Community discussions

MikroTik App

Search found 292 matches

by DarkNate
Sun Feb 28, 2021 8:37 am
Forum: General
Topic: Cannot ping IPv6 MikroTik Cloud
Replies: 7
Views: 432

Re: Cannot ping IPv6 MikroTik Cloud

It's likely your firewall misconfigured.

Use my firewall which I tried my best to conform to various IETF specs, built from scratch: viewtopic.php?f=2&t=172360
by DarkNate
Wed Feb 10, 2021 11:52 am
Forum: Scripting
Topic: Ipv6 good firewall rules?
Replies: 2
Views: 208

Re: Ipv6 good firewall rules?

I have fully built IPv4 and IPv6 firewall with IETF spec in mind + CPU optimisation.

Check here: viewtopic.php?f=2&t=172360&p=842544#p842544
And here: https://www.reddit.com/r/mikrotik/comme ... rent_ietf/
by DarkNate
Tue Feb 09, 2021 12:31 pm
Forum: Announcements
Topic: v6.48.1 [stable] is released!
Replies: 97
Views: 17500

Re: v6.48.1 [stable] is released!

BTW, the copyright needs to be updated for 2021... It still reads: MikroTik RouterOS 6.48.1 (c) 1999-2020 http://www.mikrotik.com/ (And when you are at it... How about changing the url to https?) They have enabled HTTPS overwrite on their domain, technically it wouldn't matter. But you'd expect a &...
by DarkNate
Tue Feb 09, 2021 9:45 am
Forum: General
Topic: IPV6 PPPOE Help
Replies: 2
Views: 210

Re: IPV6 PPPOE Help

MikroTik's IPv6 is lacking. Consider using VyOS instead. We can't even NPTv6 in MikroTik let alone go with advanced setups for an ISP.
by DarkNate
Tue Feb 09, 2021 9:43 am
Forum: Announcements
Topic: v6.48.1 [stable] is released!
Replies: 97
Views: 17500

Re: v6.48.1 [stable] is released!

and, no, i don't want any other answer straight one, meaning of word stable is ... Stable is don't be a pussy man! Stop complaining, you'll better send a bug report. Send a bug report? Are you new to MikroTik, users both home and professionals have been reporting various bugs for decades and MikroT...
by DarkNate
Tue Feb 09, 2021 9:42 am
Forum: Announcements
Topic: v6.48.1 [stable] is released!
Replies: 97
Views: 17500

Re: v6.48.1 [stable] is released!

BTW, the copyright needs to be updated for 2021... It still reads: MikroTik RouterOS 6.48.1 (c) 1999-2020 http://www.mikrotik.com/ (And when you are at it... How about changing the url to https?) They have enabled HTTPS overwrite on their domain, technically it wouldn't matter. But you'd expect a &...
by DarkNate
Sun Feb 07, 2021 6:01 pm
Forum: General
Topic: Is RouterOS and (routing in general) still faster on routers than on dedicated computer ? [SOLVED]
Replies: 13
Views: 1153

Re: Is RouterOS and (routing in general) still faster on routers than on dedicated computer ? [SOLVED]

This is why I'm going full x64 Zen3 in the near future with VyOS as my network OS choice. Slap some 10G NICs and it'll outperform RouterOS like eating a piece of cake.
by DarkNate
Sat Feb 06, 2021 8:57 am
Forum: General
Topic: Is my firewall config up-to-date with current IETF spec (IPv4 & IPv6)?
Replies: 0
Views: 386

Is my firewall config up-to-date with current IETF spec (IPv4 & IPv6)?

EDIT: I have updated my post with new rules/changes based on the input I received here: https://www.reddit.com/r/mikrotik/comments/ld390x/is_my_firewall_config_uptodate_with_current_ietf/ So I referenced from MikroTik's new 2020 dated documentation domain/site and built the IPv4 and IPv6 firewall fr...
by DarkNate
Fri Feb 05, 2021 7:19 pm
Forum: Announcements
Topic: v6.48.1 [stable] is released!
Replies: 97
Views: 17500

Re: v6.48.1 [stable] is released!

Problem also remains in this version. Edit by moderator: Please DO stop posting and quoting same set of quotes of quotes. You have been already warned. It is users' forum, not Mikrotik's stuff one. Send e-mails directly to support. I'm sorry, but I've no idea which moderator made this edit so I can...
by DarkNate
Fri Feb 05, 2021 2:21 pm
Forum: Announcements
Topic: v6.48.1 [stable] is released!
Replies: 97
Views: 17500

Re: v6.48.1 [stable] is released!

Problem with DoH was not fixed ?! omg
Use a separate device. I use a Pi, with dnscrypt-proxy running for DoH and Pi-Hole as the DNS Sinkhole. Uptime more than 8 months excluding updates/firmware patches/reboots.
by DarkNate
Fri Feb 05, 2021 12:02 pm
Forum: General
Topic: PCC works but no local server access [SOLVED]
Replies: 4
Views: 350

Re: PCC works but no local server access [SOLVED]

Great, thank you, this solved it for me I did: /ip firewall address-list add address=10.0.10.0/24 comment=RFC6890 list=rfc6890 add address=10.0.20.0/24 comment=RFC6890 list=rfc6890 add address=10.0.30.0/24 comment=RFC6890 list=rfc6890 add address=10.0.100.0/24 comment=RFC6890 list=rfc6890 add addre...
by DarkNate
Fri Feb 05, 2021 8:26 am
Forum: General
Topic: PCC works but no local server access [SOLVED]
Replies: 4
Views: 350

Re: PCC works but no local server access [SOLVED]

Create an RFC6890 based address list, then give a !rfc6890 dst-address-list in each of the mark connection mangle rules. Problem solved.
by DarkNate
Tue Feb 02, 2021 8:25 am
Forum: General
Topic: NAT Slipstreaming v2.0
Replies: 5
Views: 669

Re: NAT Slipstreaming v2.0

It runs from a browser exploit which has now been patched. I decided to leave the helpers on.
by DarkNate
Sun Jan 31, 2021 3:30 pm
Forum: General
Topic: Open 100 tabs at the same time
Replies: 13
Views: 878

Re: Open 100 tabs at the same time

hAP ac lite is a weak device. I'd personally do a clean netinstall of the latest stable RouterOS and set up from scratch again with optimised firewall rules/hardware offloading/optimisation configurations.
by DarkNate
Sun Jan 31, 2021 3:27 pm
Forum: RouterBOARD hardware
Topic: Recomended Router for 60 clients
Replies: 1
Views: 291

Re: Recomended Router for 60 clients

RB450Gx4 can "just" do 1G routing. I'd suggest something like the RB3011UiAS-RM or the RB4011iGS+RM for some futureproofing.
by DarkNate
Sat Jan 30, 2021 9:30 am
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

It's the last time I wrote about some quirks in the configs. An "Oh yeah we forgot about this since we set it like this ages ago, we'll maybe take a look on this to improve the behaviour since it might have not been the best call back then" would've been a little better than "set it ...
by DarkNate
Mon Jan 25, 2021 8:31 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

I know i am at dual nat state. From the ISP side is not possible for a pppoe connection. Also the CPE manages the Voip telephony so my only option is connecting with just an IP. Is there any way to manage or handle the dual nat problems? btw how does the above config distributes the connections? Is...
by DarkNate
Sat Jan 23, 2021 1:09 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

as far as I among other folks on this topic have checked recursive route for the purpose of failover does not come along with PCC load balancing if two or more route marks are being used.
I use PCC+Nth mangle load balancing + recursive routes just fine. I've shared the config in previous posts.
by DarkNate
Sat Jan 23, 2021 9:42 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

You're in a double NAT situation. Ask the ISP to bridge the CPE. Then establish PPPoE at the router level. That's is the right way to do it.

Double NAT will create all sorts of weird issues for obvious reasons.
by DarkNate
Mon Jan 11, 2021 3:00 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Hi there, Wait, what? If ISP1 fails, all clients can still reach 8.8.8.8 & 1.0.0.1 via ISP2. The routing table will automatically drop those dead ISP1 routes including the custom route for 8.8.8.8 & 1.0.0.1 which is routed via ISP1's interface, the routing table would fall back to the "...
by DarkNate
Mon Jan 11, 2021 2:56 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Ok, support response is: "RouterOS simply allocates 20 bytes headers. You can manually set the MTU and MRU values for the interface if other values are suitable. There is no need to increase the MTU on the ethernet interface." So they won't do anything about it. "What about the users...
by DarkNate
Sun Jan 10, 2021 5:58 pm
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

What? IPv6 was designed with SLAAC in mind, there's absolutely no NAT or ugly hacks needed with a proper prefix delegation from the upstream provider. Unless you have an upstream provider like mine who blocks ICMPv6 and breaks MTU along with a garbage single /64 prefix. What "what"? :-) Y...
by DarkNate
Sun Jan 10, 2021 4:42 pm
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

I fail to understand why some people choose to use IPv6 for internal networking, stick with IPv4 for internal networking (which includes the DNS stub resolver), I mean IPv6 was created to restore the end to end principle and not as an alternative to IPv4 internal networking. You got the right idea....
by DarkNate
Sun Jan 10, 2021 4:28 pm
Forum: Virtualization
Topic: Web cache proxy for Isp
Replies: 5
Views: 633

Re: Web cache proxy for Isp

Caching proxies in 2021 with most websites running TLS nowadays, is... oxymoron.
Web Caching proxy tools still exist in 2021? Crazy.
by DarkNate
Sun Jan 10, 2021 4:10 pm
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

Yeah, so really, there is no problem with RouterOS's approach to IPv6 DNS, you can use the stub resolver, or you can use direct public resolvers on a per-client basis Well, if the clients are IPv6 only, there will be no fallback to IPv4 DNS for them. or even like I do... Simply re-direct to a DNSSi...
by DarkNate
Sun Jan 10, 2021 3:05 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Obviously. But again, what you are doing is not equivalent to what I am doing, is it? I totally agree that this is all a delicate trade-off balance. In your solution, if ISP1 fails, attached clients have no way to reach 8.8.8.8 or 1.0.0.1. This is avoided in my solution at the price of slightly mor...
by DarkNate
Sun Jan 10, 2021 2:56 pm
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

If the "Advertise DNS" flag is disabled, the client devices will end up using the stub resolver on RouterOS. How would they know to use it? What do you mean "how"? If the flag is disabled, client devices will automatically fall back to the IPv4 DNS address that was originally ad...
by DarkNate
Sun Jan 10, 2021 11:22 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Aaand hello again, I have been able to piece the puzzle together. So if I understand correctly (and at the very least, things seem to work on my router with this setup), this is what needs to be done to be able to have multiple canary hosts AND PPPoE. I'll use 1.1.1.1 and 9.9.9.9 as canaries here, ...
by DarkNate
Sun Jan 10, 2021 11:14 am
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

If the "Advertise DNS" flag is disabled, the client devices will end up using the stub resolver on RouterOS. How would they know to use it? What do you mean "how"? If the flag is disabled, client devices will automatically fall back to the IPv4 DNS address that was originally ad...
by DarkNate
Sun Jan 10, 2021 10:35 am
Forum: Beginner Basics
Topic: Putting more information into router advertisement packets?
Replies: 24
Views: 1231

Re: Putting more information into router advertisement packets?

