MikroTik

drzen

Wait, is he/she sending free copies? Where do I sign up? (before Normis gets his hands on the free copies).

Nope, sorry; but in attach there are index and first chapter

drzen

Hi, our VPN is a IPsec XAuth PSK (thanks to MUM talks of Andis Āriņš at MUM Europe in 2018), as client for Apple laptop we are using Shimo (https://www.shimovpn.com/) in Apple OSX Mojave. Now we done an upgrade to OSX Catalina and the same VPN with the same connection parameters are not working. It'...

drzen

Screenshot 2019-10-11 at 15.12.52.png

I want it.

v.

drzen

If you want to start exploring topics such as advanced routing, VLAN, OSPF, BGP, MPLS, IPsec,... here my book:

Regards.
v.

drzen

Would like to see it in English. : - ) Ok. English version is ready. https://m.media-amazon.com/images/I/61TLEN0seDL._AC_UY218_.jpg Index file in pdf format: https://www.zen.pn.it/images/book-routing-en.pdf Paperback: https://www.amazon.com/Theory-laboratories-exercises-Mikrotik-RouterOS/dp/1686046...

drzen

If you want to start exploring topics such as advanced routing, VLAN, OSPF, BGP, MPLS, IPsec,... here my book: https://m.media-amazon.com/images/I/61TLEN0seDL._AC_UY218_.jpg Index file in pdf format: https://www.zen.pn.it/images/book-routing-en.pdf Paperback: https://www.amazon.com/Theory-laboratori...

drzen

Hi,

does anyone use SELKS (https://www.stamus-networks.com/open-source/#selks) as IDS for RouterOS?
I'm trying to setup but there are some minor fix to do and I want to share this experience.

Thanks in advance.
v.

drzen

If you want to start exploring topics such as advanced routing, VLAN, OSPF, BGP, MPLS, IPsec, ... in italian language here my book:
https://www.zen.pn.it/2019/01/routing-book

Index file in pdf format:
https://www.zen.pn.it/images/book2-indice.pdf

Regards.
v.

drzen

If you speak italian: Laboratori ed esercizi per MikroTik RouterOS Link su Amazon: https://www.amazon.it/dp/1521899525/ref=sr_1_1?ie=UTF8&qid=1504185567&sr=8-1 Estratto del capitolo 4 sul routing: estratto del capitolo 4 – routing: https://www.zen.pn.it/wp-content/uploads/2017/08/estrattoCap...

drzen

Hi,

I want to reach this behavior:
- in hotspot I specify max simultosly user to 1
- User connect succefully using device A
- User try to connect using device B
- User is connected in device B
- User is logout in device A

Is this possible using freeradius as RADIUS server?

v.

drzen

That would truly be bad. I've been working on other solutions to push out the list, but have yet to find a good process that is simple and available to all users / firewalls. THE solution is to output only raw ip addresses' list. But this solution collides with the length of variables in routeros. ...

drzen

Great script and hard works. Thanks. A question about security: all go rights but what if your server is violated? For example a malicious code add "/system reset-configuration" or others dangerous commands in front of a downloaded lists? This is the last doubt before adopting your solutio...

drzen

Hi, a strange behaviour. Simple network: - DHCP server - hotspot - ubiquiti unifi antennas - vlan (two SSID, two VLAN) When wireless clients increase I get a lot of: wifi offering lease <ip address> for <mac address> without success. I have already tried in DHCP server "always broadcast" a...

drzen

Hi, I have a classical hotspot configuration with freeradius. Now I want to limit user bandwidth as follow: - first 1GB download is done at full speed - exceeding download is done at limited speed (e.g. 1Mbps) - every day (or after 24 hours) this limitation will be reset (full speed) I look these: h...

drzen

Hi, One of the problems of hotspot is that user remains connected until you press the "logout" button (or other timeout/idle counters). This effect annoying especially when you manage school networks: the student of the second hour get computer still connected to the Internet because previ...

drzen

Hi, I have a router with four hotspots. Now I want to setup HTTPS certificates. Questions: 1. Do I need one hotspot DNS name for every hotspot servers? E.g. hs1.mydomain.com, hs2.mydomain.com,... refer to gateway IPs. 2. Do I need one HTTPS certificate for every hotspot servers? Thanks in advance. v.

drzen

Hi to everyone,

I'm looking for a packet flow diagram like:

http://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6

but referred to hotspot functionality (e.g what is packets flow when hotspot is active?).

