Community discussions

MikroTik App

Search found 616 matches

by rplant
Wed Apr 02, 2025 1:18 pm
Forum: Beginner Basics
Topic: CRS326 powerful enough?
Replies: 12
Views: 744

Re: CRS326 powerful enough?

I think in very recent versions, a pvid=10 sets the untagged vlan to 10, and you don't need or want anything else. You can't add an ip address to ether23 when it is part of the bridge. (In this case with no other vlan membership you would add the address to the bridge) All ports with the default vla...
by rplant
Wed Apr 02, 2025 5:56 am
Forum: Beginner Basics
Topic: Returning Newbie :) - Optimizing Bandwidth Config
Replies: 7
Views: 784

Re: Returning Newbie :) - Optimizing Bandwidth Config

I struggle with SwitchOS and find the diagnostics on RouterOS well worth the extra complexity. For a 2 CRS326 scenario, I was thinking perhaps the 2 ports to the TrueNas could be part of the redundancy scheme. If not perhaps a 2 cable etherchannel between the 2 CRS's for when the fibre link between ...
by rplant
Wed Apr 02, 2025 5:08 am
Forum: Beginner Basics
Topic: CRS326 powerful enough?
Replies: 12
Views: 744

Re: CRS326 powerful enough?

If you have a FB as a gateway firewall router, you may be able to use the CRS326 without any additional routers. You will need to add static routes in the FB so it knows that you have additional IP address ranges inside your LAN. And it should then NAT traffic from these additional IP ranges ok. I a...
by rplant
Mon Mar 31, 2025 3:15 am
Forum: Beginner Basics
Topic: Returning Newbie :) - Optimizing Bandwidth Config
Replies: 7
Views: 784

Re: Returning Newbie :) - Optimizing Bandwidth Config

Hi, My thoughts as someone who knows virtually nothing about this higher end of the world. In this instance the 2 * CRS504's seem to add very little to the system apart from cost and complexity. Perhaps you could contact your local Mikrotik Distributor maybe they would loan you a couple, (or even th...
by rplant
Mon Mar 31, 2025 2:29 am
Forum: Beginner Basics
Topic: VoIP and Double NAT
Replies: 4
Views: 446

Re: VoIP and Double NAT

Hi, With default firewall rules it should normally work with just the sip alg turned off. However I have noticed (Europe ??) that the voip is often provided over a dedicated vlan. So presumably if your voip traffic is not using that dedicated vlan, the voip will not work/connect. If this is the case...
by rplant
Sat Mar 29, 2025 2:47 am
Forum: General
Topic: upgrade from V6 to V7 question for ccr1036
Replies: 3
Views: 395

Re: upgrade from V6 to V7 question for ccr1036

I think Recent versions of Ros V7 don't have the upgrade from V6 conversion functionality any more. If you upgrade in the Gui from a very recent V6 to V7, it should offer you one of the V7.12.x ROS's. This does have upgrade functionality, (and also sets up for wireless) From 7.12.x you can upgrade t...
by rplant
Fri Mar 28, 2025 3:02 am
Forum: Beginner Basics
Topic: socks 5 to wireguard
Replies: 3
Views: 526

Re: socks 5 to wireguard

Hi,
It seems difficult.

The following is very similar, and they have some options.

viewtopic.php?t=170694
by rplant
Sat Mar 22, 2025 12:39 am
Forum: Beginner Basics
Topic: AT&T Router Passthrough Setup
Replies: 12
Views: 1239

Re: AT&T Router Passthrough Setup

Hi, A few thoughts. Does the CRS have a gateway IP address? (ie. Did its DHCP client work) Can you ping 8.8.8.8 from the CRS? Do you have the correct ip address, default gateway on your client device? On a slightly different note. The CRS312 is a switch, it can also route but its CPU is quite low po...
by rplant
Fri Mar 21, 2025 11:55 am
Forum: Beginner Basics
Topic: AT&T Router Passthrough Setup
Replies: 12
Views: 1239

Re: AT&T Router Passthrough Setup

Hi, I attempted this config on a hex, it mostly worked. I needed the following slight changes. #Not sure how this was missing, perhaps removed from your export for some reason. /interface bridge add name=bridge #websites wouldn't work without allow-remote-requests /ip dns set servers=8.8.8.8,8.8.4.4...
by rplant
Sun Mar 16, 2025 3:06 am
Forum: Beginner Basics
Topic: 2 LANS over WIFI
Replies: 5
Views: 773

Re: 2 LANS over WIFI

My thoughts, (and some assumptions) I assume your clients connecting to the MAP might have their default gateway via a wired connection and you might not want to disrupt that. You might not want the industry devices being able to reach back to connect to the LAN devices connecting to them. In additi...
by rplant
Wed Mar 12, 2025 6:52 am
Forum: Beginner Basics
Topic: PPPoE Connection Loss Requires Reboot (Does Not Work Disabling and Re-enabling Interface Only)
Replies: 6
Views: 1486

Re: PPPoE Connection Loss Requires Reboot (Does Not Work Disabling and Re-enabling Interface Only)

Sorry I Don't know but a couple of thoughts. 1. Perhaps you can have a scheduled task to take the link down and then restore it each night at some convenient out of hours time. (Hopefully the next 36 hours starts from this time) 2. Perhaps instead of turning off the pppoe you could disable the under...
by rplant
Mon Mar 10, 2025 9:40 am
Forum: General
Topic: Multi level interconnection
Replies: 4
Views: 913

Re: Multi level interconnection

Hi, It is not obvious what you want. 2 Options I can think of: Option 1. The endpoints are 192.168.4.1 and 192.168.5.1 The Socks5 proxy is the Mikrotik. Option 2. The endpoints are somewhere completely different, and the Socks proxy's are 192.168.4.1 and 192.168.5.1 Option 1. The endpoints are 192.1...
by rplant
Mon Mar 10, 2025 12:34 am
Forum: Beginner Basics
Topic: Wireguard for Win PC dont work
Replies: 6
Views: 1109

Re: Wireguard for Win PC dont work

Do you have an appropriate allowedips value on your windows client configuration in the [peer] section Something like AllowedIPs = 192.168.1.0/24 (Change as required for your Mikrotik lan range) Perhaps if you want all traffic to go via the VPN (Probably don't use this if your Mikrotik is behind cgn...
by rplant
Sun Mar 09, 2025 6:21 am
Forum: Beginner Basics
Topic: Config check - NTP Client and IPv6 issues
Replies: 3
Views: 832

Re: Config check - NTP Client and IPv6 issues

faulty ntp is common (for Mikrotik's). You often need to src-nat the port from your ntp-client (So it looks like it's coming from a high port rather than port 123) As ISP's, ntp servers will often block ntp from port 123. Something like: /ip firewall nat add action=src-nat chain=srcnat out-interface...
by rplant
Thu Mar 06, 2025 10:51 am
Forum: General
Topic: Why does FastTrack cause super-slow TCP connections for some devices?
Replies: 13
Views: 1753

Re: Why does FastTrack cause super-slow TCP connections for some devices?

A guess...

You do need to keep the accept rule after the fasttrack rule.
by rplant
Wed Mar 05, 2025 6:38 am
Forum: General
Topic: Dual WAN with public IP forwarding
Replies: 3
Views: 1225

Re: Dual WAN with public IP forwarding

Hi, I am assuming, the 10.10.10.10 routing rule uses Public as its route table. You could try the following routing rule prior to the 10.10.10.10 rule. /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main Unfortunately there appar...
by rplant
Wed Feb 26, 2025 5:09 am
Forum: Beginner Basics
Topic: Selective VPN and bridge mode [SOLVED]
Replies: 9
Views: 6358

Re: Selective VPN and bridge mode [SOLVED]

You can likely do your original request, but it is kind of expensive (on a hex) You need to have one or more bridge nat rules, that match your requirements that redirect to the CPU which effectively kicks the packet to the routing engine, and then to wireguard as required. If the routing engine just...
by rplant
Wed Feb 26, 2025 4:47 am
Forum: Beginner Basics
Topic: Selective VPN and bridge mode [SOLVED]
Replies: 9
Views: 6358

Re: Selective VPN and bridge mode [SOLVED]

BUT what if I create a subnet on Mikrotik on the same segment of the ISP router, with absolutely NO ROUTING AND FIREWALL RULES? Yes you can do this. (But I would probably leave the default config on it, with firewall rules, etc) Make a subnet, eg. 192.168.10.160/28 (A range of 16), with router ip a...
by rplant
Wed Feb 26, 2025 3:50 am
Forum: Beginner Basics
Topic: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492
Replies: 103
Views: 12115

Re: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492

It sort of looks like there are 4 bytes required.

Perhaps the pppoe comes on a vlan (quite common)
Or perhaps they are adding a priority vlan header.

Can you manually set the l2mtu of the interface to something higher than 0
eg. 1504

Perhaps via webfig/winbox/cli if you can't do it from the mobile.
by rplant
Sat Feb 22, 2025 12:36 pm
Forum: General
Topic: How do I ping link local IPv6 address?
Replies: 1
Views: 2406

Re: How do I ping link local IPv6 address?

1v73 looks wrong.
by rplant
Fri Feb 21, 2025 9:15 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 2630

Re: VRF suggestions

Isn't there any chance to get this working via dynamic routing protocols?
Sorry, I don't know.

You can probably add a ping check to the 2 static routes, so if that link fails, it will fall back to
dynamic routing.
by rplant
Fri Feb 21, 2025 4:27 am
Forum: Beginner Basics
Topic: C52iG-5HaxD2HaxD After hardware reset the wifi is off
Replies: 1
Views: 2471

Re: C52iG-5HaxD2HaxD After hardware reset the wifi is off

Hi, It's possible you have cleared the routers config. You should be able to run winbox on your computer, and find the router, (You need to be on the same subnet as the router, eg plugged into it directly. It might take a little while). It will likely have an ip address of 0.0.0.0 Login using its ma...
by rplant
Thu Feb 20, 2025 6:20 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 2630

Re: VRF suggestions

An ordinary static route should be fine on the 2116 end.

/ip route
add disabled=no dst-address=10.0.81.0/24 gateway=10.0.3.1 routing-table=main suppress-hw-offload=no
by rplant
Thu Feb 20, 2025 5:11 am
Forum: Forwarding Protocols
Topic: VRF suggestions
Replies: 7
Views: 2630

Re: VRF suggestions

Hi, By my thought would be to use some routing rules at both ends. (Though your environment looks complicated) Assuming vlan502, 10.0.3.0/30 is your direct path. For wg_roadwarrior On the 2004 Something like: /routing rule add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disa...
by rplant
Tue Feb 18, 2025 1:49 am
Forum: General
Topic: Block client MAC only on 2nd Wifi AP
Replies: 9
Views: 5898

Re: Block client MAC only on 2nd Wifi AP

Hi, Pretty sure you can disable access in the access list tab. Put in the mac address and untick authentication and maybe forwarding. You could perhaps put in a signal strength range say -120..-70 (So if the device gets quite close it will actually connect) It might also be that for some reason it c...
by rplant
Mon Feb 17, 2025 6:28 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2295

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Yet another option might be to have dhcp hand out /32 ip address ranges.
So everything IP has to be routed.

(Likely not well handled by older devices)
by rplant
Sun Feb 16, 2025 2:11 am
Forum: Beginner Basics
Topic: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492
Replies: 103
Views: 12115

Re: PPPOE MTU ALWAYS DEFAULTS TO 1480 INSTEAD OF 1492

For me with v7 it just chose 1492 with v6 it always chose 1480.

However as @tdw mentioned, you need to set both mru and mtu to 1492.
by rplant
Sat Feb 15, 2025 4:08 am
Forum: SwOS
Topic: 10Gb SFP+ to RJ45 Modules
Replies: 4
Views: 4077

Re: 10Gb SFP+ to RJ45 Modules

Hi, The Wiitek 10Gb SFP+ to RJ45 will require its backend to run at 10G (which it should automatically do) It will run hot, and also likely to drop packets. (Because its front is running at 2.5G, which the switch doesn't know about) You are probably better to get a 2.5G sfp+ to 2.5G rj45 that requir...
by rplant
Sat Feb 15, 2025 3:43 am
Forum: Beginner Basics
Topic: Port mapping issue
Replies: 3
Views: 2070

Re: Port mapping issue

Hi,

You need hairpin NAT, there is plenty of examples through the forums.

One I just found: viewtopic.php?t=172380

You can also search for hairpin in the following help topic

https://help.mikrotik.com/docs/spaces/R ... 211299/NAT
by rplant
Fri Feb 14, 2025 10:00 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2295

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Another simpler option if (it works at all) is to enable local proxy arp.
(Without changing original config)
Not quite sure where you would apply this, on the bridge, or the actual interfaces??