RouterOS does it a bit odd. If "Advertise DNS" flag is enabled in ND, it will advertise all/any IPv6 addresses set in the IP>DNS fields, whereby the client devices would directly be communicating with said addresses bypassing RouterOS's stub resolver completely. If the flag is disabled, th...
by DarkNate
Sat Jan 09, 2021 9:04 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Hi again, also... A different question here... #Then create a separate route for each of the "gateway" themselves, in my case using the PPP profile hack I just realized I don't understand this hack. How do you "copy" a PPPoE profile? Cheers, Toby. https://forum.mikrotik.com/view...
by DarkNate
Sat Jan 09, 2021 5:20 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Hi, Yep, generally that's how it works. If you need the router connectivity - you should either create a rule for its traffic to go to 'exit' table, or add default route(s) to 'main' table. Cool, THX. So then for the record this is my minimal working example that does failover with high-availabilit...
by DarkNate
Sat Jan 09, 2021 12:45 pm
Forum: General
Topic: Load Balancing and
Replies: 5
Views: 480

Re: Load Balancing and

Load Balancing three WANs? Easy add action=mark-connection chain=prerouting connection-mark=no-mark \ in-interface=pppoe-out1 new-connection-mark=ISP1_conn passthrough=no add action=mark-connection chain=prerouting connection-mark=no-mark \ in-interface=pppoe-out2 new-connection-mark=ISP2_conn passt...
by DarkNate
Sat Jan 09, 2021 12:39 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

I'll wait from support, the behaviour ain't quite right.
Any user that has a pppoe-client as WAN out there is using a 12 bytes lower MTU than his provider supports, if everything is left to auto/defaults that is.
That is also correct. Do keep us updated.
by DarkNate
Sat Jan 09, 2021 9:47 am
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Ok, I think I've figured it out where the bug might be, hope support confirms / fixes this. I've took some captures from the ethernet interface while connecting the pppoe-client and while watching them in Wireshark I saw something in an area to which I didn't pay much attention earlier (protocol re...
by DarkNate
Thu Jan 07, 2021 7:28 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

I wrote to support about this anyway, I had good results with support in the past, the issues reported were fixed. Let us know, 12 bytes going to thin air isn't possible. Someone suggested it's "padding" exclusive to MikroTik which happens to be undocumented. Perhaps you can help this gen...
by DarkNate
Thu Jan 07, 2021 7:25 pm
Forum: General
Topic: Some websites unavailable on IPv6 [SOLVED]
Replies: 12
Views: 1081

Re: Some websites unavailable on IPv6 [SOLVED]

It totally stinks and that's great. I hate these broken MTU promoters. My primary uplink provider still caps MTU at 1460 on their so-called "next-gen" fibre infrastructure. Some people never graduated 1500 ethernet MTU basics. If you have a better way given the conditions of reduced MTU a...
by DarkNate
Thu Jan 07, 2021 2:56 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Regarding the MRU, no, here it shows only 1492 (max-mtu/mru both unset / auto) but I'll stay with 1520 in case the ISP decides to implement RFC4638 anyway. ppp-mtu.PNG So MRU is not always going to be supported @1500. We found here in my country that about 20+ different OLT/ONT brands have broken M...
by DarkNate
Thu Jan 07, 2021 2:45 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

That's the one I was reffering to, how and why are those 12 (apparently invisible since it works just fine with 1500 and manualy setting 1492 for the PPPoE client interface) bytes getting in the picture. I wasn't referring to the max-payload packet, I was just underlining the differences there. Mik...
by DarkNate
Thu Jan 07, 2021 2:37 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Ah, you had another post above explaining the two ISP's, I've missed it, sorry. Did some tests here, is this realy a MikroTik PPPoE implementation bug? I'll post some logs with stripped irelevant (I hope) stuff. Ethernet MTU 1500: 13:20:05 pppoe,ppp,debug,packet pppoe-wan: sent LCP ConfReq id=0x20 ...
by DarkNate
Thu Jan 07, 2021 1:25 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

My english is not so good so i wiil try to explain my plain FTTH. I plug in my fibre direct in SFP in modem.No GPON interface in front of my modem. In our contry was deployed FTTH at first but then started GPON deployment beacuse of price. SFP is BiDi 1310/1550 That SFP module is your ISP's method ...
by DarkNate
Thu Jan 07, 2021 1:16 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Your magic orb is probably better than mine, maybe he set it to the MTU negotiated by the PPPoE interface, like I wrote on the other topic :) PS: your screenshots kinda proove that your ISP has RFC4638 implemented, otherwise it wouldn't negotiate 1500 MTU on your PPPoE interface. Why do you state t...
by DarkNate
Thu Jan 07, 2021 12:24 pm
Forum: General
Topic: Some websites unavailable on IPv6 [SOLVED]
Replies: 12
Views: 1081

Re: Some websites unavailable on IPv6 [SOLVED]

Again, not even here he didn't went with 1280. Read: https://forum.mikrotik.com/viewtopic.php?f=2&t=169757#p831468 The marked "solution" which stinks was not applied. It totally stinks and that's great. I hate these broken MTU promoters. My primary uplink provider still caps MTU at 14...
by DarkNate
Thu Jan 07, 2021 12:22 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

How do you know that he forced 1280? This is how: https://forum.mikrotik.com/viewtopic.php?f=2&t=171390#p838047 Updated my post with screenshots: https://forum.mikrotik.com/viewtopic.php?f=2&t=171390&p=838089#p838089 Anyone with basic knowledge and fundamental understanding of MTU and M...
by DarkNate
Thu Jan 07, 2021 11:11 am
Forum: General
Topic: Some websites unavailable on IPv6 [SOLVED]
Replies: 12
Views: 1081

Re: Some websites unavailable on IPv6 [SOLVED]

Set your IPv6 MTU to 1280 and see if that solves the issue as there are places on the internet that are still 1280 for IPv6. If that resolves it, you can slowly raise it until things break again to understand what your effective MTU is. https://blog.cloudflare.com/increasing-ipv6-mtu/ ICMPv6 is the...
by DarkNate
Thu Jan 07, 2021 11:09 am
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Connection to ISP is fibre. It is not GPON. It is plain FTTH. Bruh, FTTH is Fibre to the home, what in the world is "plain" FTTH? Unless you live right next to AT&T's NOCs, it is a PON, no way your ISP can afford AON to millions of customers. It can be GPON or EPON or XG-PON or XGS-PO...
by DarkNate
Wed Jan 06, 2021 7:46 pm
Forum: General
Topic: Netflix and IPv6
Replies: 27
Views: 1974

Re: Netflix and IPv6

Set underlying ethernet interface actual MTU to 1520 (value is this high because MikroTik seems to require undocumented padding for PPPoE on layer 2.5, in normal cases of course 1508 is sufficient) and L2 value must be greater than that to ensure VLANs works well, 1598 is good enough. Now in the PPP...
by DarkNate
Sat Jan 02, 2021 10:44 am
Forum: Announcements
Topic: v6.48 [stable] is released!
Replies: 324
Views: 61629

Re: v6.48 [stable] is released!

we are waiting for 6.48.5 .. stable release is beta channel Agree, The "stable" channel should be called Beta. Although v6.48 is perfectly stable for my RB450Gx4. I agree with you and the other members here. Eventually, I will be forced to move to a different vendor with a more reliable &...
by DarkNate
Sat Jan 02, 2021 10:40 am
Forum: Beginner Basics
Topic: Want to transfer packets for specific device through selected WAN from multiple WAN
Replies: 1
Views: 440

Re: Want to transfer packets for specific device through selected WAN from multiple WAN

Add these at the top of the rules but below the WAN rules (marks for incoming connections through WAN) add action=mark-connection chain=prerouting comment="Force aslanbdb's iPhone X to ISP2" connection-mark=no-mark dst-address-list=!not_in_internet dst-address-type=!local in-interface=brid...
by DarkNate
Thu Dec 31, 2020 1:13 pm
Forum: General
Topic: Trying to get IPV6 working with RouterOS 6.48
Replies: 7
Views: 668

Re: Trying to get IPV6 working with RouterOS 6.48

First, what is "Fibre modem"? Check here: https://networkengineering.stackexchange.com/questions/64456/is-an-ont-a-modem/64461#64461 Second, make the WAN interface as null in the ONT/ONU. It will automatically turn into a simple layer 2 forwarding device aka bridge mode. Assuming your ISP ...
by DarkNate
Wed Dec 30, 2020 10:35 am
Forum: General
Topic: VPN for Mikrotik for game Mobile legend
Replies: 7
Views: 621

Re: VPN for Mikrotik for game Mobile legend

Depends on your ISP, ML IIRC uses AWS. Many ISPs aren't peered with AWS. A VPN provider may fix the latency, only if the latency from your ISP to said VPN is low + VPN host is peered with AWS via their own upstream provider. A lot of factors are involved.

Just ask your ISP to peer with AWS instead.
by DarkNate
Tue Dec 29, 2020 12:25 pm
Forum: Beginner Basics
Topic: About log records " pptp, info - TCP connection established from xxxx "
Replies: 4
Views: 327

Re: About log records " pptp, info - TCP connection established from xxxx "

I have a /16 network on internet and it gets a constant flow of 1-2 Mbit/s of this crap. I run some automatic blacklisting on that network (which is not as straightforward as you would think), and it lists 70000-80000 systems doing such scans all the time. That would be too complex for most retail ...
by DarkNate
Tue Dec 29, 2020 11:07 am
Forum: Beginner Basics
Topic: About log records " pptp, info - TCP connection established from xxxx "
Replies: 4
Views: 327

Re: About log records " pptp, info - TCP connection established from xxxx "

You are probably running OpenVPN or some other server. That's not a security hole if the firewall is properly configured, it's just an attempted TCP connection from those IPs. They can be bots/human attackers or researchers like Censys. I regularly get attempted "hacks" from Censys (which ...
by DarkNate
Mon Dec 28, 2020 10:24 am
Forum: General
Topic: Mikrotik device behind limited ISP modem
Replies: 15
Views: 1100

Re: Mikrotik device behind limited ISP modem

Hi DarkNate, unfortunately the ISP device does not support bridge mode. I am hoping for some creative solution that will allow me to get rid of the double NAT given the plenty limitations of the ISP device. Is it PON? GPON/EPON? DOCSIS? DSL? One method to bridge is either to use an explicit "b...
by DarkNate
Mon Dec 28, 2020 9:53 am
Forum: General
Topic: Feature Request: IPv6 NAT66 Support
Replies: 42
Views: 12312

Re: Feature Request: IPv6 NAT66 Support

Is NAT66 the same as NPTv6, though? I believe they are a different concept, different RFCs even. You're right: NAT66 is not the same thing as NPTv6. The Opening Post originally asked for NAT66 six years ago, but many people in this thread have asked for NPT instead. NAT66 is the stateful port trans...
by DarkNate
Sun Dec 27, 2020 6:25 pm
Forum: General
Topic: DDOS Rules when Connection tracking is Off
Replies: 9
Views: 733

Re: DDOS Rules when Connection tracking is Off

DDoS protection at ISP level shouldn't be relying on "drop" rules, that's what we do at home.

ISPs should use more pro-grade solutions: https://security.stackexchange.com/a/134770
by DarkNate
Sun Dec 27, 2020 5:56 pm
Forum: General
Topic: Is it possible to "subnet" a /64 prefix between 2 internal LANs?
Replies: 10
Views: 905

Re: Is it possible to "subnet" a /64 prefix between 2 internal LANs?

