MikroTik

dave3

Yes, it's the same thing with "Destination unreachable." I haven't tried to ask my ISP. I'm pretty sure they won't do anything, based on previous interactions. If there's nothing I can do configuration-wise, the solution is to not use IPv6.

dave3

Here's the additional info: [admin@MikroTik] > /ipv6/address/print Flags: D - DYNAMIC; G - GLOBAL, L - LINK-LOCAL Columns: ADDRESS, FROM-POOL, INTERFACE, ADVERTISE # ADDRESS FROM-POOL INTERFACE ADVERTISE 0 G 2001:4452:AAA:BB00::/64 ipv6-pool bridge yes 1 D ::1/128 lo no 2 DL fe80::de2c:5555:7777:294...

dave3

Here are the settings with IPv6 enabled. /ipv6 settings set accept-redirects=no accept-router-advertisements=no /ipv6 address add from-pool=ipv6-pool interface=bridge /ipv6 dhcp-client add add-default-route=yes interface=ether1 pool-name=ipv6-pool prefix-hint=::/56 rapid-commit=no request=prefix use...

dave3

Here are the IPv6 settings. The firewall is the default setup. /ipv6 settings set accept-redirects=no accept-router-advertisements=no disable-ipv6=yes /ipv6 address add from-pool=ipv6-pool interface=bridge /ipv6 dhcp-client add add-default-route=yes disabled=yes interface=ether1 pool-name=ipv6-pool ...

dave3

I've been having this problem with my IPv6 connection. Every 5 or 10 minutes or so, it just drops out, and I get "Destination unreachable" errors for a few seconds, then it's back. This is with any IPv6 address, even the first hop on the traceroute. And if I've got multiple pings running, ...

dave3

Upgraded RB750Gr3. I noticed it lost the /system clock time-zone-name setting after the upgrade; had to add it back.

Is it possible or advisable to remove the new wireless package, since the device has no wireless functionality?

dave3

Note that host key and public key authentication are different things. To switch the former to ed25519 use:
Code: Select all
/ip/ssh/set host-key-type=ed25519;

That fixed it, thanks!

dave3

I was able to import an ed25519 public key. But using: HostKeyAlgorithms ssh-ed25519 on my client ssh config fails with an error: Unable to negotiate with 192.168.3.1 port 22: no matching host key type found. Their offer: rsa-sha2-256 If I don't insist on ed25519 as a HostKeyAlgorithm, I can connect...

dave3

I did the upgrade from v7.6 to v7.7 on my RB750gr3 yesterday. It's a pretty basic setup, but so far, so good.

dave3

My IPv6 prefix doesn't change every night, but it changes sometimes. Maybe once or twice a month. I "fixed" that, not with a script, but by just setting the Preferred Lifetime to 20 minutes, and Valid Lifetime to 12 hours. Even without that, linux and android picked up the new prefix and u...

dave3

When I used an Asus router (both merlin and freshtomato firmware), I could get IPv6 to work somewhat, though it had issues. When I switched to a TP-Link router, I couldn't get IPv6 to work reliably at all (same with openwrt). I got the Mikrotik for the purpose of better IPv6 support. It works well, ...

dave3

I used to run pi-hole on my raspberry pi 3b+ along with dnscrypt-proxy. I do think it's helpful. Eventually I removed pi-hole, though, and just use dnscrypt-proxy as pi-hole wasn't adding much for me. dnscrypt-proxy mostly does the same thing, using doh and dnscrypt, except it doesn't have the gui. ...

dave3

It's easier than that, since I have linux running already (dual boot). I wasn't aware it worked better on linux. I also seem to forget, or doubt myself when it doesn't work. Do I plug it into the "Internet" port or "eth2"? Do I use the default 192.168.88.x or do I use the 192.168...

dave3

I've done netinstall on windows 10 many times, but it usually doesn't work right away. I just have to keep trying over and over and over until it works. It usually takes 30 minutes to 1 hour of trying before it works for me.

dave3

^^^ That is correct. My isp also sometimes changes the prefix. It gives a 3 day lease, but sometimes it just stops working and I need to release the old lease. /ipv6 nd prefix default set preferred-lifetime=20m valid-lifetime=12h That's what I've got it set to. Linux and android clients (using SLAAC...

