MikroTik

kehrlein

For those interested in adding fans to the CRS309, take a look at this video for some inspiration: https://www.youtube.com/watch?v=ZDTv6NGBhYk
Of course there are more elegant ways, but this guys' solution is more efficient than just using heat sinks.

kehrlein

For those interested in adding fans, take a look at this video for some inspiration: https://www.youtube.com/watch?v=ZDTv6NGBhYk

kehrlein

You are very brave you have port 53 exposed to the world and you were so proud of it :-) DNS requests are only accepted from internal network via this rule: /ip firewall filter add action=accept chain=input comment="Accept incoming connections to router from intern" connection-state=new s...

kehrlein

Thanks for your help guys!

If 192.168.1.1 is your Mikrotik, what is this then?

My fault! I made a search & replace error when removing the real addresses from the export. I've corrected the IPs in the above post.

VLAN 7 was left over from an old config. Removed it. Thanks for the hint!

kehrlein

Workaround: Adding a DoH server (e.g. https://dns.google/dns-query) fixed the problem. I haven't been able to identify the root cause yet. My guess is that MikroTik is sending it's DNS requests to the upstream DNS with DF (don't fragment) and the response packets have to be fragmented due to the amo...

kehrlein

# 2024-01-01 23:23:18 by RouterOS 7.13 # model = CCR1009-7G-1C-1S+ /interface bridge add arp=proxy-arp name=bridge port-cost-mode=short priority=0x1000 /interface ethernet set [ find default-name=combo1 ] rx-flow-control=auto tx-flow-control=auto /interface ethernet set [ find default-name=ether1 ]...

kehrlein

Well,
show firewall - maybe a tcp/53 is cut somewhere? (just a hunch)

Port 53 input is accepted for UDP as well as TCP. Firewall filters are fine.

/ip dns cache flush

Did that. Doesn't help.

and what does
/ip dns cache all
say?

No record related to the example domain php.net.

kehrlein

Happy new year everyone! I'm having trouble resolving some domain names from a Debian machine using the internal MikroTik DNS resolver, see example with domain name php.net below. Other domain names are resolved successfully. The issue occurs only with large DNS anwers, e.g. while doing an "ANY...

kehrlein

Updated soft- and firmware to 7.13 on these models (> 50 devices in total) without any issues: - x86 - RB5009UPr+S+ - RBcAPGi-5acD2nD (cAP ac) - RB760iGS (hEX S) - CRS309-1G-8S+ - RB750GL - RB952Ui-5ac2nD - RB4011iGS+ - RBwAPG-60ad - RBwAPG-60ad-A - RBwAPG-60ad-SA - RBD22UGS-5HPacD2HnD - RBwAPG-5Hac...

kehrlein

Updated soft- and firmware to 6.49.11 on these models (> 50 devices in total) without any issues: - x86 - CCR2004-1G-12S+2XS - CCR1009-7G-1C-1S+ - CRS112-8P-4S - CRS318-16P-2S+ - CRS328-24P-4S+ - CRS354-48P-4S+2Q+ - RB750Gr3 - RB760iGS (hEX S) - RB952Ui-5ac2nD - RB1100x4 - RB4011iGS+ - RBcAPGi-5acD2...

kehrlein

Updated soft- and firmware to 7.11 on these models without any issues:

x86
RB750GL
RB760iGS (hEX S)
RBcAPGi-5acD2nD (cAP ac)
RBwAPG-5HacD2HnD (wAP ac)
CRS309-1G-8S+

kehrlein

Thanks again, @colinardo! mDNS is completely working now here. All test devices (AirPlay with Samsung TV, Yamaha MusicCast, Bose SoundTouch; AirPrint with HP MFD) are working fine, even without IGMP Proxy and without Multicast Firewall Rules. All these devices are happy without NAT. Only a newer Bos...

kehrlein

If you aren’t using an UPS: Perhaps voltage peaks in the power grid? Do you have issues with other electronical devices?

kehrlein

Updated soft- and firmware to 7.10.2 on these models without any issues: RB750GL CRS309-1G-8S+ RBcAPGi-5acD2nD (cAP ac) RB5009UPr+S+IN RB760iGS (hEX S) x86 Info regarding RB760iGS (hEX S): We‘ve had several update issues during the last months with < 10 devices and > 10 different ROS versions, resul...

kehrlein

What a nice idea, @5nik!
Would also like to see more models in this form factor. A CRS would really be great.
Thermal design will be a challenge. I‘m using the CRS309 and like the passive cooling enclosure very much in quiet location. But with SFP+ modules, it’s really tricky…

kehrlein

Cannot confirm this, successfully works both on CHR(x86) as well on a RB5009 on current fresh RouterOS Release Version 7.10.2, with the provided container. You have to follow the guide precisely! Argh! Didn't follow the guide in detail - my fault! After naming the VLAN interfaces in the proper way ...

kehrlein

For those interested, i created an extended container image based on the github repo and a setup script which simplifies the mDNS repeating setup: Mikrotik: mDNS Repeater as Docker-Container on the Router (ARM,ARM64,X86) (english version) Mikrotik: mDNS Repeater als Docker-Container auf dem Router ...

kehrlein

Please Mikrotik come up with a solution here to have Winbox natively on MacOS (Apple Silicon) rather than on the mercy of Wine.

