Community discussions

MikroTik App

Search found 490 matches

  • 1
  • 2
by Cablenut9
Tue Aug 03, 2021 5:20 am
Forum: RouterOS v7 BETA
Topic: Can't mark routes in IPv6->Firewall->Mangle
Replies: 1
Views: 49

Can't mark routes in IPv6->Firewall->Mangle

I was adding mangle rules to the IPv6 firewall mangle section and it turns out there's no way to mark routes in rules. However, in IPv6->Routes->Rules there's an option for routing marks. What gives?
by Cablenut9
Tue Aug 03, 2021 2:13 am
Forum: RouterBOARD hardware
Topic: Broken PSU in CRS328
Replies: 1
Views: 71

Re: Broken PSU in CRS328

It's impossible to know if you don't have a good version of the power supply, but maybe you do because the CRS328 might be a switch with redundant ones. Also, this doesn't seem to be a widespread issue.
by Cablenut9
Mon Aug 02, 2021 7:34 pm
Forum: General
Topic: PCC load balance not working [help]
Replies: 13
Views: 1875

Re: PCC load balance not working [help]

His method doesn't work well in v7 for some reason, so the fix for me is to condense everything into rules that directly mark routes based on the PCC.
by Cablenut9
Mon Aug 02, 2021 5:54 pm
Forum: General
Topic: Feature Request: Address List use Wildcard FQDN
Replies: 3
Views: 100

Re: Feature Request: Address List use Wildcard FQDN

I think it is too late to add that kind of "trick" as "everyone" is switching to DoH and DoT and that makes this impossible.
Unless you block all DoH servers in the firewall :)
by Cablenut9
Mon Aug 02, 2021 12:50 am
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

Is there any news about the new switch chip's L3 features?
by Cablenut9
Sun Aug 01, 2021 3:15 am
Forum: RouterOS v7 BETA
Topic: Route lookup rules: Broken?
Replies: 6
Views: 270

Re: Route lookup rules: Broken?

In other words have you setup something similar on non beta firmware and it works fine? Connection marking tended to work better on non-beta firmware, but the problem I found with it not marking connections is that it couldn't match anything other than broadcasts and multicasts with any in-interfac...
by Cablenut9
Sun Aug 01, 2021 2:31 am
Forum: RouterOS v7 BETA
Topic: Route lookup rules: Broken?
Replies: 6
Views: 270

Re: Route lookup rules: Broken?

Why are you "bumping" same day?
Maybe it has to do with time zones, but I made my first post yesterday night.
by Cablenut9
Sat Jul 31, 2021 11:30 pm
Forum: RouterOS v7 BETA
Topic: Route lookup rules: Broken?
Replies: 6
Views: 270

Re: Route lookup rules: Broken?

Bump! What I'm doing is basically a split tunnel VPN, which used to work but now it isn't. However, the method I previously used was to have a single rule that marks routing and nothing else. Now, I'm marking connections and then marking routes for those connection marks. Update: I fixed it by conve...
by Cablenut9
Sat Jul 31, 2021 2:34 am
Forum: RouterOS v7 BETA
Topic: Route lookup rules: Broken?
Replies: 6
Views: 270

Route lookup rules: Broken?

Here's my configuration: /ip firewall mangle add action=mark-connection chain=prerouting comment="mark all traffic for vpn" connection-mark=no-mark dst-address=!192.168.1.0/24 dst-address-list="!Portforwarded Servers" in-interface-list=LAN ipsec-policy=in,none new-connection-mark...
by Cablenut9
Fri Jul 30, 2021 4:47 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

I do not suppose a "standard" injector with advertised 1G ports will deliver a 2.5 link, or will it? 2.5G uses the same wires as 1G and it was designed to be used with the same cables, so the injector effectively can't tell the difference. Actually, it might be able to do 10G as well as t...
by Cablenut9
Fri Jul 30, 2021 2:28 pm
Forum: Scripting
Topic: Torrent blocking working in y2020
Replies: 34
Views: 11994

Re: Torrent blocking working in y2020

You can also use a VPN which is even harder to block, if you're using SSTP or Wireguard.
by Cablenut9
Fri Jul 30, 2021 1:58 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

There are not many 2.5G Injectors available, let alone 802.3bt....Oh, TP-Link has them (oups, wrong brand).
You don't need 802.3bt to power the RB5009 (it only supports 802.3af/at), and 2.5G works fine over regular ethernet cables.
by Cablenut9
Fri Jul 30, 2021 1:56 pm
Forum: Scripting
Topic: Torrent blocking working in y2020
Replies: 34
Views: 11994

Re: Torrent blocking working in y2020

Have a 50Mbps and try to sell 10Mbps to 100 users...
When 5 of 100 users use torrents, the uplink is full and all users complain...
Then you need to upgrade, because the customers are using what they're paying for.
by Cablenut9
Fri Jul 30, 2021 3:56 am
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

What happened to the console port ??
This is something that I really want before I can buy one.
by Cablenut9
Fri Jul 30, 2021 12:43 am
Forum: General
Topic: R11e-LTE6 Registration Status Denied
Replies: 7
Views: 272

Re: R11e-LTE6 Registration Status Denied

So it is just saying Registration Status "Denied" because I am not able to see a cell tower anymore?
This happens to me too, so try getting a better signal.
by Cablenut9
Thu Jul 29, 2021 8:51 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

ROAS concept implies that router has only single physical connection to the rest of the network.
Maybe it's a half-ROAS, because to the 10G devices it only has one connection, but to the gigabit it has many.
by Cablenut9
Thu Jul 29, 2021 8:45 pm
Forum: Beginner Basics
Topic: Block or Limit Torrents
Replies: 10
Views: 336

Re: Block or Limit Torrents

What is worth torrenting these days anyway??
If you need to find something old, weird, or otherwise hard to get the regular way (like the Olympics) then torrenting is a suitable option.
by Cablenut9
Thu Jul 29, 2021 8:10 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

I feel like the RB5009 for me would actually bet a positive gain in performance, as my RB4011 is doing inter-VLAN routing in the CPU for CCTV and RSTP, both of which aren't supported by the wimpy TTL switch chips but likely are by the RB5009's.
by Cablenut9
Thu Jul 29, 2021 7:49 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

I use ROAS where the gigabit ports are used for gigabit devices and the SFP+ is connected to a 10G switch for only 10G devices.
Then it is not a ROAS :)
Technically it is, because the WAN is located in the 10G switch and uses a VLAN to separate it from LAN.
by Cablenut9
Thu Jul 29, 2021 7:16 pm
Forum: Beginner Basics
Topic: Block or Limit Torrents
Replies: 10
Views: 336

Re: Block or Limit Torrents

:) Let me rephrase the question..I would like to block torrents or Limit their bandwidth usage within my network. Please share some working procedures. thanks
You can't, because torrents can use ports 80 and 443 and then it looks like regular website traffic.
by Cablenut9
Thu Jul 29, 2021 7:03 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

How would it matter in ROAS scenario, as SFP+ will be the only populated port then?
I use ROAS where the gigabit ports are used for gigabit devices and the SFP+ is connected to a 10G switch for only 10G devices.
by Cablenut9
Thu Jul 29, 2021 4:54 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

That RB5009 block diagram makes me think it was oriented around router-on-a-stick because the SFP+ is switched with all the other ports and that's what you'd have a lot of in a ROAS setup. Also, in the document for the switch chip, it claims "L3 routing features" which might be nice to hav...
by Cablenut9
Wed Jul 28, 2021 11:49 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

But is it possible to use this rack-mount kit for mounting single unit? Or 3 units? How stable is the whole thing if there aren't two units stacked vertically?
They want you to buy four, that way they get four times the sales.
by Cablenut9
Wed Jul 28, 2021 9:05 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

It seems like that text about DFS and "local authorities" is just boilerplate filler copied and pasted into every manual.
by Cablenut9
Wed Jul 28, 2021 5:57 pm
Forum: RouterOS v7 BETA
Topic: v7 launch date
Replies: 124
Views: 13802

Re: v7 launch date

AFAIK all forum moderators can directly edit all posts. AFAIK all MT staffers present on forum are moderators.
This is scary, as on other sites like Reddit, it was a scandal if even the site owner was able to change someone else's post.
by Cablenut9
Wed Jul 28, 2021 4:30 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 47515

Re: v7.1beta6 [development] is released!

Are you talking about WRT1200/3200 too?
No, only the cAP ac and hAP ac3.
by Cablenut9
Wed Jul 28, 2021 4:05 am
Forum: Wireless Networking
Topic: Wifi net work for home with Iot (50 devices)
Replies: 43
Views: 1219

Re: Wifi net work for home with Iot (50 devices)

Don't touch MT WiFi with a 10 foot pole! The very fastest I can get is 450 Mbps in the best conditions and that's nothing compared to my gigabit Internet connection. You might be able to go faster if you get the RB4011 Wireless Edition but that's several hundred dollars. However, if you're doing a P...
by Cablenut9
Wed Jul 28, 2021 3:25 am
Forum: General
Topic: Locked out due to vlan filtering
Replies: 6
Views: 398

Re: Locked out due to vlan filtering

Try to connect through all the possible VLANs, so that means multiple ports. Other than that, you might be out of luck.
by Cablenut9
Tue Jul 27, 2021 9:37 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

I also noticed in the YT video that they're saying there's going to be others in the RB5000 series. That means there could be a 10 port version to properly replace the RB4011, because mine is just about filled up and I would have to rearrange my network if I upgrade to the RB5009.
by Cablenut9
Tue Jul 27, 2021 7:06 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 47515

Re: v7.1beta6 [development] is released!

