MikroTik

webor

Yes, you are right! You directed me initially to look in the wiki if there is some misconfig at my side and I said that there are no discrepancies. :-) My assumption was wrong and I didn't know that both sides (server and client) have to have bridge. On my phisical routerboards I always needed bridg...

webor

so you never added the bridge interface on the l2tp profile for both the client and server as it is already mentioned in the wiki... No, I added the bridge interface on the l2tp profile on server CHR side (see OP) but didn't do the same on the client side as I tought that I don't need the bridge in...

webor

Oh. Tnx on review. I edited (minor rephrasing) the post with solution. Is it more understandable now?

webor

There was NO problem per se in adding the bridge to default profile. I personally don't like to alter default profiles (maybe I am wrong, but as I am no expert I like not to touch defaults as much as possible) so I created new one: /ppp profile add bridge=bridge1 name=profile1 and then use this prof...

webor

For all good and knowledgeable people here: It was resolved pretty soon after help provided by @sindy! After he approached the chr and after some testing he figured it out that the PROBLEM was in my config on the CLIENT side, and NOT on the CHR server side. For this configuration, on the client side...

webor

OK, maybe it's really time to have a look directly there...

I really can not figure it out, it is beyond my level. If you are in the mood, I am very grateful. My email: anti spam edit

webor

Ohh, thank you for clarification. L2TP interface in my case is created but it is not added to the bridge. I have enabled detailed logging and here is the log: 12:35:13 ipsec,info respond new phase 1 (Identity Protection): 10.0.0.6[500]<=>X.X.X.X[500] 12:35:14 ipsec,info ISAKMP-SA established 10.0.0....

webor

Can I test this somehow? Do you maybe want to test?

Following your comments, I tried now to set admin MAC on the bridge1 interface the same one as the ether1 virtual nic, but unfortunately also without sucess.

webor

EDIT: It is not relevant, please ignore Dear all, I would like to draw attention to this thread that seems as a problem specifically related to CHR on Azure. https://forum.mikrotik.com/viewtopic.php?f=2&t=177426 Maybe even a moderator could change the location of my post to this Virtualisation ...

webor

In the meanwhile I have also tried with upgrading to latest testing 6.49beta as well as latest development 7.1beta version but there is no improvement. I was particularly motivated by seeing in the changelog of 6.49beta the following change: *) chr - fixed OS provisioning on Azure; but unfortunately...

webor

OK. So my L2TP - BCP tunnel between two CHRs works just fine, except that one of the CHRs (the client one) runs 6.47.9 and the other one runs 6.48.1, so neither exactly matches your 6.47.10. At both, I can see the L2TP interface as a dynamically added item in the /interface bridge port list. What d...

webor

It is an MS Azure virtual machine.

Btw, If some of you gurus want, I can gladly provide you access to the machine.

webor

Dear Sindy, tnx on your comment!! I checked this with directly looking into the bridge ports after the l2tp/ipsec tunnel was established. As nothing was there (the l2tp dynamic interface was not in the list of bridge ports) I concluded that it doesn't work as expected, because on my nonvirtual route...

webor

Is here anyone with CHR that could test this? Many tnx in advance.
For test, I tried to reset all settings to default and then only apply the config presentrd above in the first post and it still doesn't work

webor

Thank you Zacharius for joining. I have looked and can not find any discrepancies. This is the document that I have based on my config. I also think that it should work, but as I am no expert I posted here as I was very confused why it does not work on CHR. Same thing and config works on my phisical...

webor

On CHR last long-term v6.47.10 I can not get L2TP interface to be placed as a bridge port upon connection. In contrast, the same thing fully works on my phisical routerboards, e.g. RB951G, hap ac3, etc.. Is it normal behaviour specific for CHR or...? Config is: /interface bridge add name=bridge1 /pp...

webor

How the router decides from what ip the ipsec connection is going to be initiated? After trying to answer on my own question raised, I have found the missing setting that resolved the unwanted behaviour and now the l2tp/ipsec client always uses lte2 to connect to server. The thing that was necessar...

webor

I have found some kind of workaround. If I add a dedicated route with dst-address= IP of the l2tp/ipsec server (in my case it is a dynamic public IP address) than everything works and also there is no more need to mangle anything with mark-routing. Example: /ip route add comment="route through ...

