Community discussions

Search found 161 matches

by psamsig
Fri Jan 12, 2018 1:47 pm
Forum: Scripting
Topic: Bandwidth-test in a script
Replies: 8
Views: 8422

Re: Bandwidth-test in a script

quite inconsistent
In what way? I was personaly going for the max 10 second avg over a 20 second periode, and picking the 'true' 10 second avg should at most be a matter of taste? (and so is 1000 and 1024 as long you are consistant in what you comape with)
by psamsig
Tue Dec 29, 2015 9:24 pm
Forum: General
Topic: Routerboard 2011UiAS firmware upgrade
Replies: 4
Views: 2421

Re: Routerboard 2011UiAS firmware upgrade

http://wiki.mikrotik.com/wiki/RouterBOOT_changelog

Upgrade is not automatic, you need to push 'Upgrade' in WinBox (System->Routerboard) and then do a reboot.
by psamsig
Fri Dec 25, 2015 4:32 pm
Forum: Scripting
Topic: Script is not executing....
Replies: 1
Views: 672

Re: Script is not executing....

You can not use absolute numbers in script, that is only for terminal. You have to 'find' what you want to set.
:global a
/ip hotspot user 
:set a [get "00:27:0E:03:C4:21" bytes-out]
/ip hotspot ip-binding
:if ($a= "15730745") do={
    set [find mac-address "00:27:0E:03:C4:21"] type=blocked
 }
by psamsig
Mon May 25, 2015 9:35 am
Forum: Scripting
Topic: How to perform a "dhcp-server lease find"?
Replies: 3
Views: 2177

Re: How to perform a "dhcp-server lease find"?

find has no output, only a return value, try this instead:
:put [/ip dhcp-server lease find]
by psamsig
Thu May 14, 2015 7:27 pm
Forum: Scripting
Topic: automating access list oddity
Replies: 2
Views: 1201

Re: automating access list oddity

I am pretty sure the problem lies with the :for i from=0 to=( go with :foreach i in= instead. Item indexing in script/scheduler works different than in console. Not sure what the script tries to accomplish, but here is my shot on a slightly more readable version: /interface wireless registration-tab...
by psamsig
Fri May 01, 2015 1:40 pm
Forum: Scripting
Topic: please Help me
Replies: 5
Views: 1077

Re: please Help me

There are breaks between the IPs, it is in UNIX format, so only terminated by a \n, not \r\n as Windows expect. Script almost worked, but would end in an endlless loop, if it didn't break on the IPv6 adresses (at least on mine, since I haven't IPv6 activated). Here is one that work: /file { :local f...
by psamsig
Thu Apr 23, 2015 6:19 am
Forum: Scripting
Topic: scheduler not work in v6.27
Replies: 7
Views: 1116

Re: scheduler not work in v6.27

Did you enable the scheduler? (I scripted it disabled).

The script you posted searched for more than 2 (e.g. 3 or more) identical names, that pat I didn't change.
by psamsig
Tue Apr 21, 2015 11:41 pm
Forum: Scripting
Topic: scheduler not work in v6.27
Replies: 7
Views: 1116

Re: scheduler not work in v6.27

I have tried to tidy the script up a bit, but have no hotspot running, so it isn't tested /system scheduler add comment="\C7\E3\D3\DF \CD\D1\C7\E3\EC" disabled=yes interval=1m name=\ "NetCut((shadysoft))" on-event="NetCut((shadysoft))" start-time=\ startup /system script add name="NetCut((shadysoft)...
by psamsig
Tue Apr 21, 2015 10:34 pm
Forum: Scripting
Topic: scheduler not work in v6.27
Replies: 7
Views: 1116

Re: scheduler not work in v6.27

First guess, don't put code in on-event, put it in a script. I used to (some what) work, but never been good practice.
by psamsig
Sun Apr 05, 2015 10:42 am
Forum: General
Topic: scheduler script won't run , manual run O.K
Replies: 9
Views: 1547

Re: scheduler script won't run , manual run O.K

Apart from the typo I just fixed, there shouldn't be any syntax errors. If you have only cherry picked, then write the pick like this:
:local Sms [:pick [/tool sms inbox find] 0];
by psamsig
Fri Apr 03, 2015 12:32 am
Forum: General
Topic: scheduler script won't run , manual run O.K
Replies: 9
Views: 1547

Re: scheduler script won't run , manual run O.K

I rewrote it slightly, to make it more readable, but it should be fairly obvious to see what you need to change. I haven't tried it, since I have no SMS device to try it out on. I don't know what the delays are good for so i kept them, and not sure either what the set receive-enabled=yes; is good fo...
by psamsig
Thu Apr 02, 2015 7:41 pm
Forum: General
Topic: Script Tips
Replies: 2
Views: 849

Re: Script Tips

This will rename and un-slave all ethernet interfaces /interface ethernet { :foreach eth in=[find] do={ set $eth name=[get $eth default-name] master-port=none; } } No worry about renaming, it is only a label for your reading pleasures. It won't affect firewall, routing, etc., it will however affect ...
by psamsig
Thu Apr 02, 2015 1:03 am
Forum: General
Topic: scheduler script won't run , manual run O.K
Replies: 9
Views: 1547

Re: scheduler script won't run , manual run O.K

:global SmsMsg [/tool sms inbox get value-name=message number=0];
Never ever use numbers directly in 'get' statements, they are only meant for use in console (as returned from a print), in scripts you get the number with 'find'. I'll be happy to rewrite it for you if needed.
by psamsig
Tue Mar 31, 2015 4:58 pm
Forum: Scripting
Topic: scripting an FTP file upload using a file with an unknown name ending in .txt
Replies: 7
Views: 795

Re: scripting an FTP file upload using a file with an unknown name ending in .txt

I'm all for teaching good practice, the reason I commented in the first place. Putting multiple statement in on line separated with semikolon would sure work, but personally I am not a fan of multi statement lines, they are no easy read. All down to taste of course.
by psamsig
Tue Mar 31, 2015 3:46 pm
Forum: Scripting
Topic: scripting an FTP file upload using a file with an unknown name ending in .txt
Replies: 7
Views: 795

Re: scripting an FTP file upload using a file with an unknown name ending in .txt

No you do not need to use :global instead of :local, only if run from the console, since each statement is then treated as independent scope, unless it is part of a common block (i.e. in {}) { :local myname [/system identity get name] /tool fetch upload=yes mode=ftp address=x.x.x.x src-path="$myname...
by psamsig
Fri Dec 26, 2014 12:32 am
Forum: Beginner Basics
Topic: NAT to two different servers on the same port via hostname
Replies: 2
Views: 843

Re: NAT to two different servers on the same port via hostna

You can't do L7 to direct NAT, it is to late since the TCP connection is already established. My best idea would be to make a redirect on one of the two servers, to an URL including a port number e.g. http://mysecondserver.com:81 and then add a NAT for that to the second server. Not pretty but i wor...
by psamsig
Mon Oct 13, 2014 8:25 am
Forum: Beginner Basics
Topic: Firewall Mangle rule shows no traffic
Replies: 10
Views: 2346

Re: Firewall Mangle rule shows no traffic

You need to change protocol to tcp. OpenVPN can be either TCP or UDP, in RouterOS only TCP is supported.
by psamsig
Thu Oct 02, 2014 8:33 am
Forum: Beginner Basics
Topic: A good VPN provider for Mikrotik RB750GL running 5.26 ?
Replies: 4
Views: 1352

Re: A good VPN provider for Mikrotik RB750GL running 5.26 ?

