MikroTik

Lokamaya

My suggestion are:

1. If you only have 1 internet connection, remove bridgeWAN
2. Change dhcp client for WAN to ether1
3. Move ether2 and wifi1 into bridgeLAN
4. Set ip pool for bridgeLAN to 192.168.111.20-192.168.111.245

Lokamaya

bridgeWAN port member: ether1, ether2, wifi1 bridgeLAN port member: ether3, ether4, ether5, ether6, ether7, ether8, sfp1 /interface list member add comment=defconf interface=bridgeLAN list=LAN add comment=defconf interface=ether1 list=WAN Its seem you only have 1 internet connection through ether1, ...

Lokamaya

# 2024-12-03 12:20:04 by RouterOS 7.13.5 /ip pool add name=dhcp ranges=192.168.88.100-192.168.111.10 /ip dhcp-server add address-pool=dhcp interface=bridgeLAN lease-time=10m name=defconf ... /ip address add address=192.168.111.1/24 comment=defconf interface=bridgeLAN network=192.168.111.0 /ip dhcp-...

Lokamaya

Never heard of "unknown" port problem. And this is a new device.

Can you post a winbox snapshot of it?

Lokamaya

How many router do you have on your network? A diagram would be nice, something like the diagram below.

OSPF2.png

Lokamaya

I have all of my networking equipment and sensitive devices on UPS and overvoltage protection.

Yes. After the incident, it was felt that all equipment need to be secured with UPS and overvoltage.

Lokamaya

Lightning struck the power line and caused all the equipment, including all the computers, restarted. No damage, but two switches (CSS-326) in different rooms lost connection to the computers. After the switches were restarted, the connection was restored. These switches connected to main router wit...

Lokamaya

Why do you have specified forward-fasttract for tcp/udp on port 53 only? I don's see any need for it, because all dhcp dns-server pointing to the router. And I think it is better to move forward/drop to the last row of the firewall filter. ... /ip firewall filter add action=drop chain=forward connec...

Lokamaya

Your firewall filter is a little bit off. I think you should work on it and sort it based on its chain: input first, than forward. Some of forward-drop chain to ether1 can be simplified by using address-list. The address-list is missing from the configuration above. I can not figure out what it is a...

Lokamaya

Hopefully useful. GNS3 Installation in Proxmox by Divgitally on Youtube:
https://www.youtube.com/watch?v=UfqjqigS-OM

Sorry if this has already been posted on other thread.

Lokamaya

In the past, before vlan was known, we needed many physical ports to deploy many subnets, i.e. each subnet attached to a specific port.

With vlan, we can deploy many subnets on few ports.

Lokamaya

If your vlans are in the bridge, simply use LAN for default firewall rule.

If you wan to manage each vlan in firewall, for example block certain vlan, use it carefully.

Lokamaya

If it has been tested and runs well, you can go with that configuration.

Try by unplugging the cable from ether1 and see if the the route to WAN1 disabled as expected.

Lokamaya

I guess I'm the only one...

Lokamaya

Does your domain/subdomain already pointing to your public ip-address?

Lokamaya

Why do you set DNS servers to itself? 192.168.1.1 /ip dhcp-server network add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 ... /ip dns set allow-remote-requests=yes servers=192.168.1.1 Try changing to public dns /ip dns set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4

Lokamaya

Great point. Agree..

Lokamaya

This is the basic of dual WAN using LTE on lte1 port and DHCP on ether1 as fallback. /ip dns set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1 /interface lte set [ find default-name=lte1 ] name=lte1-WAN1 #WAN1: disable DNS /interface lte apn set [ find default=yes ] use-network-apn=no use-peer-d...

Lokamaya

An easier way is simply add :
dst-address-type=!local

I tried it on Router OS v7.16, but it doesn't seem to work as I expected.

Lokamaya

Here how I approached it with Mangle and Table Rule : /interface list add name=WAN add name=LAN add name=MGMT #WAN2, WAN3, WAN4 using DHCP /ip dhcp-client #add interface=ether1-WAN1 use-peer-dns=no use-peer-ntp=no add-default-route=no add interface=ether2-WAN2 use-peer-dns=no use-peer-ntp=no add-def...

Lokamaya

Tested several configuration, and there are some approach to address this issues with its own pros and cons. 1. Totally using Tables Rule. Pros: simple when dealing with few vlan/subnet, auto-block vlan/subnet i.e. can not ping each other, etc. Cons: more vlan more headache, and need to work out to ...

