MikroTik

jager

@yinternetmalaga

Try disabling SNMP

jager

Hi everybody, Does anybody experience (upgraded to v6.0rc12) usernames and passwords vanishing without reboot or any other issue? This is on CCR1036. This router is our maing BGP router and was working OK for days after upgrade to the first pre-lease CR12. There is one full BGP route and if no BGP f...

jager

It says "Sorry, we found no results on these dates." for Freetown - Zagreb 12-16th March. But nevermind, I'm leaving Freetown at 1st of March, flying Freetown-London-Belgrade (going HOMEEEE), than Belgrade-Paris at 9th of March to be at ACE O&MSC meeting and finally 13th of March is my...

jager

I like free beers

Will accept all offers

@siscom
Where did you find the ticket for that price??

jager

Guys, stop complaining about expensive airplane ticket. I'm coming to MUM from Sierra Leone, West Africa.

Freetown - London - Zagreb

Just imagine the cost. So, keep quiet

jager

Hi IsiaNT, I noted the same error. But, this is actually not a real error. It looks like since v6, if you include any date&time in your firewall rule, the ROS takes into consideration is this rule currently active or not. If you set a rule and uncheck Friday (which is actually TODAY), the rule t...

jager

Which hardware or ROS version has made you such a MT believer that you'd blindly order rev1 hardware with ROS that is not yet stable, contains the most changes of all other major ROS releases and runs on entirely new platform? No hardware or ROS. My needs are very basic, so I really expected that a...

jager

I wanted to make it, but even after more than 30 minutes, the file was not created. I will try again, I have to succeed at the end! Normis, can you check inside that supout.rif you received for the false positive reboot entry in log, is there any users on that system beside the default "admin&q...

jager

I was connecting to IP address, not MAC, and received back the "Wrong username/password" message. Well, maybe it is only this one CCR faulty. I have another one here, still unboxed. Will try that one and will let you know what happens. BTW, in the "CCR" topic, I'm not alone with ...

jager

You can read through this topic, and aside from the unjustified panic regarding the "RC" in the version name, you will see that there are actually very few issues with the current RC6. Those issues will be fixed very soon. And what about the mysterious "router was rebooted without pr...

jager

For my way of thinking/approach this CCR "pre-production" is just ideal - you can get only one piece for the lab, just to start experimenting, working with support to get all the necessary stuff working, understanding how much performance you will get and where to put this device when ava...

jager

Normis,
at the minimum, send us the l7 rules that you used, and the basic config, so we can repeat the issue.

Mail sent to support@mikrotik.com

If there is literally anything I can do, please let me know. Thanks a million!

jager

Normis, As I wrote before, it was not possible to make the supout.rif. The file was never created, we were waiting for 30+ minutes. At this moment, I can't even access the router, as my username/password combination is not recognized, neither the default admin/no_password works. I will, however, res...

jager

Ok, so all those are saying this is an Alpha, Mikrotik then are releasing products to the market place The software is a "release candidate", as indicated in the name. Except for some really peculiar configurations, it works rock solid for 99% of users. Second - we don't have any producti...

jager

Thank you, Doush.
It will be good to test this, if the same will happen to your CCR as well.

I experienced the MAC-Winbox issue as well, but I think it is Win7 related. Linux+Wine, no problem with MAC access.

jager

@Chupaka I tried to make supout.rif so many times, as the user reset issue happened 3 times before the router finally decided to lock itself! I of course rebooted it at the end, but without luck... Simply, after clicking the "Make supout.rif" button, it says that it is creating the file. H...

jager

Instead of masquarade everything, set it by source IP address! This may help

jager

Guys, sorry for this many posts from me. Unfortunately, the "user reset" happened again. This time I can't log in with either my username nor admin/no_password Before this happened, I was logged in winbox. The log showed again that the router was rebooted without proper shutdown. After tha...

jager

Can you, please execute /ip firewall nat export and post here the result? I think you have misconfigured the masquerade.

jager

Make sure that the default gateway for the device with IP 192.168.149.112 is 198.168.149.1 and that the gateway for device using IP 10.10.10.5 is 10.10.10.1.

jager

Chupaka, thank you for your feedback!

I haven't rebooted the CCR, that's true. I just set the new users again. It will be a little strange for the one day old CC router to lose the flash, right?

Well, hopefully this will not happen again

jager

Guys, cool down before it gets personal :) I understand both opinions, and mine is somewhere in between. Very important is the existence of the CCR, which shows MikroTik's wish to enter the market they were not before. At fist, please consider me a true MikroTik lover. I can close my eyes on many sm...

jager

Well, this is not acceptable.... Without router reboot or anything similar, the system name has reset to default (which is something I can live with). But, ALL users and their passwords have disappeared! The default admin/no_password user was present instead!!!! Very serious security problem, though...

jager

@doush

It looks like this is the same on all CCR's. We have two, and both have the same issue.
Well, as far as this is only a false entry in the log, that's fine

jager

One small bug found:

For unknown reason, in the log the router reports that is has being rebooted without proper shutdown, but actually nothing happened?!

