MikroTik

teleport

have identified an issue with wireguard handshakes (Even on latest version as of today 7.16) and sent details to support. no response yet. the issue is: when wireguard tunnels are setup. seems like wireguard remembers the gateway used and uses it for handshakes. and when it changes, it goes into a t...

teleport

here is my current setup: have wireguard 'client' on mikrotik router configured (configure peer using VPN provider) and i use it to direct traffic of my VLANs to the wireguard using routing rules. would like to move wireguard to a separate machine on LAN(router struggles at vpn traffic beyond 260Mbp...

teleport

Thanks Amm0. the easy solve without much code change was to change to
:local config [:pick $interfaceConfigs $i] and everything works
understand your point of lists vs name-value pairs. will keep in mind next time

teleport

# Define settings for interfaces :local interfaceConfigs { {"P_NEW_WG_3_NS2"; 52821; "2"; "interfacekey1"; "TX100"; "10.3.0.0"; "10.3.0.2"; "TX100"; "ip1"; "10.3.0.1"; "10.7.0.1"; "peerkey1"...

teleport

Something strange happens with wireguard. Only 2 of 5 wireguard peer connections connects. Copy paste keys from scratch but no connection at all have seen that happen especially when wan dhcp renews and my wireguard connections freak out and some will not connect again. no amount of disable/enable ...

teleport

had same issue and was struggling in 7.15.3 and the latest 7.16 beta. frustrated, tried deleting and recreating interface (and recreated peer- not sure if this was necessary) and it took care of the problem. EDIT: still have the problem after a day of it working correctly. all wireguard tunnels went...

teleport

new winbox 4 on linux issue: seems to resurface old 'Option sets' in ip->DHCP Server->Network screen and leases screen for no reason. even after deleting and saving, it still keeps it and does not want to delete it(when checked again). this is causing havoc in my network clients(took a long time to...

teleport

What's new in v4.0beta6: *) minor UI improvements What's new in v4.0beta5: *) return tab based interace, while keeping benefits of dropdowns *) move action buttons into table toolbar *) change style for active sub window *) fix macOS self-update on some systems *) stability improvements please fix ...

teleport

new winbox 4 on linux issue: seems to resurface old 'Option sets' in ip->DHCP Server->Network screen and leases screen for no reason. even after deleting and saving, it still keeps it and does not want to delete it(when checked again). this is causing havoc in my network clients(took a long time to ...

teleport

where is your input firewall rule that accepts udp requests on wireguard port 13231?
also include wireguard interface in LAN interface list for seamless firewall navigation

teleport

Help! :) Still can't get it to load the container.... I run the script with the following: :local tag "ghcr.io/nberlee/bonjour-reflector:main"; :local interface "veth1-reflector"; :local containerLogging "yes"; :local mount "reflector-config"; :local rootdir ...

teleport

Version 7.15.1 RB450GX4 Issue: have a NAT dstnat rule where src-addr-type=unicast and dst-addr-type not set(along with other interface/address list based criteria). what i noticed is that, no packets are captured as part of the rule. to verify where the issue is, i did the following: a) removed src-...

teleport

here is solution: IOS needs hostname resolution to an IP to determine whether to send traffic via tunnel's allowedip address when a subset of traffic(non 0.0.0.0/0 scenarios) is passed to tunnel (in certain quirky scenarios). provide a DNS resolution of hostname that resolves to an address that is p...

teleport

Well to be honest I have always ONLY stuck in 0.0.0.0/0 for allowed IPs on my iphone wg setup, as being the admin I have many subnets I may wish to access, and perhaps even the internet. So you are saying that If only put a LAN that exists on the router in my allowed IPs and then I try to reach an ...

teleport

You are mixing apples and Oranges, what is controllable is whether or not your traffic can be split. The answer is NO. Disagree. once you put *only* homelan address in allowedipaddress-while on cellular, goto ip.me . you should see your wireless ISP details there. got to some homelan URL. you shoul...