Any interface with an address will have at least one route, if you get a default route (0.0.0.0/0) you just need to uncheck ' Add default route'. I don't know of any particular problems with PPTP in 5.26 (but on the other hand I don't use it myself), but a potential problem could be MTU, try loverin...
by psamsig
Wed Oct 01, 2014 11:36 pm
Forum: Scripting
Topic: i don't know what probelm in my interface script
Replies: 4
Views: 1179

Re: i don't know what probelm in my interface script

Static or dynamic interfaces?
by psamsig
Wed Oct 01, 2014 11:14 pm
Forum: General
Topic: this simple mark packet and routing wont work
Replies: 5
Views: 1008

Re: this simple mark packet and routing wont work

This may help you in the right direction: /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark \ in-interface=telkom1 new-connection-mark=telkom1 \ passthrough=no add action=mark-routing chain=output connection-mark=telkom1 \ new-routing-mark=route1 passthrough=no ...
by psamsig
Tue Sep 30, 2014 11:51 pm
Forum: General
Topic: this simple mark packet and routing wont work
Replies: 5
Views: 1008

Re: this simple mark packet and routing wont work

You need to use connection-marks instead of packet-marks, it is the outgoing packet (as part of a connection) you wanna mark for routing.
by psamsig
Tue Sep 30, 2014 11:38 pm
Forum: Scripting
Topic: i don't know what probelm in my interface script
Replies: 4
Views: 1179

Re: i don't know what probelm in my interface script

I have no idea what you try to do when $tx < $fconetent, but here goes: /interface { :local tx :local fname :foreach s in=[find] do={ :set tx [get $s tx-byte] :set tx ($tx / 1048576) :set fname [get $s name] :set fname ("Mostafa_".$fname.".txt") /file { :local f [find name=$fname] :if ([:len $f] = 0...
by psamsig
Tue Sep 30, 2014 10:27 pm
Forum: Beginner Basics
Topic: VPN routing issue !
Replies: 5
Views: 1201

Re: VPN routing issue !

What about default-route=yes on the pptp-client?
by psamsig
Fri Sep 26, 2014 8:52 pm
Forum: Scripting
Topic: Script to limit according to number of packets
Replies: 7
Views: 1582

Re: Script to limit according to number of packets

Use comments and filter with that:
[find comment="ThisOne"]
or combine:
[find target-addresses~"^192\\.168\\.1\\." comment="ThisOne"]
of course you can use name as well:
[find name~"contain this text"]
by psamsig
Fri Sep 26, 2014 5:23 pm
Forum: Scripting
Topic: bgp peer switch script
Replies: 8
Views: 2204

Re: bgp peer switch script

I have no experience with BGP, but here is a go: /routing bgp peer { :local priPeerState [get [:pick [find name="Primary"] 0] state] :local secPeer [:pick [find name="Secondary"] 0] :local secPeerDisabled [get $secPeer disabled] :if ($priPeerState != "established") do={ :if ($secPeerDisabled = true)...
by psamsig
Fri Sep 26, 2014 8:56 am
Forum: Scripting
Topic: Script to limit according to number of packets
Replies: 7
Views: 1582

Re: Script to limit according to number of packets

~ is regex, so escape accordingly:
[find target-addresses~"^192\\.168\\.1\\."]
Also be aware that syntax has changed for RouterOS 6 (at least in 6.19):
[find target~"^192\\.168\\.1\\."]
by psamsig
Thu Sep 25, 2014 9:23 pm
Forum: Scripting
Topic: help with address-list script please
Replies: 2
Views: 878

Re: help with address-list script please

/ip firewall address-list {
    :foreach i in=[find list=blocked] do={
        :log info [get $i address]
    }
}
by psamsig
Thu Sep 25, 2014 9:17 pm
Forum: Scripting
Topic: Scripting Sum Count of bytes Out
Replies: 3
Views: 1669

Re: Scripting Sum Count of bytes Out

/ip hotspot user {
    :local gigabyte 0
    :foreach i in=[find] do={
        :set gigabyte ($gigabyte + [get $i bytes-out])
    }
    :put $gigabyte
}
by psamsig
Thu Sep 25, 2014 9:59 am
Forum: General
Topic: IPSec Tunnel Configuration
Replies: 9
Views: 1994

Re: IPSec Tunnel Configuration

You need a NAT accept rule to pass through the LAN to LAN traffic, so it doesn't get masqueraded. Router 1: /ip firewall nat add place-before=0 action=accept chain=srcnat disabled=no dst-address=192.168.0.0/24 Router 2: /ip firewall nat add place-before=0 action=accept chain=srcnat disabled=no dst-a...
by psamsig
Thu Sep 25, 2014 9:16 am
Forum: Scripting
Topic: Script Output Works Manually But Not Automatically?
Replies: 3
Views: 947

Re: Script Output Works Manually But Not Automatically?

You can not use item numbers in scripts (i.e. get 5). If the interface you want to monitor is called 'thisOne' you should change this: :global txdata [/interface get [find name="thsisOne"] tx-byte]; :global rxdata [/interface get [find name="thsisOne"] rx-byte]; Unless this script is part of a great...
by psamsig
Tue Sep 16, 2014 10:33 pm
Forum: Scripting
Topic: Bandwidth-test in a script
Replies: 8
Views: 8422

Re: Bandwidth-test in a script

I know this is an old tread, but since it was never answered and it is the first hit when you look for one, I'll post my own findings: /tool { :local txAvg 0 :local rxAvg 0 bandwidth-test 1.2.3.4 duration=20s direction=both user=BTestClient password=******** do={ :if ($txAvg < $"tx-10-second-average...
by psamsig
Tue Sep 16, 2014 12:22 am
Forum: Scripting
Topic: Join two scripts on only one
Replies: 6
Views: 1461

Re: Join two scripts on only one

Then what about this then: /ppp active { :foreach i in=[find name=bill] do={ :foreach ip in=[get $i address] do={ /ip firewall address-list { :local o [find list=clients comment=bill] :if ([:len $o] = 0) do={ add list=clients comment=bill disabled=no address=$ip } else={ :if ([get $o address] != $ip...
by psamsig
Mon Sep 15, 2014 11:13 pm
Forum: Scripting
Topic: Join two scripts on only one
Replies: 6
Views: 1461

Re: Join two scripts on only one

The one i posted find all ppp connections by 'bill' and it adds the IP-address of these to a address-list names 'clients' with the comment 'bill' in case the don't already exists, and logs a message in case they do. I don't get your third case. Is it to remove entries from the address-list of ppp co...
by psamsig
Sun Sep 14, 2014 2:28 pm
Forum: Scripting
Topic: Need help with script to make simple queue for dhcp entries
Replies: 10
Views: 5791

Re: Need help with script to make simple queue for dhcp entr

A slightly more efficient version: /ip dhcp-server lease { :foreach i in=[find] do={ :local leasedIp [get $i address] /queue simple { :if ([:len [find target=("$leasedIp/32")]] = 0) do={ add name=$leasedIp target=$leasedIp max-limit=1000000/2000000 } } } } Since you are at 6.x, there is a new option...
by psamsig
Sat Sep 13, 2014 12:48 am
Forum: Scripting
Topic: Join two scripts on only one
Replies: 6
Views: 1461

Re: Join two scripts on only one

Not quite clear to me what you try to achieve, but her is a go: /ppp active { :foreach i in=[find name=bill] do={ :foreach ip in=[get $i address] do={ /ip firewall address-list { :if ([:len [find address=$ip comment~"bill"]] > 0) do={ :log info ($ip . " already exists in address-list") } else={ add ...
by psamsig
Tue Sep 09, 2014 11:25 pm
Forum: Scripting
Topic: Problem with scripts executing from scheduler - global vars
Replies: 5
Views: 1306

Re: Problem with scripts executing from scheduler - global v

You have a curly bracket to much, remove it and it should work.