Uptime is still counting properly....

Here is the screenshot:

jager

Yesterday I received the CCRs, as you can see from my previous post. I was very happy and couldn't wait this night to install it. At this very moment, I'm sitting at our NOC. We just replaced our Core Mikrotik router with one CCR. The old router is quad core xeon Portwell server (Power Router 2200)....

jager

Well, as far as I know, only G4 and newer servers can be booted from USB, sorry.

jager

There are many variants of HP DL360 servers.
Can you, please, post which one you have?

jager

If you received the server for free, you for sure can invest a bit to buy at least a decent 2 or 4 port ethernet card ;) Unfortunately, not every NIC chipset is supported in ROS. But this is not such a problem as many of them are already supported. Your server should accept a wide range of these car...

jager

Just received, both CCRs

jager

Do you have up and running at least the two onboard ethernet ports? It should work. I used many DL360 servers with MikroTik, never had any issues with integrated NICs. However, I had different issues with add-on cards, starting from not recognizing it at all to lockups and random reboots. If your on...

jager

See you there! I just paid online my registration

jager

You can't find it in winbox, you must use the console. It should be here: /interface ethernet edit ether1 mdix-enable and then the editor will be opened and you can edit the value Everything is documented here: http://www.mikrotik.com/testdocs/ros/3.0/interface/ethernet.php I have 6 ethernet ports, ...

jager

Thank you for your feedback! This router is actually a HP DL380 Proliant G5, with one additional quad gigabit ethernet card. Max. bandwidth utilization is < 50Mbit. The router has 8GB RAM, but of course only 2 is visible. What kills me is that I have the same configuration on 4 different places in E...

jager

I would like to see WCCP support in MikroTik. We have 4 cache servers using WCCP, and only because of WCCP i still have Cisco 7206 in my network. I really would like to get rid of it, but as we are on satellite link and those caches spare us 10-12Mbit of bandwidth, we are forced to use them. Please,...

jager

We recently configured one dual CPU xeon x86 to be the core router and PPPoE concentrator. Everything was fine for almost a month or so. The same upgrade was done: 5.14 to 5.16, and since then, we have random reboots! Sometimes once a day, sometimes twice in one hour, but sometimes it is everything ...

jager

Simply delete the files you don`t need. Old backups and similar stuff.

jager

Well, if I may raise the same question.... Currently, I`m working in Freetown, Sierra Leone. I`m rapidly changing the whole network from Proxim and Ubiquity equipment to "MikroTik ONLY"! :) It is not a problem with wireless devices, we are here almost done with my plan to use only MikroTik...

jager

The same happens here, ROS 5.2
Is it maybe fixed in 5.14?

jager

Two AP's have to be different in MAC! If you fake the MAC address of the second router, and set it the same as the first router, it will mess the whole thing up. Turning off the radio on second router was just an idea, not a recommendation :) Why you don't like the idea to have two routers with the ...

jager

Read this page, everything should be crystal clear

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle

jager

Currently, I`m administering a network with 120+ MikroTik routerboards that is located in the nearby city (60km).
Serbians are also able to work hard with limited budget

Pls, send me an email to jager(at)w802.net if you are interested, and we can continue there.
Thank you!

jager

Simple answer: NO! :) They at least need to have different MAC addresses. But, you can make a simple fail-over scenario: Set two MikroTik RouterBoards in AP Bridge, with the same settings. Turn OFF the radio on router 2, and leave it ON on the first. Then, make a script that will ping the first rout...

jager

How about admin with MikroTik Trainer licence from Serbia?

jager

Thank you for your submission, but the power supply should not be the reason for this. At least not in my case. I`m running the router on HP Proliant Xeon based server. It has dual PSU`s after all

jager

Few times happened, and here comes the problem again. Suddenly, all the interfaces dissaper, all IP addresses are listed, but no interface assigned to it. All IP's (both IPv4 and IPv6) are on UNKNOWN. When trying to list the interfaces, got ERROR:timeout. The same happens on Wireless, Bridge, PPP, M...

jager

Unfortunately no. I have no idea what was really happened. However, router password is changed, logging enabled to disk. Will see if it will happen again. Hopefully, it will not

jager

The easiest way is first to make simple queue for every used IP address (Queues -> Simple Queue), and then draw graph (tools -> graphing -> queue rules). You can check the graphs at http://router_IP/graphs However, this is useful only if your computers are using static IP addresses. Traffic Flow giv...

jager

The default pass was the first thing to remove after installation of the ROS :) It's not there for sure... I will set some logging to remote server, this should never happen again... In History, it only says that filter rule changed four times... Very interesting that both INPUT and FORWARD had DROP...

jager

Well, an VERY interesting and strange thing happened today. I was 100+ km away from office and the server room, when my customer called me to inform me that his server located in my server room is not reachable. Well, I checked the core router via GPRS, and it was not reachable too. The core router ...

jager

At our customers place. We came to install our equipment, and saw THIS that was installed by the ISP they used before...

jager

I can't change anything in LAN. My servers are in the same LAN and there is a lot of complicated bindings involved. They have to stay in 192.168.1.0/24. Same thing applies for the .253. It is their default gateway Worst case scenario :) But if your LAN is on 192.168.1.0/24 and the gateway of the cl...

jager

There really isn't a good solution to this other than making the RouterBOARD the gateway for the LAN.