Tweaking around with channels (I am alone on landside, no other used channels) and stuff I finally reached speeds like 180mbit/s with iperf3. Again, 5m meters distance. A real useless AP it was. This is pure BS, as I can get a solid 450 Mbps with my old Linux laptop at the same distance. Then again...
by Cablenut9
Tue Jul 27, 2021 7:02 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

If you watched the video introduction, there they said RB5009 will NOT be compatible with v6. I already knew this. If we have a RB4011 with v6 and a RB5009 with v7, then both have about the same routing speed. What would be nice is if we could get the RB5009 with v6, but we can't. Assuming this set...
by Cablenut9
Tue Jul 27, 2021 6:36 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

FastPath requires specific hooks in the NIC drivers as well as a number of other optimizations. Previous technique may not work with a more modern kernel, or their may be newer more efficient ways to perform FastPath on the 5.x kernel that Mikrotik are not fully utilizing yet. Assuming they don't i...
by Cablenut9
Tue Jul 27, 2021 4:16 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

I am just guessing, but I would say it is due to FastPath modules not being optimized in RouterOS v7 yet.
That's interesting, as ROS v7 is currently more optimized then v6 for routing processes like SPF and BGP downloading.
by Cablenut9
Mon Jul 26, 2021 4:03 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

If you just compare the RB4011 and RB5009 based on CPU alone, the A72 is light-years ahead of the A15, so it's strange this isn't reflected in the performance data.
by Cablenut9
Mon Jul 26, 2021 5:59 am
Forum: Wireless Networking
Topic: 5.915 Ghz on LHG AC?
Replies: 2
Views: 209

Re: 5.915 Ghz on LHG AC?

From what I know, all International AC devices support that frequency because the effective range actually goes into the 6GHz band.
by Cablenut9
Sun Jul 25, 2021 7:35 pm
Forum: Scripting
Topic: hacked script
Replies: 4
Views: 424

Re: hacked script

Post the script content here and let's see what there is, because I don't want to go to that website to find out.
by Cablenut9
Sun Jul 25, 2021 4:23 pm
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

Can I ask you where you live?
The Southeast US, but I've only seen these firewalls a couple times. I know Walmarts block L2TP/IPSec and they mess with TLS certificates leading to HSTS errors. However, a port 443 WG VPN works just fine, so it's this one place that blocks almost everything.
by Cablenut9
Sun Jul 25, 2021 4:09 pm
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

Just so you know how restrictive some of these firewalls are, I sometimes can't visit forum.mikrotik.com without a VPN because of this: "Sonicwall: Connection blocked to Latvia (GeoIP block)"
by Cablenut9
Sun Jul 25, 2021 5:09 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

I was asking you if I bothered you, like mkx want say...
Maybe, but I can see why the ISP would want to block DNS.
by Cablenut9
Sun Jul 25, 2021 12:58 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

@Cablenut9 you make it clear, please...
You gave me the dst-nat solution before mkx did, but mkx explained how my original setup might actually work.
by Cablenut9
Sun Jul 25, 2021 12:28 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

Your provider lock all UDP??? (also UDP on 53...)
Not my provider, but at some places like a coffee shop, they have those restrictions.
by Cablenut9
Sun Jul 25, 2021 12:23 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

I have to use port 53 to bypass firewalls which block everything except ICMP, TCP port 80/443, and DNS. My ISP doesn't care that much about "weird" traffic.
by Cablenut9
Sun Jul 25, 2021 12:11 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Re: Input firewall filter prioritization [SOLVED]

If you want to block it in RAW on TCP/UDP(53) traffic coming from the WAN.
This won't work because then I won't be able to use Wireguard with a listen port of 53.
by Cablenut9
Sun Jul 25, 2021 12:05 am
Forum: General
Topic: Input firewall filter prioritization [SOLVED]
Replies: 29
Views: 1020

Input firewall filter prioritization [SOLVED]

I have a setup where my main router has a DNS server accessible to clients on LAN. On the outside, there will be a Wireguard tunnel on port 53, the same port as DNS. If I add an input rule for port 53 from WAN, which router service will come first? Is there a way to disallow DNS from WAN and only al...
by Cablenut9
Sun Jul 25, 2021 12:00 am
Forum: Beginner Basics
Topic: layer 7 port forwarding
Replies: 17
Views: 678

Re: layer 7 port forwarding

If you have a restrictive firewall that blocks most traffic, UDP WG on 443 has a higher chance of getting through.
by Cablenut9
Sat Jul 24, 2021 11:51 pm
Forum: Beginner Basics
Topic: layer 7 port forwarding
Replies: 17
Views: 678

Re: layer 7 port forwarding

But not so much for WireGuard since it only uses UDP as a transport...
QUIC traffic also uses UDP
by Cablenut9
Sat Jul 24, 2021 11:44 pm
Forum: Beginner Basics
Topic: layer 7 port forwarding
Replies: 17
Views: 678

Re: layer 7 port forwarding

In that case setting up some kind of a VPN would have been a much easier, cleaner and more flexible solution...
This is hilarious, because all my solutions were originally made for me to differentiate between HTTPS and a Wireguard/SSTP VPN tunnel.
by Cablenut9
Sat Jul 24, 2021 11:18 pm
Forum: Beginner Basics
Topic: layer 7 port forwarding
Replies: 17
Views: 678

Re: layer 7 port forwarding

I had a similar problem, and the fixes are: 1. Use port knocking to manually choose which thing you connect to. 2. Use source address filters to exclude a certain address from the blog and then connect to the NAS, maybe use IP Cloud DDNS to do this? Or, you can use something like Cloudflare instead....
by Cablenut9
Sat Jul 24, 2021 10:57 pm
Forum: Beginner Basics
Topic: layer 7 port forwarding
Replies: 17
Views: 678

Re: layer 7 port forwarding

Put your domain in an address list. Then, make the NAT rule so it matches based on that domain address list.
by Cablenut9
Sat Jul 24, 2021 6:04 pm
Forum: General
Topic: Master's thesis problem?
Replies: 4
Views: 372

Re: Master's thesis problem?

The closest you'll get to "advanced features" with Mikrotik is this: https://jghuff.com/blog/dpi/
by Cablenut9
Sat Jul 24, 2021 12:02 am
Forum: RouterBOARD hardware
Topic: The big CCR2004 reboot thread (was 2004 hardware issues?)
Replies: 193
Views: 25486

Re: The big CCR2004 reboot thread (was 2004 hardware issues?)

CCR2004 trash hardware not usable in a professional network.
What's the alternative? The equivalent Cisco would cost 100 times as much.
by Cablenut9
Fri Jul 23, 2021 7:33 pm
Forum: General
Topic: Feature Request: RouterOS Nightly
Replies: 4
Views: 459

Feature Request: RouterOS Nightly

I think it would be an interesting proposition if we could download and install every new build of ROS to get the latest features, even if they don't even deserve a "beta" release yet. Firefox and lots of other software already has this, so why not RouterOS?
by Cablenut9
Fri Jul 23, 2021 4:30 pm
Forum: Wireless Networking
Topic: Mikrotik - Early Access beta hardware?
Replies: 13
Views: 787

Re: Mikrotik - Early Access beta hardware?

Yup ... buy new model devices from your local MT distributor and you're hooked up for beta testing. Or so it seems ...
Sad but true.
by Cablenut9
Thu Jul 22, 2021 8:50 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

That mystery pad could also be the NAND as they pointed it out in the video and it was on the other side.
by Cablenut9
Thu Jul 22, 2021 5:37 am
Forum: General
Topic: IPTV Configuration
Replies: 5
Views: 597

Re: IPTV Configuration

Okay, let's bring you up to speed on what some people spend their whole careers on... 🙄

I advise asking only specific questions on huge topics like this. Open-ended ones either result in vague answers or reference manuals.
Go back to Reddit
by Cablenut9
Wed Jul 21, 2021 11:49 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

Annapurna Labs AL32400: 4x1.7Ghz Cortex A57.
Looks like the A72 is actually faster than the A57, so that's bad. https://en.wikipedia.org/wiki/ARM_Corte ... prov=sfla1 What's also sad is that it's also used in the Raspberry Pi, so that's also poor value because the Pi can be had for $35.
by Cablenut9
Wed Jul 21, 2021 11:18 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

Well, till then...
by Cablenut9
Wed Jul 21, 2021 10:49 pm
Forum: General
Topic: Feature Request: Add Port Knocking on MikroTik App and WinBox
Replies: 5
Views: 405

Re: Feature Request: Add Port Knocking on MikroTik App and WinBox

This isn't a comment about Wireguard:
You can already get simple port knocking apps that work with any kind of setup, so why add it into the MT app?
by Cablenut9
Wed Jul 21, 2021 10:29 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

The video (https://www.youtube.com/watch?v=Cmt33XMLTqI) says that it'll be the cheapest CCR, and that the passive cooling version is coming soon and it'll be 15% slower and have external power supplies.
by Cablenut9
Wed Jul 21, 2021 7:26 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 107
Views: 9585

Re: MikroTik RB5009UG+S+IN

Looks like the Marvell CPU used in the RB5009 is a Cortex A72, but now I need to compare this to the one in the CCR2004. Does anyone know what processor the 2004 uses?
by Cablenut9
Tue Jul 20, 2021 11:47 pm
Forum: RouterOS v7 BETA
Topic: Wireguard on wAP AC
Replies: 6
Views: 627

Re: Wireguard on wAP AC

Make sure the "allowed addresses" setting is set to 0.0.0.0/0. ROS has a bug where you have to set it through the terminal because the GUI keeps deleting it because eit thinks it's not needed.
by Cablenut9
Sun Jul 18, 2021 5:36 pm
Forum: Wireless Networking
Topic: Love MikroTik WISP Setup
Replies: 2
Views: 373

Re: Love MikroTik WISP Setup

What's your main internet connection? How many users will there be? What's the weather like? With Starlink coming faster than ever, there's no reason to offer only a paltry 5Mb/s. If you can, upgrade to the SXTsq lite5 ac so you can get the most out of your mANTBox 15s.
by Cablenut9
Sun Jul 18, 2021 2:35 pm
Forum: Useful user articles
Topic: How to almost get DPI with almost nothing but Mangle rules
Replies: 0
Views: 389

How to almost get DPI with almost nothing but Mangle rules

https://jghuff.com/blog/dpi/
This article shows how to get a DPI-like experience with the Mikrotik firewall by using a bunch of Mangle rules and a couple other firewall filters as well. In short, it filters based on port, TLS host, domain, address, and DNS requests.
by Cablenut9
Sat Jul 17, 2021 2:02 am
Forum: General
Topic: Ethernet Flow Control
Replies: 1
Views: 356

Ethernet Flow Control

Is there a good reason to turn it on in ROS? By default it's off on all of my devices so maybe there's a reason why it's that way.
by Cablenut9
Fri Jul 16, 2021 7:23 pm
Forum: General
Topic: Overriding netmap
Replies: 6
Views: 429

