MikroTik

AlainCasault

Ahh okay so rotating depending upon country of choice........ If they only gave you one IP address /16 I would be interested to see what happens if you try a second one. Are you saying that surfshark2 is something different, or something you are no longer using? It suffers from the same issue, same...

AlainCasault

Maybe my question is premature, but when can we expect a major overall in exam questions? Once V7 becomes mainstream, a lot of the exam questions will become obsolete.

Thanks,

AlainCasault

With the inability to lower transmit power with the new versions, looks like it's time to look at other vendors. Agree. Even low-end vendors have ability to lower tx power in a simple way. Dear Mikrotik, what is official way to reduce TX power for HAP AC^2 with 6.47? Mode "card-rates" doe...

AlainCasault

Hello Piotr I have the exact same issue with my CRS-125 at the same ROS version. I have no DHCP-client setup on that router. After having read other posts, II found that I have an "Alert" rule setup in my DHCP server. After disabling it, voilà! No more false requests. So much trouble becau...

AlainCasault

Log entry DPI issue already fixed in internal build.

This is great!
When can we expect a release?

Cheers,

AC

AlainCasault

Log window (only!) is totally unreadable because the top and bottom of every line is sheared off. a fix for log window is needed before this can be used in production. Furthermore, /log print in Terminal is also useless because scrolling back Terminal screen to anything before the final contents re...

AlainCasault

Did you add ether1 to the bridge?

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, I'll be assuming that there's only one subnet for all devices. You can configure your AP as a basic L2 device. Add ether1 to the bridge. Make sure it's address (bridge1) is on your routers subnet and doesn't clash with another. No dhcp client or firewall on AP. Should be ok. Sent from my cell...

AlainCasault

Hello,

Perhaps you could tell us more about the issue. Why you want to do it.

But quickly, you could create a IP address list (in the IP firewall section) and create a firewall rule that blocks that list.

Cheers,

Sent from my cell phone. Sorry for the errors.

AlainCasault

@AlainCasault, out of curiosity, are you aware that there is not just a single sign language but many of them, historically linked to countries and/or nations of origin? So which one do you "technically not speak" :) ? (as for me, I know none). Yes I'm aware. It's probably worst than all ...

AlainCasault

@Alain, which is the third language that you speak ... if I may ask? Sacrement you want to know his third skill set, He is a maudit francais The answer is obvious osti de tabarnak... (The cursing tongue of course) Every quebecer has a colourful palette when provoked. ;-) Honestly Anav, I find your ...

AlainCasault

@Alain, which is the third language that you speak ... if I may ask?

You may ask... (Quoting James T. Kirk ). Sign language.

So technically speaking, I don't "speak" it.

Sent from my cell phone. Sorry for the errors.

AlainCasault

The idea behind "English only" is that we can all learn from each other. As much as I would looooove to speak many languages, I only speak two fluently m, a third one with some difficulty and a collection of words in various languages that can me friends I social situations. There are many...

AlainCasault

Thank you Alain for your response. I guess Chromecast and bose speakers use the same technology to advertise themselves!
How did you overcome the issue in your case?

I took the easy way out. Add pe1chi suggested, same subnet.

Sent from my cell phone. Sorry for the errors.

AlainCasault

I'm not any expect of chromecasts, but I'm guessing that the discovery part is purely layer 2.

When I'm on a different vlan of the same AP, I can't discover the CC or my Bose speaker for that matter.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Cool. Glad to be of help.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello,

I'd like it to be a one reboot thing, but the second reboot is required for the firmware update.

Sent from my cell phone. Sorry for the errors.

AlainCasault

That could be a tricky task depending on the app to bock. For example, I'd love to block Facebook messenger, but that's tcp/443. Good luck with that. You could look at a layer 7 approach, but it'll take some research on your part, much testing and a lot of router CPU. Sent from my cell phone. Sorry ...

AlainCasault

Now I feel silly because I hadn't seen the poll on my cell phone. Nice job!!!!

AlainCasault

If you suspect Synology problem, test on the same LAN. If it doesn't work, then you found it. I haven't read all of your export but make sure your firewall accepts the redirected traffic. I've seen many people think that a simple dst-nat is an implicit accept through the FW. Cheers, Sent from my cel...

AlainCasault

Hello

Can you tell us what you have in mind?

My needs may be different from yours but export suits my needs.

Regards,

Sent from my cell phone. Sorry for the errors.

AlainCasault

You can also use an application like Encrypto that does a great job. It's available on Mac and Windows.

Sent from my cell phone. Sorry for the errors.

AlainCasault

During the Markham MUM last month, I asked MikroTik to ship INT routers to Canada since we can use dfs channels PROVIDED we respect the Industry Canada rules as shown in the regulations document. My employer buys Aruba "rest of World" APs and its ok, because of our compliance to IC (and th...

