MikroTik

abbio90

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

could you tell me how you did it?

abbio90

Optionally, you can add a killswitch

could you specify what this rule does?

abbio90

It would be nice to provide more documentation on User Manager, especially the integration with major payment systems.

abbio90

Please note that hex poe lite can't provide poe 802.3at/af in 48-56volt. I suggest you to use RB960PGS or CRS112-8P, which support high voltage at 48V

abbio90

I think if you use external radius you have to handle this option from there.

abbio90

It's free?

abbio90

create a new discussion otherwise nothing will be understood

abbio90

if I'm not mistaken you can find it in the capsman datapaths

abbio90

there is also the dude from mikrotik. If not try Observium

abbio90

It happened to me too some time ago, the problem was that the ISP was under DDoS attack and had set the most sensitive filters.

abbio90

you have to use vlan filtering and you can find it in the /bridge Port menu. if you want take a look at this guide, and you will find all the instructions.

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

share the content of the login.html page and a hotspot export launched from terminal

abbio90

enable api permissions for the user and in ip service enable the service. You always see the api port in ip service

abbio90

what should you do with home assistant? do you want to connect to the router with a plugin and access the statistics? in that case you must enter the api in the user permissions as well as in /ip service and specify the correct port

abbio90

if you use "local forwarding" in your datapaths, try unchecking it

abbio90

the VPN's Nat is probably missing

abbio90

also evaluate back to home.
https://help.mikrotik.com/docs/display/ROS/Back+To+Home

abbio90

I don't think it can if captive portal is not running on that interface. what result would you like to achieve?

abbio90

I didn't understand what this user group should have access to. in any case also post a

/user export

abbio90

I'm also interested in evaluating an ax6 if it were possible. it's very cheap, and with a level 6 license it's a great option.
in any case, with rb5009 the limitation of 50 active users remains

abbio90

Consider installing an x86 with level 6 license or a chr unlimited

abbio90

theoretically it corresponds to a level 4 x86 so you can have a maximum of 20 user manager users active at the same time.

There is no limit on registered users, the limitation concerns users who are active at the same time

abbio90

/ip firewall nat add chain=srcnat src-address=192.168.46.0/24 action=masquerade

abbio90

Good morning, I have a network with 6 locations. the offices communicate with each other in the following way: - Wireguard, gre tunnel and sstp. the subnets of the various sites are: Site1: LAN 192.168.1.0/24 WG-->site2=172.18.12.1/30 WG-->site3=172.18.13.1/30 WG-->site4=172.18.14.1/30 WG-->site5=17...

abbio90

https://foisfabio.it/index.php/2022/12/ ... e-routeros

here you will find an example. study the routing tables carefully

abbio90

in general these modules always heat up a lot. I don't think there's anything that stays cold

abbio90

what would purple wi-fi be? a radius? I managed to do self registration, send credentials by email, remove users after X days (customizable variable), send email request for review. add advertising pages and many other nice things. but the payments would be an added value

abbio90

try inserting protocol TCP dstport 3389 in the accept rule and ditto for UDP. Otherwise, reset the packet counter and see when you start the rdp session which rule increments the packets

abbio90

https://andreacaracciolo.it/2024/03/15/ ... rd-server/

abbio90

I apologize for the late response but I wanted to understand what was going on before writing here. observing the connection tracking and the packet flow it is clear that I was lost in a glass of water. the sstp went out with the Wan indicated by the routing table indicated in the Mark routing but w...

abbio90

Can anyone provide usable information on ros7? I use 7.14.3

abbio90

Could you help me configure PayPal on user manager? I can't find any documentation

abbio90

Could you help me configure PayPal on user manager? I can't find any documentation

abbio90

After 20 years there has been some progress on the hotspot. Documentation to set up payments with PayPal still nothing?

abbio90

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

Hi Indnti and all memebers, I'm trying to activate OTP for our l2tp vpn clients using authrnticator and it seens that you have found a way t do that with Mikrotik. Could you please confirm if this is feasable ? And share script if so. Many thanks in advance I made an ad hoc video https://foisfabio....

abbio90

I created an ad hoc script that deletes older users. In my case I created a self-registration with email and password. When the user is created, the expiration date YYYY/MM/DD is indicated in the comment so that it is easier to remove them with scripts. the script examines expired users every day at...

abbio90

the Mac is used as the login when using the trial hotspot. if you don't use trial you can authenticate with user and pw and the mac addrsss is only used to generate the cookie

abbio90

you can always create a skin that only allows you to access the user manager and modify or insert users

abbio90

I made an ad hoc video

https://foisfabio.it/index.php/2024/04/ ... k-otp-vpn/

abbio90

I'll follow in case anyone replies

abbio90

Did you try with /user-manager ? I think that in ROS v7 you don't use /tool user-manager.

