MikroTik

jgellis

If you're still taking requests, please include CRS328-24P-4S+RM.

jgellis

I just upgraded and also ran into the same error. Perhaps my resolution will assist you in finding yours. In my case, I have an EoIP tunnel (running over VPN) from an external MT that was *Bridged* locally to an ethernet port. I was doing NAT and firewall filtering on traffic arriving from or depart...

jgellis

It works exactly as described. Why don't you describe what you are trying to do, what steps you took and what results you are seeing?

jgellis

You are part way there. How do you want to configure your customers, static, DHCP, PPPoE ? It sounds as if you have correctly configured the router with WAN IP and a public IP on LAN, you may have even setup NAT masquerade on the router (though it was not required). The final steps are to configure ...

jgellis

I did not use an enclosure, it was only a test setup. The new enclosure that will work is the CA411-711 http://routerboard.com/CA411-711 , or you can still find the original CA411U enclosure http://routerboard.com/CA411U for sale by doing a web or ebay search. As for cards or USB devices, follow the...

jgellis

To overcome the netwatch limitation, try the following which I have used as a work around in several other scripts. Create the desired script as a scheduler event (in this example it will be named "netwatchsch1". In your netwatch action, update the scheduled start-time to 1 second in the f...

jgellis

I have used the following work around in several other scripts, it may work for you as well (even to answer the netwatch issue). Create the desired script as a scheduler event (in this example it will be named "netwatchsch1". In your netwatch action, update the scheduled start-time to 1 se...

jgellis

Without knowing what cellular network you require support for, it is not possible to make a recommendation on USB stick that will work. I have successfully used the RB411U http://routerboard.com/RB411U (also http://routerboard.com/RB411UAHR will work) with a mini-PCIe 3G modem. The sim card slot is ...

jgellis

Almost all RouterBOARDS have matching indoor cases that have knockouts for swivel antennas or SMA/N-Female bulkheads. Wall mounting sometimes requires adding your own screw holes.

Provide the exact model of RB you wish to use, and I can provide you more specific details.

jgellis

The suggested masquerade NAT rule is incorrect. You should specify src-address of CUSTOMERIP instead of dst-address. Additionally, if there are multiple public IPs on this router, you will need to specify which one to appear as using the src-nat action instead of masquerade. Last, the web server wil...

jgellis

http://wiki.mikrotik.com/wiki/Upgrading_RouterOS

jgellis

http://wiki.mikrotik.com/wiki/Manual:System/LCD contains a list of compatible devices.

jgellis

Instead of 2 bridges, add all ports to a single bridge, enable the use of ip-firewall in bridging and filter traffic in ip firewall by the use of the in-bridge-port and/or out-bridge-port rule matchers. This will let you control which traffic is accepted or dropped to each port. Alternately, leave t...

jgellis

You can issue a

/sys pack pr

from the command line and look to ensure that user-manager is both installed and not disabled. You can also verify that the ip address is correct.

jgellis

First recommendation, upgrade to latest stable release (5.24). You must only install packages that are the same version as the currently installed system package (with the exception of Dude.npk) If you wish to stay on 5.19, then do the following: Download the 5.19 zip file containing all packages fr...

jgellis

I must be missing your point, as I do not see the problem. Remember that within Queues, the upload/download are from the host's perspective whereas receive/transmit are from the interface's perspective. upload/receive=speed at which data arrives at the target-interface=speed at which host sends data...

jgellis

The PUBLICIP in your command will also need to exist as an address on the router performing the DST-NAT and "ip services" cannot have anything enabled for port 443. Additionally, remember that NAT can not return out the same interface that it arrived in from.

jgellis

It still sounds like the 182.73.40.144/28 is being routed to your device at 182.73.41.138. In it's simplest configuration, you can have 13 devices beyond your router that get a public IP. Your router should have a WAN of 182.73.41.138/30 and a LAN of 182.73.40.145/28 (do not use .144, that is the ne...

jgellis

Mikrotik's built in Webbox and Hotspot portal are not full blown web servers. You cannot run PHP/CGI/etc. from within.