AlainCasault

As antennas in small RBs, for example, are usually 2dBi, your AP will be 2dBm stronger than allowed in your country.

Setting antenna gain at a non 0 value will tell the router to subtract that gain to stay with country regulation.

Sent from my cell phone. Sorry for the errors.

AlainCasault

it would be nice to add time quota per kid instead of fixed time intervals

+1

Sent from my cell phone. Sorry for the errors.

AlainCasault

I had suggested in a previous similar post to build a chassis with blades. Could be switch blades, routing blades, whatever port configuration/speed. Could even have a fan blade, just in case. Hot swappable power supplies. One blade is old? A faster one comes out? No problem, swap it. That would ad...

AlainCasault

I had suggested in a previous similar post to build a chassis with blades. Could be switch blades, routing blades, whatever port configuration/speed. Could even have a fan blade, just in case. Hot swappable power supplies. One blade is old? A faster one comes out? No problem, swap it. Just make a fa...

AlainCasault

I asked for it a few years back and got it, no issue.

I "branded" my 2011 that now shows my text logo on the LCD.

Cheers,

Sent from my cell phone. Sorry for the errors.

AlainCasault

Follow up on this issue. As I didn't have much experience with CHR licenses, I found out how to generate a new one without wasting the old one. I created a new CHR and used its software ID to generate a temporary P1 license. I then reassigned the old (permanent) P1 license to the temporary one, thus...

AlainCasault

Thanks all. I had deleted the Dude, but to no avail. As I'm not a Hyper-V expert, didn't think of expanding the disk. I tried reinstalling using ISO file, but by then, I had done too much damage. Just used another P1 license :D Mounting the Hyper-V disks didn't do much either, but it's something I'l...

AlainCasault

Hello MKX,

Will try and let you know. But it makes sense.

AC

AlainCasault

Hello guys, I'm running 6.45.6 on Hyper-V (Winodws 10 Pro). I ran The Dude on it for a while and stopped it. Now, I can't seem to delete the leftover files under /Dude and there's only 1% of my file system left (out of the original 95MB!!!). I've read through the forum, but as it's a CHR, I can't Ne...

AlainCasault

Hello, You may have many issues. If you look at the specs, you'll notice that the setup will influence performance. L7 filters, if any, load the CPU. I suggest that you start with /tools - profiles to see which service is using up the CPU and report back your findings. Also include your config for a...

AlainCasault

Hello,

Well, we see that too. Is there a question?

Regards

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello I had this issue a while back but forgot how I solved it. I have a software vlan setup with 8 VLANs, one of which is a Telco only vlan. If memory serves, I only kept the associated bridge of that vlan as a neighbour enabled interface, along with physical interfaces. Cheers, Sent from my cell p...

AlainCasault

Hello

Please include an export of your config.

2.8 is over 10 years old if not more. Are you really talking about RouterOS??

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hy

A good trick is to create a bogus rule that only logs forwarded traffic and see where traffic dies. When your bogus rule stops logging, the previous one is the culprit.

Cheers

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello Bob

Yes, that's the server. What is your exact question??

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello

Does your PPTP server have all routes to come back to the PPTP client?

Both routers need all routes to the other router.

Best regards

Sent from my cell phone. Sorry for the errors.

AlainCasault

Also, with three channels, you get better non overlapping coverage.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Good practice is to use 1-6-11 at 20Mhz. Also, 802.11 stipulates that any ap at 40Mhz WILL fall back to 20 if it causes problems to others.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello,

As per 802.11 standard...

add authentication-types=wpa-psk,wpa2-psk comment=EnterRealmOfWOOWiFi encryption=tkip \
    name=security1 passphrase=EnterRealmOfWOOWiFi

tkip WILL limit you to 54Mbps, regardless of what else you have set up. Use different encryption.

Cheers,

AC

AlainCasault

Hello,

I'm wondering the same thing.

We use Aruba Network APs, and they CAN use DFS channels. Maybe it's a misinterpretation of regulations, I don't know. But it would be great to regain use of those channels.

Cheers,

AC

AlainCasault

Salut François, It's kinda hard to see without a diagram or ROS code. I have a three-site network, each with their own VLANs (8 per site), but routed between them. My WAN is fully meshed and routed using OSPF (the VPN interfaces are L2TP/IPSec). I have full visibility of all hosts (provided firewall...

AlainCasault

As a general rule of thumb, when you hold your cursor over any flag (in WinBox) it'll tell you what they mean.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hy I'm also confused. How can CZFan's example work? The mangle uses src-address-list, meaning "Download" traffic from a bunch of IPs. How can those packet marks be used in Queue trees for uploads? ... the mangle uses src-address-list, for the device starting the connection, in this case i...

