MikroTik

container/config/set ram-high= OP addressed that in the first paragraph; it sets a single aggregate limit for all containers. OP wants a per-container limit. It is one of many reasons calling container.npk “docker” misleads more than helps. The only path forward is to file a formal request for the ...

It configured using vlan2 and vlan4. Is this a requirement from your ISP? That is, do you need to "join" these two VLANs from your ISP in order to get Internet access? If so, then you should only be using the VLAN virtual interfaces, not the physical interfaces. what I maight have done wr...

I was wondering if you had any updates, refinements, suggestions, or comments on this solution?

It's still working here, as originally presented.

Were you hoping for some change, or just confirming the article's published history, that nothing has changed in half a year?

What's the difficulty? Change the 1 to a 2 in "ether1" and vice versa, like so.

However if the OP wants to use the internet of the ISP router, thats a different story. It's not an "if". OP stated it explicitly, else I wouldn't have pointed him to my double-NAT WG guide. One would suspect that anything leaving the MT is going out the LANIP of the MT on the ISP router ...

You're probably neglecting to NAT the reply traffic on its way back out of the network.

Try this guide.

I have another MikroTik router with the same configuration running on ARM architecture with RouterOS v7.9.2, and it displays the expiry date correctly. The RB4011 is running the default firmware version (v7.10), and unfortunately, I cannot downgrade it to v7.9.2. Quoting the 7.10 changelog entry: &...

If your point is that we cannot know how many of those 250k attack bots were set up using default or easily-guessed passwords, then yes, we indeed do not know that. But this is a side issue. The point is, we have data showing that a whole lot of historical RouterOS boxes have no password (the old de...

But, if I recall correctly, the 250,000 of Meris were connected to a router os bug/vulnerability, not to 250,000 compromised passwords. That's the 2018 attack. While many remained unpatched by the time of the 2021 attack, the first linked article says, "…compromised devices that…use the defaul...

Well, if some fella is sloppy… That's the thing: it isn't "some fella." There were around 250k compromised MT boxes in the 2021 Meris attack alone , creating enough traffic to nearly double Cloudflare's normal load . This isn't a problem for "some fella," it's a problem for ever...

among all other tasks we now have to also keep a record of all RBs deployed “Also”? You weren’t already assigning random passwords to each RB and storing them in a password manager? If you were, then this change merely means you have two passwords to store per device: the one you generate locally a...

I've been trying to upgrade my router from routeros v6.4 up to 7.15 (stable). Please tell me you mean a recent 6.4x.yy, not literally 6.4 from 2013 ? It seems that I did download wrong package ( https://download.mikrotik.com/routeros/7.15.3/routeros-7.15.3-arm.npk ) and as an instruction said uploa...

PS C:\Users\allan> docker save -o ha_arm64.tar Even if "ha_arm64.tar" wasn't bound as the option to the -o flag, making it unavailable to be interpreted as the "IMAGE" argument, it it isn't an "IMAGE" in the context of that command at all. The -o flag names an OCI imag...

RTSP isn’t “a” stream. It is a control protocol for negotiating other streams, at least one, often two. (Separate audio + video.) Atop that, RTSP is TCP, but the other streams are typically UDP. Dig into the RTSP negotiation, and then typically the SIP negotiation beneath that . Only then will you h...

Yes, and if you find yourself needing to do any serious firewalling, you can bounce the packets up from the CRS328 to the RB5009 for a decision. This duplicates the I/O, but that shouldn't be a significant concern since it's a full-duplex connection. The RB5009 is capable of making these decisions a...

what happens when vlanX needs to hit VLANY, is this somehow routed between subnets at wirespeed then??

Use some combination of hardware inter-VLAN routing and hardware VLAN filtering. This takes up precious ACL rule space, but 128 rules is enough for a home lab, no problem.

That should perform admirably.

I wish more people would think to offload switching to a dedicated switch like that.

"All LANs" implies VLANs are in use. Does your "LANS" interface list contain the raw interface names (e.g. "ether1") or the VLAN virtual interfaces (e.g. "vlan99")? Also, are you aware of — and happy with — the fact that this rule catches only traffic destined...

1024M - 256M + 128M = 640MB

1024M - 256M + 128M = 896M
1024M - (256M + 128M) = 640M
1024M - 256M - 128M = 640M

They should call it a Type-C port if they aren't going to support any of the USB protocols. I know of a pair of competing vendors in a section of the computing hardware world far outside of networking that use Type-C connectors for data transfer, but with a proprietary non-USB protocol. Both of them...

All I'm saying is that if you make it as simple as "copy from Jira, paste to CHR, then look here" the support people will have no cause to bounce the report back to you with a bogus won't-fix explanation or a second-guessing of your intent. They'll have no choice but to send it on to the d...

I would distill that even further before filing a bug with MikroTik. Your "/export" has both far more info than needed (e.g. ether1 config, dude, time zone…) and also not enough to replicate the symptom. The "/container add" line in particular doesn't show the remote image name. ...

I guess it will be the same for any container using mount pattern like that...

And if not, then you will have learned something interesting, possibly even important.

non-root user process write to mounted dir This is one of the many reasons I continue to castigate container.npk for being thinly-documented. The mechanism it uses for UID mapping is important to understand in cases like this, but the word "user" scarcely appears in the single-page docume...

it seems it is ROS bug. Boil it down to a simple example like I have above with Podman and Alpine, and you will have solid grounds for filing a bug report . The easier you make it to reproduce the symptom, the faster it will be fixed. Dragging Unbound into it complicates matters to no useful end. C...

