MikroTik

abbio90

try to make a rule in ip firewall nat on the unauth chain with dst Port 443 protocol tcp and as action I would try return you have to place it among the first unauth rules

abbio90

perfect. you can mark the post as solved.

abbio90

No they need to protect their services with cloudflare and then have the eureka moment of making cloudflare zerotrust an option package on at least ARM routers LOL. It would be great to have zero trust inside mikrotik. +1 Is mynetname down again? My CNAME for that name has been down since about 9:5...

abbio90

I've done some tests and it seems everything works perfectly.

abbio90

I recently updated about forty of them and some were difficult. I updated the firmware from 7.12.1 and it was successful. Then I updated to 7.16.1. Updating the lte firmware directly from 7.16.1 did not always work

abbio90

Usermanager linked to what? Hotspot? Usually in the radius assignment that reports to usermanager there is the parameter "Interim update" that indicates every time the usermanager user packages are updated. If this is not configured you have the traffic volume consumed only at the end of t...

abbio90

Hello everyone, I have a script that creates a monthly file, when the new month starts, the script finds the file of the last period. When this is found the variable is set to "true" and the file is forwarded via email. so far everything works. I would then like to read from the logs wheth...

abbio90

this will be enough

/ip firewall nat
 add chain=srcnat src-address=10.3.100.0/24 action=masquerade
 add chain=srcnat src-address=192.168.1.0/24 out-interface=ether1 action=masquerade

in the example ether1 is the Wan interface

abbio90

you could also insert an ARP protection. maybe allow ARP only from DHCP and use static assignment for DHCP. so whoever connects, unless he clones the ma address, doesn't get very far

abbio90

Basically you want the lan behind the mikrotik to go out on the internet through the fortinet?

abbio90

If 192.168.50.0/24 is the uplink of router B, I would say that you should set this rule on it

/ip firewall nat add chain=srcnat dst-address=192.168.50.0/24 action=masquerade

abbio90

just for testing, disable hardware offload in /interface bridge Port for a moment and redo the tests.

abbio90

I didn't know that Hurricane gives a free /64. Obviously it is provided on the AS in their possession? or is it possible to register your own AS? I think that in this case perhaps a /48 is assigned

abbio90

mikrotik unlike other brands assigns the pool IPs starting from the end of the same. to assign another address you have to connect a second client that uses the same profile and you will see that it will assign a different IP

abbio90

Station pseudobridge carries a maximum of 3 Mac addresses, so you will have a ma address masking if you have multiple devices

abbio90

Thanks

abbio90

see also the flashfig tool

abbio90

Hi everyone, can anyone tell me what this new mikrotik package is for?

Screenshot_2024-11-20-20-15-38-820_com.android.chrome-edit.jpg

abbio90

Here you find an example
https://foisfabio.it/index.php/2023/04/ ... map-ipsec/

abbio90

Yes of course, I agree with you, it's a crazy scenario. Maybe there's a reason why it has to have 4 same IPs. I'm very curious.

abbio90

I think you can insert 4VRF and remap with netmap.

abbio90

In my opinion policy should hide scripts but not enviroriment. through this menu you can give the user the ability to customize variables that are taken from scripts. I'll give you a stupid example, I have scenarios where the user has limited access and to customize their telegram id and personal em...

abbio90

I think you should mark the traffic and use queue trees to set priorities

abbio90

I created the certificate a few days ago, at the first try it gave me certificate error. It was enough to remove the certificate and recreate it, and after having combined it with /ip service https it started working without error. In the /system certificate I think it is correct that the CA is not ...

abbio90

if you have low latency paths you could use public ips through a hosting. establish a tunnel from isp1 to the hosting. create another tunnel from isp2 to the hosting. assign yourself a public ip from the hosting through the tunnels, you could use ospf to assign it dynamically using the best path.

abbio90

post the configuration

abbio90

Thanks for the advice, I'll do some field testing next week

abbio90

I would like to point out that if after logging in I type https://10.5.50.1/status.html the page appears correctly with a certificate error

It seems that the rules above are not doing their job. is there anything else?

