MikroTik

kleshki

I'm at the same driver version but can't confirm this works on 7.16.x, not sure about beta

kleshki

You actually can, but this would be kinda tricky to do. Note that I'm not guarantee you that what I've described below will give you desired results and maybe @anav is right, but I'll try to give Mikrotik a chance. In ROS7 there's a DNS record called FWD. What you can do is: 1. Inject MikroTik DNS i...

kleshki

Is it possible to boot entire RouterOS from network for ARM/ARM64 devices? The RouterBOARD seems to support "try-ethernet", so I assume it is possible to extract the flash image and put it onto boot server.

kleshki

Looks like Intel new Wireless Bluetooth driver 23.90.0 and 7.17beta5 work fine for me. No more discconects under load. I'm testing about 3 hours. Can anybody else confirm that?

What's the version is shown on WiFi dongle itself in the device manager?

kleshki

There's a checkbox Lock to CAPsMAN on AP itself - is it what you mean?

kleshki

The problem is same for me when I try to remove container directory from external drive. It removes around 100-300 files of container then fails. So I have to press delete for multiple ten times to actually remove it. FS is NTFS

kleshki

L3+L4 is less common tho, but it should work good between two mikrotiks L3+L4 can spread traffic between one pair of devices to both bond links ... if devices use multiple connections in parallel. However, a single connection (e.g. single file transfer using SMB - windows file sharing) will still o...

kleshki

L2+L3 means IP is taken into consideration, so all traffic between two same hosts will go through single link. This will shine when you have multiple devices behind bonding
L3+L4 is less common tho, but it should work good between two mikrotiks

kleshki

The same Routerboard Here. https://postimg.cc/qhy0q50j https://postimg.cc/qhy0q50j Oh wow! What is with this sector writes numbers? And most of it are since the last reboot? sector-writes.png That seems /system logging action set 0 memory-lines=5000 set 1 disk-lines-per-file=5000 so just pushing lo...

kleshki

Nope I meant that traffic passes through dumb switch without any tags and reaches untagged to router at port where switch is connected. Then, if MAC address is found in bridge/host table, traffic gets tagged according to MAC->VID mapping and goes with tag through MT bridge. The return traffic gets u...

kleshki

Concur, and is why in post #3 I presented clear feedback. It was not me that muddied the waters by saying oh what your doing is possible sort of with caveats, oh yeah so clear !!!! ;-PP It's actually possible to have multiple untagged vlans per port. The setup can be like this: MikroTik -> dumb swi...

kleshki

The OP seems to be confused about the terms, so don't make pointless argues. Let's ask OP about network diagram: where VLANs 10 and 20 originate and where they should or should not go.

kleshki

According to your description, here's what I think /interface bridge add name=bridge vlan-filtering=yes ether-type=0x88a8 /interface bridge port add interface=sfpplus2 bridge=bridge pvid=100 tag-stacking=yes add interface=sfpplus1 bridge=bridge /interface bridge vlan add bridge=bridge tagged=sfpplus...

kleshki

1. Check your logs for any actions done (every configuration change in ROS7 is logged, and the user@source (local/winbox/ssh and so on) is described)
2. Post your /export file=config while omitting any sensitive data
3. Try backup -> netinstall -> restore

kleshki

So, can you specify, you receive tagged 802.1Q traffic from sfpplus2 right? This would be trunk port with customer tags.
Then you apply additional tag and then push traffic to sfpplus1 with Q-in-Q?
Maybe a network diagram of desired setup would help more, if I got you wrong.

kleshki

Looking at your config, to make it according to docs, this looks like it's something to be done from scratch almost: 1. Remove all VLANs from /interface bridge port 2. Add all physical ports to /interface bridge port and add appropriate PVID, check Tag stacking=yes where appropriate. Setup bridge ho...

kleshki

Hello.
I have read it but I really dont know how to do it.
tomorrow I will export my current configuration and please can you suggest me doing it in the new way ?
I am not able to make a working test. I really dont understand the way to do it.

Post the config and we'll see

kleshki

Use VLANs to separate devices on a single bridge. Pretty sure you can manage all VLAN stuff on pfSense, which would be a nice centralized solution

kleshki

My bad, meant wrong thing. The device should be accessible from another network, if it has gateway configured properly (i.e. 192.168.66.1 for all IoT stuff behind mAP). Another suggest is why you can't just bridge ether1 and wlan1 to have all management on pfsense?

kleshki

You should add the reverse route 10.9.4.0/24 via 192.168.66.1 on map. Then you don't need dstnat at all

kleshki

1 0.000000 laptop_ip server_ip TCP 70 52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM 2 0.000016 laptop_ip server_ip TCP 70 [TCP Retransmission] 52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM 3 0.000020 laptop_ip server_ip TCP 66 [TCP Retransmission] 52536 → 8...

kleshki

I mean you can at least do first while second is not that fast. Other option is to setup Netwatch to ping something like 8.8.8.8 and restart interface on fail pings at some reasonable threshold - that would be more suitable if your disconnects doesn't fall to some "scheduled" time. This is...

