MikroTik

sindy

So a recent experience from another installation suggests that the L2TP server does not check for duplicities - if one client gets an address from a pool and an address that fits into the pool is assigned to another client using the remote-address parameter of the /ppp secret row for that client, yo...

sindy

By default, the virtual switches of most virtualisation platforms only forward frames whose source MAC address matches the one of the virtual NIC sending them. This has to be changed in the NIC settings in order that the vswitch would accept the frames that came via the EoIP tunnel and forward them....

sindy

I would switch to the "installed SA" tab in the IPsec window and start pinging something in 192.168.55.0/24 specifying 192.168.228.1 as the source address for the ping. If the packet counter in the SA from your Mikrotik to the Checkpoint increases once per second, i.e. per each ping reques...

sindy

You can use /certificate export-certificate to copy the certificate from the hEX S to the 5009. Just remember that you have to specify the passphrase for the export, otherwise the private key will not be exported. When importing, import the certificate file first (it will ask for a passphrase but it...

sindy

So my guess was wrong, your firewall setup is very unusual to put it softly. I could understand that if router A was an ISP router with no NAT and you would avoid using connection tracking to save CPU, but since NAT is necessary at least for the connections to/from the internet, connection tracking ...

sindy

in general, how would you recommend setting the rules when I want block so that clients cant reach each other (IP addresses in the "ip_clients" list) and so that even the ISP company (WAN) can't access them. At the same time, of course, I also need them to have Internet access. I normally...

sindy

Is this ok like that or is there a better solution? The rule you have added looks strange to me in terms that you permit access to client subnets from WAN, but again - what you have shown is a modification to a configuration unknown to me, so how can I say it is the best way to do it or the worst? ...

sindy

If you only want the roaming client to be able to connect to devices in 192.168.20.0/24 and not vice versa (i.e. you don't need that those devices could actively initiate connections to the roaming client), /ip/firewall/nat/add src-address=172.16.10.2 dst-address=192.168.20.0/24 action=masquerade sh...

sindy

If you have a route to 10.20.7.0/24 (or what the actual mask is) on router A, NAT at router B should normally not be necessary. So there must be some additional issue which I cannot guess. Hence post the configuration exports of router A and router B ( /export hide-sensitive file=router-X ) between ...

sindy

You can selectively disable NAT for 10.20.7.2 on router B by placing an action=accept rule before the action=masquerade (or action=src-nat ) one and let it match on src-address=10.20.7.2 , or by adding src-address=!10.20.7.2 to the action=masquerade one if src-address match is not used in that rule ...

sindy

If you have multiple machine certificates on that machine, maybe this is what you are looking for?

sindy

But I noticed even with those rules enabled and the ports set to edge, when I click on the status page I see saw that it was checked on SENDING RTSP. Unfortunately, sending-rstp shows yes even on a port that is configured as edge=yes and sniffing shows that indeed no BPDUs are sent out via that por...

sindy

Do you think I should set dst-nat for port 5062? No, just because two distinct ports are used for SIP at 192.168.181.15, I've assumed it's some 2-port gateway or so and hence I was expecting you to have a symmetric setup for both; since you don't, I am a bit confused about the type of the SIP devic...

sindy

You have leaked the public address of the server; if it bothers you, remove the screenshot. Then, disable the L2TP client, wait 60 seconds, run /log print follow-only file=l2tp-start , enable the L2TP client, wait 60 seconds and stop the /log print... by pressing Ctrl-C. Then download the file l2tp-...

sindy

Also we can't reproduce problem, it just happens several times a week. Even better... OK, what I could imagine would be expiration of ARP cache and lazy reaction of the ISP gateway at 192.168.181.15 to ARP requests, making the Mikrotik unable to send the message received from the SIP server after u...

sindy

The SIP ALG should only act if NAT rules are in place, which is not your case. To cover the case that this is eventually not true for 7.11.2, rather than disabling it, try setting it to act on an unused port like 65060. Also, what does /ip firewall connection print detail where dst-port~":506&q...

sindy

OK. Since the distance between the 183 (that went through) and the 200 OK (that didn't) is some 27 seconds, which is far less than the UDP stream timeout on the firewall, we can exclude an issue with the normal UDP NAT. The 200 OK may be huge but the BYE should be relatively small, so issues with LA...

sindy

Something did not go as expected. When I enable logging of L2TP using /system/logging/add topics=l2tp and set up an L2TP client connecting to a non-existent server address, my log shows the following: 12:39:46 l2tp,ppp,info test: initializing... 12:39:46 l2tp,ppp,info test: connecting... 12:39:46 l2...

sindy

I am using x86 Mikrotik on a VMware ESXi for 280Mbps download and 150 Upload. If so, conserving CPU on the Mikrotik VM might help the other VMs on the machine, but if that's not important, no need to change anything about the configuration. the script am talking about was posted by DjSam Indeed, I'...

sindy

I would like to know if that's Okay or if i can improve something. I have no idea what Mikrotik model you use and what DL/UL bandwidth Ogero gives you. Depening on these factors, you might want to save some CPU cycles per packet. Assigning the public IP directly to the Fortigate would remove the ne...

sindy

settings provided from ISP is PPPoE username and password. in addition they provided 1 static real IP to be used in a /30 subnet. and require to disable NAT and use RIPv2. In design [ISP Fiber Modem in bridge mode] Connected Cat6 Cable to Mikrotik Port1 then Mikrotik Port2 connected to Fortigate Wa...

sindy

So just set WAN1 public IP as the source IP for the radius server and it will exit that interface. It doesn't work this simple. The regular routing only takes into account the destination address. So without adding a routing rule or a mangle rule that would order which routing table to use based on...

sindy

Post the output of /export hide-sensitive, between [code] and [/code] tags, after removing any additional sensitive information not suppressed by hide-sensitive (public addresses, serial numbers, usernames, secrets, private keys). Is the Mikrotik the default gateway for the LAN devices?

