MikroTik

semaja2

+1 on this request, also raised a support ticket

Cloudflare Magic WAN utilises IPSEC+VTI, and using IPSEC policies as a work around brings several issues

VTI would also make interacting with Azure etc much simpler

semaja2

I did a quick test using "upx -9" and it shrank by about 3MB, so not really worth the hassle/risk, if it could save 50% then I would consider making a special upx variant for those in desperate need of disk space

semaja2

Quick update, I noticed a huge container size increase with the new version, appears the linux netinstall binary itself is quite large now days, so have released some older versions of netinstall Eg. 7.14.1 is 55.7MB, 6.49.13 is 36.8MB The older version may be more useful to those running on very li...

semaja2

Part of the issue with downloading the images during runtime would be generally the network the container is attached to would be isolated and only directly connected to the target device, as such would require reasonable amount of config to ensure it could actually download the images. The current ...

semaja2

Fair point I had not looked at the pull numbers, also thought netinstall had been integrated into ROS by now :P I have built a new version of the container under semaja2/mikrotik-netinstall:dev which will work with both old and new methods I do not have my test environment setup anymore, so if anyon...

semaja2

I am still around, and suprised to see the thread spring to life as I figured it wasn’t of interest to many others

I’ll try to dig up the project and update to latest version and see if I can get it to just add every npk from the folder to simplify

semaja2

Basically create a new container image that simply switches to user 0, feel free to use my image but it may break in the future and also poses various security threats should zabbix be exploited

https://hub.docker.com/semaja2/zabbix-proxy-sqlite3/

semaja2

I would also like an official answer to this one, I often run standalone containers, is there a underlaying technical reason the veth needs to be in a bridge?

semaja2

I came here for the same reason, I thought I had a fix by switching to the ol image, but it seems whatever mikrotik is doing to the container is not always 100% I thought the containers were built incorrectly, and made one where the setcap/systctl settings were corrected, but once it loads on the Mi...

semaja2

Having netinstall as a npk would be a dream, but also I suppose getting ROSv7 actually stable for real usage is still a priority they should focus on... (BGP :vomit:) If there is serious interest in this container I will look to maintain and update it so it works better with the newer container feat...

semaja2

Can you post the output of the routers logs? I just did a test on a RB4011 with 7.6 and it worked without issue, potentially you ran into space issue? The registry URL was not included as its assumed the base config from the MikroTik documentation was followed /container/config/set registry-url=http...

semaja2

Passive Poe works fine for both 48 and 24V

AC will supply 54V to the board which converts to 24V as needed, or whatever 48V DC you can supply

PS. Wish it up converted from 24V to 48V would make it much more useful for our use case

semaja2

For anyone concerned about memory leaks... can you run just a base alpine image with nothing on it? There is little to gain mentioning memory leaks for a 3rd party container as its not RouterOS problem That being said ROS container system does let you set memory limits to prevent a bad container con...

semaja2

Is it possible to load the "backup" firmware which is the one the device came with? https://wiki.mikrotik.com/wiki/SwOS/CRS3xx#Reset_and_Reinstall It is possible to load a SwOS backup firmware in case standard firmware breaks or upgrade fails: Connect to the device using a serial console B...

semaja2

(and anyway, I would not use something with only SwOS regardless) That’s all good and nice to say… until there is a global supply chain problem, and mikrotik has little options when it comes to DC powered PoE switches If they sold the CSS610 as a CRS610 version I’d be all over it You assume we all ...

semaja2

That seriously is the worst attitude to security, password reuse isn't the only possible exploit, easily could do code injection etc Pretty sure you would also change your mind if someone did a factory reset on your switch at an RTS thats 8 hours away, but sure who cares about enabling the most basi...

semaja2

The argument against https support, I support: just keep your config access on a VLAN that is secure, then http is fine. The lack of basic security concepts is shocking in this statement... a VLAN does not provide any protections against interception and manipulation (eg. the password is clear text...

semaja2

Is anyone able to confirm if this is a "SwOS wont pass/forward QinQ tagged packets" or if its more "SwOS wont do QinQ tagging"? Really hope its the latter as the switch shouldnt be look at the second vlan tag for forwarding

semaja2

That’s quite easy, given the way the containers are implemented you can just load a basic alpine image Set the start command to sleep forever, console in, install all your bits you need, change the start command to run dnsmasq Or if just build a image that has it all of course :) One missing feature...

semaja2

I feel like a lot of these suggestions are either entirely a joke, or lack the understanding of what a container is Nothing stops you wrapping a BGP service into a container, but your RouterOS would still need to establish a BGP session to it Eg. Run FRRouting in a container, run it as a route refle...

