Community discussions

MikroTik App

Search found 186 matches

by dog
Tue Jan 19, 2016 12:15 am
Forum: General
Topic: Packet Mark no longer retained after decrypting IPSec in v6?
Replies: 3
Views: 1322

Re: Packet Mark no longer retained after decrypting IPSec in v6?

So, while I can no longer get the packet marking to work like in v5 there now seems to be a native replacement: /ip firewall filter> add ipsec-policy= IpsecPolicy ::= Direction,Policy Direction ::= in | out Policy ::= ipsec | none Setting it to "in,ipsec" will only match packets that were ...
by dog
Thu Jan 07, 2016 11:43 am
Forum: General
Topic: Packet Mark no longer retained after decrypting IPSec in v6?
Replies: 3
Views: 1322

Packet Mark no longer retained after decrypting IPSec in v6?

Hi, I've had a RB450 running RouterOS 5.26 which I now had to replace with a newer model. On v5 I had a mangle rule like this: add action=mark-packet chain=prerouting dst-address-type=local dst-port=4500 log-prefix=MARK new-packet-mark=ipsec-input passthrough=no protocol=udp I could then use that to...
by dog
Sat May 16, 2015 3:05 am
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

Re: NPTv6 / RFC 6296 Support?

You lost my attention at "ssl vpns are better". Lol. Really? Yep, for the very simple fact that SSL/TLS is a proven protocol with widespread use and pretty good understanding of the basic workings in the security community. IPSec on the other hand * has much too many switches left to the ...
by dog
Sat May 16, 2015 1:35 am
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

Re: NPTv6 / RFC 6296 Support?

It's breaking the end to end connectivity rule. There is no "end to end rule". "End to End" is a theoretical design maxim, much like the OSI model. NPTv6 would only be a problem for applications that violate the OSI layer model in regards of separation of concerns - those applic...
by dog
Fri May 15, 2015 11:51 pm
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

Re: NPTv6 / RFC 6296 Support?

Given the fact that IPv6 allows header stacking, maybe a new header similar to the dreaded source routing will come into use It's already there, and just as horrible as one would think – unless they got rid of it in the recent years: http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf AFAIK there...
by dog
Fri May 15, 2015 6:24 am
Forum: RouterBOARD hardware
Topic: S+31DLC10D and HP 5130-24G-4SFP+ EI Switch
Replies: 2
Views: 1204

Re: S+31DLC10D and HP 5130-24G-4SFP+ EI Switch

If you plan to use the S+31DLC10D in the HP switch:
In general HP does vendor code checking on SFPs, so only "HP-branded" models will work.
That switch however seems to be originally from 3com, where it may be different.
by dog
Fri May 15, 2015 6:00 am
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

Re: NPTv6 / RFC 6296 Support?

NPTv6 is not "NAT" as you are implying that would mean "stateful Adress/Port Translation". NPTv6 does nothing of that sort, it simply does stateless prefix translation. Also, unlike NATv4 which more or less just "happened" with all kinds of implementation incompatibilit...
by dog
Wed May 13, 2015 4:41 pm
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

Re: NPTv6 / RFC 6296 Support?

Any news on this?
Linux kernel 3.13 already seems to have native support for NPTv6.
by dog
Sat Apr 04, 2015 8:26 pm
Forum: General
Topic: PPTP server on alternative routing table fails when client is not reachable via main routing table
Replies: 0
Views: 705

PPTP server on alternative routing table fails when client is not reachable via main routing table

Hi, * Have a PPTP server running on 6.27 * Some sessions that come in via a certain interface also need to go back out through that interface * Works fine with mangle/routing marks. * However if the main routing table (which is not used here) does not know the destination, ROS will drop the response...
by dog
Sat Mar 29, 2014 6:27 am
Forum: General
Topic: No idea how this is event possible
Replies: 14
Views: 4209

Re: No idea how this is event possible

The RB2011 is "rated" at about 700Mbit/s: http://routerboard.com/RB2011UiAS-IN (the value in the lower right corner is closest to real-world) so it is unlikely that you will get 1 Gbit out of it anyway. Please post a configuration export. To test for a bottleneck first clear the router con...
by dog
Fri Mar 28, 2014 12:20 pm
Forum: General
Topic: No idea how this is event possible
Replies: 14
Views: 4209

Re: No idea how this is event possible

What Routerboard do you have?
Most likely you are simply maxing out the CPU.
by dog
Tue Mar 11, 2014 10:59 am
Forum: General
Topic: PBR - Ensure traffic leaves the same interface it arrives on
Replies: 10
Views: 9748

Re: PBR - Ensure traffic leaves the same interface it arrive

Well, take a look again at what I said:
Create a second rule that applies a new routing mark to packets marked with the connection mark and coming from the DMZ.
Right now you are switching inbound traffic to a routing table that no longer has the destination it is supposed to reach.
by dog
Mon Mar 10, 2014 6:32 pm
Forum: General
Topic: how to block open proxy in mikrotik
Replies: 1
Views: 1356

Re: how to block open proxy in mikrotik

I assume you are referring to sites like HideMyAss?

The simple answer is: Using a blacklist approach you will never be able to block a significant number of those sites, there are just too many.
Thus if you really need to block it, you will have to go switch to a whitelist setup.
by dog
Mon Mar 10, 2014 6:21 pm
Forum: General
Topic: PBR - Ensure traffic leaves the same interface it arrives on
Replies: 10
Views: 9748

Re: PBR - Ensure traffic leaves the same interface it arrive

This should be quite easy using two mangle rules. Create a first rule that marks connections coming from the VPN tunnel and not having a mark already. Create a second rule that applies a new routing mark to packets marked with the connection mark and coming from the DMZ. Add a new routing table with...
by dog
Mon Mar 10, 2014 5:31 pm
Forum: General
Topic: eduroam: VLAN assignment based on RADIUS 802.1x reply
Replies: 40
Views: 22687

Re: eduroam: VLAN assignment based on RADIUS 802.1x reply

Basically the problem is that wireless clients do not create an interface on MT (except for WDS) so you can't put them in a VLAN. The workaround would be to use a Virtual AP and create two WLANs for eduroam guests and local users and bridge them to different VLANs. Then you would have to configure f...
by dog
Mon Feb 24, 2014 1:19 pm
Forum: Wireless Networking
Topic: 802.11u, Hotspot 2.0?
Replies: 3
Views: 2403

802.11u, Hotspot 2.0?

So while reading the CAPs Manager article I saw the first official mention of 802.11u and Hotspot 2.0 from Mikrotik. Does this mean we will get support for those features soon? Will it be limited to CAP or available in all configurations? I'm especially interested in the server-side-only EAP-TLS par...
by dog
Sun Dec 22, 2013 4:58 pm
Forum: General
Topic: 100's of devices with similar mac & hostnames depleting ip's
Replies: 13
Views: 8283

Re: 100's of devices with similar mac & hostnames depleting

There is not much you can do in a hotspot scenario (with known users you can always lock down on MACs) * Increase DHCP pool -> Attack will take longer and fill up more memory * Decrease lease time (In a public hotspot I'd say you can go as low as 1h) * "DHCP Greylisting": Use the authorita...
by dog
Sun Dec 22, 2013 4:34 am
Forum: Wireless Networking
Topic: Mikrotik vs Ubiquiti Unifi
Replies: 23
Views: 22314

Re: Mikrotik vs Ubiquiti Unifi

Not currently. Mikrotik is working on a controller feature, but it isn't out yet.
Is there actually any official statement from MT on this? ("Yeah, we will consider thinking about doing it in the future" doesn't count)
by dog
Sun Dec 22, 2013 4:10 am
Forum: General
Topic: 100's of devices with similar mac & hostnames depleting ip's
Replies: 13
Views: 8283

Re: 100's of devices with similar mac & hostnames depleting

DHCP Exhaustion Attack is a pretty old type of DoS.
As with all kinds of DoS some people do that just for fun (which I assume is meant by "joke" here).
by dog
Mon May 27, 2013 4:33 am
Forum: Beginner Basics
Topic: Route
Replies: 2
Views: 1376

Re: Route

by dog
Mon May 27, 2013 4:30 am
Forum: Beginner Basics
Topic: RB493G + 3 radio
Replies: 8
Views: 2384

Re: RB493G + 3 radio

There is a huge difference between

* One radio with 3x3 MIMO
* Three radios with whatever

You can stick 3 radios in a RB493G, but you can't do 3x3 MIMO with it as those cards are all miniPCI-e and the RB493G only supports miniPCI cards.
by dog
Tue Apr 23, 2013 2:53 pm
Forum: RouterBOARD hardware
Topic: Dualband AP with Mikrotik - what hardware?
Replies: 5
Views: 2331

Re: Dualband AP with Mikrotik - what hardware?

By the way, how many clients can be connected to a single RB751? - I am just wondering, if I can spread the devices out a little to cover a greater area ... Vendors usually don't make statements about that...I've taken as a general rule for better APs: 20-25 active users, 50 users max. with most of...
by dog
Wed Jan 30, 2013 8:47 pm
Forum: Wireless Networking
Topic: what is the "best" signal?
Replies: 15
Views: 10838

Re: what is the "best" signal?

