MikroTik

sindy

Do I understand correctly then that the best way would be to create different subnets for 2ghz and 5ghz guest networks? I cannot see a reason for that. I am just saying that I don't think there is a way to make a particular wireless device keep its IP address when it moves from a 2.4 GHz network to...

sindy

I think I understand the problem with the ax3's 2 routes to the same destination, but I don't know how to fix it. As I wrote above, on the hAP ax³, the best way would be to create a "br-guest" bridge as I wrote above: " Either use a different subnet for each of the two guest WiFi int...

sindy

Is the fact that there are 2 routes with 0.0.0.0/0 destinations a problem? Two routes with the same destination may be both a desired setup or a wrong one - it depends on circumstances. E.g. if you had two WANs, two default routes could be a desired setup, as the ultimate destination would be the s...

sindy

Your complete export has revealed that there is a DHCP client attached to ether1 of the 5009 that is allowed to add a dedault route. So which port of the 5009 is connected to FIOS, ether1 or some other one? What does /ip route print detail show on the 5009?

sindy

I removed what I believe are the non-relevant sections. In general, doing so is actually a bad idea - more often than not, the issue is caused by something in those parts of the configuration that one deems irrelevant. Does anything look the routing or gateway is misconfigured? I don't understand h...

sindy

Every single packet passes through the raw table, no matter whether it is an initial one of a connection or a mid-connection one. The issue here is that raw stands before connection tracking on the path, so the connection-state attribute is not yet known as the packet is being matched against the ru...

sindy

that is such a fantastic explanation and analysis! [...] It sure seems like it is your #2 explanation: timed out connection resulting in connection-state=new Unfortunately, your conclusion suggests that the explanation wasn't as fantastic as I would like it to be :) Let me reiterate - since the sou...

sindy

Sir, you complain about getting generic info but you actually did the same - there is no point in referring to an example, even a specific one. You may have had to modify it to adjust it to your environment, you may have made a mistake when copying it, there may be a traffic in your environment that...

sindy

The use-ip-firewall setting under interface/bridge/settings is used to force also packets that are bridged (forwarded at L2 level) from one port of a bridge to another port of the same bridge (like your NVR and your camera) through the IP firewall. The original purpose of this setting is to allow Qo...

sindy

To be precise, it actually is a problem, but for sure adding a permissive rule would not be a solution to it. As in IPv4, the majority of user endpoints have private addresses, there are not many useful scenarios where endpoints in the internet would initiate connections to them, as they could only ...

sindy

The first thing to come to my mind is increased packet rate due to fragmentation of the IPsec transport packets, so whilst the bit rate increases only up to, say, 10 % as compared to the amount of the payload traffic of the IPsec connection, the packet rate almost doubles; if, on top of that, some o...

sindy

The only practical use case I can imagine from your description is to share an account on some paid "VPN" service among multiple people to save money. Leaving aside whether it is in accord with the terms of use, such an approach requires coordination of the use (as in, only one person can ...

sindy

Once I download the file - and get it via winbox to the routerboard - how do I then run the upgrade? If the LTE modem does support the local upgrade, interface lte firmware-upgrade firmware-file=xyz upgrade=yes should execute the upgrade. But as @Amm0 says, why do you need to do it this way? Is tha...

sindy

Somehow, I would expect gentlemen in Riga to provide either "BIOS CHR" and "UEFI CHR" images or a "universal CHR" image off the shelf rather than offloading that task to volunteers. I am still not sure why I had to use the UEFI-compatible image for the recent lot of CHR...

sindy

@jaclaz, you're the boss - 7.17.beta2 mangled using your gdisk magic made Vultr happy.

sindy

as soon as Sindy will be able to (hopefully) report success in the environment(s) he uses, the matter should be pseudo-solved. Sorry, it was neither soon nor 100% success. Both the pre-cooked images from @Amm0 I've tried, i.e. chr-7.16.uefi-fat.raw and chr-7.16.uefi-fat-kriszos.raw, work both in Pr...

sindy

The exports should have been placed between [ code] and [ /code] tags (using the </> button above the edit form). You may prefer to "un-post" the usernames for the pppoe services (and maybe some other logins to external services). Both can be fixed by editing the post. You do not use actio...

sindy

A blind shot as you haven't posted the configurations: you may be using mangle rules to choose traffic that has to go via Wireguard and haven't prevented that traffic from hitting the action=fasttrack rule in filter. If it's not this, post the configuration exports from both routers - check the othe...

sindy

What you are missing is that from the perspective of Server 1, the addres of Server 2 (38.x.x.10) is within its own subnet (38.x.x.0/23). So when it wants to send a packet to it, it sends an ARP request "who has 38.x.x.10", but since Server 2 is in another L2 segment, the ARP request does ...

sindy

I'm not sure what kind of reaction you actually expect from me :) A failed Phase 2 indeed means that the L2TP transport packets carrying your payload, which are supposed to get encrypted using that very Phase 2 SA, are not delivered - when an IPsec policy is in place, it intercepts matching packets ...

sindy

So now as the basic issue has been resolved, we can come back to the ones that popped up in the process. My full config looks like the following (with both mangle and routing rules): The only chain where an action=fasttrack-connection makes any actual sense is forward . If RouterOS itself is an endp...

sindy

Thinking about it, it is entirely possible as the overlap is only on the last sector of the two partitions Just to be sure, did you actually mean that the last sector of one partition overlaps with the first sector of the following one, as in "the first one is one sector larger than it should ...

sindy

For me it does (7.14.3), so it must be something else.

sindy

I also convert the result to raw as I use ceph on Proxmox that does not support qcow2, so the difference in disk image format is not the magic that saves things. Still using version #3 (I will get to the other ones later), I haven't seen any complaints of gdisk in the log, except the one regarding t...

