MikroTik

RoadkillX

I bought an ax3 recently and wifi was great 800mbps next to the Router and ~400mbps two rooms away. I upgraded to 7.13.3 about a week ago and it went down to 300mbps and -70 Next to the Router and -85 and 10mbps at best two rooms away and lagging and loosing connection. Long story short after readin...

RoadkillX

Set up a proxy in HQ so that other offices in the mpls vrf can reach the internet through it. I believe that was the intention of who chose that topology. Asking the ISP to leak your vrf to the internet will surely have additional costs.

RoadkillX

Hi, reset the configs and try this. 1. Create bridge. 2. Add ether5 to bridge 3. /Interface bridge port ether5->vlan set frame-types to vlan tagged only and enable ingress-filtering (don't change the port pvid) 4. Create vlan 10 in /interface bridge vlan, tagged ports are the bridge and ether5, no u...

RoadkillX

Check for DSCP markings on the BT router.

RoadkillX

I have 42ms latency to google when link is idle while at fullspeed either download or upload it increased to 45-47ms you guys should check those fiber connections

RoadkillX

Then somewhere it says your fasttrack have attribute in interface set to PPPoE? Remove that.

Just saying there was a reason not disagreeing with your suggestion.

RoadkillX

if fasttrack is left without in-interface all traffic that meets the condition will be fastracked so firewall filter won't apply to vlans, there was a reason behind it...

RoadkillX

I dare to disagree with the contents of what you wrote. The OP is not using the machine as a bridge, the L2 functionality is provided by an external device, but the routing is so complex and the address plan so fragmented that it may require a rearrangement of the address plan to permit use of fast...

RoadkillX

Porqué eso es un router y lo estas usando como un switch eso no son vlans, el equipo esta a tope porque lo estas usando mal. Y pensar que michel y elio siempre dicen no asere si desde que tu te fuiste la red hasta al palo no falla... I've seen this network, i was once part of it, its just a huge bro...

RoadkillX

As an example: If you have a switch chip, created bridge with ports 2 - 5 in this bridge, HW enabled. Then create 2 vlans with ports 2&3 on VLAN100 and ports 4&5 on VLAN200, then theoretically, you will get HW offload functionality between ports 2&3 and also between ports 4&5, but s...

RoadkillX

Awesome, who needs the ghostbusters, call RoadkillX

break some, fix some, learn in the process.

RoadkillX

@sindy you beat me to it. if you enable service tag (s-tag) you'd just be tagging with 802.1ad which is a tag isp uses to switch traffic and to indicate that their is another vlan tag inside it, the actual (c-tag) customer tag that comes out to the customer. So that wouldn't work unless some one is ...

RoadkillX

from what i understand, If you have on switch-chip then add all interfaces to a bridge then do vlans in /interface ethernet switch you'll get hw-offload on all interfaces in the bridge, if you have 2 switch-chips then each bridge will have the ether interfaces for it according to docs, but you'll tr...

RoadkillX

Can you try doing the speedtest connected yo ether2, you can check if hw-offload is enabled using Winbox in bridge- port you'll see the H next to the port number if hwoffload is enabled. igmp snooping must be disabled on Bridge for hwoffload to work.

RoadkillX

Yeah I agree is something in the RB, have you tried connecting the ISP cable in another RB port? You probably have, but just checking, is hw-offload active on your bridge ports? RB2011 has 2 switch chips so bridge1 must have ports (ether1-ether5+sfp1) and bridge 2 (ether 6-10), is your Lan connected...

RoadkillX

Wait...made no difference even in cpu? same speeds and cpu usage with fasstrack and without? if so then the rule is not working correctly. *I just ran a test on an RB750Gr3 fiber 300/300mbps connection with fasttrack full speed download 37MBps cpu is at 7-8% without fasstrack 22-25% i have no rules ...

RoadkillX

Have you checked if the fasstrack rule is enabled and in-interface set to your pppoe connection on the rule?

RoadkillX

If your cpu is at 94% then you need fasttrack enabled to get more bandwidth but you won't be able to use rules in filter, mangle or queue for fasttracked packets. /ip firewall filter add action=fasttrack-connection chain=forward comment=fasttrack connection-state=established,related,untracked in-int...

