MikroTik

derr12

Its been a pretty mixed bag for wifi access over mikrotik for us (great for small-scale, not so great for density). Nstream/nv2 ptmp and p2p has been good so far. As a basic router for pppoe or nat/firewall, and rate limiting... very good. Switching has been good. Media converters and fiber stuff , ...

derr12

I've started seeing this under heavy load. Also seeing large amounts (about equal to wan) traffic on the bridge interface that is layer2 traffic. Seems to behave itself quite well on the ccr1016 till it's 50mbit+ of wan traffic. See massive CPU spikes and caps drop off due to timeouts. Started remov...

derr12

Im still having background images disappear from the disk at random times on X86 (xenproject hypervisor) on rc30. have to re-upload one or two weekly.

derr12

Honestly id stick with the windows server for now. The new version is having "growing pains". i Think the last stable version was 6.35.1?

derr12

a later update has better cpu utilization, anywhere from 20-30% use on the second core. first one will occasionally peg. e-mail up/down notifications are still broken, and it's still pretty unstable. background images disappear for no reason from time to time and i have to re-upload them. a few more...

derr12

Oh, and for some reason my background images randomly dissappear from the disk drive. i have to re- upload at least 1 jpeg a day.

derr12

my ROS 6.37 x86 is more unstable than Charles Manson on crack. e-mail up/down alerts have broken text, network transfer is slow and for some reason, it shows like a hundred panels open ( I dont think its closing them properly). have to restart the client constantly because it starts glitching out. i...

derr12

don't forget to forward the sip ports.

derr12

I just wish they would quit releasing broken Dude servers in the current release tree. leave broken versions in the RC builds please! Its so broken it makes me yearn to go back to the windows server.

derr12

any progress on the notifications bug?

Service ping on x is now [Service.Status] ([Service.ProblemDescription])

derr12

Im using a pair of opteron 16 core chips in my xen environment. 2.3ghz i believe. i have it on a 8 disk raid 10 array (10gb assigned to dude) and it is backed by 1gb of LVM cache on a super fast PCI express intell SSD. Graphs are fine,. ive only assigned 1gb ram and 2 cores. it only uses about 250me...

derr12

Im using an X86 license on the dude on a xenserver VM. gave it 2 cores, dude often hits 100% on a single core, but not too bad. monitoring 450 or so devices fairly reliably. The latest current release is better on CPU usage, but the up/down notifications are broken (dont get me started). Overall, at...

derr12

service status notification bug still present in a current release? Im a little suprised that the mikrotik brass let this bug out of the RC builds and into a current release. it's kind of a doozy for a monitoring system. ETA on a fix for that?

derr12

also all the backgrounds from previous version are gone and im unable to upload images with any method. cant even drag files into the image directory with winbox.

derr12

in r34
attention.png

also transferring files is like forever
trans.png
am I missing something

RC38, and im having issues with event logging as well.

have we found a solution for this yet?

derr12

Hi there, Ive noticed something now that ive deployed my usermanager based pay as you go hotspot to the wild. If a user creates a user in the signup page, and then proceeds to go to the paypal payment screen, and then backs out or doesnt finish. The user-manager will no longer process payments (acce...

derr12

Im having a similar issue where a user is inheriting the limitations from a profile not assigned to it. sometimes takes a day, sometimes a week. I have submitted to support my supout.rif file this week after they confirmed seeing the issue when i granted them access to my CCR. you might want to do t...

derr12

Just a heads up guys. Paypal payments via usermanager are broken in 6.36 on x86. IPN responses time out on 6.36.
Also, you cant downgrade from 6.36 in the traditional method. you have to select and older version (via bugfix) in winbox.
It never attempts to install packages during bootup.

derr12

bumping this thread because i have also been unable to get this working right.

derr12

I was wondering since it isn't fleshed out in the manual. What is the difference between create enabled and create dynamic enabled when provisioning. Visually, If the CAP is not connected to the system, create dynamic enabled devices disappear from the Interfaces tab. In create enabled, they stay...

derr12

yup no difference if i activate the profile manually. still seeing my free user with the right profile name, but limitations revert to the staff speeds.

derr12

So ive noticed that when one creates a user in usermanager, the assigned profile does not activate on it's own. you have to open the user after you create it, go to all profiles and then activate it there. Otherwise after a little while, it gets goofy. Here is my setup. 1 - free unlimited time pr...

derr12

I think hotspot might work for this.

you can setup the hotspot and only authenticated users can go out to the internet at large, but then you add the websites you want allowed for everyone in the walled garden. I did this for a church and it seems to work well.

derr12

AH scratch that. looks like you have perminant users. i was thinking about pay as you go.

derr12

User manager + hotspot does this really well out of the box with minimal screwing around.

derr12

derr12

bridges are OK, but make sure you tell the bridge to use the firewall tho.

derr12

Im clearly missing something fundamental about these CCR's.

lan interfaces are bridged. sfp1 is the WAN port. users are on the 10.0.0.1/24 network.

derr12

hey guys, Ive had no problems with other routerboards, but for some reason i cant get a CCR 1016-12s-1s+ to graph at my netflow aggrigater. Ive used this setup on 1100's, rb450's, 951's, you name it. im using it to moniter bandwidth usage for lan users on my networks. never been a problem till i tri...

derr12

RB922UAGS-5HPacD 5ghz radio transmits @ 17dbi when controlled by capsman. In capsman tx power can be set auto or manually, doesn't matter. TX power at radio is always 17dbi.

