MikroTik

vingjfg

Mdns uses multicast, which means that should hit an input rule, not a forward one.

vingjfg

Mdns.

Use the mdns repeater, see https://help.mikrotik.com/docs/spaces/R ... figuration

vingjfg

try
Code: Select all
udp-timeout: 30s

@chechito, good thinking: the first recommendation was to open UDP/3389 in addition to TCP/3389 as RDP uses UDP to stream faster, but OP said it was not open and did not want to open it.

vingjfg

@vingjfg, I am a bit confused regarding how you expect these two rules to eliminate the RDP outages. The connection tracking normally identifies all ICMP messages that provide feedback regarding packets that belong to existing TCP or UDP connections, applies the appropriate src-nat and/or dst-nat t...

vingjfg

Thanks but what am i missing. I have a rule that blocks ICMP hitting the WAN interface - basically turn that off and allow ICMP? On my previous firewall ive always been able to keep it off but happy to turn it back on and see what happens Just for the Nats to the servers and the firewall rules. /ip...

vingjfg

You still haven't:

Permitted icmp to reach the servers.
Used the code tags when posting your config.

Do the first one, post the updated config using the second one and check if you still have disconnections.

vingjfg

RFC3021 is for point-to-point links. Back in the day, on Cisco one had to explicitly configure the interface with the keyword "point-to-point".

Not by a MT device right now but will definitely try tomorrow.

vingjfg

Above discussion: https://www.youtube.com/watch?v=9Gt3QY2Aa2I

"You must be Igor."
"No, it's pronounced I-gor."

Best. Movie. Ever!

vingjfg

@td32 Are you saying that disabling and re enabling the interface on the responder ("server side" router) fixes it? If you are, that's not our experience at all... Only changing the port on the connecting (remote) peer resolves it for us. What happens if you disable wireguard completely o...

vingjfg

Sawadee...It's been 3 weeks of battle finding solution and error to our problem. We have 1gb internet cnn from our ISP. Bandwidth test inside the ccr1016 shows 600-800mbps but when using speedtest on pc on the classrooms get 90-150mbps. Wifi is worst like 2-15mbps in 2.4ghz using hap ac. Please hel...

vingjfg

I am on my phone and it is hard to read long configs but it looks like:

You are missing the established and FastTrack rules
You are doing a ton of l7 matching

Both affect the throughput. There may be way to fix some of it. Will check.

vingjfg

Meant the rule should match if he goes to http://... as the Host header will be both visible and from client to server.

vingjfg

It should match http://youtube.com but not a lot more.

If you want to match the names in the certs, you need to have the rules the other way around as well as the server sends its cert. And it will not match DNS requests.

vingjfg

Oh waw ... you have a minimalistic rulebase.

BTW what is the l7 list called "1"?

As mkx said, a lot goes over encrypted connections so things may or may not work the way you expect.

vingjfg

Hi there, I suspect your l7 rule is too low. Can you export your fw rules and post here. (Don't forget the code tags!)

vingjfg

Also check if files on disk are accessible in ROS and if TCP port 2049 is accessible from IP of device where mount is performed, from docs: NFS uses port TCP/2049. If the port is not available in disk print detail you will see the state stuck at nfs-state="mounting" Seems you nailed it - ...

vingjfg

Anything in dmesg?

If you create a file from the second ros and look at the uid of the file, does it show as 0?

vingjfg

On Windows servers, you can disable the ecncapability without issue. For the rule, yes but don't forget the NAT rules - something that looks like /ip firewall nat ... add action=dst-nat chain=dstnat comment="SERVER03 (Rule 249bis) " \ dst-address=200.200.200.34 in-interface=sfp1 protocol=i...

vingjfg

The question is whether the second config you posted is after the changes: I don't see any of the icmp rules you wrote you created. The situation you mention with the rst packet is known, some servers reply with a rst instead of fin to immediately tear down the connection. I remember mentions of tha...

vingjfg

Hi there. Regarding the rules, chain input: Remove the logging for the first rule (established/related) add action=accept chain=input comment=\ "Accept related and established connections" connection-state=\ established,related log-prefix="input established rule 3" Move this one ...

vingjfg

re: a PPP profile, This has been shutdown and was for testing purposes. I'll clean up the config. OK, so not PPP and the usual MTU issue then. Do you have a different MTU for your internet fiber than you have for the internal network? re: ICMP packets Sorry thats us "50 over 2 seconds" is...

vingjfg

The configuration refers to a PPP profile, is this something else? Or are you using PPPoE? The configuration refers to sfp1 and at places to the WAN interface list - can this be standardized to the interface list wherever possible, at least in all the ip firewall sections? In your configuration (con...

vingjfg

Well, that's a different problem than the one you stated. As Mikrotik cannot own a VRRP IP, for subnets where you don't have 3 IP available (2 devices + 1 virtual), you can't use VRRP. You can piece together a script that will add/remove IP on VLAN interfaces based on conditions (to be defined), how...

vingjfg

To sum what i think: it has a moderate chance of working and a huge probability of failing catastrophically. A better alternative is to write a script on a computer that will generate the configuration command and to apply them. I can have a look in a couple of days if no one has answered before. La...

