MikroTik

luqasz

Hi

I have written a separate program to configura mikrotik devices via API. I have posted it on forum.

luqasz

Hi I have been wroking on a program to remotely configure mikrotik devices via API. You can only configure one device per program execution. Please read the documentation before using. Example usage cases: add system users change system users passwords set system ntp client Example usage: ./mcm.py -...

luqasz

Hi How to do an equivalent ip r g 1.1.1.1 on mikrotik ? On linux it gives route that matches given ip address. Consider following example. You have 2 routers connected to each other with ether1. On R2 you have 1.1.1.1/30 on ether2. You are logged on R1 and want to know what is the route for 1.1.1.1 ...

luqasz

Please correct me if i am wrong.
Session timeout is equivalent to lease-time. right ? According to dhcp rfc client must send DHCPREQUEST every half of lease time. if a router is on 24/7 it will never expire its session. Assuming ofcourse that nothing will break between clients router and DHCP server.

luqasz

Hi I have noticed that mikrotik's DHCP does not ask RADIUS every time DHCPREQUEST is sent. Consider following scenario: Client has a router witch is on 24/7. Some day he wants higher rates. Now you have to restart his router for changes to take effect. Is there any way to configure DHCP to always se...

luqasz

Issue: Wrongly calculated and selected routes. Description: http://forum.mikrotik.com/viewtopic.php?f=2&t=84461 Version affected: Tested on 6.12. I would not be suprised if all 6.x are affected. How to reproduce: http://forum.mikrotik.com/viewtopic.php?f=2&t=84461 Support TicketID: 20140428...

luqasz

Thx a lot. That was verry helpfull.

luqasz

Hi

I want to implement diffie-hellman negotiation in my python api library. I do not know how to do it. I know that chupaka implemented it in delphi but i do not know this language. Can anyone help ? I know how this mechanism works but explanation on wiki is rather enigmatic.

luqasz

Hi I am working on api query wrapper. It is placed in separate branch on github . I would verry much appreciate any feedback you give. Current proof of concept is: Iterator implementation for row in api.query('/interface').where( row.type == 'bridge' ): do stuff Executing querry and assigning result...

luqasz

Hi, Edit: It looks like a multiarea OSPF problem. It seems to be described in RFC5185 as describe in ths post: http://forum.mikrotik.com/viewtopic.php?f=14&t=84113&hilit=ospf Regards, I do not think so. Problem described in link is a different one. R2 knows about 2 paths. intra and inter ar...

luqasz

hi i have made a lab with diagram as in ospf.png . R1 /routing ospf instance set [ find default=yes ] disabled=no distribute-default=if-installed-as-type-1 !domain-id \ !domain-tag in-filter=ospf-in metric-bgp=auto metric-connected=20 metric-default=1 \ metric-other-ospf=auto metric-rip=20 metric-st...

luqasz

https://github.com/haakonnessjoen/MAC-Telnet

under debian and ubuntu just:

apt-get install mactelnet-client

luqasz

Hi I am finishing my Python3 API implementation. Project is hosted on github . This is in a developement branch. Feature requests and feedback is welcome. Planned features: * querry wrapper * tag support * asynchronous command runs (possibly via callbacks) I aim to use this library to write MCM (mik...

luqasz

hi

In 2013 openvpn releases a newer version of openvpn. That claim to do a lot of bug fixex and code cleanups.
https://community.openvpn.net/openvpn/w ... nOpenvpn23

Maybe this time mikrotik programmers will not try to commit suicide implementing full featured openvpn.

luqasz

simply show loopback interface in interface lists.
then you will be able to add addresses to it and not make a dirty empty bridge hack.

luqasz

/file mv,cp,mkdir

it is in my opinion self explanatory....

luqasz

if you want to find a mac address on a bridge host table you have to write it case sensitive. how about accepting it in case insensitive ?
This may be for some people a cosmetic feature but still noce one.

luqasz

if you set an ethernet/sfp interface as disabled link is still up. how about phisically (elecrically) disable it as well. just like a decent switch does

luqasz

hi

once host have been discovered it can stay there for a long time. even if it is down. does this protocoll have some timeout ?
i have a feeling that this list may grow endlessly

luqasz

/routing bfd interface> disable 0
failure: cannot disable 'all' interface config

remove all interface as a default configuration. you just do not use it always.