webor

Oh, now i understand :) :-) tnx for your help and time! Hmm, the router use main routing table. So, it seams that ipsec can not get routing mark and then be policy routed.? Is this the expected behaviour or a bug, or...? It seams strange such a behavior. Set lte1 last resort route with distance=2 t...

webor

Hi! Maybe I am not clear. I will try to be as simple as possble. I have remote mtik l2tp/ipsec server with public ip (that public ip is dynamic so I am using ddns on it) and I want to connect to it from my RB951G (rb951g is l2tp/ipsec client) that has two WANs - usb lte modems (lte1 and lte2). I &qu...

webor

Src nat I already have. When I add the rule /ip route rule add action=lookup interface=l2tp-client table=markforl2tp src-address=192.168.51.0/24 it still establishes ipsec connection over lte1 interface. It is like ipsec is not part of the l2tp-client interface. Ipsec establishes over lte1 and the l...

webor

Uh, yes. My MTik is RB951G with two LTE usb dongles that assign private IPs (dhcp) to the Mtiks lte interfaces. So mtik lte1 interface has private IP 192.168.8.100 and lte2 has 192.168.51.238. Corresponding routes: /ip route add comment="LTE2 for l2tp ipsec client" distance=1 gateway=192.1...

webor

Tnx! In the meanwhile I have tried with /ip route rule add action=lookup interface=l2tp-client table=markforl2tp but with NO sucess. EDIT: It is obvious that this doesn't work because l2tp is established after the ipsec so this doesn't make sense. I will try yours now and report. Can you please say ...

webor

Tnx very much @JohnTRIVOLTA ! Can you please be more specific? My apologies but I am not expert and although I understand in general what you are meaning, I am not sure what exactly should I do. After searching the forum yesterday, I tried to do something in that sense, but obviously wrong as I did ...

webor

Hi! I would kindly ask for some help in order to force my MTik L2TP/IPsec client to use specific (lte2) interface in dual wan configuration (lte1 & lte2). I want that my mtik l2tp/ipsec client when connects to my mtik l2tp/ipsec server uses lte2 gateway (192.168.51.1) My config that does not wor...

webor

For my headache also you suggest BCP?

I do not understand, what do you mean? Apologies if the suggestion is not good. It was just a hint that helped me once upon a time, nothing special..

webor

Hi. I had similar requirement and the solution that worked for me was to perform BCP bridging over pptp tunnel and it worked ok enabling fullethernet MTU. Look at this guide: https://wiki.mikrotik.com/wiki/Manual:BCP_bridging_(PPP_tunnel_bridging) In my case one side had public ip so pptp was not an...

webor

Sorry, but that's DRM for you. Thank you very very much @tangent for spending your time on this. I have learned a lot in this thread. Tnx. After multuple tests comparing BCP bridging over PPTP tunnel Vs. WDS bridge I would say that BCP brisging brings better for me. I would like to ask you if you h...

webor

Dear @tangent please find the captured packets https://we.tl/t-UdWyYxpwkW Please accept appologies for not attaching it sooner but I have tested a lot and now sending the packets that I think are most problematic. There is a channel change as well as switch to watching "old" programme - co...

webor

I've tried giving you a brain-dump before, and you ignored most of it, so at this point, you've got to give details if you want answers. Let's start with that packet capture of an IPTV stream in progress, including a channel change event. I said a few seconds, but it probably should be something li...

webor

You really don't seem to like answers which are not in the line of your thinking, do you? Fair point mkx! :-) It's probably a part of the human nature, but lifelong learning is a must! Mkx thank you very very much on your knowledge sharing! It mighy be the problem that my networking knowledge is we...

webor

If you can't get rock-solid reliable VoIP over WiFi, why would you expect to get it with IPTV? The interesting fact for me is that iptv over wifi really works for me but only if I use BCP bridge over pptp or station-wds mode. If I use station-bridge as described here it doesn't work as I expected. ...

webor

I like to believe that I am not mad, tnx for asking! ;-) Maybe I was not fully clear in my description and that makes you think that I am requiring some "special" things... I will try to simplify it as simple as possible. I am trying to establish relible wireless L2 bridge inside the apart...

