MikroTik

The simplest way to perform an update is through Winbox in the "container" section, and then in CMD with the command "--update". That's entirely contingent on what inside the container is responding to that flag. If RouterOS ever gets a CoW/overlay image system, this method will...

just reset router to default router configuration Yes. Building a firewall from scratch is either an educational exercise, a hold-my-beer stunt, or a sign that you're way up at the top end of the expertise curve. And incidentally, I happened to have roached my RB4011 since my prior post, giving me ...

maybe it should be deleted? The "D" in the flags column means it's a dynamic rule, created by the router when you add the fasttrack rule. If you try to delete it, the OS will give a complaint like "cannot remove builtin". Does it make router less safe? RouterOS wouldn't automati...

Knee-jerk observation: you're mixing your IGMP/MLD versions. It is best if they are the same throughout the entire network, including on the stream sinks and sources. The spec says the presence of IGMPv2 must make the entire network degrade from v3 to v2, but Windows at least ignores that advice, wh...

I will download the bttest for windows tool and try again. My test will be like this: LAPTOP <---> CRS328 <---> RB4011 For that test, running my iperf3 container on the RB4011 will give more useful results. I can get 7-9 Gbit/sec across my CRS328 that way, depending on where the bottlenecks are.

Not sure about the state of docker storage driver for zfs The main issue remaining there is a limitation in Linux regarding user-mode creation and mounting of new filesystems. ZFS on other platforms allows this, including the ability to delegate the "create" and "mount" permissi...

Do you know if there are any issues or limitations with the Docker Hub registry

https://www.docker.com/blog/revisiting- ... xperience/

"[cont] error response getting manifests: 401". HTTP code 401 is “unauthorized,” which leads to us asking what you're doing that requires authorization. Since RouterOS can’t push layers, and this is a public repo, the only other likely reason is that you were experimenting with DH login c...

Can't ping docker.com or docker.io from mikrotik's terminal

You will find that you can’t ping it from anywhere else, either. It’s a bogus test; their network admins have blocked ping. Try an HTTPS pull instead.

I doubt it, due to the perverse incentives currently set up. The same company that tells you they care about DDoS attackers and spammers on their networks also sells data by the byte. When more bytes = more $$, why would they put cost-center resources into shutting any of that down? The abuse@ email...

The optimist sees the glass as half-full.

The pessimist sees it as half-empty.

The engineer says the glass is twice as large as it needs to be.

Therefore the only correct answer is 100%. If it's showing anything less, you bought more router than you needed. QED.

0: Remove "defconf" comments everywhere If I had my way, any configuration edit affecting an entry with a defconf comment would automatically remove that comment. At the same time, if you've left a given defconf element unchanged, the comment should be left untouched. It's telling you som...

I’d like something reliable The heart of my backup script — kindly linked above by @BartoszP — is as reliable as computer software gets, being the version control system behind SQLite. Fossil not only keeps the SQLite project itself running, its repository format is an application of SQLite. Roughl...

What about the ping issue? A faction convinced MikroTik to make that a feature in 7.16, even though it goes against all history of how ping works. Stopping the last server bound to eth0 on a classic Linux box doesn’t cause ping to stop, but now it does for veth on ROS. The stated logic for this is ...

Would be happy to get rid of additional VMs / Wine. @phascogale is right: setting up a Linux VM is far "…easier than the explained process for Windows." Further defense and details . None of that would change with a native macOS build. It would suck for all the same reasons, and I tell yo...

https://tangentsoft.com/mikrotik/wiki?n ... +Home+WiFi

It would already be helpful when there was a separate script output by e.g. /system/default-firewall/print, in a way that can be cut/paste.

That’s why I established my defconf collection. Cut and paste from any that’s close enough to your use case.

There is no "connecting" going on here. IPTV is generally UDP multicast, selected by an IGMP group-join message going out, with the intervening devices sending the request along. With a router between the multicast sender and receiver and different IP subnet schemes on each side, you will ...

http://live555.com/proxyServer/

ax lite lte…If it's not for you, no major losses. Those can also be pressed into a number of auxiliary uses like travel routers, spare hubs, media converters, etc. if the primary use case falls through. If the initial experiment does end up working out, it can be a second AP. The main risk is the &...

i'm configure registry url, username, password and get 401 error. You're trying to set it as username:password, but password= is a separate setting: /container config set ram-high=512.0MiB \ registry-url=http://10.10.10.4:5000/v2/ \ tmpdir=/usb1-part1/temp \ username=megauser111 \ password=dsadaskl...

As a VLAN outsider, this all looks excellent to the point that I can see myself directing newbies at it and saying, “Just do it this way.” Save the fiddly details for those who actually need to know them. One thing I don’t see, though: a canned way to reliably create the “management” VLAN without lo...

Remember that each router has switch build in so if is configured properly you do not see the difference. That presumes that you haven't done one of the many, many things that will cause hardware forwarding to devolve to software bridging, not all of which can be classed as a misconfiguration. Some...

…the bandwidth limits are given from the target interface’s perspective, not that of your client. Are you saying, @tangent, that upload and download settings should be reversed when setting up a simple queue? Given that my configuration feeds two CAKE queues into a simple queue where the max-limit ...

I agree with you that if your nearest CDN is less than 30ms away - and you aren´t trying to communicate worldwide, that regional is a good setting. Am I not gambling that my furthest commonly-used CDN is less than 30ms away, and that the consequences of being wrong occasionally are minor? However, ...

There is no setting "registry-ur".

I'd love to have the fans constantly turning at about 400RPM. I feel that would keep my system cool, and be silent.