sindy

Tested at Proxmox. With 7.15.3 as a base and your gdisk script #3, after some time of black screen, it said: ERROR: could not find disk! Please attach it somewhere else. I have tried to emulate both SCSI and IDE, no difference. Since this was my first ever attempt to UEFI-boot a CHR on Proxmox, the ...

sindy

My full config looks like the following (with both mangle and routing rules): OK, so the difference from the configuration I have used to test it that causes the two to yield different results is that in yours, 123.123.123.123 is an own address of the router whereas in mine it wasn't. This has a hu...

sindy

In this context, I cannot see any benefit in testing 50 incremental scenarios just to find the one that makes it work with the minimum number of changes. The amount of CPU that has to be spent on a Linux machine to make the resulting layout "the most correct one" is not a limiting factor h...

sindy

/dev/vda2 is just a partition on /dev/vda whereas the .img file contains an image of a complete disk including the MBR, so you have to use of=/dev/vda in step 3. If you did and it crashes nevertheless, how exactly does the "crash" look in the console window? Maybe those new machines only ...

sindy

I have noticed this train of thought on the forum recently and I don't get it. Why presence of a route to a given destination (or even less logically, of a default route) in the main table should be a mandatory pre-requisite for a route to that destination to work in another table?

sindy

Is there a free environment where the image bootability can be tested? It depends on the local meaning of the symbolic address "there" :D On Proxmox, you can choose between BIOS and UEFI boot. According to the OP, a "Gen2" machine in Hyper V means that UEFI boot is used; strictl...

sindy

Since the result is different on my 7.15.3 in terms that both ways the packet for "123.123.123.123" does reach "192.168.9.9", something in your overall setup must be different from mine. Without seeing the obfuscated export of your configuration, there is no way to identify that ...

sindy

Ah, sorry - new-dst-ports=switch1-cpu is what you need. I forgot that you only needed to drop traffic from one external port to another.

sindy

As-is, the rule does not drop the matching frames but redirects them to CPU. To actually drop them, you should use new-dst-ports="" instead of redirect-to-cpu=yes.

sindy

The full tutorial is the manual , but the TL;DR is: :find can be used to find a position of an element in an array or a position of a substring in a string: :local myArray {"127";"226";"313"} ; put [:find $myArray "226" 0] ; put ($myArray->1) 1 226 :local mySt...

sindy

Devices purchased in the U.S. or Canada cannot be unlocked to use WiFi regulations from other countries, otherwise FCC would not allow them to be sold on those markets.

sindy

It is indeed not possible to filter the messages on their way to be logged by contents, nor to tell the processes generating them (dhcp, wireless in your case) to filter them by some parameters of the object being processed. You can only filter them when watching the log.

sindy

The good news for those who don't want to dive that deep (respect, @jaclaz!) is that an upgrade of an already installed CHR apparently doesn't affect the boot partition. So installing an image of 7.14.3 that has been made acceptable for UEFI using the script (whichever part of it is the actual reaso...

sindy

As of current, Wireguard listens on all the addresses of the router and the VRRP ones are no exception; what may require some additional measures is that it would use the VRRP address as the source one of the packets it sends . To ensure that, it may be necessary to use techniques similar to one of ...

sindy

Do I understand correclty that I can take a regular x86 PC, put a few NICs in it and run a virtualized instance of ROS making the entire box a router (or firewall)? Indeed. Mikrotik recommends exactly this approach (a virtualization platform and a CHR on it even if the CHR would be the only VM runn...

sindy

CHR is intended for deployment as a virtual machine - where you need a virtualized router you are familiar with rather than a bare Linux for production, or where you need to simulate some complicated setups, or where you just need a Mikrotik router running on a public IP for some training, which was...

sindy

Bellow is a script to correct this issues. Huge thanks. It helped me out as I've just hit some improvement at a cloud provider where only UEFI boot became possible since I've installed a CHR there the last time. Even better, I've installed CHR 7.14.3 using the script and the console works just fine.

sindy

It depends on what your Mikrotik is used for. If you do not use any of those protocols across NAT (i.e. your LAN side clients do not use them to connect to servers in the internet nor vice versa), it is OK to disable all of them. PPTP is an exception in terms that even if you do not use PPTP as such...

sindy

It's not this simple. A rule with the same conditions you use to assign the connection-mark may be used to assign the packet-mark directly if you only need packets in that direction to get the packet-mark. If you need to assign the packet-mark (also) to packets in the other direction than where you ...

sindy

Indeed the mst-override is what you need, you have to set the internal-path-cost to be higher on the port to which the "wrong" switch for that VLAN (corresponding to the vlan group identifier) is connected and lower for the one to which the "correct" switch is connected - lower p...

sindy

for the last 2-3 years ap has been running from a poe switch and I have tried changing ports and using with the adapter and power supply from the kit and the behaviour persists.

Given the above, I agree with the below.

Well, it seems it's time to switch to ax

sindy

How long in weeks/months is "long time"? The way you describe it it looks like an overheating problem, but in general, the first thing to degrade always used to be the electrolytic capacitors in the power adaptors (nothing specific to Mikrotik), so if you can try a newer one which matches ...

sindy

If you want each of the two USW switches to only handle a single VLAN, they cannot be connected to the same bridges on the CHRs, or you must use MSTP that can handle a separate spanning tree for each group of VLANs. Since the configuration exports suggest that there are some other switches in your t...

sindy

PPP stands for Point-to-Point Protocol, which gives a hint that it does not include any support for Point-to-Multipoint channels, i.e. it does not contain any Media Access Control address allowing to indicate for which of the devices on the RS485 bus the packet is intended, or from which of them it ...

sindy

Indeed, in order to give some packets a higher priority, the most important thing is to queue all the other packets that have to "give way" to the priority ones. Any packets that need to be queued must not be fasttracked (except some specific case mentioned in the manual, which is not rele...

sindy

What else should I change?

