MikroTik

own3r1138

Totally unrelated, but I could not stop myself.
@sindy, hope these make your ordinary day, extraordinary!

Screenshot 2024-08-22 000313.png

own3r1138

up I guess
when I access it by the IP it loads the router's login page instead of the web server, so no forwarding.

A wild guess, the MT local web server is configured on the same port number as the dst-nat rule in the firewall.

 ip service set www port=81

own3r1138

There was a possibility that OVPN router can get a "Kernel Failure". If you have a router running OVPN and it sometimes reboots due to a Kernel Failure, then upgrade and see how it goes. If the problem remains, then of course contact support@mikrotik.com and send supout file. Thank you ve...

own3r1138

It would be awesome if someone could elaborate.

What's new in 7.16rc2 (2024-Aug-13 10:05):
*) ovpn - improved system stability (additional fixes);

own3r1138

What should I put instead of the question mark? . CLI tool fetch address=ftp src-path="export/$name" user=imirsay@kooshkoo.iapp.ir mode=ftp password=00 dst-path="directory/subfolder/$name" upload=yes Note: It's recommended that use SFTP if the transfer is over a public network.

own3r1138

:local name  [/system/identity get name]
system/backup/save name="disk/backup/$name"

own3r1138

Firstly - You should set the certificate full-chain in your IPsec identity. /ip ipsec identity add auth-method=eap-radius certificate="ISRG Root X1,Let’s Encrypt R11,letsencrypt-autogen_2024-07-12T03:09:26Z" generate-policy=port-strict mode-config=ike2 peer=ike2-peer policy-template-group=...

own3r1138

DELETE

own3r1138

Issue is we cannot use windows must be Linux so learning on the fly

MikroTik user-manager

own3r1138

when running systemctl status mariadb receive the following: Is this before or after you change the database info? What I meant by.PHP file was 'daloradius/library/exten-radius_server_info.php'. Not what you have done. However, If the screenshot has been taken before you make a mess, as the log sug...

own3r1138

#47 The default firewall configuration tool for Ubuntu is UFW https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu #48 You could leave the src-address as it is. #49 Check the status of the service 'systemctl status mariadb', if the service is running, then it ...

own3r1138

should my nas client that was added through the GUI on daloradius also show up in my clients.conf within /etc/freeradius/3.0/clients.conf? No, But it shows up in your database. Regarding the firewall, you should allow/accept incoming traffic to 3799/UDP on your ROS, and 1812-1813/UDP on the Freerad...

own3r1138

so I ran the following to install daloradius: https://docs.beamnetworks.dev/en/linux/networking/freeradius-daloradius And can access the page at ipaddress/daloradius and notice a bunch more tables but what I had entered in through apache is now gone? Because in the Daloradius installation, you impo...

own3r1138

disregard last post, have added in my nas and a couple of users again, do I need to create my packages now as well? Basically once daloradius is setup, what is my next step?

Read #18 more carefully.

own3r1138

I tried to setup LetsEncrypt to grab cets in the hope I could use them for Adguard, but I hit a wall with LE needing webfig port 90 open as I have Caddy on my network and Port 80 dstnatted to the server IP. I can't work out any other way to get a valid certificate for my domain into my Adguard cont...

own3r1138

One has nothing to do with the other. PHPmyadmin is related to managing databases, and Daloradius is a GUI for Freeradius.

own3r1138

As you've got the Adguard running, why not go the extra step, configure the DoH on the container, and point the MT DNS server to the DoH address?
All the clients should be able to take advantage of Adguard.

own3r1138

I prefer the Daloradius UI, which is way better than poking around a .conf file. Furthermore, you could use an app like NTRadPing to check the radius config. client localhost { ipaddr = 127.0.0.1 # ipv4addr = * # any. 127.0.0.1 == localhost # ipv6addr = :: # any. ::1 == localhost proto = * secret = ...

own3r1138

but now i can access the open vpn but cant access the lan-network

I didn't understand, elaborate, please. It would be great if you could export your config and share it.

/export hide-sensitive ters

own3r1138

 /interface ovpn-server server export-client-configuration

own3r1138

can you tell me how I can copy my entire clients.conf file so that I can have this reviewed possibly? i.e. copy and paste the entire file, I can only copy what is currently displayed

thanks

https://1gbits.com/blog/nano-select-all-copy-all/

own3r1138

the radcheck table in freeradius server is where all my users are setup, correct?