I'm deploying a non-root container No such thing in RouterOS . (I suggest reading the whole article. This is only one area where thinking of container.npk as "Docker" will lead you into grief.) I need to write file as the container user (non-root) but the volume is always mounted as root....

/container/mounts> print ... 5 name="unbound_etc_unbound" src="/usb1/containers/mounts/unbound/etc/unbound" dst="/etc/unbound" 7 name="unbound_etc_unbound_zonefiles" src="/tmpfs1/containers/mounts/unbound/etc/unbound/zonefiles" This looks like a bug...

adding two tiny resistors to the Ax lite is enough I will happily pay $0.02 more per ax Lite to get the freedom of carrying only one USB-C power supply with me on trips. While they're in there redesigning, I want a version that will plug into the laptop's second USB-C port and not only vampire powe...

What is strange is that the Mikrotik DHCP server assign leases (usually) starting from the highest address in the range ISC dhcpd did that. At the time I was last using it, it was the most popular FOSS DHCP server in the world. I don't remember what order dnsmasq assigns leases in, the most common ...

I decided to change the diapason… We borrowed that word into English, but it's used in reference to tuning forks and such, getting an orchestra into tune. What application does it have here, in this context? …everything started working! Why? You don't give enough details for more than speculation. ...

anyone here can help me with this. As the others have said, containers are not VMs . Atop that, you are also likely to run repeatedly into the several inherent limitations of container.npk , some of which may prevent it from working, others of which will merely make this scheme unsatisfactory.

inserting a 10Mbps switch Sneaky plan: buy a box of bulk cable, pull a few meters out from each end, terminate them, and pass the assembly off to your students as “a really long cable, portably packaged.” But inside, there are two cables joined by a PoE-powered CSS106 tucked into one corner. (Fallb...

I don't think that such a miniaturized low pass filter is something that can be done at home I would not reach for active filters or IC passives here unless you had to have something that worked every time, across all manufacturers and devices. The thing is, @jaclaz's ferrite bead idea is a DIYable...

https://tangentsoft.com/mikrotik/wiki?name=Containers+Are+Not+VMs&p (section: CHR Complications) I thank you for thinking of my article, @holvoetn, but I think it's misapplied in the context of this thread. First, a nit: you'll want to remove the "&p" bit from the end of the bookm...

miswiring the cable (not the correct color sequence, but of course the same on both ends) will do it. I held off suggesting this because I have successfully run gigabit over "rainbow-wired" cables. (e.g. Orange, white-orange, green, green-white, blue, blue-white, brown, brown-white.) Purp...

You’re not reading @holvoetn’s post carefully. His scheme will cause the script to run one minute after boot, as you asked. If the system goes down before then, it will be “cancelled,” hard.

It’s both elegant and correct.

a little box on the cable Chokes and caps are bulky, but we aren’t building power supplies here. Properly engineered for the tiny currents involved, they might be surprisingly small. We live in a world where Thunderbolt cables look identical to USB-C cables despite one having a complicated IC embed...

I wonder what's your use case for CRS320 which asks for (explicit) PTP support? It's used in any area where distributed precision time matters. In addition to A/V cases exemplified by the OP's Dante use case, there are things like LXI that depend on it for accurate timing of measurements. The deskt...

Are the MDB tables populated properly on both sides of the PIM link? If not, there's no way for it to realize N-1 > 0 when N=2.

Why not use webfig Because you can't rearrange the windows into a dashboard, it can't MAC-WinBox into a RouterOS device that has no IP yet (or a broken IP), it doesn't do neighbor discovery, refreshing the browser logs you out… While I'm here, allow me to mention the option of Crossover , which for...

NTP hates step-changes. It is specifically engineered to slew slowly forward in time, only, always. If you start off far enough out of sync, it can indeed take days to get in sync.

just chuck in a linux container …or use one that's already there , as there's a high chance it either can already do this or can be extended on an ad hoc basis to do this. This feature idea has legs anywhere container.npk isn't installed, won't ever be installed, or cannot be installed. if your rea...

I expect you have the recent bandwidth test abuse in mind when you write that, @rextended, but if our goal is to make all RouterOS boxes useless to an intruder, we'd also have to remove nearly everything under /tools, including your favorite in scripting, /fetch. And also scripting , period. No; the...

And people still arguing for empty admin password should really go to hell. That's like lobbying for cars without seatbelts...

Difference being, these MikroTik "cars" drive over global-scale highways and can "crash" into thousands of other "cars" per minute.

ntpdate -q Hmm, that does give better error messages: You've apparently got the minimalist " ntpsec " version of these tools installed. I had in mind the more mainstream ntp.org ones, which give more readable output. For reference, here is its output when run against my properly-functioni...

Cards on the table; show your config.

So you'll be able to test if the config works on the US version then :wink: I've taken enough risks with my home IT core for one Saturday. Maybe tomorrow, but probably not, and definitely not during the week; I work from home. I also have a pet theory that some of these weird ax3s are coming from A...

'monitor' command from cli. Thank you. My 5 GHz radio is on 5500/ax/Ceee at the moment, which according to the Freq. Scan tool in WinBox has 0% usage on all four of the 20 MHz sub-channels. I take that as validation that it did a good job choosing automatically even with a fair bit of competition a...

