MikroTik

wiseroute

hello,

ok. nevermind.

have you read this wiki?

https://wiki.mikrotik.com/wiki/Manual:S ... sMAN_setup

--- additional

https://wiki.mikrotik.com/wiki/Manual:IP/Hotspot

maybe it can help you with your user login problem.

wiseroute

hello, Is there a way to map the port 53 on both IPs as failover? e.g. If 172.168.188.10 (ns1) is down to switch to 172.168.188.11 (ns2). I'm using RB5009 (ROS 7.9). the short answer is no. dst-nat can't do target weighting. you will need to add another machine behind your router in front of your ta...

wiseroute

hello, Site A - HEX s - With public IP -Interface Wireguard 4 -allowed addresses 10.10.200.0/30 is that 200.0/30 between site a and your phone? have you allow that subnet on site b? from phone to site b, ip route site b via wg site a. from site b to phone, ip route phone via wg site a. --- addition,...

wiseroute

hello, stuck with letting remote user(s) connect to the other remote sites through a existing wireguard connection to the main site. from your diagram - apart from any firewall problem, - do you a working bidirectional route from the wg2 clients to wg remote sites? - tools : ping and traceroute with...

wiseroute

hello, aaa.. a campus topology. does your university consist of separate building for each faculty? well, your question won't take a short answer. for this part, So the questions, How should I configure the HotSpot so that: It can work besides PPTP server? I mean, client either logins to PPTP VPN, o...

wiseroute

hello, hmm, done some reading on few lines of your fw rules, i think those are nice rules. if i may suggest, there are many types of firewalling based on these: layer 2, layer 3 and layer 4 and above. and the most important thing is to understand: - whether any set firewall rules need to be in state...

wiseroute

hello,

as requested,

for crs 1x and 2x

https://wiki.mikrotik.com/wiki/Manual:C ... s_examples

for crs 3x

https://wiki.mikrotik.com/wiki/Manual:C ... s_switches

hope this helps.

wiseroute

hmm, just to summarize all of the above suggestions: 1. dhcp snooping is mainly applied on switch level. so if anyone considering to get any manageable switch - they should look at this feature availability before they buy. it is really nice feature and important one. 👍🏻 2. if your 4 switches are ma...

wiseroute

@ nescafe2002,

nice pointer. i didn't notice that page

@ thomas,

The question here is, if the NAT on Mikrotik becomes a problem with a time of around 30 minutes with no communication on a specific NAT connection.

maybe you can try to tune it by @ nescafe2002 pointer.

wiseroute

hello, interesting 🤔 i barely pay attention to that details 👍🏻 did you host imap server internally or you were just asking about how long for your router to close your outgoing imap? i myself prefer to choose idle time is set by the server. but as for the MT firewall nat time out - maybe you can rea...

wiseroute

hello, occasionally the items stop polling, the monitored interfaces (about 800) have a polling time of 40 seconds. do you know of any mikrotik or Zabbix bugs? this one is a classic snmp problem. and generally, any polled devices - in their normal operating condition - will have no problem replying ...

wiseroute

@ anav

lightened up... let us say it is guessing week

no worries... you are invited

wiseroute

@ anav The openwrt LAN traffic will come in on ether3 untagged and we can tag it with vlan2 and move it to other ports on the MT are you sure this won't make l2 loop? openwrt LAN traffic is coming tagged from the openwrt. that's what I have suggested in my reply 😉 NOW WHICH DEVICE MT do you have ......

wiseroute

hello, But while my WAN port is a member of this bridge, it seems the NAT masquerading doesn't work since any appliance in the LAN isn't able to connect to the internet or other addresses in the WAN network. first advice is... if you don't have any urgent need to bridge wan interfaces - i think they...

wiseroute

hello, from this point, Forward all traffic from ONT from ETH1 port on MT to port ETH2 on MT (connected to OpenWRT) - VLAN untagged ETH1 - VLAN tagged ETH2 - erase public IP on MT those 2 interfaces should have the same vlan, let us say vlan 5. now, the first problem you will encounter in configurin...

wiseroute

@ miankamran, are you sure your *switch* was cisco sa500? doesn't look right? 🤔 Cisco https://www.cisco.com › obsolete Cisco Small Business SA500 Series Security Appliances anyway... with your current drawing, dynamic vlan can't do what you have in mind. so, the simplest way is : 1. make 2 vlan on M...

wiseroute

@ normis,

you really have a nice green view there, wonderful 👍🏻

well, maybe the next 2023 MT MUM it knows where to go... coffee ☕ on top of that cable roller, funtastico😉

wiseroute

hello, interesting... are you some kind of isp? 🤔 Clients connect to switches using Ethernet cable or Wi-Fi bridges, login to PPTP VPN and use network. We use PPTP to limit bandwidth and weekly traffic usage. are you sure - that was pptp vpn you are using to manage your subscribers? typo? However, P...

wiseroute

how'dy down under 👋🏻 everything looks great. you are good to go 👍🏻 on rb5009, - make a single bridge. - make 2 vlan iface : ip 10.0/24 and 200.0/24 - put ether2, 5-8 on the bridge. do bridge vlan filters. how to guide available on MT wiki bridge vlan. - make your ap in bridge mode. plug in ether2 vl...

wiseroute

hello nima, The service provider of point B informed me via email that a portscan has happened from this server (point B). for the first part, you should request any logs from your provider about their claims (to which target your router b did the scans). otherwise you will get busy for nothing. sec...

wiseroute

@ pe1chl,

are you sure about that?
wpa2/3 etc don't work any longer?

hmm, what does @op role anyway? internet cafe or something else?

wiseroute

@ primeyeti,

can you show us your drawing?

well, vrrp is very nice protocol - but it is considered *old* and not too flexible to manage.

at least you should give a dynamic routing a spin.

wiseroute

@ essam, peoples are sharing my internet with WiFi Scanning. how I can stop users from sharing my hotspot. maybe some basic approach? 🤔 1. don't broadcast your wifi ssid. 2. macaddress filters. need to register their macaddr before making the connection. 3. userman. radius. etc.. hope this helps.

