:01 am
Forum: General
Topic: Wireguard setup
Replies: 2
Views: 662

Re: Wireguard setup

When a road warrior client from router 1 is connected it can not reach ip's behind the nat of router 2 (which is possible from within router1 main network (and the other way around). Assuming there is no NAT going on. (ie. The packet from 192.168.35.1 reaches device on router 2 as being from 192.16...
by rplant
Sat Jul 27, 2024 7:51 am
Forum: General
Topic: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]
Replies: 6
Views: 5473

Re: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]

Hi, I think you could start by checking the counters on the dst-nat rules, and see if they increment. (They happen early in the firewall) Typically they will only increment once for each new connection. If they are incrementing, you need to check the 10.0.0.39 (I assume nginx) Perhaps if not increme...
by rplant
Fri Jul 26, 2024 2:37 am
Forum: Beginner Basics
Topic: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP
Replies: 4
Views: 1873

Re: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP

Fair enough, Perhaps your option 2 would be a good option, you then effectively have a site to site tunnel, and can tunnel whichever clients you want. Option 1 is doable and will most times be fairly well upgraded. However it is not perfect. (Make a script export and a normal backup onto external st...
by rplant
Thu Jul 25, 2024 3:32 am
Forum: Beginner Basics
Topic: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP
Replies: 4
Views: 1873

Re: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP

I would recommend you experiment with wireguard.
(Even if just for this particular instance)
by rplant
Wed Jul 24, 2024 3:04 pm
Forum: Beginner Basics
Topic: IPsec VPN - NAT rule to reach the server
Replies: 6
Views: 1278

Re: IPsec VPN - NAT rule to reach the server

You could possibly add a src-nat rule something like

/ip firewall nat
chain=srcnat dst-address=171.11.153.20 src-address=192.168.1.0/24 action=src-nat to-addresses=171.11.153.21

Move it up above any masquerade rules already there.
by rplant
Wed Jul 24, 2024 3:50 am
Forum: General
Topic: Loopback for RFC2544 testing
Replies: 3
Views: 2120

Re: Loopback for RFC2544 testing

For generic case, perhaps not. (maybe a container?)

But for a single source ip sending data, you could probably use a dst-nat and src-nat pair of rules, to send the traffic back.
by rplant
Wed Jul 24, 2024 3:34 am
Forum: General
Topic: Prefix deligation over WireGuard
Replies: 1
Views: 605

Re: Prefix deligation over WireGuard

You can run your eoip or other tunnel inside wireguard. Though I would perhaps attempt to set up ipv6 and associated routing on the Mikrotik manually, using one of the /64's. You would maybe need to somehow mark the prefix as used though, so the VPS does not try to reuse it. You might need to put (n...
by rplant
Tue Jul 23, 2024 2:57 pm
Forum: MikroTik hardware questions
Topic: Doesn't seem to boot no matter what reset mode I try
Replies: 2
Views: 5753

Re: Doesn't seem to boot no matter what reset mode I try

beep twice usually means it thinks it is ready to start running. You could try connecting to it via wifi, it may have some mikrotik-XXXX ssid with no password. If it is similar to a map/wap, then Wifi is often the only way to connect to this type of device when factory defaulted, but usually the eth...
by rplant
Tue Jul 23, 2024 2:48 pm
Forum: MikroTik hardware questions
Topic: wAP ac (RBwAPG-5HacT2HnD) rebooting every 10 seconds
Replies: 3
Views: 4881

Re: wAP ac (RBwAPG-5HacT2HnD) rebooting every 10 seconds

I would also suggest you get a Low ESR capacitor (as well as of 105° type).
by rplant
Mon Jul 22, 2024 9:05 am
Forum: General
Topic: most "cold" RJ45 SFP+ modules
Replies: 5
Views: 1300

Re: most "cold" RJ45 SFP+ modules

fs.com have a few rj45 sfp+ modules.