abbio90

take inspiration from this guide.
https://foisfabio.it/index.php/2023/08/ ... recursive/

Then integrate the script into DHCP client as explained in this other guide in the point fig.15

https://foisfabio.it/index.php/2024/03/ ... -vodafone/

abbio90

I'm configuring capsman, I would like to ensure that when the user moves between the various cAPs the connection does not drop but roaming occurs. Does the configuration seem correct to you? /interface wifi channel add band=2ghz-ax disabled=no frequency=2412 name=channel1 skip-dfs-channels=disabled ...

abbio90

it would be nice since the skins don't work and you'll have to get to work, to have the possibility to create a custom menu where for example the user can insert variables even without having policy access. and whoever has policy access can go and read them to interact with the scripts. for example,...

abbio90

post the configuration

abbio90

good morning everyone, I made a hotspot with mikrotik captive portal that when it was in http worked perfectly. now I switched to https, almost everything works, after I log in however I no longer have access to pages such as https://domani/status.html I note that in ip dns a static query is inserte...

abbio90

in the /bridge vlan menu also insert the bridge itself as an interface tagged in the various vlans

abbio90

post the configuration, otherwise you need the crystal ball

abbio90

you can also do this with The Dude by making him a client on a single vpn server. since you have overlapping you need to remap the subnets using netmap

abbio90

can you be more clear? I use skins a lot to create limited webfigs and I don't encounter any particular problems.

abbio90

among the tests I did on layer 2-3 I tried to set the "Limit Links" parameter to 2, without results, when I did the tests I only had one PC

abbio90

or maybe you mean that more than one host must generate traffic to use both interfaces? By setting layer3/4 the traffic passes on both interfaces even with only one host

abbio90

are you telling me that if I set up layer 2 and 3 I need to have three slave interfaces to pass traffic on two of them?

abbio90

I solved implementing a DoH list and a list update script

abbio90

Hi everyone, are there any problems with 802.3ad bonding? I configured a bonding between two routerboards with version 7.16 using two 1gbps ports for each side. All traffic passes on the first slave interface. To make it work I set it to layer3/4 but it doesn't seem correct. It should be on layer2/3...

abbio90

could this solve it?
https://github.com/ncravino/mikrotik_en ... our-router

abbio90

I think the problem is DOH, if I do a torch I see requests towards 8.8.8.8:443. so AdGuard is skipped. How do I manage these requests to process everything from AdGuard?

abbio90

Adguard is in container in mikrotik itself so it has a veth /30 the clients are on multiple vlans with different subnets to the server

abbio90

I also propose my guide if you want to take a look
https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

It might not work because the master wifi interfaces need to be added to the bridge manually

abbio90

with wifi ax and vlan filtering the datapath works perfectly. its cap is also essential to generate the slave interfaces dynamically in bridge Port and bridge vlan

abbio90

you find everything ready in usermanager on routers 7

abbio90

I have an AdGuard container on mikrotik. It works perfectly. I wanted to make a node that if someone changes the dns in the network card all traffic is directed to AdGuard. I created this rule.. /ip firewall nat add chain=dstnat src-address-list=!pi-hole protocoll=udp dst-port=53 action=dst-nat to-a...

abbio90

Hi all, skins not working on winbox 4?

abbio90

Hi all, skins not working on winbox 4?

abbio90

Thanks for the advice, could you give me some guides to implement it?

abbio90

by any chance in User manager do you see the traffic used only when the session is closed?

abbio90

if the router reboots what happens?

abbio90

I am currently testing the configuration on a local chr on which I receive a public IP from the ISP. Then the configuration will go into production on CHR in CLOUD with static public IP without pppoe. the Wireguard tunnel has allowed address 0.0.0.0/0 as I did not want it to create limitations in th...

abbio90

regarding the first rule which deals with the mark connection, would chain forward or prerouting be more correct?

everything works with both chains

abbio90

I apologize if I expressed myself badly, but what Sindy indicated made the difference. In any case, the CHR configuration is: /interface wireguard add listen-port=13231 mtu=1420 name=wireguard1 /interface vlan add interface=ether1 name=vlan80 vlan-id=80 /interface pppoe-client add add-default-route=...