wiseroute

@ holvoetn, don't worry, your proposal was totally correct - to change the remote subnets. so @op network will be scalable in the future. while my proposal was *options* - promoting MT own bridging vpn protocols 👍🏻 maybe vxlan as well 😉 so now, let us give the @op a time to think about which solutio...

wiseroute

@ bencaha,

maybe you want to read these guides

eoip :
https://wiki.mikrotik.com/wiki/Manual:Interface/EoIP

bcp :
https://wiki.mikrotik.com/wiki/Manual:B ... _bridging)

hope this helps.

wiseroute

hmm... interesting

never tried myself - and i think it is difficult to see the point of having it.

anyway... have you read this guide?

https://docs.cilium.io/en/stable/network/kube-router/

wiseroute

hello,

you might want to read this post, i have made a simple ospf interface path priority lab - almost similar to your problem.

viewtopic.php?t=196850

hope this helps.

wiseroute

hello, hmm, interesting 🤔 maybe... if all of these older devices are failed in the upgrade process - probably those devices are not supported by the v7. so they will have at max. v6.48? if there are some that succeed in the upgrade - then this will lead you doing some kind of device sorting. and ask...

wiseroute

hello, As far as I know, priority is used to determine DR and BDR roles... that's router-id in ospf instance config. I was referring to interface path priority - not related to any dr-bdr roles. For the ECMP part you mentioned, I should see two different next-hops and not the same. two different nex...

wiseroute

hello,

have you read this wiki?
maybe it can help you.

https://wiki.mikrotik.com/wiki/Manual:C ... s_examples

wiseroute

hello @miankamran, yes, But I want my users to use ether-2 for IP telephone and ether-5 for the internet. you can just plugged the phone directly to the router. or, if you have any spare budget - you can get a manageable switch for your network. if you have configure the router correctly - maybe you...

wiseroute

hello eabs, once you remove the customer from the Active & Host List of hotspot tab , then customer starts to browse again. have you set user connection limit? maybe your router running out of port for nat translation. for heavy tabbed internet browsing - you should limit user session/connection...

wiseroute

hello,

after this, I plug the ether-2 wire into the unmanageable switch and also plug ether-5 in the switch but my users are facing problems with the internet.

did you plug those 2 cables on the same switch?

if yes, it is looped.

wiseroute

hello, for this part, have two GRE tunnels between them one with a symmetric cost of 100 and the other 200. The v7 router, instead of choosing the least cost for the networks advertised, load-balances the traffic between the two GRE tunnels (192.168.106.20/30), use path priority instead of path cost...

wiseroute

hello msanaii, is this setup - a triangle shaped between those 3 devices? |-------- mt1 path 100 nsx | | |-------- mt2 path 200 am i correct? are you just want to drive the traffic to use mt1 as main, and mt2 as backup? just use lower path priority for the mt2. ie. mt1 128, mt2 64. hope this helps.

wiseroute

@ anav Just to be clear this is advanced tweaking not for the normal home user? Y/N yes and no. yes, if you feel you are being blocked by remote server (ie. www) and your internet became deteriorating because the effects of remote end closing your router ports aggressively. check cmd> netstat -a see...

wiseroute

@ op,

I'm not certain-certain but the IF is up,

your router needs to listen on different port - for the wg tunnels to be usable. ie. 13231 for nordvpn and 13232 for purevpn.

wiseroute

hello shirenzo,

/ip firewall nat add chain=dstnat action=dst-nat dst-address=100.100.100.100 src-address=10.10.10.100 dst-port=25 to-addresses=10.10.10.100 protocol=tcp

you don't need that src-addr.

and specify which interface should listen for the incoming traffic to be translated.

wiseroute

hello Maxwell, glad to hear you have solved your network 👍🏻 The design requires that sites 1-3 from the original diagram are able to access the public internet without first going through the Main Office. Therefore, non-office bound traffic was being masqueraded on the public interfaces of router1 a...

wiseroute

hello,

hmm, interesting

Customers randomly are not able to browse, we have noticed that those cannot ping to their Gateway.

did you ever check how many users connected to the hotspot?

did you provide enough ip for both authorized and unauthorized hotspot clients?

wiseroute

hello @op,

are you sure about this wg interface setup?

/interface wireguard

add listen-port=13231 mtu=1420 name=wg1-nordvpn

add listen-port=13231 mtu=1420 name=wg2-purevpn

wiseroute

hello,

maybe you want to read this article?

https://www.educba.com/nginx-gateway-timeout/

hope this helps.

wiseroute

hello, So there are no switching needs at all between the LANs, each kid only communicates and connects to the internet out through the OpenBSD router. so, do you think it is possible to forward lan traffic to the internet without switching? 🤔 anyway, never tried that openbsdrouter project myself - ...

wiseroute

hello, so one of the problem was We have one customer were the internal network will not be routed right. it is the ip 185.199.107.19. maybe this? add blackhole disabled=no distance=1 dst-address=185.199.104.0/22 gateway="" pref-src="" routing-table=main scope=30 suppress-hw-offl...

wiseroute

hello, ospf neighbor discovery using multicast address 224.0.0.0 - you should allow that address to flow inside the wg tunnels. or... you can specify ospf interface as ptp with unicast static neighbors. so... there are a lot of subnets to pass the wg tunnels : ospf itself and the rest of the network...

wiseroute

hello,

is this ccr in production or just feeding test?

which routeros version? and in what role? i mean: ebgp/ibgp? direct peering or rr-client?

if you have sample config and screenshot - maybe @mrz could help you.

wiseroute

hello Glinka,

However, this doesn't seem to have fixed the problem, and the wifi clients still cannot connect.

ok. let us see your MT dns settings,

and tell us how do configure your wifi clients ip settings. which device gives ip settings to your wifi clients? MT or your wifi box?

wiseroute

hello,

you have a nice new router there

where did you place this new ccr1072? p? pe?

i think you should contact @support for better response - don't forget to attach some comparison screenshot between the old ccr and this new one.

good luck

wiseroute

hello glinka, I'm not sure if this is what you are asking, but foo.bar.com directs to my external IP. This mapping is propagated to all DNS servers. Hence anyone can access my external IP via this domain. ok... where did you hosted your foo.bar.domain? did you rent this domain and host it on the int...