External server is your only choice to accomplish this.

jgellis

While Policy Based Routing will work, it is the more CPU intensive and long way of doing it if you are only redirecting a specific network subnet or two. The method I provided does not involve any mangling. But you've got your solution, so good enough.

jgellis

If I understand your request correctly: If PPPoE gateway is statically set: /ip route add gateway=<pppoe gateway> routing-mark=PPPoE If the PPPoE gateway is learned dynamically, install the optional Routing package and create a routing filter: /routing filter add chain=dynamic-in distance=1 set-rout...

jgellis

Strong passwords on all trunks and extensions, NO EXCEPTIONS! ACCEPT your SIP termination provider IPs through port 5060 if they do not use an outbound registration string. DROP all other port 5060 traffic destined for your PBX. If your IP phones are on the WAN instead of the LAN, use a VPN to bypas...

jgellis

ditonet is correct. The "number" attribute you see when printing in the terminal (i.e. 9 in your script) is not a configuration item on the nat rules. They are generated during a print command only. To set or get any values in a script you should always use the [find] command to narrow you...

jgellis

I doubt the CPU would ever give you problems in your situation. We passed hundreds of Mbps through RouterBOARD devices long before switch chips were introduced into the products (also before the higher powered CPUs of today).

jgellis

/interface wireless spectral-scan duration=20 range=5ghz save-file-name=remotescan

jgellis

We saw this several times under one of three conditions: when cables were not terminated properly (poor connection to passive power pins) when water had entered the outdoor enclosure and pooled in the darn RJ45-ECS (the pins would rust, short, arc and melt everything in the very near vicinity) bad P...

jgellis

Quite simply, you are pinging a local address to your laptop and the RouterBoard is in switch mode. The router is not involved and thus your DROP rule does not matter. FORWARD chain is only for packets going through the router CPU (i.e. to another network or if Bridge Firewall is enabled). Laptop1 d...

jgellis

PCC will work with any number of "ADSL". Assuming that you have tested the 7th line without PCC (i.e. you confirm that the dialer is correct and traffic is NATting to the internet just fine), please paste the output of the following three commands (executed separately): /ip firewall mangle...

jgellis

The following should work for you... When creating ca.key, the CN could be: <domain.tld> When creating server.key, the CN *should* be: <IP of server> When creating client.key, the CN could be: client.<domain.tld> With the exception of the server.key being the IP address, the other two can really be ...

jgellis

At this point (when pptp client is successfully connected) if you will try to ping any workstation form the laptop, ping will time out, because Laptop is unable to get ARPs from workstations. Solution is to set up proxy-arp on local interface Execute the following command from the terminal: /interf...

jgellis

If you have a backup, it's fairly simple to decrypt the passwords: http://mikrotikpasswordrecovery.com/ If no backup, but it's an x86 install, use a live CD to first recover the password file and then go to the site above. Details to use live CD are here: http://aacable.wordpress.com/2012/01/14/howt...

jgellis

Bonding (mostly) broken in 6.0rc11 Tested with 6.0rc11 and then again with 5.24 to confirm broken behavior. Tested with active-backup, 802.3ad, balance-rr and balance-xor. Tested with layer 2, layer2-3 and layer 3-4. Under 6.0rc11, regardless of bonding mode or transmit-hash-policy, the divison and ...

jgellis

Well now I'm not understanding your question at all. You first asked how the console cable was to be wired, now you say it is "lost in booting" and that you cannot get Putty to work with that cable. There is no serial port on the RB2011LS-IN, no console cable or putty (serial) access will ...

jgellis

I like Davis's comment:

use your equipment physicaly inaccessible by end users for this

and clarify that most of the custom configuration items could be controlled through the use of PPPoE and Radius, resulting in no *useful* secrets being stored on the boards.

jgellis

My last two suggestions: Save the output of /system default-configuration print to a factoryconfig.rsc text file. Upload this to the router and execute a /system reset-configuration run-after-reset=factoryconfig.rsc -OR- Do a Netinstall without keeping configuration and without configuration script....