kleshki

Easy way is to make a scheduled script to restart interface each day.
Harder but maybe more proper way would be to diagnose the reason of this problem.

kleshki

thanks a lot for your help, i think i see what ive misunderstood; i wasnt thinking of qinq as an extension to the vlan, rather, i was considering it more like a vpn. loosely put, the qinq is my feature in vlanning and not yours (if you are a client to me i can allow you to trunk). In my case, i am ...

kleshki

Isn't that more convenient to just mount share as disk using it's \\IP\path and forget?

kleshki

My hosting provider recently reported troubles with their network adapter - I had losses about 5% over some specific connections only, so they migrated VM to some other host (I suppose LACP troubles on their side). Previous problems are gone after migration, so maybe this could be related. However i...

kleshki

1 0.000000 IPs Removed TCP 88 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34 2 0.000007 IPs Removed TCP 88 [TCP Retransmission] 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34 3 0.459990 IPs Removed TCP 70 55024 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM 4 0.459996 IPs Remo...

kleshki

That's a cool idea, gonna do that next time connection lags. I'm not using any mangling on CHR side tho, haven't seen any issues with connections before

kleshki

I've also checked in connection tracking now that when Winbox is stuck, the connection is shown as established, meanwhile changed to "fin wait" to close or straight to close. The latter is not consistent (may be just close or fin wait first from time to time), but the amount of bytes trans...

kleshki

If that's MTU on multipath then it would be tricky as hell to figure out. CHR has 1500 default ether MTU and home router is 1492 (PPPoE) with mss-clamp mangle rule configured. I should also notice that I use same scheme with IPv6 (i.e. external access by whitelist) and while IPv4 connectivity is bro...

kleshki

1. Never allow external access to config the router. The ONLY access path using winbox should be LOCALLY from an authorized LANIP or list of admin IPs, AND via VPN where the remote user has used VPN to access the router ( and is know considered local or internal ) and the config. 2. Telnet is anoth...

kleshki

Hello everyone. I have a CHR v. 7.16 configured with whitelist access to Winbox (chain=input action=accept dst-port=8291 src-address-list=Whitelist and in Whitelist I keep my Cloud address of home router). Everything worked fine and config was untouched for quite long time, but suddenly a periodic i...

kleshki

https://help.mikrotik.com/docs/spaces/ROS/pages/28606465/Bridge+VLAN+Table check this out. Here you create L2 q-in-q, then just add /interface/vlan ontop of bridge (not bridge existing vlan interfaces as this is a described misconfiguration https://help.mikrotik.com/docs/spaces/ROS/pages/19136718/La...

kleshki

Using centralized controllers for APs is the way to go (Capsman for MT, unifi for ubnt)

kleshki

I think NAT is L3 and above cpu functionality and switch chip work/make changes only with L2 protocols, not IP for example.

Here's mentioned L3 hardware offloading described here. You talk about regular switch chips like on RB-devices, which are different.

kleshki

While posting config I would also check this:
1. /system/routerboard current firmware is equal to current ROS version installed, upgrade&reboot if not
2. /tool/profile to see what actually consumes CPU

kleshki

Microsoft DHCP Server can do what you ask, i.e. replication and lease sharing. You can learn more here With MT there's a thing called authoritative dhcp and delay dhcp, so you can have "active-backup" dhcp with mikrotiks kinda easily, but syncing configs and static leases is up to you, als...

kleshki

btest itself consumes CPU to generate traffic. Use iperf on devices connected to switch instead.

kleshki

TBH I've never seen hairpin NAT with masquerade, only with action=src-nat
But yeah, easily googleable

kleshki

It's not clear for me, you posted a config where interface should have 10.90.200.4/32. Now you tell us it's 10.55.55.254/24. For the route, you should set gateway IP to the address of the peer, so if Opnsense peer is 10.55.55.253 - this is your gateway. Also you can consider using smaller networks f...

kleshki

Curious if drivers could be added to the image so easily, can MT do some kind of driver repository for CHR, instead of pushing it to the image itself

kleshki

In peer config, set persistent keepalive to something like 20s and check if it works. Your Opnsense seems to be configured as responder and doesn't initiate connection on it's own.

kleshki

MikroTik can be WG peer (as there's no transparent server or client in WG terminology) to any other WG device. Check if you have 1. Correct keys on both sides 2. Assigned IP address to WG interface 3. WG port allowed in input firewall chain If you still couldn't spot the issue, post your config with...

kleshki

It's not a good practice to have same pool for LAN and VPN clients. What you can best do is to make a separate pool for OVPN clients and setup routing to both bridges. What you can do if you don't want solution above is to add route to another bridge to Table_ISP1 like dst-address=192.168.10.0/24 ga...

kleshki

What is in itself the problem of remaining at 7.14.3 (at least for the time being)?
Is there specific functionality missing that was introduced from 7.15 upwards?