wiseroute

@ primeyeti, I would assume they had NAT traversal enabled on the tunnel. I will double check this with them no no no.. nat traversal is on your router side to configure. There is only a single WAN so shouldn't be an issue of it coming in one WAN and attempting to leave via another if that's what yo...

wiseroute

hello, $ ping foo.bar.com PING foo.bar.com (<external IP>) 56(84) bytes of data. 64 bytes from <my ISP's domain name> (<external IP>): icmp_seq=1 ttl=64 time=3.96 ms is that foo.bar.com dns domain hosted on the internet? if yes, then you could make secondary dns server for lan user on MT : - with pr...

wiseroute

hello Thompson, Action: Redirect The domain stops working. How to proceed in this case? Can someone help me? since we don't have any idea which/what version of your ms ad platform - i only could give you general explanation. ms active directory works on top of its own dns server service (it has to b...

wiseroute

hello, so, where did you host this dns server? on the internet or locally hosted? did you have a dedicated dns server for this domain or you want to make routeros to host your domain? if this domain is actually hosted on the internet, you can dstnat that domain for local lan user directly to the tar...

wiseroute

@ primeyeti i manage a Mikrotik that sits in front of a customer's firewall in which we dstNAT all traffic from the router to their firewall. The client side of the IPSec site to site is on the customer's firewall. did you do ip or port based dsnat? i think you need to know what firewall they have a...

wiseroute

@ tangent

which I count as "mission accomplished" when it comes to the edit, but you tell me; should I have left it as-is or put the breaks in somewhere else, or rewritten it for formatting, or…

nahh.. nevermind, mission accomplished.

let us get some coffee

it is late already

wiseroute

@ pe1chl

Probably when this happens and there is enough load, the result is packet loss due to buffer overflow?

can you try that @ gavinj suggested - hw=no?

wiseroute

@ tangent

I'm sorry, are those @op outputs not being altered by your edits? it is a bit difficult to read the outputs.

@ pmsfm

which router is this on? v6 or that v7?

routing ospf instance
set [ find default=yes ] disabled=no distribute-default=never

wiseroute

hello pmstm, aaa... ok, you have intra area there 10. which router advertise the default route 0.0.0.0/0 - and in which area? backbone or 10 ? i don't see it in your outputs. this instance=default router-id=10.1.100.71 address=10.1.1.114 interface=ether1 priority=1 dr-address=0.0.0.0 backup-dr-addre...

wiseroute

hello from this guide, https://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery it said: Summary MikroTik Neighbor Discovery protocol (MNDP) and LLDP allows to "find" other devices compatible with MNDP or CDP (Cisco Discovery Protocol) or LLDP in Layer2 broadcast domain ip connectivity ...

wiseroute

hello,

I'm sorry I don't get your question - can you explain this?

Now I would like to route two (fixed IPv4 address based) outgoing WireGuard peers through the second WAN. All others through the first WAN.

do you mean:
outgoing wg should go out on wan2, and regular traffic go out on wan1?

wiseroute

hello vadimkara,

. I can ping and access other filials they can ping me but opening ports just hangs from filial to center.

can you show us your ping and traceroute output, from the branch to the central, and vice versa?

if you have a tcping or tcptraceroute output would be nice.

wiseroute

hello,

so, your local lan routes goes out of local router - before reaching its local destination?

you might want to read this guide :

https://wiki.mikrotik.com/wiki/Manual:B ... _Algorithm

wiseroute

hello can you give us some examples config between 2 neighboring v6.48 (which got that default route) and v7 (which not having the default advertisement) - and their ip route output between those 2. just ospf related part config will suffice. also, do you have any route filters on incoming route to ...

wiseroute

hello

have you follow this guide,

https://wiki.mikrotik.com/wiki/Manual:Interface/OVPN

try post your config - so that forum members can help you.

wiseroute

hello tomas, for basic remote desktop 1 to 1 connection, maybe you might read this article : https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-allow-access or, if you want other simple rdp software : https://www.tightvnc.com/ and many others. i th...

wiseroute

@ rextended,

this is a good one,

The source IP of the tcp-reset-attack is the same, or it appear to be the IP of the remote site requested?
If is the same... just drop that IP...

hmm, i have forgot what was that tool to check...

netstat -a??

wiseroute

this is the last part from your referenced link above. To help protect the router from TCP RST and SYN DoS attacks: Issue the tcp ack-rst-and-syn command in Global Configuration mode. host1(config)#tcp ack-rst-and-syn Use the no version to disable this protection (the default mode). and I don't know...

wiseroute

Any attempts to open blocked domain will be thrown into ERR_CONNECTION_RESET in Chrome and PR_CONNECT_RESET_ERROR in Firefox (see ... This indicates that a middleman had sent a RST packet, masquerading as the endpoint. first, any isp (read : routers) are mitm - in terms of traffic routing. second, ...

wiseroute

My ISP employs DPI and as one of its strategy is to use TCP Reset Attack

reading your post,
the first thing comes to my mind is:

how do you know that?

wiseroute

if I got it correctly: need to create the same wireguard tunnels from each branch to the new backup router. yes. so there would be 2*4 = 8 tunnels to both primary and backup. Still don’t understand what routing protocol i’d need to implement in the case main router goes down and backup router shoul...

wiseroute

the backup router has a public address. I can't mesh the branches between each other. Am I understanding correctly? let's make it simple... you can have either another wan for hq as backup link to connect those branches. high availability in single router with redundant wan. example: mt wan1 main l...

wiseroute

try to rent a vps on cloud.

install a chr on it. make it a secondary backup route server to overcome those cgnat.

but note those bandwidth traversing that router.

if your branches only use for online transactions - i think the vps bandwidth should suffice.

as long as you aren't huge files.

wiseroute

yes.

hq to a (backup), b, c, d.
a (backup) to hq, b, c, d.

partial meshed.

the dynamic routing protocol is used only for hq failure take over. hq and backup router path priority can be adjusted to your needs.

wiseroute

@ kartone The weak point is clear here: the central router. Ideally we would create another router, with a different link, that needs to take the ownership of routing the traffic when the other (central) router goes down. that's a good point. so there are 5 sites : hq and 4 branches. take one of the...

wiseroute

@ darci Are there any alternative solutions for redirecting them? well, basically - a port is just a port. but... a port will be in different state if it was used by an app. some app can take redirection - some with ssl (read: certificate) planted in it can't take redirection. there are differences ...

wiseroute

@ chaosphere64 Context: I have a FW that acts as DHCP server and sends the local domain as default and also as Domain Search List via DHCP. It seems like the MT devices don't pick that information when configured as DHCP clients. As a result I can't ping all other devices in the local network just b...

wiseroute

hello,

can you show us your topology?

wiseroute

hello What is the "best practice" here? I've tried building something with the help of ChatGPT but I think I am going nowhere. I also do lack of knowledge of queues/QoS in general, so please be kind with me. 8) really? you have asked bots for your settings? 😂 I'm curious... what did the AI...

wiseroute

I'm sorry, i thought i have asked you that cli output?