jgellis

Which router is closest to the internet? If A, then: RouterA: /ip route add dst-address=192.168.100.0/24 gateway=192.168.1.1 RouterB: /ip route add gateway=192.168.1.2 RouterC: /ip route add gateway=192.168.100.1 If B, then: RouterA: /ip route add gateway=192.168.1.1 RouterC: /ip route add gateway=1...

jgellis

I may have jumped the gun in responding to your first question.. That pinout *is* correct for the Cisco console cable (which the newer RouterBOARDs utilize), but the none of the RB2011L series have a serial port. What RJ45 port are you plugging this into, or did you misreport your model number? If, ...

jgellis

That's correct.

jgellis

You will need to declare the variables in your "downloader.rsc" script before you run the imports.

#script begin
:global callbackHost
:global CID
:global SID

/import global-identity.rsc
.
.
.

jgellis

Use NetInstall with custom configuration script. ANytime the reset button (or /system reset-configuration) is used, it will revert to the last configuration applied during NetInstall.

jgellis

Use NetInstall with custom configuration script. ANytime the reset button (or /system reset-configuration) is used, it will revert to the last configuration applied during NetInstall.

jgellis

System reset will always revert to the last configuration applied by Netinstall. If you no longer want your custom config to be the reset state, NetInstall again with either a new custom config, or none if you want a blank slate. /system default-configuration print will show factory default configur...

jgellis

http://forum.mikrotik.com/viewtopic.php?f=13&t=68131

jgellis

My apologies, I do not have a 2011 to verify against. The master-port is to setup switch groups in the hardware switch chip. Doing so will offload switching functions from the CPU. The "master-port" is the only one that needs to be further used in configuration settings when referencing th...

jgellis

Dual-WAN setups are the most common question I answer on the forums, nearly once or twice a day. Short of using the search feature on the forums to locate the information you need, set the "distance" on the default routes such that your preferred provider has the lowest number and enable t...

jgellis

Interface routes are for PtP links ONLY and therefore would NOT need IP addresses assigned and will also NOT be considered when selecting next hops. While you may believe that a/30 is PtP, it is actually 4 address; a network address, 2 host addresses and a broadcast address. [*]Routes with interface...

jgellis

Using my example above, this is not a concern as Watchdog has a built in delay setting which defaults to 5 minutes if not specified.

jgellis

From the GUI? Click "New Terminal" :D Seriously though, follow my script and poke around, this is how one learns! The command line pretty much lines up with the GUI... /queue simple add max-limit=256k/512k target=ether1 Click on "Queues", "Simple Queues", "+",...

jgellis

Example to create 512K download /256K upload (as viewed from client) at each port: /queue simple add max-limit=256k/512k target=ether1 add max-limit=256k/512k target=ether2 add max-limit=256k/512k target=ether3 add max-limit=256k/512k target=ether4 add max-limit=256k/512k target=ether5 They are list...

jgellis

/system watchdog set watch-address=ip.address.goes.here

jgellis

I just answered this for another user this morning:
http://forum.mikrotik.com/viewtopic.php?f=13&t=68131

jgellis

Back side of router (roughly behind ether7): http://routerboard.com/pdf/423/rb2011U-qg.pdf

jgellis

Only you can really answer that question. Consider the following thoughts/rhetorical questions: With more services being offered (even free) in the cloud, upload is becoming just as important as download since the data must be presented on the viewers side, but processed on the server side. TCP send...

jgellis

I don't have a RB751 or work out of China, so use at your own risk. If you block UDP/53, as above, it *should* attempt on TCP/53. Don't forget to change out-interface, as appropriate. /ip firewall filter add chain=output protocol=udp dst-port=53 out-interface=ether1 action=drop add chain=forward pro...

jgellis

I have many posts on the use of dyanmic IPs used in both load balancing as well as active-backup scenarios. The simplest, active-backup failover that you are trying to accomplish, can be obtained by creating two static routes, each to a single address reachable via one of the providers. I like to us...