I have the international version of the hAP ax3. Mine's the "-US" variant even though it came to me through Getic. It auto-chose frequency 5745 How do you make it admit that truth, please? All I can get is a long list of available channels, plus the "Scan" function, which doesn'...

I had to dangle an RB1100 from an Ethernet cable Fun coincidence: my ax³ was dangling from its Ethernet cables at one point in the above testing, too, and it was due to a design error I'll happily lay at MT's feet: putting only one PoE port on it, and making it the same one for in and out. I power ...

naming SSIDs …might hide the problem, by the means of clients learning to roam away from the slow 5GHz radio If that were happening here, I wouldn't be getting 656 Mbit/sec with iperf3. That's plain impossible on 2.4 GHz, particularly since I took the OP's implicit hint and switched off 40 MHz chan...

Having 2.4 GHz and 5 GHz networks separate is a matter of preference. You're telling me that bridging the two wifi networks has no effect on the original problem statement, where one side works and the other doesn't? You don't think it's even worth trying to see if it suddenly starts working when y...

Here you go Tangent: That isn't at all what I asked you for. It isn't… …the default configuration, but instead this heavily-changed AP bridge thing you're trying to set up. While it is highly useful to see what you're trying to do, I want you to realize that the reason I asked for the defconf was s...

…my near 20 years of using Mikrotik products… …may be leading you astray, because these new ax routers' behavior differs in quite a number of ways from the old ones. If all you did was copy your RB4011 config over, it's no wonder you're having trouble. (Details: 1 , 2 ) I literally want to take thi...

It was more the NAT I was reacting to, but sure, we’re singing from the same hymn book, mkx.

But if I wanted input firewalling on a CRS305, I’d reach for bridge filters first, switch rules second, and the software IP firewall last.

It isn't meant to be intuitive. It's meant to be powerful. Great power comes with great responsibility, including a willingness to learn the tool's capabilities lest you end up causing more damage than handicraft. As for the "Windows" thing, WinBox runs just fine under Wine. To be frank, t...

123/tcp closed ntp NTP is a UDP protocol; nmap's default TCP port scan is correct to show it closed. While there is a UDP port-scanning option , I'd prefer a tool like ntpdate -q for testing availability. Your own choice of ntpq should also work, though lacking experience with it, I cannot reassure...

I do NOT want the Microtik routers giving out 192.168.88.xxx address to devices So get its competing DHCP server out of the way, then. The fastest way is to give this CLI command: /ip/dhcp-server/disable 0 There's a GUI alternative, and if you want to be really thorough you will remove it entirely,...

get rid of the 128 too..... not sure why thats there It's a somewhat dirty trick to ensure that the WG tunnel becomes the default route of choice even when other default routes exist. 0.0.0.0/1 is the lower half of the IPv4 space, and 128.0.0.0/1 is the upper half. Together, they cover the same ran...

AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 Have you tried 0.0.0.0/0? Yes, I'm aware of the longest-prefix /1 trick, but the question stands. Alternately, try checking the WG client's "Exclude private IPs" box, which will change this value to a long list that avoids tunneling access to RFC1918 ad...

Unlike other OSes — there's one from Redmond Washington I'm thinking of in particular — RouterOS doesn't make it any more difficult to add 50 addresses to an interface than to add one. Moreover, it doesn't care about the mix of dynamic and static addresses. Therefore, you can keep the defconf static...

This is an English speaking forum. So please write in English If you want help. Where is that rule written? I can't find it in either the registration agreement or the stock phpBB FAQ. While I do think it's moderately foolish to post in other languages since it limits the number of people who are l...

/usr/bin/ssh -i ~/.ssh/pass admin@100.255.255.205 ":put [/user-manager/user add name=pepe group=premium comment="jose perez mikrotik 2024"]" This isn't a RouterOS problem; it's a misunderstanding of how your OS's shell works. Simply put, if you try nesting quotes like that, your...

I would prefer to do it as this instead: Much easier if you combine those two steps into one: ssh username@router-address /export terse show-sensitive > backup.rsc Bonus 1: You don't add any wear to the device's flash. Bonus 2: It's immune to the terminal I/O strangeness that the OP's send/expect m...

next-server=192.168.88.11

I've never set up PXE, but isn't next-server the TFTP server's address? Why is it inside your DHCP reservation range?

I hope that any DoS attacks will be prevented more by out of the box features of the router That's not any more likely than stopping yourself from asphyxiating when someone stuffs a firehose down your throat by begging time from your attacker to install a dental dam first. It'll do about as much go...

No WiFi. It's connected via the 2.5Gb ethernet port.

Then I'm stuck.

If the problem is as simple as you claim, why do I get 7 Gbit/sec to my iperf3 container when bridged to an RB4011?

Thanks for that! Not so fast…I think it's me hallucinating now. Going back to your original post, there's this: /ip dhcp-server add address-pool=default-dhcp interface=bridge name=defconf I saw that in red here when diffing it against the fully-stock default configuration file I have here, meaning ...

Why are you trying to save IP addresses? RFC1918 sets aside tens of millions of them for your use in applications like this. Furthermore, PIM is designed to work in the presence of regular routing, not NAT. Therefore, make these senders 10.0.0.1 thru 10.0.0.3, and then configure PIM to forward their...

Bad idea? Yes. Can it work anyway? Maybe. Try it and let us know, okay?

While we're nit-picking, this:

/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1

…is useless now that you've removed the default DHCP server.