vingjfg

Also, can you share your config with the sensitive bits removed?

vingjfg

Hi there! Some notes - The "error code 0" is the generic "there is an error somewhere", aka "Microsoft useful." 1. Can you permit both tcp/3389 and udp/3389? RDP tries to use UDP to stream more efficiently. Add a second rule both for the DST NAT and FILTER to permit tha...

vingjfg

Hi! First, please have a look at the code tag. That makes it easier to read configs. Second, I will go with this being a test configuration. ip firewall filter Incomplete at best, for example it permits DNS requests on the WAN interface, which means anyone can query your device for DNS which is not ...

vingjfg

Hej där! First, please consider using the "code" tags next time, this makes reading the config a lot easier. To make sure I understand your config: the router is used to access a tunnel to Mullvad. As it no longer has a dhcp client on ether1 (flagged as the wan port), I gather it no longer...

vingjfg

Hi there. What version are you running?

Can you send an export of your dns config?

When you have the issue, how many entries are in the dns cache?

vingjfg

The older printer, wired or wifi?

vingjfg

Hi there, can you post your configs?

Please enclose them in code tags for readability.

vingjfg

Hi there, I see a few of issues. You mention that your Sophos Firewall cannot send traps to a server on 192.168.3.0/24: does your Sophos firewall has a route for 192.168.3.0/24 via 192.168.2.2? Here is your diagram a bit flattened out. Network Flattened Diagram.drawio.png The first issue I see is th...

vingjfg

Interesting - I have a VRF in which I have an interface getting a DHCP address and the DNS, however the DNS is still placed in the main VRF. Probably another bug. [admin@router4] > /ip/vrf/print Flags: X - disabled; * - builtin 0 ;;; Front VRF name="wan" interfaces=ether7,ether8 1 * name=&...

vingjfg

OK, I have no idea why you did these things and I start to suspect you don't either. The WAN interface on R2 should only have the IP 10.10.10.11/24, not the 192.168.55.1/24 IP, that one goes on the bridge. 192.168.2.0/24: neither R1 nor R2 has that IP defined on an interface. Where does it sit on yo...

vingjfg

Yes, made the IP for r2 static in r1. Good! [ find address in 192.168.55.0/24] Is that part of the cli command in a terminal window? There seems to be a convention that I haven't learned. It is part of a command, and it says to affect the entry that matches the "find" condition. After fol...

vingjfg

My coloring rules for nano. ## Syntax highlighting for Mikrotik routers syntax mikrotik "\.rsc$" #header "-\*-.*\<C(\+\+)?((;|[[:blank:]]).*)?-\*-" magic "^# model = " comment "#" # commands color green "^/.*" color orange "^(add|set) " # c...

vingjfg

So ... Issue #1 - The DHCP network for 192.168.55.0/24 provides a DNS server on the other network 192.168.88.0/24, when you have set R2 to accept DNS requests. Fix: /ip dhcp-server network/set [ find address in 192.168.55.0/24] dns-server=192.168.55.1 The rest looks correct. Have you created a stati...

vingjfg

Hmmm, looking at the specs for your devices, that's a bit on the low side. When you did your try, did you see if the packets were going through the fasttrack/fast-path?

vingjfg

So, reading the configuration you sent yesterday for R1 Issue #1 - you have address=10.10.10.1 , which sets the netmask to /32. Fix: /ip address/set [find interface=ether3] address=10.10.10.1/24 Issue #2 - you have add address=10.10.10.0/32 gateway=10.10.10.1 netmask=24 . Fix: /ip dhcp-server networ...

vingjfg

Notice that there is no default route on r2.

On the 10.10.10.0/24, do you plan on having other machines/devices?

vingjfg

If you can/have a choice, I'd say l3 interfaces with a routing protocol between the DC and a vlan l3 interface and routing protocol intra DC.

vingjfg

You didn't have to remove the dhcp client or server, just to update the network definition on the server. As r2 is a router and you have routes to it, consider setting its ip as fixed, create a static lease or use a routing protocol. The problem you're facing is not one single, big issue on a device...

vingjfg

You need to force the router to respond to arp requests for 10.10.1.99.

Create a host route for 10.10.1.99 pointing to 10.10.10.2.99. Bridge 1 should also do proxy-arp or local-proxy-arp.

vingjfg

Without the configs: check that all VLAN are where they're supposed to be, that trunks have the relevant VLAN, that DHCP snooping is configured correctly if in use.

vingjfg

The gateway is the default route provided to the DHCP clients. In your case, on the 10.10.10.0/24 network, that's R1 itself, so the gateway should be R1's address on the 10.10.10.0/24 network, which is 10.10.10.1.

Can you do that change and try again?

vingjfg

My bad, I skipped the "... Connect List" somehow.