Oddly if you shove a 2.4ghz miniPCI radio in there, it plays nice with caps man.

Bug is present in latest RC build.

derr12

Is there any word when/if ANI will get support in capsman?

derr12

Word from mikrotik that ANI via CapsMan is not supported at this time.

derr12

you may need to specify mac addresses in your provisioning for 5ghz radios so that it can provision the radio under the right wireless profiles. Im about to explore this "trouble" myself for a capsman project.

derr12

Hey guys, maybe im just blind, but i cant seem to find out where to enable adaptive noise immunity on capsman controlled interfaces. Cant seem to find any mention of it in the documentation either.

derr12

from your description it sounds like your radio might be flaky, if the SSID comes and goes. what is your wireless CCQ showing? Also might be a good idea to do a frequency scan as this could be interference related.

derr12

one more bump. seems you can refill by buying another profile from the user login screen under profiles. so there you go. you can indeed self serve refill expired accounts.

derr12

So here is what im trying to do. Mikrotik capsman/userman/hotspot controller in the head-end in a canadian town that manages strand mounted AP's all over town. Pay as you go, self serve signup for internet access. I have a prototype setup that is currently using paypal. i have gotten the scripts tha...

derr12

Im importing a dude database from v4b3 to the latest release candidate. it failed the first two times @ 99% with "action timed out" on the third attempt it worked.

derr12

I got an answer from mikrotik support. They are planning this feature in a future release. Possibly in the next one, more likely when ROS 7 comes out.

derr12

Bump. Anyone got any ideas about refilling expired accounts via a self serve option?

derr12

got payments working.

still need to figure out how to recharge users.

derr12

Got this working, it does need an SSL cert to function.

derr12

Im on 6.33.3 and I ran this latest script. It doesnt seem to have any readout in the logs or terminal in winbox when executed. no errors or nothing.

How do i know if it's working or not?

derr12

well ill have to wait to fix my paypal payments on signup first. progress in another thread. Did MT remove the usermanagers ability to recharge accounts in the last major revision? documentation makes reference to credits which are now no longer in UM.

derr12

I think part of the problem is that it's creating users under the root user "admin" i cant find any setting that modify's this behavior

derr12

Hey guys n gals. I have setup user manager on a test unit. User signup with paypal works, user gets created under a customer ive created, paypal accepts money, but no profile gets applied and i cannot log into the hotspot with the user it created. I tried manually adding a profile and activating it ...

derr12

Hey guys, this is my first foray into user manager. Love it so far. what i haven't been able to figure out is how to let an expired user recharge his time in a self serve fashion. (payment gateway is paypal) Alternatively, if i cant do that, how would i have the self serve option auto generate a use...

derr12

Actually after reading some of the documentation, our existing daloradius VM should be able to be used for this. The configuration of it looks a little bit like too much heavy lifting for me. Let me know if you are interested in contracting for this job.

derr12

Pm me your price for a finished system if you want. I have a vmware hypervisor at the moment, but im about to migrate to xen.

derr12

Feel free to post your info here, someone else might be looking for a product too.

derr12

having deployed several hotel wifi setups, I have found that 99% of connectivity/slowness issues are caused primarily by Interference and weak clients due to dead zones. Best practices ive found so far. 1. ban all personal wifi networks from the building. 2. frequency plan so you dont self interfere...

derr12

Not really, nothing that integrates with ROS. closest ive seen is Whats up gold, but it costs an arm and a leg.

derr12

Hey guys, We just purchased a cable system in a resort town. I inherited a cloudtrax setup that is leaving a lot to be desired. 6 or 7 ap's. Id like to replace it with mikrotik hardware. I wondering if anyone has some suggestions for self serve payment systems that would include strand mounted/power...

derr12

still too hot. shoot for -65 between your links.

derr12

Ive seen similar fits in 5ghz in station mode with zero noise in good signal in multiple deployments. It was fed from a mikrotik AP that serviced both wifi clients and a station bridge in both instances. I had no luck solving it. I ended up putting a dedicated AP just for that station bridge and it ...

derr12

ah that makes sense. I should make the master port 2 and add 1 and 2 to the bridge so it crosses the CPU before it hits the internet.