I set a higher antenna gain than there really is.
by dog
Wed Jan 30, 2013 6:58 pm
Forum: Beginner Basics
Topic: What free VPN client to use with my PPTP server on Mikrotik?
Replies: 4
Views: 2774

Re: What free VPN client to use with my PPTP server on Mikro

Do those clients even support PPTP?
Nope, Checkpoint, Cisco and ShrewSoft (the last one) are all IPSec-Clients.

AFAIK There is no Third-Party PPTP Client for Windows.
by dog
Wed Jan 30, 2013 6:49 pm
Forum: Wireless Networking
Topic: what is the "best" signal?
Replies: 15
Views: 10838

Re: what is the "best" signal?

SNR < 23 too low
SNR 30-40 target range
SNR > 50 too strong

That's my general rule of thumb.
by dog
Wed Jan 23, 2013 5:28 pm
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 53
Views: 15770

NPTv6 / RFC 6296 Support?

So as it stands now most bigger ISPs have decided to still give out dynamic prefixes with IPv6.
That again makes the case for NAT.

NPTv6 provides a simple stateless NAT that only translates one prefix to another.
Any chance we are going to see at least sect. 2.1 of the RFC in a future ROS?
by dog
Sun Jan 13, 2013 11:37 pm
Forum: General
Topic: OVPN on new versoins ROS 6.0 and 5.1...
Replies: 61
Views: 25787

Re: OVPN on new versoins ROS 6.0 and 5.1...

Can you please explain in a few words to us why mikrotik team does not wish to implement those features nevertheless they are requested by so many users on this forum for quite some time. Stubbornness. OpenVPN/UDP is the by far most requested feature on the forums and in the wiki and MT rather chos...
by dog
Sun Jan 13, 2013 11:16 pm
Forum: General
Topic: Is anyone using RouterOS as an ISP DSL aggregator box?
Replies: 7
Views: 1827

Re: Is anyone using RouterOS as an ISP DSL aggregator box?

Such reseller setups are often PPPoE over L2TP and AFAIR MikroTik still has problems with that.
by dog
Sun Jan 13, 2013 11:01 pm
Forum: Forwarding Protocols
Topic: Stop redirect ICMP
Replies: 3
Views: 1965

Re: Stop redirect ICMP

Yes, this is a routing loop.

On router A (where your pppoe ac is?) you have to create a static route with destination your whole pppoe subnet and type unreachable.
by dog
Sun Dec 16, 2012 11:22 pm
Forum: General
Topic: Testing my ISP for burst throttling
Replies: 4
Views: 2026

Re: Testing my ISP for burst throttling

Actually it is an ISP problem. Youtube is hugely popular which for an ISP means they would have to upgrade their peering with youtube. However many ISPs came up with the idea that charging twice for the same thing is better than charging once so they try to blackmail Youtube by saying "Either y...
by dog
Sun Dec 16, 2012 11:12 pm
Forum: General
Topic: Clearing Owner/Info Pair Table
Replies: 10
Views: 2646

Re: Clearing Owner/Info Pair Table

Mikrotiks IP pools works like DHCP in that it tries to always reassign the same address whereas home users have come to expect from their ISP to get a new address every time they log in. This has been discussed on the forums and MT refuses to change it. Your best choice would be to use a RADIUS serv...
by dog
Sun Nov 11, 2012 10:09 pm
Forum: RouterBOARD hardware
Topic: Mikrotik RB951-2N-Level 4
Replies: 1
Views: 1291

Re: Mikrotik RB951-2N-Level 4

My internet bandwidth is ~80mbps, but the traffic I receive during the flood is 500mbps+ No router can help you with that. Only your ISP can block the IPs, but once the traffic reaches your router your connection is already full. Also the RB951 is a home user device that will probably not handle th...
by dog
Sat Nov 10, 2012 3:03 am
Forum: RouterBOARD hardware
Topic: CLOUD CORE ROUTER
Replies: 1373
Views: 1186490

Re: CLOUD CORE ROUTER

AFAIK, Tile-Gx 8000 series has only 16-, 36-, 64- and 100-core versions :)
9, 16, 36:
http://www.tilera.com/sites/default/fil ... 036-02.pdf
64 Core is a different family:
http://www.tilera.com/sites/default/fil ... r_A_v4.pdf
by dog
Sat Oct 27, 2012 2:49 am
Forum: RouterBOARD hardware
Topic: NEW PRODUCT - Cloud Core Router
Replies: 104
Views: 44105

Re: NEW PRODUCT - Cloud Core Router

Of course it is not "stable", whatever you mean by that. No company would just put a finished product on the self and tease users :) Usually when the price is released that means that the product is 1-3 months away (ie. initial production run, last bug fixes,...) So right now I'd say there...
by dog
Thu Oct 25, 2012 5:45 pm
Forum: Wireless Networking
Topic: 300 vehicles in one place
Replies: 5
Views: 2288

Re: 300 vehicles in one place

Never put more than 25 clients on a single AP (true for any vendor with standard 802.11) The client chooses which AP it uses. In ROS you can only limit the maximum amout of clients that can connect (if that is reached a client might try another AP). In general your best bet is to reduce the AP TX po...
by dog
Wed Oct 24, 2012 8:55 pm
Forum: Forwarding Protocols
Topic: RB751G-2Hnd igmp-proxy ?
Replies: 2
Views: 4956

Re: RB751G-2Hnd igmp-proxy ?

IGMP Proxy is a separate package.

Download the ZIP(!) file from http://www.mikrotik.com/download and extract it.
Take the igmpproxy.npk and drop it on the Winbox window.
Reboot the router and the package will be available under System > Packages
by dog
Tue Oct 09, 2012 10:45 pm
Forum: General
Topic: vlans/trunk between juniper switch and mikrotik
Replies: 10
Views: 3868

Re: vlans/trunk between juniper switch and mikrotik

Show your Mikrotiks configuration.

ros code

/export compact hide-sensitive
by dog
Mon Oct 08, 2012 2:33 am
Forum: General
Topic: Feature request: MLPPP server
Replies: 31
Views: 13125

Re: Feature request: MLPPP server

Has been a request for years:

http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

(Also take a look at OpenVPN/UDP on that page to see how much Mikrotik cares about user requests)
by dog
Sat Oct 06, 2012 12:44 am
Forum: General
Topic: blocking Mac Address by vendors
Replies: 2
Views: 1571

Re: blocking Mac Address by vendors

No, this can't be done.
Neither on MT, nor any other vendor because there is no MAC-ID for "iPhone" or "Android".
Only Apple, Samsung, ASUS, etc.

Apart from that you can use Bridge Filters to block MAC-ID ranges.
by dog
Fri Oct 05, 2012 11:25 pm
Forum: General
Topic: Newsletter 41: NEW PRODUCTS!
Replies: 64
Views: 29930

Re: Newsletter 41: NEW PRODUCTS!

microUSB cables have ugly big connector (the square plastic around connector tip), you can't plug it without having that hole.
So why not on CCR?
278_hi_res.png
278_hi_res.png
Also what about:
Does RouterOS support DDMI from SFPS?
by dog
Thu Oct 04, 2012 9:06 pm
Forum: RouterBOARD hardware
Topic: Boosting RB751U-2HnD Antennas!
Replies: 91
Views: 80535

Re: Boosting RB751U-2HnD Antennas!

Image
That's the device I'd like to see from MT!, but with 3x3 MIMO or Dual 2,4/5 Ghz operation and ports on one side so it can be wall mounted with the cables going up.
by dog
Thu Oct 04, 2012 8:42 pm
Forum: RouterBOARD hardware
Topic: So, ah, Cloud Core Router CCR1036 Shipping Date? Please...
Replies: 115
Views: 36674

Re: So, ah, Cloud Core Router CCR1036 Shipping Date? Please.

And now i see that CCR not for me, its just another office switch\router
Riiiiiiiight....so what would you call a RB750 then? 9600 Baud Modem?
by dog
Thu Oct 04, 2012 3:22 am
Forum: RouterBOARD hardware
Topic: 802.11ac
Replies: 4
Views: 2346

Re: 802.11ac

Q1 2013 is possible?
I don't think there's any chance for that.
MT will mostly be busy with CCR and ROS6 during Q4 12 / Q1 13.
I would rather count on somewhere like Q4 13.
by dog
Mon Oct 01, 2012 4:29 am
Forum: General
Topic: Newsletter 41: NEW PRODUCTS!
Replies: 64
Views: 29930

Re: Newsletter 41: NEW PRODUCTS!

I do not understand why MikroTik forgives a large market Probably because the xDSL market is controled by the ITU and shared only among a few companies (Broadcom, Siemens, ...) But this annoys me each day. It's basically impossible to buy a regular DSL modem nowadays that does not have some buggy r...
by dog
Wed Sep 12, 2012 4:29 pm
Forum: General
Topic: hairpin nat not working
Replies: 24
Views: 6099

Re: hairpin nat not working

One configuration for hairpin NAT with static IP is:
/ip firewall nat
add action=masquerade chain=srcnat comment=NAT disabled=no
add action=dst-nat chain=dstnat comment="SSH" disabled=no dst-address=5.x.x.x dst-port=22 protocol=tcp to-addresses=192.168.x.x to-ports=22
by dog
Wed Sep 12, 2012 12:47 pm
Forum: Beginner Basics
Topic: New to Mikrotik. Have questions, and seeking suggestions!
Replies: 1
Views: 844

Re: New to Mikrotik. Have questions, and seeking suggestions

What do you mean by high end firewall?
The ROS firewall is based on netfilter like all Linux systems.
This is a highly customizable but difficult firewall.