Thanks in advance.
v.

drzen

A simple question:

Does RouterOS support USB wireless devices?

v.

drzen

Hi, I done a fault tolerance script. Yet another. :) But... this is multi interfaces fault tolerance (with or without dhcp) and automated. Instructions: 1. Configure router as usual. 2. Check that when only a single wan is connect you must browse internet. E.g. disconnect all wans, connect wan2 and ...

drzen

Yes. It's wireless network with so many APs in WDS with bridge mode. But these APs don't do L2 nat but station/CPE at customer end does L2 nat. And there are multiple entries with same mac as there are multiple customers to single CPE which is in bridge mode with L2 nat. There is no fix time as to ...

drzen

Hi drzen,

I'm facing same issue and can't find any solution. Hotspot disable & enable solves the problem.

Have you found any workaround on this.

Please help.

Thanks.

I schedule the script every 1 hour and this resolve the problem.

v.

drzen

I believe manage engine netflow analyzer demo version lets you do this for 1 router for free.

Only 30 days demo available.

drzen

Hi to everyone, I have some Mikrotik ROS installations. Every router has some ethernets nic connected to segment with hotspot login and queues policies. Now the question. Sometimes the site boss say "I want to know where my employees go and where my internet traffic go!". Not a user specif...

drzen

Hi, in Cisco there is ip helper-address. It's used to forward broadcast to unicast, specially in dhcp and bootp requests. In mikrotik we have ip dhcp-relay that forward all dhcp request. Now the problem: I'm tryng to setup a Apple osx netboot server that use a mix of protocol and request. All go ri...

drzen

Hi, in Cisco there is ip helper-address. It's used to forward broadcast to unicast, specially in dhcp and bootp requests. In mikrotik we have ip dhcp-relay that forward all dhcp request. Now the problem: I'm tryng to setup a Apple osx netboot server that use a mix of protocol and request. All go rig...

drzen

Consider this scenario. - a mikrotik router with network segments (office1, office2, office3, wireless,...) - every segments have a hotspot active - between segments there aren't hotspot (a simple ip wallen garden rule permit this) - every segments have a simple queue to limit bandwidth for the spec...

drzen

Take a look at my post http://forum.mikrotik.com/viewtopic.php?f=2&t=79043

v.

drzen

Here the script that bring an wallen garden host and do a make-static into dhcp server: incongruenceHealt :local hosts [/ip hotspot ip-binding find bypassed] :foreach h1 in=$hosts do={ :local mac [/ip hotspot ip-binding get $h1 mac-address] :local comment [/ip hotspot ip-binding get $h1 comment] :lo...

drzen

Hi, We found an ARP incongruence when MT run a lot of DHCP+hotspot requests. Randomly some clients can't see hotspot login page. We have some clients in hotspot wallen garden ip (bypass with only mac address in rules). After some weeks of debug here the results: - when clients can't see login page -...

drzen

Hi dtoffo :D, yes! This is a my :? copy&paste error. Correct address are: add address=10.10.n.254/24 network=10.10.n.0 broadcast=10.10.n.255 interface=WANn where "n" is the WAN id. Problem 1. Trivially gre service port is on. :) User connect successfully and get correct ip. Tunnel is e...

drzen

Hi, I have N lans and N wans (adsl). I want that every lan get out from its wan. So lan1 output from wan1, lan2 output from wan2,... lanN output from wanN. I done this with these lines (based on http://aacable.wordpress.com/2011/10/27/mikrotik-policy-routing-based-on-client-ip-address/ example): /ip...

