MikroTik

robmaltsystems

Many of those posts are several years old and appear to focus mainly on IPSEC?

robmaltsystems

>Where does the public IP fit in while talking about OpenDNS blocking? It uses the public IP address to link to your account to determine which sites to block. So it's not possible to have two blocking lists behind one public IP address. I've got a ticket to look at alternatives to OpenDNS/DNS block...

robmaltsystems

>but if you want to become an anonymous on the internet and you want to hide your actual IP address, then you have to use a VPN There was actually an ulterior motive behind my post. I was interested in the mechanism by which the public IP was determined but it was triggered by a client wanting to ha...

robmaltsystems

So at some point, NAT stops when it gets out onto the single network that is the public internet and the last "Source IP" address in the IP packet will be the public IP?

robmaltsystems

Whilst this isn't a question about MikroTik really at all, I thought I'd ask it here as I find there are some pretty switched on people on the forum. I've got a reasonable understanding of how routers work but one thing I've never worked out is how the various methods of discovering your public IP a...

robmaltsystems

I had to upgrade the firmware on managed Netgear switch yesterday. That wasn't fun! But that just shows that it's all about familiarity and the general level of support/understanding. It was hard on the Netgear because it wasn't obvious - was looking for "Upgrade firmware" in web.

robmaltsystems

The point I was trying to make, poorly, is that my suspicion is that a vast majority of Cisco switches are underused, functionality wise. In fact, most switches are just, err, rather boring switching devices delivery packets around the network.

robmaltsystems

"phones on the desk" are gone already for some time now. Hmm, I'm not so sure although one plus (ha!) of the pandemic is that desk phones have rarely followed people home and their business has continued to communicate. I got a gold star for recommending my client got rid of them - lucky ...

robmaltsystems

>In the first quarter of 2020, Cisco had a share of 52 percent of the global market Ethernet switch market, I know that switches can have all sorts of features what with all the layers, VLANs etc. But don't the majority of then end up just switching packets as fast as possible around the LAN? Now ro...

robmaltsystems

Aside - anyone else think that massive PoE switches are on the danger list with the use of physical handsets being on the wane? My largest client moved office just before the pandemic and I finally got them to dump the handsets. They've gone pure Teams telephony with USB headsets and/or using their ...

robmaltsystems

So yes ... they pack a lot of performance.

Should jolly well hope so for £3,500!! Do Mikrotik do a 48 port switch? I can find MikroTik CRS328-24P so would need two for £750. Serious question, what extra does the Cisco Catalyst 9300 bring to the table?

robmaltsystems

x86 (I think they are possibly x64?) enough said. That's high-horsepower. You could do a bunch of things that's not possible on arm, arm64, MIPS etc

Although that gap is closing rapidly... Apple wouldn't drop Intel for ARM if they weren't sure their own bespoke chips could compete.

robmaltsystems

Don't they understand CPU cycles or what? Generally, no - people don't tend to realise that network devices are computers with a CPU, RAM, storage and IO with inherent resource constraints. I fell slightly into this camp until I started learning RouterOS in more detail and started to realise how it...

robmaltsystems

As an example I was directly involved in 2019 biggest ransom attack

On the right side I hope? ;-)

robmaltsystems

They make profit from selling Cisco and they keep their internal capability/knowledge footprint limited to Cisco. A valid point. I don't disagree but it doesn't make it "right" in the scheme of things :-) Technology history is littered with tales of upstarts beating the big boys. The reas...

robmaltsystems

https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

Thanks - ticket raised to read and digest later.

robmaltsystems

>1.MT is capable of everything I've never really spent much time with high-end Cisco equipment so really can't comment on functionality but yes, it does appear that RouterOS is a very capable system. I did used to manage Juniper firewalls and to be honest, I prefer the RouterOS/WinBox interface. >2....

robmaltsystems

>winbox, ssh, telnet, ftp, www, api, mac telnet/winbox/ping server, etc

Is there an article on hardening a Mikrotik router? I thought that is was pretty hardened by default from the WAN side?