Interface print

interface bridge port print

wiseroute

@ werdarrfr congratulations! hmm, in case you interested in - what i thought - more simple way... let us say - MT with 4 ethers : - mtcp router, LAN : 192.168.100.253/24, WAN : 172.16.1.2/24 (masqueraded) - lte router, LAN : 192.168.2.2/24, WAN : 172.16.1.3/24 (masqueraded) - MT, to-mtcp : 192.168.1...

wiseroute

hello, 7 chain=dstnat action=netmap to-addresses=192.168.88.71 dst-address=1.1.2.85 in-interface=ether2 log=no log-prefix="" 8 chain=srcnat action=netmap to-addresses=1.1.2.85 src-address=192.168.88.71 out-interface=ether2 log=no log-prefix="" please note that netmap is 1 to 1 ip...

wiseroute

@ werdarrfr,

aaa... you have multiple gateways there.

in that case - this will help

https://wiki.mikrotik.com/wiki/Manual:P ... _Balancing

don't overlook at the load balancing part - but focus on the classifiers to drive 10.10.2.0/24 out to your mtcp router.

wiseroute

hello,

do you mean the last bridge number 11? with id 0x00?

please show us your:

interface print

interface bridge port print

wiseroute

hello What I would like to do is a default route but taking into account only a source address (10.10.2.0/24). I'm sorry, but your setup and your requirements just doesn't make sense because your MT only have 100.253 as gateway? or do you have any other gateway on MT? let us say you make a PBR class...

wiseroute

hello challenge here, for me, is that the VMs are running in different hypervisors. hmm, how many hypervisor host connected to this ap? 1 host with multiple hypervisors? or different machine for each hypervisor? do you mean: you want to interconnect vm's under those hypervisors in other vlan than th...

wiseroute

@ sebus, If I make the port on D-link untagged VLAN 21 , W70B gets 192.168.21.2 and Registration FAILS (yet full access to Internet from this VLAN exists) that was your first problem correct? now, this on your router - where did you put vlan bridge config for tagged and untagged port? 13 R vlan21-ip...

wiseroute

bgp session is on tcp 179,

maybe you either accidentally dropped it in your fw rules - or you have misconfigured somewhere else.

wiseroute

hello wetdarrfr,

is this your setups?

10.10.2.0/24 ---> MT ---> 100.253

https://wiki.mikrotik.com/wiki/Policy_R ... uterOS_3.x

wiseroute

hello croissante, thing is when create a bgp-vpls tunnel from PE1 to PE2 the tunnels form with the peer being the route reflector! and it doesn't even show up in route reflector or has the Bgp signaled flag. can we take a look at your sample output here? along with these 2 part samples tried lots of...

wiseroute

@ Maxwell,

went ahead and tested changing the router priority at site 'D' to 64, but I'm still having the same issue

no no. that 64 is the lte path priority, with its default cost you have set = 500. not the router priority.

hope this helps.

wiseroute

hello graham, On a Linux Mint host using VirtualBox as the hypervisor, with 3 three Debian 11 VMs along with the Router OS VM ok. since i think it was easier to rolls out those vm in Linux - maybe you could try this example steps - with 3 vnic and 3 bridges for the router : 1. Linux and vbox are set...

wiseroute

@ sebus46

i thought i have requested you for

interface bridge vlan print

wiseroute

hmm.. what platform did you use for this setup? windows/linux? VMware/vbox? Looking at the above I notice that ether2 and the bridge have the same mac address. Is this normal / significant? hmm... under basic bridge this is not normal. try to change its Mac address to say 41. and let see what happens.

wiseroute

@ nikolay have gaps in the server configuration, wouldn't that affect the OpenWrt clients that work normally? I don't have any objections with your openwrt output. let us just focus on the MT to your server part. ok. i saw that you have changed your MT client ip 1 D 10.8.0.114/32 10.8.0.113 ovpn-out...

wiseroute

hello am new to Mikrotik and everything i know now is learnt from Youtube and Testing. it's great to have a wonderful learning curve. keep the spirit 👍🏻 and of course MT would love to have you as their next mtcine👍🏻 as for your dream network... i think it is better to wait for your isp to do their w...

wiseroute

hello If I attach clients to the bridge connected to ether2 everything is OK, but connecting any clients to the bridges connected to ether3 or ether 4 fail. do any vms attached to ether3 or ether4 have dual nic connected to both bridges? (as in some kind of bonded interface? no?) ok. let us see your...

wiseroute

@ mwaqsaziz

ISP will provide 0 help, I have asked them how to configure IP POOL they said your headache,

the problem is - if your ISP locked down their router then you can't do much with your router.

so, be nice with your isp - and ask them politely, maybe they will help you

wiseroute

hello

ups... wrong post.