webor

Hi to all. In an effort to dig dipper into this, for couple of weeks I was testing different setups in order to have reliable L2 wireless bridge. Successful solutions that I have tested 1) BCP bridge within Pptp tunel over wifi link. 2) Bridge using WDS = station-wds mode Unfortunately, the one that...

webor

Thank you so much on such a knowledgeable answer! I have learned so much just from one post and probably can easly conclude that there is no problem with my device, its just the way it is. I thik that after such an answer there is no practical need for more digging. Only scientific curiosity remains...

webor

Is here someone with hap ac3 who is willing to share his experience? Is such performance expected or is it something wrong with my device? Thank you in advance!

webor

I am digging into this issue and have found very very interesting thing: If I remove wlan interfaces from the bridges and perform BCP bridging (PPP tunnel bridging) over wifi link than it works without a problem. BCP bridging over PPTP performed following this guide: https://wiki.mikrotik.com/wiki/M...

webor

I was able to test the same config with RB951G-2HnD replacing the Pwr-line AP and the result is the same. Some wifi connection is established between two mikrotiks and there is connection with the STB but the picture is sluggish if it exist, sound is horrible and also constantly interupted, and plen...

webor

Thank you very much! I was afraid that I will get such an answer, but from my pleasant experience with Mikrotik during the years, I was thinking that for such a non complex and straightforward task even the lowest level of MTik will be enough. I will test it with another Mtik and report here. Can yo...

webor

I would kindly ask for some help in my effort to establish solid wireless bridge between two Mikrotik devices to serve for IPTV STB. Situation: ISP router (in bridge mode) >> UTP cable >> ether4 on Hap AC3 >> wifi los 4 meters >> Pwr-line AP as station bridge >> UTP cable >> STB Hap ac3 relevant con...

webor

Thank you. I tried now with 200 connections but it is almost the same. It is even slightly below the 85%. The CPUs utilisation is arround 83% with TCP both directions. All 4 CPUs are approximately utilised equally. What could be the limiting factor / bottleneck? EDIT: while testing with different nu...

webor

I would kindly ask some of you that have hap ac3 to test this and report if this is the same situation with your hap ac3s. This will at least show if my hap ac3 is faulty or this unknown/unclear bottleneck is present in all hap ac3s. Tnx very much in advance!

webor

Thank you very much on your fast and very informative answer!! I have retested and can confirm that all cpu cores are equally utilised arround 85% > /tool profile cpu=all Thank you for the command! I was trying to assess the CPU capabilities compared to other older MTs that I have and compared to CH...

webor

I tried to play a little bit with my new hap ac3 and noticed that when doing the bandwidth test to 127.0.0.1 using TCP in both directions it only utilises 85% of the CPUs. All other tests (UDP send, receive, both as well as TCP send, receive) utiles 100%. I am wondering why the router can not utilis...

webor

Oh, the catch was in chain. It was necessary to set chain=output instead of prerouting. After days of searching, the solution was so... hmm.. /ip firewall address-list add address=my.server.ddns.address list=adressddns /ip firewall mangle add action=mark-routing chain=output dst-address-list=adressd...

webor

It might be that you have not configured the bridge/ip addresses correctly between the main router and the ap.

webor

I would kindly ask for some help! I am kind of desparate. I am so happy with Mikrotik for more than a decade but this task is too much for me at the moment. It is obvious that I am not doing the right thing but can not figure it out what and how it should be. I am googling arround and going througho...

webor

I am really stuck here. I would really appreciate advice where to go next to search for a solution to properly prerouting mark to force the pptp-client to establish the tunnel through the specific ( lte2 ) interface. It seams that an easy (general) approach described here above doesn't work for vpn ...

webor

Thank you very much on your help. My need is to route the pptp tunel to go through lte2 (gw 192.168.51.1) interface. I do not need to route another traffic through that tunel. I just want to force pptp client to use lte2 interface when it makes connection with the ppptp main server. On the other han...