dave3

For what it's worth, I have in the past, connected a tplink extender and it's gotten a dhcp address from my mikrotik router and worked. However, it was connected to another tplink access point that was connected to the wired mikrotik router.

dave3

Something you could consider, on systems that are sensitive to IP changes, would be to use wireguard (perhaps setup on a good/reliable vps with a static IP). Wireguard doesn't care what IP address the packets come from, as long as the key is correct. I've tested using a SIP app on my cellphone, conn...

dave3

If you're using the default firewall rules and ipv4 is fasttracked, ipv4 speed will probably not be an issue, but ipv6 is slower. Not sure if you'd notice it at 300mbps on hap ac, or not.

dave3

I saw that. So we know the hardware is capable. It just needs some attention. I'm hesitant to go to openwrt, though. Before I got the Mikrotik, I was thinking of going in that direction, so I installed openwrt on an old Asus router to test. Perhaps part of it is a learning curve, but I was never abl...

dave3

On a 600/600 connection, with the RB750gr3, IPv4 hasn't been an issue. It can easily handle 600/600, running speedtests, on both v6 and v7. With IPv6, the max on v6 I'm able to get is about 350mbps. On v7, it's about 250mbps. That's with a single connection. I've tried 2 simultaneous IPv6 connection...

dave3

Thanks -- yes, that's also what I read about the route cache in v7, so I was expecting it. For anybody wondering what they can expect from IPv6 on the RB750gr3, under v6 and v7, these are some real tests.

dave3

I updated the firmware from 6.48.6 to 7.6 and tested the IPv6 performance again. With 7.6 it seems to only be able to do 250mbps over a single IPv6 connection (vs. 350mbps on 6.48.6). IPv6 Download: 249.50 Mbps (data used: 369.5 MB) Upload: 93.26 Mbps (data used: 169.9 MB) # CPU LOAD IRQ DISK 0 cpu0...

dave3

I just netinstalled 7.6 on my 750gr3 and ran into a problem with the ssh login. Using the same 4096 bit RSA key that I used successfully in 6.48.6, 6.49.x, 7.1, 7.2, I got: Server refused public-key signature despite accepting key! After generating a new 2048 bit RSA key to use, it accepted that and...

dave3

Well, I got it to work finally, but I wonder if it's a bug in v7.6.

In the past, with 6.48.6, 6.49.x, 7.1, 7.2, I used a 4096 bit RSA key without a problem, but in 7.6 it wouldn't work. I regenerated a new 2048 bit RSA key, and it accepts that new key.

dave3

I've set up ssh key login several times before, but for some reason I must be forgetting something this time. After netinstalling 7.6, I import the ssh public key and try to login and get this error: Server refused public-key signature despite accepting key! Then I'm not even able to login with the ...

dave3

It's a new model, the ax1500, not supported by OpenWRT. It has a broadcom cpu so it's unlikely it will ever be supported.

I understand, too, that I'm not really the target market. I tempered my expectations, but it was worse than I thought. But now I know.

dave3

And it's still for sale. I just got mine earlier this year. My hope at the time was it would handle 500/500. Some get close to gigabit over ipv4, and I don't doubt it. I was hoping it would get at least 500mbps for ipv6, but I might have been too optimistic. Still, I'm not disappointed. It's best fe...

dave3

I am using 6.48.6 Long Term right now, though I've used 7.x in the past, and it was the same, as far as I can remember. I am looking at each cpu core separately (2 real cpu cores). I do see one almost saturated, but the other isn't. That's why I'm wondering if it's really a cpu issue. Is there somet...

dave3

I have an an RB750gr3 connected to a 600/600 fiber line. IPv4 performance isn't an issue, but I'm not sure if I can reach even 500-600mbps over ipv6. As a baseline, I ran a speed test to a local isp server. Over ipv4 626mbps down, 622mbps up [admin@RouterOS] /system resource cpu> print # CPU LOAD IR...

dave3

I'm not certain it's a Mikrotik problem; it could be something with Wireguard itself. I just don't know.

