MikroTik

guille4

I solved it works now in ROS v6.x :local traf; /queue simple :for i from=1 to=254 do={ :if ([/queue simple find target=("192.168.1." . $i . "/32")]!="") do={ :set traf [get [find target=("192.168.1." . $i . "/32")] total-bytes] :if ($traf>104857600) ...

guille4

Hi, the script described here: http://wiki.mikrotik.com/wiki/Limiting_a_user_to_a_given_amount_of_traffic_II :local traf; /queue simple :for i from=1 to= 254 do = { :if ([/queue simple find target-addresses=("192.168.1." . $i)] != "") do={ :set traf [get [find target-addresses=(&...

guille4

Nobody?

guille4

In ip hotspot for trial users who expired the trial period, there is a way to show a certain page? For example if I give 30 minutes to trial users, once expired this period, how I can show them a particular web page? any idea?

guille4

Hi Zod, can you solve this issue?

I´m still waiting for a solution from MK, I didnt see anything until now... and I cant find it by my own experiments in my net lab.

The loss packet still present in Rb1100ahx2 with ROS 6.7.

Thank you

guille4

Same problem here. With packet marks in mangle and queue tree enabled I lost at least 5% of packets with no load. BUT if I pass more traffic in fordward acorss the bridge the losts packets up to 8%.

RB1100. ROS 6.6. Bridge and of course ip firewall activated.

This issue IS NOT present in other RBs.

guille4

Hi all, Sometimes my Rb1200 ports can't maintain 100mbps and it drops a port to 10mbps. I'm trying to do a script that disable and then enable this port when this situation occurs. (because if I do manually this procedure it works and the port backs again to 100 mbps). Then I need a script thats it ...

guille4

Hi... RB450G in bridge mode, ports 1 y 2 bridged, rstp, fw on, when traffic comes through the bridge, the rb reboot all the time... like in loop... I diconnect from the lan the port 1 and rb becomes stable... BUT with no traffic at all... same config with 5.21 and earlier firmwares works fine... I p...

guille4

Hi everyone. My question is here. I have a public IP pool adresses assigned to me by my provider, a complete C class. Network scheme: ISP GATEWAY (public space) -> [wan (MK router RB450G) lan] -> CLIENTS (private space) I need assign public ip to my clients (not private ip, not NAT, not masquerading...

guille4

When router encapsulates Ethernet frame to forward over VPLS pseudowire, it checks if packet size + VPLS CW + MPLS labels exceeds MPLS MTU of outgoing interface. If it does, VPLS will fragment frame. In this example 1514byte layer2 packets are forwarded over VPLS, router adds CW (8bytes) and one MPL...

guille4

Hi, I have a lot of customers in my network using Windows, mostly of them are using Win Firewall, and their blocks our ping probes. I know the windows machine is run and connected to my network because the mac address is showed in dude, but... the question is... How can I show up in "a green st...

guille4

contact support@mikrotik.com

guille4

My first question is with the packet mark (mangle), at time I’m only marking packets based on protocols, now I’m think I need to mark packets based on protocols and source IP pools (I’m planning to use different IP pools to distinguish residential and corporate traffic), I guess if there is any way...

guille4

I have several rb450g acting as firewall, others as bw management, others as routers. All of them never has major issues until today... one day after install 4.4 :? The issues has found in 3 rb acting as firewalls (over 8 total in production). The customers call us and said the service has become to...

guille4

the broadcast traffic never has becomes a problem. At least in my networks. The hostpot is a good solution too, but I prefer not use it because the described method (used in my case) has work great for me, just for that. My customers authentication method is by IP & mac address through firewall ...

guille4

My best config is set up all the APs in bridge mode with a extensive filter firewalling over the bridge. All the bakchauling devices to the central office must be transparent bridges. The bw limiting and the routing is located at the central office. BUT the overall network design depends of the topo...

guille4

feature request!... something like this:

http://ipwatchd.sourceforge.net/
Something like arpwatch would be more useful, IMO.

Yes. Arpwatch is better.

guille4

My last network build for a customer was done with Mikrotik RouterOS boxes at each tower location and Ubiquiti radios on the tower (some Canopy, too). This type of design is a match made in heaven. You get the BEST of both worlds. If MT and UBNT were to collaborate more, it would send some serious ...

guille4

feature request!... something like this:

http://ipwatchd.sourceforge.net/

guille4

Also, try running (from the CLI): /system script run ClearCache From your previous post, it seems that it runs when you do that. Is that correct? Here I found something !! If I run "/system script run ClearCache" in the CLI I need to press "y" (yes) then the scripts REALLY clear...

guille4

One more thing to try. Run (CLI): /system scheduler set ClearCache policy=ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write /system script set ClearCache policy=ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write That gives bot...

