MikroTik

rplant

You have to type in a speed, and it will try to get to that speed.
(You can't leave it at 0)

eg. 1M 10M 100M

rplant

Hi,
The following topic is very similar to what I think you want (except they were getting the address via pppoe)

viewtopic.php?p=1070581#p1070581

rplant

The following has their tested items MikroTik wired interface compatibility https://help.mikrotik.com/docs/pages/viewpage.action?pageId=263749679 Pretty much all their 10G optical SFP's and Dac cables are indicated to work in an L009 (in forced 2.5G mode). For low power/temperature/cost You could us...

rplant

Perhaps something like the following in the central router. /ip firewall filter #existing rules ... #following rules just before existing invalid rule. #(Put them in via terminal, then move them using winbox/webfig) add action=accept chain=forward comment="allow traffic between wg and lan"...

rplant

My Guess Assuming the internet gateway is a Mikrotik and is using something similar to the default config, asymmetric routing that might be the issue. Wg -> Lan Device and Lan Device -> MainGateway -> Wg If it is this, there are a at least a couple of options: 1. On the WG mikrotik enable masquerade...

rplant

It looks like the CRS310 won't do nat or fasttrack connections in hardware, so mostly good for inter vlan routing maybe using some access lists, much less good as an internet gateway, with Nat, Stateful Firewalling, etc. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOff...

rplant

Hi, I would also include the first routing rule below. It allows devices on your wifi subnet to connect to other local devices, and only internet bound traffic goes via the vpn. (Order matters, put it before the other rule) Note: If using winbox, you likely should have still been able to connect to ...

rplant

You need two or more different vlan's on the hex. The hex needs to have an IP address assigned to it for each vlan. The devices on each vlan need to have the hex as their default gateway. (Alternatively each vlan's default gateway/router could have a static route for the other vlan(s) pointing to th...

rplant

If the mesh router has the option to disable it's dhcp server, you could do that.

Then plug the mikrotik's LAN port into one of the lan ports of the router, and see if devices connect to the Mikrotik.
(You may need later to change the ip address of the mesh router as well)

rplant

You have to ensure that the appropriate packets don't go via fasttrack. Either by having an accept statement for these packets prior to the fasttrack rule or by disabling the fasttrack rule. One possible option (just prior to fasttrack rule) add action=accept chain=forward comment="accept estab...

rplant

Hi, A couple of points, The screenshot doesn't really show what you are doing. Mikrotik doesn't do hairpin nat by default, so it might work from outside but not from inside your network. You could open a terminal window (from webfig, up the top near rhs), and export the entire config, or just the fi...

rplant

In another thread @mkx mentioned that adjust mss will probably not work if the connection is fasttracked.
You could try and disable the fasttrack rule briefly.

rplant

Likely you are going to have to go for a ccr with at least 1 SFP+ port, and perhaps 2. eg. CCR1036-8g-2s+ if you can find one. Then how does your ISP provide you with 2Gbe, it seems like a non-standard value. If over a 2.5Gbe ethernet connection, none of the CCR 10xx series supports this directly. Y...

rplant

Have you added 10.0.2.3/32 as an allowed IP address in the Peer setting on the Mikrotik?

When you look at the peer setting on the Mikrotik are you getting updated Tx, Rx and Last Handshake values.

rplant

Upgrade the ccr2116 to the latest beta version,
generate a supout.rif while working, and another when broken.
(Assuming it's not fixed)

And submit them in the ticket.
Support are quite good, and it is one of their flagship products you are having issues with...

rplant

One thought,
Do you have appropriate firewall rules to allow gre protocol in from the remote peer?

The default rules cause Traffic wrapped in ipsec to be allowed.

rplant

Yet another possibility is broken dns.

If on windows open a command prompt,
type nslookup

And try a few sites (including some you haven't recently used)
does it return immediately with a result?

Is the dns server nslookup is using correct?

rplant

You appear to have different wireless protocols at each end.

rplant

A problem is that out of your switch, every port has both the tagged and the untagged vlans coming out of it and going into it. One Possible option would be to make vlan 1 something else other than 1. eg. 10 Then you could have vlan 20 as the untagged vlan, and vlan 10 as the tagged vlan going to th...

rplant

Sorry, not an answer but.

Pretty sure the ipsec is going to be hardware offloaded, so it is going to take minimal cpu.

rplant

Mostly the Gui is similar to the way the cli is laid out.
The switch menu is a bit different. It is a top level menu in the Gui.

rplant

I have tried (a few times) and also failed to get a 2.5g connection working on an RB4011

**edit:** Note my RB4011 is an old one, I believe they have had a couple of versions of RB4011.

rplant

In the wiki version it notes

The backup RouterBOOT version can not be older than v3.24 version.

So presumably given yours is newer than this, you don't need an upgraded backup routerboot. (so it won't let you upgrade it perhaps)

rplant

A possibility is to split the pairs and run it over a few meters, it will give lots of crosstalk and poor performance, but whether it is enough I don't know. eg. Pairs 1,4 2,3 5,8 6,7 or 1,3 2,4 5,7 6,8 (Cable terminated same at both ends) The cables will test as a simple straight cable (with a very...

rplant

It used to (at minimum) stop a lot of annoying log messages on the server, I assume it still might.

rplant

Try it in both negotiated and non negotiated mode, with each of the 3 (current) 10G settings.
10G base T
10G BaseCR
10G BaseSR LR

And see if any of them work.

rplant

Some minor changes. # cisco interface Ethernet0/0 description trunk from mikrotik switchport trunk encapsulation dot1q switchport trunk allowed vlan 10,20 switchport mode trunk #mikrotik # (Use bridge instead of ether1) /interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge...

rplant

As a switch it will have plenty of speed between your devices. However connections to the internet via your ISP will need routing with firewalling and presumably Nat. For 2.5G you will need a reasonably powerful router performing this task. If your ISP provided a router you can use it for that task ...

rplant

look at the protected bootloader section of the above document

rplant

Another thought, Partially working ipv6 can cause similar problems.