robmaltsystems

This might not be the same problem but I thought I'd bricked a single-port mAP lite when I factory reset it. Except when I twigged that a non-CAPS factory reset configures it as a router and therefore you can't connect using Winbox and a wired connection (firewall blocks you). However, you can conne...

robmaltsystems

honestly: I like Mikrotik products for their versatility and flexibility. But for large scale and support I need other solutions. Same here but as I'm a one man band supporting small companies where we're installing a router, small PoE switch and a handful of access points, then Mikrotik is a good ...

robmaltsystems

>The organizations that don't do this are the ones that you read about every day where the entire network infrastructure is encrypted for a ransom.

Isn't that usually by an exploit in the OS and/or users unwittingly installing the ransomware software? Not a compromised network?

robmaltsystems

To me, it's just ignorance and many times arrogance. Yup - it's the age-old "You never get fired for recommending Cisco/IBM/SAP" etc. Although familiarity and support of the equipment is an important requirement as salary costs are usually way higher than hardware over a longer period. I'...

robmaltsystems

PPS. Also appreciate the hAP ac lite doesn't have the fastest of CPUs either ;-)

robmaltsystems

Bit of an idle question. Experimenting with an hAP ac lite and carried out a speed test. Laptop hard wired to router is getting 85Mbps download speed (internet backbone is 220Mbps and rest of network is Gbe). I appreciate it's not going to go over 100Mbps as that's the limit of the Ethernet ports on...

robmaltsystems

Confirmed - the correct way to disable an interface/access point is to remove it from CAP interface and re-provision later via Remote CAP.

robmaltsystems

That easy ;-) I was expecting some kind of DateAdd kind of function.. Thx!

robmaltsystems

PS. On a similar subject, anyone help with the syntax for /log print to show just the last 15 mins? Or the last 10 lines of the log?

robmaltsystems

Does RouterOS have command alias? I'm finding myself typing /log print where topics~"script" a lot so being able to alias it to say (ql) would be lovely.

robmaltsystems

And Wi-Fi interfaces aren't right... I guess the right answer here is to /export, reset without configuration and bring run exported script?

robmaltsystems

Although answering my own question, possibly not a good idea as I can see lines like this: set [ find default-name=ether1 ] mac-address=48:8F:5A:60:9B:78 set [ find default-name=ether2 ] mac-address=48:8F:5A:60:9B:79 set [ find default-name=ether3 ] mac-address=48:8F:5A:60:9B:7A set [ find default-n...

robmaltsystems

Is it okay to transfer the configuration backup between identical hardware? All devices are on the same software version. Just a bit worried that MAC addresses are in software and we'd end up with devices with the same MAC addresses which would be bad news

robmaltsystems

The article linked to above has been deleted so one does assume it was out of date.

robmaltsystems

Thanks normis - I had seen the "Remove" button but that seemed a little too drastic and I wondered how you'd re-add. Will try this later.

robmaltsystems

I was pleased to find capsman as having coming from UBNT with their controller software, I wasn't particularly looking forward to managing a larger install. Not as pretty as the UniFi controller but who needs pretty when all you want to do is upgrade the devices centrally. Which is all I really do w...

robmaltsystems

Ahh thanks - will try that later.

robmaltsystems

The red cross isn't enabled on the CAP interface list...

robmaltsystems

Doh - ignore me... I assumed control channel width was the setting I was looking for but that's something else. One has to disable the extension channel...

robmaltsystems

This is how I've got the channel configured:

But Wi-Fi analyser on my phone shows it's steadfastly 40MHz wide:

What am I missing?

robmaltsystems

>/export hide-sensitive file=anynameyouwish

Those RouterOS developers really do think of everything

robmaltsystems

My journey into the fun world of RouterOS continues. Not done a big install with Mikrotik yet but have a medium size one lined up so I've been researching CAPSMAN - nice :-) Not maybe as pretty as the UBNT controller but as with many things, does the job. Quick question - is it possible to disable a...

