MikroTik

rplant

Hi, In 7.2.2(ish) the routing was changed, so that if you route mark a packet, and a matching route with that route mark exists in the route table it will use that route entry. It then processes the routing rules table, and finally the route table (again). Previously routing rules occurred first, an...

rplant

Do you perhaps mean CDP?

This is done under ip neighbors

rplant

Hi, The CPU on the CRS317 isn't super fast. (eg. a hap ac2 is faster) See: https://mikrotik.com/product/crs317_1g_16s_rm#fndtn-testresults The commonly used value for routing performance comparison is 25 ip filter rules, 512 byte packets. However it does do some fairly good L3 hardware offloading, b...

rplant

Note however if you use something like a S+RJ10 in the sfp+ port,
it can negotiate 2.5G with remote end while sfp+ is running at 10G,
(so Mikrotik thinks it is running at 10G) it runs hot.

You will likely need some traffic shaping (queue) to limit outbound traffic to <2.5G.

rplant

I assume you are using one of the SFP+ to RJ45 adapters. The following has some info on the Mikrotik one. https://mikrotik.com/product/s_rj10 They have 2 versions, and the first version did not report the link speed correctly. I would not be surprised if many other brands also have very limited link...

rplant

Hi, The 2 subnets should already be connected, you don't need the add action=accept chain=forward comment="enable interconnect lan subnets" rule. You should be able to connect to the various devices in the other subnet. There may be a couple of issues. 1. You may be expecting to see these ...

rplant

Not sure. You may have already tried this. I would try using a separate ethernet interface for the wireguard connection into the 2nd router from the CCR. With an mtu of 1492, and different IP address range to the lan. You may need a routing rule to get the wireguard traffic to exit via this separate...

rplant

My Guess is that the devices on your LAN are receiving a packet from 192.168.100.1/24 and sending their reply back to the main gateway. (Which also doesn't know where 192.168.100.1/24 is) One simple(ish) option might be to masquerade packets leaving your Wap-ax with source address of 192.168.100.0/2...

rplant

You could look at Mikrotik's rose storage.

rplant

My guess is that these devices are probably a bit like a ccr, with no default firewall rules except for a masquerade rule :( The following rules are for a hex, (they are usually all very very similar, except when they have none) And you should be able to copy and paste them in. I think they are quit...

rplant

The fact that logging has the option of a source IP address, and ignores it seems like a bug. Though it might be your config. (Given Wan interfaces usually have some sort of src-nat/masquerade) Do you have a src-nat rule for the wan interface that might apply in this case. You could put in a specifi...

rplant

You possibly also need a bridge nat rule to kick the packet into the routing section of the device.

Something like:

/interface bridge nat
add action=redirect chain=dstnat disabled=no dst-address=192.168.88.88 ip-protocol=tcp dst-port=22 log=yes mac-protocol=ip

rplant

Hi,
V7.16.1

IP Settings.
There are 2 items, the max neighbor entries and Arp Timeout
You could increase the max neighbor entries value or possibly decrease the Arp Timeout value.
(The current default Arp Timeout value appears to be 30S, I would not go below that)

rplant

A few points: The following assumes a config sort of based on default (for SOHO type routers, not CCR, etc which have no firewall rules). I am assuming you have nat. In this case an incoming connection on Wan1 must then also leave by Wan1. (Same for Wan2) Otherwise it just doesn't work. (Often true ...

rplant

Hi, The following was made on a hex, based on its default configuration. But should be applicable to many/most Mikrotiks. I removed all the firewall rules (so fastpath is active) Disabled all admin services except winbox Moved ssh and winbox access to a new vrf vrfAdmin, active on ether5. (So you ca...

rplant

It will block people/devices on the internet from attempting to login to your router. (Or using other services your router may provide, that you haven't provided a rule to allow) The default on a Mikrotik is to allow (input, and also forwarding), you should normally block access you don't specifical...

rplant

Or maybe someone or something is somehow logged into or has a vpn into your gateway router, working on the next step.

rplant

This kind of looks like what you would get, if your gateway was also a Mikrotik, and it had hairpin nat enabled for a SSH port forward/dst-nat connection to the internal router. (With attempted logins from inside)

rplant

Yes, drop by mac address doesn't work at the router stage. You could connect only the Reolink to a specific ethernet port on the router, and block based on port. You could give the Reolink a static lease from the DHCP server, and block based on IP address. (From winbox, go to ip dhcp server, the lea...

rplant

One other thought

If you have an interface that is not part of the bridge, but has an IP address on it, it will route using hw offload.
However if you have a vlan on this interface with an IP address on it, the vlan will use the CPU.

rplant

Perhaps try the following commands to see if L3 offload is not present somewhere. With 400+ routes, you might want to write it to a file, so you can examine it in a text editor or similar. /ip route print [file=somefilename] Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, o - OSPF, d - DHCP; H - HW-OFF...

rplant

I was thinking something like. /ip firewall nat add action=masquerade chain=srcnat comment="Nat lan to wan tvs" out-interface=VLAN_TVs You could also filter by src-ip address, or src ip address list. On review, I notice you have a bunch of bridges on this system. And assorted vlans connect...

rplant

I was thinking of something like. /queue type add kind=pcq name=pcq-upload-24 pcq-classifier=src-address pcq-dst-address-mask=24 pcq-src-address-mask=24 It just groups each /24 lan subnet together so the large upload machines get lumped together. On testing, you may find the pcq-upload-default works...

rplant

You could perhaps see if configuring source nat on packets leaving the LAN for the VLAN_TVs helps.

rplant

Are the MTU's on all the interfaces the same.
The switch might fragment packets in software.
My CRS305 does that...

rplant

Hi, I changed the firewall filter rules, and while I still don't like them much, the ikev2 now should work. They appear to be based on a very old routeros version. The ipsec policy rules have to go above the fasttrack rule. (They seem to work below it when pinging things, but fail when actually tryi...

rplant

Perhaps time for: Thanks @mkx Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireless PSK, etc.) and copy-paste it ...

rplant

If its running v7, use a cake queue that should (hopefully) allow you to near fill the uplink, while also giving everything else in your network a bit of bandwidth rather than being starved out because of the fat upload.

