Community discussions

MikroTik App

Search found 631 matches

by xvo
Thu Dec 05, 2019 9:50 am
Forum: RouterBOARD hardware
Topic: 3+ Wired, Routable ports + Wifi
Replies: 3
Views: 2450

Re: 3+ Wired, Routable ports + Wifi

In ROS you can choose whether you want switched or independent ports on every device for every port.
And as you don't need high speeds, shared bus to the CPU will not be a problem too.
So any device with needed number of ports and needed wifi capability will do.
by xvo
Tue Dec 03, 2019 11:04 pm
Forum: Beginner Basics
Topic: cAP AC as a home router
Replies: 2
Views: 662

Re: cAP AC as a home router

If you really don't need more ethernet ports, then it should be ok: it is capable of pretty much everything you can need in home environment.
The only thing is a lack of usb port.
by xvo
Tue Dec 03, 2019 10:54 pm
Forum: Beginner Basics
Topic: Dual WAN without configuration
Replies: 8
Views: 1094

Re: Dual WAN without configuration

If you want to set which of them should work you can remove add default route to NO in IP>DHCP Client and add them manually with different distance! You don't really need to set "add default route" to no: DHCP-client (as well as PPPoE-client, L2TP-client, etc.) have "Default route distance" setting...
by xvo
Tue Dec 03, 2019 10:11 pm
Forum: Announcements
Topic: Newsletter 92
Replies: 39
Views: 27153

Re: Newsletter 92

It's been quite a while since we've heard anything about the CRS354 and CRS332, any updates on those?
"CRS332" was released long ago as CRS326-24S+2Q+RM: https://mikrotik.com/product/crs326_24s_2q_rm
by xvo
Tue Dec 03, 2019 2:10 pm
Forum: SwOS
Topic: S-31DLC20D on Mikrotik CRS328-24p-4s+rm do not work with othe brand.
Replies: 2
Views: 2102

Re: S-31DLC20D on Mikrotik CRS328-24p-4s+rm do not work with othe brand.

CRS328-24P-4S+RM is not listed among devices that support 100Base-FX: https://wiki.mikrotik.com/wiki/MikroTik ... iber_links
by xvo
Mon Dec 02, 2019 6:36 pm
Forum: Wireless Networking
Topic: Cap Lite newbie
Replies: 1
Views: 1228

Re: Cap Lite newbie

All Mikrotik hardware products come with appropriate license preinstalled, so you don't need to purchase license separately.
by xvo
Sun Dec 01, 2019 12:37 pm
Forum: Beginner Basics
Topic: Disk Space changed from 128M to 16M [SOLVED]
Replies: 5
Views: 969

Re: Disk Space changed from 128M to 16M [SOLVED]

RB750 R2 is supposed to have 16MB flash.
Can you please post what you get in System -> Resources on both routers (the one affected, and the one that is not).
by xvo
Sun Dec 01, 2019 10:48 am
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

Seems strange.
Especially because it manifests itself only for apple devices.
Probably a bug.

Anyway, glad you found it.
by xvo
Sat Nov 30, 2019 3:24 pm
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

Yeah, you are right, that's your feature - jumping to conclusions based on your imagination only. You call imagination the fact that i can see with my eyes 3 different subnets on the provided photo ? Really ? :lol: I ve seen many times as well enginneers not seeing the obvious... no offense too.......
by xvo
Sat Nov 30, 2019 9:38 am
Forum: General
Topic: connection to the l2tp server on mikrotiku
Replies: 6
Views: 809

Re: connection to the l2tp server on mikrotiku

Yes, but can I set a ban on the firewall only for selected logins (users)?
Only on src-address basis.
Or you can let the user connect, but not allow to reach anything.

Otherwise - couple of scripts in the scheduler, that will disable/enable needed ppp secrets/interfaces.
by xvo
Sat Nov 30, 2019 12:41 am
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

Thanks xvo its just a big learning curve for me as I have always dealt with simple networks this one is a big challenge for me and a lot for me to learn. I am an engineer not a software person wires, wifi and fiber I can understand the programming side of things I struggle with. Bottom line: the an...
by xvo
Sat Nov 30, 2019 12:07 am
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

xvo this is a new project out of what I have done before. So looking for some help and constructive comments! As I wrote from the start - two devices on you picture don't have to be routers. You can do such link with two managed switches. And it won't be hard to configure them. But, that is all tha...
by xvo
Fri Nov 29, 2019 11:11 pm
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

I wonder how @xvo and @mkx would isolate those subnets on L2 and L3 with the use of only managed switches... Am just happy that am a step ahead... :lol: Each of the networks can have it's own router, for example. Ahead of what? Common sense? :lol: Yeah, you are right, that's your feature - jumping ...
by xvo
Fri Nov 29, 2019 10:59 pm
Forum: General
Topic: connection to the l2tp server on mikrotiku
Replies: 6
Views: 809

Re: connection to the l2tp server on mikrotiku

...or you can just use "Time" firewall matcher to restrict establishing the l2tp connection outside the needed time interval...
by xvo
Fri Nov 29, 2019 10:45 pm
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

Nothing was said, unless you see the photo again...


OP said
Is it possible to put 3 networks down a fiber connection then break them out at the other end?
To me this sounds a job for a pair of VLAN switches without any routing capability whatsoever.
Same for me.
by xvo
Fri Nov 29, 2019 10:36 pm
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

@xvo its an interVLAN network... you need a router to block the L3 communication between VLANs. EEEhhh, what? :shock: Please, tell me, what will change if you swap the two routers on the scheme above with two managed switches. In OP nothing is said about interVLAN routing, only about squeezing 3 se...
by xvo
Fri Nov 29, 2019 10:04 pm
Forum: General
Topic: is this possible
Replies: 25
Views: 2077

Re: is this possible

Yes, of course it is possible.
It is called VLANs.
And you even don't need routers for it - managed switches will suffice.
by xvo
Fri Nov 29, 2019 6:52 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

I don't see anything wrong apart from two moments, that are not related to the problem: 1) Address should be moved to the bridge from ether3 /ip address add address=192.168.1.1/24 comment=defconf interface=ether3 network=192.168.1.0 2) Your firewall is highly inefficient, when it comes to the load o...
by xvo
Fri Nov 29, 2019 5:57 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

Post your config: /export hide-sensitive There is a lot of sensitive information. Maybe something specific? Well, all specific ideas were already spoken :) What is left are the ones, that you won't normally think of. Replace things like public IP's and port numbers open to outside world with some a...
by xvo
Fri Nov 29, 2019 5:28 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

Post your config:
/export hide-sensitive
by xvo
Fri Nov 29, 2019 5:00 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

I don't get it, what has ping to do with dns settings at all?!
What address are you trying to ping?
And using what tool.

The only thing that comes to mind is that you DNS does not serve PTR-entries correctly.
But once again, it has nothing to do with ping.
by xvo
Fri Nov 29, 2019 3:45 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

In the situation you want to troubleshoot (nothing specified in DHCP networks), what DNS servers do apple devices get?
Does it change anything if you add router's address in DHCP networks as a DNS server too, not only as Gateway?
by xvo
Fri Nov 29, 2019 2:50 pm
Forum: General
Topic: Drop unwanted port-forwarding connections
Replies: 6
Views: 957

Re: Drop unwanted port-forwarding connections

The opposite situation, with second WAN, is less common, IMO, and it needs more qualified user to set up by itself, so it's not the problem as big. It depends what we consider a problem. If the problem is that something doesn't work (due to forgotten LAN permissive rule), the home user notices it a...
by xvo
Fri Nov 29, 2019 1:55 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

No, if you don’t have “use peer dns” checked, and have your server specified in DNS, it won’t.
by xvo
Fri Nov 29, 2019 1:16 pm
Forum: General
Topic: Drop unwanted port-forwarding connections
Replies: 6
Views: 957

Re: Drop unwanted port-forwarding connections

Why there is not an ending "drop-all" rule in the forward chain like the one in input chain ? I'm not the author of this idea used in the default firewall configuratuion, but I read it as a way to concentrate all the decision making into a single rule in the nat table, which can choose from the sam...
by xvo
Fri Nov 29, 2019 12:51 pm
Forum: General
Topic: MikroTik and internal DNS server [SOLVED]
Replies: 20
Views: 3015

Re: MikroTik and internal DNS server [SOLVED]

Why you need mikrotik in this scheme at all: just add the address of your DNS server in DHCP -> Networks for your network, and let all your devices use it directly.
by xvo
Thu Nov 28, 2019 5:34 pm
Forum: General
Topic: NTP server package installation on CRS328-24P-4S+RM [SOLVED]
Replies: 4
Views: 774

Re: NTP server package installation on CRS328-24P-4S+RM [SOLVED]

CRS328 is ARM architecture , not MIPSBE.
by xvo
Wed Nov 27, 2019 7:42 am
Forum: Beginner Basics
Topic: Queue active only if on 2nd ISP
Replies: 1
Views: 419

Re: Queue active only if on 2nd ISP

You can set your backup WAN interface as a destination in your queues.
by xvo
Fri Nov 22, 2019 11:50 am
Forum: General
Topic: Disabling vLans not working as expected [SOLVED]
Replies: 9
Views: 1116

Re: Disabling vLans not working as expected [SOLVED]

I then can add these interfaces into any bridge like any other interface and have both real ports and vlans in same bridge. That is not the proper way to do it. Not only all vlan handling is done by CPU when configured this way, but it also can lead to erroneous behaviour: https://wiki.mikrotik.com...
by xvo
Thu Nov 21, 2019 12:54 pm
Forum: General
Topic: Bandwidth test can't connect outside local subnet
Replies: 11
Views: 2244

Re: Bandwidth test can't connect outside local subnet

Well i dont know about you but i can confirm bandwidth test works just fine outside the local network. There were even some public bandwidth test servers available for those who wanted to make some tests and they worked great! Agreed, that is not the problem. The issue appears when you have multipl...
by xvo
Thu Nov 21, 2019 12:29 am
Forum: General
Topic: LAG 802.3AD slowness
Replies: 21
Views: 2858

Re: LAG 802.3AD slowness

Looking at the specs for the block diagram, the 8367 chip supports RGMII, which is 1 Gbps, whereas the 8366 and 8369 support RSGMII which is 2.5Gbps. Could this be an issue? Looking at the Realtek website, I see that there are different RTL8367 models, and some of them have 2,5Gbps interface. So I ...
by xvo
Wed Nov 20, 2019 11:21 pm
Forum: General
Topic: LAG 802.3AD slowness
Replies: 21
Views: 2858

Re: LAG 802.3AD slowness

Hello, I hope I'm not drudging up or hijacking an old thread, but it seems as though a few months old isn't too far back. However, I'm curious, how can 2.5Gbps be achieved on a 1Gbps chip? I currently have a 4011 with Ether1 and 2 bonded and am seeing a clear bottleneck. My graphs show a plateau at...
by xvo
Tue Nov 19, 2019 9:08 am
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

I have tried same Bandwidth test from LAN Bond in that i have seen 2Gig reaching both ports are using full fledge.
That is not surprising: on LAN bond you are using balance-rr mode that can utilise both links even for single connection, so it can be properly tested by single bandwidth test.
by xvo
Mon Nov 18, 2019 11:12 pm
Forum: Beginner Basics
Topic: What Limitations will my switch have with only 2mb of storage?
Replies: 1
Views: 436

Re: What Limitations will my switch have with only 2mb of storage?