You need a much bigger fan to meet that expectation. 120mm kind of thing, through a matching hole punched directly into the case lid.

Add a dstnat firewall rule.

This is what the Docker/Podman --publish flag does for you automatically, which you must do by hand on RouterOS. Details.

Never bridge VETH interfaces with physical ports, it will disable hardware forwarding. "Never" is overly strong, but because it's a consideration worth taking into account, I've added it to the list of consequences at the end of the article where I recommend this practice. It already had ...

As a home user, my needs are simple, but I wrote up my configuration anyway. It will serve as a report on my experience, and perhaps you will see an error I’ve made and advise me.

https://tangentsoft.com/mikrotik/wiki?n ... our+Switch

- First dhcp server is active in fiber modem using 192.168.1.0/24 network. MikroTik router gets WAN ip from fiber modems dhcp server. This DHCP server cannot be turned off. Sure about that? The first web search result I got for "Genexis fiber bridge" is this , which should expose your MT ...

That leaves you with two further options, then: the separate build+save method, optionally coupled with a Skopeo pass. Now that I've had time to think about it, the second option is feeling more likely to result in success. There's a third option: push to Docker Hub, then have ROS pull the image rem...

Comparing what you've done to my successful Makefile , I see a few possible explanations: Use of "buildx" instead of "build". The distinctions are collapsing as BuildKit becomes the default, but in this instance you don't need any of the advanced features of the old BuildKit, in ...

Try “touch”ing a file in that directory.

If it fails, there’s your problem, reduced to a simpler level than SQLite.

If not, is there a sqlite3 binary in that image? If so, use it to try creating a DB in that directory. A simple query like “CREATE TABLE a(a)” will force a file write.

Due to the connectionless nature of UDP, you might be able to do that with a single switch rule. Something like:

/interface ethernet switch rule
dst-port=5678 protocol=udp vlan-id=11 \
mirror=ether2 new-vlan-id=12

(Untried. I don’t use VLANs here.)

The front-panel labels give the default configuration of those ports' Internet/LAN roles. Nothing in RouterOS prevents reassigning those ports to different roles. Contrast the “PoE in” label, which informs you of a hardware limitation. You can’t move that role at will; there is no mere configuration...

add an ULA address Yes, that's a superior solution, because it solves a second, related problem: what to put in for "/ipv6/nd/set … dns=??" Before, I was using ::1 from my ISP-assigned GUA pool, but now I'm telling peers to send it to the ULA. Because the ULA range isn't advertised, none ...

In prior versions, this worked: /ipv6/firewall/nat add action=dst-nat chain=dstnat dst-port=53 protocol=udp to-address=::1/128 add action=dst-nat chain=dstnat dst-port=53 protocol=tcp to-address=::1/128 The intent behind this is to redirect all IPv6 DNS requests from the LAN to the local DNS server ...

Thank you, @EdPa. I was not looking forward to needing to filter these useless comments from my text backups, and I found no use for these inconsequential complaints in WinBox for each of my currently-unused ports.

Already reported here.

there is a "REST API" Better ? MT has mentioned "serial passthrough" in some forum postings, similar to USB passthrough. Is that something that exists, or is merely acknowledged as having made it from our wishlist to theirs? That is, are you asking for serial control to be added...

I've updated my Container Limitations article to cover these latter details. I chose not to address the topic's primary question since you can cause this same port number conflict under Docker and Podman, too, most easily by giving the --host flag. I can't justify calling this a "limitation&quo...

In a full-featured container engine, you have to do both, but now that you mention it, yeah, container.npk ignores the EXPOSE directive, doesn’t it?

Without having tried it, I’m willing to guess that they’re both trying to bind to the same port, likely 8080. You can’t have two programs (pihole and nginx in this case) binding to the same TCP port on the same IP address. If I’m right, giving one of the two a different port will require rebuilding ...

Why are all of my unused network ports now marked with red "not running" errors in WinBox and matching comments in "/interface/bridge/export" output? Unused ports is not an error. I'm not going to remove these ports from the bridge just because there isn't something plugged into ...

I don´t use Winbox Then that leaves me wondering how you managed to produce eight redundancies in that configuration, plus one outright conflict. This configuration is cleaner and simpler while saying very nearly the same thing: /interface wifi configuration add name=homeapcfg ssid=Kraailook countr...

@erlinden, I have changed the configuration: You should read my guide more carefully. It goes to some trouble to explain how and why to solve the redundant and conflicting configuration you've got going on here, doubtless owing to use of WinBox instead of the CLI. I wonder if this is part of the re...

While I see what you're trying there, @baragoon, have you actually made that work on RouterOS short of building a custom image? One of the many limitations of container.npk is that it won't break a command like "tail -f /dev/null" up into three parts for you before calling "tail"...

That's not how that one is documented as needing to be run. Being a "client" type program, it does start, run briefly, and then stop, quite on purpose. More to the point, if you don't set up logging per those docs, you get no useful output from that run. A better test here is my iperf3 con...

I don’t see that you’re trying to start it after “add”. That isn’t automatic.

If you continue to have trouble, try one of my several single-static-binary containers. Going straight to Ubuntu or PiHole is playing the game on Hard mode and skipping the game tutorial besides.

According to a past thread this is a 64-bit CPU, though possibly run in 32-bit mode. You have to target the CPU you’re running, not “ARM” generally. Details of word size affect kernel interfaces, etc. Instead of targeting specific image layers, pull the image by name using “docker pull --platform=li...