luqasz

prefix lists for bgp, ospf etc. not only rip. once done you can store prefixes in some separate place making filters refer to them and resulting in more clear configuration

luqasz

/ip firewall connection 25 tcp 212.77.100.128:80 91.xxx.xxx.xxx:52378 established 2h47m39s issuing below command: print where src-address=212.77.100.128 will not print src addres becouse you have to write it with port. what if you do not know the port or you are just not interested in it ? under wi...

luqasz

it is verry simple to crack local user password once you have access to binnary backup for example. Store them in sha or blowfish. If you do this they can be exportable via /export. Also please note that importing them would be a really nice feature. as a side note please read this and THIS . please...

luqasz

kerberos support for ssh logging.
i may be bombarded her to use radius with user-manager. problem is that radius is not as secure as kerberos. if you want to have same password for winbox and ssh you have to store and send passwords in plain-text !!!

don't you think that is a security hole ?

luqasz

ssh-rsa encoding for ssh client

this is an exact error message on cisco switch when i try to log in with ssh client on ros 6.10

SSH2 0: hostkey algo not supported: client ssh-dss, server ssh-rsa

luqasz

why this wiki pade have been removed ?

luqasz

you mean, it's the solution?

yes

what chain is used in BGP Peer?

bgp-provider-in (the same as specified in peer configuration)

luqasz

add action=jump chain=bgp-provider-in jump-target=PROVIDER-PREFIX set-bgp-prepend=6 add action=discard chain=bgp-provider-in add action=accept chain=PROVIDER-PREFIX prefix=x.x.x.x add action=accept chain=PROVIDER-PREFIX prefix=x.x.x.x add action=return chain=PROVIDER-PREFIX this will result in sett...

luqasz

it is applied to every rule in jump-target chain. confirmed.

i wan to store peers prefixes in one chain. thus i will not have to update every peers chain if a prefix changes.

luqasz

hi since routing bgp advertisments print <peer> does not print as-paths for prefixes that are distributted by me. http://wiki.mikrotik.com/wiki/Manual:BGP_HowTo_%26_FAQ#Question:_How_to_seen_routes_advertised_to.2C_and_routes_received_from_a_particular_peer.3F how to check if my routing filters actu...

luqasz

hi i have multiple bgp peers. i want to place every peers prefixes in their own chains. for example i have 2 peers A and B i want to place peers A an B prefixes in chains chain-A and chain-B. my prefixes in chain-Y. every "prefix" chain will have return action at the end. if i place: actio...

luqasz

Very simple question I want to disconnect a user from ppp active so I send /ppp/active/remove ?name=value it returns done but that user specified in the value is not disconnected. any input? http://wiki.mikrotik.com/wiki/API#Queries Api queries are not supported in commands other than print/getall....

luqasz

in RouterOS 6.8 we will have SMB 2.0 and a completely new implementation, so better to test that. If you wish to see the pre-release, email support

you mean smb 2.0 protocol version ?
i will send email to support. where shall i post my issues/observations with pre-release ?

luqasz

hi i am unable to mount a share via mount.cifs under ubuntu 12.04 output from dmesg [ 6994.728621] CIFS VFS: NTLMSSP requires Unicode support [ 6994.728631] CIFS VFS: Send error in SessSetup = -38 [ 6994.728820] CIFS VFS: cifs_mount failed w/return code = -38 output from mount command sudo mount.cif...

luqasz

anybody should be able to update it.

so you suggest that I (and almost 7 bilion people on planet) have enough skills to do it ? not knowing C.

luqasz

hi

can mikrotik update patch for stable release of openwrt ?
lots of people want to use latest stable openwrt. patch on mikrotik wiki is 2 years old

luqasz

if u use same HDD u will not
but why reinstall?

thx for info.

i have made a really stupid mistake. i have added a "system reboot" at the end of a script with is executed just after startup

luqasz

Cisco cable will work

thx for info

luqasz

hi

i need to reinstall routeros on a x86 PC. if i check that i do not want the configuration will i loose the license key ?

luqasz

hi i have noticed that these docs: http://i.mt.lv/routerboard/files/RB2011UAS.pdf http://i.mt.lv/routerboard/files/rb2011U-qg-130822142451.pdf also please note that in this doc http://i.mt.lv/routerboard/files/RB2011UAS_2HnD.pdf you can see a serial rj45 port but absolutellyno description what cable...