sindy

Simply by adding a /32 route to the address of the RADIUS server via WAN 1 gateway to all routing tables, so regardless which routing table the "bonding" (actually, it's most likely load distribution) chooses, the packets to the RADIUS server will always go via WAN 1.

sindy

The log should tell you more than this if you set /system/logging/add topics=l2tp. Can you see the log also on the server or is the server not yours?

sindy

in other thread someone said the fix is with listening port So you had two interfaces listening on the same port? If so, one of them must have been showing an error too, so the inactive address associated to it was just a consequence. now that i have 2 surfshark wireguard vpn running, how can i the...

sindy

However, in my setup, the IP address in the list in Winbox looks exactly this way if I disable the Wireguard interface it is attached to. Could it be as simple as that at your end as well?

sindy

heres a screenshot

I did not ask for a screenshot, I do believe you when you say it is red, no need to prove it to me by a screenshot. I asked for an export to see what is wrong in the configuration.

sindy

That looks pretty normal - distinct remote-address values, no pool used on either the /ppp secret row or on the /ppp profile row. What are the L2TP clients, also Mikrotiks or something else? I can imagine the client can suggest an address of its choice and the server may accept it, but already that ...

sindy

Show me the two /ppp secret rows in question, remove passwords before posting of course:
/ppp secret print where name~"test-(0033|0162)"

sindy

Hi im facing same problem can you elaborate how did you made it work, because when i try to assign same ip to 2 wireguard interface the other turns red and invalid Something else must be wrong or you are running a strange version of RouterOS: [me@myTik] > ip address/print where interface~"w&qu...

sindy

Do you use /ppp secret items or RADIUS (User Manager or an external one) to store the configuration of the L2TP clients?

sindy

On the main router (I cannot get rid of it) there is a DMZ set up pointing to Mikrotik. In the log, I see the following, and it stays without any changes before I cancel the connection: respond new phase 1 (Identity Protection): 192.168.10.1[500]<=>"Client's IP"[500] Please help me find o...

sindy

In the configuration export you have posted earlier, 192.168.121.0/24 does not exist, nor is there any route to that subnet via some tunnel. So I cannot give you any useful response until you clarify this discrepancy.

sindy

I can access this router using 192.168.121.200, but I cannot access it with 81.143.42.218 I would like to access this router with the public IP of 81.143.42.218 From where??? From a device on a private address in LAN or from a device in the internet, such as your mobile cphone connected to LTE rath...

sindy

Please bear in mind that English is not my native language, which is probably the reason why I cannot extrapolate from your minimalistic descriptions. I need an example of a particular connection that does not work, with the private (and public, if used) address of the initiator of that connection (...

sindy

I still cannot access private IP's when allocated with a public IP. I don't understand this sentence. Tell me the exact address you want to access and the exact address you want to access it from. Should I drop the idea of using dst-nat and src-nat rules and use another method? If so which one? I d...

sindy

As you say you are not interested in suggestions regarding other ways of connecting the public addresses but only in why it does not work this way, what "other ideas" do you have in mind? I've already written before that if setting arp to reply-only affects the pppoe server operation on an...

sindy

I don't get it. The only call in "remote" is at 12:00:02, from 501 to 1601, Call-ID 7-44Ub0OL5NSjkjmcN94jA.. The only call in "central" is at 11:52:30, from 1270 to 1270, Call-ID d3Rz1_aeZjjXSCHjjjVcPA.. . How are these two related? The time spans of the captures do not even over...

sindy

If e.g. GB3WK needs to talk to GB3MW's public address, the dst-nat rule must act not only for in-interface=pppoe-out1 (or what the uplink interface name is) for access from the internet, but also for in-interface=bridge (or what the name of the interface to which GB3WK and GB3MW are connected is), s...

sindy

It's a mess this time. The single call in "central" and "remote" captures is not the same one, and the capture from "3cx" sends the SIP messages between two local processes across 127.0.0.1. To be able to say something, I need a capture of the same call from the router ...

sindy

Trying to copy and paste the line into a terminal window failed, so I tried to enter the line manually, this also failed. Have you replaced the xxx in the IP addresses by the correct numeric values before pasting? But as you say you had to adjust the OSPF settings, maybe the sniffing is not necessa...

sindy

It was filter with by IP 192.168.59.95 (remote SBC), with no other exclusions. The only explanation I can imagine is that there is a bug in sniffing on Wireguard interface. Ok, found a missing nat, but this not resolved problem... What I saw was one NAT too many, not a missing one... https://drive....

sindy

I'am not sure about everything: When the automatic signatures still worked on this forum, Anav's said "use my advice at your own risk". So: 1. a /30 mask is fine 2.+3. you only need to add the subnet attached to Wireguard interface if you want to access that address through the tunnel. We...

sindy

What about the routes? You should have a route to 172.16.0.0/24 with wireguard_g43 or 10.255.255.2 as a gateway at Side A, and a route to 192.168.23.0/24 with wireguard_f2 or 10.255.255.1 as a gateway at Side B, have you got them?

sindy

Attached pcap files, thanks!!!! Interesting, what was the sniffer filter on "local"? Because on "remote" I can see the SIP signaling from the phone at 192.168.66.22 to come from 172.31.192.2, which suggests that there is a src-nat on the "local", but in the "local...

sindy

Does this help? It defnitely does. You can actually attach all the public addresses to a single interface, but having dedicated ones is not a mistake. I can see your src-nat and dst-nat rules do not match on out-interface and in-interface, respectively, but that is also not a mistake in this partic...

sindy

Post the export of the current configuration, replace any occurrence of the first three bytes of the 8 public addresses with pub.pub.pub and of course remove any usernames/passwords/secrets/private keys before posting, and tell me what kind of equipment it is that your users connect to it (other Mik...

sindy

The reason my customer SMs lost connection as did I was due to firewall being too restrictive. I had gone further in the Mikrotik Wiki https://help.mikrotik.com/docs/display/ROS/Building+Your+First+Firewall and added in the rules under Protect the LAN devices. Turns out I probably shouldn't have do...