drzen

Without more information , I cant really impart any help, however, I can say that we have many RB1100 units in such situations with uptime running into the hundreds of days, using significant AP and VLAN deployments. Some off the cuff questions: Are you running out of DHCP leases? IS the IP Pool bi...

drzen

Another puzzle piece: - in mikrotik i have 3 hotspots interface - two are wired and are ok, no problem - the problematic interface is wired in a segment with only Ubiquiti Unifi APs - the APs are configured as "plain-open" AP, no guest portal I think some ARP poison interference between AP...

drzen

If you're rebooting in the morning, reboot in the evening, manually of course, to see if it tracks a certain amount of time. Use another system to ping it constantly and let you know when it goes down. Have it send an email to you so you can know the exact time. Problem is random in time. Disabling...

drzen

Why dont you upgrade to 5.25 ?

Already done. Same problem.

V.

drzen

I have the same problem.
Any news?

v.

drzen

Hi, I have a mikrotik that send web proxy log to a syslog-ng server. For example this is a row in log: May 12 11:02:55 10.10.0.2 web-proxy,account 10.10.65.78 GET http://gsp1.apple.com/pep/gcc action=allow cache=MISS I use these lines in syslog-ng.conf filter f_squid { program("web-proxy")...

drzen

Hi, I have a router with some interfaces: wan, office, guest, service,... Every LAN interface have own it's own hotspot with specific bandwidth (dinamically generated simple queue). Now i want to logs webtraffic using http://wiki.mikrotik.com/wiki/Proxylizer/Getting_Started but using same queue traf...

drzen

Try disabling the 1:1 NAT on the hotspot. That will arp poison the localnet if you don't disable it. /ip hotspot print set X address-pool=none Just done! But no effect. v. No effect? What are you trying to do? Windows 2008 computer won't ping? Can't ping from another localnet computer? Can't ping f...

drzen

Try disabling the 1:1 NAT on the hotspot. That will arp poison the localnet if you don't disable it. /ip hotspot print set X address-pool=none Just done! But no effect. TS clients receive the second ip address but when I try to surf the web I can not (page expired). If I disable hotspot all go righ...

drzen

Any help is good.
DHCP work fine... seem an ARP problem.

v.

drzen

Hi,

anyone have experiences with windows 2008 terminal service Virtual IP and mikrotik hotspot functionality?

Thanks in advance
v.

drzen

I don't understand a step: I need an address to phisical eth and an address to bridge interface? Or only for bridge interface? /ip address add address=10.10.4.200/20 broadcast=10.10.15.255 interface=adsl network=10.10.0.0 add address=192.168.20.254/24 broadcast=192.168.20.255 interface=guest network...

drzen

Thanks! Now I'm configuring first router (left router). DHCP servers are only in private and service ethernet, the same that have a bridge (guest netwok isn't bridged and eoip). When connect cable to private I get correct ip, if I connect to service eth I get the same subnetwork ip. This is relevant...

drzen

Thanks.
There is a method to setup dhcp (on mikrotik) on every zone so I can give the correct gateway for each building?

v.

drzen

Hi, I have two buildings with 3 networks on each. I need to create a virtual network with 3 networks. I will use PPTP + EoIP. http://www.zenfamily.it/idea.png Router 1: /interface pptp-server server set enabled=yes /ppp secret add name="USERNAME" service=pptp password="PASS" \ lo...

drzen

Hi,

I'm trying to get Interface Tx/Rx rate (like appear in Winbox interface dialog) via SNMPget.
Is it possible?

Thanks in advance
v.