V6, probably a pcq queue.

rplant

I would perhaps actively block udp to and from 3389, (if only to see if it changes anything)

rplant

ikev2 (ipsec) is well supported, and there are fairly good examples around. https://help.mikrotik.com/docs/spaces/ROS/pages/11993097/IPsec#IPsec-RoadWarriorsetupusingIKEv2withRSAauthentication This is more industrial, so perhaps less likely to be dropped. But if your ISP doesn't want you running VPN...

rplant

Another possibility:
Some special handling may be required if you have multiple public ip addresses on the router.

Ignore this, mine seems to handle this fine.

rplant

One possibility. Seems unlikely, but you do have a wanIP as an address list. If you have multiple wan interfaces, and the packet is coming in from one interface, and leaving via another (the wan interface with the lowest metric). This could occur. You would need to mark your packets (or similar) so ...

rplant

One other thought, (Somewhat more like my original thought) You could perhaps make a new pcq type queue, based on pcq-upload-default, but with a 24 mask. (So everything from 10.0.1.x will be counted together) Then back to no marking, and fast track allowed. The low rate lans will be prioritised over...

rplant

Sorry, I should read things a bit more thoroughly. Unfortunately, the 3011 seems to not be great under v7. Perhaps what you have will be good. Though I do not understand why you have a limit of 100M on the backup traffic. You will likely need to add all the packet marks to the parent (WAN-Shaper) so...

rplant

It would be very functional to be able to add a description for each connection that you save and thus identify more quickly to which mikrotik equipment I want to connect I am assuming you a speaking of the managed tab in winbox. In tools at the top, there is and advanced mode you can select, and a...

rplant

As a start, I would be inclined to just put a single cake queue attached to the WAN interface, to see how well (or not) it works. (With no packet marking for shaping) Set it up for 500M, and a bucket size of 0.005-0.01, (or your settings) and see how it goes. You will need to create a new queue type...

rplant

Some possible options: If you make a custom interface list and add all the ports you want (but not the bridge) to this list, you can make ip discovery use this list and it will only target those ports. So no discovery on the ports missing from the list. Another option might be to use a switch chip r...

rplant

2. Yes and no Since the device is now a (dumb) switch it has no way to filter anything. The input firewall chain still works. However by default the bridge is a LAN interface and input is allowed from LAN interfaces, ie. All ports. (Input is disallowed from all except LAN interfaces) You can add (a...

rplant

Hi, I have added the following rules near the top of a default config. (after accept icmp) /ip firewall filter ... add action=accept chain=input comment="allow 500,4500 ipsec in" dst-port=500,4500 protocol=udp add action=accept chain=input comment="allow ipsec-esp in (no nat)" pr...

rplant

Hi, My observations: Actually wireguard in mikrotik does attempt to use the IP address that the incoming packet was sent to. Looking at the packet on the output chain is too late. It has already gone through the routing process, and had it's ip address changed, probably also natted. If you use routi...

rplant

but am struggling to get an IP address on the wireguard peer much less an internet connection You have to setup the ip address on each peer manually. It is attached to the wg interface associated with that peer. wg interface <ip address> peer - allowed ip addresses peer - allowed ip addresses Stric...

rplant

Hi, My guess is that you need to run dhcp, so the ISP gets the MAC address of your router, so it can send packets to it. It may not use arp discovery, the dhcp mac address possibly gets recorded into the radius server, and that is where the routers packets get sent too. (I believe Mikrotik's do this...

rplant

Some thoughts. 1. Don't use L2TP at all, use wireguard, its easier/better. (L2TP is slowly being discouraged) Wireguard: You only need 1 port. You usually don't have to fight much with the ISP router. You don't have to fight much with the client OS. Perhaps a little less good if you are somewhere wh...

rplant

Also Mikrotiks support for assorted sfp's has varied a lot over the routeros versions.
and not always for the better in newer versions it seems.

rplant

Hi, I had sort of thought that auto-negotiation is a combination (max) of -The speeds the sfp port is capable of. -The configured auto-negotiate speeds in the ethernet tab. -The speeds that are advertised as acceptable by the sfp devices ROM. Though your experience seems to indicate otherwise. One p...

rplant

If you have some device/network in your control with a static ip address that you can login to these devices from, you can (as a short term solution) add this ip address to an address list in ip firewall. (eg. admin2) Then change the firewall rule that allows 8291 to only allow 8291 with src-address...

rplant

Hi, I am finding it difficult to understand what you are saying, but I will assume the mikrotik has 3 public ip addresses on it. And the incoming wg packets all come into the mikrotik via either the 2.249 or 2.253 interfaces but directed at the .210 address. Normally for this, I would use routing ru...

rplant

I found this also, which might help.

add action=accept chain=input comment="Allow IKEv2 Traffic" src-address=\
172.17.153.0/24

Change 172.17... for the IP address range from your ikev2 pool.

viewtopic.php?t=190096

rplant

Hi, ikev2: If your hap lite is not the internet gateway, you will possibly need to put some sort of NAT on it, so vpn connections to devices on the local network get masqueraded. (The devices on the local network will likely try to reply to the main gateway rather than the Mikrotik). Otherwise, not ...