sindy

the action=mark-routing ones in prerouting do not stay at 0 and I lost my connection. I had safe mode enabled so I am back in. So much about a low-profile testing with minimum impact on the traffic :( I've missed a small difference between the action=mark-connection rules. In the ones that match on...

sindy

OK. So now, move the action=mark-routing chain=output connection-mark=wan10 dst-address-list=l2tp-sonar new-routing-mark=l2tp-sonar passthrough=no rule to the top of the chain output . Then you can enable all the action=mark-routing rules in prerouting , but keep the action=mark-connection ones matc...

sindy

Do you have any recommendations on other firewall rules that may be required that are not on the Wiki or will the defaults be sufficient enough? If you haven't changed anything in chain input of /ip/firewall/filter since the last export you've posted, please do the following steps until the first u...

sindy

I'll have to imitate that case and give you an update for the script. Remove the existing lease-script and copy-paste the following to the terminal: /system script add name=lease-script source=":if (\$bound=1) do={\ \n /ip route {\ \n :if ([:typeof \$\"gateway-address\"]!=\"noth...

sindy

A full export of the current configuration, please (with the public address obfuscated if it is present in the export, and any passwords/secrets/private keys/usernames removed). Too many things may be involved. The order of firewall rules matters, that's the first thing I would look at.

sindy

screenshot attached. Now hold up. The 10.5 GiB of data shown in most mark-routing rules in chain output mean that your device itself is sending tons of its own traffic (not one forwarded from the customers); as it has no reason to do that actively, and as these rules translate connection marks to r...

sindy

To ensure I understand correctly. Once final configuration is done, I shouldn't need to link Sonar and the VPN to a WAN? Yes for the Sonar if you keep connection marks in use (which is what I was expecting), maybe for the VPN. I cannot say why the L2TP was struggling initially and then later after ...

sindy

Great that you have found the issue elsewhere, but please be aware that a packet trace on the switch cannot show you how the packets looked on the wire, because the CPU recording the trace can only see the frames after they passed through the switch chip, so some switch chip rules may have already m...

sindy

In my understanding of the universe, it would be a serious bug if a switch would modify the contents of the frame beyond the L2 header without being explicitly told so. So the first thing to show is the export of your configuration, with any private information like passwords, secrets, private keys,...

sindy

There should be nothing special for a CCR 10xx vs. RB2011 configuration-wise. There may be an architecture related bug that cannot be affected by configuration, there may be an issue in 7.12 (you haven't specified what version was running on the 2011), but most likely by experience, there is some di...

sindy

I am sure there is some changes I could make to improve things so please do let me know what you find that needs to be changed. I kept the PCC mangles for the bridge-lan disabled for now until those can be fixed but so far I don't see any problems at this time. What I can see is that you have decid...

sindy

(1) I like that idea and I am implementing that now. Well, I don't like that idea, and we already had a private discussion about it with @anav. Your configuration is already complicated enough, and creating multiple connection marks and routing marks/tables that get ultimately translated to the sam...

sindy

1) I would use Wireguard (if possible) for the management VPN. If one end (your office) has a static IP, the remote end(s) (the router(s) behind Starlink) can be configured to always connect to that IP, and it reconnects really fast. Event better, strictly speaking it even isn't a reconnection - if...

sindy

This is the documentation ... I am not sure if it answers your question but this is all I really know about it. It does. The good news is that as they ask you to create the rules manually, they are interested in their ultimate effect, not in the particular rules themselves. Apparently all of our 10...

sindy

With every single page these days pulling in feeds from multiple locations... And sites requiring log ins from a specific IP address... And if the IP changes... You have to log back in. I mean voip and video calling take it the worst, actually wifi calling takes it the worst. As for src-nating the ...

sindy

... tried disabling the forward mangles as you suggested. Although those are needed for Sonar per their documentation ... A very important question here is whether Sonar needs just the effect of these rules or these rules must be there literally because Sonar's API scripts check or even manipulate ...

sindy

CRS devices are switches with a full routing feature set but a too weak CPU to provide routing of LAN <-> WAN traffic. As you mention LAN & WAN and firewall rules, I gather you are indeed using the device as a router with NAT. Look at the test results tab on the product home page, in particular ...

sindy

I ... tried disabling the forward mangles as you suggested. ... in any case it seems to have broken our VPN connection as the logs are showing it trying but failing to establish a connection. The only way how disabling only the mangle rules in forward chain could affect the L2TP would be that it wo...

sindy

Hello Sindy,

I've sent you an e-mail, check your spam folder if you haven't received it.

sindy

First of all, what does the sniffer show you on the WAN port of the Brand New Router when you run the scanner? The definition of "open port" is not that easy with UDP. With TCP, if you send the initial SYN packet from a client, the server must respond with a SYN+ACK one so that the session...

sindy

Can it be done with L2TPv3 Ethernet over UDP? I haven't tried that with L2TPv3, but it does work with traditional L2TP with BCP (that allows to interconnect bridges on the tunnel endpoints, no VLAN filtering supported as the tunnel is added as a bridge port dynamically and there is no way to define...

sindy

Before reading the configurations, I'd rather see the sniffing results first. It should show you whether the RTP arrives from the 3CX to the router that is closer to it. If it does, the RTP may get lost when forwarded by that router to the Wireguard tunnel, or when passing through the tunnel, or whe...

sindy

Sindy this is what he says ... There are multiple posts where @kissge83 describes it and I read all of them the same, that the packet does not leave the local router, i.e. the packet is not sent via the local GRE interface. Of course that also means that it never reaches the remote router, but whil...

sindy

A question I have on that lease script. I assume that is meant to be placed inside the script section in each DHCP client? It makes sense to me that it would be appropriate to put it there but figured I would ask. To be precise, it is meant to be placed just once into the /system script section, an...

sindy

You are stating and seeing exactly what I am seeing as well no packets exit the far end of the tunnel from the tunnel IP which is why you can't ping pr route thru it. But that's something else that what @kissge83 has described in the OP. You can see that the packets do not exit the far end which ma...