They range in power consumption from 1.8W to 2.9W
Apparently the S+RJ10s is around 2.7W, so the 1.8W one might be good.
(but quite pricey)

Sorry I don't know how well or hot it works, or if it will work with a Mikrotik.
though fs is usually well supported
by rplant
Mon Jul 22, 2024 8:55 am
Forum: General
Topic: RB-751 failure, and back ups corrupted [SOLVED]
Replies: 18
Views: 5967

Re: RB-751 failure, and back ups corrupted [SOLVED]

It sounds like you are trying to restore a binary backup file to a new router. That rarely works :( You could search your hard disk for .rsc script files. If you can login to the old one at all (though it sounds unlikely), do a /export, stick it onto your laptop, and manually carefully copy the conf...
by rplant
Sat Jul 20, 2024 3:20 am
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1086

Re: Speed Limitation Issues with RB3011.

I tried it running with 6.49.13, and that was much improved.

Unfortunately doesn't have the cake queues, but the other queues I tried
seemed to handle 1G ok.
CPU still seemed to be largely locked to 1 core, and still needed multiple streams
or large window to get to 1G ish.
by rplant
Fri Jul 19, 2024 1:32 pm
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1086

Re: Speed Limitation Issues with RB3011.

I had a try with some of this, just to a local iperf3 server. So very little latency unlike over the internet. I found I had to disable the queue tree for best performance. To hit near a gig download I had to have a large window size, or multiple streams. Perhaps partly a limitation of the iperf3 se...
by rplant
Fri Jul 19, 2024 11:13 am
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1086

Re: Speed Limitation Issues with RB3011.

Hi, It seems unlikely to be good for a 1G connection, Apparently a single connection will only use 1 core. (To reduce out of order packets) From: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults The commonly used 25 IP filter rules, and 512 byte packets lists 452Mbps. Your actual perform...
by rplant
Wed Jul 10, 2024 3:41 am
Forum: General
Topic: SFP port Doesn't work on CCR2004
Replies: 8
Views: 1332

Re: SFP port Doesn't work on CCR2004

Yes there have been many many sfp fixes, and complaints of devices that used to work that no longer do. You could get install the latest betas at both ends (including updating routerboot), and assuming it is still not working create a supout.rif and send to support at mikrotik.com The -40db is a wor...
by rplant
Wed Jul 10, 2024 3:30 am
Forum: MikroTik hardware questions
Topic: L009 copper SFPs
Replies: 11
Views: 6106

Re: L009 copper SFPs

The S+RJ10 plugs into a 10G sfp+ interface.
The L009 has a 2.5G sfp interface.
by rplant
Wed Jul 10, 2024 3:26 am
Forum: General
Topic: wifi Multicast flood
Replies: 6
Views: 1217

Re: wifi Multicast flood

That feels like a bug.

I think the Mikrotik radio should likely have its own multicast subscriber list and send it to only its subscribed stations.
by rplant
Mon Jul 08, 2024 2:50 pm
Forum: MikroTik hardware questions
Topic: L009 copper SFPs
Replies: 11
Views: 6106

Re: L009 copper SFPs

I gain the impression that the S+RJ10 still runs quite warm, as its backend has to be run at approx 10.3G
(whether connected on the RJ45 side at 1G, 2.5G, or 10G)

While an actual 2.5G unit's backend runs at 2.5G (* 10/8).
(Whether connected on the RJ45 side at 2.5G, 1G or lower speeds)
by rplant
Sun Jul 07, 2024 2:14 pm
Forum: General
Topic: SFP port Doesn't work on CCR2004
Replies: 8
Views: 1332

Re: SFP port Doesn't work in CCR2004

Winbox:

Perhaps under ethernet tab for sfp, turn off auto negotiation and set speed to 1G Base X
at both ends.