Correct, absolutely correct. That was the main reason I suggested to put LAN and any WAN into different subnets.

jager

For start, if you can, change the WAN3 IP address to, let's say 192.168.10.x. You need any other subnet than those you are couurently use ofr other WANs or LAN. Or, if you don't have access to that device, you will need to change your LAN's subnet. This means all computers in the local LAN will need...

jager

I think I got it now, but a simple drawing will remove any doubts :) Well, 192.168.1.0/24 is you local LAN. Your gateway that is masqueraded to the internet is 192.168.1.253 This works OK if it is your only gateway to the internet. You should either change your LAN to 192.168.2.0/24, or change the 1...

jager

If I understanded you correctly, you have 192.168.1.0/24 on your LAN. You have 192.168.1.253/24 on your WAN3 interneface. In this case, it is a misconfiguration, you can't have addresses from the same subnet on two separate interfaces. If the situation is not as I described, then please give some mo...

jager

If I understanded your config, your eoip to the third wan is made via those two wans already existed before and properly load balanced??

jager

Hi. I also have an eoip setup between 2 RB's but the DHCP server is a 3rd party device on the A network. B network clients do not recieve DHCP addresses. All else seems to work fine. Set DHCP Relay on your eoip interface. As you are using 3rd party device for actual issuing IP addresses, Relay shou...

jager

Netinstall is your friend

jager

Do you have proper grounding on your tower?

jager

Well, there is no way that MikroTik can handle this traffic, as it already reach it. You can block it from further penetration to your network, but it will still take some of your bandwidth :( I'm not very familiar with NanoStation. Maybe there is some firewall possibility, but you have to check it....

jager

Be sure to have enabled FTP server in your RouterBoard. Go to IP => Services and enable FTP.
Then, use any FTP Client software on your MAC and transfer the files to your RB.

jager

Hi Every card has about 20 wireless station user in WDS mode. Regards These station are MikroTik devices? If the answer is YES, you can simply filter all NetBios traffic before it even leaves the clients, and reaches your RB600. Additionally, it is good to know that you do not need even an IP addre...

jager

Guys, where are you all?

I'm sitting in the hotel's lobby, drinking coffe and waiting for you all!

Just finished the Train-The-Trainer class and passed exams !!!!!!

See you!

jager

sergejs,
thanx for the reply.
Ofcourse, the station is in WDS mode. The bridge is working, as I can see my whole network.
But even without any bridge, I should ping from one RB to another...

jager

I was in doubt between MMCX and SMA, but finally I gave my vote to SMA. I don`t miss the 360 degree rotation possibility, and SMA can be screwed and therefore gives the best connection. Cables are more robust and more secure. So, anything but NOT ufl. I had so many problems with pigtails!!! The inst...

jager

Hi everybody! I`m back after quite a log time... Well, there is something that drives me crazy. After a lot of MTik installations, now I`m totally lost. The scenario is as simple as it could be: Two RB411`s with RB52 cards and external antennas. Wifi link stable, -60 or so... IP address 10.172.11.1/...

jager

By default, NTP package is disabled on RB112. If you want to use NTP. first you have to shedule it to enabling, and restart the router.

jager

Wait a second ... why bridge VLANs? :) You lose the meaning of VLAN if they are bridged. However, after a close look, Eflanery your tip is good :) I suppose there is different networks on every VLAN. Separate PPPoE server should have an IP from every VLAN and I think thats all. We have VLANS too, an...

jager

If you have VLANs, every VLAN is seen as separate interface. Therefore, you have to setup PPPoE server for each VLAN you want PPPoE. The service names, ofcourse, can be the same....

jager

Yes/No/Maybe some day?
Anybody?

jager

IMHO, being unavailable to mac-telnet AND login via console cable is showing some hardware problem on the router. manish, does the routers MAC address even shows up in the list in winbox? And when you connect via console cable, does any readable text shows up on your screen? Ofcourse, set the correc...

jager

sergejs,
mac-telnet does not need IP address assigned to your PC

jager

It will be nice if such feature will be available in the next release of Mikrotik.
Is there any chanses for this to happen?
Thanx,
Jager

jager

Connect your router and your PC with lan cable. Wait a while, and then click on the "three dots" located right to the field where you are supposed to enter the routers IP address. This will bring up a list of MAC addresses that your PCs LAN card can see. It should show only one :) which is...