AlainCasault

Hy I'm also confused. How can CZFan's example work? The mangle uses src-address-list, meaning "Download" traffic from a bunch of IPs. How can those packet marks be used in Queue trees for uploads? I found this which may help Chipburn. https://mum.mikrotik.com/presentations/CZ09/QoS_Megis.p...

AlainCasault

Oooor! Just dawned on me. Try checking passthrough for the connection marking rule. Can't remember if the mark connection action allows for further processing.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, In the access-list tab entries, you can specify the interface that "this entry" will apply for. So if you want to allow mac AA:BB: etc. as a guest only, you'll specify interface "vap1". At the end, don't forget to add a catch-all entry with no mac address, no interface and...

AlainCasault

Hello, As a debugging tool, I would suggest you check "log" and add meaningful log prefixes. You may get a hint as to which mangle rules are used (and when) and you'll see which interfaces are used also. To compare, I went about it the easy (and bad) way of only doing packet marking (no pr...

AlainCasault

Here's an export of my very basic config along with basic details. __________________________________ ROUTER A /interface ipip[ add name=ipip-tunnel1 remote-address=172.16.2.203 /ip address add address=10.1.1.1 interface=ipip-tunnel1 network=10.2.2.2 /ip dhcp-client add dhcp-options=clientid,hostnam...

AlainCasault

So tell me if im doing this right. On the router A, in the route list, i need to put 1.1.1.1 instead of ipip-tunnel. Not sure if im doing this correctly, because when i do this, gateway becomes "unreachable". But i believe the problem is as you say in my routes. OK! Now that I've got my h...

AlainCasault

Damn! I had this TOTALY confused with another (and totaly unrelated) issue... My bad!!! Thank @MKS for setting me straight. /interface bridge add name=LAN /interface ipip add name=ipip-tunnel1 remote-address=172.16.2.203 /ip address add address=10.1.1.1/24 interface=LAN network=10.1.1.0 add address=...

AlainCasault

Never use an interface as gateway, always an IP address. What's wrong with using interface as gateway if interface is a point-to-point type of interface? Works for non broadcast technologies like x.25, Frame relay. Works for any PtP link, such as IPIP or PPPoE: /ip address print Flags: X - disabled...

AlainCasault

Never use an interface as gateway, always an IP address.

What's wrong with using interface as gateway if interface is a point-to-point type of interface?

Works for non broadcast technologies like x.25, Frame relay.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Eventually, use dynamic routing. Avoids the hassle of static routing.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello,

One big thing that jumps up is your routing. Never use an interface as gateway, always an IP address.

So on router A, use the IP if B's tunnel to each B's LAN.

Cheers

Sent from my cell phone. Sorry for the errors.

AlainCasault

@sindy,

Thanks for the feedback. I'll run some tests and will report my findings on the trouble ticket.

Best regards,

AC

AlainCasault

Thanks for getting back to me so fast. I'm not using that field. As I inspect the conntrack table, I see my ICMP connection there for 10 secs even though my ping only sent one packet. This is why my other pings are not seen by the other filters as the routeur thinks it's still the same connection. I...

AlainCasault

Hy all, I know I'm rehashing an old post, but this issue has me stumped. I have done the same thing for demo purposes for the longest time. I'm doing this again this morning and it doesn't work. A bit of troubleshooting and I realize that the ICMP-TIMEOUT in conntracking is the issue. If I reduce th...

AlainCasault

And the netmask. You have 65000 IP addresses?

Sent from my cell phone. Sorry for the errors.
It is ISP network not mine I am only customer....

Then, as a client, I'd be worried

Sent from my cell phone. Sorry for the errors.

AlainCasault

And the netmask. You have 65000 IP addresses?

Sent from my cell phone. Sorry for the errors.
Mon Dieu !!!!!
or in Quebec
Ostie de tabarnak
Get an IPAD LOL.............

No all Apple products. Android!! See what Apple did to your French

Sent from my cell phone. Sorry for the errors.

AlainCasault

And the netmask. You have 65000 IP addresses?

Sent from my cell phone. Sorry for the errors.

AlainCasault

We are trying to upgrade to 6.44.3 from 6.29. I can download the file and it is in the files window. It will not install. I have tried to reboot 5 or 6 times and still nothing. Any advice? Look at the log. It should tell you why. Usually, you've chosen files for the wrong architecture. Sent from my...

AlainCasault

Hello If I understood you correctly, the DVRs have hardcoded IP addresses. In that case, I would just click the add button, use all 0's for the mac and input the reserved IP's on the IP address field. That way, those two addresses will never be handed out. Sent from my cell phone. Sorry for the erro...