Re: Overriding netmap

All NAT rules try to match before anything in the filter section, so if any of your NAT rules match your traffic, then it gets "taken away" from any accept rules elsewhere. Try adding Dst. Address = !YY.YY.YY.101 to the NAT rule.
by Cablenut9
Fri Jul 16, 2021 6:35 pm
Forum: General
Topic: Overriding netmap
Replies: 6
Views: 429

Re: Overriding netmap

Then add Src. Address = !your-excluded-address to the netmap rule.
by Cablenut9
Fri Jul 16, 2021 6:04 pm
Forum: General
Topic: Overriding netmap
Replies: 6
Views: 429

Re: Overriding netmap

NAT rules come before any "filter" rule, so to fix this, exclude the ports 500 and 4500 from the netmap rule.
by Cablenut9
Fri Jul 16, 2021 2:39 am
Forum: RouterOS v7 BETA
Topic: v7 launch date
Replies: 124
Views: 13802

Re: v7 launch date

Because they have asked to test filters specifically.
Sorry for my ignorance, but why does anybody need route filters?
by Cablenut9
Fri Jul 16, 2021 2:26 am
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

Another solution: My webserver which uses QUIC is protected by Buttflare. Since Buttflare has a set list of IPs that they request from, I can specify the NAT rule for QUIC (and also TCP 443) for only these IPs, and have the VPNs available for all other addresses. This also has a bonus feature of blo...
by Cablenut9
Fri Jul 16, 2021 1:04 am
Forum: Wireless Networking
Topic: Netmetal maximum throughput?
Replies: 7
Views: 589

Re: Netmetal maximum throughput?

uh, it definitely has 2 chains, or even three on one model.
There's one kind of Netmetal that only has 1 chain, but the others have 2/3. In that case, you can easily get a solid 450Mbps
by Cablenut9
Thu Jul 15, 2021 11:46 pm
Forum: Wireless Networking
Topic: Netmetal maximum throughput?
Replies: 7
Views: 589

Re: Netmetal maximum throughput?

You'll never get above about 300Mbps with the Netmetal because it only has 1-chain 802.11n/ac, and that's best-case!
by Cablenut9
Thu Jul 15, 2021 5:44 pm
Forum: RouterBOARD hardware
Topic: wAP 60Gx3 bandwidth
Replies: 2
Views: 460

Re: wAP 60Gx3 bandwidth

If you do only "internal L2 routing" between the clients and the ap, you can really reach the gigabit sum,
I'm not using the gigabit port at all, but rather L3 routing between stations connected to the wAP itself.
by Cablenut9
Thu Jul 15, 2021 4:40 pm
Forum: RouterBOARD hardware
Topic: wAP 60Gx3 bandwidth
Replies: 2
Views: 460

wAP 60Gx3 bandwidth

How much bandwidth does the wAP 60Gx3 have between the three phase-array antennas? I'm wanting to make a setup where lots of data will be sent to and from these antennas/radios but in the block diagram, there's no speed listed for the link between the CPU and the 60GHz radio. This likely means it's ...
by Cablenut9
Thu Jul 15, 2021 6:14 am
Forum: Wireless Networking
Topic: Virtual interfaces for 60GHz
Replies: 8
Views: 566

Re: Virtual interfaces for 60GHz

But why would you keep changing the MAC on the station side to begin with? Presumably you control both sides?
That's in case someone hacks a station and wants to subtly attack the network.
by Cablenut9
Thu Jul 15, 2021 5:45 am
Forum: Wireless Networking
Topic: Virtual interfaces for 60GHz
Replies: 8
Views: 566

Re: Virtual interfaces for 60GHz

Let's say I have an AP and a station. If the AP assigns slave interfaces based on each station, using the MAC to differentiate between them, then the AP will make a new interface for each MAC it sees. The script on the station changes its MAC to some random value every time it connects. The AP, thin...
by Cablenut9
Thu Jul 15, 2021 5:27 am
Forum: Wireless Networking
Topic: Virtual interfaces for 60GHz
Replies: 8
Views: 566

Re: Virtual interfaces for 60GHz

The station interfaces are only created after connect, but they are not dynamic, so they will stay there even if the far end goes down. Is this really true? If so, then what stops someone from making a script that changes the identity of some station and cramming the AP with a long list of dummy in...
by Cablenut9
Thu Jul 15, 2021 5:06 am
Forum: Wireless Networking
Topic: Virtual interfaces for 60GHz
Replies: 8
Views: 566

Virtual interfaces for 60GHz

Is it possible to have a virtual interface to which 60GHz stations can connect to? I want to have a setup where multiple wAPs connect to a single wAP 60x3 and that wAP 60x3 can create a PtP link from itself to any of the stations. However, I noticed in the MikWiki that the station interfaces are cre...
by Cablenut9
Wed Jul 14, 2021 11:45 pm
Forum: Forwarding Protocols
Topic: Point-to-point (/31) addresses
Replies: 85
Views: 57942

Re: Point-to-point (/31) addresses

but they fail when you use protocols that expect to be able to use broadcast over a link, like OSPF.
This partially untrue, as OSPF has PtP mode which eliminates address broadcasts, making /32 addresses the absolute simplest and easiest option, but only for PtP mode OSPF.
by Cablenut9
Wed Jul 14, 2021 11:43 pm
Forum: RouterBOARD hardware
Topic: The big CCR2004 reboot thread (was 2004 hardware issues?)
Replies: 193
Views: 25486

Re: The big CCR2004 reboot thread (was 2004 hardware issues?)

anyone has better results with 6.48.3?
https://tryitands.ee

Anyway, considering all the fixes in 6.48.3, I would expect there to be some improvement with the CCR2004.
by Cablenut9
Wed Jul 14, 2021 4:12 pm
Forum: Forwarding Protocols
Topic: Point-to-point (/31) addresses
Replies: 85
Views: 57942

Re: Point-to-point (/31) addresses

Normis, it seems /31 works fine on RouterOS v6 stable/long-term though?
/32 really cuts down on addresses though, and it follows the philosophy of "hosts have IP addresses, not interfaces"
by Cablenut9
Wed Jul 14, 2021 4:42 am
Forum: General
Topic: Route traffic through IP tunnel after masquerading
Replies: 3
Views: 299

Re: Route traffic through IP tunnel after masquerading

I fixed it! If I add another rule to use the src-nat rule for all IPIP interfaces in addition to the masquerade rule for my other interfaces, it works great. /ip firewall nat add action=src-nat chain=srcnat out-interface-list=IPIP to-addresses=10.0.0.2 add action=masquerade chain=srcnat ipsec-policy...
by Cablenut9
Wed Jul 14, 2021 2:54 am
Forum: General
Topic: Route traffic through IP tunnel after masquerading
Replies: 3
Views: 299

Re: Route traffic through IP tunnel after masquerading

Here's what I want to do: I need to encapsulate the router's IP two ways, both in the inner IP packet and on the outside IPIP packet so it looks like this: [Router Address][Dst Router Address](Router Address)(Some Dst Internet Address)(IP Packet Content)[IPIP Trailer] Could the regular src-nat actio...
by Cablenut9
Tue Jul 13, 2021 11:47 pm
Forum: General
Topic: Route traffic through IP tunnel after masquerading
Replies: 3
Views: 299

Re: Route traffic through IP tunnel after masquerading

Is this possible with some route rule hack?
by Cablenut9
Tue Jul 13, 2021 10:51 pm
Forum: General
Topic: Route traffic through IP tunnel after masquerading
Replies: 3
Views: 299

Route traffic through IP tunnel after masquerading

I have problem where I have an IP tunnel to some other router and a NAT setup. When I try to ping 1.1.1.1 from R1, the IP tunnel interface on R2 shows that it is coming from a LAN address. However, this means that I'm encapsulating the traffic BEFORE the NAT masquerade. Is there a way to double this...
by Cablenut9
Tue Jul 13, 2021 6:26 pm
Forum: Forwarding Protocols
Topic: BGP ECMP (multipathing)
Replies: 53
Views: 20333

Re: BGP ECMP (multipathing)

It's on the roadmap for protocol support in the v7 status page
https://help.mikrotik.com/docs/display/ ... col+Status
I just need OSPF route conversion from v6 and then I'm golden.
by Cablenut9
Mon Jul 12, 2021 9:23 pm
Forum: RouterOS v7 BETA
Topic: IPv6 forwarding not working in 7.1beta6
Replies: 13
Views: 1832

Re: IPv6 forwarding not working in 7.1beta6

7.1beta6 is super buggy on the RB4011, so good thing you made that downgrade.
by Cablenut9
Mon Jul 12, 2021 2:16 am
Forum: RouterBOARD hardware
Topic: LHGG LTE6 reply timeout from modem
Replies: 4
Views: 1396

Re: LHGG LTE6 reply timeout from modem

to check for new version

/interface lte firmware-upgrade lte1

to download new firmware

interface lte firmware-upgrade lte1 upgrade=yes
This doesn't work with v28 because you can only download v27 right now.
by Cablenut9
Sun Jul 11, 2021 7:06 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 47515

Re: v7.1beta6 [development] is released!

It's July and we're due for beta7.
by Cablenut9
Sun Jul 11, 2021 4:48 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

My test network already has MIPS 880MHz 2-core and ARM 716MHz so I just want to see how much slower a SMIPS/MIPSBE device is.
by Cablenut9
Sun Jul 11, 2021 4:38 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

Maybe I should upgrade to a hAP which has 64MB RAM and is MIPSBE so I can get all the good features, or should I get a hAP Lite just for testing?
by Cablenut9
Sun Jul 11, 2021 4:30 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

My network could have a lot of SMIPS devices with OSPF in PtP mode, so each link will have at most 2 MAC addresses.
by Cablenut9
Sun Jul 11, 2021 4:25 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

Is this a real issue with SMIPS or something that can just happen in theory?
by Cablenut9
Sun Jul 11, 2021 4:11 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

Interesting, so how bad of a performance degredation can I expect?
by Cablenut9
Sun Jul 11, 2021 4:02 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

Looks like I don't need any of the things on that list for what I'm doing, so I'm going to try it and see.
by Cablenut9
Sun Jul 11, 2021 3:33 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

there's no explicit snmp, sntp, smb, radius, tftp packages
understand now?
That doesn't tell me what features SMIPS is missing.
by Cablenut9
Sun Jul 11, 2021 2:52 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

do not exist 1 packet for files, 1 paket for address, 1 packet for user, 1 packet for snmp, 1 packet for sntp, etc....
I don't know what this means, you might have gotten your Italian->English translation wrong.
by Cablenut9
Sun Jul 11, 2021 1:29 am
Forum: RouterBOARD hardware
Topic: E3372h-320 USB/lte1 problems constantly LTE1 link up-down
Replies: 56
Views: 20606

Re: E3372h-320 USB/lte1 problems constantly LTE1 link up-down

I don't understand why version 6 is called stable when it makes such a problem
Ironic, because the current v7 doesn't work with LTE at all.
by Cablenut9
Sun Jul 11, 2021 12:54 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

Re: What packages are missing from SMIPS?