Beside creating a "station" configuration profile in Capsman, no idea, sorry.

vingjfg

In /interface/wifi, for example:

/interface/wifi/print

vingjfg

Sure does. Can you check that you have the package qcom-ac installed? /system/package/print Columns: NAME, VERSION, BUILD-TIME, SIZE # NAME VERSION BUILD-TIME SIZE 0 wifi-qcom-ac 7.15 2024-05-29 12:44:08 2676.1KiB 1 routeros 7.15 2024-05-29 12:44:08 11.0MiB

vingjfg

The top item in the firewall rule base on R2 can't be moved--special dummy rule for Fasttrack.... If I open that rule it can't be edited. It is Passthrough in the Forward chain. I created a new Fasttrack rule as you described (disabled) and placed it second. Close enough to the top? That's fine. Th...

vingjfg

From the documentation "When enabled, prevents a port moving from discarding into forwarding state if no BPDUs are received from the neighboring bridge. The port will change into a forwarding state only when a BPDU is received. This property only has an effect when protocol-mode is set to rstp ...

vingjfg

So, here are Move these firewall rules (chain=forward) to the top of the rulebase add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related disabled=yes add action=accept chain=forward comment=\ "defconf: accept established,relat...

vingjfg

Nice, so packets are going through r1 now, correct?

Can you send r2's config?

vingjfg

Hi, Could you - Remove the route rule /ip route rule add action=unreachable dst-address=192.168.55.0/24 interface=ether1 Edit the firewall filter to have these three rules on top of the rule base (chain=forward) add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ c...

vingjfg

OK. So R1 knows where to send the packets, and R2 accepts them.

Can you send a fresh config from R1? There were a few changes now.

vingjfg

The thing is, there is nothing obviously wrong in your config. So let's do this systematically.

From R2, can you SSH into the backend server on 192.168.55.0/24?

/system/ssh address=<dst address> user=<user>

If so, from R1, can you SSH into the backend server on 192.168.55.0/24?

vingjfg

@mkx beat me to it. The same applies to 192.168.2.0/24: unless R1 provides DHCP services to that network, you can remove it and add a route instead. After removing these, the route "unreachable" and the interface from the bridge, the config looks better. Some notes regarding the order of r...

vingjfg

NP. Here are my comments - /interface bridge port add bridge=bridge comment=defconf disabled=yes interface=ether3 It is better to remove the interface from the bridge instead of disabling it. /ip dhcp-server network add address=192.168.55.0/24 gateway=10.10.10.10 netmask=24 Not sure what you try to ...

vingjfg

The config seems to be r2 as it has a 192.168.55.0/24 on the bridge interface. Can you check?

vingjfg

Also, mind the differences between src-nat+dst-nat vs netmap.

1:1_mapping

vingjfg

The 2nd bridge was added to keep the hotspot isolated from the other networks. I can fix up the firewall rules but I dont see how they are relevant to throughput between a laptop connected to ether 2 and the WAN. So, yes, the security on the router can be better but nothing we have found so far exp...

vingjfg

I was about to mention a couple of things Amm0 recommended. My thought is we either are missing something very obvious or hitting a nasty bug. Regardless, I guess the best to do for now is to wait for the support to chime in on your ticket.

Sorry I couldn't be of more help...

vingjfg

Yeah, it looks like I got bitten by some poor choice of terminology here. Can you post the output of /interface/ethernet/monitor ether2 once /interface/ethernet/monitor ether5 once That will give the error counters (among others) In your configuration, I see two bridges, any reason not to stay on on...

vingjfg

Actually, it would. If you set "speed", it means you disable the autonegotiation, and in that case, if you leave one side with autonegotiation enabled, it will take the correct speed, but for 10 and 100Mb/s, it will default to half-duplex causing a duplex mismatch, which in turns will have...

vingjfg

Darn! I was secretly hoping that was it.

Does it start ok then quality decreases after a while? Or does it start bad?

vingjfg

Ok. I will brush up on my multicasting tonight and will look more in details tomorrow morning.
Thanks!!

Hi there. Any change after the command above?

vingjfg

On ether5, not 2.

vingjfg

Ah, you set the speed on ether2. It means you end up as 100Mb/s half-duplex.

Can you remove the speed setting on ether2?

vingjfg

Can you post the config, as well as the interface ether2 stats and details?

vingjfg

Ok. I will brush up on my multicasting tonight and will look more in details tomorrow morning.

vingjfg

OK. First thing, let's change the autonegotiation to only attempt 1Gb/s: in some cases 2.5Gb/s may raise issues. Can you issue the following command? This may interrupt your connectivity for a second. /interface/ethernet/set [find name=ether1] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,...

vingjfg

Up to you. If you are game, we can try to go to the bottom of it.

Thx for the link, opening and reading now.

vingjfg

Yo. With the TV on wired, can you send the current configuration as well as the following outputs? Replace /interface/ethernet/monitor [find name=ether1] once /interface/bridge/monitor [find name=bridge] once /interface/bridge/mdb/print Also, you referred to a page in Spanish documenting the configu...

vingjfg

Hello there,

Can you post your firewall configuration here after you removed the sensitive bits?

In the terminal, issue

/ip/firewall/export

vingjfg

From your configurations, there is an upstream device or devices to which your AP connect. Can you send the configuration of the one to which AP2 connects?

vingjfg

Should be fine. Create the vlan and add the ip to your management vlan.