Read this . It not only describes one common way to get exactly what you ask for, it links to the reasons not all IPv6 devices do that. Reflashing proprietary smart plugs with ESPHome and similar isn’t the only option. A lot of these things use mDNS to announce themselves by name, so you no longer ...

Not really arguing. Just pointing out that while I’m trying to help, there are people with actual clues here, and you might have cause to give their advice more weight than mine.

In evaluating my replies, realize that I've only ever done a single /64 at a time . I have this loony idea that having eighteen bazillion IPv6 addresses on a single LAN is enough . If you want someone who actually understands IPv6 at a carrier scale, you want to talk to people like @tdw. Y'all have ...

Yes; those NDP packets have to transit some type of medium to get from ether1 to ether4/6. If not a bridge, then you say what, but a bridge is one of the more sensible options.

That's getting beyond the scope of the question and into local network design principles, which you are the best authority on. That said, how else did you expect these SLAAC messages to get from the ISP to the individual internal LAN router interfaces? (Serious question! Did you have a different pla...

This:

/interface bridge port
interface=ether4 unknown-multicast-flood=yes

Do that for every port along the NDP multicast path, from ISP ingress.

From those thin details, my only guess is that you’re trying to instantiate a 32-bit (ARMv6 or v7) OCI tarball on your shiny new 64-bit router. (ARMv8)

If you want better guesses, give more details.

That can happen due to overzealous multicast filtering, IGMP bugs…

The simplest path is to allow unknown multicast on ports toward the NDP source, same as you’d mark those links “trusted” to get DHCPv4 answers.

I just had to revert another device from 7.17beta4 to 7.16.1 owing to these DHCP changes. This latest beta utterly wrecked an existing configuration:

7.17beta5 appears to have fixed this symptom.

I've successfully upgraded a hAP ax³, a CRS328-24P, and an RB4011 (wired-only) to beta5.

All RouterOS devices are running 7.17beta2. I doubt this is a beta bug… The NDP+routing misconfiguration identified by @tdw and marked as this thread's "solution" is only part of the solution. The rest did turn out to be a beta bug, fixed in 7.17beta5: *) switch - updated dynamic switch r...

You always need a target device responding before it does anything.

For TCP, you may be right, but UDP is spoofable unless it takes specific measures to guard against it. (Three-way handshakes, cryptographic authentication, etc.) If not, it’s a potential attack bandwidth amplifier.

accept-router-advertisements=yes

Where did I say you were all wrong with your guidance? Outright, never, but you've now taken this crusade up three different places*, a sign that you're seeking approval to go on doing what you originally planned to do in the face of good advice. Then when people get annoyed, you get defensive. wha...

1- when configured as router with the usual subnet 192.168…. we loose some access to the rest of the network and most importantly all access to Bonjour printers so that in particular people with phones or tablets can’t print. Very frustrating I can't tell from the absence of the setting whether you...

Strange, @infabo, maybe you are not running jitter/loss sensitive sessions and you did not look at the logs? I've got logs from my ax³ going back to August, and I see only 55 instances of "not responding" in that time, the first being 41 days ago, so roughly once a day. The only WiFi bug ...

Why does the router even have an FTP service if we simply should never use it? At a guess, it's because of a combination of RouterOS being a quarter century old and that it isn't always used across the open Internet. Just because a feature is present doesn't mean it is wise to use it in all situati...

I created a separate user for FTP and applied a new group to it that only has FTP access and read/write access. 🤦‍♂️ You just “… grant[ed] write access to the router's configuration …” to that FTP user. I realize that just above this on the same page it says you need ftp+write to allow FTP uploads,...

One of the advantages of SSH over WG in cases like this is trivial client isolation. The easy path with WG puts them all on the same LAN, but if the remote Pis don't have good reasons to see each other, now you need to set up barriers between each WG endpoint. With the "ssh -N" option — lo...

how to configure the MikroTik x86 server Replace it with a $5/month VPS. That will buy you a terabyte of transfer a month, enough CPU to manage the encryption, and the public IP the remote Raspberry Pis connect to. how do I connect to the remote host? Each Pi gets a serial number, which is either t...

Run an SSH tunnel out to a public host, each with a unique port as "serial number" identifying the client location.

The writing has been on the wall warning you to get off PPTP for twenty-six years ! Before we get to what you should do now that it’s an emergency, would you mind saying why didn’t you act while you still had the ability to use PPTP as a bridge to supported technology? I can not get…their admin to a...

Is your modem in bridge mode?

Try following my guide. It documents what worked here.

The damage from having duplicate IPs can last ~10 minutes after disconnecting the offending device as the ARP caches time out.

When you try this again, you likely want to configure the second RB5009 as a smart switch, not as a router.

Those were two separate questions, port-forwarding and public IP. A good many ISP-supplied modems do give port-forwarding capabilities without needing a public IP. Alternately, a good many can be put into bridge mode, allowing your hEX to acquire the public IP from the ISP directly, easing VPN setup...

an old hEX, that can offload IPSec encryption, but that is IPSec singular benefit. Granted, no question. It’s just that after you factor your time in, it might net out cheaper to drop in a 2024 hEX. you forgot a loopback and GRE tunnel parts in your list ;). I am planning my next MikroTik Solutions...

IKEv2 is a bit more complex to setup… A bit? Hah! More like 3-10× more complicated, depending. Let's see: Three ports you need to forward through the firewall, not one. The vastly over-engineered X.509 certificate system vs Base64 hex strings for keys. Working out how each third-party vendor has ma...