I do know that it happens with multiple clients: Windows, Linux, and Android. And it doesn't happen with ipv6 endpoints, just ipv4.

dave3

I've been having problems with Wireguard (not wireugard running directly on the Mikrotik). I suspect it's a NAT issue, but I'm not sure how to fix it. My firewall rules are just the default setup, and I've had this problem on v7 (up to v7.2.1) and now I've downgraded to LTS 6.48.6, and the problem p...

dave3

90.1% now.
Wait, 90.2%

Yes, a 10 megabyte file downloading at dial-up speed. Same for me. I can envision a 30 year old PC hooked up to a US Robotics 28.8k modem sitting in the corner of an office serving firmware update files. :)

dave3

The defaults changed, to get rid:
Code: Select all
/interface/ovpn-server/server/set auth=md5,sha1,sha256,sha512;

Thanks.

dave3

The upgrade went ok on an rb750gr3 from 7.1.5 to 7.2. It still downloaded very, very slowly, but without constant timeouts this time. Comparing an export from before and after the upgrade, everything remained the same, except this was added in 7.2: /interface ovpn-server server set auth=sha1,md5 I d...

dave3

From some wiresharking, I can tell my isp is using huawei equipment also, and I've had trouble with ipv6. But I've had the best success getting it to work with Mikrotik, vs. other routers. What I do notice is that the first time it gets a prefix (or after after it's been disconnected for a long time...

dave3

It can point to some MTU problem further upstream. E.g. you have the MikroTik behind an ISP router that has a PPPoE link with MTU 1492 or so, but on the LAN side the MTU is 1500 and that is also what the MikroTik sees. The whole thing is relying on PMTUD then, which is broken for the MikroTik downl...

dave3

I had a similar problem on my RB750gr3 with connection timeouts from system->package. I don't know why it's like that. It would try to download (at dial-up modem speed or worse) and constantly timeout and restart. Eventually, it did download, very slowly. But also, I just downloaded the npk file fro...

dave3

I updated from 7.1.4 to 7.1.5. I was just looking at the routing, i.e. /ip/route/print and /ipv6/route/print and it looks the same. I think the "routing table" is something separate, beyond the scope of my knowledge. Hopefully everything is still fine.

dave3

Thanks, I put the .npk file in the .download directory of the router, and executed the /system/package/update and it disconnected, did it's thing, and rebooted. It's a small file and downloaded instantly over the same connection from the website. Not sure why it won't download properly from the rout...

dave3

Trying to download the update, but it's dialup-modem slow, and keeps disconnecting. [admin@MikroTik] /system/package/update> download channel: stable installed-version: 7.1.3 latest-version: 7.1.4 status: ERROR: connection disconnected If I download the npk file from the website and place it in the ...

dave3

I also have an RB750gr3. There are two different diagrams, one "with disabled switching" and one "with enabled switching." The "disabled switching" is the desired configuration, with ports 1,3,5 with 1gbps, and ports 2,4 with 1gbps. I can't find how to tell which config...

dave3

I have the graphing setup to write to memory instead of disk. So it will only have graphs for the current uptime. It would be nice if you could write the graphing data to an sd card, but it's ok.

dave3

I know it's not a solution, but for what it's worth, I don't have NTP enabled and the system time still gets set correctly. Even in v6 it had another built-in means of setting the time apart from ntp. It doesn't seem to maintain accuracy, though. My router (on 7.1.3) was up 11 days, and the time was...

dave3

If you just need a basic setup, it's not that difficult. And quickset works fine.

dave3

In many countries, you just buy a SIM card, and use it however you like. It's on you to make sure the phone or device is compatible. The provider doesn't care much what you use it for, as long as it's paid for. I understand in the US it's a little different. I've heard AT&T is whitelisting IMEI ...

dave3

Aside from the technical solution, and educating users, and using anti-virus software; I'm not sure anyone expects an ISP to provide email service anymore. There are plenty of email services to use, on their own. I think that was mainly a thing back in the 90's.

dave3

Well, I was connected to a vpn when testing it, but I think it was still routing the public IPv6 over the LAN. And that's why it was accepting the (LAN) connection.

dave3

I have the default IPv6 firewall installed. From what I can tell, it should generally block new incoming connections. But when I try to access port 80 remotely over IPv6, it's open, and I can connect. Maybe I'm just reading the firewall rules wrong. Should the default firewall be blocking new incomi...

dave3

The backup/restore doesn't include the software, just the settings. And I think it's recommended that the restore is only done on the same version of software it was backed up with.

dave3

Sure, but the message that it is activated is not related to that. It is related to bridge offloading and it was also there in v6.