AlainCasault

I like your plan. a. there are no hackers in france and germany (FACT) b. there are no computers in france and germany that can be hacked and controlled by Bots (FACT) c. allowing access to winbox by external IPs is very safe (FACT). FACT Foundation for the Advancement of Cardiac Therapies, In (whe...

AlainCasault

I know it's not your question, but maybe a raspberry pi? I have one with scripts for availability (netwatch replacement), and iperf to test my queue trees. I "cron"ed the availability script but I could create a web page from which to launch the queue testing script... Hum, that's actually...

AlainCasault

Hello Joe I'm not a script guru, so I'll send you elsewhere. Have you considered creating a limited skin (only for web interface though) and only show the tools you wants to be made available? It's a somewhat lengthy process, but it could help you. You'll need to create user accounts with limited ac...

AlainCasault

So I'm guessing you're doing a lot of queuing :D As ROS is software with no specialized ASICs, the more features one configures, the more hits the CPU takes. Check MUM presentations to see if there are suggestions about optimizing queues. There are presentations that talk about the load layer 7 filt...

AlainCasault

Hello,

Your issue is something special because, indeed, the stats are good.

Have you tried to use Tools->Profil? That'll give you a hint.

AlainCasault

Hello,

Thinks to check...

Has telnet been disabled in IP->SERVICES?
Has the user been modified to refuse telnet access?

Cheers

AlainCasault

Or maybe personal firewall. I've seen this before. And always disable unused interfaces on the laptop. That also has been an issue.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Actually, you could use netmonitor.... I think that's what it's called.

Once you reach a threshold, either in our out, the script is run.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello

Check your ip-neighbour-settings

Then interface list

Maybe the port you're connected to doesn't send mndp anymore.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello,

Netinstall and start from scratch.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello If you want to see ntp traffic, add a firewall rule with: Chain=input Protocol=UDP Dst.port=123 Action=log Make sure it's on top and you'll see everything for ntp. Add the proper in interface to see only internal requests. I'm not in front of a router, but check to see if your ntp server has m...

AlainCasault

Whichever tool you use, I suggest NOT using your AP as it'll drop current clients. Your kids won't like you

Use a spare router.

Ahs yes, snooper is good IMHO and gives a loooot of information.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, I'd say no. I do that to block those very same sites and as you can tell, there are no common strings between youtube and googlevideo :D Go with 2 rules. Be careful though; wanting to block the YouTube app, I wound up blocking other sites. Still not sure how or why !!??!?! Sent from my cell p...

AlainCasault

Try the tls-host field in a mangle rule. It works for me blocking other sites like Netflix.

And you can use the same marking in simple queues to rate limit.

Cheers,

Sent from my cell phone. Sorry for the errors.

AlainCasault

At any rate, once you find out the model, go on routerboard.com, search for end of life models and the specs should be there.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello

Don't you have physical access?

The sticker under should have all the details.

Regards,

Sent from my cell phone. Sorry for the errors.

AlainCasault

I haven't seen if it's possible but would looooove to make that work.

I have devices that regularly select a weaker AP then the users complain of slow Internet access (your network sucks...)

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello SUD Please see this regarding licence questions: https://wiki.mikrotik.com/wiki/Manual:License As for only 5 tunnels working, there shouldn't be any issues with having more. It would be good if you posted your config and any error message you may have on your logs. Cheers, Sent from my cell ph...

AlainCasault

Use that mikrotik protocol thing

NV2

Sent from my cell phone. Sorry for the errors.

AlainCasault

Did not see much channel usage for this frequency in the snooper, freq usage or scan. What option is Greenfield. I am currently researching it.

It's an expression meaning that you don't mix modes (a/n/ac) but rather stick with just one (ac).

Sent from my cell phone. Sorry for the errors.

AlainCasault

Have you tried the built-in tools to analyze the RF (scan, shopper)?

Have you also tried seeing it up as Greenfield, not a/n/AC?

Otherwise, signal levels are good... Snr good...

Sent from my cell phone. Sorry for the errors.

AlainCasault

Actually, the way I'm reading this, his MAC-WINBOX is being blocked.

You should allow udp src.port 5678 so that the return traffic is allowed.

You should then see your routers.

Regards,

Sent from my cell phone. Sorry for the errors.

AlainCasault

I'd go with OSPF and let everything sort itself our ;) Take a look at https://alaincasault.com/ca/posts/, the post named. "Redundant WAN links". When the failure is in the ISP's infrastructure, the regular "check gateway" doesn't help much. Cheers, Sent from my cell phone. Sorry ...

AlainCasault

True!

Sent from my cell phone. Sorry for the errors.

