MikroTik

jmay

One of our client computers (windows 10) is saving an old login password. It'll log in fine with the correct username and password, but if you close dude and relaunch it again it will still have the old password, never saving the new one. I tried uninstall it and deleting the contents of C:\Program ...

jmay

Why be a dick?

jmay

Ok, I pieced together enough information to figure out that with v7 you have to create an address list for your bgp routes and create a blackhole route for anything less than a /24 and the advertises get sent out properly. What's the advantage to all this?

jmay

Does V7 no longer support using an IP address as an NTP server? I'm experiencing the same issue as OP when I use my own internal server, but if I use something like time.windows.com it syncs just fine. This happened right after updating from 6.47.4 to 7.5. It's not my ISP, I'm the ISP lol. All the o...

jmay

I just watched a turorial on youtube and it seems that now we create a firewalll list with the networks we want to advertise, then under our BGP filter we set that address list under Output Network. Is this correct? Also the video made it sound like this is a temporary work around for v7. Can anyone...

jmay

I would also like to know, I just found out the hard way that going from 6 to 7 has changed so I had to downgrade. I wasn't getting any aggregates advertised at all. What are we missing?

jmay

I'm trying to figure out why MT devices don't have a uniform oid database and if there is a way around it. Example, 2 devices, a NetMetal 55HP Triple and a NetMetal 55HP have different oid's for frequency. Both devices are setup as AP Bridge running the same software and same firmware. I can set the...

jmay

You only wrote a novel ... Nothing is understood and one has to guess, without providing any graphs with relevant configurations. Asking for help takes mental effort, if you are unwilling to do so, no one will help you. Nevermind then I'll figure it out myself like I always do. Thanks for nothing d...

jmay

Long story short, I've had several GRE tunnels established for quite some time with zero issues. We are currently testing some new monitoring software and it is unable to ping through these tunnels, but pings fine to equipment that does not traverse a tunnel. SNMP probes however are working fine thr...

jmay

In all these years I've never had to do a restore, but I can't get it working. I'm running dude 6.46.4 and I have months worth of daily backups. Per the instructions I tried /dude import-db backup-file=dudedatabasebackup.db and got an error message that import failed I then set dude to disabled and ...

jmay

hahahaha!

(See reply)

jmay

I wish someone would build a decent cheap program that works with all kinds of hardware. Right now I've got Dude for infrastructure, Zabbix for Access Points and Customer SM's, and a whole host of various methods to update software on all this stuff. I can't be the only one with lots of competing ge...

jmay

2 ways to setup notifications. One is under the device under the polling tab. The 2nd is under the services tab and double clicking each service you want a notification to be sent on. As far as the icon turning red when only one service is down, I don't think that is possible. If one is down and som...

jmay

I see this from time to time as well, so if you are doing something wrong I'm doing the exact same thing.

jmay

An export would help. Its either a routing issue or a firewall rule blocking it.

jmay

Anyone figure out a way to use the dude to store port information from a Netonix POE Switch? I'd like to have history so when one dies (which happens a lot) I can have access to which ports had POE on and whether they were 24v or 48v. I figure I can graph which works and gives me a 24 or 48 graph to...

jmay

Easy question, what is the syntax for adding multiple lines of code to the scheduler via command line? I've got tons of routers to change and would be faster to do this via command line. An example would be a scheduler that does 2 things on startup. /ip neighbor discovery-settings set discover-inter...

jmay

I can black hole a single IP address via BGP communities with my upstream provider to drop attacks, but how do I combat an attack thats hitting my BGP peer IP? This happened over the weekend and my upstream provider was no help at all. How do people handle that? A 2nd BGP peer with them perhaps that...

jmay

I'm having a strange problem since I think the update before 6.2.4 and still with 6.2.4. I have a wireless bridge from my house to 2 out buildings using a wAPac as an 802.11 ap to feed them. Randomly both SM's will drop off the ap at the exact same time and will not attempt to reconnect until I shut...

jmay

I have never used webfig for my routers. Winbox only and I only allow specific IP's that access. I should be fine yeah? Most of my routers are currently at 6.41.

jmay

This update has bricked one of my HAP AC units to a reboot loop I had to use netinstall to restore it (first time for me) After netinstall and upgrade everything seems fine :D Thanks! Same thing just happened to me. Updated all the MT's at home and now my outdoor AP seems to be power cycling. I sho...

jmay

We get around 10,000 scan attempts a day on some of our main routers. I've never really looked to see if the bots send multiple probes at the same time or not. We will lock this down to only allow a couple of IP's access some time today. I've never done a VPN with MT so at first I was thinking estab...

jmay

I just ran a test. If you scan port 1723 the Mikrotik will log a TCP connection established like my log in my first post indicated.

