MikroTik

gabacho4

That's the kind of stand up behavior from Mikrotik that I've come to greatly appreciate. Joegoldman - if you wanted to hook me up with a CHR license (should you ask for a few) I wouldn't complain. Would be fun to play with a (licensed) CHR instance. Regardless, glad we could get to the bottom of the...

gabacho4

Using a bit of Google Lens, I was able to find joegoldman's original post. Normis, you guys were indeed lied to in a big way. https://forum.mikrotik.com/viewtopic.php?t=133271&start=50 Also picture from bottom left was stolen from a web article dated Nov 2022 featuring a setup in Wales: https://...

gabacho4

If it's that big a deal, start watermarking your photos. Easy fix.

gabacho4

somehow sad and pathetic this has to be told to people (or even those who refer to themselfes as network engineers)

+1,000,000,000,0000

gabacho4

Thread on the same issue

viewtopic.php?p=1016583&hilit=bad+blocks#p1016583

gabacho4

Honestly, it's not even worth the effort. It has no impact on router performance and is not indicative of any issue at all.

gabacho4

It's not a problem at all. Seems like netinstall makes it go away in my experience but it isn't a problem regardless.

gabacho4

"Noticed that on all of them I needed to reboot a second time to upgrade the routerboard firmware despite having "/system routerboard settings set auto-upgrade=yes" configured." This has always been required. All the auto-upgrade does is save you the effort of having to go in and...

gabacho4

amm0 OP is in Germany not Canada. The Canada angle was introduced by another user.

gabacho4

What sockets are you talking about? Can you provide a picture? I personally spent a bit of time doing some tests to determine which bands where fastest in a CA configuration. For me (in Kuwait using Zain) it was band 1 and 20 or 3 and 20 depending on the time of day. So I only enabled those three ba...

gabacho4

Glad I could help. As long as your EP06 is the A variant and not the E you should enjoy a much better experience. I used my LtAP in Kuwait with an EP06E and was getting 150 Mbps download easily. Yes, I know, the default modem should have worked. It did, but I heard the Quectels were a little more pe...

gabacho4

According to Mikrotik's product page for the LtAP LTE6, it can used the following: 2G bands 2 (1900MHz) / 3 (1800MHz) / 5 (850MHz) / 8 (900MHz) 3G Category R7 (21Mbps Downlinks, 5.76Mbps Uplink) / R8 (42.2Mbps Downlink, 5.76Mbps Uplink) 3G bands 1 (2100MHz) / 2 (1900MHz) / 5 (850MHz) / 8 (900MHz) LT...

gabacho4

@ctop what bands are used in Canada? The LtAP LTE6 sold by Mikrotik comes with a modem that is tuned for European bands. If Canada uses European bands then you definitely have something worth looking into. I would think Canada however would utilize bands like those used in the USA. Therefore, the Lt...

gabacho4

@mkx fair enough then. OP should disable the GSM option and then test the 3G by itself to see what speeds he gets. If they are decent he could leave the 3G and LTE enabled. If 3G is crap, then disable it and stick with LTE only. Unfortunately this is how it works with Mikrotik gear. You have to dial...

gabacho4

Some research has confirmed. Per this https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.ackermansecurity.com/blog/home-security-tips/3g-4g-5g%23:~:text%3DAccording%2520to%2520digital%2520trends%252C%25203G,say%252C%2520in%2520a%2520moving%2520vehicle.&...

gabacho4

From my experience it seemed to connect to whatever has the strongest signal. The modem doesn't care about your connection speed, it just wants a solid signal. If you're moving in and out of coverage areas, then go with what works best but just prepared for your connection speed to be potentially sl...

gabacho4

Uncheck the gsm and 3g boxes. You do not want the LtAP LTE6 to use those as they are much slower than LTE.

gabacho4

Strongly suspect you've left your router DNS open to the world due to bad or no firewall rules. Can you please post your config?

Edit: your whole config

gabacho4

Most companies these days are using CGNAT however many will give you a static public IPv4 for a generally nominal monthly fee. Well worth it. The other thing to check is if you have IPv6 as that should be publicly routable. Takes a while to wrap the mind around IPv6 if you're not used to it.

gabacho4

Create a new routing table in Routing -> Tables. Then create a routing rule at Routing -> Rules and specify the IP you want and select the desired table and lookup only in table. Lastly make sure your firewall rules don't interfere. I assume you need to have a NAT rule as well for that gateway.

gabacho4

You aren't running the test with one of the routers as the client or serving endpoint are you? Routers are not meant for that type of activity and will always perform less than amazing. You have to use non-router client/server at both ends to test this.

gabacho4

I do not think that you will be able to achieve 500Mb with any MT router. I am maxed out on two 1gig connections with the same provider a few miles apart and the best we can achieve is around 300 or so What router model are you using? I've seen other posts from people claiming well above that. Beli...

gabacho4

Just to close the loop on this. I did a bit more exploring and discovered that someone had previously joined two Cat5e cables with a female to female keystone jack. This cable run is the one that feeds my CCR2004 WAN. I went ahead and turned a trusty Hex into a switch, removed the keystone, and plug...

