MikroTik

Wyz4k

According to https://wiki.mikrotik.com/wiki/Manual:Peripherals SIM7100 is supported in LTE mode on v7.xx. I started with a working PPP connection in ROS 6.48.7 and then tried to convert it to LTE. I've tried it in ROS 7.14 and I get it to connect and run, but I'm unable to get an IP for the LTE conn...

Wyz4k

Unfortunately the functionality that I require on the wAP R ac to make it compatible with the RB922s is not working on ROS 6. And I can't downgrade the wAP R ac to the version where it is working, so I have to run ROS 7 or there is no compatibility. MikroTik have also mentioned they have no plans to...

Wyz4k

I can't netinstall hundreds of devices in the field. Nor can I deploy them or upgrade them remotely if upgrades even between minor versions are prone to failing.

Wyz4k

Must say, this issue remains tremendously frustrating. I wasted several hours today having to repeatedly netinstall a wAP R ac that crashed and failed to upgrade because of this exact issue. The primary reason is because it only has a 16MB flash. This is simply too small for a brand new and super po...

Wyz4k

Let's try and keep things civil please! We are all on the same side - my side

Wyz4k

They function as distributed desk Gigabit switches and WiFi APs (CAPS). Other than that their configs are very basic.

Wyz4k

I upgraded 3 hap ac2s from 7.9 to 7.9.1 and all three bricked. If you have any hap ac2s be very careful with this upgrade.

I had done netinstalls recently on all of these to get them to ROS7 and stable, I'll have to do it again now but this caused disruption and downtime unfortunately.

Wyz4k

It's a very fine line. I've been able to upgrade both my hap ac 2 and hap ac lite to 7.9, but I've had to do netinstalls etc. Then at work I upgraded 3 hap ac2s from 7.9 to 7.9.1 and they all 3 bricked. So it's incredibly temperamental to upgrade at the moment and any upgrades on ROS 7 should be don...

Wyz4k

Yep, fixed for me too. For the first time I can stay connected for longer than an hour.

Wyz4k

MikroTik have confirmed that they can reproduce the problem. So we need to wait for them to fix it.

Wyz4k

I had the same issue. Please see viewtopic.php?p=953696#p953696 for how I fixed it.

Wyz4k

Please see viewtopic.php?p=953696#p953696 for how I solved my issue

Wyz4k

For what it's worth I just found an issue between an RB922 running 6.48.6 and wap R AC 6 running 6.49.6 in mesh config the mesh connection kept breaking every 2-3 minutes. I tracked this down to a script that was doing a background scan every 2-3 minutes. From here it gets interesting. This script h...

Wyz4k

My personal view on what's happening: somewhere in the process during upgrades from ROS6 to version - version - version - ROS7 - version - version ... "something" is left behind which completely messes up the install which at that point bricks everything. A clean netinstall and then impor...

Wyz4k

Yeah, luckily I had recent backups from when I went from ROS 6 to 7.
It was a pain to netinstall though, but managed to get it going to ROS 7.4 in the end.

Yeah, I guess so pe1chl. Long stable upgrade history on ROS 6 and then a lot of issues trying to get it stable on 7 :)

Wyz4k

After upgrading my hap ac 2 from 7.3.1 to 7.4 via Winbox upgrade packages it is now bricked.

Wyz4k

I experienced a lot of that with my RB 751U-2HnD that only has 32MB of RAM. I contacted MikroTik about it and they said ROS7 requires more RAM than ROS6 does. So if you are running a bunch of memory intensive things on your hap ac lite before upgrading, there is a chance that it won't work after upg...

Wyz4k

Connected at 16:21:29 Disconnected at 17:22:14. Just over an hour again. Server logs show: 17:22:13 ovpn,info ovpn-client: terminating... - peer disconnected 17:22:13 ovpn,info ovpn-client: terminating... - peer disconnected 17:22:14 ovpn,info,account client logged out, 3663 150404 11810 1270 184 fr...

Wyz4k

Tested with ROS 7.3.1 I've just recently converted my OVPN TCP tunnels to OVPN UDP and I've noticed that after almost exactly an hour my OpenVPN clients get a hard error that requires the user to click OK and then manually reconnect. Multiple clients are experiencing the same issue. If the connectio...

Wyz4k

I managed to upgrade my whole home network to 7.3.1. Two routers were a real pain, but got there in the end. 6.48.6 - moved all files to PC - 6.49.6 - set dns cache to 64kB - 7.1 - 7.3 (oops) - 7.3.1 - set dns cache back to 2048kB - copied files back 6.48.6 - moved all files to PC - set dns cache to...

Wyz4k

Fortunately most users aren't on at the same time, but there are regular complaints about VPN performance which is not great. I've just upgraded my home routers to ROS 7.3.1 which took a lot of effort due to space restrictions. I'll monitor for stability on them over the next few weeks before starti...

Wyz4k

OpenVPN on RouterOS v6 always uses TCP transport and it will be affected a lot by long RTT (long distance). It also does not use hardware acceleration. It will likely work better when you use IPsec instead of OpenVPN. Thanks for that. If it really doesn't use hardware acceleration as you mention th...

Wyz4k

I was able to eak out a little bit more performance on the link by forcing a 250 packet pfifo buffer on both sides of the connection. But this is only viable on router - router connections.