+1

kehrlein

wireguard ipv6 bug still exists.

Could you please provide any details about the bug?

kehrlein

Usually (experienced on 6.x.y) regenerating host keys takes only a couple of seconds [or minutes]. I do have two boxes with 7.6 (CRS112-8P-4S mibsbe & CRS309-1G-8S+ arm) where the process 'certificate' is running for more than 24 hours after initiating the regeneration. Even if the selected Host...

kehrlein

Updated soft- and firmware on these models without any issues: RB750GL CRS309-1G-8S+ RBcAPGi-5acD2nD (cAP ac) RB760iGS (hEX S) RBD52G-5HacD2HnD (hAP ac2) Update 09.01.2023: Several issues after more days in production and deeper analysis with RB1100AHx4 (regarding VLAN, Bridge, SSH, connections issu...

kehrlein

Guys, do you have newer information about the support of ECDSA keys in ROS 7?

kehrlein

Guys, do you have newer information about the support of ECDSA keys in ROS 7?

kehrlein

Beware that if you're not very careful with antennae, it might not work due to self-inflicted interference ... both 2.4GHz radios will not be synchronized for Tx/Rx periods and even if both radios use different channels, RF filters on Rx side are not good enough to cancel all the energy in same ban...

kehrlein

Hey guys,
I'm looking for a tri-band access point like MikroTik Audience (one 2.4 GHz & two 5 GHz) but it should have two 2.4 GHz & one 5 GHz wireless channels included.
Any idea?
Thanks!

kehrlein

Updated soft- and firmware on these models without any issues:
CCR2004-1G-12S+2XS
Did you a downgrade beyond the factory-firmware?
Our CCR2004's came with a pre-insalled V7...

No, I didn’t do a downgrade before. Our CCR2004s had version 6.x pre-installed.

kehrlein

Updated soft- and firmware on these models without any issues:
RB4011iGS+
RB1100AHx4
RB750GL
RBD52G-5HacD2HnD (hAP ac2)
RBD25G-5HPacQD2HPnD (Audience)
CCR2004-1G-12S+2XS
CCR1009-7G-1C-1S+
CRS112-8P-4S
x86

kehrlein

Update of RB760iGS (hEX S) led to inaccessibility of the device; netinstall solved the issue.

Updated soft- and firmware on these models without any issues (besides RoMON still not working since 7.1.x):
RBcAPGi-5acD2nD (cAP ac)
RB750GL
CRS309-1G-8S+

kehrlein

Updated soft- and firmware on these models without any issues:
CRS112-8P-4S
RB750GL
RBcAPGi-5acD2nD (cAP XL ac)
RB1100AHx4
CCR2004-1G-12S+2XS
CCR1009-7G-1C-1S+
x86

edit: added more models

kehrlein

CRS112-8P-4S: Not usable after upgrade from 6.49.3 to 7.1.3 (soft- and firmware) Working for some minutes after booting, then ports are starting to flapp and the data transfer between the clients is interrupted permant. No further errors / information in the log. Downgrade to 6.49.x solved the issu...

kehrlein

Updated soft- and firmware on these models without any issues:
CCR1009-7G-1C-1S+
CCR2004-1G-12S+2XS
CRS112-8P-4S
RBcAPGi-5acD2nD (cAP ac)
RB1100AHx4
RB750GL
RBD52G-5HacD2HnD (hAP ac2)
x86

kehrlein

After upgrading from 6.49.3 to to 7.1.3 RoMON is not working any longer.
Tested with RB760iGS (hEX S), RBcAPGi-5acD2nD (cAP ac) and CRS309-1G-8S+.

Also see viewtopic.php?t=181472#p900955 which seems still being the current state.

kehrlein

I can confirm the romon issue.
After upgrading RB760iGS (hEX S), RBcAPGi-5acD2nD (cAP ac) and CRS309-1G-8S+ from 6.49.3 to to 7.1.3 RoMON is not working any longer.