gabacho4

I appreciate the response and the script. I can certainly try it. However, as I point out in my OP, there are instances of this happening multiple times in succession just a few minutes after a new lease is acquired. Why would my router be reaching out to the DHCP server a mere number of minutes aft...

gabacho4

Device is given the same IP again though and has had the same one for days now. My understanding of DHCP is that the device should request an IP in advance of the lease expiration at which point it will be either reassigned the old one or given a new one. With the current situation, my device is los...

gabacho4

Hello all, For my home network I have Verizon FiOS which I have directly connected to my CCR2004. No Verizon router required or utilized. Everything works outstanding as far as my IPV4 and IPv6 connectivity is concerned. However, I am seeing a large number of dhcp client "lease stopped locally&...

gabacho4

Put the passwords in a text file and then encrypt it. That way you don't have to remember more than one password and your devices should be safe from others. There are password managers that do the same thing but I don't like to give things like passwords to other companies who themselves then get h...

gabacho4

/system routerboard settings set auto-upgrade=yes I prefer to decide when to upgrade and where to. This doesn't update the packages, it just updates the routerboard firmware at the same time I update the packages manually. Device reboots twice and I'm done versus having to update the packages, rebo...

gabacho4

Don't use auto.
Set frequency yourself to a non used channel.

Probably that's why your laptop can't see it.

Just to follow up, manually setting the freq absolutely solved my issue with the lappy. Running strong and fast now.

gabacho4

Why not wait for capAXE and wifiwave3
Or
capAX7 and wifiwave4? :-0

With any luck, Zerotier for non-ARM devices will come first!

But seriously, tell me more about my config. If it's great I'll port it over to capXXX or wifiwaveX.

gabacho4

Ok, I'll tackle the freq next. Does the rest of the config look alright? If I got it 99.9% right the first time, I'd probably drop dead.

gabacho4

Hello all, I decided to grab a Mikrotik CapAX in order to get some experience configuring their APs, all well as to see how the 'Tik wifi really performs. I've seem plenty of people declare that it is less than amazing, while others say that it works just fine for them. It was a little weird to put ...

gabacho4

Read the subject and the first couple sentences and immediately got bored. Best of luck network guru.

gabacho4

Ride the lightning!!

gabacho4

Perhaps it was that you spammed the forums with like 6 separate SPOILER posts in short succession rather than put them all in one post?

Ironic that one of those who takes a heavier handed approach with other forum users now complains when heavy handed approaches are taken with him...

gabacho4

IN indicates that it's a desktop useable device versus a rack mount (RM) one.

OUT means that it is a device designed to be used outdoors.

gabacho4

You cannot have multiple peers and use an allowed IP of 0.0.0.0/0 on the router. This is why the first connected client works but the others don't. The router is being told to send ALL traffic to the peer (the first connected) and so it all goes to peer1 and to no one else. Instead you need to set t...

gabacho4

Awesome! Now I can finally upgrade my CSS610-8P from the SwOS 17rc1 I was running for the past 1.5 years! So glad to see SwOS isn't dead. It really is great for normal L2 implementations where ROS is complete overkill. Keep it coming Mikrotik!

gabacho4

In this thread a call for mod volunteers was made. Related to that very action are the responses of those of us that are trying to ensure that Mikrotik wisely chooses mods who don't abuse us in the course of posting to the forum. This is no unrelated. It's entirely on topic. Already demonstrated is ...

gabacho4

@mrz and Mikrotik staff - you all really have to start to have a more active role in ending the overzealous mod issue. This is your brand name and reputation. It's a Mikrotik owned forum. There are people literally abandoning the forum and your products because of the toxic experience they are subje...

gabacho4

This is the kind of arbitrary and unacceptable Mod crap I am referring to (pulled from a random post): Last edited by AnalForumMod on Thu May, 2023, edited 1 time in total. Reason: removed excessive quotting of preceding post; be wise, quote smart. lines of quote, 1 line of post. In other words, I t...

gabacho4

This is spam, detected from my SpamGPT https://forum.mikrotik.com/viewtopic.php?p=968765#p968765 No one is arguing that legitimate spam or inappropriate posts shouldn't be removed. I'm all for it. I'm referring to the many edited by AnalForumMod with a Reason stating not to use quotes or whatever t...

gabacho4

BartosP, that post is not spam. It is not unrelated to Mikrotik or promoting another product or fake service. Why would it be deleted? It is someone expressing their frustration with the seemingly arbitrary way things are moderated on this forum. A sentiment echoed by a number of us. Just because pe...

gabacho4

I think all reasonable users can agree that spam is things like a post for p3nis enlargement or something else obnoxious and unrelated to the purpose of the form. Spam is not generally considered to be a user using a legitimate feature of the forum to quote or otherwise refer to another user's post....

gabacho4

Well said... Which is exactly why I don't pretend to tell others how they should post so long as they aren't posting spam, inappropriate material, or otherwise abusing the forums.

gabacho4

Some tend to overuse the freedom of speech which is given to them arquing that "what is not forbidden is allowed". And others tend to abuse their moderator powers to impose their will that "what is not forbidden, should be." I believe Normis has weighed in a couple of times on t...

gabacho4

Can someone just kill this topic.....