Then maybe all ip traffic would get routed.
by rplant
Fri Feb 14, 2025 8:59 am
Forum: General
Topic: Traffic Shaping for 1000+ users as well as AP & Backhauls
Replies: 5
Views: 2378

Re: Traffic Shaping for 1000+ users as well as AP & Backhauls

I was able to figure it out so I'm all set.
I don't currently need to know this, but I would like to for if/when I do need it (please) :)
by rplant
Fri Feb 14, 2025 8:49 am
Forum: General
Topic: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP
Replies: 3
Views: 2295

Re: Send L2 traffic over EoIP, IP traffic in parallel outside of EoIP

Hi, Somewhat of a guess You need to have 2 ip address ranges to get things to route. With the device sending its packet at the router, not at the other device. You could perhaps split the 172.16.16.0 range into 2 /25 ranges. with side 1 having 172.16.16.0/25 gateway 172.16.16.1, side 2 having 172.16...
by rplant
Thu Feb 13, 2025 1:22 am
Forum: General
Topic: Still fighting with Ecobee (and losing)
Replies: 14
Views: 4200

Re: Still fighting with Ecobee (and losing)

Is dhcp snooping enabled on any of the ubiquiti gear, it might cause this.
(Apparently it may be a default in some of their gear)
by rplant
Tue Feb 11, 2025 7:42 am
Forum: General
Topic: Router reaches the Internet, subnets do not
Replies: 13
Views: 3214

Re: Router reaches the Internet, subnets do not

Hi, The following are my changes to the configuration. (Sorry, It is not a complete configuration @anav is much better at this...) You will need to apply it slowly piece by piece. You will also need to remove your old multi bridge configurations. #xxx.yyy.zzz.11 <--> 10.11.0.0/22 [ether2] #xxx.yyy.z...
by rplant
Mon Feb 10, 2025 3:24 am
Forum: Beginner Basics
Topic: Unable to get inter-VLAN routing to work despite proper IP services [SOLVED]
Replies: 2
Views: 5127

Re: Unable to get inter-VLAN routing to work despite proper IP services [SOLVED]

I tried your config, and it seemed to work ok. (I was connecting to another mikrotik) Also when plugged into the trunk it supplied the 3 ip ranges to the Mikrotik via vlans. Perhaps the devices you were connecting too had a firewall on them, and didn't like being accessed from another subnet. or had...
by rplant
Sat Feb 08, 2025 1:29 am
Forum: General
Topic: Router reaches the Internet, subnets do not
Replies: 13
Views: 3214

Re: Router reaches the Internet, subnts do not

Hi, As far as I can see the only usable LAN subnet you actually have is 192.168.88.0/24, and I think it likely should work. (It may need a specific NAT rule per @TheCat12) The other subnets you list and attach to bridges are all on the router only, and there is only a single active address for each ...
by rplant
Sat Feb 08, 2025 12:54 am
Forum: General
Topic: Still fighting with Ecobee (and losing)
Replies: 14
Views: 4200

Re: Still fighting with Ecobee (and losing)

Hi, I know nothing about these, but my (only) guess is that it might have something to do with DHCP. Perhaps if it fails to get an IP it eventually stops asking, or something. Check none of the delay options are configured on the dhcp server. Set up a script/netwatch to periodically ping/arp ping on...
by rplant
Tue Feb 04, 2025 4:22 am
Forum: General
Topic: Storm control on egress
Replies: 2
Views: 2558

Re: Storm control on egress

Probably doable using hw offloaded qos. https://help.mikrotik.com/docs/spaces/ROS/pages/189497483/Quality+of+Service Possibly special handlers already exist for multicast (and??) broadcast. Otherwise you can perhaps use switch rules to map the packets you want restricted to a specific traffic class....
by rplant
Mon Feb 03, 2025 7:10 am
Forum: SwOS
Topic: Switch allows DHCPDISCOVER but drops DHCPOFFER
Replies: 3
Views: 5874

Re: Switch allows DHCPDISCOVER but drops DHCPOFFER

Perhaps there is some dhcp snooping configuration defined somewhere that needs to be reviewed.
by rplant
Mon Feb 03, 2025 2:25 am
Forum: General
Topic: Feature requests
Replies: 1807
Views: 793530

Re: Feature requests

I would like a refresh version of the hap ac2. Pretty much exactly the same as current. Exactly the same Case, pcb and components, except the RAM is replaced with a 256M unit, and the Flash is replaced with a 32M Unit. (Possibly by now cheaper than the current smaller devices) I would also like a (c...
by rplant
Sun Jan 26, 2025 7:12 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 6108

Re: Starlink Packet Loss Troubleshooting

I don't know that I can help further, but I found the following couple of posts elsewhere that you may have already seen. https://www.reddit.com/r/Starlink/comments/1eyndnu/high_packet_loss_in_bypass_mode/m672h96/ https://www.reddit.com/r/Starlink/comments/17h2f99/solved_issue_with_bypass_mode_slown...
by rplant
Fri Jan 24, 2025 10:34 am
Forum: Beginner Basics
Topic: Multisite Multicast Nat
Replies: 2
Views: 3111

Re: Multisite Multicast Nat

I am quite possibly completely misunderstanding here, but anyway. I would imagine that 192.168.1.x on R1 would register for a particular multicast with its router. That Router R1 would then register for multicast with something closer to the source. The identity of the original requesting device won...
by rplant
Fri Jan 24, 2025 10:25 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 6108

Re: Starlink Packet Loss Troubleshooting

Also its often worth graphing your wan interface traffic.

Perhaps something like:

/tool graphing
set store-every=24hours

/tool graphing interface
add allow-address=YOUR_COMPUTER_IP_ADDRESS interface=ether1

Then you can look at the graph(s) in winbox/webfig
by rplant
Fri Jan 24, 2025 5:33 am
Forum: Beginner Basics
Topic: Starlink Packet Loss Troubleshooting
Replies: 17
Views: 6108

Re: Starlink Packet Loss Troubleshooting

From winbox or webfig have a look at your wan/ether1 interface traffic. (traffic tab) Is it as expected? I would initially disable ipv6, because if its sort of working but sort of not it can be painful. Once network is working well with only ipv4, you can look at this further. You may need to discon...
by rplant
Mon Jan 20, 2025 12:44 pm
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10096

Re: L3 HW Offloading

Another slight possibility, I don't know if this will work at all, it depends a lot on the L3 switch. You could reconfigure the DHCP server on the 5009 to point the default route of the LAN network at the L3 switch IP Address. Then the devices would send their packets to the switch (for both interne...
by rplant
Mon Jan 20, 2025 6:38 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10096

Re: L3 HW Offloading

Hi, A little off topic now maybe. I trialled a much simplified version of this system on a Hex (much slower/smaller), to verify some things I thought I knew... It turns out as mentioned by @lurker888, marking the packets as notrack does seem to mean they can't be fasttracked. (under ip settings you ...
by rplant
Mon Jan 20, 2025 2:59 am
Forum: Beginner Basics
Topic: Setting up connection between 2 routers over the WiFi [SOLVED]
Replies: 2
Views: 7169

Re: Setting up connection between 2 routers over the WiFi [SOLVED]

I think one possible set of changes is likely to be: Add wifi2 to the bridge, and change its mode to "Station Bridge" Optional: You could/should also put a dhcp-client on the bridge if you don't have one on it already so the hapac2 also gets an IP address from the Audience. (if you have a ...
by rplant
Sun Jan 19, 2025 10:47 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10096

Re: L3 HW Offloading

Hi, I think your current problem is that you are getting triangular routing. (which is probably why hardware offload is good, as it is likely not stateful) From Device on 192.168.1.x network to 10.0.0.0/8 likely goes from device to 5009 then to Switch then to 10.x.x.x device. (Hopefully often the 50...
by rplant
Sun Jan 19, 2025 12:33 am
Forum: General
Topic: L3 HW Offloading RB5009
Replies: 96
Views: 10096

Re: L3 HW Offloading

You seem likely to have done all of this already but just in case... Remove sfp+ from bridge Give sfp+ an IP address, and switch port/vlan? at other end an IP address. Make the sfp+ interface a member of the LAN interface list. But if you need lots of gigs of intervlan routing, it isn't going to do ...
by rplant
Sun Jan 19, 2025 12:03 am
Forum: General
Topic: asymmetric routing
Replies: 13
Views: 4761

Re: asymmetric routing

Another possible option is to mark the packets more carefully.

eg. in interface list not WAN (or in interface not WAN-2)
by rplant
Sat Jan 18, 2025 5:24 am
Forum: General
Topic: asymmetric routing
Replies: 13
Views: 4761

Re: asymmetric routing

Hi, In 7.2.2(ish) the routing was changed, so that if you route mark a packet, and a matching route with that route mark exists in the route table it will use that route entry. It then processes the routing rules table, and finally the route table (again). Previously routing rules occurred first, an...
by rplant
Sat Jan 18, 2025 4:43 am
Forum: Beginner Basics
Topic: Turn Off CDR
Replies: 2
Views: 2676

Re: Turn Off CDR

Do you perhaps mean CDP?

This is done under ip neighbors
by rplant
Sat Jan 11, 2025 5:42 am
Forum: Beginner Basics
Topic: Checking the Portspeed with with an SFP+ has connected
Replies: 3
Views: 3320

Re: Checking the Portspeed with with an SFP+ has connected

Hi, The CPU on the CRS317 isn't super fast. (eg. a hap ac2 is faster) See: https://mikrotik.com/product/crs317_1g_16s_rm#fndtn-testresults The commonly used value for routing performance comparison is 25 ip filter rules, 512 byte packets. However it does do some fairly good L3 hardware offloading, b...
by rplant
Fri Jan 10, 2025 9:06 am
Forum: MikroTik hardware questions
Topic: CCR1009-7G-1C-1S+ 2.5G Compatible?
Replies: 7
Views: 5458

Re: CCR1009-7G-1C-1S+ 2.5G Compatible?

Note however if you use something like a S+RJ10 in the sfp+ port,
it can negotiate 2.5G with remote end while sfp+ is running at 10G,
(so Mikrotik thinks it is running at 10G) it runs hot.

You will likely need some traffic shaping (queue) to limit outbound traffic to <2.5G.
by rplant
Fri Jan 10, 2025 8:59 am
Forum: Beginner Basics
Topic: Checking the Portspeed with with an SFP+ has connected
Replies: 3
Views: 3320

Re: Checking the Portspeed with with an SFP+ has connected

I assume you are using one of the SFP+ to RJ45 adapters. The following has some info on the Mikrotik one. https://mikrotik.com/product/s_rj10 They have 2 versions, and the first version did not report the link speed correctly. I would not be surprised if many other brands also have very limited link...
by rplant
Thu Jan 02, 2025 12:10 pm
Forum: Beginner Basics
Topic: inter connect two subnets
Replies: 2
Views: 3712

Re: inter connect two subnets

Hi, The 2 subnets should already be connected, you don't need the add action=accept chain=forward comment="enable interconnect lan subnets" rule. You should be able to connect to the various devices in the other subnet. There may be a couple of issues. 1. You may be expecting to see these ...
by rplant
Mon Dec 30, 2024 2:16 am
Forum: General
Topic: VXLAN over WireGuard weird packet size issue over VDSL - Have I found a bug?
Replies: 1
Views: 1821

Re: VXLAN over WireGuard weird packet size issue over VDSL - Have I found a bug?

Not sure. You may have already tried this. I would try using a separate ethernet interface for the wireguard connection into the 2nd router from the CCR. With an mtu of 1492, and different IP address range to the lan. You may need a routing rule to get the wireguard traffic to exit via this separate...
by rplant
Thu Dec 26, 2024 4:58 am
Forum: General
Topic: Wireguard behind NAT
Replies: 2
Views: 1734

Re: Wireguard behind NAT

My Guess is that the devices on your LAN are receiving a packet from 192.168.100.1/24 and sending their reply back to the main gateway. (Which also doesn't know where 192.168.100.1/24 is) One simple(ish) option might be to masquerade packets leaving your Wap-ax with source address of 192.168.100.0/2...
by rplant
Fri Dec 20, 2024 10:35 am
Forum: MikroTik hardware questions
Topic: Expanding the storage capacity of CRS520 [SOLVED]
Replies: 4
Views: 14777

Re: Expanding the storage capacity of CRS520 [SOLVED]

You could look at Mikrotik's rose storage.
by rplant
Thu Dec 19, 2024 1:08 pm
Forum: General
Topic: Mikrotik Reset Password Without Loosing Configurations
Replies: 7
Views: 2562

Re: Mikrotik Reset Password Without Loosing Configurations

My guess is that these devices are probably a bit like a ccr, with no default firewall rules except for a masquerade rule :( The following rules are for a hex, (they are usually all very very similar, except when they have none) And you should be able to copy and paste them in. I think they are quit...
by rplant
Tue Dec 17, 2024 11:15 am
Forum: General
Topic: When the WAN network card is bound to multiple IPs, there is an issue with the source IP for system remote logging
Replies: 6
Views: 1749

Re: When the WAN network card is bound to multiple IPs, there is an issue with the source IP for system remote logging

The fact that logging has the option of a source IP address, and ignores it seems like a bug. Though it might be your config. (Given Wan interfaces usually have some sort of src-nat/masquerade) Do you have a src-nat rule for the wan interface that might apply in this case. You could put in a specifi...
by rplant
Tue Dec 17, 2024 8:23 am
Forum: Beginner Basics
Topic: Swith ACL redirect-to-cpu question [SOLVED]
Replies: 3
Views: 7135

Re: Swith ACL redirect-to-cpu question [SOLVED]

You possibly also need a bridge nat rule to kick the packet into the routing section of the device.