jgellis

The RB2011UAS-2HnD-IN ( http://routerboard.com/RB2011UAS-2HnD-IN ) has everything you are looking for except 5Ghz and one USB port and it's available at a fantastic price point! The D510 is 6x the price (which seems quite expensive for home use) and doesn't carry 6x the specifications of the RouterB...

jgellis

At first I was inclined to reply that 80Mbps/5Mbps would be plenty for 350 users in a student environment, then I caught the hostel part and am not so certain. The 80Mbps down would probably be acceptable, the 5Mbps upload seems rather low. If symmetrical is not required, I would look for download t...

jgellis

You are looking for the firewall filter switch "in-bridge-port" and "out-bridge-port". I think you might already have figured out most of the configuration, so perhaps you just need to examine the very last line in my example below. /interface bridge settings set use-ip-firewall=...

jgellis

Very easy to do, doesn't even *require* Netwatch or scripting. Simplest form of failover when using DHCP-client on multiple WAN interfaces... use the default-route-distance option in /ip dhcp-client. Make all clients have unique values and in order from lowest (most preferred) to highest (last resor...

jgellis

I had Dude databases around 2GB In size when monitoring ~400 devices for ping and an additional 30 devices for snmp throughput and wireless registration details, I also used it to collect syslog messages from around the network, but logging was minimal. I would *never* consider a RouterBOARD to host...

jgellis

/tool user-manager user set [find customer=tom] customer=roger

jgellis

You can shorten any command that would not create an ambiguous result, a

/system reset-configuration

is the same as

/system reset

or even as short as

/sy rese

jgellis

Connect your ISP modem/router to a switch, plug 5 of your 9 RouterBOARD ports into the switch. But the real question is WHY? Why do you NOT want the servers to get their own IP addresses? Picture the following: ether1=WAN ether2=LAN ether3-ether4=empty ether5-ether9=DMZ (Servers) bridge ether1 &...

jgellis

Theoretically, 65536 hosts could be NATd through one IP, realistically, around 4000. This is of course assuming your firewall specifications have enough ram/CPU to manage the connection tracking database as well as Internet throughput to handle the sum of all traffic. Above response also applies to ...

jgellis

2nd - (different box) I want to be able to configure virtual access points that are either rate limited with regard to their WAN connection (wired ethernet port this time) or have a virtual access point be disabled/deleted after a certain amount of traffic has been passed over the virtual access po...

jgellis

So many possible answers with so little information...

Try the guide here:
http://wiki.mikrotik.com/wiki/How_to_co ... ome_router

jgellis

The 2011 series has several options that include SFP:

http://routerboard.com/RB2011UAS-RM
http://routerboard.com/RB2011UAS-IN
http://routerboard.com/RB2011UAS-2HnD-IN
http://routerboard.com/RB2011UAS-2HnD
http://routerboard.com/RB2011LS-IN
http://routerboard.com/RB2011LS

jgellis

First off, if I understand correctly what you are reporting someone else told you to do already, it was poor advice. Since you only receive the 5 addresses that are within a /29 from your ISP rather than having the entire /29 block *routed* to your MT, assign the public IP 200.190.xxx.123 directly t...

jgellis

You don't need a serial console in order to perform Netinstall.

The 2011L series do not have serial ports.
The 2011 (non-L) series have an RJ45 console port on the back of the device that utilizes a standard Cisco console cable pin-out.

jgellis

RouterOS v6 includes the dhcp-server lease-script command. Very little/no documentation exists, so try the following in a controlled environment first. Due to lack of documentation or lack of features, it may not be able to provide details on the specific lease that was just obtained, so the below o...

jgellis

You could use Hotspot and direct all traffic through the proxy, turn off payment requirements and modify the login page html as appropriate for your use. This would, of course have some effect on existing Hotspot configuration, if you are using that as well.

jgellis

Your message asks how to block traffic by MAC, though I'm not certain why you wouldn't filter by IP. If you are looking to filter by IP see the writeup on DDoS Detection for ideas: http://wiki.mikrotik.com/wiki/DDoS_Detection_and_Blocking If you are looking to filter by MAC, then you will need a scr...