Maybe this will help the next guy.

jmay

I am the ISP. The site in question is a remote tower with 1 piece of hardware plugged into it and the VPN has not been active for 24 hours yet. We fully intend to protect the site, the router itself is already firewalled and the network that feeds it is ridiculously protected, but right now we were ...

jmay

I setup a VPN in a Mikrotik yesterday and I have a question about the log. I havent locked down the router yet as we are still testing and the site is not a site that really needs to be secured yet, but if the log shows entries like this, but doesnt show an authentication failure, what are they? Are...

jmay

I have a bunch of routers in the field. I have my password but we had another account setup for someone who has left the company. I'd like to let his replacement start using that login but I dont know what it is. If I log into the router with my admin password how can i see the pw on another account...

jmay

Can anyone point me to the right resource in the US regarding being an ISP and issuing shared IP addresses to customers? We have reached the point to start considering options, but I'm not sure if we are required by law to keep all customers separated and trackable. My hunch is that we do, but my co...

jmay

I meant to learn this before I finished building my new version of dude, but I got excited and built the whole thing. Fast forward 3 weeks and I thought I better learn this. I messed up one of my maps and wanted to restore it. I had previously followed the directions at: https://wiki.mikrotik.com/wi...

jmay

Nevermind, I just figured out thru trial and error that ftp was also needed. I should have read the manual better.

jmay

I setup my first extra user for our dude server and the new user doesn't load any of the custom background images I used. Also, the font looks different and the text is not very clear. I created a user group with Dude and Read selected. Full users look fine.

What am I doing wrong?

jmay

Is it possible to graph all the time and still have a notification on failure if a probe fails? For example, I'm graphing DC voltage from MT's and I want an alert if that Voltage drops down to a certain point. I used to do this with 2 probes, but if would be nice if I could just have one probe. The ...

jmay

If I set my links color to anything other than black, many of the links stop turning red when full. I had my links set to white because I'm using a dark background and noticed that many of the congested links were still showing white. Through trial and error I figured out that they work fine if I ke...

jmay

Thanks! I get it now, one of the interfaces belongs to the bridge.

jmay

Yes I have, but it doesnt seem to work.

jmay

Why is it some of my wireless devices use iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifSpeed.1 while others use iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifSpeed.2 or even .3? These devices only have 1 ethernet port. Some devices will show a .2 and a .3 for example w...

jmay

I use a MT router as a pingable device to monitor when a generator comes on or off. It's there to let us know that the generator works and when it comes on. The down side is when the generator is off the probe is red because the MT is down which makes my little flag red. I use ack to make it blue so...

jmay

If u manage to make this work, please share.

jmay

Well I'm glad its not just me then. It's not a huge deal as I graph from the switch it plugs into, but it would make the maps look cleaner if I could someday graph from the wireless side like my other links. But I can live with it.

jmay

Ok I figured out the new dude could graph negative numbers after I posted this so I took out the multiplication to make it a positive and it seems to work fine now. I was using dude 3.6 originally which forced me to do it that way.

jmay

Solectek bridges have kind of the same trouble where the OID is actually something different on each link even though they use the same hardware something is tacked onto the end of the RSSI OID. For example the actual oid is 1.3.6.1.4.1.2890.7.6.2.1.5.6.0.128.72.116.21.168 on one bridge, Since it i...

jmay

I just realized you said powerbeam. I can graph ubnt products as long as they are not airfibers. The airfiber line seems to be different.

jmay

Which MIB are you using? Maybe airfiber is different but I cant get this to work. I get the interface options of air, eth0, br, sit, lo, but non of them show more than a few k of traffic.

jmay

Wow 4 and a half years later and I'm still searching for a solution and came upon my own thread lol. I'm starting my build using v6 and so far so good with most things, but the problem outlined in my first post still exists with it. After 4.5 years I've gotten used to it and can live with it, but if...

jmay

I'm confused. I'm using SNMPWalk from within the Dude to find the OID's I want. Then I graph them also using the Dude. What is snmpget? Maybe my sytax is wrong. I'm testing right now by putting this into a network map in the dude. Is this correct? [oid("iso.org.dod.internet.private.enterprises....

jmay

Are u saying to use this? I tried this and it returned nothing.

iso.org.dod.internet.private.enterprises.mikrotik.mikrotikExperimentalModule.mtXRouterOs.mtxrWireless.mtxrWlRtabTable.mtxrWlRtabEntry.mtxrWlRtabStrength

jmay

I have MT's setup as backhauls all over the place. When I snmpwalk them each link will have a slightly different OID for graphing rf levels. I don't see a universal one. Is there a way to over come this? I have to create a probe for every link and if a MT gets swapped out I have to rebuild the snmp ...

jmay

Has anyone gotten ubiquiti products to graph with the dude other than graphing from the port the ubnt plugs into? I'm rebuilding our dude server with version 6 and would love to graph these on the wireless link like I do with all other hardware. Best I can tell the oid I want to use is this one, whi...

jmay

Nevermind, blonde moment! I didn't realize the 60gig was internal and needed to be formatted first. I guess I saw the SD slot and assumed thats how these were configured. So move along, nothing to see here.

jmay

I just ordered an 1100AHx4 Dude Edition MT from Amazon and the included SD card is not with it. I'm currently working with Amazon to correct that, but I started wondering if I'd be better off using an internal HD. Any thoughts on what would be best? This is for a good sized network of 80 towers. I'm...

jmay

Started playing with the new dude for the first time and when I snmpwalk most of the MIBs are greyed out. Why is that? This is a brand new install with 1 mikrotik added. When I do an snmpwalk I don't see many of the options I used to, such as dhcp total count, etc. After looking at my old 3.6 server...

jmay

We are starting to run out of Public IP's so we're putting a few customers on private IP's and natting them. I have the dude show me total DHCP leases so I know when I get close to running out of public IP's, but with the introduction of privates it throws the calculation off. Is there a way to show...

jmay

Started sending IPv6 to about 150 Ubiquiti CPE's and 1 device is causing this error every every few minutes. What is this?