Port config should be trunks to the network devices and access in whatever vlan for the rest.

vingjfg

I would be very careful mixing VLAN and unmanaged switches, as there is a chance that you'll crash the device, the worst would be that the crashes occur with large packets, that is: seemingly randomly. If you can, ask for a small budget and get a few manageable switches to replace the unmanaged devi...

vingjfg

First, can you fix the netmask on your bridge interface? /ip address add address=192.168.0.1 comment=defconf interface=bridge network=192.168.0.0 Should be /ip address add address=192.168.0.1/24 comment=defconf interface=bridge network=192.168.0.0 Second, masquerade implies natting behind the device...

vingjfg

Morning,

Please post you router configuration.

vingjfg

You can make the feature request in the support portal: https://mikrotik.com/support

vingjfg

Hi there. Can you remove the route rule? I suspect it is messing with the connection. From the 10.10.10.0/24 network, if you want to connect to your SSH servers, either your host has a direct route to 192.168.55.0/24 via 10.10.10.10, or you need to set up hairpin NAT on the Mikrotik so it can proces...

vingjfg

My experience with ROs 6 is that trying to set up the mesh can be a lot of trouble. With 2 devices, consider one as AP, the other one as STATION-BRIDGE. That works rather well.

My setup has 3 Audience and they are plowing along without a hitch.

vingjfg

No need to do VLAN filtering on CAPs, that is handled by (the old) CAPsMAN through datapath indeed. Only when using the new wifi-qcom-ac driver, it is required. Unless you have to do some VLAN filtering because of a second LAN port, please leave CAPs mode as default (except for identity). Can you s...

vingjfg

On the AP, if you issue the following command, do you have your additional VLANs? /interface bridge vlan/print As far as I understand CAPSMAN and the datapath, the Wifi will be associated to the correct VLANs on the bridge, but the VLAN themselves are not created on the bridge. When you have the VLA...

vingjfg

Yo! On the AP(s), you need to create the relevant VLANs, that is not automated by CAPSMAN (unfortunately). Provided that ether1 on the AP is the trunk back to the main switch: /interface bridge vlan add bridge=bridge-trunk tagged=ether1 vlan-ids=11 add bridge=bridge-trunk tagged=ether1 vlan-ids=13 a...

vingjfg

Here is the config between code tags. That's easier to read and copy-paste. That being said, there is nothing in this configuration, at least not the WLAN that you mentioned in your message. Can you post the configuration from the CAPSMAN manager? /interface bridge add mtu=1500 name=bridge-trunk pro...

vingjfg

Can we get source IP on bandwidth test tool
Really painful on complex link routers when you can't control what IP the test launches from.

Hi there! The best way to submit a new feature is through the support portal:
https://help.mikrotik.com/servicedesk/s ... r/portal/1

vingjfg

Hi. I will do a few IPv6 tests over the weekend. Reading your configuration, I have a few comments and questions. Here are the configuration bits and my notes. /interface pppoe-client add add-default-route=yes disabled=no interface=ether1 name="ISP PPPoE" \ service-name=internet user=bthom...

vingjfg

For the DHCP issue, that's a good question, no idea really where it can be as it seems intermittent. I would start by checking on which AP the laptop(s) connect, make sure they get a correct registration entry in the CAPSMAN, that their MAC is present on the switch and everything.

vingjfg

Do you see your Mac in the host list?

vingjfg

Do you have a machine on the wifi?

vingjfg

Can you send the output of

 /interface bridge host print

vingjfg

OK, slight change of plans: you are using the native VLAN on the RB and cAP for the management. Let's keep it that way. On the RB, let's assign an IP to the BR1 interface, add it to the BASE list and create a DHCP server. /ip address add interface=BR1 address=192.168.64.1/24 /ip pool add name=pool_a...

vingjfg

You assign the ip to the vlan interface.

Can you post the cAP's config?

vingjfg

Config has no dhcp on base. Did you set a static IP, gateway and dns?

vingjfg

You need to allow BASE to access the Internet as well, add something like /ip firewall filter add action=accept chain=forward comment="BASE Internet Access only" connection-state=new in-interface-list=BASE out-interface-list=WAN After this one add action=accept chain=forward comment="...

vingjfg

Yeah. It didn't register with me, but this rule is rather wrong: /ip firewall raw add action=drop chain=prerouting comment="Drop all non-internet networks" src-address-list=not_in_internet It will drop all traffic with private IP coming from the internal networks, where the intent is to dr...

vingjfg

Do you have an IP on eth1_WAN? And a default route?
Yes, the home router assigned 192.168.1.146 to the RB.