CSS326-24G-2S+RM is a Layer 2 switch, so it can't do routing.
And it doesn't have any advanced features that can need more storage than it is onboard.
by xvo
Mon Nov 18, 2019 1:00 pm
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

You can try balance-xor if cisco supports it, yes, but that's not the point: there is nothing wrong with 802.3ad, you just don't test it right.
by xvo
Mon Nov 18, 2019 10:59 am
Forum: General
Topic: howto setup static ipv6 prefix from ipv6 pool
Replies: 2
Views: 575

Re: howto setup static ipv6 prefix from ipv6 pool

There is a "bug" in ROS: the wildcard size is not equal the pool size, but the prefixes it hand out.
There was a topic about that not long ago:
viewtopic.php?f=1&t=153437&p=757885
by xvo
Sun Nov 17, 2019 12:35 pm
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

So you say that LACP does not work when L2+L3 hash is used right? No. I say, that when L2+L3 is used the hash result between two hosts will always be the same, resulting all connections between these two host will always end up to use one particular link. So to fully utilise the bond you need multi...
by xvo
Sun Nov 17, 2019 12:25 pm
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

L2+L3 No, it means L2+L3 hash is "maximum level" hash for LACP bonding. LACP does not support L3+L4 hash. I do not understand what is your point... My point is you can't test throughput of a bond that is using L2+L3 hash with bandwidth test between only two devices at a time, even if you establish ...
by xvo
Sun Nov 17, 2019 12:02 pm
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

You mean LACP does not work on L2+L3 hash ?
Because even in the wiki the example uses L2+L3
No, it means L2+L3 hash is "maximum level" hash for LACP bonding.
LACP does not support L3+L4 hash.

Balance-xor does, and also switch chip on CRS always uses L2+L3+L4 hash policy.
by xvo
Sat Nov 16, 2019 3:17 pm
Forum: Beginner Basics
Topic: Cisco Bonding not working
Replies: 22
Views: 1576

Re: Cisco Bonding not working

802.3ad can't spread a single connection to multiple links.

And even more: L2+L3 hash means that even multiple connections between two particular hosts will use only one of the links.
by xvo
Sat Nov 16, 2019 3:11 pm
Forum: General
Topic: Mikrotik CAT 6 modems
Replies: 8
Views: 1127

Re: Mikrotik CAT 6 modems

We have as much information as there is in the presentation :)
by xvo
Sat Nov 16, 2019 12:36 pm
Forum: General
Topic: Mikrotik CAT 6 modems
Replies: 8
Views: 1127

Re: Mikrotik CAT 6 modems

Latest announcement from MUM in Athens couple of days ago:

https://mum.mikrotik.com//presentations ... 732455.pdf
by xvo
Fri Nov 15, 2019 3:54 pm
Forum: Wireless Networking
Topic: cap ac as wifi repeater + ethernet2
Replies: 3
Views: 1465

Re: cap ac as wifi repeater + ethernet2

* Make a slave off the same radio that is a station to be an Access point - make sure this slave interface is on the same bridge as the Station and Eths. * Voila your printer will now connect wirelessly to whichever is the strongest signal or via cable if you prefer. Only this part is not needed, b...
by xvo
Fri Nov 15, 2019 7:55 am
Forum: Beginner Basics
Topic: Hardware recommendation?
Replies: 10
Views: 1202

Re: Hardware recommendation?

So let's say I'll take the MikroTik RB4011iGS+RM. How do I power my 3 APs via PoE? The router seems to have only one PoE. Or which wireless APs with Ethernet ports would you use together with the RB4011? For an AP you can choose between cAP ac and wAP ac: https://mikrotik.com/product/cap_ac https:/...
by xvo
Thu Nov 14, 2019 10:19 pm
Forum: Beginner Basics
Topic: Hardware recommendation?
Replies: 10
Views: 1202

Re: Hardware recommendation?

Well the problem is that it doesn't make sense for me to get a router with wifi. My internet connection on the first floor is in a seperate tech room (as pictured but hard to see in my "network plan") and I only want to (have to) run wired connections inside it. There is a version of 4011 without w...
by xvo
Thu Nov 14, 2019 2:32 am
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

so opening the 4500 port is enough, no need to open both 4500 and 500. Прошу прощения, но leaving aside my understanding of your "otherwise there's no real point to use L2TP at all", the above statement is simply wrong. You are perfectly right that an IKE v2 responder MUST always listen on 4500, an...
by xvo
Wed Nov 13, 2019 10:03 pm
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

For sure I can imagine use cases for l2tp between two devices with public addresses too, but these are scenarios where building a symmetrical tunnel is impossible for some reason. OK, but what you write is relevant for L2TP without IPsec, because it is the only one of "only tunneling" (i.e. without...
by xvo
Wed Nov 13, 2019 9:06 pm
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

in case clients are behind the NAT, which most likely is the case, because otherwise there's no real point to use L2TP at all. Can you be more verbose regarding this thought, please? Clients, that can benefit from dial-in behaviour: PCs, phones, other personal devices are always behind at least one...
by xvo
Wed Nov 13, 2019 8:20 pm
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

Evening, Im to accomplish exactly this, is there any example of what the firewall rules should look like? Karel For l2TP+IPSec these ports have to be open: 1) UDP 1701 - for L2TP 2) UDP 500 - for IPSec and UDP 4500 - for IPSec with NAT-traversal, in case clients are behind the NAT, which most likel...
by xvo
Wed Nov 13, 2019 8:02 pm
Forum: Wireless Networking
Topic: Simple Wireless Bridge for a 50-100m point-to-point connection
Replies: 21
Views: 2291

Re: Simple Wireless Bridge for a 50-100m point-to-point connection

You can use something like this mount (no matter which one of the devices you choose): https://www.amazon.com/Universal-Antenn ... B002T0E91A
by xvo
Wed Nov 13, 2019 7:36 pm
Forum: Wireless Networking
Topic: Simple Wireless Bridge for a 50-100m point-to-point connection
Replies: 21
Views: 2291

Re: Simple Wireless Bridge for a 50-100m point-to-point connection

For 30-80m it seems like a total overkill. https://mikrotik.com/product/wireless_wire For 30-80m it seems like a total overkill. https://mikrotik.com/product/wireless_wire It will work like a charm...! XVO you can have a look at this post https://forum.mikrotik.com/viewtopic.php?t=128251 ... This p...
by xvo
Wed Nov 13, 2019 7:08 am
Forum: Wireless Networking
Topic: Capsman manager running on RB2011, but no CAP on it [SOLVED]
Replies: 19
Views: 3347

Re: Capsman manager running on RB2011, but no CAP on it [SOLVED]

Shall I disable the "drop" rule, add the rule you suggested and then enable the "drop" rule again?
Just drag it higher in the GUI :)
by xvo
Tue Nov 12, 2019 10:59 pm
Forum: Wireless Networking
Topic: Capsman manager running on RB2011, but no CAP on it [SOLVED]
Replies: 19
Views: 3347

Re: Capsman manager running on RB2011, but no CAP on it [SOLVED]

I missed the "add".
Sorry about that :)
/ip firewall filter add action=accept chain=input src-address-type=local
And don't forget to place it higher than the last "drop" rule.
by xvo
Tue Nov 12, 2019 9:54 pm
Forum: Forwarding Protocols
Topic: Drop all NEW connections from the input chain
Replies: 6
Views: 2215

Re: Drop all NEW connections from the input chain

Out of curiosity why would that rule NOT BLOCK an initial negotiation with ones ISP to get an IP for example?
Is it because the routers outgoing communication (looking for an ISP) is what triggers the sequence???
DHCP session starts from the client.
by xvo
Tue Nov 12, 2019 8:30 pm
Forum: Wireless Networking
Topic: Capsman manager running on RB2011, but no CAP on it [SOLVED]
Replies: 19
Views: 3347

Re: Capsman manager running on RB2011, but no CAP on it [SOLVED]

/ip firewall filter action=accept chain=input src-address-type=local
by xvo
Tue Nov 12, 2019 8:20 pm
Forum: General
Topic: Force Google DNS Usage
Replies: 5
Views: 1287

Re: Force Google DNS Usage

The it will be something like this: /ip firewall nat add chain=dstnat action=dst-nat dst-address=!8.8.8.8 to-addresses=8.8.8.8 protocol=tcp dst-port=53 in-interface=***YOUR_LAN_BRIDGE*** add chain=dstnat action=dst-nat dst-address=!8.8.8.8 to-addresses=8.8.8.8 protocol=udp dst-port=53 in-interface=*...
by xvo
Tue Nov 12, 2019 8:17 pm
Forum: Forwarding Protocols
Topic: Drop all NEW connections from the input chain
Replies: 6
Views: 2215

Re: Drop all NEW connections from the input chain

It's not really "someone": something in your provider's network searching for multicast subscribers.
No idea what exactly for. If you also don't know - just drop it :)
by xvo
Tue Nov 12, 2019 7:54 pm
Forum: General
Topic: Force Google DNS Usage
Replies: 5
Views: 1287

Re: Force Google DNS Usage

It is not clear from the description, do you want to:
1) Redirect all dns queries to the router and use 8.8.8.8 as an upstream dns for it.
2) Redirect all dns queries to 8.8.8.8 and also use 8.8.8.8 for the router itself too?
by xvo
Tue Nov 12, 2019 7:37 pm
Forum: Forwarding Protocols
Topic: Drop all NEW connections from the input chain
Replies: 6
Views: 2215

Re: Drop all NEW connections from the input chain

It won't.
And you can just drop the log=yes part.
by xvo
Tue Nov 12, 2019 6:09 pm
Forum: General
Topic: IPSEC, ERROR
Replies: 1
Views: 551

Re: IPSEC, ERROR

/ip firewall address-list add address=216.218.206.90 list=blacklist

/ip firewall filter add action=drop chain=input comment="drop blacklisted" in-interface=***YOUR_WAN_INTERFACE*** src-address-list=blacklist
And move this rule just after "drop invalid" rule in the input chain.
by xvo
Tue Nov 12, 2019 2:54 pm
Forum: General
Topic: Mikrotik as L2TP/IPsec client
Replies: 1
Views: 434

Re: Mikrotik as L2TP/IPsec client

Perhaps you have "Add Default Route" setting checked.
by xvo
Tue Nov 12, 2019 12:15 pm
Forum: General
Topic: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.
Replies: 18
Views: 1817

Re: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.