However it is not an ALG or UTM system.
by dog
Tue Sep 11, 2012 2:23 am
Forum: RouterBOARD hardware
Topic: NEW PRODUCT - Cloud Core Router
Replies: 104
Views: 44105

Re: NEW PRODUCT - Cloud Core Router

Btw does Mikrotik Support HA such as Clustering? Clustering in the sense of configuration synchronization....No, that is another long standing feature request. Any update regarding the expected "end of september" availability of the CCR? They never said a year. Always remember the RB2011 ...
by dog
Mon Sep 10, 2012 11:12 pm
Forum: RouterBOARD hardware
Topic: RB750 CPU Usage Problems
Replies: 25
Views: 14293

Re: RB750 CPU Usage Problems

Nope, mine has ST NAND512W3A2CN6

A friend of mine says the problem disappears as soon as he has Queues affecting the traffic and starts again when he removes them.

My observation is that it only happens on RB750s that also had the bad caps problem.
by dog
Mon Sep 10, 2012 7:24 pm
Forum: General
Topic: Using a Mikrotik, can't visit this one website
Replies: 3
Views: 1604

Re: Using a Mikrotik, can't visit this one website

Works for me.
Try lowering your MTU setting.
by dog
Mon Sep 10, 2012 7:19 pm
Forum: General
Topic: hairpin nat not working
Replies: 24
Views: 6099

Re: hairpin nat not working

The configuration depends on whether your public IP is static or dynamic.
by dog
Mon Sep 10, 2012 7:05 pm
Forum: General
Topic: Auto Negotiation
Replies: 4
Views: 2779

Re: Auto Negotiation

Why would you even want to disable it?

90% of times I have seen networks with major performance problems it was because someone decided it was clever to turn off auto-negotiation.
by dog
Sun Sep 02, 2012 3:06 pm
Forum: General
Topic: SNMP doesn't work with asymmetric routes?
Replies: 32
Views: 13532

Re: SNMP doesn't work with asymmetric routes?

And I thought I was the only one with that problem...
by dog
Fri Aug 10, 2012 7:37 pm
Forum: RouterBOARD hardware
Topic: RB750 CPU Usage Problems
Replies: 25
Views: 14293

Re: RB750 CPU Usage Problems

Same problem for me (and a friend) with RB750s in all last releases (in 5.19 too).
When doing a download at about 50Mbit/s flash goes to 100% and winbox will disconnect and the router reboots (if the download takes long enough).
by dog
Mon Jan 30, 2012 2:52 pm
Forum: Forwarding Protocols
Topic: OSPF and failure on switched link
Replies: 7
Views: 2935

Re: OSPF and failure on switched link

No, I haven't found a "real" solution and I think there is none. What I did however was set the priority of R2 and R3 to 0 so they would not try to become DR. That means if they loose connection to the third router in the same subnet they should assume the network is down. I guess the only...
by dog
Mon Jan 23, 2012 12:08 pm
Forum: Scripting
Topic: PHP + Mikrotik 5.12
Replies: 16
Views: 8560

Re: PHP + Mikrotik 5.12

Check under IP > Services that api is actually enabled.
by dog
Mon Jan 23, 2012 10:15 am
Forum: General
Topic: v5.12 released
Replies: 144
Views: 38018

Re: v5.12 released

So now that you want to be in the home router market, will we finally get a native DynDNS client? :-?
by dog
Sat Jan 21, 2012 12:14 am
Forum: General
Topic: v5.12 released
Replies: 144
Views: 38018

Re: v5.12 released

Seems like they have forgotten the interface for "use BFD" in OPSF/BGP when adding a BFD menu.
by dog
Fri Jan 20, 2012 10:51 pm
Forum: General
Topic: DHCP "Busy" when using Airport routers??
Replies: 3
Views: 1315

Re: DHCP "Busy" when using Airport routers??

Technically the device would have two ways to find out about "double NAT": * Connect to a webserver and compare the returned IP to the one on the WAN interface * Check whether the IP on the WAN interface is in a private subnet From that you can gather what a solution would be. It's also pr...
by dog
Fri Dec 23, 2011 3:50 am
Forum: General
Topic: RB 750 As a switch
Replies: 21
Views: 4409

Re: RB 750 As a switch

Right.
Just like Port Isolation on regular switches it needs to be implemented on every switch in the network.
by dog
Fri Dec 23, 2011 2:03 am
Forum: General
Topic: RB 750 As a switch
Replies: 21
Views: 4409

Re: RB 750 As a switch

If you just want to prevent all client ports from talking to each other and only allow the uplink port just put all ports into a bridge and set the SAME value for bridge-horizon for all client ports.
by dog
Fri Dec 23, 2011 12:44 am
Forum: General
Topic: RouterOS future requests
Replies: 3
Views: 1201

Re: RouterOS future requests

Actually this has been a long standing feature request, and the wiki explains why: Our ADSL subscribers are served by a Huawei/Cisco Access Concentrator using PPPoE and assigns dynamic IP addresses which change with every session establishment. This is the kind of behaviour the customer expects. Som...
by dog
Thu Dec 15, 2011 4:49 pm
Forum: General
Topic: Same Vlan Tagged and Untagged
Replies: 10
Views: 16096

Re: Same Vlan Tagged and Untagged

Your RB450G likely still has the Mikrotik default configuration, which is mostly useless.
In Terminal enter
/system reset skip-backup=yes no-defaults=yes
and you'll have a blank router to start with.

The version number is in the titlebar of the winbox window.
by dog
Sat Nov 26, 2011 9:09 pm
Forum: Forwarding Protocols
Topic: OSPF and failure on switched link
Replies: 7
Views: 2935

Re: OSPF and failure on switched link

In reality the network (the relevant part) looks like this: ospf2.jpg The orange lines are wireless links that are inside a bridge interface to prevent OSPF state changes from short disconnects as the recalculation would usually take longer than the disconnect. Those links are the problem. If wirele...
by dog
Sat Nov 26, 2011 8:06 pm
Forum: Beginner Basics
Topic: Multiple SSID on RB751U-2HnD
Replies: 2
Views: 24686

Re: Multiple SSID on RB751U-2HnD

Yes, this is possible with Virtual AP.

http://wiki.mikrotik.com/images/5/5f/Cr ... Campus.pdf
by dog
Sat Nov 26, 2011 7:35 pm
Forum: Forwarding Protocols
Topic: OSPF and failure on switched link
Replies: 7
Views: 2935

Re: OSPF and failure on switched link

That is what I assumed too. However I had a case in a similar network where R1 and R2 where connected by a switch and NET1 via an additional router on the same switch. After the failure on S2 the additional router lost all routes that would normally go via R1 and R1 lost all routes (instead of going...
by dog
Sat Nov 26, 2011 7:13 pm
Forum: Forwarding Protocols
Topic: OSPF and failure on switched link
Replies: 7
Views: 2935

OSPF and failure on switched link

Hi, let's assume the following theoretical scenario: ospf.jpg All routers are connected using /30 subnets, all in the backbone area. Usually NET1 and NET2 would communicate via the link R1<->R4 as the shortest path. Now S2 failes, but the physical link is still up on R1 and R4. What would happen to ...
by dog
Tue Oct 25, 2011 2:04 am
Forum: Forwarding Protocols
Topic: Layer 2 Encryption?
Replies: 3
Views: 2000

Re: Layer 2 Encryption?

As far as I understand IPSec I would have to configure it on every router in the network and I'm unsure if I would even work together with MPLS.
I really only need to encrypt traffic between two devices that are logically directly connected.
by dog
Tue Oct 25, 2011 1:26 am
Forum: Forwarding Protocols
Topic: Layer 2 Encryption?
Replies: 3
Views: 2000

Layer 2 Encryption?

Hi,

some part of our network will soon run inside a VLAN of another companies network.
At both ends are ROS devices.
Is there a way to encrypt all traffic between those two devices and still be able to use MPLS and OSPF?

Regards

Max
by dog
Tue Sep 13, 2011 4:06 pm
Forum: Beginner Basics
Topic: Mikrotik 450G Password forgot help
Replies: 2
Views: 3664

Re: Mikrotik 450G Password forgot help

There is no password recovery in RouterOS.
You can only reset the whole configuration.
by dog
Sat Aug 06, 2011 6:51 pm
Forum: General
Topic: Printer Routing
Replies: 8
Views: 2595

Re: Printer Routing

Where is your problem? Add the IPs on the MT: /ip addr add=192.168.0.2/24 int=ether1 /ip addr add=192.168.2.1/24 int=ether2 Add the internet route: /ip route add dst=0.0.0.0/0 gateway=192.168.0.1 Set the MT as default gateway on Host A and Host B. Then on the xp box you either need to set a reverse ...
by dog
Sat Aug 06, 2011 6:30 pm
Forum: Beginner Basics
Topic: RB750 misbehavior
Replies: 2
Views: 1218

Re: RB750 misbehavior

This is a hardware problem with the older 750 models.