Ahhh okay! The masquerade rule should still work though. On the RB, do you see any rule counter increasing? Any NAT counter increasing?

vingjfg

There are some defaults that can be selected during the install. From the page:

Google
OpenDNS
Level3
Comodo
DNS.WATCH
Quad9
CloudFlare DNS
Custom

vingjfg

For DHCP, I have netmask=24 on each network. It should not matter: the default (netmask=0) uses the netmask from the IP address. Yup, eth1_WAN is a member of the interface list WAN. Your srcnat rule is incorrect - it means "anything going through and exiting through WAN should be natted behind ...

vingjfg

I'll get a look at your config later today. Meanwhile, can you send the output of "ipconfig /all" on your gaming computer with the isp router and then with the rb5009?

vingjfg

Can you send the output of

show crypto ipsec sa

On the asa?

vingjfg

No, you can't create an ACL with multiple interface-lists (unfortunately ...), so the solution is to create successive rules /ip firewall filter add action=drop chain=forward dst-address=77.66.21.133 in-interface-list=VLAN add action=drop chain=forward dst-address=77.66.21.133 in-interface-list=BASE...

vingjfg

Hi there. My comments - Chain input looks good. Chain forward: I think this one has the in-interface wrong add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet\ in-interface=BR1 log=yes log-prefix=!public_from_LAN out-in...

vingjfg

I suspect there are still issues with the export - for example 192.168.0.1 is assigned twice: once to BASE_VLAN, once to Employee_VLAN. Firewall filter The first 4 rules mask all the rest for the chain=input . Checking is easy: do you see the counters below the 4th rule incrementing? /ip firewall fi...

vingjfg

Yup, having a look in a second.

vingjfg

As far as I understand, CAPSMAN does a lot but not everything. Regarding the interface on the RB - have you added BR1 as listening? I am unsure whether eth3 would work as it is a member of the bridge and not a standalone interface. Another possibility is to define the DHCP option caps-manager=<capsm...

vingjfg

This is my cAP: OK, that is really minimalist :lol: So, there is no DHCP server on VLAN1 (interface BR1, 192.168.0.0/24) on your RB. Do you prefer setting a static IP on the cAP or using DHCP? Or did you remove that info from the RB? Your bridge on the cAP needs VLAN-filtering, and you still need t...

vingjfg

My comments on the configuration of the RB . protocol-mode=none can be problematic as the bridge then floods the unknown multicast packets on all ports - that includes LACP PDU, LLDP, spanning tree et al . I have a ticket open for this setting breaking the LACP bonds attached to a switch. Unless you...

vingjfg

Can you post the configuration (minus the sensitive bits) of your RB and one of the cAP? It's in my first post. I'm not with the cAP now, but can provide it in an hour. But the cAP is just factory reset with CAP mode. No other settings made. Works for me, as long as the configuration you posted is ...

vingjfg

Can you post the configuration (minus the sensitive bits) of your RB and one of the cAP?

vingjfg

You can also use the TLS Host to reset the connections to the sites you don't want.

https://mum.mikrotik.com/presentations/ ... 535774.pdf

vingjfg

Alright then. I'm reading on CAPsMAN with the old Wireless driver. Immediately, I see that in Wireless -> CAPSMAN Interface -> Manager -> Manager Interface, you have the all/Forbid above the eth3_MikrotikAPs. Can you invert that order? If that doesn't work, can you set the "all" to "f...

vingjfg

In my case, I had to select the persistent name assignment, and manually add each wifi interface to the relevant vlan on each device (audience)

Do you see the remote caps on the manager?

vingjfg

Would help to have the same on both.
Can you install the wireless package on the cap as well?

vingjfg

Can you post the list of packages installed on your rb and cap?

vingjfg

Wifi -》 remote caps

vingjfg

BTW, the datapath has vlans. In my case that was an issue.

vingjfg

That's good. Do you see the capsman clients on the RB?

vingjfg

Totally should. Do you see your cAP's MAC in the bridge host table?

vingjfg

Eth3 part of a bridge on which capsman listens

vingjfg

Do the cAP have l2 connectivity to the rb? Wired?

vingjfg

Yup, the implementations are incompatible between 6 and 7.

vingjfg

Hi there.

All cAP are at version 7.14 and can see the manager at l2?

vingjfg

Wow wow wow! An IP should be present once and only once - remove the IP addresses assigned directly to ether3 - this interface should be L2 only, no IP. The IP addresses must be on the VLAN interfaces. Can you reconfigure it for the following: IP addresses on the VLAN interfaces, not on ether3 ether...

vingjfg

The setting you see in IP -> Firewall -> Service Ports are the Application Layer Gateways ("ALG"), which transparently transform the traffic going through the Mikrotik. In the case of SIP, that is to rewrite the fields via and contact, to mention only two. Your router doesn't act as a SIP ...

vingjfg

Hi there. If you do the following, does your computer get an IP in vlan 50? /interface bridge port set [find interface=ether3] pvid=50 If you don't have a pvid defined for a bridge port, its default is whatever is defined as pvid for the bridge itself, which you can get with a bridge print. By defau...

vingjfg

Do you have a way to capture some traffic on that port on your host?

vingjfg

As tangent says, there is no better solution here, just pick the one you feel is the most manageable for you and stick to it. I tend to use the interface name to describe the type of connection (ether, pppoe, wifi), and the list name to describe the role (WAN, LAN-Trusted, LAN-IOT, LAN-PRINTERS). As...