Try turning off ipv6 on the router.

From winbox
ipv6 settings tick the disable ipv6 box and wait a short while.
(May need to reboot PC if want it to update faster)

rplant

Yes, you could have used the wireless package, and the map could then connect in station bridge. Wifi package does have some niceish features though. Other options: Use Station-Pseudo bridge mode. Ok when it works, need to turn off RSTP. If you go this way and it's not behaving it is worth searching...

rplant

Yes,
If you use poe as an alternate power source, it must be passive/forced on poe or the Mikrotik may lose power when main/other power is lost. (Usually briefly but...)

rplant

A couple of options. 1. Reset the mikrotik with no default config, (but perhaps keep users), and then try to import the file. 2. Open the file in notepad or similar and copy and paste a section at a time into the terminal. You might be wise to compare the current default config to the config you wan...

rplant

I think documentation means devices with version 7 factory firmware, but less than 7.6 get upgraded to a v7.6 factory firmware with protected router boot function. Devices with older (v3, v6) factory firmware get an updated factory firmware (not v7) which has the new protected router boot function. ...

rplant

You can probably enable dhcp relay on the appropriate switch vlans.
And have your dhcp server managing the vlan (remotely).

rplant

You could set it up with the CRS317 as the gateway for both VlanA and VlanB The CRS ROUTES packets from vlanA and vlanB to the router. (and between vlan A and vlan B) No firewall rules needed on CRS for internet traffic, so should be L3WH offloaded, (with very few if any ACL's) Rules/ACLs, mostly fo...

rplant

A couple of thoughts, The following statement doesn't really seem helpful given your current results, but anyway: Mikrotik doesn't by default do hairpin Nat (you need to add the appropriate src-nat rule), so if you are testing from inside your network it will likely not work. You could download tcpr...

rplant

Hi,
License wise:
Not sure there is a limit for raw ipsec.
There is a 500 user one for l2tp.

However, the processor on the RB2011 doesn't do ipsec hardware encryption, and does not have much Ram.
So really only a couple maybe. You would be better off with wireguard with the 2011.

rplant

When a road warrior client from router 1 is connected it can not reach ip's behind the nat of router 2 (which is possible from within router1 main network (and the other way around). Assuming there is no NAT going on. (ie. The packet from 192.168.35.1 reaches device on router 2 as being from 192.16...

rplant

Hi, I think you could start by checking the counters on the dst-nat rules, and see if they increment. (They happen early in the firewall) Typically they will only increment once for each new connection. If they are incrementing, you need to check the 10.0.0.39 (I assume nginx) Perhaps if not increme...

rplant

Fair enough, Perhaps your option 2 would be a good option, you then effectively have a site to site tunnel, and can tunnel whichever clients you want. Option 1 is doable and will most times be fairly well upgraded. However it is not perfect. (Make a script export and a normal backup onto external st...

rplant

I would recommend you experiment with wireguard.
(Even if just for this particular instance)

rplant

You could possibly add a src-nat rule something like

/ip firewall nat
chain=srcnat dst-address=171.11.153.20 src-address=192.168.1.0/24 action=src-nat to-addresses=171.11.153.21

Move it up above any masquerade rules already there.

rplant

For generic case, perhaps not. (maybe a container?)

But for a single source ip sending data, you could probably use a dst-nat and src-nat pair of rules, to send the traffic back.

rplant

You can run your eoip or other tunnel inside wireguard. Though I would perhaps attempt to set up ipv6 and associated routing on the Mikrotik manually, using one of the /64's. You would maybe need to somehow mark the prefix as used though, so the VPS does not try to reuse it. You might need to put (n...

rplant

beep twice usually means it thinks it is ready to start running. You could try connecting to it via wifi, it may have some mikrotik-XXXX ssid with no password. If it is similar to a map/wap, then Wifi is often the only way to connect to this type of device when factory defaulted, but usually the eth...

rplant

I would also suggest you get a Low ESR capacitor (as well as of 105° type).

rplant

fs.com have a few rj45 sfp+ modules.

They range in power consumption from 1.8W to 2.9W
Apparently the S+RJ10s is around 2.7W, so the 1.8W one might be good.
(but quite pricey)

Sorry I don't know how well or hot it works, or if it will work with a Mikrotik.
though fs is usually well supported

rplant

It sounds like you are trying to restore a binary backup file to a new router. That rarely works :( You could search your hard disk for .rsc script files. If you can login to the old one at all (though it sounds unlikely), do a /export, stick it onto your laptop, and manually carefully copy the conf...

rplant

I tried it running with 6.49.13, and that was much improved.

Unfortunately doesn't have the cake queues, but the other queues I tried
seemed to handle 1G ok.
CPU still seemed to be largely locked to 1 core, and still needed multiple streams
or large window to get to 1G ish.

rplant

I had a try with some of this, just to a local iperf3 server. So very little latency unlike over the internet. I found I had to disable the queue tree for best performance. To hit near a gig download I had to have a large window size, or multiple streams. Perhaps partly a limitation of the iperf3 se...

rplant

Hi, It seems unlikely to be good for a 1G connection, Apparently a single connection will only use 1 core. (To reduce out of order packets) From: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults The commonly used 25 IP filter rules, and 512 byte packets lists 452Mbps. Your actual perform...

rplant

Yes there have been many many sfp fixes, and complaints of devices that used to work that no longer do. You could get install the latest betas at both ends (including updating routerboot), and assuming it is still not working create a supout.rif and send to support at mikrotik.com The -40db is a wor...

rplant

The S+RJ10 plugs into a 10G sfp+ interface.
The L009 has a 2.5G sfp interface.

rplant

That feels like a bug.

