MikroTik

anav

I have no reason to doubt that the AX3 is best followed by hapac2 followed by hapax2 based on those tests.
Your in Riga, pop over to MT to confirm!!

anav

Well endpoint has to be a specific WAN for the client to reach the right ROUTER.
The VRRP is for the inside facing users from what I understand.
But its a good point for discussion. Looking forward to what comes out of this thread.

anav

Nice!!

anav

Use wireguard.

anav

Sure that makes sense, if you have misconfigured your wireguard.
If the router is server peer for handshake and it has a number of peers, and one of the peer client settings on the ROUTER, has the error of 0.0.0.0/0 set in Allowed addresses, then this type of problem occurs.

anav

Your trying to stuff a pre-conceived solution for an unknown problem into the MT, the worst way to proceed.
Suggest you detail the USER TRAFFIC requirements, the use-cases that are driving your request.

It may very well be that other tools and methods make sense.

anav

For all IPs that either should not or admin wants not to get forced out of server. /ip firewall address-list add address=IPofDNS list= Exempt comment=" the dns server itself" add address=someOtherUser list=Exempt comment="user to router DNS not my server" /ip firewall nat add cha...

anav

Its not wireguard, that is the problem.
Reset your config to defaults then add wireguard and see if it works.

anav

Thats the European polite answer or part of anyway. This is the German answer!!! This is why if the OP came to me, offering their business I would run for the hills ( okay drive to the Swiss Alps in my Audi ) Tying the router to wifi is STEWPID, wifi technology changes much more quickly and ideal pl...

anav

In this case the wireguard traffic is going to some third party site, presumably to go out internet there. Probably not even a wireguard device at the other end. Since we dont control both ends, how is the remote end supposed to know what subnets we are going to have coming through on wireguard. THe...

anav

Is this a homework question?
If not, then please detail the business requirements and traffic flow requirements.

anav

I’m planning to setup a LAN with few CRS354 and CRS328 all PoE capable ( that’s why of 328 choice for 24ports switches) all linked by 10G sfp+ The only concern is about different switching capability between these two machines, 328 are rather old design…. Any thought ? ? YEAH what a crappy way to m...

anav

BLANK FOR FUTURE IDEAS

anav

Blue squigglies on the diagrams are my attempt to show mandatory entries. One should note that much is based upon having made the wireguard interface first, as this is a reasonable assumption. Where possible, admins may or may not select fields depending upon logic. Ignore the poor quality and non-s...

anav

Manual Peer creation ( key-pair creation at both ends ) This process addresses setting up the router as a client peer for handshake and setting up incoming client peers. The entry process for ‘manual’ will consist of first entering the Interface Name from a pull-down menu. The next common entry arg...

anav

Discussion for the Peer Creation Options: (2) New Peer Creation Process Discussion: The current peer creation process is an attempt to squeeze a number of processes into one page and from a UI perspective fails to be an intuitive and clear approach. After some review, even though there is overlap in...

anav

DISCUSSION: (1) New Wireguard Interface Creation Process Discussion: Overall. the current Wireguard Interface creation menu (New) is acceptable except for the ambiguous nature of the private key. A plus symbol is used to indicate a manual private key entry, typically only used in a third-party VPN s...

anav

When I started using Winbox4, and wireguard, I realized it needs much work! The GUI IMHO is not particularly useful, efficient, or intuitive. Everything is mushed onto one page and one has to sift up and down to find the right information to enter and of course we know there are errors in the curren...

anav

Blue squigglies on the diagrams are my attempt to show mandatory entries. One should note that much is based upon having made the wireguard interface first, this is a reasonable assumption. Where possible, admins may or may not select fields depending upon logic. Please feel free to critique and imp...

anav

Discussion for the Peer Creation Options: (2) New Peer Creation Process Discussion: The peer creation current process is an attempt to squeeze a number of processes into one page and from a UI perspective fails to be an intuitive and clear approach. After some review, even though there is overlap in...

anav

DISCUSSION: (1) New Interface Creation Process Discussion: Overall. the current Wireguard Interface creation menu (New) is acceptable except for the ambiguous nature of the private key. A plus symbol is used to indicate a manual private key entry, typically only used in a third-party VPN scenario, w...

anav

I was trying to keep it as close to the current setup, using clipNsave and paint LOL, no fancy tools. Its simply representative, and while doing it I realized what the three USE CASEs really are. a. local and remote key pair generation required ( manual ) b. local key pair generation not required ( ...

anav

Well either you did monkey with the MTUs, and have forgotten OR someone else configured the router.

anav

New Proposed winbox4 ideas: Much is predicated on first completing the Wireguard Interface setup! Note in the Tab Under WIreguard additional grey entries. ................. wg-peers.jpg ............... when selecting NEW, the options to select type are presented ------------- Peers2.jpg __________ N...

anav

1. Most people set this to none, its been known to cause issues. /interface detect-internet set detect-interface-list= INTERNE T 2. Why do you think its okay to assign two Subnets to the bridge. If you want more subnets make vlans and remove bridge from dchp. /ip address add address=192.168.10.1/25 ...