RoadkillX

This works for me, but am sure there are better ways to do it though and it's still a work in process. RB750Gr3 /interface bridge add admin-mac= auto-mac=no name=bridge protocol-mode=none /interface ethernet set [ find default-name=ether1 ] name=ether1.HUG set [ find default-name=ether2 ] name=ether...

RoadkillX

I don't know the inner workings of CRS3xx but...
q.e.d.

You want a cookie or a tap on the back? ...

RoadkillX

yes, nothing to lose, but all vlans packets transmitted over all ports. I tested this option in practice. If you remove the vlan-filtering=yes option, the switch turns into a hub ). Think you read the https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#VLAN. I don't know the inner workings...

RoadkillX

@RoadkillX: Trouble is, it's all wrong (it's nothing against you). If you make DNS server in Location A (which can resolve both private and public names) your main resolver, then Location B becomes dependent on Location A. And it's not about those local names, that's just a small, less-important pa...

RoadkillX

I have two bridges? Are you saying if I remove one bridge suddenly HW off loading will magically appear. Where is this magic information hiding LOL. Can't remember were i read it but yes you can only have 1 bridge with hw-offload on RB devices and 7 on CRS devices, you can select which bridge to en...

RoadkillX

Not really, you can have dynamic list that may not always contain something.

Then it makes sense, didn't know that could be done, i've been using RouterOS for less than 2 months so still have to discover a lot of bells and whistles.

RoadkillX

I will take a wild guess at your HW offload issue, bridges, many, many bridges.....

I always forget that, on RB only 1 bridge hw-offload on CRS only 7 something like that.

RoadkillX

So conditional forwarders, send everything for X domain to X ip and all else to public dns, can't be done on mikrotik but you can use your primary dns as a dns-server in the mikrotik and in bind allow the mikrotik to query internal zones, recursion and access the cache so if bind already knows the A...

RoadkillX

Well, if you had src-address-list=192.168.0.0/24, then it was looking for list named "192.168.0.0/24". And you thought RouterOS was broken, shame on you!

I guess in some way it is broken it shouldn't allow the name of a list that doesn't exist.

RoadkillX

roadkil in ref to hw offload, my iGMP snooping is off?? roadkil in ref to rules order, yes I allow all LAN to WAN, you are saying why not limit traffic ONLY to port 80 and 443?? probably a good idea, but only if Sob says so! ;-) it sounds and is weird, on my RB750Gr3 in winbox it showed igmp snoopi...

RoadkillX

( PS what i cannot figure out is why my HW offloading which is checked off is showing as NOT on :-( ) My RB750Gr3 went crazy once with the igmp snooping on the bridge in winbox it would be unticked and in the terminal it would show igmp-snooping=yes i disabled it in terminal and hw-offload started ...

RoadkillX

if you can, post the netmap rules and remove public ips from them, not sure if hide-sensitive will do that. Maybe you missed something or misunderstood how something works and someone else can spot it, can't troubleshoot with limited information. *netmap - creates a static 1:1 mapping of one set of ...

RoadkillX

(PS does it make any difference if invalid drop rule is after or before accept established, connected rule - i.e. any logic to apply here?) i'd say more along the lines of performance and not security, if you drop invalid before checking if it's connected or established you'll be saving cpu time in...

RoadkillX

- SSTP, OpenVPN(TCP) Works, is fine, but TCP over TCP should not be the way to go for Site-to-Site-VPNs. Running on several sites, primary at 2mbps and sites at 512kbps they only share internal routes, Domain controller replication runs without a problem and hits 460kbps for each site instant messa...

RoadkillX

Again all rules are needed to determine which one is causing the problem something is forwarding your publicip:445 to an internal host before it gets to the samba dst-nat rule,try in nat move the samba dst-nat to the begginng of the list am sure it'll work or your samba is blocking connections. *net...

RoadkillX

Export your filter, mangle and Nat rules.