You said what I've been thinking painfully inside for days.

gabacho4

hide-sensitive is a working export command for me on 7.9.2 and 7.10rc5. Is it just not needed anymore?

gabacho4

Post your router configuration. Your ENTIRE router config!

In terminal: /export hide-sensitive file=AnyNameYouWish. Then view in a text editor, copy and paste for others to review.

gabacho4

Glad to be of help. Sometimes we all need a little nudge in the right direction. I've had many a "lightbulb" moment in the course of my networking adventure.

gabacho4

Just use the ddns host as the IP address. You can use a fqdn. So, client.dn.mynetname.net will work just fine. Set a keep alive for like 30 seconds. Easy peasy. The ddns will perform a check every 30 minutes unlesd you changed the setting. I'd probably recommend like 5 to 10 minutes instead. Only wa...

gabacho4

Signs point to yes

My favorite is "Concentrate and ask again"

gabacho4

There

gabacho4

You're kidding right? Did you even look at the forum posts or conduct a search? Glad you don't secure my networks.

gabacho4

I was expecting nothing more than the fix for the CVE. Holy crap! And finally all the BFD and BGP complaints will stop!!!!!

gabacho4

Appreciate Normis's candor on this matter and definitely look forward to the update addressing it. As I said before, I'm a huge fan of Mikrotik devices and want to be able to keep singing their praise to friends and coworkers. Seems there is more to the story than reported initially. I'm more than w...

gabacho4

Don't forget how the vendor then asked for the vulnerability info to be resent. So the intial notification was either not truly received or someone at Mikrotik missed it, saw it and forgot, or they just hit delete. I really like Mikrotik but this chain of events concerns me. And while a fix has been...

gabacho4

It barely fits in the bolts of the mikrotik rack. I had to use force in order to bolt it down. The adaptors would need to be 2-3 mm longer. I've no idea what you're talking about. I have the Mikrotik rack and had no problem whatsoever. This sounds like yet another instance of someone claiming the M...

gabacho4

I can confirn it's sturdy. I wouldn't go out of my way to stress it but it's not going to break with expected wear and tear. The metal is not flimsy. Two of them makes it much more solid but one works well enough. Otherwise I guess you could design your own and 3d print them maybe.

gabacho4

I've just had a similar issue with my CSS610-8G-2S+ except I maybe discovered the cause ?? When setting up the switch, I had the device powered on and upon inserting the 10G SFP+ transceiver, the switch restarted. Seemed almost like a short or something. Switch rebooted and everything appeared to be...

gabacho4

Some people have jobs requiring them to download and upload large files or graphics/photographs. Aside from that, I myself wonder the same. I think it's an issue of the way these things are marketed to the masses who are told that more bandwidth means better internet speed. Nevermind the fact that m...

gabacho4

@normis

That is amazing to hear on both counts. Cannot wait for the new mDNS feature and more stable DNS function. The users whined and Mikrotik listened. Keep it up!

gabacho4

Does your provider use IPv6 by chance? That would most likely get you globally routable IPs if getting out from behind NAT is a requirement.

gabacho4

Just create a vlan and corresponding SSID for wifi that only kid devices connect to. Then create a rule that disables the vlan access to WAN at a given hour. This way, it doesn't matter if your kid statically sets his IP or not as the kids vlan access to WAN will go dark. Of course, were it one of m...

gabacho4

There is not.

gabacho4

Mikrotik devices don't force you to use any single port for WAN or LAN or APs etc. You can absolutely use ether1 for WAN and the other ports for anything you wish. For POE you just have to be sure you're not drawing more power than the device can provide. That would be the only limitation I can thin...

gabacho4

Any of the Ethernet ports will work as all are capable of providing power. SFP+ do not provide power nor will they ever as fiber is not a conductor.

gabacho4

I feel it is useless... Like so many of your posts. No wonder your mod powers were revoked. You've contributed nothing to this thread today other than to attack someone. Now I've contributed negatively as well but after watching your interactions with forum users over the past year or so I finally ...

gabacho4

Just to make sure that I've understood this thread correctly - I have two RB5009s with VLANs in VRRP configuration. I've enabled pre-emptive mode for all the VRRP interfaces, set one of the VLAN VRRPs as the Group Master, and then enabled Sync.Connection Tracking on the Group Master interface on bot...

gabacho4

Curiously my RB5009UG only shows CPU temperature for system health. No PoE in voltage, no 2 pin voltage, no jack voltage, no board temperature...that's weird to me given that they are the same hardware minus PoE out.

gabacho4

So you all have piqued my interest as I had not previously seen a reason to try something aside from ipsec or wireguard for my remote network access and streaming needs. I am trying to wrap my head around the zerotier concept as it differs a bit from a traditional vpn solution. Just to be certain, I...