No, ROS (for now) supports only usage of /64 subnets. Ask your ISP to stop being jerks and to start to deliver at least /60 prefixes. https://www.ripe.net/publications/docs/ripe-690 : A single network at a customer site will be a /64. At present, RIR policies permit assignment of a /48 per site, so...
by DarkNate
Sat Dec 26, 2020 8:25 pm
Forum: General
Topic: Mikrotik device behind limited ISP modem
Replies: 15
Views: 1100

Re: Mikrotik device behind limited ISP modem

Bridge the ISP device, that will make it a simple layer 2 forwarding device. Bridge mode depends on make and model aka Transparent bridging.
by DarkNate
Sat Dec 26, 2020 11:29 am
Forum: General
Topic: Another thread asking for help with port forwarding (RB750Gr3)
Replies: 7
Views: 637

Re: Another thread asking for help with port forwarding (RB750Gr3)

Is your ISP using CGNAT? If they are, obviously you can't port forward. If they are not, then something like this will work: add action=dst-nat chain=dstnat comment="Port Forwarding for Local Web Server to WAN" dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=192.168.8.9 to-port...
by DarkNate
Sat Dec 26, 2020 10:33 am
Forum: General
Topic: PPPoE session with IPv6 ND of automatically allocated /64 and address for WAN interface (SLAAC)
Replies: 4
Views: 460

Re: PPPoE session with IPv6 ND of automatically allocated /64 and address for WAN interface (SLAAC)

I have experience with this. PPPoE over IPv6 via SLAAC aka true IPv6 aka stateless aka your ISP did their IPv6 101 right. Run the DHCPv6 client to request prefix, add that to a pool, then advertise a /64 in IPv6>Address on a per-interface/VLAN basis (since you get a true /48 unlike my useless ISP wi...
by DarkNate
Fri Dec 25, 2020 5:48 pm
Forum: RouterBOARD hardware
Topic: Which router with NAT/Masquerading Performance > 1Gbps
Replies: 9
Views: 1097

Re: Which router with NAT/Masquerading Performance > 1Gbps

...many thanks for your fast response! Looks like that RB450 variant comes with the same CPU and performance test results as the hap-ac2, but with much more RAM...which, economically doubles its retail price in comparison (adding enclosure and power supply). Go for the RB450Gx4, 1GB RAM + 512MB Fla...
by DarkNate
Fri Dec 25, 2020 4:18 pm
Forum: RouterBOARD hardware
Topic: Which router with NAT/Masquerading Performance > 1Gbps
Replies: 9
Views: 1097

Re: Which router with NAT/Masquerading Performance > 1Gbps

Bare minimum I highly suggest this: https://mikrotik.com/product/rb450gx4#fndtn-testresults

Plenty of RAM and storage with powerful enough CPU to hit 1G as per those specs/results.
by DarkNate
Thu Dec 24, 2020 5:46 pm
Forum: Useful user articles
Topic: Using RouterOS to QoS your network - 2020 Edition
Replies: 216
Views: 277180

Re: Using RouterOS to QoS your network - 2020 Edition

Same as yours:
5 sec and 1514 bytes
I wonder if those values need tweaking to give a potentially better outcome.
by DarkNate
Thu Dec 24, 2020 4:54 pm
Forum: Useful user articles
Topic: Using RouterOS to QoS your network - 2020 Edition
Replies: 216
Views: 277180

Re: Using RouterOS to QoS your network - 2020 Edition

What values do you guys use for default SFQ here?
Image
by DarkNate
Thu Dec 24, 2020 10:30 am
Forum: Announcements
Topic: v6.48 [stable] is released!
Replies: 324
Views: 61629

Re: v6.48 [stable] is released!

RB450Gx4. Smooth upgrade, no problems, no errors, nothing. Perfect.
by DarkNate
Thu Dec 24, 2020 10:07 am
Forum: General
Topic: Feature Request: IPv6 NAT66 Support
Replies: 42
Views: 12312

Re: Feature Request: IPv6 NAT66 Support

On IPv6 I generally avoid NAT but see the need for NPT. However, I do actually agree that in a few corner cases NAT66 can be helpful. I would never use it to NAT users, but in one case I am using NAT66 port forward for a RADIUS IP to avoid having to manually add dozens of clients as RADIUS clients....
by DarkNate
Thu Dec 24, 2020 9:21 am
Forum: General
Topic: Feature Request: IPv6 NAT66 Support
Replies: 42
Views: 12312

Re: Feature Request: IPv6 NAT66 Support

Once again, I had to change all IPv6 addresses for services on my local network because Comcast changed my /60 for what seems like the sixth time. I am quite tired of this, so this time, I defined a ULA for my local network instead of changing all of my servers' addresses and reverse DNS zones to t...
by DarkNate
Thu Dec 24, 2020 9:16 am
Forum: Beginner Basics
Topic: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]
Replies: 9
Views: 773

Re: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]

You can try, if it's the only l2tp connection originated by the router. Mangle output and srcnat chains are at your service. But I don't see in what way is it simpler. Yeah, so I went with the null-bridge method, it works! Basically, I created a null-bridge, then in IP>Address List I added a non-ex...
by DarkNate
Wed Dec 23, 2020 8:51 pm
Forum: Beginner Basics
Topic: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]
Replies: 9
Views: 773

Re: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]

Two possibilities: 1) Create a loopback interface (empty bridge) and assign this random/unused address there. That should work. 2) Add a script to PPP profile used for PPPoE to update the address in l2tp-client and route rule any time it changes. Anyway, try to make it work with you current dynamiс...
by DarkNate
Wed Dec 23, 2020 8:33 pm
Forum: Beginner Basics
Topic: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]
Replies: 9
Views: 773

Re: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]

src-address :) Just what exactly do I use for the src-address in LT2P client? Both my WANs are dynamic IPs over PPPoE. I tried using something random/unused like "192.168.3.1" but that resulted in errors phase1 negotiation failed due to send error. 192.168.3.1[500]<=>45.56.157.40[500] 2bf...
by DarkNate
Wed Dec 23, 2020 7:21 pm
Forum: Beginner Basics
Topic: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]
Replies: 9
Views: 773

Re: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]

1) Fill the src-address field in l2tp-client. 2) Use /ip route rule (lookup-only-in-table) to force connections originated from this ip to desired routing table. ExpressVPN does not support static server IPs. They use DDNS based hostnames and the IPs change in every session. It is a commercial VPN ...
by DarkNate
Wed Dec 23, 2020 6:32 pm
Forum: Beginner Basics
Topic: Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]
Replies: 9
Views: 773

Force LT2P (IPSec) tunnel over specific WAN interface [SOLVED]

So I have two ISPs, both are a member of "WAN" interface lists in Interface>List. I have ExpressVPN configured with LT2P+IPSec with NAT/Policy Routing for LAN and it works as expected. But by default RouterOS picks the shortest route to establish the tunnel and that's WAN1. I've tried with...
by DarkNate
Wed Dec 23, 2020 11:41 am
Forum: General
Topic: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]
Replies: 113
Views: 8529

Re: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]

Mikrotik cannot be used in enterprise. Its only for home with low-speed wan. Its too bugged and have very poor support. For example - see CCR\GRE\IPSEC saga: https://forum.mikrotik.com/viewtopic.php?t=84465 https://forum.mikrotik.com/viewtopic.php?t=87892 https://forum.mikrotik.com/viewtopic.php?t=...
by DarkNate
Tue Dec 22, 2020 8:55 am
Forum: General
Topic: What is the difference between 192.168.88.1/24 and 192.168.88.0/24 address list? [SOLVED]
Replies: 35
Views: 2474

Re: What is the difference between 192.168.88.1/24 and 192.168.88.0/24 address list? [SOLVED]

Is 192.168.88.1/24 meant as the gateway address? It is your router's own address. The router can have multiple own addresses (usually in different subnets, and usually each subnet is attached to a different interface). And it is quite typical that router's own addresses are used as gateway addresse...
by DarkNate
Tue Dec 22, 2020 8:53 am
Forum: General
Topic: What is the difference between 192.168.88.1/24 and 192.168.88.0/24 address list? [SOLVED]
Replies: 35
Views: 2474

Re: What is the difference between 192.168.88.1/24 and 192.168.88.0/24 address list? [SOLVED]

Wow, it's even worse - if you open the /ip address table in Winbox via IP -> Addresses, the window title really reads Address List . Shame on you, Winbox developers, for confusing people. Well, it is not wrong, but it confused me at first. Interface address list makes more sense as that section sho...
by DarkNate
Fri Dec 18, 2020 10:11 am
Forum: Beginner Basics
Topic: how to correctly enable DNS over HTTPS
Replies: 6
Views: 687

Re: how to correctly enable DNS over HTTPS

Check the forums, DoH on MikroTik is buggy. I stopped using it completely, plus DoH is dead anyway, we have ODoH now which is coming soon to popular stub/forwarders and you can already use some beta options: https://blog.cloudflare.com/oblivious-dns/ I use Pi-Hole for DNS Sinkholing with dnscrypt-pr...
by DarkNate
Fri Dec 18, 2020 10:07 am
Forum: General
Topic: TCP retransmissions & low performance while bridging
Replies: 5
Views: 625

Re: TCP retransmissions & low performance while bridging

Re-Check Actual MTU and L2 MTU on all ethernet interfaces/bridges/VLANs. Make sure all are the same.
by DarkNate
Thu Dec 17, 2020 5:01 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

This FailOver was public at MikroTik WIKI, now it's moved/re-write here: https://help.mikrotik.com/docs/display/ ... upOverview
@SiB
Great, now I know they reworked my article without even mentioning me... That's a bit depressing :)
by DarkNate
Tue Dec 15, 2020 10:33 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Thanks =) I'm a bit out of networking/ISP for a couple of years already, but still doing my best to support the community :D Some of the core crucial core topics/issues are better documented by individuals like yourself than the networking company/vendor themselves. Which is funny considering they ...
by DarkNate
Mon Dec 14, 2020 6:02 pm
Forum: General
Topic: Ryzen build for Routeros
Replies: 7
Views: 1524

Re: Ryzen build for Routeros

If you're going x64, go for VyOS instead of RouterOS. RouterOS doesn't have many basic features such as NPTv6, Routing Marks for IPv6 etc and the fact that RouterOS v7 has been in development for a decade if not more. VyOS is enterprise-ready (go through their documentation and confirm yourself) an...
by DarkNate
Mon Dec 14, 2020 5:08 pm
Forum: General
Topic: Public-Mikrotik-Bandwidth-Test-Server(s)
Replies: 692
Views: 630153

Re: Public-Mikrotik-Bandwidth-Test-Server(s)

@TomjNorthIdaho was testing multi-threaded (30+), you may have seen requests for up to 200 threads (tested the same with public iPerf3 servers to detect if my ISP throttles per thread, which they do), in case your setup/logs thought it was an attacker, + have two ISPs (testing it out). My ISP's ASN:...
by DarkNate
Mon Dec 14, 2020 4:49 pm
Forum: General
Topic: Ryzen build for Routeros
Replies: 7
Views: 1524

Re: Ryzen build for Routeros

If you're going x64, go for VyOS instead of RouterOS. RouterOS doesn't have many basic features such as NPTv6, Routing Marks for IPv6 etc and the fact that RouterOS v7 has been in development for a decade if not more. VyOS is enterprise-ready (go through their documentation and confirm yourself) and...
by DarkNate
Sun Dec 13, 2020 6:27 pm
Forum: Beginner Basics
Topic: Traffic Priority for Facebook, Messenger and Viber
Replies: 10
Views: 990

Re: Traffic Priority for Facebook, Messenger and Viber

I ended up ditching Queue Tree/Advanced QoS like https://forum.mikrotik.com/viewtopic.php?f=23&t=73214 completely. I use Simple queues like the following: /queue simple add bucket-size=0.01/0.01 burst-time=1s/1s dst=pppoe-out1 max-limit=205M/205M name=ISP1-QoS priority=1/1 queue=default/default ...
by DarkNate
Fri Dec 11, 2020 2:44 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

I don't remember what RB model and how fast internet connections you have, and I'm not re-reading whole thread to find out if you mentioned it or not. But generally, you want the router to do some work, so it needs some resources to do it. Dynamic routing works like this. Whether it's too much or n...
by DarkNate
Thu Dec 10, 2020 11:09 am
Forum: Beginner Basics
Topic: UPnP not forwarding ports
Replies: 4
Views: 457

Re: UPnP not forwarding ports

OP is CGNATted or double NATted themselves by not bridging the CPE.
by DarkNate
Thu Dec 10, 2020 11:07 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

Routing marks are per-packet. If you want them routed the right way, you have to keep marking them. So high CPU usage all the way through and through, at the most, I set passthrough=no for all routing mark rules. So no work-around I guess to reduce CPU usage? Overall my tweaked rules over the month...
by DarkNate
Thu Dec 10, 2020 11:06 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

Well if you were using this as a guide... (and that guy is brilliant)........ https://www.youtube.com/watch?v=67Dna_ffCvc your outgoing mangle rules are not correct. Other than that, above my head. The video is of bandwidth-based load balancing, per interface. I ain't doing that. I use PCC+Nth comb...
by DarkNate
Wed Dec 09, 2020 1:01 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