Change:
           :log info "Unotelly: Updated with IP $currentIP"
       }
   }  else={
to:
           :log info "Unotelly: Updated with IP $currentIP"
   }  else={
by psamsig
Sat Sep 06, 2014 11:22 am
Forum: General
Topic: Redirect dns lookup of .local domain to a single DNS server
Replies: 7
Views: 4001

Re: Redirect dns lookup of .local domain to a single DNS ser

Well you are right that you can false positive matches, but not with something like www.localtaxi.com, only with something like local.com or www.local.com (the \x05 part makes sure of that). I have tried a few ways to enhance it, and this filter even them out: /ip firewall layer7-protocol add name="...
by psamsig
Sat Sep 06, 2014 3:16 am
Forum: Scripting
Topic: running script problem
Replies: 2
Views: 756

Re: running script problem

Haven't tested the following, had no router with user-manager at hand. /tool user-manager user { :local p [find actual-profile="200MBN" || actual-profile="500MBN" || actual-profile="1GBN"]; :if ([:len $p] > 0) do={ enable $p; /log info "night user enabled successfully"; }; }; Even this should work. ...
by psamsig
Sat Sep 06, 2014 2:56 am
Forum: General
Topic: Redirect dns lookup of .local domain to a single DNS server
Replies: 7
Views: 4001

Re: Redirect dns lookup of .local domain to a single DNS ser

Sure it is. Something like this should do the work. Requests comes in on 'ether1' aimed for the router and all requests for *.local will be redirected to 1.1.1.1 /ip firewall layer7-protocol add name="DNS .local" regexp="\\x05local" /ip firewall mangle add chain=prerouting protocol=udp dst-port=53 i...
by psamsig
Sun Aug 24, 2014 12:07 am
Forum: Scripting
Topic: Uptime script
Replies: 8
Views: 4401

Re: Uptime script

What was wrong with
:delay 1h
by psamsig
Mon Aug 18, 2014 11:08 pm
Forum: Beginner Basics
Topic: Users AAA Radius NPS Windows Server 2008
Replies: 7
Views: 4211

Re: Users AAA Radius NPS Windows Server 2008

I have it working too. Did you remember to change your AD to allow passwords to be stored using reversible encryption?

EDIT: AND changed your password afterwards.
by psamsig
Mon Aug 18, 2014 11:00 pm
Forum: General
Topic: IPSec traffic from within the router cli
Replies: 3
Views: 540

Re: IPSec traffic from within the router cli

Add a static route as suggested, but don't add a gateway address, specify the interface that covers the policies src-address as gateway.
by psamsig
Mon Aug 11, 2014 12:25 am
Forum: Scripting
Topic: [6.17][script error]monitor-traffic
Replies: 9
Views: 2058

Re: [6.17][script error]monitor-traffic

Try this one on 6.18 (wont work on versions < 6.x)
:foreach reci in=[/ppp active find] do={
    :do {
        /interface monitor-traffic $reci once do={
            :log warning $reci
        }
    } on-error={
        :log warning ($reci . " disappeared")
    }
}
by psamsig
Thu Aug 07, 2014 11:00 pm
Forum: Scripting
Topic: [6.17][script error]monitor-traffic
Replies: 9
Views: 2058

Re: [6.17][script error]monitor-traffic

Something has changed that I can't put my finger on, but if you run your original script on earlier versions, the output looks very different and it takes forever to complete. If you make one little adjustment, it seems to run equally well. My guess is that the different behavior gives at PPP connec...
by psamsig
Tue Aug 05, 2014 8:52 am
Forum: Scripting
Topic: Help with script to find / in identity and replace with -
Replies: 3
Views: 1150

Re: Help with script to find / in identity and replace with

/system identity { :local orgIdentity [get name] :local newIdentity :for i from=0 to=([:len $orgIdentity] -1) do={ :if ([:pick $orgIdentity $i] = "/") do={ :set newIdentity "$newIdentity-" } else={ :set newIdentity ($newIdentity . [:pick $orgIdentity $i]) } } :if ($orgIdentity != $newIdentity) do={...
by psamsig
Mon Aug 04, 2014 5:26 pm
Forum: Beginner Basics
Topic: About scripts scheduler
Replies: 4
Views: 794

Re: About scripts scheduler

As long as you don't run it shortly before midnight, this should work:
start-time=([/system clock get time] + 00:00:02)
by psamsig
Fri Aug 01, 2014 12:10 am
Forum: Scripting
Topic: Unique Global Variables
Replies: 9
Views: 2069

Re: Unique Global Variables

If the variables is only used within a script, they should be declared local and not global.
by psamsig
Mon Jul 28, 2014 2:39 pm
Forum: General
Topic: Multicast between two IPSec connected networks
Replies: 0
Views: 562

Multicast between two IPSec connected networks

I have a program that uses multicast to address 231.0.0.1 to inform other instansces of the same program on other machines in the network of certain events. Now i have a situation where the program is running in two different networks (lets call them 192.168.0.0/24 and 192.168.1.0/24), connected thr...
by psamsig
Fri Jan 03, 2014 10:44 am
Forum: General
Topic: How to detect if master port in a switch is connected or not
Replies: 3
Views: 1025

Re: How to detect if master port in a switch is connected or

I still haven't found a solution.
by psamsig
Fri Jun 07, 2013 2:41 pm
Forum: Scripting
Topic: Handling expected errors?
Replies: 15
Views: 9172

Re: Handling expected errors?

With fewer exemptions worth mentioning, never ever assume any entry numbers, they are more often than not, non-sequential.
by psamsig
Thu Feb 14, 2013 10:34 am
Forum: Forwarding Protocols
Topic: MikrotTik NAT doesn't masquerade some packets
Replies: 3
Views: 1350

Re: MikrotTik NAT doesn't masquerade some packets

The reason I answered was that I have just resently seen something quite similar, when tracking problems with a HTTP based webservice, and in my case I got rid of it (without really understanding the root cause) by changing the HTTP session from 'Connection: Keep-Alive' to 'Connection: Close'. I wro...
by psamsig
Wed Feb 13, 2013 11:26 pm
Forum: Forwarding Protocols
Topic: MikrotTik NAT doesn't masquerade some packets
Replies: 3
Views: 1350

Re: MikrotTik NAT doesn't masquerade some packets

My guess would be that the connection has timedout in the connection-tracking (IP -> Firewall -> Connections push 'Tracking') that handles NAT, there are quite a number of timeout settings in there to play with, but so far I haven't really found any good description of what and why (and why not) to ...
by psamsig
Thu Jan 03, 2013 8:43 am
Forum: General
Topic: IPSEC tunnel issues - SAs need flushing from time to time
Replies: 23
Views: 5404

Re: IPSEC tunnel issues - SAs need flushing from time to tim

One thing to try was not having 'Send initial contact: Yes' in both ends.
by psamsig
Wed Dec 12, 2012 11:29 pm
Forum: Scripting
Topic: one script runs, one doesn't IPSEC Policy GET
Replies: 3
Views: 1068

Re: one script runs, one doesn't IPSEC Policy GET

Never use numbers unless you are in the console, and have then from a print , in scripts you use [find <something>]. The are very few exception to this rule. and as you have seen your self, it may work i one situation, but not nesseserely in an other, thats why you never use numbers in scripts. Ther...
by psamsig
Tue Dec 04, 2012 8:49 pm
Forum: General
Topic: IPsec failure: The policy is invalid!
Replies: 3
Views: 669

Re: IPsec failure: The policy is invalid!

It must be conflicting with an other policy, on its self, it seems ok.
by psamsig
Sun Dec 02, 2012 10:38 am
Forum: Scripting
Topic: Remove Dynamic Invalid Address
Replies: 4
Views: 4163

Re: Remove Dynamic Invalid Address

If DI is your requirement, then this should work:
/ip address remove [find dynamic=yes invalid=yes]
by psamsig
Sat Dec 01, 2012 10:49 pm
Forum: Scripting
Topic: Script text runs on Terminal , but not from "run script"
Replies: 2
Views: 1530

Re: Script text runs on Terminal , but not from "run script"

Try this:
:global sysmanping
:if ($sysmanping=0) do={ :log info "test ok" }
by psamsig
Fri Nov 30, 2012 12:16 pm
Forum: General
Topic: How to detect if master port in a switch is connected or not
Replies: 3
Views: 1025

How to detect if master port in a switch is connected or not

As soon as at least one slave is connected, the master port gets a running state and 'link-ok' status, rate will be '10Mbps' and full-duplex will be 'no'. I am trying to make a script to find possibly misconfigured ports/switches (mostly half-dubplex), but the master port gives me false positives, w...
by psamsig
Thu Nov 29, 2012 12:04 am
Forum: General
Topic: IPSec cannot reach router from router
Replies: 4
Views: 638

Re: IPSec cannot reach router from router

Wrong interface, in your case use eth02.LAN
by psamsig
Wed Nov 28, 2012 9:08 pm
Forum: General
Topic: IPSec cannot reach router from router
Replies: 4
Views: 638

Re: IPSec cannot reach router from router

Add a static route on each router, you don't need to a specific gateway, just the desired interface.
by psamsig
Thu Nov 08, 2012 7:47 am
Forum: General
Topic: Scripts skiping lines!
Replies: 5
Views: 1307

Re: Scripts skiping lines!