anav

Suggest you open a new thread in the wireless forum State what device you have and how you can set up the WIFI to accept WIFI on 2ghz wifi as a WLAN from the hotel for example and then use WIFI on 5ghz ( and ether ports ) to distribute to LAN devices. mode (station | station-wds | ap-bridge | bridge...

anav

1. YES, this can be simplified. /interface bridge vlan add bridge=bridge_LAN comment=home_vlan tagged=bridge_LAN,bond_2-4 vlan-ids=10 add bridge=bridge_LAN comment=guest_vlan tagged=bridge_LAN,bond_2-4 vlan-ids=60 add bridge=bridge_LAN comment=eyes_vlan tagged=bridge_LAN,bond_2-4 vlan-ids=50 add bri...

anav

Both configs are good, except on home router this rule is not required as access is covered in the src-address list rule in the input chain. add action=accept chain=input comment="allow WireGuard traffic" src-address=192.168.100.0/24 Its time to ensure the public IPs from generated by oppo...

anav

I predict success with the above changes.

anav

Can you please forget about whatever you are doing with OPVN, it makes no sense to me and is getting in the way. There is no port forwarding ON any of your configs. Also the diagram showing input chain rule on travel router is wrong. I will have a look at the configs. Home router looks okay! One sub...

anav

In other words, unless you get a true DPI router, any type of control over access of google, youtube, etc, is not really effective or worth it.
DNS is a different kettle of fish, so not sure if DPI would even help in that regard.

anav

Getting there LOL. On the HOME router you failed to put in the forward chain rules I had recommended earlier. { default rules to keep } add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes add action=accept chain=for...

anav

There are some tools and ways to do so, and thus experts should chime in, who do this stuff.
In the meantime there are external third party applications designed for the deployment of large numbers of MT devices. Admiral Platform comes to mind.

anav

Good the zyxel has a stand alone configuration which I prefer.
Will be very curious as to your wifi results, throughputs with iphone or android phones etc....

anav

Mkx was faster, but faster is not always better, ask any woman.................

Gigabytes answer gets my vote. Management control is saaweet over RoS.
Your setup looks good!!! Which wifi AP did you get, TPLINK, Zyxel ??

anav

Well I have driven to NYC many a time, and the rules of thumb are carry a gazillion one dollar bills for tolls, get a toll pass when it makes sense, park the car and take the ferry, get a multi-day transport pass ( subway and bus) if there for any length of time. I guess what has changed is this new...

anav

Well I have a suggestion for MT, make their AI bot better, so that I dont have to see people beg rextended for scripts, especially when they pull out AI outputs that are pure crap.

anav

No need to be specific of protocol etc. The fact is that any traffic to the router over 4G itself should respond back via 4G. Finally only two rules are required. /ip firewall mangle add action=mark-connection chain=input comment="Mark connection ICMP for 4G" in-interface=l2tp-4G new-conne...

anav

WAN aggregation does not improve speed. Any singular sessions speed is limited by the WAN being used for that session. What you get is MORE bandwidth overall to share with users, so that there is less bottleneck. Additionally you get redundancy in that being separate Providers, if one is not availab...

anav

How do you propose to identify sites that users traffic is supposed to use the local WAN? Are we talking about programs (like youtube or google), that the router cannot do as its DPI dependent. Then the answer is NO. Are we talking about static public WANIPs ( or dynamic ones that can be identified ...

anav

I only have to know it has come from darkextended to understand it............. it was very much close to my reaction to reading the Ops post,,,,, in english we use the word gibberish.

Reminds me: https://www.youtube.com/shorts/g8ZF3zE7hh4

anav

I am not interested in proving or disproving some testing or lab creation. If you need assistance it will be important that there is clarity in all the use cases of needed traffic flow by users internal, external and admin. Including any vpns, port forwarding etc. and sufficient details if more than...

anav

Dunno, I thought it was so Larsa can fly around and sniff sweet smelling MT equipment. ;-P ROSE (RouterOS Enterprise) package adds data center functionality to RouterOS - for supporting disk monitoring, improved formatting, RAIDs, rsync, iSCSI ,NVMe over TCP, NFS . This functionality currently is su...

anav

You need to buy a car, that scooter just doesnt cut it and you cannot carry much. ;-P

anav

We are all going to end up as batteries for machines anyway

..........................................

the_matrix_human_batteries.jpg

anav

Well when you have a router config to export, and somethings not working let us know.

anav

Of course things didnt work, you made very little of the recommended changes and based on that, I dont think I can help much further.
The main error was pointed out again. Good luck!

anav

You failed to hoist in this point properly.............. Travel Router First problem USING THE SAME SUBNET BEHIND THE ROUTER> Now that you have access on ether5, you should have changed the subnet on the Travel Router, I had suggested to 192.168.38.0/24. THis would be reflected in the allowed addres...

anav

Are they wired or is by wifi?