robmaltsystems

I tend to find there is nearly always a way to achieve what you want in RouterOS

robmaltsystems

Thanks for clarifying. Another piece of the jigsaw filled in.

robmaltsystems

Ahh thanks - yes that shows antenna-gain. I wonder why it's not exposed in the GUI anymore?

robmaltsystems

Later... if I run this command, I can then set country to UK: /interface wireless> set [find default-name=wlan1] antenna-gain=2 However, when I do /export of the entire config, there is no mention of antenna-gain - which is perplexing! As it's certainly now there as I can do this: /interface wireles...

robmaltsystems

hAP lite running v6.47.1. If I try and set the country to UK like this:

I get this error message but there is no box to specify antenna gain - which I've seen on other models:

robmaltsystems

Apologies for a pretty basic question about how switches work. My knowledge of networking is a bit like Swiss cheese - full of holes. Electronics and software development background means I can sort of grasp how things work :-) Want to clarify how a switch works. Am I right in thinking that when the...

robmaltsystems

Thanks Sob - very useful. Your first comment rings true as whilst my detailed knowledge of all things routing and switching is certainly full of holes, I get the general idea and as a programmer, I can just about grasp how it all works. So yes, it dawned on me too that the upstream router has no ide...

robmaltsystems

Sir you are a gentleman and a scholar! Such an easy fix...

Ohh hang on, spoke too soon - my mobile had fallen over to the private Wi-Fi not the guest...but maybe starting to bark up the right tree...

robmaltsystems

# aug/07/2020 18:13:07 by RouterOS 6.47.1 # software id = CQ0X-HGUZ # # model = RouterBOARD 952Ui-5ac2nD # serial number = 924C098FF96B /interface bridge add name=bridge-private add name=bridge-public /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add au...

robmaltsystems

This one has got me stumped... sorry for the detail. Not sure how to ask the question here simply. I've gone through (and mainly understand) the process here of adding guest Wi-Fi to a hAP lite configured in router mode: https://www.youtube.com/watch?v=6P0MDlYWR_E Out of the box configuration as a r...

robmaltsystems

Thanks xvo.... peace of mind.

robmaltsystems

Powering 802.3af/at with 24V passive PoE Can a RB260GSP switch (with passive PoE) supply power for a cAP lite AP (PoE 802.3af/at)? https://mikrotik.com/product/RB260GSP https://mikrotik.com/product/RBcAPL-2nD-307 I understand that with 802.3af/at, the switch negotiates with the device whether it wan...

robmaltsystems

Realising that the device was in bridge mode allowed me to Google a little more accurately and I discovered a similar post which took me to this dialog. The default was to no use the firewall and to allow fast path: https://i.imgur.com/zQjmPo0.png Enabling firewall and disabling fast path worked! Ph...

robmaltsystems

Urgent-ish question. I'm trying to set-up a queue on a mAP lite. I've done this before very successfully on hAP devices and know just enough to know that you have to turn off fasttrack for queues to work. I infer from this that queues only work when traffic is going through the firewall? However, on...

robmaltsystems

Nice looking bit of kit but sadly about twice the price of the Huawei B535 in the UK

Shame they don't have a plain 4G LTE modem.

robmaltsystems

Does MikroTik have any LTE modems that can handle 250Mbps? If not, I'll stop looking

robmaltsystems

Will do! I really do love Mikrotik kit. Just bought the mAP Lite mainly out of interest to see how good it was and to use in the lab as it's functionally the same due to the wonderful RouterOS. How tiny!!

robmaltsystems

Thanks for the quick response. I'll try and see if my friends can find out the bands used by the Crotia ISP - they already asked the vendor to recommend a more powerful model/router than the Alcatel portable device they normally ship. Already moved onto the B535 after doing more research.

robmaltsystems

Apologies for the FAQ but it's often quicker to ask those in the know that plough through a long product list. Friends are building a holiday premises in Croatia with multiple guest bedrooms. They can "only" get 4G Plus LTE at the premises with 250Mbps download. Not bad! I've recommended t...