The topic, please. This one is not the right place for discussing this, create a new one.

sindy

Is here anyone with working Netwatch/Fetch? Anyone know how to solve it? I do send Telegram notifications using /tool/fetch in 7.15.3 and I do not suffer from this kind of problems: /tool fetch url="https://api.telegram.org/$botId:$botPwd/sendMessage\?chat_id=$chatId&text=$message&pars...

sindy

Have you checked your mailbox recently?

sindy

The issue you describe is definitely not "normal" so it is either a misconfiguration or some issue between the Mikrotik's and Ubiquiti's implementations of IPsec. So as the first step, post the export of the Mikrotik configuration (after proper obfuscation - serial numbers, public addresse...

sindy

Use action=src-nat to-addresses=the.chosen.ip.address instead of action=masquerade. It will only work if the.chosen.ip.address is static.

sindy

No one (except maybe the forum administrators) can respond to you by e-mail as the e-mail address you have entered when registering to the forum is not shown to other users and Personal Messages only worked for several brief periods. You can use the approach from this post if you generate your own k...

sindy

I understand I do not answer your question, but why do you insist on use of masquerade if you assign the addresses manually anyway? The purpose of masquerade is to handle a single dynamically changing address and remove connections src-nated to that address if it disappears.

sindy

This (address not responding while container is down) was the first thing to come to my mind when @lpetrov posted the question, because it would be a logical behavior as you've pointed out. But the behavior I observe in 7.15.3 is not logical - the veth interface is "running", the /interfac...

sindy

It did not come to my mind, but indeed - if you cannot identify traffic generated by the router itself, you may instead identify the one that was not . So if you don't mind setting a connection-mark or a packet-mark to the initial packets of any forwarded traffic in chain forward in mangle , you can...

sindy

1. can the same identity be shared among several peer configurations? I read somewhere that it can, but from what I see the peer=xxx field is mandatory in identity. It may be a misinterpretation. Multiple "peers" as in "remote devices" can indeed match (hence "use") th...

sindy

Can you be more clear? ... How this parameter works if it is used by initiator? and how does it work if used by responder? ... Do I understand correctly, that: if Mikrotik is used as a responder than send-initial-contact is simply ignored, and will not be used (meaning that Mikrotik always drops ex...

sindy

What about moving the action=add-src-to-address-list rule from chain forward in /ip/firewal/filter to chain prerouting in /ip/firewall/raw or /ip/firewall/mangle?

sindy

In an hour at the earliest. If you don't want to reveal your contact information publicly, you can use the method described here.

sindy

right

sindy

Reading RFCs is often helpful. Also, I would swear I have seen somewhere the INITIAL_CONTACT to cause connections from the same address to be dropped as written above, but today I could only find in both RFC 5996 and RFC 4306 that it is related to connections authenticated using the same credentials...

sindy

sindy

The Mikrotik documentation often assumes the reader is familiar with the standards regarding the protocol and only explains the particular ways how that protocol is implemented on Mikrotik. Plus, like other vendors, Mikrotik sometimes uses shorter keywords to express the behavior. So passive should ...

sindy

Unless you use bare IPsec, the following rule in the dstnat chain of /ip firewall nat should be sufficient: chain=dstnat in-interface=name-of-the-vpn-interface protocol=xyz port=xyz action=dst-nat to-addresses=192.168.2.200 But that rule alone does not address the need that the PC has to send the re...

sindy

I would expect that the address you define for vethN only responds if the container linked to that veth is up and listening on that address, but on 7.12.1, the address linked to a veth responds even if no container has ever been using it, let alone being currently attached to it. On 7.15.3, it doesn...

sindy

Sorry, you'll have to express the setup and issue using a drawing (a photo of a hand-drawn sketch is normally enough) as it is not really clear (at least to me) what the issue is. I did understand that you've got multiple sites where the ISP modem provides the same LAN subnet, and I assume I have un...

sindy

Is my statement (at high level) correct?

If the intention is to get the same behavior like a single VLAN-aware hardware switch, then yes.

sindy

I'll check it once it fails again, if its gone form there I just wanted to be sure that the router uses USB to talk to this particular modem model. So do check whether the row is still there once it fails, but after you do that, try /system/routerboard/usb/power-reset duration=20s . If it asks for ...

sindy

I'm not sure how it the LTE modem is connected on hAP ax lite LTE6 - what does /system/resource/usb/print show when the LTE interface is present in the configuration?

sindy

Whilst my personal opinion is that it is better to post in the original language than to post already machine-translated text (as posting in original language prevents information loss), other forum users may have a different opinion. But more important - it is not clear to me whether you want the t...

sindy

I would say that like in many other cases, sniffing is your friend here. If a router finds out that the out-interface is the same like in-interface for a packet towards a given destination, it does forward the packet, but it also sends an ICMP message to the original sender, informing it that a bett...

sindy

VLAN virtual interfaces Does a virtual VLAN interface react only to packets tagged with the specific VLAN ID? What happens when a properly tagged packet reaches a virtual VLAN interface? Does it get "untagged" by the interface, or does it preserve the 4bytes for VLAN identifier? What happ...

sindy

As for the cross DHCP offers, I have enabled DHCP Snooping on the bridge and made the VXLAN port untrusted, is there still a problem? I'm not sure the treatment of DHCP packets on a VLAN-enabled bridge is any more useful than matching by IP address in bridge filter rules, you have to try - the manu...

sindy

@CZFan has found this: viewtopic.php?t=151067#p814972

sindy

Many things may be set up differently on both the Mikrotiks and the Windows PCs. Since the pinging between the bridge addresses of the Mikrotiks themselves works, and even some connection between the two PCs does (the VNC one), it means that Wireguard itself and the associated routes are OK. Unless ...

sindy

If I configured more that one subnet on the polices and the nat settings, but only one subnet has communication end to end.

Set the level of all the policies you've added to unique. If that does not help, post the configuration exports from both devices.

sindy

In easy things to try... setting the mode to "IPv4" instead "auto" in the APN is worth a shot.