guille4

/system scheduler
add comment="" disabled=no interval=1w name=ClearCache on-event=ClearCache \
    policy=reboot,read,write,policy,test,password,sniff,sensitive \
    start-date=jan/01/1970 start-time=05:15:00

Mikrotik V 4.2

guille4

they increased all the time... the proxy follow runs at the scheduled time without problem... this has confirmed on log but it has no visible effects after the script runs with in scheduled with the winbox closed. (if I run the script manually they clear the disk ok) the complete script "ClearC...

guille4

Your NAT config is wrong. you must put something like that in ip firewall nat: add chain=srcnat action=masquerade src-address=10.10.10.0/24 out-interface=ether1 enabled=yes use as source address and mask the ip pool of you internal network. You must config properly the ip address and routes in your ...

guille4

all this items has been checked.

guille4

Use the netwatch tool to change the routes rules if a link becomes down or up.

guille4

http://wiki.mikrotik.com/wiki/Firewall_nat

view the "dstnat" and "redirect to" functions.

guille4

post your firewall filter rules and nat rules here. do you use a bridge? Uf yes, then you need a firewall filter rule as follows: add chain=forward protocol=udp src-address=10.10.1.15 dst-port=5000 action=drop comment="deny udp attack" make sure the chain is forward if you use bridge or ch...

guille4

disable ALL the firewall filter rules and try again.

Post here your complete firewall config.

guille4

for better results you need use at least 15m of margin over the LOS to assure the link.

guille4

use the torch tool.

guille4

Hi all I have several web proxy cache... with this scrpt: /ip proxy set enable=no :delay 10s /ip proxy clear-cache If I run this script in certains ways I obtain different results. 1. If I use the "scheduled" mode with the winbox open, then the proxy cache disk (sata in secondary disk) bec...

guille4

If I have 10 CPE's and bandwidth equally assigned 1Mbps each, does the AP assigned the time "windows" equally to all CPE's or based on needs? Based on needs, with a max limit, follow read... AP assign more time "window" to one CPE causing other CPE's to frequently timeout? No. T...

guille4

Disable the web proxy over the RB1000. My best solution has been set up a webproxy cache in another machine with the only purpose to act as webproxy cache.

guille4

Maybe you need read about the use of the netwatch tool with the proper scripts when up and when down certain link.

guille4

Isn't the 2GHz-5MHz has maximum of 13MHz bandwidth? If so, at 2MHz full blast per client, wouldn't it be limit to about 6-7 clients, even if I have 40M fiber connection? Don't be confused between MHZ and MBPS. The transmission of IP packets is NOT continue, this fact improves the usage of the frequ...

guille4

yes, you're right. My mistake.

guille4

Yes you can. First: put one RB450G in bridge mode as you described in your schema. Use as ports of the bridge at least 2 ether interfaces. One side to backbone, other side to user's switch. In bridge you must activate the firewall. In firewall Mangle you must add all the customers, one rule per cust...

guille4

Use as parent the phisical outgoing interfaces that you use for providing service to your clients. If you use more than one, so you need use more than one iface as parent, and then define the pcq trees accordingly. With mangle you can mark connections and mark the packets with precission with the us...

guille4

yes. Maybe a BUG.

guille4

You may set up the bandwidth alocation as you wish. It's not really any change if you use 256k or 250k. These conventions is today obsolete and was made only for to do more easy the bytes/bites calcs at the first times of internet... too much years ago.

guille4

post your entire configs.

guille4

This may help you:

http://www.routerboard.com/pdf/tests_april_2009.pdf
http://www.routerboard.com/pdf/RouterBO ... arison.pdf

guille4

This may help you: http://www.routerboard.com/pdf/tests_april_2009.pdf I've got several rb450G and they can handle until 150M and 50000 pps of 512bytes each (aprox.), without any problem. CPU resources in that cases is not beyond 60%... so... I´m happy user of these boards under my network conditions.

guille4

additional note: with use of web proxy you can save 10-15% of provider bandwitdh. Checked.

guille4

First question: if your clients have a full charge of load then 40M are used for max 20 clients without degradation, beyond this may occur slow downs for all. I'm not sure how to reach this consumption in your wireless schema, because multiple factors may affect the service in a wireless links. But ...

guille4

In my several web proxys (mikrotik 4.2 version) I have no problem at all with facebook login. Try deactivate the caching, and with direct routing to the sites take a look if you follows experiment the issue.

guille4

Ok. To set priorities for ToS you should use simple queues. To set rules per client you should use PCQ trees. You need read some documentation like the famous QoS Megis PDF file, it is very explanatory about that. http://mum.mikrotik.com/presentations/CZ09/QoS_Megis.pdf Too look the video in MUM her...

guille4

Sure. Put a queue tree rule as follows: /queue tree add name="ether2" parent=ether2 limit-at=2000000 priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s limit-at format is in bits/seg, ether2 is an example: put your own interface here. This limits are ever applied in outgo...