7.15 patch notes include wifi-qcom driver update.

kleshki

Yeah, it purely depends on the unmanaged switch firmware, which could either ignore or drop VLAN tags, so you can either have expected behavior or no VLANs at all. Better find cheapest managed switch for this purpose. D-Link DGS1100 is very affordable, and you can find some vlan-aware stuff on aliex...

kleshki

Recursive has been the same for every sub version of version7, to my knowledge anyway. In early versions, IIRC, there was a bug where scope was auto-decrementeded, so you had to specify target-scope 21 instead of 20 or something to hit scope 20 (maybe I'm wrong in exact terms but the description wi...

kleshki

Can't this be just a scheduled script that monitors link status and switches between 802.3ad and active-standby with primary interface? Not a single config line like Arista, but still may do the trick

kleshki

When I tested extensively in 2022 the behaviour was inconsistent. In some cases default route's target scope needed to be 10 to find the gateway (scope 10), in other cases it needed to be 11. And some other inconsistencies. Hence trial and error to find the rule actually in effect for any specific ...

kleshki

As in the first post NVR mentioned, I think the use case is to have a centralized security camera monitoring, maybe at some small outlets. It is true about sufficient VPN server tho, even from abstract numbers, 1500 endpoints * 10Mbit is around 15Gbit/s of encrypted data which is a lot. There probab...

kleshki

Seems to be webfig-only related, as Winbox shows v6 connections correctly for me

kleshki

There's no need for trial and error. You set it like this: 0.0.0.0/0 via 8.8.8.8/32 scope=30 target-scope= 20 check-gateway=ping 8.8.8.8/32 via whatever-gw-you-want scope= 20 target-scope=10 so default route targets scope that a real route has. After that, you can check immediate gateway on default ...

kleshki

My suggest would be something with RADIUS, like IKEv2, to manage authentication centrally. Even wireguard configuration generation can be scripted, there's still error-prone things here. With RADIUS, configurations are pushed through RADIUS-attributes, you only need to set equal config for each endp...

kleshki

Is there a real reason to use passthrough instead of virtio driver or maybe try to use SR-IOV?

kleshki

A quick google search I've found there's a way to boot on bhyve guide
Can't try myself, but there's a bunch of guides how to boot ROS7, maybe this could solve your problem

kleshki

@anav I expected to see a config with fasttrack enabled and checkbox disabled for the situation to be strange. Now I only see disabled fasttrack and disabled checkbox as a result. OP should try reboot. As for your question in n.1 add address=192.168.88.1 comment=defconf name=router.lan type=A is act...

kleshki

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-mark=no-mark connection-state=established,related disabled=yes \
    hw-offload=yes

disabled=yes

kleshki

Glad to hear you've got it

kleshki

You tell us you have your upstream router as port 4. Why do you put address on ether2 and route through ether2? Why do you bridge ports 2-4? Your WAN list has ether1 port only.

kleshki

You have to specify DNS server under /ip/dns and not just in DHCP Network in order to Mikrotik be able to resolve update-server name - that's my suggestion. Otherwise, post config.

kleshki

IP firewall doesn't look into packets flowing inside bridge. You can either use /bridge/filter or enable IP Firewall for bridges. Chain is also wrong - should be forward not input. Another option is to use firewall inside VM.

kleshki

Hello I am testing WireGuard, i got the basic site-to-site config to work. But i want to modify it litle bit. i would like to add secondary router that has its own public ip and route all internet traffic to there, but when i remove the 0.0.0.0/0 from my wireguard router then peers wount connect an...

kleshki

I'm on 7.16.1 for now, intel driver v. 23.70.2.3. I don't have time now to play games and so on, so it's hard for me to notice disconnects that I had before. But logs are filled with this: 19:08:39 wireless,info 0C:7A:15:F5:D2:AF@wifi-5ghz disconnected, connection lost, signal strength -70 19:08:39 ...

kleshki

ChatGPT v4 says my config is fine so it's your fault Mikrotik blah blah

kleshki

Even if you could manage to implement duplicating packets through multiple interfaces, I doubt other side will accept it normally, since it would expect a packet flow from a single endpoint. Otherwise, how they should preserve packet sequence, especially with LTE delays.

kleshki

What you ask is not a trivial task, it's not just a "youtube to WAN2 checkbox"

kleshki

Hello guys, I'm trying to follow this tutorial https://www.youtube.com/watch?v=2pFcVRaoscE to add a VPN connection using Wireguard to warp Cloudflare. But when I try to add mangle rules, on action "mark routing", the 'new routing mark' doesn't show the routing tables that I already add. I...

kleshki

Is there a possibility that topic starter is just behind ISP NAT that's why no one hitting him? Because normally there's a lot stuff hitting router outside in input chain, but if your ISP doesn't care about security, you can be unprotected from L2 neighbors, so they can just route to private range t...

kleshki

User manager is just radius server, how can this be only solution?

kleshki

Can you connect through console?

kleshki

If the problem costs you thousands dollars, hire a competent specialist to make it for you, this will be way cheaper. Otherwise, no need to babycry on a forum, where answering your questions is some kind of volunteering, and support also doesn't help with configuration, only when bug occurs to debug...

kleshki

Found the solution, I had to set the in interface. Now everything is working fine. By the way I’m opening all ports because my mikrotik is connected to another router where I have a firewall, so I don’t need to block any port on the mikrotik, I already handle it in my other router. That's weird any...