Somehow there is an IPv6 DNS query that got responded in the sniff above... so I wonder what the mode setting is actually worth

sindy

and how if i want to access the windows service such smb or windows sharing ? No idea, I'm not that deep into Windows so I have no idea what is the default behavior for their various proprietary protocols. right now i can access VNC PC B from PC A and vice versa, so how can i access windows share o...

sindy

Or export the current config and compare it using diff on an external computer with all the other ones.

sindy

You can src-nat to any address you want but in order that the response could reach your router, the routers on the return path must send it to your router, and if L2 network is used between your router and the neighbor, your router must respond to ARP or ND messages for that address. However, the th...

sindy

As written above - Windows by default would not respond to ping requests that arrive from outside its local subnets, i.e. where the ping response would have to be sent via a gateway. So you have to change the Windows firewall settings, use some other method to determine that the PC is alive, or use ...

sindy

Do you mean, that a Peer field in Policy itself will be used? and the policies are reverse matched to peer? Indeed. A manually configured policy must refer to one or two peer objects and if the actually connected remote initiator proposes a traffic selector, only the manually configured policies th...

sindy

Did you actually used udp for that? Rest assured I did :D Maybe the missing dstnat EINAT rule is the problem? Indeed. It did not come to my mind that filtering might be controlled by a rule in dstnat chain, although now as you've pushed my nose into it I can imagine the mechanism behind. OK, I will...

sindy

I can't give you a link to a better documentation that the Mikrotik one, but I can help you in question-and-anwer mode :) First answer: Phase 1 proposal parameters are aggregated on rows of /ip/ipsec/profile , Phase 2 proposal parameters are aggregated on rows of /ip/ipsec/proposal . Second answer: ...

sindy

Apparently I was reading too diagonally today :) My impression from your OP was that R3 was a wireless client of R2. Since it is not, there is no need to configure its wireless interface(s) to station-bridge mode. Just two AP mode interfaces, one master and one slave, each linked to another VLAN. As...

sindy

The routes and allowed-address items seem fine to me. Windows devices by default only respond to pings coming from the own subnet of the interface, could it be this simple?

sindy

If the question was for me - if R1 presents 192.168.1.0/24 and the path to the PPPoE server on the same physical interface, then indeed the PPPoE client has to be connected to the VLAN interface on the common bridge. If there are two separate interfaces on R1, one for LAN and another one for the PPP...

sindy

Both ways are possible, each Wireguard interface may have multiple peers, that's how it is designed.

sindy

I think the above would be unnecessarily complicated. I would set the master wireless interface of R3 to station-bridge mode, make it a trunk port for multiple VLANs, and use the "single common bridge with vlan-filtering=yes for all VLANs" mode also on R2, so that its WAN would be yet anot...

sindy

I'm not sure I understand properly, but the fact that it works for the road warrior means that the port 13231 on site A is reachable from the internet. So in order to add the site-to-site functionality, return the /interface/wireguard/peer row representing site b (with allowed-address=192.168.90.0/2...

sindy

The other address comes by SLAAC and is the one MT's DDNS reports. Ah... as you have to force Mikrotik to use SLAAC when configured as a router, I never went that way. The SA's correctly go out the AT&T side, so there is no encapsulation. You mean IKE/IKEv2 here. Both Phase 1 (IKE, IKEv2) and P...

sindy

1. should Set keepalive on site b to 30s, but not on site A or on both site ? site b only. 2. should i add ip address for both wireguard interface? and add route for both interface? Only add the routes corresponding to allowed-address at the same device. There is no need to attach an interface to t...

sindy

Other packets are accepted in filter established rule That's not true. The individual stages (tables) of the firewall are passed independently and accept in filter is only relevant for filter . It's the first packet because the following ones go to connection tracking. But honestly, I am still a li...

sindy

how can i check if there was successfull handshake ? The last-handshake column as mentioned above is completely absent if no successful handshake took place yet. If the column is present but the time shown is longer than 2 minutes, it is also suspicious. There is a moment in your exports that I don...

sindy

I did not ask for results of torch , I asked for results of sniffer , and there was a reason to it. Recently I have seen a situation where the traffic from the router to the LTE modem went from a more or less normally looking MAC address but the LTE modem was sending the responses to MAC address 00:...

sindy

We have to go step by step. So far I still have no other idea than fragmentation issues (the EoIP transport packets carrying a 1514-byte Ethernet frame are far bigger than 1500 bytes, so they have to be fragmented in order to pass through paths with L3 MTU of 1500, and if something is miscofnigured ...

sindy

how can i get the configurtaion ?

Here's why and how.

how can i check if the wireguard connection was working ?

/interface/wireguard/peers/print detail shows items like current-endpoint-address, current-endpoint-port, rx, tx, last-handshake.

sindy

can anyone give me some guide to solve this ? It "should" work so the best course of action is to post the exports of the configuration of both devices (after removing any serial numbers, logins to external services, and replacing the prefixes of public addresses in such a way that the re...

sindy

They are not untagged by the bridge, they get from ether2 to the tagged end of the VLAN20 pipe still tagged. It's the passage through VLAN20 that removes the tag. In the opposite direction, the tagless frame that arrives via eoip-tunnel1 passes through Bridge_VLAN to the tagless end of the VLAN20 pi...

sindy

my understanding is that Starlink does randomly change the prefix. Sometimes every day, other times it may stay for weeks. My own experience was that the /56 did not change for months (until the Ethernet adaptor finally broke so it wasn't possible to use the bypass mode any more without an addition...

sindy

It's not adding the tagless end of VLAN20 as a member port of the bridge, it's rooting the tagged end of VLAN20 in the bridge whose member port is ether2 . So the frames tagged with VID 20 that ingress via ether2 will get to the tagged end of VLAN20 via bridge bridge and egress there, get untagged, ...