--- edit

you might want to read this first

https://wiki.mikrotik.com/wiki/Manual:Interface/L2TP

your requirements on the l2tp server profile section.

hope this helps.

wiseroute

hello

is it possible to ping Miktotik router from public? If yes! How to configure my routers?

yes. it is possible - but it is easier for you to get help from your isp directly. because forum members don't have any idea/privilege on your isp router.

hope this helps.

wiseroute

hello nikolay, this part on your MT router - ovpn client DAc 10.8.0.113/32 ovpn-out1 0 doesn't match with any of your ping result output (the second picture) - that is why you don't see any ovpn interface traffic on your first picture. maybe you might have missed the client config on your ovpn server?

wiseroute

@ holvoetn Not sure what you mean with 1:1. as dedicated 1 ip 1 user (exact measurements of dhcp pool allocation). and the line being not over crowded/over subscribed 😀 500/30 - 1/6 compression. i think it's above normal for home subscription, don't you think? 👍🏻 ok. back to the topic.. so, is this ...

wiseroute

My network leases transit and an IP space of 1.0.0.0/24 to CompanyX CompanyX pays me for 150/150mbit of bandwidth to the internet CompanyX has 2 sites that connect to my network, and I also sell them capacity into my network at 100/100mbit for each site aaa... ok. you have played both l2 and last m...

wiseroute

hello smithg400 In each case the virtual machines were setup with 4 network interfaces and these are configured so that ether1 is attached to Bridged Adapter (virtualbox) / Network Bridge (hyper-v) and ether2-4 are attached to separate internal networks (virtualbox) / private virtual switches (hyper...

wiseroute

@ millenium7 i am sorry don't quite understand for the first part of your questions. can you be more specific? for the second part, imho, although everything is up to you as your own network operator - but I think it is better to leave your client doing their own bgp peering directly to ix. otherwis...

wiseroute

@ holvoetn

(though in practice I have never seen it change the past years).

it's good for you

and I could imagine that your line rate never below 75 percent of your service plan? maybe 1:1 subscription?

wiseroute

@ kentzo

maybe you might want to read this article

https://www.techtarget.com/searchnetwor ... lems-occur

you will find your answer there.

hope this helps.

wiseroute

hello sebus46, SIP (Yealink W70B) is on default LAN, it gets 192.168.88.20 & Registers fine at VoIP provider on Internet via DSL line out hmm, can you post your interface print interface bridge vlan print and your ip firewall rules related to your incoming sip. let us see what exactly is being t...

wiseroute

i think that's a normal dynamic behavior since you didn't put your l2tp clients as static.

for every dynamic interface links (such as pptp, pppoe etc) you will have that behavior.

hope this helps.

wiseroute

@ velis after re-read your post, I want to be able to "ping zabbix" and that would resolve to a machine identifying itself as zabbix, which is somewhere in the subnet. Right now all I can do is "ping 192.168.237.22". i think you should understand that there are 2 ways of ip addre...

wiseroute

have you tried these?

https://wiki.mikrotik.com/wiki/Setting_ ... DHCP_lease

https://wiki.mikrotik.com/wiki/Manual:IP/DNS

wiseroute

do you mean bridge nat as mac address proxy? as my experience concerned, i could barely meet or need one - both in data center and sp environment. let's say i preferred to avoid another unnecessary layer 2 headache since it's really difficult to predict its (l2) behavior, and mac address doesn't pas...

wiseroute

@ nichky https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge nat - bridge network address translation provides ways for changing source/destination MAC addresses of the packets traversing a bridge. Has two built-in chains: - srcnat - used for "hiding" a host or a network behind a differ...

wiseroute

have last two questions: 1. I will know if I will not install a next OS with the reverse proxy is there a good option to use the dsnat function for each FQDN to forward it to the correct server? 2. What is better - install a linux system with reverse proxy or use the Win Server? 1. how many public ...

wiseroute

in MikroTik, neither are offloaded to ASIC.

speaking of which.. has anyone tried to port routeros to an onie-based bare metal switches?

like those from netberg, edge-core?

wiseroute

hello, let's say I have to serve 20 clients in lan2lan, that I will have to close 20 VXLAN tunnels from one router to another only, let's say, this is an example.would it be an overhead of 20x50bytes? I'm not too well versed in vxlan since I had retired long enough to forget the industry. but, afaik...

wiseroute

@ gnoby, please explain us if this is what you meant internet(Public Network Address） connected to: wireguard(mikrotik-server ip-address10.10.10.1/24) it then connected to: wireguard(mikrotik-client10.10.10.2/24) it then connected to: PC{ win7(ip-address)192.168.0.1/24 win10(ip-address192.168.0.2/24...

wiseroute

@ shadow82 Maybe there is some statis route autoupdating scirpt also? interesting 🤔 hmm.. how about these? from the wg client, 1. since you already did the remote ip ddns, how about - wait for the tunnel to come up. then.. 2. create another script to read the tunnel interface status, to read remote ...

wiseroute

@dungtran88 hmm... i dont know whether this lab will fits you : vlan5-kids : ether2 192.168.5.0/24, gateway 192.168.5.1 vlan2-others : ether3 192.168.2.0/24, gateway 192.168.2.1 internet 172.16.1.1/32 ### show interfaces : [admin@home] > /interface/print Flags: R - RUNNING; S - SLAVE Columns: NAME, ...

wiseroute

hello, How can I make make these services redundant as the way they configured in the second machine. I would like to setup the second machine the same way but it should be the backup machine. Is it possible? yes, you can make those 2 routers in redundant setup - but not for the: 1. ip/gateway/routi...

wiseroute

want to test ping from One of the porta in the second switch to One of the devices connected tò the First One, but Is a remote location so I cannot attach nothing to the second switch. as an addition to what @mkx has explained above, there's a tool called mac-telnet, https://manpages.ubuntu.com/man...

wiseroute

@ nichky

aaa... yes, sorry. i didnt take a closer look below that line

'i' as inactive. backup site.

wiseroute

@ sindy are you sure your vrrp example in a running state? [me@chr-7-2] > ip address/print where interface=vrrp1 Flags: I, D - DYNAMIC Columns: ADDRESS, NETWORK, INTERFACE # ADDRESS NETWORK INTERFACE 13 I 192.168.216.1/24 192.168.216.0 vrrp1 it has 'i' in it as invalid? by the way, this is interesti...

wiseroute

I'm not using DHCP; IP addresses are assigned manually, but I'm involved in server leasing, and the management of the leased servers belongs to the customers. Each server is allocated one IP address, so I'm running only one VLAN. How can I solve this using a different method? 1. are you in some kin...

wiseroute

@ dungtran88 ok. let us see your cli output of ip firewall filter print. we just need to see your firewall sequence. i think you need to put that kids to adults block rule on top of everything. and start doing ip based firewall instead of interface list. vlan is nothing without ip. sorry, my eyes co...