kleshki

It's not "probably", it is definitely compromised. This is now a common botnet thing, which creates System user and partially restricts you. It occurs almost instant via api on unportected device Reset your device or do netinstall, take care of default security measures before throwing it ...

kleshki

170 MB/s is slightly above 1.3Gbit/s which is only half of 2.5Gbit and slightly above of what you experience during HTTP download (1Gbit/s) with direct connection. At this point I doubt this is router problem

kleshki

May this be related to some tcp offloading on a laptop working improperly and network card can't handle buffers? When you did iperf test, you probably did udp. What if you try tcp instead and see what happens? Try to check laptop network adapter's settings, increase buffers, update driver and so on.

kleshki

Except of strangeness of your action, what you're doing wrong is probably not specifying restrictions on dst-nat rule, so ports 443 and 80 for outbound also match it and are being forwarded.

kleshki

I doubt a lot of resources are spent to make ROSE package. This could be just recompile of well-known linux packages and that's it, not that much resources wasted. Agree on ax troubles tho. 2 versions no fix.

kleshki

No, SSTP uses AES and you can't just disable it, as it defeats the purpose of protocol, best you can do with that is use device with aes-hw-offload. Or use another protocol which has optimized software encryption, like wireguard.

kleshki

I saw somewhere script that does lookup logs for ipsec errors to block undesired connection attempts. You can try and do the same - make a script that looks up for whatever you want, extract MAC from the message, look for dhcp-lease with corresponding MAC, :log info $MAC . $AP with the format you wa...

kleshki

I think that's because a hypervisor (not only Hyper-V but others too) doesn't allow VM to advertise MAC address, that is different from assigned to a specific adapter. But RouterOS chooses one MAC for a bridge and announces it to all bridge ports. MAC is chosen from one of bridge ports, so it was ch...

kleshki

You can try the reverse thing: create a single VRRP, create VLANs on top of VRRP. This should work, if it's ok that a single VRRP handles all VLANs at once.

kleshki

I'm pretty sure it's bottlenecked by a single core of your routers. Since it's stream cipher, I doubt it can be multithreaded, as packet order should be preserved. HEX has two cores, so one of cores is fully loaded, that's why it's slightly above 50%. Ac3 has four cores, that's why it's slightly abo...

kleshki

TBF your description is not clear (at least for me). By default, if you have, for example, 0.0.0.0/0 via ISP and 10.0.2.0/24 via vlan66, no matter the distance, 10.0.2.0/24 should go via vlan ignoring default gateway, as more "strict" routes have priority. Since it doesn't work for you as ...

kleshki

I've managed to push 400 Mbit btest between gigabit single-core CHR VMs with SSTP and H flag on it. This could be more I suppose, because btest also takes CPU cycles to generate UDP traffic. Wireguard pushed around 850+ same channel, so you can compare the numbers. I have an ax3 with 300Mbit channel...

kleshki

Different IPs on different routers? Certificate name should match SSTP server IP or FQDN

kleshki

You can only improve your performance of SSTP with hardware encryption. IIRC, ac3 doesn't support that. Ax3 does, however.
That's the nature of SSTP protocol, which uses TCP, compared to Wireguard and UDP. ANd encryption algorithm also matters.

kleshki

Still can't get from thread what's wrong with recursive routes? Just setup both recursive route and netwatch to same host to have both route failover and up/down scripts

kleshki

If you do /export hide-sensitive, secrets aren't exported that way. Dynamic entries aren't exported with /export too.

kleshki

I've recently heard an opinion that connected USB3 device may affect wireless (friends who have ax3 had problems with usb and didn't have without). I had problems before I attached USB disk, and now there isn't much transfers (only error logs by now). Maybe it will be useful if anyone who has proble...

kleshki

This is not possible, because wireguard uses public-key routing (or whatever they call that), so with same keys, server won't know where to route traffic. It's however possible to connect two wireguard clients from same subnet but with different keypairs (dunno why you want to have same keypairs) II...

kleshki

Isn't 802.1x and GPO a better solution for that? (but you have to have clients connected to managed switch directly, not through some 5port dumb ones)

kleshki

There was another separate article using this approach with list, however the drop rule was in input for some reason, I just moved it to prerouting. I see there's a similar chain, but the approach is different. Instead of parsing all bad traffic all time, you remember source of undesired traffic onc...

kleshki

Could you link to that particular info please? I can't find the exact wiki page, as the link I've found is dead already. But I can post you my firewall export in case you interested: /ip firewall filter add action=add-src-to-address-list address-list=Port-Scanners address-list-timeout=2w chain=inpu...

kleshki

It's possible, but the traffic will flow out and in to the router anyway, and wireguard doesn't hurt performance much. So maybe you should consider telling what router/ROS version you using, what perfmon tells you under wireguard load and so on. if not, then you can just route traffic to a "box...

kleshki

Can you please elaborate more? I mean by default hypervisor host only expects VMs to connect to network using MAC-address given by host. But LACP may announce other MAC on links so host just blocks those eframes. Feature is called "Allow MAC Spoofing" or similar and is located in VM setti...

kleshki

Any chance Mac-spoofing enabling on vm helps with this?