As a MikroTik forum, this isn't the best place to get advice on third-party solutions. If your VPN tech of choice is not among those that ship in RouterOS — or at least offer a compatible interface allowing interoperability — then you're risking having your posts deleted as off-topic here. In partic...

There are a bunch of different VPN technologies built into RouterOS, largely because there isn't a single definition for what "VPN" means or why you'd set one up. What's your purpose in having a VPN? Yes, you say you want two sites connected, but why? For what specific purpose? Knowing tha...

Starting over from scratch is either a stunt, a proof of network engineer "manliness," or it is an expression of NIH syndrome . It is perfectly fine to start with the default configuration and work from there. This is the position of my article on the default configuration : don't replace ...

My Lan network is 172.168.10.0/24. May I ask which division of Microsoft's LAN you run for them, then? ( Ahem …) I'm not able to get to this site from LAN with http://mywebsite:5000. The necessary configuration is documented . Show your work, then we can explain what you've missed. The simplest thi...

Block Diagram is available Another strange PoE choice: the PoE-in port is off the switch, a sensible choice for a router-class device, but we then have to ask which ISP modems provide PoE input power? Stretching for a use case, I suppose you could use this to create semi-airgapped small LANs off a ...

I do not want a subnet That's an incompatible wish given your prior requirement that it be a router and not a bridge. The IP schemes have to be different on each side for routing to do its thing. There is no this side/ that side distinction otherwise. The wifi would be used for unregistered devices...

don't have block diagram too Other open questions: The capabilities of this new switch chip; a doc search for “EN7562CT” turns up nothing. Can it do bridge VLAN filtering, for instance? The “E” prefix isn’t documented in the naming guide . I’d want that explanation to cover the reason why the 2024 ...

Try the command at the end of this article. I’ve never had the chance to use this specific variant, but we did use the copper version (X11SPM-TF) for a while, which had a possibly related behavior quirk: you could run them no slower than 1G. If you accidentally plugged them into a 100M port, it woul...

Depending on what type of router you use

hAP ax³ for the moment, 128 MB.

configure partitioning

Solid plan. Thanks for reminding me of the option.

I set the fallback sequence up for part0 → part1→ Etherboot. Sane?

I just had to revert another device from 7.17beta4 to 7.16.1 owing to these DHCP changes. This latest beta utterly wrecked an existing configuration: Three independent devices stopped getting their lease renewals: an iPhone 14 running iOS 17.6.1, a cheap WiiM DAC, and an AlmaLinux VM bridged to the ...

EAP? One unique fingerprint per device. Yay!

Quick update: the switch is still getting a globally-routable IPv6 address under 7.17beta4 with my variant of @tdw's config fix applied, but it continues to show the NDP multicast regression issue despite a claimed fix in the Changelog. It looks like we'll have to wait for the third beta for a prope...

/interface/bridge/mdb/add bridge=bridge group=FF02::2 ports=[/interface/bridge/port/find where bridge=bridge] I get "input does not match any value of port" from that command. However, on inspecting the MDB, I do see an entry for that IPv6 multicast group on the CRS328's bridge and on the...

The /16 mask is iffy. That takes over one entire RFC1918 range as a single subnet. If you want a /16, use one of 172.16 thru 172.31.

Since I don’t see .13 in your static DHCP reservation list, I’m going to guess the Plex box is set for /24 (255.255.255.0) That will cause havoc.

/ipv6 settings set accept-router-advertisements=yes-if-forwarding-disabled Aha! This leads me to one of the solutions I was seeking in my top post: /ipv6/settings/set accept-router-advertisements=yes Simpler and more direct for a near-defconf smart-switch config, don't you think? And yes, it does f...

And all clients that are connected via cable are successfully getting IPv6 addresses. Can't we chalk that up to DHCPv6 vs NDP/SLAAC? DHCPv6 has a different role than DHCPv4. I'm running a DHCPv6 client on the border router purely in order to get a PD from my ISP, and I am not running a DHCPv6 serve...

Here is my current home configuration Thanks for sharing! I don't want to use DHCPv6 inside the LAN, but I did try applying your shorter RA lifetimes to the border router which owns the PD, and it didn't help. I also tried disabling ND on the CRS328, per both your advice and @tdw, but that also did...

This upgrade appears to be breaking IPv6 ND (a.k.a. NDP) to wired clients connected to RouterOS switches, when those switches sit between the client and the NDP source. Full saga here , but the tl;dr is that rolling back to 7.16.1 via netinstall fixed the symptom, and re-upgrading to 7.17beta2 broke...

Some bridge settings broke multicast until very recent versions of 7.x which prevented IPv6 from working properly Well, it looks like they've broken it again. After rebuilding my configuration from text backups atop the 7.16.1 netinstall, the client continued to get its NDP messages, but then on up...

Progress: I just netinstalled the switch with 7.16.1 and suddenly the same client machine called out above is getting a globally-routable IPv6 address from the gateway. Next steps: Find out why the CRS328 itself is still not getting one despite "/ipv6 nd prefix default autonomous=yes". Upg...

i have similiar setup but a tplink switch instead but all mine work?? Are you telling me that your TPLink switch is getting a globally-routable IPv6 address from your gateway router, and that all of the wired-only clients behind it are, too? i just followed my isp directions like this then rebooted...

I have a working IPv6 configuration to my ISP. It gets a /64 prefix via DHCPv6 and assigns itself an address from that pool. WiFi clients can then connect to that hAP ax³ and get an IPv6 address within that pool. These clients then get successful results when visiting the usual IPv6 test sites. My p...