Weird, because there's no explicit dot1x package, so it had to included in some other one. I suppose I'll have to buy a router with SMIPS and see.
by Cablenut9
Sun Jul 11, 2021 12:21 am
Forum: RouterBOARD hardware
Topic: What packages are missing from SMIPS?
Replies: 19
Views: 957

What packages are missing from SMIPS?

I know dot1x is missing from SMIPS Mikrotik devices. However, are there any other missing features? Having the routing package is a hard requirement for me, so I need to know in advance.
by Cablenut9
Sat Jul 10, 2021 9:53 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

I just realized that I can use port knocking to add myself to an address list that gets redirected to Wireguard, and addresses that don't use port knocking get redirected to QUIC. Solved!
by Cablenut9
Sat Jul 10, 2021 4:28 pm
Forum: General
Topic: Congestion based QoS
Replies: 4
Views: 470

Re: Congestion based QoS

Bump, I think this kind of queue is also called SQM
by Cablenut9
Sat Jul 10, 2021 12:29 am
Forum: RouterOS v7 BETA
Topic: L2TP/IPsec tunnel erases configuration
Replies: 1
Views: 434

L2TP/IPsec tunnel erases configuration

I was setting up a L2TP/IPsec tunnel with a 7.1beta6 device on one end, and a 6.49beta46 on the other. After the interface was created after connecting, the v7.1 router crashed and erased the whole configuration. Luckily for me, I had made a backup the day prior just in case something like this happ...
by Cablenut9
Fri Jul 09, 2021 10:21 pm
Forum: General
Topic: Congestion based QoS
Replies: 4
Views: 470

Re: Congestion based QoS

Is this even possible?
by Cablenut9
Fri Jul 09, 2021 9:19 pm
Forum: General
Topic: Congestion based QoS
Replies: 4
Views: 470

Congestion based QoS

I'm interested in making a QoS setup where the queues come into effect when packets are lost, AKA when interface queues become used. My Mikrotik device uses an LTE interface and depending on where I take it, the speeds can range from 1 to 100 Mbps. If I used queue trees the usual way, I would have t...
by Cablenut9
Fri Jul 09, 2021 5:24 pm
Forum: RouterBOARD hardware
Topic: CCR2004 all port flap
Replies: 4
Views: 813

Re: CCR2004 all port flap

The CCR2004 has issues, so you might be out of luck for now until new software becomes available.
by Cablenut9
Fri Jul 09, 2021 4:42 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

route them via vpn like so: /ip firewall mangle add action=mark-connection chain=prerouting dst-address-list=windows_update new-connection-mark=\ c_windows_update passthrough=yes add action=mark-packet chain=prerouting connection-mark=c_windows_update \ new-packet-mark=p_windows_update passthrough=...
by Cablenut9
Fri Jul 09, 2021 2:39 am
Forum: Wireless Networking
Topic: URGENT HELP remove SIM on wAP ac LTE6 kit
Replies: 20
Views: 976

Re: URGENT HELP remove SIM on wAP ac LTE6 kit

Are you using a SIM adapter? If so, then you might be out of luck.
by Cablenut9
Thu Jul 08, 2021 9:25 pm
Forum: RouterOS v7 BETA
Topic: OSPF distribute-default option is missing [SOLVED]
Replies: 8
Views: 1379

Re: OSPF distribute-default option is missing [SOLVED]

Have you tried 7.1beta6?
by Cablenut9
Thu Jul 08, 2021 9:02 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Does this setup look good? /ip firewall mangle add action=jump chain=prerouting comment=*xbox*.com dst-port=80,443 jump-target=tls protocol=tcp tls-host=*xbox*.com add action=jump chain=prerouting comment=*a-msedge.net dst-port=80,443 jump-target=tls protocol=tcp tls-host=*a-msedge.net add action=re...
by Cablenut9
Thu Jul 08, 2021 8:48 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

you would have to reject that packet with a TCP RST reply and also add the destination address to your address list.
I already added the destination address to the address list, but I can't think of a good way to send a TCP RST. Is there some feature or hack in ROS that can do this?
by Cablenut9
Thu Jul 08, 2021 7:11 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

So, here's a new plan: Match TLS hosts and the action is to jump to a custom chain. This custom chain has rules that simply add both the source and destination to address lists. Later in the prerouting chain, have a rule that matches these address lists and marks routes as going to the VPN.
by Cablenut9
Thu Jul 08, 2021 6:51 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

When does a client first send a packet with the TLS host? I forgot how the process works, but if it doesn't send it at first, then I'm definitely going to have to make another address list.
by Cablenut9
Thu Jul 08, 2021 5:52 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

When you catch that, it is too late to setup the TCP session via another path. Technically true, but HTTP(S) has a native 1/RTT feature that automatically restarts the connection if the path changes. And, if it doesn't work, then no data of value would be lost anyway since all I'm matching against ...
by Cablenut9
Thu Jul 08, 2021 3:46 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Now I have a quadruple-whammy setup that is easy on the CPU and the LTE modem. First, I start with rules that redirect ALL traffic on certain ports that only Windows and Apple devices use. If that doesn't work, I match traffic based on address-lists full of IPs and a handful of domains that can't be...
by Cablenut9
Thu Jul 08, 2021 3:36 pm
Forum: RouterOS v7 BETA
Topic: L3HW User Manual Updated
Replies: 16
Views: 2001

Re: L3HW User Manual Updated

How is there a 7.1beta7 listed if it hasn't been released yet, or are you just keeping it as up-to-date as possible?
by Cablenut9
Thu Jul 08, 2021 3:29 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

HELP! After adding all these domains to the address-list, my router is pulling a perpetual 200kb/s through the LTE modem. Is there a way to extend the TTL for DNS so it doesn't use so much data? Here's an alternative idea I just got: Use L7 regex and the big list of IPs together. However, use L7 to ...
by Cablenut9
Thu Jul 08, 2021 1:10 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

I just found this potential list that could work: https://support.apple.com/en-us/HT210060
by Cablenut9
Wed Jul 07, 2021 10:08 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Is there a similar list for Apple?
by Cablenut9
Wed Jul 07, 2021 7:21 pm
Forum: General
Topic: CCR2004-1G-12S+2XS SFP+ Upload issues
Replies: 15
Views: 1027

Re: CCR2004-1G-12S+2XS SFP+ Upload issues

I had a similar problem and the issue was the SFP+ not autonegotiating to 1 gigabit, so it stayed on 10 gigabit and kept trying to push that kind of signal through a 1 gigabit interface in the other end.
by Cablenut9
Wed Jul 07, 2021 6:29 pm
Forum: General
Topic: CCR2004-1G-12S+2XS SFP+ Upload issues
Replies: 15
Views: 1027

Re: CCR2004-1G-12S+2XS SFP+ Upload issues

The CCR2004 is notoriously bad at switching, so you probably need to use a real switch instead.
by Cablenut9
Wed Jul 07, 2021 6:10 pm
Forum: Beginner Basics
Topic: Disabling2.4GHZ wifi
Replies: 3
Views: 408

Re: Disabling2.4GHZ wifi

/interface wireless disable wlan1
by Cablenut9
Wed Jul 07, 2021 3:14 pm
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43423

Re: v6.49beta [testing] is released!

I'm getting a memory leak too, my device is already using 75% of 128MB in just a few hours.
by Cablenut9
Wed Jul 07, 2021 4:26 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Too late, I already did it! add address=activity.windows.com list=windows_telemetry add address=tile-service.weather.microsoft.com list=windows_telemetry add address=evoke-windowsservices-tas.msedge.net list=windows_telemetry add address=cdn.onenote.net list=windows_telemetry add address=spclient.wg...
by Cablenut9
Wed Jul 07, 2021 4:07 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Now I have the master list, but I need a good way to transfer it to an address-list. I found the quickest manual way was to get into the terminal and keep entering the last command where the domain is replaced with a new one every time. Would it be a good idea to get rid of the list of IP addresses ...
by Cablenut9
Wed Jul 07, 2021 3:52 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

there are official Micro$oft list of domains... LINK The problem is, this has non-Windows stuff as well (like ad domains) but I only need to masquerade addresses that are a "smoking gun" that there is a Windows machine in the network. I found a few candidates here: https://answers.microso...
by Cablenut9
Wed Jul 07, 2021 3:34 am
Forum: Wireless Networking
Topic: 6ghz and Automated Frequency Coordination
Replies: 3
Views: 543

Re: 6ghz and Automated Frequency Coordination

Looks like they're using HTTPS, which is pretty expected. However, this opens up problems like certificates expiring, and the fix might be to make the devices not care about certs. Then, that means I can bypass AFC checks and get more power over my devices :)
by Cablenut9
Wed Jul 07, 2021 3:21 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

You need to have an address-list, like the one crazy-max provides
What about L7 in addition to or instead of address-list?
by Cablenut9
Wed Jul 07, 2021 3:09 am
Forum: Scripting
Topic: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)
Replies: 86
Views: 52802

Re: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)

Explain it section by section, then give the "whole thing" at the end.
by Cablenut9
Wed Jul 07, 2021 3:08 am
Forum: General
Topic: Dollar sign in password
Replies: 5
Views: 496

Re: Dollar sign in password

Reset button, and of that doesn't work then do Netinstall.
by Cablenut9
Wed Jul 07, 2021 3:01 am
Forum: Beginner Basics
Topic: Tunneling VLAN traffic over Wireguard
Replies: 18
Views: 1229

Re: Tunneling VLAN traffic over Wireguard

Clamping MSS also makes things load faster because there's less fragmentation, so adding that rule is always a good thing.
by Cablenut9
Wed Jul 07, 2021 2:23 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