kleshki

Ax3 is a single stand-alone device, so there's nowhere to roam. Sure there is: from 5 GHz to 2.4 and back when both radios have the same SSID. FT does apply in this case! I have 5GHz and 2.4GHz SSIDs separate as 5GHz covers area well enough, so I wanna make sure all devices use 5GHz all time

kleshki

Thank you for the answers. I am still interested to learn about those other security measures. Could you elaborate? It depends on what you have and what you're protecting. For me it now seems that you're solving problems you aren't facing in reality. If you are facing DoS attack on your system, try...

kleshki

2. The list isn't actually "long", it's only 1787 entries at the moment I've opened it. How can it be measured? Load it into your router and test RAM and CPU usage for blocking this (try raw prerouting for that). Wouldn't take noticeable performance on a good device. 3. In my opinion, appr...

kleshki

You getting any issues with that setup? Does your devices roam without ft=yes ft-over-ds=yes? Yes I had disconnects with Intel AX on that. Ax3 is a single stand-alone device, so there's nowhere to roam. Support told me that those options make no sense in my setup (but are enabled by default). In on...

kleshki

Because you can open this list on your own and clearly see that it contains public IPs. Those IPs aren't issues yet to anyone but eventually will.
Bogons in a MT guide are IPs that are intended to use as private, loopback, multicast and so on. Those things are different.

kleshki

/interface wifi channel add band=5ghz-ax disabled=no frequency=5220,5180-5320,5660-5845 name=5ghz skip-dfs-channels=10min-cac width=20/40/80mhz /interface wifi security add authentication-types=wpa2-psk disabled=no management-protection=disabled name=home-private /interface wifi set [ find default-...

kleshki

Actual bogons are different of what you've linked - those are IPs from which malicious traffic was detected (port-scanning, brute-forcing etc.).

kleshki

Rather than name-call the others, I prefer to contribute positively, as with this article I've just written, presenting a working configuration for at least one person, me. How much broader does that go? I don't know, but it's objectively the case that everything isn't terrible for everyone. I didn...

kleshki

It happens with any kind of configuration, whether it's defconf or not, and support guy told me they replicated the problem with Intel AX in their lab. I haven't noticed any issues with 7.14.3. But any 7.15 onwards the disconnects are just waaaay to often. All stuff that we tried with support worked...

kleshki

Your device probably has reset jumpers, you may try it. Also, netinstall may help, if bootloader is not in protected mode, otherwise gg.

kleshki

Hi everyone! I have such scheme: Wireguard clients -> CHR1 -> CHR2/3/4 BGP peer with "set gw 127.0.0.2" routing filter on CHR1. So if CHR2 fails then CHR3 kicks in and so on. All works fine. /ip route add check-gateway=ping disabled=no distance=1 dst-address=127.0.0.2/32 gateway=10.1.0.2%w...

kleshki

Yes, here it is /interface bridge port add bridge=bridge interface=wifi-5ghz /interface bridge vlan add bridge=bridge tagged=bridge,wifi-5ghz-guest vlan-ids=10 add bridge=bridge tagged=bridge,wifi-5ghz vlan-ids=100 add bridge=bridge tagged=bridge vlan-ids=50 /interface vlan add arp=reply-only interf...

kleshki

If you have only static leases and DHCP is on a bridge with vlan-filtering, you can use /int/bridge/host static entries for that and add devices per their MAC.

kleshki

Maybe "one session per host" tick may help you in L2TP server configuration.

kleshki

You may want to add custom info into your script flow. I.e.

:if (whatever) :log info "script X failed on Y"

kleshki

TLDR; The fix was to limit myself to only channels up to 124.

What's the ROS version you have where it works?

kleshki

Another XY problem. That's why its good to
1. Post entire config
2. Ask right questions

kleshki

Googled this thread viewtopic.php?t=196632 and then noticed it's in beta forum.
So, peer counters still reset after reaching 4096MB (ROS 7.16) any update on this, will there be a fix?

kleshki

How is this a bottleneck if you don't have CPU pumping to 100% (or atleast one core to 100%)? We also know now you have queues, they may be misconfigured, leading to problems you described Edit: you can't have switch-hw configuration as you don't have switch chip in hap ac. This is hardware not soft...

kleshki

Connect wired until you figure out

kleshki

Is there any progress on the issue? Year gone and peer counters still reset @32bit byte value

kleshki

He meant old wifi config won't help since in new versions there's new wifi package which differs in configuration, and you should do it from scratch

kleshki

I'm using ax3 device, which is a bit more powerful than ac2, but have no issues with pushing 600 Mbps speed over 5GHz ax using vlan filtering (tagged only bridge 3 vlans, ether and wlan2.4 and wlan5 bridged in a single bridge). It also doesn't have a built-in switch chip so I just use regular bridge...

kleshki

The first block should contain them. The problem is that current implementation is buggy and gonna be fixed in 7.17, so no more handshake failures in logs. Currently, if client doesn't handshake in a default 2min window, server tries to handshake on its own using discovered client endpoint, which sh...