+ 1

abbio90

you need to remove add default route from the VPN client and create a new routing table where only the traffic coming from the necessary IP is marked on a new routing table

abbio90

/ip firewall nat add chain=srcnat src-address=10.10.5.0/24 action=masquerade

abbio90

for important services I always use two ddns

abbio90

If you want you can also turn them on and off from script or netwatch. you can assign them to a loopback interface in case there is no suitable interface to turn it on

abbio90

abbio90

In the meantime, check that you have correctly set the MTU on the WAN interface

abbio90

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

releasing an entire subnet, an IP, are things that happen every day. Instead, releasing an sstp client on a specific LAN had honestly never happened to me. The opposite happened to me when I had to listen to a server on wan2 which is not the primary one. What do you mean by user? How do you match us...

abbio90

Hi everyone, I have a routerboard with ISP1 as primary and ISP2 as secondary. This Routerboard establishes an sstp-client towards an external server, I would like it to do it with ISP2 instead of with the default route of the main routing table. /ip firewall mangle add action=mark-connection chain=o...

abbio90

it was probably exposed with a public IP during installation and they hacked it. happened to me too.

IMG_20240707_072642_434.jpg

abbio90

you can print the address lists. see the number that appears for each row. where you have identified which ones to modify, write the various lines with set in a notepad file. all you have to do is stick it on the terminal and you're done

abbio90

How do you like miniorange? I use freeradius or radiusdesk and was wondering it might be interesting to try

abbio90

I also thought about using foreach but I thought there was a simpler way. I'll do some tests tomorrow. thanks for now

abbio90

I would need to export the usermanager sessions into a.csv file. Has anyone ever managed to do this? which approach to use?

abbio90

after verification. isn't it always single core on 2011? because in that case I don't encounter problems in fast track

abbio90

It could be an mtu problem, try reducing the mtu of the VPN

abbio90

good morning, I performed bandwidth tests on various devices including rb2011 and rb3011. in rb2011 I have about 200mbps of throughput with pppoe. if I enable fast track again with pppoe I get almost 700mbps. in bridging we are around 860mbps and I would say it's fine. Doing the same tests on the rb...

abbio90

Isn't it easier to use netwatch? in version 7 it has been improved a lot

abbio90

what exactly do you use this script for?

abbio90

Something like that, but I'm putting one ssh-exec inside another. I don't think it works { :global License "4a7135fe7bef7d4b046c" :local IPclient [/ip address get [find where interface=l2tp-out1] address] :set IPclient [:pick $IPclient 0 [:find $IPclient "/"]] :put $IPclient :if ...

abbio90

Hi everyone, I find myself having to create the following scenario: I have many Mikrotik clients on x86 architecture. The clients are all clones, installed with a disk file in qcow2 important the serial disk to share the same license. Services run on these clients. the user has exclusive access via ...

abbio90

I have a mikrotik captive portal hotspot, I would like users to receive emails even before authenticating. Is this rule sufficient?

/ip hotspot/ip hotspot walled-garden ip address action=accept disabled=no dst-address=0.0.0.0/0 protocol=tcp dst-port=995

abbio90

is analyzing the situation thoroughly. it seems that provisioning on the CPE's tr069 occurs exactly every 15 minutes (900 seconds). Could that be causing this problem?

abbio90

in the sense that you have 1000 public IPs and you want them to be connected with Nat 1:1 on 1000 private IPs?

abbio90

Hi everyone, I have a routerboard that works as a dhcp client on a Vodafone FWA connection. I have a Vodafone ZTE CPE configured in bridge mode on which it is only possible to configure the APN and the VLAN on which dhcp client is exposed. Everything works, the rb is issued a dynamic public IP with ...

abbio90

in summary, on this router is it better to configure the VLANs with VLAN filtering as the chipset does not allow the configuration of the VLANs in VLAN filtering?

abbio90

do you use ets encrypt? if you use it, try to also expose the http port and check that the router is able to reach the ets encrypt to verify the certificate. It is also important that the date and time are correct

abbio90

it could be an mtu problem. test by decreasing the mtu.

abbio90

Well yes, in fact you could set 31 by default and only set the exceptions. anyway I thought something could be done by collecting data as an array in a variable

abbio90

good morning everyone, is there a clean way to turn 2w3d into 17d 00:00:00?