RoadkillX

Ok so this switch is the middle switch then It doesn't have to add a c-tag only switch based on service vlan instead if user vlan. /interface bridge add name=bridge0 igmp-snooping=no protocol-mode=none /interface bridge port add bridge=bridge0 interface=t01 hw=yes add bridge=bridge0 interface=t02 hw...

RoadkillX

Honestly don't understand how something so simple on CRS1xx/CRS2xx is so complicated or even as you say not possible on CRS3xx.

RoadkillX

That is what i was referring to, according to the documentation for QinQ to work you will have 1 vlan(17/27 c-tag) inside another vlan(11 s-tag) and it to ethernet trunk which will be the ethernet port from ISP with vlan11. That is why i was saying for that to work it'd require layer3 which won't be...

RoadkillX

You're right just add a dhcp-server on vlan20. else even if vlans are correct you won't get dhcp lease.

RoadkillX

Why do you have to do it in NAT? Devices on network 192.168.1.0/24 can reach 192.168.1.1 directly and 192.168.1.10, same subnet, so on your input chain incoming interface dst-address 192.168.1.1 Lan dst port 8080 redirect to 192.168.1.10 to port 80. Only set dst address if router has multiple lan ip...

RoadkillX

The one you should be using is:
https://wiki.mikrotik.com/wiki/Manual:S ... p_Features

That's the one i can't seem to understand its way easier in CRS1xx/2xx

RoadkillX

Your right....my apologies as I have been adding and removing configurations. I now have it enabled like so: /interface ethernet switch egress-vlan-translation add customer-vid=20 customer-vlan-format=untagged-or-tagged new-customer-vid=0 ports=ether2,ether4,ether6 service-vlan-format=untagged-or-t...

RoadkillX

try action dst-nat instead of netmap and specify in-interface. No, didn't help. I have several perfectly working forwards like rdp, vnc and ssh, but problem with samba. Samba also uses 445 for file sharing it is after all microsoft-ds so same port you'd open on windows, 139 you don't need across th...

RoadkillX

You'd have to do is, on the ubqt device tag the vlans i really can't help there, i don't have a clue on ubqt, once that's done you'll receive tagged frames for both vlans on your mikrotik all to do is in brige vlan add pseudo: /interface bridge vlan vlan10 tagged=eth10-ubqt,brigde-trunk untagged=eth...

RoadkillX

@RoadkillX you do not test your setup on the mentioned HW therefore it's invalid and not what anybody was asking for. @TestCRS thx for the ethertype reminder from RoadkillX I found the relatively simple case to do: set the vlan added to the bridge with "use service tag" and you should be ...

RoadkillX

I don't see a problem. Uploading at the max bandwidth of 10Mbps will result in high latency. There are ways to adjust for it with custom queuing to reduce the high latency for desired traffic, such as ping for example. It will result in a slight, not very noticeable reduced upload speed for the big...

RoadkillX

You have some vlan10 configurations disabled as explained by @sindy above, i'll assume you've done that intentionally since it isn't working and continue to what i think is the issue. i'd look into this: add customer-vid=0 new-customer-vid=20 ports=ether2,ether4,ether6,ether8 add customer-vid=0 disa...

RoadkillX

I really don't think that would work redirections to https are done by webservers because they tell the browser to start talking ssl over XXX port, if you do a redirect on the router you are just changing the packet data the browser doesn't know and will continue like if it were an http connection, ...

RoadkillX

When you apply fasttrack to certain traffic it won't go through flter mangle or queues, so it doesn't hit the cpu which increases throughput, downside you won't be able to apply queues or firewall rules to that traffic. the default rule still gives quite a lot of control in firewall since it's only ...

RoadkillX

Reorder the rules to be mark-connection then mark-routing then mark-packet enable passthrough on mark-routing disable on all rules that mark-packets so that once marked it leaves the prerouting chain and the mark-connection will not get overwrriten by http-https rule. 1) Mark Google Drive connection...

RoadkillX

Quite sure upgrade will fix it, there are problems on that version with the pppoe-client MRU and fasttrack was not yet implemented that's why the rules added had no effect

, Give us an update when done!

RoadkillX

Can you ping the router on 192.168.3.1? In your client openvpn configuration do you have the line redirect-gateway?