@Sob hopefully you can see this. So after months-long testing, I have come to one conclusion, the following rules are constantly "marking the route" even for already marked/routed connections and hence leads to increase CPU usage, over 50% CPU usage when I'm downloading/uploading with 30 T...
by DarkNate
Fri Nov 27, 2020 10:12 am
Forum: General
Topic: Load Balancing force some devices to WAN1
Replies: 1
Views: 206

Re: Load Balancing force some devices to WAN1

It's simple, like this:
add action=mark-connection chain=prerouting comment="Force Pi to ISP1" disabled=yes dst-address-type=!local dst-address-list=!not_in_internet in-interface=LAN new-connection-mark=ISP1_conn passthrough=yes src-address=192.168.88.91
by DarkNate
Fri Nov 27, 2020 10:06 am
Forum: General
Topic: Allow CGNat IP to Establish PPTP Connection
Replies: 3
Views: 644

Re: Allow CGNat IP to Establish PPTP Connection

If you're behind a CGNAT. The only way would be to use NAT punching with TCP/UDP (unreliable on some ISPs due to short timeout of UDP streams) from the end-customer's side. Example ngrok, OpenVPN etc. Any protocol that needs a real public IP address port forwarding will never work: https://en.wikipe...
by DarkNate
Thu Nov 26, 2020 10:14 pm
Forum: Scripting
Topic: PPP Profile Scripts to send an email
Replies: 0
Views: 258

PPP Profile Scripts to send an email

So inside each PPP profile there's a "On Up" and "On Down" field to write a script. So I have two ISPs, both PPPoE clients. So I use the "On Down" field to send an email when the link is down like this: /tool e-mail send to=example@gmail.com subject="MikroTik"...
by DarkNate
Mon Nov 09, 2020 7:09 pm
Forum: Beginner Basics
Topic: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface
Replies: 12
Views: 1072

Re: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface

You're Indian, I'm Indian, so I can be of more help in the context of Indian ISPs. Did you bridge ACT's ONT/Router if any? Did you bridge Airtel's ONT/Router if any? Is your Tik handling both ISPs completely? That is you have two PPPoE clients? If above is yes then you got it 99% done. There are so...
by DarkNate
Wed Nov 04, 2020 11:50 am
Forum: General
Topic: Question about TCP Established and Call of Duty disconnects [SOLVED]
Replies: 26
Views: 1502

Re: Question about TCP Established and Call of Duty disconnects [SOLVED]

Hello @Darknate , If I disable conntrack, the packet will go into slowpath. I have enabled fasttrack and the CPU is about 20% with ~5Gbit traffic. What? Check the official documentation by MikroTik. Fast Path will continue to work with conntrack disabled and only works if conntrack is disabled. Giv...
by DarkNate
Wed Nov 04, 2020 12:15 am
Forum: General
Topic: Question about TCP Established and Call of Duty disconnects [SOLVED]
Replies: 26
Views: 1502

Re: Question about TCP Established and Call of Duty disconnects [SOLVED]

hello In our network we use NAT for our end users. Some gamers have public IPs. The ip firewall settings, are all defaults, except for TCP Established that is set to 5 minutes. I have no issues at all in the network. Seldom appears Call of Duty disconnects, the client suddenly disconnects from serv...
by DarkNate
Wed Nov 04, 2020 12:11 am
Forum: Beginner Basics
Topic: Upnp not working for open NAT o Destiny 2
Replies: 3
Views: 352

Re: Upnp not working for open NAT o Destiny 2

Your ISP puts you behind a CGNAT and they've not implement port control protocol.
by DarkNate
Sun Nov 01, 2020 8:26 pm
Forum: Beginner Basics
Topic: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface
Replies: 12
Views: 1072

Re: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface

It depends on the optical delivery and type of SFP. For GPON a dumb SFP will not work, but an active SFP which contains ONT functionality and presents a 1000Base-X electrical interface should. There are also some ISPs who use point-to-point 1000Base-LX or 1000Base-BX optics rather than GPON. A true...
by DarkNate
Sun Nov 01, 2020 3:49 pm
Forum: Beginner Basics
Topic: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface
Replies: 12
Views: 1072

Re: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface

@Darknate, I am planning on using the SFP interface to eliminate the ACT ONT. The ONT is labelled Acton 1000W2A(SM-10) and some googling suggests that this is a single-mode 1310nm device. I was unable to find any documentation that says so definitely. Do you have any advice on where to buy such a m...
by DarkNate
Sat Oct 31, 2020 1:42 pm
Forum: Beginner Basics
Topic: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface
Replies: 12
Views: 1072

Re: Dual WAN (PPPoE, dynamic IP) PCC load balancing to bridge interface

You're Indian, I'm Indian, so I can be of more help in the context of Indian ISPs. Did you bridge ACT's ONT/Router if any? Did you bridge Airtel's ONT/Router if any? Is your Tik handling both ISPs completely? That is you have two PPPoE clients? If above is yes then you got it 99% done. There are som...
by DarkNate
Thu Oct 29, 2020 8:57 pm
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

Re: UPnP in load balancing setup

Regarding Flash memory, in the long run, running this script every minute isn't the wisest thing I think? I will write an update for the script and we will test it. I hope that changes from UPNP will not be frequent and, accordingly, the load on the flash memory will be small, and it will be the no...
by DarkNate
Thu Oct 29, 2020 6:28 am
Forum: Beginner Basics
Topic: Strict NAT type problem
Replies: 9
Views: 759

Re: Strict NAT type problem

Enable UPnP on the Tik.
by DarkNate
Mon Oct 26, 2020 12:57 pm
Forum: General
Topic: Device in LAN - check open port by RouterOS
Replies: 4
Views: 328

Re: Device in LAN - check open port by RouterOS

In the LAN behind the router 192.168.88.1 is an LAN-connected device PC with the address 192.168.88.254.

Is there a way to check whether port 502 is open on PC by RouterOS means?
Check in IP>Firewall>NAT
by DarkNate
Sun Oct 25, 2020 7:35 pm
Forum: Beginner Basics
Topic: [problem] high ping latency - MultiWAN
Replies: 14
Views: 1154

Re: [problem] high ping latency - MultiWAN

Hello @DarkNate i follow your advise but i find a small problem with mangle i can not connect to internet when i enable add action=drop chain=forward comment="DENY-ALL" if i disable this DENY-ALL rule, internet is working this my mangle configuration : /interface pppoe-client add interfac...
by DarkNate
Sat Oct 24, 2020 2:29 am
Forum: General
Topic: Two wan with in the same subnet
Replies: 19
Views: 1124

Re: Two wan with in the same subnet

I have two ISPs. I connect to them via two modems and they give ip from the same ip block 192.168.1.xxx. I can make mikrotik connect via two seperate dhcp clients. I can not change the ip blocks. The only setting i can change is the router ip. So i can make router ip different. I can see that this ...
by DarkNate
Fri Oct 23, 2020 3:07 am
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

Re: UPnP in load balancing setup

Regarding Flash memory, in the long run, running this script every minute isn't the wisest thing I think? I will write an update for the script and we will test it. I hope that changes from UPNP will not be frequent and, accordingly, the load on the flash memory will be small, and it will be the no...
by DarkNate
Fri Oct 23, 2020 12:22 am
Forum: Announcements
Topic: v6.47.6 [stable] is released!
Replies: 39
Views: 7911

Re: v6.47.6 [stable] is released!

RB450Gx4, everything worked great for months until I updated to 6.47.6. Wireless package installed since forever but is obviously disabled.

Image

Edit: I found this on the 6.48 thread, however: viewtopic.php?t=163308#p811799
by DarkNate
Fri Oct 23, 2020 12:16 am
Forum: Beginner Basics
Topic: Setup an OpenVPN server in Mikrotik @ Home
Replies: 4
Views: 345

Re: Setup an OpenVPN server in Mikrotik @ Home

https://www.medo64.com/2016/12/simple-o ... -mikrotik/

And just use the Cloud DDNS you get from IP>Cloud in the OpenVPN client profile, that's it.
by DarkNate
Thu Oct 22, 2020 9:07 pm
Forum: General
Topic: PSA: Trickbot is using compromised Mikrotik devices. Secure your routers reachable from the internet.
Replies: 18
Views: 1534

Re: PSA: Trickbot is using compromised Mikrotik devices. Secure your routers reachable from the internet.

Go check Shodan for your public IP space to see what they've discovered.
Enter your public IP into the search form field and press the magnifying glass.
Does absolutely nothing. "No results found" in 0.1ms
by DarkNate
Wed Oct 21, 2020 5:09 pm
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

Re: UPnP in load balancing setup

Is there a way to make your script do this: 1. Clone WAN1 dynamic rules to WAN2 and also clone WAN2 to WAN1 because that's the original problem with UPnP anyway 2. Of course, while avoiding cloning already existing clones on either WAN interfaces. I think yes The original article said: 1. Make the ...
by DarkNate
Wed Oct 21, 2020 2:19 pm
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

Re: UPnP in load balancing setup

Hello! I tried to write "FUTURE VERSION" but cannot test. And i use "in-interface" matcher instead of "dst-address=<WAN 2 IP>". :local wan2InterfName "ether2" :local RuleComment "UPnP_Cloned" :local I :local J :local NeedTo #if rules identical - fun...
by DarkNate
Tue Oct 20, 2020 3:10 pm
Forum: RouterOS v7 BETA
Topic: Torrent client
Replies: 59
Views: 19862

Re: Torrent client

maybe a separate soho.npk that includes the torrent client, kid-control and SMB server.. :)
... and Quick Set
I disagree with this. Quick Set is very useful to get online in 5 seconds after a clean install/first time install to get up and running.
by DarkNate
Tue Oct 20, 2020 1:55 am
Forum: Beginner Basics
Topic: Pools, VPNs, and profiles
Replies: 6
Views: 368

Re: Pools, VPNs, and profiles

I was thinking the server address should be in the same subnet as the pool, but it doesn't seem to care. It doesn't have to be. VPNs are point-to-point tunnels with a /32 address at either end, they can be pretty much anything. I'm about to add an OpenVPN server, as well, mainly to overcome the lac...
by DarkNate
Tue Oct 20, 2020 12:15 am
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

Re: UPnP in load balancing setup

Bump... Anyone?
by DarkNate
Mon Oct 19, 2020 7:09 pm
Forum: Beginner Basics
Topic: Pi-Hole and Mikrotik - DNS - Pi-hole only show my router’s IP address
Replies: 12
Views: 1284

Re: Pi-Hole and Mikrotik - DNS - Pi-hole only show my router’s IP address

Give the Pi a static IP from DHCP>Leases

Then use static IP as DNS inside DHCP>Network

I'm using Pi-Hole myself.
by DarkNate
Mon Oct 19, 2020 3:37 pm
Forum: Beginner Basics
Topic: Forcing Gaming traffic only through WAN 1
Replies: 6
Views: 379

Re: Forcing Gaming traffic only through WAN 1

Seems like my only way out is to make two different subnets. One for general usage and other for gaming customers only. Your only way out is to peer with the major CDNs. I fail to understand why local ISPs and BSNL in India avoids peering and proper routing like the plague. Your customers will suff...
by DarkNate
Mon Oct 19, 2020 2:00 am
Forum: Beginner Basics
Topic: Forcing Gaming traffic only through WAN 1
Replies: 6
Views: 379

Re: Forcing Gaming traffic only through WAN 1

Probably the only way. A. group ports for rules, (maintain a list in MS Works, separated by commas) and just copy and paste into dst-port for rules) B. Conversely use a NOT rule (apply rules NOT using any port, and put in the ports that folks use that are not gaming ports 80,443 and others for exam...
by DarkNate
Mon Oct 19, 2020 1:51 am
Forum: General
Topic: DNS over HTTPS
Replies: 158
Views: 39475

Re: DNS over HTTPS

So if I put the pi-hole on its own VLAN give it a fixed IP. I then put that IP address for each of my vlan dhcp-server-network entries? Do I need firewall rules to allow the pi-hole anything specific on teh input chain? Do I need firewall rules to allow users from all other vlans to the pi-hole vla...
by DarkNate
Sun Oct 18, 2020 10:05 pm
Forum: General
Topic: DNS over HTTPS
Replies: 158
Views: 39475