Wyz4k

Hi everyone, I'm keen for some input on why I'm getting such dismal OVPN throughput. I'm running ROS 6.48.6 on both routers. The two routers are about 10,000km apart. One router is an RB1100AHx2 and the other one is an RB1100AHx4. According to the https://wiki.mikrotik.com/wiki/Manual:IP/IPsec page ...

Wyz4k

https://www.whois.com/whois/192.35.169.80 their IP range is 192.35.168.0/23. Add this to an IP list called badguys: ip -> firewall -> address list then add a new rule: chain=input src_address_list=badguys action=drop and chain=forward src_address_list=badguys action=drop. Make sure those two rules a...

Wyz4k

I have the same errors. It was scanner Сensys.io. I'd recommend create drop rules that blocked all their IPs

Yeah, already done.

l contacted them and asked why they were scanning my IPs which they did not respond to, so I reported it to my government as a malicious actor.

Wyz4k

https://help.mikrotik.com/docs/display/ROS/GPIO

Wyz4k

Some if not all of those answers are available here: https://help.mikrotik.com/docs/pages/viewpage.action?pageId=41680915 note: Analog input voltage is 0-60 V. Theoretical resolution is 4 mV (14bit ADC). Analog input impedance is approximately 72K Ohm. note: Digital input voltage is 0-2.5 V max. To ...

Wyz4k

It's wise for each person to test it as their configuration may be different. You can contact them at sari @ jsof-tech dot com to request the latest scripts.

The scripts only output text, so it wouldn't qualify as a report.

Wyz4k

I requested and tested the scripts on my MikroTiks and they weren't found to be vulnerable.

Wyz4k

Simple solution:
Do not use the devices for testing (well, better: guessing) bandwidths. It's always a CPU bottleneck.
Get yourself two computers, connect them to the switches and run iPerf on them.
-Chris

Thanks Chris

Wyz4k

How do you test? What exact CRS do you use? What is the CPU usage while testing? What RouterOS version are you running? Can you share your config ( /export hide-sensitive file=anythingyoulike )? Good questions. I used bandwidth test with UDP settings from the central CRS that connects to both other...

Wyz4k

I'm hoping that somebody will be able to assist me with this. I have reached out to MikroTik support as well but they seem unwilling to assist. I have Two point to point SFP+ links between 3 buildings. Building 1-2 and Building2-3. Each building has a CRS with a 10G-SFP31-LRM-C1 in the SFP slot to c...

Wyz4k

/file get [/file find name=file.txt] contents - has a known limitation of 4095 bytes. So if the file you are trying to read is larger than that it will fail. Ridiculous I know.

Wyz4k

If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs. No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set...

Wyz4k

If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs. No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set...

Wyz4k

When the reason for the reboot is an upgrade of ROS, the router already logs that... Maybe it was just an unfortunate example and you want to be able to specify other messages like "shutdown for maintenance in rack #2"? That's right yes. reason = "Shutting down because DHCP broken sc...

Wyz4k

Can we get an option to add a reason for rebooting? For example /system reboot reason="upgrading to new ROS" and have that reason be stated in the next log?

Wyz4k

Yes, you need to escape the ? with a \ infront of it. For example "/tool fetch url="http://192.168.20.11:3480/data_request\?id=action&DeviceNum=113&serviceId=urn:upnp-org:serviceId:SwitchPower1&action=SetTarget&newTargetValue=0&output_format=json"" Reference: ...

Wyz4k

The IP is nearly identical too. Would be good if you could submit a supout as well to them. My ticket number is SUP-23883

Wyz4k

11:12:25 ovpn,info TCP connection established from 192.35.169.80 11:12:25 ovpn,debug,error,63032,14304,12812,12240,31696,40220,14232,12808,l2tp,info,12812,debug,79,65535,critical,64600,15944,21392,79,40 1928,40220,37872,40220,error unknown msg! 11:12:26 ovpn,info TCP connection established from 192...

Wyz4k

https://www.cisecurity.org/advisory/mul ... _2020-083/

Does Mikrotik make use of the Treck stack on any of their hardware?

Wyz4k

I have tested the latest versions 6.45.9 (LTS) and 6.46.6 (stable) and and the bug persist. Supouts and screenshots provided to support@mikrotik.com again.

We are still exposed to CVEs despite repeatedly informing Mikrotik of this blocking bug.

Come on Mikrotik!

Wyz4k

There you have another problem. Getting an IPsec tunnel to work with another end you don't control is usually an exercise of extreme hair-pulling. Hehe. The important part is up and running and I have end to end connectivity between devices on both ends. The fact that the router has limited access ...

Wyz4k

You are doing it the difficult way. Probably for a reason, but I never recommend plain IPsec tunnels. Instead make a GRE tunnel, with IPsec protection (just put the key in that field on the GRE tunnel config screen and it will automatically create the IPsec config). Put an IP address from a separat...

Wyz4k

Hi pe1chl,

Thanks for the help. I managed the get the router to use the correct IP, now I still need to get the end to end connectivity up.

Wyz4k

One of my routers has a direct Internet connection available, and it also creates an IPSEC tunnel to a couple of remote networks. With my current config I am able to offer clients of the router access to both the Internet and the devices over the IPSEC tunnels. However the router itself is not able ...

Wyz4k

Indeed. I still have regular WiFi issues with my apple products at home.

Wyz4k

Unfortunately I have to report that this issue is still present. I have just tested 6.46.2 and 6.45.8 and they both still contain the same bug. I have again submitted supout.rifs to Mikrotik in the hope that they can fix this issue so that we can upgrade beyond 6.43.12 (the last version that was wor...