Not sure how i missed that.

Probably because I never use the switch chips in any of my deployments, Im an all CPU kind of guy.

derr12

dude is abandonware, tho i still love it. don't expect a fix until they announce plans to start development again. From what ive heard, they are not planning on doing it.... ever. too bad cuz i love me some dude. I would pay into a kickstarter or whatever gladly to see development resume.

derr12

Hi guys, have an 1100ahx2 running 6.27. Have it configured as a switch with a firewall to filter traffic to some web hosting servers. I noticed that my rules for blocking were not being followed by some of my machines. Turns out it was the machines plugged into the first switch group that were not g...

derr12

Ive been testing freeradius + daloradius to be used for AAA. The rate limit feature works as advertised, I noticed there are some perimeters in there to limit bandwidth usage on PPPOE connections. "limit bytes in/Limit Bytes out" is the peramiter on the mikrotik that it changes via radius....

derr12

ah thats got it, thanks.

my problem is that i was trying to set one at a time instead of both. it kept resetting the values to default

derr12

Ive been trying to figure out how to enable jumbo frames on my setup. running an esxi host with intel gbe cards to a realtek GBE card. my hardware setup should saturate a gigabit link no problem but im still getting around 400mbits between these devices. Jumbo frames enabled at both ends. still cant...

derr12

I really like DMA, unfortunetly i have a vast wimax network that needs authenticating. at this time DMA does not have support for wimax authentication. hopefully it's just a matter of time as freeradius does have a wimax plugin. Aradial wanted 10k for licenses... so they are out. Any experience out ...

derr12

I have it working in the field. Im not sure why it was giving me trouble... i probably forgot to clear arps when i changed it over.

derr12

using different router-boards and client bridge works fine. nuts....

derr12

And of course it works just fine in station bridge mode here with different hardware.... ill have to tinker some more.

derr12

in the lab, when i tested it with station bridge mode, it worked for clients off the 2nd access point as expected. However, when i connected my laptop to the first AP, I was no longer able to see the 2nd access point on the network. It appeared to have broken the bridging to the second AP as soon as...

derr12

Ive run into an issue that i did not expect with my setup. I had a dead zone that i had to service in a hotel hotspot network. here is the layout; ccr router (hotspot, dhcp,firewall) -> 2x MT switches (bridged) -> 11 MT AP's (bridged) -> wifi Clients + 1 MT repeater(2ghz radio in station psuedobridg...

derr12

so looks like if you have mixed brand clients in the first AP, set station bridge on the other, bridging breaks to the second. So looks like im stuck with station psuedobridge I tried using station psuedobridge clone, but unfortunetly, I was not able to surf off the first AP in that circumstance. I ...

derr12

I tried your first suggestion on the bench, but I was not getting any data thruput to 802.11 clients. I wasn't sure why since all ap's were mikrotik.. Now that I think of it, it's possible I was connecting my station radio to a ubiq router, ill retest tomorrow and see. The networks will be named dif...

derr12

So i have a hotel that i needed to use a repeater in to reach a deadzone where running ethernet was not possible. I have a ccr router running dhcp and hotspot services for me, that goes to an RB2011 acting as a switch, which goes to a 912 dual band AP. Acting as a client radio on the 2.4 band a seco...

derr12

Im going to be demoing free radius and DMA RADIUS MANAGER. unlimited licenses are just 200 bucks. Looks like they support paypal as well as other instant access payment methods.

Will post my results.

derr12

I believe manage engine netflow analyzer demo version lets you do this for 1 router for free.

derr12

what kind of cpu usage are you seeing?

derr12

still shopping around for a good cheap solution. Ant testimonials/advice appreciated.

derr12

Hi guys, i have a need to fix a dead zone by making a repeater setup. Right now i have 2 912 outdoor units. 1 is acting in AP bridge mode with both interfaces. The second device, the repeater is connecting to the first AP on the 2.4ghz network In station psuedobridge mode. The second radio is a 5ghz...

derr12

What about free-radius + Hostbill + paypal. Anyone had a chance to try these out for hotspot payments?

derr12

I used a ccr spf router to feed some hotels and i used both some random 2 way transceivers and also the mikrotik brand ones and it was seamless. Tho i was going from one mikrotik device to another. I didn't try mixing a media converter on one end and mikrotik on the other. might have something to do...

derr12

I would imagine a rubberized paint would keep it un-rusted during the duration of it's lifespan. Like that rock-chip stuff you can get in the can.

derr12

Hey guys, in the new year one of the projects we want to take on is getting into the business of offering canned payment modual services for hotels and the like. we want payments to go directly to the customers chosen bank account. We have used aradial with a payment modual and moneris for all our p...

derr12

Id bet money that if you pulled the Lid, you would find blown/bulgy caps.

derr12

I would literally eat a pine-cone if it meant the release of an RB2011 type chassis that had dual band 2x2 wireless capability.