jager

It should be enough, but if the box will only doing PPPoE for clients. If it will use additional firewall entries, it is a question will it be OK for this number of clients. I have P4 @2.8GHz 1Gig ram, upto 250 concurrent PPPoE connections and some firewall and NAT. CPU load goes upto 50%, average i...

jager

There can be a lot of reasons for a bad performance link. How are the SNR looks? Do you have clear LOS? Is the freshnel penetrated? Are there any radio noises? Have you tried to change operating frequency?

jager

ghmorris, do you use the cards in 2.4, 5GHz or mixed?
2.4 band in my case was giving exactly the same problems as you described.
Can`t comment 5GHz mode, we are using SR5 for this band from the very begining

jager

Thank you, Nathan, you are reading my mind

I can`t always express my reflections properly, my english is not sko good. But, you`ve got the point what I mean with my previous post. Thans again!

jager

dsovereen, you can consider yourself very lucky! I can`t desribe you what different problems I had with those cards: router rebooting, random clients disconnection, tx signal weakening... I really did everything what could be done to fix the problem, experimented as much as possible, bcouse I had 12...

jager

I understand that. But why should I even want to use the pre-2.9.25 option? To block such clients and do not allow them to associate? "pre-2.9.25" does not work with Intel Centrino PCI-express cards. "post-2.9.25" does work with ALL client cards Sorry, but I still don`t understan...

jager

jo2jo, please send the supout file, I don`t have any 8602 cards running. They are all swapped to SR2.

jager

sergejs, thanx for answer, but I must be stupid ... From the docs I can`t figure out why the hell should I even want to use pre-2.9.25? THe docs says as follows: post-2.9.25 - include extensions in the form accepted by MikroTik RouterOS starting from veriosn 2.9.25, and compatible with all known wir...

jager

It looks that we all should use "post-2.9.25", why is then the default settings "pre-2.9.25" ?
Should I change this to "post" or leave to "pre" ? I`m using SR2 and SR5 cards. Thanx for answer

jager

Tully, believe me that 8602 have serious problems. I changed a lot of settings that i do understand, but at the end I gave up and I replaced 10+ of these cards with SR2 and now everything works just fine. Problems showed up with RB112 and RB532, no matter what board I`m using. I havent tested 8602 w...

jager

These cards have a lot of problems with Mtik. I had the same issues. It has been discussed here a few times, please search the Forum for results

jager

Stupid me!

Yes, the package was disabled ...
Thanx, cibernet

jager

In INPUT chain, drop all traffic from all IP addresses that you don`t need. This should do the job.

jager

Am I totally blind or what?

I simply cant found NTP client on RB112. This is a real pain, as I use graphing and the graphs shows bad dates. RB forgots the manually entered date/time after reboot ... logs shows bad dates ... I would like to fix this if anyhow possible! Please, help!

jager

I have a stupid suggestion, but have you tried to remove one card, swap the PCMCIA slots in which they are inserted? I also had a problem regarding empty output in /interface print, but it is interesting that i never experienced this on routerboard, only on x86 version and regular PC. A lot depends ...

jager

At first, do you have only one public IP address from your ISP and will go for masquerade (users have local IP addresses) or you have a free IP pool of public addresses? Regarding network cards, IMHO it does not matter which one will you use for Internet/Your LAN... Even old 10Mbit cards will do the...

jager

I had the same problem as described, but never had 100% success redirecting only p2p traffic to secondary gateway. Users always complained about "LowId" with Emule or other similar problems in other p2p softwares. The best what I got is to leave p2p on default gw, and redirect everything e...

jager

to the RouterOS community: I am sorry!

Apology accepted

jager

hi Randy!
Your rule should be in forward chain.

jager

Now now. lets not get that angry OK, you`re right. Sorry for my vocabulary :) remember i am the one who paid money and i am displeased with the product. Do you wanna say that router os is overpriced or what? I agree that this OS is not perfect, and that there is much to work on it. It is in constan...

jager

I was a little nervous during 40 km away RB upgrade from 2.9.12 to 2.9.26 but everything went fine

Succesfully upgraded 12 pcs of RB532 and 112! Good work!

jager

If someone can`t figure out how to do certain things with router os, after looking at the manual and writing to this forum where a lot of fine ppl willing to help, than he better stop bugging with computers and go for agriculture. There is NO second option , router os is the best, easyest and cutest...

jager

Welcome to the Internet.