Wyz4k

Hi there,

Is it possible to login to winbox with a username + certificate instead of a username + password? From what I can see this is not possible, however it is possible to do this with ssh but then I will have to disable winbox mode.

Wyz4k

By the way, not sure if you guys are using the neighbor broadcast with mesh but there are some issues that's preventing us from using the latest version: viewtopic.php?f=2&t=150330

Wyz4k

Nice! Will give it a try.

Wyz4k

Just popped in for a similar post, same issue. Did you ever find a resolution?

Afraid not. It seems that there aren't many people using the Mesh functionality but unfortunately it is a critical requirement to us. So we are just working around the issues at the moment.

Wyz4k

I think it is like this: after boot, the router first waits for no-ping-delay before doing anything. To give other devices time to initialize and make a connection. Then, it starts pinging at an interval of ping-timeout/6. So, one ping every 10 seconds for the default ping-timeout of 60s. When no p...

Wyz4k

Somehow we have missed to update wiki Watchdog page, now this feature is documented. https://wiki.mikrotik.com/wiki/Manual:System/Watchdog Thank you for the update. watch-address (IP; Default: none) The system will reboot, in case 6 sequential pings to the given IP address will fail. If set to none...

Wyz4k

As I have seen that several of you are in the same problem, I decided to share it with the whole community

Thank you floryluc! Very nice of you to post this here. I will definitely give it a bash.

Wyz4k

My personal view (I'm sure many around here will disagree) is that ICMP with so many network admins (and "admins") blocking it is inherently unreliable. Thus it's unfit to depend upon for device watchdog unless you control all devices involved. E.g. it is probably fine to use pings agains...

Wyz4k

Hi everyone, I'm looking for some advise on the best way to insure that my watchdog ping packet gets prioritized above all traffic. This is what I've tried: [username@device] > /queue tree print Flags: X - disabled, I - invalid 0 name="watchdogQueue" parent=global packet-mark=criticalPacke...

Wyz4k

Hi there, Since v6.44.x there has been a bug with the neighbour broadcasting on mesh interfaces where the message is either not broadcasted or not received. This happens even if the discovery settings is changed to include all interfaces. I have repeatedly escalated this to Mikrotik and repeatedly t...

Wyz4k

In recent versions security package depends on dhcp package :-( Even if DHCP package is installed but disabled, upgrade won't proceed ... so DHCP package has to be installed/enabled before performing upgrade. Meh. It would be nice if they ship the devices with the individual packages installed by d...

Wyz4k

May be don't include modules disabled by default in RouterOS package for smips ? advanced-tools, hotspot, mpls, routing, security -- that modules can be uploaded separately. That's how I managed to resolve the problem. By only downloading the absolute minimum packages required for the next version ...

Wyz4k

Remove unwanted packages. Remove all removable files. Put newer single system package only and reboot. Then add rest of required packages and reboot again. There isn't enough space to do that. This is a remote router. Netinstall is not an option. Trying to upgrade from 6.42.3: I have deleted everyt...

Wyz4k

Same problem here. Trying to upgrade hap lite to 6.43.12. The update is 7.4MB. I have deleted everything from files except for skins that's an empty directory. Files reports 8.4MiB of 16.0MiB used. I've restarted the router and tried again. [admin@nimda] > /tool fetch url=https://download2.mikrotik....

Wyz4k

Please post configuration of "another Mikrotik device on the network" ... it might be that that devices is mis-configured. I am not at liberty to do that - see the info below. I have sent the supouts to Mikrotik. Probably your device is leaking broadcasts between ethernet and wifi, e.g. b...

Wyz4k

I don't believe this is an Apple issue. It wasn't in my case.

Please see my post here: viewtopic.php?f=7&t=96472&p=699200#p699200

Wyz4k

Please see my post here: viewtopic.php?f=7&t=96472&p=699200#p699200

Wyz4k

Hi all, To make a long story relatively short. I also encountered this issue. I tried all of the steps above and they did not solve my particular issue. I'm not saying that they don't also solve variants of the issue, but they did not help me. I did however manage to temporarily solve my issue thoug...

Wyz4k

RFC 5424 compliant syslog client so that I can use a cloud syslog server. https://help.sumologic.com/03Send-Data/ ... log-Source

Wyz4k

did you make a test? what your result say?

It would not be correct for me to speculate about how a feature works. It should be documented.

Wyz4k

As i understand it goes with Ping Start After Boot, so when Watchdog happen it will be ping time out for 60s and then process will start over From what i know there's more to it. It doesn't restart after 1 failed ping, but requires a certain amount of failed pings within a time interval. This shoul...

Wyz4k

Hi there,

ROS 6.43 added *) watchdog - added "ping-timeout" setting;

But this is undocumented. Please add documentation for this new setting explaining exactly how it works.

Wyz4k

@Wyz4k No. I should apologize. I didn't realize it will sound so aggressive. This is certainly about "feature requests". Sometime, requests are great. Sometime not - people submit them due to misunderstanding or lack of information. I just tried to correct some of your statements and I di...

Wyz4k

My mistake. I thought this was the "Feature requests" topic, not the "We'll find creative ways to partially solve your problems in inefficient ways" topic. That being said the snmp get functionality on the mikrotik is useful and isn't something that I've used before. Thanks for t...