luqasz

ok thx for reply. it seems that yes/no is always accepted while true/false not.
i will then map yes/true to boolean True and no/false to boolean no/false.

luqasz

hi i am writing my impleentation of api in python and i have encountered a problem with sending yes/true, no/false. all examples belowa are for version 6.1 take for example: <<< /ip/address/print <<< EOS >>> !re >>> =.id=*1 >>> =address=x.x.x.x/x >>> =network=x.x.x.x >>> =interface=bridge1 >>> =actu...

luqasz

what does

=category=0

mean

luqasz

hi i have been wondering what do those =category=NUMBER mean in API. !trap (5) =category=2 =message=interrupted <<< /ip/apress/print <<< EOS >>> !trap >>> =category=0 >>> =message=no such command or directory (apress) >>> EOS >>> !trap >>> =message=no such command prefix >>> EOS >>> !done >>> EOS I ...

luqasz

hi

i am rewritingg my routeros api implementation (python).
i host my code on github. this is the branch where i rewrite my code.

i need code reviews and some design pattern help.

luqasz

when an entry appears in /ip dhcp-server lease you could then launch a script passing internal *id as parameter and do some actions based on it. add custom firewall rule etc. i know this is a "BIG" feature request, but imagine the possibilities. there's some undocumented feature :) /ip dh...

luqasz

changing of firewall default policy

luqasz

"trigger" events.
example:
when an entry appears in /ip dhcp-server lease you could then launch a script passing internal *id as parameter and do some actions based on it.
add custom firewall rule etc.
i know this is a "BIG" feature request, but imagine the possibilities.

luqasz

source address selection with /tool fetch

luqasz

considder this example. you monitor some interface. that interface is no longer present on the routeros. mrtg image url is then invalid. error 404 should be putbut instead you get an image with text "ERROR: invalid id" i considder this a bug. when using wget you will not be able to disting...

luqasz

swap mrtg with rrd
it will be possible to specify different time ranges when viewing history
also posiibility todownload rrd files for some other possibilities.

luqasz

loopback interface address assignment. [admin@Mikrotik] > ping 127.0.0.1 count=2 HOST SIZE TTL TIME STATUS 127.0.0.1 56 64 6ms 127.0.0.1 56 64 5ms sent=2 received=2 packet-loss=0% min-rtt=5ms avg-rtt=5ms max-rtt=6ms HOST SIZE TTL TIME STATUS you can ping it but can not add more addresses. only solut...

luqasz

hi.

can we (forum users) update wiki pages ?
i have some api examples that i think some people will find usefull. shall i post those updates here ?

luqasz

Also, side note: ".proplist" is an attribute word, not a query word. It could (if you let it...) go into the same place where users would normally specify arguments (e.g. "detail", "stats", etc.). i don't want to distinguish normal print and print with querry. in a sen...

luqasz

thx for reply my goal is to write some wrapper for queries so when someone will use my api implementation (in python3) he/she will not have to learn query syntax. for example: query('/interface').where(query.type == 'ethernet').returning(query.id) this will show all ethernet interfaces with =.propli...

luqasz

kerberos ssh login

this would be a really secure and nice alternative to radius.

luqasz

sory for that.

currently i am rerwiting mcm and routeros api implementation. i hope i will finish it soon.
consider this topic as closed.

luqasz

thx for your reply. it did answer some questions. /interface/print ?type=wlan ?#! ?type=bridge ?#! ?#& is equivalent to /interface/print ?type=wlan ?type=bridge ?#|! ok got that. above is the same as: (!a && !b) == !(a || b) but how to write this: !(a && b) == (!a || !b)

luqasz

hi i would like to use queries more frequently. problem is that i do not understand all that is written on wiki . considder following examples: i have a routerboard with 5 ethernet interfaces, 1 wlan, 1 bridge print all interfaces that are not type=wlan and type=bridge /interface/print =.proplist=ty...

luqasz

hi in API docs you write that maximal lengts is up to 0x7FFFFFFFFF. up to including or not ? in short. length must be: < 0x7FFFFFFFFF <= 0x7FFFFFFFFF ? according to table: len >= 0x10000000 5 0xF0 and len as four bytes i understand that i always write 0xF0 as first byte and "len as four bytes&q...

luqasz

hi for some time i have been working on program that will ease up my work. i wanted something that will change some part of mikrotik configuration on multiple devices without doing it manually. i have made "mikrotik configuration manager". this software is free, open source licensed under ...