webor

Hi! I also tried this but it still doesn't work. It seams that the vpn traffic can not be routed in such an easy way. I really can not figure it out why exactly but it does not work for me. I tried also with l2tp/ipsec and it also ignores that routing mark. For the memoment I figured out the let's s...

webor

I have implemented your suggestions but unfortunately it still doesn't work. All traffic including vpn connection goes through lte1. This is my code at the moment /ip firewall address-list add address=my.server.ddns.address list=adressddns /ip firewall mangle add action=mark-routing chain=prerouting...

webor

This is my config (relevant part) at the moment that unfortunately doesn't work: /ip firewall address-list add address=my.server.ddns.address list=adressddns /ip firewall mangle add action=mark-routing chain=prerouting dst-address-list=adressddns new-routing-mark=markpptpclient passthrough=yes proto...

webor

Thank you very much on your time and willingness to provide me help! I have all the things that you are mentioning successfully setup (dynamic dns, pptp server, pptp client) beside the specific routing issue. I tried with the mark-routing the tcp 1723 as well as gre and than route this through the l...

webor

I would kindly ask for help in my (still unsuccessful) effort to route a pptp client connection through a specific gateway in a Mikrotik system with two LTE gateways. I want to route a pptp client connection from Mikrotik remote router to Mikrotik central router through its lte2 interface and all ot...

webor

Just to inform that I have "resolved" the problem. I succeeded with the BCP over PPTP with MRRU=1600. For now it works great. I saw arround the web that EoIP is somehow "quirky" and in my example it seems so. The solution was to give up EoIP and implement BCP bridging over PPP as...

webor

Thank you very very much both of you! Best wishes in new 2021 too, for you and all others. Such fast responses are so nice thing. Tnx. I set EoIP MTU to 1500 on both sides, and also unchecked Clamp TCP MSS on both sides. I also set MRRU to 1600 on pptp server as well as client side, but unfortunatel...

webor

Thank you @mistry7 on your help. I was googling and trying for 2 days mostly by following mum presentations and trial and error approach. I successfully establish BCP bridge with l2tp as well as already mentioned EoIP tunnel through VPN (pptp as well as l2tp) but unfortunately IPTV box is not connec...

webor

Tnx for this guidance! Complete success following it. Only one thing that you are mentioning I can not find: "Note: you will need to set the "enable ip forwarding" parameter in the resulting azure vm network interface."

webor

Hi! I am trying to establish ethernet connection over pptp connection and then bridge those connections in order to establish connection with iptv settopbox over that. Home location (ISP router/bridge for iptv > MTik ether4 > pptp server & EoIP over pptp > bridgeed ether4 & EoIP tunnel ) ---...

webor

Hi and thank you very much Zaffo for your suggestion! I did not provide enough info in the first question (apologies!), but the USB port is going to be used / occupied with 4G LTE modem (IK40 specifically) that is going to be WAN default gateway, so there is only an option to put some usb hub and po...

webor

I want a combined outdoor setup and planning to take BaseBox2 and to put RPi ZeroW in its "free pocket" -free space where the G-LAN and USB ports are. I am planning to buy one PoE Splitter to extract the power from the UTP cable for powering RPi. My concern is, if this PoE Splitter will &q...

webor

Apologies for reposting? Has anyone ever had similar experience, with any other hardware, that with the same MikroTik version the same specific hardware thing (for.ex. 3g usb...) fully works on one platform (for.ex. x86) and in the same time it is not even recognized on another platform (for.ex. mip...

webor

Hy! Thank you for this post, It was very useful for me. Regrading the setup of routes in this example, and from what I have experienced testing this, for me those two blackholes are not needed. I am using latest bugfix v6.38.7. For me everything works perfect without blackholes routes. The only open...

webor

I have noticed in the latest edition of the Manual:Peripherals that Alcatel IK40 was tested and works on v6.41RC11 but from the resultes that I have tested it perfectly works even on latest bugfix for example 6.38.7 but only on x86 platform (tested on vmware) and in the same time on mipsbe (tested o...

webor

I can confirm that proposed solution now completely works! THANK YOU very much on your valuable help! The only thing that was needed to be added was: /interface ethernet switch vlan add ports=ether1,switch1-cpu switch=switch1 vlan-id=100 There is only two open questions for me now regarding this con...

webor

Add vlan 100 in the mt switch and tag only outside port and cpu. Now that 100 vlan will be sent to RouterOS with vlan id 100. I think I understand. Seems that sid5632 provided CL for that if I am right. Add vlan interface 100 to bridge1 in routeros I do not understand what to exactly do with this. ...

webor

Thank you for getting involved. Yes, I apologize for not being clear. In my head the topology is known, but, as you said, it would be good to give whole info from my side...