kleshki

It's a server-side config "per-user", you can have multiple peers on a single interface, and for a reason want to be some as initiators, and others as responders. But that only means if server wish to start connection first or not, but doesn't affect "client wishes" in any way.

kleshki

Responder should be side that can have static connectivity and IP address (let's call it server, maybe? WG seem to not love this word), so dynamic devices can initiate connection to it, and responder, well, responds to them.

kleshki

Maybe your router is insecure and compromised. "admin" is not a secure login and should be removed right after turning on your device and before letting it to Internet. My advice would be: 1. Inspect your config (maybe with help of a professional) for vulnerabilities or if it's compromised...

kleshki

Firewall is always enabled but for L3. Enabling "Use IP Firewall" in /int/bridge section means firewall also starts processing L2 traffic. Yes, it will have a performance hit - but depends on your environment, if it will be noticeable or not. My suggestion would be to create a VLAN for eac...

kleshki

a Java application deployable on some Java runtime container like Tomcat or JBoss

This should be a docker container or a self-contained app, not a java application. Unifi has its controller with java dependency and it's annoying af.

kleshki

I doubt 50 Mbps is the amount hap ac can't handle. Check your router resource consumption under load. Maybe you have your firewall overloaded or something. Also what's the firmware version?

kleshki

What's your internet bandwidth, so just a package update breaks your streaming? If you have a good enough ISP link, you probably should investigate your wireless issues and fix them, rather than baking queues into where they're not needed at all

kleshki

5GHz would still be nice to see because of wireless interference in some places where you can come.
hap ax lite lte is nice with everything but 5GHz absence. If it's by design to make a more compact router, I'd personally prefer this to be with 5GHz-only.

kleshki

The advantage is you have one less interface in your configuration, which is already something

kleshki

Same stuff via api.
MikroTik please react! This is common

kleshki

My assumption is that EoIP should be set as tagged in /bridge/vlan like regular port (someone should confirm this or you may try it out yourself) as I don't see any tagged traffic in torch output.

kleshki

Nah there are lots of hosts that are focused on scanning such things. I got caught by the same thing and ALSO with api but on a fresh CHR on VPS. It's actually your fault that you netinstall with WAN/modem link up, eject it until your config is reapplied and device is secure. P.S.: still propose MT ...

kleshki

There's not much of configuration related to VLANs in this setup. Bridge filter, two interfaces, move IP from bridge to lan vlan, appropriate datapath per wlan. Then what you said: firewall and so on.

Your solution works too tho, it's fine. It's just my opinion that it should be configured this way

kleshki

I guess this is not high priority since small companies barely need that, and big enterprises can implement it on their own without much effort. My bet is people having same request as yours can be counted on fingers.

kleshki

Implement separate VLAN for LAN and guest and assign DHCP servers per VLAN. Adjust firewall accordingly. This will fix your problems, including red dhcp (which is red because wlan interface is considered disabled until at least single client is connected, and dhcp on disabled interface is red indeed).

kleshki

Try to establish EoIP between RB and switch so traffic flows through tunnel. This way you will exclude AP problems or state that they're involved and go with this solution. If the problem persists, the problem is with either RB or switch (but I personally can't spot it for now). If not - either use ...

kleshki

1. b 2. b and b (which seems to be "c"). Either CHR package or docker container. Would be nice to see native Windows service, not just *nix, since I use MikroTiks in Windows environments much. 3. -Active Directory integration for service itself (to split device configuration/monitoring per...

kleshki

On one side you are right, but on the other - if you asking something for years for a really huge enterprise - why not just create your own log proxy to convert it to whatever you want?

kleshki

My bad I missed that connection point, need glasses LOL. in that case will only work if the APs are managed and can pass vlans. Happens, everyone can miss details :D Since topicstarter wants to save his APs, my proposal still remains - use wireless bridge as transport for EoIP or L2TPv3 tunnel or s...

kleshki

You probably should setup queues to limit user bandwidth

kleshki

User can set whatever he wants, but wg traffic still doesn't bypass firewall. So if you tell in-interface=wg-users out-interface=whatever-allowed action accept and drop at the end, you are fine.

kleshki

I don't say it's impossible, I only say that scheme states there's WiFi 7 between APs, not wire. We can only guess if it's possible to wire them or not, until topic starter returns back with answers

kleshki

I guess the idea is that it's impossible to have wired connection between APs, since locations are called home and office, they are separate. And APs build a wireless bridge. In that case, it doesn't matter if APs are directly attached to CRS and RB, or through small smart switches and trunk ports.

kleshki

No, admin privileges are not required to run winbox, it only may ask you to add to the firewall but that's automatic. You may have some kind of "custom image" of windows, where everything is cut for "performance" reasons. Those sucks, but no one can guess what causes your problem...

kleshki

You can create multiple wireguard interfaces and connect to them separately.

kleshki

If you want to put VLAN-unaware devices to VLAN, you use untagged ports on your VLAN-aware switch and that's it. Won't that make all the devices connected via the switch part of the same VLAN? I want the segregation to happen also at the switch level, I want to have different ports associated with ...

kleshki

If you want to put VLAN-unaware devices to VLAN, you use untagged ports on your VLAN-aware switch and that's it.

