MikroTik

rjow2021

Just to be sure I understand. Your router has a non--public IP address. The wan is either like CGNAT or a private IP from an upstream ISP router (which you cannot forward a port on). WAN is on a public IP address Sir (83.##,##,##) no CGNAT, and port forwarding all working fine. What you want to do ...

rjow2021

The only thing I see is an address list "back-to-home-lan-restricted-peers" that could indicate...something. And that list isn't used. Is the export complete? Or did you perhaps redact it? Ran the command... /export file="" for the config and omitted sensitive stuff and the DHCP...

rjow2021

By far the easiest (and in my opinion best) way is to add: /interface list member add interface=back-to-home-vpn list=LAN This way, all wireguard connections are handled as being part of the trusted LAN list. This already exists, although not shown in the config above. Created Dynamically. Just uns...

rjow2021

The only access I have while connected to BTH is to the router. I have no access to any other LAN device. "allow LAN" = yes # 2024-04-11 21:37:04 by RouterOS 7.14.1 # software id = SKU-FU # # model = RB4011iGS+ # serial number = D4NKSERIAL4U /interface bridge add admin-mac=b0:l0:c5:55:77:d...

rjow2021

Although the suggestion worked, a few days later I had issues with wireless devices not able to access the DHCP server. And access to the Emby server was slow from my phone. Can you explain the netmask command in the code... /ip dhcp-server network add address=192.168.50.10/32 dns-server=8.8.4.4 net...

rjow2021

Thanks for your help

rjow2021

That is a much neater way that I will use.

Just one thing, which may not be necessary. Can I use 2 DNS servers? I.E.

/ip dhcp-server network
add address=192.168.50.10/32 dns-server='8.8.4.4,8.8.8.8' netmask=24 <other options>

rjow2021

I run an AdGuard server where some IP DNS are routed to. But I wanted to know if there is a slicker way of doing this? At the moment I set devices with static IP's then in the DNS options, available when you set devices with a static IP, I set the IP for the AdGuard server. Below is the current conf...

rjow2021

Your firewall doesn't block forwarding from WG to internet. But if you configured WG client to use your router as DNS server, that currently wouldn't work, because firewall blocks that. Simple solution, if you trust all WG clients, is to add wireguard1 to LAN interface list. Yep, you figured out th...

rjow2021

I have the current config... # jan/28/2022 13:59:09 by RouterOS 7.1.1 # software id = FW5U-5K9I # # model = RB4011iGS+ # serial number = ***************** /interface bridge add admin-mac=*********** auto-mac=no comment=defconf name=bridge /interface wireguard add listen-port=13231 mtu=1420 name=wire...

rjow2021

Is it possible to have ROS automatically kill WireGuard sessions when clients rejoin the LAN?

rjow2021

I run AdGuard Home on a Windows 10 box, but there is a docker image available.

How would an RB4011 fair with AdGuard Home docker installed, in docker, with OISD (8.7MB) block list?

Would this be possible?

rjow2021

Thank you very much for the explanation. It actually helped me understand and fix the issue.

And now I have it working, it is actually very easy to set up.

rjow2021

Is this strictly for iOS?

I tried replicating the settings. My android phone looks like it connects, but I have no WAN/LAN.

Also, I'm trying to understand the need for the different IPs in this set up.

rjow2021

It's definitely something I'm doing wrong.

My phone is auth'd with an IP, as is the router (RB4011), in the ZeroTier interface.

zerotier interface print

shows it's set up.

But I cannot get access to LAN from WAN.

Is there firewall rules I need to apply?

rjow2021

Like this feature a lot!

I have the RB4011 non wireless on version v6.48.4. Apart from backing up the current config, is there anything else I need to do before going to 7.1rc2?

rjow2021

Thanks for your help. I added this... /ip firewall address-list add address=216.218.206.0/24 list=Blacklist add address=45.33.36.126 list=Blacklist And this... /ip firewall raw add action=drop chain=prerouting comment="drop all in Blacklist!" log=yes \ log-prefix=BLACKLISTED! src-address-l...

rjow2021

I have a failed IPSec connection in the log every morning... respond new phase 1 (Identity Protection): WAN IP[500]<=>216.218.206.106[58955] 216.218.206.106 failed to get valid proposal 216.218.206.106 failed to pre-process ph1 packet (side: 1,status 1). 216.218.206.106 phase1 negotiation failed. Th...

rjow2021

In the web interface, or WinBox, open the New Terminal and type...