robmaltsystems

Yes that's what I normally do. We're trying to talk the client out of the requirement - it's a committee run organisation and only one person is asking for this. They can't do much with the data anyway as they can't do direct marketing. Guest isolation is fine IMO.

robmaltsystems

I've used the UniFi controller in the past to set-up a guest logon for the guest Wi-Fi. Does Mikrotik offer anything similar? To be honest, I'm not sure why my guest wants or needs it. They're not going to do anything with the data but ho hum. https://beambox.com/landers/unifi?gclid=Cj0KCQjw6PD3BRDP...

robmaltsystems

It got a strong signal when using the in-built Wi-Fi interface but low when using the USB-adapter. So the signal is clearly strong but something else is causing it to report/run low signal. It's very weird.

robmaltsystems

Hmm, sort of - it works fine with every other Wi-Fi access point and I live somewhere where there are lots of access points:

It's perplexing but does seem to be a problem between the USB adaptor and the hAP lite alone.

robmaltsystems

I've just plugged the USB adaptor into my laptop and same problem. Use the laptop inbuilt Wi-Fi and totally strong signal. Use the USB Wi-Fi adaptor and very low signal. Can get a slightly better signal if I move the laptop right next to the router but still only one bar. So this particular USB Wi-F...

robmaltsystems

I've got a generic USB Wi-Fi connector that I occasionally plug into my PC so I can do "wireless" stuff. However, it's getting a very poor signal with a hap Lite. The router is currently 3m away from the PC/adaptor but this is the strengh: https://i.imgur.com/NNsf1aH.png So note how low th...

robmaltsystems

>added LegacyMode (disabled by default) to allow using older, less secure connections to RouterOS older than v6.43;

For the record, how has the security been improved in the later versions? Or maybe, why is the legacy mode insecure?

robmaltsystems

How very old school

Which I actually love...

robmaltsystems

Thanks for that heads-up. Sounds like there are many way to skin a cat here. Will check out this feature later.

robmaltsystems

>Better than scheduled script is lease script for DHCP client, because it will run only when DHCP gets new address/gateway

Thanks for the heads up on that - yes, a script in the DHCP client is a more sensible location rather than scheduled script.

robmaltsystems

I've just come onsite to test the fail over in a more accurate scenario, i.e. the WAN DHCP client is still up but there is no route to the internet. Unfortunately it doesn't work as covered in the original article. So I must be missing something. In my earlier tests, I was disconnecting the WAN conn...

robmaltsystems

Thanks for the posts - will need to put aside a bit of time to digest them. >can you explain again how to deal with the dhcp interfaces ? Was that directed at me? If so, then this is the full script I have at the moment: # Failover: part of the ISP failover system. # Updates the route with the curre...

robmaltsystems

Ahh good idea about looking at the firewall and blocking some paths. Later...

robmaltsystems

Thanks for the reply - will digest later. It's a bit of a background project.

robmaltsystems

In my previous post, I was asking about how a particular documented fail over method actually worked. This is an associated post. The scenario is a wedding barn where they take cashless payments, i.e. the card readers have to work if the main internet link fails - hence the fail over to a mobile pho...

robmaltsystems

There appears to be many, many ways to implement fail over between two ISP WAN connections on a hEX. Most of them are a combination of netwatch, script and scheduled scripts. I have a urgent job where the client wants to fail over to a mobile phone hot spot if the main VDSL2 line goes down. I solved...

robmaltsystems

I've got an idea to restrict access to a printer that has no access controls and is connected connected to an unmanaged switch. The idea being to connect the router to a MikroTik HAP device in router mode. So I can walk before I run, I'm just learning about routing by trying to get a laptop that's a...

robmaltsystems

Quick follow-up, the default country is etis allows the auto setting to wander up into the DFS spectrum range. You can select status on the Wi-Fi interface and see what channel it's selected. It's picking 5640 for me right now. Neither my mobile or laptop can use this channel. But setting to United ...