Something like:

/interface bridge nat
add action=redirect chain=dstnat disabled=no dst-address=192.168.88.88 ip-protocol=tcp dst-port=22 log=yes mac-protocol=ip
by rplant
Fri Dec 13, 2024 12:50 am
Forum: General
Topic: How to fix IPv4 neighbor Table Overflow
Replies: 2
Views: 1269

Re: How to fix IPv4 neighbor Table Overflow

Hi,
V7.16.1

IP Settings.
There are 2 items, the max neighbor entries and Arp Timeout
You could increase the max neighbor entries value or possibly decrease the Arp Timeout value.
(The current default Arp Timeout value appears to be 30S, I would not go below that)
by rplant
Fri Dec 13, 2024 12:37 am
Forum: General
Topic: 2 WAN active at the same time [SOLVED]
Replies: 19
Views: 3540

Re: 2 WAN active at the same time [SOLVED]

A few points: The following assumes a config sort of based on default (for SOHO type routers, not CCR, etc which have no firewall rules). I am assuming you have nat. In this case an incoming connection on Wan1 must then also leave by Wan1. (Same for Wan2) Otherwise it just doesn't work. (Often true ...
by rplant
Mon Dec 09, 2024 1:14 am
Forum: Beginner Basics
Topic: Wan to Wan routing and setup
Replies: 1
Views: 3158

Re: Wan to Wan routing and setup

Hi, The following was made on a hex, based on its default configuration. But should be applicable to many/most Mikrotiks. I removed all the firewall rules (so fastpath is active) Disabled all admin services except winbox Moved ssh and winbox access to a new vrf vrfAdmin, active on ether5. (So you ca...
by rplant
Sat Dec 07, 2024 10:40 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

It will block people/devices on the internet from attempting to login to your router. (Or using other services your router may provide, that you haven't provided a rule to allow) The default on a Mikrotik is to allow (input, and also forwarding), you should normally block access you don't specifical...
by rplant
Sat Dec 07, 2024 10:32 am
Forum: General
Topic: Logs showing Public IP as gateway IP
Replies: 4
Views: 1159

Re: Logs showing Public IP as gateway IP

Or maybe someone or something is somehow logged into or has a vpn into your gateway router, working on the next step.
by rplant
Sat Dec 07, 2024 12:04 am
Forum: General
Topic: Logs showing Public IP as gateway IP
Replies: 4
Views: 1159

Re: Logs showing Public IP as gateway IP

This kind of looks like what you would get, if your gateway was also a Mikrotik, and it had hairpin nat enabled for a SSH port forward/dst-nat connection to the internal router. (With attempted logins from inside)
by rplant
Fri Dec 06, 2024 11:56 pm
Forum: General
Topic: Droping packets base on mac address is not working
Replies: 5
Views: 1163

Re: Droping packets base on mac address is not working

Yes, drop by mac address doesn't work at the router stage. You could connect only the Reolink to a specific ethernet port on the router, and block based on port. You could give the Reolink a static lease from the DHCP server, and block based on IP address. (From winbox, go to ip dhcp server, the lea...
by rplant
Fri Dec 06, 2024 11:38 pm
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 1876

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

One other thought

If you have an interface that is not part of the bridge, but has an IP address on it, it will route using hw offload.
However if you have a vlan on this interface with an IP address on it, the vlan will use the CPU.
by rplant
Fri Dec 06, 2024 11:27 am
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 1876

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

Perhaps try the following commands to see if L3 offload is not present somewhere. With 400+ routes, you might want to write it to a file, so you can examine it in a text editor or similar. /ip route print [file=somefilename] Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, o - OSPF, d - DHCP; H - HW-OFF...
by rplant
Fri Dec 06, 2024 6:09 am
Forum: General
Topic: mDNS VLAN Setup Help
Replies: 7
Views: 1928

Re: mDNS VLAN Setup Help

I was thinking something like. /ip firewall nat add action=masquerade chain=srcnat comment="Nat lan to wan tvs" out-interface=VLAN_TVs You could also filter by src-ip address, or src ip address list. On review, I notice you have a bunch of bridges on this system. And assorted vlans connect...
by rplant
Fri Dec 06, 2024 5:55 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 1994

Re: Shaping /Qos Policy

I was thinking of something like. /queue type add kind=pcq name=pcq-upload-24 pcq-classifier=src-address pcq-dst-address-mask=24 pcq-src-address-mask=24 It just groups each /24 lan subnet together so the large upload machines get lumped together. On testing, you may find the pcq-upload-default works...
by rplant
Thu Dec 05, 2024 12:37 pm
Forum: General
Topic: mDNS VLAN Setup Help
Replies: 7
Views: 1928

Re: mDNS VLAN Setup Help

You could perhaps see if configuring source nat on packets leaving the LAN for the VLAN_TVs helps.
by rplant
Thu Dec 05, 2024 12:23 pm
Forum: General
Topic: CRS510-8XS-2XQ-IN High CPU Netwoking process
Replies: 11
Views: 1876

Re: CRS510-8XS-2XQ-IN High CPU Netwoking process

Are the MTU's on all the interfaces the same.
The switch might fragment packets in software.
My CRS305 does that...
by rplant
Thu Dec 05, 2024 11:58 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, I changed the firewall filter rules, and while I still don't like them much, the ikev2 now should work. They appear to be based on a very old routeros version. The ipsec policy rules have to go above the fasttrack rule. (They seem to work below it when pinging things, but fail when actually tryi...
by rplant
Wed Dec 04, 2024 10:32 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Perhaps time for: Thanks @mkx Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireless PSK, etc.) and copy-paste it ...
by rplant
Tue Dec 03, 2024 8:50 am
Forum: General
Topic: PPPOE on upload disconnecting!
Replies: 4
Views: 1231

Re: PPPOE on upload disconnecting!

If its running v7, use a cake queue that should (hopefully) allow you to near fill the uplink, while also giving everything else in your network a bit of bandwidth rather than being starved out because of the fat upload.

V6, probably a pcq queue.
by rplant
Tue Dec 03, 2024 8:42 am
Forum: General
Topic: RDP HELP!
Replies: 31
Views: 7159

Re: RDP HELP!

I would perhaps actively block udp to and from 3389, (if only to see if it changes anything)
by rplant
Mon Dec 02, 2024 12:39 pm
Forum: General
Topic: Wireguard is blocked by ISP any other solution
Replies: 20
Views: 4448

Re: Wireguard is blocked by ISP any other solution

ikev2 (ipsec) is well supported, and there are fairly good examples around. https://help.mikrotik.com/docs/spaces/ROS/pages/11993097/IPsec#IPsec-RoadWarriorsetupusingIKEv2withRSAauthentication This is more industrial, so perhaps less likely to be dropped. But if your ISP doesn't want you running VPN...
by rplant
Mon Dec 02, 2024 9:30 am
Forum: Beginner Basics
Topic: UDP Port forwarding [SOLVED]
Replies: 6
Views: 5709

Re: UDP Port forwarding [SOLVED]


Another possibility:
Some special handling may be required if you have multiple public ip addresses on the router.
Ignore this, mine seems to handle this fine.
by rplant
Mon Dec 02, 2024 6:04 am
Forum: Beginner Basics
Topic: UDP Port forwarding [SOLVED]
Replies: 6
Views: 5709

Re: UDP Port forwarding [SOLVED]

One possibility. Seems unlikely, but you do have a wanIP as an address list. If you have multiple wan interfaces, and the packet is coming in from one interface, and leaving via another (the wan interface with the lowest metric). This could occur. You would need to mark your packets (or similar) so ...
by rplant
Mon Dec 02, 2024 4:26 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 1994

Re: Shaping /Qos Policy

One other thought, (Somewhat more like my original thought) You could perhaps make a new pcq type queue, based on pcq-upload-default, but with a 24 mask. (So everything from 10.0.1.x will be counted together) Then back to no marking, and fast track allowed. The low rate lans will be prioritised over...
by rplant
Mon Dec 02, 2024 2:17 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 1994

Re: Shaping /Qos Policy

Sorry, I should read things a bit more thoroughly. Unfortunately, the 3011 seems to not be great under v7. Perhaps what you have will be good. Though I do not understand why you have a limit of 100M on the backup traffic. You will likely need to add all the packet marks to the parent (WAN-Shaper) so...
by rplant
Sun Dec 01, 2024 7:49 am
Forum: General
Topic: Feature requests
Replies: 1807
Views: 793530

Re: Feature requests

It would be very functional to be able to add a description for each connection that you save and thus identify more quickly to which mikrotik equipment I want to connect I am assuming you a speaking of the managed tab in winbox. In tools at the top, there is and advanced mode you can select, and a...
by rplant
Sun Dec 01, 2024 7:35 am
Forum: General
Topic: Shaping /Qos Policy
Replies: 7
Views: 1994

Re: Shaping /Qos Policy

As a start, I would be inclined to just put a single cake queue attached to the WAN interface, to see how well (or not) it works. (With no packet marking for shaping) Set it up for 500M, and a bucket size of 0.005-0.01, (or your settings) and see how it goes. You will need to create a new queue type...
by rplant
Sun Dec 01, 2024 3:50 am
Forum: General
Topic: Disable Voice VLAN on specific Ports
Replies: 3
Views: 1186

Re: Disable Voice VLAN on specific Ports

Some possible options: If you make a custom interface list and add all the ports you want (but not the bridge) to this list, you can make ip discovery use this list and it will only target those ports. So no discovery on the ports missing from the list. Another option might be to use a switch chip r...
by rplant
Fri Nov 29, 2024 11:34 pm
Forum: Beginner Basics
Topic: Setup mAP in reverse config from default
Replies: 18
Views: 4541

Re: Setup mAP in reverse config from default

2. Yes and no Since the device is now a (dumb) switch it has no way to filter anything. The input firewall chain still works. However by default the bridge is a LAN interface and input is allowed from LAN interfaces, ie. All ports. (Input is disallowed from all except LAN interfaces) You can add (a...
by rplant
Fri Nov 29, 2024 6:23 am
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, I have added the following rules near the top of a default config. (after accept icmp) /ip firewall filter ... add action=accept chain=input comment="allow 500,4500 ipsec in" dst-port=500,4500 protocol=udp add action=accept chain=input comment="allow ipsec-esp in (no nat)" pr...
by rplant
Thu Nov 28, 2024 9:26 am
Forum: General
Topic: RouterOS blatantly ignores pref-src. Can this really be a bug?
Replies: 59
Views: 6002

Re: RouterOS blatantly ignores pref-src. Can this really be a bug?

Hi, My observations: Actually wireguard in mikrotik does attempt to use the IP address that the incoming packet was sent to. Looking at the packet on the output chain is too late. It has already gone through the routing process, and had it's ip address changed, probably also natted. If you use routi...
by rplant
Thu Nov 28, 2024 1:55 am
Forum: Beginner Basics
Topic: Secure Remote Access - QuickSet VPN
Replies: 17
Views: 5648

Re: Secure Remote Access - QuickSet VPN

but am struggling to get an IP address on the wireguard peer much less an internet connection You have to setup the ip address on each peer manually. It is attached to the wg interface associated with that peer. wg interface <ip address> peer - allowed ip addresses peer - allowed ip addresses Stric...
by rplant
Thu Nov 28, 2024 1:26 am
Forum: Beginner Basics
Topic: Why can I not use static ip_
Replies: 13
Views: 3637

Re: Why can I not use static ip_

Hi, My guess is that you need to run dhcp, so the ISP gets the MAC address of your router, so it can send packets to it. It may not use arp discovery, the dhcp mac address possibly gets recorded into the radius server, and that is where the routers packets get sent too. (I believe Mikrotik's do this...
by rplant
Wed Nov 27, 2024 6:03 am
Forum: Beginner Basics
Topic: L2TP/IPsec VPN clients can't access LAN
Replies: 1
Views: 2643

Re: L2TP/IPsec VPN clients can't access LAN

Some thoughts. 1. Don't use L2TP at all, use wireguard, its easier/better. (L2TP is slowly being discouraged) Wireguard: You only need 1 port. You usually don't have to fight much with the ISP router. You don't have to fight much with the client OS. Perhaps a little less good if you are somewhere wh...
by rplant
Wed Nov 27, 2024 3:08 am
Forum: General
Topic: SFP+ interface compatibility with 1G optical transceivers
Replies: 2
Views: 1026

Re: SFP+ interface compatibility with 1G optical transceivers

Also Mikrotiks support for assorted sfp's has varied a lot over the routeros versions.
and not always for the better in newer versions it seems.
by rplant
Wed Nov 27, 2024 3:03 am
Forum: General
Topic: SFP+ interface compatibility with 1G optical transceivers
Replies: 2
Views: 1026

Re: SFP+ interface compatibility with 1G optical transceivers

Hi, I had sort of thought that auto-negotiation is a combination (max) of -The speeds the sfp port is capable of. -The configured auto-negotiate speeds in the ethernet tab. -The speeds that are advertised as acceptable by the sfp devices ROM. Though your experience seems to indicate otherwise. One p...
by rplant
Wed Nov 27, 2024 2:23 am
Forum: Beginner Basics
Topic: Secure Remote Access - QuickSet VPN
Replies: 17
Views: 5648

Re: Secure Remote Access - QuickSet VPN

If you have some device/network in your control with a static ip address that you can login to these devices from, you can (as a short term solution) add this ip address to an address list in ip firewall. (eg. admin2) Then change the firewall rule that allows 8291 to only allow 8291 with src-address...
by rplant
Mon Nov 25, 2024 3:55 am
Forum: General
Topic: Any advice for further debugging handshaking failed on wireguard roadwarrior setup?
Replies: 13
Views: 2448

Re: Any advice for further debugging handshaking failed on wireguard roadwarrior setup?