Drop all incoming traffic (in input table) from addresses that are not welcome, and you soved the problem.
And answer to your question: YES, this is brute force bot...

jager

antenna-mode=ant-b <--- is this default settings??? I don't think so Even the MAC address shows different, I suppose this is SR2 with MMCX pigtail. I had the same configuration, but had lot of problems with it. Users had very weak signal levels, and therefore, slow speeds. The card was not faulty, ...

jager

mperdue, isn`t SR2 and SR5 in the same RB112 a little too much? I mean a lot of power consumption for that tiny board?
If you can please confirm that it WORKS ok with both cards installed?

jager

I`ve found something that should work OK. In a few days the board will arrive for testing...

http://wlan-ok.hu/index.php?si=297

jager

Awesome!

jager

I can confirm that RB532 with 20 meters of 48V PoE and 2pcs SR5 at max power works fine. I`ve installed it almost a month ago and no lockup problems, thanks God

jager

it *looks* to me by the amount of retransmissions that MT is not waiting long enough for a reply from the radius server...

I agree. We had very similar problems, so I get mad and set radius timeout to 10000 ... now everything is running fine

jager

Great test, and great results!

jager

Here is what the manual says, READ IT carefuly! MikroTik RouterOS may be used to provide CIR and MIR with some contention level and priority. Here we will talk in terms of queues (which represent either real or virtual interface) and classes (children of a queue; each class has an another queue atta...

jager

With 200+ active PPPoE users I have the same truncated output from linux :( Tested it several times, always at no. 83 82 R name="bosscaffe" service=pppoe caller-id="00:0D:88:A4:E9:F3" address=213.244.212.151 uptime=1h13m40s encoding="MPPE128 statefull" session-id=0x8180...

jager

I know

Will go for Intel.
Thanx

jager

Djape, you`re right! :) But, there are exceptions, always :) Sometimes it is useful to ask somebody for help and opinion if you are not in a position to test everything you wanna do with the box. Look at my problem: I don`t have enough spare RBs to play with, damn money problems, as usual in Serbia ...

jager

VIA motherboards run Mikrotik? :) This forum and a few others will advise against using the VIA chipset. Look for Intel rather. Well, ok, but here is what /system resource pci print says on RB532: 1 00:03.0 VIA Technologies, Inc. VT6105 [Rhine-III] (rev: 134) 143 2 00:02.0 VIA Technologies, Inc. VT...

jager

Ricky, thank you very much for your post! I was thinking about the same, to split site 2 onto two routerboards. I`ve already ordered new routerboards and SR5 cards. I had another idea too, to replace the routerboards with much powerful P4 PC`s, but.... The site 2 is on the top of a water tower where...

jager

No Queue is set up on boxes.
I`m using WDS, as simple client interface is not bridgable.
If I switch to Nstreme can I bridge that interface too? Will it eat less CPU power than WDS?

Thanx!

jager

Please help! I have the following setup (backhaul link): RB532 (station 1*SR5) ----15km----RB532(2*SR5)----12km----RB532(station 1*SR5) Signal levels are more than sufficient (-52, -57) Every RB has set up a bridge between wlan and ethernet interfaces. Connection tracking disabled, no firewall rules...

jager

Interesting, but AR5413 started to WORK after inserted into a third motherboard! It works OK in genuine Intel motherboard with P3 500MHz ...
Weird, really, but at least we figured out that this really was a motherboard issue.

jager

Older mainboards don't have 3,3V ni PCI slot...

You`re right! Well, we found out what is going on with the old Fujitsu. Thank you a million!
But, what is the difference between AR5413 and AR5213?
In the same motherboard and miniPCI to PCI converter the 5213 works, but 5413 does not. WHY?

jager

compex 5413 won't work on pc! (interface didn't show up on /inter wire) but it will work using wrap + bios update. Same problem here, but with Senao NMP-8602 PLUS (Atheros AR5413) It works well in RB532, but in PC it does not show up in interfaces list. SR5 works in the same PC. I would like to sav...

jager

Yes, it will be nice feature to have... But, IMHO, if you setup a router on linux, even with "top" you can`t separately see things that are executed by kernel. Bandwidth limiting (cbq), firewall (iptables), etc will not be shown as separate tasks.... Maybe this is the main reason why such ...

jager

It is not possible in Winbox, since 2.9.8

Only in CLI.

jager

Hi,
Is there any way to see where the router uses the most of its CPU power, on what task?
We are suffering from very high CPU load, and it will be very useful if I could somewhere see what on earth is eating the CPU....

jager

We are suffering for similar problem, and it started 2 days ago. Our router is working for more than a year without ANY hardware changes (P4@2.6GHz). Our maximum CPU usage was upto 35-40%, average less than 20%. 2 Days ago, CPU usage raised to average +80% without any reason. No configuration and/or...

jager

I plan to make a website for this software, but it is still just "in queue"

It will be nice not to use this Forum for my own advertising, therefore anybody who is interested, drop me a mail and we can discuss all details.
Thanx

jager

We have developed an accounting system based on Mikrotik with PPPoE. It is in use for about 2.5 yrs and we have tested it very well in live, with over 200 online users. I can give you a demo account to take a look how it looks like and how it works. If you are interested, and for further details, co...