/export hide-sensitive file=anynameyoulike

Then insert the output here.

rjow2021

Ah yes, I changed this to a more secure passphrase when entering the command in the terminal for Home client 1. Is it necessary to be secure? Or can I just use what you have used as a passphrase? EDIT: Doesn't matter, it excepted the cert. Turns out android or windows doesn't like complex passwords ...

rjow2021

When importing the cert. into the android device, it's asking for a password? Step 3. What password is it that I need to enter? Also tried on Windows 10 machine, Error "This file is invalid for use as the following: Personal Information Exchange" Tried installing as "Local machine&quo...

rjow2021

Reset the switch and start again. Before you connect it to a network... On a laptop/PC, that you connect to the switch to set it up, manually set its IP to 192.168.88.2. Log into the switch by browsing to 192.168.88.1 on the same machine. Set the switch to DHCP auto. Plug the switch into your networ...

rjow2021

So, /interface bridge vlan add bridge=bridge tagged=bridge vlan-ids=10 add bridge=bridge tagged=bridge vlan-ids=20 add bridge=bridge tagged=bridge vlan-ids=30 I have also disabled Internet detect. And now turned on vlan filtering on both RB4011 and CRS328 add admin-mac=08:00:00:C0:00:00 auto-mac=no ...

rjow2021

Difficult to say what the problem is without the 4011 configuration. Good morning, I have edited the 2nd post which now shows the complete config file for both. Last night I seemed to have broken the VLAN, and devices plugged into any of the VLAN ports was issued a completely random IP. In the mean...

rjow2021

If the trunk port on the 4011 is a member of a bridge then /interface vlan items should refer to the bridge, not the individual port, with a similar VLAN-aware bridge setup as on the CRS. A bridge has two roles - its is both like a switch connecting various ethernet ports together, and also like an...

rjow2021

CRS devices are intended to be L2 switches with some L3 functionality, but NOT wire-speed L3 routing/firewalling as they are performance-limited by the CPU (RouterOS v7, currently in beta, will provide L3 hardware offloading on some CRS3xx devices). So it is best to use the CRS just for switching V...

rjow2021

CRS328... # apr/02/2021 10:02:06 by RouterOS 6.48.1 # software id = # # model = CRS328-24P-4S+ # serial number = D************* /interface bridge add admin-mac=00:00:00:00:00:00 auto-mac=no comment=defconf name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=sfp-sfpplus1 ] adv...

rjow2021

I've been battling with VLANs with the CRS328 for most of the week and figured I'd post what I have done so far for feedback. Just cannot get it to work. And at the same time I'm trying to understand why I need to configure the RB4011 and the CRS for VLANs. I thought I could do it all on the CRS328....

rjow2021

(1) Should be removed. add action=drop chain=forward comment="Block IPs to WAN" log=yes log-prefix=\ "IP blocked from WAN" src-address-list="Block IP" (2) This may not be necessary or more likely wrong, not sure why you are routing on the LAN???? ip route rule add acti...

rjow2021

I feel there's a few things that can be removed, but that's the next bit I'm working on. I don't use CAPsMAN, and don't have any VLANS.

rjow2021

post config /export hide-sensitive file=anynameyouwish # mar/29/2021 12:48:07 by RouterOS 6.48.1 # software id = FW5U-5K9I # # model = RB4011iGS+ # serial number = *************** /interface bridge add admin-mac=48:8F:5A:C2:F6:90 auto-mac=no comment=defconf name=bridge /interface ethernet set [ fin...

rjow2021

WAN connected via "ether6" with the settings above. "ether1" connected to CRS328 for PoE only, and is working. I disabled "ether1" in the RB4011 to stop any traffic flow, PoE still works. SFP+ link to CRS328. CRS328 confirms ~190mA @ ~52V on "ether1" to the RB...

rjow2021

QuickSet is, in my opinion, great for new MikroTik users to configure a basic configuration. After that, don't use it anymore at all. Excellent, so I will ignore the "Quickset options" now. In addition to your adjustments, in the IP > Firewall > NAT tab you have to change your masquerade ...

rjow2021

Dont use quickset, use winbox to configure MT device

Yep, I use WinBox every time.

Just wanted to see if Quick set is irrelevant when setting a different WAN port. Because it doesn't show "ether6" as an option.

rjow2021

This is so I can power the RB4011 from the CRS328 switch using "ether1". I have removed "ether6" from the bridge. I have added "ether6" to the "Interface list" as WAN. Added "ether6" to the "DHCP client" list. But on the "Quick set&quo...

rjow2021

/ip firewall nat add action=dst-nat chain=dstnat comment="plex forwarding" dst-port=public port set in Plex in-interface=ether1 log=yes protocol=tcp to addresses=192.168.1.2 to-ports=32400 add action=dst-nat chain=dstnat comment="channels forwarding" dst-port=80 in-interface=ethe...

rjow2021

Excellent. I could remove the automatic log for this rule so it doesn't get logged.

Glad its doing what it should.

Thanks you for your help.

rjow2021

I'm having a lot of these show up in the log. It's a drop rule. As you can see its a default config as I learn more and maybe streamline the firewall. The MAC in the log is showing as Cicso in MAC lookup. Just would like to know that the rules below are sufficient for a rookie starting out. /ip fire...

rjow2021

Just stumbled on this. Had similar issue trying to power the OC200 controller for TP-Link. Now I know why it didn't work.