rplant

Another thought The arp table can get very big these days. There is an arp timeout value on interfaces and bridges. (Not defined by default) You could perhaps see how big your arp table is and see if it might be the problem. And see if setting the arp timeout to some value (seconds, minutes, hours, ...

rplant

Hi, I suspect it should be possible using vrf's. But I am not sure, and don't know how too, sorry. I had a trial of putting another mikrotik (a hex) in front of a similarly configured setup, and this appears to work ok. If your main router is a high end expensive CCR or similar, this is probably not...

rplant

Perhaps the following might be useful in this case. To make all packets go through the CPU first, and offload only the Fasttrack connections, disable l3hw on all ports but keep it enabled on the switch chip itself: /interface/ethernet/switch set 0 l3-hw-offloading=yes /interface/ethernet/switch/port...

rplant

Hi, I am not quite sure what you are asking, but here are some answers. The RB4011 is not powerful enough to route 10G (and doesn't have the ports to do it really) From the test results section of the RB4011 page: https://mikrotik.com/product/rb4011igs_rm#fndtn-testresults From these results the 512...

rplant

Hi,

There is an mdns repeater setup on recent routeros versions.

It is in ip dns.
You add the interfaces you want mdns to be repeated between.

or by cli (example)

/ip dns
set mdns-repeat-ifaces=ether1,ether2

rplant

Sorry for the delay, forum didn't seem to work for me. /ip firewall mangle # (remove/disable this rule) add action=mark-packet chain=postrouting out-interface=ether1 new-packet-mark=shaped-packets passthrough=no /queue tree add name="WAN-Shaper" parent=ether1 packet-mark=no-mark max-limit=...

rplant

A few things. 1. The RB3011 isn't really fast. 2. It is quite a bit slower using Rosv7 3. You can't fast track simple queues. (not fast track is much slower) 4. You need to set a lower bucket size on the queues. You can show system resources and watch the cpu when you run traffic through the link. T...

rplant

Hi, A couple of things. I would put a routing rule like: add action=lookup comment="min-prefix=0, all except 0.0.0.0/0" disabled=no min-prefix=0 table=main before your existing routing rules. So only for traffic that needs to go via a default gateway will use Table_ISP1 or Table_ISP2. I wo...

rplant

My guess is that perhaps the end devices don't know how to (or don't want to) route back to the wireguard IP address range.

You could add a source nat rule that if the ip address is the wireguard range, it gets masqueraded and see if that works.

rplant

Hi, From your listing. The 2 rules below are not required, the last filter rule will allow (actually let fall through to default allow) connections allowed by your dst-nat rules Rule: add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface="ether8[ISP]"...

rplant

You could check the ip route table with dhcp and static and see if there is any differences. I think your masquerade rule should have an interface (out-interface) on it. Presumably bridge1. Though perhaps only if it is coming from the 10.2.2.0/24 network. Not quite sure why you have ether1 attached ...

rplant

You could maybe try hitting it with a web browser, and see what it thinks about it,
(The mikrotik might have web over tls enabled??)

rplant

You do mention you have a gateway router. So does this router do the firewalling from the internet that your network requires. If so, the CRS354 may be ok. (Otherwise as @anav mentioned, a RB5009 in front might be good) In switch settings, you can enable L3 HW Offload for the switch chip. Then under...

rplant

Hi, It seems to work for me. Though having only 2 ip addresses in the dhcp server pools seems wrong. It could be the devices you are connecting too on the .200.x and/or 178.x vlans don't have the CRS305 as their default gateway. (eg. Not configured by the crs dhcp server) Could also be firewall rule...

rplant

As mentioned by yourself a better option, get a 2.5G ethernet sfp to plug into the router.
Much cheaper and cooler than the 10G device.

fs.com have them.

rplant

Given the routers are fairly powerful. For the outbound traffic, you can probably attach some sort of queue to the sfp+ interface. Queues based on cake are usually easy, perhaps fqcodel might be better in this case but I am no expert on queues. (I have had success with red queues in the past) Set it...

rplant

Sorry, this isn't an answer, but the following may be worthwhile looking at. The following video shows a (fairly long) presentation on setting up something maybe similar (also on a 1036) using dhcp. From 2018 MUM in Melbourne, (unfortunately, there seems to be no printable version) https://www.youtu...

rplant

One thought. You need to do your bandwidth test between 2 devices with the switches in between them. eg. A fast desktop/laptop/server ideally with a 10G port on it, to another desktop/laptop/server with a 10G port on it. Perhaps easier, 1G ports to start with. When the bandwidth test is running thro...

rplant

Hi, Some comments: You have no firewall rules, so it should (if enabled) run in fastpath which is notionally faster than fasttrack. (I am kind of wishing there was a quickset that would apply a default set of firewall rules) These switches will do what I will call L3 switching, and do it really well...

rplant

Perhaps because horizon has been around for a long time and works on all platforms (I believe)

Switch port isolation not so much. Use Switch port isolation if available.

rplant

Below is wrong on router1
(Needs to be .144.1)

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=65.58.144.2

rplant

Hi, It isn't indicated in your listings, but if the default fasttrack rule is in place, it will break marked packets. You could put an accept rule just prior to the fasttrack rule, with a connection-mark=!no-mark (Or add connection-mark=no-mark to the fasttrack rule) Your 2 dst nat rules are identic...

rplant

My thought is to disable the fasttrack rule and see if that helps.

Fast tracked traffic does not get packet/routing marks applied.