If you still have warranty get it replaced, otherwise get a new unit or look around the forums.
There is a guide on which caps need to be replaced.
by dog
Sat Aug 06, 2011 6:27 pm
Forum: Wireless Networking
Topic: Wireless but no IP Traffic
Replies: 3
Views: 1439

Re: Wireless but no IP Traffic

From your description I assume you have bridged ether1 and wlan2.
This will not work!
station mode per specification only allows traffic from the connected device itself.
There is a lengthy explanation and work-arounds in the Wiki.
by dog
Thu Nov 25, 2010 9:01 pm
Forum: Forwarding Protocols
Topic: OSPF and short disconnects
Replies: 3
Views: 1424

Re: OSPF and short disconnects

So, if I understand you right the idea is to add the wireless interface to a bridge, assign the IP to the bridge and add OSPF on the bridge interface, so that the interface will never go down and then use the Router Dead interval to set the timeout?
by dog
Wed Nov 24, 2010 10:29 pm
Forum: Beginner Basics
Topic: nOOb question
Replies: 1
Views: 937

Re: nOOb question

OSPF has no problem even if there are 10 routers in a subnet. Actually having only two OSPF routers in a subnet is a special case (those interfaces should be configured as point-to-point) However you have created a single point of failure by using a switch and not the interfaces of the RB. So it wou...
by dog
Wed Nov 24, 2010 10:20 pm
Forum: Forwarding Protocols
Topic: OSPF and short disconnects
Replies: 3
Views: 1424

OSPF and short disconnects

Hi, I'm still experimenting with OSPF and made this observation: 0s - link goes down 1s - OSPF has removed the route from all routers 3s - link comes back up 30s - OSPF re-added route to all routers So with short wireless disconnects which are usually not a problem OSPF will create a problem by taki...
by dog
Tue Jul 20, 2010 2:15 pm
Forum: RouterBOARD hardware
Topic: New Hardware
Replies: 3
Views: 1847

New Hardware

"A new and exciting product is getting announced today." @mikrotik_com

Any guesses?
I'd say RB750 with wireless :)
by dog
Tue Jul 06, 2010 5:15 am
Forum: RouterBOARD hardware
Topic: Negative karma for u.fl
Replies: 2
Views: 1040

Re: Negative karma for u.fl

A hot-melt gun is your friend there :)

We now do this with every card.
by dog
Sun Apr 25, 2010 6:00 pm
Forum: General
Topic: About Public Real World IP to Internal IP (Natting Question)
Replies: 4
Views: 1335

Re: About Public Real World IP to Internal IP (Natting Quest

No, you can't do that.
Computers never communicate via DNS names but always via IP.

I guess you want to have separate web-servers on one public IP?
In that case there is a way because of how HTTP/1.1 works.
You need a reverse proxy like pond or Varnish though.
by dog
Mon Apr 19, 2010 10:15 pm
Forum: RouterBOARD hardware
Topic: Adsl integrated (again?)
Replies: 29
Views: 6150

Re: Adsl integrated (again?)

/me is interested in VDSL2-Master- and Client-Modem as miniPCI card too.
by dog
Mon Apr 19, 2010 10:08 pm
Forum: RouterBOARD hardware
Topic: RB433 all lan ports don t work
Replies: 6
Views: 2190

Re: RB433 all lan ports don t work

Perhaps the ports are disabled in software.
Connect to the device via serial port and reset the configuration or boot it via Netboot and reflash it.
by dog
Mon Apr 19, 2010 9:58 pm
Forum: General
Topic: RB450G
Replies: 7
Views: 2609

Re: RB450G

and I have ~80 pppoe users on a 450G with 16Mbit upstream and 3Mbit per user and about 80 firewall rules.
The device is pretty bored most of the time.
by dog
Sun Apr 18, 2010 5:40 pm
Forum: General
Topic: Redirect traffic to Squid ( Linux )
Replies: 30
Views: 98440

Re: Redirect traffic to Squid ( Linux )

The only option is to use the squid proxy as gateway for your clients.
by dog
Sun Apr 18, 2010 5:23 pm
Forum: General
Topic: RB450G
Replies: 7
Views: 2609

Re: RB450G

So the total uplink speed is 3-4Mbit or each customer gets 3-4Mbit?
by dog
Sun Apr 18, 2010 5:14 pm
Forum: Forwarding Protocols
Topic: vrf and dynamic interfaces
Replies: 10
Views: 5601

Re: vrf and dynamic interfaces

is there no way MT can remember the dynamic interfaces
Don't use dynamic interfaces :)
You can create static l2tp-server interfaces for each client (or copy a dynamic one) which will stay there.
by dog
Sun Apr 18, 2010 5:06 pm
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

OK, I played around a bit with areas and area ranges: areas.jpg The problem I have now is that all area routes have the same distance i.e. at R1 both area4 and area3 are at 110. As I understand it with this setup two routes to area4 * R1->R2->R3->R4->R5->area4 * R1->R2->Rx->area4 both would be treat...
by dog
Sat Apr 17, 2010 1:38 am
Forum: General
Topic: About Public Real World IP to Internal IP (Natting Question)
Replies: 4
Views: 1335

Re: About Public Real World IP to Internal IP (Natting Quest

/ip firewall nat #for one public ip add chain=srcnat src-addr=192.168.0.10 action=src-nat to-addr=1.1.1.1 add chain=dstnat dst-addr=1.1.1.1 action=dst-nat to-addr=192.168.0.10 #for a subnet add chain=srcnat src-addr=192.168.0.100-192.168.0.200 action=netmap to-addr=1.1.1.100-1.1.1.200 add chain=dst...
by dog
Sun Apr 04, 2010 3:07 am
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

Hey greg,

yeah, the question now is: If OSPF can't do what I want - is there another way? :)
by dog
Sun Mar 21, 2010 2:14 am
Forum: RouterBOARD hardware
Topic: Inexpensive Starter Core Router?
Replies: 7
Views: 2541

Re: Inexpensive Starter Core Router?

That depends on your uplink speed and number of concurrent(!) users.
I'd say for most things a RB750 is already enough but if it's not for 200 concurrent(!) users you can't do much wrong with a 450G.
by dog
Tue Mar 16, 2010 11:04 pm
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

*bump*
by dog
Sun Mar 14, 2010 9:50 pm
Forum: General
Topic: Mikrotik LACP (MK to Cisco)
Replies: 1
Views: 10597

Re: Mikrotik LACP (MK to Cisco)

So from your example I see that with L2 you mean attaching an IP address to a VLAN and with L3 you mean attaching it directly. So for MT the examples would be: /int bond add mode=802.3ad slaves=ether1,ether2 /int vlan add vlan-id=50 int=bonding1 name=bond1-vlan50 /ip addr add int=bond1-vlan50 addr=1...
by dog
Fri Mar 12, 2010 2:05 am
Forum: General
Topic: Multilink over IP?
Replies: 1
Views: 1133

Multilink over IP?

Hey, I've been wondering (no concrete scenario): Is there something like Multilink over IP? By which I mean: I have a Site A with e.g. 5 DSL 1000 connections and a Server at a data centre with one 100Mbit connection. Let's say Multilink PPPoE is not a viable option. Is there some software that would...
by dog
Mon Mar 08, 2010 10:12 pm
Forum: General
Topic: PPTP dialup with specify interface (WAN)
Replies: 6
Views: 1909

Re: PPTP dialup with specify interface (WAN)

I suppose he has 3 internet connections to the same ISP and in order to get WAN access he needs to dial in via PPTP but has to make sure that each PPTP client uses a specified connection.
by dog
Mon Mar 08, 2010 9:52 pm
Forum: Beginner Basics
Topic: PPPoE + Routed subnet
Replies: 16
Views: 5243

Re: PPPoE + Routed subnet

This rule was an example. You could have either used the last or the one before that. In general the last one would be more secure as it is only simple port forwarding, the other creates an Exposed Host (you can google that). Also I made a little typo. Correct would have been: add chain=dstnat dst-a...
by dog
Mon Mar 08, 2010 7:54 am
Forum: Beginner Basics
Topic: Setting up RB750 to be a simple router
Replies: 11
Views: 4650

Re: Setting up RB750 to be a simple router

is that all i need.
Depends.
Do you want the RB750 to act as a DHCP server?
Do you want the networks to communicate with each other?
You'll probably want to add firewall rules.
by dog
Sun Mar 07, 2010 11:59 pm
Forum: RouterBOARD hardware
Topic: Building a RouterOS Router with wireless
Replies: 3
Views: 1393

Re: Building a RouterOS Router with wireless

Just use a R52 - many people have reported problems with the R52H and the R52 are working fine for us even as WISP-AP

Also keep in mind that you won't be able to use the benefit in output power at all depending on your country.
by dog
Sun Mar 07, 2010 11:49 pm
Forum: Beginner Basics
Topic: Setting up RB750 to be a simple router
Replies: 11
Views: 4650

Re: Setting up RB750 to be a simple router

Will a normal gateway router do this??
Depends on the model...
and with the NAT rules, do i need one or a whole lot?
One for each network a,b,c.
by dog
Sun Mar 07, 2010 9:44 pm
Forum: Beginner Basics
Topic: Setting up RB750 to be a simple router
Replies: 11
Views: 4650

Re: Setting up RB750 to be a simple router

Well you need one route on the RB750 to reach the Internet:
/ip route
add dst-addr=0.0.0.0/0 gatew=192.168.0.1
Keep in mind that this gateway needs a route back as mentioned above.
by dog
Sun Mar 07, 2010 8:45 pm
Forum: Beginner Basics
Topic: Setting up RB750 to be a simple router
Replies: 11
Views: 4650

Re: Setting up RB750 to be a simple router

No, those were just examples and not real commands.