PS: I use this value in a linux box with a command like this:

snmpget -v 1 -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.10.9

drzen

Perfect answer. Thanks!

v.

drzen

No. When I rename an interface: /interface set "lan wifi" name="eth wifi" all reference (for example rules, hotspot,...) change into new name. So if i do this: /interface set "lan1" name="lan2" /interface add name="lan1" the rules (for example) point...

drzen

I want to rename the interface in a live router (i need to add a vrrp interface without changing rules, hotspot,..).

v.

drzen

Ok, this is good.
Someone has just do this sync with C++ or PHP API?

Thanks in advance
v.

drzen

Hi, how can I rename an interface without victimizing the rest of the configuration? For example: Before: /interface ethernet set 2 mac-address=00:01:18:C4:05:BD name="lan wifi" /ip hotspot interface="lan wifi" name=wifi_hotspot_server profile=wifi_server_profile After rename: /i...

drzen

Hi, I would like to keep my backup VRRP routers config synced (firewall/mangle/hotspot/vpn etc). Network is http://forum.mikrotik.com/viewtopic.php?f=2&t=38669 I want to refine idea posted in http://forum.mikrotik.com/viewtopic.php?f=9&t=37384 So i want to do two script: one running on maste...

drzen

I do a more specific post in scripting section about master/backup configuration sync.

Look at http://forum.mikrotik.com/viewtopic.php?f=9&t=38689

thanks
v.

drzen

Well, I think that is the solution for me. Some doubts: 1. I have two routers R1, R2. 2. R1 is completly configured (firewall rules, nat, hotspot,...) 3. R2 without any configuration 4. For each interfaces (X is the lan id - see network diagram before): R1 configuration: /ip address add address=192....

drzen

Ok.
I start reading: http://wiki.mikrotik.com/wiki/VRRP

v.

drzen

Hi, I have a routerOS with 7 lan interface (with hotspot, bandwidth queues,...) and 1 wan interface. Here the overview: http://www.zenfamily.it/schemaFT.png Now I want to give more stability with an hardware failover. What I want is a system similar to cisco pix where two routers are seen as a singl...

drzen

You need to send DM (disconnect message).

http://wiki.freeradius.org/Disconnect_Messages

Thanks for tip. What's to send (to client) is user is already good for accounting (aka I don't want disconnect)?

v.

drzen

Hi, I have a freeradius with a routerOs 2.9 hotspot. All go right about authentication. Clients connect to router, hotspot send auth frame and freeradius respond to request. Now I want to set Interim-Update so I can disconnect clients in some condition (for example account disabled). I set Interim-U...

drzen

drzen, In order to have control over the traffic in your described setup, you need need to know what traffic can go out a certain port of your router and set up mangle for ALL of it. You must not miss one packet that can go out that port. And setup a queue that gives priority to Internet traffic yo...

drzen

It is not wrong, but only in case you limit upload and download together. You need separate packet marks for upload and download and separate limits. Ok. I wanna limit upload and download together. If I wanna prioritize traffic like describe in the last page of janism Pdf (see at http://mum.mikroti...

drzen

I write this little php page to automatic compile bandwidth rules:

http://lnx.zenfamily.it/progetti/routerOS

Is this correct?

v.

drzen

Hi,

no because you change the interfaces.

So... this isn't a solution for me.

drzen

You have to connect all LANs to one routerboard (one with the hotspot) and make a bridge with ether or WLANs you need to autenticate, then the hotspot is installed in this interface bridge.

Ok. But this preserve my actully firewall rules and QoS queues?

v.

drzen

I am a little confused now. What devices are on each of these interfaces? I presume each network is on a separate ethernet port on the RB493, correct? How does each device connected to these ports get the ip assignment? Is one (or more) box a dhcp server? Or static ips? - Each lan is in his separat...

drzen

ADD: I think my question is: If you want all these computers to communicate with each other, why are you netmasking them off from each other, only to reconnect them somewhere in the routing? Is assigning a 10.10.0.0/20 network out of the question? Then connect all the interfaces (ether2-7) like a h...

drzen

One hotspot then.

but in which interface? In winbox can only select a interface....