In my experience coding the SFP(+) for different vendors is only done to get around vendor lock-in. The experience behind the post above is from accidentally ordering a Huawei-coded version of FS.com's SFP-10G-T-30I after being advised that this unit runs far cooler than MikroTik's S+RJ10 , the clo...

It's SFP. It is an industry standard. You'd think. And you'd think wrong . Why else would FS.com ship a given module matching the rough specs of this thread's topic in 20 different versions plus "Generic," each with a different product ordering attribute? Why would their staff follow up a...

I'm also having the same issue That's presumptive. You might be having the same symptom but by a different cause . Atop that, you're already telling us that the above solutions didn't work for you, right? I mean, you did try everything listed above, yes? Therefore, how can your problem be "the...

Can someone explain the missing part with “…” (two places)
To replace it with properties related to wifi slave configuration…

Also local details like country settings, SSID, PSK… Things I don’t want to reveal about my local config and cannot predict for yours. Fill in the blanks.

5g guest network rejects WAN request, so smartphone could not connect to internet. Mikrotik hap AC^2, 7.15.3 That’s a documented feature of my scheme: guests do not get full-service WiFi. I have no desire to prototype an alternative that lifts that restriction for you, but it would involve creating...

That sounds a lot like my guest WiFi scheme. That should at least get you started.

I don't know where the problem is

Short of more guessing, neither do we until you post your /export output, as requested.

no need any advanced options

You might be surprised at some of the things you lose by booting into SwOS. It’s rarely worth it, IMO.

We diagnosed this over on the Discord server. The tl;dr is that on the hAP ac lite, the Reset button has an extra optional capability to trigger the WPS server for a time, and the only thing separating the cases is how long you hold it. Too long, and your intended WPS trigger becomes a reset to defc...

Your question is vague to the point of allowing guessing only. My guess? You need to put the DHCP server on the bridge instead.

If that’s not it, post your sanitized /export output here and explain in more detail what isn’t working.

Ax3 is a single stand-alone device, so there's nowhere to roam.

Sure there is: from 5 GHz to 2.4 and back when both radios have the same SSID. FT does apply in this case!

CRS304 (plastic)

Check the other pics: the plastic shell overlays a bottom-half heat sink.

The true distinction here is on price: the CRS304 retails for the cost of a CRS305 plus one copper 10GigE module. Add anything more and the 304 wins.

…support guy told me they replicated the problem with Intel AX in their lab I was speaking of Apple devices, which as far as I know, do not include the affected Intel AX chipsets. Regardless, I am not attempting to gainsay the MT engineers on this one; if they say the chipset has a bug that affects...

Apple recommends DTIM interval of 4. Where? Their current recommendations do not speak of DTIM at all. For what it's worth, I've gone back and documented my hAP ax³ WiFi configuration in more detail than my post #2 above , which continues to work nicely with several Apple devices, and has done sinc...

While the initial post smacks of "write my curriculum for me," I will repeat this common observation: the best way to learn how something works is to try to teach it to someone else. Therefore, begin writing. Each time you run into a wall, experiment, then write down what you have found ou...

Is there any newby friendly guide I can follow to configure it? That's a big ask for a brand-new feature. Your best bet right now is the official docs . I have no idea how this integrates with the optional (!) on-device RADIUS server called User Manager , available as user-manager-*.npk in the extr...

I want to have per MAC VLAN tagging using external RADIUS server. And this feature seems to be unsupported. Or do I miss something?

That feature was just added in 7.17beta2 as part of the new PPSK feature, but only for ax devices. Details here.

Why is the CRS304 not called the CRS305? It has 5 wired interfaces, just like the existing CRS305 does. Management-only ports are excluded from the count, as they aren’t meant for general-purpose I/O. Prior art: CRS312, with 4× combo ports, 8× 10GigE, and a 100M management port. In both cases, the ...

It's easy to test @Ammo0's prediction: try hdhomerun_config's discovery command from the Cisco side of the network, on the PC shown on the PDF diagram. If that works, then it's the firewall to blame, as he says. Firewalls almost always block broadcasts. Separately, there's a lot that can be cleaned ...

It's driving me crazy cause it doesnt even log anything...

Setting "logging=yes" isn't enough. You also have to enable the "container" topic:

/system/logging/set topics=container action=memory

but then /container/start 0 16:58:30 container,info,debug execve: No such file or directory I don't get that error, but I do get a different one, owing to the fact that above, I was echoing "--json" from @toffifee's post above without having tested it. That flag is for a third-party speed...

add remote-image seems to require to set a registry-url first. what would be the correct one? Quoting the container's README.md file , "Start by installing the container package per MikroTik’s docs …" That link gives you this command: /container/config/set registry-url=https://registry-1....

You've given a static IP to the WAN interface but no route to it. Add something like this:

/ip/route/add gateway=sfp-sfpplus1

You should also remove sfp-sfpplus1 from the bridge, not merely disable it.

What happens when you drop the -R from your test?

Why is the -P argument so high? In my testing, setting it higher than the server’s core count makes it slower, if anything.

No such thing.

You would do well to read the whole article before proceeding with container.npk, freeing you of the weight of your preconceptions dragging behind you.

it is a bug of 7.15.3 or some radical change of approach It sounds like you're describing a change coming in 7.16: *) container - clear VETH address on container exit and mark interface as running only when VETH is in use; It's an intentional answer to a few complaints from people about containers ...

container/config/set ram-high= OP addressed that in the first paragraph; it sets a single aggregate limit for all containers. OP wants a per-container limit. It is one of many reasons calling container.npk “docker” misleads more than helps. The only path forward is to file a formal request for the ...