jgellis

First, PDF is not in the default list of firewall layer 7 protocol matchers, so it must be created: /ip firewall layer7-protocol add name=PDF regexp="%PDF-1\\.[0123456]" Next, you must use this matcher in a firewall filter rule and I'm not sure exactly which direction you view as uploading...

jgellis

RB2011 reset and Netinstall is documented in the quick guide here: http://routerboard.com/pdf/409/rb2011L-qg.pdf To Netinstall: Start Netinstall software, hold reset button on back, apply power, wait 5 seconds or longer and release. The RB should show up in Netinstall. To factory reset: hold reset b...

jgellis

Create your desired config and export it. Clean up this export to remove unique items such as mac-addresses, license, etc. Use Netinstall to reinstall ROS and instead of keep old configuration, check the option to use a "Configure Script" (the one you cleaned up). Now, anytime you do a /sy...

jgellis

I use VLAN trunking between my RB600 and My Netgear GS724T, while the RB600 does not have the switch chip that the RB2011 does, the configuration is the same. For some of my VLANs, I do have IPs assigned, as I want to reach the MT router on that address/vlan, if you only want to bring the vlans to t...

jgellis

I'm sorry, I don't have a 2011LS to verify, but the spec sheet says it has no voltage monitor, no PCB temperature monitor and no CPU temperature monitor ( http://routerboard.com/RB2011LS ), so I'm not sure what else you expect to see in system health. The RB600, 800 and 1000 series (and possibly oth...

jgellis

We used Ubiquiti's SR71-15 in our Routerboards. http://dl.ubnt.com/sr71_15_ds.pdf Not precisely the same level of power output (2 to 4dBm lower), but you really are much better off turning down the power on your radios and installing better antennas. You can achieve better long distance link perform...

jgellis

To confirm, you either: uploaded the required packages via Winbox to Files then selected "Downgrade" from the Packages GUI uploaded the required packages to the MT and then issued a /system packages downgrade selected the device in Netinstall first, then selected 5.23 and performed the Net...

jgellis

I must not be understanding the whole scenario, so can you clarify for me... Are you trying to ping 10.1.1.3 (the MT vlan2 IP) from the same MT (that has 172.17.1.254 configured as vlan3) or from an external device? If from the same MT, you're right, there is no reason the MT shouldn't be able to pi...

jgellis

Unfortunately, NAS is not an option. RouterOS can only use a "store" that is locally attached. See here for details: http://wiki.mikrotik.com/wiki/Proxy_on_ ... rnal_drive

As for license level, I already laid out all the details in my previous post.

jgellis

Absolutely. Create additional specific routes for the EoIP endpoints (a more specific route is always preferred to a default route) or create additional default routes that utilize routing-marks. I have several other posts on this very process, but here is the shortened version for you. Create two s...

jgellis

First, I do not use the built in user-manager, so use the following at your own risk... I believe what you are looking to do can be accomplished with the following scheduled script set to run at regular intervals: /tool user-manager user remove [find credit-left=00:00:00] I find very little document...

jgellis

Hopefully you have not already spent the money on the RB1200 with that use in mind. Comparably priced Mikrotik products that might meet your needs: RB1100AH (has a micro-SD slot, though flash is not the best choice for proxy cache) RB800 (has a CF slot that can utilize microDrives which are real har...

jgellis

I feel like replying to really old topics today, so here goes. PPPoE by definition is a point to point interface. It cannot be added to a bridge because it is only supposed to talk to one other device! Try making your scripts smart like so: Lets say that only one pppoe connection is established at a...

jgellis

Having blocked out the first octet, one cannot answer if these are public or private addresses. By your description, the WAN is /30, which is only two usable addresses (one for the gateway and one for your router). By definition, the LAN should be a local only network and since it is a /28 would be ...

jgellis

I accomplish this by calling the script from the scheduler. Create a scheduled script called "SchScript2" to run at startup that contains one line: /system script run test2 Now, modify your first script, replacing the above code with: :local newstarttime ([/system clock get time] + 00:00:0...