sindy

You have posted only the export from the "local" end, so some information is missing; however, what is definitely wrong is that the VLAN interface VLAN20 is hooked to ether2 whilst ether2 is a member port of bridge bridge . Such an arrangement is incorrect and known to cause issues, so you...

sindy

Show me the configuration exports, that indeed sounds strange, unless the addresses are from the same subnet.

sindy

If so, try attaching a DHCP client with add-default-route set to no to the bridge that joins the EoIP with the Ubnt-facing VLAN interface and try pinging the IP attached to the remote end of the EoIP tunnel with size=1500. Do you get responses?

sindy

If you can ping even public addresses through the EoIP tunnel, it sounds like an MTU issue (if you haven't forced the MTU of the EoIP interfaces to 1500, which is what the wireless clients probably expect) or a reassembly issue (if you have forced the MTU of the EoIP interfaces to 1500, so the size ...

sindy

Even in debug, the logging typically shows only control traffic and omits the packets carrying only payload. So sniffing may show you e.g. long periods of silence in one direction and corresponding retransmissions in the other one. Less important, my personal experience is that people tend to accept...

sindy

I can only suggest sniffing on the underlying Ethernet interface. As the sniffing has to record all the traffic right before the disconnect, the amount of sniffed data will be proportional to your total traffic on that PPPoE interface. So unless your router has a USB port and you can sniff to a file...

sindy

There are very few Mikrotik products whose switch chips support VLAN ID manipulation using rules, and I do not happen to own one of these so I cannot test it, hence the following is just a theoretical suggestion. The switch chip rules handle the frames as they ingress, so the rule you have used, /in...

sindy

You can use a dst-nat rule to forward a list of ports or port ranges to the one where the Wireguard instance listens, but in countries where this is a concern, those "someones" typically use DPI to filter wireguard and other VPN types by packet contents rather than by port numbers.

sindy

I added 4500 and 500 (maybe that one's not necessary since I have NAT traversal set on the office side?) accept rules on the office side, and esp rules on both sides. Support of NAT traversal is an optional extension in case of IKE (v1); in IKEv2, it is part of the standard so there is no need to e...

sindy

Just for the case - if you activate the bypass mode on Starlink, you get a static global /56 on the LAN side of the Starlink dish (in addition to the CGNAT IP address). But assuming you have your reasons to stick with IPv4, if by "relay" you mean a device on a public address that both the ...

sindy

At this stage I've got no other idea than checking one more time that there is no typo in the settings of the .2 and .3 peers in the central site configuration, as .2 may shadow the .3 due to a typo in the mask (e.g. /3 1 instead of /3 2 ) and the .3 may be just wrong (something similar to 20.99.9 8...

sindy

Grrr... I've got it in front of my eyes all the time. The mistake are the /24 masks in the allowed-address lists on the "hub" device. Change 20.99.99.1/24 to 20.99.99.1/32, 20.99.99.2/24 to 20.99.99.2/32 and so on and you'll be good. The thing is that when the virtual Wireguard router rece...

sindy

Strictly speaking both 20.99.99.254/30 and 20.99.99.254/24 are incorrect ways to express the 30-bit prefix 20.99.99.252 and the 24-bit prefix 20.99.99(.xx), respectively, but the Wireguard configuration is apparently not that picky and accepts these formats, treating them the same like the formally ...

sindy

Sorry for gramer. No need to say sorry, I was just explaining where my uncertainty regarding what is the actual issue comes from. In your OP, you've mostly used 2 0.99.99.x , now you show to be pinging 1 0.99.99.x . Could it be as simple as having a typo on the first two peers? I have seen a manual...

sindy

I'm not sure what you have in mind, running a container with NodeRed on a Mikrotik device? Containers can only run on arm, arm64, and x86_64 devices, so anything *mips* is out of question. And an external disk is a must for containers, otherwise you'll kill your internal flash in weeks even if it is...

sindy

Wireguard is up, there is tunnel betwen server and all 4 peer Based on what have you concluded this? The wireguard interfaces are always shown as R unning, even if no peers are configured. So it requires sniffing to determine whether the communicaton between the peers has indeed been established. F...

sindy

First, what do /interface/lte/monitor lte1 duration=1s and /ip/address/print where interface=lte1 show (obfuscate a public IP if you get one)? Second, can you ping 8.8.8.8 from the router itself? Third, if not, open a command line window, make it as wide as your screen allows, run /tool sniffer quic...

sindy

Assuming that neither Router C itself nor any client connected to it use 10.0.0.1, on Router C, you can add a route to 10.0.0.1/32 via the address of Router B in 10.20.x.x, and then you can make Router C selectively respond with its own address only to 10.0.0.1 using /ip arp add address=10.0.0.1 int...

sindy

First, is my assumption correct that currently both devices have a public IP address on their WAN, so IPsec does not have to encapsulate ESP packets into UDP? Second, there is nothing in chain input of your firewall filter rules that would permit the Main Office router to accept incoming IKEv2 conne...

sindy

You may want to revisit the configuration of the Main Office router and improve the obfuscation.

sindy

configure it so that it replies to ALL possible IPs with it's own MAC and forwards all traffic to router C, say, 10.20.0.1. I figure you mean all possible IPs within 10.0.0.0/24, as that is all it ever gets any traffic for from Router A, is that a correct assumption? The key here is the proxy-arp f...

sindy

right? right. Is there any special settings required for CHR1? None I would be aware of. If you can telnet to port 80 on the global IP of CHR2 from CHR1 (in terms that the TCP connection gets established) and ssh forwarding is enabled ( forwarding-enabled: both ) on CHR1, it should work also via th...

sindy

... couldn't get any traffic over IPv6, which I guess is due to the fact that there are some configs and setting missing on my routeros end which I don't know of :( ... proxy forwarding without any additional settings on Linux itself ... I have just tested the suggestion of @mkx with PuTTY where I'...