anav

So they have confirmed connectivity from the street to their modem is solid? If thats the case sounds like the connection fro the modem to the router is the problem. Try a different cable.

anav

Plan for device replacement strategy based on flash usage?

anav

vlan-filtering one bridge can be daunting for the new user as one is adding vlans and eventually drop DCHP and address from the bridge as one should ( bridge subnet simply becomes another data vlan etc.) reference to read: https://forum.mikrotik.com/viewtopic.php?t=143620 To facilitate a painless ex...

anav

Netmap maybe?
Take an etherport off the bridge that is attached to the device..............
Etherport not part of LAN interface
Separate firewall rules if required for etherport

anav

Config of hex
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys)

anav

Travel Router First problem USING THE SAME SUBNET BEHIND THE ROUTER> Remember first post I stated: " I would use ether5 as a config port or emergency access port OFF the bridge. " Doing so allows one to easily change subnets. I know its difficult otherwise!! 1- So REMOVE ether5 from the b...

anav

A dynamic IP is not a problem with the home router, and I am assuming its a public IP. The router provides domainurl mynetname under IP cloud to use as a Wireguard endpoint on the travel router I will take a look at the config later. home router config looks pretty normal. If you are not using IPV6 ...

anav

Well, congrats on guru status! Now, the real test: What’s the meaning of life?
Easy: "Always look at the bright side!"

ex. If I have to leave USA (NY) before it turns into Russia, I have a new friend in Canada with room!

( well at least a tent LOL)

anav

IS EVE-NG any better then??

anav

CGG is bang on, it looks like that the BRIDGE itself, should not really have any selections for ingress filtering for frame types or PVID for that matter for vlan-filtering=yes and leaving PVID=1. As I stated I use frame-types admit only vlan tagged specifically to stop any traffic entering the rout...

anav

luv it!

anav

Fascinating but does not answer the question I have in the other thread and request about wireguard.................. our ongoing conversation!!

anav

The bond XR option should only be used with some smart (but dumb) managed switches that only have LAG option. Concur with patrick, 802.ad is the way to go.

anav

All good to know......... ! Hope its working now.

anav

Huawei products should not be used for a multitude of reasons, and one you probably dont know about is how poorly they treat their workers

anav

Thanks for this topic guys, helped me to understand MikroTik better. But I have a little question. For me Ethernet2 is a trunk port (admit only vlan tagged) carrying about 4 vlans(one is the mangement ). I tagged the bridge on each vlan table and the ethernet2 also. At this moment normally my L3 wo...

anav

Based on your config I have no clue what your are doing. Vlan filtering typically has one bridge you have two?? Is this device supposed to be acting as a router or a switch? I suspect a switch because its a switch LOL, and also by ethernet1, I assume that is a trunk port to the upstream router. IF s...

anav

No worries, by the way if you wanted to block wifi clients to wired clients on the same vlan, use bridge horizon same value on /interface bridge ports

anav

I will but, one should not think that more slaps are better!!
https://www.youtube.com/watch?v=IhJQp-q ... xhcA%3D%3D

anav

@Holvoe SEE my friend, simple capsmanless datapthless config IS SUPERIOR. said somewhat in jest of course, The challenge is to provide this chap with a working config with all the datapath entries he was using at the beginning and for the config to work. We can deal with capsman at another time as i...

anav

Yup, good execution, to start with a working config then add pieces back slowly to ensure you understand what breaks and what works. For data path isolation, no worries, assign a datapth1 JUST with isolation invoked and add that to the WLAN where you want to isolate wifi users from each other. That ...

anav

Personally, I see no reason to change your hardware at the moment. Both cameras are on the same vlan so untagg the camera vlan to the dumb switch and you are covered there. The two APs are what unifi, nothing wrong with those, they handle vlans and you just need to feed them hybrid ports from the MT...

anav

No offense taken, in fact MKX is bang on the money and I would unashamedly say that his sentiment lasted far longer than that. I can say that I probably crossed the line when it penetrated my thick skull to find my pea brain, that a wireguard address on the MT router was actually a good thing. And L...

anav

The more detailed the requirements the more accurate the answer!!

anav

Since you don't know the problem, why do you think you know the relevent parts of the config. :-) Seems illogical. In any case /export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, long dhcp leases etc.) and for the love of god, dont use VERBOSE export!!! Plea...

anav

Much better and fruitful ways to spend your time LOL

anav

well where will your users get their internet phone book information from then??

anav

Not really but you can ask here but be sure to state your requirements and use cases for traffic and also ISP information. etc.

anav

I may still have one floating around, and if you know anyone with a 3D printer, they could probably make one.

anav

Based on Sindys advice, this may do the trick......... TO ADDRESS ADDITIONAL REQUIREMENT OF SOME USERS USING LOCAL WANS. The key to ensure ECMP works, is for the routes in question to all have the same table with same distance. /ip firewall filter add action=fasttrack-connection connection-state=est...

anav

Thats changing the requirements which nobody wants to deal with --> its called scope creep. The onus is on you to be honest and state the full requirements PRIOR to designing a config. Do better next time!! So before answering, will request much better detail on any other requirements percolating......