Correct

own3r1138

Do you use a .local TLD for both of the NASs?

own3r1138

I ain't sure what kind of services your NAS provides, you might need a mDNS service.

own3r1138

The "10.255.255.0/30" is the local subnet of the Wireguard peers, nothing special.
Why DNS configuration? for the NAS?

own3r1138

Freeradius includes several config files. The directory name might not be the same as my instance, which runs on RHEL distribution. However, the file names are the same.
/etc/raddb/clients.conf = NAS config file
/etc/raddb/radiusd.conf = Freeradius config file

own3r1138

That is an installation plus a basic setup, which doesn't contain any configuration.

own3r1138

Sorry for the dumb question but what is ROS and RAS, I have most setup in router os on my mikrotik, security profiles, etc Didn't know what type of authentication type should be used? Thanks ROS = Mikrotik RAS = Freeradius https://wiki.freeradius.org/guide/Mac-Auth https://wiki.mikrotik.com/wiki/Ma...

own3r1138

Same here, using the local IP address of the WG peer in Netwach as an src-address doesn't pass the traffic through the WG tunnel, instead, it goes out from the main interface.

own3r1138

It's not that simple. It would help if you shared more detailed information about your configuration. I assume you are missing a ton of configuration, as you didn't provide any. Firstly, the "radiusd -X" is a mode in which Freeradius operates on a debug mode. You could exit from it with Ct...

own3r1138

It also has a duplicated NAS client.

rlm_sql (192.168.88.1): Client "test mikrotik" (sql) added
rlm_sql (sql): Adding client 10.108.21.198 (test mikrotik 2) to global clients list
Failed to add duplicate client test mikrotik 2
Failed to add client, possible duplicate?

own3r1138

Of course, it's possible with the scripting. Furthermore, as suggested earlier, the Netwatch option is more suitable for the task. However, I still wonder why, as the distance should be enough for the failover. Perhaps you could elaborate more? I didn't understand the meaning of your previous remark...

own3r1138

You're welcome. Out of curiosity, why did you need to create separate OVPN servers for each client?

own3r1138

The technical answer is that you can use a Let’s Encrypt certificate as a client certificate. You cannot, however, use your Let’s Encrypt certificate to sign an additional client certificate which is what you want.

own3r1138

Did you enable the use of profiles?

/user-manager set use-profiles=yes

own3r1138

Everything you need is in these three links.

https://help.mikrotik.com/docs/display/ROS/Container
https://hub.docker.com/r/jc21/nginx-proxy-manager
https://nginxproxymanager.com/guide/#quick-setup

own3r1138

You could create three separate ovpn clients with the same routing table and use the distance in the route list for failover.

own3r1138

ppp active remove [find where encoding!="AES256-CBC" and service=sstp]

own3r1138

Zero Trust

own3r1138

viewtopic.php?t=182459

own3r1138

And still you refer to LOTS of problems but it's only you ?

viewtopic.php?t=205246#p1063059

own3r1138

Feature added, will be available within next testing version, 7.15beta10

Hooray

own3r1138

/system logging set 0 topics=info,!fetch

own3r1138

Bro, The version you are running doesn't support GCM ciphering. You could use CBC. However, you are missing the Key size. Protocol TCP Auth sha1 Cipher AES-CBC with any key size . This setting must be the same on the server and the client profile. Wrong: cipher AES-CBC [ at client profile] Correct: ...

own3r1138

Protocol TCP Auth sha1 Cipher AES-CBC with any key size. This setting must be the same on the server and the client profile.

own3r1138

Well, it seems as if your ROS is an older version that supports TCP protocol only. It doesn't support GCM as your client profile.

own3r1138

This should be fixed at the OVPN server too.

own3r1138

2024-04-08 15:15:38 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2024-04-08 15:15:38 TLS Error: TLS handshake failed

cipher AES-256-GCM
auth SHA1

cipher AES-256-GCM
data-ciphers AES-256-GCM
auth none

own3r1138

Welcome to the club, we are having this issue since 7.7 release.