sindy

I have to test how exactly the endpoint-independent-nat works before commenting on the case when there is no manually configured dst-nat rule but the action of the rule in srcnat is the endpoint-independent-nat one, so I won't speculate here until then. Did you already investigated on this? So I've...

sindy

OK, so indeed ether2-clientB is an access port to VLAN 88 on bridge1 , same like vxlan2-home . But in that case, the topic actually changes from "why is the packet for (presumably) 192.168.189.x that came in via ether2-ClientB routed using a 'wrong' route" to "why is the packet that c...

sindy

If the router was offline for long enough that the lease has expired (or if the interface to which the DHCP client is attached went down), a new lease is requested rather than the previous one being renewed, and therefore the script does get invoked.

sindy

Since VxLAN is normally used for L2 tunneling, I did not study your config too deeply at first and assumed that the issue was with routing of the VxLAN transport packets (the UDP ones carrying the payload L2 frames inside), sorry for this lack of concentration. However, when looking at it with more ...

sindy

The explanation why this happens and the solution if you insist on L2TP/IPsec is here ; further in the discussion there are some suggestions what else to use, but in my case, I use SSTP clients on the remote Mikrotiks to manage them remotely. Be aware that using SSTP without at least a server-side c...

sindy

One possible cause of this is that some security appliance on the path between the client and the server inspects the payload of the TLS connections using a MITM techniques, i.e. it behaves as a client towards the server and presents an ad-hoc certificate signed by its own root CA to the client. Fro...

sindy

There is a script item of the dhcp client, which is invoked each time the DHCP asignment changes (address is lost, address is obtained, address is changed); it is not invoked if the lease is renewed without any change. So instead of scheduling the scripts for a periodical run, you can just set this ...

sindy

i use ipip tunnels from each side , i don't see any passive options That's the case I have anticipated above - you've told RouterOS to create the IPsec configuration providing the IPsec encryption for the IPIP tunnel for you automatically, by setting ipsec-secret parameter of the row of /interface/...

sindy

I'm still missing something because the return traffic is routed using the catchall route to the WAN interface where its getting lost obviously. I've reviewed the post I've linked and it indeed does not deal with anything but the mangle rules, assuming that the reader already understands the rest o...

sindy

Can you elaborate on how you connect via the ssh "tunnel"? Do you configure forwarding to a particular address:port combination (or a list of them) or you use the proxy mode tunneling?

sindy

Most likely yes if you post the export of your configuration (go to command line, use /export hide-sensitive file=somenicename , then download somenicename.rsc , open it using a text editor, obfuscate public addresses and other sensitive information and post the result here between [ code] and [ /co...

sindy

Such a setup is indeed possible. Post exports of both Mikrotik devices to get to the root cause of that "no Phase 2". When obfuscating public IP addresses, take care so that all occurrences of the same public subnet are aliased the same, i.e. that the obfuscation does not break the relatio...

sindy

One of the parameters of an /ip ipsec peer item is passive ; if you set it to yes , the device will only act as a responder for that peer, i.e. it will not try to establish a connection to it actively (i.e. act as an initiator). With passive set to no , which is the default, it does both. If you use...

sindy

As was explained to me, Ping is checking to see if if something is UP or ON, while ARP is checking if something is down or OFF. Reverse viewpoint same results...... Nope. Just some devices choose to respond only at protocols and ports they like, so they may ignore even pings from their connected su...

sindy

The example Sindy posted, making use of the scheduler, runs every x time so it needs both a check and a conditional execution inside the script. The only reason why I prefer scheduled scripts to netwatch is that netwatch can monitor only a single host, so if that host becomes unreachable (and I hav...

sindy

Sounds like my skill issue :D "Skill" and "experience with the oddities of various ISPs" are not the same thing :) I'd suggest to disable just the routing rule and try the same ping again - if that prevents the pings from getting responded, we can be sure that the ISP indeed che...

sindy

I would expect the traffic to return the same way it came in. That's exactly what does not happen automatically. The basic routing only takes into account the destination address. If you want the route to be chosen according to any additional criteria, like the source address, protocol, source and/...

sindy

Step 1 - insert the Huawei ONU SFP into SFP port 1 of your CRS. Check whether interface ethernet monitor sfp-sfpplus1 (or an equivalent in Winbox) even shows you the module. Step 2 - if it does, create a new bridge interface, and move one of the copper Ethernet ports (basically any of them except th...

sindy

Since the VxLAN transport is not "symmetric" in terms that the packets from node A to node B use the port specified in the /interface vxlan vteps table as destination but a randomly chosen one as source, and so do the packets from node B to node A, could it be that a firewall on the Linux ...

sindy

A lot depends on how paranoid your ISP is - they may check whether you send the packets from an IP address from the same MAC address from which you have requested the lease of that IP address. So first of all I would check that the dhcp client attached to the macvlan inteface has a valid lease, and ...

sindy

Sadly, there is no way to selectively suppress IPsec logs per peer (or interface logs per interface, ...). If you can the peers at your side to passive mode, you can reduce that to a single error as the branch disconnects.

sindy

The above may be confusing, so if you haven't changed anything yet as compared to the configuration you have posted, copy-paste the following rows into a terminal window one by one: /ip pool set [find name=dhcp] ranges=192.168.88.10-192.168.88.254 /ip dhcp-server set [find name=dhcp1] interface=brid...

sindy

Oops, I have missed this one:

/interface bridge port
add bridge=bridge1 hw=no interface=ether1

So this one does explain why ether1 is bridged with the remaining ports.