Lokamaya

In my environment, I have 4 routers providing a Guest network for 15k users.

Never though having 15k users

Almost swept 192.168.0.0/18 subnet

Lokamaya

This more looks like to be DNS hijacking

Lokamaya

#Create a bridge for LAN /interface bridge add name=bridge1 /interface bridge port add bridge=bridge1 interface=ether4 add bridge=bridge1 interface=ether5 add bridge=bridge1 interface=ether6 #Create 2 lists: WAN & LAN /interface list add name=WAN add name=LAN /interface list member add list=WAN...

Lokamaya

Are you on Router OS 6 or 7?
And how each WAN connect to internet? Using DHCP or PPPoE?

Lokamaya

Second, connect the sfp port from UDM to Mikrotik.

If you want to make adjustment to sfp port on Unifi side, go to Device > Port Setting. But I think leave it as default (except you know what you are doing).

If you already setup Unifi properly, feel free to ask on Mikrotik side.

Lokamaya

First, I guess you already know how to setup VLAN on Unifi Network Controller (Setting > Networks). As mentioned by Anav and Jaclaz, don't use VLAN ID 1, use another number. Example: - name=vlan 100 - vlan id= 100 - ip-address=192.168. 100 .1 - netmask=24 (then generate address, see picture) Capture...

Lokamaya

a. create a bridge with only eth7 & 8 which will connect the TPLINK router and switch for network 192.168.0.0

Why do you need a bridge? Do you mean bonding?

Deco X7 has 1 x 2,5Gb RJ45 and 2 x 1Gb RJ45
Rb5009 has 1 x 2,5Gb Rj45 (on eth1), 7 x 1Gb RJ45 (including eth7 and eth8) and 1x SFP+

Lokamaya

Try using mode: 802.3ad
Most switch support it.

Capture.JPG

Lokamaya

... found the first error is coming where the current IP address for WAN is being retrieved. # Update Cloudflare DNS IPv4 address script :local ip4new [/ip address get [/ip address find interface=$wanif] address] :set ip4new [:pick [:tostr $ip4new] 0 [:find [:tostr $ip4new] "/"]] How your...

Lokamaya

Feature request: I would like to have a note inside Winbox xD

When I leave unfinish configuration, I want my friend who come later know what he has to do.

Lokamaya

I used SCP and uploaded both r10 and r11 to /data/unifi-core/config, rebooted the UDM, and Chrome still shows the DANGEROUS page in red. It's seem you have to upload the .crt and .key file manually to UDM. Please see here: https://community.ui.com/questions/UDM-Pro-SSL-Certificates/e83b07a7-bbb3-45...

Lokamaya

Setting pvid= is irrelevant with frame-types=admit-only-vlan-tagged as untagged packets are discarded. Yes, it's what is expected. The default Proxmox network interface with bridge-vlan-aware look like this: auto lo iface lo inet loopback iface enp0s25 inet manual auto vmbr0 iface vmbr0 inet static...

Lokamaya

The thing is that the choice between R10 and R11 is random, so the fact that your certificate is signed using R10 doesn't mean that @josephny's one will be too; actually, it even doesn't mean that your next one will be signed using R10. Oh I see. So, we have to check it on our browser by clicking t...

Lokamaya

@Lokamaya, how do you know it is r10 in particular and not r11? I can't see that in the error message. I try it on my Mikrotik router using your script: #PREPARATION /ip/firewall/address-list/ add address=acme-v02.api.letsencrypt.org list=lets-encrypt /ip/firewall/mangle/ add chain=postrouting src-...

Lokamaya

It is little bit tricky on unifi line because all folder are protected by "sudo" except the home/user dir. I only have UCK-G2+, so I can not confirm where the folder is on UDM. First upload the file to home_dir or user_dir using SCP or SFTP (WinSCP or similar), then use SSH to copy the fil...

Lokamaya

On UDM, upload r10.pem to /data/unifi-core/config/

Lokamaya

I leave a comment and come back later when I need it. Thanks.

Lokamaya

I would still go for ROS since it is A LOT more flexible then SWOS.

I agree. ROS for CRS326.
And you need to upgrade it to v7+. The CPU only count 1 on v6, while on ROS v7+ its count 2.

Lokamaya

> /tool bandwidth-test protocol=tcp \ direction=receive address=87.121.0.45 \ user="neterra" password="neterra" \ duration=20s status: done testing duration: 21s rx-current: 221.2Mbps rx-10-second-average: 293.5Mbps rx-total-average: 259.2Mbps random-data: no direction: receive ...