At the company I work for a the missing dual band Soho model is the ONLY thing keeping us from putting mikrotik products in our end users hands.

derr12

Add these rules to your filter, but change the source address to your intended target. should do a pretty good job of killing a lot of p2p /ip firewall filter add action=drop chain=forward comment="TORRENT No 4: prohibits download .torrent files. " content="\r\ \nContent-Type: applica...

derr12

I eliminate a lot of these by simply turning off the access methods im not going to use.

In IP - > services. If you dont use ssh and are winbox only like me you can turn off everything except winbox. easy-peazy.

derr12

This should get you there, foudn it in the wiki.

http://wiki.mikrotik.com/wiki/Wireless_repeater

derr12

Hmm ive neve seen a switch cause that kind of problem before, maybe try forcing duplex on both the switch and mikrotik ports? there isnt any leftover vlan configuration from a previous deployment on the switch is there?

derr12

For monitering ive assigned the management IP's of the AP's as non-routable IP's on the mikrotik wan interface so i dont need to waste a public IP on each for up/down status monitering. Then you simply creat a nat rule to forward all traffic from your monitering server to the non-routable (the dude,...

derr12

yeah you are better off using the Proxy + whitelist if you only want to make some services available. It will block everything else. Can also setup firewall rules to allow only specific ports and block the rest. As far as limiting speeds go, can either use the hotspotor a simple queue to limit the b...

derr12

The 1100x2AH would be the way id go. You wont have enough memory in the lower models for any sort of queueing with that many users. They are also somewhat reasonably priced. Ive got one doing hotspot/dhcp/queueing to 25mb/w5mb and it barely breaks a sweat.

derr12

Im going to give nstream dual a go, The failover is nice, the speed is more important tho.

derr12

/queue type add kind=pcq name="3m per user down" pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-limit=35 pcq-rate=3M pcq-src-address6-mask=64 pcq-total-limit=10000 add kind=pcq name="1m per user up" pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-limit=35 pcq-ra...

derr12

The OSPF interfaces i made are showing down and an unknown area. Thats probably my problem right there, what did i do wrong in the guide? i created them as they said.

derr12

Hey guys, ive been playing around with a couple 912 units. using the built in 5ghz radio and a second 2.4ghz radio. Ive followed the guides here; http://wiki.mikrotik.com/wiki/Setup_Dual_Wireless_Link_with_OSPF I find that i can disable one radio and it automatically fails over to the second, but I ...

derr12

alright, matching antennas it is. orientation doesnt matter then it will just change the horizontal plane of the second antenna and not give me true dual cahin unless both horizontal beams reach my target then, correct?

derr12

you could could use pptp to connect to the other router, its probably easier to just use more capable hardware tho. The 1100x2AH is quite affordable and has lots of gusto.

derr12

I guess the thing to remember is using bridging will limit you to the 1gbit limit between the CPU and the bridge. Might become an issue in some installs. Also Bridging uses more CPU Rescources. I use bridging almost all the time because of how conveniant it is, but I also way overbuild on hardware r...

derr12

you could set a firewall rule to limit the number of udp and tcp conenctions per client as well. It's possible someone is maxing out the radio's maximum packets per second abilities. Last time I saw this in the wild it was a low/noisy signal wireless client who was connecting at low rate downloading...

derr12

Hey guys, I have an interesting problem. I guess my decision on how to procede hinges on a couple fundamental holes in my wireless theory knowledge. If I had a dual chain mikrotik router with external high gain antennas and getting the most thruput possible was not a priority could I do the followin...

derr12

Hey guys. Im using the hotspot to authenticate users for a hotel network. Generally it works fine, ive set my timeout values so that no matter what a user only has to log in once every 24 hours. Ive had some odd behavior from a couple users that will simply not load the hotspot login page no matter ...

derr12

is it possible that you have "allow remote requests" enabled on your dns settings and someone externally is running dns shinanigans thru your gateway overloading both your layer 7 and dns services for the same reason?

derr12

I think this is traffic from the pushdo botnet, because this is an applciation layer attack, layer 7 rules may be the only way to catch this on a hardware firewall, the only other option is to install mod_security on each box and block it that way. Was hoping to avoid having to rely on the servers t...

derr12

I have since learned that Layer 7 regexp's are written in perl. I have no experience in such things.

http://perldoc.perl.org/perlre.html#Regular-Expressions

does anyone have any expertise in perl that can help a brother out in making this layer 7 rule?

derr12

Hey guys, Im trying to filter a probing attack from reaching all my webservers. The offending line in my server logs looks like this; POST / HTTP/1.1" 403 1296 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Where I have failed to accomplish with filtering based on p...