wiseroute

much more efficient to have a drop rule at the end of the forward chain.

absolutely,
but just for trouble shooting - sometimes we need to do top to bottom approach @anav

if it is harder to filter in layer 2 - how about we do it on upper layer 3

wiseroute

hello filament, The config I've posted is full and complete, these routers are currently working perfectly (using SSTP), but I would like to change to Wireguard. That's why I'm asking for help. The examples in Mikrotik's website do not work for me. I tried to use them, but I reverted back to my norm...

wiseroute

how about this Bridge - VLAN2 = 20.0/24 - VLAN3 = 30.0/24 - VLAN4 = 40.0/24 - VLAN5-Kids = 50.0/24 - VLAN6 = 60.0/24 ip firewall list add kids address 50.0/24 ip firewall list add adults address 20, 30, 40, 60.0/24 ip firewall filter add chain input in interface bridge src-addr=kids dst-addr=adults ...

wiseroute

@ pe1chl

Don't let you distract by questions from wiseroute, it is clear what you want.

ok. i am just trying to draw @ op topology and knowing what he wants -- i don't like crystal ball

ok. feel free to take over this topic

wiseroute

@ alfista

the requests should go from internet (FQDN) to local servers (IP or FQDN). I have local DNS server which resolve also some other local FQDN's.

does your router have a public ip?

did you really host an internet dns locally already?

wiseroute

@ asdgmae2, There is a malicious user who sets up a virtual router on their own server and assigns the gateway address to themselves, redirecting all traffic to their server. if your network is office network, then you should lock down all the workers station from any system modification. if your ne...

wiseroute

hello,

which direction do you want to redirect?

1. from the internet going to your network
or
2. from your network going to the internet?

and,

3. which subject do you want to translate to?
- from fqdn to ip
or
- from ip to fqdn?

wiseroute

hello, hmm... it's a bit complicated because of vpn and 3rd party redirection. assuming : a = you (or your router/browser), b = first hop server, c = redirected server. did you mean: you need to know c address? or... am finding form Wireshark the connection is failing. in natted environment - it is ...

wiseroute

interesting topic 👍🏻 but unfortunately this qos/sla kind of questions can't take a short answer. key points : - bandwidth available on interface (or on the network) - multipliers (idle/peak time, numbers of concurrent access etc) which then creates baseline average, which sometimes could be below no...

wiseroute

hello,

you might want to read this wiki first

https://wiki.mikrotik.com/wiki/Mesh_wds

hope this helps.

wiseroute

hello,

you might want to read this article:

https://forums.openvpn.net/viewtopic.php?t=21205

maybe you could find any similarities and work around your problem.

hope this helps

wiseroute

@mkx, With VLANs again... 😂 it still Tuesday consider MLAG as L2.1 and VLANs as L2.5). no no.. they said mpls as l2.5, and ppp as l2.5... so that would make vlans as l2.3 😂 @ wassy83 know how to do this with vlans without MLAG but I don't how to do this with MLAG on top. as @mkx said, it is the othe...

wiseroute

hello pulzpulz, 1) ISP router does nat. from there, i just would like to ask you whether you subscribed to your isp managed service? because not that i don't want to help you, but I think your requirements will be much easier for you to work with your isp in this matter. just let them know what you ...

wiseroute

hello benoitc,

it's a bit tricky config but maybe you might want to try it?

https://wiki.mikrotik.com/wiki/Manual:PCC

hope this helps

wiseroute

hello pulzpulz, instantiate a connection to my MK ipsec+l2tp (i can connect to vpn server from lan from windows 10 client, but cannot from outside) one thing you need to know first, which router do the nat/masquerade for your lan? the isp cpe router or your router? second, you need to know whether y...

wiseroute

@ kxrist

you might want to read this

https://wiki.freepbx.org/plugins/servle ... /100929794

hope this helps.

wiseroute

tftp error code explained:

https://docs.ruckuswireless.com/fastiro ... 014D2.html

hope this helps.

wiseroute

any ways - sorry for posting IPv4 & IPv6 stuff in this "Maximum number of NAT users / sessions" thread. @tom, let us put those last ipv6 posts as a way to promote ipv6 usage and adoption 😉 this one, think of ISPs that have no plans to add IPv6 networks to their customers somewhat like...

wiseroute

@ rextended, However I currently have 75% of my traffic over IPv6... On 2014, when this topic is open, 0%..... i would definitely say that is really a great achievement 👍🏻 it is always about our team. when they are ready, everything looks easy. - but sometimes it was kinda 1 in 1000 momentum to deli...

wiseroute

@ tom, My NAT444 configuration uses jump rules/tables , If IP & port range is this then jump here and scan only a few lines to find what to NAT to/from. hmm, interesting 🤔 which platform did you use to perform this setup? i mean: MT or Linux boxes? since I read that jump statement. in your curre...

wiseroute

... than detecting all the fake source addresses of ddos traffic to block that traffic afaik, well if the graph triggers sms - all i could say was don't overlook sa-da. just do rate limit to throttle the bandwidth. neutralize it to a state safe enough to do the next step. +++ edit after all, the on...

wiseroute

@ chechito, is a common missconception to think that you are limited to 65535 connections per "WAN" ip, you are limited to that only for a single Destination IP, you can reuse SRC port "numbers" for diferent destinations. agreed to *reuse* src port part. but, are you sure about t...

wiseroute

@ chechito,

in a ddos attack source ip addresses are fake you are not catching nothing useful

even if they were real - can the router or the server or the target (read: cpu+ram) buffers such a massive objects in single window time frame?

hmm... i think my calculator running out of battery

wiseroute

@ anav

Wait, my crystal ball is due to be delivered by amazon later.

you buy another one??

does the old one in your fish aquarium no longer work?

wiseroute

@ anav, Short answer: No MT routers are not capable of stopping an attack! It is the responsibility of your provider ISP to do so and further up the food chain. I don't think MT or any brand has any relationship with stopping the ddos. i would think of the man behind the car. ie. even though you gav...

wiseroute

hello andriusk79,

I'm sorry I don't get your question.