kleshki

Do like this

kleshki

You probably should just have correct gateway on your WS. If it's only at vlan10, you should specify default gateway of the corresponding vlan and the traffic will pass to it without any extra actions. It's also weird for me that you use 10.x.x.0/24 address for each vlan, this is not intended for us...

kleshki

https://i.imgur.com/qPURAfr.png This is literally what happens when you follow official wiki guide to install CHR into ubuntu VPS (curl -> unzip -> dd) here . While you enter "admin" through VNC, kindly decline an offer to read full license agreement, type new password twice, a bot that s...

kleshki

Seems to be an XY problem. Ask what you wish, not about winboxes.
Very true noted above, if it's just for logs, you can log to remote.

kleshki

Didn't have a deal with e-i-n, but you can probably try to supout when CPU is already high but not 100% yet (around 95%+)

kleshki

1) If DoH is configured, regular DNS is used to resolve DoH hostname only 2) It is on 7.16 already, you can try it out. On older versions, static entries are ignored when DoH is configured, so you may or may not disable it - doesn't matter 3) No way currently, only one DoH can be configured at once ...

kleshki

IIRC, it's pretty new that CHR has dhcp in defconf. And firewall stuff is usually extra-service for extra money, pretty unnecessary after you setup your own security. I think a good thing is to have all stuff like dhcp, L2 discovery, IP services and MAC-access stuff to be disabled by default, and pr...

kleshki

What's the point of dhcp-client in default CHR configuration? If CHR is deployed on owned servers, it's no problem to setup address through console or even login through MAC. I got caught in a situation, where I did fresh CHR installation on a VPS using dd, and was literally too slow to login though...

kleshki

You can advertise LL address fe80::whateveritis/64 which is not dynamic

kleshki

Blaming MikroTik for setting proxy properties in your browser in another stage of weirdness. Check if your PC is compromised

kleshki

SSTP has decent speeds with CHR where VPS provider has correct passthrough of AES-hw encryption AND you specify AES256-GCM encoding (while AES256-SHA doesn't enable Hw.Crypto flag for some reason). I personally do not know what exactly means "correct passthrough" but I've seen around 50-70...

kleshki

You can still use PCC but play with values, so more goes into WAN1

kleshki

I use hap ax3 at home, why would I lose functionality because someone bought wrong home device that "just don't work"? Those who did it accidentally can just return it back to shop. When you open MT shop cart, in literally every shop you can definitely see reviews like "it's HARD to s...

kleshki

It's both 1Gb/s up and down simultaneously, so it's actually 2Gb/s speed according to your screen. You can try setting direction to send/receive and you probably see more. For P10 it seems to be a bug with license limitation, since P-unl works fine. Do you also monitor host resources state? Maybe in...

kleshki

Oddly enough - https://help.mikrotik.com/docs/display/ROS/Device-mode [admin@MikroTik] > system/device-mode/print mode: enterprise interesting. Perhaps MikroTik is already been thinking they need to segment in some manner. You can set mode manually, this is another thing, probably created to rent t...

kleshki

Yep, true.
I think the first thing that should be tested is P unlimited, so there's no internal limiting mechanism involved.
If the issue resolves, than it's a P1/P10 bug, if not - something else.

kleshki

I know this seems to be related to a license at first, but maybe not. It's interesting to see if the problem persists on another type of hypervisor, especially in Hyper-V since it doesn't use virtio drivers for switches. Also, what happens if you try to acquire different type of license for testing ...

kleshki

I didn't open a separate ticket for that, but send my supout in another ticket wifi-related (I've notified them that I can't test wifi further because of that crash), so they know I had this problem and received supout, but dunno how do they handle this. No response for ticket where I send it.

kleshki

No, in first post you stated that you run speedtest from container. Can you do the same but now watch perfmon

kleshki

What if you do profiling when you do iperf from internal source through CHR?

kleshki

With BTest your CPU is under 100% load, that may probably cause issues. Can you use Tools->Profile to see if your router handles your loads maybe?

kleshki

Or just spin a CHR on the same prox host without any config just with BTest server, can't see a reason why it can take more than 2 minutes to do so

kleshki

You can try to spin iperf container inside CHR and test there (there are example of successful setups)

kleshki

I'm using same version 23.70.2.3 adapter is AX201

kleshki

What is your configuration? I.e. firewall rules and so on.
Have you run perftests from CHR directly to some local host?
What are resources of the CHR VM? How many vCPU and RAM

kleshki

I am facing Wi-Fi connection issues with my hAP ax3, causing the laptop to disconnect during Zoom meetings. As you can see in the logs the laptop gets disconnected from AP despite having the strong signal. This happened in the recent stable version (7.15.3) and still happens in the latest rc versio...

kleshki

Other packets are accepted in filter established rule

kleshki

/summon mind-reader guys
without config export I doubt anyone can help you

kleshki

Make a separate tagged wireless network for those several clients, create an appropriate L3 routing between "several-clients-vlan" and work vlan. Block in firewall when work access is not desired.

kleshki

Printers tend to be kinda dumb with wireless and can keep their address longer. If you can access printer's network stack through its physical panel, you can check out if maybe an address is stuck and should be reset, my suggestion is this now Everything connected smoothly! Thank you very much kles...