I understand, thanks.

dave3

I thought I read it was new for v7 (perhaps not v7.1.3 exactly), though I could be wrong. I know that "hw-offload=yes" wasn't in the same configuration I had in v6.

dave3

I was going to wait, but I decided to try it. From 6.49.3 to 7.1.3 on RB750gr3, with netinstall. So far, so good, as far as I can tell. It's using about 15MB more RAM than before. My setup is pretty vanilla, though I am using IPv6. I do notice this new hardware offloading: add action=fasttrack-conne...

dave3

Thanks, I didn't know that. I didn't see it anywhere in the netinstall instructions. It's interesting, even the packages were listed as 6.49.3. But after doing the /system routerboard upgrade, the current-firmware is listed as 6.49.3.

dave3

I upgraded my RB750gr3 to v6.49.3 with netinstall. And when I connect in winbox it says I'm connected to v6.49.3 on hEX (mmips). But if I do a /system routerboard print, it says my current-firmware is 6.47.10 (the same as the factory-firmware). Should I be concerned? [admin@MikroTik] > system router...

dave3

I used netinstall on windows 10 64 bit to install both v6.49.2 and v6.49.3. From what I've read, it's the best way to insure a problem-free upgrade, if you don't mind reconfiguring it. It worked fine, as long as I enabled the "apply default config." Without that, I couldn't find it on my n...

dave3

It underwent 2 months of rigorous testing before release. :)

dave3

We cannot do Fasttrack offloading until the software IPv6 Fasttrack gets implemented. The latter is on the TODO list (backlog) but not on the roadmap yet. I suggest creating a feature request thread on RouterOS v7 forums for IPv6 Fasttrack - if it gets enough user attention, it might receive a prio...

dave3

It looks like it's the "IPv6 ND Prefix" defaults that are the important values. I don't think the ND RA Interval and RA Lifetime are as important.

After the Preferred Lifetime, Windows 10 deprecates the address. And after the Valid Lifetime, it removes it completely. I tested it.

dave3

Thanks, that's what I was looking for. I see it under the "Advanced" tab, though.

dave3

Is there a list of events somewhere, that can be used for triggering a scheduled script? Specifically, I'm looking for something that would tell me a dhcpv6 lease has been obtained, or even just renewed. It could even be for all dhcp leases / ipv4 & ipv6. Otherwise, since it's time sensitive, I ...

dave3

Do you think your script would work, when it gets a new prefix after rebooting the router? Would the old prefix survive the reboot? I think that would be the main time I could get a new prefix (after rebooting).

dave3

mikrotik-btest-ipv6-2022-02-11.png From the Philippines, 500/500 fiber. This is on ipv6. It seemed to only test TX. I tried a second test for Receive later, but it wouldn't connect. I also tried the ipv4 test, but it was really slow, and when I tried a second time (after more than 5 minutes) it wou...

dave3

Look at /ipv6/nd/prefix/default.

Thank you! I didn't see that before. That did it.

[admin@MikroTik] /ipv6 nd prefix default> print
          autonomous: yes
      valid-lifetime: 1h
  preferred-lifetime: 10m

dave3

Even with a short ra-lifetime, it's not helping for me. There's the "nd" settings and the "nd prefix" settings. The "nd" settings have an "ra-lifetime" value, and the "nd prefix" settings have "valid-lifetime" and "preferred-lifetime&q...

dave3

Another workaround that was discussed in older threads about this subject: https://forum.mikrotik.com/viewtopic.php?f=2&t=73034 Is setting the preferred-lifetime and valid-lifetime to a shorter value, like 10 minutes. That way, if the prefix changes, the old IPv6 addresses will expire quicker. T...

dave3

For the rb750gr3, if you're not using "the dude," is there any good use for an sd card? What else could it be used for, and is it worth it/useful? For curiosity's sake, if you're using "the dude", what else these cards could be used for ? I've got the mikrotik on order, and I ne...

dave3

For the rb750gr3, if you're not using "the dude," is there any good use for an sd card? What else could it be used for, and is it worth it/useful?

dave3

This issue was already reported in 2013, but apparently still not fixed. There's scripts in the other threads, also, to try to deal with the problem. Deprecating old IPv6 prefix when removed or replaced RFC6204 https://forum.mikrotik.com/viewtopic.php?t=73034 IPv6 connectivity problems... https://fo...

Search found 68 matches