The second one was my bad.
It basically means you can't use in-interface in srcnat.
The command should have been:
/ip fire nat
add chain=srcnat src-address=192.168.1.0/24 out-int=ether1 action=src-nat to-addr=192.168.1.1
by dog
Sun Mar 07, 2010 7:38 pm
Forum: Beginner Basics
Topic: Setting up RB750 to be a simple router
Replies: 11
Views: 4650

Re: Setting up RB750 to be a simple router

So your configuration on the RB750 is like: /ip addr ether1 = 192.168.0.2/24 ether2 = 192.168.1.1/24 ether3 = 192.168.2.1/24 ether4 = 192.168.3.1/24 /ip route 0.0.0.0/0 over 192.168.0.1 And now you want a client e.g. 192.168.1.129 to show up as 192.168.1.1 and so on? While I don't really understand ...
by dog
Sat Mar 06, 2010 12:48 am
Forum: Beginner Basics
Topic: PPPoE + Routed subnet
Replies: 16
Views: 5243

Re: PPPoE + Routed subnet

There is a way to do this for dynamic IPs BUT: It will only work for one IP. /ip fire nat add chain=srcnat out-interf=pppoe-out1 action=masq #to create an "exposed host": add chain=dstnat in-interf=pppoe-out1 action=dst-nat to-addr=192.168.0.101 #or to only forward specific ports add chain...
by dog
Fri Mar 05, 2010 5:09 pm
Forum: Beginner Basics
Topic: PPPoE + Routed subnet
Replies: 16
Views: 5243

Re: PPPoE + Routed subnet

So you have: +-----+ pppoe-out1 +----+ 105 ether2 106 +----+ | ISP |----- 66.78.x.105/32 ----| RB |------ 66.78.x.104/30 -------| PC | +-----+ +----+ +----+ That is a tricky setup as two interfaces have the same IP. I would then go another way: Instead of giving this public IP to the PC use a simple...
by dog
Fri Mar 05, 2010 2:47 am
Forum: General
Topic: how can I remote RB's from different locations
Replies: 5
Views: 1351

Re: how can I remote RB's from different locations

so I need to know if there is ports or anything that I would to access the RB's from tower to main office. That sentence makes no sense :) OK, let's view a standard configuration: +-----+ +-----+ +----+ +-------+ | ISP |-------------| R1 |--------| R2 |--- .... ---| Cust. | +-----+ | +-----+ +----+...
by dog
Fri Mar 05, 2010 1:04 am
Forum: General
Topic: Update Key through console
Replies: 3
Views: 1778

Re: Update Key through console

No, only Winbox allows updating license and MT does not plan on changing that.
by dog
Fri Mar 05, 2010 1:01 am
Forum: General
Topic: how can I remote RB's from different locations
Replies: 5
Views: 1351

Re: how can I remote RB's from different locations

Sorry, but I don't understand your question.
Add an IP address and ROS will start routing :)
by dog
Thu Mar 04, 2010 6:49 pm
Forum: Beginner Basics
Topic: Lost Newbie help w/RB493 basic Internet DHCP Router Setup
Replies: 25
Views: 6075

Re: Lost Newbie help w/RB493 basic Internet DHCP Router Setup

You can also try to press a key in the "Press any key for boot menu" phase while start up.
Then press "b" (boot order) and "1" (boot once from network).
You can then reset the router using NetInstall.
by dog
Thu Mar 04, 2010 6:44 pm
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

Is there a specific need for those routes to be hidden, or do you just think they are unnecessary? Yeah I see them mostly as clutter which makes reading the routing tables more difficult. Also I noticed a strange behavior where the router would no longer use it's global ip (set in pref-src) but a t...
by dog
Thu Mar 04, 2010 3:26 am
Forum: Beginner Basics
Topic: log HTTPS pages with mikrotik proxy
Replies: 6
Views: 4794

Re: log HTTPS pages with mikrotik proxy

It is technically impossible to transparently proxy https pages. That's not entirely true. Using a transparent proxy you can end HTTPS, inspect the traffic and reencrypt the connection. That is something supported by many business firewalls like Forefront TMG. The only limitation here is that a bro...
by dog
Wed Mar 03, 2010 11:40 pm
Forum: Beginner Basics
Topic: Lost Newbie help w/RB493 basic Internet DHCP Router Setup
Replies: 25
Views: 6075

Re: Lost Newbie help w/RB493 basic Internet DHCP Router Setup

The router should also have a hardware reset button between serial and ether1.
Just hold it down for 30 seconds and the configuration will be reset.
by dog
Wed Mar 03, 2010 7:07 pm
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

Why should it?
I just want the routing table via OSPF to look the same as it does currently via static routes.
RX in my opinion does not need to know anything about the transfer network between R1 and R2.
It only needs to know it can reach 192.168.1.1/24 over R1.
by dog
Wed Mar 03, 2010 2:29 am
Forum: Beginner Basics
Topic: help !! how to protect end-users from each others on network
Replies: 7
Views: 1816

Re: help !! how to protect end-users from each others on network

There are too few information about your network.
I guess you are using a completely flat L2 network?
That would be a no-go for 300 users!

Do your users connect via CPEs or directly via their computers?
In first case just use pppoe and most of your problems will be gone...
by dog
Tue Mar 02, 2010 10:26 pm
Forum: SwOS
Topic: SwOS features - anybody care to guess?
Replies: 56
Views: 28683

Re: SwOS features - anybody care to guess?

I looked at the slides and must say I have no idea of what to make of this product. Either this is a veeeeery early stage in the expansion of the product palette or MT is looking for a hobby. So we have a 5 port soft-managed gigabit switch. The only place where I can think of using that is under my ...
by dog
Tue Mar 02, 2010 6:24 pm
Forum: Beginner Basics
Topic: Lost Newbie help w/RB493 basic Internet DHCP Router Setup
Replies: 25
Views: 6075

Re: Lost Newbie help w/RB493 basic Internet DHCP Router Setup

I did something wrong, and now I cannot connect to the router with winbox anymore. In winbox click on "..." - does the router still show up? If so click on it's MAC-ID (not the IP address) and you will be able to connect and reset the configuration (see my first post). Is that the netmask...
by dog
Tue Mar 02, 2010 1:16 am
Forum: General
Topic: Response from support
Replies: 30
Views: 9530

Re: Response from support

At least MT should build a usable L2TP/IPSec implementation before dropping OpenVPN ;)
by dog
Mon Mar 01, 2010 11:23 pm
Forum: SwOS
Topic: SwOS features - anybody care to guess?
Replies: 56
Views: 28683

Re: SwOS features - anybody care to guess?

with web-only interface =)
That would be bad unless MikroTik found a way to do this:
vlan 15
untag 1-24
tag 25,26
in the same time with a web interface (which I have yet to see). :)
by dog
Mon Mar 01, 2010 11:12 pm
Forum: Beginner Basics
Topic: Lost Newbie help w/RB493 basic Internet DHCP Router Setup
Replies: 25
Views: 6075

Re: Lost Newbie help w/RB493 basic Internet DHCP Router Setup

Clear any configuration: /sys reset-c skip-b=y no-def=yes Create an IP pool from which the users will get their IPs /ip pool add name=dhcp-pool1 ranges=192.168.50.102-129 Add a network configuration for the DHCP server: /ip dhcp-s netw add addr=192.168.50.0/24 dns=<insert your dns> gatew=192.168.50....
by dog
Mon Mar 01, 2010 10:14 pm
Forum: Beginner Basics
Topic: PPPoE + Routed subnet
Replies: 16
Views: 5243

Re: PPPoE + Routed subnet

Where is your problem?