Lokamaya

#Bridge
/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge1 vlan-filtering=yes
...

#Bridge Port: Facing to Proxmox
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether2 pvid=4094

Lokamaya

You need a trunk port on both router and proxmox Got it working with single NIC on my Proxmox server. This tutorial and "How To Create VLANs in Proxmox For a Single NIC" on Youtube make me understand why we need "admit-only-vlan-tagged" and add "pvid=4094" to the bridg...

Lokamaya

I don't know if this helps anyone, but I got Traefik to work on an RB1100 (which is actually ARM32) using this image: https://hub.docker.com/_/traefik

I have to try this. Thanks Amm0

Lokamaya

Currently whitelist is available on latest 7.17beta2. For now, I just add static DNS for specific domain. For example, if I want to whitelist "googleadservices.com": 1. Disable specific list from adlist 2. Open terminal > ping googleadservices.com 3. Add the ip to static DNS /ip/dns/static...

Lokamaya

I don't have experience with public/private ip. But, do you consider using netmap rather than dst-nat?

Lokamaya

I'll use Netwatch, not Logging, for sending email for the time being until it is resolved. And add "start up delay" into it.

Lokamaya

Yes, some Quad9 ip or server seems still not get the proper certificate.

Lokamaya

The Adlist (and similar service like PiHole) requires DNS from our Tix/PiHole. Still the Adlist can't block client who uses custom DNS or PVN, but who can?

Lokamaya

On ROS 7.14, I choose Adlist (Adblock) from Mikrotik. First, create a new GitHub project, i.e. "MyTube Blocker" Then, add MyTube Blocker list to Adlist Lastly, update MyTube Blocker regularly through GitHub project When we need to access Youtube temporarily just disable "MyTube Blocke...

Lokamaya

After two days of trying to solve the SSL error problem on DoH, it finally worked normally again. I use Quad9 DNS service for this feature. I also tried Cloudflare and NextDNS (free up to 300K queries) just to find out which is the shortest hop from my place. But in the last few days suddenly the lo...

Lokamaya

Sometime creating an empty folder or file inside the empty flashdrive would solve the problem. Or format the flashdrive in ext4 format.

Lokamaya

You could send a VLAN between two bridges, but that would involve bridge stacking, something like this:

I just know this is possible. Thanks.

Lokamaya

I tested it on Mangle chain prerouting: dst-address-type=local or src-address-type=local. Its seem that on prerouting only one known, either source or destination.

Edit:
Btw, it works on Mangle chain=input, dst-address-type=local or src-address-type=local

Lokamaya

There is a bug in RouterOS v6 installed on CRS326. The CPU only count 1, while on RouterOS v7+ its count 2.

Lokamaya

I am upgrading to RouterOS 14.1 and got 3500Kb of free storage. Here what I did viewtopic.php?t=206130

Best,
Lokamaya

Lokamaya

CRS326-24G-2S+ is a dual OS switch, equipped with 16Mb of storage. This makes the storage fill up quickly, especially when upgrading RouterOS from version 6 to 7.7. After several months of experiencing a lack of storage and not being able to upgrade or downgrade, this week I finally got a backup swi...

Lokamaya

Got the same problem. For packets incoming from LAN, I add "reject: tcp reset" just before the default invalid filter. /ip firewall filter add action=reject chain=forward connection-state=invalid out-interface-list=WAN protocol=tcp reject-with=tcp-reset tcp-flags=!syn add action=drop chain...

Lokamaya

Yes, Anav... need time to draw a complete diagram. Hopefully in the near future.

In short, there are two approaches: client have its own DHCP server, or everything is centralized. Currently I use the first approach on my setup.

Lokamaya

Interesting. Thank you.

I just home and office user with small network. Never touch EdgeRouter, but quite familiar with EdgeSwitch (and SwOS). Once I had an USG, but now I prefer Mikrotik.

Lokamaya

Hi all, This is my first experience working with the Mikrotik wireless LAN and Unifi network controller system. My setup is quite simple. I just want to give internet access to clients in different buildings, while managing the Unifi access point centrally. And I'm quite happy with the results. Wire...

Lokamaya

The howto: https://github.com/nberlee/bonjour-refl ... /README.md

Thanks

Lokamaya

Login to RouterOS using IP or MacAddress?