AlainCasault

The binary backup will let you restore a perfect/complete copy of the config of the original router (A) on the new router(B). It will work. But DO reset the MACs, either manually or through a script as suggested. Obviously, it should NOT be done if the original router (A) is still running as you'll ...

AlainCasault

Ok, got it. Still can't do hub in MikroTik. Do a switch as was suggested before using a bridge. From within the router, you can launch a packet sniffer (in tools menu) which is wireshark compatible (make sure to name the file .pcap). You'll have to play with it as I don't remember if the bridge will...

AlainCasault

Because I have to simulate something like that in laboratories. Maybe as a bridge to do it, that it would be similar? I'm not sure you know what you require if you think that a hub and a switch are similar. Can you explain what you need to achieve? That could help us understand. Sent from my cell p...

AlainCasault

More to the point: why do you want a hub?

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, This topic has been documented MANY times. But, yes, you CAN restore a binary backup of one device to another of SAME model. But: * Make sure they're both running the same version of OS * Reset each interface's MAC address. Voilà! As far as running and storing backups, that too has been docum...

AlainCasault

Hello, I'm assuming that the /16s are just to summarize local subnets and you don't have such a big network. Otherwise, break the subnet down to smaller ones (like /24). Also, I'd probably go with fiber regardless since your working with two buildings. Fiber will insulate you from grounding issues, ...

AlainCasault

Also, try this.

I think this is what you're going for.

https://wiki.mikrotik.com/wiki/Manual:S ... p_Features

Cheers,

AlainCasault

Hello, I know what you mean as I have a Unifi also. I basically took the IP address of my Telco devices' subnet and its associated DHCP server and moved them to the trunk bridge. The Unifi is connected to a trunk port, but because the IP was set to the trunk bridge, that subnet became untagged. Of c...

AlainCasault

Hello Nazralte, 1st thing to do is make sure your catch-all rules log traffic reaching them. As you indicate not being so good w/ firewalls, I'll give you more information, hoping I'm not treating you like a child ;) Catch-all rules just drop and log whatever was not processed by the previous rules,...

AlainCasault

Hello, For starters, your devices should have a static IP address, not get one from a server. Otherwise, how do you plan on doing proper management with dynamic IP addresses? Secondly, I suggest you post a diagram you what you wish to acheive and your devices current configuration. You're asking for...

AlainCasault

Hy again!! If you can winbox but not webfig, check that the IP Service for TCP 80 is not disabled. Could be that simple. :| If you use "bridge" mode (and it's not a typo), then your problem could lay there. I'm not in front of a router right now, but you should be set as AP-bridge mode, an...

AlainCasault

Hello

Are you connecting using an IP address or a mac address?

If it's the MAC, yes you may loose connectivity often. Use a IP as soon as possible.

Regards

Sent from my cell phone. Sorry for the errors.

AlainCasault

Thanks for both replies! One additional question, I've read that a WDS mode has to be enabled in the routers and that both routers must be bridged into a single Wireless interface. Is that right? Thanks again. Hello No need for wds. And keep the setup as simple as possible. The APs' Wi-Fi card shou...

AlainCasault

Hello

Packet marking is the first step. You'll move on to queue trees where you'll use the packet marks.

Check the url I gave you for a real step by step.

Cheers

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, What I wrote was meant as a general guideline, so it's possible it may not apply to your setup. But the caracteristics part still applies. Unless you know how an application behaves (protocol, port, DST IP address, anything that can help to identify it), it's going to be hard to do bandwidth ...

AlainCasault

Hello, The hard part is to categorize your traffic. That is to says that you need to know as many "traits" as possible. As an example, I have VoIP phones on three dedicated subnets (three sites) and my PBXs on another. That becomes easy to do QoS between all subnets. My PBXs connect to my ...

AlainCasault

Hello, Since you don't mention it, I'll start of with 2,4GHz. The choice of 20 or 40 MHz depends on your neighbors. If there's a lot of 2,4GHz around you, stick with 20MHZ as the AP will revert from 40 to 20 if it detects interference. If you can go to 40MHz, then scan what's around you and select a...

AlainCasault

I don't recommend using the app from the WAN side, for many reasons (mainly security) other than its just in beta. However if you can open a VPN to home and then use the APP as though you were on the LAN, that may be a different story) Am I hearing an echo here? ;) Sent from my cell phone. Sorry fo...

AlainCasault

Hello A gateway of 0.0.0.0? That can't be good. You're probably missing stuff in your ppp profile. Post your ppp setup. /ppp export. I have this basic setup and it works great. Is your tunnel coming up? I'm guessing yes if you're getting an address. Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello Pablo, I'm glad you solved your issue but did you realize you created a new one? It's not a good idea to open WinBox on your WAN port. It's a major security risk. You'd need better off doing at least port knocking first or, better yet, VPN to your router before managing it. Regards, Sent from ...