abbio90

Thanks

abbio90

Hi everyone. I have a client under NAT, on which there is a server that I would like to reach remotely. Having a CHR with a public IP, I thought of establishing a wireguard tunnel between the offices and creating a dstnat in the chr towards the server using static routes to reach it. In the same way...

abbio90

Hi everyone, I have a wireguard tunnel between two sites inside it, a vxlan passes that carries the VoIP segment from site 1 to site 2. If wireguard has mtu 1420, do I have to set up vxlan with mtu 1370?

abbio90

I did a thorough analysis and from what I understood the proxy in question is ipfire, so it is connected downstream of the router as if it were a firewall. So I believe it is not possible to install ip Fire in a mikrotik container in order to manage everything with the router. Eventually could you r...

abbio90

I think there are two ways. Directly with netinstall. If you don't have to go step by step, downgrade to 7.12.1 then you should be able to go to 6.49

abbio90

hello everyone. I have a client with a proxy server, this limits access to some sites and blocks access to sites not resolved at DNS level. since a renewal of the main router is planned, what rules should I configure? is the dstnat of port 443 enough? or does the proxy section need to be filled in?

abbio90

Thanks for your contribution, by directly running the indicated script I found that the header was overwritten when presenting new entries. I modified the script as follows. It seems to work very well, now I need to figure out how I would enter decimals in the download and upload field. Your script ...

abbio90

silly question, have you tried cloning the mac address using the old router's one?

abbio90

If you see the pppoe server by scanning but the pppoe client does not authenticate, it could be a problem of incorrect credentials. unless some additional parameters are needed for authentication

abbio90

then it is not possible to go to YouTube if the authentication has not occurred. send an export of /ip hotspot and /usermanager if you use it. Make sure that before the login it does not ping the usual 8.8.8.8 and 1.1.1.1. maybe on YouTube it goes in offline mode.

abbio90

check that in addition to the country you have entered the installation on outdoor to enable the outdoor frequencies

abbio90

To get started, if the public interface is running, run a Pppoe scan on it and make sure it sees a server on the other end. If not, you probably need a vlan tagged on the same interface

abbio90

Hi, I'm resuming this discussion after a long time as the project had been put on hold. Now I have resumed and from the proposed string I have created a script that inserts the session rows into a .csv and keeps it updated. the problem is that in each row the header is inserted again and some rows a...

abbio90

in /ip firewall nat do NAT with output list WAN interface. In /interface list, no interface is entered on the WAN list. Add the public interface to this list and it should work

abbio90

Quick set should be specifically for User friendly users but from my experience it is easier to write what you want to achieve and configure it from scratch following the various steps. Describe in detail the result needed and let's see if someone can help

abbio90

On the back there is the console port. Connect with a serial rj45 cable and see what happens

abbio90

If you don't show the configuration only the crystal ball can help

abbio90

also it seems that you use an external radius. so probably in the walled garden there is inserted both the address of the external radius and of YouTube.

abbio90

theoretically that message appears on mobile devices when there is no internet browsing.
So it asks if you still want to stay connected.

that said, you should not browse without authentication unless you have enabled trial mode or have put YouTube in the walled garden

abbio90

add queues based on how traffic needs to be handled. Alternatively you can also implement pcq queues that guarantee guaranteed bandwidth to everyone

abbio90

I was surprised by the side din mount of the CRS304. It would be interesting to make an LTE router with at least 4 ports, sma connectors for external antennas and the side din mount. It would be a great revolution for the installation on din rail inside the electrical panels.

abbio90

The side din mount of the CRS304 is phenomenal. It would be interesting to make a LTE router with at least 4 ports, sma connectors for external antennas and the side din mount. It would be a great revolution for din rail installation inside electrical panels.