If it helps, you might be better off with routing rules.
As they should continue to work with/without fasttrack.

rplant

Rules look ok. Some guesses Does the mikrotik have the same internal ip address as the old router? Presumably .100 and .102 are set up with static ip configurations. Perhaps static arps have been configured somewhere Can .100 and .102 connect to the internet? Traceroute from these to 8.8.8.8 does it...

rplant

Yes.

It has license level 4, so can act as an ap for multiple devices.
(license level 3 only allows a single device)

rplant

Hi, My guess(es) is that it might be something to do with Spanning tree, or more likely Vlan configuration. I would expect spanning tree to begin to work after a minute or so (worst case scenario) Perhaps the switch port you have plugged the router into is on a different vlan to the port the device ...

rplant

Normally Wireguard uses a private key and public key, where the public key is not wrapped in a certificate. Assuming a client/server type configuration. If the clients have a peer (the only one in client/server) with the server's public key, it will trust and can connect to the server with the corre...

rplant

RDP connection dying was one thread
viewtopic.php?p=992900

rplant

Have you disabled fasttrack for the affected/all traffic.

Simplest though blunt option is to disable the default fasttrack forward rule.
CPU usage will increase a lot.

Also, having limit-at on just one queue is probably bad. (Means it is guaranteed 50M, the others are Guaranteed nothing)

rplant

I think this might be basically doable, so long as the ISP router can be configured with static routes on it. ie. 10.0.0.x/24 via 192.168.1.2 (the IP address I have assigned to the CRS) If a device on the main ISP LAN wants to connect to a device on your new LAN, it will send the packet to the ISP r...

rplant

You could perhaps try you iperf (I assume iperf3) With the -V and -M options.

Using custom/reduced MSS settings to see if it is perhaps something to do with reduced MTU at one end due to pppoe.
And add an appropriate mss adjustment rule if it helps

rplant

The current default is 30S, it was 10S for quite a few versions, but there were plenty of people having issues with the 10S value.

rplant

Hi, The tls auth thing is not a certificate. From: https://help.mikrotik.com/docs/display/ROS/OpenVPN OVPN client supports tls authentication. The configuration of tls-auth can be added only by importing .ovpn configuration file. Using tls-auth requires that you generate a shared-secret key, this ke...

rplant

Hi, From the MikroTik wired interface compatibility page. S+RJ10 devices Use these modules only in 10G SFP+ ports with auto-negotiation enable I am fairly sure the S+RJ10 devices need the SFP Port actually running at 10G (10.3G?) for the somewhat complex base T conversion electronics which likely ne...

rplant

Hi, I have found script diagnostics leave a bit to be desired. You can put something like: :log info "script scriptname starting" (perhaps also logging parameters if available) and perhaps a similar entry near the scripts exit point(s) With luck the most recent starting log entry will be a...

rplant

Hi, I would suggest you start off with the default mikrotik config. Then Interface <ether1> contains <VLAN7> <pppoe-out1> is attached to <VLAN7> Enable dns client on <pppoe-out1>, (review settings of pppoe-out1) <dhcpv6-client> is running on <pppoe-out1> ** Changed ** <VLAN7> and <pppoe-out1> both m...

rplant

Perhaps the following on the server /interface detect-internet set detect-interface-list=none /interface list member add comment=defconf interface="WG VPN" list=LAN You may want to eventually restrict it a bit more than giving it full LAN access, but in the short term... Client: Only if th...

rplant

If you do want full l2 connectivity, perhaps you should investigate ZeroTier
(which is supported by Mikrotik)
I have not tried it, but I believe it will do this.

rplant

Some thoughts. A rough outline of what I would do. To hopefully create an approximation to what you appear to want. (Sorry there will likely be errors in this) This assumes somewhere near default config of the Mikrotiks. With a LAN interface list. The 192.168.169.0/24 is broken up into a bunch of /2...

rplant

Hardware: Optical: If you can use prebought optical patch cables or DAC cables things are ok. As soon as you need to make stuff it gets very expensive for the tooling. And yes, copper cables are much more durable. But 10G copper seems to run very hot, so you need fan cooled switches, etc. dac cables...

rplant

Hi, You have the following rule before your allow dns to vlans. add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN Perhaps put all the input rules together and forward rules together. Sorry there may be other issues, that's just the one I s...

rplant

Not sure, seems like something dubious. One hack possibility (for tcp) might be to clamp the mss of your internal devices to 1452, while letting the outside devices stay at 1460. So your devices upload with shorter packets. /ip firewall mangle add action=change-mss chain=forward comment="clamp ...

rplant

Sorry, not much of an answer but. 2. The speed of the switch mostly does not depend on the type of router. However, broadcast and similar packets will likely cause slowdowns as they have to go to everywhere including the slow bits on the lan segment. Would recommend you minimise the number of slower...

rplant

You could try something like the following from the mikrotik, and see if it replies (and the size at which it stops) /ping size=1500 8.8.8.8 do-not-fragment And with luck some indication of where it stops. (You can also use /tool/traceroute with size and do-not-fragment) Note: Traditionally 8.8.8.8 ...

rplant

You could try an mtu on the vigor of 1508 (to include the pppoe header) or even 1512 (to also include the vlan) and see if that helps.

rplant

You have to type in a speed, and it will try to get to that speed.
(You can't leave it at 0)

eg. 1M 10M 100M

rplant

Hi,
The following topic is very similar to what I think you want (except they were getting the address via pppoe)

viewtopic.php?p=1070581#p1070581

rplant

The following has their tested items MikroTik wired interface compatibility https://help.mikrotik.com/docs/pages/viewpage.action?pageId=263749679 Pretty much all their 10G optical SFP's and Dac cables are indicated to work in an L009 (in forced 2.5G mode). For low power/temperature/cost You could us...