semaja2

Home Assistant. If anyone has got it right, let me know, To reply to the 'why would we' people, one good reason is that this is how we learn. But my reason is to have fewer devices running off an inverter to prolong battery life during loadshedding in South Africa. What's loadshedding? - Eskomplica...

semaja2

Recreating the container is the correct approach for Docker, in theory due to the way MikroTik implemented their containers you could potentially do the upgrade in the container you have However the correct approach is to make sure you setup persisting volumes for any data that needs to be persisten...

semaja2

There is probably potential for further optimisations, however we are reaching a point where there is little gains left (we talking 6MB from the distro now) the biggest space consumer is the actual net install binary at 50MB plus a npk file which is usually 10-15MB I would say if you have a device w...

semaja2

After a bit of early testing, we now have the base container down to 5.35MB compressed (including the qemu part) so after we add netinstall the container comes to 38.72MB compressed As a result I am successfully able to run the netinstall container on a Netpower16P :shock: and perform a netinstall o...

semaja2

Those wanting containers for several CPU types on smaller routers will appreciate not having to pay the cost of a CPU emulator. I will let you now how I go forcing it into smaller devices, but largely anything with an ARM CPU will be fine doing this x86 emulation from a CPU perspective, the netinst...

semaja2

From my testing there is actually no need for a native ARM build (besides being a nice to have) This container actually uses qemu to run the x86 code on both ARM and ARM64 platforms (testing was done on a RB4011) From an image perspective, I originally included the npk files but due to limited space...

semaja2

Congrats! but the link posted right before the Steps section asks for a login for some reason.
This works: https://hub.docker.com/r/semaja2/mikrotik-netinstall

Thanks for that, I have updated the post, looks like I copied the management URL

semaja2

After a bit of an adventure, you can actually run the netinstall-cli on ARM perfectly fine using qemu-user binaries Effectively it will emulate the CPU for the process, it doesn't start a VM as most would know, and leaves the process where it should be (eg. it can access the network perfectly fine) ...

semaja2

Or, do the same thing to a disused RB3011, running a separate netinstall container behind each port, one for each RouterOS NPK type you have in use, and you've got a benchtop version of the same facility. Someone brings in a flatlined router, you pull over a labeled cable matching the CPU type of t...

semaja2

Hi All, Wasn't sure where to best post this, but hopefully someone will find use of it :) With the implementation of containers in ROSv7 it opened a whole world of abilities for a Tik, and for anyone that needs to do bulk netinstalls or remotely perform a netinstall in the field (eg. a Tik AP connec...

semaja2

+1 for this, would also be wonderful if it could be compiled for Mac.... or you know... release the source code

semaja2

Can we get an option to just print the log from a container, and run commands or open a cli whilst its running

semaja2

Big one for us is a light weight Zabbix proxy for remote sites without needing to add another device onsite We also use a tik for our Out of Band devices, and being able to spin up a basic linux docker could be useful to run extra troubleshooting software onsite (eg. could have a container with nmap...

semaja2

Containers the new "v7" meme?

semaja2

Is it possible to configure Winbox to disconnect idle sessions?

We have some Tiks behind metered connections, and Winbox burns through data and its very easy to leave a session left open

semaja2

Hi, I am looking to filter DHCP from responding to certain requests (eg. hostname contains XYZ) From what I can gather the communication is too small and the layer 7 protocol inspection occurs too late to prevent the traffic Is there any other ways to filter DHCP more specifically? (eg. only allow c...

semaja2

Whilst the NetPower16P is based on the CRS328, and provides DC inputs it is really only suitable for mounting on a pole However there does not appear to be any other CRS3xx series switches that can run directly on DC inputs? Has anyone modified a CRS328 for DC input, or is this something MikroTik is...

semaja2

We have just obtained a GPEN21 as a prototype for using as a simple customer NTU, providing a clean handoff point from a wireless dish However upon inspection, there appears to be no way to properly bond the ethernet ports to earth, without using an external PoE adapter which defeats the purpose of ...

semaja2

Any update about SFP(+) compatibility fixes? Running 2.13 and it works, afraid to upgrade to 2.14 especially if remote access is over fiber connection that might break. The devices really should have a dual firmware feature - upgrade, reboot and login to confirm (within a timeout) the new firmware ...

semaja2

When adding container did You also specified "logging=yes"?

Yes as well as enable "container" logging under "logging"

Is it possible to attach to the container?

semaja2

How do we get any logging output, or attach to a container console?

I have attempted to import the Alpine Armv6/v7 container to a RB4011 and neither will start and there is no log output

This is a great feature as it will enable things like running a small Zabbix proxy on a CHR or onsite router

Search found 41 matches