luqasz

hi. i want to use fetch via api. problem is that trough api running fetch repeats its status on and on forever until it gets terminated by '/cancel'. it makes things difficult. it requires someone (like me) to implement totally different method to use '/tool fetch' in mikrotik via api. it is not com...

luqasz

i have found that when logging via ssh/telnet mikrotik sends password in clear text. when logging via winbox/mac-telnet/bw-test mikrotik sens password in chap-password format. it is now obvious why radius fails to "transform" chap password into sha-password. i am asking why it is different...

luqasz

hi i have noticed that if i have password stored in database in md5 or sha user can not use/authenticate using: * bandwidth test * winbox * mac-telnet things taht only work are: * telnet * ssh * ftp if i have password in clear text format all above works freeradius -X returns: without clear text log...

luqasz

and ? any official statement ?

luqasz

hi

are you aware of this ?
http://felinemenace.org/~andrewg/MikroT ... sis_Part3/
and this ?
http://manio.skyboo.net/mikrotik/index.en.php

luqasz

thx for reply

luqasz

hi

i was wondering if it is possible to get file contents via api. for example to get contents of rsc files.

luqasz

ok thx for reply. my fault. thought it was a bug

luqasz

found something that works much faster. { :local gw [/ip route get [find where dst-address=0.0.0.0/0] gateway]; :local mac [/ip arp get [find address=$gw] mac-address ]; :put [/interface bridge host get [find mac-address=$mac] on-interface ]; } and something really interesting: :put [:typeof [/ip ro...

luqasz

hi i want to get an uplink interface based on ip address of default route on bridged mikrotik. i have solved this by doing: :put [/interface bridge host get [find where mac-address=[/ip arp get [find where address=172.16.244.33] mac-address]] on-interface] problems: slower when more entries in bridg...

luqasz

OMG it is so SICK. i have found that in debian not all dictionaries are included in directory /usr/share/freeradius/dictionary file (witch holds $INCLUDE lines per vendor dictionary)
i was missing $INCLUDE dictionary.mikrotik line

any way thx for your quick response. much apicieated.

luqasz

# NAME VERSION SCHEDULED 0 system 4.10 1 dhcp 4.10 2 hotspot 4.10 3 calea 4.10 4 gps 4.10 5 advanced-tools 4.10 6 mpls 4.10 7 ipv6 4.10 8 multicast 4.10 9 routerboard 4.10 10 ups 4.10 11 security 4.10 12 ntp 4.10 13 user-manager 4.10 14 routing 4.10 15 ppp 4.10 16 wireless 4.10 ii freeradius 2.1.10...

luqasz

[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'ukasz' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE u...

luqasz

thx for info but: - freeradius says that Mikrotik-Group is no longer used (confusing) - in witch table should i input this value (radreply, radgroupcheck, radgroupreply) and how it should look like (operator)? maybe you could post me some debug infor from mikrotik user manager and mikrotik device th...

luqasz

hi i have installed freeradius and set up mikrotik to use accounts in radius to login via telnet ssh. default group is read. i can not find any info how to set up radius to assign some users to group full. i am using freeradius + postgres backend. have any 1 tried it ? radreply table (i have tried c...

luqasz

thx for reply i can not edit http://wiki.mikrotik.com/wiki/Manual:System/Packages can you please post on wiki: Dependencies All packages require same version as system package and system package itself. Packages are independent. Dude package does not depend on any package and on any version. For exa...

luqasz

hi i am writing a cfengine like program for routeros to massively configure ros devices via api. i would like to manage package sets in ros devices but i don't know their dependencies. can i have some documentation on this ? what packages depend on witch one and version relations etc. i will documen...

luqasz

ok my problem was that same interface that was on bridge was used in vlan.

ether3 was bridged with eoip. i wanted to add vlan to ether3 and when i removed ether3 from bridge vlan worked

luqasz

the main difference between linux and mikrotik is: - linux's interface can be both tagged and untagged same time no this is VERRY WRONG - mikrotik's interface CANNOT be both tagged and untagged same time (by my experience) by sample: linux interface eth0 (untagged to ANY VLAN - depends on switch po...

luqasz

i have only 1 cable that leads to the roof witch is preetty much inaccesable.