rplant

Perhaps something like the following in the central router. /ip firewall filter #existing rules ... #following rules just before existing invalid rule. #(Put them in via terminal, then move them using winbox/webfig) add action=accept chain=forward comment="allow traffic between wg and lan"...

rplant

My Guess Assuming the internet gateway is a Mikrotik and is using something similar to the default config, asymmetric routing that might be the issue. Wg -> Lan Device and Lan Device -> MainGateway -> Wg If it is this, there are a at least a couple of options: 1. On the WG mikrotik enable masquerade...

rplant

It looks like the CRS310 won't do nat or fasttrack connections in hardware, so mostly good for inter vlan routing maybe using some access lists, much less good as an internet gateway, with Nat, Stateful Firewalling, etc. https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOff...

rplant

Hi, I would also include the first routing rule below. It allows devices on your wifi subnet to connect to other local devices, and only internet bound traffic goes via the vpn. (Order matters, put it before the other rule) Note: If using winbox, you likely should have still been able to connect to ...

rplant

You need two or more different vlan's on the hex. The hex needs to have an IP address assigned to it for each vlan. The devices on each vlan need to have the hex as their default gateway. (Alternatively each vlan's default gateway/router could have a static route for the other vlan(s) pointing to th...

rplant

If the mesh router has the option to disable it's dhcp server, you could do that.

Then plug the mikrotik's LAN port into one of the lan ports of the router, and see if devices connect to the Mikrotik.
(You may need later to change the ip address of the mesh router as well)

rplant

You have to ensure that the appropriate packets don't go via fasttrack. Either by having an accept statement for these packets prior to the fasttrack rule or by disabling the fasttrack rule. One possible option (just prior to fasttrack rule) add action=accept chain=forward comment="accept estab...

rplant

Hi, A couple of points, The screenshot doesn't really show what you are doing. Mikrotik doesn't do hairpin nat by default, so it might work from outside but not from inside your network. You could open a terminal window (from webfig, up the top near rhs), and export the entire config, or just the fi...

rplant

In another thread @mkx mentioned that adjust mss will probably not work if the connection is fasttracked.
You could try and disable the fasttrack rule briefly.

rplant

Likely you are going to have to go for a ccr with at least 1 SFP+ port, and perhaps 2. eg. CCR1036-8g-2s+ if you can find one. Then how does your ISP provide you with 2Gbe, it seems like a non-standard value. If over a 2.5Gbe ethernet connection, none of the CCR 10xx series supports this directly. Y...

rplant

Have you added 10.0.2.3/32 as an allowed IP address in the Peer setting on the Mikrotik?

When you look at the peer setting on the Mikrotik are you getting updated Tx, Rx and Last Handshake values.

rplant

Upgrade the ccr2116 to the latest beta version,
generate a supout.rif while working, and another when broken.
(Assuming it's not fixed)

And submit them in the ticket.
Support are quite good, and it is one of their flagship products you are having issues with...

rplant

One thought,
Do you have appropriate firewall rules to allow gre protocol in from the remote peer?

The default rules cause Traffic wrapped in ipsec to be allowed.

rplant

Yet another possibility is broken dns.

If on windows open a command prompt,
type nslookup

And try a few sites (including some you haven't recently used)
does it return immediately with a result?

Is the dns server nslookup is using correct?

rplant

You appear to have different wireless protocols at each end.

rplant

A problem is that out of your switch, every port has both the tagged and the untagged vlans coming out of it and going into it. One Possible option would be to make vlan 1 something else other than 1. eg. 10 Then you could have vlan 20 as the untagged vlan, and vlan 10 as the tagged vlan going to th...

rplant

Sorry, not an answer but.

Pretty sure the ipsec is going to be hardware offloaded, so it is going to take minimal cpu.

rplant

Mostly the Gui is similar to the way the cli is laid out.
The switch menu is a bit different. It is a top level menu in the Gui.

rplant

I have tried (a few times) and also failed to get a 2.5g connection working on an RB4011

**edit:** Note my RB4011 is an old one, I believe they have had a couple of versions of RB4011.

rplant

In the wiki version it notes

The backup RouterBOOT version can not be older than v3.24 version.

So presumably given yours is newer than this, you don't need an upgraded backup routerboot. (so it won't let you upgrade it perhaps)

rplant

A possibility is to split the pairs and run it over a few meters, it will give lots of crosstalk and poor performance, but whether it is enough I don't know. eg. Pairs 1,4 2,3 5,8 6,7 or 1,3 2,4 5,7 6,8 (Cable terminated same at both ends) The cables will test as a simple straight cable (with a very...

rplant

It used to (at minimum) stop a lot of annoying log messages on the server, I assume it still might.

rplant

Try it in both negotiated and non negotiated mode, with each of the 3 (current) 10G settings.
10G base T
10G BaseCR
10G BaseSR LR

And see if any of them work.

rplant

Some minor changes. # cisco interface Ethernet0/0 description trunk from mikrotik switchport trunk encapsulation dot1q switchport trunk allowed vlan 10,20 switchport mode trunk #mikrotik # (Use bridge instead of ether1) /interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge...

rplant

As a switch it will have plenty of speed between your devices. However connections to the internet via your ISP will need routing with firewalling and presumably Nat. For 2.5G you will need a reasonably powerful router performing this task. If your ISP provided a router you can use it for that task ...

rplant

look at the protected bootloader section of the above document

rplant

Another thought, Partially working ipv6 can cause similar problems.

Try turning off ipv6 on the router.