Make sure fibre is correct, (looks to need single mode fibre)
by rplant
Thu Jul 04, 2024 3:20 am
Forum: General
Topic: Wireguard does not work after reboot
Replies: 19
Views: 2667

Re: Wireguard does not work after reboot

I found out empirically that if you turn off the interfaces and peers on both routers for 10-15 minutes and then turn them on, everything works. I think I have seen something similar in the past, if you turned off the wireguard interface and then turned it back on it fairly soon after. It didn't se...
by rplant
Wed Jul 03, 2024 1:58 pm
Forum: General
Topic: Wireguard does not work after reboot
Replies: 19
Views: 2667

Re: Wireguard does not work after reboot

Sorry, don't know. However I would turn off the persistent-keepalive on router-B. Perhaps trying to connect back to the IP/Port it was last connected too is doing something. Also, you can check the counters on the firewall rule on Router-B, and see if packets are actually getting in, enable logging ...
by rplant
Wed Jul 03, 2024 5:28 am
Forum: Forwarding Protocols
Topic: send udp packet with destination 255.255.255.255 to other subnet In router
Replies: 5
Views: 6474

Re: send udp packet with destination 255.255.255.255 to other subnet In router

I have in the past done the following

/ip arp
add address=192.168.44.252 interface=bridge-local mac-address=\
FF:FF:FF:FF:FF:FF

I was using it for Wake on Lan.
To any device on the 192.168.44.0/24 network

** Edit: on review, this is an answer to a different question :( **
by rplant
Wed Jul 03, 2024 5:18 am
Forum: General
Topic: Loop error even though RSTP is enabled
Replies: 6
Views: 1102

Re: Loop error even though RSTP is enabled

My guess is that it is doing what it is supposed to, but perhaps imperfectly.

The spanning tree needs reconfiguring, and it does this, but some looped packets get through.
But it seems to resolve quickly.
by rplant
Wed Jul 03, 2024 4:44 am
Forum: General
Topic: Wireguard: only the last edited peer is working [SOLVED]
Replies: 10
Views: 4509

Re: Wireguard: only the last edited peer is working [SOLVED]

Usually means you have overlapping allowed addresses on your peer configurations. This is an error. If this what you actually need and want, (eg. you want to use ospf to the peers and route via the ospf chosen link, etc) You need to have multiple wireguard interfaces with one (overlapping) peer per ...
by rplant
Tue Jul 02, 2024 2:47 pm
Forum: Beginner Basics
Topic: Mangle Rules with Multi WAN
Replies: 6
Views: 2728

Re: Mangle Rules with Multi WAN

Hi, I have a dhcp-client script that changes some of the routes. /ip dhcp-client add default-route-distance=70 interface=ether2 script="/ip route\r\ \n:if (\$bound = 1) do={\r\ \n set [find where comment~\"altgw\"] gateway=\$\"gateway-address\"\r\ \n}" I also find it be...
by rplant
Tue Jul 02, 2024 2:04 pm
Forum: Beginner Basics
Topic: Tunneling internet traffic through IPsec tunnel
Replies: 8
Views: 2238

Re: Tunneling internet traffic through IPsec tunnel

Perhaps get a hap ac2 as a gateway router in front of the switch at the home end.

Then you can have hardware offloaded ipsec at both ends if you want that.
Or wireguard. (I like wireguard, but hardware offloaded ipsec can be quite fast)
by rplant
Tue Jul 02, 2024 6:54 am
Forum: General
Topic: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease
Replies: 11
Views: 2285

Re: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease

You should perhaps change the bucket size on the queue to 0.01

If it works ok, do same for the other ethernet ports. (ether1 with 2.5G max-limit)
by rplant
Mon Jul 01, 2024 9:19 am
Forum: General
Topic: Specify IPsec proposal and profile for IPIP/IPsec
Replies: 4
Views: 795

Re: Specify IPsec proposal and profile for IPIP/IPsec

Or perhaps run the ipip over a wireguard tunnel.