Wyz4k

I just want to see average cpu usage on a router somewhere in the field. Now I either have to run: 1) unsecured graphing which can't be queried using a script anyway 2) have to run a 3rd party snmp server because there is no snmp server from Mikrotik and no ability to query snmp registers from the r...

Wyz4k

hello, no solution but a work around not running the ssh command via a script -> importing them via an rsc file /system scheduler add name=run_sshscript interval=24:00:00 start-time=00:00:00 start-date=jan/01/1970 on-event="/import file=sshscript.rsc" the commands (system ssh x.x.x.x comm...

Wyz4k

Please add average cpu usage for the last day / month / year whatever. This makes it possible to at a glance see how hard a router is working. This is done in 'graphing' you can set up resource graphs and access them through webfig (at login hit the 'Graphs' button underneath the login) This will k...

Wyz4k

Please add average cpu usage for the last day / month / year whatever. This makes it possible to at a glance see how hard a router is working.

Wyz4k

as i said you need to create a .rsc file (eg: /system ssh x.x.x.x command="/interface disable ether1") safe it as script.rsc then create the scheduler: /import script.rsc verbose=yes you'll see the script starting and where it gets interrupted I'd love to be proven wrong, but that doesn't...

Wyz4k

Please add the ability to authenticate with a ssh certificate in Winbox - thereby providing an alternative to passwords.

Yes, this is available for ssh, but lots of people (myself included) prefer using Winbox most of the time.

Wyz4k

it works with ssh key you just need to create the scheduler and script with the account linked to the private key. I tried this, but could not get it going. If I manually call the script from the terminal it works fine and connects to ssh, but if I run it with a schedule it doesn't execute and give...

Wyz4k

hello, no solution but a work around not running the ssh command via a script -> importing them via an rsc file /system scheduler add name=run_sshscript interval=24:00:00 start-time=00:00:00 start-date=jan/01/1970 on-event="/import file=sshscript.rsc" the commands (system ssh x.x.x.x comm...

Wyz4k

Ok, let's step back and look at the facts. What is implemented at the moment: An algorithm that does a frequency sweep and literally counts how many MACs it sees in each frequency. It then takes one of the channels with the fewest MACs. Probably not even a random one, probably the top one. What is b...

Wyz4k

Expecting relative cheap Wifi devices like Mikrotik's indoor units, Ubiquity, TP-Link and name many other economic wifi routers for domestic use is the same as asking Formula 1 performances from a Hyundai I10 car..... The problems with Wifi enviroments is that to find the best channel for the AP to...

Wyz4k

Please add all items that are in wireless -> registration table to CAPSMAN -> registration table. I regularly use the last-ip column for example which is not available in CAPSMAN.

Wyz4k

There seams to be a bit more to it unfortunately. One could theoretically use frequency-monitor or snooper to get an idea for how populated the other channels are to make an informed decision. But once you start going down this path you'll quickly see that these functions have been nerfed to make it...

Wyz4k

Please implement a proper auto channel selection that looks at the usage and noise floor of each frequency in the scanlist before choosing a channel. And not one that just counts how many devices it sees per frequency (as per now): https://forum.mikrotik.com/viewtopic.php?f=7&t=122063&p=6773...

Wyz4k

So it is not about signal levels and band utilisation and such things? Just about the number of other devices? OMG! Yes, this is only based on number of networks in each frequency. It is only for home users that don't know which frequency to use. It's shocking to hear that the implementation is tha...

Wyz4k

Hi everyone, Please add a way to authenticate with the Mikrotik router using a certificate similar to how you can authenticate with an ssh server using a private/public key pair. Also then please add a way to disable username / password logins. This is already available for SSH. You just upload you...

Wyz4k

Hi everyone,

Please add a way to authenticate with the Mikrotik router using a certificate similar to how you can authenticate with an ssh server using a private/public key pair.

Also then please add a way to disable username / password logins.

Wyz4k

The woobm is awesome, but it lacks the ability to paste. Please add a "paste" button. If you are only interested in the switch/router the woobm is connected to via USB, then use telnet instead. You're telnet client C&P will work just fine. This is the feature requests channel. I am re...

Wyz4k

Bump. I too would love to know how to extract the actual error message. [support@router] > { :put [:resolve www.example.com.m]; :put "lala" failure: dns name does not exist In a do: on-error: setup, how can I read the "failure: dns name does not exist" into a variable so that I c...

Wyz4k

So I tried writing a script that if it sees "kernel failure in previous boot" or similar error messages in the boot log it automatically generates a supout.rif and emails it to me so that I can submit it to Mikrotik. Unfortunately the /tool e-mail refuses to send .rif files when it's calle...

Wyz4k

Hi there,

Using OSPF is it possible to setup a filter to drop a 0.0.0.0/0 route through gateway 192.168.1.1, but to at the same time allow other 0.0.0.0/0 routes?

I've tried using egress and ingress routing filtering but with no success.

Wyz4k

I'm getting the same problem only on 5Ghz, and I have confirmed that both APs have the same country set.

Wyz4k

Thanks, seems I underestimated that issue. When I read that it !) winbox - fixed vulnerability that allowed to gain access to an unsecured router; it did not seem like such a big deal as my routers were "secured", but clearly that was not the meaning of that line. It would have been better...

Wyz4k

Hi everyone, Please scour your routers for dodgy accounts in ppp secrets. One of our extremely secure routers running ROS 6.41.2 has been compromised by what I believe must be a security vulnerability. This router has brute-force protection and ridiculous passwords which would have made brute-forcin...