I think the Mikrotik radio should likely have its own multicast subscriber list and send it to only its subscribed stations.

rplant

I gain the impression that the S+RJ10 still runs quite warm, as its backend has to be run at approx 10.3G
(whether connected on the RJ45 side at 1G, 2.5G, or 10G)

While an actual 2.5G unit's backend runs at 2.5G (* 10/8).
(Whether connected on the RJ45 side at 2.5G, 1G or lower speeds)

rplant

Winbox:

Perhaps under ethernet tab for sfp, turn off auto negotiation and set speed to 1G Base X
at both ends.

Make sure fibre is correct, (looks to need single mode fibre)

rplant

I found out empirically that if you turn off the interfaces and peers on both routers for 10-15 minutes and then turn them on, everything works. I think I have seen something similar in the past, if you turned off the wireguard interface and then turned it back on it fairly soon after. It didn't se...

rplant

Sorry, don't know. However I would turn off the persistent-keepalive on router-B. Perhaps trying to connect back to the IP/Port it was last connected too is doing something. Also, you can check the counters on the firewall rule on Router-B, and see if packets are actually getting in, enable logging ...

rplant

I have in the past done the following

/ip arp
add address=192.168.44.252 interface=bridge-local mac-address=\
FF:FF:FF:FF:FF:FF

I was using it for Wake on Lan.
To any device on the 192.168.44.0/24 network

** Edit: on review, this is an answer to a different question

**

rplant

My guess is that it is doing what it is supposed to, but perhaps imperfectly.

The spanning tree needs reconfiguring, and it does this, but some looped packets get through.
But it seems to resolve quickly.

rplant

Usually means you have overlapping allowed addresses on your peer configurations. This is an error. If this what you actually need and want, (eg. you want to use ospf to the peers and route via the ospf chosen link, etc) You need to have multiple wireguard interfaces with one (overlapping) peer per ...

rplant

Hi, I have a dhcp-client script that changes some of the routes. /ip dhcp-client add default-route-distance=70 interface=ether2 script="/ip route\r\ \n:if (\$bound = 1) do={\r\ \n set [find where comment~\"altgw\"] gateway=\$\"gateway-address\"\r\ \n}" I also find it be...

rplant

Perhaps get a hap ac2 as a gateway router in front of the switch at the home end.

Then you can have hardware offloaded ipsec at both ends if you want that.
Or wireguard. (I like wireguard, but hardware offloaded ipsec can be quite fast)

rplant

You should perhaps change the bucket size on the queue to 0.01

If it works ok, do same for the other ethernet ports. (ether1 with 2.5G max-limit)

rplant

Or perhaps run the ipip over a wireguard tunnel.

Even better with luck might be able to just use a wireguard tunnel, without ipip.

rplant

So it is not possible if the peer is on dynamic IP? Yes, You can look at the ipsec setup created when you add ipsec to the ipip tunnel and make something similar. But I think ipip requires a fixed address at each end anyway. You could possibly use an ikev2 tunnel, (where the client can get a fixed ...

rplant

You could try attaching a queue onto the LAN ethernet port you are using and see what that does. (ether2...) Make a new queue type using cake, probably near default. Create a new queue, (Queue tree) with your new queue type, attach with parent as ether2, and set with a max limit of 1G. Assuming you ...

rplant

You could do a tool/ ip scan, which should refresh the Arp table.

Arp entries are often only seen/updated when the router/switch needs them.
Which is rarely if running as an L2 switch.

rplant

Not sure, but possibly if you do that, it can't tell the remote end (client) what the server end IP address is. This usually doesn't matter, except perhaps if you want to ping the server from the client. (I don't know that windows likes it much though) There is a couple of places to setup the loca...

rplant

Hi,

You don't seem to have an IP address on the wireguard interface, but then you are using masquerade on that interface??

The first /ip firewall rule (I assume is filter) seems a bit doubtful.

rplant

You can get GPON ONU sfp modules. However you would need to get the ISP, or their wholesaler to agree to you using the 3rd party module. You would need to provide them with some information about it, perhaps its mac address and/or serial number, not sure. They can then add the ONU information onto t...

rplant

I assume the ISP's router is doing Nat? Or is it handing the IP address off to the Mikrotik in some fashion? If ISP router is doing NAT, it will also need a port forward (likely to the Mikrotik, possibly direct to the web server) The web app server needs to know it is running on port 8080, or more u...

rplant

You can set both the wireguard and eoip mtu's to 1500, it becomes less efficient as the larger packets are fragmented, but they get rebuilt at the endpoint. Perhaps set the eoip mtu to 1500 and leave the wireguard one at 1420 (1420 assumes no pppoe). An alternative, you can use a mangle rule to do m...

rplant

Hi, Assuming a near default mikrotik configuration. I will make ether2 the second port. You need the ip address and netmask of the Zyxel. Using winbox (or webfig) From Bridge, Ports tab Remove, or disable the ether2 entry from the default bridge. From ip/address, create a new ip address in the same ...

rplant

Try enabling "Ignore Rx LOS" and see if that helps.