Even better with luck might be able to just use a wireguard tunnel, without ipip.
by rplant
Mon Jul 01, 2024 8:51 am
Forum: General
Topic: Specify IPsec proposal and profile for IPIP/IPsec
Replies: 4
Views: 795

Re: Specify IPsec proposal and profile for IPIP/IPsec

So it is not possible if the peer is on dynamic IP? Yes, You can look at the ipsec setup created when you add ipsec to the ipip tunnel and make something similar. But I think ipip requires a fixed address at each end anyway. You could possibly use an ikev2 tunnel, (where the client can get a fixed ...
by rplant
Mon Jul 01, 2024 8:33 am
Forum: General
Topic: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease
Replies: 11
Views: 2285

Re: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease

You could try attaching a queue onto the LAN ethernet port you are using and see what that does. (ether2...) Make a new queue type using cake, probably near default. Create a new queue, (Queue tree) with your new queue type, attach with parent as ether2, and set with a max limit of 1G. Assuming you ...
by rplant
Mon Jul 01, 2024 8:21 am
Forum: General
Topic: Show IP of client connected to each port
Replies: 3
Views: 818

Re: Show IP of client connected to each port

You could do a tool/ ip scan, which should refresh the Arp table.

Arp entries are often only seen/updated when the router/switch needs them.
Which is rarely if running as an L2 switch.
by rplant
Mon Jul 01, 2024 8:17 am
Forum: General
Topic: PPPoE interface address
Replies: 2
Views: 516

Re: PPPoE interface address

Not sure, but possibly if you do that, it can't tell the remote end (client) what the server end IP address is. This usually doesn't matter, except perhaps if you want to ping the server from the client. (I don't know that windows likes it much though)   There is a couple of places to setup the loca...
by rplant
Fri Jun 28, 2024 4:26 am
Forum: Forwarding Protocols
Topic: WireGuard slowdown after minutes
Replies: 6
Views: 5027

Re: WireGuard slowdown after minutes

Hi,

You don't seem to have an IP address on the wireguard interface, but then you are using masquerade on that interface??

The first /ip firewall rule (I assume is filter) seems a bit doubtful.
by rplant
Thu Jun 27, 2024 9:23 am
Forum: General
Topic: RB4011 + GPON
Replies: 2
Views: 658

Re: RB4011 + GPON

You can get GPON ONU sfp modules. However you would need to get the ISP, or their wholesaler to agree to you using the 3rd party module. You would need to provide them with some information about it, perhaps its mac address and/or serial number, not sure. They can then add the ONU information onto t...
by rplant
Wed Jun 26, 2024 7:37 am
Forum: Beginner Basics
Topic: Publishing WebApp through static IP
Replies: 2
Views: 909

Re: Publishing WebApp through static IP

I assume the ISP's router is doing Nat? Or is it handing the IP address off to the Mikrotik in some fashion? If ISP router is doing NAT, it will also need a port forward (likely to the Mikrotik, possibly direct to the web server) The web app server needs to know it is running on port 8080, or more u...
by rplant
Wed Jun 26, 2024 6:20 am
Forum: General
Topic: Possible L2 MTU issues with EoIP Tunnel and Bridge
Replies: 5
Views: 1776

Re: Possible L2 MTU issues with EoIP Tunnel and Bridge

You can set both the wireguard and eoip mtu's to 1500, it becomes less efficient as the larger packets are fragmented, but they get rebuilt at the endpoint. Perhaps set the eoip mtu to 1500 and leave the wireguard one at 1420 (1420 assumes no pppoe). An alternative, you can use a mangle rule to do m...
by rplant
Tue Jun 25, 2024 1:18 pm
Forum: Beginner Basics
Topic: connecting port to the dsl modem [SOLVED]
Replies: 1
Views: 3765

Re: connecting port to the dsl modem [SOLVED]

Hi, Assuming a near default mikrotik configuration. I will make ether2 the second port. You need the ip address and netmask of the Zyxel. Using winbox (or webfig) From Bridge, Ports tab Remove, or disable the ether2 entry from the default bridge. From ip/address, create a new ip address in the same ...