gabacho4

I was wondering when that plug would be dropped. Was beginning to think you'd acquired an arm model

gabacho4

I'll trade your 40 ms latency for my mid 2xx ms latency. The big hop across the great waters hurts AND my internet is serviced with an LTaP LTE6 using the local cell provider. Get 100+ Mbps down / 50 Mbps up. Service works well enough but the latency sucks. I'm rocking at CCR2004 PC version at the r...

gabacho4

Damnit llama stop rejiggering your posts! 😀 Yes third party providers and data centers (alas I used to use linode for this) all have know IP blocks and so the streaming providers just blacklisted them. It was (maybe is) a game of wackamole trying to use a server that hadn't been blocked yet. For a h...

gabacho4

From henceforth, we're all to be known as Team Alpha Super Awesome Cool Dynamite Wolf Squadron.

Hellz yeah!

gabacho4

Amazon prime video, Disney+ (I gotta have my princess movies), Netflix, few other streaming services that verify US presence.

gabacho4

I can't speak for zero tier but I do this quite successfully via standard Wireguard VPN and policy based routing (routing/rules) after creating the requisite table and address list/firewall rules. Works on my laptop in a traditional client to server setup as well as over specific home network device...

gabacho4

It is legit. Both of mine and many others had some sort of oil on the heatsink. Just part of the manufacturing process from all I've seen and heard. As for the firmware, this is normal too. The lower one is what comes installed by default and 7.6 was the latest stable at the time your router was pro...

gabacho4

I can kindly ask why?

He was told that he'd get all the girls like Anav if he signed up on the forum...then he learned the propaganda about Anav is all a lie.

gabacho4

If I had to guess it's the L3 offloading. I remember a similar warning being given previously. It's probably not stable on the CRS3xx or something like that right now.

gabacho4

Anav - how do you feel about moving to Latvia? I think you have a bright future in Mikrotik marketing.

gabacho4

That's like networking 101. You're using a Mikrotik device and doing more advanced configurations and we were supposed to remind you to change your DNS to the pihole DNS server on a downstream device? Anyway...

gabacho4

Reinis - getting a stable SWoS lite version instead of 17rc1 would be cool. A worried that the slow pace of development and lack of stable version means SWoS is dead.

gabacho4

You seem to forget that none of us are paid support and have jobs/life/other interests. That said, if you can't use your SPF port you have a configuration issue. I'm sure you can figure that out by yourself as well.

gabacho4

+1 for AES GCM 128 256 512 in phase 1 of IKE2

AND

VTI

gabacho4

This really is great! Thanks a million for your efforts and help!

gabacho4

You'd need to know the IMEI of the deceased device and then follow that link I posted. There are AT commands to be run.

gabacho4

This looks promising https://www.reddit.com/r/mikrotik/comments/soa182/r11elte6_custom_identity/?utm_source=share&utm_medium=android_app&utm_name=androidcss&utm_term=1&utm_content=share_button Would seem you can take the IMEI of a device known to work and clone it. Probably not a goo...

gabacho4

You forgot to provide the output of system/disks/print.

Currently your container is set to use the router's nand memory. Not USB.

gabacho4

But will you pass me my slippers?

. Seriously, I misread leanfr91's message and thought he had altered the script some. After rereading I see that is not the case. Thanks for the script and the learning tool. We can work on the bed assistance later.

gabacho4

Need to see output of system/disks/print.

Also need to see your container settings in their entirety. Don't have access to my 5009 but believe /container/print might work.

gabacho4

Care to provide the full working script by chance? I'd enjoy the chance to work through it step by step as I learn scripting.

gabacho4

(useless comment) If someone with a big PPPoE server has upgraded, I really want to see if it has issues,

Popping some popcorn for the big show. Extra butter!

gabacho4

Regardless of cause, the iOS functionality is limited compared to Android's. I tried the iPhone out and got tired of such limitations across a number of capabilities and tools that just work on Android. So back to Android it is for me.

gabacho4

On Android, the Mikrotik app has the ability to launch a terminal/CLI for config or other purposes. On iPhone that feature does not exist because Apple decided it allowed too much system access or something. Apple restricts access to a number of data sources or features that Android does just fine. ...

gabacho4

Works just fine for me on my Pixel 7 Pro. No functionality issues at all and I can actually launch a tik terminal unlike anav and his precious iPhan.

gabacho4

You're gonna wanna see viewtopic.php?t=188407#p962169 and look for the link to SWoS lite 17.1rc1.

gabacho4

It exists in the android version. Believe iOS security features do not permit it and so there is no terminal on iPhone.

gabacho4

I have not been able to save a backup of my CCR2004 config to the cloud for a number of days now. Every time I try I get: Server error: backend error. Is anyone else having this issue?

gabacho4

As @anav already said I use route rules for policy based routing for subnets or individual devices through different routing tablea as I find them much cleaner than mangling and they allow me to continue to use fastrack.

gabacho4

Interesting.... I've got no other suggestions unfortunately. I have the same switch and it works just fine with POE+ and ubiquiti APs. I know I've seen people say that mikrotik doesn't necessarily adhere to the same standards/protocols as other manufacturers. Wonder if this is one of those cases? Or...