Just configure the LAN interface as 1.1.1.105/30 and the PC as 1.1.1.106/30 with GW 1.1.1.105
ROS will start routing automatically.
by dog
Mon Mar 01, 2010 10:01 pm
Forum: General
Topic: Problem with RB750
Replies: 8
Views: 2107

Re: Problem with RB750

In IP > Firewall > NAT:
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1-gateway
That rule should be:
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=pppoe-out1
by dog
Mon Mar 01, 2010 5:20 pm
Forum: Scripting
Topic: Change hotspot password with PHP API
Replies: 73
Views: 53314

Re: Change hotspot password with PHP API

You forgot to end the sentence. Call $API->finish_sentence(); before trying to read anything. ...forget that comment, I have a modified version of the API :) With the "official" API you would have to write: $API->write('/ip/hotspot/user/getall',false); $API->write('=.proplist=name',false);...
by dog
Mon Mar 01, 2010 5:08 pm
Forum: RouterBOARD hardware
Topic: rb750 and rb493 for load-balancing/failover of wireless link
Replies: 6
Views: 3295

Re: rb750 and rb493 for load-balancing/failover of wireless link

s. I know I definitely want load balancing so no one link becomes saturated and auto failover so if one link goes down, traffic automatically reroutes. That won't be possible. Real load balancing requires the LB to keep track of the capacity and load on a endpoint. What you can accomplish is load d...
by dog
Sun Feb 28, 2010 10:47 pm
Forum: General
Topic: Maximum bandwidth with Quad Core and PCI-E
Replies: 34
Views: 9311

Re: Maximum bandwidth with Quad Core and PCI-E

650 Mbit/s full duplex on the links
That is the value I've seen in all my (netio-)tests with cheap Realtek or Yukon chipsets under Linux.
by dog
Sun Feb 28, 2010 9:00 pm
Forum: General
Topic: MUM Poland 2010 thread
Replies: 113
Views: 32682

Re: MUM Poland 2010 thread

Bildschirmfoto 2010-02-28 um 19.56.31.png
Bildschirmfoto 2010-02-28 um 19.54.42.jpg
those will probably more fun the later it gets :D
by dog
Sun Feb 28, 2010 8:42 pm
Forum: General
Topic: MUM Poland 2010 thread
Replies: 113
Views: 32682

Re: MUM Poland 2010 thread

Bildschirmfoto 2010-02-28 um 19.41.17.jpg
....and wee need a Chat ;-)
by dog
Sun Feb 28, 2010 6:53 pm
Forum: RouterBOARD hardware
Topic: rb750 and rb493 for load-balancing/failover of wireless link
Replies: 6
Views: 3295

Re: rb750 and rb493 for load-balancing/failover of wireless link

That would be possible. But I would recommend using a RB433 mounted in a Poynting A0042 case (or similar). Then connect them to a switch or RB750 or RB450 and then to a switch. Both have advantages and disadvantages: Connect them directly to the switch: You can use VRRP for failover Connect them to ...
by dog
Sun Feb 28, 2010 6:27 pm
Forum: Wireless Networking
Topic: Program to draw diagram
Replies: 7
Views: 5012

Re: Program to draw diagram

On Windows: Microsoft Visio
On Linux: Dia
On Mac: OmniGraffle

Cross-Platform: Illustrator, ConceptDraw
by dog
Sun Feb 28, 2010 6:25 pm
Forum: General
Topic: MUM Poland 2010 thread
Replies: 113
Views: 32682

Re: PL MUM HOTEL PRICE (sticky please)

can anyone see the live video stream in tiktube.com ?
Yup. :)
A bit choppy though sometimes.
by dog
Sun Feb 28, 2010 6:20 pm
Forum: General
Topic: Mikrotik Management for iPhone Available Now
Replies: 141
Views: 37914

Re: Mikrotik Management from iPhone (soon)

I manage the same about of devices over a PHP+API tool I have written. I basically only have to enter the wireless MAC-ID and it will create the necessary configuration for me, which I then can import (this takes about 1.5m per device) After that I can control all devices via my tool :) I suspect ma...
by dog
Sun Feb 28, 2010 2:45 am
Forum: RouterBOARD hardware
Topic: rb750 and rb493 for load-balancing/failover of wireless link
Replies: 6
Views: 3295

Re: rb750 and rb493 for load-balancing/failover of wireless link

I don't quite understand your structure. At each remote site you want a RB750 and 2 RB493 which connect back to the main site? Or do you want to interconnect the remote sites to create a kind of mesh? Either way I would either recommend to use a completely routed network or a completely routed netwo...
by dog
Sun Feb 28, 2010 2:17 am
Forum: Forwarding Protocols
Topic: Load Balancing to three connections on the same subnet
Replies: 10
Views: 4660

Re: Load Balancing to three connections on the same subnet

and my bandwidth never goes above 2mbps (thats the speed of each individual connection). That will never happen. ECMP routing can only load balance between connections. That means if you have 3 PCs every one can have 2mbps, but 1 PC will never get 6 mbps. There is only one possibility for that: Mul...
by dog
Sun Feb 28, 2010 2:05 am
Forum: General
Topic: PPTP Server talking to Windows and other clients
Replies: 6
Views: 3499

Re: PPTP Server talking to Windows and other clients

Actually Windows will always route all traffic except for the local subnet over a PPTP-VPN in standard configuration.
See: http://i27.photobucket.com/albums/c181/ ... vpn-MT.jpg
by dog
Sat Feb 27, 2010 2:48 am
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

01:43:27 route,ospf,debug SEND: Hello 10.0.0.2 -> 224.0.0.5 on ether2-lan 01:43:29 route,ospf,debug RECV: Hello <- 10.0.0.1 on ether2-lan (10.0.0.2) 01:43:29 route,ospf,debug received options: E 01:43:30 route,ospf,debug RECV: Link State Update <- 10.0.0.1 on ether2-lan (10.0.0.2) 01:43:30 route,os...
by dog
Sat Feb 27, 2010 2:24 am
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

Same experiment: +----+ +---+ +---+ |RX |-- 10.0.0.0/30 --|R1 |-- 10.0.1.0/30 --|R2 |-- 10.0.2.0/30 ... +----+ +---+ +---+ 192.168.0.1/32 192.168.1.1/32 no filters: [admin@RX] > ip route pr Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B ...
by dog
Sat Feb 27, 2010 1:38 am
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

Re: OSPF - I'm too stupid

Hi Nick, thank you, the blackhole tip brought me quite a bit forward. However I am having a problem filtering out the transfer networks. Under /routing ospf networks I set add network=10.0.0.0/16 area=backbone to start OSPF on both needed interfaces. Then I added a routing filter /routing filter add...
by dog
Thu Feb 25, 2010 9:28 pm
Forum: Forwarding Protocols
Topic: OSPF - I'm too stupid
Replies: 23
Views: 9818

OSPF - I'm too stupid

Hi, I have played a bit with OSPF and got it working but never in the way I like it to be. Take the following router: ether1 10.0.0.1/30 ether2 10.0.1.2/30 loop1 192.168.0.1/32 wlan1 192.168.0.129/25 Now everything I want to do is run OSPF on ether1 and ether2 to receive routes and redistribute them...
by dog
Thu Feb 25, 2010 9:44 am
Forum: General
Topic: Problem with RB750
Replies: 8
Views: 2107

Re: Problem with RB750

what's a docx file? I don't use MS office products That's an oxymoron. :) From your screenshots everything looks fine, but in your second screenshot the setting needs to be "Enabled". Also please go to terminal and post the output of /ip addr pr /ip route pr /ip fire export (In code tags ...
by dog
Wed Feb 24, 2010 10:15 pm
Forum: General
Topic: Mikrotik Management for iPhone Available Now
Replies: 141
Views: 37914

Re: Mikrotik Management from iPhone (soon)

Yes, you could.
What I am saying is that you should configure the firewall so that this is not possible for security reasons.
by dog
Wed Feb 24, 2010 3:53 am
Forum: General
Topic: Mikrotik Management for iPhone Available Now
Replies: 141
Views: 37914

Re: Mikrotik Management from iPhone (soon)

Apart from that you should always only be able to access the API if you are
a) in the same network (e.g. connected via WLAN)
b) connected over a secure link (e.g. via PPTP VPN)
by dog
Wed Feb 24, 2010 3:26 am
Forum: General
Topic: Mikrotik Management for iPhone Available Now
Replies: 141
Views: 37914

Re: Mikrotik Management from iPhone (soon)

/me want's to test it too :D
by dog
Tue Feb 23, 2010 10:39 pm
Forum: SwOS
Topic: SwOS features - anybody care to guess?
Replies: 56
Views: 28683

Re: SwOS features - anybody care to guess?

Also it will be difficult for MikroTik to match e.g. HP in 30 years guarantee Next business-day replacement So they will have to go for Price Features Given that a basic 24 port Gigabit HP switch costs 480€ (2510-24G) a MikroTik with MSTP,LACP,etc. and the bridge filter we have now, costing less wou...
by dog
Mon Feb 22, 2010 11:43 am
Forum: Wireless Networking
Topic: Radio Mobile basics
Replies: 3
Views: 1485

Re: Radio Mobile basics

*bump*
by dog
Sun Feb 21, 2010 10:03 pm
Forum: General
Topic: how to construct a Lan of game?
Replies: 5
Views: 1330

Re: how to construct a Lan of game?

Most games can work with routed networks too. That means you can put each user in a different subnet and only allow access to the subnet of the server and only the port of the gameserver. That would minimize the possibility for viruses to a) misconfiguration b) errors in ROS c) errors in the Gameser...
by dog
Fri Feb 19, 2010 11:20 am
Forum: General
Topic: winbox / dude un mac powerpc
Replies: 1
Views: 1110

Re: winbox / dude un mac powerpc

If you bought M$ Virtual PC for Mac you could run Windows on a PPC an Winbox and Dude.
AFAIK there is not other solution and I would not recommend this solution.
PPC is EOL :(
by dog
Wed Feb 17, 2010 1:23 pm
Forum: General
Topic: Router missing in traceroute
Replies: 4
Views: 1305

Re: Router missing in traceroute

traceroute to remote.endpoint (8.xxx.xxx.1), 30 hops max, 40 byte packets
 1  router (9.xxx.xxx.1)  0.463 ms  1.036 ms  1.004 ms
 2  ac.provider (6.xxx.xxx.1)  16.176 ms  18.056 ms  18.675 ms
[...]
This is as expected.
by dog
Wed Feb 17, 2010 12:57 pm
Forum: General
Topic: Router missing in traceroute
Replies: 4
Views: 1305

Re: Router missing in traceroute

I'll ask the RouterOS gnomes because I didn't play with the ttl :lol:
by dog
Tue Feb 16, 2010 6:57 pm
Forum: General
Topic: Router missing in traceroute
Replies: 4
Views: 1305

Router missing in traceroute

Hi, I have a pretty simple problem (I guess :shock:) Doing a traceroute to one of my IPs I get: traceroute to 9.xxx.xxx.2 (9.xxx.xxx.2), 64 hops max, 72 byte packets [...] 7 ac.provider (6.xxx.xxx.1) 62.172 ms 64.967 ms 59.974 ms 8 9.xxx.xxx.2 (9.xxx.xxx.2) 173.959 ms 117.509 ms 145.809 ms My proble...
by dog
Fri Feb 12, 2010 12:58 am
Forum: General
Topic: Is MikroTik right for me?
Replies: 2
Views: 1263

Re: Is MikroTik right for me?