It configured using vlan2 and vlan4. Is this a requirement from your ISP? That is, do you need to "join" these two VLANs from your ISP in order to get Internet access? If so, then you should only be using the VLAN virtual interfaces, not the physical interfaces. what I maight have done wr...

I was wondering if you had any updates, refinements, suggestions, or comments on this solution?

It's still working here, as originally presented.

Were you hoping for some change, or just confirming the article's published history, that nothing has changed in half a year?

What's the difficulty? Change the 1 to a 2 in "ether1" and vice versa, like so.

However if the OP wants to use the internet of the ISP router, thats a different story. It's not an "if". OP stated it explicitly, else I wouldn't have pointed him to my double-NAT WG guide. One would suspect that anything leaving the MT is going out the LANIP of the MT on the ISP router ...

You're probably neglecting to NAT the reply traffic on its way back out of the network.

Try this guide.

I have another MikroTik router with the same configuration running on ARM architecture with RouterOS v7.9.2, and it displays the expiry date correctly. The RB4011 is running the default firmware version (v7.10), and unfortunately, I cannot downgrade it to v7.9.2. Quoting the 7.10 changelog entry: &...

If your point is that we cannot know how many of those 250k attack bots were set up using default or easily-guessed passwords, then yes, we indeed do not know that. But this is a side issue. The point is, we have data showing that a whole lot of historical RouterOS boxes have no password (the old de...

But, if I recall correctly, the 250,000 of Meris were connected to a router os bug/vulnerability, not to 250,000 compromised passwords. That's the 2018 attack. While many remained unpatched by the time of the 2021 attack, the first linked article says, "…compromised devices that…use the defaul...

Well, if some fella is sloppy… That's the thing: it isn't "some fella." There were around 250k compromised MT boxes in the 2021 Meris attack alone , creating enough traffic to nearly double Cloudflare's normal load . This isn't a problem for "some fella," it's a problem for ever...

among all other tasks we now have to also keep a record of all RBs deployed “Also”? You weren’t already assigning random passwords to each RB and storing them in a password manager? If you were, then this change merely means you have two passwords to store per device: the one you generate locally a...

I've been trying to upgrade my router from routeros v6.4 up to 7.15 (stable). Please tell me you mean a recent 6.4x.yy, not literally 6.4 from 2013 ? It seems that I did download wrong package ( https://download.mikrotik.com/routeros/7.15.3/routeros-7.15.3-arm.npk ) and as an instruction said uploa...

PS C:\Users\allan> docker save -o ha_arm64.tar Even if "ha_arm64.tar" wasn't bound as the option to the -o flag, making it unavailable to be interpreted as the "IMAGE" argument, it it isn't an "IMAGE" in the context of that command at all. The -o flag names an OCI imag...

RTSP isn’t “a” stream. It is a control protocol for negotiating other streams, at least one, often two. (Separate audio + video.) Atop that, RTSP is TCP, but the other streams are typically UDP. Dig into the RTSP negotiation, and then typically the SIP negotiation beneath that . Only then will you h...

Yes, and if you find yourself needing to do any serious firewalling, you can bounce the packets up from the CRS328 to the RB5009 for a decision. This duplicates the I/O, but that shouldn't be a significant concern since it's a full-duplex connection. The RB5009 is capable of making these decisions a...

what happens when vlanX needs to hit VLANY, is this somehow routed between subnets at wirespeed then??

Use some combination of hardware inter-VLAN routing and hardware VLAN filtering. This takes up precious ACL rule space, but 128 rules is enough for a home lab, no problem.

That should perform admirably.

I wish more people would think to offload switching to a dedicated switch like that.

"All LANs" implies VLANs are in use. Does your "LANS" interface list contain the raw interface names (e.g. "ether1") or the VLAN virtual interfaces (e.g. "vlan99")? Also, are you aware of — and happy with — the fact that this rule catches only traffic destined...

1024M - 256M + 128M = 640MB

1024M - 256M + 128M = 896M
1024M - (256M + 128M) = 640M
1024M - 256M - 128M = 640M

They should call it a Type-C port if they aren't going to support any of the USB protocols. I know of a pair of competing vendors in a section of the computing hardware world far outside of networking that use Type-C connectors for data transfer, but with a proprietary non-USB protocol. Both of them...

All I'm saying is that if you make it as simple as "copy from Jira, paste to CHR, then look here" the support people will have no cause to bounce the report back to you with a bogus won't-fix explanation or a second-guessing of your intent. They'll have no choice but to send it on to the d...

I would distill that even further before filing a bug with MikroTik. Your "/export" has both far more info than needed (e.g. ether1 config, dude, time zone…) and also not enough to replicate the symptom. The "/container add" line in particular doesn't show the remote image name. ...

I guess it will be the same for any container using mount pattern like that...

And if not, then you will have learned something interesting, possibly even important.

non-root user process write to mounted dir This is one of the many reasons I continue to castigate container.npk for being thinly-documented. The mechanism it uses for UID mapping is important to understand in cases like this, but the word "user" scarcely appears in the single-page docume...

it seems it is ROS bug. Boil it down to a simple example like I have above with Podman and Alpine, and you will have solid grounds for filing a bug report . The easier you make it to reproduce the symptom, the faster it will be fixed. Dragging Unbound into it complicates matters to no useful end. C...

I'm deploying a non-root container No such thing in RouterOS . (I suggest reading the whole article. This is only one area where thinking of container.npk as "Docker" will lead you into grief.) I need to write file as the container user (non-root) but the volume is always mounted as root....