. Apologies once more.
Here is a diagram:

webor

I would kindly ask for some help. My ISP provides me optic connection tagged with three VLANs: vlan 100 for internet (pppoe), 101 for voip, 1500 for iptv. I want to configure that my MT is directly connected to the ONT (GPON) and that it: 1.) gets public ip internet connection with pppoe on vlan 100...

webor

that is because more secure algorithms are picked first until supported protocol by client is matched. Thank you on your prompt response, appreciate. I have solved the problem by choosing the Maximum strength encryption under "Data Encription" in Security Tab of the connection on the Wind...

webor

After upgrade to 6.34.6 I encounter some error logs for IPsec when connecting from client machines (Windows 7, Android 6) to Mikrotik L2TP/IPsec server. The IPsec Proposal allows aes-256-cbc , aes-192-cbc , aes-128-cbc , and 3des If Windows connects ( aes-128 ) there is error ipsec,error key length ...

webor

Can someone experienced just take a look and provide some feedback regarding my proposed configuration, is this the proper and best way? Or should I do it with bridging maybe? Or..? tnx in advance!

webor

Normis, thank you very much on your suggestions and help. At the moment I am using bug-fix 6.32.4 on my RB951G-2HnD and I did not know that in 6.35.2 there is a new package. Is it safe to use it (I am asking because this it is not included in the standard package but the "all packages")? W...

webor

Dear All, I would kindly ask for suggestions about a planned upgrade of my existing home network. Existing core router for my network is RB951G-2HnD configured as main gateway and vpn server. Configured are one ethernet subnet and wifi subnet for home clients as well as third subnet for vpn connecti...

webor

I am apologizing to quote myself, but this situation looks like "twilight zone" to me. I am kindly asking if somebody from MT support can just say is this true or false? I am not sure, but I think that 204.16.170.40 is somehow hard-coded into MT? Mine Non-authoritative answer for nic.chang...

webor

My location is PK [Pakistan]. Non-authoritative answer: Name: nic.changeip.com Address: 170.178.190.165 Ok as your requested, I checked ddns at following Location right now and working OK. (I provide network support to various operators so i have there rb access) - PAKISTAN > checked around 5-6 dif...

webor

Here is the changeip DDNS script i am using. so far its working fine as of 8th-dec-2015. (I am using it on few 5.20 x86 versions, and mostly at 6.33.x versions) :local ddnsuser "DDNS_USER_ID@hotmail.com" :local ddnspass "DDNS_PASS" :local ddnshost "MYDDNSHOSTNAME.dns1.us&qu...

webor

If anyone with more experience can help, I would really appreciate it! THNKS in advance. If you're not using their server for anything else at the moment of your update, you could add a dst-nat rule to nat the old IP to the new one.... then disable or remove that rule as soon as the update is compl...

webor

yes, it is a new error! It is a result of: If you specify dns-server parameter dns-server=XXX.XXX.XX.XX then Mikrotik requires that you also specify zone=somezone.com parameter. If you omit the zone parameter while specifying the dns-server then the error is "parameter missing" . I have te...

webor

i also faced this issue for about 2 weeks, but now its working. Dear Cicserver, Can you please say if you changed something in the script or the problem resolved without your intervention or some 3rd solution...?? Thank you very much in advacnce! Cmon , a little script digging is not that hard. Try...

webor

I am using MikroTik as a core router for my home network in great combination with changeip for long time but since around 28/11/2015 the changeip does not updates any more. I am using this script: http://wiki.mikrotik.com/wiki/Dynamic_DNS_Update_Script_for_ChangeIP.com It was successful for a long ...

webor

This is weird, sometimes the wireless card in the laptops have it disabled and you need to go to driver setting and enable use of 20/40MHz. Mobile phones also should not have any issue with it as its standard. My iPhone 4S and Galaxy SIII did not have any issues as far as I remember.. What is your ...