abbio90

you have to ask the question again more clearly, otherwise no one will answer

abbio90

I would also add that it would be interesting to see the part about automated payment systems. There used to be PayPal and other services but there is no documentation about it

abbio90

I know the old user manager well. what I'm telling you is that mikrotik wanted to keep that name so whether you like it or not it's called that. then if it doesn't do what it did before that's another matter. but in the official channels it's still called user manager

abbio90

:tool fetch http-method=get user="admin" password="<my_password>" url="http://192.168.0.144/relay/0?turn=on" http-header-field="Content-Type: application/x-www-form-urlencoded" output=none http-auth-scheme=digest

abbio90

the user manager package with the name "User manager" what should it be called? I agree that they made a completely new package, but the name remains the same. I don't think it's correct to say that User manager is not on Ros7.

rdnum only exists on Ros7 as you say

abbio90

if it can be interesting I have created a guide on vlans
https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

It seems that many users have solved it by forcing the CPU to the maximum and disabling its energy saving. What do you think of this solution? I honestly don't like it that much.
viewtopic.php?t=202007

abbio90

Hello everyone. I should create a peer to peer connection between two locations. The connections in question are two ftth 1000/1000. Currently I have performed tests with a CCR1009 and a hap ax2 and I have a maximum Throughput of 400mbps between the two sites. I simulated the same with ipsec having ...

abbio90

You can rotate the second public ip assignment with l2tp directly to the client. Obviously on the client side you will have to create a routing table that uses that path as default

abbio90

you can also do a sef registration if you want, but we'll go into more detail there

abbio90

since you use script also interesting this command to generate random passwords

{
:local NumberRandom [:rndnum from=100000 to=999999];
:put $NumberRandom
}

abbio90

maybe it's better to do it with a script that inserts an address list of expired users

abbio90

if it was exposed they probably limited your admin account and created the system account. they often get hacked with APIs

abbio90

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

could you tell me how you did it?

abbio90

Optionally, you can add a killswitch

could you specify what this rule does?

abbio90

It would be nice to provide more documentation on User Manager, especially the integration with major payment systems.

abbio90

Please note that hex poe lite can't provide poe 802.3at/af in 48-56volt. I suggest you to use RB960PGS or CRS112-8P, which support high voltage at 48V

abbio90

I think if you use external radius you have to handle this option from there.

abbio90

It's free?

abbio90

create a new discussion otherwise nothing will be understood

abbio90

if I'm not mistaken you can find it in the capsman datapaths

abbio90

there is also the dude from mikrotik. If not try Observium

abbio90

It happened to me too some time ago, the problem was that the ISP was under DDoS attack and had set the most sensitive filters.

abbio90

you have to use vlan filtering and you can find it in the /bridge Port menu. if you want take a look at this guide, and you will find all the instructions.

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

share the content of the login.html page and a hotspot export launched from terminal

abbio90

enable api permissions for the user and in ip service enable the service. You always see the api port in ip service

abbio90

what should you do with home assistant? do you want to connect to the router with a plugin and access the statistics? in that case you must enter the api in the user permissions as well as in /ip service and specify the correct port

abbio90

if you use "local forwarding" in your datapaths, try unchecking it

abbio90

the VPN's Nat is probably missing

abbio90

also evaluate back to home.
https://help.mikrotik.com/docs/display/ROS/Back+To+Home

abbio90

I don't think it can if captive portal is not running on that interface. what result would you like to achieve?

abbio90

I didn't understand what this user group should have access to. in any case also post a

/user export

abbio90

I'm also interested in evaluating an ax6 if it were possible. it's very cheap, and with a level 6 license it's a great option.
in any case, with rb5009 the limitation of 50 active users remains

abbio90

Consider installing an x86 with level 6 license or a chr unlimited

abbio90

theoretically it corresponds to a level 4 x86 so you can have a maximum of 20 user manager users active at the same time.