sindy

It might be best to start fresh with the mangle rules. Let's go that way if you like, but I'd prefer a more interactive communication channel than the forum. This kind of "share the wisdom" sites is great to describe typical setups and principles so that others could follow them, but ther...

sindy

Can you let me have the instructions for programming a LAN port with a public IP, without using scr-nat and dst-nat rules that you mentioned in a previous post. There are many ways, from one wasting 5 of your 8 addresses for "overhead" that works with any type of LAN client to more effici...

sindy

I can assure you on OS7.12 you can't IP route thru the GRE tunnel IP's. Maybe there is some misunderstanding? Without IPsec, it works in ROS 7.12 as expected, see below. Test setup: a /24 subnet is attached to the GRE tunnel interface on the DUT: [me@myTik] > /ip/address/print where interface=gre-t...

sindy

Could you provide some assistance with getting this going? I have read a bit about PCC and started working on it with the help of anov who was the first to respond to my post. I do have many mangle rules and static routes created but they are currently disabled until I am certain they are configure...

sindy

You get it right. The first routing chooses an out-interface and assigns a source address (unless the packet being routed is a response and unless its source address has been assigned according to configuration or a command line parameter). The mangle rules in chain output can see this out-interface...

sindy

can anybody shed some light on the significance of this... I cannot provide an official documentation, only practical experience. The use case is that the router with dual-peer policy (typically acting as an initiator) establishes an IKE/IKEv2 SA with both peers (typically acting as responders) but...

sindy

The only idea I've got is to sniff the same call simultaneously at both Mikrotiks to see whether it's the phone asking the 3CX via SDP to send the RTP to a wrong public address it has detected using STUN or some firewall/routing issue on one of the Mikrotiks.

sindy

Unfortunately it does not have the capability to use FQDN and not sure if they will add that in future updates. The reason for the question was that the router could update a DNS record in your company DNS if the latter has an API for that, or using the Mikrotik "ip cloud" service, or usi...

sindy

There are chains srcnat and dstnat , and there are actions src-nat and dst-nat (and for the sake of completeness, there also connection states srcnat and dstnat that firewall rules in other tables than nat may use to match packets). Action masquerade is a special case of action src-nat that a) deter...

sindy

A couple of questions regarding Sonar:

can it use an FQDN of the router it manages rather than an IPv4 number?
does it require a continuous connection or it is not an issue if it loses contact for minutes?

sindy

Can you help me please? I assume I can help but I am not sure what the problem is. The order of firewall rules is important but only within the same chain (i.e. rules in chain dstnat can be interleaved with rules in chain scrnat, only the mutual order of rules in the same chain actually matters). I...

sindy

Currently I have no filter rules that would block incoming connections, Firewall is wide open until I get it working then I will work on the security. A big fat NO for this. Firewall is the first thing to deal with when you connect something directly to the internet, always, no exceptions. The filt...

sindy

I had just added -wanN to the end of the default names but willing to rename them to simplify things if necessary. Depending on the order of creating the DHCP client, renaming the interface it is attached to, and possibly rebooting the router in the past the result may be different. The lease scrip...

sindy

Maybe consider adding some monitoring of the starlink performance — which is kinda annoying since it use gRPC, not SNMP. I know there is starlink plugin for Prometheus, but if you have some other NMS somewhere... imagine there are plugins for starlink. The terminal's gRPC data includes stuff like m...

sindy

I suppose the 192.168.181.15 is on the LAN side of the Mikrotik, is that correct? The timestamps are missing in your screenshot, but already the 200 OK messages are not forwarded, so the timeout has to be quite short or the called party must be picking up quite late, as the normal timeout for a resp...

sindy

So here's how to make the DHCP clients add/modify the routes the necessary way. First, copy-paste the following script to the command line window of the router. The exported form looks awful, but it is not invoked until you change other things in the configuration, so you can paste the creation scri...

sindy

I had removed some sensitive data in the config before posting it. That's likely why it wasn't in there. Clear. OK. Now let me clarify some points that may not be obvious. First a disclaimer - I am aware that you have inherited most of the current configuration from the previous administrator, so i...

sindy

The L2TP client is running directly on the Mikrotik router in Alaska and it connects to another Mikrotik router at our HQ in Oregon running the L2TP server. Then something must have gone wrong in the process of posting the configuration, because I can see no /interface l2tp-client section there. Th...

sindy

ECMP works fine V7 – it relies on connection tracking to store the routing decision for future packets. Thanks. I was wondering about this for some time already. The LTE being 600ms would imply the cell networks backhaul is using GEO sat, which at a full transponder would be ~50-100Mb capacity rang...

sindy

So I finally got to reading through it, and I am trying to put the bits together. You wrote that the public IP addresses assigned by Starlink with the high priority subscription were changing but now they are not, but if I get it right, the L2TP/IPsec tunnel still keeps disconnecting (or is not conn...

sindy

Well, use cases where it would make sense actually do exist. Some of them could be resolved by using a multicast address, other ones by taking source addresses into account when choosing the route/gateway/peer. I have even met people who had valid reasons to connect multiple devices with exactly the...

sindy

Could you please give an advise, how to tune it up to make more efficient ? The efficiency consists in pushing the mid-connection packets through as few firewall rules as possible. In your case, a mid-connection packet that must not be fasttracked hits 4 rules in total - the one in mangle that sets...

sindy

I can see if they really do manage to "escape" by looking at masquerade rule packet count for that interface You cannot. A stateful nat, which is the only variant of NAT made available to the administrator in RouterOS, is just one of the many functions of the connection tracking. So whils...

sindy

Yes, two uplinks are continuously available on one cable. If so, you can use the mode switch button to modify the configuration. But not all router models support a mode switch button. You can use multiple LAN ports and multiple routing tables, so equipment connected to one of the LAN ports will us...

sindy

I much like certificates more as authentication. You are one of few :) Certificates are essential for proxied trust (i.e. where you have to rely on a 3rd party to guarantee authenticity of your peer because it is impossible to exchange keys with the peer before entering into contact, or in full mes...