Wyz4k

3GB is less than ROS? ROS is 20-40MB...

Wyz4k

@Wyz4k: There's also Select All in right-click menu.

There is indeed. Thanks Sob, you are a legend!

Wyz4k

In the scripts and schedules editor in winbox can we please add the ability to select all - ie ctrl a? At the moment in order to select a big script you have to manually drag from start to finish.

Wyz4k

The woobm is awesome, but it lacks the ability to paste. Please add a "paste" button.

Wyz4k

Hi there,

Has anyone tried using a Gemalto 4G module in a Mikrotik router? Something like https://navisys.en.taiwantrade.com/prod ... 48792.html ?

Wyz4k

Are you running any scripts? It could be a script that is causing this (high console usage).

Wyz4k

I also hope this has interchangeable plugs.

Wyz4k

SIMCOM SIM7100E

Wyz4k

I haven't done any more testing on the MC7430, but I have asked Mikrotik to look into the firmware stability now that the MC7304 has been made end of life.

Personally we've moved to a different radio that's cheaper and offers better functionality.

Wyz4k

Nope, it's not a privilege thing. It's functionality not allowed by Mikrotik

Wyz4k

not three tunnels but three policies, or maybe you can "summarize" your 3 remote subnets into one bigger supernet

Unfortunately one big supernet isn't really an option unless I want to risk cutting out a lot of potential Internet IPs.

Wyz4k

I've managed to get the tunnel working. What I had to do was to add a separate NAT rule which masqueraded traffic from my local LAN heading towards the ipsec traffic so that it uses the routers IP which the tunnel allows. My final issue now is that it does not look like I can add multiple destinatio...

Wyz4k

Wow carl0s, you are awesome. Thanks mate. I am getting really close now. With the tunnel established, if I ping the IP within the subnet using the src-ip of the ipsec tunnel I get a reply. But the reply comes back from one of my local interfaces instead of the remote IP. Basically my router has a co...

Wyz4k

Thank you carl0s, I see, so I don't have to worry if I don't see a route to that network in the routing table. I have one more thing that I can try to fix the issue. At the moments my ping to the dst-net time out.

Wyz4k

Hi guys, I'm trying to setup an IPSEC tunnel between a Mikrotik and an ISP controlled IPSEC tunnel. They've provided me with the public peer IP, IKE1 details, IPsec transform set, IPsec profile etc. And using this I've been able to get it to the point where the tunnel is established. My questions: 1...

Wyz4k

Hi there, I'm trying to determine which mac-addresses are available on which interface of the mesh using the mesh's FDB. A print returns the info that I need, but any attempt to extract the information through a script fails. I suspect that it happens because no unique counters are assigned when you...

Wyz4k

It's all indoor use yes.

Wyz4k

Hi there, How can I in a script detect the bold+italian text error below? On the console this text is displayed in a reddish brown colour. [admin@NG200B021700119] > /interface wireless monitor wlan1 ;;; no supported channels status: disabled channel: 5180/20/ac/P(16dBm) noise-floor: -104dBm authenti...

Wyz4k

Hi there, I'm seeing a new issue with 6.41rc52 where the router reports "No supported channels" on wifi. This may be related to some of the channel changes that I've seen in the changelog "wireless - updated "united kingdom" regulatory domain information;" This gateway ...

Wyz4k

As far as I understand, WPA encryption is done on the wifi chip not on CPU. So these chips are designed to handle that amount of traffic and encryption/decryption. IPsec and other VPNs are done on CPU. Your routerboard simply doesn't have a powerful enough (or with AES support) CPU to do what you a...

Wyz4k

You've got that backwards. ipsec existed long before WPA anything. Yeah I know that, but I am primarily using wifi and falling back to ethernet when the signal is too bad or the distance too great. If the wifi security is good enough for the wifi links, then something equivalent should also be good...

Wyz4k

The RB in question is the RB922. Unfortunately not super beefy. What's the best I can do on RB922?

Ultimately the security has to be comparable to a wired version of wpa-psk2.

Wyz4k

Hey guys, I'm looking for a secure alternative to eoip to connect two routers to one another over Ethernet. It must also be something that I can then add as a mesh port. EoIP does what it needs to do but the performance knock is massive. Over a Gbps ethernet link I'm only getting around 10MB/s of re...

Wyz4k

Hi guys, Just received a notification that the Sierra Wireless MC7304 will go EOL (end of life) in May 2019. http://m2mconnectivity.com.au/m2m-connectivity-newsletter-august-2017/ The recommendation is to start looking at switching to the MC7430 but there are lots of stability issues with that card ...

Wyz4k

Hi there, Try adding a src nat allow rule to allow your local lan subnet to the dst network address. /ip > firewall > nat > src addr */local subnet/* dst */remote network allow Hope that helps. Thanks for the advice. I already have that, but I failed to quote it :) add action=masquerade chain=srcna...

Wyz4k

Hi there, I have successfully setup an ipsec tunnel over the Internet, and the PH2 State is established, but no traffic is flowing over the tunnel. If I ping one of the IPs that should be reachable over the tunnel I get a timeout. myIP = my Internet IP. theirIP = their Internet IP. myLocalNet = my L...

Wyz4k

Further response: from 6.41rc13 change-log: *) lte - improved reliability of USB LTE modems; if possible please test this in isolated environment, because we are getting mixed reviews from customers about this fix usefulness. Even though it says just USB LTE modems this also affects miniPCI-e: Yes, ...