anav

I'm curious as to the purpose of the tunnel to this swiss device.
Is the requirement to reach a subnet behind that ISP router?
Is the requirement to simply use internet at that router?
Is the requirement for some entity behind the swiss router to reach the single LANIP on your MT?

anav

Not sure what you mean? The LAN user will only go over the wireguard to the CHR, so there is no other alternative. Yes expect a reduction of speed through wireguard to the CHR. 1. First consider the throughput of each WAN will limit the speed of any session using that WAN 2. Consider the limit on th...

anav

Thanks ! I will fix the PVID 93, my Switch gets ip from the main vlan dhcp and I wanted it to get some ip from the management so I tried to put pvid93 so the device will prioritise that but it is still on MainVlan 15 subnet the switch. I guess I have to put pvid 1 ( default ) instead of pvid93 on t...

anav

Im no wifi datapath expert but I am guessing that since you have detailed both the bridge and vlan in datapath. You need NO entries in either /interface bridge port or /interface bridge vlan FOR ANY of the VLAN traffic, But before you try that first fix the gross error to see if that helps 1. Trunk ...

anav

Hi AMMO, can you go through the page above, and think of making what I have better, and I am missing anything?
A better way to reorg, or to enter data etc.. Or anyone for that matter.

PS. send me a hello on discord anav_ds, I have a word doc for your to critique/peruse!

anav

Well as always it depends, and it depends because the full config has not been provided. A config is very much interrelated so snippets dont provide full context.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys)

anav

I would consider setting up VRRP Instances. VRRPA - Router 1 is the primary and Router 2 is backup VRRPB - Router 2 is the primary and Router1 is backup. Why you ask, so that Router1 LAN subnets can use R1 ( via VRRPA) and Router2 LAN subnets can use R2 ( via VRRPB). A more efficient use of both ROU...

anav

My bad, I thought your standard use was connecting to wifi WAN, and then sending the traffic through wifi to other devices in the room. IF that is not your go to, then by all means IP DHCP client on ether1 is ENABLED and the 2.4ghz WAN link in wifi is disable. In both cases wifi to local devices is ...

anav

Very reasonable request, and without going to much into the config it shouldnt be too much of a problem. If the ask was for a USER on the LAN originate traffic to router A that would be more difficult. Basically since we NAT all the traffic leaving router B, going to the TPLINK router, the wireguard...

anav

Looks good from what I can see. The travel router should also be setup with IP DHCP disabled on ether1, just in case you have a wired connection. Otherwise you will need to figure out how to a. grab wifi WAN from 2.4ghz connection to hotel etc ( the part you may need to ask for WIFI assistance to co...

anav

I think it would be worthwhile to point out WHEN vlan-id=1 HAS to be used, (no other way/recourse), and I can probably count on my four finger amputated hand, how many situations that is........
When the time comes though, I will be asking graelex for advice so dont piss him off

anav

Well all the ports are 1gig, the Hex can route about 250-300 Mbps, so that may be your limiting factor, but more likely its the AP throughput. Six vlans but 8? pools? You are still confused a. please remove any IP address assigned to the bridge, it does no dhcp on vlan bridge filtering, to keep it s...

anav

Must be an IPV6 issue then.

anav

I think water broke through the dykes and got into your ears. The chap doesnt need such fancy stuff. A. Basic need, two separate VLAN to separate guest users and trusted users each one tied to the approriate WLAN and different security settings. B. More advanced need, invoke isolation between wifi u...

anav

The concept proposed is a non-PCC, ECMP approach with minimal mangling required. We will use the listening port of the interfaces we create at the CHR (the endpoint ports in the router wireguard peer settings) as an entry argument for our mangle output chain rules. In this way, the handshake ORIGINA...

anav

You cannot. You are hamstrung by whatever device is coming in the WIFI. Stupidly dumb wifi devices internally create a faux guest network. This network uses the same LANIPs but is isolated from the other wifi users and also are isolated from any LAN users on the same subnet but wired. They can only ...

anav

But I can wireguard to my router (establish tunnel) and then use ip addresses on the router to configure the router via the MT app. Do you mean wireguard to a device directly that is downstream of the router, so lets say an AX3 or other MT device behind the router? If so do you want me to test if it...

anav

or just reboot the router? often a good idea after many changes.

anav

My apologies, but I dont understand your network and I dont use IPV6. If you can provide a similar scenario that I could test on my equipment to confirm your findings I am glad to attempt such tests. Do you mean you wireguard into a downstream router or device and wish to be able to reach and config...

anav

Okay so I need to test this by attempting to access a subnet on my Router from my ios app. The allowed IPs on my WG app thus should be restricted to a subnet and the wireguardIP of the router......okay will try. Added wireguard subnet access to a printer on a printer vlan. router firewall rule Chang...

anav

If the upstream or downstream device is a unifi, then you simply need to create a hyrid port vice a trunk port Assume the unifi subnet/management comes into the MT device as untagged and the data vlans tagged. If your running the CRS3XX as a switch then its simple Only define the management VLAN let...