Yes, sindy, you are right, that’s what I had in mind.

My second idea, to change dst-nat dst-address (or use in-interface matcher instead) will prove the same point: if everything starts working “magically”, that will mean ISP is using 1:1 NAT instead of static routing.
by xvo
Tue Nov 12, 2019 8:19 am
Forum: General
Topic: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.
Replies: 18
Views: 1817

Re: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.

What is your rule in input chain that is being hit by these packets? Can you add the explicit condition dst-address=59.43.27.9 to it? My guess is that your ISP is NATing packets with your public IP as a dst-address to you grey IP, instead of routing them to you as is. That is possibly why they never...
by xvo
Mon Nov 11, 2019 11:40 pm
Forum: General
Topic: Winbox security/access using FW lists and/or IP service [SOLVED]
Replies: 8
Views: 1506

Re: Winbox security/access using FW lists and/or IP service [SOLVED]

IMHO there's a big difference between blocking winbox access using (a very specific if you will) firewall filter rule and setting alowed addresses on service itself: in the later case initial conection is established and only service then decides to drop connection. In case of some nasty vulnerabil...
by xvo
Mon Nov 11, 2019 8:34 pm
Forum: General
Topic: 2 default routes when ROS starts
Replies: 10
Views: 1390

Re: 2 default routes when ROS starts

Why you think of it as a dirty solution? Solely because it relies on the assumption that the VPN server will always run on the same single IP, whereas the VPN providers often give out an FQDN, like any other internet service, and use short-lived DNS records to distribute the load among their server...
by xvo
Mon Nov 11, 2019 8:31 pm
Forum: General
Topic: 2 default routes when ROS starts
Replies: 10
Views: 1390

Re: 2 default routes when ROS starts

So, as this is a test routeboard i didn't let it run for hours, so probably the routing cache expires eventually. I solely trying to find a solution to forward all traffic through the VPN (even if it's pptp or l2tp. in my case it is l2tp with ipsec). The first solution (quick and dirty one), there ...
by xvo
Mon Nov 11, 2019 8:18 pm
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

have dynamic rules created for each client from DHCP server leases Requires the lease to be static... Are you sure about that: all the needed settings are in dhcp-server config? There is no rate limit setting under dhcp server... The only rate limit can be applied for a static lease... So yes unles...
by xvo
Mon Nov 11, 2019 5:52 pm
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

have dynamic rules created for each client from DHCP server leases
Requires the lease to be static...
Are you sure about that: all the needed settings are in dhcp-server config?
by xvo
Mon Nov 11, 2019 5:39 pm
Forum: General
Topic: 2 default routes when ROS starts
Replies: 10
Views: 1390

Re: 2 default routes when ROS starts

So a quick and dirty solution is to create a static route with dst-address matching the IP of the VPN server, and let the L2TP install a dynamic default route. Why you think of it as a dirty solution? What can possibly be wrong if the default route distance for dhcp-client on wlan is changed to som...
by xvo
Mon Nov 11, 2019 5:10 pm
Forum: General
Topic: Winbox security/access using FW lists and/or IP service [SOLVED]
Replies: 8
Views: 1506

Re: Winbox security/access using FW lists and/or IP service [SOLVED]

Question 1 - What is the difference between these two approaches and their advantage or disadvantages? Is there ever a time you would use both? The firewall rules allow any type of connection to the router from your address list. While "available from" is tied to a specific service. However, if you...
by xvo
Mon Nov 11, 2019 4:46 pm
Forum: General
Topic: Categorizing OpenVPN users to access specific servers [SOLVED]
Replies: 3
Views: 664

Re: Categorizing OpenVPN users to access specific servers [SOLVED]

thank you so much xvo !
The problem solved. your suggestion helpt me.

Best Regards
You are welcome! :)
by xvo
Mon Nov 11, 2019 9:16 am
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

See the "dynamic" with ip 192.168.6.32/27 i put "download limit at" 1M. I set all smartphone for youtubers will be in that IP range. Does it means every user in that IP range will get minimum 1M? No, that's for the whole range. If you want each of them to have 1M you can either use PCQ queue type w...
by xvo
Sun Nov 10, 2019 9:41 pm
Forum: Beginner Basics
Topic: Trying to configure CRS305-1G-4S+IN... [SOLVED]
Replies: 8
Views: 2171

Re: Trying to configure CRS305-1G-4S+IN... [SOLVED]

What are the modules that you use?
by xvo
Sun Nov 10, 2019 8:49 pm
Forum: Beginner Basics
Topic: Trying to configure CRS305-1G-4S+IN... [SOLVED]
Replies: 8
Views: 2171

Re: Trying to configure CRS305-1G-4S+IN... [SOLVED]

I know GreasyGeek and am trying to help him with this. Unfortunately, the two CRS309-1G-8S+IN switches I have in production have a different VLAN for traffic and management. What he wants to do (and I can't remrmber how to do) is use the 10Gne ports for their speed and also have the 1Gbe port be pa...
by xvo
Sun Nov 10, 2019 7:51 pm
Forum: Beginner Basics
Topic: Trying to configure CRS305-1G-4S+IN... [SOLVED]
Replies: 8
Views: 2171

Re: Trying to configure CRS305-1G-4S+IN... [SOLVED]

I’m almost sure you don’t need to configure anything at all in SwOS - the default config should work.
Maybe just change its own IP.
by xvo
Sun Nov 10, 2019 2:28 pm
Forum: Beginner Basics
Topic: Trying to configure CRS305-1G-4S+IN... [SOLVED]
Replies: 8
Views: 2171

Re: Trying to configure CRS305-1G-4S+IN... [SOLVED]

Why do you want vlans at all if you need everything in one subnet?!

Just bridge all the interfaces and add dhcp-client to that bridge for the CRS to get the address itself (or even add that address statically).
by xvo
Sun Nov 10, 2019 11:58 am
Forum: Scripting
Topic: Disconnecting users based on time
Replies: 6
Views: 2020

Re: Disconnecting users based on time

Or, to outsmart the ones, who will just change their MAC address, as @Jotne suggested, you can reverse the logic: - set default-authenticate=no (or add a "drop" rule at the bottom of ACL). - add rules that will allow authentication to some MACs without any time condition. - and for some MACs with th...
by xvo
Sun Nov 10, 2019 11:51 am
Forum: Scripting
Topic: Disconnecting users based on time
Replies: 6
Views: 2020

Re: Disconnecting users based on time

There is the "time" option in the access list itself.
You can have default-authenticate=yes and add some rules, that won't allow authentication in the needed time window.
by xvo
Sun Nov 10, 2019 11:33 am
Forum: General
Topic: Categorizing OpenVPN users to access specific servers [SOLVED]
Replies: 3
Views: 664

Re: Categorizing OpenVPN users to access specific servers [SOLVED]

Use different PPP Profiles for different users. And add to each profile the address list (or interface list, whatever suits you better) where the user using this profile will be added. Or you can even use separate firewall chains for each profile defined in incoming-filter and outgoin-filter in prof...
by xvo
Sun Nov 10, 2019 9:49 am
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

Thank you for this - are you saying add the user to an interface list? It looks like you can specify an interface list in the profile. I would need to create different VPN profiles as opposed to default. Do i have that right? You can create "L2TP Server Binding" interfaces for every user, that need...
by xvo
Sun Nov 10, 2019 12:11 am
Forum: General
Topic: Router access with Winbox using VPN [SOLVED]
Replies: 13
Views: 1989

Re: Router access with Winbox using VPN [SOLVED]

Should I consider a port knock on prior to allowing a VPN connection?
That's not needed. L2TP+IPSec will be secure enough.
Then allow that IP address via a firewall filter input rule access to Winbox port 8291.
Or you can allow access from the l2tp-in interface created for that user instead.
by xvo
Sat Nov 09, 2019 1:18 am
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

Target of the parent must be changed to 192.168.1.0/24 and the algorithm used should be PCQ upload/download default. After that it will work just perfect.! Agree about the parent's target, but I don't about choosing PCQ as a type for it: - if NAT is performed on .2 and .3 (or if you set PCQ Mask to...
by xvo
Fri Nov 08, 2019 10:53 pm
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

You are welcome. The thing I was talking about in my second proposition is this: You have 20/4 limits from your ISP, and let's say you want to split them equally between two routers. Imagine two scenarios: 1) the load is high on both routers. 2) the load is high on one of them, and zero on the other...
by xvo
Fri Nov 08, 2019 5:49 pm
Forum: General
Topic: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.
Replies: 18
Views: 1817

Re: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.

... you can always workaround assigning the address somewhere by dst-nat to any other router's address. Not to another router address but to address of an internal device ... just like usually done with lone router's address ... Sure. But you can extend this approach for the router itself too.
by xvo
Fri Nov 08, 2019 5:46 pm
Forum: Beginner Basics
Topic: RB705gr3 with ISP vlan [SOLVED]
Replies: 5
Views: 1000

Re: RB705gr3 with ISP vlan [SOLVED]

Check what DNS server your PC gets from your router.
by xvo
Fri Nov 08, 2019 4:34 pm
Forum: Beginner Basics
Topic: RB705gr3 with ISP vlan [SOLVED]
Replies: 5
Views: 1000

Re: RB705gr3 with ISP vlan [SOLVED]

That is what is missing:
/interface list member add interface=vlan101 list=WAN
by xvo
Fri Nov 08, 2019 12:38 pm
Forum: Beginner Basics
Topic: MikroTik and LAN on second router
Replies: 20
Views: 2200

Re: MikroTik and LAN on second router

Edge router does not know where 2.0 and 3.0 are... So since it communicated with them someone has manually configured it.. Thats why there is a one direction communication... Ofcorse there might be other reasons too... Sure. But to get a response back without manually configured routes on mikrotik,...
by xvo
Fri Nov 08, 2019 12:23 pm
Forum: Beginner Basics
Topic: MikroTik and LAN on second router
Replies: 20
Views: 2200

Re: MikroTik and LAN on second router

Add a route in each mikrotik for the 192.168.1.0/24 and gateway the WAN IP of the Edge rourer... I guess that won't be enough: if it works now (without any additional routes on Mikrotiks) in one direction, then it means NAT is being performed either on UBNT, or on Mikrotiks, or everywhere. An that ...
by xvo
Fri Nov 08, 2019 11:56 am
Forum: General
Topic: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.
Replies: 18
Views: 1817

Re: SRCNAT to a /32 loopback address works fine, but DSTNAT failed.