Wyz4k

I received this response from Mikrotik support one or two days ago: This issue is already fixed in the latest Release Candidate version of RouterOS.

Wyz4k

Please add SMB support to the fetch tool or the ability to limit FTP accounts to specific folders to the FTP server. The SMB server is considerably more advanced than the FTP server on Mikrotik and makes it easier to limit clients to a specific folder.

Wyz4k

That's a shame.

The FTP client is sorely lacking in features, and it would be really handy if I could use the samba client to limit the client to a particular folder and then use fetch to download from that folder.

Wyz4k

Hi there,

Is it possible to do a /tool fetch from a samba server (another router)? Or any other method that can access a SMB share.

Wyz4k

 ppp - added output values for "info" command for finding the GSM base station's location ("LAC" and "IMSI");

I've upgraded to ROS6.40.1 but don't see any LAC or IMSI info in the ppp - info command. Neither in Winbox or in the CLI. Is there any more info available?

Wyz4k

I had to disable my firewall for a few minutes to get netinstall to work.

Wyz4k

If you stop the ntp client does it still say started? If so the service has crashed and you will have to reboot (send a supout to mikrotik about it before you reboot). If it correctly switches back to "using local clock" it means that the service is still okay.

Wyz4k

going to Tools -> Clear Cache in Winbox has helped for one occurrence of this. But it just fixes the symptom not the root cause.

Wyz4k

Kernel failure message says - there was a problem with router. What kind of problem - you can not say just by seeing log message. If you experience kernel failure reboot, then upgrade router to latest RouterOS version. If problem persist also after upgrade, then after kernel failure generate supout...

Wyz4k

Getting this issue on one router running ROS6.38.5

Wyz4k

Unfortunately this issue is still present. I have numerous routers deployed in the field with identical configurations. Some of them are stuck in the "started' state but never reach synchronized even though the servers can be pinged. Disabling / Re-enabling does not help the issue. I suspect th...

Wyz4k

I implemented L2TP + IPSEC on RB922, but found that it's performance was asymmetrical and it reduced the performance of traffic from the router to my PC by a factor of 100 which made it practically unusable. OpenVPN is the way to go. It's secure, and fast.

Wyz4k

Yep, L2TP+IPSEC was almost unusable. From a basically synchronous line there developed a factor 100 difference between upload and download speed, which meant that when I pulled data from a remote site I only got 300bytes/second. PPTP did not show this performance penalty, but is no longer secure. I ...

Wyz4k

Hey guys, I have a weird problem that I'm trying to understand and resolve. I have a remote router with a 3G connection. If I directly connect to the public IP and copy to it or pull from it I get a reasonable data rate that is almost perfectly symmetrical. If however I form a VPN connection this sa...

Wyz4k

A. Try to connect with MAC and check if refreshing works.
B. You need to clear session state of WinBox.

Hi BartoszP, could you give a bit more info?

I know how to connect to MAC, but how do I refresh? Or do you imply that it will happen automatically?
How do I clear session state?

Wyz4k

Try upgrading Winbox..

https://wiki.mikrotik.com/wiki/Winbox_changelog

What's new in v3.8:

) support RouterOS v6.39;
) fixed problem when table header was hidden if filters were activated;
) after Log window was opened second time, updates were not displayed automatically;

I am using v3.11.

Wyz4k

Hi there, I'm encountering an issue on ROS 6.38.5 where the winbox log has stopped updating. Freeze is not selected. I have tried closing and reopening the log several times. I've tried it with freeze selected and unselected. I've switched from memory to all and vice versa. Nothing. The latest entry...

Wyz4k

Hi

You need to fill out your email settings in
Code: Select all
/tool e-mail
set address=smtp.gmail.com from=<mail@gmail.com> password=abc1234 port=587 start-tls=yes user=mail@gmail.com

I have filled that in. I am using SMTP elsewhere.

Wyz4k

Hi there, I'm trying to setup the watchdog to automatically generate and email a supout.rif file to me. According to the manual it should be possible to leave the send-email-from and send-smtp-server fields blank and in doing so allow it to use the settings from /tool e-mail. However this is not pos...

Wyz4k

Answering my own question after support gave me the answer: It's possible to clear ghost USB devices by doing a power-reset on the USB port. However it may be necessary to reset bus 2 even though the device shows that it is on bus 1 and vice versa.

Wyz4k

You can't get any newer Sierra Wireless modems (apart from MC77xx) to work without a PPP interface. I email MikroTik support every time a new SW modem comes out and the response is always the same: "yes, it works 100% in v7". This really means "no, it only works with PPP and we've go...

Wyz4k

I'm guessing but try this. System > Routerboard > USB and set the USB port to Mini-PCIe On the RB953 you can only run either the type A port or the mini-PCIe ports. Hopefully it will then show up in the System > resources > USB System > ports list Also don't forget to tape the USB 3.0 pins on the M...

Wyz4k

RB922

Wyz4k

You can't get any newer Sierra Wireless modems (apart from MC77xx) to work without a PPP interface. I email MikroTik support every time a new SW modem comes out and the response is always the same: "yes, it works 100% in v7". This really means "no, it only works with PPP and we've go...

Wyz4k

I've just decided to give a MC7430 a try, and I can't even get it to be picked up in the USB tab. I've made sure that it's not in direct-ip mode, and I've rebooted several times. I've power-resetted the USB several times. Nothing. I downgraded to 6.35.4 and my device got stuck in a endless boot rese...