AlainCasault

You're better off with export files. True, but with export files it also isn't easy, as I described above. It would be much easier when those minor changes were made... Of course we all understand that you cannot import an export from a 10-port router into a 5-port router without some manual action...

AlainCasault

Doing a binary restore is "officially" meant for the same device, we all know this. It'll work ok on two devices of same model, as long as you reset the MAC address of all physical interfaces. Doing this on two routers of different models is asking for trouble and is NOT recommended. You'r...

AlainCasault

Hello, I'm assuming that you're rebooting AND loading the rev file at startup. I've found that if you add a 15 second delay at the top of the script file, it solves the case. Also: When transferring an export from one model to an other, it's good practice to edit the file (to remove unwanted configs...

AlainCasault

Hello

All MikroTik devices support dnat.

Cheers

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello

That model only has one radio with the frequency software selectable.

When in doubt, always refer to the specs. https://mikrotik.com/product/RBMetalG-52SHPacn

Cheers,

AlainCasault

The solution he posted involved changing the skin in the web interface. It does not work in winbox.
Click on "Design Skin" and remove the checkmark in front of Quick Set, then save it as default.

Ah! OK, thanks,

Would have loved a WinBox solution also. Oh well.

AlainCasault

How do you imagine that would work? The home user needs QuickSet by default, he will not download and install it before he knows how RouterOS works. And removing QuickSet is already possible: Screenshot 2016-02-22 09.59.45.png Hello Normis, Could you please repost how to remove Qucikset? I'm affrai...

AlainCasault

I would have added the last line near the top of the list, not at the bottom.

I'd also say to not bother with "dst-port=8291 protocol=tcp " on the drop filter. You got there, I'll block "everything" you do!

AlainCasault

Thanks Pegasus for that code. Very nice! I would suggest that if these attempts come from inside, contact the person behind the computer and have a talk with him/her. Remind him/her of company policies on hacking and the potential risks to his/her job. If it's home, block the kid's access for a day ...

AlainCasault

I don't see much that could block return traffic (LAN to VPN). Do PCs on VPN have active firewall? I've seen that often where people would go head scratching because of that. I don't think masquerading VPN users helps much since the global masquerade filter will take care of that. I sugget filters t...

AlainCasault

I saw that you created an IP POOL to assign ip addresses to your VPN clients. You don't need to since all your ppp secrets have an address defined. Keep the pool only if you create secrets that don't have a predefined address, but change the range so that assigned addresses don't clash with hard cod...

AlainCasault

Hmmm Your secrets specify IP addresses found the the IP Pool pptp-vpn. Just change the profile to NOT have an IP Pool since all your users have hardcoded IPs. Can LAN ping VPN and vice versa? comments /ip firewall filter add action=accept chain=input comment="Allow WinBox from MAIN LAN" ds...

AlainCasault

TIP : If you don't see it in a pull-down menu after its creation, you can't use it. Address-list is in the firewall section, and is usable only for firewall configs. The idea is interesting though!! Cheers, In some cases I have allowed addresses in an address list, in those cases I have to write th...

AlainCasault

As you support older standards, you may have a negative effect on overall performance as Wi-Fi will enter protected mode to accomodate everybody. But wouldn't it only do that if a device tried to connect with b? So if there are no older devices trying to connect, wouldn't it just run normally, and ...

AlainCasault

Hello,

show us output of "export /hide-sensitive".

Thank you

AlainCasault

TIP: If you don't see it in a pull-down menu after its creation, you can't use it.

Address-list is in the firewall section, and is usable only for firewall configs. The idea is interesting though!!

Cheers,

AlainCasault

Hello Vertigo220,

Does your model have a USB connector? If you connect your phone to it and tell the phone to share its connexion through USB, then a LTE interface will appear in the RB2011. Then you can use it as a real WAN port.

Cheers,

AlainCasault

It's more a question of having an open port to exploit, two in your case.

And with a VPN, you can have proper routing and all your tools will work as if at home (or at the office).

AlainCasault

Hello, This is my ( very basic ) suggestion. It'll be your job to translate it to ROS ;) ==1== chain=intput in-interface=ether1 connection-state=established, related action=accept ==2== chain=forward in-interface=ether1 connection-state=established, related action=accept ==3== chain=intput in-interf...

AlainCasault

Hello, Many things may cause this like large data transfers, CPU spikes (whatever the cause). Hard to tell from just a screen capture, but I wouldn't worry for a glitch like that. Thing is to know your network and what is normal for you. This is called baselining. If you expect (through regular veri...

AlainCasault

Hello Michael, I think you answered your own question :) If I understand you: * Station has a connect-list entry to the SSID * Station is MikroTik device, since you use connect-list entries * AP1 does not have access-list entry for station * AP2 has access-list entry for station Since AP1 refuses &q...