jmay

IMO the firmware that we download from the mikrotik site should be called software. The firmware firmware is specific to each board, so think of it like a bios update. The other firmware, the one I'm calling software, then runs on top of that.

jmay

Ok, I may just keep my clients using an IPv4 DNS for a while. I like caching at my routers because the network is so large and spread out these days that many customers have a long path back to our 2 main servers. Thanks to everyone in this thread btw! We have about a dozen customers testing IPv6 ri...

jmay

Quick followup question: I figured out I can manually enter an Routers IPv6 IP as my DNS server on a computer and it works just fine as a DNS cache router. I can also add that same IP to the DNS servers list and the router will hand that IP out to my clients. However, the router then constantly quer...

jmay

Since I have the attention of a couple of smart people let me ask another question. The above rule is for our office. I'll keep playing with that one, but here's what I've got so far for my core routers. Can you guys critique these and tell me if they should protect the routers themselves? 0 ;;; Acc...

jmay

Scratch that last post, that might just be working. I'm getting a small handful or RST's, but nothing like I had before. Prior it was filling up the log screen pretty rapidly.

jmay

Just tried it, still seeing lots of RST.

jmay

I started paying a bit more attention to the devices that were having this problem and noticed it's only a couple computers in the entire office generating these RST packets. The biggest offender is the user thats the most technically challenged person in the building. He's also the VP, go figure. :...

jmay

Thanks zero, I tried it both ways the other day when I found an old post of yours, same issue either way. I was running 6.39.2, just upgraded to 6.40.1 but I'm still seeing the same thing. Funny thing is it appears to work. If I goto ipv6-test.com it shows green a cross the board, but yet the router...

jmay

I started learning IPv6 for the reasons most ISP's do, we ran out of IPv4! Then I learned that IPv6 isnt much of a replacement option at all so we were left with one decent option, deploy it and let some customers use both, but still run out of IPv4! We're moving forward anyways so when the world fu...

jmay

I have a log rule right before the last drop rule to see what gets dropped in case I am missing anything. ;;; Log chain=forward action=log log=no log-prefix="" I'm seeing a ton of entries like this one: 08:58:49 firewall,info forward: in:ether1 out:ether2, src-mac d4:ca:6d:22:5c:2b, p roto...

jmay

We're about to start deploying IPv6 in the next couple of weeks. We've been in a test mode for a while running it at key locations. As far as BGP goes, the only BGP we use is to our 3 upstream providers, but with each case we ran a separate instance and seperate peer, one for IP4 and one for IP6. Wo...

jmay

I'm trying my first basic firewall set and I think I'm missing something here. When I make a request it seems that the connection is not getting established and then the firewall blocks the incoming packets. Here's the rule set: (more or less copied from a post by @zerobyte ) The log will show that ...

jmay

I think I was fighting a bug of some kind. With my initial testing I had an IPv6 DHCP server on an ether port with no vlan tagging. When I was ready to test it on VLAN2 I simply moved the IPv6 address and DHCP server to VLAN2. My clients were still receiving prefixes on the ethernet port, but not on...

jmay

I've got MT's all over the place being used as basic switches with all ports bridged together. All traffic is currently untagged. I'm trying to add a vlan2 to my network and it appears that my bridges are combining all the tagged and untagged traffic together because if I put my IPv6 DHCP server on ...

jmay

The reason I'm trying to inject OSPF into BGP is we have 3 core routers in 3 different towns. Each town will have a dedicated direction to reach the internet, but I'd like the towns to switch to another town in the event of a problem considering all our towns are interlinked via wireless. In the pas...

jmay

THANK YOU THANK YOU THANK YOU!!! This makes sense and it works! I see how to do this with IPv4 now as well. This is exactly the info I needed. If you ever end up in New Mexico let me know and I'll buy you a beer!

jmay

For simplicity sake, lets say my bgp router is connected to a 2nd router via ospv3. 2nd router has been given a /48, we'll say 2001:1111:1::/48. 2nd router uses that pool to assign /64's to customers. Actually I'm now issuing /60's. I set 2nd router to distribute connected and static routes as type ...

jmay

Should I be able to advertise IPv6 space via aggregates because it doesn't appear to work. I have multiple upstream providers and would like to use OSPF to advertise routes via one fiber or another, but it doesnt alter the advertisement. My provider appears to be accepting /64 advertisements which w...

jmay

I've got about a dozen 450G's that have been locking up randomly ever since updating past 6.17. I would say once every 2 weeks one of them somewhere locks up and needs to be power cycled to recover. It's only the ones being used as routers, I have dozens and dozens of these as switches that do not b...

jmay

Why would ISP's be changing prefix so often? With the sheer number I plan on setting my reservations ridiculously high, like 6 months to a year. Could make tracking old information a bit easier.

jmay

I'd like someone to call my non techy boss and explain to him how hard my job actually is and that I should get a raise!

How much would that cost me?

jmay

That makes perfect sense about the dhcp lease. I'll likely just use routable IP's for this, I mean a /32 should be enough for me.