/container/mounts> print ... 5 name="unbound_etc_unbound" src="/usb1/containers/mounts/unbound/etc/unbound" dst="/etc/unbound" 7 name="unbound_etc_unbound_zonefiles" src="/tmpfs1/containers/mounts/unbound/etc/unbound/zonefiles" This looks like a bug...

adding two tiny resistors to the Ax lite is enough I will happily pay $0.02 more per ax Lite to get the freedom of carrying only one USB-C power supply with me on trips. While they're in there redesigning, I want a version that will plug into the laptop's second USB-C port and not only vampire powe...

What is strange is that the Mikrotik DHCP server assign leases (usually) starting from the highest address in the range ISC dhcpd did that. At the time I was last using it, it was the most popular FOSS DHCP server in the world. I don't remember what order dnsmasq assigns leases in, the most common ...

I decided to change the diapason… We borrowed that word into English, but it's used in reference to tuning forks and such, getting an orchestra into tune. What application does it have here, in this context? …everything started working! Why? You don't give enough details for more than speculation. ...

anyone here can help me with this. As the others have said, containers are not VMs . Atop that, you are also likely to run repeatedly into the several inherent limitations of container.npk , some of which may prevent it from working, others of which will merely make this scheme unsatisfactory.

inserting a 10Mbps switch Sneaky plan: buy a box of bulk cable, pull a few meters out from each end, terminate them, and pass the assembly off to your students as “a really long cable, portably packaged.” But inside, there are two cables joined by a PoE-powered CSS106 tucked into one corner. (Fallb...

I don't think that such a miniaturized low pass filter is something that can be done at home I would not reach for active filters or IC passives here unless you had to have something that worked every time, across all manufacturers and devices. The thing is, @jaclaz's ferrite bead idea is a DIYable...

https://tangentsoft.com/mikrotik/wiki?name=Containers+Are+Not+VMs&p (section: CHR Complications) I thank you for thinking of my article, @holvoetn, but I think it's misapplied in the context of this thread. First, a nit: you'll want to remove the "&p" bit from the end of the bookm...

miswiring the cable (not the correct color sequence, but of course the same on both ends) will do it. I held off suggesting this because I have successfully run gigabit over "rainbow-wired" cables. (e.g. Orange, white-orange, green, green-white, blue, blue-white, brown, brown-white.) Purp...

You’re not reading @holvoetn’s post carefully. His scheme will cause the script to run one minute after boot, as you asked. If the system goes down before then, it will be “cancelled,” hard.

It’s both elegant and correct.

a little box on the cable Chokes and caps are bulky, but we aren’t building power supplies here. Properly engineered for the tiny currents involved, they might be surprisingly small. We live in a world where Thunderbolt cables look identical to USB-C cables despite one having a complicated IC embed...

I wonder what's your use case for CRS320 which asks for (explicit) PTP support? It's used in any area where distributed precision time matters. In addition to A/V cases exemplified by the OP's Dante use case, there are things like LXI that depend on it for accurate timing of measurements. The deskt...

Are the MDB tables populated properly on both sides of the PIM link? If not, there's no way for it to realize N-1 > 0 when N=2.

Why not use webfig Because you can't rearrange the windows into a dashboard, it can't MAC-WinBox into a RouterOS device that has no IP yet (or a broken IP), it doesn't do neighbor discovery, refreshing the browser logs you out… While I'm here, allow me to mention the option of Crossover , which for...

NTP hates step-changes. It is specifically engineered to slew slowly forward in time, only, always. If you start off far enough out of sync, it can indeed take days to get in sync.

just chuck in a linux container …or use one that's already there , as there's a high chance it either can already do this or can be extended on an ad hoc basis to do this. This feature idea has legs anywhere container.npk isn't installed, won't ever be installed, or cannot be installed. if your rea...

I expect you have the recent bandwidth test abuse in mind when you write that, @rextended, but if our goal is to make all RouterOS boxes useless to an intruder, we'd also have to remove nearly everything under /tools, including your favorite in scripting, /fetch. And also scripting , period. No; the...

And people still arguing for empty admin password should really go to hell. That's like lobbying for cars without seatbelts...

Difference being, these MikroTik "cars" drive over global-scale highways and can "crash" into thousands of other "cars" per minute.

ntpdate -q Hmm, that does give better error messages: You've apparently got the minimalist " ntpsec " version of these tools installed. I had in mind the more mainstream ntp.org ones, which give more readable output. For reference, here is its output when run against my properly-functioni...

Cards on the table; show your config.

So you'll be able to test if the config works on the US version then :wink: I've taken enough risks with my home IT core for one Saturday. Maybe tomorrow, but probably not, and definitely not during the week; I work from home. I also have a pet theory that some of these weird ax3s are coming from A...

'monitor' command from cli. Thank you. My 5 GHz radio is on 5500/ax/Ceee at the moment, which according to the Freq. Scan tool in WinBox has 0% usage on all four of the 20 MHz sub-channels. I take that as validation that it did a good job choosing automatically even with a fair bit of competition a...

I have the international version of the hAP ax3. Mine's the "-US" variant even though it came to me through Getic. It auto-chose frequency 5745 How do you make it admit that truth, please? All I can get is a long list of available channels, plus the "Scan" function, which doesn'...

I had to dangle an RB1100 from an Ethernet cable Fun coincidence: my ax³ was dangling from its Ethernet cables at one point in the above testing, too, and it was due to a design error I'll happily lay at MT's feet: putting only one PoE port on it, and making it the same one for in and out. I power ...

naming SSIDs …might hide the problem, by the means of clients learning to roam away from the slow 5GHz radio If that were happening here, I wouldn't be getting 656 Mbit/sec with iperf3. That's plain impossible on 2.4 GHz, particularly since I took the OP's implicit hint and switched off 40 MHz chan...