sindy

there's HAVE TO BE a default 0.0.0.0/0 route in @main routing table, even if you're routing differently. If there's none, mangle gets very confused Mangle doesn't get confused, mangle most likely has nothing to handle. When a process on the router itself sends a packet, it uses table main first, un...

sindy

I failed to get working lots of variants of fasttrack that I tried to study. The default action=fasttrack-connection rule doesn't care about packet direction. Packets belonging to a given connection can either be mangled or fasttracked, not both. So no packet of a connection whose traffic needs to ...

sindy

@sindy – I have no idea :lol: I suspect it's from the times I've tried to make multicast work between VLANs and it's a leftover from previous config... Thanks! I removed it Nice to learn that you have removed it, but I've mentioned that because I've thought that the strict setting was the reason wh...

sindy

it seems that it does not need a public IP on both sides, which would be perfect and it would be L2. Do you think it would work in my case? For all VPN protocols supported by Mikrotik, it is enough that just one end of the link has a public IP address, or at least that you can set up port forwardin...

sindy

my eth1 and the pppoe connection is same connector. That's what I have expected, but I cannot see any static IP configuration linked to ether1 in the .rsc file, nor a DHCP client, so what have I missed? Other than that, do you have in mind that both uplinks are available on the same cable all the t...

sindy

What has made you set rp-filter to strict under /ip settings ? With this setting, the router silently drops incoming packets if routing indicates that a (potential) response to such an incoming packet would be routed via some other interface than the one through which the incoming packet came in, an...

sindy

DHCP can only hand out a single default gateway (it can also hand out a routing table but still just a single gateway per destination prefix, and there is nothing related to this in your config). Since your /ip dhcp-server network items look fine to me, could it be that the devices have the route vi...

sindy

You may want to remove at least the password from the /interface pppoe-client row in the .rsc file you have posted (remove the file from the post, edit it and attach it again). You can attach the static IP configuration to ether1 and add a default route via the corresponding gateway with distance=2 ...

sindy

Forget about IPsec for a moment and think where the real problem is. Let's suppose it was possible to add the 10.251.0.0/16 to two distinct peers. Now state the criteria the router should use to decide to which one of those two peers to send a packet for 10.251.1.3. The solution will depend on these...

sindy

If you currently don't use any mangle rules assigning routing-mark and you don't have any routing tables except the default one, use the following: If you use RouterOS 6: /ip route add routing-mark=via-wan2 gateway=gw.ip.of.wan2 /ip route rule add src-address=own.ip.of.wan2 action=lookup-only-in-tab...

sindy

Thanks for reply, but unfortunately simple queue seems does not match any packet with target: wan IP of the MikroTik itself, zero packet in stats :( You are right, I've just tested that and got the same result. I've also tried to set the WAN interface name as target and let the simple queue match o...

sindy

You can not "IP route" thru the GRE addresses they do not form a proper network they are just tunnel ends even if they have what looks like a network between them. You will find you can change to /32 non connected network IPs and they will work exactly the same. This is your confusion and...

sindy

As I explained above, I have a dedicated IP (only mine) from PureVPN and I can control all ports. I got PureVPN with the intention of setting up an EoIP tunnel. As I explained above, a port number is not the same like protocol number. So even if the PureVPN service does a 1:1 dstnat to the private ...

sindy

So on the one that is connected to the PureVPN, currently all ports are open. The other one has been added to the DMZ of my ISP router and has the GRE port open in the firewall The thing is that GRE is not a port but a protocol (like UDP or TCP), and unlike TCP and UDP, it has no notion of ports, w...

sindy

I cannot see anything in your configuration export that would explain the behaviour you encounter. You assign a connection-mark ( ipsec ) to packets that go from 10.1.1.192/28 to 10.77.0.0/24, but you do not match on any connection-mark anywhere so that cannot be the explanation. But it will cause n...

sindy

You can prevent multicast traffic towards certain multicast MAC addresses from getting forwarded to other switch ports (including the CPU-facing one), so the bridge FDB (MAC-address-to-port mapping table) should not learn the source MAC addresses from these frames, but the FDB of the switch will nev...

sindy

If you think that is a bad idea (or not necessary) then I will do without - and use the default MACs of that device. It's not a matter of what a random forum user thinks (you know neither of us three who have responded, do you), it's a matter of what Mikrotik says in the manual: "can be re-app...

sindy

Well, my suggestion to use VRRP on WAN side was based on the wrong understanding I've built, that the cloudflared establishes a pair of tunnels to each POP for redundancy and each of them should use another WAN (ISP1 and ISP2) of your setup. So the essence of the idea was to have two VRRP interfaces...

sindy

Neznášam príbehy s otvoreným koncom... posunul si sa niekam? Not to leave the hypothetical future readers curious about the outcome: there was a happy end, they broke up... The LAN side clients are UBNT devices, and we haven't found a way to configure them to use a /32 public address on their end a...

sindy

The export should contain lines like
set [ find default-name=ether1 ] name=ether1-renamed in the /interface ethernet section.
Is that the case? If so, what default-name values are shown in the export of the RB1100Hx2? Are they the same like on the CCR1036?

sindy

Sure there is. Own traffic of the router is handled by firewall chain output , and packets sent by the router itself do pass through the queue tree and the "simple" queues too. So you can let a simple queue match on the own address of the router, or you can use mangle rules in chain output...

sindy

First, I absolutely agree with @joegoldman regarding what the correct approach would be. Second, my solution to your required behaviour would be the following: create a static associative array of the profile names indexed by the pppoe interface names as a global variable using a scheduler running a...

sindy

The servers have 3 NICs total. - 4-port 1Gb Ethernet LOM which is used as the VMWare management ports. - Mellanox ConnectX-4 dual 10Gb which are used for the application/VM traffic - Mellanox ConnectX-4 dual 25Gb which are used for the vSAN traffic Just a terminological remark, the abbrevaiation NI...

sindy

Hello, regarding MLAG: traffic between two IP addresses in the same subnet does not need to go up to the routers because, scrictly speaking, it is not routed . The behavior is the same as if there was a single switch, the Ethernet frames carrying those IP packets are L2-forwarded/bridged/switched be...