jgellis

I'm not sure exactly what you are asking. The Dude works perfectly in a routed environment to monitor CPE or AP devices. If you are trying to monitor remote devices behind a masquerading Mikrotik router, just install the optional Dude.npk package and set it up as a Dude agent for those devices behin...

jgellis

You cannot create new graphs other than what is built into ROS. To do the kind of graphing you seek, check out an external tool such as the Dude (http://www.mikrotik.com/thedude) or Cacti (http://www.cacti.net)

jgellis

The RouterBOARD 1200 has no storage expansion capability whatsoever.

jgellis

I'm guessing you are seeing hundreds of forged DNS queries requesting information about isc.org, which would be indicative of a DDOS attack against the purported requestor, of which they are using your device to participate in the attack. But not being entirely sure what "this attack" you ...

jgellis

Your WAN address is a /30, which is only one address for your upstream gateway and one address for your router. You have no other free addresses to allocate to a "client". You *could* dst-nat all inbound connections to that IP out to the "client" so that they could run a server, ...

jgellis

A quick glance at your first script looks like it is designed to set routing-marks on dynamically learned gateways. If that is your desire, here is how I accomplish the same, without scripting, using native ROS features available with recent versions. If your dynamic assignments are via DHCP, set th...

jgellis

Connection tracking does not concern itself with whether a NEW/ESTABLISHED/RELATED/etc connection originates from "inside or outside". A firewall will protect whatever you tell it to. That could be preserving your upstream bandwidth by blocking internal traffic from getting to the internet...

jgellis

Well I ended up running into this exact same issue with Routing Tables today and following my own advice proved fruitless! A reboot cleared the temporary table names that are not stored in the config but still mysteriously show up in Winbox. Hopefully the same holds true for your address-list that i...

jgellis

Thanks, but no. The only "function in that script changes the month from 3 letters to it's respectively number via simple array look up. While that would be the first step in a manual date arithmetic function, it is far from the complete answer. If I do feel like finishing this arithmetic funct...

jgellis

I am intimately familiar with the intricacies of securing SIP in these situations. 3) Permit : for the IP-PBX - I have tried to set up rules in my RB750 that will ONLY allow the forwarded packets (from ISP router) addressed to the IP-PBX port 5060 IF they have a SRC address of my IP-telephony provid...

jgellis

I am closing this request for support as follows, as I don't expect the forum to be able to correct for Conmcast's behavior. :) Comcast is intentionally ignoring the published behavior in the RFC (no surprise there). RFC 2131 4.3.2 reads (in part): DHCPREQUEST generated during RENEWING state: . . . ...

jgellis

Not natively, but if you provide some more detail on what you want to use the mac-address lists for, perhaps we can give you some direction on alternatives.

jgellis

Check the following in the WinBox Loader... The behavior I think you are asking for requires the "Load Previous Session" option to be active in the Loader before connecting. There have been issues in the past of the saved sessions getting corrupted. To resolve, deactivate the above option,...

jgellis

You mention that you bought this device for security, but yet it seems you have bridged the WAN to the LAN? While you could still do some filtering, this may not be what you intended. Most ISPs provide you with a limited number of public IP addresses. In order to share this address or addresses, you...

jgellis

As with traditional electrical grounding, telecommunications networks and equipment should be grounded to the electrical service. However, simply grounding to structural steel isn’t enough when tackling telecommunications systems. The sensitivity of the electronic equipment requires that the telecom...

jgellis

A route with an interface specified instead of a gateway IP will not be used for NextHop lookups. This is by design, as without an IP, it can only communicate on a Point to Point link, meaning there is only one host at the other end of the interface. If you are receiving the IPs via DHCP and using t...

jgellis

Your logic is correct, the address-list name will appear as a drop-down in Winbox if it is mentioned *anywhere* in config. When you exported, did you export the entire config, or just the firewall section? If the address list contains anything other than alpha numeric characters (like a hyphen), it ...

jgellis

This is just the way they are rendered in the cmdlin editor. If you were to export the script to a file and view it on your PC/Mac or edit it in Winbox GUI, you would not see the extra line breaks. This is not an issue with your choice of Wine or ssh/telnet client as the same behavior is exhibited f...