own3r1138

viewtopic.php?p=818662&hilit=user+manager+2fa#p818321

own3r1138

sad-cat.jpeg

own3r1138

1- The format drive of a USB is broken for some reason. My hAP AC3 shows that the file system is unknown after an update from 7.13 to 7.14. OS downgrade with formatting (EXT4) was omitted. It started to work fine, then I saw the 7.15b4 change log: disk - improved support for formatting ext4 file-sys...

own3r1138

@rextended
Will you share your contact info?

own3r1138

*) firewall - increased default "udp-timeout" value from 10s to 30s;
It wasn't applied after the update to v17.14.

own3r1138

Everyone has their agenda. All I know is what usually brought me here is no longer here, which is not in the best interest of anyone.

own3r1138

I'm not concerned about who got bullied or who got banned.
The only thing I'm talking about is the documents that are no longer available because of this discussion.

own3r1138

no. some other things were attempted. some people got banned, some got demoted from moderator status and got really mad :D I did not know MT was in the business of getting people mad. I think this forum is where one could get help. This discussion and the way MT handled the issue harmed the forum.

own3r1138

This has to be fixed.

Until now, the only outcome of this discussion was a few guideline posts being removed.

own3r1138

could you please post your working script? Script :local dohServers {"https://record-a.domain.tld/dns-query";"https://record-b.domain.tld/dns-query";"https://record-c.domain.tld/dns-query";"https://record-d.domain.tld/dns-query"} :local dohServerAvailable fal...

own3r1138

/system logging add prefix=--->IPSEC topics=ipsec,!packet

own3r1138

I'm not familiar with NPS. I utilize the User-manager, Freeradius.
The Strong-Swan log isn't helpful. I strongly recommend enabling the IPsec logging at MT. It will have more details regarding the session.

own3r1138

Intermidiate cert is installed and specified in Identity No joy? What is your radius server? User-manager? Enable the system logging for IPsec, try to establish a connection once more, export the latest IPsec and user-manager configuration, along with logging entries, and share it, please. Also, ca...

own3r1138

viewtopic.php?t=189832

own3r1138

The user-manager is for Radius which wireguard doesn't support.
change log 7.12:
*)wireguard - allow to specify client settings under peer menu which will be included in configuration file and QR code

own3r1138

Create your own.
https://docs.docker.com/build/building/multi-platform/

own3r1138

I watched this video before, But I want to access these file through Internet without authentication and connect to MikroTik network Only using a Domain Link and some custom driectories Something like this : https://sub.domain.com/dir/file.txt You don't have to have any AUTH if you don't want to. P...

own3r1138

https://www.youtube.com/watch?v=pmyVQS93HMM

own3r1138

Do you have a SUP ticket to reference for this? Thank you!

MikroTik support #[SUP-131841]

own3r1138

Could you please generate a supout file on your router after IPsec has experienced unexpected disconnect and send it to support@mikrotik.com? Without any evidence we can not be sure about that, but seems that the problem might not be caused by the RouterOS: https://forums.macrumors.com/threads/sono...

own3r1138

Yes, that is a common issue with IPsec. People configure "more secure" IPsec settings (PFS, 256 bits, DH with long keys) and then it only works between routers but not with commonly used client devices... The worst is that it requires ongoing research to know what settings are supported i...

own3r1138

On iOS 17 devices, established IKE2 peers will disconnect after 24 minutes of being connected. The disconnect happened after rekeying sent by the responder and then rejected by the initiator. ROS = 7.11.2, 7.12rc1 Responder PFS= none 14:13:28 ipsec --->IPSEC: -> ike2 request, exchange: CREATE_CHILD_...

own3r1138

Known limitations Windows will always ignore networks received by split-include and request policy with destination 0.0.0.0/0 (TSr). When IPsec-SA is generated, Windows requests DHCP option 249 to which RouterOS will respond with configured split-include networks automatically. Moreover, Strongswan...

own3r1138

In previous days, Apple released iOS 17, after which I got lots of reports from IKEv2 EAP clients on Apple devices running this version that they were disconnected after 8 minutes when utilizing a previously created connection to the update. However, they couldn't connect at all when they tried with...

own3r1138

What version?
I think this is due to adding IPv6 support for VETH.
You can check with "interface/veth/print" in the terminal. If you close the window in the Winbox and don't click OK or Apply, It should work as expected.