My router model is LTE 18. No, it isn't. That's one non-unique fragment of the product name, and it refers to LTE user equipment category 18 . There are at least three different MikroTik products with "LTE18" in their name. Fortunately, only one appears to also have WiFi in it. Are you sp...

otherwise I would see the same problem when I run the client on a different PC That's a detail you should have led with, not needed to have dragged out after days worth of back-and-forth. This thread's initial post implies that it affects all hosts on the network, and then you come along and claim ...

I doubt there are many people in a position to "download from newsgroups" for you as a test, and even if there was one willing and able, that's not what I'd call a repeatable test. Which file, which group, which platform…? Here's what a repeatable test looks like: go to this page and downl...

If I add the veth to my single bridge, it completely tanks my download speeds, although speed tests are at full speed for some reason. That doesn't happen here, but then, you haven't told us how you're determining this slowdown in a repeatable manner. You can tell us it's repeatable where you are, ...

Is there an alternative way to use containers without resorting to a second bridge?

Yes.

an easily accessible repository with the "standard" (or "factory") configuration .rsc files, one for each model Here's a start . Consider this an open solicitation for more files. I'm willing to take: Descriptive diffs, e.g. "the RB5009 is like the RB4011 but with these few...

Would have been nice with a better hardened default config out of the box. Such as…? If that includes a wish that the recent policy of random default passwords started much earlier, then I agree. But, go read all the threads here moaning about how terrible a burden it was when it finally did land. ...

I'd write a short sed/awk/perl/whatever command/script to recast your input data into the proper format:

/ip firewall address-list add address=192.168.88.1 list=MyListName

So, what does the input format look like?

In 7.14, they exposed the actual underlying network stack's "lo" interface.

Whether that's what you need or not, I can only speculate, since you haven't said why you want to have a dummy interface.

A) Purchase MikroTik products only if you are an expert in TCP/IP …or mean to become one through experience, which is why I so often lead with links to relevant docs. If the poster shows evidence that they either won't read or won't attempt to understand and apply what they did read, then that fall...

handled by Mikrotik They've explicitly ruled out this category in point 6, here : "Technical support does not include training on TCP/IP." I'll readily grant that this is a poor-quality question, but as the mod who approved it, I'll tell you why: rejecting it would not have helped the OP....

https://help.mikrotik.com/docs/display/ ... ndamentals

that works but i would say half. The "-t 10" bit in my command example overrides the default port scan timeout of 5 seconds (5000 ms) to just 10 ms, suitable for scanning fast hosts on a quiet LAN. Your next-hop may be more than 10 ms away, meaning it times out too fast to get any results.

It would be incredibly useful to be able to scan for live devices and available ports (similar to a very basic NMAP) You mean like the pscan tool built into Busybox, thus into every Alpine Linux based container? 🤓 > /interface/veth > add address=192.168.88.3/24 gateway=192.168.88.1 > /interface/bri...

This feels like an XY problem . Tell us your end goal, in detail, not about your difficulties achieving the goal given the current contents of your mental toolbox. One or another of the various VPN features in RouterOS will probably do what you want. Realize also that "VPN" is a broader cl...

I was using it for Wake on Lan. I have two different WoL clients here, and both support setting a directed broadcast address. At that point, your routing rules should transport the WoL packet across the boundary without any extra help. If it's being blocked, that's likely a firewall configuration l...

Who uses SSH??? Approximately the entirety of The Cloud . How else do you suppose all those zillions of remote Linux boxes are managed? I mean SSH1 as that is what Open SSH was based on?? Completely incorrect, but off-topic, so I won't chase it further here. Instead, read this , then realize that R...

I moved and re-titled your post because the term scripting has an unrelated meaning to what you posted above. But as for that post, I'm not sure what type of "sorting" you're wanting. At a quick glance, it looks like nearly all of it can be sorted directly into the round file . There is ze...

Sounds like this…

VRRP?

Kept telling me that there is no pool name ipv6. That pool is dynamically created by the first step in the article, "/ipv6 dhcp-client add …" Note that the command can be given on one line without the line breaks and the backslash, or it can be given on two lines, with "/ipv6 dhcp-cl...

Do you have an interface called “wan1”? If not, the script will of course fail. Either change the name to that of your actual WAN interface or rename it to wan1 to placate the script.

The first is best, being straightforward, yet flexible. If the second succeeds, it is only by the accident that there is no service at port 1234 on the router itself. It would not work for port-forwarding external HTTP conns to your public IP while still allowing WebFig access from the LAN, for exam...

/ip dns static add regexp="^(?![\\w]*[-][\\d]{2})(.*[\\.]?ad\\.localdomain)$"… failure: name or regexp required That isn't a "POSIX basic regular expression" (BRE) that this setting is documented as taking . It's vaguely PCRE style, though with odd variations like with the doubl...

<moderator-hat> @denzkie1191, please don't post essentially the same thing in multiple forums. I merged my reply to the other thread into this one, below, then deleted the other one. I chose this one only because it has other replies. </moderator-hat> I just want to ask what what firewall rules sho...

Never mind…confused on the product naming…

I can shop around for and purchase PCIe 4.0 x16 network cards that technically should be able to enable local area network (lan) connections up to 100 to 250 gigabits per second Have you tested whether putting a pair of those into your local computers lets you push 100-250 Gbit/sec between them con...

<moderator hat on> Please don't cross-post, @mmdelhajj. I just deleted a duplicate of your post above in the linked thread. If you want this post merged into the other thread, you can ask and have the matter considered, but don't open the same topic in multiple locations. Also, in case you're wonder...