teleport

explanation of setup: a) wireguard 'server' on home router(mikrotik) setup fine. b) wireguard IOS app(allowed ip=0.0.0.0/0) can connect to the wireguard 'server'(peer allowedip=wireguard ios client interface ip). checked accessing lan devices and internet using Iphone IOS browser. everything works f...

teleport

The login works fine from the app when I use it. Are you attempting winbox or something else. On the Router you need to allow the wireguard IP to the input chain. For address just use MT wireguard IP : winboxport - not winbox. mikrotik IOS app - wireguard on RouterOS is not a problem. as mentioned,...

teleport

in a road warrior setup, where i use Mirkotik IOS app to connect to home network over wireguard (using wireguard app on-demand setup to include homelan network as part of allowed address) , i see that i cannot login (webfig login works). when allowed address is changed to 0.0.0.0/0. it works fine. a...

teleport

am having issues though reaching the container that has controld running(veth port to a controldbridge) from my main vlan aware(bridge vlan filtering enabled) bridge where my devices are. ping from devices on my main bridge cannot reach the ip of veth (while i can ping it using tools->ping). any hel...

teleport

here is a way to get past controld arm docker image issue, build image yourself. on a linux box: cd github git clone https://github.com/Control-D-Inc/ctrld.git cd ctrld; env GOOS=linux GOARCH=arm go build -a -gcflags="all=-l -B" -ldflags="-w -s" ./cmd/ctrld cd .. docker run --pri...

teleport

https://docs.controld.com/discuss/66370 ... 000fcb224f

please let me know if anyone was successful

teleport

thanks Amm0/tangent for your replies.

teleport

i was able to configure it with bridge vlan filtering on main bridge and get it to work. Hardware offload turned off. switching speeds(same vlan iperf) dropped from about 950 to 880 Mb/sec .Routing speeds (Across vlan iperf) remains the same ~740 Mbps(as expected). for VETH-ha, had to make pvid=<iot...

teleport

here is support response till now and my response back to them: Support: *** /container mounts add dst=/config name=ha_config src=/usb1/ha_config /interface bridge add admin-mac=78:9A:18:A9:E8:C7 auto-mac=no comment=defconf name=bridge port-cost-mode=\ short add name=ha vlan-filtering=yes /interface...

teleport

You can treat VETH the same as a ether1 etc ports. So it can use in your "main" (or only) bridge, and using vlan-filtering=yes. Possible to make a trunk (e.g. /interface/bridge/vlans as a tagged=), or, an access or hybrid port by setting a PVID etc. The same as any other ethernet port liv...

teleport

have requested support to provide sample configuration for vlan aware veth ports in a single bridge configuration with multiple vlans (from homeautomation perspective even the matter server is expected to be on same network as ha/devices)

teleport

Put the VETH on the bridge . if main bridge had VLANs(each serving to clients with its own DHCP server), then just assigning an unused address from any of the VLAN (specifically that would have homekit devices) work? i remember trying this and it did not (meaning, it was not reachable via http://<i...

teleport

followed below instruction for setup of homeassistant: https://help.mikrotik.com/docs/display/ROS/Container+-+HomeAssistant with above, am unable to add homekitbridge to IOS as an accessory (Since they reside on different Networks. HA on its own bridge/ip based on above instruction and homelan devic...

teleport

Hi All, I had a RPi4 Pihole for a couple year perfectly working and heard of the possibility to configure a Pihole container into my RB5009 so I decided to give it a try. I'll avoid for now to fill this message with all the ROS configuration, maybe I could post it later if something punctual is nee...

teleport

have noticed that applehomekit has quirky behavior especially when you roam from wifi to cellular and back to same wifi (with vpn like protonvpn always enabled/on). it does not work correctly when you roam and come back to same wifi (on IOS)

teleport

while the above setup works with different vlans setup on the router, was wondering how to get it to work when router has wireguard enabled and me as road-warrior would like to use homekit (with an iphone) when connecting via wireguard from outside home.