Lokamaya

So, the best practice is to let the VLAN_MGMT remain in the main table.

Lokamaya

I can confirm when VLAN_MGMT changed from main table to rtab-WAN1 , I can not ping the DHCP modem (WAN2: 10.2.2.1) from outside the router. The WAN2 modem only accessible from inside the hEX router and its port. I still can access internet through WAN2 internet provider, but I can not access the mod...

Lokamaya

I have a chance to test it on 4 WANs, 1 PPPoe and 3 DHCP. But have to make some wiring to the 3th and 4th internet provider, maybe in the weekend.

Lokamaya

You can see this post viewtopic.php?t=189520
Just change the failover (distance: 200) to different distance.

Thanks

Lokamaya

/routing table add disabled=no fib name=rtab-WAN2 /routing rule add interface=VLAN_20 action=lookup table=rtab-WAN2 add interface=ether5 action=lookup table=rtab-WAN2 add interface=VLAN_30 action=lookup-only-in-table table=rtab-WAN2 /ip route add distance=2 dst-address=0.0.0.0/0 gateway=200.10.10.1...

Lokamaya

(5) You really dont have a primary and secondary at the moment, both have same distance and you dont have check-gateway=ping on the primary. Recursive route is another homework. I'm just digesting this one and the "recursive" thing is too difficult to handle for the beginner like me. Whil...

Lokamaya

(1) Looking only at your routes, What is the purpose of the distance differences, need to understand your logic?? The differences is for fallback or failover. /ip route add distance=200 dst-address=0.0.0.0/0 gateway= 200.10.10.1 routing-table= main scope=30 target-scope=10 add distance=200 dst-addr...

Lokamaya

There are some ideas here........... viewtopic.php?t=182373

Thank you Anav. I've read that post and many others of your posts. You are my hero here and very helpful.

Lokamaya

Reserved

Lokamaya

After struggling for several weeks to get dual-wan policy based routing running on RouterOs version 7.5, with the help of this forum and various trials, I finally found a solution. My basic question (as I asked here https://forum.mikrotik.com/viewtopic.php?t=189239): What is /routing/table/ and /rou...

Lokamaya

I'll post my finding in another thread.

Thanks

Lokamaya

You only need 2 wires for DC: black (-) and red (+). Maybe you get different color combination, and its depend on your country. Computer fans has 2, 3 or 4 wires (mostly 12V). The first 2 for electricity, the 3th for sensor and fans speed, the 4th for other control like LED. So, no matter how many w...

Lokamaya

The 24V fan is rare but I choose not to use 12V version because there will be more works to do. And I'm lucky to get four 24V DC fans with 3 wires. Here my list: 1. 24V DC fan 40mm x 40mm x 10mm 2. Screw Metal M3 - 12mm (my fan 10mm) 3. Nylon M3 Pilar Spacer PCB 4. Extra cable and cable's fan connec...

Lokamaya

After reading this thread and found Eric Shewe (https://www.pickysysadmin.ca/2022/08/1 ... tallation/) post, I start hunting fans for my CRS and CSS. Here my results:

Capture-css.JPG

CSS326 45-47°C

Capture-crs.JPG

CRS326 49-50°C

Lokamaya

Thanks again. This is what I need.
I'am currently using ipinfo.io (json format) to get dynamic public ip.

Lokamaya

Thanks @rextended, its works.

I'll try it with more complex script to get dynamic public IP of my ISP and stored it on address list.

Lokamaya

I have run the script and make JSONLoad as global variable.
Thanks

Lokamaya

Hi all, I have a json file with IP address and other data. I try to parse it with JParseFunctions (https://github.com/Winand/mikrotik-json-parser). The script running well on terminal, but I don't know how to make it works on /System/Scripts. Capture.JPG JSON code { "ip": "108.177.16....

Lokamaya

192.168.2.1 is your modem, I guess. And 10.10.0.200 maybe a port forward or something in your modem...

Lokamaya

So everything works except the UNIFI?? Just finished the EdgeSwitch configuration, and have to dig deep into legacy interface to change trunk port from 1 to 99. Maybe this would be helpful for anyone: Switches > VLAN > Port Summary. Or, using CLI here https://help.ui.com/hc/en-us/articles/115002359...

Lokamaya

I also not so sure. Back to mangle for the live RB.