2023-08-31_15-51-17.png

own3r1138

Any way to get it again with a new expiration date?
Where to get it, do you know?

https://support.mozilla.org/en-US/kb/se ... ertificate

own3r1138

Were you in your underground bunker?
Yes, It seems that it's expired.

Screenshot 2023-08-28 045700.png

own3r1138

@own3r1138, version ROS? Not working:-(

ROS 7, The address list is 100% correct. You should work on your mangles.

Screenshot 2023-08-27 101709.png

own3r1138

Here is what I use. Although, this is for the ECMP. However, one can change that. /ip firewall address-list add address=149.154.160.0/22 comment="Telegram Messenger Inc" list=AS62041 /ip firewall address-list add address=149.154.164.0/22 comment="Telegram Messenger Inc" list=AS62...

own3r1138

It will be just like this one.
*) Winbox - allows to set multiple addresses and added IPv6 support under the "Interface/VETH" menu;

own3r1138

*) wireguard - added "wg-add-client" configuration wizard (CLI only);
*) wireguard - added "wg-export" and "wg-import" functionality (CLI only);

Thank you very much.

own3r1138

You're welcome.

own3r1138

36fc2361959b56bad15a97bdeff62b5f.jpg

own3r1138

RSA
https://help.mikrotik.com/docs/display/ ... entication

EAP
https://help.mikrotik.com/docs/display/ ... outerOSv7)

own3r1138

I have a valid dynamic IP which is obtained via PPPOE. However, BTH didn't have a direct IPv4 connection. 2023-08-08_02-26-21.jpg Apparently it was not possible to connect to it, maybe ISP blocking something Well, I use the main WG tunnel daily. Does the BTH check the tunnel connectivity from your ...

own3r1138

MikroTik relay is only involved in this case. IF you have public IP, it's just a direct wireguard, no relay.

I have a valid dynamic IP which is obtained via PPPOE. However, BTH didn't have a direct IPv4 connection.

2023-08-08_02-26-21.jpg

own3r1138

@strods
Will you fix the IPsec EAP RAS authentication with EC certificates, please?
SUP-124151

own3r1138

Unfortunately, there's no way to get 7.11rc1 back from the website.

https://download.mikrotik.com/routeros/ ... -arm64.npk

own3r1138

It does work on MT. You should follow this article about containers in MT.
The Technitium documentation is also available here.

1.jpg

2.jpg

3.jpg

own3r1138

Sadly the IPSec problem mentioned here viewtopic.php?t=197095&start=300#p1014852 is still present in this version.

My home setup suffers from the same issue. It also doesn't work with SSTP, which is sad.

own3r1138

I use this for IPv4. Perhaps, you could also use it with IPv6. My code ([/interface pppoe-client monitor [find name="interface-name"] once as-value]->"local-address") Try this CLI in your terminal and see if it shows your IPv6 as a return to your query. Then, you can use it in yo...

own3r1138

Then WG needs more entities to do that. The external IP-address/domain and the allowed address range to be able to generate such a config file: Not everybody knows their public IP address. A dynamic domain is then easier and then we are back with the original APP by MT. For those who have a fixed p...

own3r1138

Well done, Although It would be awesome if Mikrotik could implant the WG Wizard in the main Wireguard section so one could use it for peer config generation like what we have now in OVPN.

own3r1138

next beta will have ipv6 support for veth:
Code: Select all
add address=172.17.0.3/16,fd8d:5ad2:24:2::2/64 gateway=172.17.0.1 gateway6=fd8d:5ad2:24:2::1
as well as multiple addresses

Thank you, this is good news.

own3r1138

Since the pool is just an allocation, you don't need to break it up unless you have a very large network. Normally you would just add an ipv6 address from the pool with a /64 prefix hint and set it to advertise.