teleport

Add veth1-reflector as tagged port to the vlans you want to use. Change the bridge to your bridge and vlan-ids to the vlans you want to use. Please note, these commands open an editor, to save the changes press ctrl+o to exit the editor. Interfaces are comma separated, so if you want to add multipl...

teleport

heavy memory leak on the rc2 on rb450gx4. within 4 hours, 1gb ram became 450MB available (from typical 920MB available)

teleport

SSH client seems a bit broken. I use the mikrotik as a client to connect to something like a UniFi - it attempts a connection but it immediately quits. It doesn't get as far as asking for a login or password. It works in 7.7 Edit: also works ok in 7.10rc1 refer https://forum.mikrotik.com/viewtopic....

teleport

RouterOS version 7.10 has been released in the "v7 stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage s...

teleport

The issue has been identified, and we look forward to fixing it on upcoming RouterOS versions above is not fixed in 7.10rc6 (where it is mentioned as fixed). still get same 'authentication failure' when accessing remote SSH host as ssh-exec and 'welcome back' message as ssh. works fine when tried f...

teleport

The issue has been identified, and we look forward to fixing it on upcoming RouterOS versions above is not fixed in 7.10rc6 (where it is mentioned as fixed). still get same 'authentication failure' when accessing remote SSH host as ssh-exec and 'welcome back' message as ssh. works fine when tried f...

teleport

What's new in 7.10rc6 (2023-Jun-13 10:52): *) ssh - fixed RouterOS SSH client login when using a key (introduced in v7.9); above is not fixed in 7.10rc6. still get same 'authentication failure' when accessing remote SSH host as ssh-exec and 'welcome back' message as ssh. works fine when tried from ...

teleport

Hello, I also have a problem with login by SSH public key. [geadmin@rtr.lesko-ing.com.pl] > /system/ssh-exec user=geadmin address=192.168.40.3 command="/system/resource/print" failure: authentication failure On the same key I can login from linux without any problem. So problem exist betw...

teleport

- 1 x RB450Gx4 that after the upgrade never came back online (it's 30 KM away from where I am) The RB450G was born with v6.x, why was there a need to put v7? in my case, reason i got RB450GX4 few years back was because v7 would first be supported for ARM. all stable 7.x has been good on my RB450GX4...

teleport

I had issues with:
- 1 x RB450Gx4 that after the upgrade never came back online (it's 30 KM away from where I am)

Respectfully disagree. i have upgraded RB450Gx4 without issues. used the IOS app to trigger upgrade in my case (home setup).

teleport

Does proton provide a private key for you to use in the WG interface? If not, then proton will need the public key generated by the private key provided by the MT router. yes proton provides private key.here is sample information generated from protonVPN: [Interface] # Bouncing = 0 # NetShield = 2 ...

teleport

read this to get some ideas:

viewtopic.php?p=978606&hilit=protonvpn#p978606

teleport

Command line: Setup Interface /interface/wireguard/add name=protonwg00 private-key="<private Key>" comment="ProtonVPN interface" Add peer /interface/wireguard/peers/add endpoint-address=<IP> endpoint-port=51820 public-key="<public_key>" allowed-address=0.0.0.0/0 interfa...

teleport

recent one RB260GS(CSS106-5G-1S) which supports up to SwOS 2.13 Issue Resolved: From Support: It is related to RSTP. The RB450Gx4 with HW offloaded bridge and configured VLANs on the switch menus tags RSTP BPDUs from CSS106. These tagged BPDUs are received on the CPU and they should be ignored base...

teleport

Update: Removed all mangle rules. made only changes in /routing/rules. (3 Vlans total and 2 of them go through protonVPN) for DNS: made NAT setting to forward DNS traffic to protonVPN DNS for the 2 VLan's Question: 1.how important is changeMSS for protonVPN. have skipped that setting(as i have remo...