If not, make a supout.rif while broken, running on 7.16b2 and send it to Mikrotik support.

They have been making many changes to the SFP code...

rplant

Assuming near default Mikrotik configuration. Likely option is you need to make the openvpn client interface on the Mikrotik a member of the LAN interface list. The following seems likely already done, you need to have routes on the Asus telling it the mikrotik lan network IP's are via the openvpn c...

rplant

Hi, Check the counters on the following rule. /ip firewall filter add action=accept chain=input comment=Wireguard dst-port=54321 protocol=udp If when you try to connect via mobile, it doesn't increment at least the once it cannot work. You could try changing the port. Other things to check (Once the...

rplant

Make sure that Vlan832-internet is a member of the WAN interface list.
Double check that bridge is a member of the LAN interface list.

Disable your first srcnat rule.
(Can try reenabling it once you have it working)

rplant

The following might help

viewtopic.php?p=1070581#p1070581

Though now days, the hex is not super quick either

rplant

ip firewall, choose connections tab, then click on tracking button.

rplant

Fairly sure that mpls requires a layer 2 equivalent under it, which gre isn't.

You could perhaps use eoip, or vxlan.
Not seeing a lot of point of then running mpls over these.

You could run these 2 protocols over wireguard or ipsec (I like wireguard)
sstp is good, but not very performant.

rplant

Have a look at wireguard, it is very good, and handles NAT well.

You will likely need something brisk for 20-30 clients at a good speed.
Perhaps an RB5009 (or low end ccr) would be a good starting point.

rplant

Hi, I have seen a post for something maybe similar, where the solution was to make the queue on ether1 a multi-queue-ethernet-default queue. (Assumes ether1 is internet) (Maybe you could try multi-queue-ethernet-default on the other interfaces as well) If this doesn't help: You could perhaps experim...

rplant

There have been other questions about the 10GTek device, perhaps this might help. https://forum.mikrotik.com/viewtopic.php?p=1067590#p1067590 I have not used this sfp module, (or the css switch), but I find on their routers, using 1G base X is a good choice for connectivity. Also there have been a l...

rplant

Hi,

You can try using sni

search for tls-host in the following
https://help.mikrotik.com/docs/display/ ... nd+Actions

Unfortunately, sni inspection is becoming unavailable with the advent of TLS 1.3, so is working less and less well.

rplant

Hi The following has the list of devices with assorted compatibilities, including 2.5G https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility It doesn't (currently) list the CCR2004-16G-2S+ as being compatible with 2.5G, but does have a different CCR2004 device listed. The...

rplant

You could try something like

/ip firewall mangle
add action=mark-routing chain=output new-routing-mark=YOUR_ROUTING_MARK passthrough=no protocol=gre

From a security point of view it would be far better to swap your pptp for wireguard.

rplant

Hi,

On the wifi, I would enable multicast helper (ideally to full, but perhaps dhcp would be more compatible)
and probably enable multicast buffering.

Also on the bridge enable igmp snooping.

See if that helps.

rplant

Hi, For not double NAT. If you can change the ISP router, you may be able to add a static route to it. 192.168.88.0/24 via 192.168.1.2 Then from anav's config, change all the WAN interfaces to LAN and let the ISP router pretty much do all the Natting and external firewalling. /interface list members...

rplant

A similar problem here (and solution).

viewtopic.php?p=1045608#p1045608

rplant

There have been other questions about the 10GTek device, perhaps this might help.

viewtopic.php?p=1067590#p1067590

rplant

Not sure, but

1. They should be using src-nat rather than masquerade
2. dst-nat rules are same on both routers

rplant

I have a working SF.Com passive DAC which also gives a connector type of copper pigtail.

Perhaps it can't (or doesn't) tell the difference between AOC and Passive (or active) Dacs.
They all use the same copper/active/OM4 link length field.

rplant

Another thought, perhaps there is some queues configured. I trialled a basic gre tunnel from a 4011 to a hap ax3, Edit: was incorrectly fast path (all fast track and about 2 meters of cable), and tested a bidirectional btest over the gre link at 300M in both directions from my PC through the 4011 (g...

rplant

Your mtu of 1476 on the at&t service seems highly dubious. I believe the default MTU for at&t it is 1500. (But I could easily be wrong) 1476 matches the normal mtu of a gre tunnel. (Inside a normal 1500 mtu ethernet connection). Then also 1420 seems odd, (looks maybe like an mtu for ipsec en...

rplant

SMTP is often blocked at the ISP level.
You likely need to jump through at least a few hoops before you can use it as a mail server.

rplant

Private vlan might be a good option.
(Done in hardware)

https://help.mikrotik.com/docs/display/ ... rivateVLAN

rplant

Hi,
You probably want the private vlan feature.

https://help.mikrotik.com/docs/display/ ... rivateVLAN

rplant

You need to have correct time/date/timezone on the mikrotik.
You need to specify number of days valid. (eg. 730 for ~2years)

rplant

One possible option: Configure the router with a separate /32 subnet and interface with device A plugged into it. (Assuming router described is Mikrotik, Probably just remove ETH1 from the bridge) This subnet/interface is added as a member of the LAN interface list. (And removed from WAN interface l...

rplant

I think you would be better off using a Mikrotik at both ends.