anav

Well this is true, port forwarding requires either a. you get a public IP from the ISP modem b. you get a private IP frome the ISP modem Router BUT, you can access the ISP modem/router to forward ports, or ask the ISP provider and they forward ports upon your request. If not , then you cannot port f...

anav

Sorry not a capsman expert so if its the problem, cannot help. On the hairpin nat rule DUMP the extra stuff and be granular. add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=192.168.0.0/16 src-address=192.168.0.0/16 to-addresses=192.168.2.100 should just be add action=m...

anav

Okay, it got me to thinking that the MT approach is a mess. Their import function is located on the main page so how do you know which interface the peer applies to. Wireguard files do NOT include interface name! When you select a wireguard interface, the IMPORT function is GONE. Similarly to the EX...

anav

Usual problems. ROUTER: a. forgot to add allow input chain rule for incoming handshake port b. forgot to add allow wireguard interface or incoming IP address on input chain (for config purposes) c. forgot to add wireguard address on the router under /ip address d. copied public key from client incor...

anav

Okay just tested in on my Router, from iphone on cellular, MT app worked just fine with format a. trusted LAN address ( like 192.168.88.1 : winbox port ) b. actual wireguard IP of the router ( Like 10.20.30.1 : winboxport ) Steps created wg interface and wireguard address created input chain rule fo...

anav

Okay so its acting as a router. Okay so the purpose of the wifi is so that clients can go where????? ( if not the internet). Should I assume the idea is that: - you have a bunch of users on one wifi that need to talk to each other --> WLAN1 - you have a bunch of users on a different wifi that need t...

anav

Wireguard fine!, BTH wireguard no and thus assuming you are using the maplite as a client to server somewhere, or have a public IP available locally ( from ISP directly ) or port forwarding from upstream router.

anav

Your assuming that we have created the FILE and stored the file, which assumes you have external storage and know how to set that up??? Edit, just read the bit about small files, and no storage required.......I was wondering about that, (size of peer files) thanks..... What I would like to see on th...

anav

Are you setting this up as a ROUTER or as an AP?
post your config thus far
/export file=anynameyouwish ( minus device serial number, any public WANIP information ).

anav

Well, it depends. If you can ensure that a group of vlans share the same bridge and then a group of vlans share the other bridge. To ensure HW offloading, then yes two bridges one bridge for 1-5 and another bridge for ports 6-10. Note that this supports traffic on the same vlan across ports. So asse...

anav

Your logic seems sound and its certainly product specific to the 5009 as many other devices are used as switches let say behind a 5009 even, and they dont report such issues. Using the 5009 as a router, all /interface bridge vlans would be tagged with Bridge, so it would not normally be seen. Since ...

anav

Well it was a little better than "there was no sugar in my coffee", as at least we know equipment that accesses the www was involved, unless it was a bad dream!

anav

It has nothing to do with the router.

anav

Understood, I didnt realize that if I had static entries they would be ignored if I set gw dhcp dns-server to none. It is not clear to me HOW static entries are then advertised to devices:??? In other words what is the difference between dns-server=no-server /ip dns set servers=10.44.44.1,1.1.1.1 AN...

anav

1. You have me confused, You only have 2 vlans, all traffic from one goes out ISP1 and all traffic from the other goes out ISP2 -2 pools - 2 dhcp servers etc. But magically you have a server on a non-existing subnet?? 2. Your IP addresses are wrong a. the two vlans need the interface to be the bridg...

anav

Honestly dont care about ubuntu..... In terms of the MT and manually sending subnet to wither wireguard or local WAN.... Modify what I had before...... /routing table add fib name=useWG /routing rules { order of rules is important } add action=lookup-only-in-table src-address=192.168.88.0/24 dst-add...

anav

Its a start but needs major work First thing is to be clear on requirements. 1. So you have two sets of user ONLY vlanX and vlanY Each has its own WAN it should go out of. 2. What happens if wan1 is not available, should users on VLANX be allowed to use WAN2 ?? 3. Are there any VPNS to the router? 4...

anav

Super, much thanks.

anav

The RB3011 has ports 1-5 on one chip and ports 6-10 on another chip, So practically speaking one bridge makes sense not three ( on all newer products, ) two bridges does in your case. Figure out which traffic load amongst your three bridges is the greates and use that bridge for ports 1-5 and put th...

anav

Stick to standard subnets /24 until you get more experience!!! Additions/Modification 1. Adjust frame type, the default is admit-all. /interface bridge add comment="LAN Bridge" frame-types=admit-all name=bridge_LAN vlan-filtering=yes 2. YIKES< your diagram screams problem . You have multip...

anav

Understood, it can be tricky the first time, just click on the tab to make new one.
...........

Screenshot 2025-03-13 123152.jpg

anav

holvoe, can you comment on the wifi changes, good bad ugly??
I am not seeing much difference but then again I am lucky enough not to have those problems with disconnects like some others do.