sindy

If the pings and DNS were not working, I would assume it would be caused by some ARP cache expiring and being updated only by received IP packets rather by responses to ARP requests. But since DNS and ping work during the strange period, the only thing I can think of is some strange firewall setting...

sindy

Your picture suggests that the remote peers are Fortigate devices, so your choice of options may be restricted. When using bare IPsec, only one policy may be active at a time for any given traffic selector (a combination of local and remote prefixes), so only an active+standby setup is possible in t...

sindy

I've realized that this very script can actually be used with any kind of point-to-point tunnel interface, not necessarily a LTE one. So I ran it on my test CHR and it did what it was expected to do. The only modification I've done was that I have replaced lte1 by <pppoe-test> to match the test envi...

sindy

It doesn't "correct" the entry with the correct address. When you run the script manually, does it throw any error or it just silently does nothing? In general debugging 5 lines of code via a forum with a round-trip time of several hours is a bad idea. So you if you want me to assist, fol...

sindy

The challenge is that I cannot find any script examples to achieve this, it could very well be my searching ability and/or the choice of words, but is there any chance anyone can point me in the right direction please? You'll probably need a lot of debugging as I write this without a possibility to...

sindy

it seems, if the source address is not the local GRE interface, but one of the LAN IPs (for example 10.1.1.193 at home), I can see the ICMP packet on the firewall's out chain (logged) in the direction of the other router's network - 10.77.0.160, but once I created a pcap (with sniffer) and checked ...

sindy

In order that ping from IP address A to IP address B could succeed, all devices in the path from A to B (includung device with IP address A itself) must have a correct route to B, and all devices in the path from B to A must have a correct route to A. So the first question is whether the Mikrotik in...

sindy

Fine but i dont understand completly, sorry but can you write me example for this ... I set it up and send export file Export the file as it is now, I will give you a script to modify it. Or maybe even better if you follow this post . 173 need connect to 60ghzap1 and client1 and finally this public...

sindy

Your settings only work when I set pppoe connection to bridge-lan interface. That's strange, but as you haven't posted the export of your configuration, I can't see why. My next question is, can I assign 1 of the static ip to acess my mikrotik router and manage it? Of course you can. Just assign it...

sindy

Sorry, you quote my whole post and then ask a question without referring to any particular part of it, so it is hard to understand what you actually have in mind. So guessing: On the 4011, keep pppoe settings as they are now. Regarding firewall, no idea how it looks like now, so no idea whether it n...

sindy

Sorry but I dont see you answer Don't you see it at all (even now) or you didn't see it before because no notification e-mail has arrived? What does the forum show you if you click this link ? On the Mikrotk side, you would set the following: /ip address add address=10.100.10.100/32 interface=bridg...

sindy

It all depends on how exactly you have implemented the forwarding of incoming traffic from the internet towards the public addresses to UBNT 1 and UBNT 2 from the 4011, but normally, it should work just fine. So post the output of /export hide-sensitive command on the 4011 after redacting all occurr...

sindy

What you did wrong when posting is that you haven't given enough details: are the addresses of all the "internal things" within just 10.10.0.0/16 or are there any also in other private subnets? does the "I" in "I can't go to some internal things" mean only 10.10.155.5 o...

sindy

Just curious; if I would replace the TP-Link with a MikroTik, why would that work? Because RouterOS uses proprietary extensions to the wireless protocol that allow it to be used for transparent bridging. Some other vendors do that too but there is no vendor that would have a compatibility agreement...

sindy

i test by bandwidth test and by speedtest by cable 1g You seem to keep assuming we have all got crystal balls allowing us to add the parts you haven't written. So my crystal ball tells me you are using the Mikrotik bandwidth test utility and speedtest .net by Ookla . Is that correct? i don't enable...

sindy

How exactly do you test the speed? Are you aware that a single session can only use a single WAN?

Also, as you have only posted part of your configuration, is there no action=fasttrack-connection rule in /ip firewall filter?

sindy

Even if the way how the VLAN tags are transmitted would be compatible between Mikrotik and TP-Link, I'm afraid the 4-address format of the wireless frame, which you need for bridging, is not. 802.11 only specifies a 3-address frame format where the MAC address of the wireless receiver and the MAC ad...

sindy

Let's start from an explanation what a "direct link" means in case of your datacenter. Is it a cable, or at least an L2 interconnect provided by the DC? If so, you can bridge the LANs of the two Mikrotik routers together using that "direct link", and use the one in the Rack 2 as ...

sindy

viewtopic.php?t=192458#p978072

Indeed, there is a clear statement by Mikrotik staff in the same topic: viewtopic.php?p=988941#p988941 . Nice

sindy

Have you narrowed the search down to the topic title, i.e. if you change arp to enabled for that /interface vlan , the PPPoE server starts working, or is it just the only unusual setting you have found and you only suspect it to be related? There is no reason why arp=reply-only on an interface shoul...

sindy

In my experience so far, bypass mode indeed gives 100.64.0.1 as the default gateway to all clients. But that doesn't matter for load balancing alone because you can indicate both the IP address of a gateway and the interface to use, using the gateway=100.64.0.1%ether1 syntax. Only recursive next-hop...

sindy

I haven't got a wifiwave2 device at hand, but with the default wireless package, you have to explicitly tell the cAP that the CAPsMAN is listening on 127.0.0.1 if the wireless interface that seeks CAPsMAN control is colocated with the CAPsMAN itself on the same hardware. I assume it's still the case...

sindy

Neznášam príbehy s otvoreným koncom... posunul si sa niekam?

sindy

wondered if this could be a done dynamically?