gabacho4

Have you tried setting the POE to on instead of auto? My guess is that AP requires passive POE not POE+.

gabacho4

Weakest MT newsletter I have ever seen. Shame on you guys, looks like you have notbing to say. No new device, no ROS features announcements, nothing! Are you still alive there? 😳 P.S. Please ensure us you won't stop your dyndns for upcoming holidays as you once did before! Holy @#$& you must no...

gabacho4

My CSS610-8P has been this way since day 1. My CRS 328 running SwOS successfully checks and says it’s up to date. MikroTik seemingly hasn’t completely implemented whatever setup in the backend is needed for the css610-8p. To blow your mind even more, search the forums for SwOS 17rc1 for the css610-8...

gabacho4

I run mine as a container and use cloudflare’s family protection dns servers. Great for allowing to see what my more chatty/tracking filled devices are as well as identify any errant activity by kids online.

gabacho4

I used to use pihole but discovered adguardhome and haven’t looked back. It’s much smaller than pihole and works outstandingly on my RB5009. Highly recommend.

gabacho4

Glad I could help answer question #1.

As for #2 I don’t have an answer why the voltage display isn’t there (perhaps not supported by CPU) but I can say that you’re not unique. I don’t see it on my 5009 either.

gabacho4

Hate to ask but what is the exact model number of your 5009?

gabacho4

Just as a data point, I’m currently running an ipsec (IKEv2) connection with one endpoint behind NAT with no problem. As mentioned UDP port 4500 is used. I’ve tested IPSec with both endpoints behind NAT in my lab environment and have had no issues. Unless you deliberately disable NAT-T it works.

gabacho4

What device are you using? AES256GCM is supported on a number of models. My RB5009UG for example.

Also SHA384 is supported too. I’m using ROS7.7beta8 for what it’s worth

gabacho4

Give that license level 6 gets you unlimited everything just about I would think it’s safe to assume unlimited. Frankly I don’t think there is a limit at any license level. The only limit I could foresee is the one imposed by the specs of your hardware.

gabacho4

Don't believe it will run on your other device. There is very specific SWOS versions for each of the CSS610 devices. What I would REALLY like to see however is a final version for the CSS610-8P rather than a beta version. I'm still a bit salty that I bought a device that was non-functional right out...

gabacho4

I could have sworn I saw a post earlier this week from someone at MikroTik saying that they generally recommended keeping the hex and similar devices on ROS 6, i believe due to storage limitations or something. Perhaps this is yet another reason? Seems the downgrade to 6 clearly fixed things for OP.

gabacho4

It appears that way. I’d assumed it was based on a hardware check as well or something like that. Will admit I know nothing about the subject but it is disappointing to know that one can be using a supported encryption scheme and yet have no way to determine that other than watching the cpu use perh...

gabacho4

Well, for anyone else wondering, here is the answer I received from Mikrotik. Emīls Z. Hello, After double checking, the RB5009 has already AES-GCM hardware acceleration support. Currently it is not indicated with the "H" flag next to the IPsec-SA entries. We will try to resolve the issue ...

gabacho4

Just noticed that the table for hardware acceleration now shows that the CPU used by the RB5009 (88F7040) supports AES-GCM for IPSEC acceleration. Very happy to see it as AES-GCM is more performant than AES-CBC etc. So I quickly changed my existing setup to use GCM but notice that the installed SA's...

gabacho4

@anav that’s a great question. Not something I’ve ever tried myself as my device has the usb port. In principle I would think the SD card would work but there could be some sort of limitation that I don’t know of. If you insert a card and the go to System -> disk does the SD show up ? If so, how?

gabacho4

@Znevna I have a 512 gig SSD I was going to play with but thought it was overkill for my immediate needs. Have confirmed that the 5009 recognizes it and all. @anav the thumb drive, or SSD, is so that you are not increasing the writes to the internal memory of the device which will shorten its lifesp...

gabacho4

Can confirm that the feature works wonderfully on an RB5009 ROS 7.6 with container package and a 32 gig USB thumb drive. Couldn’t be happier.

gabacho4

In a nut shell, the input chain is dangerous if you misconfigure it. Input is access to the router itself. So don’t create allow rules in the input chain unless you absolutely understand what you’re doing and if doing so is necessary. Most importantly, never create an input rule that allows access f...

gabacho4

Wouldn’t you also want to specify 2000 as the destination port in that rule? Source port can be whatever but OP is specifically trying to block connections to his router on port 2000. Also, add action=accept chain=input dst-address=127.0.0.1 log=yes makes me uneasy as well. The better course, as rec...

gabacho4

Your firewall rules are what play the biggest role there. Which ROS version are you using? Can you provide a sanitized copy of your config?

gabacho4

Your router has likely been hacked. That IP belongs to a hosting service so odds are it has been made part of some sort of botnet. You need to perform a net install on the router, recreate your configuration, and ensure that you don't change any firewall rules without understanding 100% what they do.