Re: DNS over HTTPS

Hi Darknate, I am interested in how you added the pi-hole to the MT Router for this functionality. Is it on its own subnet for example. How do you point users to pi-hole. How do you point pi-hole to the external servers you wish to use What firewall rules are germane to the setup for the pihole and...
by DarkNate
Sun Oct 18, 2020 9:59 pm
Forum: Scripting
Topic: UPnP in load balancing setup
Replies: 8
Views: 716

UPnP in load balancing setup

Both ISPs are PPPoE clients and have UPnP enabled, but since this is a load balancing setup, sometimes traffic is routed to ISP1, but UPnP opens up for ISP 2 and vice versa. I'm no good at scripting, to begin with. So I found this: https://forum.mikrotik.com/viewtopic.php?p=426711#p426711 Set it to ...
by DarkNate
Sun Oct 18, 2020 12:45 pm
Forum: General
Topic: DNS over HTTPS
Replies: 158
Views: 39475

Re: DNS over HTTPS

I ditched ROS DoH completely and replaced it with Cloudflared binary + Pi-Hole now DoH works 100% of the time with zero errors. Zero problems whatsoever. DoH on ROS was and still is broken. can u tell me the step to do this? https://docs.pi-hole.net/main/prerequisites/ https://docs.pi-hole.net/guid...
by DarkNate
Sat Oct 17, 2020 6:18 pm
Forum: General
Topic: Detect-internet causing internal packet loss
Replies: 17
Views: 5918

Re: Detect-internet causing internal packet loss

Weird problem. I have been using Detect-internet for months and never disabled it, works fine without problems.
by DarkNate
Sat Oct 17, 2020 12:10 am
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

What do you think is the proper way to use Nth for per-connection distribution (implying mark connection)? The way I did originally? Yes, that way was fine for per-connection distribution. All that confusion came just from the fact that you declared that it does per-packet distribution. Earlier you...
by DarkNate
Fri Oct 16, 2020 10:47 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Then, you don't know up-front how much traffic will go over a marked connection. I could look in NAT which connection, had not much traffic yet and then prefer that link. In real time, that is only possible if Mikrotik implement a distribution by clean switching of the source port. Maybe that is al...
by DarkNate
Fri Oct 16, 2020 10:31 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

If there's no difference between PCC and Nth in per-connection distribution, then what exactly is this paper talking about? https://www.ijcnis.org/index.php/ijcnis/article/view/4340 Let me quote myself from post #16: "the apparently best dynamic load distribution method (nth) gives astounding ...
by DarkNate
Fri Oct 16, 2020 10:22 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

I'm not re-reading the whole thread again to find out if it was already mentioned in some way, but do you have any statistics how much are ports other than 80 and 443 actually used? In other words, if all your effort is really worth it. Because if you are developer and your application needs to acc...
by DarkNate
Fri Oct 16, 2020 9:53 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

I've edited my post reacting to your edited one accordingly. I've expressed my opinion earlier - in an environment with NAT, the impact of per-packet traffic distribution is always negative (except connections which consist of a single request packet and a single response one as @Sob has pointed ou...
by DarkNate
Fri Oct 16, 2020 9:35 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

It should, but it's always better to check than to just hope. If everything is set correctly, the rules translating the packet-mark into routing-mark must count exactly the same amount of packets as the rules which assign the packet-mark . Reset counters at all five of them using a single command s...
by DarkNate
Fri Oct 16, 2020 8:36 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

The last paragraph of post #32 suggests multiple ways how to do that. Any of them is sufficient. So I did the following, so far nothing breaks (80/443 obviously will never go beyond the following), I'll test it for a few hours with gaming, VoIP, Banking. My thumb of rule is, if banking works everyt...
by DarkNate
Fri Oct 16, 2020 8:23 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

So to conclude: with a single-threaded transfer and per-connection distribution, you cannot get aggregate bandwidth the fact that you do get an aggregate bandwidth for a multi-threaded transfer provides no information regarding the type of traffic distribution with a single-threaded transfer and pe...
by DarkNate
Fri Oct 16, 2020 5:27 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

OK, so let me present another idea how to explain it. When I say "per connection distribution of traffic", it does not mean the same as "traffic distribution controlled by per-connection-classifier ". It simply means that all packets of the same connection use the same WAN, no m...
by DarkNate
Fri Oct 16, 2020 4:39 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

You're missing few details. For start, your original config that you thought does per-packet Nth didn't really do that, and when @sindy explained in detail what happens, you didn't get it at all. You also misundertood his other suggestion . And his interest in your native language is not to make fu...
by DarkNate
Fri Oct 16, 2020 4:34 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Yeah, the packet counters are a good idea by the way. Reset the counters on both the nth rules which assign packet-marks and the rules which translate packet-mark into routing-mark , then run some traffic eligible for nth handling, and compare the counters after that. They should be equal (every pa...
by DarkNate
Fri Oct 16, 2020 4:01 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

What is your native language? I feel as if you do not attempt to understand what I write. You believe you only use connection-mark for 80 and 443, but the reality is that you use it for all connections, most likely because you still can't understand how the connection-mark actually works. With the ...
by DarkNate
Fri Oct 16, 2020 3:59 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

There's definitely some misunderstanding. Because if it's regular dual WAN config, i.e. two independent ISPs, then per-packet load balancing will work great with single-packet exchanges like DNS queries, but everything else will be absolutely terrible, if it will work at all. Sob my dude, I never o...
by DarkNate
Fri Oct 16, 2020 3:11 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

I wonder which part of the firewall handling you are missing or misunderstand that prevents you from seeing the logic: do you realize that once you assign a connection-mark to a connection while handling any of that connection's packets, regardless the direction, this connection-mark is then automa...
by DarkNate
Fri Oct 16, 2020 3:09 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

If you want to make sure that you have everything "right" for testing, then temporarily disable these two rules: /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=pppoe-out1 new-connection-mark=ISP1_conn passthrough=no add action=mark-con...
by DarkNate
Fri Oct 16, 2020 12:44 am
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

So how do we make it per-packet when I'm already using mark-parket+Nth? Since it is only needed for a test, just add dst-port=80,443 or packet-mark=no-mark to the two rules which assign a routing-mark based on connection-mark - i.e. the action=mark-routing chain=prerouting connection-mark=ISPx_conn...
by DarkNate
Thu Oct 15, 2020 10:31 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

So how does the above give aggregated bandwidth in downloads/uploads? I see doubled bandwidth across the board. Like any other dynamic load distribution method. If you make a throughput test using a single session (=connection), it will show a single uplink bandwidth. speedtest.net, as well as othe...
by DarkNate
Thu Oct 15, 2020 9:02 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

So I'm still confused as to how there's no packet-loss, broken config. Even traceroutes from LAN to remote sites works fine and shows their corresponding routes based on whichever ISP was assigned. I use MTR and see 0 packet loss. And gaming, works!? What? So what happens is the following (tracking...
by DarkNate
Thu Oct 15, 2020 8:15 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

I can't bother to quote everything cleanly, so I'll reply in paragraph wise.
You don't have to quote at all, I suggest you try it sometimes.
No forum rule is violated by quoting anything dude
by DarkNate
Thu Oct 15, 2020 7:31 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Regarding the Nth everywhere thing, well I'm not suggesting the whole world to use it, now am I? Did I? Ever? No I did not. I've announced in advance I'm going to be a bit emotional ;) So the neutral form of the same statement would have been that the results haven't proven any significant advantag...
by DarkNate
Thu Oct 15, 2020 3:37 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Well, as this topic was a bit emotional throughout its history, let me be a bit emotional too. Yes, this other paper is much better, but still there are two points: the apparently best dynamic load distribution method ( nth ) gives astounding 101.5% of the download throughput of the apparently wors...
by DarkNate
Thu Oct 15, 2020 12:45 am
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

@DarkNate, I'm afraid there may be just some confusion of terms. First, know your audience - many people here deal only with the typical "home router with two ISPs" case, where the ultimate public IP on each WAN is different, so a real per-packet (means per- mid-connection -packet) load d...
by DarkNate
Wed Oct 14, 2020 8:07 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Why are you agressive? This is a forum for help and interaction. I only see this code from you: add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local dst-address-list=!not_in_internet in-interface=bridge new-connection-mark=ISP1_conn passthrough=yes nth=2,1 add...
by DarkNate
Wed Oct 14, 2020 6:35 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Dude, did you even bother to read the research paper I linked above? It's already been proven that Nth does a better job of bandwidth distribution than PCC due to the obvious reason that Nth is Per Packet whereas PCC is Per Connection . https://help.mikrotik.com/docs/display/ROS/Load+Balancing If y...
by DarkNate
Wed Oct 14, 2020 5:03 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Hi Darknate, Can you post a generic config with the useful bits to show that split personality config on bandwidth load balancing........ add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local dst-address-list=!not_in_internet in-interface=bridge new-connection-...
by DarkNate
Wed Oct 14, 2020 3:56 am
Forum: Beginner Basics
Topic: Accidently, I removed Interface ether1.
Replies: 5
Views: 624

Re: Accidently, I removed Interface ether1.

What kind of device do you have (model)?
How did you remove the interface ?
Is that even possible Normis? To remove the ethernet interface itself?
by DarkNate
Wed Oct 14, 2020 3:49 am
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Hi Darknate, Can you post a generic config with the useful bits to show that split personality config on bandwidth load balancing........ I have been using this config for more than a month now. PayPal works, GPay, App Store, Play Store and full aggregated bandwidth when downloading/uploading (50/5...
by DarkNate
Mon Oct 12, 2020 4:32 pm
Forum: General
Topic: DNS over HTTPS
Replies: 158
Views: 39475

Re: DNS over HTTPS

I ditched ROS DoH completely and replaced it with Cloudflared binary + Pi-Hole now DoH works 100% of the time with zero errors. Zero problems whatsoever.

DoH on ROS was and still is broken.
by DarkNate
Mon Oct 12, 2020 4:27 pm
Forum: RouterOS v7 BETA
Topic: how to understand routi9ng in v7
Replies: 7
Views: 1084

Re: how to understand routi9ng in v7

"How to understand"?

You start by reading before posting here, you start by searching:

https://help.mikrotik.com/docs/display/ ... col+Status

https://help.mikrotik.com/docs/display/ ... g+Examples
by DarkNate
Sun Oct 11, 2020 12:30 am
Forum: Beginner Basics
Topic: MTU LAN vs WAN
Replies: 6
Views: 511

Re: MTU LAN vs WAN

My ISP gives me nothing but a pretty useless cable modem router. This thing can’t even be switched into bridge mode. On top of that, I don’t know much about what they are doing. It’s consumer grade internet. Honestly, I’m not very good at those things. Not a network guy, just a Cloud Architect. But...
by DarkNate
Sat Oct 10, 2020 10:37 pm
Forum: Beginner Basics
Topic: MTU LAN vs WAN
Replies: 6
Views: 511

Re: MTU LAN vs WAN

LAN network should be standard 1500 on all ethernet interfaces and software-defined bridges including the wireless bridge unless you know what you're doing and require jumbo frames. WAN MTU depends on your ISP, if it's PPPoE you need to set ethernet MTU to 1520 on the port which is running the PPPoE...
by DarkNate
Sat Oct 10, 2020 10:33 pm
Forum: Forwarding Protocols
Topic: NTH load balancing
Replies: 63
Views: 2965

Re: NTH load balancing

Using Nth does give a more "even" bandwidth distribution as per this research paper: https://www.researchgate.net/publication/332831075_Application_of_Load_Balancing_with_the_Nth_Method_on_Multiple_Gateway_Internet_Networks But you'll need to take of the "sticky connections" for ...
by DarkNate
Sat Oct 10, 2020 1:16 pm
Forum: Scripting
Topic: Combine two IP4 address lists to create a /24 list
Replies: 4
Views: 386