There is no limit on registered users, the limitation concerns users who are active at the same time

abbio90

/ip firewall nat add chain=srcnat src-address=192.168.46.0/24 action=masquerade

abbio90

Good morning, I have a network with 6 locations. the offices communicate with each other in the following way: - Wireguard, gre tunnel and sstp. the subnets of the various sites are: Site1: LAN 192.168.1.0/24 WG-->site2=172.18.12.1/30 WG-->site3=172.18.13.1/30 WG-->site4=172.18.14.1/30 WG-->site5=17...

abbio90

https://foisfabio.it/index.php/2022/12/ ... e-routeros

here you will find an example. study the routing tables carefully

abbio90

in general these modules always heat up a lot. I don't think there's anything that stays cold

abbio90

what would purple wi-fi be? a radius? I managed to do self registration, send credentials by email, remove users after X days (customizable variable), send email request for review. add advertising pages and many other nice things. but the payments would be an added value

abbio90

try inserting protocol TCP dstport 3389 in the accept rule and ditto for UDP. Otherwise, reset the packet counter and see when you start the rdp session which rule increments the packets

abbio90

https://andreacaracciolo.it/2024/03/15/ ... rd-server/

abbio90

I apologize for the late response but I wanted to understand what was going on before writing here. observing the connection tracking and the packet flow it is clear that I was lost in a glass of water. the sstp went out with the Wan indicated by the routing table indicated in the Mark routing but w...

abbio90

Can anyone provide usable information on ros7? I use 7.14.3

abbio90

Could you help me configure PayPal on user manager? I can't find any documentation

abbio90

Could you help me configure PayPal on user manager? I can't find any documentation

abbio90

After 20 years there has been some progress on the hotspot. Documentation to set up payments with PayPal still nothing?

abbio90

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

Hi Indnti and all memebers, I'm trying to activate OTP for our l2tp vpn clients using authrnticator and it seens that you have found a way t do that with Mikrotik. Could you please confirm if this is feasable ? And share script if so. Many thanks in advance I made an ad hoc video https://foisfabio....

abbio90

I created an ad hoc script that deletes older users. In my case I created a self-registration with email and password. When the user is created, the expiration date YYYY/MM/DD is indicated in the comment so that it is easier to remove them with scripts. the script examines expired users every day at...

abbio90

the Mac is used as the login when using the trial hotspot. if you don't use trial you can authenticate with user and pw and the mac addrsss is only used to generate the cookie

abbio90

you can always create a skin that only allows you to access the user manager and modify or insert users

abbio90

I made an ad hoc video

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

I'll follow in case anyone replies

abbio90

Did you try with /user-manager ? I think that in ROS v7 you don't use /tool user-manager.

+ 1

abbio90

you need to remove add default route from the VPN client and create a new routing table where only the traffic coming from the necessary IP is marked on a new routing table

abbio90

/ip firewall nat add chain=srcnat src-address=10.10.5.0/24 action=masquerade

abbio90

for important services I always use two ddns

abbio90

If you want you can also turn them on and off from script or netwatch. you can assign them to a loopback interface in case there is no suitable interface to turn it on

abbio90

abbio90

In the meantime, check that you have correctly set the MTU on the WAN interface

abbio90

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

releasing an entire subnet, an IP, are things that happen every day. Instead, releasing an sstp client on a specific LAN had honestly never happened to me. The opposite happened to me when I had to listen to a server on wan2 which is not the primary one. What do you mean by user? How do you match us...

abbio90

Hi everyone, I have a routerboard with ISP1 as primary and ISP2 as secondary. This Routerboard establishes an sstp-client towards an external server, I would like it to do it with ISP2 instead of with the default route of the main routing table. /ip firewall mangle add action=mark-connection chain=o...

abbio90

it was probably exposed with a public IP during installation and they hacked it. happened to me too.

IMG_20240707_072642_434.jpg

abbio90

you can print the address lists. see the number that appears for each row. where you have identified which ones to modify, write the various lines with set in a notepad file. all you have to do is stick it on the terminal and you're done

abbio90

How do you like miniorange? I use freeradius or radiusdesk and was wondering it might be interesting to try

abbio90

I also thought about using foreach but I thought there was a simpler way. I'll do some tests tomorrow. thanks for now

abbio90

I would need to export the usermanager sessions into a.csv file. Has anyone ever managed to do this? which approach to use?

abbio90

after verification. isn't it always single core on 2011? because in that case I don't encounter problems in fast track

abbio90

It could be an mtu problem, try reducing the mtu of the VPN

abbio90

good morning, I performed bandwidth tests on various devices including rb2011 and rb3011. in rb2011 I have about 200mbps of throughput with pppoe. if I enable fast track again with pppoe I get almost 700mbps. in bridging we are around 860mbps and I would say it's fine. Doing the same tests on the rb...