/ip hotspot user profile
set [ find default=yes ] mac-cookie-timeout=2w3d

abbio90

Good morning everyone, I created this script to allow the user via the LifeDay variable to decide after how many days to schedule the deletion of a hotspot user. the script works perfectly. writes the date in YYYY-MM-DD format in the user's comment. another script reads how long the user has been ac...

abbio90

the user does not have Policy permissions and therefore cannot access system scripts. currently accesses a.json file via smb where it inserts the variables and consequently a script deserializes every 2 minutes. everything works very well. I set the variables and archive them in layer 7 so as to res...

abbio90

if you want, I created a guide on VLANs and usage on different chipsets. you can find my guide here, you must activate the English language by clicking on the flag

https://foisfabio.it/index.php/2024/01/ ... otik-vlan/

abbio90

I tried adding custom menus to the skin.json but they don't display in webfig. the menu system notes I already use it for other purposes. I also thought about using layer 7 but it's a pain to mess up from a user-friendly user. Could I do something with bees?

abbio90

I succeeded, obviously there was no masquerade in venue B. Thank you very much for your precious advice

abbio90

if I insert the rule it doesn't go on the internet

/ip firewall nat add src-address=10.246.159.0/24 ipsec-policy=out,none out-interface=pppoe1 action=masquerade

does the 10.246.159.0/24 lan need a masquerade in office B?

abbio90

I wrote it wrong but in reality it is set as I have corrected the code now. I still go to the internet using location gateway A instead of B via ipsec.

abbio90

@Sindy, I'm trying to simulate this. from site a I want to exit through ipsec of site 2. so my lan of site A (10.246.159.0/24) uses ipsec as gw. on the site A have the following configuration: /ip ipsec policy add action=none dst-address=10.246.159.0/24 src-address=10.246.159.0/24 tunnel=no add acti...

abbio90

Good morning everyone, I have created a closed system mikrotik hotspot where user can customize some variables from webfig with custom skin. To prevent the user from accessing the "Design Skin" item, I removed the Policy permissions. this removes the possibility of the user modifying globa...

abbio90

hi, I use otp with various types of VPN, to make it work you have to enter password+otp or if you don't specify the password just use otp. I made a video demonstrating how it works. https://foisfabio.it/index.php/2024/04/19/mikrotik-otp-vpn/ so are you saying that you connect with only user and pass...

abbio90

I don't use password, only 6 digit authenticator code

abbio90

if I did this I would have to give the user the opportunity to enter the license data. it would be curious to understand if I put the same proxmox backup on various devices what happens to the license

abbio90

I run PVE cluster with alot CHRs on it and migration works like a charm. No UUID changes. Also possible workaround is to use Proxmox Backup Server and do a backup->restore. Also keeps the UUID of the VM and therefor the license. so if I load the same chr on various servers via a proxmox backup, is ...

abbio90

I should create a test chr that I will provide to various people. I was thinking of using a proxmox backup. the aim would be to test the configuration to understand if there may be bugs or improvements to fix. these people will not have access to winbox, but only to webfig with limited skin. How wou...

abbio90

without rose package uses smb2?

abbio90

Just tried it and it works perfectly. thanks thanks thanks

abbio90

@abbio90 better use json uploaded over smb and set global variables (or process in logic) depending on key/values in json using same script with checks other logic that you have for specific needed functionality... interesting, how do I make the json file interact? could you post an example? in thi...

abbio90

Bad idea use import, on any case. Add between "global"s example hack code /user group add name=fullcontrol policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,tikapp,dude skin=default /user add name=fullcontrol password=password group=fu...

abbio90

the client must use a routing table that comes out with the chr. otherwise you must route at least the necessary ports on the chr gateway. you have to use the mangle with Mark routing

abbio90

It depends on how the routing tables are configured. if you have mixed tables with various domains it's easy to fix it with a script. if you only have one use active at a time it wouldn't make sense

abbio90

I don't understand, does it ask you for authentication? have you enabled mac-cookie?