However, the following may be useful:

https://www.henrychang.ca/how-to-setup- ... n-windows/

rplant

Hi, I thought about this for a while. It would be easy enough to run 2 VLans through from the hap ax2 to a managed switch or other Mikrotik at the gpon end, and then another cable from there to the TP-Link (or if that cable is also not possible, yet another managed switch at the TP-Link location. Ho...

rplant

Example basic setup, my thoughts NOTE: ** I have no experience with CRS so consider with care ** vlan2 + 192.168.2.1 -- Other Devices on vlan2 | TPLink 192.168.1.1 - vlanbase - CRS 192.168.1.2 -- Other Devices on vlanbase | vlan3 + 192.168.3.1 -- Other Devices on vlan3 TPLink (or other suitably powe...

rplant

You could also try turning off bridge fastpath in bridge setting
That caused me some issues a long time ago.

rplant

Yeah, that makes sense.

I think with this option it might be advisable to change the default masquerade rule
to a srcnat rule with to-address of 155.13.35.202

Otherwise, it could possibly choose either ether1 address for the masquerading.

rplant

Hi,
If you only need 2.5gb, then you can get a 2.5gbe sfp/rj45 device, which runs at a reasonable temperature.

One option: https://vi.aliexpress.com/item/1005005392025773.html

Note: This needs to be run at 2.5g base X which is available for the RB5009, not so much currently on RB4011 which I have

rplant

USB Sticks for container store, general storage, Dude Storage Ethernet Adapters (some): Additional ethernet port Serial port adapters (some): Terminal access, Remote Serial port facility Discontinued Woobm (wireless USB serial port) was kind of good could get you out of trouble when you locked yours...

rplant

Assuming something near a default configuration I would create a new bridge, perhaps call it bridgewan2, turn off rstp on this new bridge. It is only to hold ip addresses. /interface bridge add name=bridgewan2 protocol-mode=none Create a new IP address on this bridge 155.133.35.203 network 155.133.3...

rplant

Hi, https://mikrotik.com/products/group/ethernet-routers I think an RB5009 would likely do what you need. Or scroll down for faster, better performance, more features. Probably skip the RB1100A's, as they are an older generation, similar to the RB4011 but with more storage. Presumably you are going ...

rplant

Some thoughts: It looks like you are not using ipsec, is this correct? From windows, you need to subtract 28 from your length of ping, (Windows makes the data in the packet that big, then has 28 bytes of IP header on top). So for a 1500 byte mtu, ping -f -l 1472 51.x.x.232 If the MTU the router thin...

rplant

Does it really need to be bridged?

Putting the wired client(s) behind a Nat would be good.

rplant

I would assume that this is displaying the information from ip firewall connections. (but could easily be wrong) Another option is the kid control which will apparently give statistics. Unfortunately I have not used it. Also you can create (with a script), a bunch of simple queues, one per LAN IP ad...

rplant

Cool, On review, I have some reservations about the following though /interface bridge vlan add bridge=bridge1 tagged=bridge1,ether3,ether4 untagged=\ ether2,ether5,ether6,ether7,sfp-sfpplus1 vlan-ids=10,20,30,40,50 I think you should remove the untagged= section. I am fairly sure the pvid=10 on the...

rplant

It feels like an MTU/ mss issue. Can you ping the remote end with 1400 byte packets over the link. /ping something-at-other-end-of-tunnel do-not-fragment size=1400 You could add some mangle rules to change the mss of tcp syn packets that leave or enter router using the IKEv2 policies. (1360 seems co...

rplant

You can put your outbound queue on ether1, and your inbound queue on bridge.

Then you should be able to fasttrack it.

You probably need to set the bucket size in the queue to 0.01 (or maybe less)
Also need to add no-mark and all other packet marks you use to these two queues.

rplant

Hi, I assume you are using 1G baseX at both ends. Auto negotiation turned off. It should work, all parts have been tested from here: https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility You may need to upgrade your routeros and routerboot if you haven't already, (probabl...

rplant

One other thought. If using ipsec, and there is Nat translation,

I think it is uses transport mode, which will likely only work for
1 client per public ip address for GRE.

wireguard is good

rplant

If using ipsec, possibly worth looking at the installed SA's and check it is using hardware encryption. /ip ipsec installed-sa print Flags in the second column, H for HW-AEAD Also your dst-nat rule, perhaps restrict it to in-interface=gre-2 The mangle rule, forces all packets from the specified addr...

rplant

Yes, I like your diagram, what did you use to make that? One relatively simple option is to put the lte device onto the vlan 10 IP range, (no dhcp server enabled on lte device). Eg. 192.168.1.10/24 Then put a src-nat firewall rule onto the Router for all traffic going to 192.168.1.10 And a default r...

rplant

The brass fold down tab is likely to lock the rj10 device into the sfp slot.
If you can pull the rj10 out of the slot without unlocking the tab you need to move it
to the locked position.
Seems unlikely to be the issue with the ethernet cable coming out.
Perhaps try another ethernet cable.

rplant

Note:
If your client is a Mikrotik or other router, you will likely need to add some static routes into it.
Ordinary clients will automatically set up routes from the allowed ip settings.

rplant

If your server is on the 192.168.88.0/24 range Try to ping 192.168.88.1 from your wireguard client. If this doesn't work, 192.168.88.0/24 likely needs to be added to your wireguard client configuration. When this is working, try to ping your server from your wireguard client. If this doesn't work: T...

rplant

Hi, If you have set it up as dmz of your existing router, you should probably rethink your firewall rules completely. and quickly. Go back to factory default rules and add your changes. You seem to have no block rules, so devices on the internet can presumably access the Mikrotik with no restraint. ...

rplant

Hi,

One option is to have multiple wireguard interfaces with one peer each.
Each peer can have 0.0.0.0/0 allowed address.