Your NTP configuration relies on DNS working properly due to the use of address pools. What happens when you say… /tool/ping 0.asia.pool.ntp.org By the way, the whole point of NTP pools is that you don't have to list many addresses. I would pare your local NTP configuration back to a single pool add...

Without the rest of the /export output, we're going to have to speculate somewhat. Your issue might have to do with "/ip/firewall/filter" rules, for instance.

Short of that, have you tried the several solutions given in this long thread?

it probably adds some overhead for Mikrotik You want to talk about overhead, let's talk about what it costs to keep "… more than 280 employees " coming back to the office day after day. You want production-grade software for free because…? Give me a better reason than "because I want...

Build a child container using the following Dockerfile, then install that:

FROM zabbix/zabbix-proxy-sqlite3:ol-7.0-latest
RUN setcap cap_net_raw=ep /usr/sbin/fping

The first one initially appears under-powered, but given the Audience's 27W max power draw spec , you come up with 1.125A at 24V, so 1.2A may work. The main worry here is that you're running the PSU right at its limits and thus may shorten its life. I don't have a good sense of how you would make th...

I already reflashed the firmware via the netinstall methode, using the -e and -r flags, but it did not change anything. Is there anything i'm missing? The thing you might be missing is that when netinstalling to a WiFi device, it's best to pass both the base "routeros" package and the one...

No. Containers are not VMs.

Not only does the same hardware run high-security crypto algorithms just fine (VPN, SSH, HTTPS…) the web login use case is on the order of one per hour. As long as the salt+hash computation completes in ~1 second, it’s fast enough.

authentication types - they seem to be ignored from security config, leaving my network "open" This is the kind of thing I meant in my first reply: you're setting it from two different places, creating a conflict: /interface wifi configuration add antenna-gain=0 country="United State...

Please stop using passwords use ssh keys instead.

The thread is about SwOS, which doesn't support SSH.

BTW the link to the NIST document recommending 8 character passwords, that recommendation is from 2017. I find it hard to belief that anybody would consider that secure today. It depends on what type of rate-limiting is in place in front of it. That's why I bothered to set up fail2ban in front of R...

A sensible limit of that type will be based on a buffer size, as I indicated. 256 bytes is sensible. 1k is sensible. 64k is sensible. 18 smacks of a fixed-length plaintext field in a C structure stored as-is in the flash RAM; there are no common 144-bit hash functions. What they ought to use that sp...

Here's my config It would be clearer if you posted the sanitized output of "/interface/wifi/export", not "print" because that includes sub-items like the configuration and security sections. One thing this can show more clearly is when you have redundant or conflicting items in ...

I don't think that a 18 characters long password can be that much insecure I believe you're missing @mwiesenhaan's point. A length limit implies that they're storing the password in plaintext, thus that it can be retrieved and reused as-is. If they were salting and hashing the password as has been ...

I’ve moved the topic. It beggars belief that the OP could have tried this and gotten that result on SwOS. The true issue must be something else.

Would someone here please clarify if these German Telekom users want PIM-SM, or SSM, or SSM over a PIM-managed network, or…? It feels like an acronym mashup, but lacking experience with these foreign networks, I can’t disentangle it on my own. Both are features of IP multicast, but PIM Sparse Mode ≠...

What's the point than to "have" gigabit port?

@anav said it, but to clarify, traffic between wired interfaces in the default configuration’s “LAN” list will go at a full gigabit, being hardware-offloaded.

Maybe it's time to show your config ? That, or a minimal reproducible test case that is expected to show the same result everywhere. It's unreasonable to expect third-party testers to set up complex things like VictoriaMetrics, but if you instead give us something that can be tried in under a minut...

Are you using one of the official container images for this, or is it something you've built locally?

I tried to find out what the heck a “J.ZAO QL SERIES” was, but I found little that was enlightening. The best of the bunch was this test result, where its ranking of around ¼ that of mainstream top products suggests it’s a cheap PoS at best.

What brand name did this thing come under?

I created 1 network 10.0.0.1/22 and the dhcp gave me ip pool of 10.0.0.100-10.0.1.254. Was it your intention to assign only half the space to DHCP? A /22 subnet spans 10.0.0.1 to 10.0.3.255. Now, we have a linux server from another office in another location which has the ip of 172.16.10.254. What ...

Port mapping has nothing to do with this.

The second result for "port forward" in the docs is this: https://help.mikrotik.com/docs/display/ ... forwarding

/ip firewall filter add action=drop chain=input comment="WAN -> FW | Ping blockieren" \ in-interface=ether1 protocol=icmp This is a bad idea . add action=drop chain=forward comment="ALLG. | Alles andere verwerfen" \ connection-nat-state="" connection-state=""...

I don't see what the actual problem is, but this rule needs to go: add action=accept chain=forward comment="ALLG. | Port-Forwarding" connection-nat-state=dstnat in-interface-list=WAN As you can see from this packet flow diagram , it does you no good, the dst-nat chain being part of PREROUT...

to get ~10g routed traffic on my 2004 i have to turn the MTU up to around 8k Across the OP's CRS309, standard-sized Ethernet packets suffice, if we can go by my CRS328 tests here. I have yet to be able to justify jumbo packets with any test I've been able to devise here. That's not to say it isn't ...

is rule number 8 well located there or do I have to lower it all the way down? It's as far down as it can get already. Rules apply within a given chain, so with no other "input" chain rules after it, that one is at the end already. Pushing it further down in the list shown by WinBox will ...