Hi, I am finding it difficult to understand what you are saying, but I will assume the mikrotik has 3 public ip addresses on it. And the incoming wg packets all come into the mikrotik via either the 2.249 or 2.253 interfaces but directed at the .210 address. Normally for this, I would use routing ru...
by rplant
Sun Nov 24, 2024 1:24 pm
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

I found this also, which might help.

add action=accept chain=input comment="Allow IKEv2 Traffic" src-address=\
172.17.153.0/24

Change 172.17... for the IP address range from your ikev2 pool.

viewtopic.php?t=190096
by rplant
Sun Nov 24, 2024 1:09 pm
Forum: Beginner Basics
Topic: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN
Replies: 12
Views: 6395

Re: HELP: IP/SEC VPN for android and lost "standard" PPTP VPN

Hi, ikev2: If your hap lite is not the internet gateway, you will possibly need to put some sort of NAT on it, so vpn connections to devices on the local network get masqueraded. (The devices on the local network will likely try to reply to the main gateway rather than the Mikrotik). Otherwise, not ...
by rplant
Sat Nov 23, 2024 3:48 am
Forum: General
Topic: L3HW: Nexthop HW table FULL
Replies: 3
Views: 947

Re: L3HW: Nexthop HW table FULL

Another thought The arp table can get very big these days. There is an arp timeout value on interfaces and bridges. (Not defined by default) You could perhaps see how big your arp table is and see if it might be the problem. And see if setting the arp timeout to some value (seconds, minutes, hours, ...
by rplant
Fri Nov 22, 2024 5:32 am
Forum: General
Topic: same subnet
Replies: 6
Views: 1309

Re: same subnet

Hi, I suspect it should be possible using vrf's. But I am not sure, and don't know how too, sorry. I had a trial of putting another mikrotik (a hex) in front of a similarly configured setup, and this appears to work ok. If your main router is a high end expensive CCR or similar, this is probably not...
by rplant
Wed Nov 20, 2024 6:17 am
Forum: General
Topic: L3HW: Nexthop HW table FULL
Replies: 3
Views: 947

Re: L3HW: Nexthop HW table FULL

Perhaps the following might be useful in this case. To make all packets go through the CPU first, and offload only the Fasttrack connections, disable l3hw on all ports but keep it enabled on the switch chip itself: /interface/ethernet/switch set 0 l3-hw-offloading=yes /interface/ethernet/switch/port...
by rplant
Wed Nov 20, 2024 5:59 am
Forum: Beginner Basics
Topic: Sufficient power to run multi crs305 via RB4011 ?
Replies: 1
Views: 2110

Re: Sufficient power to run multi crs305 via RB4011 ?

Hi, I am not quite sure what you are asking, but here are some answers. The RB4011 is not powerful enough to route 10G (and doesn't have the ports to do it really) From the test results section of the RB4011 page: https://mikrotik.com/product/rb4011igs_rm#fndtn-testresults From these results the 512...
by rplant
Wed Nov 20, 2024 5:23 am
Forum: Beginner Basics
Topic: Troubles with configuring hairpin NAT
Replies: 11
Views: 6210

Re: Troubles with configuring hairpin NAT

Hi,

There is an mdns repeater setup on recent routeros versions.

It is in ip dns.
You add the interfaces you want mdns to be repeated between.

or by cli (example)

/ip dns
set mdns-repeat-ifaces=ether1,ether2
by rplant
Wed Nov 20, 2024 12:31 am
Forum: General
Topic: Traffic Shapping from ISP
Replies: 7
Views: 1782

Re: Traffic Shapping from ISP

Sorry for the delay, forum didn't seem to work for me. /ip firewall mangle # (remove/disable this rule) add action=mark-packet chain=postrouting out-interface=ether1 new-packet-mark=shaped-packets passthrough=no /queue tree add name="WAN-Shaper" parent=ether1 packet-mark=no-mark max-limit=...
by rplant
Sun Nov 17, 2024 11:32 am
Forum: General
Topic: Traffic Shapping from ISP
Replies: 7
Views: 1782

Re: Traffic Shapping from ISP

A few things. 1. The RB3011 isn't really fast. 2. It is quite a bit slower using Rosv7 3. You can't fast track simple queues. (not fast track is much slower) 4. You need to set a lower bucket size on the queues. You can show system resources and watch the cpu when you run traffic through the link. T...
by rplant
Sun Nov 17, 2024 4:54 am
Forum: General
Topic: Change the routing table for OVPN connections dynamically on a MikroTik router
Replies: 4
Views: 1267

Re: Change the routing table for OVPN connections dynamically on a MikroTik router

Hi, A couple of things. I would put a routing rule like: add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main before your existing routing rules. So only for traffic that needs to go via a default gateway will use Table_ISP1 or Table_ISP2. I wo...
by rplant
Sun Nov 17, 2024 4:32 am
Forum: General
Topic: Wireguard/RouterOS issue
Replies: 7
Views: 1047

Re: Wireguard/RouterOS issue

My guess is that perhaps the end devices don't know how to (or don't want to) route back to the wireguard IP address range.

You could add a source nat rule that if the ip address is the wireguard range, it gets masqueraded and see if that works.
by rplant
Sat Nov 16, 2024 8:25 am
Forum: Beginner Basics
Topic: Troubles with configuring hairpin NAT
Replies: 11
Views: 6210

Re: Troubles with configuring hairpin NAT

Hi, From your listing. The 2 rules below are not required, the last filter rule will allow (actually let fall through to default allow) connections allowed by your dst-nat rules Rule: add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface="ether8[ISP]"...
by rplant
Thu Nov 14, 2024 9:57 am
Forum: Beginner Basics
Topic: AP Speed Static IP Vs DHCP
Replies: 1
Views: 2097

Re: AP Speed Static IP Vs DHCP

You could check the ip route table with dhcp and static and see if there is any differences. I think your masquerade rule should have an interface (out-interface) on it. Presumably bridge1. Though perhaps only if it is coming from the 10.2.2.0/24 network. Not quite sure why you have ether1 attached ...
by rplant
Thu Nov 14, 2024 5:36 am
Forum: Beginner Basics
Topic: Mysterious SSTP VPN Certificate issue
Replies: 2
Views: 2584

Re: Mysterious SSTP VPN Certificate issue

You could maybe try hitting it with a web browser, and see what it thinks about it,
(The mikrotik might have web over tls enabled??)
by rplant
Wed Nov 13, 2024 12:27 am
Forum: Beginner Basics
Topic: CRS354-48P-4S+2Q+RM Performance Issues with Light Load
Replies: 5
Views: 2372

Re: CRS354-48P-4S+2Q+RM Performance Issues with Light Load

You do mention you have a gateway router. So does this router do the firewalling from the internet that your network requires. If so, the CRS354 may be ok. (Otherwise as @anav mentioned, a RB5009 in front might be good) In switch settings, you can enable L3 HW Offload for the switch chip. Then under...
by rplant
Mon Nov 11, 2024 2:38 am
Forum: General
Topic: Routing between VLANS not working - CRS305 [SOLVED]
Replies: 3
Views: 1168

Re: Routing between VLANS not working - CRS305 [SOLVED]

Hi, It seems to work for me. Though having only 2 ip addresses in the dhcp server pools seems wrong. It could be the devices you are connecting too on the .200.x and/or 178.x vlans don't have the CRS305 as their default gateway. (eg. Not configured by the crs dhcp server) Could also be firewall rule...
by rplant
Sat Nov 09, 2024 1:24 am
Forum: General
Topic: 2.5Gbps on SPF+ ports broken
Replies: 3
Views: 2590

Re: 2.5Gbps on SPF+ ports broken

As mentioned by yourself a better option, get a 2.5G ethernet sfp to plug into the router.
Much cheaper and cooler than the 10G device.

fs.com have them.
by rplant
Sat Nov 09, 2024 1:13 am
Forum: General
Topic: 2.5Gbps on SPF+ ports broken
Replies: 3
Views: 2590

Re: 2.5Gbps on SPF+ ports broken

Given the routers are fairly powerful. For the outbound traffic, you can probably attach some sort of queue to the sfp+ interface. Queues based on cake are usually easy, perhaps fqcodel might be better in this case but I am no expert on queues. (I have had success with red queues in the past) Set it...
by rplant
Sat Nov 09, 2024 12:46 am
Forum: Beginner Basics
Topic: R.OS v7.15.2 PPPoe Client - Connected Without Internet
Replies: 2
Views: 2043

Re: R.OS v7.15.2 PPPoe Client - Connected Without Internet

Sorry, this isn't an answer, but the following may be worthwhile looking at. The following video shows a (fairly long) presentation on setting up something maybe similar (also on a 1036) using dhcp. From 2018 MUM in Melbourne, (unfortunately, there seems to be no printable version) https://www.youtu...
by rplant
Fri Nov 08, 2024 8:33 am
Forum: General
Topic: Issues with bandwidth [SOLVED]
Replies: 19
Views: 2088

Re: Issues with bandwidth [SOLVED]

One thought. You need to do your bandwidth test between 2 devices with the switches in between them. eg. A fast desktop/laptop/server ideally with a 10G port on it, to another desktop/laptop/server with a 10G port on it. Perhaps easier, 1G ports to start with. When the bandwidth test is running thro...
by rplant
Fri Nov 08, 2024 3:07 am
Forum: General
Topic: Issues with bandwidth [SOLVED]
Replies: 19
Views: 2088

Re: Issues with bandwidth [SOLVED]

Hi, Some comments: You have no firewall rules, so it should (if enabled) run in fastpath which is notionally faster than fasttrack. (I am kind of wishing there was a quickset that would apply a default set of firewall rules) These switches will do what I will call L3 switching, and do it really well...
by rplant
Mon Nov 04, 2024 12:40 pm
Forum: General
Topic: CRS3xx Bridge horizon vs Switch port isolation
Replies: 2
Views: 598

Re: CRS3xx Bridge horizon vs Switch port isolation

Perhaps because horizon has been around for a long time and works on all platforms (I believe)

Switch port isolation not so much. Use Switch port isolation if available.
by rplant
Mon Nov 04, 2024 12:15 pm
Forum: Beginner Basics
Topic: CG-NAT lab assistance [SOLVED]
Replies: 2
Views: 3104

Re: CG-NAT lab assistance [SOLVED]

Below is wrong on router1
(Needs to be .144.1)

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=65.58.144.2
by rplant
Mon Nov 04, 2024 8:51 am
Forum: General
Topic: Issue: Dual WAN Routing for HTTPS Access with Connection Mark and NAT Challenges
Replies: 5
Views: 1087

Re: Issue: Dual WAN Routing for HTTPS Access with Connection Mark and NAT Challenges

Hi, It isn't indicated in your listings, but if the default fasttrack rule is in place, it will break marked packets. You could put an accept rule just prior to the fasttrack rule, with a connection-mark=!no-mark (Or add connection-mark=no-mark to the fasttrack rule) Your 2 dst nat rules are identic...
by rplant
Fri Nov 01, 2024 6:27 am
Forum: General
Topic: Sluggish web browsing via Wireguard on Mikrotik [SOLVED]
Replies: 2
Views: 845

Re: Sluggish web browsing via Wireguard on Mikrotik [SOLVED]

My thought is to disable the fasttrack rule and see if that helps.

Fast tracked traffic does not get packet/routing marks applied.

If it helps, you might be better off with routing rules.
As they should continue to work with/without fasttrack.
by rplant
Wed Oct 23, 2024 8:03 am
Forum: Beginner Basics
Topic: Can't figure out port forwarding
Replies: 12
Views: 1945

Re: Can't figure out port forwarding

Rules look ok. Some guesses Does the mikrotik have the same internal ip address as the old router? Presumably .100 and .102 are set up with static ip configurations. Perhaps static arps have been configured somewhere Can .100 and .102 connect to the internet? Traceroute from these to 8.8.8.8 does it...
by rplant
Mon Oct 21, 2024 4:39 am
Forum: General
Topic: Is PtMP possible with NetBox 5AX ?
Replies: 2
Views: 464

Re: Is PtMP possible with NetBox 5AX ?

Yes.

It has license level 4, so can act as an ap for multiple devices.
(license level 3 only allows a single device)
by rplant
Thu Oct 17, 2024 9:02 am
Forum: Beginner Basics
Topic: Problem with switches behind Mikrotik
Replies: 5
Views: 1211

Re: Problem with switches behind Mikrotik

Hi, My guess(es) is that it might be something to do with Spanning tree, or more likely Vlan configuration. I would expect spanning tree to begin to work after a minute or so (worst case scenario) Perhaps the switch port you have plugged the router into is on a different vlan to the port the device ...
by rplant
Tue Oct 15, 2024 7:33 am
Forum: General
Topic: Asking for help: Setting Up a Multi-Site in-house Wireguard network [SOLVED]
Replies: 10
Views: 1482

Re: Asking for help: Setting Up a Multi-Site in-house Wireguard network [SOLVED]

Normally Wireguard uses a private key and public key, where the public key is not wrapped in a certificate. Assuming a client/server type configuration. If the clients have a peer (the only one in client/server) with the server's public key, it will trust and can connect to the server with the corre...
by rplant
Fri Oct 11, 2024 1:12 am
Forum: Beginner Basics
Topic: Connection Timeouts UDP / UDP Stream / SIP
Replies: 11
Views: 2999

Re: Connection Timeouts UDP / UDP Stream / SIP

RDP connection dying was one thread
viewtopic.php?p=992900
by rplant
Fri Oct 11, 2024 12:56 am
Forum: Beginner Basics
Topic: Simple Queues question
Replies: 3
Views: 991

Re: Simple Queues question

Have you disabled fasttrack for the affected/all traffic.