Wyz4k

I too would love to have this to start testing LTE on MC7304.

Wyz4k

Hi there, According to https://wiki.mikrotik.com/wiki/Supported_Hardware#4G_LTE_cards_and_modems the MC7304 works for LTE and PPP in v7.xx of ROS, but unfortunately as there isn't even a beta version of that ROS available is there any possibility that I would be able to get it going in v6.39.1? Any ...

Wyz4k

I would like to request the required changes in order to allow 3G/LTE signal strength to be monitored on a continual basis without interrupting the signal - see https://forum.sierrawireless.com/viewto ... 108#p41108

Wyz4k

but where would you see the output? there is no monitor port ...

There are many other options of communication available. The LEDs, the speaker, the sms functionality, sending an email etc.

Wyz4k

Hi there, Is there a way for me to clear out ghost USB devices? I see devices lingering around in system resource USB after they've been plugged out. It's even possible to have two identical copies of the same device in the USB list (based on serial number, device id and vendor id) just on different...

Wyz4k

HI guys, Is it possible to plug a USB keyboard into the USB port of a RB and interact with the router in any way? I've plugged in a keyboard and I've seen that it detects it correctly as a keyboard so driver's shouldn't be a problem. I've tried using the port, screen and serial terminal interfaces w...

Wyz4k

Could we get a proper AT command + reply interface? Sending down AT commands in the info string and then having them randomly overwrite some output as a response is far from ideal. On that same topic, it would be great if the /interface ppp-client info section can be rewritten to go away and read al...

Wyz4k

Hi there, I'm struggling with an issue on the Sierra Wireless MC7304 where I've only been able to find a single communication channel between the routerboard and the modem - channel 2. I've tried all other combinations, but channel 2 is the only one that responds. I can only use this channel for eit...

Wyz4k

Please add the ability to ping / ssh / telnet / other from the ip dhcp-server screen in winbox. This is already offered from the wireless registration page. Any chance we could get the ability to form simple socket connections / ssh from the router in a script? Currently it's really one sided in tha...

Wyz4k

Two things are required:
1) proxy-arp on the local interface that your LAN is connected to.
2) a masquerade rule between the local LAN subnet and the single remote IP in the same subnet.

Wyz4k

seems we have to leave it to Mikrotik guys do decide which way to go

Indupitably

Wyz4k

I can pick it up on the input chain... Just booted up some 6.39 CHR in GNS3 real fast and logged traffic from an ACL as well as verified in WireShark. 14:18:15 firewall, info input: in:ether1 out:(none), src-mac 00:00:5e:00:01:01 proto 112, 10.1.1.253->224.0.0.18, len 32 /ip firewall filter add act...

Wyz4k

Hi there, I'm having a peculiar issue that I've now seen on two different routerboards. To fix the issue on the first one I basically had to netinstall it and reload the config. Essentially the DHCP server runs fine for a period of time, and then after some unknown trigger it goes into an "I&qu...

Wyz4k

https://tools.ietf.org/html/rfc3768#section-7.2 It sounds easy enough. I'd turn on logging w/a global drop in GNS3 to see which chain and interface you need in particular. This may be further complicated if you are using bridges. If so you'll have to enable the use-ip-firewall flag on the bridge at...

Wyz4k

I would love if I could run a script as a firewall action. this would degrade the packet forwarding performance in an unpredictable but disastrous way. but you can log the match with custom tags, parse logs with scheduler, and fire actions as needed. You mean like inspecting every packet with a lev...

Wyz4k

I would love if I could run a script as a firewall action. this would degrade the packet forwarding performance in an unpredictable but disastrous way. but you can log the match with custom tags, parse logs with scheduler, and fire actions as needed. You mean like inspecting every packet with a lev...

Wyz4k

The devices are directly connected either through mesh, or through Ethernet with an unmanaged switch. There isn't anything else in-between. What concerns me is that I'm not able to stop multicast going out even if I try. a reject/drop rule on the multicast dest ip and output chain doesn't trigger at...

Wyz4k

I'm also having an issue with this.

I am trying to block VRRP, and if I drop VRRP (proto 112) on output chain and also separately drop dest 224.0.0.18 on output chain it doesn't trigger at all. And on receiving router it gets the packet from proto 112 heading towards 224.0.0.18...

Wyz4k

Hi there, ROS 6.38.5 I'm trying to figure out which ports I need to open to get VRRP to work, by taking a working setup and breaking it. So far I haven't been able to break it even after dropping practically everything it still works. I need some help... How can I break VRRP in IP firewall? Edit: On...

Wyz4k

From your description it sounds like the VRRP broadcasts don't make it to the other routers. Might there be a firewall for inbound traffic on these firewalls that blocks this? Hi mavink, I'm back on this topic again. I've looked for which ports / protocols need to be opened for VRRP and there isn't...

Wyz4k

Can we get standard 802.11s support? https://wiki.mikrotik.com/wiki/Manual:I ... e/HWMPplus indicates that the HWMP+ protocol is based on 802.11s draft but is not compatible with it.

Wyz4k

Thank you, I will try it out!

Wyz4k

Please add the ability to do a where query in [] with any valid-variable. fail example: :local identity "testRouter" :local interface [/ip neighbor find where identity=$identity] fail reason: result differs from :local interface [/ip neighbor find where identity="testRouter"] con...