Example:

2023-07-06_22-29-09.jpg

own3r1138

I rather generate the QR code locally.
crash fix

2023-07-04_20-58-45.jpg

own3r1138

I am on quite a bit and can certainly assist in removing spam. I am also cat friendly.
Some of my best posts are not actually my own!
...
gateau.jpg

I think your cat is trying to say something to you. Is it concerned about the pile of junk on your keyboard?

own3r1138

Solution found: let'sencrypt, as default, generate ECDSA key, unsupporte by mikrotik. Use --keytype rsa on certbot command to generate a let'sencrypt RSA key, that works on mikrotik. Thank you for taking the time and document it. However, if one creates the certificate with MT "/certificate en...

own3r1138

Thank you.
Interesting, I have to check this one out.
*) system - reduced RAM usage for SMIPS devices;

own3r1138

What's new in 7.11beta2 (2023-Jun-21 14:39):
*) certificate - restored RSA with SHA512 support;

own3r1138

Hello, It would be great if you could elaborate on this. Does anyone use IKEv2 EAP with the user manager? Shared users/Max simultaneous sessions don't work as they should when IKEv2 is used. The first connection gets disconnected when the next one is trying to connect. It does work with PPP sessions...

own3r1138

This not helpful, that is shown if i use ppp or hotspot or usermanager ….etc, i would like to know what is the maximum users without any of those type of connections.. just i will use it as a DHCP Server . Well, If what you want to implant is not limited by the license tier, then you are not affect...

own3r1138

https://help.mikrotik.com/docs/display/ ... cense+keys

own3r1138

I thought ovpn was something cooked up by those using non ipsec routers and using merlin and other after market hack firmwares to emulate VPN. https://forum.mikrotik.com/viewtopic.php?t=196619#p1005390 Are you saying that OVPN is possible where Wireguard is not? YES I would have thought zerotier a ...

own3r1138

Anyone who uses OVPN knows that anything higher than 7.7 will render OVPN unusable.

own3r1138

@AUsquirrel, Thank you.

own3r1138

7.10 (almost) stable. Just get rid of OVPN and solves a bulk of issues.

ezgif.com-optimize.gif

own3r1138

This work regardless the RouterOS date format

Thank you very much.

own3r1138

Mine is working correctly.
V7.7, V7.10
strong-crypto=yes

2023-06-16_21-34-23.jpg

Bitvise Client log

2023-06-16_21-31-57.jpg

own3r1138

@rextended Would you revive this for me, please? It doesn't work correctly anymore. :local arrMonths {jan="01";feb="02";mar="03";apr="04";may="05";jun="06";jul="07";aug="08";sep="09";oct="10";nov=&quo...

own3r1138

https://help.mikrotik.com/docs/display/ ... Ev1)tunnel

own3r1138

Yes.

Well explained, thank you.

own3r1138

Is there any known issue when IPv6 mangles are being used? ROS 7.9.2

2023-06-07_11-47-20.jpg

2023-06-07_12-33-12.jpg

own3r1138

ipv6 dhcp-server bug report.

2023-06-02_00-32-25.jpg

own3r1138

I guess they are identifying large TLS traffic to single outside country endpoint (with maybe exclusion of some common safe domains) as suspect and then throttle upload to that endpoint which limits then vpn/proxy connection speed to point of uselessness. IR has different types of censorship on dif...

own3r1138

No, What they did was putting a significantly higher price for services. So they can use our own F money for doing the F filtering.
They are cheap as F.

own3r1138

Even if you somehow block this, how do you plan to block for example Shadowsocks + v2ray on 443 port with TLS1.3?

You can ask this from the IR government, they successfully blocked it.

own3r1138

At least do the effort then to provide supout from recent 7.10-chain where this still happens. Well, the ticket was opened in 2022. It doesn't mean I did not update it. https://forum.mikrotik.com/viewtopic.php?t=196061#p1001122 https://forum.mikrotik.com/viewtopic.php?t=193986#p987137 2023-06-01_09...

own3r1138

If you experience problems with OVPN even after 7.10rc installation, then please let us know about that through support@mikrotik.com. Several issues regarding the OVPN service have been addressed in v7.10. The last visible changes regarding OVPN were in 7.10B5. I didn't check the newer releases bec...

own3r1138

Thanks for the suggestion. They were helpful. Right? YES Would it work? NO Imagine that Mikrotik would need to query the DNS names of my network, for any type of validation. Then in the RouterOS DNS server settings, the VPN DNS server address would be placed. Rephrase, please. Export your config mi...

own3r1138

I use WG for this tunnel. However, the principle is the same. . /ip firewall mangle add action=mark-connection chain=prerouting comment="DNS VIA VPN" dst-port=53 log=yes new-connection-mark=dns-via-vpn passthrough=no protocol=tcp src-address="192.168.88.5-VPN-CLIENT" /ip firewall...