jager

We are usign PPPoE and radius, and everything works fine with Rate-Limit. Users queue gets all parameters correctly. But, we also played with the Rate-Limit for some time before it worked as we want to. Be sure to correctly forward all the data Rate-Limit needs, and the most important, give them in ...

jager

Thank you very much for answer. I will do what you suggest, and will let you know does this solve the problem.

jager

We also have tsunami, model MP11.a 9pcs, and it does not restart. Had no problems with them and Dude

jager

If they are in the same network, and if your mikrotik has one IP from that network, and both client uses that IP as gateway, they can.

jager

I browsed the forum`s archive, and found that this should be a harmless message, and that the client who is not even associated is sending some data that is kicked ignored. But! In the last 3 or 4 weeks, we experience huge problems on one of our 2.4GHz omni. For the same time (ALL the time) I have t...

jager

Jager radio sam ovo ...zato sto sam mislio da ide po onom nacinu, odozgo na dole po izvrsavanju pravila. Pa znas ono ovo je dozvoljeno ali ono ne. Shvatam :) I ja sam se već ovako zajebao :) OK, moving back to English, for others to understand too .... I understand that is is easy to track, and the...

jager

chain=dstnat src-address=disabled.user.ip.address dst-address=!your.web.server.ip
protocol=tcp dst-port=80 action=dst-nat to-addresses=your.web.server.ip
to-ports=81

jager

EoIP?

jager

version 2.9 when user is ban / disable, can they bee redirect to a web-site, to get a message Yes. Redirect all his traffic on port 80 to server that will display your "You`re disabled/banned" page. It can be an another apache process on your existing web server that will listen on differ...

jager

It will work, but you have to make some modifications to your settings. You can bridge the LAN and Wifi interface only if the WLAN is in AP mode. On the client side, it is possible, but it does not work. You should implement EoIP, and get fully functional bridges. Or, if you use Atheros based cards,...

jager

Well .... if you enable your last rule: add chain=forward in-interface=SBB protocol=tcp action=drop comment="" \ disabled=yes in that case all tcp traffic to and from your cable provider will be dropped. It means no traffic. You are cutting the tree you are sitting on :) majku mu ... ;)

jager

It can be done. Just need to find out how. IMHO, queue tree will be the asnwer. Here is why I thik this: I have PPPoE users with dynamic simple queues for every pppoe interface. If I mangle for example p2p packets, and create a new simple queue with p2p mark, set the limit to 1Mbit, this will be the...

jager

Wow ..... well, please, send your config. Some setting is obviously wrong

jager

Did you mangled the packets in prerouting or in forward chain? Prerouting should do the job OK

jager

One solution to this is to bill the user based on usage and not give them unlimited transfer. This is right what we are doing. Users have to "prepay" the wished ammount of data to download. We DO NOT charge for upload. It is free at all, to allow users to use P2P software. 0.5% user DO up...

jager

We are using level 5, and it gives you 500 PPPoE connections in the same time. True, we will soon go for L6

jager

I`m crossing fingers for Ofasa`s suggestion to work, but I think it will not

IMHO, backup radius server will be used only if the primary radius is not responding. Correct me if I`m wrong

jager

...enter username for one of the users, enter service name of your PPPoE Server that is running, repeat for other users. I would like too to have graphs "stay available" after user disconnects, but it will be a real pain to manually enter over 1500 users, especially when they are entered ...

jager

This is an interesting question at all. We have very similar setup (PPPoE users) and we would like to add more SSID`s to our APs. This should allow some business users to have their separated local traffic for some monthly fee, and that traffic should not be "accounted" by the radius as In...

jager

Listen to my advice

Just TRY with another one. I had some strange situation with a few Kingston cards. Replaced it with some no-name and worked OK.
But, if the installation fails with the second CF, we will discuss further

jager

If I undersanded well your question, all you need to do is to specify what radius server MT shell use in Radus menu. If you have static users, they will be connected without contacting the radius server. If the user is not in the list, then he will be authenticated by (and accounting packet sent to)...

jager

Try with another CF card. This look like hardware issue in the card.

jager

Very simple. In IP > Firewall set up a new rule (input chain) that will accept traffic on port 22 (ssh) for your IP`s from which you want to connect to the router by ssh, and drop the rest of the traffic on this port. Do the same for port 21 (ftp). Or, if you have only one network from which you wan...

jager

That total throughput - more than 200Mbps was only for RB500 (CPU 333MHz)

Well, it`s worth trying with P4 3GHz and test what throughput will come out

jager

OK, I agree. But, idea for another Mikrotik implementation: as switch, was not even close to my mind

jager

You can use PC and fill it up with something like RB44 (4 ethernets in 1 PCI) and you will get 6 PCI = 24 ethernet port managable switch with vlan traffic shapping, firewall filtering and so on! WoW! Wonderful idea! A very good maximaly managable "switch" that replaces x.000USD cisco/3com...

jager

Wel, theoreticaly, it should work. Practicaly, it does not

I really have no clue about why it behaves like this. Somebody who have better knowledge should have the answer, for sure. Normis?

jager

Yes, that is exactly what I mean.
I hope Mikrotik will implement this in the next release of Dude. After all, it should not be cool, and useful for a huge number of Dude users.
Anybody from Mikrotik: PLEEEASE!

jager

Great!