Simplest though blunt option is to disable the default fasttrack forward rule.
CPU usage will increase a lot.

Also, having limit-at on just one queue is probably bad. (Means it is guaranteed 50M, the others are Guaranteed nothing)
by rplant
Wed Oct 09, 2024 10:10 am
Forum: Beginner Basics
Topic: Configure a Single Switch (CRS305-1G-4S+) and ISP Router
Replies: 8
Views: 1534

Re: Configure a Single Switch (CRS305-1G-4S+) and ISP Router

I think this might be basically doable, so long as the ISP router can be configured with static routes on it. ie. 10.0.0.x/24 via 192.168.1.2 (the IP address I have assigned to the CRS) If a device on the main ISP LAN wants to connect to a device on your new LAN, it will send the packet to the ISP r...
by rplant
Tue Oct 08, 2024 1:34 pm
Forum: General
Topic: IPsec VPN Mikrotik - Sonicwall not using full internet speed
Replies: 8
Views: 1512

Re: IPsec VPN Mikrotik - Sonicwall not using full internet speed

You could perhaps try you iperf (I assume iperf3) With the -V and -M options.

Using custom/reduced MSS settings to see if it is perhaps something to do with reduced MTU at one end due to pppoe.
And add an appropriate mss adjustment rule if it helps
by rplant
Mon Oct 07, 2024 2:03 am
Forum: Beginner Basics
Topic: Connection Timeouts UDP / UDP Stream / SIP
Replies: 11
Views: 2999

Re: Connection Timeouts UDP / UDP Stream / SIP

The current default is 30S, it was 10S for quite a few versions, but there were plenty of people having issues with the 10S value.
by rplant
Fri Oct 04, 2024 3:03 am
Forum: Beginner Basics
Topic: Can't import the TLS key for OpenVPN
Replies: 2
Views: 2828

Re: Can't import the TLS key for OpenVPN

Hi, The tls auth thing is not a certificate. From: https://help.mikrotik.com/docs/display/ROS/OpenVPN OVPN client supports tls authentication. The configuration of tls-auth can be added only by importing .ovpn configuration file. Using tls-auth requires that you generate a shared-secret key, this ke...
by rplant
Thu Oct 03, 2024 10:04 am
Forum: MikroTik hardware questions
Topic: SFP transceivers to connect L009 & RB5009
Replies: 21
Views: 18035

Re: SFP transceivers to connect L009 & RB5009

Hi, From the MikroTik wired interface compatibility page. S+RJ10 devices Use these modules only in 10G SFP+ ports with auto-negotiation enable I am fairly sure the S+RJ10 devices need the SFP Port actually running at 10G (10.3G?) for the somewhat complex base T conversion electronics which likely ne...
by rplant
Sun Sep 29, 2024 3:05 am
Forum: General
Topic: Wanted feature in logging or info about logging issue.
Replies: 3
Views: 703

Re: Wanted feature in logging or info about logging issue.

Hi, I have found script diagnostics leave a bit to be desired. You can put something like: :log info "script scriptname starting" (perhaps also logging parameters if available) and perhaps a similar entry near the scripts exit point(s) With luck the most recent starting log entry will be a...
by rplant
Fri Sep 20, 2024 10:35 am
Forum: Beginner Basics
Topic: correct order of interfaces for PPPoE/VLAN-ISP connections? [SOLVED]
Replies: 3
Views: 1659

Re: correct order of interfaces for PPPoE/VLAN-ISP connections? [SOLVED]

Hi, I would suggest you start off with the default mikrotik config. Then Interface <ether1> contains <VLAN7> <pppoe-out1> is attached to <VLAN7> Enable dns client on <pppoe-out1>, (review settings of pppoe-out1) <dhcpv6-client> is running on <pppoe-out1> ** Changed ** <VLAN7> and <pppoe-out1> both m...
by rplant
Wed Sep 18, 2024 5:55 am
Forum: Beginner Basics
Topic: Upgrading router, Wireguard not working
Replies: 4
Views: 1237

Re: Upgrading router, Wireguard not working

Perhaps the following on the server /interface detect-internet set detect-interface-list=none /interface list member add comment=defconf interface="WG VPN" list=LAN You may want to eventually restrict it a bit more than giving it full LAN access, but in the short term... Client: Only if th...
by rplant
Sat Sep 14, 2024 6:32 am
Forum: Beginner Basics
Topic: Network two LAN-s through WireGuard
Replies: 3
Views: 2735

Re: Network two LAN-s through WireGuard

If you do want full l2 connectivity, perhaps you should investigate ZeroTier
(which is supported by Mikrotik)
I have not tried it, but I believe it will do this.
by rplant
Fri Sep 13, 2024 3:43 pm
Forum: Beginner Basics
Topic: Network two LAN-s through WireGuard
Replies: 3
Views: 2735

Re: Network two LAN-s through WireGuard

Some thoughts. A rough outline of what I would do. To hopefully create an approximation to what you appear to want. (Sorry there will likely be errors in this) This assumes somewhere near default config of the Mikrotiks. With a LAN interface list. The 192.168.169.0/24 is broken up into a bunch of /2...
by rplant
Fri Sep 13, 2024 3:33 am
Forum: Beginner Basics
Topic: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?
Replies: 9
Views: 1930

Re: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?

Hardware: Optical: If you can use prebought optical patch cables or DAC cables things are ok. As soon as you need to make stuff it gets very expensive for the tooling. And yes, copper cables are much more durable. But 10G copper seems to run very hot, so you need fan cooled switches, etc. dac cables...
by rplant
Thu Sep 12, 2024 1:39 pm
Forum: General
Topic: VLANs unable to do DNS lookup [SOLVED]
Replies: 5
Views: 2164

Re: VLANs unable to do DNS lookup [SOLVED]

Hi, You have the following rule before your allow dns to vlans. add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN Perhaps put all the input rules together and forward rules together. Sorry there may be other issues, that's just the one I s...
by rplant
Thu Sep 12, 2024 1:47 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1412

Re: Poor upload speeds with baby jumbo frames?

Not sure, seems like something dubious. One hack possibility (for tcp) might be to clamp the mss of your internal devices to 1452, while letting the outside devices stay at 1460. So your devices upload with shorter packets. /ip firewall mangle add action=change-mss chain=forward comment="clamp ...
by rplant
Wed Sep 11, 2024 10:14 am
Forum: Beginner Basics
Topic: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?
Replies: 9
Views: 1930

Re: Is the Mikrotik CRS312-4C+8XG-RM correct for my 10 Gbps ethernet network?

Sorry, not much of an answer but. 2. The speed of the switch mostly does not depend on the type of router. However, broadcast and similar packets will likely cause slowdowns as they have to go to everywhere including the slow bits on the lan segment. Would recommend you minimise the number of slower...
by rplant
Wed Sep 11, 2024 9:53 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1412

Re: Poor upload speeds with baby jumbo frames?

You could try something like the following from the mikrotik, and see if it replies (and the size at which it stops) /ping size=1500 8.8.8.8 do-not-fragment And with luck some indication of where it stops. (You can also use /tool/traceroute with size and do-not-fragment) Note: Traditionally 8.8.8.8 ...
by rplant
Wed Sep 11, 2024 4:46 am
Forum: Beginner Basics
Topic: Poor upload speeds with baby jumbo frames?
Replies: 7
Views: 1412

Re: Poor upload speeds with baby jumbo frames?

You could try an mtu on the vigor of 1508 (to include the pppoe header) or even 1512 (to also include the vlan) and see if that helps.
by rplant
Sat Sep 07, 2024 1:22 pm
Forum: General
Topic: Windows btest.exe super-duper slow
Replies: 3
Views: 1662

Re: Windows btest.exe super-duper slow

You have to type in a speed, and it will try to get to that speed.
(You can't leave it at 0)

eg. 1M 10M 100M
by rplant
Sat Sep 07, 2024 1:04 pm
Forum: Beginner Basics
Topic: Help bridging L2TP to port with external IPs
Replies: 2
Views: 761

Re: Help bridging L2TP to port with external IPs

Hi,
The following topic is very similar to what I think you want (except they were getting the address via pppoe)

viewtopic.php?p=1070581#p1070581
by rplant
Thu Sep 05, 2024 6:45 am
Forum: MikroTik hardware questions
Topic: 2.5 gig RJ45 SFP for L009 router
Replies: 2
Views: 6738

Re: 2.5 gig RJ45 SFP for L009 router

The following has their tested items MikroTik wired interface compatibility https://help.mikrotik.com/docs/pages/viewpage.action?pageId=263749679 Pretty much all their 10G optical SFP's and Dac cables are indicated to work in an L009 (in forced 2.5G mode). For low power/temperature/cost You could us...
by rplant
Mon Sep 02, 2024 10:44 am
Forum: Beginner Basics
Topic: Problem with accessibility of sites through WG
Replies: 7
Views: 1405

Re: Problem with accessibility of sites through WG

Perhaps something like the following in the central router. /ip firewall filter #existing rules ... #following rules just before existing invalid rule. #(Put them in via terminal, then move them using winbox/webfig) add action=accept chain=forward comment="allow traffic between wg and lan"...
by rplant
Mon Sep 02, 2024 6:41 am
Forum: Beginner Basics
Topic: Problem with accessibility of sites through WG
Replies: 7
Views: 1405

Re: Problem with accessibility of sites through WG

My Guess Assuming the internet gateway is a Mikrotik and is using something similar to the default config, asymmetric routing that might be the issue. Wg -> Lan Device and Lan Device -> MainGateway -> Wg If it is this, there are a at least a couple of options: 1. On the WG mikrotik enable masquerade...
by rplant
Sun Aug 25, 2024 2:14 pm
Forum: General
Topic: CRS310-8G+2S+ is choking my internet bandwidth
Replies: 5
Views: 1026

Re: CRS310-8G+2S+ is choking my internet bandwidth

It looks like the CRS310 won't do nat or fasttrack connections in hardware, so mostly good for inter vlan routing maybe using some access lists, much less good as an internet gateway, with Nat, Stateful Firewalling, etc. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOff...
by rplant
Sun Aug 25, 2024 3:54 am
Forum: Beginner Basics
Topic: Forwarding 1 interface to another
Replies: 6
Views: 1664

Re: Forwarding 1 interface to another

Hi, I would also include the first routing rule below. It allows devices on your wifi subnet to connect to other local devices, and only internet bound traffic goes via the vpn. (Order matters, put it before the other rule) Note: If using winbox, you likely should have still been able to connect to ...
by rplant
Sun Aug 25, 2024 3:40 am
Forum: Beginner Basics
Topic: hEX on Switch should manage access to printer [SOLVED]
Replies: 20
Views: 2391

Re: hEX on Switch should manage access to printer

You need two or more different vlan's on the hex. The hex needs to have an IP address assigned to it for each vlan. The devices on each vlan need to have the hex as their default gateway. (Alternatively each vlan's default gateway/router could have a static route for the other vlan(s) pointing to th...
by rplant
Sat Aug 24, 2024 8:49 am
Forum: Beginner Basics
Topic: Microtik hotspot with Wavlink AC1200 in mesh mode
Replies: 5
Views: 1847

Re: Microtik hotspot with Wavlink AC1200 in mesh mode

If the mesh router has the option to disable it's dhcp server, you could do that.

Then plug the mikrotik's LAN port into one of the lan ports of the router, and see if devices connect to the Mikrotik.
(You may need later to change the ip address of the mesh router as well)
by rplant
Fri Aug 23, 2024 2:34 am
Forum: General
Topic: HELP Tried the PCC load balancing from mikrotik YouTube vid but it doesn't work for me I might be doing something wrong
Replies: 20
Views: 3429

Re: HELP Tried the PCC load balancing from mikrotik YouTube vid but it doesn't work for me I might be doing something wr

You have to ensure that the appropriate packets don't go via fasttrack. Either by having an accept statement for these packets prior to the fasttrack rule or by disabling the fasttrack rule. One possible option (just prior to fasttrack rule) add action=accept chain=forward comment="accept estab...
by rplant
Wed Aug 21, 2024 7:52 am
Forum: Beginner Basics
Topic: hAP ac3 NAT forwarding issues [SOLVED]
Replies: 9
Views: 3937

Re: hAP ac3 NAT forwarding issues [SOLVED]

Hi, A couple of points, The screenshot doesn't really show what you are doing. Mikrotik doesn't do hairpin nat by default, so it might work from outside but not from inside your network. You could open a terminal window (from webfig, up the top near rhs), and export the entire config, or just the fi...
by rplant
Wed Aug 14, 2024 4:46 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 2922

Re: lot of sites dont load on the first try

In another thread @mkx mentioned that adjust mss will probably not work if the connection is fasttracked.
You could try and disable the fasttrack rule briefly.
by rplant
Mon Aug 12, 2024 9:12 am
Forum: General
Topic: CCR 1016-12G 2Gbit upgrade recomendation
Replies: 6
Views: 1328

Re: CCR 1016-12G 2Gbit upgrade recomendation

Likely you are going to have to go for a ccr with at least 1 SFP+ port, and perhaps 2. eg. CCR1036-8g-2s+ if you can find one. Then how does your ISP provide you with 2Gbe, it seems like a non-standard value. If over a 2.5Gbe ethernet connection, none of the CCR 10xx series supports this directly. Y...
by rplant
Mon Aug 12, 2024 8:48 am
Forum: General
Topic: Wireguard issues; can connect but can't access hosts
Replies: 5
Views: 986

Re: Wireguard issues; can connect but can't access hosts

Have you added 10.0.2.3/32 as an allowed IP address in the Peer setting on the Mikrotik?