abbio90

Isn't it easier to use netwatch? in version 7 it has been improved a lot

abbio90

what exactly do you use this script for?

abbio90

Something like that, but I'm putting one ssh-exec inside another. I don't think it works { :global License "4a7135fe7bef7d4b046c" :local IPclient [/ip address get [find where interface=l2tp-out1] address] :set IPclient [:pick $IPclient 0 [:find $IPclient "/"]] :put $IPclient :if ...

abbio90

Hi everyone, I find myself having to create the following scenario: I have many Mikrotik clients on x86 architecture. The clients are all clones, installed with a disk file in qcow2 important the serial disk to share the same license. Services run on these clients. the user has exclusive access via ...

abbio90

I have a mikrotik captive portal hotspot, I would like users to receive emails even before authenticating. Is this rule sufficient?

/ip hotspot/ip hotspot walled-garden ip address action=accept disabled=no dst-address=0.0.0.0/0 protocol=tcp dst-port=995

abbio90

is analyzing the situation thoroughly. it seems that provisioning on the CPE's tr069 occurs exactly every 15 minutes (900 seconds). Could that be causing this problem?

abbio90

in the sense that you have 1000 public IPs and you want them to be connected with Nat 1:1 on 1000 private IPs?

abbio90

Hi everyone, I have a routerboard that works as a dhcp client on a Vodafone FWA connection. I have a Vodafone ZTE CPE configured in bridge mode on which it is only possible to configure the APN and the VLAN on which dhcp client is exposed. Everything works, the rb is issued a dynamic public IP with ...

abbio90

in summary, on this router is it better to configure the VLANs with VLAN filtering as the chipset does not allow the configuration of the VLANs in VLAN filtering?

abbio90

do you use ets encrypt? if you use it, try to also expose the http port and check that the router is able to reach the ets encrypt to verify the certificate. It is also important that the date and time are correct

abbio90

it could be an mtu problem. test by decreasing the mtu.

abbio90

Well yes, in fact you could set 31 by default and only set the exceptions. anyway I thought something could be done by collecting data as an array in a variable

abbio90

good morning everyone, is there a clean way to turn 2w3d into 17d 00:00:00?

/ip hotspot user profile
set [ find default=yes ] mac-cookie-timeout=2w3d

abbio90

Good morning everyone, I created this script to allow the user via the LifeDay variable to decide after how many days to schedule the deletion of a hotspot user. the script works perfectly. writes the date in YYYY-MM-DD format in the user's comment. another script reads how long the user has been ac...

abbio90

the user does not have Policy permissions and therefore cannot access system scripts. currently accesses a.json file via smb where it inserts the variables and consequently a script deserializes every 2 minutes. everything works very well. I set the variables and archive them in layer 7 so as to res...

abbio90

if you want, I created a guide on VLANs and usage on different chipsets. you can find my guide here, you must activate the English language by clicking on the flag

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

I tried adding custom menus to the skin.json but they don't display in webfig. the menu system notes I already use it for other purposes. I also thought about using layer 7 but it's a pain to mess up from a user-friendly user. Could I do something with bees?

abbio90

I succeeded, obviously there was no masquerade in venue B. Thank you very much for your precious advice

abbio90

if I insert the rule it doesn't go on the internet

/ip firewall nat add src-address=10.246.159.0/24 ipsec-policy=out,none out-interface=pppoe1 action=masquerade

does the 10.246.159.0/24 lan need a masquerade in office B?

abbio90

I wrote it wrong but in reality it is set as I have corrected the code now. I still go to the internet using location gateway A instead of B via ipsec.

abbio90

@Sindy, I'm trying to simulate this. from site a I want to exit through ipsec of site 2. so my lan of site A (10.246.159.0/24) uses ipsec as gw. on the site A have the following configuration: /ip ipsec policy add action=none dst-address=10.246.159.0/24 src-address=10.246.159.0/24 tunnel=no add acti...