But it places a big question mark over the presumed "reset to defaults", it seems it has never actually happened.

sindy

Weird but zip file can not be extracted or opened, errors invalid file etc. downloaded by WinBox. Only was able to view file if open it without extraction inside WinRar Nothing weird about that - it indeed is a plain text file. .rsc probably stands for R outerOS Sc ript or so. There are several wei...

sindy

When a PPP-something (L2TP, SSTP, PPTP, even OpenVPN) client establishes a connection to the server, a virtual interface is created for that client on the server, the name consisting of a <pppoe- prefix, the username, eventually and order extension like -2 , and a suffix > . So if user john has conn...

sindy

Nothing in https://help.mikrotik.com/docs/display/ROS/User+Manager#UserManager-Overview suggests that User Manager could (currently!) use anything else than User-Name and Calling-Station-Id when searching through the list of users. The attributes list configured for a user indicates which attributes...

sindy

1. the SSTP control and transport packets use the IP protocol you have chosen implicitly by setting an IPv4 or IPv6 connect-to address. Inside the transport packets, the PPP does its usual job, so there are more or less independent tunnels for each type of payload (IPv4, IPv6, BCP, MPLS, ...). 2. th...

sindy

Copy-paste the following commands into a command line window on each LHGG - it is not dangerous as the scheduler row will be added as disabled and a script does nothing until you execute it manually or using the scheduler (or another script). /system script add name=test-wan source=":local locG...

sindy

The way you describe it you indeed need a scheduled script at each LHGG that will check the transparency of the local WAN by pinging some addresses in the internet via the local ISP router, and if none of them responds, update the gateway item of /ip dhcp-server network with the IP address of the re...

sindy

Da-a-a-m ba-a-a-d 🐑 (© 1900 Jerome Klapka Jerome) The thing is that the essence of all the challenge-based algorithms (including the two MS-CHAP ones) is not to transport the password itself across the link between the client and the server, so there is no way how it could get logged. So it might be...

sindy

Not sure whether in the logs, but: if the client allows PAP, you can set the L2TP server to only accept PAP, and then you will see the password in plaintext - at least in .pcap (sniff) if not in the log. Otherwise you'll have to assign new passwords to the users.

sindy

Windows use a specific method to obtain a route list from the VPN server - they send a DHCPINFORM request asking for Option 249, which is a route list. The only VPN type where RouterOS responds this request is bare IKEv2 (and to make things worse, I have recently come across a case where a particula...

sindy

I would say that what you need to look at is VRRP. Assuming you now have physical.ip.A and physical.ip.L as the addresses of the two routers on sites A(DSL) and L(TE) respectively, you would add two VRRP interfaces to each router, one with virtual.ip.A and the other one with virtual.ip.L, but the pr...

sindy

as a bridge i use WAN port to connect main router and then any LAN port to connect to laptop/PC in PTP Bridge AP mode all working good including Wi-fi, just tested Please post the export of the configuration: run /export hide-sensitive file=somenicename in terminal download somenicename.rsc to your...

sindy

...and if you purchased both the SFPs and the patchcords in the same human-operated shop, I would suggest to use some other one.

sindy

Since the existing cables are orange (but my color perception is not ideal so I may be wrong), your choice of SFP was incidentally correct (orange coating normally means multimode), whereas your choice of the adaptor patchcords was incidentally wrong (yellow coating normally means single mode). The ...

sindy

There are actually three elements under a common name bridge - the virtual switch, one of its ports, and an interface of the router that is connected to that port. The virtual switch does not touch VLAN tags when forwarding frames from one port to another; the tag may be added as the frame ingresses...

sindy

No idea what that indicates - in both cases the DHCP server indicates the same in-interface, vlan0.50. But the sniff shows that the DHCP server response arrives to ether1 without tag. I have no idea why that happens.

sindy

The sniffing result shows that the tagging by the wireless stack works fine, and that the frame received from 2.4 GHz guest interface gets properly multicasted to the 5 GHz interface, ether1, and bridge. But there is no response from the router in what you posted. Can you add port=67 to the sniffer ...

sindy

I also think that setting vlan-id=300 and vlan-mode=use-tag on the two wireless interfaces should be sufficient and you should not need to set vlan-filtering to yes on the bridge and use the pvid=300 setting on the /interface bridge port rows and the row for vlan-ids=300 settings in /interface bridg...

sindy

I may be wrong here, it's only my own conclusion from observing the behavior, as the desrciption in the manual says something else (or maybe the same but in a pythic wording): if you have two policies between the same peers, require allows to use the same pair of SAs to deliver packets matching to e...

sindy

It sounds very strange, as you say the management access is still possible and you could upgrade and downgrade it even using netinstall. Since netinstall is not exactly user friendly, I suppose you did check after netinstall what the version was using a normal management connection (winbox, webfig, ...

sindy

First of all, change the level parameter of both policies from required to unique. If that does not help, we'll dig further.

sindy

Do you think I can or should add another layer of access as a backup to the WG?

I have already expressed my opinion on that here. An additional tunnel can be useful but it is not a panacea.

sindy

No updates were installed, just like the user posted on the Samsung site. Somehow, magically it started working. This is very strange. Somewhere at the beginning of that Samsung thread someone said that these "security updates" are downloaded in the background and installed without asking...

sindy

I don't know is GRE, IPIP, or L2TP would be an alternative to EoIP that would satisfy the needs above, or if there is a better alternative (something without the unnecessary broadcast/multicast traffic problem). I'd suggest you study a bit of the networking basics, like the meaning of L2 and L3 in ...

sindy

What is the topics list for that log line?

19:13:29 fetch,info Download from api.telegram.org FINISHED
19:13:35 certificate,debug start CRL update
19:13:36 system,info,account user me logged in from 192.168.88.254 via ssh

sindy

It's at the other site with a working /56 IPv6 prefix.