You have the only ax3 made in Latvia then. ;-)

anav

Sorry wont touch your config cause you mix apples and oranges.
In a vlan setup the bridge should do no DHCP and if you need that subnet for something real, then make it a vlan as well.

Clearly you failed to read the referenced article.

anav

Did you read the article: https://forum.mikrotik.com/viewtopic.php?t=143620? If you say you did, I dont believe because nowhere does it state to have this. /interface bridge add comment="LAN Bridge" frame-type= admit-only-vlan-tagged name=bridge_LAN vlan-filtering=yes The application of in...

anav

Sorry cannot provide any useful thoughts on the ubuntu server, I once tried to read docs and forums and the thing is truly PHUCKED up to understand.

anav

@supervisor of mischa01101 - MT has reduced the hours you are required to pay mischa01101 and the cost of trips to sites.

anav

That makes no sense and not true! My Server has no preshared key............no such thing ( its strictly an extra step between the peers when connecting) in other words I could have preshared key on only ONE of my 20 peers!! The export shows the preshared key and the chosen allowed IPs of that remot...

anav

So the users in the scenarios 1,2,3 do not have to have access to the input chain at all for DNS ???

anav

Not being an SSTP expert by any means, but like wireguard I would separate the SSTP by port as well. This makes it much easier to identify and segregate traffic when required in config rules. Also we dont know how your router is setup for the two WANS, Are they load balanced, is one primary and one ...

anav

This approach assumes
a. no vpn coming in on any WAN ( thus no need to mangle for traffic to router itself )
b. no LAN servers, that external users will be visiting through the WAN connections
c. no specific requirements for any Lan user(s) to go out a specific WAN.

anav

1. So you have two bridges and two subnets, so what is this.......?? /ip pool add name=dhcp_pool0 ranges=192.168.9.50-192.168.9.254 triplicate add name=dhcp_pool1 ranges=192.168.9.100-192.168.9.254 duplicate add name=dhcp_pool2 ranges=192.168.9.100-192.168.9.254 duplicate add name=dhcp_pool3 ranges=...

anav

1. Quick question, is there any reason you have to use port 444, for both VPNs? Assuming the SSTP VPN is being hosted on third party sites 2 a. are the SSTP clients (application) on PCs on your LANs OR b. are you using the router as an SSTP client 3. Who is using the first SSTP VPN? One user, or one...

anav

I have mikrotik router CRS326-24S+2Q.

Wrong you have a mikrotik switch but it can be used a router but dont expect throughut to reach 200Mbps.
.....

Screenshot 2025-03-13 104300.png

anav

THe export button does attempt to send something but its incomplete and a mix of some settings, a few right but wrong on the other, the preshared key I entered for the peer is there, and the allowed IPs, but the private key is wrong. Its dumb because the export should be clearly associated with the ...

anav

Not sure why so hostile, mkx and I were just asking for the facts and attempting to determine at the time, model used and exact config to help, based on evidence/facts to assist. An incorrectly configured router is capable of many weird effects for example. In other cases the issue is the PC, or ser...

anav

I use a whip!! Looking at the wireguard peers, it would seem that this device is a Client peer for handshake. But that could just be a mistake on the OPs side as its all settings are contradictory. to make it less hard on the eyes. example of a hot mess allowed IPs configuration. /interface wireguar...

anav

Okay I have no idea how your script works, but suffice to say, Its hard enough to use the gui. 1. Need to create the peer 2. Need to create a QR entity that we will create and then export , (but where is the export or download button location) 3. Need to deposit this file somewhere, assuming a share...

anav

I still dont see export in winbox4, can you take a jpeg so i know where to look.....

anav

Many use a virtual network check CNS3 and EVE-NG are two popular ones.

anav

But why do that................... all this extra typing keeps my typing skills up........... and then I dont have to learn all that syntax stuff.

anav

Thanks for the reply, very clear!

Two questions:
What dependency do any of the working options 1-3 have on the users being able to reach the router services on port 53?

How does the router know if a DNS address is not available?

anav

What is the practical difference between /ip dhcp-server network add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 dns-server=10.44.44.1,1.1.1.1 /ip dns set allow-remote-requests=yes AND /ip dhcp-server network add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1 dns-serve...

anav

The Router providing the DHCP service for all vlans sends all the traffic to ether1 on the Switch, on that we agree. The switch then takes that traffic coming in ether1 and distributes to any dumb devices on access ports (untagged) or to smart devices, if applicable on trunk ports (tagged) on that w...

anav

Biggest problem I see is this warning....... # vlan90_WAN3 not a bridge port add bridge=bridge1 tagged=bridge1,ether6,vlan90_WAN3 vlan-ids=90 Quite correctly the ether1 fiber connection should not be part of any bridge configuration to the best of my knowledge. set [ find default-name=ether1 ] name=...

anav

To login by IP Address you need to enter two things. IPADDRESS:WINBOX PORT ...............the advantage of mac, is you simply click on mac address......... Also your subnet mask usage is weird. The management vpn pool is better suited to /24 setup. The same for your wireguard setup change to /24 mgm...