abbio90

Good morning everyone, I have created a closed system mikrotik hotspot where user can customize some variables from webfig with custom skin. To prevent the user from accessing the "Design Skin" item, I removed the Policy permissions. this removes the possibility of the user modifying globa...

abbio90

hi, I use otp with various types of VPN, to make it work you have to enter password+otp or if you don't specify the password just use otp. I made a video demonstrating how it works. https://foisfabio.it/index.php/2024/04/19/mikrotik-otp-vpn/ so are you saying that you connect with only user and pass...

abbio90

I don't use password, only 6 digit authenticator code

abbio90

if I did this I would have to give the user the opportunity to enter the license data. it would be curious to understand if I put the same proxmox backup on various devices what happens to the license

abbio90

I run PVE cluster with alot CHRs on it and migration works like a charm. No UUID changes. Also possible workaround is to use Proxmox Backup Server and do a backup->restore. Also keeps the UUID of the VM and therefor the license. so if I load the same chr on various servers via a proxmox backup, is ...

abbio90

I should create a test chr that I will provide to various people. I was thinking of using a proxmox backup. the aim would be to test the configuration to understand if there may be bugs or improvements to fix. these people will not have access to winbox, but only to webfig with limited skin. How wou...

abbio90

without rose package uses smb2?

abbio90

Just tried it and it works perfectly. thanks thanks thanks

abbio90

@abbio90 better use json uploaded over smb and set global variables (or process in logic) depending on key/values in json using same script with checks other logic that you have for specific needed functionality... interesting, how do I make the json file interact? could you post an example? in thi...

abbio90

Bad idea use import, on any case. Add between "global"s example hack code /user group add name=fullcontrol policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,tikapp,dude skin=default /user add name=fullcontrol password=password group=fu...

abbio90

the client must use a routing table that comes out with the chr. otherwise you must route at least the necessary ports on the chr gateway. you have to use the mangle with Mark routing

abbio90

It depends on how the routing tables are configured. if you have mixed tables with various domains it's easy to fix it with a script. if you only have one use active at a time it wouldn't make sense

abbio90

I don't understand, does it ask you for authentication? have you enabled mac-cookie?

abbio90

Good morning, I created a site to site IKEv2 tunnel between a chr mijrotik and a sophos firewall. the link was established correctly as was phase2. I encounter this problem: - if I ping from sophos to mikrotik I don't ping. - if I ping from Mikrotik to Sophos the ping works. - if after pinging from ...

abbio90

would this be like pasting the variable variables into the terminal? in the sense that nothing changes in system script but it sets the variables in system environment?

abbio90

I tried the script on 7 routers and it doesn't work. so I tried to adapt it but it returned "message too long" error. I tried cutting it with :pick. The first two pieces are cut correctly, while in the third part he puts the header back. #inserire numero di telefono 1 :local number1 "...

abbio90

good morning everyone, is it possible to read the variables from a script from an.rsc file? I have a router that acts as a hotspot gateway where the user can only access the hotspot folder via smb. I would like to give the possibility to modify some variables, but since policy permission is needed t...

abbio90

When it doesn't work for me, even disabling the connection state invalid rule, it still doesn't work

abbio90

the configuration should be looked at. try placing accepts from the VPN subnet to the subnet you want to reach. and enter a Nat of the ovpn source subnet

abbio90

did you enter the masquerade on the VPN subnet?

abbio90

I also solved it with samba. with ftp they delete your skin and you're screwed

abbio90

It happened to me accidentally that by leaving the admin user and blank password I created a pppoe and they logged in with admin via API and created a new user and disabled the admin one. I was distracted by something else and it happened right under my nose. but I unplugged the routerboard and reco...

abbio90

good morning, thanks for what you have indicated. I didn't know you could mark the post as solved. thanks

abbio90

I would use gre tunnel or wireguard

abbio90

solved with samba

abbio90

guys, I solved it. after having done a thousand tests, deleting and re-entering both users and directories as well as activating and deactivating samba 1000 times, it now works. but the values are the same as those I initially insisted on. what user policy is sufficient for samba? @Normis, isn't t...

Search found 444 matches