It is considered bad practice to use index numbers i scripts, use some kind of [find=..] instead. But if I understand you correct, then on of the failing lines, in both cases, is the with ipsec, and that doesn't make sence, apart from reading something about a problem witn a [find] on its own, I don...
by psamsig
Wed Nov 07, 2012 12:23 pm
Forum: General
Topic: IPsec VPN keeps disconnecting
Replies: 14
Views: 9217

Re: IPsec VPN keeps disconnecting

From the thread it seems to be related to DPD, and cases where the Cisco end drops a SA, but MT router doesn't tries to negotiate a new. Try lower your DPD, both interval and failures (dpd-interval=2m dpd-maximum-failures=5), start with 20s/1. You could also ask somebody in Cisco-land, if it really ...
by psamsig
Tue Nov 06, 2012 9:04 pm
Forum: General
Topic: IPsec VPN keeps disconnecting
Replies: 14
Views: 9217

Re: IPsec VPN keeps disconnecting

Did you happen to read the answer on same question?

http://forum.mikrotik.com/viewtopic.php ... 34#p340974
by psamsig
Sat Nov 03, 2012 12:11 pm
Forum: General
Topic: Disconnected IPSEC peer problem
Replies: 4
Views: 2775

Re: Disconnected IPSEC peer problem

I have never seen an IPSec router that didn't had its quirks, especially when connecting to other brands, and RouterOS isn't an exception, but on the other hand I have hundreds of tunnels running rock steady, with a RB at least in one end. Post complete IPSec configuration, both ends, you have to ru...
by psamsig
Fri Nov 02, 2012 10:30 pm
Forum: General
Topic: IPsec VPN keeps disconnecting
Replies: 14
Views: 9217

Re: IPsec VPN keeps disconnecting

@Jacka: Post your configuration (peer, policy and proposal). What equipment is in the main office? Are lifetimes/lifebytes equal on both ends? Are you using DPD? Do you use Netwatch to keep trafic running?
by psamsig
Wed Oct 17, 2012 11:42 pm
Forum: General
Topic: IPSec vpn won't work unless subnet routed to local bridge
Replies: 10
Views: 4431

Re: IPSec vpn won't work unless subnet routed to local bridg

You only need the route if you want/need the router itself to send trafic through the tunnel (like Netwatch). To be honest it was a suprise to me too, and also to others if you search the forum, but it is just how RouterOS works. You get a SA for each direction, so two is normal (with swaped src/dst).
by psamsig
Sat Oct 13, 2012 2:51 pm
Forum: Scripting
Topic: time server resolving script, help please!
Replies: 2
Views: 1090

Re: time server resolving script, help please!

In other words, you missed the $ in front of the variables. But since we are in the process of rewriting the original, here is how I would have put it: /ip firewall address-list { :local resolvedIP [:resolve time.windows.com] :local o [find comment=time.windows.com] :if ($resolvedIP != [get $o addre...
by psamsig
Sat Sep 08, 2012 1:53 pm
Forum: Scripting
Topic: Triggering script from a firewall rule
Replies: 4
Views: 5432

Re: Triggering script from a firewall rule

Make the firewall rule that add to an address list, schedule a script to run ever so often and check if something has been added to that list, if that's the case, then remove entry (entries) and do your thing.
by psamsig
Sat Aug 25, 2012 10:13 am
Forum: Beginner Basics
Topic: difference between routeros??
Replies: 2
Views: 661

Re: difference between routeros??

There is a difference, but only in the CPU class, 'Device' just helps you pick the right one. At the moment there is four different CPUs (mipsbe, mipsle, powerpc, x86), and one more seems to be on ots way.
by psamsig
Fri Aug 24, 2012 10:47 pm
Forum: General
Topic: clearing firewall address list
Replies: 2
Views: 437

Re: clearing firewall address list

/ip firewall address-list remove [find name="name_of_addresslist"] 
by psamsig
Fri Aug 24, 2012 10:41 pm
Forum: Scripting
Topic: Script to disable, wait some seconds and enable an interface
Replies: 5
Views: 15990

Re: Script to disable, wait some seconds and enable an inter

Try give this a spin: /system script add name="Restart ether0" \ source=":global runningRestartEther0\r\ \n:if ([:len \$runningRestartEther0] = 0 || \$runningRestartEther0 = 0) do\ ={\r\ \n /interface {\r\ \n :set runningRestartEther0 1\r\ \n :local o [find name=\"ether0\"]\r\ \n set \$o disabled=ye...
by psamsig
Thu Aug 23, 2012 6:21 am
Forum: General
Topic: sonicwall ipsec multiple subnets
Replies: 2
Views: 822

Re: sonicwall ipsec multiple subnets

Try make the policies level to 'unique' instead of 'require'
by psamsig
Sat Aug 18, 2012 7:02 pm
Forum: General
Topic: Script for disabling wlan
Replies: 7
Views: 1249

Re: Script for disabling wlan

Well, I was to lazy to test it, this is tested and should work: /interface { :local arps [:len [/ip arp find interface=ether1]] :local wlan [find name=wlan1] :local inact [get $wlan disabled] :if ($inact = true && $arps > 0) do={ set $wlan disabled=no } else={ :if ($inact = false && $arps = 0) do={ ...
by psamsig
Sat Aug 18, 2012 2:24 pm
Forum: General
Topic: VPN Issue
Replies: 5
Views: 889

Re: VPN Issue

According to http://wiki.mikrotik.com/wiki/Manual:Interface/PPTP : At this point (when pptp client is successfully connected) if you will try to ping any workstation form the laptop, ping will time out, because Laptop is unable to get ARPs from workstations. Solution is to set up proxy-arp on local ...
by psamsig
Sat Aug 18, 2012 2:13 pm
Forum: General
Topic: Script for disabling wlan
Replies: 7
Views: 1249

Re: Script for disabling wlan

Here is something that may get you going, I would suggest it being scheduled to run evey 5-10 seconds. /interface { :local arps [:len [/ip arp find interface=ether1]] :local wlan [find name=wlan1] :local state [get $wlan disabled] :if ($state = true && aprs > 0) do={ set $wlan disabled=false } else=...
by psamsig
Fri Aug 10, 2012 7:02 am
Forum: General
Topic: PPTP forward port not working
Replies: 7
Views: 8174

Re: PPTP forward port not working

There is no need for making a NAT rule for GRE, the PPTP helper takes care of that, and as long you use standard port 1723, the helper will kick in automatically. I just tested a similar senario, with a MikroTik router acting as PPTP server behind yet a MikroTik router with the NAT rule, and with a ...
by psamsig
Fri Aug 10, 2012 12:38 am
Forum: Beginner Basics
Topic: Pingable Static route unreachable. I'm baffled.
Replies: 8
Views: 8056

Re: Pingable Static route unreachable. I'm baffled.

6 ADC 255.255.255.224/32 10.34.17.44 4_RMC 0 The IP adress for this interface 4_RMC is configuret wrong, someone put a netmask (and that is almost never used in RouterOS) as network. This is how it is now: /ip address add address=10.34.17.32/32 interface=4_RMC network=255.255.255.224 this is how it...
by psamsig
Thu Aug 09, 2012 10:27 pm
Forum: Scripting
Topic: Reading internal menu ID
Replies: 6
Views: 1229

Re: Reading internal menu ID

These all do the same: /ppp active remove [find name="main-2] { :local cpename "main-2"; /ppp active remove [find name=$cpename] } { :local cpename "main-2"; :local o [/ppp active find name=$cpename] /ppp active remove $o } /ppp active { :local cpename "main-2"; :local o [find name=$cpename] remove ...
by psamsig
Thu Aug 09, 2012 11:05 am
Forum: Scripting
Topic: Reading internal menu ID
Replies: 6
Views: 1229

Re: Reading internal menu ID

Ah, I missd the problem
:local ifstr [/interface get [find name=$ifname]];
should be
:local ifstr [/interface find name=$ifname];
by psamsig
Wed Aug 08, 2012 9:39 pm
Forum: Scripting
Topic: Copy current synchronized time/date to flash
Replies: 9
Views: 1647

