D'oh, a better way indeed...

Not sure how I missed that in the options but it does exactly what I need.

Thanks!

Hello, What is the best way to configure a DHCP server (CCR2004, ROS 7.14.1) that has no dynamic addresses? Specifically, I have a subnet that has a well-known list of clients; I want to ensure that no addresses are handed out beyond these approved MACs. I tried the naive solution but it appears tha...

Wow, that'll do nicely for my purposes. Also, +1 for making a generalized secret store as mentioned in your other post; that would also have solved this case as well.

Thanks for putting in the legwork and posting it up for everyone!

Where is the best place to store credentials (username / password) for accessing a private API on a CCR2004-1G-12S+2XS? Specifically, I have written a script to hit an HTTP(S) API with some basic information. The function of this API isn't relevant and is effectively immutable and, functionally, the...

Thank you both, for the in-depth answers. I think the problem is the dumb switch as I can see tagged traffic egressing the Linux host but nothing is ever seen in /tool sniffer quick ip-address=172.16.50.0/24. Unfortunately, due to physical constraints, it will take some doing to excise the dumb swit...

Hello all, Perhaps I missed something in my research but I am having a devil of a time setting up a simple one-port VLAN on my CCR2004-1G-12S+2XS. Here is what I am trying to achieve: I have a site-to-site wireguard VPN which is functioning as expected for years now. I would like to bypass this and ...

For now I am using a second routing table as I have written a special script to handle re-registration periodically required by the VPN vendor. The second routing table allows me to, on successful registration (and receipt of a new default gateway), regenerate the entire table without having to worr...

Good to know about the n-th full traversal, that explains a lot. Also, thanks for the tips on the routing rules. For now, I am running everything through the VPN but this may be handy in the future for "unmodified" subnets which poke out to the internet directly. Thanks again for the assis...

Oh, I think I see. So the very first packet for this connection traverses the entire "normal" data path including MSS fixing and eventually hits the FastTrack rule. This doesn't do anything per se but does add the connection to the FastTrack list. Then, when the next packet is seen its con...

Sindy, Thanks for the info and that makes sense. That said, what I am struggling with is why FastTracking is detrimental in the first place. Shouldn't all of the mangle rules and such be done by the time the packet is FastTracked? At this point, isn't the wireguard traffic basically the same as any ...

I have been playing with WireGuard a lot as of late and am a bit confused as to exactly how FastTrack rules are considered. Details regarding my setup are here . Additionally, I have implemented MSS clamping as described here . This leaves me with a functional connection, except that TCP connections...

You can use point to point config and not worry about mask (it's slightly unintuitive, but it works): /ip address add address=10.25.184.192/32 interface=wireguard-pia network=10.25.128.1 I see, I think: the above command could be translated as "add the address 10.25.184.192 to interface wiregu...

Thank you all for the detailed discussion. It has highlighted a number of gaps in my knowledge, which is always a good thing when learning. For what it is worth, most of this configuration I am sort of reverse-engineering. The VPN provider has a couple of bash scripts using wg-quick to set up the wg...

Unfortunately, disabling the FastTrack rule in the forward chain did not fix it. Is there a way to get more detailed debug information about the routing decisions being taken for a connection / frametype / etc? My suspicion is that something is incorrect about the default route and the frames in que...

Yes, 10.25.184.192 is my local IP and changes every time I re-register with their API. Additionally, my full config is below. I think I have some conceptual breakdown on how multiple routing tables are handled in ROS. Most of my experience is in low-level switch firmwares where, once a frame is allo...

Long time lurker, first time posting. Please let me know if there are any ways I can improve the post or information provided. I am having a bit of trouble with multiple routing tables and could definitely use a more experienced eye. Specifically, I am running ROS 7.1 on a CCR2004-1G-12S+2XS and try...