Having 2.4 GHz and 5 GHz networks separate is a matter of preference. You're telling me that bridging the two wifi networks has no effect on the original problem statement, where one side works and the other doesn't? You don't think it's even worth trying to see if it suddenly starts working when y...

Here you go Tangent: That isn't at all what I asked you for. It isn't… …the default configuration, but instead this heavily-changed AP bridge thing you're trying to set up. While it is highly useful to see what you're trying to do, I want you to realize that the reason I asked for the defconf was s...

…my near 20 years of using Mikrotik products… …may be leading you astray, because these new ax routers' behavior differs in quite a number of ways from the old ones. If all you did was copy your RB4011 config over, it's no wonder you're having trouble. (Details: 1 , 2 ) I literally want to take thi...

It was more the NAT I was reacting to, but sure, we’re singing from the same hymn book, mkx.

But if I wanted input firewalling on a CRS305, I’d reach for bridge filters first, switch rules second, and the software IP firewall last.

It isn't meant to be intuitive. It's meant to be powerful. Great power comes with great responsibility, including a willingness to learn the tool's capabilities lest you end up causing more damage than handicraft. As for the "Windows" thing, WinBox runs just fine under Wine. To be frank, t...

123/tcp closed ntp NTP is a UDP protocol; nmap's default TCP port scan is correct to show it closed. While there is a UDP port-scanning option , I'd prefer a tool like ntpdate -q for testing availability. Your own choice of ntpq should also work, though lacking experience with it, I cannot reassure...

I do NOT want the Microtik routers giving out 192.168.88.xxx address to devices So get its competing DHCP server out of the way, then. The fastest way is to give this CLI command: /ip/dhcp-server/disable 0 There's a GUI alternative, and if you want to be really thorough you will remove it entirely,...

get rid of the 128 too..... not sure why thats there It's a somewhat dirty trick to ensure that the WG tunnel becomes the default route of choice even when other default routes exist. 0.0.0.0/1 is the lower half of the IPv4 space, and 128.0.0.0/1 is the upper half. Together, they cover the same ran...

AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 Have you tried 0.0.0.0/0? Yes, I'm aware of the longest-prefix /1 trick, but the question stands. Alternately, try checking the WG client's "Exclude private IPs" box, which will change this value to a long list that avoids tunneling access to RFC1918 ad...

Unlike other OSes — there's one from Redmond Washington I'm thinking of in particular — RouterOS doesn't make it any more difficult to add 50 addresses to an interface than to add one. Moreover, it doesn't care about the mix of dynamic and static addresses. Therefore, you can keep the defconf static...

This is an English speaking forum. So please write in English If you want help. Where is that rule written? I can't find it in either the registration agreement or the stock phpBB FAQ. While I do think it's moderately foolish to post in other languages since it limits the number of people who are l...

/usr/bin/ssh -i ~/.ssh/pass admin@100.255.255.205 ":put [/user-manager/user add name=pepe group=premium comment="jose perez mikrotik 2024"]" This isn't a RouterOS problem; it's a misunderstanding of how your OS's shell works. Simply put, if you try nesting quotes like that, your...

I would prefer to do it as this instead: Much easier if you combine those two steps into one: ssh username@router-address /export terse show-sensitive > backup.rsc Bonus 1: You don't add any wear to the device's flash. Bonus 2: It's immune to the terminal I/O strangeness that the OP's send/expect m...

next-server=192.168.88.11

I've never set up PXE, but isn't next-server the TFTP server's address? Why is it inside your DHCP reservation range?

I hope that any DoS attacks will be prevented more by out of the box features of the router That's not any more likely than stopping yourself from asphyxiating when someone stuffs a firehose down your throat by begging time from your attacker to install a dental dam first. It'll do about as much go...

No WiFi. It's connected via the 2.5Gb ethernet port.

Then I'm stuck.

If the problem is as simple as you claim, why do I get 7 Gbit/sec to my iperf3 container when bridged to an RB4011?

Thanks for that! Not so fast…I think it's me hallucinating now. Going back to your original post, there's this: /ip dhcp-server add address-pool=default-dhcp interface=bridge name=defconf I saw that in red here when diffing it against the fully-stock default configuration file I have here, meaning ...

Why are you trying to save IP addresses? RFC1918 sets aside tens of millions of them for your use in applications like this. Furthermore, PIM is designed to work in the presence of regular routing, not NAT. Therefore, make these senders 10.0.0.1 thru 10.0.0.3, and then configure PIM to forward their...

Bad idea? Yes. Can it work anyway? Maybe. Try it and let us know, okay?

While we're nit-picking, this:

/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1

…is useless now that you've removed the default DHCP server.

My router model is LTE 18. No, it isn't. That's one non-unique fragment of the product name, and it refers to LTE user equipment category 18 . There are at least three different MikroTik products with "LTE18" in their name. Fortunately, only one appears to also have WiFi in it. Are you sp...

otherwise I would see the same problem when I run the client on a different PC That's a detail you should have led with, not needed to have dragged out after days worth of back-and-forth. This thread's initial post implies that it affects all hosts on the network, and then you come along and claim ...

I doubt there are many people in a position to "download from newsgroups" for you as a test, and even if there was one willing and able, that's not what I'd call a repeatable test. Which file, which group, which platform…? Here's what a repeatable test looks like: go to this page and downl...

Search found 1720 matches