Thanks again for your help.

jmay

Good thread! I'd like to see a DHCPv6 Setup feature like the one available for IPv4. Here's why. As someone that just started learning IPv6 it's been a long and difficult journey. It was very frustrating at times considering I was starting from scratch with this new IP protocol. This forum got me th...

jmay

Ok, well that makes sense based on what I'm seeing. I'm curious though, how does an MT as a client receive the PD when using link local? What's the difference? With my network a customer facing IP is very doable so I could use that as a solution if I had to. Seems like a waste of IP's, but I suppose...

jmay

Even stranger. Once the 2 routers have linked up, I can delete the one IPv6 from the MT router and the Netgear continues to work just fine using what should be an invalid WAN IP at that point. Once I reboot the Netgear router though, it loses internet again.

I need a stiff drink!

jmay

Since I posted last, this configuration fixes both the netgear and the linksys routers. With nothing but a linklocal on my dhcp MT router they do not work. Per your suggestion I changed the customer facing router IP to fd00:a::/64 and it still works. So it doesn't appear to matter what IP is there a...

jmay

I got it working! Well, at least on the netgear, but not on the linksys yet. I think testing with MT first led me down the wrong path. I found out that for the Netgear to work I needed to add another IPV6 address from another subnet on my MT DHCP server router, on it's customer facing port. This all...

jmay

Has anyone gotten this to work? I just need to know if I'm doing something wrong or if I should give up this quest and delay it for the future.

jmay

We've been a wisp for more than a decade at this point so we have a mix of CPEs. We started out as one of the original Canopy users before migrating to various other platforms. We still have thousands of users using the old Canopy and the only way IPv6 is ever going to work with them is by bridging ...

jmay

Should this work? I have our MT router setup as an IPv6 DHCP server and handing out prefixes that I own and route through BGP. If I use an MT router as a client everything works fine, but when using generic routers (I've tried a Linksys and a Netgear at this point) I cannot get this to work. In both...

jmay

How does that work exactly? What do you use for a gateway?

jmay

Anyone play around with non MT routers? I'm testing with home based routers since our customers have them and for the life of me I cannot get IPv6 working on this netgear I purchased. I'm going to pick up another brand to see if it's something I'm doing wrong, but I'm wondering what kind of luck you...

jmay

I'm still using 3.6 on windows machine and it's serving our needs just fine, but I'm wondering if I should be making the transition. Is V6 ready to replace it at this point?

jmay

Are any of you running an ISP? I'm wondering how you are handling all this. I have a mix of canopy and ubiquiti for customer CPE's that are not going to be easy to implement IPv6 like MT CPE's. Ubnt only supports IPv6 via DHCPServer as far as I can tell and for the old canopys I would have to run th...

jmay

So as an user, you may be too early. As an ISP, you're already late. :) Believe me I know I'm late. In my defense I don't own the ISP, but I am asked to single handedly be the network admin, the manager, the customer complaint department, the tower crew leader, employee relations, and pyschiatrist....

jmay

Thank you for everones responses! I do believe I am walking slowly on the right freeway now. A few days ago an IPv6 address looked like date stamp from the future, but thanks to this forum and lots of youtube videos I've got internet on a few devices. :D Thats a good point about charging for IPv4 sp...

jmay

We have a large networking consisting of 18 routers. I setup OSPFv3 to get the networks working with IPv6 using the link-local addresses and it works fine. With IPv4 we used private addresses for OSPF because we didn't have enough addresses to use public IP's. It never created any issues for us othe...

jmay

Ok I seem to have everything working here. IPv6 is really confusing at first, but starting to make sense to me the more I play with it. I have my main router setup to hand out prefixes via dhcp6. Main router is using link local addresses only, but handing out prefixes from a 32 that Arin gave us. My...

jmay

Ok I just figured out that other computers on the network are grabbing IPV6 address so some of what I'm seeing is that. I guess I figured without a DHCPv6 server they would need to manually be setup, but obviously I still have a lot to learn. I guess this is SLAAC that I'm seeing?

jmay

I successfully got my first computer working online with an IPV6 address, yay for me. But now I'm a bit confused. When I go into my MT router and use torch I am seeing traffic from IP's on my /64 subnet, but none of them are the ones my computer has assigned to it. When I goto a command prompt on th...

jmay

Now I'm discovering that MT can't even hand out dhcp addresses yet. Is this going to happen any time soon as well? Seems like my journey into learning ipv6 is going to be very short lived unless I start playing around with other routers.

jmay

I found a post from 2 months ago stating MT does not fully support ipv6 and cannot hand out dns information over dhcp. Is this going to happen any time soon? I am beginning my journey with IP6 and it seems I may be at a stopping point without that. We can't call all of our customers and ask them to ...

jmay

Yes, I have never changed the names of ports, I use comments instead. Are others not experiencing this? I've dealt with it for years and just put up with it. If the 2 routers are the same model it's ok, but if I go from one model to another, especially if the 2 models have a different number of port...

jmay

This is an old issue, but I wonder if we can ever fix it. Any time I upgrade a router the configuration file really jumbles up all the ethernet ports. I have to manually identify each port and then change dhcp settings, ip addresses on wrong ports, firewall rules setup on wrong ports, etc. It's real...

jmay

In my case I could push up to 300 megs on that link during testing and never had a bandwidth problem, just a packet drop problem. If turning the LCD off is the trick that's good enough for me, but man I should have posted this a week ago lol!

jmay

The busiest of the 4 routers runs at 30 percent, the least busy router runs 20%. These routers are dealing with less than 200 megs of traffic.

jmay

Anyone seen this before? I spent a week trying to track down the source of packet loss. I have a chain of 4 towers all linked together with Airfiber 5x's and an RB 3011 at each site connected via OSPF. I was seeing 1% packet loss on each link, so 4% by the time we got to the end of the chain. I spen...