kleshki

Printers tend to be kinda dumb with wireless and can keep their address longer. If you can access printer's network stack through its physical panel, you can check out if maybe an address is stuck and should be reset, my suggestion is this now

kleshki

/interface wifi datapath add bridge=bridge disabled=no name=home-private-datapath vlan-id=100 add bridge=bridge disabled=no name=home-guest-datapath vlan-id=10 add bridge=bridge disabled=no name=iot-datapath vlan-id=50 /interface bridge vlan add bridge=bridge tagged=bridge,wifi-5ghz-guest vlan-ids=...

kleshki

Are you trying to catch L2 traffic in firewall? This doesn't pass through it. If device is connected directly, you need to enable IP firewall for bridge (or better consider other options of doing what you want).

kleshki

This looks like a request loop, so request is forwarded to localhost and hits FWD record again. I've also tried to point FWD record to localhost (so it resolves further with upstream), but this didn't work. Try to specify external DNS server.

kleshki

Hello and welcome to forum
You probably have to post your firewall rules, including filter ones, so we don't have to guess what you have already done and what can be wrong with it.

kleshki

Can you manually add wireless interfaces to the ;;;luogo vlan as Tagged?
After that, restart your wireless interfaces, so they are removed from untagged

kleshki

Maybe you can try to ssh into router with IPv6?

kleshki

There is a promiscuous mode in Hyper-V, however, it seems that just enabled spoofing and trunk mode on a virtual port is enough. At least this seem to work between two CHR instances on a single Windows 11 hyper-v host - they failover correctly with just one packet lost. Will try it out with separate...

kleshki

In the Mikrotik DNS , add static entries for the MT devices.
It will create the corresponding reverse DNS (PTR) entries with the correct syntax for you.
.
Klembord3.jpg

Is it possible to do the same for IPv6 when prefix is dynamic? ::1/64 something like that AAAA record

kleshki

I suggest you change admit frame type to "admit all" on wireless interfaces and try it out. I can't explain, but I remember I had issues with wifi and vlans on 7.x, but now I look at my own config and see that wifi interfaces are actually shown under "Current tagged" in /interfa...

kleshki

I suggest you change admit frame type to "admit all" on wireless interfaces and try it out. I can't explain, but I remember I had issues with wifi and vlans on 7.x, but now I look at my own config and see that wifi interfaces are actually shown under "Current tagged" in /interfac...

kleshki

Answering own question:
1. Set bridge port passed-though off vswitch frame types to admit tagged-only
2. Set bridge frame types to admit all, set PVID to the desired VLAN for VRRP packets
3. In bridge/vlans add desired VLAN to list, add bridge as untagged, port as tagged

kleshki

Can you post some kind of your connection scheme, like are those printers wireless or wired and what ports/networks do they use, is there a switch (managed or dumb) in-between and so on

kleshki

Ok, after some investigation I've found out that: Attempt 2: was a stupid misconfiguration by me, where I duplicated vlan20-vrrp IP and static IP of another device in subnet. Everything works. Attempt 1: I managed to get it working by: 1. Create a bridge. Add ether1 to bridge. Assign unused subnet I...

kleshki

Nothing. /interface bridge add admin-mac=48:A9:8A:XX:YY:ZZ auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes You can check it with either UI or by typing /interface bridge export verbose There is pvid=1 which is not exported since it's default value, but ...

kleshki

Once you set a port as trunk, default remains at 1, true, since the setting "Admit only VLAN tagged" obsoletes that anyhow. Access ports should be set to the pvid for the VLAN they are supposed to handle and "Only admit untagged ...". Nowhere else (besides trunk ports) I have pv...

kleshki

From The unofficial official VLAN bible: https://forum.mikrotik.com/viewtopic.php?t=143620 A word of caution if you are thinking of using VLAN 1 in your network design. Most vendors use VLAN 1 as the native VLAN for their hardware. MikroTik uses VLAN 0. If you try to create a VLAN 1 scenario with M...

kleshki

5678 seems to be LLDP traffic

kleshki

As already stated above, there's a defconf rule to accept input from loopback (commented for CAPsMAN) on some devices, so you probably already had the rule but accidentally removed it.

kleshki

For me it doesn't look ok, because lo doesn't actually represent LAN. Eventually you could have some case when you have to have it separate. So my suggestion is to make an explicit accept rule for lo interface and place it before drop rule:

/ip firewall filter add action=accept in-interface=lo

kleshki

DHCP offer but not accepted I've usually seen with incorrect VLAN configuration (so traffic goes out but doesn't return back). Haven't check yet the config, but maybe you will find it yourself, or probably there's a misconfigured switch in-between. Edit: my assumption is that you have pvid=10 on bot...

kleshki

I have both IPv4 and IPv6 tunnels established (using separate interfaces and peers) and I have equal bandwidth on both protocol versions. Tunnels are between hap ax3 <-> CHR and CHR <-> CHR.

kleshki

This is not a (permanent) solution since reducing channel width also lowers throughput.

Search found 293 matches