When you look at the peer setting on the Mikrotik are you getting updated Tx, Rx and Last Handshake values.
by rplant
Fri Aug 09, 2024 1:09 pm
Forum: General
Topic: UPnP / NAT-PMP question
Replies: 4
Views: 1091

Re: UPnP / NAT-PMP question

Upgrade the ccr2116 to the latest beta version,
generate a supout.rif while working, and another when broken.
(Assuming it's not fixed)

And submit them in the ticket.
Support are quite good, and it is one of their flagship products you are having issues with...
by rplant
Thu Aug 08, 2024 2:07 am
Forum: General
Topic: EoIP+bridge Over WAN
Replies: 8
Views: 1265

Re: EoIP+bridge Over WAN

One thought,
Do you have appropriate firewall rules to allow gre protocol in from the remote peer?

The default rules cause Traffic wrapped in ipsec to be allowed.
by rplant
Wed Aug 07, 2024 7:59 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 2922

Re: lot of sites dont load on the first try

Yet another possibility is broken dns.

If on windows open a command prompt,
type nslookup

And try a few sites (including some you haven't recently used)
does it return immediately with a result?

Is the dns server nslookup is using correct?
by rplant
Wed Aug 07, 2024 7:55 am
Forum: Beginner Basics
Topic: Slow speed - basic settings
Replies: 1
Views: 816

Re: Slow speed - basic settings

You appear to have different wireless protocols at each end.
by rplant
Wed Aug 07, 2024 4:34 am
Forum: Beginner Basics
Topic: Hybrid ports and VLAN for tagged and untagged connections.
Replies: 10
Views: 1850

Re: Hybrid ports and VLAN for tagged and untagged connections.

A problem is that out of your switch, every port has both the tagged and the untagged vlans coming out of it and going into it. One Possible option would be to make vlan 1 something else other than 1. eg. 10 Then you could have vlan 20 as the untagged vlan, and vlan 10 as the tagged vlan going to th...
by rplant
Wed Aug 07, 2024 2:29 am
Forum: General
Topic: EoIP+bridge Over WAN
Replies: 8
Views: 1265

Re: EoIP+bridge Over WAN

Sorry, not an answer but.

Pretty sure the ipsec is going to be hardware offloaded, so it is going to take minimal cpu.
by rplant
Wed Aug 07, 2024 2:25 am
Forum: General
Topic: Steps to configure CRS326-24S+2Q+RM as a L3 Switch wihtout Router-on-a-stick
Replies: 23
Views: 2742

Re: Steps to configure CRS326-24S+2Q+RM as a L3 Switch wihtout Router-on-a-stick

Mostly the Gui is similar to the way the cli is laid out.
The switch menu is a bit different. It is a top level menu in the Gui.
by rplant
Wed Aug 07, 2024 2:16 am
Forum: General
Topic: 4011 2.5Gb SFP Module
Replies: 1
Views: 816

Re: 4011 2.5Gb SFP Module

I have tried (a few times) and also failed to get a 2.5g connection working on an RB4011 :(

**edit:** Note my RB4011 is an old one, I believe they have had a couple of versions of RB4011.
by rplant
Tue Aug 06, 2024 2:44 am
Forum: General
Topic: RB2011uiAS upgrade backup-routerbooot
Replies: 12
Views: 4469

Re: RB2011uiAS upgrade backup-routerbooot

In the wiki version it notes

The backup RouterBOOT version can not be older than v3.24 version.

So presumably given yours is newer than this, you don't need an upgraded backup routerboot. (so it won't let you upgrade it perhaps)
by rplant
Mon Aug 05, 2024 2:23 am
Forum: MikroTik hardware questions
Topic: How to intentionally make cable that will negotiate at 10 mbps?
Replies: 16
Views: 6715

Re: How to intentionally make cable that will negotiate at 10 mbps?

A possibility is to split the pairs and run it over a few meters, it will give lots of crosstalk and poor performance, but whether it is enough I don't know. eg. Pairs 1,4 2,3 5,8 6,7 or 1,3 2,4 5,7 6,8 (Cable terminated same at both ends) The cables will test as a simple straight cable (with a very...
by rplant
Sun Aug 04, 2024 7:23 am
Forum: General
Topic: question about "wireguard responder"
Replies: 15
Views: 5235

Re: question about "wireguard responder"

It used to (at minimum) stop a lot of annoying log messages on the server, I assume it still might.
by rplant
Sun Aug 04, 2024 7:19 am
Forum: General
Topic: How to setup 10GBit/s copper TP-Link SFP+ modules for CCR2004-16G-2S+.
Replies: 4
Views: 1102

Re: How to setup 10GBit/s copper TP-Link SFP+ modules for CCR2004-16G-2S+.

Try it in both negotiated and non negotiated mode, with each of the 3 (current) 10G settings.
10G base T
10G BaseCR
10G BaseSR LR

And see if any of them work.
by rplant
Sun Aug 04, 2024 7:06 am
Forum: Beginner Basics
Topic: Is this vlan setting correct? [SOLVED]
Replies: 9
Views: 4907

Re: Is this vlan setting correct? [SOLVED]

Some minor changes. # cisco interface Ethernet0/0 description trunk from mikrotik switchport trunk encapsulation dot1q switchport trunk allowed vlan 10,20 switchport mode trunk #mikrotik # (Use bridge instead of ether1) /interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge...
by rplant
Sun Aug 04, 2024 6:35 am
Forum: Beginner Basics
Topic: Basic Router setup on CRS310-1G-5S-4S+
Replies: 8
Views: 1382

Re: Basic Router setup on CRS310-1G-5S-4S+

As a switch it will have plenty of speed between your devices. However connections to the internet via your ISP will need routing with firewalling and presumably Nat. For 2.5G you will need a reasonably powerful router performing this task. If your ISP provided a router you can use it for that task ...
by rplant
Fri Aug 02, 2024 6:11 am
Forum: General
Topic: RB2011uiAS upgrade backup-routerbooot
Replies: 12
Views: 4469

Re: RB2011uiAS upgrade backup-routerbooot

look at the protected bootloader section of the above document
by rplant
Fri Aug 02, 2024 5:39 am
Forum: Beginner Basics
Topic: lot of sites dont load on the first try
Replies: 16
Views: 2922

Re: lot of sites dont load on the first try

Another thought, Partially working ipv6 can cause similar problems.

Try turning off ipv6 on the router.

From winbox
ipv6 settings tick the disable ipv6 box and wait a short while.
(May need to reboot PC if want it to update faster)
by rplant
Thu Aug 01, 2024 2:48 am
Forum: General
Topic: Post 7.13 incompatible station bridge versions
Replies: 2
Views: 962

Re: Post 7.13 incompatible station bridge versions

Yes, you could have used the wireless package, and the map could then connect in station bridge. Wifi package does have some niceish features though. Other options: Use Station-Pseudo bridge mode. Ok when it works, need to turn off RSTP. If you go this way and it's not behaving it is worth searching...
by rplant
Wed Jul 31, 2024 8:19 am
Forum: MikroTik hardware questions
Topic: RB5009UG+S+IN dual power power [SOLVED]
Replies: 15
Views: 26526

Re: RB5009UG+S+IN dual power power [SOLVED]

Yes,
If you use poe as an alternate power source, it must be passive/forced on poe or the Mikrotik may lose power when main/other power is lost. (Usually briefly but...)
by rplant
Tue Jul 30, 2024 3:43 am
Forum: Beginner Basics
Topic: Trouble Loading RSC File
Replies: 4
Views: 1172

Re: Trouble Loading RSC File

A couple of options. 1. Reset the mikrotik with no default config, (but perhaps keep users), and then try to import the file. 2. Open the file in notepad or similar and copy and paste a section at a time into the terminal. You might be wise to compare the current default config to the config you wan...
by rplant
Mon Jul 29, 2024 5:51 am
Forum: General
Topic: Upgrading Rooterboot factory software
Replies: 25
Views: 9293

Re: Upgrading Rooterboot factory software

I think documentation means devices with version 7 factory firmware, but less than 7.6 get upgraded to a v7.6 factory firmware with protected router boot function. Devices with older (v3, v6) factory firmware get an updated factory firmware (not v7) which has the new protected router boot function. ...
by rplant
Sun Jul 28, 2024 2:31 pm
Forum: Beginner Basics
Topic: help creating "allow" rule via switch ACL
Replies: 5
Views: 1336

Re: help creating "allow" rule via switch ACL

You can probably enable dhcp relay on the appropriate switch vlans.
And have your dhcp server managing the vlan (remotely).
by rplant
Sun Jul 28, 2024 2:19 pm
Forum: Beginner Basics
Topic: help creating "allow" rule via switch ACL
Replies: 5
Views: 1336

Re: help creating "allow" rule via switch ACL

You could set it up with the CRS317 as the gateway for both VlanA and VlanB The CRS ROUTES packets from vlanA and vlanB to the router. (and between vlan A and vlan B) No firewall rules needed on CRS for internet traffic, so should be L3WH offloaded, (with very few if any ACL's) Rules/ACLs, mostly fo...
by rplant
Sat Jul 27, 2024 11:21 am
Forum: General
Topic: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]
Replies: 6
Views: 5395

Re: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]

A couple of thoughts, The following statement doesn't really seem helpful given your current results, but anyway: Mikrotik doesn't by default do hairpin Nat (you need to add the appropriate src-nat rule), so if you are testing from inside your network it will likely not work. You could download tcpr...
by rplant
Sat Jul 27, 2024 8:20 am
Forum: General
Topic: VPN IPSEC
Replies: 1
Views: 463

Re: VPN IPSEC

Hi,
License wise:
Not sure there is a limit for raw ipsec.
There is a 500 user one for l2tp.

However, the processor on the RB2011 doesn't do ipsec hardware encryption, and does not have much Ram.
So really only a couple maybe. You would be better off with wireguard with the 2011.
by rplant
Sat Jul 27, 2024 8:01 am
Forum: General
Topic: Wireguard setup
Replies: 2
Views: 635

Re: Wireguard setup

When a road warrior client from router 1 is connected it can not reach ip's behind the nat of router 2 (which is possible from within router1 main network (and the other way around). Assuming there is no NAT going on. (ie. The packet from 192.168.35.1 reaches device on router 2 as being from 192.16...
by rplant
Sat Jul 27, 2024 7:51 am
Forum: General
Topic: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]
Replies: 6
Views: 5395

Re: Packets for port 80 disappear before reaching NAT or filtering [SOLVED]

Hi, I think you could start by checking the counters on the dst-nat rules, and see if they increment. (They happen early in the firewall) Typically they will only increment once for each new connection. If they are incrementing, you need to check the 10.0.0.39 (I assume nginx) Perhaps if not increme...
by rplant
Fri Jul 26, 2024 2:37 am
Forum: Beginner Basics
Topic: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP
Replies: 4
Views: 1764

Re: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP

Fair enough, Perhaps your option 2 would be a good option, you then effectively have a site to site tunnel, and can tunnel whichever clients you want. Option 1 is doable and will most times be fairly well upgraded. However it is not perfect. (Make a script export and a normal backup onto external st...
by rplant
Thu Jul 25, 2024 3:32 am
Forum: Beginner Basics
Topic: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP
Replies: 4
Views: 1764

Re: Connect to L2TP/IPSEC VPN from 2 devices with the same public IP

I would recommend you experiment with wireguard.
(Even if just for this particular instance)
by rplant
Wed Jul 24, 2024 3:04 pm
Forum: Beginner Basics
Topic: IPsec VPN - NAT rule to reach the server
Replies: 6
Views: 1208

Re: IPsec VPN - NAT rule to reach the server

You could possibly add a src-nat rule something like

/ip firewall nat
chain=srcnat dst-address=171.11.153.20 src-address=192.168.1.0/24 action=src-nat to-addresses=171.11.153.21

Move it up above any masquerade rules already there.
by rplant
Wed Jul 24, 2024 3:50 am
Forum: General
Topic: Loopback for RFC2544 testing
Replies: 3
Views: 2082

Re: Loopback for RFC2544 testing

For generic case, perhaps not. (maybe a container?)