vingjfg

Hmmm these are addresses on your local network. If your Mikrotik is doing the PPPoE with your ISP, well I guess you have Internet access, and your modem is just bridging between the two, then it may be hard to get its MAC. Have you checked the underside of the modem? Also, if it is Proximus, I guess...

vingjfg

Digging further, it seems that anything coming or going to a Wifi interface is not fasttracked. Question asked to the support.

vingjfg

Recently, I played with the tls-host fields in the rules. I noticed that the connections were half-fasttracked - meaning only one of the counters is increasing. My setup is like this: boubou.drawio.png The wired connections are untagged, the wifi between the routers is tagged and defined as AP-BRIDG...

vingjfg

Yo So, this rule - /ip firewall nat add action=dst-nat chain=dstnat dst-address=192.168.1.2 dst-port=80 \ in-interface=bridge-local protocol=tcp src-address=192.168.1.253 \ to-addresses=192.168.1.2 to-ports=80 It reads "When a packet comes from 192.168.1.253 to original IP address 192.168.1.2 o...

vingjfg

Yes, I could, but I'm not fully sure what you mean by config and probably how to get it. Could you say how, please, pref via WinBox. Thanks In Winbox, click on the button "New Terminal". There, type the command /export file=myExportedConfig In the files section, you will have a new file c...

vingjfg

Hi there. Can you share your current config minus the sensitive parts?

vingjfg

Any chance you can capture some traffic?

vingjfg

Good! The reason I asked is Mikrotik is notable for not repeating mDNS across subnets.

So, both the homepod and iPhone are connected to Wifi and both get an IP in the same subnet, correct?

vingjfg

OK. Are the Homepod and the iPhone on the same L2 network?

vingjfg

As pfturner said, you need to accept NDP advertisements on the WAN interface. Try adding the following and move them above the final deny /ipv6/firewall/raw add chain=icmp6 action=accept in-interface-list=WAN icmp-options=134:0-255 limit=5,10:packet log=no log-prefix="" \ protocol=icmpv6 h...

vingjfg

If I read this correctly, you are not setting the band 2ghz-n to your configuration. Try

/interface/wifi/configuration
set [where name=hidden_2G] channel="2G N"

//JF

vingjfg

OK! I was uncertain as you posted the ip firewall raw for IPv4 and information for IPv6 - but mentioned the issues related to connectivity so I went with IPv4. I saw a few things in the info you sent, namely that you use the interface-list name "VLAN" and not "LAN", keep in mind ...

vingjfg

So it is getting the right IP from the reservation in DHCP, so all good. If you set the IP on the server to static, DHCP will never see any request from the server and will thus never say that it is assigned: it will stay as "waiting" in the DHCP server. If you set the server to get the IP...

vingjfg

Hi there!

Then I am confused - you said you had issues when you added the ip firewall raw rules - do you mean you have issues when you do the same with the ipv6 firewall raw rules?

vingjfg

Your /ip/dhcp-server/export is missing a few items. And you didn't send the output of ip link on the Debian box.

Regarding finding what IP a MAC is assigned (or tries to get), you can look in the logs

/log/print where topics~".*dhcp.*"

vingjfg

Well, it seems you sent me the ipv6 bits and not the ip(v4) ones - can you send again the ipv4 addresses and address-list?

vingjfg

Hi there!

Can you post the output of the following commands?

/ip/address/print
/ip/firewall/address-list/print
/interface/list/member/print

Also, when posting commands or outputs, consider using the code tag (the button is </> above). This presents the information in a nicer format.

vingjfg

Hi there.

I'd start by checking what wifi settings are negotiated between the pod and the fritzbox, and see whether that's available or configured on the cap/ax3.

vingjfg

Hi there.

Can you provide an expunged/sanitized config?

When you have the blank arp table, is all l3 connectivity lost? Or does everything works as usual?

vingjfg

The following command should give you the information as local-address /ip/route/print detail where dst-address=192.168.1.0/24 Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, y - bgp-mpls-vpn; H...

vingjfg

Hi!

Can you post the output of the following command?

/ip/dhcp-server/export

Also, consider running "ip link" on your Debian server, so I have the MAC address.

vingjfg

Nope, I only see the local DNS resolver and not its upstream. resolver #1 nameserver[0] : 192.168.2.1 if_index : 4 (en0) flags : Request A records reach : 0x00020002 (Reachable,Directly Reachable Address) Can you check on your Mac in the network settings, advanced settings, whether 1.1.1.1 was added...

vingjfg

Interesting. Let me fire up my old mac to see what scutil says.

vingjfg

Can you check that this DNS is not configured as an option in your DHCP?