Re: Combine two IP4 address lists to create a /24 list

Just force phone/TV to use same WAN like this
add action=mark-connection chain=prerouting comment="Force my laptop to ISP2" dst-address-type=!local disabled=yes dst-address-list=!not_in_internet in-interface=LAN new-connection-mark=ISP2_conn passthrough=yes src-address=192.168.88.103
by DarkNate
Sat Oct 10, 2020 10:23 am
Forum: Beginner Basics
Topic: QoS and Speed optimization
Replies: 5
Views: 489

Re: QoS and Speed optimization

There's a dedicated guide for this: viewtopic.php?f=23&t=73214
by DarkNate
Fri Oct 09, 2020 5:20 pm
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

Ok this is the response from the ISP.. "Just to reiterate, the circuit that we provide is a raw circuit and neither us nor the line provider has any equipment onsite that will be blocking any traffic. The NTU onsite is only there to terminate the fibres coming into the building. Based on your ...
by DarkNate
Fri Oct 09, 2020 5:18 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

Sorry, my knowledge has some limits. I never studied how exactly conntrack works with related connections. I'm sure that multiple tcp connections are not seen as related (except ftp). They may be related from application's perspective, but router has no way of knowing that. But I can't tell you all...
by DarkNate
Fri Oct 09, 2020 3:26 pm
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

My ISP's NOC team has personally spoken to me and told me it's broken on their end at layer 2.5 (They use PPPoE and some useless local tunnelling mixed with native IPv6) and even though they didn't admit it, they simply lack the skillset required to fix the problem. Heck maybe your're in the same c...
by DarkNate
Fri Oct 09, 2020 3:12 pm
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

My ISP's NOC team has personally spoken to me and told me it's broken on their end at layer 2.5 (They use PPPoE and some useless local tunnelling mixed with native IPv6) and even though they didn't admit it, they simply lack the skillset required to fix the problem. Heck maybe your're in the same c...
by DarkNate
Fri Oct 09, 2020 3:09 pm
Forum: Beginner Basics
Topic: Can't access hosts via certain ports from a computer connected to an hEX-S
Replies: 15
Views: 668

Re: Can't access hosts via certain ports from a computer connected to an hEX-S

1. If I use webfig (all Linux machines here, so no WinBox) What do you mean "no Winbox"? Winbox runs just fine on Linux and was designed to work with WINE straight out the box: https://techsoftcenter.com/how-to-run-winbox-mikrotik-on-linux-mint-ubuntu-etc/ As the other member suggested, p...
by DarkNate
Fri Oct 09, 2020 2:59 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

If you have rules with connection-mark=no-mark, it has similar effect; connection-state=new may be a bit more efficient, but it's again just a guess and you'd have to come with some reliable testing and measure it. 'Related' is how conntrack sees it. For example ftp's data connection is related to ...
by DarkNate
Fri Oct 09, 2020 2:55 pm
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

Do you get a full house if you test on www.ipv6-test.com ? It is possible to get full house, I get it on one of my hosts ... but that's linux server with statically assigned IPv6 address and properly configured DNS records. For LAN host which gets IPv6 address via SLAAC, I only get 17/20. It says &...
by DarkNate
Fri Oct 09, 2020 2:59 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

You have packet from device in LAN going to some public address, so it gets connection mark (and later also routing mark based on connection mark). But this packet has low ttl and it expires while passing through router, so router sends icmp ttl exceeded packet to inform client about it. This new p...
by DarkNate
Fri Oct 09, 2020 1:40 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

I don't think you want anything with src/dst-address-type here. If it's dst-address-type=!local, it's useless, because it matches almost all packets, except some rare ones sent by router to itself. And src-address-type=!local would break the main purpose of these rules, because everything in output...
by DarkNate
Fri Oct 09, 2020 1:05 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

It should be: connmark-out output: in:(unknown 0) out:<interface>, proto ICMP (type 11, code 0), <router's LAN address>-><clients's LAN address>, len <x> And number of logged packets depends on how many are sent with each TTL. My traceroute uses three and mtr keeps sending them until stopped. Routi...
by DarkNate
Fri Oct 09, 2020 12:39 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

Rule for testing: /ip firewall mangle add chain=output protocol=icmp connection-mark=!no-mark action=log log-prefix=connmark-out It should log three packets when you do traceroute. It logs two with normal trace route. It logs n number of icmp packets with MTR. What I was referring to is MTR which d...
by DarkNate
Thu Oct 08, 2020 11:59 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

I don't remember this exactly and I don't have time to play with it now, but I think that icmp packets for exceeded TTL may inherit either connection or routing mark from original packet. Which does have it, because it's outgoing packet to some external address, so PCC rules applied to it. You can ...
by DarkNate
Thu Oct 08, 2020 4:01 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

Well, that's a question. I can skip some conditions in mangle rules, so that may lower CPU usage a bit (or may not, it depends on the order in which conditions are evaluated). Routing rules will undoubtedly add some processing, but routing should be the most optimized part of system, so it shouldn'...
by DarkNate
Thu Oct 08, 2020 2:49 am
Forum: Beginner Basics
Topic: OpenVPN Server/Client with PCC/Load Balancing [SOLVED]
Replies: 1
Views: 249

Re: OpenVPN Server/Client with PCC/Load Balancing [SOLVED]

Never mind.

I created a static OVPN Server Binding in PPP>Interface
Then I placed the Binding in LAN inside IP>Interface List and now it's able to essentially "load balance" the VPN client.

Problem solved.
by DarkNate
Thu Oct 08, 2020 2:47 am
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

Cheers Guys Sob: It is weird tbh, as looking at the ipv6 connections, there is nothing at all for protocol 58. However, if i run the test on ios, i get a connection at port 58, but it shows a connection to icmpv6 but with a source port & destination port as 0? Dark: I am running a leased line a...
by DarkNate
Thu Oct 08, 2020 2:24 am
Forum: Beginner Basics
Topic: OpenVPN Server/Client with PCC/Load Balancing [SOLVED]
Replies: 1
Views: 249

OpenVPN Server/Client with PCC/Load Balancing [SOLVED]

So basically I followed this for OpenServer config and for the client except that the VPN client shares the same subnet as the LAN clients: https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/ Internet and LAN access works fine through the VPN tunnel with arp-proxy on the bridge. But in...
by DarkNate
Thu Oct 08, 2020 12:27 am
Forum: Beginner Basics
Topic: IPV6 Firewall [SOLVED]
Replies: 55
Views: 2441

Re: IPV6 Firewall [SOLVED]

Thanks. Just checked those and all seems to be set up properly. I tried another test site and got this, so i have no idea whats going on. https://thumbsnap.com/t/VwwDSZxf.jpg Also, there doesn't seem to be any packets at all recorded across most of the rules... https://thumbsnap.com/t/QuLiUEL8.jpg ...
by DarkNate
Thu Oct 08, 2020 12:25 am
Forum: General
Topic: Mikrotik routers - Firewall?
Replies: 9
Views: 566

Re: Mikrotik routers - Firewall?

I also see that some users instead load OpenWRT - is there a comparison of issues or features somewhere?
RouterOS is enterprise-grade. OpenWRT is consumer-grade. Why would people ever want to use OpenWRT over RouterOS?
by DarkNate
Thu Oct 08, 2020 12:05 am
Forum: General
Topic: DDoS detection and blocking [SOLVED]
Replies: 8
Views: 697

Re: DDoS detection and blocking [SOLVED]

R1CH, there is no crash here my friend so no worries, What you are saying is already well known and not the issue here but thanks anyways! ;) Wait until you get a SYN Flood DDoS and watch your MikroTik (doesn't matter which model or how much bandwidth you have) become totally unresponsive. There's ...
by DarkNate
Thu Oct 08, 2020 12:03 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

No, this "local" means only addresses on router, nothing with subnets. I don't think there's one perfect config, there may be some as good starting point, but different people need different things. Most important is to understand what it does, why and how. MikroTik's example tries to exp...
by DarkNate
Wed Oct 07, 2020 10:45 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

It depends where those public addresses are. If they are directly on your router, they are already excluded from marking, if you kept PCC rules with dst-address-type=!local from example. If it's NAT 1:1 and they are in fact elsewhere, you'd need to exclude them too, and additionally add routes to t...
by DarkNate
Wed Oct 07, 2020 5:27 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

If your "not_in_internet" list contains 10.0.0.0/8, then it's already solved by that. If you ping ISP's gateway 10.x.x.x from LAN, it won't get marked and router will use main routing table. Although I can ping the "gateway" IP of both ISPs as expected, I can't ping the actual p...
by DarkNate
Sat Oct 03, 2020 10:40 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

If your "not_in_internet" list contains 10.0.0.0/8, then it's already solved by that. If you ping ISP's gateway 10.x.x.x from LAN, it won't get marked and router will use main routing table. About combination of PCC and Nth, there's probably no reason why it wouldn't work, but whether it ...
by DarkNate
Sat Oct 03, 2020 7:08 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

I meant traceroute to ISP's gateway, which should always have only two hops, first your router and then ISP's gateway right behind it. But even if you have it wrong, you still have 50% chance that it will work correctly, because it will get mark for right ISP. I'm sure you can live without these ru...
by DarkNate
Sat Oct 03, 2020 1:22 pm
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

1) I don't know what exactly you have, but it's also possible that ping is taking a little longer path. Check what traceroute shows. Let's say the gateway for ISP1 is public address and you try to ping it from device in LAN. If you mark this outgoing ping with ISP2 mark and you don't exclude it in ...
by DarkNate
Sat Oct 03, 2020 2:25 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

1) It's to allow devices in LAN to access anything in those subnets. Ping ISP's gateway, access modem configuration, if you're connected behind one, etc. If you don't need any of that, you can live without these rules. 1.1) PPPoE has equivalent of lease script in PPP profile. 2) Yes. You can test i...
by DarkNate
Sat Oct 03, 2020 2:03 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Re: Need some explanation regarding PCC load balancing mangle rules [SOLVED]

1) "local" means any address assigned to router, it does not cover anything else, so if you don't want to break routing between other subnets, you have to deal with them too. 1.1) You can update rules from dhcp lease script. 2) Prerouting is for traffic from other devices. Output is for t...
by DarkNate
Sat Oct 03, 2020 12:09 am
Forum: Beginner Basics
Topic: Need some explanation regarding PCC load balancing mangle rules [SOLVED]
Replies: 39
Views: 2580

Need some explanation regarding PCC load balancing mangle rules [SOLVED]

So in this: https://help.mikrotik.com/docs/display/ROS/Firewall+Marking#FirewallMarking-DetailedSectionOverview.2 We can see a solid and stable method to implement PCC. But I have some doubts. 1. The first rules had this statement "With policy routing, it is possible to force all traffic to the...
by DarkNate
Fri Oct 02, 2020 5:04 pm
Forum: RouterOS v7 BETA
Topic: fq_codel or cake in v7
Replies: 62
Views: 20754

Re: fq_codel or cake in v7

Or the whole MikroTik team was hacked :D
Seems likely, it coincides with IP>Cloud issues people were facing including me along with the forum timing out just about a week ago hahaha...
by DarkNate
Wed Sep 30, 2020 9:10 pm
Forum: RouterBOARD hardware
Topic: hAP ac³
Replies: 31
Views: 3820

Re: hAP ac³

Believe me Normis " clearly labeled INTERNET " is not enough for tipical residential Customers ;-D Is some cases they are even not able to find out an electrical plug... ;-D Rgds Deployed a FTTh solution in a golf estate, first question sked when customers calls in and say they have no in...
by DarkNate
Tue Sep 29, 2020 11:32 pm
Forum: RouterBOARD hardware
Topic: hAP ac³
Replies: 31
Views: 3820

Re: hAP ac³

Lol mikrotik barely have Wifi 5 and you want them to start doing FXS
Exactly, like MikroTik markets itself towards WISPs and ISPs, not Wi-Fi.