own3r1138

Most of us don't have a rocket ship to get there so keep dreaming. OVPN is like a zit that won't go away Once we get rid of the useless OVPN code, there will be tons of room, for Zerotrust Cloudflare tunnel WITHIN ROS , let alone as an options package for all devices. Until MT releases a ZT.npk for...

own3r1138

I can NOT delete this.

own3r1138

OVPN is one of the few protocols which still not blocked in the Pleiades.

own3r1138

@Mikrotik,
What do we need to do? For you to fix the OVPN issues. These OVPN issues have been around for four months now.

own3r1138

I welcome any suggestions to improve the script. 2023-05-31_18-09-18.jpg . :local IPv6 "true" :local APIurl "https://USER:TOKEN@ipv4.tunnelbroker.net/nic/update?hostname=TUNNEL-ID&myip=" :global WANInterface "PPPOE" :local previousIP "" :local WANip "...

own3r1138

Good, you're welcome.

own3r1138

Can you separate the list=name? Because I can not create more complex scripts. :D W8 on that. :d I rather not mess with your firewall. I don't feel comfortable enough for that. You need to set a unique comment for this entry in your list=unexpected-src-address-hitting-ISP. :local currentIP [/ip dhcp...

own3r1138

In which case you would also have to remove the old one? Sorry, my mistake. I didn't think about this part. How do you set the crontab? . /system scheduler add name=ip-list interval=00:00:15 on-event="script-name OR simply paste the below script" . :local currentIP [/ip dhcp-client get [f...

own3r1138

Thank you, Finally. :put [$str2base64 ("\00\00\01\00\00\01\00\00\00\00\00\00\03wwww\07example\03com\00\00\01\00\01") "nopad"] AAABAAABAAAAAAAAA3d3d3cHZXhhbXBsZQNjb20AAAEAAQ :put [$str2base64 ("\00\00\01\00\00\01\00\00\00\00\00\00\03wwww\06google\03com\00\00\01\00\01") &...

own3r1138

Check the official config example.
https://help.mikrotik.com/docs/display/ ... entication
Use Strongswan on Android clients.

own3r1138

https://help.mikrotik.com/docs/display/ ... outerOSv7)

EAP is working fine on MT. Use Strongswan on Android clients.

own3r1138

Perhaps you could also use a script if the IP address changes too frequently. You can set an interval as you like.

:local currentIP [/ip dhcp-client get [find interface=ether1] value-name=address]
/ip firewall address-list
add address=$currentIP list="unexpected-src-address-hitting-ISP"

own3r1138

Check the cached record ttl.

own3r1138

Okay, I will keep the default one for now. Can you check the functionality of the script? My DOH is an Adguard-home container. It responded to the default record in the terminal. Well, thank you. I'm reading the https://forum.mikrotik.com/viewtopic.php?p=977576#p977769 right now. What are these [] i...

own3r1138

Enable the DDNS and use the record as an entry in your address list.

/ip cloud set ddns-enabled=yes
/ip firewall address-list
add address=33445566.sn.mynetname.net list="unexpected-src-address-hitting-ISP"

own3r1138

I tried the final script, but it didn't work even with the default request record of www.example.com. How should I encode the requested record? I have tried several online Base64url encoders, none of which worked with the error status "400 bad requests". 2023-05-29_05-02-23.jpg . PS C:\Use...

own3r1138

Hi, It doesn't work with DoH.

This command doesn't exist.

:put [resolve www.domain.tld use-doh-server="server" ]

2023-05-29_03-45-13.jpg

own3r1138

What is src-address-list=\ssh_blacklist in you command? A brake line from your export?

Maybe you could use the import by file command.

import file-name=file.rsc

own3r1138

I want to create a service health check script that monitors my DoHs. I couldn't get it done with my poor scripting skill. I surely appreciate any help. Original script :log info "DNS HealthCheck Started" :local currentDNS [/ip dns get use-doh-server] :local DoHMain "https://record.do...

own3r1138

1 - You leaked out your device SN in your export.
2 - You have a Fasttrack rule with no disabled=yes, which can be the source of your issue. You can use /routing/rules as @Anav mentioned or use connection-mark=no-mark in your Fasttrack filter rule.

own3r1138

Do you have Fasttrack enabled on MT?

own3r1138

You're welcome. I have too much shit going on. I rather not confuse anyone.