> /ip/dhcp-server/network/export
...
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1 netmask=24

vingjfg

Deadpete, You can restrict the advertised speeds on the link. For example to restrict ether1 to 100M/full or 1G/full, you may use the following. /interface/ethernet/set [find default-name=ether1] advertise=100M-baseT-full,1G-baseT-full This could be an alternative to forcing speed/duplex, as this wi...

vingjfg

If you're willing to give a second shot, here is my lab setup. Mikrotik: external 10.0.0.2, loopback 10.255.255.1/32, tunnel 10.255.254.1/30 Cisco: external 10.0.1.2, loopback 10.255.255.2/32, tunnel 10.255.254.2/30 Mikrotik configuration (relevant bits) /ip ipsec profile set [ find default=yes ] dh...

vingjfg

So the Pi may be a special case. Let's focus on the USB Server then. Currently, only destination NAT is defined - can you look what happens when you try to connect to it from a computer (not the Pi) on your WIFI: torch or packet capture on R1 and R2 - R1 should see 10.30.30.3 and 192.168.100.xx, R2 ...

vingjfg

OK. On the pi, can you send me the output of the following? ip neigh ip route ip link sudo ufw status In R1, when 192.168.88.254 (pi) accesses the Internet, do you see the connections from 192.168.88.254? Or from 10.30.30.2? From 192.168.88.253, there is no srcnat yet so you must see the original IP...

vingjfg

Hi there Can you send the command you created? /ip/firewall/raw/export /ip/firewall/address-list/export Regarding limiting the number of email per hour per IP, not that I know of in the default configuration. The Mikrotik has a pretty basic firewall and in no case something that does DPI/L7 inspecti...

vingjfg

Almost there. Bridge bridge : interface sfp1 is part of the bridge while being used as a L3 interface later. Can lead to issues, especially that bridge and sfp1 are in different interface lists. Firewall chain forward : your natted traffic will go through the default rule and will not show in the st...

vingjfg

Both the host route and the proxy-arp are needed if you don't add a secondary IP to the interface. Adding a secondary IP is not my preferred solution but that's one that works.

Can you send a fresh export of the configuration on R2? There were a few changes and I lost track of which.

vingjfg

Not needed, but check whether the Pi has a firewall set locally.

vingjfg

By the looks of it, this is from R2. Do you have an ARP entry on R1 for 10.30.30.2?

vingjfg

Then on R2 you need to set the interface sfp for proxy-arp. You still need the route for 10.30.30.2/32 to 192.168.88.254.

Adapt the following line of code.

/interface/ethernet/set [find name=sfp1] arp=proxy-arp

Note that sfp1 is still present in the bridge, while being used as a L3 interface.

vingjfg · Re: 1:1 NAT configuration But do you have an ARP entry for 10.30.30.2 on R1?

But do you have an ARP entry for 10.30.30.2 on R1?

vingjfg

No ARP entry.

On R2:

/ip/route/add dst-address=10.30.30.2/32 gateway=192.168.88.254

And try again

vingjfg

On R1.

/ip/arp/print

Do you have an entry for 10.30.30.2?

(If you posted it in the screenshot, can't see it, resolution is too low.)

vingjfg

Sure thing.

If you look in r1, do you see an arp entry for 10.30.30.2?

If not, you need a route host in r2 for 10.30.30.2 that points to your pi. You may have to set proxy arp on the external interface as well, can't remember whether it 's needed.

If you need the commands, let me know.

vingjfg

Can you share the config for R1?

Also, you use action netmap instead of srcnat/dstnat. Be sure to understand how netmap works as it had some subtleties.

vingjfg

Given that the server and the clients are on the same network, the initial packet goes through the router and is dst-natted to 10.0.0.10, but the response goes directly from the server 10.0.0.10 to the client, which expected a reply from 10.0.0.1. The client drops that datagram. If you *really* want...

vingjfg

Seems like a mtu issue, see viewtopic.php?t=155014

vingjfg

Last one for today. If that doesn't work, I will make a lab tomorrow: can you give the 10.0.40.10 ip to your pc and check again?

vingjfg

That's uncanny. Can you post the whole config (remove the private bits)?

vingjfg

Well, paint me green and call me a pickle ... Columns: TIME, INTERFACE, SRC-ADDRESS, DST-ADDRESS, IP-PROTOCOL, SIZE, CPU # TIME INTERFACE SRC-ADDRESS DST-ADDRESS IP-PROTOCOL SIZE CPU 0 6.192 wifi8 192.168.2.6:35454 192.168.2.1:1234 udp 42 3 1 6.192 bridge 192.168.2.6:35454 192.168.2.1:1234 udp 46 3 ...

vingjfg

What might play is if the ethernet interface on the router (the one with IP 10.0.40.254) is itself down because of link-down. Can you connect something to it, like a mini-switch or anything that will make the link go up?

For the non-existent host, my gut feeling is no, but I am about to do a test.

vingjfg

Nope, you are right - my mistake.