what is that traffic priority you were talking about? do you mean intervlan traffic? internet??

wiseroute

hello hagoyi, it depends on the router resources itself. ie. cpu, ram. but the way you make some firewall rules for that dos - will give you insight whether it is effective or not. ie. on part 1 of your reading, i could say yes - maybe it is effective enough to protect the target. on part 2, the att...

wiseroute

you might want to read this first?

viewtopic.php?t=125750

wiseroute

@ ruberts,

maybe this one has better example:

https://wiki.mikrotik.com/wiki/Manual:PCC

wiseroute

This will put any VI/EMACS discussion to shame.
Seems more like a sed and awk problem to me .

where is that notepad when we need it most?

wiseroute

@ blacksnow, It is much easier to use the policy rules to steer the entire incoming interface's traffic to use a particular routing table. So for me I continue to do it that way versus the connection marking route and therefore I still need the drop rule on the router output chain. well, after all t...

wiseroute

blizzard, The question is, why do i see multiple TCP connects from the same client and to the same WAN IP, and might that be expected behavior with bonding (Fragmentation or whatever)? if you were alone on your lan, just you and your computer browsing MT website using multiple tabs - you will have t...

wiseroute

hello ruberts, The connection works one way because I can see packets coming into the debian server with tcpdump: ok. assuming that your tcpdump out was correct - which is your debian server sees your home client ssh connection - now all you have to do is routing back your server reply via that l2tp...

wiseroute

SACs 192.168.0.10:50491

do you mean that ip?

was that your vrrp ip and outgoing/incoming port number? no?

wiseroute

hello blizzard, example, if a client visits a website, i see around 10 different TCP connection in the firewall connections list, with different source Ports, but the same destination/port. is this your setup? inet --- cisco --- mt1 --- mt2 can you be more specific in log examples?

wiseroute

think Normis is looking for a moderator, not for 5 minutes a day, but for more time, otherwise the waits continue to be long. With the work I do, I have to be connected all the time, basically from 09:00 (CET) to 22:00 (CET) (if not longer…) 7 days a week. no. not again 😂 how can I make that script...

wiseroute

hello blacksnow, So the issue is really in between the connection closing and the NAT entry being deleted, the router responds with ICMP. yes. but this chicken and the eggs thing could be overlap one another. which is who will close the door first: the server or the router? supposed that remote serv...

wiseroute

@ msatter, Reading this I think this is not the golden bullet because the incoming traffic can be valid and have a active connection tracking. Only when the router want to push the traffic to the client the client says, won't accept it because I don't have an active memory of that connection. absolu...

wiseroute

@ fvaseghi,

that's wonderful

anyhow, this

If the result of this checking faile, connection will be close or disconnect.

as per your pptp question,
does this probe only apply for the initial internet link - or.. will it applies to any other subsequent new link? ie. other vpn link etc?

wiseroute

@ msatter ps. filtering on related is not needed because it is always related when the router answers on behalf. agreed. related means conntrack should be enabled. otherwise we will see huge amount of alien Traffic. but. why do we bother to stop the end result of a stale connection (outgoing to any ...

wiseroute

hello blacksnow, To be clear, I orginally thought the router was responding to a ICMP packet but the actual situation is that flow of TCP packets that cannot be delivered generate a ICMP packet from the router back to the source letting them know the packet cannot be delivered etc. it (the icmp 3 ge...

wiseroute

@ fvaseghi i am sorry, i and the other members just coloring the day. it's weekend, so let us all and you - get some rest a little bit 😉 ok. back to you, As I said, the MikroTik router still serves to other devices properly. But Just Windows 10 and 11 clients can't connect correctly. they connect fo...

wiseroute

@ amm0 maybe use "pptp" as topic as well to make sure. can you make my life easier?? 😂 @ rextended was busy helping the other OP how to script deleting pppoe username and password twice a day... and now you asked me to debug and find pptp logs?? how many pipe should I use? :debug [ find to...

wiseroute

Perhaps enabling "debug" as topic in logging would yield more clues on what's going on for you during PPTP session establishment

i really like this one

ok @OP... show us the that pptp logs. show us that crystal ball

because @ chechito said the other way around -

wiseroute

@ amm0

yes, i don't mind with that l2tp in winbox quick setup.

but... again, have you ever count how many clicks you have to make for your windows based road warrior l2tp client to get them work? both for the server and the client

no no no... I'm just kidding

have a nice weekend folks

wiseroute

@ erlinden,

have you ever count how many clicks you have to make between pptp and IPsec to get them work?

wiseroute

hello But now windows 10 and 11 connot connect to these pptp servers. Older versions of windows, Smart Phones, Other routers and ... still connect properly. did you do any windows update before this happened? well, let us be fair - don't put any unnecessary burden to MT side alone. sometimes other s...

wiseroute

the main reason is that i need to make a script, where it will automatically change the username and password of that pppoe interface and then put it on a schedule..

I'm just wondering how will your isp call center handling your pppoe change request twice a day

wiseroute

hello @abn,

ok. are those olt's linked directly back to the core (your pppoe server)?

or do you have any pop nearest to the olt's?

are those 1200, 1300, 3000 users differentiated by profiles? do you have any mac filters for the wires?

wiseroute

hello @abn,

i am wondering about your pppoe and overall network design. did you put one centralized server for all these connections?

wiseroute

@ edpa, agreed. vm lab doesnt represent true hardware performance. but - if you take a closer on those tx-rx error/drops between the bridged bonded interface vs plain bonded one, i think the error/drop would be quite significant in heavy traffic load. again, i just doing a balance-rr, i dont know ab...

wiseroute

@edpa i think these OP's @unlikely and @iamgavinj maybe correct - it seems adding bond interface to a bridge causing some packet lost. but, i am not really sure about their config/performance lost while @ourplan - the bond mode still in question? output - balance-rr, without bridge on v7.9: [admin@s...

wiseroute

hello ok. 1. vpls is a professional services from your isp, they should be the first one who you call to assist you with the problem. while this forum members we don't have any idea you and your isp setup. 2. The ISP says they have tagged all the vlan's and the assigned subnet is routing from the IS...