anav

Yes do pray tell. How best to send this QR code to another ROUTER in a secure manner How to best to send this QR code to a single device , smartphone in a secure manner How to best to send this QR code to a a single device, laptop in a secure manner. The problem is that the there is no secure alread...

anav

Most weird, perhaps an IPSEC variable use has changed slightly ???

anav

Okay that is much clearer. Intention is to manually decide if the single LAN subnet will go out local LAN or WIREGUARD for internet. I should also perhaps note that its likely you want DNS requests, while using VPN, to go out wireguard as well and not leak out local router. Factors going into config...

anav

I'll be vague, as I was before the CVE for brute-forcing usernames came out publicly. I wouldn't use 7.17 even if they paid me, I believe MikroTik got it done with 7.18.... but with 16MB peripherals I wouldn't use 7.18.2 either... and anyway 7.18.2 is too fresh.... I believe 7.18 got it done, is ba...

anav

Very true, if he is indeed doing winbox over the IPSEC, that is great, if not then its a concern. Since it was noted on a separate sentence without mention of ipsec, wanted to be sure ( there was no connecting words between the two sentences to give me a warm and fuzzy that ipsec was being used )!!

anav

May I remind you of the title of this thread WITHOUT SCRIPTING ;-PP

anav

Sorry not an ipsec guru, but to be clear, the purpose of ipsec is so that a user at one router, on one device can use the RDP app/protocol through the ipsec tunnel to reach a device on the other router?? That sounds reasonable! What does not sound right is using winbox over the internet. That would ...

anav

Interesting so there is a serious issue with leaks on RoS post 7.16.2 and they have still not fixed it.

What to do, Hmm perhaps we should Annex Latvia and call it our fourth territory!

anav

Hi there, I want to better understand the wireguard requirements. a. you have a single user that you wish to go out the internet at the location of the unbuntu server. b. should the single user be able to access a subnet on ubuntu, in which case you will need an additional route on the MT router c. ...

anav

CG, lets say for shits and giggles the OP made an error calling ether1 a trunkport and for some reason the upstream router passed one subnet untagged on the port leading to ether1 and then a bunch of tagged vlans as well. In other words, the upstream was providing a hybrid port to the MT switch. Thi...

anav

This thread makes no sense nor do the replies. First the OP, is this a router or a switch and what model, without context, your questions or observations, are meaningless. +++++++++++++++++++++++ So we have to play the assume game a. assumption1 --> switch with ether1 uplink to a dhcp router b. assu...

anav

One needs to look at the changes between updates. For example 7.18.2 just came out and it has very few changes at all and most of them are for niche needs .... the only one that may have broad applicability is improved stability of wifi interfaces, vague statements like this are not appreciated but ...

anav

Daft a tad............... nice to make suggestions, but without reasons what will the OP learn....

anav

No can do.......
I work from a provided config.......

anav

Sorry cannot help with scripts, only configs LOL

anav

Did you follow this for vlans........... https://forum.mikrotik.com/viewtopic.php?t=143620 if not be sure you do. Also state what MT you have and finally will need a copy of the config, once you applied the learning from the article above. /export file=anynameyouwish ( minus router serial number, an...

anav

Please post export as well.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys )

anav

Yes, the article referenced contains examples for both the router and the switch, Use those. Also a video by https://www.youtube.com/watch?v=YLtGQAQ8iS0&pp=ygUhdmxhbnMgc3dpdGNoIG1pa3JvdGlrIDMwMFggc2VyaWVz is good for the switch. The main differences, only the management or base vlan needs to be ...

anav

I agree, the peer tab for regular wireguard ( not bth ) should be: a. Top half - standard manual approach b. Bottom half - QR generation. Even if there are duplicate types of entries, they should be separate and thus clear to the reader. They are making it difficult by trying to be too cute. In QR s...

anav

Okay, the real problem is the complete disconnect between entering in allowed IPs and what actually gets put on the QR code. MAIN issue. Secondarily IMHO, once you put in the client wireguard IP address, that should be autopopulated to allowed IPs, and of course removeable etc.....as one may elect t...

anav

Well thats effed. To enter in a peer for export I had to enter at the top port, Private key, which is fine in the sense that I need to know the public key at my end from the recipient device and this way its done. So far so good, I entered the wireguard IP address of the device. After hitting apply ...

anav

Okay looking at this, A. YES I can set the listen port on the client device its not greyed out for m B. YES I can allow allowed IPs, where it says client address, you can add as many entries as you need, the first one I imagine should be the IP address of the client and the other entries and other a...

anav

In the final analysis sending the private key in any shape or form is NOT a SAFE approach.

anav

@A9
when able
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys)

anav

viewtopic.php?t=143620

anav

Concur, if they are going to provide a function, then at least make it useful. However the QR code port sent to the user to install for endpoint port should reflect the port set in wireguard interface for that wireguard subnet, so not so sure about that one. For allowed IPs, yes its reasonable to as...