I honestly don't understand why people buy MikroTik routers for the Wi-Fi. I would just use MikroTik only for routing/switching, that's pretty much it.
by DarkNate
Tue Sep 29, 2020 10:15 pm
Forum: Beginner Basics
Topic: [problem] high ping latency - MultiWAN
Replies: 14
Views: 1154

Re: [problem] high ping latency - MultiWAN

Hello @DarkNate Thank you very much for your precious share. You are right , i want to avoid double NAT So, i will implement PPPoe client on routeur Mikrotik : / interface set ether3 name=WAN-09-ADAPTER set ether4 name=WAN-12-ADAPTER /interface pppoe-client add interface=WAN-09-ADAPTER name=pppoe-o...
by DarkNate
Mon Sep 28, 2020 11:09 pm
Forum: SwOS
Topic: RTSP usage
Replies: 2
Views: 422

Re: RTSP usage

There's no harm in leaving it enabled, it simply protects your network from looping.
by DarkNate
Mon Sep 28, 2020 9:17 pm
Forum: General
Topic: SXT 6 (RouterBOARD SXT G-6HPnD) Freeze with very high Delay (ping above 500ms)
Replies: 1
Views: 372

Re: SXT 6 (RouterBOARD SXT G-6HPnD) Freeze with very high Delay (ping above 500ms)

Did you use the default firewall filter rules at the least? Because the router could be DDoSed from WAN/External network (such as a PON link if the ISP is stupid enough to not isolate clients like it is in my case).
by DarkNate
Mon Sep 28, 2020 3:22 am
Forum: Wireless Networking
Topic: hAP ac3 recommended buy?
Replies: 50
Views: 5593

Re: hAP ac3 recommended buy?

I would just buy an RB450Gx4 for routing and consumer-grade APs for Wi-Fi instead.

Currently using a TP-Link Archer A10 for AP, getting 400Mbps wireless bandwidth performance without a hitch on the 5GHz band, 100Mbps straight on the 2.4GHz band.
by DarkNate
Mon Sep 28, 2020 1:04 am
Forum: Beginner Basics
Topic: [problem] high ping latency - MultiWAN
Replies: 14
Views: 1154

Re: [problem] high ping latency - MultiWAN

First, why is the ISPs' CPE's not put in bridge mode? You're supposed to let the MikroTik router handle both WAN interfaces which is PPPoE as you have mentioned. You have put yourself in a double NAT situation, why would you want that? D-Link DSL-2890AL should be very easy to bridge, unlike some of ...
by DarkNate
Mon Sep 28, 2020 12:58 am
Forum: General
Topic: UPnP with Multi-WAN PCC based setup
Replies: 2
Views: 299

Re: UPnP with Multi-WAN PCC based setup

Hello,

could you please share your configuration to try understand :)

Best regards
I have two PPPoE clients from two different ISPs, whereby I use PCC to load balance. The issue is widely known, ROS's UPnP implementation does not work with multi-WAN setup.
by DarkNate
Sun Sep 27, 2020 6:46 pm
Forum: General
Topic: Weird PING behavior on RouterOS
Replies: 10
Views: 758

Re: Weird PING behavior on RouterOS

Status Report: so far the "sluggishness" of the network is gone.

Thanks for all hints.

Mauricio
Also be sure to configure the "cable modem" in bridge mode, to allow the MikroTik to handle WAN interface completely.
by DarkNate
Sun Sep 27, 2020 4:32 pm
Forum: General
Topic: UPnP with Multi-WAN PCC based setup
Replies: 2
Views: 299

UPnP with Multi-WAN PCC based setup

So I have two ISPs, both PPPoE clients, load-balanced via PCC with failover. Everything works great except for UPnP. Both ISPs are dynamic IPs that change frequently from the providers. Inside IP>UPnP I have indeed added two external interfaces for each of the ISP and a single internal interface for...
by DarkNate
Sun Sep 27, 2020 2:14 am
Forum: General
Topic: Adblocking with address lists
Replies: 7
Views: 1322

Re: Adblocking with address lists

Use Pi-Hole, problem solved.

Beautiful ain't it?
Image
by DarkNate
Sun Sep 27, 2020 2:12 am
Forum: General
Topic: Request for Temporary Mitigation Guide/Official Patch for CVE-2020-12695
Replies: 3
Views: 603

Re: Request for Temporary Mitigation Guide/Official Patch for CVE-2020-12695

You should be more worried about other UPnP devices. For example, I tried the test and it says that TV has UPnP and is vulnerable. And since it's a little older, it's unlikely that manufacturer will update anything. How do we block a specific client device with static IP from using UPnP on RouterOS?
by DarkNate
Sat Sep 26, 2020 3:57 pm
Forum: General
Topic: IPv6 Mikrotik's SLAAC - DHCPv6 ( asking for some help )
Replies: 2
Views: 426

Re: IPv6 Mikrotik's SLAAC - DHCPv6 ( asking for some help )

Why do you require DHCPv6 server to begin with? Are you an ISP or Service Provider? What is the prefix size you got from your ISP? IPv6 is generally meant to be stateless for the end user. I'm sure you have Android devices, right? Well read this: https://www.nullzero.co.uk/android-does-not-support-d...
by DarkNate
Sat Sep 26, 2020 2:54 pm
Forum: General
Topic: Request for Temporary Mitigation Guide/Official Patch for CVE-2020-12695
Replies: 3
Views: 603

Request for Temporary Mitigation Guide/Official Patch for CVE-2020-12695

So there is a vulnerability CVE-2020-12695 dubbed "CallStranger" that so far is not mentioned anywhere on the MikroTik forum. The patch required for vendors is described here: https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf More information on the vul...
by DarkNate
Sat Sep 19, 2020 8:38 pm
Forum: General
Topic: Bandwidth Limiting VLANS
Replies: 1
Views: 251

Re: Bandwidth Limiting VLANS

Yeah, you can just use simple queue directly without the mangle rules, something like this: viewtopic.php?f=13&t=165945&p=815923&hi ... ue#p815933

Your goal is simple bandwidth limitation not advanced QoS.
by DarkNate
Sat Sep 19, 2020 6:35 pm
Forum: Beginner Basics
Topic: Set bandwidth limit on WAN [SOLVED]
Replies: 11
Views: 795

Re: Set bandwidth limit on WAN [SOLVED]

/queue simple add dst=pppoe-out1 max-limit=10M/10M name=queue1 queue=default/default target=eth1 Thanks a lot for the reply. Apart forbthe queues code, do i need to add anything else on the firewall or anywhere else? Nope, but I misread your original post a little, so the command should be: /queue ...
by DarkNate
Sat Sep 19, 2020 1:57 am
Forum: General
Topic: PPPoE WAN, L2TP UDP works, TCP unreliable (some bursts of data work randomly) - I am lost :(
Replies: 7
Views: 463

Re: PPPoE WAN, L2TP UDP works, TCP unreliable (some bursts of data work randomly) - I am lost :(

I have solved this by actually dealing with one of my ISP's engineers who also runs on MikroTik equipment. At the time we were testing RFC4638, which is now working successfully. So when you are running PPPoE on an ethernet interface, set the MTU of that particular ethernet interface to 1520 like th...
by DarkNate
Tue Sep 15, 2020 3:59 pm
Forum: General
Topic: DDoS protection for IPv4 & IPv6
Replies: 0
Views: 205

DDoS protection for IPv4 & IPv6

So this right here, shows some DDoS protection mechanism for IPv4: https://help.mikrotik.com/docs/display/ROS/DDoS+Protection First, is the above actually good enough for IPv4 to begin with? And then what about IPv6, what are the things to look for, avoid, not avoid? How do we implement similar meas...
by DarkNate
Mon Sep 14, 2020 2:14 pm
Forum: Announcements
Topic: v6.46.7 [long-term] is released!
Replies: 45
Views: 11534

Re: v6.46.7 [long-term] is released!

Shouldn't we be seeing the changelog from 6.45.9 to 6.46.7 not from 6.46.6 ? Going up a major version in a long-term release should be looked over a bit more carefully before we take the plunge. Yes, that would be logical. Mikrotik fought the Logic and Mikrotik won. Man, they fight even hard eviden...
by DarkNate
Sat Sep 12, 2020 11:52 pm
Forum: SwOS
Topic: LOADBLACING
Replies: 3
Views: 524

Re: LOADBLACING

hi everyone, i have two wan, The bandwidth is 200M and 100M, respectively, I want to configure the loadblacing to a 2: 1 ratio, please help me. Why did you post this in SwOS? Did you bother to search with Google first? Do something like this: /ip firewall mangle ###Accept LAN traffic### add action=...
by DarkNate
Fri Sep 11, 2020 2:30 am
Forum: General
Topic: Very annoying VoIP affecting bug in latest 6.47.x Router OS
Replies: 6
Views: 458

Re: Very annoying VoIP affecting bug in latest 6.47.x Router OS

I'm moving away from MikroTik as soon as I have the money. @DarkNate Have some patience.... it is frustrating when they do not respond on a timely manner.... but with this COVID hitting everywhere its a new situation and will take time to adjust. It’s very difficult to beat the MikroTik value propo...
by DarkNate
Fri Sep 11, 2020 12:42 am
Forum: General
Topic: hEX S or the hAP ac² [SOLVED]
Replies: 17
Views: 1142

Re: hEX S or the hAP ac² [SOLVED]

I would have recommended the RB450Gx4 instead.
by DarkNate
Fri Sep 11, 2020 12:41 am
Forum: General
Topic: Very annoying VoIP affecting bug in latest 6.47.x Router OS
Replies: 6
Views: 458

Re: Very annoying VoIP affecting bug in latest 6.47.x Router OS

Nice report but the responsible thing is to create supout reports and raise a ticket with MT (for both issues new and old). Assuming that was the first step right? MikroTik's support is awful. I have been providing them with multiple supout files and 1 and a half month later, issue is unresolved, t...
by DarkNate
Mon Sep 07, 2020 6:23 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Yeah, something weird... Could you write to support@mikrotik.com with your problem? Ahahaha... MikroTik and "support" does not go very well. At the moment I have an open ticket with them about a critical bug that effective kills my internet access, it's similar to this: https://forum.mikr...
by DarkNate
Sat Sep 05, 2020 11:58 pm
Forum: Beginner Basics
Topic: No IP Address Acquired
Replies: 30
Views: 8947

Re: No IP Address Acquired

Good news is I've already opened a bug report support ticket with MikroTik on this very issue. About two days ago I was able to catch the bug (logs and everything right) right after a clean reboot, which I then immediately generated a supout file and that should give MikroTik sufficient information ...
by DarkNate
Sat Sep 05, 2020 2:10 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

You cannot check different uplinks via the same test host. So you need different hosts per uplink (like 8.8.8.8 and 1.1.1.1 for ISP1 and 8.8.4.4 and 1.0.0.1 for ISP2) So I tried this: ###Workaround for interfaces### /ip address add address=127.0.0.1 comment="Host for Recursive Routing on ISP 1...
by DarkNate
Fri Sep 04, 2020 7:12 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Well, by 127.1.2.3 I meant exactly 127.1.2.3, i.e. any private/unused address. Wait I'm not following so here, please help me understand this. /ip address add interface=PPP address=127.1.2.3 network=8.8.4.4 Network of course refers to the "test host". Address given means any private/unuse...
by DarkNate
Fri Sep 04, 2020 12:16 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

I see that you may add those routes manually via: /ip address add interface=PPP address=127.1.2.3 network=8.8.4.4 This (8.8.4.4) does work as gateway for recursive routes, according to my quick testing. But I get dynamic IPs from the PPPoE which my ISP changes randomly throughout the day. So that w...
by DarkNate
Thu Sep 03, 2020 5:08 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

I mean, not via PPP Profile but directly, with /ipv6 address add
Yeah, I tried it via address. Does not work.