derr12

That is a TON of layer 7 rules to process. You might want to try avoiding using layer 7 at that massive scale on that hardware as it is hugely cpu hungry. you might want to try cerating a QOS tag for other traffic that is easy to identify, dns, voip, http and e-mail and such. give them a higher prio...

derr12

any experts wanna chime in with a yay or nay?

derr12

sounds like the radius server is sending an invalid radius attribute. could be the radius serverhas the wrong nas type selected or is sending some extended radius attributes to the mikrotik that it doesnt understand.

are you using free radius or aradial or something?

derr12

pretty sure if you set the priority (in the advanced tab for the simple queue) for the individual higher than the subnet it will behave as expected.

derr12

You could always use PPPOE to each user via the same username and password. The user can enter the PPPOE information in thier own routers or devices, that way it bypasses the hotspot but still has all that radius accounting stuff you love. anyone who isnt connecting via PPPOE would still have to pas...

derr12

Ok I have implimented the filter as suggested, with connections getting marked and then dropped in the firewall. It is blocking a large number of the botnet "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" apache requests, however im still getting some thru. I suspect this is beca...

derr12

bump. Anyone know if this is possible?

derr12

im honestly not even happy with how the dude operates as an agent on routerboard hardware. Love it, but keep it on x86 harware where it belongs...

derr12

This is not something ive tried personally but... presumably you would have to make two sets of mangle rules, 1 set for each WAN interface. If you are load balancing based on source/destination IP address lists you can make mangle rules based on the same IP subnets and then make simple queues for yo...

derr12

Hey guys, I was wondering. This current setup requires that the user go to an HTTP page in order for the authentication to take place. Is it possible for this to work if a users homepage is an https page? Currently if we go to an https page first it never hits the authentication and the user gets no...

derr12

Im my experience, i would create your speed "tiers" in simple queues. you wont need to set mangle rules for for individual speed limits. example PCQ queue type to set a 3m/1m package; /queue type add kind=pcq name="3m per user down" pcq-classifier=dst-address pcq-dst-address6-mas...

derr12

As for the minimum bandwidth, you will want to create a simple queue and an additional PCQ queue type Here is what I use in a hotel, an RB1100 being a controller for 11 bridged wireless ap's. Tho im doing some shaping, its a slightly more complicated version of what you are trying to do. My mangles;...

derr12

Remove the limit on your queue types, the queue tree will be the one handling your speed limits. Other than that it could be that your packet marking is not working as expected. I usually just mark traffic based on the source/destination IP or interface, for example; 26 ;;; Mark all remaining Upload...

derr12

cuz clouds are fluffy, and capable hardware makes me feel fluffy inside.

derr12

yup just limit speed on the WAN port to 10mbits. The other queues should level out as you illustrated.

You can also do this with queue tree and mangle rules, but simple queue is much easier.

derr12

if money is not an issue, go with the 36 core ccr.

The 12 core CCR should be able to handle everything you can throw at it @ those speeds tho.

derr12

fewi to the rescue again. Runs like a champ when i tried this.

May a squadren of sandwitches find thier way to your mouth.

derr12

running version 4.0 b3 by the way

derr12

hey guys, for a long time i had the dude sending e-mail notifications to 2505551234@txt.bell.ca which would then send a text message to my phone when something goes down. That stopped working recently for no appearant reason. I checked and when i send a test e-mail to the same address in my e-mail c...

derr12

Hi guy's Im building a firewall for a cluster of webservers using a routerboard. I was building my list of rules when I had a thought. In the event I need to block something specific like, during a DDOS, what would be the most efficient way (cpu wise) to block specific traffic. For example; If i wan...

derr12

I think I might have figured it out.

I created a seperate subnet and dhcp server per interface, I created my mangle rules based on the source and destination IP's.
The queue tree seems to work as intended on the global parent.

derr12

double check and make sure your snmp is allowing the correct networks. Ive noticed cacti doesnt like un-named snmp sources. In winbox make sure the contact info and location needs is filled out as well as the community should have the appropriate subnet showing for devices you want to allow access, ...

derr12

Hey guys, Im trying to do class based shaping per Ethernet interface. Ive done this in a bridged setup a hundred times, but creating mangle rules/queue trees that work in NAT mode on seperate ethernet interfaces eludes me. Ether1 is my WAN port, Ether 2-5 are bridged. The end game is to have seperat...

derr12

Boba Fett, guards my rb2011 setup with linksys Voip adapter. I have an rb751 as a wireless bridge feeding my entertainment center in my living room.