jgellis

Mikrotik Bursting does not quite work in the method you desire. It samples the average bandwidth of the last 16 samples (i.e. if your burst time is set to 16 seconds, the samples would be taken every 1 second, if it was 8 minutes, the samples would be every 30 seconds). If, during or after 16 sample...

jgellis

If you have multiple upstream gateways and multiple remote bandwidth-test host IPs, you could implement static routes to those other bwtest hosts via the different upstream gateways which would be more specific than the default route. Alternately, you could use firewall mangle to apply a routing-mar...

jgellis

It is not possible to do it natively in ROS (you cannot redirect the output of /tool traceroute to a file or variable that could later be written to a syslog, file or web server). You *could* implement it from a remote server that performs an SSH into the box and executes the traceroute from the cmd...

jgellis

Several ways to achieve this, depending on your desired results. One would be to implement policy based routing in which you need to Firewall>Mangle all of the VPN destined subnets to apply a Routing-Mark, after that you would need to add another default gateway that has the same routing mark. All m...

jgellis

Add the following into the Netwatch Up tab in Winbox: /tool e-mail send to=xxxxxx@gmail.com subject="this host is now up" tls=yes from=xxxxx@gmail.com body="the client of ny is now up" server=74.125.25.109 Likewise for the following to the Netwatch Down tab: /tool e-mail send to=...

jgellis

Blocking DNS requests that are not explicitly allowed is a good practice. It will keep your router's DNS cache from filling up with unexpected queries and it will preserve your bandwidth for your customers instead of public entities. Assuming your concentrator sits fully between your customers and t...

jgellis

This is not a problem with receiving the same IP as presently assigned (which is the RFC behavior specified if the address hasn't been reallocated elsewhere). The problem is that Winbox or command line renew requests result in NO CHANGE to the lease or the creation of DHCP request/offer/ack/nak mess...

jgellis

I have a RB600 running the latest ROS (although tested with 5.14, 5.23 as well as 6.0rc7) in which the following problem occurs. I have two internet providers, both providing DHCP public addresses to separate physical ethernet interfaces. I can test the problem below with either provider individuall...

jgellis

I have a need to perform date arithmetic, but cannot find a method native to ROS, can anyone shed some light on a native process before I go scripting the math manually? The first date is obtained as [/system clock get date] I want to add either a standard time (i.e. 2d12:10:09 or 36:10:09 or 12:10:...

jgellis

There is absolutely nothing wrong with that line, at least up through version 5.14. If you understood the scripting :pick and :find commands, you would realize that should not be removed. The :pick command is taking a sub string from the signal strength result which looks like "-61dBm@54Mbps&qu...

jgellis

Will there be a RB2011LS-RM or alternatively, a RBRMK for the RB2011LS ?

jgellis

Will any of the new RB products (specifically the 1100AHx2) support balance-alb ? If so, will it be on all interfaces, or will only some of them support it?

jgellis

Am having a few issues with an upgrade to 4.0b2 from 3.6. The issues are around REMOVED features. What happened to Outage Notes? Where do we set custom chart appearances now (i.e. background/line/font colors, not global and not the data sources themselves)? Why is 4.x not backwards compatible with 3...

jgellis

Thanks for all the much needed updates! As for SQLite3 though, I cannot read the data unless Dude is completely shut down. Even using SQLITE3_OPEN_READONLY, I get denied because the database is locked. SQLite is supposed to be able to handle concurrency with the exception of simultaneous writes, whi...

jgellis

First method, NAT between the public network and the private to allow communications from a specific external IP to access the internal (second) Mikrotik. Second, better, method. Install the optional Dude package onto your main router. Configure it for security, but do not add any devices to it. On ...

jgellis

If you read the whole failed message, I'm guessing you see:

failed: License key is up to date!

That is a good failure.

jgellis

There are no Routerboards with DSL modems built in. You would connect your DSL modems to the Routerboard via ether or build an x86 machine perhaps with PCI or similar DSL cards inside and install RouterOS onto the box. The Dude is a free server and client app all in one. It does not require any Mikr...

jgellis

Your GPS NMEA string is tripping up the bootloader.
The following is well documented throughout the forums and should resolve your issue.