Just brainstorming from my part: is it really necessary to play with the "fake" bridge just to assign the /32 address to some interface? From ISP side packets with dst-address=/32 will just get routed to your RB. From LAN side it doesn't get used at all. So it's all internal to RB and thus you don'...
by xvo
Fri Nov 08, 2019 11:35 am
Forum: Beginner Basics
Topic: Deny some clients from accessing LAN
Replies: 7
Views: 1002

Re: Deny some clients from accessing LAN

@xvo: you managed to miss the point with the second paragraph ... OP wrote that the isolated devices need internet access, so firewall filter dropping packets from those devices toward WAN interface is exactly the opposite of what OP wants. There was a second part of the question in the initial pos...
by xvo
Fri Nov 08, 2019 11:29 am
Forum: Wireless Networking
Topic: Capsman manager running on RB2011, but no CAP on it [SOLVED]
Replies: 19
Views: 3347

Re: Capsman manager running on RB2011, but no CAP on it [SOLVED]

The problem is in the firewall: you need to add a rule to the input chain that will allow src-address-type=local
by xvo
Fri Nov 08, 2019 11:23 am
Forum: Beginner Basics
Topic: Deny some clients from accessing LAN
Replies: 7
Views: 1002

Re: Deny some clients from accessing LAN

Those of your switches, that "doesn't support 802.1q", won't know anything about your router's firewall rules, and they will gladly pass traffic between different LAN clients. As for the clients that need access to outside blocked, the solution is pretty straightforward: you need to create a rule in...
by xvo
Fri Nov 08, 2019 10:59 am
Forum: Beginner Basics
Topic: Simple Queue "Upload Max Limit" does not work [SOLVED]
Replies: 15
Views: 2405

Re: Simple Queue "Upload Max Limit" does not work [SOLVED]

Do you have fasttrack disablled in firewall? And by the way, unrelated to this particular problem, I think it will make sense to: 1) add your wan-interface as a Dst. to this queue group - I guess you want to limit only connections to outside world by these 3 queues? 2) set your max limits the same f...
by xvo
Fri Nov 08, 2019 10:40 am
Forum: General
Topic: Port forwarding to 443 fail
Replies: 6
Views: 1023

Re: Port forwarding to 443 fail

As I see now your default rule 17 does the same, so you don't need the one I suggested at all.

Are you sure your ISP is not blocking port 443?
Change dst-port in your initial NAT rule to anything else (but leave to-ports=443), and try connecting to this different port from outside.
by xvo
Fri Nov 08, 2019 9:28 am
Forum: General
Topic: Port forwarding to 443 fail
Replies: 6
Views: 1023

Re: Port forwarding to 443 fail

In order for this to work you also need a firewall rule, that will allow such connection in forward chain. The simpliest one is: add action=accept chain=forward connection-nat-state=dstnat in-interface=ether1-gateway Placed lower than accept established/related and drop invalid rules of the forward ...
by xvo
Fri Nov 08, 2019 9:16 am
Forum: Beginner Basics
Topic: Ping Vlan interface from access port [SOLVED]
Replies: 2
Views: 579

Re: Ping Vlan interface from access port [SOLVED]

You need to add bridge itself as a tagged member of the vlan, for which you created a vlan-interface.
In other words, this:
add bridge=bridge1 untagged=ether9 vlan-ids=9
should be this:
add bridge=bridge1 tagged=bridge1 untagged=ether9 vlan-ids=9
by xvo
Thu Nov 07, 2019 11:49 am
Forum: General
Topic: daily and weekly graphics not match [SOLVED]
Replies: 3
Views: 520

Re: daily and weekly graphics not match [SOLVED]

It may sound confusing, but that’s not “max instant” speed, it’s “max average” :)

“Max 5min average” and “max 30min average” respectively.
by xvo
Thu Nov 07, 2019 11:04 am
Forum: General
Topic: daily and weekly graphics not match [SOLVED]
Replies: 3
Views: 520

Re: daily and weekly graphics not match [SOLVED]

You can see on your own screenshot: first chart is 5min average, while the second is 30m average.
by xvo
Wed Nov 06, 2019 10:12 pm
Forum: General
Topic: CRS125-24G-1S-RM vs CRS326-24G-2S+ BackUp
Replies: 6
Views: 1094

Re: CRS125-24G-1S-RM vs CRS326-24G-2S+ BackUp

Backup is not meant to be used on any other device, except for the one it was made on.
Use config /export for that.
by xvo
Wed Nov 06, 2019 9:51 pm
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

a razor and shaving cream. ;-)
What are these?!
A plot to make you uglier ...
:lol:
by xvo
Wed Nov 06, 2019 7:37 pm
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

a razor and shaving cream. ;-)
What are these?!
by xvo
Wed Nov 06, 2019 12:43 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Yup, it's that! Thanks again. For all :P
Nice! Glad we squared this out.
You are welcome :)
by xvo
Wed Nov 06, 2019 10:26 am
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

I found something interesting, i'm sure it's all about this. On router where i can use filtering device 1 and device 2 was on port 2 and port 10, so it's used by different switch chips. When i put device 1 from port 2 to port 9, there is no packets (of course after changing filter). It will be alwa...
by xvo
Wed Nov 06, 2019 10:16 am
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Fast Path option, only on bridge settings tab?
Yes.
And where can i find hw-offload option?
Port settings in Bridge -> Ports tab
by xvo
Tue Nov 05, 2019 5:35 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Another thought: perhaps Fast Path on the bridge or (and) hw-offload on the ports that are involved need to be disabled manually in order for bridge filter to work.
by xvo
Tue Nov 05, 2019 4:35 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Can't see anything wrong, apart from an address assigned to ether2 instead of bridge, and not ideal masquerade rule.
Have no idea why the rule in question is not being hit.
by xvo
Tue Nov 05, 2019 4:06 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Ok. Do
/export hide-sensitive
on a device, that doesn't work and paste the result under here inside "code" marks.
by xvo
Tue Nov 05, 2019 3:37 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Both devices are directly connected to Mikrotik, and you can actually see that there is traffic between them? And another idea. That is the device with you ovpn server and the one, on which you enabled proxy-arp on the bridge, right? Try to revert arp mode to enabled and see if it makes the differen...
by xvo
Tue Nov 05, 2019 3:17 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Keep in mind that direction makes a difference.
And if your network layout allows you use interface matchers, you probably don't need any others (protocol, ip addresses, etc), if you want to drop all the traffic between devices.
by xvo
Tue Nov 05, 2019 1:34 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

You are welcome! :)
by xvo
Tue Nov 05, 2019 1:24 pm
Forum: Beginner Basics
Topic: Router reset not working: couldnt reset configuration-not permitted(9)
Replies: 6
Views: 1011

Re: Router reset not working: couldnt reset configuration-not permitted(9)

Write permissions will work just fine...
Ok, then :mrgreen:
by xvo
Tue Nov 05, 2019 1:20 pm
Forum: General
Topic: 100 Mbps download limit on CRS109-8G-1S-2HnD
Replies: 4
Views: 867

Re: 100 Mbps download limit on CRS109-8G-1S-2HnD

It's a switch with some L3 capability, not a router.
It won't be able to route 500mbps in real world use.
by xvo
Tue Nov 05, 2019 1:16 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Thanks, for the answer. But i can't set any IP filtering, everything greyed. I can only use MAC filtering...
You can use IP section only if you select MAC Protocol - IP, obviously :)
by xvo
Tue Nov 05, 2019 1:12 pm
Forum: Beginner Basics
Topic: Router reset not working: couldnt reset configuration-not permitted(9)
Replies: 6
Views: 1011

Re: Router reset not working: couldnt reset configuration-not permitted(9)

If reset doesn't work go for netinstall...
What is your ROS version ?
In case protected-routerboot is on netinstall won't work.
by xvo
Tue Nov 05, 2019 1:05 pm
Forum: Beginner Basics
Topic: Router reset not working: couldnt reset configuration-not permitted(9)
Replies: 6
Views: 1011

Re: Router reset not working: couldnt reset configuration-not permitted(9)

Look in System -> Routerboard -> Settings for Reformat Hold Button value.
Then reset your router.
by xvo
Tue Nov 05, 2019 12:21 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

Do you use different subnets for LAN and OVPN clients?
No, all in one subnet.
Make them different then, unless you really need them to be in one /24 subnet.
In that case you can make it work by setting arp-mode to proxy-arp on your bridge.
by xvo
Tue Nov 05, 2019 12:14 pm
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

And about second question, just checked it on my second mikrotik router. For testing i created rule to block printer adress access from my local computer. And here too, zero packets. Here i have normal masquerade rule, src address local network, out interface WAN. (Because there is no VPN here) Wha...
by xvo
Tue Nov 05, 2019 11:57 am
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

except VPN connection - when masquerade is used on out wan interface then i can't connect to local network from my openvpn connection. When out-interface is blank, then i can access everything.
Do you use different subnets for LAN and OVPN clients?
by xvo
Tue Nov 05, 2019 11:05 am
Forum: RouterBOARD hardware
Topic: Internet slow via routerboard
Replies: 2
Views: 1906

Re: Internet slow via routerboard

How can anyone find out if you are doing something wrong if you don't describe what exactly you are doing?! :lol:
by xvo
Tue Nov 05, 2019 10:58 am
Forum: General
Topic: Firewall problems [SOLVED]
Replies: 27
Views: 2309

Re: Firewall problems [SOLVED]

The best practice is to use masquerade with out-interface (or out-interface-list) matcher, and only for your WAN interface(s).
by xvo
Tue Nov 05, 2019 12:47 am
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

I don't see anything wrong neither in your config nor here.
Are you sure the problem is not on the UniFi side?
Maybe it needs some special settings for hybrid port to work properly?
by xvo
Mon Nov 04, 2019 10:48 pm
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

Config (export) shows only static entries, while "print" command shows the dynamic ones as well.
by xvo
Mon Nov 04, 2019 10:45 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

As unfortunate as it is, for now there is no other way to do this, other than performing dst-nat. And you can't perform dst-nat for the packet originated from the router itself. Instead of doing it on all 500 end devices you can place additional router between dude server and the network, to do it i...
by xvo
Mon Nov 04, 2019 10:17 pm
Forum: Beginner Basics
Topic: Default firewall config
Replies: 6
Views: 6181

Re: Default firewall config

That is basically what a SOHO firewall is with fasttrack rule removed (you don't need it using a CCR in home environment): /ip firewall filter add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comme...
by xvo
Mon Nov 04, 2019 6:13 pm
Forum: General
Topic: Can't route between local Subnets. (One router). [SOLVED]
Replies: 16
Views: 1927