gabacho4

Basically you can mount the antennas wherever you need them or want them. I just bored out holes in the front end of the case for mine.

https://imgur.com/a/Hq42fiU

https://imgur.com/a/ZxxE6La

gabacho4

Have the very same PoE options with my CRS328-24P which I know for sure does passive. Very inclined to believe the CSS610-8P does as well.

gabacho4

The only options available are on, auto, off. Whenever I see the ability to turn PoE “on” I think passive but haven’t tested that theory with this device. Might be able to find time to test with a spare rb5011 later.

gabacho4

@chechito thanks for flagging that! So glad to finally see something to confirm IPSec is accelerated on the RB5009.

gabacho4

But what can i do with Apple devices Unfortunately, you'll have to dumb down your configuration to support the apple devices. So you'd have to use AES-CBC with SHA256. That or your have a P1/P2 for your site to site connection and then a separate P1/P2 for your remote clients. If that doesn't work ...

gabacho4

@depth0cert - try the proposal with no auth-algorithm. According to Netgate (PfSense) no auth-algorithm is required with AES-GCM for Phase 2. Believe that is why you are getting the error message.

gabacho4

In my quest to ever improve the performance of a few ipsec tunnels that I run, I was wondering if anyone has heard if there is any expectation that acceleration for AES-GCM will be forthcoming to the RB5009 series? I noticed it was just added for the Hap ax2 and is available in CCR2004 and RB4011 mo...

gabacho4

Let me know how much you want to sell your CCR2004 for. I might be interested in buying it assuming you are in the US. I’ll netinstall it and make it purr.

gabacho4

Many thanks to all who suffered before me and to @oskarsk for providing the link to 2.17rc. After beating my head for a number of hours trying to figure out what I was doing wrong on this device versus my css610-8G-2S+IN, I was relieved to see it wasn’t me at all. Now I can finally put this thing in...

gabacho4

What does “manually installed the same config” mean?

I have 2 x RB5009 and have no issues at all. I think your config has some sort of problem.

gabacho4

Your second example is the layout.

gabacho4

Believe you have noticed the same thing a few of us already have. I believe this should be of help. No one has confirmed that I’m not crazy, but my belief makes sense given how PoE works other than passive.

https://forum.mikrotik.com/viewtopic.php?t=171943

gabacho4

I see same thing on my switch although it goes away if you turn PoE for the ports off. Believe it’s totally normally. My guess is that it shows up that way because the switch looks for some sort of signaling and, when it doesn’t see it, the switch believes there to be a short. Would explain why turn...

gabacho4

What is difference among CCR2004-16G-2S+ and CCR2004-16G-2S+PC other than later has cooler fan?

Form factor and cpu clock speed

gabacho4

I have used the same setup. Used Ubiquiti 1.25 gig multi mode SFP transceivers and some LC OM3 fiber patches I bought on Amazon. Worked like a charm.

gabacho4

You say that like it’s a bad or nefarious thing. When you choose to buy and use closed source software, you willingly and actively accept that reality. If you don’t like it then sell what you have and use only open source solutions. Best of luck.

gabacho4

Got it figured out. Man that was a wild one. This stuff bends your mind a bit right before you have the big “ah hah” moment.

gabacho4

Anyone? Bueller?

gabacho4

Good evening, I have two RB5009s that I am trying to use in a VRRP (master/backup) configuration so that I can update one without taking down the internet for everyone in the home. Configs are identical with the exception of R2 having VLAN interface IPs that are one more than R1s. I have all the por...

gabacho4

As in the reset worked? Having a hard time deciphering that last message.

gabacho4

The method the video shows is the right one but your device is absolutely not reset. So I have to assume you’re not doing something right. Unplug the power adapter -> press and hold the reset button -> plug in the power adapter -> keep holding the reset app until the user light flashes (I’d hold it ...

gabacho4

How are you attempting to reset the device?

gabacho4

I think he means that the sync feature won’t work for him as a result of something the MikroTik router/firewall is doing. Ya dig what I’m saying? Trying to access service X through the tik doesn’t work. Accessing servic X through some other router does. But OP gives us nothing to even work with othe...

gabacho4

https://youtu.be/J1-mYdJj_fk That should help you.

gabacho4

@kennethc it’s in the switch settings.

gabacho4

removed unneeded quote - use "Post Reply"

Porvenir only works for me if I use a vpn with an endpoint in the US.

s16.movilsp.co works for me without the need of a vpn.

gabacho4

From what I can tell there is a geo block and maybe some browser weirdness. If I try to access the directvgo site from my current location I get the error that @rextended noted. If I enable a vpn putting me in the US it works. If I use Safari to go to the hbomax site, it tells me the service isn’t a...

gabacho4

@anav good catch. I had a lapse in focus and forgot that OP blew all those rules away. I shall strive to be more worthy.

gabacho4

Popping some popcorn now before anav sees the previous post. Let me try to spare you a lashing… Please order your firewall rules with input ones at the top and forward ones at the bottom. You would have been better served to keep the default rules as I can confidently say you set these up from scrat...

gabacho4

Obviously the answer to that question is "yes".