webor

Inox thank you on your suggestion! Between RB951G-2HnD vs RB951G-2HnD what is better for my? I have local hosue network with HTPC and NAS on LAN, and three laptops, tablet and two mobile phones on Wifi. Price difference is not so much. Could I achieve full 100Mbps with RB951G-2HnD - without gigabit ...

webor

I have RB433 with R52 802.11 b/g wifi card for my home LAN. My ISP gives me new high speed broadband for my home. Till now I had 4/0,5 Mbps adsl link, and now I have 100/20 Mbps. Till now ma R52 was enough but with this new 100/20 Mbps speed my R52 now is a bottleneck for my wifi laptops that have 8...

webor

Can someone please help a little bit? Is Mikrotik script update for Changeip works for you other people? Am I alone experiencing this problem or is it widespread? I am using latest MT and this script http://www.changeip.com/mikrotik/ and everything was brilliant until aprox. 1 month ago when all the...

webor

For last 3 days the problem is again present. Time is 2 min. Hmm
Yours?

webor

It seems that the problem was at Changeip side, because my setup at MikroTik side did not changed and last 3 days everything is back to normal, so the problem was at changeip side and now it is solved.

webor

Today I can see that error log has changed to "ddns error timeout". Problem still persist but error log has changed!
What is the situation with other users? Please reply share your experiance.
tnx

webor

Hy. From the beginning of MT 5.x I am using the script that is tested on MT3.x and MT4.x that is published on the adress http://www.changeip.com/MikroTik/ It worked great for me until 2 days ago. Since then I can not update IP adress and there is an error in MT Log: ddns error connect error. I also ...

webor

Yes off course, you can PM me, but I suggest to post it here because here are lots of great experts that know much more then me so they can be more helpful to you and also to me. I have success without any modification to IPsec at windows client side, just default l2tp/IPsec client setup and enterin...

webor

What version of MT ROS you have? I have succeeded with version 3 of MT. Please update to the latest stable version and try. You have to define L2TP server and secret (your username and password) in your MT in PPP and also you have to define IPSec peer with adress 0.0.0.0/0 (ATTENTION!: not 0.0.0.0 ,...

webor

Ok. I see that there is no help about configuration of that zyxel router to work with MikroTik. I am stuck and I need to solve that so I think about buying small MT (eg. RB 450) and put that as a router in my boss house behind that zyxel that will be adsl modem (bridge). Possible configuration: inte...

webor

I have tested with old adsl router at my boss place without sucess. Today I tried with new adsl router Zyxel P-660HW-D3 that supports vpn passthrough option but again I have no sucess. I tried with NAT-port mapping in that adsl router and with opening of ports in the router but there is no success. ...

webor

The router may have VPN Passthrough that needs to be disabled. I never had a problem using NAT with ipsec unless the passthrough wasn't enabled. Tnx for your suggestion!! To be honest, I didn't understand correctly. "VPN passthrough that needs to be disabled" - I understand that VPN passt...

webor

Hilton, tnx a lot for your support and sharing knowledge!! If you install a Mikrotik router at the big guy's house, then you can create a LAN to LAN VPN which is permanently on, although this is most often set-up without the IPSec part, just using MPPE 128 stateless encoding of the L2TP connection. ...

webor

Hilton, thank you on your response!! I need to use l2tp/ipsec because known security vulnerabilities of pptp and strong security policy in my company. So, you think that at a server side is everything ok with configuration for NAT-T, and that a router on client side is bad? This lousy router with NA...

webor

Does adding stpbridge-legacy, add another bridge icon in winbox? because i saw that package and made me think that is what it is...... Yes, I had the same issue (two Bridge icons in winbox) with v3.13 and newest v3.17 and after I removed (uninstalled) stpbridge-legacy package everything was back to...

webor

Hello to all! This is my first post here. Best regards to all of you. We recently bought MT (v 3.17 is up) and implemented it in our office LAN as a gateway for LAN and as a VPN server for remote access to our office LAN. I have to say that this product is great, especially comparing the price and w...

Search found 97 matches