I cant take pictures of the 30 or so routerboards i administrate at work so this will have to do :p

derr12

if your hard-drive is shot, you should be good provided A; You wrote down your license key and B; you have a backup of your configuration. If you dont have your license key anymore you will probably have to buy another license. You could beg support@mikrotik and see if that gets you a new key, it di...

derr12

i found where he actually sells his script. It's this page; http://store.wispgear.net/p260/RouterOS ... 4jekbd6l05

derr12

looks like it behaves properly with all 4 chains. Case closed!

derr12

found my answer in the manual; antenna A is for internal antenna's. should all 4 chains be active still?

derr12

We love the dude! If developement started again, we would donate in a heartbeat. Fire up a Kickstarter campaign! guarenteed youd get some cashola for the project.

derr12

you forgot the "add" in front of your comment, thats why it fails on the syntax.

derr12

Yes that's correct, the public IP is the dst address.

an example of port forwarding 49000 would be;

add action=dst-nat chain=dstnat comment="Example SIP" disabled=\
    no dst-address=*publicIP* dst-port=49000 protocol=tcp to-addresses=\
    *localIP*

derr12

Hi guys, im wondering what the recomended setup for this router is.

This has 2x2 mimo right? So should be antenna b - both chains enabled on rx and tx right?

derr12

not going to bother, release notes make no mention of bugs that sound like this.

derr12

bridge the lan ports and put the hotspot server on the bridge?

derr12

you can also use snmp polling on a mikrotik as well.

derr12

Butch evans, is generally considered the de-facto expert consultant for wisp QOS. He sells a very complete set of scripts for just such a job. we used an early version of his rules to get started.

The price for his script is reasonable as well.

http://www.butchevans.com/

derr12

or if you want to just add my example; /queue tree add max-limit=11M name=Uploads_Full parent=ether1 priority=1 queue=default add max-limit=38M name=Downloads_Full parent=ether2 priority=1 queue=default add limit-at=256k max-limit=38M name=DN_priority1 packet-mark=p1_down parent=Downloads_Full prior...

derr12

just in each of the child queues. i use this format in my transparent shaper; Flags: X - disabled, I - invalid 0 name="Uploads_Full" parent=ether1 packet-mark="" limit-at=0 queue=default priority=1 max-limit=11M burst-limit=0 burst-threshold=0 burst-time=0s 1 name="Downloads...

derr12

super keen on this products release, Any word on an expected ship date?

derr12

I havnt tried it yet. Ill schedual a maintanance window and give it a try.

derr12

Hi guys, I have deployed several of the CCR 16 core routers as transparent traffic shapers on my network. Generally they preform admirably, however one unit is misbehaving. After a month or so of steady operation, we are unable to reach network destinations past the first ethernet port. Rebooting th...

derr12

Im not sure how to impliment this without using the hotspot server. What I would like to see is have a user connect to an unsecured wireless AP, and on the first lanuch of a browser re-direct to the hotel website. After the first load of the page, it should allow browsing to anywhere without re-dire...

derr12

Eagerly awaiting the specs for the cloud router switch. Im eyeballing it for hotel installations. Any idea when it will be released for public consumption?

derr12

Just to make sure, at first glance it appears that the ccr1016-12g does not have a switch chip, correct?

derr12

You want to use the firewall to tag traffic types (mangle rules) and then create a queue tree in order to prioritize by class. This is a heady subject, you will want to read the wiki and then google some examples; http://wiki.mikrotik.com/wiki/Manual:Queue http://wiki.mikrotik.com/wiki/Manual:IP/Fir...

derr12

A little about my setup before i get started on my question; Lets say I have a ROS6 routerboard running as a NAT, providing dhcp and dns services to clients like so; Wan - MT - bridged Motorola AP - dhcp client radios ............. - bridged Motorola AP - dhcp client radios ..............- bridged M...

derr12

+1 for this feature. That would be dang handy to pull backup files via the dude.

derr12

this may seem assinine, but make sure you havnt got the dhcp client on. ive seen 192.168.x.x addresses get assigned to my wan port periodically and that was the reason.

derr12

change the mangle chain to pre-routing and see what it does. In theory there should be no difference but i think forward might be after the queue tree and before simple queues in the new ROS6 packet map.

derr12

Odd.. Ive used plain jane PCQ via simple rules minus the mangle rules with speeds as low as 512k/256k before without issue... someone else will have to chime in, im totally stumped.

derr12

We use radius to authenticate Ptmp wireless clients. I use aradial radius tho. You place the users in groups(home, business, etc). When the pppoe client asks the router for access it sucks down the radius attributes (including what speed they should get) and makes a simple queue automatically. Consi...

derr12

The other thing you could do since you are using PPPOE... what does your pppoe authentication, radius? you can set user speeds via radius attributes too. All they do is dynamically create a simple queue tho.

derr12

That was true prior to ROS6. QOS has been re-done in version 6. Simple queue are processed as fast as queue tree's now, appearantly you can double QOS now.