You should be looking at something like hardware queues instead. It’s a switch, not a router.

This article shows a successful WG config with double NAT. Not ideal, but I ran that way for about a year before I was able to replace the border router with an ax³ and move WG service to it.

.multicast-enhance=enabled

?

If something is little, it doesn’t automatically mean it should be treated as true and correct.

The more smarts you add, the bigger it gets. There isn’t room left even for something the size of crun on some ROS devices that support containers today, much less Podman scale or larger.

TANSTAAFL.

Part of your misapprehension is assuming there is a 1:1 correspondence between IPs and containers. There isn't, and there should not be. Thanks for contributing your time to this issue and writing such a long message. I appreciate your opinion. The part you quoted isn't an opinion. Consider a Kuber...

why should anybody want a VETH independent of any container? I don't think it's a matter of "want" but more a reflection of the bare-bones nature of RouterOS's container runtime. It has no equivalent of " podman network create " for example, much less the even more elaborate beh...

Community , if you use containers, do you think stopped containers should respond to pings? Your question is based on a misapprehension: that started containers respond to pings. They don't. It's the VETH that responds to pings, because it owns the IP you're pinging. Since the VETH lifetime is inde...

Are you sure ? Because my CRS by default works like a router. Are you sure? 🤓 Become sure by saying "/system/default-configuration/print without-paging" and then stripping away all the conditional logic, unrolling the "for" loops, etc. When I do that here on my CRS328 running 7....

Ubiquiti is absolutely horseshit. MikroTik should learn from VyOS developers Are you trying to get banned with all these unprofessional tirades? Bad language aside, UBNT's EdgeRouter series were based on a fork of VyOS. ( Source ) If VyOS is the fount of networking wisdom…? The mind boggles attempt...

Try this.

I think you should keep the CRS310 and extend your existing network like this: https://tangentsoft.com/mikrotik/doc/trunk/images/crs310-rb5009.pikchr?popup The thick arrows represent an aggregation of multiple links, to contrast them with the single-link arrows. This leaves you with a single spare 1...

The overcompensation came because my network is 10G ready, and I don't want to waste money over years upgrading devices. So, I wanted to keep the 10G ready network. This is why I suggested segregating switching from routing, with 10G on the LAN side bottle-necking to 2.5G at the WAN link. Let's use...

Mikrotik, unfortunately, doesn't have competitive routers…Maybe the NETGEAR PR60X would be the best choice at the moment Either you have a strange definition of "competitive," or you're trolling. You offer a $700 NetGear router as an alternative to a $465 MT unit and call the latter non-c...

If the purpose of getting the CRS310 is to have more 10G ports than an RB5009 gets you, you can connect these two together with a short DAC cable. Separating switching from routing is an excellent way to get the best speed. It segregates the 10G LAN traffic from that going out to the Internet throug...

I upgrade the routerboard with CRS310-8G+2S+IN.

No, you downgraded from a router to a switch. Check the test results:

A proper ~2.5 Gbit/sec upgrade for a hEX class router is an RB5009. They've even got a PoE version now.

Seriously? Encrypting DNS across the private LAN is a "huge miss in the entire market space"? That seems a rather niche requirement.

Encrypting over the Internet is the bulk of the market need, and for that, the current facilities suffice.

The internal hosts don’t use DoH themselves. They ask the router questions via plain old DNS, and it asks Cloudflare (in this case) questions via DoH on their behalf.

I don't know whether you're overthinking matters or overlooking something obvious, but there's no obscurity here at all. You set the router up to use DoH as documented, enable an externally-responding DNS server on same with your DoH as the upstream, then pass your router's IP out with DHCP requests...

server is 2012 era…Lenovo Thinkstation C 30 That looks like your problem to me. I wasn't in the 10G market in 2012, but I don't remember anything "workstation" grade coming with 10G NICs, not even the top-end Mac Pro. That didn't start happening until 2016-2017. PCI express lanes on my 20...

I'm still only getting 3-4gbits/sec across the switch.. isn't that a bit weird? First rule of troubleshooting: test one thing at a time. You've got several unnecessary complexities in this setup: Two fiber links to the Home Server in the lower left corner of the network diagram. Unplug one to give ...

listBridge is the exact name from there Yes, that's resulting in unnecessary confusion, for both of us. I reported this issue to MT support, and they've made a whole series of improvements to the First Time Configuration article, and not merely to standardize the article's naming choices relative t...

Hmmm,...the alternative would be to declair those devices "End of Live" or "End of Support"... but would this be the better solution instead of supporting old devices with the newest ROS with concerns? One of the things that pushed me into the RouterOS world is the promise of 5 ...

I went this way as it should give me better understanding of how things work In principle, over the long haul, sure, but as we’ve seen, you made a few serious mistakes already. The biggie is putting the WAN and LAN sides in the same interface list. It had no effect in your prior config, but it was ...

I can not migrate my config to L009UiGS-2HaxD-IN routeros v7. Apply the config in parts. Most things are unchanged. When you get to the part or parts that fail, you can look for advice in the Upgrading to v7 guide in the manual, or by comparing what doesn't work with what is currently documented el...

listBridge is the exact name from there Yes, that's resulting in unnecessary confusion, for both of us. Me because I didn't recognize the alternate configuration and map it back to the defaults, you because this doc leads you to discarding the defaults and starting over from scratch, unnecessarily....