But for a single source ip sending data, you could probably use a dst-nat and src-nat pair of rules, to send the traffic back.
by rplant
Wed Jul 24, 2024 3:34 am
Forum: General
Topic: Prefix deligation over WireGuard
Replies: 1
Views: 579

Re: Prefix deligation over WireGuard

You can run your eoip or other tunnel inside wireguard. Though I would perhaps attempt to set up ipv6 and associated routing on the Mikrotik manually, using one of the /64's. You would maybe need to somehow mark the prefix as used though, so the VPS does not try to reuse it. You might need to put (n...
by rplant
Tue Jul 23, 2024 2:57 pm
Forum: MikroTik hardware questions
Topic: Doesn't seem to boot no matter what reset mode I try
Replies: 2
Views: 5238

Re: Doesn't seem to boot no matter what reset mode I try

beep twice usually means it thinks it is ready to start running. You could try connecting to it via wifi, it may have some mikrotik-XXXX ssid with no password. If it is similar to a map/wap, then Wifi is often the only way to connect to this type of device when factory defaulted, but usually the eth...
by rplant
Tue Jul 23, 2024 2:48 pm
Forum: MikroTik hardware questions
Topic: wAP ac (RBwAPG-5HacT2HnD) rebooting every 10 seconds
Replies: 3
Views: 4409

Re: wAP ac (RBwAPG-5HacT2HnD) rebooting every 10 seconds

I would also suggest you get a Low ESR capacitor (as well as of 105° type).
by rplant
Mon Jul 22, 2024 9:05 am
Forum: General
Topic: most "cold" RJ45 SFP+ modules
Replies: 5
Views: 1177

Re: most "cold" RJ45 SFP+ modules

fs.com have a few rj45 sfp+ modules.

They range in power consumption from 1.8W to 2.9W
Apparently the S+RJ10s is around 2.7W, so the 1.8W one might be good.
(but quite pricey)

Sorry I don't know how well or hot it works, or if it will work with a Mikrotik.
though fs is usually well supported
by rplant
Mon Jul 22, 2024 8:55 am
Forum: General
Topic: RB-751 failure, and back ups corrupted [SOLVED]
Replies: 18
Views: 5829

Re: RB-751 failure, and back ups corrupted [SOLVED]

It sounds like you are trying to restore a binary backup file to a new router. That rarely works :( You could search your hard disk for .rsc script files. If you can login to the old one at all (though it sounds unlikely), do a /export, stick it onto your laptop, and manually carefully copy the conf...
by rplant
Sat Jul 20, 2024 3:20 am
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1010

Re: Speed Limitation Issues with RB3011.

I tried it running with 6.49.13, and that was much improved.

Unfortunately doesn't have the cake queues, but the other queues I tried
seemed to handle 1G ok.
CPU still seemed to be largely locked to 1 core, and still needed multiple streams
or large window to get to 1G ish.
by rplant
Fri Jul 19, 2024 1:32 pm
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1010

Re: Speed Limitation Issues with RB3011.

I had a try with some of this, just to a local iperf3 server. So very little latency unlike over the internet. I found I had to disable the queue tree for best performance. To hit near a gig download I had to have a large window size, or multiple streams. Perhaps partly a limitation of the iperf3 se...
by rplant
Fri Jul 19, 2024 11:13 am
Forum: General
Topic: Speed Limitation Issues with RB3011.
Replies: 3
Views: 1010

Re: Speed Limitation Issues with RB3011.

Hi, It seems unlikely to be good for a 1G connection, Apparently a single connection will only use 1 core. (To reduce out of order packets) From: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults The commonly used 25 IP filter rules, and 512 byte packets lists 452Mbps. Your actual perform...
by rplant
Wed Jul 10, 2024 3:41 am
Forum: General
Topic: SFP port Doesn't work on CCR2004
Replies: 8
Views: 1256

Re: SFP port Doesn't work on CCR2004

Yes there have been many many sfp fixes, and complaints of devices that used to work that no longer do. You could get install the latest betas at both ends (including updating routerboot), and assuming it is still not working create a supout.rif and send to support at mikrotik.com The -40db is a wor...
by rplant
Wed Jul 10, 2024 3:30 am
Forum: MikroTik hardware questions
Topic: L009 copper SFPs
Replies: 11
Views: 5515

Re: L009 copper SFPs

The S+RJ10 plugs into a 10G sfp+ interface.
The L009 has a 2.5G sfp interface.
by rplant
Wed Jul 10, 2024 3:26 am
Forum: General
Topic: wifi Multicast flood
Replies: 6
Views: 1158

Re: wifi Multicast flood

That feels like a bug.

I think the Mikrotik radio should likely have its own multicast subscriber list and send it to only its subscribed stations.
by rplant
Mon Jul 08, 2024 2:50 pm
Forum: MikroTik hardware questions
Topic: L009 copper SFPs
Replies: 11
Views: 5515

Re: L009 copper SFPs

I gain the impression that the S+RJ10 still runs quite warm, as its backend has to be run at approx 10.3G
(whether connected on the RJ45 side at 1G, 2.5G, or 10G)

While an actual 2.5G unit's backend runs at 2.5G (* 10/8).
(Whether connected on the RJ45 side at 2.5G, 1G or lower speeds)
by rplant
Sun Jul 07, 2024 2:14 pm
Forum: General
Topic: SFP port Doesn't work on CCR2004
Replies: 8
Views: 1256

Re: SFP port Doesn't work in CCR2004

Winbox:

Perhaps under ethernet tab for sfp, turn off auto negotiation and set speed to 1G Base X
at both ends.

Make sure fibre is correct, (looks to need single mode fibre)
by rplant
Thu Jul 04, 2024 3:20 am
Forum: General
Topic: Wireguard does not work after reboot
Replies: 19
Views: 2466

Re: Wireguard does not work after reboot

I found out empirically that if you turn off the interfaces and peers on both routers for 10-15 minutes and then turn them on, everything works. I think I have seen something similar in the past, if you turned off the wireguard interface and then turned it back on it fairly soon after. It didn't se...
by rplant
Wed Jul 03, 2024 1:58 pm
Forum: General
Topic: Wireguard does not work after reboot
Replies: 19
Views: 2466

Re: Wireguard does not work after reboot

Sorry, don't know. However I would turn off the persistent-keepalive on router-B. Perhaps trying to connect back to the IP/Port it was last connected too is doing something. Also, you can check the counters on the firewall rule on Router-B, and see if packets are actually getting in, enable logging ...
by rplant
Wed Jul 03, 2024 5:28 am
Forum: Forwarding Protocols
Topic: send udp packet with destination 255.255.255.255 to other subnet In router
Replies: 5
Views: 5832

Re: send udp packet with destination 255.255.255.255 to other subnet In router

I have in the past done the following

/ip arp
add address=192.168.44.252 interface=bridge-local mac-address=\
FF:FF:FF:FF:FF:FF

I was using it for Wake on Lan.
To any device on the 192.168.44.0/24 network

** Edit: on review, this is an answer to a different question :( **
by rplant
Wed Jul 03, 2024 5:18 am
Forum: General
Topic: Loop error even though RSTP is enabled
Replies: 6
Views: 1038

Re: Loop error even though RSTP is enabled

My guess is that it is doing what it is supposed to, but perhaps imperfectly.

The spanning tree needs reconfiguring, and it does this, but some looped packets get through.
But it seems to resolve quickly.
by rplant
Wed Jul 03, 2024 4:44 am
Forum: General
Topic: Wireguard: only the last edited peer is working [SOLVED]
Replies: 10
Views: 4260

Re: Wireguard: only the last edited peer is working [SOLVED]

Usually means you have overlapping allowed addresses on your peer configurations. This is an error. If this what you actually need and want, (eg. you want to use ospf to the peers and route via the ospf chosen link, etc) You need to have multiple wireguard interfaces with one (overlapping) peer per ...
by rplant
Tue Jul 02, 2024 2:47 pm
Forum: Beginner Basics
Topic: Mangle Rules with Multi WAN
Replies: 6
Views: 2526

Re: Mangle Rules with Multi WAN

Hi, I have a dhcp-client script that changes some of the routes. /ip dhcp-client add default-route-distance=70 interface=ether2 script="/ip route\r\ \n:if (\$bound = 1) do={\r\ \n set [find where comment~\"altgw\"] gateway=\$\"gateway-address\"\r\ \n}" I also find it be...
by rplant
Tue Jul 02, 2024 2:04 pm
Forum: Beginner Basics
Topic: Tunneling internet traffic through IPsec tunnel
Replies: 8
Views: 2145

Re: Tunneling internet traffic through IPsec tunnel

Perhaps get a hap ac2 as a gateway router in front of the switch at the home end.

Then you can have hardware offloaded ipsec at both ends if you want that.
Or wireguard. (I like wireguard, but hardware offloaded ipsec can be quite fast)
by rplant
Tue Jul 02, 2024 6:54 am
Forum: General
Topic: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease
Replies: 11
Views: 2134

Re: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease

You should perhaps change the bucket size on the queue to 0.01

If it works ok, do same for the other ethernet ports. (ether1 with 2.5G max-limit)
by rplant
Mon Jul 01, 2024 9:19 am
Forum: General
Topic: Specify IPsec proposal and profile for IPIP/IPsec
Replies: 4
Views: 768

Re: Specify IPsec proposal and profile for IPIP/IPsec

Or perhaps run the ipip over a wireguard tunnel.

Even better with luck might be able to just use a wireguard tunnel, without ipip.
by rplant
Mon Jul 01, 2024 8:51 am
Forum: General
Topic: Specify IPsec proposal and profile for IPIP/IPsec
Replies: 4
Views: 768

Re: Specify IPsec proposal and profile for IPIP/IPsec

So it is not possible if the peer is on dynamic IP? Yes, You can look at the ipsec setup created when you add ipsec to the ipip tunnel and make something similar. But I think ipip requires a fixed address at each end anyway. You could possibly use an ikev2 tunnel, (where the client can get a fixed ...
by rplant
Mon Jul 01, 2024 8:33 am
Forum: General
Topic: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease
Replies: 11
Views: 2134

Re: Please help :| RB5009 with 2.5G Advertise allowed, dramatic speed decrease

You could try attaching a queue onto the LAN ethernet port you are using and see what that does. (ether2...) Make a new queue type using cake, probably near default. Create a new queue, (Queue tree) with your new queue type, attach with parent as ether2, and set with a max limit of 1G. Assuming you ...
by rplant
Mon Jul 01, 2024 8:21 am
Forum: General
Topic: Show IP of client connected to each port
Replies: 3
Views: 762

Re: Show IP of client connected to each port

You could do a tool/ ip scan, which should refresh the Arp table.

Arp entries are often only seen/updated when the router/switch needs them.
Which is rarely if running as an L2 switch.
by rplant
Mon Jul 01, 2024 8:17 am
Forum: General
Topic: PPPoE interface address
Replies: 2
Views: 487

Re: PPPoE interface address

Not sure, but possibly if you do that, it can't tell the remote end (client) what the server end IP address is. This usually doesn't matter, except perhaps if you want to ping the server from the client. (I don't know that windows likes it much though)   There is a couple of places to setup the loca...
by rplant
Fri Jun 28, 2024 4:26 am
Forum: Forwarding Protocols
Topic: WireGuard slowdown after minutes
Replies: 6
Views: 4489

Re: WireGuard slowdown after minutes

Hi,

You don't seem to have an IP address on the wireguard interface, but then you are using masquerade on that interface??

The first /ip firewall rule (I assume is filter) seems a bit doubtful.
by rplant
Thu Jun 27, 2024 9:23 am
Forum: General
Topic: RB4011 + GPON
Replies: 2
Views: 610

Re: RB4011 + GPON

You can get GPON ONU sfp modules. However you would need to get the ISP, or their wholesaler to agree to you using the 3rd party module. You would need to provide them with some information about it, perhaps its mac address and/or serial number, not sure. They can then add the ONU information onto t...
by rplant
Wed Jun 26, 2024 7:37 am
Forum: Beginner Basics
Topic: Publishing WebApp through static IP
Replies: 2
Views: 874

Re: Publishing WebApp through static IP

I assume the ISP's router is doing Nat? Or is it handing the IP address off to the Mikrotik in some fashion? If ISP router is doing NAT, it will also need a port forward (likely to the Mikrotik, possibly direct to the web server) The web app server needs to know it is running on port 8080, or more u...
by rplant
Wed Jun 26, 2024 6:20 am
Forum: General
Topic: Possible L2 MTU issues with EoIP Tunnel and Bridge
Replies: 5
Views: 1722

Re: Possible L2 MTU issues with EoIP Tunnel and Bridge

You can set both the wireguard and eoip mtu's to 1500, it becomes less efficient as the larger packets are fragmented, but they get rebuilt at the endpoint. Perhaps set the eoip mtu to 1500 and leave the wireguard one at 1420 (1420 assumes no pppoe). An alternative, you can use a mangle rule to do m...
by rplant
Tue Jun 25, 2024 1:18 pm
Forum: Beginner Basics
Topic: connecting port to the dsl modem [SOLVED]
Replies: 1
Views: 3680

Re: connecting port to the dsl modem [SOLVED]

Hi, Assuming a near default mikrotik configuration. I will make ether2 the second port. You need the ip address and netmask of the Zyxel. Using winbox (or webfig) From Bridge, Ports tab Remove, or disable the ether2 entry from the default bridge. From ip/address, create a new ip address in the same ...
by rplant
Mon Jun 24, 2024 5:45 am
Forum: MikroTik hardware questions
Topic: 10G-LR instability in CCR2116-12G-4S+
Replies: 4
Views: 5696

Re: 10G-LR instability in CCR2116-12G-4S+

Try enabling "Ignore Rx LOS" and see if that helps.