RoadkillX

Well if you can't reset the device because you need the configs then upgrade to latest firmware, i went through the changelog and there are quite a few relevant updates for pppoe-client since 6.34.2

RoadkillX

Did you add all those config or were they there when you bought the router? And it's on version 6.34.2 latest is 6.42.1

* This was clearly a corporate router before i suggest a config reset upgrade and add your BT config.

RoadkillX

@TestCRS /interface ethernet switch set bridge-type=service-vid-used-as-lookup-vid /interface ethernet switch egress-vlan-tag add tagged-ports=ISP vlan-id=11 # This is assuming that traffic incoming on internal interface is already tagged. if it's not then add #2 instead of #1 #1 /interface etherne...

RoadkillX

@TestCRS /interface ethernet switch set bridge-type=service-vid-used-as-lookup-vid /interface ethernet switch egress-vlan-tag add tagged-ports=ISP vlan-id=11 # This is assuming that traffic incoming on internal interface is already tagged. if it's not then add #2 instead of #1 #1 /interface ethernet...

RoadkillX

My bad, on the router terminal type export hide-sensitive without the / should give a dump of all the config for pasting here.

RoadkillX

weird, last resource /export hide-sensitve if you can.

RoadkillX

you might brush up your knowledge

sure thing

RoadkillX

How is your cpu usage on the router while running the speedtest? check your firewall if this rules exist and are enabled: add action=fasttrack-connection chain=forward connection-state=established,related,untracked in-interface=MyPPPOE add action=accept chain=forward connection-state=established,rel...

RoadkillX

Set on the mikrotik pppoe MTU=1492 and MRU=1492 and see if it improves.

RoadkillX

it should do 10Gb within the same vlan but not intervlan the original poster was never talking about inter-vlan-anything maybe you should revisit the original problem-report. QinQ requires intervlan. it's a vlan interface inside another vlan interface so revisit the docs ;-), to be more clear QinQ ...

RoadkillX

Is this a future device? i can't find anywhere to buy it and its not on the mikrotik page, i NEED that sfp port i have a HEX right now and that is my only complain.

RoadkillX

This is not a bug, its clearly misconfiguration respectfully disagree - the CRS and the new bridge-hardware-accelleration config to use it as a switch and get hardware-forwarding is what the original poster tried to achieve imho (and I see no flaw in the config); you are referencing the implementat...

RoadkillX

This is not a bug, its clearly misconfiguration starting with ingress-filtering on ports, you can't filter ingress frames when you haven't stated if that interface will be tagged or untagged for the vlan in interface bridge vlan. You're are actually dropping all frames not for vlan17 or 27 so no vla...

RoadkillX

You need to discard network and configurations issues on your workstations then move on to the router if it is a router misconfiguration then please be more verbose so we can help you.

RoadkillX

May I ask with which program did you make the diagram? i used https://www.draw.io/ This explanation gives a much better perspective, one doubt, which is your vlan10 tagged interface? this will be where your l3 vlan interface needs to be in order to have intervlan routing. i'am asuming eth10 is conn...

RoadkillX

Can you check that you have the same MTU on the BT Home router and on the mikrotik pppoe connection?

RoadkillX

Well, I wouldnt go that far, he may be onto something................

RoadkillX

I think the error is related as it says to the value-name which happens to be your input so edit the script and change the name of the l2tp-client to the actual name of your l2tp-client or rename the interface to match the #script1. Same for script 2 check that your interface is named WAN if not ren...

RoadkillX

Default config allows incoming icmp from any interface, edit all the firewall rules and change the incoming interface to your pppoe which is the connection that needs protection and remove the default icmp allow rule since mikrotik firewall has a default accept policy the icmp packets will go throug...

RoadkillX

Export the firewall rules which are full length-intuitive text, don't reinvent the wheel.

RoadkillX

What @revelation said: What is lacking about your current service for WiFi for your clients? You need to know this in order to know what to prioritize or limit depending on the situation, evalutate your networks (per service) bandwidth allocation and configure preferably queue trees (queue trees use...