From winbox
ipv6 settings tick the disable ipv6 box and wait a short while.
(May need to reboot PC if want it to update faster)

rplant

Yes, you could have used the wireless package, and the map could then connect in station bridge. Wifi package does have some niceish features though. Other options: Use Station-Pseudo bridge mode. Ok when it works, need to turn off RSTP. If you go this way and it's not behaving it is worth searching...

rplant

Yes,
If you use poe as an alternate power source, it must be passive/forced on poe or the Mikrotik may lose power when main/other power is lost. (Usually briefly but...)

rplant

A couple of options. 1. Reset the mikrotik with no default config, (but perhaps keep users), and then try to import the file. 2. Open the file in notepad or similar and copy and paste a section at a time into the terminal. You might be wise to compare the current default config to the config you wan...

rplant

I think documentation means devices with version 7 factory firmware, but less than 7.6 get upgraded to a v7.6 factory firmware with protected router boot function. Devices with older (v3, v6) factory firmware get an updated factory firmware (not v7) which has the new protected router boot function. ...

rplant

You can probably enable dhcp relay on the appropriate switch vlans.
And have your dhcp server managing the vlan (remotely).

rplant

You could set it up with the CRS317 as the gateway for both VlanA and VlanB The CRS ROUTES packets from vlanA and vlanB to the router. (and between vlan A and vlan B) No firewall rules needed on CRS for internet traffic, so should be L3WH offloaded, (with very few if any ACL's) Rules/ACLs, mostly fo...

rplant

A couple of thoughts, The following statement doesn't really seem helpful given your current results, but anyway: Mikrotik doesn't by default do hairpin Nat (you need to add the appropriate src-nat rule), so if you are testing from inside your network it will likely not work. You could download tcpr...

rplant

Hi,
License wise:
Not sure there is a limit for raw ipsec.
There is a 500 user one for l2tp.

However, the processor on the RB2011 doesn't do ipsec hardware encryption, and does not have much Ram.
So really only a couple maybe. You would be better off with wireguard with the 2011.

rplant

When a road warrior client from router 1 is connected it can not reach ip's behind the nat of router 2 (which is possible from within router1 main network (and the other way around). Assuming there is no NAT going on. (ie. The packet from 192.168.35.1 reaches device on router 2 as being from 192.16...

rplant

Hi, I think you could start by checking the counters on the dst-nat rules, and see if they increment. (They happen early in the firewall) Typically they will only increment once for each new connection. If they are incrementing, you need to check the 10.0.0.39 (I assume nginx) Perhaps if not increme...

rplant

Fair enough, Perhaps your option 2 would be a good option, you then effectively have a site to site tunnel, and can tunnel whichever clients you want. Option 1 is doable and will most times be fairly well upgraded. However it is not perfect. (Make a script export and a normal backup onto external st...

rplant

I would recommend you experiment with wireguard.
(Even if just for this particular instance)

rplant

You could possibly add a src-nat rule something like

/ip firewall nat
chain=srcnat dst-address=171.11.153.20 src-address=192.168.1.0/24 action=src-nat to-addresses=171.11.153.21

Move it up above any masquerade rules already there.

rplant

For generic case, perhaps not. (maybe a container?)

But for a single source ip sending data, you could probably use a dst-nat and src-nat pair of rules, to send the traffic back.

rplant

You can run your eoip or other tunnel inside wireguard. Though I would perhaps attempt to set up ipv6 and associated routing on the Mikrotik manually, using one of the /64's. You would maybe need to somehow mark the prefix as used though, so the VPS does not try to reuse it. You might need to put (n...

rplant

beep twice usually means it thinks it is ready to start running. You could try connecting to it via wifi, it may have some mikrotik-XXXX ssid with no password. If it is similar to a map/wap, then Wifi is often the only way to connect to this type of device when factory defaulted, but usually the eth...

rplant

I would also suggest you get a Low ESR capacitor (as well as of 105° type).

rplant

fs.com have a few rj45 sfp+ modules.

They range in power consumption from 1.8W to 2.9W
Apparently the S+RJ10s is around 2.7W, so the 1.8W one might be good.
(but quite pricey)

Sorry I don't know how well or hot it works, or if it will work with a Mikrotik.
though fs is usually well supported

rplant

It sounds like you are trying to restore a binary backup file to a new router. That rarely works :( You could search your hard disk for .rsc script files. If you can login to the old one at all (though it sounds unlikely), do a /export, stick it onto your laptop, and manually carefully copy the conf...

rplant

I tried it running with 6.49.13, and that was much improved.

Unfortunately doesn't have the cake queues, but the other queues I tried
seemed to handle 1G ok.
CPU still seemed to be largely locked to 1 core, and still needed multiple streams
or large window to get to 1G ish.

rplant

I had a try with some of this, just to a local iperf3 server. So very little latency unlike over the internet. I found I had to disable the queue tree for best performance. To hit near a gig download I had to have a large window size, or multiple streams. Perhaps partly a limitation of the iperf3 se...

rplant

Hi, It seems unlikely to be good for a 1G connection, Apparently a single connection will only use 1 core. (To reduce out of order packets) From: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults The commonly used 25 IP filter rules, and 512 byte packets lists 452Mbps. Your actual perform...

rplant

Yes there have been many many sfp fixes, and complaints of devices that used to work that no longer do. You could get install the latest betas at both ends (including updating routerboot), and assuming it is still not working create a supout.rif and send to support at mikrotik.com The -40db is a wor...

rplant

The S+RJ10 plugs into a 10G sfp+ interface.
The L009 has a 2.5G sfp interface.

rplant

That feels like a bug.