Re: Copy current synchronized time/date to flash

How very odd, the NTP package changes the default bootup date, so the second script should be changed to the following: /ip dns static { :local o [find name=clock.localhost] :if ([:len $o] > 0) do={ :local datetime [get [:pick $o 0] comment] /system clock { :if ([:len $datetime] > 0 and [:pick [get ...
by psamsig
Wed Aug 08, 2012 9:13 pm
Forum: Scripting
Topic: Reading internal menu ID
Replies: 6
Views: 1229

Re: Reading internal menu ID

$ifstr wil contain an array of ids, $idstr will hold the first entry of these They can be used either way: /interface set $ifstr disabled=yes /interface set $idstr disabled=yes or /interface remove $ifstr /interface remove $idstr In your current example it will be the same (since there at most can b...
by psamsig
Tue Aug 07, 2012 2:31 pm
Forum: General
Topic: IPSec VPN to Cisco 1841 help
Replies: 5
Views: 3477

Re: IPSec VPN to Cisco 1841 help

The most common problem (in the MikroTik end) would be the lack of an exception in /ip firewall nat to accept the VPN trafic before it hits the general masquerading rule. For the configuration in the posted example it would be something like this: /ip firewall nat add place-before=0 action=accept ch...
by psamsig
Tue Aug 07, 2012 2:13 pm
Forum: Scripting
Topic: remove script on the basis of comparison
Replies: 5
Views: 1136

Re: remove script on the basis of comparison

works fine, thank you so much.
That's what karma is for :)
by psamsig
Tue Aug 07, 2012 2:10 pm
Forum: General
Topic: how to make routerboard 433 restart itself every 30 days
Replies: 4
Views: 698

Re: how to make routerboard 433 restart itself every 30 days

4w2d is how 30d 00:00:00 got exported, and if you need it to be every 5th day, then just write 5d
by psamsig
Tue Aug 07, 2012 1:59 pm
Forum: Scripting
Topic: remove script on the basis of comparison
Replies: 5
Views: 1136

Re: remove script on the basis of comparison

Try this, at least I got this working on 5.18, I don't have access to a 3.30:
/ip proxy access remove [find src-address="192.168.3.1" dst-host="domena"]
by psamsig
Tue Aug 07, 2012 1:49 pm
Forum: General
Topic: how to make routerboard 433 restart itself every 30 days
Replies: 4
Views: 698

Re: how to make routerboard 433 restart itself every 30 days

/system script add name=Reboot source="/system reboot"

/system scheduler add name=Reboot on-event=Reboot start-date=aug/07/2012 start-time=05:00:00 interval=4w2d
by psamsig
Tue Aug 07, 2012 1:28 pm
Forum: Scripting
Topic: remove script on the basis of comparison
Replies: 5
Views: 1136

Re: remove script on the basis of comparison

/ip proxy access remove [find src-address=192.168.3.1 dst-host=domena]
by psamsig
Mon Aug 06, 2012 11:33 pm
Forum: General
Topic: netwatch failover assistance
Replies: 2
Views: 2073

Re: netwatch failover assistance

In the script that switches ISP put this: /ip firewall connection remove [find protocol="udp"] , it will remove any NATed udp 'conncections'. P.S. In case you use ROS 5.12+ then try a /export compact instead next time. P.P.S. It is a bad idea to put commands/script code directly in a netwatch the up...
by psamsig
Mon Aug 06, 2012 10:06 pm
Forum: Scripting
Topic: Copy current synchronized time/date to flash
Replies: 9
Views: 1647

Re: Copy current synchronized time/date to flash

Or maybe MT could stop graphs from being updated until NTP is synchronised. +1 Quite a few things should get postponed until NTP is synchronised, e.g. I have often noticed that an IPSec VPN gets established before a response from NTP kicks in, so the tunnel has to get recreated after just a few sec...
by psamsig
Mon Aug 06, 2012 8:24 pm
Forum: Scripting
Topic: Copy current synchronized time/date to flash
Replies: 9
Views: 1647

Re: Copy current synchronized time/date to flash

Create this as a script and run it with a scheluder. This may be hard on the NAND, so schedule accordingly, but frequence will be the 'precision' of the saved clock. /ip dns static { :local o [find name=clock.localhost] :local datetime /system clock { :set datetime ([get date] . " " . [get time]) } ...
by psamsig
Mon Aug 06, 2012 7:39 pm
Forum: Scripting
Topic: Scripting Virtual Interfaces
Replies: 3
Views: 825

Re: Scripting Virtual Interfaces

Many thanks !!!
That's what karma is for :)
by psamsig
Mon Aug 06, 2012 12:56 pm
Forum: Scripting
Topic: Scripting Virtual Interfaces
Replies: 3
Views: 825

Re: Scripting Virtual Interfaces

 /interface wireless set [find interface-type="virtual-AP"] default-authentication=no hide-ssid=yes
by psamsig
Mon Aug 06, 2012 12:41 pm
Forum: General
Topic: email not working in 5.19
Replies: 10
Views: 1752

Re: email not working in 5.19

I have had my fair share of e-mail problems, but it always comes down to misconfiguration (firewall in either end, spamfilter frontend and so on), never RouterOS. And as mentioned already, I have 5.19 sending mails like a charm.
by psamsig
Mon Aug 06, 2012 1:23 am
Forum: General
Topic: email not working in 5.19
Replies: 10
Views: 1752

Re: email not working in 5.19

Works fine for me. You did notice that parameters changed a bit between 4.11 and 5.19 right?
by psamsig
Fri Aug 03, 2012 11:17 pm
Forum: General
Topic: IPSec VPN hardware encryption performance-cant get 820Mbps
Replies: 5
Views: 1896

Re: IPSec VPN hardware encryption performance-cant get 820Mb

Out of curiosity, and in case you still have the test setup running, how does it perform with MD5 instead SHA1?

On earlier occasions, tests have shown that RouterOS gets surprisingly high differences between MD5 and SHA1 (not so surprisingly in the favor of MD5)
by psamsig
Wed Aug 01, 2012 1:24 am
Forum: General
Topic: Autoupgrade Winbox issue
Replies: 2
Views: 449

Re: Autoupgrade Winbox issue

Works for me with a user belonging to a group with only ftp, winbox and read
by psamsig
Mon Jul 30, 2012 11:36 pm
Forum: General
Topic: IPSec too many connections at once
Replies: 8
Views: 946

Re: IPSec too many connections at once

I still urge you to write to MikroTik support, don't expect them to pick up from the forum. The problem with all tunnels being renegociated when adding/removing peers can't I remember seeing myself, and reports about it is old (2+ years). I even tried on a 5.18 box with 449 enabled peers and current...
by psamsig
Mon Jul 30, 2012 4:45 pm
Forum: General
Topic: IPSec too many connections at once
Replies: 8
Views: 946

Re: IPSec too many connections at once

Apart from that the box should handle this by it self, this may be a work around: /ip firewall filter add action=jump chain=input dst-port=500 jump-target="IPSec sluice" protocol=\ udp add chain="IPSec sluice" dst-limit=1,5,src-address add action=drop chain="IPSec sluice" be warned though, I haven't...
by psamsig
Fri Jul 27, 2012 2:03 pm
Forum: General
Topic: IPSec too many connections at once
Replies: 8
Views: 946

Re: IPSec too many connections at once

I would contact support. 250 tunnels on a RB1100AHx2 doesn't sound unreasonable.