Re: Can't route between local Subnets. (One router). [SOLVED]

You don't need those two rules, they are not a solution but a workaround for you problem (if you have a problem at all).
Try to disable firewall on your windows machines, as mkx suggests.
by xvo
Mon Nov 04, 2019 3:19 pm
Forum: General
Topic: Firewall: Limit PPS on per IP basis
Replies: 6
Views: 733

Re: Firewall: Limit PPS on per IP basis

You can change "Dst limit" "Limit by" to src-address.
by xvo
Mon Nov 04, 2019 3:04 pm
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

What does
/interface bridge vlan print
show?
by xvo
Mon Nov 04, 2019 1:07 pm
Forum: General
Topic: Firewall: Limit PPS on per IP basis
Replies: 6
Views: 733

Re: Firewall: Limit PPS on per IP basis

Can you please provide an example? I am using custom chains ;) This is what i have in this moment: /ip firewall filter add action=jump chain=forward comment="=> Block Specific UDP" dst-address-list=OwnIPs in-interface=ETH1 jump-target=UDPConnections \ limit=5k,20k:packet protocol=udp src-address-li...
by xvo
Mon Nov 04, 2019 12:57 pm
Forum: RouterBOARD hardware
Topic: Antenna mod for hAP ac2 (RBD52G-5HacD2HnD-TC)
Replies: 6
Views: 4347

Re: Antenna mod for hAP ac2 (RBD52G-5HacD2HnD-TC)

You will probably need to unsolder or reposition some resistors to disconnect internal antennas and connect your own.
Better contact support directly on this.
by xvo
Mon Nov 04, 2019 12:39 pm
Forum: General
Topic: Firewall: Limit PPS on per IP basis
Replies: 6
Views: 733

Re: Firewall: Limit PPS on per IP basis

You can use Dst-limit matcher.
But as it performs desired action when under the limit, then applies passthrough, and that behaviour is not reversible (like with Limit matcher), you will need a custom chain for it.
by xvo
Mon Nov 04, 2019 11:35 am
Forum: Beginner Basics
Topic: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)
Replies: 37
Views: 5319

Re: Can't make VLANs to work with RB30011 (cant get PI addres from dhcp)

Thanks @anav fir answer but assigning address to ether2 works fine and I have no problems with it. On my eth2 I have connected switch (Cisco SRW2048) where all devices (including APs) are connected and all of them works fine - gets an IP, etc. Problem I have is that no devices connected to ether2 w...
by xvo
Mon Nov 04, 2019 11:29 am
Forum: General
Topic: Traffic/Ping VPN Client from LAN (bidirectional)
Replies: 2
Views: 424

Re: Traffic/Ping VPN Client from LAN (bidirectional)

Why on earth are you masquerading everything in all directions?!
by xvo
Mon Nov 04, 2019 11:15 am
Forum: General
Topic: Can't route between local Subnets. (One router). [SOLVED]
Replies: 16
Views: 1927

Re: Can't route between local Subnets. (One router). [SOLVED]

If that is the whole config, nothing is preventing clients in one subnet from access to the other. But I believe it's only a part of it, so maybe there's something in the part, that you didn't post. For example in firewall rules. As for seeing computers by the names in different subnet - you need a ...
by xvo
Sat Nov 02, 2019 7:06 pm
Forum: Beginner Basics
Topic: ERROR: could not connect to 192.168.88.1
Replies: 23
Views: 10796

Re: ERROR: could not connect to 192.168.88.1

Interfaces -> Interface List
by xvo
Sat Nov 02, 2019 6:22 pm
Forum: Beginner Basics
Topic: ERROR: could not connect to 192.168.88.1
Replies: 23
Views: 10796

Re: ERROR: could not connect to 192.168.88.1

Keep in mind that the more correct way to resolve the issue is not disabling this last firewall rule, but rather to make it work as intended by adding your bridge to interface-list LAN. Not so critical in your current config, because all your interfaces are actually LAN. But can be crucial in other ...
by xvo
Sat Nov 02, 2019 3:38 pm
Forum: General
Topic: Multiple vlan tags on an access port
Replies: 16
Views: 2505

Re: Multiple vlan tags on an access port

Add this device to a separate vlan and allow access between this vlan and all other vlans in your router, that is used as a firewall.
by xvo
Sat Nov 02, 2019 2:57 pm
Forum: Beginner Basics
Topic: VPN Routing [SOLVED]
Replies: 7
Views: 1611

Re: VPN Routing [SOLVED]

Add a set of static routes on all three routers:
1) On A: to .20 and .30 via B's tunnel address.
2) On B: to .10 via A's tunnel address and to .30 via C's tunnel address.
3) On C: to .10 and .20 via B's tunnel address.
by xvo
Sat Nov 02, 2019 2:37 pm
Forum: General
Topic: Multiple vlan tags on an access port
Replies: 16
Views: 2505

Re: Multiple vlan tags on an access port

Adding one mikrotik router between this device and mikrotik switch should be an workarround? Kind of. But not in a way you think of it. And not the sole existence of a router, rather the way it, and the rest of your network will be configured. You don't need to "clone" frames - that won't work for ...
by xvo
Sat Nov 02, 2019 1:58 pm
Forum: General
Topic: Multiple vlan tags on an access port
Replies: 16
Views: 2505

Re: Multiple vlan tags on an access port

There's no problem to strip all tags and send untagged frames out.
But how it is supposed to know which tag to add to which frame in the opposite direction?!
Some criteria is needed.
by xvo
Sat Nov 02, 2019 1:23 pm
Forum: General
Topic: Multiple vlan tags on an access port
Replies: 16
Views: 2505

Re: Multiple vlan tags on an access port

How it is supposed to chose which vlan tag to add on ingress on ether2 in your scheme?
by xvo
Sat Nov 02, 2019 1:20 pm
Forum: General
Topic: checking subet of IP
Replies: 11
Views: 1720

Re: checking subet of IP

It clearly stated the opposite to me. I must must have read the manual on those two in the last two years a dozen times. You don't expect to have to reverse it to make it working as expected. I guess it was designed to be used mainly with a "drop" rule: "passthrough all connections until they reach...
by xvo
Sat Nov 02, 2019 1:09 pm
Forum: Beginner Basics
Topic: Speed slower after upgrading
Replies: 3
Views: 709

Re: Speed slower after upgrading

CRS125-24G-1S-2HnD-IN is not a router.
It's a switch with a little L3 capability.
by xvo
Fri Nov 01, 2019 8:26 pm
Forum: Beginner Basics
Topic: RB750R2 BASIC home Vlan Setup
Replies: 6
Views: 1188

Re: RB750R2 BASIC home Vlan Setup

Since nobody knows, what exactly you did, it’s hard to judge whether it’s right or wrong. Post /export hide-sensitive from terminal here, and somebody will take a look. But the thing you definitely wrong about is the assumption, that by default router will block traffic between different interfaces/...
by xvo
Fri Nov 01, 2019 6:40 pm
Forum: Beginner Basics
Topic: ERROR: could not connect to 192.168.88.1
Replies: 23
Views: 10796

Re: ERROR: could not connect to 192.168.88.1

These are supout files, not config exports.

Go to terminal, do:
/export hide-sensitive
and post the result.
by xvo
Fri Nov 01, 2019 6:13 pm
Forum: Beginner Basics
Topic: ERROR: could not connect to 192.168.88.1
Replies: 23
Views: 10796

Re: ERROR: could not connect to 192.168.88.1

Please, reset it once again.
Configure the same way you've done before.
And before you disconnect from it (losing the ability to connect again) make an /export of the config and post it here.
by xvo
Fri Nov 01, 2019 5:55 pm
Forum: General
Topic: checking subet of IP
Replies: 11
Views: 1720

Re: checking subet of IP

Matches connections per address or address block after given value is reached.
If you have an accept rule, that means it starts accepting after you reach the limit.
Before that it work like a passthrough rule.

You should reverse the condition with "!".
by xvo
Fri Nov 01, 2019 4:28 pm
Forum: Beginner Basics
Topic: Firewall/NAT Issues
Replies: 3
Views: 756

Re: Firewall/NAT Issues

Search for Hairpin NAT :)

And by the way, with your rules no wonder you are getting to the router itself: they are configured only for ether1.
by xvo
Fri Nov 01, 2019 4:10 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

You can’t.
The only way is to perform nat from 8291 to your custom port.
And how can I do that?
Add this on your device:
/ip firewall nat add action=dst-nat chain=dstnat dst-address=YOUR_DEVICE_IP dst-port=8291 protocol=tcp src-address=YOUR_DUDE_SERVER_IP to-p
orts=YOUR_CUSTOM_PORT
by xvo
Fri Nov 01, 2019 2:52 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

You can’t.
The only way is to perform nat from 8291 to your custom port.
by xvo
Fri Nov 01, 2019 2:38 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

Is there anything valuable in the device’s logs when dude is trying to connect?
Does winbox run on the default port?
Can you confirm with torch, that dude packets are reaching the device?
by xvo
Fri Nov 01, 2019 2:25 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

Check that your device’s firewall accept connections on default winbox port 8291 from the address of your dude server.
by xvo
Thu Oct 31, 2019 9:56 pm
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

Do
/user print
and
/user group print
on the router you are trying to connect to.
And see, if the user you are using to login from dude server have the necessary rights.
by xvo
Thu Oct 31, 2019 2:44 pm
Forum: General
Topic: Sonos across VLANs?
Replies: 38
Views: 8861

Re: Sonos across VLANs?

Maybe something wrong with Multicast-Settings on the Switch.
Could be.
Try testing without a switch to understand whether Mikrotik or Cisco is causing the problem.
by xvo
Thu Oct 31, 2019 2:16 pm
Forum: RouterOS v7 BETA
Topic: IP6 address from pool bug fixed?
Replies: 12
Views: 3217

Re: IP6 address from pool bug fixed?

Not exactly, if your pool’s prefix length is larger than /64, you can use larger wildcard. Tried with /48 pool and /56 prefix length. Wildcard size is tied to to the wrong setting. Could be, I don't have freedom to choose different prefix size (/56 is what I get from ISP so /64 subnets on interface...
by xvo
Thu Oct 31, 2019 12:03 pm
Forum: RouterOS v7 BETA
Topic: IP6 address from pool bug fixed?
Replies: 12
Views: 3217

Re: IP6 address from pool bug fixed?

right now it simply dismisses request if wildcard size is anything larger than /64.
Not exactly, if your pool’s prefix length is larger than /64, you can use larger wildcard.
Tried with /48 pool and /56 prefix length.
Wildcard size is tied to to the wrong setting.
by xvo
Thu Oct 31, 2019 12:24 am
Forum: The Dude
Topic: Help with the dude
Replies: 16
Views: 3895

Re: Help with the dude

Does the user you are using to login have "dude" permission?
by xvo
Wed Oct 30, 2019 11:52 pm
Forum: General
Topic: Sonos across VLANs?
Replies: 38
Views: 8861

Re: Sonos across VLANs?