2023-05-28_15-18-07.jpg

own3r1138

13.jpg

1.jpg

2.jpg

3.jpg

4.jpg

5.jpg

6.jpg

7.jpg

8.jpg

9.jpg

10.jpg

11.jpg

12.jpg

own3r1138

Hurricane Electric Tunnel Broker Example for Home

2023-05-26_16-03-31.jpg

own3r1138

Supout file contains sensitive information. One should not share it publicly.
https://mikrotik.com/client/supout

own3r1138

try this

/ip ipsec peer
add address=78.39.x.x/32 name=Profile-Test profile=Profile-Test send-initial-contact=yes

/ip ipsec policy
add dst-address=78.39.x.x/32 src-address=185.x.x.x/32 protocol=47 level=require peer=Profile-Test proposal=Profile-Test

own3r1138

2023-05-22_12-52-26.jpg

own3r1138

Did you check if the ports are bonded with www and www-ssl services?

own3r1138

MT, show him that he is wrong.

own3r1138

I see, so the order in post #12 is okay if you wish to use it.

own3r1138

In the screenshot, you have at least 13 filter rules. Now you have less than that. What is going on? /ip firewall filter add action=accept chain=input comment="Established, Related, Untracked" connection-state=established,related,untracked add chain=input action=drop connection-state=inval...

own3r1138

The order does matter. export all of your /ip firewall filter and share them.

own3r1138

Stopped or disabled? Did you check this after PPPOE reconnected?

own3r1138

own3r1138

There is not much to it. Reboot after applying these rules. If you Marked your QOS, you could also use connection-mark=no-mark in the Fast-track rule. add action=accept chain=input comment="Established, Related, Untracked" connection-state=established,related,untracked add action=fasttrack...

own3r1138

Did you mean Fast-Track?

own3r1138

What is the DNS for your DHCP?
Provide a network diagram, please.

own3r1138

Do you use DHCP-client and PPPoE-out on the same port?

own3r1138

I think user-man with an attribute of framed-ip-address=x.x.x.x for that user.
If the number of users is not large and you don't want to set up any Radius, you could also use remote-address=x.x.x.x.

own3r1138

VTI, IPsec queue

own3r1138

*) ovpn - improved system stability

The supout file is available, Ticket #SUP-96432.

own3r1138

viewtopic.php?t=196061

own3r1138

Use a tar file. The pull still has problems.

own3r1138

Internal? Elaborate, please.
The host is your ROS. So you should add a rule to dst-nat your public-ip:8080 to your veth-ip.

Parameters
-p 8080:8080 - Binds the service to port 8080 on the Docker host, required

own3r1138

/ip firewall nat

own3r1138

Out of curiosity, why can't you use it?

own3r1138

It should have a valid certificate. Both IKEv2 Identity and user manager will use that. Otherwise, one should import the CA.

own3r1138

You could also use IKEv2 EAP.

https://help.mikrotik.com/docs/display/ ... outerOSv7)

own3r1138

What happened between old ROS releases and newer ones?
The v7.7 shows unreachable routes with RED color in the "/ip route" However, the latest 7.9rc5 release doesn't!

2023-04-30_08-17-13.png

own3r1138

1- pull the image with Docker or Podman.
2- save image-name > name.tar
3- use the.tar file to create a container.

own3r1138

And he only has one eye!!

The Eye of Barad-dûr

hqdefault.jpg

own3r1138

There is an Alpha version 7.10.39 out, which fixed the CPU utilization problem on 7.8.
In the meantime, stay on 7.7 if you have an OVPN server running.

own3r1138

The log indicates that the connection is stuck in the security association.
Export your config and share it. Someone might find out where the problem is.

own3r1138

/system logging
add prefix=--->IPSEC topics=ipsec,!packet

share the full log.

own3r1138

I want the lan pc that is connected to port 2 able to connect to 192.168.0.5 web interface without manually changing their ip address. . /ip firewall nat add action=src-nat chain=srcnat comment=modem dst-address=192.168.0.5 protocol=tcp dst-port=80,443 out-interface=ether1 src-address=192.168.50.40...

own3r1138

No, I await for response in the forum. If no progress is achieved here, I will raise a support ticket. Force AES It doesn't have this on V7. Both the PFS option and clients' certificate verification were disabled. FQDN? Let's Encrypt doesn't support using IPs in their certificates. Yes, I used FQDN.

own3r1138

Downgrade and check again. Moreover, it looks like the new RC version is working correctly.