Regarding IPv4 PPP profile, how could we have more than one "checking host" when "remote address" per PPP profile is limited to one?
by DarkNate
Thu Sep 03, 2020 12:53 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

Unfortunately, I don't have PPPoE with IPv6, so can't even test... You may try to add your checking IP directly to the interface and see if it helps. That can't be done as mentioned before, "Remote Address" in PPP profile only accepts a single address. Which is the same for IPv4, it limit...
by DarkNate
Wed Sep 02, 2020 9:12 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

But the "gateway" "host" is shown as unreachable. Any ideas why? Yeah, all your routes are not working :( It's because of RouterOS limitation: recursive routes cannot be resolved via interface routes (i.e. gateway=pppoe-out1 is bad route). As a workaround, you make a copy of you...
by DarkNate
Wed Sep 02, 2020 2:22 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

But the "gateway" "host" is shown as unreachable. Any ideas why? Yeah, all your routes are not working :( It's because of RouterOS limitation: recursive routes cannot be resolved via interface routes (i.e. gateway=pppoe-out1 is bad route). As a workaround, you make a copy of you...
by DarkNate
Wed Sep 02, 2020 12:04 am
Forum: General
Topic: Feature Request: IPv6 NAT support
Replies: 20
Views: 5998

Re: Feature Request: IPv6 NAT support

IPv6 NAT will kill the whole point of IPv6.

https://blog.apnic.net/2018/02/02/nat66-good-bad-ugly/
by DarkNate
Tue Sep 01, 2020 5:46 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

So why did you use routing marks in the original post in the first place? Because that config was for traffic balancing. Failover scenario can be greatly simplified, as you can see :) Ah, that makes sense. This is what I've done. And it works when tested, as my ISP1 goes down pretty often and I nev...
by DarkNate
Tue Sep 01, 2020 1:47 am
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

I have tried setting the routes as described in the first post, but it did not work. Later from the thread I realized that I would need to setup mangle rules for this to work. You don't need routing marks at all: /ip route add dst-address=CheckingHost gateway=GW_MAIN_IP scope=10 add distance=1 gate...
by DarkNate
Sat Aug 29, 2020 3:30 pm
Forum: Useful user articles
Topic: Using RouterOS to QoS your network - 2020 Edition
Replies: 216
Views: 277180

Re: Using RouterOS to QoS your network - 2020 Edition

@pcunite thanks for doing this. I've noticed a few things that I'd like your input on. 1. I'm trying to work out why you are detecting VoIP by just blanket accepting 10,000+ ports. Often these ports are also used for gaming etc. Is this intentional or by mistake? I'd like to see a variant made wher...
by DarkNate
Sat Aug 29, 2020 12:18 am
Forum: Beginner Basics
Topic: TWO PPPoE INTERFACES ON MIKROTIK
Replies: 2
Views: 235

Re: TWO PPPoE INTERFACES ON MIKROTIK

Simple failover will happen. Route distance that's lower will become "primary" WAN and route distance that's higher will become "secondary wan".

That's it.
by DarkNate
Fri Aug 28, 2020 2:39 am
Forum: RouterOS v7 BETA
Topic: fq_codel or cake in v7
Replies: 62
Views: 20754

Re: fq_codel or cake in v7

This should help you all: viewtopic.php?f=23&t=73214
by DarkNate
Fri Aug 28, 2020 2:36 am
Forum: General
Topic: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]
Replies: 113
Views: 8529

Re: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]

x86 (I think they are possibly x64?) enough said. That's high-horsepower. You could do a bunch of things that's not possible on arm, arm64, MIPS etc Intel® x86 CPU complex with 8-GB (DDR4 2400 MT/s) memory, and 16 GB of flash and external USB 3.0 SSD pluggable storage slot to host containers Sure t...
by DarkNate
Thu Aug 27, 2020 4:30 pm
Forum: General
Topic: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]
Replies: 113
Views: 8529

Re: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]

Don't they understand CPU cycles or what? Generally, no - people don't tend to realise that network devices are computers with a CPU, RAM, storage and IO with inherent resource constraints. I fell slightly into this camp until I started learning RouterOS in more detail and started to realise how it...
by DarkNate
Thu Aug 27, 2020 3:47 pm
Forum: General
Topic: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]
Replies: 113
Views: 8529

Re: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]

Don't they understand CPU cycles or what? Generally, no - people don't tend to realise that network devices are computers with a CPU, RAM, storage and IO with inherent resource constraints. I fell slightly into this camp until I started learning RouterOS in more detail and started to realise how it...
by DarkNate
Thu Aug 27, 2020 3:45 pm
Forum: Beginner Basics
Topic: Problem with DoH
Replies: 3
Views: 672

Re: Problem with DoH

Redo the config again like this (Remove IPv6 addresses if you don't have IPv6 connectivity): /ip dns set allow-remote-requests=yes max-concurrent-queries=80 query-server-timeout=100ms query-total-timeout=5s servers=\ 1.1.1.1,8.8.8.8,2001:4860:4860::8888,2606:4700:4700::1111\ use-doh-server=https://c...
by DarkNate
Thu Aug 27, 2020 3:22 pm
Forum: RouterOS v7 BETA
Topic: IPv6 Mangle routing-mark?
Replies: 2
Views: 584

Re: IPv6 Mangle routing-mark?

I hope they release v7 soon with all the improvements and IPv6 policy routing. I can't set up recursive routing failover on IPv6 on v6 and it's a pain in the ass.
by DarkNate
Thu Aug 27, 2020 3:19 pm
Forum: General
Topic: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]
Replies: 113
Views: 8529

Re: Mikrotik or NOT!!! Industry standarts say no!! Why? [SOLVED]

I'm no expert on this matter. But here's my opinion anyway: Why are governments/companies expecting a single device to do everything? Routing/Firewalling/DPI? Don't they understand CPU cycles or what? If the networking tasks are offloaded, it would benefit the very company/government in the long run...
by DarkNate
Thu Aug 27, 2020 12:04 am
Forum: RouterBOARD hardware
Topic: hAP ac (and some other new rotuers) too small flash
Replies: 62
Views: 20856

Re: hAP ac (and some other new rotuers) too small flash

I looked all over the web on router's flash size and many people complained about low storage.

This is why I am so glad I opted for the RB450Gx4 instead. 512MB flash is ample.
by DarkNate
Mon Aug 24, 2020 12:40 pm
Forum: Useful user articles
Topic: Advanced Routing Failover without Scripting
Replies: 148
Views: 28003

Re: Advanced Routing Failover without Scripting

I had another go at doing the mangle without conn marks and I think that worked. add action=mark-routing chain=prerouting comment=WAN1 dst-address-list=!to_WAN2list new-routing-mark=to_WAN1 passthrough=no src-address-list=to_WAN1list add action=mark-routing chain=prerouting comment=WAN2 dst-address...
by DarkNate
Fri Aug 21, 2020 4:17 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 387
Views: 96949

Re: v7.1beta2 [development] is released!

WireGuard Support! Finally! About time!
by DarkNate
Fri Aug 21, 2020 2:54 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

The only alternative I can think of is to have some router or VPS "in the cloud" which has the external IP(s) for the company and then configure 2 tunnels from the company site to that place, and figure some way to balance the traffic over those. Then all external access is from one IP (t...
by DarkNate
Fri Aug 21, 2020 2:51 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

Is there anything else out there that's superior to PCC-type concept for load-balancing between two different ISPs without the use of proper bonding? I mean outside the world of MikroTik. Outside or inside Mikrotik, it is not an implementation question, but rather a question of concept, as you stat...
by DarkNate
Fri Aug 21, 2020 1:56 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

The benefit of "both addresses" is the increased chances of bandwidth aggregation. "both addresses and ports" would double or triple the chances of bandwidth aggregation. That is only true for small amount of client devices. When we are talking about 50, 100 and more active user...
by DarkNate
Fri Aug 21, 2020 1:54 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

For a professional production network I'd expect the utilisation of OSPF/ECMP etc. PCC is a hack, not a clean channel bonding solution after all. Like the OP, we use this as a load balancing solution in a multiple ISP scenario. We get fiber from two different providers and we balance the users over...
by DarkNate
Fri Aug 21, 2020 12:29 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

That is right. That is what I mean. You would not want to do an ftp to a site and have the control connection use one WAN address and the data connection using another, because that may be rejected by a firewall at the destination machine. The ftp protocol itself has no problem with it, but statefu...
by DarkNate
Fri Aug 21, 2020 1:51 am
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

Nah, you got it wrong. What the other guy tried telling is, when an app/service/site does multiple connections to multiple destination IPs. Hence the hash will never be the same for each pair of "source IP" and "destination IP" where the latter varies. Please, reread the thread:...
by DarkNate
Fri Aug 21, 2020 12:41 am
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

No one has ever shown any hard evidence for "broken connections due to multiple source IPs". How will using both-addresses end up with "multiple source IPs" in the first place?! The hash will always be the same for a given pair of addresses - so the resulting WAN will be the sam...
by DarkNate
Fri Aug 21, 2020 12:06 am
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

I wrote "To avoid any problems". I cannot name an application, but I can envision how there could be problems, and I can be certain there won't be problems when using only source address. With 300-1000 phones and laptops being used on the network with all kinds of applications I don't kno...
by DarkNate
Thu Aug 20, 2020 11:21 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

Yes, but that would not only affect http/https (in fact it does not affect those protocols in themselves, but it will affect applications). It will also affect ftp, sip etc that really have multiple connections within the same protocol. To avoid any problems I only use src address for the PCC in th...
by DarkNate
Thu Aug 20, 2020 9:53 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

per-connection-classifier=both-addresses-and-ports:2/0 This is normally the risky part with protocols that have multiple connections and expect them to be from the same source address. To be more safe, remove at least the "ports" part from that, and probably also select only source addres...
by DarkNate
Thu Aug 20, 2020 9:44 pm
Forum: RouterOS v7 BETA
Topic: DHCPv6 Server
Replies: 29
Views: 1831

Re: DHCPv6 Server

IPv6 was intended to work with SLAAC and RAVD. What do you need DHCPv6 for?

Even Google is against DHCPv6: https://www.nullzero.co.uk/android-does ... -fix-that/
by DarkNate
Thu Aug 20, 2020 9:41 pm
Forum: General
Topic: Sharing bandwidth easily
Replies: 2
Views: 413

Re: Sharing bandwidth easily

This will help you: viewtopic.php?f=23&t=73214
by DarkNate
Thu Aug 20, 2020 8:27 pm
Forum: General
Topic: Help with load balancing 2x PPPOE-out
Replies: 8
Views: 991

Re: Help with load balancing 2x PPPOE-out

So, you want the effect of aggregated bandwidth without breaking HTTPs traffic/secure traffic, right? Many popular apps already take advantage of Multi-Path TCP such as Steam, Battle.net etc. Hell even Ookla, Fast.com etc uses Multi-Path TCP when it detects multiple-WAN interfaces aka multiple publi...
by DarkNate
Thu Aug 20, 2020 8:20 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 3032

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

Thank you! Your script is prettey much is the same as my one. Except the https but this is likely not related to FaceTime. On this point: Please note I used !dst-address-list as I discovered without it, it causes packet loss on LAN traffic. I use: add action=accept chain=prerouting comment=*e dst-a...
by DarkNate
Wed Aug 19, 2020 5:09 pm
Forum: General
Topic: doh server connect error network is unreachable
Replies: 9
Views: 2271

Re: doh server connect error network is unreachable

I found a solution for the "doh server connect error network is unreachable" problem. I tested with both Google and Cloudflare DoH for over a month and this works well even with unstable PPPoE links. Note 1: I have both IPv4 and IPv6 from my ISP1, so just remove the AAAA entry and IPv6 ser...
by DarkNate
Tue Aug 18, 2020 2:42 pm
Forum: General
Topic: DoH max concurrent queries reached
Replies: 9
Views: 3454

Re: DoH max concurrent queries reached

max-concurrent-queries: 1048576 Could it be possible you have incorrectly configured the firewall and your DNS server is open to public? This number ir much higher than you claim you have users. Many of us are seeing the same issues with DoH on ROS. It's simply not stable/consistent enough. The sam...
by DarkNate
Mon Aug 17, 2020 10:56 pm
Forum: General
Topic: DNS over HTTPS
Replies: 158
Views: 39475

Re: DNS over HTTPS

Dear All has anybody tested IPV6 DNS over HTTPS? Yes. I've tested with: /ip dns set use-doh-server=https://dns64.cloudflare-dns.com/dns-query verify-doh-cert=yes Unfortunately, It does not work. Even though ipv6 works OK. [admin@MikroTik] > put [resolve dns64.cloudflare-dns.com] 2606:4700:4700::64 ...