Follow the link to sonos forum from this early post: viewtopic.php?f=2&t=101244#p549825
There is a comment, that tcp/4444 also need to be opened for software updates to work.
by xvo
Wed Oct 30, 2019 11:44 pm
Forum: RouterBOARD hardware
Topic: Mikrotik LTE vs 4G for Europe? [SOLVED]
Replies: 2
Views: 2730

Re: Mikrotik LTE vs 4G for Europe? [SOLVED]

LTE version is better.

4G version covers only 3,7,20 international bands, while LTE version additionally covers 1,8,38,40, that are also frequently used in Europe.
by xvo
Wed Oct 30, 2019 9:59 pm
Forum: RouterOS v7 BETA
Topic: IP6 address from pool bug fixed?
Replies: 12
Views: 3217

Re: IP6 address from pool bug fixed?

We have this wildcard feature, it is not something new, and it is working somehow.
But the expected behaviour should be that the maximum wildcard size can match the size of the pool, not the size of the prefixes it hand out.
So I still think of it to be a bug.
by xvo
Wed Oct 30, 2019 6:12 pm
Forum: General
Topic: Access LAN using DDNS (cloud) address
Replies: 10
Views: 1559

Re: Access LAN using DDNS (cloud) address

But think about upsides. Well, just the one upside, it doesn't even need more. It's one-time config, you won't need to touch it ever again, because it's completely transparent and compatible with everything. It's still a hack, no doubt, but it's hard to not like it. I am perfectly aware of the upsi...
by xvo
Wed Oct 30, 2019 9:56 am
Forum: Beginner Basics
Topic: DST-NAT to internal multiple IP Adresses
Replies: 5
Views: 740

Re: DST-NAT to internal multiple IP Adresses

Not for the same ports.
by xvo
Wed Oct 30, 2019 9:52 am
Forum: Beginner Basics
Topic: Torrent drops packets on my Smart TV
Replies: 6
Views: 925

Re: Torrent drops packets on my Smart TV

What did you try to limit the connection number? There is a dedicated "connection limit" matcher in firewall filter. But, honestly I don't thing the problem is in the number of connections, unless it's multiple thousands of them. Are you sure you are using queues right and your IPTV traffic is exclu...
by xvo
Wed Oct 30, 2019 8:37 am
Forum: General
Topic: Access LAN using DDNS (cloud) address
Replies: 10
Views: 1559

Re: Access LAN using DDNS (cloud) address

1) Masking the real src-address.
2) Unnecessary traffic through router.
by xvo
Tue Oct 29, 2019 11:09 pm
Forum: General
Topic: Access LAN using DDNS (cloud) address
Replies: 10
Views: 1559

Re: Access LAN using DDNS (cloud) address

What you are looking for is called Hairpin NAT. But i remember from other posts you don't like Hair Pin NAT... :lol: If you want to access just your router from inside the LAN you can just add a static DNS entry... In case you want to access more then as xvo suggested you should use Hair Pin NAT......
by xvo
Tue Oct 29, 2019 4:17 pm
Forum: General
Topic: Access LAN using DDNS (cloud) address
Replies: 10
Views: 1559

Re: Access LAN using DDNS (cloud) address

What you are looking for is called Hairpin NAT.
by xvo
Tue Oct 29, 2019 11:37 am
Forum: General
Topic: Problem with DHCP server [SOLVED]
Replies: 12
Views: 1804

Re: Problem with DHCP server [SOLVED]

Let’s say router leased .30 to some device, then .31, then .32
When .30 lease expired, it can be leased again, but router won’t try to fill that gap. It will continue to lease .33 etc. if .32 is still active.
That is what you are talking about?
So once again, why does it bother you?
by xvo
Mon Oct 28, 2019 11:30 pm
Forum: Beginner Basics
Topic: Hairpin NAT with DST NAT tcp/80
Replies: 6
Views: 1177

Re: Hairpin NAT with DST NAT tcp/80

Src-nat is performed after forward, so it's ok, actually.
If you add logging for your masquerade rule, you can see the same packets being masqueraded afterwards.
by xvo
Mon Oct 28, 2019 11:16 pm
Forum: Beginner Basics
Topic: Hairpin NAT with DST NAT tcp/80
Replies: 6
Views: 1177

Re: Hairpin NAT with DST NAT tcp/80

Because this rule does exactly that - it redirects all tcp/80 traffic to 192.168.2.5: add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=192.168.2.5 to-ports=80 Add dst-address=YOUR-EXTERNAL-IP condition to it. And, by the way, that is not hairpin nat. Hairpin nat is an additional...
by xvo
Mon Oct 28, 2019 6:15 pm
Forum: General
Topic: Mk, NAT Open Request [Help needed]
Replies: 83
Views: 8897

Re: Mk, NAT Open Request [Help needed]

c. Filter rule 'INPUT" from vlan interface (or console) to router for what I dont get??????????????? /ip firewall filter add chain=input action=accept ??????????????????????????????????????????????????? For UPnP service on UDP 1900 :) You console needs a communication channel with the router for as...
by xvo
Mon Oct 28, 2019 6:05 pm
Forum: General
Topic: Quick Set: Home AP Dual - IP assignment
Replies: 8
Views: 1484

Re: Quick Set: Home AP Dual - IP assignment

As you've been already told - it is not a bug. Quickset is just a number of preconfigured templates, that can be used for initial configuration. Using quickset on the router that was already configured means overwriting part of its configuration leaving the other part intact and as a result - most l...
by xvo
Mon Oct 28, 2019 5:41 pm
Forum: General
Topic: Problem with DHCP server [SOLVED]
Replies: 12
Views: 1804

Re: Problem with DHCP server [SOLVED]

Why is that a problem?
by xvo
Sun Oct 27, 2019 3:40 pm
Forum: Beginner Basics
Topic: [Solved] Route between different subnets managed by RouterOS
Replies: 12
Views: 3336

Re: Route between different subnets managed by RouterOS

1) Delete all leftovers. No way somebody here will want to try to understand wether they are interacting with something or not, if they are not needed at all. I definitely don't want to. 2) What is the network interconnecting the two routers: please add to you scheme what address are on that link on...
by xvo
Sun Oct 27, 2019 2:06 pm
Forum: Beginner Basics
Topic: [Solved] Route between different subnets managed by RouterOS
Replies: 12
Views: 3336

Re: Route between different subnets managed by RouterOS

It seems you need to decide something first, or at least state it clearly: what device will be responsible for filtering between .2.X and .4.X: Alpha or Beta?
by xvo
Sun Oct 27, 2019 2:01 pm
Forum: Beginner Basics
Topic: [Solved] Route between different subnets managed by RouterOS
Replies: 12
Views: 3336

Re: Route between different subnets managed by RouterOS

1) Why you have this on Alpha?
/ip address add address=192.168.4.2/24 interface=e2_switch network=192.168.4.0
2) Why you need so complex firewall on Beta?
3) You definitely don't need NAT on Beta.
4) I can't see where DHCP-server for 192.168.4.0/24 is at all?
by xvo
Sun Oct 27, 2019 12:05 pm
Forum: Beginner Basics
Topic: [Solved] Route between different subnets managed by RouterOS
Replies: 12
Views: 3336

Re: Route between different subnets managed by RouterOS

Please, be more clear about your network layout: where is subnet B: 192.168.3.1/24 connected? Alpha or Beta?
And post config exports for both devices.
by xvo
Sat Oct 26, 2019 9:05 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

I know, I know. Just treat it like a trigger for yourself to reread couple of previous comments :wink: Returning to the subject. Scope/target scope are used for nexthop selection . You can think of it like a process of "route creation" for recursive routes. Scope and target scope are related to each...
by xvo
Sat Oct 26, 2019 8:38 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

Haven't you met anav before? :D
Sure I have!
I'm the one who welcomed him in the world of VLANs!
...The deed I will probably regret for the rest of my life... :lol:
by xvo
Sat Oct 26, 2019 6:46 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

You are joking, right?
by xvo
Sat Oct 26, 2019 5:44 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

Exactly!

There is no relation between distance and scope/target-scope: one is used for route selection, another for nexthop selection.
by xvo
Sat Oct 26, 2019 11:35 am
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

Once again, step by step: 1) A route 1 in your config needs a nexthop. 2) It has target-scope=10 3) It then searches the nexthop among the routes that has their scope<=10 4) It finds route 2 that has needed dst-address and scope=10 5) scope=10 (of route 2) <= target-scope=10 (of route 1) ---> route ...
by xvo
Sat Oct 26, 2019 11:24 am
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

I just explained you the purpose of both scope and target scope few comments above, then you wrote a config that should work, and now you state, that you haven't understood a word, that I said?
How are you doing it? :lol:
by xvo
Sat Oct 26, 2019 12:55 am
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

Something like that.
by xvo
Fri Oct 25, 2019 6:06 pm
Forum: RouterBOARD hardware
Topic: Antenna Gain
Replies: 19
Views: 50401

Re: Antenna Gain

Not in the verbatim sense of meaning. Phase array doesn't change geometry of antenna, it changes Tx timing of individual (tiny) dipoles and ditto for Rx (where constructive resonance of all Rx elements contributes to higher overall Rx signal from one direction) ... but yes, the net effect is simila...
by xvo
Fri Oct 25, 2019 5:53 pm
Forum: RouterBOARD hardware
Topic: Antenna Gain
Replies: 19
Views: 50401

Re: Antenna Gain

That counts for
unless an antenna can change it's geometry on the go :)
by xvo
Fri Oct 25, 2019 5:49 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

I think you have that mixed up.
Not me, man. Not me. :lol:
by xvo
Fri Oct 25, 2019 5:37 pm
Forum: General
Topic: Can somebody explain scope and target scope?
Replies: 32
Views: 8453

Re: Can somebody explain scope and target scope?