I think the Mikrotik radio should likely have its own multicast subscriber list and send it to only its subscribed stations.

rplant

I gain the impression that the S+RJ10 still runs quite warm, as its backend has to be run at approx 10.3G
(whether connected on the RJ45 side at 1G, 2.5G, or 10G)

While an actual 2.5G unit's backend runs at 2.5G (* 10/8).
(Whether connected on the RJ45 side at 2.5G, 1G or lower speeds)

rplant

Winbox:

Perhaps under ethernet tab for sfp, turn off auto negotiation and set speed to 1G Base X
at both ends.

Make sure fibre is correct, (looks to need single mode fibre)

rplant

I found out empirically that if you turn off the interfaces and peers on both routers for 10-15 minutes and then turn them on, everything works. I think I have seen something similar in the past, if you turned off the wireguard interface and then turned it back on it fairly soon after. It didn't se...

rplant

Sorry, don't know. However I would turn off the persistent-keepalive on router-B. Perhaps trying to connect back to the IP/Port it was last connected too is doing something. Also, you can check the counters on the firewall rule on Router-B, and see if packets are actually getting in, enable logging ...

rplant

I have in the past done the following

/ip arp
add address=192.168.44.252 interface=bridge-local mac-address=\
FF:FF:FF:FF:FF:FF

I was using it for Wake on Lan.
To any device on the 192.168.44.0/24 network

** Edit: on review, this is an answer to a different question

**

rplant

My guess is that it is doing what it is supposed to, but perhaps imperfectly.

The spanning tree needs reconfiguring, and it does this, but some looped packets get through.
But it seems to resolve quickly.

rplant

Usually means you have overlapping allowed addresses on your peer configurations. This is an error. If this what you actually need and want, (eg. you want to use ospf to the peers and route via the ospf chosen link, etc) You need to have multiple wireguard interfaces with one (overlapping) peer per ...

rplant

Hi, I have a dhcp-client script that changes some of the routes. /ip dhcp-client add default-route-distance=70 interface=ether2 script="/ip route\r\ \n:if (\$bound = 1) do={\r\ \n set [find where comment~\"altgw\"] gateway=\$\"gateway-address\"\r\ \n}" I also find it be...

rplant

Perhaps get a hap ac2 as a gateway router in front of the switch at the home end.

Then you can have hardware offloaded ipsec at both ends if you want that.
Or wireguard. (I like wireguard, but hardware offloaded ipsec can be quite fast)

rplant

You should perhaps change the bucket size on the queue to 0.01

If it works ok, do same for the other ethernet ports. (ether1 with 2.5G max-limit)

rplant

Or perhaps run the ipip over a wireguard tunnel.

Even better with luck might be able to just use a wireguard tunnel, without ipip.

rplant

So it is not possible if the peer is on dynamic IP? Yes, You can look at the ipsec setup created when you add ipsec to the ipip tunnel and make something similar. But I think ipip requires a fixed address at each end anyway. You could possibly use an ikev2 tunnel, (where the client can get a fixed ...

rplant

You could try attaching a queue onto the LAN ethernet port you are using and see what that does. (ether2...) Make a new queue type using cake, probably near default. Create a new queue, (Queue tree) with your new queue type, attach with parent as ether2, and set with a max limit of 1G. Assuming you ...

rplant

You could do a tool/ ip scan, which should refresh the Arp table.

Arp entries are often only seen/updated when the router/switch needs them.
Which is rarely if running as an L2 switch.

rplant

Not sure, but possibly if you do that, it can't tell the remote end (client) what the server end IP address is. This usually doesn't matter, except perhaps if you want to ping the server from the client. (I don't know that windows likes it much though) There is a couple of places to setup the loca...

rplant

Hi,

You don't seem to have an IP address on the wireguard interface, but then you are using masquerade on that interface??

The first /ip firewall rule (I assume is filter) seems a bit doubtful.

rplant

You can get GPON ONU sfp modules. However you would need to get the ISP, or their wholesaler to agree to you using the 3rd party module. You would need to provide them with some information about it, perhaps its mac address and/or serial number, not sure. They can then add the ONU information onto t...

rplant

I assume the ISP's router is doing Nat? Or is it handing the IP address off to the Mikrotik in some fashion? If ISP router is doing NAT, it will also need a port forward (likely to the Mikrotik, possibly direct to the web server) The web app server needs to know it is running on port 8080, or more u...

rplant

You can set both the wireguard and eoip mtu's to 1500, it becomes less efficient as the larger packets are fragmented, but they get rebuilt at the endpoint. Perhaps set the eoip mtu to 1500 and leave the wireguard one at 1420 (1420 assumes no pppoe). An alternative, you can use a mangle rule to do m...

rplant

Hi, Assuming a near default mikrotik configuration. I will make ether2 the second port. You need the ip address and netmask of the Zyxel. Using winbox (or webfig) From Bridge, Ports tab Remove, or disable the ether2 entry from the default bridge. From ip/address, create a new ip address in the same ...

rplant

Try enabling "Ignore Rx LOS" and see if that helps.

If not, make a supout.rif while broken, running on 7.16b2 and send it to Mikrotik support.

They have been making many changes to the SFP code...

rplant

Assuming near default Mikrotik configuration. Likely option is you need to make the openvpn client interface on the Mikrotik a member of the LAN interface list. The following seems likely already done, you need to have routes on the Asus telling it the mikrotik lan network IP's are via the openvpn c...

rplant

Hi, Check the counters on the following rule. /ip firewall filter add action=accept chain=input comment=Wireguard dst-port=54321 protocol=udp If when you try to connect via mobile, it doesn't increment at least the once it cannot work. You could try changing the port. Other things to check (Once the...

rplant

Make sure that Vlan832-internet is a member of the WAN interface list.
Double check that bridge is a member of the LAN interface list.