wiseroute

interesting 🤔 first built a basic BOND with two ETHs, with all default settings (ARP Enabled), and everything worked fine. No packet loss. Then I created the BRIDGE and added the BOND to it, swapped the IP address from the BOND to the BRIDGE, and the packet loss returned. could the problem be in the...

wiseroute

hello atanas, As a result, I’m going to conclude that PCC doesn’t “make” internet more reachable - effectivly. It may balance your load, but at the same time you may loose part of it; however it may bring to your basket something, which you considered unreachable until then. yup 👍🏻 especially in nat...

wiseroute

hello ipavlik What I tried was based on layer7 protocol mark connection, based on this mark all packets and process specific dst-nat rule with marked packets , since I found information that I can't process dst-nat with layer7 filtering because only part of packet takes place. i think you are abusin...

wiseroute

hello aa.. ok. 2 wan pcc. May someone tell me how ROS behaves when a destination IP is unreachable through a route engaged in PCC, while the same IP is reachable through the rest routes in PCC? pcc has nothing to do with routeros as a system - but rather it (pcc) just a more complex routing algorith...

wiseroute

think I will better verify it for sure with them (AA). yup 👍🏻 My understanding was that they would provide me with just an external IP address (static IP) and when I connect to that address, it would be tunnelled to my router and it would appear as if my router's l2tp-client-interface has that exte...

wiseroute

hello ip firewall nat add chain=srcnat action=masquerade out-interface-list=WAN comment="Default Internet masquerade" disabled=no hmm, how about trying to ping the internet via that setting on the router. ping dst-ip src-addr=your-wan-ip. Don't forget to put that src-addr. ip route list?

wiseroute

hello looks like a simple question - but actually not 😂 have a CRS318-16P-2S+OUT setup. It will be "only" used to assign VLANs for the Ethernet Port, the uplink is via a 10G connection. I'm sorry i don't get your question. do you mean the switch just basically for vlan access with 1 vlan t...

wiseroute

hello ruberts, i like your drawing - very artistic 👍🏻 btw, about your 3rd party cloud based l2tp vpn server for your cgnat pass through.. i am afraid it won't work - because there should be other routing to be made on the server to connect your home and office net. if they offer that auto paired rou...

wiseroute

hello, [f4hof@e1-lyo69] > ping 44.7.0.1 vrf=hamnet SEQ HOST SIZE TTL TIME STATUS 0 22 (Invalid argument) there are not much info which source which interface did you ping 0.1 from? and is there really 0.1 host up? are local and remote.role don't mean anything to your config? ++++ edit and could you ...

wiseroute

hello troy,

maybe this wiki can help you?

https://wiki.mikrotik.com/wiki/Manual:I ... s_from_VRF

wiseroute

hello I'm sorry I don't get your question. what are you trying to do related to pcc? are you trying to connect 2 isps via your router as transit point? ie. user1 connects from isp1 at your eth1 - and then you want to mark the connection - and then you want to re-route that user1 to isp2 and vice ver...

wiseroute

hello troy,

it's nice to meet you. I'm Athens. could you be kind enough to give our helen back?

no no. just kidding

ok. @ troy, what is your core? layer 2 network access provider or something?

as we have no idea - what are you trying to achieve (vrf) related to your environment.

wiseroute

hello @xxiii very long description you have there, and interesting thought as well 👍🏻 from the fact that incomplete origin is the least preferred route 1. igp 2. egp - actually doesn't mean much. that MT wiki about not having synchronize off option does really help to minimize this ? routes. Routes ...

wiseroute

dalami, when there are 2 routes to the internet in single router : 1 to internet and 1 to wireguard network (which for simplicity - let us call it the second "internet*) made the map lan member (iot) needs to know which route to reply pings. the symptoms: from tip you can ping map ip - but not ...

wiseroute

hello from the wiki https://help.mikrotik.com/docs/display/ROS/Moving+from+ROSv6+to+v7+with+examples In v7 it is not possible to turn off synchronization with IGP routes (the network will be advertised only if the corresponding IGP route is present in the routing table). and this I don't want to fil...

wiseroute

hello pere What am I missing here? Shouldn't the router send the packets to 10.0.2.0/30 using the sfp-sfpplus8 interface even though it is learning that the D8:5B:22:02:46:93 MAC address is also available through sfp-sfpplus7? well sometimes resolving a layer 2 problem much harder then those in rout...

wiseroute

hello this Add TIP to mAP Wireguard allowedip. Attempt to access TIP from mAP - succeeds. Attempt to access TIP from IoT - fails the answer is this IoT device connected to a mAP. IoT uses mAP as gateway. you need to srcnat iot as map gateway ip. as not in full ip routing - but ip srcnat. So, what am...

wiseroute

@ sindy thank you for your compliment 😂 Believe me or not, it is not always the case :) having difficulty in market penetration, doesn't mean you have to push your luck to the edge. and, as far as experience concerned - either the op doesn't have that promising look or just can't compete with others...

wiseroute

Is there a way to generate a port knock from within RouterOS? even if there is port knocking in MT or in other vendors - your question description is too obvious that the company simply don't trust you, be it other vendors resident engineer who stayed there to run the security subsection nor local ...

wiseroute

And I'm having difficulties working with the corporate firewall administration. I'm hoping they'll approve opening the ports I need but even if they do it's made me think about how I can safeguard for the future. the obvious question is : who are you and what is your relationship with the company? ...

wiseroute

@ maxwell, hmm, done some lab for you - abcd topology, which i think your topology turned out to be normal one? :) running on v7.6 the modified point was only on router d/LTE : /routing ospf instance add disabled=no name=default redistribute=connected router-id=172.16.1.4 /routing ospf area add disa...

wiseroute

hello Maxwell, I'm sorry, didn't remember this thread. ok. let us continue shall we? your topology was a-b-c-d-a , am i correct? a-b is dark fiber a-d is lte. am i correct? ab is 1, ad is 500. and you want that if ab has back online - you want to re route ad 500 to ab 1, correct? your problem was on...

wiseroute

hello, Trying to get an idea of the "official" MikroTik answer here. As far as I can tell, unless you're redistributing connected, rip, bgp, static, etc , it's not possible to filter routes for LSA types that aren't external for my own simplicity when configuring routing protocols - i woul...

Search found 353 matches