teleport

I had thought it would be: 1, 2, 7, 8, 3, 4 Such that once line 8 matches, it would return, and the "passthrough=yes" from line 8 applied to the behavior of the jump action in line 2, thus continuing to lines 3 and 4. But if I understand what you're saying, it should be: 1, 2, 7, 8, 9, 10...

teleport

Here is a working setup. please comment on shortcomings/optimizations/embedded questions. Route all internet traffic through a VPN server Enter the following in the command line (hitting enter after each line): /ip firewall address-list add address=192.168.88.0/24 list=under_protonvpn Above line No...

teleport

have you discarded STP/RSTP issues? which version of SwOS are you using? is OLD RB260GS which supports only up to SwOS 1.7 or the later version RB260GS(CSS106-5G-1S) which supports up to SwOS 2.13 ? recent one RB260GS(CSS106-5G-1S) which supports up to SwOS 2.13 Issue Resolved: From Support: It is ...

teleport

Hello: protonvpn has provided steps to configure Mikrotik for wireguard. https://protonvpn.com/support/wireguard-mikrotik-routers/ Question: 1. if i have multiple VLAN's and i want only one of them to access internet using ProtonVPN, how would the instructions change? --especially around DNS where i...

teleport

have you discarded STP/RSTP issues? which version of SwOS are you using?

is OLD RB260GS which supports only up to SwOS 1.7 or the later version RB260GS(CSS106-5G-1S) which supports up to SwOS 2.13 ?

recent one RB260GS(CSS106-5G-1S) which supports up to SwOS 2.13

teleport

did that too on 74beta5. issue still persists.support has been given supout.rif even on latest beta (beta5) can someone acknowledge that they have also run into same issue(even in latest bets5/rc2). am having hard time convincing support something that is easily reproducible. works fine with defaul...

teleport

From ROS 7.4beta5 change log: So maybe you can upgrade your RB450Gx4 to latest beta and see if things got any better? did that too on 74beta5. issue still persists.support has been given supout.rif even on latest beta (beta5) can someone acknowledge that they have also run into same issue(even in l...

teleport

DHCP Regression issue from 7.3 and above. support acknowledges(SUP-85542) but fails to provide information as to which release it would be fixed.

viewtopic.php?t=187080

teleport

From ROS 7.4beta5 change log: *) dhcpv4-server - placed option 53 as the first one in the packet; So maybe you can upgrade your RB450Gx4 to latest beta and see if things got any better? did that too on 74beta5. issue still persists.support has been given supout.rif even on latest beta (beta5)

teleport

From Support: "We have managed to reproduce the issue locally in our labs and look forward to fixing it on upcoming Router OS versions, unfortunately, I cannot provide an ETA now." if anyone wants this issue to be prioritized so that they can use container feature or anything else new in 7...

teleport

can someone condense the thread to best practice(and working setup) needed to setup wireguard client on Mikrotik to connect to protonVPN.thanks

teleport

downgrade to 7.2.3 fixed the issue. seems to be regression crept into newer releases. can someone bring this to attention of mikrotik developers. thanks Nice catch. There are already reports about various DHCP clients having issues with DHCP server in 7.3 (and AFAIK 7.4beta). Seems that option orde...

teleport

played around with that too..12 hrs was initial.then changed to 8 hours.both cases at end of 15 seconds it asks for lease again in a perpetual loop..changed power supply from PoE to dedicated power..same issue..introduced third party switch in between. still same behavior. Here is latest findings: ...

teleport

Port flapping (intermittent connection losses) should be shown in logs even with default logging settings. And those would explain frequent DHCP lease renewals. What about lease time setting on your DHCP server? It seems that too short setting (e.h. shorter than a few tens of minutes) can upset som...

teleport

Port flapping (intermittent connection losses) should be shown in logs even with default logging settings. And those would explain frequent DHCP lease renewals. What about lease time setting on your DHCP server? It seems that too short setting (e.h. shorter than a few tens of minutes) can upset som...

teleport

And nothing else about that device or ethernet port through which it connects?