AlainCasault

...
Also, when I reply in this forum, others will read it over time. So, I provide the most correct settings I know, not merely answering your exact question.

Great philosophy!! +1

AlainCasault

I know b is old, but unless it's a security issue, which I don't see why it would be, I don't really see the harm in leaving it for compatibility with older devices. That said, I highly doubt I would ever actually need it, and so I also don't see any harm in disabling it; I was just curious if ther...

AlainCasault

But will MNDP work? That was his problem, the "not discovering routers"... Not sure what MNDP stands for ... but Winbox displays routers and MAC Winbox connection works in Linux and wine if that is the question. Mikrotik neighbor discovery protocol, like Cisco's CDP. You answered. Thanks!!

AlainCasault

Side remark/question here: 1.) instead of netinstall (need to press that button, set IP on the computer), is a down grade and then an upgrade of ROS equivalent to netinstall and erases all internal memory safely? 2.) I assume once you have a clean router, if you use a "backup" taken on an...

AlainCasault

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS. Hello, The URL and examples shown by Baragoon will work. Yes, the URL has...

AlainCasault

Yep, Linux. (and OSX/macos).

You can run winbox in both using wine.

But will MNDP work? That was his problem, the "not discovering routers"...

AlainCasault

Hello MKX, Aaaah, the joy of offline discutions. Argh, it'd be so much easier "live". Oh well! So, I got it that lowercase=vlan interface (vlan101port) and UPPERCASE=bridge. But I'm still confused as to what you're saying (post #2) since if vlan101port (vlan interface) is assigned to a bri...

AlainCasault

As a bonus, here's my (partial) working setup for CAPsMAN. /caps-man channel add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled \ frequency=2412,2437,2462 name=channels-tous-n add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled \ frequency=2412 name=cha...

AlainCasault

As VAPs are setup as tagged, all traffic artiving at bridge VLAN101 is tagged. For L3 configuration that's not acceptable, only untagged traffic is fine. And vlan interfaces do proper tagging/untagging: /interface vlan add name=vlan101port interface=VLAN101 and move IP configuration from VLAN101 to...

AlainCasault

Piece of advice: activate RoMON On all devices. You'll find your devices no matter what. It would have been better for you if you could have used WinBox.

Glad it worked for you

Sent from my cell phone. Sorry for the errors.

AlainCasault

Sounds like a guest port to me. Put it on a separate subnet and allow it access only to non private addresses (through the use of address lists to keep it clean and short).

But anav is correct, I may be out of context. Let me know.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello Normally, you should have an IP address (on hap) on the same subnet of the port the hap is connected to. Otherwise, you can't connect. Since you can't use winbox, I'm assuming you have a Linux box, yes? Create a bridge on the hap, slave Wi-Fi and ether ports to it, assign address to bridge, an...

AlainCasault

As VAPs are setup as tagged, all traffic artiving at bridge VLAN101 is tagged. For L3 configuration that's not acceptable, only untagged traffic is fine. And vlan interfaces do proper tagging/untagging: /interface vlan add name=vlan101port interface=VLAN101 and move IP configuration from VLAN101 to...

AlainCasault

Inside rack

The grasshopper is only one hop away

Sent from my cell phone. Sorry for the errors.

AlainCasault

Have you tried to disable IP CLOUD and set up SYSTEM CLOCK for the correct time zone?

Sent from my cell phone. Sorry for the errors.

AlainCasault

What I dont see is on the /ip dhcp server-network, a typical reference to dns??? I do not remember what the IP dhcp client shows for normal config export. Good point! Checked options should be show on an export, although I'm not in front of my computer to validate. Even if dns allows remote request...

AlainCasault

I think it has to do with your dhcp client. It's not creating a default route. What make you think that? I've a hAP lite running DHCP client on WAN and config as shown in export is exactly the same as in OP. It does create dynamic route entries, shown only using print command. You were talking abou...

AlainCasault

I think it has to do with your dhcp client. It's not creating a default route.

Cheers,

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, Excuse my ignorance, but why would we want to shutdown the router at the end of the day? It's Linux based, not Windows :D Kidding aside, maybe you're dealing with an issue I don't know about... Please let me know. If one wants to clear memory (???), then perhaps you could simply schedule a re...

AlainCasault

Ya, since the names can be changed, it can be confusing. Use wlan1 or 2.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Finally, my mother told me never to trust a man driving in a red car sporting a beard.

LOL!!!!!

Joking aside, you're right on the money.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Is there not a simple step by step guide that contains all the steps that is also compatible with the current OS? I cannot follow this with one step here, another step there, and some steps that are not compatible with my OS. Hello, The URL and examples shown by Baragoon will work. Yes, the URL has...

