Hi, my customer has a fiber connection in Mexico from the provider Totalplay. He uses the Huawei HG8145V5 as a modem and would like to switch to Mikrotik.

What SFP module would you recommend to use for Totalplay ISP in Mexico?

BTW ad "ComCast Business gateway" - do you really need it? Two years ago I replaced three such gateways by combo [Mikrotik Router(20USD one-time) + cheapest generic Cable modem bought at Target or such similar store (60USD one-time)]. Total cost 80USD one-time investment per combo, instead...

ad "It would have to work that way. I can't imagine that they would want to act as the man-in-the-middle for tens of thousands of simultaneous connections." Easy to determine - try to run "netstat -f" command during such TeamViewer session. I bet you will see at least one connect...

Yeah, "Dozens of possible solutions actually." - but why to use unnecessarily complex solution, instead of one cheap/free VPS, one SSTP VPN and two NATs and quarter of hour total deployment time? TeamViewer specifically is not a free product. AWS VPS is totally free for one year. Enough ti...

AWS is not necessary, you can use any VPS. Consider AWS only as example. Generally, 1 shared core and 128MB RAM (plus public IP) is enoung for running a Mikrotik CHR (https://wiki.mikrotik.com/wiki/Manual:CHR#CHR_has_been_tested_on_the_following_platforms:) instance. Such VPS could be obtained for a...

With some basic networking knowledge/experience, you can deploy your own cloud controller on VPS using Microtik CHR instance - even AWS EC2 t2.micro instance (1year free ) is enough, including static public IPv4 address. Mikrotik CHR appliance is also free (https://aws.amazon.com/marketplace/pp/B01E...

Is the "certificate" option available in 6.44beta61 ?

It seems like CLI does not recognize this parameter …

[admin@ip-172-31-36-160.eu-west-3.compute.internal] > /ip ipsec peer set certificate=certificate.crt,ca_bundle.crt
expected end of command (line 1 column 31)

please post the whole config here (by /export hide-sensitive command)
please enable ipsec debug blog (by /system logging add topics=ipsec) command

and in case there is NAT between server and client: google "AssumeUDPEncapsulationContextOnSendRule"

Do you have proxy-arp enabled on your "bridge" interface? Hint: google "mikrotik sstp vpn proxy-arp" And please have a look at https://forum.mikrotik.com/viewtopic.php?t=114422 and search for "proxy-arp" string on that page. BTW, your ether2 is member of "bridge&qu...

Please see https://wiki.mikrotik.com/wiki/Manual:License#RouterBOARD_and_PC_license, section: Q:I lost my RouterBOARD, can you give me the license to use on another system? A:The RouterBOARD comes with an embedded license. You cannot move this license to a new system in any way, this includes upgrad...

Thanks for your explanation and report, so let's correct another bugs in your config. add action=accept chain=input comment="defconf: drop all from WAN" in-interface=all-ethernet is another buggy rule - first of all, like some rule mentioned in my previous post, this rule has also comment ...

Have you changed your passwords ? The most probable explanation of repeated hack is repeated using of previously leaked password.

Some bad news - your configuration deserves some fixes due to security reasons (and some simplifications to make it more readable, too.) First of all, add action=accept chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=invalid in-...

Please export your whole configuration here by ("/export hide-sensitive") command Also, make sure you have DSTNATed connections allowed in your firewall forward chain. add action=accept chain=forward comment="allow DSTNATed" connection-nat-state=dstnat connection-state=new in-int...

You should use "forward" chain instead of "input" chain. "Input" chain is linked only to packets which are terminated on your Mikrotik. "Forward" chain is linked to packets which goes through your Mikrotik. Or, from a different point of view, your intention is...

Q:How do i set an static IP on the WAN/ether1 interface of the mikrotik router? A:When the modem has DHCP server, do not need to set static IP, you can set mikrotik to act as dhcp client on ether1 by ip dhcp-client add interface=ether1 disabled=no default-route-distance=1 which is currently in your ...

Thanks for the picture. So, now it is clear that you want to use your Mikrotik as a router. Could you please add intended IP addresses to your picture (to all interfaces) ? It would be very helpful for further configuration. Here https://ibb.co/fyyAWU is my suggestion, you may choose another, but re...

Thanks for the configuration. What about the 192.168.0.0/24 on both brigde1 and WAN interfaces ? Each interface should be on different subnet.

You configuration is strange mix of AP only and AP+router configuration. First of all, do you want your Mikrotik to act as AP only, or as AP+router ?

Could you please export and post here the whole configuration ? (by "/export hide-sensitive file=config" command) ? Generally, bridge/PPPoE interface is a virtual interface upon physical ether1 port of your Mikrotik. When change to fiber modem, you should set correct addresses (or DHCP cli...

Are you sure that the device had obtained IP address from Mikrotik's DHCP ? Can you please attach a screenshot of IP/DHCP Server/Leases ?