RoadkillX

check.png

is the above what you're trying to do? i don't understand your diagram and config is a weird mix of bridge vlans&switch chip vlans&vlans interfaces inside bridges...

RoadkillX

Firewall Address list with summarized routes, and block forwarding from LAN to WAN for that address list /ip firewall address-list add address=146.66.156.0/23 list=Valve add address=185.25.180.0/23 list=Valve /ip firewall filter add action=drop chain=forward dst-address-list=Valve in-interface=bridg...

RoadkillX

Can you check that the switch connected to port24 is not tagging vlan20 across the port since the crs328 expects untagged traffic incoming on ether24. Or on the CRS328 switch ether24 in the vlan bridge from untagged to tagged for vlan20 and see if it works. i really can't see any other problems. *Ha...

RoadkillX

!!sfp port!!

RoadkillX

CRS112-8G-4S with 5 vlans on the switch chip can easily switch 2Gbps between diferent vlans and cpu usage is lauphable, this without using sfp ports. So i imagine a CRS3xx could do a whole lot better. if you do vlans on a bridge the cpu gets involved and Routing-NAT without fastrack will give most 3...

RoadkillX

You can't forward traffic heading to the internet unless you are forwarding a public ip address, create this rules in prerouting on each vlan interface or lan interface list, on the interface with your public address configure masquerade or src-nat (if static ip) for everything since you're doing fi...

RoadkillX

Can you export the relevant part of your config (switch vlan or bridge vlan) so it'll be easier to see? what i understand is that you have vlan600 which is for managment with range 192.168.100.0/24 and another 5 vlans and you can ping 3 of the branches, can you ping from the mgmt vlan, from office v...

RoadkillX

if each vlan has its own gateway which is the router why not use the router as your DNS server and allow incoming traffic on each vlan to destination port 53/udp (the router) otherwise just allow incoming on each vlan with destination any udp/53 and in nat create from source desired vlan for all tr...

RoadkillX

Okay last time I will list the list on this thread........... One question though remains, when looking at the TO address for the NAT DSTNAT rule for DNS, How would I best handle the fact that I would have multiple router LANIP gateway addresses. Consider each LAN or VLAN will have its own gateway?...

RoadkillX

So are you saying dont bother with such rules?? Regardless I am interested in how one would identify such trafffic using the mikrotik,,,,,,,, what combination of time and connections in the extra page would do the trick........... Mirror the wan port to an ethernet interface and check all traffic w...

RoadkillX

If you just want to be able to connect via ssh and manage your devices you can use a tor hidden service, if you want to host something on the internet then you have to ask you isp for upnp on your interface or static port nat mapping or 1:1.

RoadkillX

DNS queries work over 53/udp, tcp is only used for zone transfers, first rule is correct second is wrong if you only accept established connections all new will be dropped, you can do output same as input just make sure to create an outgoing accept rule in output chain for connections related, esta...

RoadkillX

Okay new and improved Version............. /ip firewall filter {INPUT} add action=accept chain=input comment="Accept established and related connections" \ connection-state=established,related protocol=tcp add action=accept chain=input comment=\ ALLOW list admin access to Router (all port...

RoadkillX

Is use-ip-firewall=yes for both bridges? I don't know which device is being used but if it's not a CRS you'll only get hw-offloading on 1 of the bridges and you'll see high cpu usage, this is better done using vlans (Correct way to divide layer2 networks) since right now it's like 2 separate network...

RoadkillX

Try this: - Create bridge1 add ether1 and ether24. - add vlan 10 tagged ether1 - add vlan 20 tagged ether1 untagged 24 - add interface vlan10 vlan-id 10 interface ether1 (set ip address) - enable bridge vlan filtering /interface bridge add name=bridge1 /interface bridge port add bridge=bridge1 inter...

RoadkillX

Having kind of the same problem with RB750Gr3 6.42.1, i can get a max speed of 12mbps using BF-CBC and MD5 if i change to aes-256-cbc and SHA1 it'll go down to 6-7mbps even when copying from hosts in my own LAN connected either from inside or outside the network, internet is stable and idle during t...

Search found 88 matches