I think PCQ got a performance boost too.

derr12

Probably this: http://www.lolbrary.com/post/38107/i-can-typing/

derr12

That's a new one. Maybe try making a simple queue instead of a queue tree and see if it still does it? /queue simple add disabled=no name=1meg queue=1m_upload-default/1m_download-default simple queues are supposed to be like 8 times faster in ROS6 so usinga simple queue instead of a queue tree for t...

derr12

rb2011 is probably even overkill. I have a whole hotel on 10mbit fiber connection being fed by an RB450g with shaping and simple queues that doesnt break a sweat.

derr12

PS If you dont have your subnets organized like suggested above then you will have to use packet marks and your address list in order to place them in the correct simple queue. /queue simple add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="" \ direction=both disabled=yes d...

derr12

Connection marking is only required if you are going to use Queue tree's. The easiest way to do this would be by sorting your speed classes into different IP subnets: If your unlimited users are all on the same subnet you can simply not include them at all in your rules. so all you really need is; /...

derr12

Thanks for the consideration; Yes, the way i see it we would only need to start checking queues after ether1 hits 60mbits. Forgive my psuedo scripting: schedualer can execute the first script every 30mins; If ether1>60mbits then run script "check users" which would then run; [max-limit (in...

derr12

Im trying to sell this as a NetEQ replacement which uses a penalty-box type approach. PCQ ensures fairness by equally sharing whats left over amungst all users yes, but what we have to gain with the penalty box idea is an overall bandwidth increase for the other non-penalized users. It is a small bu...

derr12

The web interface will give you interface stats. just make sure /IP services www is enabled and then fire up a browser to the router IP and click on graphs.

derr12

I find my dhcp server assigns ip's at seeming random ip's The lease is renewed after a disconnect/reconnect or when the lease expires. You can set the dhcp lease time in your dhcp server to whatever time. set a short lease time and your idle timeouts with remove the lease immidiatly. I assume you ar...

derr12

It doesnt look like standard logging will output what you are looking for there is a firewall logging option, but it doesnt include the connection tracker it seems. The mikrotik can export the raw data you need via netflow or accounting, but you need another box to organise all the data for you. Jus...

derr12

I got to thinking, having a bajillion simple queues for a script to check might not be the way to go... its messy and they execute in order. What if the script watches the wan link bandwidth. If it reaches 90% of its capability, the script would fire up torch and watch for streams to/from the local ...

derr12

After talking with Butch, it sounds like the only way to manage this will be with simple queues. The problem with simple queues is that they execute in order.. things will get messy and slow if I have a thousand simple queues. Im thinking somehow I get a script to execute torch and moniter streams I...

derr12

I havnt ruled out the possibility of paying someone to script this for us either if anyone is interested?

derr12

firewall rules?

derr12

had a chat with Butch Evans, He suggested about the only way to moniter usage in this setup would be with simple queues. so... I guess I should start by adding simple queues for every IP on the subnet this transparent shaper will be shaping(unlimited speed by default), then i can start working on th...

derr12

You want to add a simple queue to specify an ip or ip range you want to apply the pcq limit to like this; /queue simple add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment=\ "wireless router 2meg/512k" direction=both disabled=no dst-address=0.0.0.0/0 \ interface=all limit-at=0...

derr12

Post your problem here, you might be able to get help for free.

derr12

Hi guys. Im trying to figure out how to impliment this on transparent shaper. A user has been running High sustained data rate for hours and is hogging bandwidth. I want to be able to identify high sustained traffic ip's and place them into a "penalty box" where they get say, 60% of thier ...

derr12

Would a script be able to recognise when an IP on a subnet has exceeded (x) mbits for (x) time and then add a simple queue at a reduced speed for (X) time? I guess the real problem is that since my unit is bridged, where would you be able to moniter current thruput for an IP that doesnt involve torc...

derr12

Ive seen the odd routerboard fail to boot after a /system reboot. Usually always the same one.
Ive had to power cycle every time to get them responding again.

On the problem unit ive stopped asking it to reboot automatically.

derr12

Hi guys. Im trying to figure out how to impliment this on the ROS6 platform. A user has been running High sustained data rate for hours and is hogging bandwidth. I want to be able to identify high sustained traffic ip's and place them into a "penalty box" where they get say, 60% of thier a...

derr12

You should be able to use a simple queue to limit speeds for each user on a subnet while still having all your shaping rules obeyed, (i cant see how your trees are setup because the images wont zoom for me) here is an example of having every IP limited to 512k/256k on a 10.0.0.0/22 network: add burs...

derr12

looks good to me.

derr12

you would pretty much have to assign a 1-1 nat to every user with a unique public IP.