/system routerboard settings set silent-boot=yes enter-setup-on=delete-key

jgellis

Let's call the 2.4 wlan2 for discussion. Bridge2 can be removed, it is not needed. The following are the minimum configurations, more detailed settings can better secure your network. Do the following: /ip address add address=10.1.0.1/24 interface=wlan2 /ip pool add name=pool1 ranges=10.1.0.2-10.1.0...

jgellis

Is it possible that one or both of your ISPs are blocking external DNS queries? If so, requests to DNS1 that were "load balanced" out ISP2 would get rejected (and vice-versa). A workaround would be to create two or more static routes ensuring that the DNS traffic destined for DNS1 only goe...

jgellis

On RB1000, you will need two static Public IPs (can even be in same subnet) assigned to single WAN interface. On RB433, you will need one Public IP from each of your two ISPs assigned to each of your two WAN interfaces. On RB433, create static route for RB1000 IP1 to go out WAN1 gateway address. On ...

jgellis

No specifics yet, but looks like the New Product Announcement in today's email explains it:

"RB1100 13-port gigabit rackmount router"

jgellis

Looks like the New Product Announcement in today's email explains it:

"RB1100 13-port gigabit rackmount router"

jgellis

After a short review of your intended action, I do not believe this is possible. I did come up with an alternative though. Do not use the Dude hosting MT as a DNS server for your clients! If the client DNS is set via DHCP, change the DHCP network settings to point to a different MT or DNS server. On...

jgellis

The API can certainly be used to accomplish what you are looking for. At the very top of this forum, there is a sticky topic to API Examples. In addition, the following may provide you with some insight into what commands you may be able to execute from within the API: http://wiki.mikrotik.com/wiki/...

jgellis

Netwatch is useful if your link is very reliable as it performs it's actions based on the results of a single ping attempt. It's also useful because it's quick and easy to implement. For a more versatile and failsafe way to do ping monitoring, check out "Better Netwatch", here: http://foru...

jgellis

Is there a way to set tx-power without loosing the connection?

Unfortunately, no. Any changes to tx-power (from either end) cause the wireless interface to stop and restart, resulting in a reconnect by the clients. Luckily, the reconnect only takes a split second.

jgellis

RK, It was great chatting with you and I hope you enjoy the script. It was thoughtful of you to pay for the work and then let the community benefit from it freely. If you or anyone else should have a need for advanced MT scripting and design, please do not hesitate to call on me! -John INSTALLATION ...

jgellis

RK, I have created a script to meet your exact specifications (well I had to add a few specs that were critical, but not considered). Please contact me via AIM (see profile) if you would like to proceed. The script features the following: Global variables to set desired minimum dBm (default=-85) as ...

jgellis

Exactly what you are looking for is available in Dude. Once you add your devices to be monitored into Dude, you can even view all wireless registrations across all Dude devices, on one screen! From there you can right-click and open in Winbox.

jgellis

You may only ping (or perform other actions) from another device if that device is a Dude Agent. To be a Dude Agent, a device would need to be running Windows with Dude installed, or be a capable RouterOS device with the optional Dude package installed. Once the device is ready, you can create the A...

jgellis

Maybe I'm not reading your post correctly, but here's my piece based on my understanding of what you are trying to accomplish... FTP only uses ports 20-21 to setup the connection, after that it switches to a random high port. Instead of trying to explicitly ALLOW FTP from internal addresses, it woul...

jgellis

If the entire /27 is routed from your ISP to your MT, you can do whatever you want from the MT and beyond. You could make one /28 and two /29, four /29, eight /30, etc. I suggest you go here to calculate your subnets: http://www.subnet-calculator.com/ Additionally, it would help to read the RouterOS...

jgellis

I have one RB133c that returns a "bad id" whenever I try to perform a bandwidth-test internally. I can successfully perform the test from any other 133c to the same targets, but I get the error from this particular one when attempting to test to any target. I tried it with a mix of ROS fro...

Search found 139 matches