robmaltsystems

Similar problem here in the UK. The default for frequency is auto and the 5GHz signal isn't visible on either my laptop or mobile. Changed the frequency to 5180 and it appears. It will be to do I suspect with the allowed channels - and the auto channel will be going too high. I need to read up on DF...

robmaltsystems

The configuration script: # dec/04/2019 23:20:21 by RouterOS 6.42.11 # software id = V8LI-Q6E1 # # model = RB941-2nD # serial number = A1C50A2CBA7A /interface bridge add name=bridge1 /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=...

robmaltsystems

And in the spirit of sharing, here is my process for the hAP lite but it's pretty generic: Plug router into network and connect laptop to router Run Winbox, find neighbours and connect to the router System/Reset Configuration: Reset router without no default configuration Reconnect to bridge System/...

robmaltsystems

>Bit of a faff, hoping for plug-n-play, but thanks anyway. You're buying the wrong devices if you need wizards and plug-n-play :-) RouterOS is a very powerful and therefore complex beast - more of a professional device sold at consumers prices. Yes, I've had to document this process for when I have ...

robmaltsystems

This post is a couple of years old - going to assume it'll still work?

robmaltsystems

I'd be interested in using HAP mini as a wireless repeater BUT I want to turn off the wireless access point bit, i.e. I want to connect via Wi-Fi to another access point and plug in a wired device. I have a client that only has Wi-Fi but a printer that's only got a wired connection. This device work...

robmaltsystems

Thanks for that - it's a bit of an idle though about a site I manage whereby they have limited bandwidth shared with a lot of people and some are abusing streaming. I will also be looking at packet sniffing to see if one can throttle just the streaming services. But the throttling I mention might be...

robmaltsystems

On Virgin Media, they have a fair use policy where if you download a certain amount of data, your connection is throttled back for a certain time period. Is RouterOS capable of anything similar? For example, if somebody downloaded 2GB, their bandwidth is throttled for an hour.

robmaltsystems

When I try /import static.rsc, I also get "no such item"...

robmaltsystems

I agree. New to RouterOS and I expected a duplicate option on right-click - sort of a de facto standard. But at least there is a way to do it.

robmaltsystems

>but honestly from the point of view of users I'm not sure if I can tell the difference. Whilst I personally agree, when you get above 50Mbps, only power users are going to really notice the difference. But, UK consumers are sometimes very, err, demanding and if they know their speed test is such-an...

robmaltsystems

>If your ISP line is anything more than, say, 50Mbps, then you shouldn't be looking at hAP ac lite as your router ... realistically it's not capable of routing much faster than around 50Mbps ... So don't be so cheap and buy a vastly more capable device which is not so cheap, such as hAP ac2.. My con...

robmaltsystems

>This Virgin Media operates in your country, while most of the other planet gets less than 100Mbit from their provider and 100Mbit is plenty enough. I agree for consumer use but MikroTik is also sold in the business space here where 100Mbit often isn't enough. I'm new to the MikroTik range and I'm s...

robmaltsystems

I appreciate that real world wireless speeds are way less than the stated speeds of the raw connection. I'm guessing that the Wi-Fi 4 2-chain Mikrotik devices are labelled as 300Mbps but hence the reason I quoted that real-life speedtest rating of 70Mbps if you're a few metres away from the access p...

robmaltsystems

PS. the hAP ac² I get because that does have 1Gbps Ethernet ports.

robmaltsystems

The maximum one tends to get with Wi-Fi 4 (802.11n) with two chains (e..g many laptops) is ~70Mbps so it's a reasonable match for VDSL2 here in the UK where the internet link isn't much higher than that is many cases, often less. So having 100Mbps port for the internet connection is fine. One tends ...

robmaltsystems

For anyone else hitting this topic later, there is a playlist of all the tutorial videos here: https://www.youtube.com/playlist?list=P ... zL3VrYtsKS

robmaltsystems

Am I correct in saying that the Dude only runs on certain hardware but that includes the x86 environment? And if so, is it possible to run it in a VMware virtual environment? That would be a great way to experiment as you can set up multiple virtual networks for testing VLAN etc. But did I also see ...