I'm no queue expert, but I wonder if limiting trafic to UDP/500 would be a (short term) solution, but you need someone else to help you there.
by psamsig
Fri Jul 27, 2012 1:06 am
Forum: General
Topic: IPSec too many connections at once
Replies: 8
Views: 946

Re: IPSec too many connections at once

What version of ROS, although not documented, it seems some work has been done on later versions, I am currently on 5.18. Have you turned on ipsec logning (e.g. /system logging add topic=ipsec ...), I used to, but in 5.x it has become extreamly verbose, so I use topics=ipsec,!debug now. What DH-grou...
by psamsig
Thu Jul 26, 2012 10:03 pm
Forum: General
Topic: IPSec too many connections at once
Replies: 8
Views: 946

Re: IPSec too many connections at once

Do you have 'Send Initial Contact' enabled on all the peers in the RB1100AHx2?
by psamsig
Fri Jul 20, 2012 9:47 am
Forum: Wireless Networking
Topic: Advance wireless channel...
Replies: 14
Views: 3575

Re: Advance wireless channel...

by psamsig
Mon Jul 02, 2012 9:24 pm
Forum: General
Topic: Two IPSec tunnels from the same network
Replies: 6
Views: 1106

Re: Two IPSec tunnels from the same network

10.20.0.32/28 is covered by 10.20.0.0/24, so if you you haven't added a priority, the first one created wins.
by psamsig
Sun Jul 01, 2012 1:04 pm
Forum: Scripting
Topic: Running script on startup with interval
Replies: 6
Views: 4698

Re: Running script on startup with interval

Make a new scheduler that runs this scrip at startup: /system scheduler { :local o [find name="Job to be run at startup and every 24h after that"] :if ([get $o disabled] = no) do={ set $o disabled=yes } :local today :do { :delay 3 :set today [/system clock get date] } while=([:pick $today 7 11] = "1...
by psamsig
Sun Jul 01, 2012 10:39 am
Forum: Scripting
Topic: Checking for something before adding it
Replies: 3
Views: 948

Re: Checking for something before adding it

/ip hotspot walled-garden { :local gardenList (\ "www.wifiportal.co.uk"\ , "www.candengo.co.uk"\ , "www.apple.com"\ , "www.paypal.com"\ , "www.paypalobjects.com"\ , "paypal.112.2O7.net"\ , "*.paypal.com"\ , "*.paypalobjects.com"\ , "*.akamaiedge.net") :foreach i in $gardenList do={ :if ([:len [find...
by psamsig
Sun Jun 24, 2012 2:36 pm
Forum: General
Topic: Mikrotik and QNO IPSec VPN is unstable
Replies: 3
Views: 1234

Re: Mikrotik and QNO IPSec VPN is unstable

100+ tunnels should be no problem on that box. I have experience with QNO, but here is what I would play around with in your situation. You have different phase 2 timeouts (3600 seconds is not 30 minutes) Don't set 'Send initial Contact' (I only set it in the 'client' end) Don't set 'NAT Traversal' ...
by psamsig
Fri Apr 20, 2012 5:03 pm
Forum: Scripting
Topic: Script to update IPSec Peer Address
Replies: 5
Views: 1507

Re: Script to update IPSec Peer Address

/32 IS a single IP address. It may be that WinBox allows you to enter a single IP, but if you try to enter a terminal and do an export of your IPSec peer configuration, you will see that the script language uses (and requires) the net address notation.
by psamsig
Thu Apr 19, 2012 11:44 pm
Forum: Scripting
Topic: Script to update IPSec Peer Address
Replies: 5
Views: 1507

Re: Script to update IPSec Peer Address

Because it expect not an IP address but a net address. So address=10.0.0.1/32 should do the trick.
by psamsig
Sun Dec 25, 2011 2:47 am
Forum: Scripting
Topic: Using the find command in a script
Replies: 2
Views: 1642

Re: Using the find command in a script

:local xName "total"
:if ([:len [/queue simple find name=$xName]] = 1) do={
    :put "found"
}
or if you need the index of the queue
/queue simple {
    :local i [find name=$xName]
    :if ([:len $i] = 1) do={
        :put "found @$i"
    }
}
by psamsig
Mon Dec 05, 2011 10:52 am
Forum: Scripting
Topic: Possible bug with global variables
Replies: 26
Views: 5942

Re: Possible bug with global variables

My script is called from different places, scheduler and netwatch.
And all you have to do is make a script that contains all you otherwise would have in NetWatch and call that sctipt instead.
but this workaround isn't solution in my case.
Did you try?
by psamsig
Mon Dec 05, 2011 8:39 am
Forum: Scripting
Topic: Possible bug with global variables
Replies: 26
Views: 5942

Re: Possible bug with global variables

I have had the same problem, I solved it by moving the up-/down-script lines to two named scripts and call them instead:
/tool netwatch
add comment="" disabled=no down-script="Netwatch VPN down" host=10.0.11.1 interval=1m timeout=1s up-script=\
    "Netwatch VPN up"
by psamsig
Sat Dec 03, 2011 7:48 pm
Forum: General
Topic: restarting the ipsec tunnel
Replies: 5
Views: 5702

Re: restarting the ipsec tunnel

Use netwatch to trigger a tunnel: http://forum.mikrotik.com/viewtopic.php?f=2&t=49016
by psamsig
Sat Dec 03, 2011 7:43 pm
Forum: Scripting
Topic: A script to calculate Average CPU Load
Replies: 19
Views: 12550

Re: A script to calculate Average CPU Load

You don't need any logging for it to do it's main purpose, rebooting on high load, you can even remove all lines starting with ':log'
by psamsig
Fri Nov 11, 2011 10:50 pm
Forum: Scripting
Topic: I need a script - please help
Replies: 5
Views: 1005

Re: I need a script - please help

/ip firewall address-list remove [find]
is all it takes to clear address-list
by psamsig
Tue Oct 04, 2011 11:45 pm
Forum: Scripting
Topic: Scripting help
Replies: 3
Views: 806

Re: Scripting help

flood-ping has the following values: sent, received, "min-rtt", "avg-rtt" and "max-rtt"
:local maxRtt; /tool flood-ping 1.1.1.1 count=10 do={:if ($sent = 10) do={:set maxRtt $"max-rtt"}}; :put $maxRtt;
by psamsig
Sat Sep 03, 2011 12:03 pm
Forum: Scripting
Topic: Handling expected errors?
Replies: 15
Views: 9172

Re: Handling expected errors?

It is really silly to have it break a script, and if that wasn't enough, these breaks leads to memory leaks. So it is quite absurd that this hasn't been dealt with yet, I resently found a post here on the forum that some kind of try/catch was being cosidered, but that was two years ago, so I wouldn'...
by psamsig
Tue Aug 30, 2011 8:37 pm
Forum: Scripting
Topic: Logic assistance with script
Replies: 2
Views: 634

Re: Logic assistance with script

This should make a pretty good start, save as a script and schedule it as frequent at you wish, it prevents multiple concurrent runs by it self (RouterOS wont) :global scriptRunning :if ([:len $scriptRunning] = 0) do={ :set scriptRunning "1" :local staticIP "10.0.0.1" :local infName "pppoe-out1" :lo...
by psamsig
Sat Aug 27, 2011 12:47 am
Forum: Scripting
Topic: What is the problem with my script?
Replies: 2
Views: 734

Re: What is the problem with my script?

'/log find' not '/log print', remember a '\' with all '?' in strings. :global lastTime; :local currentBuf [/log find buffer=VPN]; :if ([:len $currentBuf] != 0) do={ :local currentLineCount [:len $currentBuf]; :local lastItem [:pick $currentBuf ($currentLineCount - 1)]; :local currentTime [:totime [/...
by psamsig
Fri Jul 22, 2011 10:35 am
Forum: General
Topic: IPSEC performance MD5 vs SHA
Replies: 6
Views: 5142

Re: IPSEC performance MD5 vs SHA

Please see attached performance comparision of RB450 and RB450G using openssl test:
http://open-wrt.ru/forum/viewtopic.php?id=22323
That rules out 1) and 3) (slower but not terribly) and leaves '2) sha-1 hashing algorithm implementation used is badly optimized for mipsbe' ?
by psamsig
Wed Jun 15, 2011 8:15 am
Forum: Scripting
Topic: Basic scripting questions
Replies: 4
Views: 2187

Re: Basic scripting questions

:for i from=0 to=2 do={ :if ($i < 2) do={ :log info "True" :if ($i < 1) do={ :log info "True 2" } else={ :log info "Not True 2" } } else={ :log info "Not True" } } works like a charm, only reason the original post should fail I can come up with, is the lacking space between 'if' and the '(' Tested ...
by psamsig
Sun May 29, 2011 6:43 pm
Forum: General
Topic: Static gateway unreachable !
Replies: 13
Views: 12372

Re: Static gateway unreachable !