/interface list add name=listBridge You shouldn't be renaming defaults before you fully understand them. The purpose of the "LAN" interface list isn't to alias the bridge or anything like that. It merely expresses the truth that in the default configuration there is only one "interfa...

how does AR8327 Switch know to have all of these ports and bridge port on the same broadcast domain? Because you configured RouterOS to tell it so. If you're asking how switch chips work internally, you might be able to dig up a bootleg copy of the IC manual without signing an NDA, but it'll be a s...

PIM-SM?

a docker container May I ask, whose? Mine is capable of better than that with an RB4011, and an RB5009 should do a smidge better still. See the benchmark results at the bottom of the linked documentation. Partly that's the low-overhead nature of the setup, but also it's careful setup of the test. T...

MikroTik didn't expose jack. Where's EVPN? The Marvell ASICs on CCR2k supports it, where's the “exposé”? We're arguing two separate points. You're welcome to demand every single feature of the chip in RouterOS, but MT has finite resources, and their priorities likely differ from yours atop that. My...

That thread linked of mine isn't a Thesis I’m using that word in the “proposition stated as the basis of an argument to be proven” sense, not the “doctoral dissertation” sense. I do assume you are interested in reasoned argumentation over mere argumentativeness, yes? Linux bridge doesn't have good ...

configuration abstraction complexity of MikroTik The way I summarize that thread's application to this one is that there is some RouterOS configuration change that would somehow cause the OP's application to proceed much faster, and the only reason it isn't being done is that there are too many pos...

Does "unsquashfs --help" list xz as an available decompressor?

What's your version of unsquashfs?

Install an OS designed to be scripted from the ground up, then use that to netinstall your routers. One of many possible expressions of this basic philosophy is this article . This is meant as inspiration, not prescription. No one here is going to design your automated deployment system for you and ...

It should be "configuration.ssid" and "datapath.client-isolation=yes" instead.

The abbreviation is standard, emitted by RouterOS, not something the user did. You can see an example of it here, in MT's own docs.

Do you suggest disabling flow control in the slow-to-fast direction?

I would expect it to have no effect either way, but how about you do the test and tell us?

Do you know why? If you're asking for end-user guesswork, I'd say it's because the entire product category sucks , and MT decided they didn't want to play in the mud any more. Does Mikrotik have a plan to bring back this line of devices? Ask MikroTik. This is a user-to-user forum, not a channel for...

are there any improvements I can make? I don't see any. You've got the main thing there, being the Ethernet flow control, needed with the speed mismatch and protocols like UDP that don't have their own flow control, such as a WG tunnel out to a peer elsewhere on the Internet. Ethernet flow control ...

any idea which is best? Mine, unconditionally, always. 😜 The only material difference is "in-interface=pppoe-out1" vs "in-interface-list=WAN". Since the WAN list has exactly one interface in it, pppoe-out1, the two rules mean the same thing. Which you choose is more a matter of ...

/ip firewall nat add action=dst-nat chain=dstnat dst-address=192.168.1.2 dst-port=80 \ in-interface=bridge-local protocol=tcp src-address=192.168.1.253 \ to-addresses=192.168.1.2 to-ports=80 Drop the src-address bit. It's simply wrong. The packets' source addresses will be unpredictable, being that...

And what about the upgrade for devices with 15.3MB memory(hapac2) ?

"*) system - general work on optimizing the size of RouterOS packages;"

Why force older configs to "short"/10 anyway if the default is "long"/20000? Answers at the top here ; solution in the "Bridge Interface Path Costs" section near the end. As it says, this behavior change is two releases old now. Please keep this thread on-topic. EDIT: ...

The RB5009UPr+S+IN meets that description, though I assume what you really want is a PoE version of the CRS310-8G+2S+IN. Yeah, me, too; been asking for it for nearly three years now, and I'm not alone.

all I get is 3 to 5 Gb on my 10G hardware You need to have everything dialed in to peg the meters on a 10G link with consumer-grade hardware. Disk, memory, packet sizes, drivers… everything . It's why it's taken so long for 10G to reach the consumer market; most PCs couldn't make decent use of it u...

What am I doing wrong? Let's start with the fact that you haven't posted a single relevant detail about your configuration. Post the output of "/interface/wireguard/export" and the Android-side config at minimum, stripped of all keys. (You could technically leave the public keys in, but s...

NET:ERR_CERT_COMMON_NAME_INVALID That means the name you put into your browser's address bar doesn't match the CN field of the certificate. Use your browser's certificate inspection tools to cross-check this. This is my current conf (i've been trying random stuff for hours so may be a bit messy) Ye...

…the same port flapping… What makes you believe our flapping is your flapping? I'm serious. The "severe" in this thread's title was correct, at the time, and it is now fixed. It was bad in the early 7.x days. Now it seems any time someone sees more than one flap, it's suddenly "sever...

What's up with this toxicity? That's not the intent. I'm reacting to a combination of things. You currently have a post count of five, and yet you are insisting that you know how RouterOS works internally. I believe my years of experience counts for something here, but at the same time, I've taken ...

But the other ports are not connected phisically to the network, does that matter? There are control freaks here who think you should have to go into the router/switch configuration to explicitly enable the port when plugging a new device in. Me, I just bridge all the LAN-side ports and be done wit...