drzen

More details: - I have already a Radius server for users accounts. - The routerOS is already in a RB493 box - The lan aren't access point but complex lans (with servers, printers,....) - I need to authorized (and autheticate) every users when try to connect to internet via wan interface. what's abou...

drzen

Hi, this is the network: http://www.zenfamily.it/files/network.jpg I need that every users from every lans will be autheticated when use internet connection (so when exit from wan interface). Note that no authentication is needed if a user from one lan transit over routerOs to another lan. How to do...

drzen

Ok, now I'm ready to go (read read read all materials) for a really configuration. First step 1. A mangle for each lan interface - chain prerouting (mark incoming traffic) 2. A first Q1 queue type PCQ max-limit: 10 MB on global-out 3. A queue for each mangle/lan interface with type PCQ with no max-l...

drzen

Thanks! Now I print and read. After that... apply.

drzen

Hi, this is the network: http://www.zenfamily.it/files/network.jpg WAN have 10Mbps Bandwidth I want to give: - a minimun of 500 Kbps for Lan 1 and Lan 2 - a minimun of 2 Mbps for Lan 3 to Lan 6 * these Bandwidths are refereed to internet (wan) connection. No limit to traffic from lan 1 to lan2 and s...

drzen

Hi, I need some help about this configuration: +--- Lan 1 WAN --- Router os ---- Lan 2 +--- Lan 3 WAN have 10Mbps Bandwidth I want to give: - a minimun of 2 Mbps for Lan 1 - a minimun of 4 Mbps for Lan 2 - a minimun of 4 Mbps for Lan 3 * these Bandwidths are refereed to internet (wan) connection. No...

drzen

Are you configured static routes on routers to connect both PC? *on left router: > ip route add dst-address=192.168.1.0/24 gateway=10.10.20 8.2/20 *on right router: > ip route add dst-address=10.10.0.0/20 gateway=10.10.20 8.1/20 Yes. The problem seems the load balancing. For example: pinging from p...

drzen

Hi, here my network: http://img403.imageshack.us/img403/3531/forumff1.th.jpg now pc1 can explorer the web usin wan1, wan2 of fw01, and pc02 using fw02. wan1 and wan2 are load balancing using this schema: http://wiki.mikrotik.com/wiki/Load_Balancing but pc1/pc2 cannot ping pc2/pc1 using backbone. How...

drzen

1. different user for different nics
2. some nics use differente radius servers
3. different ip-address

v.

drzen

add a routing

destination 0.0.0.0
gw 192.168.101.105

with no mark connection!

z.

drzen

Hi,

how to setup different pptp server on different NICs?

I have 3 NIC and want 3 different pptp server.

thanks in advance
z.

drzen

Hi, I have a MT with 3 nic: 2 wan 1 lan Two wan have public ip addresses and are load balancing adsl like: http://wiki.mikrotik.com/wiki/Load_Balancing_Persistent Now I want to make a pptp server using wan1. I do pptp server and can connect from lan to wan1 but no response from external to wan1. Any...

drzen

ok. I do the correct address.

/ip address add address=200.200.200.107/29 interface=wan2

(in my case the interface name is wan2)

but no result. Take a look of picture.

v.

drzen

Hi, 3 nic: lan, wan and dmz. I want connect a server in dmz (internal ip 10.10.224.10) with external 200.200.200.107 I do these steps: # setup lan /ip address add address=10.10.0.2/20 interface=lan # setup wan /ip address add address=200.200.200.106/29 interface=wan # setup default gateway /ip route...

drzen

Hi, I have 3 homed router: WAN, LAN, PUBLIC-LAN These are permission rules: From WAN to LAN: nothing permit From LAN to *: all permit From PUBLIC-LAN to LAN: nothing permit From PUBLIC-LAN to WAN: captive portal (hotspot) Everything go right. Now I want add a PPTP over PUBLIC-LAN to permit some clie...

Search found 82 matches