-Support QoS, firewall, NAT, remote management to router. QoS is called Queues and you have a lot of options there. The firewall is based on netfilter, so it is similar in configuration to iptables from Linux. NAT is supported of course. Management can be done via Serial Port, SSH, Telnet, Windows ...
by dog
Fri Feb 12, 2010 12:50 am
Forum: RouterBOARD hardware
Topic: RB450 Capacitors problem?
Replies: 121
Views: 61131

Re: RB450 Capacitors problem?

Now I'm curious.
We are using a RB450G as our main router.
Can we have an official statement on whether we should get it replaced by another model?

I found this post: http://www.badcaps.net/forum/showthread ... =su%27scon

Best regards

Max
by dog
Wed Feb 03, 2010 2:14 am
Forum: RouterBOARD hardware
Topic: Router suggestion
Replies: 23
Views: 7036

Re: Router suggestion

And another question, should I go for RB450G or for RB750G? The 450G is actually better than the 750G Do I need to hold the full internet route table? What do you mean by that? Usually there is 1 (in your case 2) routes for internet access. I think the 450G will do the job. I tried a 750 at 50 Mbit...
by dog
Wed Feb 03, 2010 2:05 am
Forum: Forwarding Protocols
Topic: VPLS termination - your opinion?
Replies: 2
Views: 1614

VPLS termination - your opinion?

Hi, I'm currently thinking about where I should terminate VPLS tunnels (the other end will always be the PPPoE-AC). Terminate at Access Point: + Easier Setup + Possibly less load on the devices - less control Terminate at CPE: + More control + Possibility to provide VPLS VPNs to customers + Briding ...
by dog
Mon Feb 01, 2010 6:04 pm
Forum: General
Topic: Redirecting
Replies: 6
Views: 1596

Re: Redirecting

ip fire addr add list=allowed-users addr=10.0.0.1
and so on.. :)
by dog
Fri Jan 29, 2010 3:39 pm
Forum: General
Topic: Redirecting
Replies: 6
Views: 1596

Re: Redirecting

/ip fire nat add src-address-list=!allowed-users chain=dstnat dst-port=80 to-addresses=192.168.0.111
Should do it
by dog
Fri Jan 29, 2010 12:19 pm
Forum: General
Topic: Static IP traffic accounting
Replies: 4
Views: 2587

Re: Static IP traffic accounting

For Basic traffic accounting you could use the IP Accounting / Snapshot feature.
http://www.mikrotik.com/testdocs/ros/2. ... unting.php
You can then download traffic stats via web as a CSV file.

If you want to do more you can use Netflow.
by dog
Fri Jan 29, 2010 12:13 pm
Forum: General
Topic: PPPoE Server + Firewall rules
Replies: 6
Views: 3881

Re: PPPoE Server + Firewall rules

what do you want to do with that rule?
Some basic spoofing prevention as well as filtering.
I would prefer "Prevent all pppoe-clients from accessing subnet 10.0.0.0/24" to "Prevent 80.x.x.x/24 from accessing subnet 10.0.0.0/24"
by dog
Fri Jan 29, 2010 11:03 am
Forum: General
Topic: PPPoE Server + Firewall rules
Replies: 6
Views: 3881

Re: PPPoE Server + Firewall rules

in-interface=pppoe-whatever
I don't really like the idea of creating over 80 rules :?
by dog
Thu Jan 28, 2010 8:57 pm
Forum: General
Topic: PPPoE Server + Firewall rules
Replies: 6
Views: 3881

PPPoE Server + Firewall rules

Hi,

I'm running a PPPoE Server on RouterOS 4.5
Is there a possibility to match any traffic that originates from a pppoe-client apart from their IP addresses?

Best regards

Max
by dog
Mon Jan 25, 2010 5:45 am
Forum: Wireless Networking
Topic: Radio Mobile basics
Replies: 3
Views: 1485

Radio Mobile basics

Hi, I have been playing around with Radio Mobile a bit but the simulations don't really seem to match the real values. I'm using R52 cards with Mars Dual antennas. system.JPG As I read it Radio Mobile tells me that this link would be barely usable on 54Mbit. link.JPG In reality however I get a 54Mbi...
by dog
Sat Jan 23, 2010 11:06 pm
Forum: General
Topic: PPPoe to clients side
Replies: 4
Views: 1457

Re: PPPoe to clients side

station-pseudobridge will also make brigde auto, not exstra configurasjon on the client or ap side? No configuration is needed on the ap. On the client you need to bridge wlan and ether interfaces - that's it. so i have control over how many that are connected. so pepol not just connect a switch af...
by dog
Sat Jan 23, 2010 10:42 pm
Forum: General
Topic: PPPoe to clients side
Replies: 4
Views: 1457

Re: PPPoe to clients side

In your situation you can set the clients wireless mode to "station-pseudobridge".
Then bridge the wlan and ether interface together.
This will allow exactly one device (the router) to access the wlan.
by dog
Sat Jan 23, 2010 5:53 pm
Forum: Beginner Basics
Topic: MPLS tunnel per client?
Replies: 0
Views: 759

MPLS tunnel per client?

Hi, we are currently using a pretty standard setup: Wireless AP bridged with EoIP tunnel ending at PPPoE-AC. I don't really like this solution as the only possibility to avoid client-client-communication seems to be bridge-horizon and disabling default-forward. I've read a bit about MPLS and I'm won...
by dog
Wed Oct 21, 2009 8:21 pm
Forum: Beginner Basics
Topic: outgoing via PPPoE client
Replies: 3
Views: 2011

Re: outgoing via PPPoE client

You could have gotten that simpler:
ip fire nat add chain=src-nat out-interface=pppoe-client action=masq
by dog
Wed Oct 21, 2009 8:16 pm
Forum: General
Topic: PPPO Bridging Problem
Replies: 6
Views: 1495

Re: PPPO Bridging Problem

Is it not possible to connect yourself to another port of the router?

The other solution: Dial in via PPPoE like all other users and use the gateway ip you got from your router.
by dog
Wed Oct 21, 2009 11:45 am
Forum: General
Topic: PPPO Bridging Problem
Replies: 6
Views: 1495

Re: PPPO Bridging Problem

So do you have an IP address assigned on the PPPoE bridge?
On the same interface the users are connecting via pppoe the router must not have an IP address.
by dog
Wed Oct 21, 2009 3:44 am
Forum: Beginner Basics
Topic: How to get 2 lan with 2 wan
Replies: 2
Views: 1404

Re: How to get 2 lan with 2 wan

Basically you have three sources to account for: - LAN 192.168.5.0/24 - DMZ 172.16.31.0/30 (This means the DMZ only consits of one Server and the router !?) - The router itself I would use three routers in this case: ISP1 --- 84.234.123.43/32 --- NAT-Router ---- 10.255.255.0/30 -+ +-- 192.168.5.0/24...
by dog
Wed Oct 21, 2009 3:14 am
Forum: Beginner Basics
Topic: RB450G switched ports
Replies: 4
Views: 2852

Re: RB450G switched ports

Don't worry too much about the switch-Feature for now. What you are looking for is called "Master Port" and is located under interfaces. For example to create a switch between ports 3,4,5 you change the master port of ether4 and ether5 to ether3 and set the master port of ether3 to none - ...
by dog
Wed Oct 21, 2009 3:04 am
Forum: Beginner Basics
Topic: Pulling my hair out
Replies: 7
Views: 2304

Re: Pulling my hair out

Please check your setup looks like so: +-------+ +------+ +----------+ +--------+ | PC |--- 192.168.30.0/24 ---| AP |--- 10.255.255.0/30 ---| Client |--- 192.168.16.0/24 ---| Laptop | +-------+ +------+ +----------+ +--------+ On PC: Standard Gateway = 192.168.30.1 On AP: Static Route => 192.168.16....
by dog
Wed Oct 21, 2009 12:53 am
Forum: General
Topic: PPPO Bridging Problem
Replies: 6
Views: 1495

Re: PPPO Bridging Problem

A dhcp server doesn't come from nowhere :)
So you must have either set up a dhcp-server listening on the bridge or on some other device reachable via the bridge.
Second question:
How are the users that are dialing in connected to the device?