guille4

Install these software in your computer. Start use it. Analyze all of the open connections coming of this softs with netstat. Then take note of the ip of this softwares attempt to connect in the login process (dest ip address). Then you can block all dest ip's in the firewall rules of mikrotik (drop...

guille4

The B is more robust over interference situations that others like G. Potentially you have minor real bw values than G, but B is much more stable and strong signal than others. Aditionally the B standard has a better throughput in nLOS environments (with different kinds of obstructions) that others ...

guille4

you cannot. Wifi clients in your schema have unlimited bandwitdh... so you can't guarantee any type of services to the clients behind the rb433 because the wifi clients can, potentially, eat all the bandwitdh.

guille4

these sites shows to her users dinamically html pages generated with tons of variable contents all the time. And then the web proxy cache only store on disk certains type of elements as images, logos, certain photos, of the sites that used that dinamic html format. I run several web proxy cache and ...

guille4

In my experiences when the cache size reach the 30 gb over one sata disk then the usage CPU goes up peeks of 50% or more... (dual core 2,6 Ghz). Then it is time to clear cache. But I think 40 o 50 gb may be still remains good speed at level user navigation. After that, yes, you can only expect see a...

guille4

I agree. Your explanation is really what here happens.

Pressing "cancel" instead "ok" in the status tab is the better way to avoid this issue.

Thank you!

guille4

I´ve got several devices in that mode, without any problem.

In fact, I use mangle rules to block or allow customers taking her mac addresses...

Please copy here the configs.

guille4

I have a RouterOS v3.30 with a AMD dual core 2,6 Ghz with 2GB RAM & 80 GB IDE HD for system & 80GB SATA HD for web-cache. I use a transparent web proxy and I set Max. Cache Size = unlimited then i close winbox, after a while, I open it again and Max. Cache Size is automatically setted to non...

guille4

read the docs and other posts about web proxy.

The SD cards is NOT recommended to use web proxy on it.

You should use a hard disk to do that.

guille4

In the mountain use ap bridge mode, AND you should enable the wds in dynamic in this rb. Ever use with the bridge mode ON between ethernet and wlan as ports over the same bridge. In the other site you must use station wds mode. And thats its all... your macs should traspass transparently in both ways.

guille4

For better understand your network policies.. how you determine if a mac address is a bad mac address? define bad-mac please in your terms. Anyway.. In my opinion you can't determine this BEFORE the mac get connection to your ap, because you dont know if a mac is bad o good before they get connected...

guille4

My request: each AP MUST accept ALL MAC except MAC in black-list. I need to centralize the access-list :( I dont know why you want accept all mac except certains mac blacked list. This is a big security hole. A better aproaching should be deny all macs and accept only the authorized macs. In this c...

guille4

for deny wireless ap connections to your ap use access-list (don't forget uncheck the default authenticate in your wlan card interface). for centralized mac blacklist you can use ip firewall mangle, doing a rule for each mac address in src-mac-address selector (put here the specific mac to block) a...

guille4

for deny wireless ap connections to your ap use access-list (don't forget uncheck the default authenticate in your wlan card interface). for centralized mac blacklist you can use ip firewall mangle, doing a rule for each mac address in src-mac-address selector (put here the specific mac to block) an...

guille4

What you need is to configure multiple ip over the same interface in your dude server machine. If you want see i.e. 10.10.10.0/24 in the dude, then you add ip 10.10.10.2... if you want monitor 10.10.40.0/24 range, then you add i.e. 10.10.40.2... over the same interface. this is easy to do in windowx...

guille4

Try this:

\x4d\x5a\x90\x03\x04|\x4d\x5a\x50\x02\x04

taken from: http://l7-filter.sourceforge.net/layer7 ... es/exe.pat

guille4

The ports of the bridge must be the eth port AND each wlan attached to the port. But, if you want filter some type of traffic, then you must use the firewall filter for bridges. Try: interface bridge settings set use-ip-firewall=yes or in winbox click on BRIDGE menu then on the SETTINGS menu and che...

guille4

Rb1000 is a better solution to do this, I think.

R200 too ! but is more expensive.

The rb1000 has not movile parts like HD, then the possibility of faults by hardware are minor than r200.

guille4

the difference is minimal.