If not, make a supout.rif while broken, running on 7.16b2 and send it to Mikrotik support.

They have been making many changes to the SFP code...
by rplant
Mon Jun 24, 2024 5:35 am
Forum: Beginner Basics
Topic: Mikrotik as OpenVPN client, lan behind mikrotik?
Replies: 1
Views: 949

Re: Mikrotik as OpenVPN client, lan behind mikrotik?

Assuming near default Mikrotik configuration. Likely option is you need to make the openvpn client interface on the Mikrotik a member of the LAN interface list. The following seems likely already done, you need to have routes on the Asus telling it the mikrotik lan network IP's are via the openvpn c...
by rplant
Mon Jun 24, 2024 5:25 am
Forum: Beginner Basics
Topic: Problems with wireguard and Mobile Data
Replies: 3
Views: 1627

Re: Problems with wireguard and Mobile Data

Hi, Check the counters on the following rule. /ip firewall filter add action=accept chain=input comment=Wireguard dst-port=54321 protocol=udp If when you try to connect via mobile, it doesn't increment at least the once it cannot work. You could try changing the port. Other things to check (Once the...
by rplant
Mon Jun 24, 2024 5:11 am
Forum: Beginner Basics
Topic: Internet Connectivity Issue with MikroTik Router [SOLVED]
Replies: 6
Views: 5171

Re: Internet Connectivity Issue with MikroTik Router [SOLVED]

Make sure that Vlan832-internet is a member of the WAN interface list.
Double check that bridge is a member of the LAN interface list.

Disable your first srcnat rule.
(Can try reenabling it once you have it working)
by rplant
Sat Jun 22, 2024 4:20 am
Forum: Beginner Basics
Topic: PPPoE offload [SOLVED]
Replies: 3
Views: 5048

Re: PPPoE offload [SOLVED]

The following might help

viewtopic.php?p=1070581#p1070581

Though now days, the hex is not super quick either :(
by rplant
Wed Jun 19, 2024 12:51 pm
Forum: Beginner Basics
Topic: How to set udp-timeout and udp-stream-timeout [SOLVED]
Replies: 2
Views: 4217

Re: How to set udp-timeout and udp-stream-timeout [SOLVED]

ip firewall, choose connections tab, then click on tracking button.
by rplant
Mon Jun 17, 2024 7:52 am
Forum: Forwarding Protocols
Topic: VPLS Bridge but no traffic
Replies: 2
Views: 3759

Re: VPLS Bridge but no traffic

Fairly sure that mpls requires a layer 2 equivalent under it, which gre isn't.

You could perhaps use eoip, or vxlan.
Not seeing a lot of point of then running mpls over these.

You could run these 2 protocols over wireguard or ipsec (I like wireguard)
sstp is good, but not very performant.
by rplant
Mon Jun 17, 2024 2:57 am
Forum: Beginner Basics
Topic: IPIP vpn - basic question
Replies: 2
Views: 884

Re: IPIP vpn - basic question

Have a look at wireguard, it is very good, and handles NAT well.

You will likely need something brisk for 20-30 clients at a good speed.
Perhaps an RB5009 (or low end ccr) would be a good starting point.
by rplant
Fri Jun 14, 2024 2:02 pm
Forum: General
Topic: hap aX3 performance issue?
Replies: 8
Views: 1218

Re: hap aX3 performance issue?

Hi, I have seen a post for something maybe similar, where the solution was to make the queue on ether1 a multi-queue-ethernet-default queue. (Assumes ether1 is internet) (Maybe you could try multi-queue-ethernet-default on the other interfaces as well) If this doesn't help: You could perhaps experim...
by rplant
Fri Jun 14, 2024 9:20 am
Forum: MikroTik hardware questions
Topic: Beginner Attempt at Fiber a Fail - Help Needed
Replies: 2
Views: 4253

Re: Beginner Attempt at Fiber a Fail - Help Needed

There have been other questions about the 10GTek device, perhaps this might help. https://forum.mikrotik.com/viewtopic.php?p=1067590#p1067590 I have not used this sfp module, (or the css switch), but I find on their routers, using 1G base X is a good choice for connectivity. Also there have been a l...
by rplant
Fri Jun 14, 2024 8:56 am
Forum: General
Topic: How Can I Show A Custom Message When Blocking Sites Using FireWall?
Replies: 6
Views: 4299

Re: How Can I Show A Custom Message When Blocking Sites Using FireWall?

Hi,

You can try using sni

search for tls-host in the following
https://help.mikrotik.com/docs/display/ ... nd+Actions

Unfortunately, sni inspection is becoming unavailable with the advent of TLS 1.3, so is working less and less well.
by rplant
Wed Jun 12, 2024 1:38 pm
Forum: General
Topic: Does CCR2004-16G-2S+ support SFP 2.5Gbps?
Replies: 1
Views: 869

Re: Does CCR2004-16G-2S+ support SFP 2.5Gbps?

Hi The following has the list of devices with assorted compatibilities, including 2.5G https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility It doesn't (currently) list the CCR2004-16G-2S+ as being compatible with 2.5G, but does have a different CCR2004 device listed. The...
by rplant
Wed Jun 12, 2024 1:25 pm
Forum: General
Topic: Route PPTP Client to another gateway
Replies: 1
Views: 362

Re: Route PPTP Client to another gateway

You could try something like

/ip firewall mangle
add action=mark-routing chain=output new-routing-mark=YOUR_ROUTING_MARK passthrough=no protocol=gre

From a security point of view it would be far better to swap your pptp for wireguard.
by rplant
Tue Jun 11, 2024 3:13 am
Forum: Beginner Basics
Topic: IPTV setup on WiFi interface
Replies: 4
Views: 3698

Re: IPTV setup on WiFi interface

Hi,

On the wifi, I would enable multicast helper (ideally to full, but perhaps dhcp would be more compatible)
and probably enable multicast buffering.

Also on the bridge enable igmp snooping.

See if that helps.
by rplant
Wed Jun 05, 2024 2:17 pm
Forum: Beginner Basics
Topic: Mikrotik as secondary router - one LAN port bridged to WAN
Replies: 6
Views: 4327

Re: Mikrotik as secondary router - one LAN port bridged to WAN

Hi, For not double NAT. If you can change the ISP router, you may be able to add a static route to it. 192.168.88.0/24 via 192.168.1.2 Then from anav's config, change all the WAN interfaces to LAN and let the ISP router pretty much do all the Natting and external firewalling. /interface list members...
by rplant
Wed Jun 05, 2024 11:07 am
Forum: General
Topic: L2tp ipsec vpn network with user connection problems
Replies: 2
Views: 735

Re: L2tp ipsec vpn network with user connection problems

A similar problem here (and solution).

viewtopic.php?p=1045608#p1045608
by rplant
Wed Jun 05, 2024 2:45 am
Forum: General
Topic: CRS510-8XS-2XQ SFP GE transceiver in SFP28 port
Replies: 2
Views: 626

Re: CRS510-8XS-2XQ SFP GE transceiver in SFP28 port

There have been other questions about the 10GTek device, perhaps this might help.

viewtopic.php?p=1067590#p1067590
by rplant
Tue Jun 04, 2024 7:14 am
Forum: Forwarding Protocols
Topic: VRRP + DST-NAT
Replies: 4
Views: 3600

Re: VRRP + DST-NAT

Not sure, but

1. They should be using src-nat rather than masquerade
2. dst-nat rules are same on both routers
by rplant
Tue Jun 04, 2024 2:08 am
Forum: MikroTik hardware questions
Topic: AOC SFP module - S+AO0005. Connector type info.
Replies: 2
Views: 4667

Re: AOC SFP module - S+AO0005. Connector type info.

I have a working SF.Com passive DAC which also gives a connector type of copper pigtail.

Perhaps it can't (or doesn't) tell the difference between AOC and Passive (or active) Dacs.
They all use the same copper/active/OM4 link length field.
by rplant
Mon Jun 03, 2024 7:07 am
Forum: MikroTik hardware questions
Topic: GRE tunnel performance with RB4011 vs RB5009
Replies: 3
Views: 5242

Re: GRE tunnel performance with RB4011 vs RB5009

Another thought, perhaps there is some queues configured. I trialled a basic gre tunnel from a 4011 to a hap ax3, Edit: was incorrectly fast path (all fast track and about 2 meters of cable), and tested a bidirectional btest over the gre link at 300M in both directions from my PC through the 4011 (g...
by rplant
Mon Jun 03, 2024 4:39 am
Forum: MikroTik hardware questions
Topic: GRE tunnel performance with RB4011 vs RB5009
Replies: 3
Views: 5242

Re: GRE tunnel performance with RB4011 vs RB5009

Your mtu of 1476 on the at&t service seems highly dubious. I believe the default MTU for at&t it is 1500. (But I could easily be wrong) 1476 matches the normal mtu of a gre tunnel. (Inside a normal 1500 mtu ethernet connection). Then also 1420 seems odd, (looks maybe like an mtu for ipsec en...
by rplant
Mon Jun 03, 2024 3:59 am
Forum: Beginner Basics
Topic: Unable to connect to SMTP service port on WAN IP. [SOLVED]
Replies: 3
Views: 3483

Re: Unable to connect to SMTP service port on WAN IP. [SOLVED]

SMTP is often blocked at the ISP level.
You likely need to jump through at least a few hoops before you can use it as a mail server.
by rplant
Sun Jun 02, 2024 6:31 am
Forum: Beginner Basics
Topic: Device Isolation
Replies: 4
Views: 1115

Re: Device Isolation

Private vlan might be a good option.
(Done in hardware)

https://help.mikrotik.com/docs/display/ ... rivateVLAN
by rplant
Tue May 28, 2024 6:59 am
Forum: General
Topic: Client Isolation - Wired and Wireless
Replies: 1
Views: 542

Re: Client Isolation - Wired and Wireless

Hi,
You probably want the private vlan feature.

https://help.mikrotik.com/docs/display/ ... rivateVLAN
by rplant
Fri May 24, 2024 11:00 am
Forum: General
Topic: Certificates generating with invalid invalid-before and invalid-after dates [SOLVED]
Replies: 4
Views: 1973

Re: Certificates generating with invalid invalid-before and invalid-after dates [SOLVED]

You need to have correct time/date/timezone on the mikrotik.
You need to specify number of days valid. (eg. 730 for ~2years)
by rplant
Thu May 23, 2024 6:42 am
Forum: General
Topic: Redirect Communications
Replies: 1
Views: 535

Re: Redirect Communications

One possible option: Configure the router with a separate /32 subnet and interface with device A plugged into it. (Assuming router described is Mikrotik, Probably just remove ETH1 from the bridge) This subnet/interface is added as a member of the LAN interface list. (And removed from WAN interface l...
by rplant
Thu May 23, 2024 6:26 am
Forum: General
Topic: Access Lan Devices through windows Wireguard Client
Replies: 13
Views: 3506

Re: Access Lan Devices through windows Wireguard Client

I think you would be better off using a Mikrotik at both ends.

However, the following may be useful:

https://www.henrychang.ca/how-to-setup- ... n-windows/
by rplant
Thu May 23, 2024 5:21 am
Forum: General
Topic: Need to connect 2 home networks through the ISP GPON
Replies: 9
Views: 2114

Re: Need to connect 2 home networks through the ISP GPON

Hi, I thought about this for a while. It would be easy enough to run 2 VLans through from the hap ax2 to a managed switch or other Mikrotik at the gpon end, and then another cable from there to the TP-Link (or if that cable is also not possible, yet another managed switch at the TP-Link location. Ho...
by rplant
Wed May 22, 2024 9:11 am
Forum: Beginner Basics
Topic: [delete]
Replies: 23
Views: 2140

Re: CRS310-8G+S2 reality check on CPU use when using internet traffic

Example basic setup, my thoughts NOTE: ** I have no experience with CRS so consider with care ** vlan2 + 192.168.2.1 -- Other Devices on vlan2 | TPLink 192.168.1.1 - vlanbase - CRS 192.168.1.2 -- Other Devices on vlanbase | vlan3 + 192.168.3.1 -- Other Devices on vlan3 TPLink (or other suitably powe...
by rplant
Tue May 21, 2024 6:14 am
Forum: Wireless Networking
Topic: Pseudobridge or Pseudobridge clone not work -> dhcp client in searching
Replies: 7
Views: 4072

Re: Pseudobridge or Pseudobridge clone not work -> dhcp client in searching

You could also try turning off bridge fastpath in bridge setting
That caused me some issues a long time ago.
by rplant
Tue May 21, 2024 6:07 am
Forum: Beginner Basics
Topic: Two public addresses from one provider
Replies: 3
Views: 981

Re: Two public addresses from one provider

Yeah, that makes sense.

I think with this option it might be advisable to change the default masquerade rule
to a srcnat rule with to-address of 155.13.35.202

Otherwise, it could possibly choose either ether1 address for the masquerading.