robmaltsystems

Yes, that is of course the problem with the printed form and why having the reference manual online is the right choice. I'm in same place as the author of the book - need a better grounding in the concepts behind a router. We have a phrase in the UK "All the gear and no idea" which means ...

robmaltsystems

Yes, those were the videos I linked to and they are very, very good. But I don't like just following blind instructions - or rather in this case I'd like to invest the time understanding exactly what I'm doing. RouterOS is incredibly powerful but it's also a darn complicated beast if you're not fami...

robmaltsystems

Re-discovered how to search Amazon for books (so long since i bought a book) and I ended up at this book: https://www.amazon.co.uk/RouterOS-Example-2nd-Stephen-Discher/dp/0692777083/ref=sr_1_1?keywords=routeros&qid=1566152590&s=books&sr=1-1 The synopsis very much fits in what I've just w...

robmaltsystems

I've bought the tiny but very functional hAP mini because I was intrigued about the product and esp. the power of RouterOS. My knowledge of switchers, routers and firewalls is limited to the basic kind of set-up although I was pretty adept at Juniper Netscreen firewalls in my time. I recognise all t...

robmaltsystems

>Side question - it has internal antenna; does this make a big difference to range compared to external antenna?

Answering this question with some unscientific tests but the hAP mini does as well as any other similar device range wise.

robmaltsystems

But I don't have entries for the other devices on there? When they establish DHCP, DNS is automatically updated. So this is some function of the DHCP client on RouterOS?

robmaltsystems

In the upsteam DNS server (i.e. on my Windows server) or on the hAP?

robmaltsystems

This is how my test hAP mini appears on the host network. What do I have to do to allow a name to be assigned to the device for easier identification? Like "Rivendell" and "Faramir" which are names of Windows servers on my network.

robmaltsystems

>hAP ac^2 is very much in the same price range as hAP and offers 5MHz radio too. It was looking for AC access points that brought me to the Mikrotik range. Whilst the Wi-Fi 4 devices are competitively priced here in the UK, the Wi-Fi 5 (AC) variants are middle of the pack. For example the TP-Link Ar...

robmaltsystems

I think one has to invest some time in learning RouterOS. This website/tutorial helped me:

http://tksja.com/qos-basics-one-simple- ... all-users/

The key "ah ha" is that if Fasttrack is enabled, queues are ignored.

robmaltsystems

Thanks - yes, very impressed with RouterOS - even in this tiny hAP mini that's I'm working with. Couldn't get a simple rule working until I found a handy tutorial that mentioned queues are disabled is Fasttrack is enabled. Very useful website: http://tksja.com/qos-basics-one-simple-queue-for-all-use...

robmaltsystems

I'm looking to do the same as well. I guess this is the hit you have to take for RouterOS being such a powerful system - you have to learn a little more than usual to carry out might be more simple through a GUI. I've created a simple queue on wlan1 but nothing appears to be throttled so I guess I'm...

robmaltsystems

Very late to this thread, but is tiktube still available?

robmaltsystems

Hands up - never even installed or used a MikroTik device but I am very interested in the range due to what appears to be a very powerful Router OS - offering a level of control and configuration way beyond other devices in the same price bracket. I'm a sometimes programmer so have no problem with g...

robmaltsystems

>You install crappy TP Link wifi routers in small cafes and this is how you treat your customers LOL. I think you'll find the reason was also in my first sentence: cost-effective solution. Sure, the 4011iGS looks like a fine device but it's well over £200 compared to £25. And the only problem with t...

robmaltsystems

I'm always on the look out for a cost-effective Wi-Fi 4 router/access point for small cafe installations and I came across the hAP mini at Broadbandbuyer. Lovely looking device. I normally install TP-LINK TL-WA801ND but these aren't the best devices IMO ;-) Specifically they struggle with stable DHC...

Search found 111 matches