jmay

Anyone seeing problems with ping timeouts? Every MT I have is losing about 5% of pings. I can even ping a MT from a computer with a direct cable plugged into it and lose packets.

jmay

Can I power more than one router through the POE out ports? I have an RB2011iL-RM and I want to power up a Hap AC Lite off the POE out port. Could I then power another Hap AC Lite from the POE out on the first Hap AC Lite?

jmay

No, I didn't know that. I didn't write the scripts above I found them on this forum. I'm still learning scripting and command line. Whats the syntax if I want to remove the /32 addresses? These would be different each time.

jmay

I have a blackhole script that I found on here that adds /32 networks to a bgp black hole when a DDOS attack occurs. This script works great, but I end up with a few /32 addresses in the bgp network list that I have to manually remove once in a while. I don't see a way to remove a specific IP or net...

jmay

We are about to start advertising our ipv6 space with our upsteam provider next week. We already have an existing ipv4 bgp session operational. If my reading is correct all we will be doing is setting up a new peer with ipv6 enabled, using the assigned ipv6 remote address, and adding the ipv6 addres...

jmay

The courisosity is killing me. I setup a dummy router in an attempt to let it connect to it. If I turn off authentication completely it never tries to register. So, is it possible to see the password that it's trying to send to my router or no? I'd like to let it connect and see what happens. :) Als...

jmay

I'm blocking the mac address to stop it from trying, but does anyone know if I can setup a script to alert me when someone is constantly connecting and reconnecting or perhaps even auto block them after so many tries? I know I can allow my devices and block the rest, but I don't want to do that or i...

jmay

I have a device trying to connect to my home router every couple of minutes. I can even change my SSID and the device still makes constant attempts. Do you think this is a confused device or something trying to hack in? The mac address comes up as Suga Electronics which specializes in emergency serv...

jmay

Not sure I understand the question, but the order is top down. Top rules run first. You want your accept rules at the top to accept whatever traffic you want and the drop rules below.

jmay

If using winbox login to the router, goto wireless, open the wlan1, press advanced mode button, choose the tab labled tx power. You can change the mode to all rates fixed or manual and then lower the dbm output. You'll need to experiment in the dorm rooms to see what works best. Also, set the wirele...

jmay

Depends on your goal. If you are going from router to wan on linksys 1 and then lan on linksys 1 to wan of linksys 2 you'll need to make sure all three routers are on different subnets. As far as the mikrotik is concerned it will be setup out of the box as a basic router so you wont need to change a...

jmay

I should add that you should have some accept rules at the top. Accept traffic to ports from IP's that you control. For example, if you only use winbox to talk to your router and you always do it from the same IP address then accept that port from that IP. Then you can post rules like mine with a dr...

jmay

The best way to secure your router is to create accept rules for things you want and drop everything else, but I like to have a bit of visibility to see what people are trying to do before dropping them. So the idea is to identify IP's that are making malicious attempts and then drop everything they...

jmay

Its a pretty simple rule that says if connections are made on the input chain of the router to common ports like ssh, telnet, http, etc then put the incoming ip into an address list for a period of time and drop all traffic from those ips. I just read on cbs that the big ddos attack on the us yester...

jmay

Maybe this is old news but I found it fascinating. One of my firewall rules grabs hack attempts on my routers and throws them into an address list for a week. At that point all traffic from that IP is dropped. Over the years the number of IP's in this list has grown and grown to the point that I cur...

jmay

I'm trying to be very delicate on how I handle this because I do not want anyone accused that potentially could be innocent. We have never needed to keep a dhcp log in the past. I now see we over looked a major flaw in our strategy that might come back to haunt us. So if the lease expires in the MT,...

jmay

I need someone to answer this question for me, preferably someone from MT. We have a subpoena from the authorities investigating a customer and they want to know information on who an IP address belongs to. We are a small wisp and have no history tracking in place. The date in question is 10 days ag...

jmay

Be very very very careful if you're going to have an automated black hole function. The automated black hole itself could be used as a DDoS vector without the need for any botnet - The firewall rules you posted don't require any amount of bandwidth consumption to be considered an attack - just numb...

jmay

{ :local addrlist [:toarray ""] :foreach i in=[/ip firewall address-list find where list=bgp-blackhole] do={ :local addr [/ip firewall address-list get $i address ] :local addrstr :if ([:typeof $addr]...

jmay

I use this for detecting attacks and dropping them. I found this on this forum somewhere a long time ago. Someone else deserves the credit I just don't recall where I found it. It works really well, during an attack it does start dropping the packets and expires after 10 minutes if the attack is ...

jmay

If money is no object (must be nice), go big. We have a ccr1009-8g-1s-1s+ that serves about 2000 customers, runs nearly 800 megs during peak time and the CPU does not work hard at all! In fact, the other day we were the victim in a massive DOS attack and the router was running about 30% on the cpu...

jmay

I've been reading through the forums and various options to automate this and see mentions of scrips, but cannot find the script. I already have firewall rules in place that will detect and stop the attack, but how can I write a script that will take that address list and add it to the bgp route fi...

jmay

Thank you for everyone's help! My provider had something wrong on their end, now it works great!

jmay

I failed to mention it, but yes I also have that IP advertised in my BGP session as a /32. In my advertisements list it shows up and has the community value in it. So it should be working right? But I can still ping it from outside of my network. I've emailed my provider to check their config, b...