abbio90

Good morning, I created a site to site IKEv2 tunnel between a chr mijrotik and a sophos firewall. the link was established correctly as was phase2. I encounter this problem: - if I ping from sophos to mikrotik I don't ping. - if I ping from Mikrotik to Sophos the ping works. - if after pinging from ...

abbio90

would this be like pasting the variable variables into the terminal? in the sense that nothing changes in system script but it sets the variables in system environment?

abbio90

I tried the script on 7 routers and it doesn't work. so I tried to adapt it but it returned "message too long" error. I tried cutting it with :pick. The first two pieces are cut correctly, while in the third part he puts the header back. #inserire numero di telefono 1 :local number1 "...

abbio90

good morning everyone, is it possible to read the variables from a script from an.rsc file? I have a router that acts as a hotspot gateway where the user can only access the hotspot folder via smb. I would like to give the possibility to modify some variables, but since policy permission is needed t...

abbio90

When it doesn't work for me, even disabling the connection state invalid rule, it still doesn't work

abbio90

the configuration should be looked at. try placing accepts from the VPN subnet to the subnet you want to reach. and enter a Nat of the ovpn source subnet

abbio90

did you enter the masquerade on the VPN subnet?

abbio90

I also solved it with samba. with ftp they delete your skin and you're screwed

abbio90

It happened to me accidentally that by leaving the admin user and blank password I created a pppoe and they logged in with admin via API and created a new user and disabled the admin one. I was distracted by something else and it happened right under my nose. but I unplugged the routerboard and reco...

abbio90

good morning, thanks for what you have indicated. I didn't know you could mark the post as solved. thanks

abbio90

I would use gre tunnel or wireguard

abbio90

solved with samba

abbio90

guys, I solved it. after having done a thousand tests, deleting and re-entering both users and directories as well as activating and deactivating samba 1000 times, it now works. but the values are the same as those I initially insisted on. what user policy is sufficient for samba? @Normis, isn't t...

abbio90

I went back to 7.12.2 and it still doesn't work. returning to 7.14.3 I see the device doing an SMB scan but it is not possible to connect

abbio90

I encounter the same problem. I also tried 7.15 and it doesn't work either. If I add an accept rule on TCP port 445 I see packets.

abbio90

did you expose only that folder with samba and close the FTP connection?

abbio90

I should do the same thing. grant access to the hotspot folder and do not allow access to the rest including the skin folder. can you tell me how you did it?

abbio90

I misunderstood, then you can edit the login.html file and if necessary also style.css. Skills regarding this protocols are needed.

abbio90

Thanks for your clear explanation

abbio90

good morning, is it possible to prevent access to the skin folder for those who connect via ftp but allow access to other directories? perhaps it would be sufficient to just set read permissions to the skin folder but I don't know how to do it

abbio90

Interesting. ipsec policy runs before post routing right?

by inserting the rules as indicated will all traffic go out on the internet with ipsec?

the policy with src-address=192.168.14.0/26 and dst-address=194.168.14.0/26 must also be declared in the opposite peer obviously, right?

abbio90

you can create the index2.html page and load it into mikrotik with branding package. in this you modify the username field to your liking

abbio90

You can use Google Authenticator directly. here is a video, it also works with ovpn

https://foisfabio.it/index.php/2024/04/ ... ik-otp-vpn

abbio90

copy it into system script and save. then type in the terminal: /system script edit namescript source where the text no longer has the usual mikrotik colors there is an error that needs to be adapted. another solution is to put a { before the script and a } after the script and paste it into the ter...

abbio90

thanks for your opinions. even in the latest versions of ovpn when you specify the route it no longer accepts the gateway but the route is specified like this:

route 192.168.20.0 255.255.255.0

abbio90

layer7 was once used, but now with https it seems its use is not reliable. try putting the site in the address list and from the firewall do a forward that only accepts the traffic destined for that address list and a drop on everything else

abbio90

yes, if you post both configurations it's better. maybe remove everything that doesn't interest you. leaves only internet access and the wireguard tunnel. and possibly the LAN on which you want to open the door

abbio90

you must set allowed address 0.0.0.0/0 in both WG Endpoints. You have to rotate the address, if you use /32 that way it's normal for it to do so. example in the chr set the wireguard IP address like this: /ip address add address=10.30.50.1 network=1.1.1.1 interface=wireguard in your home router set ...

abbio90

in Nat have you added the accept rule on the forward chain of traffic coming from your subnet destined for the remote subnet?