2023-04-19_06-05-10.png

Regards,

own3r1138

/ip firewall address-list
add address="duck-dns-record.domain.tld" list=name

Now use this as a dst-address-list in your NAT rule.

own3r1138

The new user manager doesn't have a web interface for admin. Therefore you should use CLI or Winbox.

own3r1138

 /user-manager set use-profiles=yes

own3r1138

How are you generating the certificates for the SSTP server?

Let's Encrypt & CF API

Are those certificates marked as trusted on both ends (if they're not from a trusted CA)?

Yes

2023-04-18_12-37-22.png

own3r1138

The goal is to establish an SSTP tunnel between two Mikrotik endpoints.
Does RouterOS support the EC certificate on the SSTP server?

own3r1138

It does work fine with the RSA certificate. Therefore I conceive the certificate key type plays a role in the error. Furthermore, the EC certificate works well with the www-ssl service and user manager. 2023-04-17_11-18-47.png I have also tried a Windows SSTP client connection without success. The u...

own3r1138

I changed the SSTP server certificate from RSA 2048 to EC secp384r1, and the client is getting an ssl: fatal alert handshake (6) error. Has anyone else experienced this issue?

own3r1138

@own3r1138 Thank you very much for the script, I've put it onto my router and it already began to ban the IP's with failed attempts from the past logs

You're welcome. However, all the credit goes to Jotne & Rextended, creators of the script.

Regards,

own3r1138

disable this line and try. /ip dhcp-client add disabled=no interface=ether1 This is also wrong as the PPPoE should be your WAN, not the ehter1. /interface list member add comment=defconf interface=ether1 list=WAN "I think perhaps I should give my ISP a mac address but I dont know which one to g...

own3r1138

1 - A script to block the IP addresses. https://forum.mikrotik.com/viewtopic.php?p=905420#p906705 2 - By adding the allowed address list that contains your location. https://mikrotikconfig.com/firewall/ https://www.iwik.org/ipcountry/ Wireguard https://forum.mikrotik.com/viewtopic.php?t=182340 Peers...

own3r1138

It seems yes!
It's been two days passed I've downgraded everything's fine

Don't use queue or interface binding with 7.7. It'll cause a crash again.

own3r1138

Thank you for the answer, but it doesn't help me. I need a tutorial because all I tried fails.

Unfortunately, I don't have any tutorial for it. However, if you are interested, I could configure it for you via a remote desktop.

own3r1138

My container has been running on 7.8b3 since I started it 32 days ago. Perhaps an older build would run? DB https://nginxproxymanager.com/setup/#using-mysql-mariadb-database 2023-04-09_23-55-46.png . /container mounts add dst=/data/ name=nginx-proxy-data src=/pcie1-part1/containers/mounts/nginx-prox...

own3r1138

I couldn't get the Traefik container to work too. Therefore I decided to use nginx-proxy.

own3r1138

There is not much to it. Firstly, import your certificate. Secondly, you should create and configure an OVPN client interface to your server requirements. Thirdly, you should create a new routing table and rules to route whatever you want through your VPN tunnel. Perhaps one could use IP/firewall/ma...

own3r1138

@MT
We are not able to track this problem down/repeat it in our internal tests.

own3r1138

Is OVPN still unstable like in 7.8 or is that already fixed?
I'm very interested in this too, anyone tried it?

No, it has not been fixed. Instant crashes due to high CPU utilization.

own3r1138

2023-04-01_06-27-06.png

own3r1138

7.7 and 7.8beta3 are the most stable in recent releases for the OVPN server.

own3r1138

2023-03-29_17-09-31.png

own3r1138

Still, no OVPN fix on this release despite numerous reports about the instance kernel crashes from 7.8 RC to 7.9 B.

own3r1138

Auto-renewal doesn't work. You can use scripts for renewal later on.

own3r1138

I'm having the same problem here, on an RB4011. After updating to 7.8, the system has a kernel error and restarts before completing 5 minutes of uptime. I have about 150 ovpn connections.

https://www.youtube.com/watch?v=XhI2dNzRpHY

Search found 801 matches