Scope/target scope pairs define which routes can be used for recursive nexthop: the route will search for nexthop only among other routes, whose scope is not higher than it's own target scope.
by xvo
Fri Oct 25, 2019 10:16 am
Forum: Wireless Networking
Topic: Hap AC2 - crap wifi 5GHz
Replies: 26
Views: 7250

Re: Hap AC2 - crap wifi 5GHz

Indeed :-( In console it shows all zeroes for current Tx power ... One of beauties of wireless on ARM ...
It's not just ARM, that is true for all 5Ghz radios in 802.11ac devices.
by xvo
Fri Oct 25, 2019 10:12 am
Forum: RouterBOARD hardware
Topic: Antenna Gain
Replies: 19
Views: 50401

Re: Antenna Gain

So setting the antenna gain does not focus the radiation beam?
How can it possibly do that? :lol:
Antenna gain (and thus a radiation pattern) is a physical characteristic dependant on antenna's geometry, and can't be changed unless an antenna can change it's geometry on the go :)
by xvo
Wed Oct 23, 2019 8:15 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

So I guess all the questions are of the table now :)

The main thing we figured out: Mikrotik in regulatory-domain mode won't let us break the law after all...
...For that we have manual-tx-power and superchannel! :lol:
by xvo
Wed Oct 23, 2019 7:31 pm
Forum: General
Topic: Using a hap AC as a switch [SOLVED]
Replies: 15
Views: 2230

Re: Using a hap AC as a switch [SOLVED]

What if you don't use it but you check on it, just to know what your programming is "doing"? You find some red fields stating that you must write something. You find some working modes that you don't even know or care about.... In my case you could also find that you lost your 5GHz wifi.... And sin...
by xvo
Wed Oct 23, 2019 7:17 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

No it wont change the Txpower, however it affects it in other ways... For, example the Txpower will get lower and lower as we increase the Gain in order to stay legal... And also if lets say i use an Antenna with a Gain of 6 dbi instead of one with 3 dbi, its like"doubling" the power because of the...
by xvo
Wed Oct 23, 2019 6:13 pm
Forum: General
Topic: Using a hap AC as a switch [SOLVED]
Replies: 15
Views: 2230

Re: Using a hap AC as a switch [SOLVED]

Actually, never use quick set :D It's tempting to always advice that, but the truth is, ROS is quite a complicated thing for those who see it for the first time, especially for "home" users. So it is either quickset or "i'll better go and buy something else" for them. Don't think it is wise to enco...
by xvo
Wed Oct 23, 2019 5:39 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

Again, the EiRP shows the power radiated, and that is the power that should be inside the legal limits, and TX + Gain give us the final dbm value... i dont understand why you say that Gain has nothing to do when thetr is a formula for that thing... Yes! Tx-power + gain will give you the maximum the...
by xvo
Wed Oct 23, 2019 5:25 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

Have you tried it? :) If you have tx-power-mode=default, antenna-gain=3dbi and tx-power/total-tx-power=14/17dbm and then change to antenna-gain=6dbi you will end up with 11/14dbm! Because the device lowered the Tx-power to stay inside the regulations. Seriously, just try it. You can use tx-power-mod...
by xvo
Wed Oct 23, 2019 4:58 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

So the total radiated power has two factors, the Tx power of our transmitter and the Antenna's Gain... That is totally wrong. TX-power is a characteristic of the radio emitter, totally independent from the used antenna. Antenna gain shows the distribution of this power in space (compared with an is...
by xvo
Wed Oct 23, 2019 4:35 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

Nope.
TX-power and Total TX-power indicate values for one chain and for all enabled chains.
The difference between them has nothing to do with antenna gain.

https://wiki.mikrotik.com/wiki/Manual:I ... d_802.11ac
by xvo
Wed Oct 23, 2019 4:26 pm
Forum: General
Topic: Using a hap AC as a switch [SOLVED]
Replies: 15
Views: 2230

Re: Using a hap AC as a switch [SOLVED]

Don’t ever use quickset after you made some changes from initial configuration.
by xvo
Wed Oct 23, 2019 4:10 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

You are confusing different things.
TX-power indicates the total amount of power radiated, it will not change if you change the antenna.
by xvo
Wed Oct 23, 2019 3:20 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

I think that’s because for some devices and some countries you can work on max tx-power without breaking any rules.
by xvo
Wed Oct 23, 2019 2:13 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

Now I see this too: just needed to try more countries :)
by xvo
Wed Oct 23, 2019 12:49 pm
Forum: Beginner Basics
Topic: RouterOS Throughput via VPN [SOLVED]
Replies: 7
Views: 1426

Re: RouterOS Throughput via VPN [SOLVED]

When you first start up the CHR you have a trial license (level 0) which is valid for 24 hour. Once registered you are using free license (level 1). Both come with a set of restrictions. HW licenses based on 0-5 levels and CHR licenses are different and can’t be used one instead of another. What yo...
by xvo
Wed Oct 23, 2019 12:23 am
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

E.g. if built-in antennae have 2dBi gain, then it's not possible to set this parameter to 0 or 1 ...
But it still is!
My guess, it just ignores it, if the value is lower than minimum for selected country.
by xvo
Wed Oct 23, 2019 12:14 am
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

So, if the device knows its antenna's gain, then why should i provide it as well?
I guess you no longer need to.

What needs to be clarified, is what happens when you set something there using frequency-mode=regulatory-domain.
by xvo
Wed Oct 23, 2019 12:04 am
Forum: Beginner Basics
Topic: RouterOS Throughput via VPN [SOLVED]
Replies: 7
Views: 1426

Re: RouterOS Throughput via VPN [SOLVED]

Well, I don't see anything wrong in this approach. :) Free licence is for testing purposes, to show you all the functions that ROS can provide you. It is not limited in any way other than the interface speed. You can configure everything, test all the needed protocols, the only thing you can't do - ...
by xvo
Tue Oct 22, 2019 11:43 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

To sum up: The device itself for sure "knows" the gain of its integrated antennas. You can check it yourself: /interface wireless info hw-info wlan1 And it is clear, that from ROS 6.43.11 version if in regulatory-domain mode the device won't let you fall out of your country regulations somehow. That...
by xvo
Tue Oct 22, 2019 11:18 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

AFAIK there is no need to specify it for devices with integrated antenna. Any reference in the wiki for that? I was talking about changes made in this ROS version: https://forum.mikrotik.com/viewtopic.php?f=21&t=144949 If I understand this right, in theory, if frequency mode is set to regulatory do...
by xvo
Tue Oct 22, 2019 8:00 pm
Forum: Beginner Basics
Topic: RouterOS Throughput via VPN [SOLVED]
Replies: 7
Views: 1426

Re: RouterOS Throughput via VPN [SOLVED]

I guess you are on free license? :)
by xvo
Tue Oct 22, 2019 7:49 pm
Forum: Wireless Networking
Topic: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]
Replies: 38
Views: 12647

Re: Correct antenna-gain setting on Mikrotik Hardware [SOLVED]

AFAIK there is no need to specify it for devices with integrated antenna.
by xvo
Thu Oct 17, 2019 12:25 pm
Forum: General
Topic: Low speed
Replies: 4
Views: 1175

Re: Low speed

Wire speed can be achieved only on first bridge, all others bridges are software this is why you have low perfomance. RB4011 have two switch chips, so hw-offloading can work on two bridges if each one of them utilises different switch chips. However bonding and vlans are hw-offloaded only on crs3xx...
by xvo
Wed Oct 16, 2019 8:03 pm
Forum: Beginner Basics
Topic: Sharing the bandwidth doesn't work
Replies: 37
Views: 4212

Re: Sharing the bandwidth doesn't work

Still can't find anything in your config that could interfere with queues.
by xvo
Wed Oct 16, 2019 4:49 pm
Forum: Beginner Basics
Topic: Sharing the bandwidth doesn't work
Replies: 37
Views: 4212

Re: Sharing the bandwidth doesn't work

Try setting max-limit much lower than your actual speed (5M/10M for example) and see if the queues still don't work.
To rule out the possibility, that your ISP shaper takes effect before your mikrotik.
by xvo
Wed Oct 16, 2019 4:11 pm
Forum: General
Topic: Point to Point 10 routers [SOLVED]
Replies: 12
Views: 4683

Re: Point to Point 10 routers [SOLVED]

Create separate provisions for each frequency and use them on the cAPs you want (based on radio MAC address).
by xvo
Wed Oct 16, 2019 12:58 pm
Forum: Beginner Basics
Topic: Sharing the bandwidth doesn't work
Replies: 37
Views: 4212

Re: Sharing the bandwidth doesn't work

I have no other ideas.
Almost identical config works for me.
by xvo
Wed Oct 16, 2019 10:19 am
Forum: Beginner Basics
Topic: Sharing the bandwidth doesn't work
Replies: 37
Views: 4212

Re: Sharing the bandwidth doesn't work

Did you also try to change targets from interface names to address ranges?
by xvo
Tue Oct 15, 2019 11:05 pm
Forum: General
Topic: Is MikrotikOS good enough to support two networks independent of each other? (one needs PPPoE)
Replies: 41
Views: 6579

Re: Is MikrotikOS good enough to support two networks independent of each other? (one needs PPPoE)

Try setting your max-limit values at least 5-10% lower than your typical ISP speed: you might hit the ISP limits before you hit your own.
by xvo
Tue Oct 15, 2019 7:52 pm
Forum: Beginner Basics
Topic: CCR1009-7G-1C-1S+PC
Replies: 8
Views: 1700

Re: CCR1009-7G-1C-1S+PC

What I wanted to achieve is to bring the internet into combo1 port therefore all remaining 7 ethernet ports will be free for my local network. You can do that. But you need to move all existing "wan" config from eth1 to combo1. For reference do an /export in terminal and look for all the places whe...
by xvo
Tue Oct 15, 2019 6:04 pm
Forum: Beginner Basics
Topic: CCR1009-7G-1C-1S+PC
Replies: 8
Views: 1700

Re: CCR1009-7G-1C-1S+PC

You are free to use any port or multiple ones for your WAN connection. That depends only on how you configure the router. As it is clearly stated in the wiki, only combo port accepts 100mb sfp modules, so even if it worked you wouldn't get any additional free ethernet ports: https://wiki.mikrotik.co...
by xvo
Mon Oct 14, 2019 11:28 pm
Forum: Beginner Basics
Topic: Help separating vlans for iot and smart-tvs [SOLVED]
Replies: 19
Views: 4031

Re: Help separating vlans for iot and smart-tvs [SOLVED]

The second should not be a problem: +1 local port to add to the bridge; -1 wan port and everything related to connecting to the outside world; -all dhcp servers; +1 dhcp client on one of the vlan-interfaces (on this device it is actually ok if the bridge is a tagged member for only one vlan - to hav...
by xvo
Mon Oct 14, 2019 10:05 pm
Forum: Beginner Basics
Topic: Help separating vlans for iot and smart-tvs [SOLVED]
Replies: 19
Views: 4031

Re: Help separating vlans for iot and smart-tvs [SOLVED]

In order to stop guessing post your:
/export hide-sensitive
by xvo
Sat Oct 12, 2019 7:56 pm
Forum: General
Topic: Wrong ethernet speed negotiation [SOLVED]
Replies: 13
Views: 1372