Best regards

Max
by dog
Fri Oct 02, 2009 12:02 am
Forum: Beginner Basics
Topic: how to configure a bridge
Replies: 3
Views: 1827

Re: how to configure a bridge

I would use an EoIP tunnel for this: On the device in the middle bridge EoIP and LAN together and on the PPPoE-Server add a new bridge, add EoIP to it and attach the pppoe server to that bridge. The only thing to pay attention for it that both ends of the EoIP tunnel have a different MAC address whi...
by dog
Thu Oct 01, 2009 11:43 pm
Forum: Beginner Basics
Topic: local to local masquerade
Replies: 3
Views: 2533

Re: local to local masquerade

What you are looking for is hairpin NAT. This is possible, but the NAT rule might look a bit strange at first: For example to forward HTTP to server at 10.26.4.15 you would need this rule (10.26.4.254 is the router ip). chain=dstnat action=dst-nat to-addresses=10.26.4.15 protocol=tcp dst-address=!10...
by dog
Thu Oct 01, 2009 11:17 pm
Forum: Beginner Basics
Topic: Queue Questions [SOLVED]
Replies: 3
Views: 1324

Re: Queue Questions

Thank you two! :D This worked with some minor changes: The main queue must not have an interface set (interface=all,parent=none). And all Upload/Download values need to be swaped ( upload will be Rx and vice versa) Similarly the "Target Address" is the remote host ip and the Dst. Address i...
by dog
Sat Sep 26, 2009 7:49 pm
Forum: Beginner Basics
Topic: Queue Questions [SOLVED]
Replies: 3
Views: 1324

Queue Questions [SOLVED]

Hi, I've read the manual on Queues but it just don't get it :( I really only want to do something simple: - I have an interface ether1 which needs to be limited at 2M outgoing and 50M incoming traffic - On this interface sits interface vlan1 which should be able to use all this traffic - Also there ...
by dog
Thu Sep 17, 2009 11:02 pm
Forum: Beginner Basics
Topic: RB450 vs RB750
Replies: 9
Views: 3245

Re: RB450 vs RB750

I tried a RB750 on a VDSL50 line (Germany) with some NAT and firewall rules.
I could get 48 Mbits throughput and 50-70% CPU load with a few hundred Torrents...
by dog
Tue Sep 08, 2009 7:23 pm
Forum: Beginner Basics
Topic: Easy way to use VLAN over wireless?
Replies: 0
Views: 790

Easy way to use VLAN over wireless?

Hi, from reading through the forums I found out that this setup would be possible to transport VLANs over wireless: wlan1 wds-client1 wds-client1-vlan4 wds-cleint1-vlan9 bridge1-vlan4 eoip1 wds-client1-vlan4 bridge1-vlan9 wds-client1-vlan9 This might work for a PtP setup but I want to use VLANs with...
by dog
Tue Sep 08, 2009 2:20 am
Forum: Beginner Basics
Topic: How to connect via ethernet with dynamic ip address then vpn
Replies: 6
Views: 2870

Re: How to connect via ethernet with dynamic ip address then vpn

Do not add the default route supplied by the DHCP server - you won't need it.

Also: Is the pptp server in the same subnet as the dhcp ip you receive?
If not you might need to add a host route.
by dog
Mon Sep 07, 2009 11:03 pm
Forum: Beginner Basics
Topic: Merging 10 PPPoE Clients into one output ethernet
Replies: 3
Views: 1340

Re: Merging 10 PPPoE Clients into one output ethernet

is it possible to access all of these 10 clients in one LAN Card This would be possible using VLANs. You would need a VLAN capable switch (e.g. HP-1700) and add each modem to an untagged VLAN as well as the RouterOS interface tagged on all VLANs. and i want to merge them into one line so the result...
by dog
Mon Sep 07, 2009 9:40 pm
Forum: Beginner Basics
Topic: Simple Bridging Problem!!
Replies: 5
Views: 1941

Re: Simple Bridging Problem!!

When using a bridge you should not assign an IP to one of it's interfaces but to the bridge itself. Also please try the following: In the "General" tab of the bridge select "proxy-arp" for the ARP dropdown. If this does not work try it with either the wlan oder ether interface it...
by dog
Mon Sep 07, 2009 4:41 am
Forum: Beginner Basics
Topic: Simple Bridging Problem!!
Replies: 5
Views: 1941

Re: Simple Bridging Problem!!

In the Ubiquity software, I just select bridge mode, and accosiate it with the AP, and everything works ok!
- Set the operation mode of the wlan interface to station and make sure it connects.
- Create a bridge
- Add wlan1 and etherX to the bridge

That should do the trick.
by dog
Mon Sep 07, 2009 4:37 am
Forum: Beginner Basics
Topic: PPPoe client need help
Replies: 4
Views: 1579

Re: PPPoe client need help

Ok, that's an interesting problem.

I don't know RouterOS too well, but I would use 3 routers (either physical RB750 or MetaROUTER): Two for making the pppoe connections and one for doing the routing.
Or switch to an ISP which supports ML-PPPoE
by dog
Sat Sep 05, 2009 6:37 pm
Forum: Beginner Basics
Topic: DNAT-U-Turn?
Replies: 14
Views: 6921

Re: DNAT-U-Turn?

So it does work if the ip address is correct? Yeah. How often does your public ip address change? To help sell their leased lines the owner of pretty much all German last-miles "Deutsche Telekom" enforces a pretty silly limitation: Every DSL user will be disconnected every 24 hours and wi...
by dog
Sat Sep 05, 2009 3:30 pm
Forum: Beginner Basics
Topic: DNAT-U-Turn?
Replies: 14
Views: 6921

Re: DNAT-U-Turn?

If you use the "public ip of the day" in the nat rules, does it work? I know it is not a fix, but might help with the debugging. Yup, as said above this would work: 0 ;;; Standard-NAT-Rule chain=srcnat action=masquerade src-address=10.26.4.0/24 1 ;;; HTTP -> G5 chain=dstnat action=dst-nat...
by dog
Fri Sep 04, 2009 10:40 pm
Forum: Beginner Basics
Topic: DNAT-U-Turn?
Replies: 14
Views: 6921

Re: DNAT-U-Turn?

Is there a bridge somewhere in between? No, all LAN traffic comes from ether2 and all WAN traffic goes through pppoe-telekom1 (which is mounted on ether1) In the IP/firewall/filter: chain=forward action=accept protocol=tcp dst-port=20-21 In the IP/firewall/nat: chain=dstnat action=dst-nat to-addres...
by dog
Fri Sep 04, 2009 2:40 pm
Forum: Beginner Basics
Topic: DNAT-U-Turn?
Replies: 14
Views: 6921

Re: DNAT-U-Turn?

/ip firewall nat add action=masquerade chain=srcnat dst-address=10.26.4.15 \ dst-port=80 protocol=tcp src-address=10.26.4.0/24 I wish that would work, but it does not. /ip firewall nat chain=srcnat action=masquerade src-address=10.26.4.0/24 dst-port=80 protocol=tcp Neither does this example by mrz....
by dog
Fri Sep 04, 2009 5:33 am
Forum: Beginner Basics
Topic: PPPoe client need help
Replies: 4
Views: 1579

Re: PPPoe client need help

http://forum.mikrotik.com/viewtopic.php?t=34221

This might be what you are looking for
by dog
Fri Sep 04, 2009 5:05 am
Forum: Beginner Basics
Topic: DNAT-U-Turn?
Replies: 14
Views: 6921

DNAT-U-Turn?

Hi, I have a problem using Port Forwarding. I want to expose a webserver via dstnat rules - which works if if I try to access it from the outside, but does not if I try to access it from LAN: LAN-IP -> LAN-IP: works WAN-IP -> WAN-IP: works LAN-IP -> WAN-IP: doesn't work; I see the webbox These are m...
by dog
Sun Aug 16, 2009 5:12 pm
Forum: Beginner Basics
Topic: Multiple pppoe connections with subnet?
Replies: 2
Views: 1328

Re: Multiple pppoe connections with subnet?

Thanks,

I found some examples at the end of this pages which match my situation:
http://www.mikrotik.com/documentation/m ... t382128020 (won't work anymore)
http://www.mikrotik.com/testdocs/ros/2. ... t.php#.4.2
by dog
Sun Aug 16, 2009 3:52 am
Forum: Beginner Basics
Topic: Multiple pppoe connections with subnet?
Replies: 2
Views: 1328

Multiple pppoe connections with subnet?

Hi, is the following situation possible with RouterOS? I have two pppoe connections: pppoe-out1 and pppoe-out2 They have the public IPs 80.1.1.1 and 80.1.1.2 Also the ISP routes two subnets to those IPs: 1.1.1.0/24 and 2.2.2.0/24 Now given that the ISP will also prevent IP spoofing so that traffic f...
by dog
Wed Aug 12, 2009 4:57 pm
Forum: Beginner Basics
Topic: Change platform value
Replies: 5
Views: 2293

Re: Change platform value

Do you mean the device name?
You can set that under system > identity

Best regards
by dog
Wed Aug 12, 2009 3:44 pm
Forum: Beginner Basics
Topic: Port Isolation in Bridge?
Replies: 0
Views: 1009

Port Isolation in Bridge?

Hi, this is my first post :) I'm fairly new to RouterOS so please bear with me. I have the following bridge with members: bridge2 -> eoip1 -> ether2 -> ether3 -> wlan1 I want both ether ports and the wlan1 port to be able to send PPPoE traffic to eoip1 but they should not be able to communicate with...