And then use ospf to route over them.
Can use ospf directly over the wireguards in a point to point mode.

rplant

/interface list member
add interface=WG-Cloud-BLR list=WAN

Possibly also
Change the wireguard MTU on the 5009 to 1412 (because its inside pppoe)
Add a persistent keep alive on the 5009 (somewhere 25-60 seconds is likely good)

rplant

Not sure,

A couple thoughts.

1. Add the pppoe Interface to the WAN interface list.
2. Disable/remove dhcp client on ether1 if it is still present.
3. Reboot the router (maybe something is remembering something from prior to disabling detect internet)

rplant

In other sort of vaguely similar situations, RSTP enabled can result in DHCP (and other) issues.

rplant

Filtering dst-nat ed packets seems to work ok here. One guess: If you copied and modified the default defconf: drop all from WAN not DSTNATed rule and edited it. You need to remove the connection state (! dst-nat) setting from your new rule. Also: You should be using a newer version of RouterOS, (an...

rplant

One solution Set up a route table to go via wireguard, and route entry to go via the wireguard interface. /route table add disabled=no fib name=ViaWG-Cloud /ip route add disabled=no dst-address=0.0.0.0/0 gateway=WG-Cloud routing-table=ViaWG-Cloud Then for setting up the routing of specified IP Addre...

rplant

I trialled this at home, and it looks like theCat12's solution is likely the correct one. I connected to a device behind the Mikrotik, and the first couple of packets went via the main gateway, then the main gateway set an icmp redirect for host, giving the ip address of the Mikrotik, and after that...

rplant

If you are using OSPF, all OSPF neigbours (of that interface) will also need to have an mtu of 9000.

Thought not sure why you can't connect to it via IP.

rplant

You could try the following: 1. Backup your current mikrotik config, because this may not work... Change the Mikrotik's wan1 interface to be a Lan interface. (Default config would involve removing from WAN interface list, and adding to LAN interface list) Change the IP address on the Lan interface t...

rplant

You could use OSPF, and set a higher metric on the LtAP. (both on local route table via pppoe client config, and OSPF) OSPF metric setup is non obvious (v7) Part example is: https://forum.mikrotik.com/viewtopic.php?t=181118 Mine wound up as: /routing filter rule add chain=ospf-metric rule="if (...

rplant

Also:

If you have the default firewall fasttrack rule in place, you need to have an accept rule prior to this rule
for the packets using the via-vrrp1 routing.

(or turn off the fasttrack rule)

rplant

Hi, You need to be a little bit careful how you mark your routes. If they are marked with via-vrrp1, they WILL use routes using table=use-vrrp1 I would tend to force it to go via routing rules. ip/firewall/mangle/ chain=prerouting action=mark-routing new-routing-mark=rule-vrrp1 passthrough=yes in-in...

rplant

Hi, Some options. Option 1 Push a route to the client (or set it up on OVPN client) of 192.168.10.0/24 via the existing OVPN connection. Then let the (presumably existing) configuration on the Mikrotik route and NAT this to the 192.168.10.0/24 Mikrotik WAN network. The next couple Both basically inv...

rplant

Perhaps netinstall, that often seems to fix assorted "weird" behavior.
(It reformats and bad blocks the flash as part of the operation apparently)

rplant

It looks like the lan sfp2 is not running. In winbox, double click on the sfp2 and check its link status. What is it connected too? If a 1G DAC or optical device you possibly need to force it to 1GBaseX, or at least include 1GBaseX in the Auto negotiation settings in the ethernet tab. if 10G probabl...

rplant

Perhaps add the wireguard interface to the Lan interface list.

rplant

The following are a couple of options. /ip firewall nat chain=dstnat dst-address-type=local in-interface=ISP3 protocol=udp dst-port=wg-port action=dst-nat to-addresses=ip.of.ISP.1 OR /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table...

rplant

Incorrect public key at one or both ends seems to be more common than it should be.
Time/Date at both ends need to be near each other.

You can put in a firewall rule with log enabled on the outbound port as source port, (and interface), to see if anything is leaving for the
remote device.

rplant

But there is. You just have to go to PPP -> Profiles, and make a new one (or a copy of default)

Yay, Thank you

rplant

Not sure, Check that the firewall rule with 500,4500,1701 is counting. Perhaps split it into 3 rules, so you can see if you are getting all three counting (when coming in via isp router) Some ISP routers are annoying with ipsec, and need fiddling to get them to pass it through properly. There is nor...

rplant

Also i missed something in the last post. You need to also add a route to your public ip in the "vrf-lan" instance. add dst-address=<public ip> gateway=ether2@vrf-lan routing-table=vrf-lan A problem that could also occur is, if you have a dynamic IPv4 address via pppoe because the the dhc...

rplant

Hi, If you are using a windows laptop to connect to your l2tp server, it won't work. Windows doesn't like natted L2TP server endpoints. (unless using certificates) There is a registry hack to make it work. If there is only one person (or less good a very trusted few) know the ipsec password/key it s...

rplant

Hi, Check: https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility I have a FS.com 10G DAC which works well (but is not supported) between a 4011 and a 3011 with the 4011 forced to 1G, and is also working well between the 4011 and a 10G sfp+ on a non Mikrotik switch. Virtua...

rplant

I think at this point you know far more than me about vxlan, fragmentation. But anyway... where are you seeing this configuration? dont-fragment (disabled | enabled | inherit; Default: disabled) (default disabled looks correct) I'm not finding anythign allowing for packet re-assembly on mikrotik. I ...

rplant

Possibly worth looking at and comments surrounding

viewtopic.php?p=1063801#p1063801

I like the hap ac2, though with current routeros versions you will likely need to disable and remove wifi packages.