Disable your first srcnat rule.
(Can try reenabling it once you have it working)

rplant

The following might help

viewtopic.php?p=1070581#p1070581

Though now days, the hex is not super quick either

rplant

ip firewall, choose connections tab, then click on tracking button.

rplant

Fairly sure that mpls requires a layer 2 equivalent under it, which gre isn't.

You could perhaps use eoip, or vxlan.
Not seeing a lot of point of then running mpls over these.

You could run these 2 protocols over wireguard or ipsec (I like wireguard)
sstp is good, but not very performant.

rplant

Have a look at wireguard, it is very good, and handles NAT well.

You will likely need something brisk for 20-30 clients at a good speed.
Perhaps an RB5009 (or low end ccr) would be a good starting point.

rplant

Hi, I have seen a post for something maybe similar, where the solution was to make the queue on ether1 a multi-queue-ethernet-default queue. (Assumes ether1 is internet) (Maybe you could try multi-queue-ethernet-default on the other interfaces as well) If this doesn't help: You could perhaps experim...

rplant

There have been other questions about the 10GTek device, perhaps this might help. https://forum.mikrotik.com/viewtopic.php?p=1067590#p1067590 I have not used this sfp module, (or the css switch), but I find on their routers, using 1G base X is a good choice for connectivity. Also there have been a l...

rplant

Hi,

You can try using sni

search for tls-host in the following
https://help.mikrotik.com/docs/display/ ... nd+Actions

Unfortunately, sni inspection is becoming unavailable with the advent of TLS 1.3, so is working less and less well.

rplant

Hi The following has the list of devices with assorted compatibilities, including 2.5G https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility It doesn't (currently) list the CCR2004-16G-2S+ as being compatible with 2.5G, but does have a different CCR2004 device listed. The...

rplant

You could try something like

/ip firewall mangle
add action=mark-routing chain=output new-routing-mark=YOUR_ROUTING_MARK passthrough=no protocol=gre

From a security point of view it would be far better to swap your pptp for wireguard.

rplant

Hi,

On the wifi, I would enable multicast helper (ideally to full, but perhaps dhcp would be more compatible)
and probably enable multicast buffering.

Also on the bridge enable igmp snooping.

See if that helps.

rplant

Hi, For not double NAT. If you can change the ISP router, you may be able to add a static route to it. 192.168.88.0/24 via 192.168.1.2 Then from anav's config, change all the WAN interfaces to LAN and let the ISP router pretty much do all the Natting and external firewalling. /interface list members...

rplant

A similar problem here (and solution).

viewtopic.php?p=1045608#p1045608

rplant

There have been other questions about the 10GTek device, perhaps this might help.

viewtopic.php?p=1067590#p1067590

rplant

Not sure, but

1. They should be using src-nat rather than masquerade
2. dst-nat rules are same on both routers

rplant

I have a working SF.Com passive DAC which also gives a connector type of copper pigtail.

Perhaps it can't (or doesn't) tell the difference between AOC and Passive (or active) Dacs.
They all use the same copper/active/OM4 link length field.

rplant

Another thought, perhaps there is some queues configured. I trialled a basic gre tunnel from a 4011 to a hap ax3, Edit: was incorrectly fast path (all fast track and about 2 meters of cable), and tested a bidirectional btest over the gre link at 300M in both directions from my PC through the 4011 (g...

rplant

Your mtu of 1476 on the at&t service seems highly dubious. I believe the default MTU for at&t it is 1500. (But I could easily be wrong) 1476 matches the normal mtu of a gre tunnel. (Inside a normal 1500 mtu ethernet connection). Then also 1420 seems odd, (looks maybe like an mtu for ipsec en...

rplant

SMTP is often blocked at the ISP level.
You likely need to jump through at least a few hoops before you can use it as a mail server.

rplant

Private vlan might be a good option.
(Done in hardware)

https://help.mikrotik.com/docs/display/ ... rivateVLAN

rplant

Hi,
You probably want the private vlan feature.

https://help.mikrotik.com/docs/display/ ... rivateVLAN

rplant

You need to have correct time/date/timezone on the mikrotik.
You need to specify number of days valid. (eg. 730 for ~2years)

rplant

One possible option: Configure the router with a separate /32 subnet and interface with device A plugged into it. (Assuming router described is Mikrotik, Probably just remove ETH1 from the bridge) This subnet/interface is added as a member of the LAN interface list. (And removed from WAN interface l...

rplant

I think you would be better off using a Mikrotik at both ends.

However, the following may be useful:

https://www.henrychang.ca/how-to-setup- ... n-windows/

rplant

Hi, I thought about this for a while. It would be easy enough to run 2 VLans through from the hap ax2 to a managed switch or other Mikrotik at the gpon end, and then another cable from there to the TP-Link (or if that cable is also not possible, yet another managed switch at the TP-Link location. Ho...

rplant

Example basic setup, my thoughts NOTE: ** I have no experience with CRS so consider with care ** vlan2 + 192.168.2.1 -- Other Devices on vlan2 | TPLink 192.168.1.1 - vlanbase - CRS 192.168.1.2 -- Other Devices on vlanbase | vlan3 + 192.168.3.1 -- Other Devices on vlan3 TPLink (or other suitably powe...

rplant

You could also try turning off bridge fastpath in bridge setting
That caused me some issues a long time ago.

rplant

Yeah, that makes sense.

I think with this option it might be advisable to change the default masquerade rule
to a srcnat rule with to-address of 155.13.35.202

Otherwise, it could possibly choose either ether1 address for the masquerading.

Search found 566 matches