Re: Wrong ethernet speed negotiation [SOLVED]

Stupid question: is interface on Site B configured to advertise 1000M at all (have needed options ticked)?
by xvo
Sat Oct 12, 2019 11:52 am
Forum: Beginner Basics
Topic: Help separating vlans for iot and smart-tvs [SOLVED]
Replies: 19
Views: 4031

Re: Help separating vlans for iot and smart-tvs [SOLVED]

In most of the the cases when DHCP server doesn't work on vlans after initial configuration, the reason is somebody forgets to add bridge itself as a tagged member of all needed vlans, and as a result - all vlan-interfaces configured on that bridge are actually not connected anywhere.
by xvo
Fri Oct 11, 2019 3:29 pm
Forum: General
Topic: RB4011iGS+RM Internet stops after a few days
Replies: 10
Views: 1884

Re: RB4011iGS+RM Internet stops after a few days

The fact, that the problem appears after a few days, makes me think, that something goes wrong when router tries to renew dhcp lease.
Anyway, if that’s on ISP side OP should try to contact them in the first place.
by xvo
Fri Oct 11, 2019 3:12 pm
Forum: General
Topic: RB4011iGS+RM Internet stops after a few days
Replies: 10
Views: 1884

Re: RB4011iGS+RM Internet stops after a few days

My mistake.. XVO any suggestions for the actual problem instead of correcting me for somerhing obviously i didnt see?
Most likely problem is on ISP side.
by xvo
Fri Oct 11, 2019 12:27 pm
Forum: General
Topic: RB4011iGS+RM Internet stops after a few days
Replies: 10
Views: 1884

Re: RB4011iGS+RM Internet stops after a few days

No its not ok... you ping your ISPs lan IP which is 192.168.0.1 and you get network unreachable...
That is a response from 192.168.0.1 about the 1.1.1.1
by xvo
Thu Oct 10, 2019 9:24 pm
Forum: General
Topic: Point to Point 10 routers [SOLVED]
Replies: 12
Views: 4683

Re: Point to Point 10 routers [SOLVED]

No dhcp server is needed on the cAPs.
by xvo
Thu Oct 10, 2019 4:25 pm
Forum: Beginner Basics
Topic: Sharing the bandwidth doesn't work
Replies: 37
Views: 4212

Re: Sharing the bandwidth doesn't work

That should work: /queue simple add dst=ether1 max-limit=22M/50M name=queue3 queue=default/default target=ether2,ether4 add dst=ether1 limit-at=11M/25M max-limit=22M/50M name=queue1 parent=queue3 queue=default/default target=ether2 add dst=ether1 limit-at=11M/25M max-limit=22M/50M name=queue2 parent...
by xvo
Wed Oct 09, 2019 11:27 pm
Forum: RouterBOARD hardware
Topic: hAP-aC2 with SFP port
Replies: 13
Views: 3390

Re: hAP-aC2 with SFP port

So what? You asked "Why would a home/office Access point/router have an SFP port ?" like it's some kind of nonsense never seen before. While it's really a nice feature to have for some users. Home users as well. If you want an sfp port then buy a mikrotik model with an SFP port! So many!!! If i wan...
by xvo
Wed Oct 09, 2019 1:34 am
Forum: General
Topic: Why (not) use Hairpin NAT
Replies: 28
Views: 4344

Re: Why (not) use Hairpin NAT

Ok, I get it.
Some people in this thread are from ip:port + hairpin nat camp.
Others from dns + reverse proxy camp.
You are somewhere in the middle :lol:
by xvo
Tue Oct 08, 2019 11:45 pm
Forum: General
Topic: Why (not) use Hairpin NAT
Replies: 28
Views: 4344

Re: Why (not) use Hairpin NAT

Personally i use Hair pin nat in the following cases (just an example) I have a dns name which with the help of a script i update it with my public IP address and at the same time there is a static dns entry in my router with the same Dns name which points to my rourers IP... This way i can access ...
by xvo
Tue Oct 08, 2019 9:54 pm
Forum: RouterBOARD hardware
Topic: Does CRS328-24P-4S+RM support 24v passive poe?
Replies: 20
Views: 5669

Re: Does CRS328-24P-4S+RM support 24v passive poe?

Any reason why you would advice against powering them wih PoE? By the way, they max at 19W, not 24W.
No..! According to the manual the max power consumption is 24W...
You are confusing CSS326 and CRS326.
by xvo
Tue Oct 08, 2019 7:47 pm
Forum: General
Topic: Allow users to access clients connected with L2TP
Replies: 2
Views: 752

Re: Allow users to access clients connected with L2TP

Does firewall on ppp client device allow ping at all?
by xvo
Tue Oct 08, 2019 2:31 pm
Forum: General
Topic: CCR1036 + Bonding + VLAN - cannot find correct way to configure
Replies: 7
Views: 1263

Re: CCR1036 + Bonding + VLAN - cannot find correct way to configure

I guess that in my case it is: physical interfaces -> bonding -> bridge -> vlan(-s) on top of bridge
Yes, that's correct.

You are welcome :)
by xvo
Tue Oct 08, 2019 1:54 pm
Forum: General
Topic: CCR1036 + Bonding + VLAN - cannot find correct way to configure
Replies: 7
Views: 1263

Re: CCR1036 + Bonding + VLAN - cannot find correct way to configure

I guess both blue and orange arrows need to run on one logic link between the two routers? In that case on Mikrotik 2 you will need to: - bridge upper and lower interfaces. - create 3 vlan interfaces on that bridge (for wan, lan and management) + for each one an ip configuration. - configure (in bri...
by xvo
Tue Oct 08, 2019 12:47 pm
Forum: General
Topic: Best VPN for Mikrotik Router
Replies: 13
Views: 3497

Re: Best VPN for Mikrotik Router

BestVPN is one you make yourself, host CHR somewhere and use native Mikrotik protocols (EoIP, IPIP, etc.)
True.
by xvo
Tue Oct 08, 2019 12:45 pm
Forum: General
Topic: CCR1036 + Bonding + VLAN - cannot find correct way to configure
Replies: 7
Views: 1263

Re: CCR1036 + Bonding + VLAN - cannot find correct way to configure

The reason it is used in the most example configs is the simple fact that in most typical scenarios you need some of the ports switched or bridged together to have L2 connectivity between the ports. That is not the case when you use only one interface for uplink, one for downlink, and device is used...
by xvo
Tue Oct 08, 2019 11:56 am
Forum: General
Topic: CCR1036 + Bonding + VLAN - cannot find correct way to configure
Replies: 7
Views: 1263

Re: CCR1036 + Bonding + VLAN - cannot find correct way to configure

Bridge is essentially a software switch, and you don't need a switch between you UPLINK and DOWNLINK. So remove UPLINK from the bridge, so that it contains only one interface - DOWNLINK. Then all the vlans have to be created on the bridge as a parent. And after that you can use UPLINK and VLAN-XXX i...
by xvo
Tue Oct 08, 2019 9:49 am
Forum: RouterBOARD hardware
Topic: hAP-aC2 with SFP port
Replies: 13
Views: 3390

Re: hAP-aC2 with SFP port

And why not? Original hAP AC has it :) So, it should have an SFP because another model does? Also hap ac with hap ac 2 are completelly different, the only common they got is their name... hap ac has different CPU, different architecture, different wireless chips and different prices.. you can't com...
by xvo
Tue Oct 08, 2019 12:40 am
Forum: RouterBOARD hardware
Topic: hAP-aC2 with SFP port
Replies: 13
Views: 3390

Re: hAP-aC2 with SFP port

Why would a home/office Access point/router have an SFP port ?
There are many other models with SFP ports...
And why not? Original hAP AC has it :)
by xvo
Tue Oct 08, 2019 12:21 am
Forum: The Dude
Topic: Winbox/Dude Client for LINUX and/or Mac OS/X
Replies: 4
Views: 3276

Re: Winbox/Dude Client for LINUX and/or Mac OS/X

Can't confirm the crashes to be a serious issue. I guess I only experienced winbox to crash only several times for the last couple of years. But I'm on high sierra. And the inability to drag-n-drop from winbox, well, could be a major issue for a file server client, but not for a router configuring s...
by xvo
Mon Oct 07, 2019 11:17 pm
Forum: General
Topic: Daisy Chain on Wire Speed [SOLVED]
Replies: 12
Views: 3958

Re: Daisy Chain on Wire Speed [SOLVED]

Connecting to the router itself won't make that traffic "routed", just "switched to the router's CPU".
Obviously such traffic can't avoid CPU in any scenario - because CPU is its destination :)
And it won't affect the other traffic in any way.
by xvo
Mon Oct 07, 2019 5:46 pm
Forum: The Dude
Topic: Winbox/Dude Client for LINUX and/or Mac OS/X
Replies: 4
Views: 3276

Re: Winbox/Dude Client for LINUX and/or Mac OS/X

No, they don't.
But wine winbox/dude from http://joshaven.com work flawlessly for most people on this forum.
by xvo
Sun Oct 06, 2019 11:24 pm
Forum: RouterBOARD hardware
Topic: New High Performance Routers ! ?
Replies: 48
Views: 10420

Re: New High Performance Routers ! ?

There were some gentle hints some time ago that something is on the way, but no specifics, no timeline.
by xvo
Sun Oct 06, 2019 2:08 pm
Forum: General
Topic: Point to Point 10 routers [SOLVED]
Replies: 12
Views: 4683

Re: Point to Point 10 routers [SOLVED]

Sure!
If you can connect all the APs by wire it will be the best and the easiest solution.
Only thing to keep in mind - use different non-overlapping channels on the adjacent APs.
by xvo
Sun Oct 06, 2019 12:04 pm
Forum: General
Topic: Point to Point 10 routers [SOLVED]
Replies: 12
Views: 4683

Re: Point to Point 10 routers [SOLVED]

There is no universal solution.
Too many factors: inside/outside, distances, obstacles, number of clients, uplink speed, neighbouring network, etc.
And the best option can be found only after at least basic radio analysis at the location.
by xvo
Sat Oct 05, 2019 9:12 pm
Forum: General
Topic: Point to Point 10 routers [SOLVED]
Replies: 12
Views: 4683

Re: Point to Point 10 routers [SOLVED]

Both options are bad, but the second one is still muuuuch better.
Ideally you need separate radios for PtP backbone and for serving clients.
by xvo
Sat Oct 05, 2019 1:19 pm
Forum: Virtualization
Topic: VPS, experiences on running CHR on VPS [SOLVED]
Replies: 8
Views: 4124

Re: VPS, experiences on running CHR on VPS [SOLVED]

That's exactly how I did it.
And from what I've read, yes, any VPS running on VMware/KVM should be fine.