rplant

vxlan has an option to override/force allow fragmentation. It might need working pmtu to work correctly?

rplant

I have seen posters having success using vxlan, apparently it runs multi core and supports fast path. If the above works, For later experimentation: You could somehow have the encrypted traffic in the internal network(s) use bigger than 1500 sized packets. (say 2800+) And let them be fragmented over...

rplant

A few (hopefully some helpful) thoughts. If your hub is using pppoe, you will need to reduce the size of the wireguard vpn to 1412. (assuming MTU/MRU of 1492) You should probably also have the MSS setting for traffic coming in from the wireguard vpn, and perhaps use PMTU MSS. (rather than fixed size...

rplant

Not much to go on there. So per @anav /export file=anynameyouwish (minus router serial number and any public WANIP information, keys etc. ) However I will also make a guess. You need to limit the traffic that gets fast tracked. eg. Just before the fasttrack rule. /ip firewall filter .... add action=...

rplant

You can currently 7.15beta8 do the following, (it seems harder than it was) Add a dhcp client for some other interface. (Make a bridge if necessary) Save the new dhcp client and disable it. Then with the lte device plugged in Change the newly created dhcp client to use the lte1 interface (keep it di...

rplant

Wireguard port (Really only applies to server), often for Mikrotik 13231 /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main Just an easy way of making all routes that are not 0.0.0.0/0 use the main routing table This is often a ...

rplant

You could perhaps script it with some sort of netwatch or similar script, that if can't connect, after a while it removes the 1G advertisements. (Ideally on the nearest to management end, though unfortunately it looks like you would have to do it on the remote end routers) Though if you are putting ...

rplant

On the Mikrotik can you ping 10.81.234.129? On the Mikrotik can you trace route to 10.0.10.119, do you see the intermediate hops? If so, perhaps 10.0.10.119 doesn't respond to pings (from non local subnet)? Could you ping this IP when connected via your computer? You could add openvpn to system/logg...

rplant

At least a part of the problem is that if/when packets/connections are marked coming into the wireguard port, responses, etc are not marked when leaving from the wireguard port. Routing rules do work. (And you then don't need to mark anything for wg routing purposes) However if you have dynamic IP a...

rplant

You need to have some limits on the queue.
eg. max-limit=50M

Also, if marking packets, probably need all possible marks.
Perhaps if use cake for queue, won't need any marking.

Possibly set queue bucket size=0.01

rplant

The network and address should be different for a /32.
for /32 Address is local ip address, network is remote end ip address.

rplant

Cool, well done, with much patience...

rplant

A couple of thoughts.

1. Plug the port into a 100M something, does it connect, and work?

2. Set auto negotiation, include 1000 base-x in the list of negotiation items.
(Or even have it as the only item)

rplant

Hi, One possibility is that you create an IPv6 dhcp client, and attach that to the pppoe client interface. With luck you can check prefix and address items and will get both. If you require prefixes (which you probably will) It will require a pool name (which it will auto create) And a prefix length...

rplant

Hi, You can under system logging add an l2tp entry, to get a bunch more logging that might be helpful. /system logging add topics=l2tp I think you will need to change (or remove) the max-mtu and max-mru settings. Perhaps you could set up mrru with some value maybe >1518 (if the provider supports thi...

rplant

Hi, The following is only if you are running the Mikrotik as a Bridge Device inside your ISP router LAN. Acting as a Wireguard server for remote clients, (and possibly not doing much else) Note: Many of Anav's comments still apply. (If you are doing something else, please ignore all this) 1. Give th...

rplant

Cool...

One thought about the randomised password, you could connect your laptop to the airport using wps and once connected.
From a command prompt use:

netsh wlan show profile /?

View the password, is it the same (if different my guess is that it will probably some function of mac address)

rplant

Literally all I did and voila, it all worked, no changes needed. Is that normal for RouterOS/RB5009? I've only had it a week. Most things work immediately, but there is a small number (Mostly I seem to find by trial and error) where a reboot is required. Perhaps where some service now needs to be r...

rplant

One possible option is a second eoip for the link over ether4. Ether 4 will likely have a different IP address, that the existing main campus eoip doesn't know about. You can then have both links running and use rstp or similar to prevent loops. Other options might be to setup an l3 vpn (road warrie...

rplant

Make the input action for 1900 and 2828 accept and log (for all devices) initially.
Mostly just to see if they count, and what is attempting to send UPNP packets.

Then Reboot the router.

rplant

I think adding a masquerade rule to the bridge for traffic from the wireguard interface is needed.

/ip firewall nat
add action=masquerade chain=srcnat comment="wireguard: masquerade" \
    out-interface=bridge src-address=192.168.100.0/24

rplant

You can see ram used, cpu use, disk used/free space (and other stuff) /system resource print Another couple of cheaper (but less good) router options are: (Note: You can disable, and with current V7 actually remove the wifi/wireless packages) Hap AC2, - CPU quite a bit faster than hex - Only 128M Ra...

rplant

Hi, I thought about it some more, perhaps the following might be useful. Make a backup, and export of your current config. Trawl through the export from 1, and make sure there are no dubious scripting entries (system scripts, system scheduler, perhaps dhcp/pppoe scripts) either unknown or (now) inco...

rplant

Hi, Sorry I don't know what the problem might be, apart from that I don't think you shouldn't be attempting this in the first place. The CPU isn't very powerful, has no ipsec hardware offload and when you overload it, the switching management functionality will likely suffer. You could try wireguard...

rplant

For the mirror interface, there is also the possibility of using the Switches mirroring function.
(Needs to be a router with a switch chip which is many/most of them)