You have to understand that only the (unencrypted!) dns traffic between your Windows Client and the configured DNS Server (I assumed it's the Mikrotik Router) gets inspected/altered. It doesn't matter if you're using DoH on any upstream DNS Resolver. You didn't even come close to what I'm doing. To...
by Cablenut9
Wed Jul 07, 2021 2:14 am
Forum: Wireless Networking
Topic: wAP ac LTE6 HELP on wifi disconnections
Replies: 2
Views: 419

Re: wAP ac LTE6 HELP on wifi disconnections

Post your config with /export hide-sensitive
by Cablenut9
Wed Jul 07, 2021 1:12 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

only (small) dns packets will be matched against the L7 filter. In this case, the TLS version is unimportant. This is basically useless to me as I'm using DoH which hides all the DNS from attackers, but you already knew this. you'd have to use rextended's solution and mark sessions/packets based on...
by Cablenut9
Wed Jul 07, 2021 12:23 am
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Here's the pros and cons for each policy routing method:

Address list pros: Easy (?) on CPU, works with TLS 1.3
Cons: Changes because of CDNs, requires updates

L7 pros: Doesn't require updates
Cons: Hard (?) on CPU, doesn't work with TLS 1.3
by Cablenut9
Tue Jul 06, 2021 11:37 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Now I don't know what to do, use regex or use the address-lists. I probably shouldn't do both because that'd be a waste of CPU resources.
by Cablenut9
Tue Jul 06, 2021 9:52 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Your solution is useless because on close future DoH and DoT are used...
I'm also doing this, complete with verified certificate.
You always want easy things... :-)
I could make a C++ script to do it for me but I'm low on time. :)
by Cablenut9
Tue Jul 06, 2021 9:24 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

How am I supposed to add that into an address-list?
by Cablenut9
Tue Jul 06, 2021 9:21 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

I'm actually trying to make it so all Windows Update traffic gets redirected to a VPN because the device I'm doing this on is a hotspot and I don't want the cellular ISPs to see any Windows stuff. I also made an address-list with a bunch of Windows Update domains but I'm going to do the L7 regex as ...
by Cablenut9
Tue Jul 06, 2021 8:16 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

Re: "TLS Host" option doesn't work

Any help?
by Cablenut9
Tue Jul 06, 2021 7:17 pm
Forum: General
Topic: wApR and LTE (AT&T sim specifically) DENIED
Replies: 9
Views: 1502

Re: wApR and LTE (AT&T sim specifically) DENIED

I see some post about IMEI what was removed and I think no one write the way here. What are you saying here? Anyway, the way to change the LTE6's IMEI is here: https://www.reddit.com/r/mikrotik/comments/nr22yt/changing_the_imei_on_the_mikrotik_lte6_modem_no/ The website is down but the instructions...
by Cablenut9
Tue Jul 06, 2021 3:10 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1672

"TLS Host" option doesn't work

I tried setting the TLS Host in a firewall rule to drop packets to download.windowsupdate.com and then in my computer I did this: curl https://download.windowsupdate.com and it worked. In other worlds, the TLS Host setting didn't work. What's the fix?
by Cablenut9
Tue Jul 06, 2021 1:50 am
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43423

Re: v6.49beta [testing] is released!

Entries appear in the cache and then disappear a few seconds later, rendering DNS caching useless.
This often happens with things like PiHole where it returns a fake address of 0.0.0.0.
by Cablenut9
Mon Jul 05, 2021 11:55 pm
Forum: RouterBOARD hardware
Topic: Chateaux Firmware
Replies: 14
Views: 2657

Re: Chateaux Firmware

There's a super special v7 STABLE version only for Chateau. However, the regular downloader program doesn't know this and tries to download an incompatible version, but it doesn't tell you this. Chateau is also compatible with v7 BETA that is totally different.
by Cablenut9
Mon Jul 05, 2021 8:48 pm
Forum: General
Topic: Feature Request: Change TCP properties in mangle rules
Replies: 5
Views: 379

Re: Feature Request: Change TCP properties in mangle rules

give the ability to change every single aspect of the packet.
This is what I would love from RouterOS.
by Cablenut9
Mon Jul 05, 2021 8:24 pm
Forum: General
Topic: Feature Request: Change TCP properties in mangle rules
Replies: 5
Views: 379

Re: Feature Request: Change TCP properties in mangle rules

as firewall or as Desktop OS?
Both
by Cablenut9
Mon Jul 05, 2021 2:49 pm
Forum: General
Topic: Feature Request: Change TCP properties in mangle rules
Replies: 5
Views: 379

Feature Request: Change TCP properties in mangle rules

I need to be able to change things like the TCP scaling window and timestamp in the firewall, but I can't find any way to. Linux already has these features available, so what gives?
by Cablenut9
Sun Jul 04, 2021 8:17 pm
Forum: RouterOS v7 BETA
Topic: NTP Client is borked
Replies: 6
Views: 711

NTP Client is borked

I can't get NTP Client to work at all on my RB4011 with 7.1beta6. I set it to Enabled, added addresses in the Servers section, yet it refuses to update. The same addresses worked on a different device with v6, so this is likely a bug with v7
by Cablenut9
Sun Jul 04, 2021 3:22 pm
Forum: RouterBOARD hardware
Topic: Holes at the low end of the CRS product line
Replies: 10
Views: 1240

Re: Holes at the low end of the CSR product line

I just need a simple, cheap CRS with 8-10 1G ethernet ports and only ONE SFP+ port.
by Cablenut9
Sun Jul 04, 2021 3:40 am
Forum: Beginner Basics
Topic: Firewall DNS instead of IP address
Replies: 14
Views: 876

Re: Firewall DNS instead of IP address

There's obviously no way to add it directly to the firewall filter, but address lists have the same exact functionality with an extra step.
by Cablenut9
Sun Jul 04, 2021 3:19 am
Forum: Beginner Basics
Topic: Firewall DNS instead of IP address
Replies: 14
Views: 876

Re: Firewall DNS instead of IP address

@Cablenut9 NO, can't, still impossible to add DNS entry on firewall filter. You can only suggest ANOTHER WAY
How is this possible if I have a 200 entry list with DoH domains?
by Cablenut9
Sun Jul 04, 2021 3:05 am
Forum: Beginner Basics
Topic: Firewall DNS instead of IP address
Replies: 14
Views: 876

Re: Firewall DNS instead of IP address

Is it possible to add an ALLOW entry in the firewall that targets a DNS entry instead of an IP address? If so, how?
You can, but it's weird. To do it, make an entry of the DNS name in Address Lists and give it some name. Then, use that address list in your firewall rule.
by Cablenut9
Sat Jul 03, 2021 8:38 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

The Fix: I just changed the WG port to 80 so it uses the same one as HTTP and this will work for now.
by Cablenut9
Sat Jul 03, 2021 7:18 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

WG actually used to work before my RB4011 "bricked" and had to be rebooted, but not it doesn't. :( I can't find any differences between then and now, including the keys.
by Cablenut9
Sat Jul 03, 2021 6:41 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

I'm setting the source port in my WG client to 4430 and I excluded source port 4430 from the NAT, but it's still not working. Is there another way to differentiate them? The WG is hosted on the router.
by Cablenut9
Sat Jul 03, 2021 5:50 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Re: Separate Wireguard and QUIC in firewall rules [SOLVED]

So, all I need to do to do QUIC NAT is to add a rule where dst-port=443 and src-port=1000-65000? Then I add a firewall input accept rule for src-port=443 and dst-port=443.
by Cablenut9
Sat Jul 03, 2021 4:07 pm
Forum: General
Topic: Separate Wireguard and QUIC in firewall rules [SOLVED]
Replies: 10
Views: 1232

Separate Wireguard and QUIC in firewall rules [SOLVED]

I have a setup where I have a webserver that supports QUIC (UDP port 443) and Wireguard which can be any port. To bypass restrictive firewalls, I want it so that both WG and QUIC can work with my NAT but I need some way to differentiate between them. Could L7 filters work or is there a simpler way?
by Cablenut9
Sat Jul 03, 2021 4:10 am
Forum: RouterOS v7 BETA
Topic: v7 launch date
Replies: 124
Views: 13802

Re: v7 launch date

As 7.1beta7 runs stable for a month already I can't complain at the moment.
There's a beta7? Also, if there is a beta7, then I need it soon because my RB4011 keeps bricking itself with Wireguard.
by Cablenut9
Sat Jul 03, 2021 3:14 am
Forum: General
Topic: RB4011 and RB1100 AHx4 "bricks" randomly
Replies: 207
Views: 46414

Re: RB4011 and RB1100 AHx4 "bricks" randomly

I just had to spend 30 minutes on a video chat to reboot my RB4011 away form home, and I had the R2 version!
by Cablenut9
Sat Jul 03, 2021 12:04 am
Forum: General
Topic: RBwAPG-5HacT2HnD (WAP AC) discontinued?, what are my options? [SOLVED]
Replies: 3
Views: 450

Re: RBwAPG-5HacT2HnD (WAP AC) discontinued?, what are my options? [SOLVED]

The antennas are beefed up, but I'm not sure how the transmit power compares.
by Cablenut9
Sat Jul 03, 2021 12:01 am
Forum: Beginner Basics
Topic: Sailboat secondary Router issue
Replies: 10
Views: 670

Re: Sailboat secondary Router issue

I would also upgrade the Groove to a Metal because you'll get better performance.
by Cablenut9
Fri Jul 02, 2021 1:35 am
Forum: Wireless Networking
Topic: LHG 60G Wireless Pipeline Throughput Dopbs by Half
Replies: 3
Views: 558

Re: LHG 60G Wireless Pipeline Throughput Dopbs by Half

Make sure all the antennas are using different frequencies because at the end of the line, the data has to go through all of them and there could be signal leakage. Also, make sure your MCS values are good enough to sustain a fast enough connection.
by Cablenut9
Fri Jul 02, 2021 1:16 am
Forum: RouterOS v7 BETA
Topic: WebFig does not display all routes
Replies: 5
Views: 653

Re: WebFig does not display all routes

This is just yet another issue with v7, so you'll have to wait.
by Cablenut9
Thu Jul 01, 2021 11:07 pm
Forum: RouterOS v7 BETA
Topic: Firewall TCP rules are missing
Replies: 1
Views: 535