I have a 54V 2A PSU that I will test with my RB4011 and see if I'm able to power the OC200 from Ether10.

rjow2021

This is something I'm tying to figure out too. I cannot seem to set a "hostname" to a client. Something I was able to do in other routers.

rjow2021

Just want to make sure that I can connect these together, SFP+ to SFP?

And if so the correct modules to use?

Side note: Could I use the same modules with the 328-24P-4S+RM?

Many thanks.

rjow2021

Thanks for the reply.

I'll keep the RB4011, it is a great piece of kit, and grab a smaller MikroTik PoE switch.

rjow2021

I have the RB4011 and require a PoE switch.

The MikroTik 328-24P-4S+RM is advertised as a router/switch. So could I replace the RB4011 with the 328 for routing and switching? WAN will be gigabit.

rjow2021

I have two cAP's. When I compare both in Interface <wlan2>, the details at the bottom of the window are different. One cAP shows "enabled" , "running" , "slave" , "running ap" The other cAP shows "enabled" , "" , "slave" , "r...

rjow2021

This should also appear in the log, that radar was detected

Ah yes, and there was an entry yesterday "wlan2: radar detected on 5260000". And I was mistaken. DFS in the UK is 5260 - 5825.

Now I need to figure out how to stop the cAP selecting busy channels when it decides to switch.

rjow2021

Yes, if you are in a country with DFS requirement, if the device detects a radar (meteorological, military), operating at your chosen frequency, it will ignore your setting and choose the first frequency in the scan list you have defined (in your case it is probably the default). Yes, in the UK DFS...

rjow2021

I had high latency and jitter will on the cAP downstairs. Quickly realised that it changed its 5Ghz Fq from 5250 down to the very low end of the 5Ghz area, where everyone else is.

The setting is manual, not auto. Is there anything else that would've forced the cAP to go low on the 5Ghz band?

rjow2021

I have the RB4011 with 2 cAP-AC access points and currently have them set up manually without CAPsMAN,

What would be the advantage/disadvantage of running them under CAPsMAN?

rjow2021

I have the cAP AC set up in HomeAP Dual and it's working great. Is there a way to have the cAP assign IPs from the RB4011? I would like its wireless features but at the moment its handing out IPs from a the pool set in the cAP instead of the RB4011. The cAP itself is assigned an IP from the RB4011. ...

rjow2021

Ah I see. I did consult a similar table when setting up. I seem to have got the 5Ghz going on band 100, can't remember what Fq that was in the settings but it seems to be working now. I now have to figure out the correct settings for the AP in Home Dual AP mode, with the RB4011 routing and firewalli...

rjow2021

I picked up the cAP AC and I'm trying to get the 5ghz radio working. But it seems the only channels I can use are a few low down in the 5ghz spectrum. Any time I select a frequency that my Asus routers work on, I get the message "radar detected" and the radio goes inactive. I've correctly ...

rjow2021

Probably RSTP is enabled on the bridge, and as a result hw-offloading is disabled.

I'll look into this, because although iperf stats are what they should be, the file transfers are slow.

rjow2021

I would start by testing network speed with iPerf.

Mmmm, just checked with iperf. Speeds are great, 922 Mbits/sec. How foolish of me to blame the RB4011.

rjow2021

I had my PC and server connected to a simple non managed switch before. When moving files I would get 115MB/s. I have ditched the switch and wired both to my new RB4011 and struggle to get 50MB/s when transferring files. Its running on default config with a few additions for port forwarding. Any hel...

rjow2021

I've had the privilege of naming hosts that don't broadcast their host names on the network. But I cannot see how to do it on a MikroTik.
So, I wanted to know what others do in this situation. Do you name the host? if so, how?
Or do you just ignore this missing value in the Leases list?

rjow2021

It's my 3rd week with the RB4011 and having demoted the AX88U to AP duties, the RB4011 is doing great. Although im using the default config for firewall rules I would like to better understand the hierarchy of the rules and what the settings mean. Some are pretty obvious but I want to further unders...

rjow2021

Make dhcp entries static then assign dhcp option 6; they will override dhcp network setting.

Absolutely amazing, thanks.

Who would have thought you could do this on a router! Two weeks into the MikroTik world and it's looking great.

rjow2021

Easier to assign users to vlans based on their DNS preference LOL. Ah yes, I will have careful play with VLANs. Although I'm looking at the IP > DHCP server > Networks, where I set my DNS; not IP > DNS, and I figure I could create a DHCP server pool here just for those that want to resolve via PiHo...

rjow2021

I have a PiHole on the network. I would like to know the best way to have clients on the PiHole DNS or not. So, if clients want to be on the PiHole DNS, add them to a list for PiHole DNS, otherwise 1.1.1.1 or 1.0.0.1. I could just statically set it on the each device. But wanted to see other suggest...

Search found 59 matches