Sounds like The Dude is more efficient than Windows !!

guille4

this is your solution: Matcher PCC.

http://forum.mikrotik.com/viewtopic.php ... atcher+pcc

regards.

guille4

Maybe the problem is not about how much traffic in kbps himself. And not about how much clients you have in each sector. Maybe you suffering a bottleneck with the amount of simultaneous connections at the same time. I've experienced dozens of issues with clients thats have trojans or viruses. They t...

guille4

Your problem is mostly probably due to high external interference. Maybe intentional !! Resource hardware in your case is ok. No more cpu or memory is necessary. The power of the wireless cards is ok too. Each card can manage about 30-40 clients without problems. You can try doing a spectrum analysi...

guille4

The media server is in the Lan segment? Can you post your lan / internet network diagram? can you post your queue/s config? do you use simple queues o tree queues? And please tell me if your final intention is to give your users 2.9 mbps of stream bandwidth AND 128 kbps of internet at the same time,...

guille4

ponela en español y la miro. En winbox ir a New Terminal, /interface wireless> pr y luego copiame el resultado. Luego: /interface wireless registration-table> pr y copiame aqui lo que te larga. In English: go to New Terminal, /interface wireless> pr and put here the results. Do it too with /interfac...

guille4

Config is not possible to be EXACTLY equal because rb433 has wireless interfaces and rb1000 not. If the count packet in firewall mangle of the rb1000 is zero when you try to mark the connections then you may adjust this to catch better your packets. If they not matched (and marked) then pcq trees do...

guille4

Please can you post your config?

/ip address> print
/interface> print
/ip firewall filter print
/ip firewall nat print   
/ip route print

thanks.

guille4

MK uses external smtps for send email... and usually doens't works properly.

In my opinion still have remains bugs in this area and her behaviour is umpredictable and unstable.

My suggestion is at the moment is to use a external software to do this.

guille4

http://wiki.mikrotik.com/wiki/Centraliz ... tspot_user

maybe this helps you.

Regards.

guille4

Your english is really bad. I can't understand it.

guille4

Yes, this is ONE suggestion. Other valid option is to use separate domains... I.E. user@wisp1 and user@wisp2 to differentiate users incoming from one or other wisp, but all of them validating over same radius server. Each wisp should can admin only your own domain. Freeradius is a god option for ach...

guille4

I dont know why... but in windows XP all works fine... with the same config. A total mistery.

guille4

looks like a interference problem, or may be a poor quality signal.

You make tests of bandwidth between you and your clients? ping tests? loss? avg time response?

can you post your wireless config?

guille4

Yes, in my opinion, this is a bug. You can retry execute after 10 secs the same command and it maybe send succesfully the email. I dont know why this behaviour, but I put my script to retry after 15 secs and the first time I obtain a ERROR SENDING EMAIL: AUTH failed. After 15 secs the email is going...

guille4

You should use the 3.4 version of The Dude.

guille4

The problem is: How can know the MK where should be validating an incoming connection client in one radius or other radius? The simplest way is to have only ONE radius server, with private zones for each wisp. In this way one wisp can add, modify, etc., only her users without the other wisp can mana...

guille4

check this out:

http://wiki.mikrotik.com/wiki/Dmitry_on_firewalling

regards.

guille4

PROBLEM SOLVED !!!!!!!!!!!! THANKS SAM !!! YOU'RE RIGHT !!! # DST-ADDRESS PREF-SRC G GATEWAY DISTANCE IN.. 0 A S 0.0.0.0/0 r 192.168.1.1 1 et.. r ether3 et.. Deleting "ether3" in the config everything works fine !!!!!! You save my soul !!! thank you thank you thank you very much... You win...

guille4

your "ip route print" has 2 entries under the default gateway, one with the IP and one with the interface. Why is that? I wonder if thats part of the problem. Also, are you double natting? I wonder why your public ip is a private ip, or was that for forum privacy? Is IPv6 package loaded? ...

guille4

After very much probes, the result is the same. Some sites responds, the majority not. From MK ping to some sites responds ok, at the same time from ping in Vista to the same site I obtain a "destination unreachable" message from the "wan" ip address of Mk. In timeline some sites...

guille4

I probe putting MTU = 1480 and MTU = 1460 and same results.

It is very frustrating.

I think is some problem in Mikrotik, because the same machine with Vista works fine behind others common routers.

guille4

I forgot it: the MTU value in Vista and in the RB is 1500. Checked.

guille4

Thank you Jimbo. I have disabled al "tunnels" connections and virtual interfaces in Vista (teredo, ISATAP, and others). I disabled all the protocols over each interface in Vista, I have now only active and configured tcp/ip v4 over LAN connection. I probe it too with another RB450G, and I ...

guille4

Hi all, I have some strange problem. Scenario: RB450G with one wan (ether1) and one lan (private) with srcnat active. Both interfaces have static ip. Fixed public ip in ether1 200.xx.xx.xx, connected to my ISP, and fixed public in lan, in a private range 10.10.10.1/24. chain=srcnat action=src-nat to...

guille4

make sure you have marked "store on disk" in your "Graphing" rules.

I've got the same problem. After software reboot the previous graphs disappear. RB450G, ver 3.30. Store on disk = yes.

Search found 93 matches