MikroTik

rkorolev

I'm thinking about it, but how can I make dst-nat for only specific users?
Set up a chain which will be used as "Filter-Id" and set action to "jump=dstnat" - will this work?

rkorolev

Hello. For users with negative balace we just supply "Filter-Id" attribute for PPPoE users with an ACL, that blocks all, but stats/news websites and DNS server, but sometimes they do not want to visit such sites and prefer to call tech.support with questions like "why my favourite web...

rkorolev

Hello.
I've accidentally set "all" in interface graphing rules, but when I removed it, there's still a list of all dynamic interfaces in graphs.
And it still collects all this data.
How to remove everything or just unneeded interfaces?
ROS 3.16

rkorolev

Load balancing with several ROS is working. Almost. There's one problem you can't handle without real cluster: serverA gets 100 users at night, serverB also gets 100 users. But 10 users on serverA with high bandwidth start downloading torrents and server is pretty loaded. You can't mirate some of th...

rkorolev

I don't know if it's a multi-core bug, but there's still a problem with 3.15 and 3.16 with timers: clock goes at least two times faster than real clock on a dual-core CPU.

rkorolev

ROS 3.16 released, there's a line in Changelog:

fixed problem - x86 clock was 10 times faster then it should be on some boards;

Just tried it, now time goes only two times faster than real... ;(

rkorolev

We're using an automated script that check all login attempts and blocks specific MACs in bridge filters if user is trying to connect more than 3 times in 60 seconds, block lasts for sometime and then it's auto-removed. This also helps to lower the load on an auth server when there's a lot of discon...

rkorolev

Yes, we have exactly same situation.

rkorolev

We also have packet loss 1% at least, but sometimes I've seen a 3% loss on a 600 packets

rkorolev

that's not a topic for routeros forum

you can write me a mail to

rkorolev

Currently 50-58mbit/s, 580 users (325 queues) - packet loss i still here :( To RouterOS itself: 600 packets transmitted, 594 packets received, 1% packet loss The absolutely same story via connected PPPoE: Packets: Sent = 600, Received = 594, Lost = 6 (1% loss), It's better than 2-5% loss in older ve...

rkorolev

At least one more problem was found with test build.

Problem will be fixed in next build and at this point it looks like it will be
the last - so, please, wait for the release of 3.7

rkorolev

We still have problems with 3.7 beta, it works good only a short period of time.

rkorolev

And a new beta of 3.7 just arrived. Testing again...

rkorolev

Pity, but after a day of uptime it began loosing packets and a minimal ping is 60ms :-/

rkorolev

It's a DSL shaped to 128kbit and latency is pretty good (except "maximum", but maybe it was a lag on a line).

rkorolev

3.7 beta works fine, as we can see for this short period of time:
Packets: Sent = 4546, Received = 4546, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 6ms, Maximum = 478ms, Average = 8ms

Before this I had 2%-5% loss on 200 packets.

rkorolev

I believe MT is working on this issue. But there is always workaround - use static queues or queue tree. There are also several benefits to use static queues: Probably you can find more. Static queues are not suitable for at least one situation: when you have a number of bandwidth plans and you set...

rkorolev

Do you use queues? We have the same problem with packet loss and one of the problems is that ROS drops a packet every time a queue is created or deleted. When many users connecting/disconnecting you get a packet loss. Maybe that's not the only reason, but thats a reproducable and Mikrotik confirmed ...

rkorolev

BTW, the problem was not with Broadcom NICs, but with BIOS settings: Advanced -> USB Control USB - Device 29, Function 7: disable This is something abount USB 2.0 Functionality and RHEL. Setting it to "disable" help to boot ROS. Strange, but ROS <=3.1 worked fine even with these settings.

rkorolev

Hello. Maybe someone will reply here, 'cause support@mikrotik.com is keeping silence... 1. Broadcom GigE on-board LAN is not working since 3.2. On 3.1 everything is fine. 2. As i know, the ROS license (Software ID) is fixed to a HDD when you first install ROS. I've tried to move my HDD to another se...

rkorolev

There's a reply from support, that they fixed drivers in release of 3.3.
And there's more good news:
What's new in 3.3:
*) fixed bug - PPPoE server could crash when running on multiple cores;

Will try to upgrade on monday...

rkorolev

I'm using ROS on HP Proliant DL140.
Neigher upgrade from 3.1 to 3.2, nor clean install of 3.2 from CD works.