anav

But WHY Vingjfg

anav

So your vague answer means. a. that the QR code is FOR the regular wireguard scenario, and is to facilitate generating QR codes for users, which is often easier. b. this has been translated from CLI to Winbox 4 only, and the implementation sucks c. does not solve the issue that the user still needs ...

anav

Good morning, everyone! (Sorry for any typos, I am partially using a translator.) Please post your config for review /export file=anynameyouwish (minus router serial number, any public WANIP, keys) Note; Do you need primary / secondary or do you prefer users have equalish access to both wans for tr...

anav

Good day, after some time has passed, I think my approach now would be different. I would not use a primary and secondary wan approach. I would use load balancing ECMP approach. This would achieve the goals of the OP ( wireguards throught both WANS at the same time) without any need for any tricky r...

anav

I would comment if a config was provided
/export file=anynameyouwish (minus router serial number, any publicWANIP information, keys )

Off the top of my head there is no need for VRF, can you post link to berg video you used please.

anav

Then you will need to mangle. a. accept all local traffic to local traffic ( and which is allowed by applicable firewall rules of course ) ( avoids this traffic getting caught in any mangle rules ) b. mangle traffic coming in each WAN to go out same WAN ( important for configuration and vpn aspects ...

anav

My understanding is that MT dynamically creates any peer settings in wireguard when added during BTH.
I will confirm later.

anav

To be clear AMMO, 1. Yes, the peer settings are automatically created by BTH, so there is no need to create them manually. 2. Okay, you have confirmed that there is some sort of QR code generating facility in the router itself but only visible in winbox4?? a. this QR code generating capability true ...

anav

Note to self: Never use PPPOE it sucks!

anav

Only thing usually required on bridge is to set vlan-filtering=yes. Use /interface bridge port settings to add ingress-filtering=yes ( now is default on), and the applicable frame type! The only reason not to hve both of the above is for hybrid ports. Also, if doing vlans do only vlans and not have ...

anav

First why two ports to the upstream router that is wasteful. Second, yes the router tends to burp when turning vlan-filtering=yes. That is why I always recommend when doing vlans to configure the router from a safe spot off the bridge. SO: a. remove etherX from bridge (lets say ether2 as you already...

anav

Incorrect.

anav

viewtopic.php?t=143620

anav

Interesting I am still on winbox3 and there is no ability to create qrcodes etc at wireguard peers..

anav

post config
/export file=anynameyouwish (minus router serial number, any public IP information, keys)

anav

1. Set this to none, as its been known to cause issues. /interface detect-internet set detect-interface-list= none 2. Not sure why but on my devices netmask is not shown on the export so if you entered /24 manually on the bridge IP address ensure you remove it. /ip dhcp-server network add address=17...

anav

@A9691 This is what I would do...... Assumptions: You have two fixed/static WANIPs Unknowns, Its not clear as to why you are mangling?? ISP1 is the preferred IP based on having a distance of 1 for all the users on the network. If you wanted a specific subnet to go out WAN2 vice WAN1, then use routin...

anav

1. Quick question is this device behind another router......... There are hardly any firewall rules..... AND you have no IP addresses. There is something seriously wrong with the config. 2. Did you manually enter the wireguard peer settings for 192.168.216.5 or did the router create that entry.........

anav

Your post has nothing to do with the Wireguard menu?
By chance are you actually talking about BTH back to home vpn wireguard activated through the IP cloud menu??

anav

Do you have anything else going on with the WANIPs............ any VPN traffic or port forwarding to local servers??

Will need to see your config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys)

anav

Should have provided this guide first time around.
viewtopic.php?t=143620

anav

Sorry unable to assist, unless you want to know that most often I wear wool socks. They belong on the feet not in configs but I know dickus about networking.

anav

Yes, good idea to check out that fileserver and after we can sort out the router. The grass is always greener, Im sure there are redeeming qualities of where you live.........

anav

1. Thanks CGG, very clear and useful info.
2. According to what CGG stated, Yes! The CPU will get less loaded regardless and that should help, also the hint of changing freq may help a bit.
If the OP in question has significant vlan traffic across Ports, the change will be the most significant.

anav

Sorry diagram makes no sense to me, hopefully somebody with more experience with this type of setup can assist.

anav

Hmm interesting I recently read this at MT Docs, but assume it doesn't affect your solution.......... "The preferred source is not used anymore for connected routes. FIB chooses the source address based on the out-interface. This allows making setups that in ROS v6 and older were considered inv...

anav

Sorry we cannot guess and thus need to see information. Im assuming you dont have a public IP and your ISP router does not forward ports and thus why BTH. We would need to see the config...... /export file=anynameyouwish ( minus router serial number, any public WANIP information, vpn keys ) We would...

anav

Before Sindy takes a crack at it, did you try removing your responder entry. I dont use that on any of my configs?? /interface wireguard peers add allowed-address=192.168.166.2/32 comment=G interface=WGC name=peer1 \ public-key="xxxxxxxxxxxxxxxxxxxxxx" responder=yes add allowed-address=192...

Search found 23374 matches