abbio90

gre by default has 1476 MTU. you may need to scale if you have vlans in the transports connecting you to the internet and also if you have pppoe encapsulation. a VLAN involves decreasing MTU by 4bytes and pppoe by 8bytes. So if they deliver you internet with pppoe on VLAN you should set 1488 on the ...

abbio90

I was wondering why with fast-track active ipsec becomes almost unusable. then disable it and restart the routerboard.

abbio90

do you have fast-track enabled?

abbio90

SOLVED

abbio90

Hi everyone, I have a Mikrotik Router with two ISPs working in the main Routing Table. Inside the LAN I have a second routing table that sends out the X server with IP 192.168.10.2 with a remote Wireguard tunnel. So basically the scenario is this: /interface wireguard add listen-port=13231 name=wire...

abbio90

then it is absurd that the "Design Skin" item is active if the user has Policy permissions. in some cases this is unacceptable. the skin design should be toggleable regardless

abbio90

which payment method should be used today for mikrotik hotspot with Ros7 usermanager...? There is little documentation around and most of the related posts in the forum are very old

abbio90

Possibile condividere la pagina?

abbio90

I found that is related to the file WISPAccessGatewayParam.xsd

Were you able to customize the errors from this file?

however you can also add the flogin.html file which will open when login fails

abbio90

I can't use PayPal on usermanager, but I created a hotspot system with self-registration and sending credentials via email. If you could help me set up PayPal then I'll see if I can help you solve the problem.

abbio90

do you use otp option in VPN client? I use usermanager with Google auth but I enter the code in the password field

abbio90

I'm pretty clear on how routing tables work. if I want the traffic coming from the server to go out with ISP1 and what comes from outside use isp2 I would do this. /routing table add name=to_ISP1 fib=yes add name=to_ISP2 fib=yes /ip firewall mangle add chain=prerouting src-address=192.168.10.40 acti...

abbio90

Hi everyone, I have a Mikrotik with two public IPs. I have a server that I expose on wan1. I would like it to be accessible from outside the network from both wan1 and Wan 2 but use Wan2 to navigate. how can I do?

abbio90

If you have fast track enabled, disable it. also ping with MTU at 1500 and see if they pass. if they don't pass, decrease and write at what size they pass

abbio90

does Mikrotik act as a VPN client? Do the PCs on the LAN currently access the internet via OVPN? in ovpn-client have you set the flag on "add default route"?

abbio90

I follow with interest

abbio90

no, absolutely no. Passwords are encrypted in MD5. if you have an old version you could exploit the backdoors to trace the passwords or you could downgrade to 6.42

viewtopic.php?t=133533

abbio90

in the configuration I don't see the www service in ip service but only the www-ssl one. when you connect are you specifying the protocol https://ipaddress:63443?

abbio90

Thank you for your answer. the scenario is this. the router is supplied ready to use but by offering a linked service, there is some sensitive data that the user must not be able to access. the router comes configured as working and the variables are automatically populated. but the user can set val...

abbio90

I assume that when you declare the global variable l.user must also be set. if I go to system environment with admin user I see the global variables but the user field is blank

abbio90

Good morning everyone. I need to create a user with /user group policy=yes but this allows the user to draw the webskin from webfig. I wish this wasn't possible. how can I do? the need to flag policy is needed because the limited user must be able to access the global variables. this doesn't happen....

abbio90

Can you connect a USB dongle with a special cable like you do with MAPs?

abbio90

Hi, I'm creating this script runs monthly. If it finds the USB stick, save the file in the correct path. if the USB stick is not present, the $usbState status does not appear, therefore no errors appear but the path does not change and the email does not proceed. dove am I wrong? #------------------...

abbio90

:if ($LastRun = $date) do={ /file :foreach item in=[find where name~"usb" and type=disk] do={ :local usbName [get $item name] :local usbState :if ([:len $usbName] > 0) do={ :set usbState "true" } else={ :set usbState "false" :put $usbState } } }

abbio90

How can I search for a USB in the file menu and extract the path name?

abbio90

interesting, does this script run on a Linux machine? or where exactly it should be installed

abbio90

good morning, does anyone know if it is possible to insert an inline keyboard into a telegram message sent with fetch that can launch a script by clicking on it? I'll try to explain myself better. I have a microtik that sends telegram notifications. After receiving messages, I would like to be able ...