No.

sindy

The next question is good for me, yes I have 3 router after this mikrotik router on lan, and when its possible, I set 1 of public IPs on every router after this mikrotik. ... Please help me and thank you for answer. When you can any question I answer it. Sorry for late answer, the e-mail notificati...

sindy

Som voľaaký zmätený where the problem is. You say you have purchased static addresses but at the same time you declare you need all 4 of them to get dynamic which I don't understand. For me the categories are public/private/CGNAT in one dimension, static/dynamic in another one, and manually/automati...

sindy

Is the single address you get from the ISP on the 4011 a public one? I.e. does it fit into 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 range (private) or into 100.64.0.0/10 range (CGNAT), or into none of them? There are multiple ways how an ISP can deliver public addresses to a PPPoE client, so it ...

sindy

If someone properly reports that to Mikrotik, there sure will. But that's just my experience-based opinion, and I have no power over Mikrotik R&D priorities. Some fixes have taken years to happen. Are you sure nothing has changed in the configuration between the last known good state and the occ...

sindy

the netfilter (firewall) does not allow to change MSS in prerouting and input chains, and the two Mikrotiks most likely normally do not talk to each other using the addresses from the subnet that lives inside the EoIP tunnel. So I assume what happens is that when you spawn the internal speedtest be...

sindy

use-ip-firewall=yes is a special setting of bridge whose primary purpose is to allow insertion of queues (for QoS) to the bridging path; for any other purposes it just causes unpleasant surprises. The fact that the ip firewall does not see the packet marks assigned by bridge filter may be one of th...

sindy

/interface bridge filter add action=mark-packet chain=input in-interface=eoip1 new-packet-mark=eoip1 /ip firewall mangle add action=add-src-to-address-list address-list=eoip1 address-list-timeout=10m chain=prerouting packet-mark=eoip1 Of course these rules must be blended properly into your existin...

sindy

thanks, so we have 2 possible situation, first is that my cpe is not reachable, then we need blackhole? And if my cpe is not reachable then we need blackhole ? I'm not sure what you actually wanted to express, so please reword that. So how can i improve my firewall settings further on, can we preve...

sindy

Should there be a mac address associated with this interface somewhere? Also should arp=proxy-arp be set on the bridges and the admin-mac address at both ends? No and no. The bridges the BCP tunnels become dynamic ports of already have some MAC addresses; whether these are assigned automatically or...

sindy

Is any local-address and remote-address specified on the /ppp secret row at the server side? If yes, what happens if you remove them?

sindy

I would guess you have somehow managed to engage the L3 and L2 tunnel in parallel, but it's just a wild guess. I'd have to see the complete configuration exports from both ends of the tunnel as well as the addresses you used for the ping (both source and destination). Don't forget to anonymize the e...

sindy

If ISP_1 "goes down" in terms that internet is not reachable via ISP_1 but the physical interface connected to the CPE provided by ISP_1 stays up (which is your main concern as per post #4 , you don't need the blackhole route because in such a situation, the route to 9.9.9.9 via 192.168.0....

sindy

is there a better more modern way to connect remote sites across the internet instead of EoIP where MTU sizing is not an issue and may also take less CPU resources and have better throughput? The best way is to avoid L2 tunneling completely, so the MTU issues are handled at routing level as they sh...

sindy

Is there any other way to lower the MTU below 1500 on an EoIP interface and not affect everyone else on the bridge even though they aren't even sending traffic over the EoIP interface. There isn't. From the point of view of the IP stack, which deals with the MTU, the bridge (as in "the virtual...

sindy

You can use those mangle rules using a slightly more complicated way. Use a bridge filter rule to assign a packet mark (for simplicity, EoIP ) to frames entering the bridge via the EoIP interface, and use mangle/prerouting rules to add source IP addresses of packets bearing this packet mark to an ad...

sindy

OK. So the idea is based on the fact that the connection tracking itself (not the firewall as a whole) only takes into account the IP part of the packets (addresses, protocol, and ports) - it doesn't care about in/out interface or MAC addresses. Also, to reset the timeout of the connection, it is en...

sindy

OK, are you interested in the UGLY workaround then?

sindy

On this forum, feature requests can be only raised within a specific topic dedicated to them. You can also issue a support ticket. The official way to open feature requests is via your distributor. I have a rough idea of an ugly workaround which involves a hairpin tunnel and spoofing of UDP packets ...

sindy

So, I found a better way of doing this, if anyone will find this usefull one day. ... The server is already on the local lan as 192.168.1.100 (static DHCP) ... Quick, Clean, Easy, Painless. This was the essence of my alternative suggestion back then: ... or it must have a private address and a dst-...

sindy

What you want cannot be accomplished to the letter. With LTE bridge mode active, the router gets a single /32 IP address from the mobile ISP, and based on that address, it either creates the smallest possible subnet into which this address fits and attaches another IP address from that subnet to the...

sindy

Since you can ping a public IP from the RBwAPR itself now as the passthrough-interface is unset, we have successfully confirmed that the Beeline service is OK. So you may set the passthrough-interface back to internet . However, what you wrote regarding the direct connection of the PC suggests that ...

sindy

Wow. If the only thing you have done was to change the APN proflle settings, disable and re-enable the LTE interface and give it some 3 minutes before sending the monitor command again.

sindy

What bothers me is that the apn profile sets the apn name to free whereas the LTE monitor states you are connected to Beeline network, and, more important, that you are using a Beeline SIM, so the APN name should be set to internet.beeline.ru . If that change doesn't help, the next step is to unset ...

sindy

What does /interface/lte/monitor lte1 once show?

sindy

Maybe your version of RouterOS (which one it is?) does not support one of the parameters on some of the lines. Instead of pasting the whole configuration, go line by line, i.e. start from just /interface lte , if it succeeds (it really should :) ), paste just set [ find ] mac-address=AC:50:43:1A:EE:...

sindy

all the various tutorials I can find online refuse to work, I can't get a connection. Does someone have a method that actually works? Thanks. What "various tutorials"? If you want to get a useful help, follow one of those tutorials, show the resulting configuration of both devices involve...

sindy

Hi, so looks like I have exactly the same issue. From your description it does not look like the same issue. There are two points: to let the WAN of the unifi device get its address via DHCP - this is no different to connecting it to any device/network that runs a DHCP server, such as a DSL router ...

sindy

per-connection-classifier=src-address:d/r

sindy

my routerOS(having laadbalancer PCC with two WANs) . When I do the traceroute, I observe the request is passing through BOTH the IPS's Gateways every time! To understand why this happens you have to understand how traceroute works and how PCC works. tcpdump/wireshark are of great help here: tcpdump...

sindy

Do you mean the new endpoint NAT function?