Not sure if last post was an indication that you fixed the problem, or that you didn't get my point, but in case of the latter:
by psamsig
Sun May 29, 2011 6:11 pm
Forum: General
Topic: Static gateway unreachable !
Replies: 13
Views: 12372

Re: Static gateway unreachable !

255.255.255.128 is the network mask, it is NOT what goes under network, here you should put 200.x.x.128.
by psamsig
Sun May 29, 2011 5:32 pm
Forum: General
Topic: Static gateway unreachable !
Replies: 13
Views: 12372

Re: Static gateway unreachable !

Post '/ip address' configuration, it seems like you have entered something wrong, on your screen dump you have a route for 255.255.255.128, that doesn't seem right!
by psamsig
Mon Apr 18, 2011 10:45 pm
Forum: Scripting
Topic: Ping randomly and Monitor the Latency Script...
Replies: 12
Views: 13708

Re: Ping randomly and Monitor the Latency Script...

Someone resently brought this little cutie to my attention: { :local avgRtt; /tool flood-ping 1.1.1.1 count=10 do={ :if ($sent = 10) do={ :set avgRtt $"avg-rtt" } } :put $avgRtt; } you can get min (min-rtt), max (max-rtt) or average (used above) times, or even lost packets (recived - sent). Play wit...
by psamsig
Sun Apr 17, 2011 9:43 am
Forum: Scripting
Topic: netwatch and multiple scripts
Replies: 1
Views: 849

Re: netwatch and multiple scripts

/system script {run "script1"; run "script2"}
by psamsig
Mon Apr 04, 2011 11:45 pm
Forum: Scripting
Topic: Upgrade bios firmware in script
Replies: 6
Views: 5880

Re: Upgrade bios firmware in script

Try this, worked for me when I had the same problem: /system script add name="Upgrade bootloader" source="/system routerboard upgrade" and in your original script, subtitute /system routerboard upgrade with /system script run "Upgrade bootloader" it was the only way I could get it to work, on 3.29+ ...
by psamsig
Mon Apr 04, 2011 9:11 pm
Forum: General
Topic: IPSec disables local access to RouterOS
Replies: 4
Views: 915

Re: IPSec disables local access to RouterOS

I haven't found the 'right' way to do this, and too have had several different brads of VPN routers that had no problem with a setup like that. On RouterOS I have solved it so far, by access the router through the external IP (from the inside net), of course that gets slightly complicated unless you...
by psamsig
Sun Mar 20, 2011 11:07 pm
Forum: RouterBOARD hardware
Topic: CPU Frequences on an 1100AH? ;)
Replies: 4
Views: 894

Re: CPU Frequences on an 1100AH? ;)

Try
/system routerboard settings set memory-frequency=?
by psamsig
Sun Mar 20, 2011 1:16 am
Forum: General
Topic: A-ipsec-B-ipsec-C, with out VPN C access to A LAN?
Replies: 1
Views: 384

Re: A-ipsec-B-ipsec-C, with out VPN C access to A LAN?

Only address space covered by a policy can go through a tunnel, so you need covering policies or multiple tunnels, expect best performance with A-B, B-C and A-C tunnels though.
by psamsig
Sun Mar 20, 2011 12:10 am
Forum: General
Topic: IPSEC Tunnel between Mikrotik routers
Replies: 5
Views: 915

Re: IPSEC Tunnel between Mikrotik routers

1. site, Wan 1.1.1.1, Lan 10.1.1.0/24, getting VPN access to 10.2.2.0/24 and 192.168.2.0/24 from 10.1.1.0/24 /ip ipsec proposal add auth-algorithms=md5 disabled=no enc-algorithms=aes-128 lifetime=8h name=md5-aes-128-8h pfs-group=none /ip ipsec peer add address=2.2.2.2/32:500 auth-method=pre-shared-k...
by psamsig
Sat Mar 12, 2011 2:50 pm
Forum: Scripting
Topic: finding the interface that a the default route in on
Replies: 2
Views: 738

Re: finding the interface that a the default route in on

This should do the trick: { :local gatewayStatus [:tostr [/ip route get [:pick [find dst-address=0.0.0.0/0 active=yes] 0] gateway-status]] :local i [:find $gatewayStatus " reachable " -1] :local interface :if ($i > 1) do={ :set interface [:pick $gatewayStatus ($i + 11) 255] } :put $interface }
by psamsig
Sun Mar 06, 2011 11:38 am
Forum: Scripting
Topic: need help with flood-ping script
Replies: 3
Views: 2876

Re: need help with flood-ping script

Im not sure I understand what you mean when you ask where I found the constructs ?
The other day you asked about /interface monitor-traffic do={} and this is about /tool flood-ping do={}, and I just haven't seen these do={}'s used in that manner before, and as I said, they are not well documnted.
by psamsig
Sat Mar 05, 2011 12:38 pm
Forum: Scripting
Topic: need help with flood-ping script
Replies: 3
Views: 2876

Re: need help with flood-ping script

do={} is executed at start, end and at every 'interval', and you only want the last
:local maxRtt; /tool flood-ping 66.xxx.xxx.4 count=10 do={:if ($sent = 10) do={:set maxRtt $"max-rtt"}}; :put $maxRtt; 
Where do you find these odd constructs, I can't seem to find any documentation for them!
by psamsig
Fri Mar 04, 2011 12:52 am
Forum: Scripting
Topic: Trying to put a new line in an email, not working
Replies: 2
Views: 832

Re: Trying to put a new line in an email, not working

/tool e-mail send to="my@email.not" subject="Test" body=".\r\n."
works for me on 3.29, 4.10, 4.11 and 5.0rc9.
by psamsig
Mon Feb 28, 2011 7:55 pm
Forum: Beginner Basics
Topic: Routing trough VPN
Replies: 2
Views: 459

Re: Routing trough VPN

I belive you are talking about an ipsec VPN, and if so, then you can't route any other trafic than what the policies allow (e.g. a tunnel defined as 192.168.5.0/24 - 192.168.1.0/24 can not pass trafic to or from 10.10.0.0/24). It is possible though, to have more than one policy per peer, at least be...
by psamsig
Sun Feb 27, 2011 1:52 pm
Forum: Scripting
Topic: script works in 3.x but not in 4.x. helo
Replies: 3
Views: 944

Re: script works in 3.x but not in 4.x. helo

This is tested to work on 3.29, 4.10 and 5.0rc9 (all I have access to) /interface ethernet { :foreach i in=[find] do={ :local infName [get $i name] :local sysName [/system identity get name] /interface monitor-traffic $infName once do={ :log info ("Interface,$sysName,$infName,$"rx-packets-per-second...
by psamsig
Fri Feb 25, 2011 11:13 pm
Forum: Scripting
Topic: Second script no updating IPSEC peer
Replies: 5
Views: 1618

Re: Second script no updating IPSEC peer

Here is what I use: /ip ipsec { :foreach i in=[peer find comment~"^\\+.*"] do={ :local curPeerIP [peer get $i address] :set curPeerIP [:pick $curPeerIP 0 [:find $curPeerIP "/" -1]] :local dnsName [peer get $i comment] :set dnsName [:pick $dnsName 1 [:len $dnsName]] :local dnsAddress [:resolve $dnsNa...
by psamsig
Fri Feb 25, 2011 9:33 am
Forum: Forwarding Protocols
Topic: IPSec Installed-sa
Replies: 3
Views: 10006

Re: IPSec Installed-sa

Yes to both, especially the second. But both should be easy tested. Try use a wrong PSK and see if the messages change.
by psamsig
Fri Feb 25, 2011 9:29 am
Forum: Scripting
Topic: The "in" logical oprerator -- in srearch for a :toipprefix
Replies: 2
Views: 455

Re: The "in" logical oprerator -- in srearch for a :toippref

If you are going to revise this anyway, then consider: 1) implicit conversion of both left and right side of the operator, this is consistent with behavior elsewhere (e.g. "1" + 1 = 2) 2) allow the left oprator to be implicit conveted from ip to ip-prefix (e.g. 1.1.1.1 -> 1.1.1.1/32) combining 1) an...
by psamsig
Fri Feb 25, 2011 1:32 am
Forum: Scripting
Topic: The "in" logical oprerator -- in srearch for a :toipprefix
Replies: 2
Views: 455

The "in" logical oprerator -- in srearch for a :toipprefix

Am I the only one who has some trouble with this operator? According to the Wiki the format is like: :put (1.1.1.1/32 in 1.1.1.0/24) which should return true, and I have confirmed that it does, but it is very picky on its types :put ("1.1.1.1/32" in 1.1.1.0/24) returns 'false'. :put [:typeof 1.1.1.1...
by psamsig
Tue Feb 22, 2011 11:05 pm
Forum: Forwarding Protocols
Topic: IPSec Installed-sa
Replies: 3
Views: 10006

Re: IPSec Installed-sa

1) Yes, SHA is MikroTik is SHA-1, so thats not the problem.