jmay

One more question, prior to this working my provider had to set us up as a multihop on their end. Do I need to do the same on my end?

jmay

Ok, I got past that first hurdle. I found that when I added the BGP-Out filter to the Peer the routes would stop advertising until I disabled the peer and re-enabled it, then it worked fine. I then added a single filter with a single IP address and I am showing that I am advertising it with the new...

jmay

Ok my provider set me up so I can send communities along with a /32 IP address in order to black hole a single IP. I've been reading the wiki for the last couple of days and I'm missing something as I cannot get this to work. If I edit my BGP peer and add an Out-Filter that I called BGP-Out I stop...

jmay

Ok thank you. I'll work with my upstream provider on this. I wanted to know first if it was possible so thank you again!

jmay

Is it possible with bgp to not advertise a single ip address in a /24 when my peer will not accept less than a /24? We had a udp flood attack on a single customer and lost the network. My router successfully started blocking the packets, but it did us no good as our entire 1gig fiber had maxed out a...

jmay

No, the infrastructure is all private IP's. Currently each of my 17 routers act as independent DHCP servers and hand out public IP's to clients. Each client is a wireless subscriber that receives 1 public IP, and then NAT on the customer side like a traditional router. My big problem is some network...

jmay

Oh I agree, but you know how things go with various companies. I actually have a very strong understanding of ipv4, I'm the one that set the entire network up. When I came to work here I took a flat bridged network that had hundreds of customers natted and sharing 1 public IP address. I installed ro...

jmay

Thanks for the reply. I may go this route as a temp solution. I know I need to migrate to ipv6 but I'm a lone ranger over here and the company assigns me a lot of other duties outside of IT. I did some reading the last couple of days on IPv6 but it seems a bit over whelming considering I need to lea...

jmay

If you are an ISP, you know the headache it can be Clients love you for delivering the web, but when it breaks they loathe you instead Half of the time the fault is theirs, But don't tell them that, they don't care But do not worry, feel comfort with this, When computers take over.. support will be ...

jmay

I'm just thinking out loud here: I'm running out of IP's for our ISP and Arin will not give me more. I have some IPv6 assigned to me but I'd like to buy some time before diving into that fiasco. My network is subnetted pretty heavily with 17 different routers via OSPF that all go out to the internet...

jmay

Thanks for all the replies. This is an absolute LOS link from one mountain top to another. There is no way to split this shot into 2 shots. This will be a backup link to the main so it's not as critical, but I wasn't sure if MT could shoot that far. Our record is a 79 mile (127km) shot so we know ho...

jmay

When I started into this business 10 years ago our boss taught all the climbers to wrap the connectors with electrical tape (courtesy tape), then weather proof it with that tar wrap (sorry don't know the official name), and then another layer of electrical tape. I've always thought this was a terrib...

jmay

I have the dish size calculated and know I could pull this off with some other hardware, but I'd like to get this working with a pair of Netbox 5's. Should I expect them to link up and get 50 megs?

jmay

Nevermind I figured it out. I needed to add warning and NOT dhcp and they got rid of the dhcp messages.

jmay

I've had my routers setup for years to send their logs to a remote server so I had a history of events. For the first time in a long time I needed to look up something that happened yesterday and noticed the logs are not working as they used to. I have it setup to send me logs that are info, but not...

jmay

In case anyone else comes upon this, uninstall and reinstall does not work. Uninstall, search for all files named Dude on main drive, delete them all, restart computer, then reinstall dude. Works fine.

jmay

One note tho. When you backup one router and restore another it will change your port mac addresses on the new router to match the original router. If these 2 routers are going to exist on the same network you'll likely want to reset the mac addresses on the new router. You can do this by clicking e...

jmay

This morning I opened the Dude and I get a message asking me to select language. If I click OK the same msg just keeps popping back up. Tried uninstalling and reinstalling but same problem. The windows server launches fine from the server and other clients are ok, just not this one. I'm using versio...

jmay

Here is what you want if I am understanding you properly.

jmay

Sounds like you are creating a loop somewhere. Can you give us details on how you are setting this up?

jmay

God I hope I'm retired before we need 80 gigs around here!

jmay

I wonder if this thread will prompt hollywood to produce a Big Lebowski Sequel!

jmay

The airfiber does have an option to turn it off, but its on by default. Ubiquiti says its best to leave it on, but I find many posts like yours suggesting a network is better off without it. I guess I'll leave it on for airfibers, and off for everything else.

jmay

Port 1. I have no bridges on this router.

jmay

Interesting. Turning on flow control did make the error go away tho and I can reproduce it by turning it back off. This is a link that runs close to 600 megs at times, and minimally runs 300 megs.

jmay

We gave up on trying MT AC. NV2 works better.

jmay

Anyone...

Anyone...