Exactly. It's just that the official name is so meaningless that I cannot remember it.

sindy

You can do that but it would only make sense if you wanted another application to listen for incoming connections at port 12345. There are multiple cases how to let an "innocent application" listen on a port on WAN: you manually set up a dst-nat rule (clearly not your case here) the applic...

sindy

maybe i got that wrong You have reverted the logic. The client actively initiates the connection by sending a request packet to the server which passively listens and responds if a request arrives. As the NAT rules are only consulted for the initial packet of each connection, and the subsequent pac...

sindy

the server is output client is input Can you rephrase these? In addition to posting the configurations of both the client and the server, describe or draw what you want to achieve. The original topic was dealing with making a RouterOS L2TP server listen on some other port than 1701 (which only requ...

sindy

1. YES (but I don't know if it a good pratice) It is OK if it is your intention (to keep a connection on the secondary WAN even if the primary one recovers). 2. in the last version, I removed the input mangle rules and it works (but I think this not optimized) Traffic that uses input chain also use...

sindy

I'm not sure I understand your intentions properly, so just some points: in prerouting , you first assign the routing-mark to packets that did not come via WAN, and only the next rule assigns the connection-mark depedning on in-interface . From this, and from the absence of any rules distributing th...

sindy

I read somewhere that Fasttrack and mangle dual-wan are incompatible, is it a mistake ? The very principle of fasttrack operation is that the fasttracked packets bypass some stages of packet processing, mangle is just one of these stages. is there a workaround to keep fasttrack only for some packet...

sindy

First of all, elaborate on "same problem". Multiple issues have been discussed throughout this topic so describe your particular configuration and your particular problem.

sindy

You need to additionally deny access to the test IP through any other interface than the desired one in the firewall. For that, routes to /32 destinations are usually enough, maybe with blackhole ones with higher distance to the same /32 destination where necessary. But you can do that using firewa...

sindy

check-gateway=ping is only useable if the modems are unreachable (power outage or bricked, gateway IP is the modem itself) If you use check-gateway=ping with the recursive routing, where you ping the virtual gateway (1.0.0.1 or 8.8.4.4 in your case) rather than the physical one, you check the actua...

sindy

The two routes, check-gateway=ping comment="Netwatch ISP1" distance=1 dst-address=1.0.0.1/32 gateway=1.1.1.2 check-gateway=ping distance=1 dst-address=1.1.1.2/32 gateway=172.16.1.254 suggest that you want to use recursive routing (indicating that the remote gateway 1.1.1.2 is reachable via...

sindy

hmm.. do you have multipath interface for it? i mean, multipath eoip for it as well? Sorry to disappoint you, no, it's just that the CHRs run on Hyper-V, which by default (like many other virtualization platforms) filters frames with source MAC addresses different from the own ones of the sending v...

sindy

My ROS 7 test CHRs never ran ROS 6, and they accept an address with a /24 without any issue (freshly deleted an added to be sure): [me@chr-7-1] > ip/address/print where interface=vrrp1 Columns: ADDRESS, NETWORK, INTERFACE # ADDRESS NETWORK INTERFACE 15 192.168.216.1/24 192.168.216.0 vrrp1 [me@chr-7-...

sindy

Since you have 3 lines, it is quite likely you'll need 3 Mikrotiks, as I cannot see a way to make RIP advertise each of the 3 public IPs via another PPPoE client - no instances, no routing filters. I have to correct myself - routing filters cannot be used with RIP, but routing prefix lists can, so ...

sindy

Is this the correct info that i should provide ?

I don't like open ends, so yes, it is

sindy

If we can setup a teamviewer/remote session that we could work through it the mikrotik config part in order for it to push a static ip for the sonicwall i would really be grateful.

Here you go: viewtopic.php?p=902082#p902082 (and the three posts after just in case).

sindy

I can help with the Mikrotik part if that's enough. Since you have 3 lines, it is quite likely you'll need 3 Mikrotiks, as I cannot see a way to make RIP advertise each of the 3 public IPs via another PPPoE client - no instances, no routing filters. If you have a spare PC with two Ethernet cards, it...

sindy

One query - why cannot I see the ssh connection in firewall connections list? Most likely due to wrong syntax of the filter expression if you use command line or because you cannot spot it among other connections if you don't. Or, less likely, it is some glitch of ROS 7.10. NAT is a functionality o...

sindy

For some time I ... saw that the tcp connection stopped at handshake (no synack packets making their way back to ssh client) This happens because you assign the routing mark l2tp-table to all packets belonging to connections bearing the connection mark L2TP_CONN regardless their direction, so the r...

sindy

If vpn interface is down - how to block all local devices traffic? Simple not to switch on main default route, just block internet access? One possibility would be to add another default route to table vpn with type=blackhole , no gateway , and a higer distance than the one with gateway=PPTP-VPN . ...

sindy

Start from adding a route for the test. At the client, add a route dst-address=1.1.1.1 gateway=l2tpaa , and try pinging from the client router itself, not specifying the interface. Depending on the actual use case, you may need multiple routes at both the client and the server, or a src-nat/masquera...

sindy

The terms "client" and "server" come from regular business, where the client requests a service and the server provides that service. Other protocol standards call the client an "initiator" and the server a "responder", which better illustrates their respectiv...

sindy

For L2TP, you can tell a particular L2TP client interface which particular own address of the router to use for the control & transport packets, overriding the normal choice made by routing. To make use of it, you have to use a routing rule saying that whatever has a source address of a particul...

sindy

i thign that i got that going Maybe it is correct, maybe it is not - the documentation only mentions in-interface-list so I use that one. I never needed to use the same bridge filter rule on multiple bridges so far, so I haven't even noticed the existence of in-bridge-list and out-bridge-list match...

Search found 10196 matches