rkorolev

please both of you who has this problem, make the support output file from router when it is booting and working fine (v3.0 or v3.1), so then we could compare and look why it isn't booting the new version. Send those files to support@mikrotik.com I've sent a message to support 6 days ago, no reply....

rkorolev

Who said that all 3000 users should be on the same subnet? How about VLANs?
I'm also interested in RB1000 performance with a large number of PPPoE clients with shaping/filtering.

rkorolev

I'm using ROS on x86 PC.
Tried to upgrade 3.0 to 3.2 via combined package, the ROS stopped responding after reboot. The only thing in console is "Loading system".
Tried reinstalling 3.2 from CD and it didn't help. Reinstalling 3.1 help, it works again.
Does anyone have same problem?

rkorolev

I got recomendation to replace dynamic change-mss to static rules from Mikrotik support and we now have these: [admin@MT-0] /ip firewall mangle> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=forward action=accept in-interface=ether1 1 chain=forward action=accept out-interface=ether1 2 ...

rkorolev

Radius and separate radius server. And now we have an additional service written in Perl to control PADI flood and server load via ROS API, that helped alot. But the same amount of users can handle simple and free FreeBSD/exppp (patched user-level ppp) solution. When we bought L6 I hoped that ROS ca...

rkorolev

Even without encryption, just pure termination.
600 online pppoe users without encryption, with per-user shaping and filtering and ROS is 100% loaded.
Even winbox lags and sometimes disconnects.

rkorolev

I can't see the REAL advantage of multicore at this specific moment PPPoE/VPN termination. p.s. Now we have better performance on free solutions, than on purchased ROS :-/ We were thinking about purchasing 6-8 more L6 licenses, but I think we'll move to FreeBSD/mpd5 solution if Mikrotik doesn't fix...

rkorolev

We loaded up the system with 2,631 PPPoE sessions, 3,464 OSPF routes from two peer routers, while maintaining a 62% CPU load average for 30 minutes.

Lucky man you are... We have a much heavier load, 'cause we need shaping and filtering.

rkorolev

The only response you get from support will be "turn off multi-cpu".
And on the question, when this will be fixed:
"About multi-core - sorry, I can't give you any estimates."

rkorolev

You will also need v3 for dual core support. Good thought to try to upgrade to v3, and turn off connection tracking. See how that does. Make sure you turn ON multi-processor support in v3 though, its not on by default. Multi-processor on ROS v3 is not working: ROS just stops responding to PPPoE the...

rkorolev

3.0 final, approx. ~270 pppoe clients, packet loss is here:
Ping statistics for 194.87.0.50:
Packets: Sent = 500, Received = 408, Lost = 92 (18% loss),
Approximate round trip times in milli-seconds:
Minimum = 9ms, Maximum = 47ms, Average = 17ms

rkorolev

there is not one reasony why one core would not be enough. either your configuration is flawed, or you just haven't tested the actual performance of a good cpu. even the rb1000 can handle any setup you can imagine! I have an existing servers with intel dual/quad core CPUs for OSPF and PPPoE access ...

rkorolev

Strange, but now (after ~1hr uptime) it works like it should.
But when that happened only window open was "Interfaces".

rkorolev

Hey, just installed 3.0 release and noticed that after I open connection to ROS with winbox I got a 16-17mbit/s load.
Does anyone have the same problems?

rkorolev

It's very bad when you pay for an L6 license and can't use ROS for full, because one CPU is not enough...
multi-cpu should be fixed.

rkorolev

I'm with rkorolev on this one.. There needs to be a way to limit the PADI requests that are answered simultaneously. Say, answer 50 requests, wait until they 're authenticated and shaped, then answer more requests. There's a way to rate-limit PADIs with bridge filters: /interface bridge filter add ...

rkorolev

I've got a reply from ROS Support:
PPPOE crash will be fixed in next release.

rkorolev

Sent by email, hope you can understand what it's doing

rkorolev

1. Tried to use filter in interface graphing to just show "vlan*" interfaces. The winbox appliction closes just after I click "Filter" button. 2. Under heavy load (>500 users) ROS suddenly stop accepting new connections and starts to disconnect already active PPPoE users. Winbox ...

rkorolev

The same strange things, when I'm telnetting to MT:
[rk@hit /usr/log]$ telnet xx.xx.xx.xx
Trying xx.xx.xx.xx...
Connected to xx.xx.net.
Escape character is '^]'.
Password:
Login failed, incorrect username or password

Login: admin
Password:

See this "Password" without "Login"?

Search found 43 matches