You can look into outright blocking bit torrent and peer to peer, having an bandwidth usage limit and enforcement of that limit will pretty much eliminate dvd downloaders.

derr12

All you should need to do is create a simple queue with the target address of 192.168.8.254/22, then you just set the upload and download speed. If you want to limit bandwidth or force them to share equally you could use PCQ to accomplish that as well. A good place to start for QOS types is here; ht...

derr12

your PPPOE connection is not able to establish because the connection properties that the mikrotik is getting from the Radius server is borked. Look at the user in your radius server and make sure any overiding radius attributes have not got your bursting limit higher than your max-limit. It could a...

derr12

If you want to limit 10 connections to any IP on the following 192.168.3.0/24 destination network;

add action=drop chain=forward comment="tcp connection limit" \
connection-limit=10,32 disabled=no dst-address=192.168.3.0/24 protocol=\
tcp

derr12

Be as specific or as not specific as you like. a 10 connection limit to any address would look like this: /ip firewall filter add action=drop chain=forward comment="tcp connection limit" \ connection-limit=10,32 disabled=no protocol=tcp I should warn you that web browsing would be very dif...

derr12

Ok I THINK i got it figured out add action=mark-connection chain=forward comment="Mark HTTP Download" \ disabled=no in-interface=Bridge1 new-connection-mark=http_down \ passthrough=no protocol=tcp src-port=80,443 add action=mark-connection chain=forward comment="Mark HTTP up" dis...

derr12

passthru=no means it will not bother to check any of the mangle rules below it once it has been identified. For example mangle rule 1 could be set to pick up http traffic. mangle rule 2 is set to identify "everything else" To prevent mangle rule 2 from taking the already marked packets fro...

derr12

You shouldnt need to specify the out interface, try without that. you could also try identifying it via the source port instead of destination as well.

I have better luck identifying via my local IP's instead of publics for some reason too.

derr12

since most of the work is offloaded to other devices, you could go with any of the medium range mikrotiks to server your function. Any of the 2011 line will do, also the rb450g will be fine as well. Both these units will be able to do what you are suggesting plus you should be able to shape your int...

derr12

Dont understand the question.

Trafficflows are for exporting netflow stats to a collector. For example you would send it to a NTOP server or cacti server for data handling.

Less netflow information would be Incomplete netflow information. And what good is netflow data if it's not complete?

derr12

I should note that it seems to be working fine when the mikrotik is a router, you just make the source and destination ports like so: 8 ;;; HTTP Uploads chain=prerouting action=mark-packet new-packet-mark=p2_up passthrough=no protocol=tcp dst-port=80 9 ;;; HTTP Downloads chain=prerouting action=mark...

derr12

Here ya go, /ip firewall filter add action=drop chain=forward comment="tcp connection limit" \ connection-limit=100,32 disabled=no protocol=tcp This is set to drop the 101rst tcp connection per ip address you can modify it by specifying the destination IP and port to get really specific if...

derr12

Ive built a mangle rule to pick up all HTTP traffic to or from port 80 on my transparent shaper (ROS6 beta9) It works when i go to a speedtest site, but just browsing the web or viewing youtube it gets counted on my mangle to catch everything else. I seem to recall the mangle rule (stolen from the t...

derr12

Should I have used my wan interface instead of the bridge? like this; 0 chain=prerouting action=mark-packet new-packet-mark=download passthrough=no in-interface=ether1 1 chain=postrouting action=mark-packet new-packet-mark=upload passthrough=no out-interface=ether1 I should note, when i tried this i...

derr12

I want it watching for high packet loss too, not just downtime. Likewise I dont want it pre-maturely thinking it's down just because my watch ip decides he wants to fire up a torrent and he gets a few packets dropped as a result. This is temporary. Eventually all these subs will get migrated to our ...

derr12

This is a pretty complete guide for doing what you are attempting:

http://wiki.mikrotik.com/wiki/Manual:BC ... ridging%29

derr12

Hi guys we deployed a router at a site and needed to limit speeds there to 8m/8m. So i added the following packet marks: 0 chain=prerouting action=mark-packet new-packet-mark=download passthrough=no in-interface=bridge 1 chain=postrouting action=mark-packet new-packet-mark=upload passthrough=no out-...

derr12

Hello, We have some P2MP links that occasionally go unresponsive or high packet loss. Rather than using a watchdog timer on an IP (Sometimes the unit will hang on restart) im monitering ive decided to try making my very first script. It works as intended: I have a netwatch watching a local IP "...

derr12

You could always try setting up a dude agent inside the network and assign it a public IP address.

derr12

smtp or snmp? The dude does send mail for alerts, but it would be via another dedicated e-mail server. The dude uses SNMP to poll data from the devices you are monitering so one would expect a constant trickle of SNMP and ICMP. I moniter a few hundred devices and I get a total traffic spike of jsut ...

derr12

For Aradial Radius I added my dude server IP in my list of NAS's and then created the a radius user;

The probe can be broken down like this after:
\x01D\0,0123456789012345\x01\x06RadiusUSERNAME\x02\x12PASSWORD\0

derr12

had another rb450 laying around that had ROS 4.10 on it. It installed fine. So try an older ROS version.

Search found 411 matches