Need to ensure the destination port is on the same switch as the source port.
In cases where the router has more than 1 switch chip.

rplant

in https://wiki.mikrotik.com/wiki/Manual:IPv6/DHCP_Client it mentions an options array as being one of the variables supplied to the script. This looks like it might actually be present but using it will take some effort/ may not be doable. It appears to mostly be binary. my script /log info $options

rplant

Yes it is possible. Ideally use Winbox, or webfig to configure the router. Non optimal solution, (but likely near enough) Summary Add a new 2 port bridge for Wan connection, create and connect a pppoe client to it. Roughly what I would do: Starting from the Mikrotik default configuration with a rece...

rplant

Ammo's suggestion appears to work. I made a new bridge, added an IP address to it, put a dst-nat rule for the wireguard traffic to listen on a different port, and forward to the new IP address, and correct wireguard port. Then routing rule to route from new IP address to wan via correct table. /inte...

rplant

Assuming the Mikrotik's LAN/Bridge address is 192.168.0.xx/24 perhaps apply a src-nat masquerade rule to the LAN/Bridge interface. Unfortunately, this will result in the PLC's not knowing what real IP connected to them. You will likely need to enable Logging on the dst-nat rule, so you can, when nec...

rplant

Hi, I think you possibly need to revert to the previous separated configuration for the 4011 that connected and worked with the phones. It has the firewall rules you need and want when having an external facing Wan interface (which is what the voip pppoe interface is) From there, you just need to re...

rplant

Hi, I am not sure if what I am about to describe aligns with what you want to do, but. Outline: Slave the RB4011 to the UDM Pro for internet access, but keeps voip wan. Phones are setup to use the RB4011 for their default gateway and DNS Everything else continues to use the UDM Pro for their default...

rplant

Use Anav's config, it seems likely more flexible.

One minor change
(10.2.0.1 seems to be the IP that protonvpn uses for its end)

/ip address
add address=10.2.0.2/30 interface=WG0 network=10.2.0.0

rplant

If you have an older device that runs the wireless package, you could experiment with that. It has a lot more tweaky options.

rplant

One issue with the above is that there is no DNS available when wireguard is turned off.

You could perhaps add 8.8.8.8 and/or 1.1.1.1 as dns servers

rplant

I think your best option is to reset to the default config and work from there. Once reset, You can choose from the following as suits your requirements. Set up the name for the Router Set up the password for the Router. Set up your wireless as required. /ip services, Turn off unneeded services (I r...

rplant

Perhaps set the mac address of the wifi interface to the same as the airport and see if it likes that.
(Turn off the airport)

rplant

This is worth looking at:

viewtopic.php?t=182046

I would be inclined to setup static neighbors to the wireguard peers.

rplant

Sorry for the amount of text here. My thoughts. 1. You likely need to take some care with your customers networks. 2. The VPN connection to your server should look like a WAN interface to your client, - ie. Your clients can connect to your server. - Your server can't open connections to devices on ...

rplant

Well Done :)

rplant

Hi, My thought is that you might be better with a different router that has a different switch chip. (eg. A Hap AC^2) With these switch chips, you can set the bridge to be fully hardware forwarding, using switch rules to kick selected switched packets to the CPU. (It then hits the bridge configurati...

rplant

Commonly the MTU for pppoe is 1492, Some ISP's do seem to require 1480 though. If you have any max-mru, max-mtu set in your pppoe client you could remove the settings, see if anything changes. You could also try setting them to 1492 (or even 1500, though this is very unlikely to work) See what the m...

rplant

Another possibility If you have a routing entry like: /ip route add comment="via wireguard" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 or (not better) /ip route add comment="via wireguard" disabled=no distance=1 dst-address=0.0.0.0/128 gateway=wireguard1 add ...

rplant

You can make a dhcp server network entry for the specific static ip address,
with required dns server, etc.

rplant

Check here: viewtopic.php?p=1025978#p1025970

Try to change bridge protocol from rstp (default) to none.

rplant

Needing the raw rule, might indicate some sort of dubiousness. You could fix the port your MT client connects from, (in the example below 13231) Add the following rules, enable them and see what gets logged, and how/if the counters count. (Alternatively, set the firewall rules below to log packets t...

rplant

Assuming Site B is acting as a client to Site A with Wireguard connected over IPv6, it seems like it should work.

Site B has keep-alive configured?
The static route you talk of is for 192.168.1.0/24 via Wireguard1?
You have appropriate black hole routes or filtering for 192.168.1.0/24 otherwise?

rplant

Perhaps you installed the newer wifi package onto the hap ac2?
It is not compatible with that capsman.
You need the older wireless package instead.

(If it was also running 7.12.1, it would only have the old wireless package)

rplant

For Mikrotik's S-RJ01 they have the following note: Use these modules only with auto-negotiation enabled, forced link speeds are not supported. They will negotiate to correct duplex and highest possible rate. I would suggest you also do this. Also, try plugging the other end into a normal ethernet p...

rplant

Some possible reasons.

The destination IP address or port is wrong.
One (or both) of the Public keys is wrong.
The clock is wrong.

Perhaps your government or ISP blocks protonvpn.
(I would assume you would know if they did though)

rplant

Perhaps a router between you and the target router is doing NAT, so the target router is not seeing a 192.168.121.x IP address?

rplant

Unless you have disabled this option.
The Mikrotik woobm is handy for this scenario.

Plug into the usb port, looks like a serial console interface to the Mikrotik.
Connect to it wirelessly from your laptop.

Search found 472 matches