It's not like each interface is dedicated to it's own single CPU core You’re presuming an implementation. I thought you came here to ask how RouterOS works, not tell us. We forum denizens are fellow end users for the most part, not RouterOS software engineering insiders, but one thing I can confide...

I created this post so somebody who has knowledge about Mikrotik hopefully can explain why the performance is so bad. You already got that, to a lesser extent from me, and then mkx, who's about as knowledgeable as it gets around here. The test seems to be using UDP. I guess that makes things quite ...

I have firewalls upstream, so that would not give me the correct results. So you're measuring the speed of the firewalls, not the speed of the network. Take a look at the RB5009 test results . Your application is the lower rightmost number in the first table, tiny packet sizes, so that almost nothi...

I have a server behind NAT Why isn't it bridged to the LAN it needs to examine instead? Why is only 50 % of the packets showing up as FP Because that decision can't be made until after the first SYN is seen, where the default firewall applies the fasttrack-connection flag . This is one of many cost...

It is the "Default Router Configuration Script" given immediately below the "-s reset.scr" bit that references it. If you don't like mine, write one that configures the router as you please.

My suspicion is that the IGMP snooping happens with hardware offload and the OS isn't pulling all the info from the switch chip. While it is true that IGMP snooping is a layer 2 function best offloaded to the switch chip, that doesn't mean you can only see the MDB on devices configured as the queri...

So hard..

It’s easier this way…

If nothing else, reading that will give you insights into the necessary complexities in this process, as opposed to the unnecessary ones imposed by pressing a general-purpose Windows laptop into this role instead.

This one doesn't teach how to do it with CAPsMAN so it doesn't work for me. One of the things that CAPsMAN does is create a single virtual bridge among all the WiFi routers under its control. I've never used CAPsMAN, but doesn't that mean the bridge filtering option at the end of that article would...

Pease I need an answer guys I need you.

The article I linked you to above gives two different solutions. What was wrong with them?

I just got a Mikrotik CRS112-8G-4S-IN 8 port Gigabit Cloud Router Switch and I need to use it as a router. Postel's ghost help you, then. That's a gigabit switch , not a gigabit router . Yes, it can route, but at tens of megabits per second with a likely configuration, low hundreds at best with a h...

If the OP was already using VLANs, putting the guest WiFi on another one would be perfectly justified.

Converting this configuration to VLANs for that single purpose, however, is not. You do not need VLANs to have an isolated guest WiFi network.

you can't put that new pest on a 16MB flash anyways :lol: Turns out, you can, but that's about all you can get into that space: $ rpm --queryformat='%6{SIZE:humaniec} %{NAME}\n' -q systemd 12M systemd I realize you're joking, but the on-topic point here for this thread is, "No, there is no sys...

because I don't use Windows. So the winbox will be not an option for me. WINE runs WinBox well. But in fact the behaviour should be uniform. Either everything or nothing escaped. It's not nearly that simple. The stupendous compound complications of human languages are collectively and imperfectly r...

the css610 needs to be working with the ver2? anybody knows the details of the right values? IGMPv3 simply adds features to v2, without breaking compatibility. However, the rules of the protocol are that any IGMPv3 device that sees a v2 packet is supposed to shift into v2 mode, using no v3 features...

I get the error "outgoing interface matching not possible in input and prerouting chains" when I put out interface That’s why you need the mangle rules and additional routing tables @pimmie initially suggested. Study that PCC doc I linked above. Once you understand it, you will understand...

There are a vast number of "cloud services," which is why I did not dare presume your meaning before, but I am now willing to dare a guess that you mean RouterOS's Cloud feature . If that's the case, you simply modify the route command I gave you before to direct packets to the documented ...

I think the part I was missing is the direction of the VPN tunnel establishment. You did not state that, and so I presumed that you were allowing an external network to connect into your VPN server via that public IP you speak of, in which case you get the behavior I predicted. It sounds like the VP...

I don't think it's possible to switch between Router and Bridge mode or do whatever Quickset configuration on the CLI There's nothing QuickSet can do that you cannot do from the CLI. The only tricky bit is doing it in a single step without locking yourself out. For this, you have to rely on RouterO...

one port linked into another network where the igmp querier is configured. By "another network" do you mean another subnet, putting it beyond a routing layer, inside another broadcast domain, or do you mean another segment of the same LAN? There needs to be one querier per subnet; no more...

I’m not seeing that you need to do anything more clever than set the default route to WAN2. That sends local traffic out that direction, but inbound VPN traffic comes in on the public IP bound to WAN1, which means the outbound replies go back out the same direction. What am I missing that makes this...

I think we’re getting caught up in a confusing use of “client” here. Study the diagram. OP refers to two business client hosts running servers on the same IP. The network clients are across the Internet, if I’m reading this correctly.

Will have to research this one. @pimmie is essentially proposing the inverse of a typical PCC load-balancing configuration . Instead of one LAN fed by two ISPs, you have two LANs accessed from the one-and-only Internet. They also used default ports like port 80 If all Internet clients connect to po...

@pimmie, yes.

The only remaining question is how will they discriminate the incoming connections? Will it be acceptable to port-forward $PUBLIC_IP:8000 to Web Server 1 and :9000 to Server 2, or are they going to want some type of domain name-based routing?

how did you fix this?

Post #4.

DHCP snooping is a feature that causes a RouterOS switch to drop DHCP service replies from ports that aren't authorized to send them, to prevent a malefactor from reconfiguring your network one host at a time. There is no "database" or "table" for this, only the per-port trusted ...

Search found 1595 matches