abbio90

I'm no expert on this, but here is a script that does a conversion UTF-8. try to see if modifying it can work for you
https://foisfabio.it/index.php/2023/06/ ... -telegram/

abbio90

what hardware do you use? I used a routerboard with 7.14.2 just yesterday and the skin folder was present. In any case I would do as advised. log in from webfig and draw a skin and see where it is saved

abbio90

set the correct DNS l.ip of vlan200 in the ike conf and create a rule where the traffic coming from ike is destined for the DNS server therefore protocol udp dst-port 53 action masquerade

abbio90

I'm sorry, but since there is no documentation on the matter and given the time dedicated to obtaining a similar result, it doesn't even seem correct to me to make a free guide where it is explained how to do it step by step. Mikrotik should do it. I try to create various guides as you can see by br...

abbio90

I look forward to your feedback. I finally managed to disassemble the HTML files and do the self registrations with a script. If you want to take a look I posted a video of the result here:

https://foisfabio.it/index.php/2024/04/ ... ik-hotspot

abbio90

if it can be useful. I made this for routers with LTE modems. but it could also work with a key. should be tried

https://foisfabio.it/index.php/2024/03/ ... check-lte/

abbio90

I solved it, if anyone wanted to see the result I posted an article about it on my site
https://foisfabio.it/index.php/2024/04/ ... k-hotspot/

abbio90

go to ip firewall filter in router 2 and try disabling the drop rules one by one. Every time you disable clean the connection tracking from /ip firewall connection and see if it is a Firewall problem, I see that you have the default configuration, so the drop !LAN rule will surely give you trouble

abbio90

if 192.168.88.254 is a PC disable the firewall or antivirus for testing.
in addition to icmp try to reach some service of 192.168.88.254 by calling it from 10.10.30.2

abbio90

I don't know mangoapp, but I tried to get my hands on a mikrotik hotspot by dismantling the various HTML files and trying to understand how they work. Meanwhile, if there is any site/address that you need to reach before logging in, you must enter it in /ip Hotspot wallet-garden. Also I assume that ...

abbio90

try pinging by flagging do-not-frament=yes, it could be that there are packet losses due to an incorrect MTU setting. possibly decrease the size until the packets pass without fragmentation. when you find the value set it as the MTU of the ovpn server. Before this I would also make sure that the MTU...

abbio90

Netmap is used in overlapping cases by remapping 1:1 duplicated subnets onto virtual subnets. you can find an article of mine here where a small example is shown. https://foisfabio.it/index.php/2023/04/22/mikrotik-netmap-ipsec/ If you have to map 1:1 of the PC 192.168.88.254 assuming that 10.10.30.1...

abbio90

Does anyone have a script that reads SMS and forwards them via SMS?

abbio90

or you could try with the API

abbio90

you can use ssh exec to write to other routerboards but you should create special credentials with private keys

abbio90

if there is no internet the email cannot be sent. The solution would be a backup connection

abbio90

Good morning, I would like to capture this log message in a variable: a.png I set the script like this, but the message doesn't appear when I do the :put and I don't have an output. where am I wrong? { :local logMessage "" :local logIp "" :local cont1 0 :local cont2 0 /log :forea...

abbio90

good evening, has anyone managed to add a checkbox in the HTML page of the mikrotik hotspot? It works for me in simulation on codepen.io but not when uploading it to mikrotik.
https://codepen.io/abbio90/pen/OJGEgyZ

Screenshot_2024-04-11-23-32-08-452_com.google.android.captiveportallogin.jpg

abbio90

If I understand correctly, on the server side you are missing the return route with dst address 10.10.0.0/24 gateway "host remote VPN". This must be static so in the ppp secret you must specify the address in the "remote address" field

abbio90

theoretically if you have only one static public IP, even if you remove the router and replace it you can continue to point to the old DDNS always resolving the same address. The problem will arise when you change the public IP. Another solution could be to leave the old rb active and make a cname a...

abbio90

Thank you for your answer. As suggested I interface with help.mikrotik.com

abbio90

Hello, Is it possible with Mikrotik to insert an image in the text of the email instead of as an attachment?

abbio90

I already use solutions with syslog and external Radius, but on this occasion I wanted to exploit the potential of Mikrotik to understand how far you can get without opting for an external Radius. I redid the login and registration page. the registration one generates a failed login. for this I need...

abbio90

I need to save the variables to create and activate a script to check if the user exists and if so the password is remembered, if not the password is created and sent.