Wyz4k

Could we get the LAC (local area code) also being displayed in in the info box for 3G/4G modems? This information is required to locate the sim. Currently the cellid is being displayed and it's possible to determine MCC and MNC. See http://cellidfinder.com/

Wyz4k

Please make it possible to change the comment associated with a connection without it restarting said connection.

Wyz4k

If I got a call from a client with intermittent internet I just log into his CPE and see what happened. Power cuts, Ethernet drops (=cable), wireless disconnects. Etc. simple. Most of the client I don't look into for months not years. For a full scale syslog system there is no need. If the software...

Wyz4k

I'm getting this error in ROS 6.38.5 on RB751U-2HnD when I try to create an unencrypted backup. I upgraded to the release candidate 6.39rc72 as that appears to have solved a lot of the issues here and I'm still getting the error. I ran a check installation which reported that installation is ok. I h...

Wyz4k

But because the topic field is hardcoded I have to try and choose one which hopefully won't carry other traffic. Just make one identical to the default you use. Critical/Error/Info/Warning are the defaults that go into your LOG screen. I can do that, but if I could create a custom one I could signi...

Wyz4k

Make a new logging action=file, then make a new logging rule with this action. after done debugging, delete it. I've tried this and it would work okay if I could create my own topic. But because the topic field is hardcoded I have to try and choose one which hopefully won't carry other traffic. Thi...

Wyz4k

Make a new logging action=file, then make a new logging rule with this action. after done debugging, delete it.

I'll try that.

What about adding support for a ring buffer where it deletes the oldest and moves everything up as an alternative to "Stop on Full"?

Wyz4k

Two reasons I can think of, both have affected me over the last few days: 1) For debugging purposes I really don't care about the history at this particular moment in time and would like to clear the log, try something and look at a minimized version of the log that hasn't been filled by my previous...

Wyz4k

Unfortunately this method no longer works. I have done a feature request for a "clear log" function to be added.

Wyz4k

Please add a button to clear the log. It's practically impossible to try and debug routers over crappy connections when just attempting to load the log causes the connection to break. If I could periodically clear the log it would reduce the traffic enough for the connection to remain viable. I've t...

Wyz4k

Is not it easier to use simple queues for these ip and watch traffic there?

Mmm, that's probably the best suggestion yet.

Wyz4k

Sounds like VLANs with IPs on bridges to me...

Is that a possible solution, or a similar problem?

Wyz4k

Hey guys, I have a router with only one Ethernet interface that has multiple IP addresses on different networks on that Ethernet interface. Is there a way for me to create virtual interfaces that I can assign the individual IP addresses to instead? The benefit of this would be that I could then see ...

Wyz4k

Hi there, I'm trying to implement VRRP on three routers. They have unique IP addresses on the network and then share one IP address on the VRRP interface. I've tried: 1) Making the VRID the same, or different on all devices 2) Making the VRRP IP /32 or /24 3) Changing the master interface from a mes...

Wyz4k

Bridge-like filtering (L2) for Mesh.

Wyz4k

It should be yes. Are you using one of the newer ROS versions?

See http://stevedischer.com/mikrotik-adds-b ... -wireless/

Wyz4k

Edit: Scratch that.

Wyz4k

The ability to copy and paste data more easily.
1) Selected text from the log to the clipboard.
2) From random tables into the clipboard in csv format.

Wyz4k

Hey guys,

Any update on this?

Wyz4k

It will be good if RouterOS will have integrated brute force protection and filter.

Most definitely! The current "implementation of brute force protection" is a joke. A counter on port visits as opposed to actually checking whether the login succeeds or not.

Wyz4k

Or any solution in 2017?

Wyz4k

Have you tried experimenting with admin-mac? I would expect some at least a brief interruption if a device's MAC address changes when it switches between interfaces. At least it is my understanding that the admin-mac allows you to define one MAC address for the mesh which should theoretically stop s...

Wyz4k

Mesh will work fine. Although I am currently experiencing some issues with the mesh preferring WLAN even when an Ethernet link is available. See http://forum.mikrotik.com/viewtopic.php ... 88#p579788

Have you tried setting CTS to Self on all of the devices?

Wyz4k

Have you tried cts-to-self?

Wyz4k

Hi there, Just found a bug with the watch dog timer that is present in v6.38 at least. Setup: Set a watch dog timer to ping an address, say 8.8.8.8. Tick enable watchdog timer. So far this works as intended. However if you go back and untick watchdog timer, it still resets if it's unable to ping 8.8...

Wyz4k

Hi there, I have a working dynamic mesh between three devices over WLAN. But as this mesh could become a lot bigger I would like to have the flexibility of using ethernet links between some devices to reduce wireless usage / interference etc. However when I add the ether1 interface to the mesh, it s...

Wyz4k

I have a mesh 802.11 network between three routers. If I use compress-all between them my Winbox connections to remote routers close sporadically. If I remove IP packing the disconnections stop. I then gradually re-enabled IP packing and could go up all the way to compress-headers without the connec...

Wyz4k

Hi there, How can I determine the status of the access point through the terminal or scripts? I need to determine in a script whether the WLAN status is currently "running ap", or "detecting radar", or whatever else. In Winbox I can see it by double clicking on the interface and ...

Wyz4k

ip -> neighbours would only be valid once you have connected to the network.

I'm trying to decide which network to connect to based on the information that I read from the scan.

Search found 245 matches