Firewall TCP rules are missing

I can't seem to add filters for TCP or IGMP flags/options in v7. However, my v6 devices have options galore for these filters. Will they be added in v7?
by Cablenut9
Thu Jul 01, 2021 8:40 pm
Forum: Wireless Networking
Topic: 60Ghz, it's your turn Mikrotik
Replies: 2
Views: 538

Re: 60Ghz, it's your turn Mikrotik

802.11ay is coming, but the Big Mik at least still has a monopoly on low-cost 802.11ad (Wireless Wire).
by Cablenut9
Thu Jul 01, 2021 8:21 pm
Forum: RouterOS v7 BETA
Topic: RouterOS v7.1beta6: GRE/IPIP tunnel doesn't work [SOLVED]
Replies: 2
Views: 743

Re: RouterOS v7.1beta6: GRE/IPIP tunnel doesn't work [SOLVED]

Mikrotik has a Mik-only keepalive mechanism, so try disabling that.
by Cablenut9
Thu Jul 01, 2021 5:17 pm
Forum: RouterBOARD hardware
Topic: CCR 2004 All SFP Crash
Replies: 8
Views: 1115

Re: CCR 2004 All SFP Crash

Contact the Big Mik's support because this sounds like a hardware problem.
by Cablenut9
Thu Jul 01, 2021 4:12 am
Forum: RouterBOARD hardware
Topic: Powerful hardware quality
Replies: 1
Views: 730

Re: Powerful hardware quality

What else is not worth buy it?
https://youtu.be/8Gv0H-vPoDc
by Cablenut9
Wed Jun 30, 2021 11:23 pm
Forum: RouterBOARD hardware
Topic: CCR 2004 All SFP Crash
Replies: 8
Views: 1115

Re: CCR 2004 All SFP Crash

Give us the result of this: /export hide-sensitive
by Cablenut9
Wed Jun 30, 2021 7:42 pm
Forum: Beginner Basics
Topic: L2TP Question
Replies: 2
Views: 343

Re: L2TP Question

You can't, but you can work around that by using different profiles for the server.
by Cablenut9
Wed Jun 30, 2021 6:05 am
Forum: General
Topic: PCC with different send and return interfaces
Replies: 7
Views: 450

Re: PCC with different send and return interfaces

who's there
The (fire) Wall
by Cablenut9
Tue Jun 29, 2021 11:17 pm
Forum: Beginner Basics
Topic: Dual WAN selective routing; PCC or IP Routing rules?
Replies: 1
Views: 325

Re: Dual WAN selective routing; PCC or IP Routing rules?

PCC is just special IP routing rules, so I would try PCC and see if that works. You can specify any kind of traffic you want to go through any route you want.
by Cablenut9
Tue Jun 29, 2021 7:07 pm
Forum: General
Topic: PCC with different send and return interfaces
Replies: 7
Views: 450

Re: PCC with different send and return interfaces

Do I even need to add the extra rules?
by Cablenut9
Tue Jun 29, 2021 2:59 pm
Forum: General
Topic: PCC with different send and return interfaces
Replies: 7
Views: 450

PCC with different send and return interfaces

I'm using this presentation https://mum.mikrotik.com/presentations/US12/steve.pdf to do PCC. However, I'm getting stuck at the step where I add mangle rules to mark returning packets from WAN interfaces. In my network, I'm using IPIP tunnels to send data out, but due to the way I'm routing the netwo...
by Cablenut9
Tue Jun 29, 2021 2:51 pm
Forum: General
Topic: Allow IPIP from any address in network
Replies: 6
Views: 448

Re: Allow IPIP from any address in network

I guess I would have to do what you said, but in my case about 50 of them.
by Cablenut9
Tue Jun 29, 2021 2:02 am
Forum: General
Topic: Allow IPIP from any address in network
Replies: 6
Views: 448

Re: Allow IPIP from any address in network

Bump
by Cablenut9
Mon Jun 28, 2021 6:38 pm
Forum: General
Topic: Allow IPIP from any address in network
Replies: 6
Views: 448

Allow IPIP from any address in network

I need to make an IPIP tunnel where it can receive packets from any address in a particular network, say 10.0.0.0/8. Is there a way to do this?
by Cablenut9
Mon Jun 28, 2021 5:03 pm
Forum: General
Topic: Can Someone Explain this!!!!
Replies: 7
Views: 609

Re: Can Someone Explain this!!!!

The input traffic is higher because there's some housekeeping stuff happening.
by Cablenut9
Mon Jun 28, 2021 1:23 am
Forum: SwOS
Topic: IPv6 support for SwOS
Replies: 2
Views: 886

Re: IPv6 support for SwOS

RouterOS is only just now getting good IPv6 support, so it's going to be a while before you can do that with SwOS.
by Cablenut9
Sun Jun 27, 2021 7:44 pm
Forum: General
Topic: What is rx-code-error?
Replies: 4
Views: 471

Re: What is rx-code-error?

How does it compare to the FCS system used in L2? It seems like 4B/5B and MLT-3 errors are essentially layer-1 errors and FCS can be affected by this "code error."
by Cablenut9
Sun Jun 27, 2021 6:58 pm
Forum: General
Topic: ARRIS TM822
Replies: 1
Views: 258

Re: ARRIS TM822

Post your configuration here with
/export hide-sensitive
by Cablenut9
Sun Jun 27, 2021 6:37 pm
Forum: General
Topic: What is rx-code-error?
Replies: 4
Views: 471

Re: What is rx-code-error?

Bump
by Cablenut9
Sun Jun 27, 2021 5:03 pm
Forum: RouterBOARD hardware
Topic: Going above 1Gbps - should I replace my router?
Replies: 7
Views: 1114

Re: Going above 1Gbps - should I replace my router?

Just get a CRS305 and use router-on-a-stick to give you 3 SFP+ ports to do anything with.
by Cablenut9
Sun Jun 27, 2021 2:42 pm
Forum: Wireless Networking
Topic: Mikrotik equipments to deploy small WISP
Replies: 6
Views: 718

Re: Mikrotik equipments to deploy small WISP

Watch out, because raising the tower to 20 meters might make the project more expensive overall.
by Cablenut9
Sun Jun 27, 2021 2:05 am
Forum: Wireless Networking
Topic: Mikrotik equipments to deploy small WISP
Replies: 6
Views: 718

Re: Mikrotik equipments to deploy small WISP

The closest thing that would be cheaper is the mANT 15s, although that might not be enough to hold a good link at the very edges of the village. Another even cheaper alternative is to get a Netmetal 5SHP and connect that to a single omnidirectional antenna like this one: https://multilink.us/ubiquit...
by Cablenut9
Sun Jun 27, 2021 1:11 am
Forum: Wireless Networking
Topic: Mikrotik equipments to deploy small WISP
Replies: 6
Views: 718

Re: Mikrotik equipments to deploy small WISP

I would swap out the hAP lites with hAP minis since your speeds are so slow. They are cheaper and have the same specs except for 1 fewer ethernet port and no 802.11ac. To help make up for routing speed, I would use the SXTsq as the actual router and the hAP is just a WiFi access point. If a customer...
by Cablenut9
Sat Jun 26, 2021 4:14 pm
Forum: Beginner Basics
Topic: Is 50% CPU @ 50 MBps reasonable for RB2011 firewall/NAT/queue?
Replies: 5
Views: 682

Re: Is 50% CPU @ 50 MBps reasonable for RB2011 firewall/NAT/queue?

The fix is to just switch to the RB4011 which is literally orders of magnitude more powerful and a lot newer than the RB2011.
by Cablenut9
Sat Jun 26, 2021 3:24 am
Forum: General
Topic: What is rx-code-error?
Replies: 4
Views: 471

What is rx-code-error?

The Mik Wiki says the ethernet "rx-code-error" statistic is just the number of frames with a code error. What does this actually mean? I can't find anything about "ethernet code errors" anywhere.
by Cablenut9
Fri Jun 25, 2021 10:01 pm
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4543

Re: Under flood attack, how resolve this ? [SOLVED]

What's your native language?
by Cablenut9
Fri Jun 25, 2021 3:59 pm
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4543

Re: Under flood attack, how resolve this ? [SOLVED]

Did you get the RB4011?
by Cablenut9
Fri Jun 25, 2021 4:31 am
Forum: General
Topic: From Mikrotik to Ubiquiti UniFi and back to Mikrotik
Replies: 46
Views: 4056

Re: From Mikrotik to Ubiquiti UniFi and back to Mikrotik

If you got Mikrotik APs, you might be able to have all those SSIDs by creating "virtual interfaces" which you then link the VLANs to.
by Cablenut9
Fri Jun 25, 2021 3:03 am
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4543

Re: Under flood attack, how resolve this ? [SOLVED]

Get the RB4011, and maybe you can add a firewall rule in the Raw section that just blocks all UDP except for DNS and QUIC.
by Cablenut9
Thu Jun 24, 2021 9:28 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15631

Re: Newsletter June 2021 (#100)

Sure there often are workarounds possible but apparently it still is the protocol of choice for large-scale ISPs.
Weird, as my provider (AT&T) only does DHCP with public IPs. Is this something that's especially popular with WISPs?
by Cablenut9
Thu Jun 24, 2021 9:00 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15631

Re: Newsletter June 2021 (#100)

PPPoE is a "funky setup"? 100% of our deployments are PPPoE. PPPoE became pointless as soon as dialup got replaced by cable modems and optic fibers. Today, DHCP and plain old ethernet work just as well and you have no PPPoE limitations to deal with. (aka a login that is limited specific t...
by Cablenut9
Thu Jun 24, 2021 8:05 pm
Forum: RouterOS v7 BETA
Topic: USB ethernet NIC is reported as LTE interface
Replies: 3
Views: 779

Re: USB ethernet NIC is reported as LTE interface

Many LTE modems appear as USB ethernet adapter. It's likely someone reported LTE modem that wasn't appearing as such and they just assigned same USB class to be LTE modems... This is pretty lazy, as basically all LTE modems support AT commands and other cellular function and no USB Ethernet adapter...
by Cablenut9
Thu Jun 24, 2021 4:09 am
Forum: RouterBOARD hardware
Topic: Block diagram "1 Gb/s": full or half duplex? [SOLVED]
Replies: 1
Views: 1364