Also see viewtopic.php?t=181472#p900955 which seems still being the current state.

kehrlein

RBcAPGi-5acD2nD (cAP ac): Upgrading from 6.49.3 Unfortunately the space of the cAP ac is too small for doing an easy in-production update. Of course, all files (e.g. logs) were removed before to gain some more free space. I needed to delete all packages until only the system package was left. Then I...

kehrlein

CRS112-8P-4S: Not usable after upgrade from 6.49.3 to 7.1.3 (soft- and firmware) Working for some minutes after booting, then ports are starting to flapp and the data transfer between the clients is interrupted permant. 19:20:06 system,info,account user XXXX logged in XXXX via winbox 19:20:27 interf...

kehrlein

... I already have a 4011, and at the moment I am using it to test v7. I selected it because it would be a drop-in replacement of the 2011 I had for years (and became too slow). However it has a architecture-specific bug. I hope it will be fixed sometime soon. What specific architecture bug do you ...

kehrlein

Same as with previous versions (e.g. 6.49.1, 6.49.2): Upgrade to 6.49.3 resulted in a boot loop of a particular hEX S (RB760iGS, mmips). No access to device was possible until Netinstall, which solved the issue. Updated soft- and firmware on these models without any issues: CCR2004-1G-12S+2XS CCR100...

kehrlein

Updated soft- and firmware on these models without any issues:
mAP 2nD
RBcAPGi-5acD2nD (cAP ac)
CRS309-1G-8S+
CRS328-24P-4S+
RB750GL
CCR2004-1G-12S+2XS
CCR1009-7G-1C-1S+
x86

Additional models (12.12.2021):
CRS112-8P-4S
RB1100AHx4

kehrlein

Hi EdPa, thanks for your reply! Did you already report this to support, do you have a SUP ticket number? Created SUP-68147 right now. Let me know if you need further information. Did the device successfully upgrade to 6.49.1 or 6.49.2, or did the boot loop only start after the RouterBOOT upgrade (af...

kehrlein

Same as with 6.49.1:
Upgrade to 6.49.2 resulted in a boot loop of hEX S (RB760iGS, mmips).
No access to device was possible until Netinstall, which solved the issue.

kehrlein

Upgrade to 6.49.1 resulted in a boot loop of hEX S (RB760iGS). Due to an automatically script for firmware update, I can't say if the issue occured after installing the software or the firmware. No access to device was possible until Netinstall, which solved the issue. Updated on these models witho...

kehrlein

Upgrade to 6.49.1 resulted in a boot loop of hEX S (RB760iGS).
Due to an automatically script for firmware update, I can't say if the issue occured after installing the software or the firmware.
No access to device was possible until Netinstall, which solved the issue.

kehrlein

some here:

http://disnetern.ru/play-mikrotik-beeper-melody-script/

These are really great. Thank you

kehrlein

I made this script, You should add scheduler every 5-10 minutes it's check if you had login failure more then 5 times from same ip it's automatically add the ip to block list.

Great script, Zivtal! Thank you very much!!

kehrlein

I am looking to buy 2x CCR2004-1G-12S+2XS to use with ZeroTier.

Does anyone know if ZeroTier is available on those ?

Yes, if you're installing RouterOS v7.1rc2 or newer.

kehrlein

Does RB5009UG new router supports zerotier??

Yes. RB5009UG needs RouterOS v7.x and since v7.1rc2 ZeroTier ist available.

kehrlein

Updated several devices without any issues:
CCR1009-7G-1C-1S+
CCR2004-1G-12S+2XS
CRS326-24G-2S+
CRS112-8P-4S
RB750GL
RB1100AHx4

kehrlein

Did you find a way to configure AMSDU Limit via CAPsMAN?
Unfortunately ( / of course) if AP is managed via CAPsMAN the parameter can't be configured locally on the AP.

kehrlein

Did you find a way to configure AMSDU Limit via CAPsMAN?
Unfortunately ( / of course) if AP is managed via CAPsMAN the parameter can't be configured locally on the AP.

kehrlein

Updated several devices without any issues:
CCR1009-7G-1C-1S+
CCR2004-1G-12S+2XS
CRS326-24G-2S+
CRS112-8P-4S
RB750GL
RB1100AHx4

kehrlein

It should be the same as with IPv4, i.e. only single address on VRRP interface: 2a00:xxxx:yyyy:2b::ffff /128 . MikroTik Support wrote: For IPv4 as stated in the manual /32 should be used on vrrp interface if address on the vrrp interface is from the same subnet where vrrp protocol is running. IPv6 ...

kehrlein

+1
Thx!

kehrlein

Just found this old thread. If someone is still looking for a solution, check https://forum.mikrotik.com/viewtopic.php?t=41261#p205403 You could also log all of the NAT traffic, but be aware of the amount of data: /ip firewall mangle add action=log chain=prerouting connection-nat-state=srcnat log=ye...

kehrlein

I installed a fan and it went to 37 under load

Which fans did you choose and how did you install them?

kehrlein

I've got a similar issue. Does anyone has an idea or more information about this behaviour?