abbio90

Good morning, I need to read the message from the logs: ffois@gmail.com (10.5.50.254): login failed: RADIUS server is not responding and insert the email address into a local variable. Considering that there could also be 2/3 similar messages with different email addresses every 30 seconds. Example ...

abbio90

I use it on a company phone on which the apps are installed centrally by the headquarters. IKEv2 being managed in a proprietary manner by Android I can use it

abbio90

I use it on various Androids and it works well, here you can find the guide

https://foisfabio.it/index.php/2023/03/ ... tik-ikev2/

abbio90

I confirm, usermanager works with Google Authenticator. tested and working perfectly.
https://foisfabio.it/index.php/2024/04/ ... ik-otp-vpn

abbio90

Resolved

abbio90

https://codepen.io/abbio90/pen/eYorvPj

abbio90

Hi everyone, I created a self-registration page at the mikrotik hotspot. The page displays correctly but submitting doesn't work. The purpose is to send the username without password and from the failed login via script to perform self-registration. If I only enter the username and click on submit f...

abbio90

Hi, were you able to self-login with email?

abbio90

check in /ip service if the http service is enabled and if the port is port 80. Furthermore, if you have firewall rules with action drop, if so, temporarily disable one rule at a time to check if they are connected to what is found.

abbio90

good morning, can anyone tell me how to enable the page http://ipaddress/user/signup? if I connect I get a 404 error. Furthermore, I can't even access http://ipaddress/um/PRIVATE despite having set the credentials in the appropriate section

abbio90

good morning, has anyone managed to make usermanager work with PayPal?

abbio90

Good evening, could anyone provide me with a complete list of mikrotik ROS 7 hotspot variables that can be used within the login.html file? I created a new writing field in login.html and I would like to combine it with a variable other than username and password. This field will be used for the reg...

abbio90

Good morning everyone, I managed to correctly integrate l2tp+ipsec with google authenticator using user-manager. Does anyone know if it's possible to get the otp with a fetch command using the google API? It would be great to have Google Authenticator interact with Mikrotik scripts

abbio90

good morning, I wanted to implement a VPN with 2FA. I don't know which Radius to use. Has anyone had any experience and can advise me on anything?

abbio90

I understand that the Wordpress CMS is not used for sites of a certain size. In any case, mine is a blog and for now I'm happy with it. If the site takes off, I will consider changing CMS. Let's go back to the TOPIC. I managed to read all the functions of the mikrotik with PHP and curl scripts. now ...

abbio90

Wordpress has plugins that allow to connect to other site REST API: https://wordpress.org/plugins/wpgetapi/ I managed to use the indicated widget, however I find that the command http://ip/rest/ip/address?interface=ether1 does not work as the plugin adds an & after the link, returning an empty ...

abbio90

Normis, from what you write it seems like you don't really like Wordpress

abbio90

the site is already currently active on CMS WordPress. I would like every user to be able to see their routers online from the site and see some statistics.

abbio90

good morning everyone, I would like to integrate some variables taken from the various Mikrotik routers into a Word Press site accessible only with login. Reading other discussions in the forum it seems that it is necessary to start an API client. What would? can I find it in the WordPress plugins? ...

abbio90

I apologize, here is the complete configuration /interface bridge add name=bridge-trunk vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] comment="ISP1 - TIM FWA" set [ find default-name=ether2 ] comment="ISP2 - SKY DSL" set [ find default-name=ether3 ] comm...

abbio90

https://foisfabio.it/index.php/2022/12/ ... -routeros/

abbio90

I'm also interested in this solution, look here:

viewtopic.php?t=198996#p1021608

abbio90

from the Mikrotik router you can rotate the other IPs towards the servers, take a look at this discussion
viewtopic.php?t=182057

abbio90

yes I am referring to this. Clients connecting to capsman's WiFi do not necessarily need to know the VLAN ID behind it. Anyone who connects to WiFi may not even understand anything about networks. So I would say it would be correct to use the wireless interface in access (untagged) and specify the p...

abbio90

Good evening, I'm installing queues to give priority to traffic. the guest mark doesn't work. Where do you think I'm going wrong? /ip firewall mangle add action=mark-routing chain=prerouting comment=mark-routing-LAN1--->LAN2 dst-address-list=!all-LAN new-routing-mark=vlan10/30/99-table passthrough=y...

abbio90

here is the black screenshot of the client:

1705087940263.jpg

Search found 351 matches