Block diagram "1 Gb/s": full or half duplex? [SOLVED]

I noticed that the Wireless Wire can do a full duplex gigabit connection, yet the wAP 60G's block diagram shows a "1 Gb/s" link between the CPU and the ethernet port. Therefore, is a 1 gigabit link in a block diagram actually 2 gigabits because it can go either way? It would be nice if thi...
by Cablenut9
Thu Jun 24, 2021 2:22 am
Forum: RouterOS v7 BETA
Topic: Adding 3rd party packages
Replies: 5
Views: 934

Adding 3rd party packages

I just checked out OpenWRT's gigantic list of optional packages and it's scary how many there are and how many extra features you can get. Meanwhile, with Mikrotik, you only get what comes with RouterOS. Would it be possible to add the ability to install 3rd party packages in ROS v7?
by Cablenut9
Wed Jun 23, 2021 6:45 pm
Forum: General
Topic: to many winbox/dude sessions
Replies: 13
Views: 3463

Re: to many winbox/dude sessions

What license level do you have? Depending on it, you can only have so many sessions at one time.
by Cablenut9
Wed Jun 23, 2021 1:53 am
Forum: The User Manager
Topic: PROBLEM WITH MULTIPLE SAME USER PPPOE - HELP PLEASE
Replies: 3
Views: 1194

Re: PROBLEM WITH MULTIPLE SAME USER PPPOE - HELP PLEASE

Why is that spam-type posts are always about PPPoE?
by Cablenut9
Tue Jun 22, 2021 4:15 am
Forum: General
Topic: VLANs and address assignment
Replies: 8
Views: 535

Re: VLANs and address assignment

I'm actually thinking of making a ROAS setup where none of the ports are on a bridge, so they're all routed and can either have the same or different addresses.
by Cablenut9
Mon Jun 21, 2021 11:46 pm
Forum: RouterOS v7 BETA
Topic: USB ethernet NIC is reported as LTE interface
Replies: 3
Views: 779

USB ethernet NIC is reported as LTE interface

I'm using a hAP ac3 with a USB->Ethernet dongle and for some reason, v7beta6 thinks it's an LTE interface. It seems to work just fine, but almost nothing can be changed other than the MTU. I also can't add this interface to a bridge. The chip used inside the dongle is a common Realtek NIC, so what g...
by Cablenut9
Mon Jun 21, 2021 6:52 pm
Forum: General
Topic: VLANs and address assignment
Replies: 8
Views: 535

VLANs and address assignment

If I have some interface, like ether1, and a bunch of VLAN interfaces on it, like vlan2 and vlan3, does ether1's IP address "carry over" to the VLANs? If so, is there a way to disable this?
by Cablenut9
Mon Jun 21, 2021 4:59 pm
Forum: General
Topic: Lte passthrough not working...
Replies: 5
Views: 379

Re: Lte passthrough not working...

What version are you using?
by Cablenut9
Sun Jun 20, 2021 8:41 pm
Forum: Wireless Networking
Topic: P2P Link with SXTsq 5 AC for 3.5 KM link
Replies: 6
Views: 722

Re: P2P Link with SXTsq 5 AC for 3.5 KM link

There's no way to say for sure, so if you already have the SXTsq then it's worth a shot.
by Cablenut9
Sun Jun 20, 2021 8:37 pm
Forum: Wireless Networking
Topic: P2P Link with SXTsq 5 AC for 3.5 KM link
Replies: 6
Views: 722

Re: P2P Link with SXTsq 5 AC for 3.5 KM link

You can try it, but you won't get full speed. They have a chart showing what speed you can expect and to get the full 802.11ac speed, you'd have to stay within about 2km or 4km for the Disc.
by Cablenut9
Sun Jun 20, 2021 7:09 pm
Forum: RouterOS v7 BETA
Topic: OSPF distribute-default option is missing [SOLVED]
Replies: 8
Views: 1379

Re: OSPF distribute-default option is missing [SOLVED]

They did away with the default route as part of the instance configuration. From the help docs: All route distribution control is now done purely with routing filter select, no more redistribution knobs in the instance. This gives greater flexibility on what routes from which protocols you want to ...
by Cablenut9
Sun Jun 20, 2021 7:05 pm
Forum: Wireless Networking
Topic: P2P Link with SXTsq 5 AC for 3.5 KM link
Replies: 6
Views: 722

Re: P2P Link with SXTsq 5 AC for 3.5 KM link

You should get a Disc Lite5 ac instead, as the SXTsq is just plain wimpy for a 3.5KM connection.
by Cablenut9
Sun Jun 20, 2021 6:30 am
Forum: RouterOS v7 BETA
Topic: OSPF distribute-default option is missing [SOLVED]
Replies: 8
Views: 1379

Re: OSPF distribute-default option is missing [SOLVED]

They did away with the default route as part of the instance configuration. From the help docs: All route distribution control is now done purely with routing filter select, no more redistribution knobs in the instance. This gives greater flexibility on what routes from which protocols you want to ...
by Cablenut9
Sun Jun 20, 2021 3:36 am
Forum: General
Topic: /31 addresses
Replies: 1
Views: 312

/31 addresses

What's the deal with /31 subnets and Mikrotik support? I heard that you can't use them with ROS, although this might have been only a v7 thing.
by Cablenut9
Sat Jun 19, 2021 5:59 am
Forum: RouterOS v7 BETA
Topic: OSPF distribute-default option is missing [SOLVED]
Replies: 8
Views: 1379

OSPF distribute-default option is missing [SOLVED]

Yet another problem with v7 OSPF! I can't find a distribute-default setting anywhere for creating a default OSPF route. I need this for a network I want to build, but since it's not available in v7 yet, I'm out of luck. Will it ever be added again?
by Cablenut9
Sat Jun 19, 2021 3:25 am
Forum: Forwarding Protocols
Topic: Use OSPF with /32 subnets
Replies: 5
Views: 781

Re: Use OSPF with /32 subnets

I already selected the PtP network type, but it didn't work. I also set up loopback interfaces and added them to the interface templates. For some reason, I can't ping the other routers with /32 addresses even though all that connects them is a simple ethernet cable, and there's no firewall rules a...
by Cablenut9
Sat Jun 19, 2021 2:49 am
Forum: Forwarding Protocols
Topic: Use OSPF with /32 subnets
Replies: 5
Views: 781

Re: Use OSPF with /32 subnets

I already selected the PtP network type, but it didn't work. I also set up loopback interfaces and added them to the interface templates. For some reason, I can't ping the other routers with /32 addresses even though all that connects them is a simple ethernet cable, and there's no firewall rules at...
by Cablenut9
Sat Jun 19, 2021 12:02 am
Forum: Forwarding Protocols
Topic: Use OSPF with /32 subnets
Replies: 5
Views: 781

Use OSPF with /32 subnets

Is there a way to get OSPF working with Mikrotik routers that have /32 addresses? I'm interested in having a network where every router has only ONE unique address. If I used /24 or even /30 subnets, each router has multiple addresses I can route to. However, I only want one (1) address per router a...
by Cablenut9
Fri Jun 18, 2021 6:26 pm
Forum: General
Topic: My ISP ( WiLogic ) uses MikroTik Routers and without a doubt..
Replies: 25
Views: 1431

Re: My ISP ( WiLogic ) uses MikroTik Routers and without a doubt..

What if there was a special user available that had access to WebFig but with a "barebones" skin? Then all they can do is look at the logs to help support and add port-forward rules and nothing else.
by Cablenut9
Fri Jun 18, 2021 5:36 pm
Forum: RouterOS v7 BETA
Topic: OSPF interface templates don't properly match
Replies: 0
Views: 779

OSPF interface templates don't properly match

I'm setting up a barebones OSPF network between 2 hEXes with 7.1beta6 and using the OSPF interface templates, it can't match the instance to either an interface or network, but rather only when both the interfaces and networks are set. In the official Mikrotik Wiki, it shows this working with only o...
by Cablenut9
Fri Jun 18, 2021 2:29 am
Forum: Forwarding Protocols
Topic: Networking Education
Replies: 13
Views: 4213

Re: Networking Education

like one serial number and corresponding license?
This is genius, because the only people who post on this forum have at least 1 Mikrotik device.
by Cablenut9
Thu Jun 17, 2021 10:32 pm
Forum: Forwarding Protocols
Topic: Networking Education
Replies: 13
Views: 4213

Re: Networking Education

good post like it
the rain wets
It's a bot
by Cablenut9
Thu Jun 17, 2021 7:58 pm
Forum: SwOS
Topic: CSS106: Bricked? [SOLVED]
Replies: 1
Views: 1248

Re: CSS106: Bricked? [SOLVED]

Update: I fixed it by setting up a ping on my computer and by restarting it until the backup firmware loaded. Then, I set up a good static IP on the switch and let it download the new firmware.
by Cablenut9
Thu Jun 17, 2021 6:21 pm
Forum: SwOS
Topic: CSS106: Bricked? [SOLVED]
Replies: 1
Views: 1248

CSS106: Bricked? [SOLVED]

I just got a CSS106 and tried to upgrade the firmware. After waiting a few minutes, I rebooted and noticed that the version is unchanged. I tried it again and now the firmware is 2.7p. I kept trying this again a few more times, and now the switch can't get DHCP or have its webpage accessible. I can ...
by Cablenut9
Thu Jun 17, 2021 5:02 pm
Forum: General
Topic: Make a user group with specific permissions [SOLVED]
Replies: 3
Views: 433

Re: Make a user group with specific permissions [SOLVED]

I made an ultra-limited skin in WebFig and as it turns out, the new user group I made can't change the skin, so this is just what I needed. :)
by Cablenut9
Thu Jun 17, 2021 5:40 am
Forum: General
Topic: Make a user group with specific permissions [SOLVED]
Replies: 3
Views: 433

Make a user group with specific permissions [SOLVED]

Is it possible to make a user group that can read and write certain things only? If I give someone a router that I can control, I want them to be able to add dst-nat rules so they can port forward without needing to contact someone. However, I don't want them to be able to do anything else. I saw th...
by Cablenut9
Thu Jun 17, 2021 1:36 am
Forum: Wireless Networking
Topic: Which Outdoor Directional AP should i choose for my backyard? [SOLVED]
Replies: 5
Views: 1066

Re: Which Outdoor Directional AP should i choose for my backyard? [SOLVED]

The mANTBOX 12s is better because it can receive signals better than the SXT2, and that's important with devices that can't send much out to begin with.
by Cablenut9
Thu Jun 17, 2021 12:43 am
Forum: Wireless Networking
Topic: Which Outdoor Directional AP should i choose for my backyard? [SOLVED]
Replies: 5
Views: 1066

Re: Which Outdoor Directional AP should i choose for my backyard? [SOLVED]

If you can afford it, get a mANTBox 52 15s which has both 2.4 and 5GHz, giant antennas, high transmit power, and a slick-looking package in one.
by Cablenut9
Wed Jun 16, 2021 8:30 pm
Forum: General
Topic: 1:1 NAT DDoS protection?
Replies: 7
Views: 543

Re: 1:1 NAT DDoS protection?