I`m sure that you will have no issues at all. Our system was set up from the very begining right on the same way. It was 2 yrs ago, until today, no probs at all with any Mtik version!

jager

Don't do that, god knows what one of your users can do to your network... :) :) Hahhaha, Djape, I see that you know well how users behave in Serbia :) A few days ago, a wrong placed NAT made me a lot of trouble... and a lot of free, unlimited internet access to some of my cusomers :) It lasted just...

jager

I`m happy that my suggestion was worth trying

jager

Just configured Dude for the very first time, entered all our network nodes. I love this software

I would like to make our network map public via http to all users, and it will be nice to have fulscreen mode of map in browser. Please, add this feature!

jager

You can configure Mtik client with ONE PPPoE account, and then share/masquerade internet on PC's. Or, you can set up EoIP between client Mtik and PPPoE server, and connect every PC with separate accounts.

jager

Sorry, I'm not in the Mikrotik programmers team. I don't know this.

jager

Somewhere inside Mikrotik. If you connect from one winbox, and after reconnect with the second computer, you got the same windows position

jager

Sorinbuda, you did not get the point. Chat is not a replacement for the Forum. It is for quick answers for not a so complicated issues, and for CHAT with other Mikrotik users....

jager

ahh ok. maybe just leave those `special` windows open when you close it ?

This is exactly the same what I am doing from time to time

jager

@sten
Well written

jager

up to about 300 concurrent connections on 2.9.12 on a P4 without no problems

Same here. CPU load upto 30% on P4 2.6GHz. We use also some basic firewall on the same box, without it I think CPU load should be few percent lower. Anyway, works very good.

jager

The real power of Mikrotik lays in the fact that it is based on linux kernel. Imagine a win-based Router OS

It will suprise you with blue-screen very often

jager

We have gotten bandwidth throttling working on a bridge. So are we saying that this definately cannot be done on a bridge, and needs to be done via routing? Yes, that`s correct, but that is only my opinion. I don`t say that I am 100% right, but as nobody has submited any better solution I suppose m...

jager

You did not misunderstanded anyhing

This is right what I am suggesting you to do. I know it will not pass without problems/downtime etc, but at the end it will worth the job.
At the end, after you`re done, let me know how does it work. I hope you will be nicely supriced

Crossing fingers...

jager

Thank you very much for answer.
I have a question: If I mangle the packets that are related to local traffic, set up a new simple queue and limit the bandwidth to 1mbit, will this limit be per user or general limitation?

jager

Do not mess with ping times, it will for sure drive you to nowhere. Changeip`s TTL suggestion makes the most sence, i think. NO, i don`t have the solution :) I just think that it might work. But at the end .... if you sell the bandwidth to the user, why are you care is it shared or not? It`s payed, ...

jager

You can solve this in much cheaper way

Put the cheapest switch you can find between Routerboad and your cable modem.
I solved my Motorola Canopy problem on this way, as it also have problems with autodetecting crossover/straight cable connections, as well as 10/100Mbit negotiation

jager

Having your own PA space is much nicer than using a chunk out of some other ISPs space. This way, you can drop providers without renumbering. Yes, this is a very important thing. I survived 2 complete changing of public IP addresses on my network, and I can tell that it was *REALLY* very painfull. ...

jager

I think this is not going to work, as you do not have the VLANs defined on Mikrotik. Is is possible to do VLANs on Mtik, and not on Juniper? Only in that case you can assign one simple queue for every VLAN, and it will work OK. I have several VLAN switches, and every AP, remote link have assigned a ...

jager

Well, as I said, we use Mikrotik to run PPPoE server on it, and for some firewalling. PPPoE users are authenticated by radius, and after the authentication is succesfull, user logs in, and Mikrotik creates a new interface (pppoe-username) and aslo creates a simle queue for that interface based on th...

jager

Mikrotik HATER??? I can`t imagine anybody who does not love it....

jager

Finally an answer :) Thanx a lot cibernet :) Well, I don`t know how to make them static! The queue is created by Mtik after the user logs in, and in radius I`m using the `Ascend-Data-Rate=524288` fox example, if I want the user to have 512k bandwidth. In the manual at radius section there is not eve...

jager

Really nobody wanna help a stupid guy like me?

I`m giving up.....

jager

... MT is way too powerful but maybe only the military are entitled to know how to use it.