Bueller...

jmay

Holy crap Hell Froze over!! :D Started browsing the forums because of a recent oddity with Dude 3.6 and discovered The Dude is being reincarnated. Cool. I have no issue buying a router just for the Dude. What model would you suggest? Also, with the current release is there a way to send text alerts?...

jmay

I had the same problem yestarday after upgrading my router from a 1100AH to a CCR1009-8G-1S-1S+. The 1100 never had this issue, but the CCR did immediately. Both routers were running 6.30.2. Changing flow control to auto on the MT fixed the issue for me.

jmay

bandwidth.png I'm seeing this every night. At first I thought it was the router because CPU was 80-90% during these times. We upgraded the router to a CCR1009-8G-1S-1S+ yestarday and still see the same issue. So now I'm wondering, is this a dude problem or a Router OS problem. Anyone successfully g...

jmay

I would not be looking at MT for 400 megs. You should look at Ubiquiti Airfiber.

https://www.ubnt.com/airfiber/airfiber24/

jmay

One of my routers was giving an error "fcs error on link". I have an Airfiber plugged into that port and I found something that suggested turning on flow control would fix the problem since flow control was enabled on the Airfiber. This indeed made the error go away, but then I started won...

jmay

You need to clear the trees if you want 400 megs. Build a small tower and then anything will work.

jmay

Good to hear! Thanks. Does anybody know exactly how mikrotik divies up the multi-cores for processing? With my dual core routers I poll both cores and I've noticed at times one might be 100% while the other is near 0%, then at other times they are even. It could be that the dude is not polling at id...

jmay

Thanks for responding! We ordered the ccr1009. I'd love to have gone bigger but I don't set my own budgets unfortunately.

We are in the business of selling internet so every dollar I spend is a dollar that does not make it to my bosses pocket, lol.

jmay

Ok, my boss gave me permission to upgrade the router. We'd like to get one with an SPF cage and dump the fiber converter that's there now. I'm looking at the CCR1009-8G-1S-1S+, do you think that would be a significant upgrade from the RB1100AHx2?

jmay

Maybe a dumb question, but at what point should I consider upgrading my main router? I have an RB1100AHx2 that peaks around 75% CPU during high usage which is about 550megs. Will these function fine up to 100% or should I start looking to upgrade it? I'm not really having any issues with it, except ...

jmay

Is there really no way to do this?

jmay

This seems like a simple enough thing to do but I am not finding a clear answer anywhere on the web or in this forum. Being that I am 100% wireless a cross multiple towers I don't always know how much bandwidth will be available to a site as it can fluctuate for a thousand different reasons. How do ...

jmay

Yah let me clarify. I have 2 fiber connections to my provider. I use BGP at each location but mainly so I can redirect specific towers and IP's on the fly. The one I am having a problem with is a 500 meg connection. The 2nd connection is only 200 megs and is very located several tower hops away and ...

jmay

Makes sense. We are dual homed but the other fiber is several cities away so we don't really have the backhauls to send everything that direction. Since this is a short term problem do you have any ideas how I can avoid this? Do I need to learn how to prioritize packets at this point?

jmay

Ok, any reason why setting this to say a couple hours could be a problem? Does it need to match up with what my provider is doing or no? Once I get my gig port I can put it back but to sooner.

jmay

Are there any consequences to increasing the BGP Hold Time? What exactly does this do? I had an issue last night where our fiber connection maxed out and my MT reported "Hold Timer Expired". The router then rebooted itself and after reboot failed to re-establish the BGP session with my pro...

jmay

For next time if you make a backup file and restore that on the new router it will retain dhcp lease information. This method works best when replacing 2 identical models of router. For some reason when you do this from one model to another model it jumbles up all the ethernet ports and mislablels t...

jmay

I'm having the same problem. It's annoying. I have to log into another routerboard and look at it's neighbor list, copy the mac address, then paste the mac into winbox to log into it.

Whats the deal?

jmay

I work for an ISP and we have 17 routers interconnected via OSPF. We're slowly running out of IPv4's and was denied by ARIN for any additional. They did give me a rather large block of IPv6 but at this point I don't have a clue how to use them. I have a very strong understanding of mikrotik and IPv4...

jmay

I have 17 routers that are currently all their own dhcp server and they are all linked together through OSPF. I'm thinking about dedicating a router as a dhcp server for all of them using relays. I know how to set this up, but.. All of my routers give out public IP's of various subnet sizes. I curre...

jmay

I started upgrading all my mikrotik backhauls from 6.17 to 6.30.2 and now the dude is not reading any of my power level oids. I noticed that these have changed and each radio has a different oid for this value. So this means I'm gonna need to create a seperate probe for every device. Is there any wa...

jmay

I manage a wireless ISP using Canopy subscribers, but Mikrotik as all my routers at towers. Network is broken up into 18 parts using OSPF with 2 fiber points using BGP. Currently Canopy SM's register to a tower via an authentication code that only installers know. This is controlled by each access p...

jmay

I'm looking for a good solution here, I've been given a budget of 10 grand or less. Since we have a mixed variety of client devices radius would work the best for us and rather than a seperate system I'd really like a billing solution that has it built in. What are you all using?

jmay

Thank you to all that have helped me so far. Theres a couple of questions I am having trouble understanding. So I have 2 internet facing routers in 2 seperate towns. Both with Cogent. These 2 towns are interconnected with a series of backhauls with many mikrotik routers in between. These routers all...

jmay

No change at all. Is anyone else using these at decent distances? Maybe I am trying to push them to hard. Mikrotik wireless is really getting on my nerves. Today we are swapping out another set of Mikrotiks because one of the 2 polarities has lost 10 db. This must be the 12 time we've swapped out ra...

jmay

Can someone kindly explain how to configure this?? The documentation is written as if I should already know all this. The following does not help me at all. BGP allows the aggregation of specific routes into one route with. This menu ('/routing bgp aggregate') allows to specify which routes you want...