Lokamaya

I guess these are both the same: src-address == interface (interface===in-interface, but be careful because src-address !== interface). There is no out-interface, only in-interface. Capture.JPG If we can write script like this, there will be no confusion where to look for routing table: /routing/rul...

Lokamaya

I even can not ping from any subnet to it's own gateway: ping 192.168.20.1 -> request timed out (from 192.168.20.x) ping 192.168.30.1 -> request timed out (from 192.168.30.x) So here the simplest solution with 3 lines of code: /routing/rule/ add dst-address=10.0.0.0/8 action=lookup-only-in-table tab...

Lokamaya

TRIVIA: RouterOS 7.5 I moved one Unifi AP to different subnet (192.168.10.10, vlan10) and try to adopt it from Unifi Controller (10.199.99.10, vlan99) but failed; Trying to ping the AP (192.168.10.10) from my PC (10.199.99.30, vlan99) also failed-> Request timed out ; Trying to ping the AP (192.168....

Lokamaya

My hEX is running flawlessly right now.
Thank you Anav for your time. Bless you, keep happy and healthy.

I leave the Unifi' thing for next day....

Lokamaya

PART 03 (7) SOURCE NAT RULE is not configged properly , first there is no such interface as all-vlan, its bound to be a list anyway and I think you meant in-interface-list=VLANs add action=redirect chain=dstnat dst-port=53 in-interface=all-vlan protocol= udp Why only udp and not TCP ?? Done (8) Raw ...

Lokamaya

PART 02 Oops you dont have all the vlans identified as members to your INTERFACE LIST entry ---> VLANs ?? (6) Lets fix your interface lists and firewall address list. USE of firewall address lists is BEST SUITED for when you have a few users in one subnet or across subnets or groups of users from wi...

Lokamaya

PART 01 # 200+ = SENIOR HIGH SCHOOL - 192.168. 100 .0/24, 192.168.210.0/24 (teacher), 192.168.220.0/22 (student) should that not be .200 ? Typo. You are right, it's should be 200. (1) Okay I am not sure what you are doing with the management interface..........? Typically this is a vlan that only th...

Lokamaya

I've been locked out from RB several time... tbh

Lokamaya

Sweet, have some time to look at the config....... (will add as I read through and will state done when finished looking at it).

Amazing. I have to look into your suggestion line by line. I'll be back soon.
Thank you

Lokamaya

Awesome, now one needs to know the requirements or in your case how you expect to use the WAN connections. For example. a. wan1 primary and wan2 secondary b. load balanced PCC other less frequent options are c. wan1 primary and wan2 secondary but some user, groups of users, or subnet should use WAN...

Lokamaya

Here the network layout. CRS as a root bridge connected to 2 CSS switches in other buildings using SFP+ port in this ring topology. I've tried connected internet directly into CRS and make it as main router, but this device seem not suitable for routing and WAN (CPU load was high and I run out of di...

Lokamaya

Hi there, so let me understand this correctly.
The router connected to the internet is the CRS ?

hEX connected to internet
CRS for internal switching

Lokamaya

Hi, thanks Anav... Here my RouterOS v7.5 setup on hEX RB750Gr3. This RB router connected directly to CRS326-24G-2S+ as the main switch-router. ############################################################################### # RouterOS 7.5 on hEX RB750Gr3 ##############################################...

Lokamaya

I will try to get all the useful links to threads to look at when some script is needed, that is not yet in wiki or is in wiki, just to get them not buried under loads other posts. Check time of the post, to make some link to RouterOS version these where created for. New script for RouterOS v7, ple...

Lokamaya

I found this interesting and maybe a bug. After upgrading to v7.5, I got 2 cores on my CRS326. With 2 cores, the CPU-Load drops drastically.

mikrotik-crs326v6.jpg

mikrotik-crs326v7.jpg

Thank you

Lokamaya

Hi all, Just upgraded my hEX from v6.49 to v7.5 and found it is little bit different regarding dual ISP handling. I've read routing tutorial here https://help.mikrotik.com/docs/display/ROS/Routing and also some other examples on Youtube, but still don't get the basic concept of routing rules. Here s...

Lokamaya

There is nothing wrong with the disk, but it is too small. Only 16Mb.
I lost part of firewall configuration and part of static DNS.

It's seem that that part remains in the memory and lost when I reboot the MK.

Capture.JPG

Lokamaya

Me too. I'm using CRS326+24+2

Lokamaya

Send me an email, it is listed above.

I can not contact you at mike(at)43index.com.

Search found 102 matches