Which is why I was going to advise him to uncheck that since he’s using pihole for dns.

gabacho4

Can you take a screenshot of your DNS settings? In Winbox, IP -> DNS. Do you have it set to allow remote requests?

gabacho4

Sounds like an MTU/MSS issue to me. Have you done any fragmentation testing?

gabacho4

Just be careful when you set up the firewall that you allow access via input chain or you’ll be hurting again.

gabacho4

Would be good to add a port that isn’t on the bridge to your acces list as well. That way you can access the router by MAC address if something really goes off the rails. If you want to get fancier, you can give the port an IP address, then statically set your laptop to have an IP in that subnet and...

gabacho4

You need to create an interface list called something like “WinboxAccess” and add the bridge and whatever other ports you want to access Winbox with. Then go to Tools -> MAC server -> MAC Winbox server, and make sure the interface list you created is selected as the Allowed Interface List Your curre...

gabacho4

Sorry you dont get instant gratification here, now go suck on a lollypop and learn patience like the rest of the children.

That statement will reverberate for all time…

gabacho4

I would go by this factoid.......... No ipsec test results yet on product page. Is MikroTik diligent about updating that kind of stuff or could it be a feature and they just haven’t conducted their tests and updated the page? I don’t have any agenda, just trying to understand how things generally w...

gabacho4

Really wish someone from MikroTik would put this question to bed. It’s been asked multiple times and no final answer has been given. The change log for 7.1.3 said ipsec acceleration was added. So why I keep seeing others say it isn’t? If the documentation doesn’t indicate it, that could be more of a...

gabacho4

Lets understand your CRS ports ether1 trunk port assuming to ????????? ether1 is a trunk port to RB5009 port 5 trunk ether3 RB 5009 access port, trunk port or hybrid port ports 3, 5, and 7 are on a vlan 5 which only exists on the switch in order to isolate them. I use the CRS POE to power the 2 x R...

gabacho4

Set this to NONE < not using a secure protocol. I assume you mean the telnet server one? Done if so... Also suggest besides the ether6 management port you take a port OFF the bridge, assigne an IP address only and then you can access the router separate from the bridge which avoids many headaches. ...

gabacho4

I prefer to choose what IP I want my smart devices to have and typically I assign them outside the pool and in dhcp leases on the router I set them to static leases. This is exactly what I have done except on the router end. The pool for the MGNT network starts at 10.20.100.100. I create static ent...

gabacho4

Anav, thanks a million. So let me ask you really quick, what is the advantage to setting up the CSR ip and all manually versus letting the switch get a dhcp assignment from the RB5009 which would then tell it what it’s route, dns, etc all was. Is that a preference thing or is there a strong reason I...

gabacho4

of course, I still welcome any suggestions/input that anav or anyone else might have. This is all being used on a home network so I do try to use best practices but don't lose any sleep if things aren't 100% the way they would/should be in an enterprise environment. That said, I am constantly learni...

gabacho4

I may have licked this one. I just added a vlan from the ip/interface/vlan menu using the MGMT vlan. Added that to the bridge. Then I set the DHCP client to run on the MGMT VLAN interface and viola! The switch picked up the IP address I had statically set on the RB5009. And I am now able to connect ...

gabacho4

Anav! Look forward to the butt kicking I'm probably about to get. :D I'll leave the bridge alone. I know you are protective of it. I would like to be able to see the router and switches while connected on the MGMT vlan of my network. This would be via an access port using WinBox. I don't use anythin...

gabacho4

Hello all, I am about to lose my mind and would request some assistance and mercy. I've set up a CRS328 and have everything working great for my network. However, the issue is that the only way I can administer the switch is to connect to it and access it by mac address via winbox. I have set the dh...

gabacho4

Thanks for being a better reader than I was tangent. allow from VLAN did it! The mystery of the phantom switch has been solved.

gabacho4

Just re-read the wiki and maybe that will work. I’ll give it a shot. Damn I can’t believe it was something that simple if it does work. I though it was more for limiting access than anything else.

gabacho4

The allow from VLAN field is only to limit the VLAN that can be used to access the GUI for switch config. That won’t be of help here. I had been running RoS on the switch and wanted to give SwOS a try. It I think I’m going to go back. There are a number of little things that I find either don’t exis...

gabacho4

OK let's hope this helps. It's crude but I think it conveys everything I am trying to say and what I am witnessing. I'm sure the issue is that the switch sees two DHCP servers but I am struggling with how to have the switch accept one while allowing the other to give an IP to the expected device (RB...

gabacho4

Apologies, it’s an CRS328-24P-4S+RM. Was so focused on describing the issue that I goofed the product name. I’ll do a quick chart here shortly.

gabacho4

Good day everyone, I have an issue where my CRS368 running SwOS 2.13 is obtaining the wrong IP address via DHCP. Let me give you the background. I use the switch to power an LtAP LTE6 and RB5009. This works great so that I don't have to have two more devices plugged into a power strip. The LtAP and ...

gabacho4

Come to Canada we will lubricate you!