jmay

I'm having terrible luck with these things. 25km link with -60 on both polarities using 5ghz netboxes. According to the built in freq scanner very clean on both sides, noisefloor -100. I've tried a combo of everything from 802.11, nv2, nstream. Various channel sizes from 20 to 80 and the best I can ...

jmay

I got it working ty. Must have been doing something wrong at work. I work in a VERY noisy environment and its hard to concentrate. Logged in from home and got in it going in 2 mins!

jmay

I get that. I think im getting it. I can use aggregates to advertise as /24 but internally route them smaller right? Can someone show me the proper config to do that? Mikrotik manuals are headhurting some times.

jmay

I can't wrap my head around this. If router one is peered with a full bgp router how do i get the rest of my network to know through ospf that a default route is available since with full bgp there is no default route? Do I need to use 2 routers at the fiber location? One for the full bgp routes and...

jmay

So if I am reading this properly it cannot be done? I would need to have a /24 in each of my 3 routers?

jmay

First time BGP setup. I have the basic BGP working fine on 1 of my 2 connections with cogent using full routes. Right now I am advertising a /24 out of one of my /21s and internet is working great. However Cogent will not allow me to advertise smaller than a /24. Is there a way around this? Here's m...

jmay

I'm in the same boat. Dude service is crashing several times a day and restarting. Rather than jack with it I'm thinking about moving on. So far I've tried cacti, was not remotely impressed. Tried spiceworks, what the hell is that one good for? And right now trying zabbix and it sucks. Reached about...

jmay

I think were going to try these at dual polarity. Will it harm the boards if I keep that 3rd chain unselected?

jmay

Well, I've got about a hundred of em floating around the network. The first set will probably go up on a short hop. 2.5 miles. We're using 3' dishes now with some Motorola PTP backhauls that are capped at 200 megs 1 way. It's a backup link for some airfibers but the airfibers shutdown in heavy rain....

jmay

I just received my first Netmetal5 pair and realized I accidentally ordered the 3 chain version. Is anyone doing this yet? Does the bandwidth go up with that 3rd chain? Triple Polarity dishes are expensive. I could try 2 dishes with one being a slant polarized but this seems messy. If I decide to us...

jmay

What is everybody using to authenticate subscribers to their network? We use a variety of hardware so Radius seems the most appropriate. I've been messing around with freeradius and daloradius for a month now and can't seem to it going. I hate linux btw, I really do! So what other options are out th...

jmay

Oops I meant netbox 24. But same question applies.

jmay

Ive got an rv park im about to upgrade. I bought 3 omnitiks with some high gain antennas. Since the park will be a mix of laptops, phones etc would I be better off using a single chain or a dual setup? We dont need n speeds as the park only jas 10 megs coming in, but I want the best setup for range ...

jmay

We have a pair of 711G's being used as backhauls. I upgraded them from 6.7 to 6.15 about a week or 2 ago. Last night the slave side suddenly would not register. It saw the AP at a -50 but was reporting ranging errors. I rebooted both ends and they linked back up after rebooting the AP side, but woul...

jmay

Where are the instructions for 802.11ac? I installed this on some rb711's and some rb911gs and I dont see an option for it. Do these boards not support this?

jmay

Old post but I'm having the same problems with 912's. I've been jackin with these things for months trying to figure out what I'm doing wrong only find this post where apparently everyone is dealing with it. Frustrating My CCQ's are all over the place unless I limit them to MCS11 or 12. Throughput s...

jmay

I just got back from vacation (yay cancun!) and finally got around to playing with this. I ran a test and an upstream loop does not get blocked by RSTP. So I'd like to play with mangle a bit and see if I can create storm control on these Mikrotiks. Any body have any examples? I know a real switch wo...

jmay

Hmm, maybe this is my problem. I do use RSTP in other parts of the network for redundancy links, but not in this case. I've been expecting it to stop network loops if they occur however. Maybe I am mis-using this. In my diagram above, if a customer on switch 2 creates a network loop at his location,...

jmay

Ok I'm going to try this and run some experiments but I'm a bit confused. If I currently have just 1 bridge with all physical Ethernet ports on that bridge, how do the vlans even cross that bridge without utilizing the spanning tree? I would think that all traffic on the bridge would be bound to the...

jmay

Ok, don't make fun of my drawing I don't have visio. In it's simplest form this would be the layout. The loop was created by the customer on VLAN 100 on Switch 2. It took down everything plugged into Switch 2 and Switch 1. I could log into Switch 1 when it was happening because I was on the other si...

jmay

I have some mikrotiks setup as switches using RSTP. Basically I bridge all physical Ethernet ports and turn RSTP on. On the main switch at the router I set the priority lower than the default of 8000 to 7000 so it becomes the root bridge. All works well, I can even get failover working with this set...

jmay

Added info. I rebooted the router in the middle of the night and ended up with 3 bridges when I originally had one. So when the bridge disappeared the previous two times and I added a new bridge each time these were recovered after the reboot. Any thoughts?

jmay

Ok the first time this happened I thought I had a blonde moment but it happened a 2nd time to me today. The first time a few days ago. I have an RB1100AHx2 with 6.7 software and firmware 3.10. I was in winbox deleting a couple of IP addresses from the firewall address list when I suddenly lose conta...

jmay

This makes sense. (yes I read it). I'll try it tonight, thank you!

Search found 336 matches