You should upgrade to 7 first, then install the qcom driver.

vingjfg

That is ... weird. I created a test rule - Flags: X - disabled, I - invalid; D - dynamic 0 X ;;; defconf: masquerade chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none 1 ;;; Test chain=dstnat action=dst-nat to-addresses=172.29.0.1 protocol=udp src-address=192.168.2.0/24 dst-...

vingjfg

From the configuration you sent, you have RouterOS 6.49.14. Try:

https://cdn.mikrotik.com/routeros/6.49. ... .49.14.zip

vingjfg

That is correct - the to-address will not affect the matching of the rule. If the counters are not incrementing, it means something is getting in the way earlier than the rule. To confirm, because you had an input rule that said 3260 and not 1234: The source address is 10.0.10.10 The destination add...

vingjfg

Hello there! Can you share the configuration of one of your wAP AC devices? do not forget to put the configuration between code tags (see: viewtopic.php?p=1051702&hilit=forum#p1051702 for more info).

vingjfg

Ha HA! You wrote initially: ... The machine IP address is 10.0.10.10 The machine does not have a gateway. The router IP address on that interface is 10.0.10.1, which is also the destination IP address of the UDP packages. The destination port is 1234 I can see the incoming traffic using the /tool/to...

vingjfg

Note that you can print all the rules for a given chain by using where=<chain to display> in your print statement. For example all the rules in the input chain: /ip/firewall/filter/print where chain=input The dst-nat arrives before the firewall - so as you change the destination for a non-local addr...

vingjfg

Hi there! The nat rule you sent seems correct. What I cannot say is whether it is high enough to avoid the traffic being matched by another rule. Can you edit it to add the src-address so it looks like the following line, and move it above whatever other dstnat you may have in place. Also, consider ...

vingjfg

That should be the way. Just to be sure, the address-list exists, correct?

Can you provide the error message? And the version of ROS?

vingjfg

As mkx said, you didn't really fix it, you simply changed it to something that happens to work most of the time. In the second packet capture you joined, you see something that will put you on the path: your PC send arp requests for 10.10.5.50 but gets no answer. Here is a discussion that should giv...

vingjfg

Fixed in Observium. Thanks for your support.

Glad to hear it! Please mark this as solved if you get a chance.

vingjfg

IP adress config from your Mikrotik router.

PCAP is a packet capture. You said you took one.

I am interested in seeing the icmp and arp packets.

vingjfg

Can you share the ip address config?

Also, can you share a pcap?

vingjfg

The MAC 00:00:00:00:00:00 indicates a conflict: likely the Mikrotik attempted to hand out the IP 192.168.80.222, but its check determined that IP is already on the network, so Mikrotik blocks it in the pool. As Holvoetn says, it could be a static IP on the Ruckus. Other possibilities I can see: The ...

vingjfg

I tried a snmpwalk with the top of the LLDP OID tree and I get the info.

snmpwalk [...] -m MIKROTIK-MIB -m LLDP-MIB 192.168.2.1 1.0.8802.1.1.2

If you haven't, can you download the Mikrotik MIB and add it to your tool?

https://mikrotik.com/download

vingjfg

Wow, you didn't make it easy for you! The issue I see is that the packet goes in the VPN from the central site to the remote site, is put on the local network, arrives at the windows server .., which tries to reply to 192.168.1.0/24 on the local network. In order for this to work, you will have to p...

vingjfg

Hi there, There is a support portal: Support portal. Regarding lldp and the sending interface, that should be the property interface-name . [admin@********] > /ip/neighbor/print detail 0 interface=wifi3,bridge mac-address=XX:XX:XX:XX:XX:XX identity="*****" platform="" version=&qu...

vingjfg

No worries. Regarding your NAT rule, taking one at random: /ip firewall nat ... add action=accept chain=srcnat comment=ISW_Endpoints dst-address=\ 172.x.x.11 log=yes log-prefix=ISW src-address=105.x.x.19 ... This means "For connections coming from a.b.c.19 and going to 172.x.x.11, do not change...

vingjfg

It looks like the two certificates from letsencrypt actually have different key size: Screenshot from 2024-02-10 21-13-28.png 2048 (MT) vs 4096 (pfsense) I don't know - in the logs with the failure, the certificate status is found as "good", which would indicate that the certificate is ac...

vingjfg

My mistake, I missed the sha256 in the config. Your pfsense has pfs in phase 1, the MT config says none. Can you try setting one?

Nope, nothing obvious I see.

vingjfg

If I read this correctly, your ikev2 p1 has only sha1 defined. Can you add sha256?

vingjfg

For the formatting, please enclose the configuration or config statements between code tags. Looking at your config ... there are severe issues, for example you have the WAN and ISW interfaces parts of the same bridge, while ISW and LAN are part of the same interface group. This begs the question of...

vingjfg

Can you check the IKE p1 proposal on the MT? From the last excerpt, it works with SHA-2 384.

vingjfg

Sure, add the /32 to the tunnel domain on both sides and a nat rule on the server side.

Send the anonymity configs if you want.

vingjfg

Could you post a diagram with this?

X.x.x.19 - you wrote "... assigned to a dedicated private server ..." Do you mean it has a private ip and nat? Or directly the public ip?

vingjfg

Would changing the Radius server be possible?

vingjfg

This is a bit of a feature that is becoming a bug: "protocol-mode=none" not only disables spanning-tree but results in all L2 multicast frames being forwarded to all ports as well. As a result, the switch was forwarding the LACPDU from one ethernet port to another, resulting in the Cisco s...

Search found 417 matches