2) I have no experience with aggressiv mode and the use of FQDN, so I can't advise you on that, but 'debug HASH mismatched' sounds like some of shared information, between the two routers, like PSK, IP and/or FQDN doesn't add up.
by psamsig
Sun Feb 20, 2011 11:17 pm
Forum: Beginner Basics
Topic: IPSec Installed-sa
Replies: 2
Views: 3838

Re: IPSec Installed-sa

No it doesn't look right, try enable ipsec logging
/system logging action add memory-lines=100 memory-stop-on-full=no name=ipsec target=memory
/system logging add action=ipsec disabled=no prefix="" topics=ipsec
and check the log.
by psamsig
Wed Feb 16, 2011 8:02 pm
Forum: General
Topic: IPSec tunnel subnet problem
Replies: 2
Views: 803

Re: IPSec tunnel subnet problem

I have the very same problem and haven't found any real solution for it yet. So far i have 'solved' it by using the address of the WAN interface to access the router, even from the inside, and also used it for DNS address, it works, but ain't pretty.
by psamsig
Thu Feb 10, 2011 10:33 pm
Forum: General
Topic: Netwatch to an IP address on the other side of a IPSEC VPN
Replies: 5
Views: 4688

Re: Netwatch to an IP address on the other side of a IPSEC V

Add a route to 192.168.1.0/24 on you LAN interface

e.g:

/ip route add disabled=no dst-address=192.168.1.0/24 gateway=Lan

that will make Netwatch work
by psamsig
Thu Dec 16, 2010 11:09 pm
Forum: Forwarding Protocols
Topic: Realworld results with RB1000U - IPSEC
Replies: 6
Views: 928

Re: Realworld results with RB1000U - IPSEC

The IPsec subsystem gets unstabel and craches on a regular basis when you reach 100-120 tunnels, true for both RB1100 and PowerRouter 732 with RouterOS up to and including 4.11, haven't tried ROS 5 yet, but since 'nothing is changed unless it is stated in the change log' then I see no need to. So st...
by psamsig
Mon Sep 13, 2010 8:21 pm
Forum: Scripting
Topic: usage warning script
Replies: 15
Views: 3598

Re: usage warning script

i noticed that the moment i run the script manually it sends the emails but what i cant understand is if i run it again it sends the same users a email.Is it not supposed to remember that it sent a email to that person and not send a warning again? Yes it was, but you dropped the line that handled ...
by psamsig
Mon Sep 13, 2010 7:45 pm
Forum: General
Topic: Ident doesn't work with RouterOS
Replies: 2
Views: 556

Re: Ident doesn't work with RouterOS

all daemons out there work out of the box with a standard SOHO router I tend to disagree on that, no router, SOHO or otherwise, I have ever layed my hands on, come with preconfigured inbound NAT, at most they may come with preenabled UPnP (shiver). Never the less, it should be easy enough (especial...
by psamsig
Sun Sep 12, 2010 8:22 pm
Forum: Scripting
Topic: Testing Scripts
Replies: 5
Views: 5176

Re: Testing Scripts

If you want to paste code from a script into a termnial window (aka CLI), you often have to wrap in a {} block, e.g.: { :local str "Hello world" :put $str } this way you get it to run as when run as a script. Here is an alternative to your script for inspiration: /ip firewall address-list { :foreach...
by psamsig
Sun Sep 12, 2010 7:42 pm
Forum: Scripting
Topic: Script Star
Replies: 8
Views: 2038

Re: Script Star

Your question makes no sense in english, and apperently no one speaks spanish. If you had tried to translate it back to spanish you would have gotten: Hola, mi consulta es la siguiente, necesito un script para iniciar la programación de un jack estéreo de todos los 15 días como si no, todos los mese...
by psamsig
Sun Sep 05, 2010 11:01 pm
Forum: Scripting
Topic: Error in Script with SSH
Replies: 3
Views: 892

Re: Error in Script with SSH

Really no need to use :global, and i think your problem is that the 'interface get' requires that it is run in the root context (where as '/interface get' is not) /interface {:local iname; :foreach i in=[find type=pptp-in] do={:set iname [get $i name]; :put $iname}} or as I would format it: /interfa...
by psamsig
Wed Sep 01, 2010 10:04 pm
Forum: General
Topic: IPSEC problem
Replies: 7
Views: 995

Re: IPSEC problem

If you want to trigger the tunnel from the box itself, you need to add a route, read http://forum.mikrotik.com/viewtopic.php?f=9&t=35348
by psamsig
Sun Aug 22, 2010 10:12 pm
Forum: General
Topic: RB750 and IPsec throughtput
Replies: 9
Views: 2421

Re: RB750 and IPsec throughtput

Turns out that all my troubles with IPSEC are related to (unresolved) issue with Eth1.
Where is this stated, I can't find any information, is this officially acknowledged?
by psamsig
Sat Aug 21, 2010 1:24 pm
Forum: RouterBOARD hardware
Topic: ipsec hardware acceleration under RB1000
Replies: 12
Views: 8945

Re: ipsec hardware acceleration under RB1000

So, somehow there's a bug on the RB1000 that causes the VPN traffic to be transmitted out of order.
Did this ever get confirmed and/or resolved?
by psamsig
Fri Jul 30, 2010 1:41 am
Forum: Scripting
Topic: Work around for exiting a loop?
Replies: 1
Views: 654

Re: Work around for exiting a loop?

Here is a take on it: /interface ppp-client { :local deviceID [/system resource usb get [find ports=0] device-id] :local content [/file get [find name=test.txt] contents] :local contentLen [:len $content] :local deviceFound false :local lineEnd 0; :local line ""; :local lastEnd 0; :do { :set lineEnd...
by psamsig
Fri Jul 09, 2010 1:00 am
Forum: Beginner Basics
Topic: How do I delete a variable?
Replies: 3
Views: 883

Re: How do I delete a variable?

To delete global_variable:
/system script environment remove [find name="global_variable"]
by psamsig
Thu Jul 08, 2010 5:55 pm
Forum: Scripting
Topic: A script to calculate Average CPU Load
Replies: 19
Views: 12550

Re: A script to calculate Average CPU Load

This should work: # Name : Average CPU Load # Set up the scheduler to run this at a 1 second intervals (Sample Rate) # Set info logs to echo to Terminal in System Logging # # maxsamples is the number of cpu-Load samples to keep # Experiment with this value to incease or decrease the number of sample...
by psamsig
Wed Jul 07, 2010 11:16 am
Forum: Scripting
Topic: script
Replies: 14
Views: 1866

Re: script

I think the problem was in the matching of the target address, it lacked the '/32' suffix /queue simple { :for i from=1 to=254 do={ :local o [find target-addresses=("192.168.10." . $i . "/32")] :if ($o != "") do={ :if ([get $o total-bytes] > 1048500) do={ set $o max-limit=16000/16000 } } } }
by psamsig
Thu Mar 25, 2010 2:31 pm
Forum: Scripting
Topic: Program LED to VPN Status using Netwatch and scripting
Replies: 2
Views: 2526

Re: Program LED to VPN Status using Netwatch and scripting

Great idea, and I am thankful for being told about the requirement of the route, it has been rather frustrating that I cound't figure out how to initiate a tunnel from the router itself.

/pds
by psamsig
Sat Feb 20, 2010 11:07 pm
Forum: General
Topic: Feature request: per-domain forwarding in DNS
Replies: 16
Views: 14113

Re: Feature request: per-domain forwarding in DNS

I'll second this as well, it shouldn't really be that complicated to implement.