kehrlein

I would also be interested in this model. But I've the need for a quiet one.
Does anyone have experience with the switch and/or reducing the noise by changing the fans?

kehrlein

Updated several devices without any issues:
750GL, RB760iGS (HeX S), CRS326-24G-2S+, CRS112-8P-4S, CCR2004-1G-12S+2XS, CCR1009-7G-1C-1S+

kehrlein

Updated several devices:
750GL, RB760iGS (HeX S), CRS326-24G-2S+, CRS112-8P-4S, CCR2004-1G-12S+2XS, CCR1009-7G-1C-1S+

Only one small issue occured until now:
Dynamic IPv6 Route (created via DHCPv6 Client) was broken. Disabling and re-enabling the DHCPv6 Client solved the problem.

kehrlein

Upgraded several devices with no issues so far:
CRS326-24G-2S+
CRS112-8P-4S
CCR1009-7G-1C-1S+
hEX S
RB750GL
mAP2nD

kehrlein

Upgraded several devices without any issues:
- CRS326-24G-2S+ (with bridge, bonding, VLAN, SFP+)
- CRS112-8P-4S (with bridge, bonding, VLAN, SFP)
- RB750GL
- RB760iGS (HeX S)

kehrlein

Great work! Thank you!

kehrlein

VTI +1
and also +1 for an optional package with Root Certificates.

kehrlein

Yes, that’s possible.
See https://mikrotik.com/software and use the x86 image for installation.

kehrlein

Small DIN switches.. Wide input DC power. It'd be nice to be able to mount small switches on walls in closets, cabinets, backboards, industrial situations, etc...

+1
Would be a nice option!

kehrlein

I also had trouble with L2TP/IPsec server behind NAT.
Modifying the registry on a Windows 10 system solved the issue for me.

kehrlein

[...] This is very annoying. No other vender forces you to learn three ways to do simple VLAN stuff. [...] MikroTik does not - it's not *wrong*, it's just not they way they do it. Once you realize this, you can design and use it accordingly. Okay, then I wasn't clear enough: no other vendor forces ...

kehrlein

Hi folks, I'm currently using an USB-to-serial adapter for managing other devices with RS-232 interface via a MikroTik hEX S and it works pretty well. # settings for port "usb1" /port set usb1 baud-rate=115200 data-bits=8 flow-control=none parity=none stop-bits=1 # disable system console f...

kehrlein

It's very unclear why STP and RSTP stop DHCP client from functioning on the bridge itself, and everything behind that bridge. Fact is that setting the protocol to "none" fixes the problem in many occasions, for Mikrotik but also other DHCP servers. try set new priority. /interface bridge ...

kehrlein

Hi guys, I'm trying to update a MikroTik device (named as "client" in the following case) with packages provided from another MikroTik device ("server"). server (running on a x86 system; v6.46.4) provides this package: > file print where type=package # NAME TYPE SIZE CREATION-TIM...

kehrlein

Another issue I have on all my devices is that a scheduler script that used to run on boot, but with version 6.46 dosen't run anymore: add name=UpgradeFirmware on-event="if ([/system routerboard get current-firmware] < [/system routerboard get upgrade-firmwar\ e]) do={\r\ \n/system routerboard...

kehrlein

Does everybody experiencing this run Dude on the device? I have had the exact same issue on my RB1100AHx4 shortly after setting up Dude. Happened 3 or 4 times over a month or two before i connected the dots. Disabled Dude server and no hickup since (6-8 months ago...). I had the issues on several d...

kehrlein

Same issue here with 3 different RB1100AHx4. The situations happens with < 7 days uptime. During the incident, the devices don't accept new SSH, Winbox, SNMP or PPTP connections to the router itself. Also logins via CLI aren't possible (serial connection is possible; login doesn't work). We tried t...

kehrlein

Tested with CRS326-24G-2S+RM:
H flag for hardware offloading in combination with bonding appeared not before putting in the first connection of the bond.

kehrlein

Upgraded several CRS326-24G-2S+RM / CRS112-8P-4S-IN / RB1100AHx4 from 6.45.7 to 6.46 without any issues so far.

kehrlein

fyi: viewtopic.php?f=2&t=149062&sid=d942c65b ... 143005be5b describes the same issue.

kehrlein

Same issue here with 3 different RB1100AHx4. The situations happens with < 7 days uptime. During the incident, the devices don't accept new SSH, Winbox, SNMP or PPTP connections to the router itself. Also logins via CLI aren't possible (serial connection is possible; login doesn't work). We tried to...

kehrlein

Have a look at viewtopic.php?f=21&t=149786&p=738259&hilit=pptp#p738259
I had the same issue since 6.45.1 and enabling the pptp helper service solved the issue in my case:

/ip firewall service-port enable pptp

Search found 77 matches