I've got that, I just used the VLAN numbes from the problematic site as a shortcut. I should have written "WAN VLAN" instead of "VLAN 10" and "LAN VLAN" instead of "VLAN 2" to avoid confusion.

sindy

Hehe. Remember English is not my first language. So the most accurate wording would probably be "been there, fucked that up myself, more than once"

sindy

However, the NS messages in the ND process refer to the global IPv6 address of the target, and not the solicited-node multicast address. It's weird. Or my IPv6 knowledge is a bit lacking. Maybe it's the effect of a properly configured static route on their part? Wait. By "target" you mean...

sindy

Some change in vlan over wireless... sorry, I don't remember exactly, it's been years ago.

sindy

That's where selective thinking comes into play - the change (addition of the first EoIP interface to the bridge) was made so long before the issue with access to Yahoo got spotted that the relationship did not pop up immediately, and when thinking back, it was "just adding EoIP to the bridge, ...

sindy

MT's Torch is showing some confusing info. Indeed. That's why I always use /tool/sniffer and, if necessary, Wireshark. I can see neighbor solicitation messages and the solicited-node multicast address from the ISP router that go unanswered. ... I temporarily added an address from the internal pre...

sindy

IPv6 addresses are set without prefix length, they should have /64 included. Without it, it's taken to be /128 (just like in IPv4 it's assumed to be /32). This also caught my eye so I've made a test, and the default behavior in IPv6 indeed differs from the one in IPv4, at least in 7.15.3: [me@myTik...

sindy

Mysteries like this one often happen if the MTU in your network becomes smaller than the "usual" 1500 for some reason and PMTUD (Path MTU Discovery) is broken (google up "criminally braindead ISP" to learn the details) on the path between the client and the server. So knowing abo...

sindy

the result of your test is the same using find or find where? ... an old discussion (can't find the link right now) that suggested find is used for single results I have never seen any difference betwen the results of find <condition expression> and find where <condition expression> . So I've tried...

sindy

For those who may have a similar problem or are interested, setting the PFS Group to none in the proposal solved the problem. It seems like an unrelated issue to me. A mismatch in PFS settings affects the connection at the first Phase 2 rekey, so typically in about half an hour after the communicat...

sindy

I still suspect on their side of the link they are doing the equivalent of Only now I understood what you had in mind in your previous post. Yes, indeed, since @kobuki explicitly mentioned "v6 ICMP Echo Request" to arrive to the remote host, I somehow did not expect that (s)he hasn't chec...

sindy

Unfortunately I soon will be on holiday Sounds funny to me to complain about being on vacation :) There is no static priority between manually configured dst-nat rules and src-nat ones (including endpoint-independent-nat). Any incoming packet is checked against a list of tracked connections (unless...

sindy

since I had added those two forwarding rules in the filter table I yet had no "stuck" calls anymore. Either this is just luck or those rules might capture the cases where the connection state is recognized from the endpoint-indepenant-nat/nat as new and would not be catched by the establi...

sindy

Would you suggest leaving the nat-traversal methods of the grandstreams to the keep-alive mechanism or rather switch to STUN? The whole purpose of STUN is to determine the behavior of the NAT behind which the phone is located, so that the phone could put the correct public address and port into the...

sindy

The reason why it does not work is that the first pass of the packet from client 2 to wan-srv (client 2 -> R1) uses the same IP addresses and ports like the second one (R1->wan-srv), so the RouterOS firewall handles them using the same tracked connection. So the initial packet of that connection (fr...

sindy

you configured the ether1, ether2 interfaces as access ports Indeed, and I have admitted that openly straight away :) However, I can't imagine how this difference should be related, given that you can ping the router itself from both sides (VLAN 10 and VLAN 2), so the IPv6 packets clearly do pass t...

sindy

set file-name=usb2/voip-debug.log filter-ip-protocol=udp filter-port=5066,5067 memory-limit=100000KiB memory-limit and file-limit are two different things, and the 3011 does not have that much memory, please fix that ASAP. Also, the default value of filter-operator-between-entries is or , so try fi...

sindy

There are many other places in RouterOS scripting where some keywords are optional. Maybe where used to be mandatory after find and now it remains only for backward compatibility reasons, like hide-sensitive which does nothing (as hiding sensitive information during export finally became the default...

sindy

https://help.mikrotik.com/docs/display/ROS/Cloud :
/!\ IP/Cloud requires a working perpetual license on Cloud Hosted Router (CHR).

sindy

Leaving aside that I forgot to press Ctrl-C once so instead of pasting just the single ovpn-client line to my test CHR (to check what is the default value of add-default-route ), I pasted your complete configuration there, there is indeed no reason why enabling and disabling the ovpn client should i...

sindy

/interface bridge add frame-types=admit-only-vlan-tagged name=bridge protocol-mode=none vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] disable-running-check=no set [ find default-name=ether2 ] disable-running-check=no /interface vlan add interface=bridge name=bridge.402 vla...

sindy

OK, so no dynamic rules there. I wasn't sure how exactly Mikrotik has implemented the part of the RFC that mentions the filtering requirements related to endpoint-independent NAT, and as no rules have been added dynamically to filter (which would be kind of similar to dst-nat rules being added dynam...

sindy

I don't know whether it is a bad news or a good one, but I have replicated your setup as closely as I could on a CHR running 7.15.3, and it just works. In my case, ether1 is an access port in VLAN 410, and ether2 is an access port in VLAN 402, /interface/vlan for both vlan IDs are attached to the br...

sindy

So you wanted the forum to confirm your suspicion before eventually filing a ticket? Sorry, that explanation did not come to my mind.

I wonder how many other people took my non-sterile formulations as insults but did not let me know

sindy

Think of the EoIP tunnel the same way like of a loooong Ethernet cable connecting two Ethernet interfaces on the two routers. So same steps would be required to use them as a backup communication channel. For example do not make either of the Ethernet interfaces a member port of any bridge, just ass...

sindy

OK. So shall I get it that all you took from my whole post is that I've suggested you to send your valid concern where it will be handled in a form you perceive as offending? Can you imagine how many people believe that Mikrotik support staff reads every single post on the forum? How could I know yo...

Search found 10811 matches