luqasz

hi i have a routerboard 433ah connected fo switch and a pc with debian on board with is connected to a switch 433ah ether 3 <->(port 11) sw (port8)<-> debian i want to pass a vlan tag-id 300 from routerboard to debian. then bridge vlan on rb with wifi card. name="test" mtu=1500 l2mtu=1518 ...

luqasz

hi

where can i find old pre 3.30 routeros images ?

luqasz

hi will you implement import of hosts feature ? we are using nagios (verry old version) and currently we can not click one by one 1000k and growing number of hosts. import would be verry nice and as well as some templates for importded hosts. weather it is a mikrotik device (default password) or pc ...

luqasz

hi

can you implement ssh + kerberos based logins feature ? this will be a nice alternative for user manager

luqasz

i might know what is your problem. this is my whole rsyslog.conf # /etc/rsyslog.conf Configuration file for rsyslog v3. # # For more information see # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for loca...

luqasz

ok then it is impossible (and not only this) to log failed logins with prefix --ACCOUNT-- and rest of system messages as --SYSTEM-- only. problem is that i would have to know EVERY log message that mikrotik can send to filter it properly either in mikrotik or rsyslog. having add action=remote disabl...

luqasz

hi i want to log couple of thing into a remote host via rsyslog. problem is that: 13:59:24 wireless,info --WIRELESS--: 00:0B:6B:2C:35:7C@wlan4: connected, wants WDS 13:59:26 system,info,account --ACCOUNT--: user admin logged in from 10.194.3.56 via ssh 13:59:26 system,info,account --SYSTEM--: user a...

luqasz

hi for some time i have been strugling with remote loging in syslog. i have made it to a level that i can sort messages in rsyslog to separate files. problem is with failed logins. this is my /system logging export /system logging action set memory memory-lines=300 memory-stop-on-full=no name=memory...

luqasz

new policy in /user group. special policy to log in via api called api, now it can be blocked via winbox policy only. please separate those two. any chance for this ? we have almost 1000k mikrotiks and counting in network and we woul love to use one password for entire countru to log in via api. gi...

luqasz

new policy in /user group.
special policy to log in via api called api, now it can be blocked via winbox policy only.
please separate those two.

luqasz

many users write some scripts (many of them are not version compatibile) to backup and export configuration maybe some feature like /tool backup to write backup and rsc file and send it via ftp, tftp, scp to a remote host. verry important feature would be to write files to memory and not internal s...

luqasz

NAB can you enable your read function to supress this:

 php-cgi -q mt.php

5
37
0
5
0
5
0
5
0
5
0

when not in debug mode ?

luqasz

many users write some scripts (many of them are not version compatibile) to backup and export configuration maybe some feature like /tool backup to write backup and rsc file and send it via ftp, tftp, scp to a remote host. verry important feature would be to write files to memory and not internal st...

luqasz

Hi, Please add feature that will allow me to add DNS name instead of exact IP address. I need this to connect 2 or more MKT routers (PPTP connection) if they are connected to internet thru ADSL and theirs IP addresses are dynamic. I hope that you understand what I am saying and that we can expect t...

luqasz

ok but can i edit backup.xml somehow to import those mikrotiks ?

luqasz

ok program is ok. i have tried exporting configuration and modyfying <Device> and <NetworkMapElement>. no success. i have 500 mikrotiks to add into dude and ther is no way i can do it automaticly. i have added 400 device sections and changed <sys-id> that matches <item-id> in <NetworkMapElement> no ...

luqasz

thx for reply. i will take a look into dude. i wonder how i will import 500 routerboards into dude. if only by hand then it is waste of time

do i need to install dude package into mikrotiks befor upgrading ?

luqasz

hi

i have various versions of routeros on routerboards (different kinds of and i have about 500 of them active in network). is it possible to upgrade them all to 4.11 ? versions vary from 2.9 to 4.2

luqasz

Hi I was glad to use 2.9.27 os version becouse it was stable and i knew what to expect after executing some commands. It is stable and nstreme-dual works great on it. In 3.x os version i can't expect that and be sure about stability and performance of ndtreme-dual. In fact nstreme-dual works horribl...

luqasz

hi i want to learn mirotik router os, but i can not understand several modes in wlan networking. what is, what for and how to use: station, station wds, wds-slave, ap-bridge and bridge considder this situation: i want one mt to work as an transparent bridge and other one to get ip address fron dhcp ...

Search found 101 matches