If the router at the datacenter is equal to or less powerful than the one at the real network, then I can still do stuff at the protected network and I only have to think about the one at the datacenter. That basically means the NAT is a sacrificial setup that simply protects me from giant attacks.
by Cablenut9
Wed Jun 16, 2021 7:55 pm
Forum: General
Topic: 1:1 NAT DDoS protection?
Replies: 7
Views: 543

Re: 1:1 NAT DDoS protection?

The idea is to use the NAT as a choke point so the "real" network only gets as much as the router can pass through. That's actually what Cloudflare does, but on a bigger scale. Also, it's to help hide the real IP so it can't be targeted directly.
by Cablenut9
Wed Jun 16, 2021 5:42 pm
Forum: General
Topic: I want to use ISP2 for populair speedtest sites and also android apps
Replies: 2
Views: 306

Re: I want to use ISP2 for populair speedtest sites and also android apps

You can't do this if they use HTTPS, which most sites are, so you're probably out of luck. However, you could make a hack solution that checks how much data each connection is using and add that address to a list that ensures that they are used by ISP2.
by Cablenut9
Wed Jun 16, 2021 5:29 pm
Forum: General
Topic: Hardware recommendation for routing up to 2Gb/s
Replies: 6
Views: 576

Re: Hardware recommendation for routing up to 2Gb/s

You could combine a CRS305 and a RB4011 and get great routing with multiple SFP+ ports, and that's the next cheapest option after getting a CCR1036 with only 2 SFP+ ports.
by Cablenut9
Wed Jun 16, 2021 4:40 pm
Forum: General
Topic: 1:1 NAT DDoS protection?
Replies: 7
Views: 543

1:1 NAT DDoS protection?

Is it possible for me to use 1:1 NAT as a DDoS protection system? If I had some Mikrotik router colocated in a datacenter that had one firewall rule that creates a 1:1 NAT to my real IP address, then all people would see is the Mikrotik's address. However, this seems too simple to work, so will it?
by Cablenut9
Tue Jun 15, 2021 9:02 pm
Forum: Wireless Networking
Topic: 6.47.10 failure: frequency 66960 not supported on this interface
Replies: 4
Views: 1153

Re: 6.47.10 failure: frequency 66960 not supported on this interface

Mikrotik support wrote

this will be available on new 802.11ay hardware.
Unfortunately this cannot be used reliably on our existing 802.11ad devices - that is why this frequency support is removed
Sad, because Ubiquiti supports 71GHz on their 802.11ad hardware, which is way higher.
by Cablenut9
Mon Jun 14, 2021 8:42 pm
Forum: Wireless Networking
Topic: WIFI 6 Roadmap
Replies: 97
Views: 59664

Re: WIFI 6 Roadmap

Another thing with 6E is that the AFC system for outdoor usage won't be working until 2022, but of course I'll be working on a way to bypass it (through dst-nat rules!) when it goes live.
by Cablenut9
Mon Jun 14, 2021 5:27 am
Forum: General
Topic: Selective 1:1 NAT
Replies: 1
Views: 296

Selective 1:1 NAT

I have a weird setup I want to try. Let's say I have two routers and some client on some network. R1 (DHCP server) | R2 (switch/DHCP-proxy) | Client (LAN) I want R2 to act like a layer-2 passthrough, so basically a switch between the two ports that connect it to R1 and LAN. However, I want some rule...
by Cablenut9
Mon Jun 14, 2021 1:00 am
Forum: General
Topic: CCR smart cards
Replies: 1
Views: 318

CCR smart cards

Why do a few of the CCR models have a slot for a smart card? I can only think that they could be used for user authentication, but I don't know why you'd need to do that.
by Cablenut9
Mon Jun 14, 2021 12:20 am
Forum: RouterOS v7 BETA
Topic: R11e-LTE6 not working in 7.1beta6
Replies: 8
Views: 1201

Re: R11e-LTE6 not working in 7.1beta6

There are lot of reports with beta6 not working with LTE, do the fix is to either to go to beta5 or switch to v6.
by Cablenut9
Sun Jun 13, 2021 3:41 pm
Forum: General
Topic: wApR and LTE (AT&T sim specifically) DENIED
Replies: 9
Views: 1502

Re: wApR and LTE (AT&T sim specifically) DENIED

You can't send PMs on this forum.
by Cablenut9
Sun Jun 13, 2021 3:28 pm
Forum: Wireless Networking
Topic: Can't register SIM of mobinnet
Replies: 5
Views: 930

Re: Can't register SIM of mobinnet

I sometime have the same problem, but the fix was to simply get better reception of a tower.
by Cablenut9
Sat Jun 12, 2021 7:43 pm
Forum: RouterOS v7 BETA
Topic: R11e-LTE6 not working in 7.1beta6
Replies: 8
Views: 1201

Re: R11e-LTE6 not working in 7.1beta6

This is a common issue with beta6, go back to beta5.
by Cablenut9
Fri Jun 11, 2021 3:48 am
Forum: RouterOS v7 BETA
Topic: Feature Request : IPv6 Fasttrack
Replies: 19
Views: 2481

Re: Feature Request : IPv6 Fasttrack

Why isn't this a thing yet?
by Cablenut9
Wed Jun 09, 2021 4:24 am
Forum: Scripting
Topic: Some Music
Replies: 16
Views: 25818

Re: Some Music

RB4011 doesn't have a beeper :)
by Cablenut9
Sun Jun 06, 2021 2:45 am
Forum: Forwarding Protocols
Topic: A weird routing problem
Replies: 4
Views: 978

Re: A weird routing problem

Update: I think IPIP might work for this because it simply puts an IP header on top of the original IP packet. Then, the outer layer can be processed as if it were regular inter-network traffic, so normal routing will work for that. When the packet reaches the destination router, the inside gets ext...
by Cablenut9
Sun Jun 06, 2021 12:01 am
Forum: Forwarding Protocols
Topic: A weird routing problem
Replies: 4
Views: 978

Re: A weird routing problem

If I add R3 as the default route on the R2 VRF, does that mean I can't use R2 as a gateway for some traffic from R1?
by Cablenut9
Sat Jun 05, 2021 10:49 pm
Forum: Forwarding Protocols
Topic: A weird routing problem
Replies: 4
Views: 978

A weird routing problem

Let's say I have three Mikrotik routers, and each router has its own route to to to the Internet. R1 --- Internet | R2 --- Internet | R3 --- Internet I can set up OSPF so each router knows the best path to any destination on this routed network. However, I need a way for some traffic on R1 to reach ...
by Cablenut9
Thu Jun 03, 2021 5:17 am
Forum: Wireless Networking
Topic: R11e-4G change IMEI
Replies: 2
Views: 1967

Re: R11e-4G change IMEI

What error do you get with the 4G? If it has to do with "Production Mode" then this article might be handy: https://jghuff.com/blog/modem/
by Cablenut9
Thu Jun 03, 2021 2:05 am
Forum: General
Topic: Weighted load balancing
Replies: 1
Views: 337

Weighted load balancing

Is there a way to use PCC to give some routes more weight over another? It looks like PCC only does equal-weight which means each route has an equal Cha ce of being picked, but I'd like to have a setup where it prioritizes one gateway over another, so that if one is slower yah nthe other it doesn't ...
by Cablenut9
Mon May 31, 2021 2:17 am
Forum: Wireless Networking
Topic: USA Regulatory Domain - UNII-4 and UNII-2
Replies: 7
Views: 827

Re: USA Regulatory Domain - UNII-4 and UNII-2

That was a lot of words that boil down to "I don't agree with the laws so I choose to ignore them." That was the whole point of my post, as sometimes you have to do what you have to do. The firmware frequency/power locks requirement went into effect a bit over 5 years ago, so this is not ...
by Cablenut9
Sun May 30, 2021 9:50 pm
Forum: Wireless Networking
Topic: USA Regulatory Domain - UNII-4 and UNII-2
Replies: 7
Views: 827

Re: USA Regulatory Domain - UNII-4 and UNII-2

As such, what you're suggesting is illegal in the US, unfortunately. To clarify, not illegal to posess but illegal to use. Like clockwork, I get this boilerplate line every time something like this is brought up. However, there are a couple counterpoints: -> Many FCC rules are outdated or aren't en...
by Cablenut9
Sun May 30, 2021 6:44 pm
Forum: Forwarding Protocols
Topic: Setting OSPF interface cost by speed
Replies: 2
Views: 942

Setting OSPF interface cost by speed

On Cisco routers, you can change OSPF cost based on a couple bandwidth numbers and an equation based on those numbers. Is there a way to do this with Mikrotik?
by Cablenut9
Sun May 30, 2021 3:46 pm
Forum: Wireless Networking
Topic: USA Regulatory Domain - UNII-4 and UNII-2
Replies: 7
Views: 827

Re: USA Regulatory Domain - UNII-4 and UNII-2

Your idea would absolutely work for the standard/international version of the hardware! This inflexibility is a regulatory restriction that caused Mikrotik to have to ship a completely separate version of every device: the standard models that are completely configurable to the limits of the actual...
by Cablenut9
Sun May 30, 2021 4:03 am
Forum: Wireless Networking
Topic: USA Regulatory Domain - UNII-4 and UNII-2
Replies: 7
Views: 827

Re: USA Regulatory Domain - UNII-4 and UNII-2

Hotfix: Use Superchannel mode to get these new frequencies without having to upgrade to some future version for now. Mikrotik is usually sloooow to add new features, so it may be a while.
  • 1
  • 2