Hey, after all, it`s not rocket science

jager

Have you made any adjustments to the number of connections limits?

jager

Set up an external squid, or any other proxy server (windows/linux platform, whatever) on a cheap, old P3 or similar. Then, on Mtik, NAT all outgoing 80 port tcp traffic from local machines to your proxy`s IP.
This should work ok for you!

jager

maxfava, why are you complicating your own life?

If you have /24 that you want to be used by your customers, GIVE THEM public IP`s

jager

It would be nice if MT could run a proper http server. In this case the router with big HD could be used to be the server in the network... no need for additional server.... :roll: Install any Linux distro you like and put apache on it :) It can route, firewall, be a web server, use your imaginatio...

jager

Only one physical radio interface can transmit on only ONE frequency at the same time. Two cards ==> TWO frequency... so simple

SSIDs are handled by software, frequencyes have to be managed by the radio card itself.

jager

Anybody, ANY suggestion? Please....

jager

Well, then a feture to turn on or off the sounds

When there are 5-6 ppl in chat, I minimize that button as nobody types nothing, and miss when typing starts.
If it is easy to implement this, if will be nice, if no, we can live without it

jager

Why not just use a CF - PATA converter and put a 64MB CF card in?

That`s right. We use this combination for a long time, and it works like hell

jager

You can setup a new simple queue to every VLAN interface, and shape the traffic as you wish. For example, like this: 142 name="VLAN Proxim 1" dst-address=0.0.0.0/0 interface=proxim1 parent=none direction=both priority=8 queue=default/default limit-at=0/0 max-limit=10000000/10000000 total-q...

jager

I`m on 2.9.8 just becouse the upgrade licence has expired

Will update it soon, and go to the latest version....

jager

Suggestion:
This chat should have sound notification after somebody types the message.

jager

I`ve just came back from a great 3-day MT training in Budapest (greetings to Peter :) ), and was full of ideas how to fix several queue issues I have. Unfortunately, after looking into the winbox upto 4:30 AM this morning, I came out with no solution. We are using PPPoE & radius, and after user ...

jager

If you are familiar with radius, you can set up (almost) anything you want

You can monitor the users traffic every 5 mins (for example) and then run a script that will simply delete his interface after he run out of bytes available.

Hope this helps

jager

Nice!

Hope this chat will be popular

jager

As far as I know, Mtik key is bounded to the HDD.
So, change your hardware, but keep the disk. You can add another one (for cache, or something else you want to store). This is the easyest way

jager

WoooW!!!
This is a cool one....

jager

I don`t know.
My licence has just expired, and I can`t upgrade

In Serbia it is still problems to send money to foreign country, but I also have contacted my friend in Hungary who will manage the payment.
Will let you know after upgrading...

jager

I`m running 2.9.8. In PPP -> profiles I made a profile that gives the user address from Ip pool defined in IP > Pool. In PPP -> Secrets, I created a user and selected his profile. At this stage, user connects, and Mtik gives him the correct IP. In PPP > Sercrets i enter remote address for this user ...

jager

We did it on the following way: At first, if the user has no "valid" package and need to pay, PPPoE pool for this user gives him a local IP address (192.168.0.x) On you web server, make a new one on port 81 for example. On this server sits your "damn bill" page :) In Ip->Firewall...

jager

I agree with Eflanery. The /ip firewall won't match on this since it's not IP.
I will try to play arround with bridge group and post here the results.
Thanx for your posts and help!

jager

YES, im running PPPoE server ON Mtik.
I changed the rule to be in input, but still without luck

jager

savage, thanx for all your suggestions, I appreciate them very much! I`m going to play arround with a second radius server (good idea!

) and will post what have I discovered...

jager

Yap, you`re right, but it simply does not work

I made a rule in forward chain, in advanced typed in the MAC, and in action selected drop. In the list of available protocols, there is no pppoe, so I left it blank (all protocols).
Even then, this weird client comes every 5-6 seconds....

jager

The AP does not forward PPPoE packets, for sure. I had the same situation with stupid Tellus A14 AP. It has an option, called "IP Filter" and if it is enabled, it passes only IP traffic. I can ping, etc, but no PPPoE. Turning this off solves the problem. Baxide, look carefuly, is on your A...

jager

In my case, I have more than 30 APs in town and surrounding villages, and VLANs are configured on our Mtik with PPPoE for almost every AP. APs are very mixed by its manufacturer. Who the hell will manually open every AP and enter the MAC?

I did not mean to ban the MAC on AP, rather on PPPoE server

jager

In my case, 00:40:F4:D9:AD:08 is the only MAC address that connects every few seconds. But, it connects and DISconnects! So, it does not locks up my Mtik, just filling up the log with trash. I can live with it :) But, in franco`s case, that client connects, does not disconnect, and connects again, m...

Search found 289 matches