Did you try to reboot RB260GS?

Reboot did not help. Any specific logging levels on rb450gx4? Just had dhcp logging level on apart from standard log levels .

teleport

attached is the debug log from the upstream dhcp server.(rb450gx4)..notice every 15 seconds..there is activity..

teleport

have an Rb260GS switch which had been working great for about 1.5 years. recently the computers connected to the switch were finding it difficult to get DHCP IP address. the switch is in turn connected to an RB450GX4 up stream router(also DHCP server). to isolate the issue to the switch, replaced th...

teleport

issue was related to zerotier interface not getting zerotier address.this was working before. now, you need to set 'allow managed' flag in zerotier interface configuration screens in winbox. after setting it the interface gets ip address and things work Zerotier : a) without VLans my zerotier setup ...

teleport

thanks.works now. just wish this was documented well in the help/wiki section for zerotier.
in the past this was working without explicitly assigning this flag when things had to be done via commandline.

Try enabling this:
Screenshot 2022-02-25 115545.png

teleport

after successful setup of zerotier
the command /zerotier/interface/print shows correct output and connection is fine.
ip/address/print where interface~"zero"
returns nothing. the interface has no zerotier address

Device:RB450GX4

teleport

Zerotier : a) without VLans my zerotier setup was working great. i was able to hit webfig UI from another computer in internet running zerotier(part of same zerotier network) with above VLAN setup zerotier access stopped working: Question: a) should the WAN port be defined in specific way in switch ...

teleport

Hi All: i was able to make it work. here are my switch related settings on my RouterBoard. to test: had one guest vlan id 10 and another management vlan 20. since mine had atheros 8327, when you turn on vlan-mode secure..it does all the magic of tagging/untagging(using setting of default-vlan-id) wi...

teleport

Thanks to both of you for replies(it was a great primer to read) . Anav: for Routerborad RBG450GX4 i gather from documentation that /interface ethernet switch vlan {} and /interface ethernet switch port {including switch port} are the way to set it up. how would the management LAN setup look like wi...

teleport

AP Device: U6LR (3 ssids: Vlan 20,30 and third under default 'LAN'{MGMT Vlan} ). Mikrotik: RBG450GX4 (eth1 -connected to internet, eth2 -connected to AP, eth3 connected to downstream switch that has Unifi controller connected,eth4,5 other devices ) would like: Vlan20 clients to have only internet ac...

teleport

in 7.1rc4 on rb450gx4, i see these sporadic errors: "DoH server connection error: Idle timeout - waiting data"
its configured for cloudflare DNS.

teleport

Like this feature a lot! I have the RB4011 non wireless on version v6.48.4. Apart from backing up the current config, is there anything else I need to do before going to 7.1rc2? i did it on routerboard rb450gx4 and all i had to do was drop the rc2 into 'files' and reboot twice. also take the zeroti...

teleport

Teleport, start with Zerotier tutorial on their webpage. Did you get a connection to their network, and then went and approved this Windows PC in the zerotier portal? You have to approve every device there. thanks for response. those were all setup correctly. i have the setup working now after the ...

teleport

Why not, you can install iPhone Zerotier client and then join your home LAN with this. Home network with Mikrotik ethernet router rb450gx4: tried to access the webfig URL using the zerotier IP from a windows box(zerotier enabled/connected) with not much success.(zerotier is running and connected to...

teleport

have RBG450GX4 with latest stable version. am trying to apply 7.1 beta 2. no matter what approach i take(use webfig/winbox->quickset/winbox->system->packages for upgrade,dropping npk file), i get the 'not enough space for upgrade' in the log after reboot. here is log line 1 and 2 after reboot: syste...

Search found 76 matches