That's not the type of penetration testing I'm interested in signing up for...

gabacho4

Winbox for the mac
Is what many cry out for
Wine works fine for me

gabacho4

I can connect to them both in Winbox. Just trying to figure out if there’s a cleaner way to manage and identify devices.

gabacho4

Why didn’t I have this fabulous understanding while I was pounding my head on the desk?! Thanks for helping me think this through. Guess I’ll either connect via MAC or just save a connection using the switch IP.

Is what I’m trying to do something that Romon would fix?

gabacho4

Yeah the switch is on a 10.20.2.x subnet while the laptop is on a 10.200.2.x subnet. I guess that makes sense now since the laptop should not be aware of the other subnet directly. The 10.200.2.x subnet does however have access (firewall rule permitting this) to the 10.20.2.x which would explain why...

gabacho4

Hello all! I’m setting up my first MikroTik switch (crs328 24 port PoE 4sfp+ yada yada) and have encountered a weird anomaly. The switch sits behind an RB5009 and I have gotten all my vlans set up and things work outstandingly. However, when I open Winbox on a laptop and look at the Neighbors tab, I...

gabacho4

This has been a great thread so far. I’ve learned some very good things from the discourse. Thanks for sharing!

gabacho4

The puck could very likely be for GPS.

gabacho4

Yes. From what I recall reading, the router will prefer the higher voltage power source and fall back to the next source should the first fail/ be disconnected.

gabacho4

I didn’t use those but those would perhaps work. I just went through the side of the black cover myself. I am using the device overseas so it uses a European band LTE modem. They do t use the same bands as the US and the provider isn’t one that is located in the US. The key is that you get a US comp...

gabacho4

I had to purchase a couple U.fl -SMA pigtails. https://mikrotik.com/product/acsmaufl Then I opened the LtAP, disconnected the internal antenna, drilled a couple appropriately sized holes in the cover of the LtAP ( they actually mark areas where this can be done but you can put them wherever you like...

gabacho4

I love my LtAP LTE6. It supports external antenas if you get the necessary parts and are comfortable making a few adjustments and it has 3 sim slots. It only has one Ethernet port but that can be fixed with a simple switch. Been rock solid for me for the most part over the past couple years. Runs ev...

gabacho4

Never had this problem but have you tried another SPF module from a different manufacturer?

gabacho4

But shouldn't it use CA automatically (Carrier Aggregation) ? LTE device located in France is supposed to be using 7 and 3. But whenever I try to force it, it breaks the connection. Only when leaving stuff at auto, I see under load B3 being added as CA next to primary B7 (which still results in a m...

gabacho4

For the SIM card not inserted error you could try to put a layer or two of scotch tape on the back of the SIM card in order to make it a little thicker. If you make the tape longer than the SIM it’ll make a nice tag for you to pull on in order to take the SIM out next time. That error seems to come ...

gabacho4

I just wish people would post the issue they are having and ask for a config sanity check or whatever instead of immediately blaming MikroTik. Not that MikroTik doesn’t have faults or issues but but the number of times I’ve seen people blame MikroTik only to be proven wrong is insane.

gabacho4

Have you tried another cable of the same length just for fun? 87 mbps might be about right considering the cable length is half the maximum recommended of 100M.

Still far better than the 20mbps you were getting. I think your wifi device is misconfigured or time for a new one.

gabacho4

You didn’t do as advised. First do a test with your computer connected directly to a port on the 4011. What speed? Then connect the switch to the 4011 and then connect directly to the switch. What speed? Then connect the second switch to the first switch and connect your computer directly to the sec...

gabacho4

I’m getting 75 megs download and 26megs upload across a WireGuard s2s between an RB5009 and a pfsense box approx 7500 miles away. I’m on a LTE connection which generally sees 100 megs download and 2x megs upload but sometimes less depending on provider network load. Test is being run from my compute...

gabacho4

The rb4011 or rb5011 are too big for you?

gabacho4

This isn’t an Ireland issue. It’s global. The wait time for networking gear from many, if not all, manufacturers is months and even then the backlog is so large you’ll find that they’re only able to ship out enough to cover a portion of their orders. Threatening to go to another company for your nee...

gabacho4

It isn’t necessary at all. The drop everything else rule, as you mention, takes care of that too. I’m sure there are performance gains in large networks to having invalid dropped at the top of the chain but I don’t think you’ll notice any appreciable difference in a home or SMB environment.

gabacho4

open telnet and admin without password in 2021 - laughter

I guess it’s not as bad in 2022.

gabacho4

If the upgrade is making from routers bricks Mikrotik should remove it ASAP. No one expect from stable version this bricking firmware.... It didn’t brick any of mine. Everything is relative and, as has been said before, rushing to install a new release means you assume risks. Before EVER installing...

gabacho4

I don’t know @anav, white American speaks poorly of another white American with a history of issues. Clear cut case of racism…. racism- prejudice, discrimination, or antagonism directed against a person or people on the basis of their membership in a particular racial or ethnic group, typically one ...

Search found 282 matches