AlainCasault

Hello,

This may seem obvious but make sure you don't leave ssh open too long and that your router is at the latest os.

For extra protection (sounds like a condom ad), allow ssh only from a specific IP address.

Cheers,

Sent from my cell phone. Sorry for the errors.

AlainCasault

My comment was purely on form and manner, if it wasn't obvious enough...

Next time, report my post and let a real moderator tell me what to do.

AlainCasault

Well, you are rude and you're not very understanding. If you read the original question: request is to setup two different dhcp server configuraiton for two ports which are seemingly in same bridge configuration. What's so hard to understand? If you're not willing to help, then don't bother others ...

AlainCasault

Its not possible to add the dhcp server on a bridged interface because those ports are logically connected like on a switch. That means the dhcp service on slave interface (ether6) would also listen on slave interface (ether7). That results into the problem that the service cannot distinguish from ...

AlainCasault

Hello, I didn't think that mixed mode will do anything with rain fade. It will help you support older clients, which I did not want (for me). If I read you properly, it's your infrastructure. I'd go Greenfield, meaning pure N and pure AC. Yes, mixed mode allows older clients to connect but it also s...

AlainCasault

Hello, I'm afraid your question is all over the place. Dhcp, traffic flow... I'll answer the dhcp question: assign your dhcp server to the bridge hosting the two ports. As the router is saying, you can't assign the server to a port inside a bridge. Cheers, Sent from my cell phone. Sorry for the erro...

AlainCasault

Hello Olaf, I haven't seen the WAN LAN naming convention that you mention. I personally would not like it as I find it very confusing to make a quick corelation between WAN and etherX. Many of my students do that (rename interfaces). Instead, I encourage them to use comments. There are no ports labe...

AlainCasault

I ran into the same issue last year Alain caused by a conflict with the same TFTP server and it took me a while to figure it out. Felt silly afterwards. I think it happens to everyone from time to time.

Sent from my cell phone. Sorry for the errors.

AlainCasault

I forgot,

Run netstat -abno (as admin) to see what process or application uses which ports / protocols.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello all, ====General FYI==== I got this error that says: Bind tftp general failed: One occurence of each port / address allowed (10048) when I was using Netinstall. I realy needed it as my client's router got hacked. I checked the forum posts, to no avail. You know what nerves will do when tired a...

AlainCasault

Given that there are switch chips and encryption chip, how about other types of specialized ASICs to further offload the cpu and give the boxes better performance. A firewall chip perhaps?? Sent from my cell phone. Sorry for the errors. Switch chips typically have ACL capabilities built-in. Limited...

AlainCasault

Given that there are switch chips and encryption chip, how about other types of specialized ASICs to further offload the cpu and give the boxes better performance.

A firewall chip perhaps??

Sent from my cell phone. Sorry for the errors.

AlainCasault

I would say the outdoor stuff is much more expensive to design test and certify???? Not sure about certification. Each device has to be tested under it's model number/name, even if they all use the same chip set. Wouldn't make much sense to try to save money there. Maybe design and testing is a dif...

AlainCasault

I agree with Anav. Order SHOULD be irrelevent. " Grad that address list and use it to check for a match ". I couldn't care less about order. Imagine the hassle of redoing the entire list if there's an order issue?? Hope you guys are good with Excel and sorting :D Major bug if it's the case.

AlainCasault

Hello,

Layer 3 VPNs can be filtered easy enough with regular filters. Just intercept forward traffic between both subnets and voilà!

A good example is L2TP over IPSec.

Regards

Sent from my cell phone. Sorry for the errors.

AlainCasault

Edit; firewall lists work great, so no, no problems there and your understanding is good.

Sent from my cell phone. Sorry for the errors.

AlainCasault

Hello, If it works for one, it should work for all, unless you forgot to add an address in your list, which you would have spotted fast enough. A common problem that I see often in my classes is computer's personal firewall. Disable it and redo your tests. Make sure also that you have a rule that al...

AlainCasault

Those functions are not in the menu, that is true. Just open a CLI window and: /export file=filename As I suggested before, edit your file before importing it to the new router. You could, technically, restore a binary backup to the new router (if same model), but you'd need to go through ALL physic...

AlainCasault

Hello Anav, I think the idea behind the "elephant" expression was just that it's human nature to get easily discouraged when faced with a big task. But, if we approach it in a step-by-step manner, nothing is insurmountable. I understand that the "ant" expression is meant to secur...

AlainCasault

Like my MikroTik trainer once said: "How do you eat an elephant? One bite at a time." Doing something complicated remotely is not recommended practice. Go local if you can. I would establish one link and make sure it's stable. Work from there after. The first thing you absolutely need to l...

AlainCasault

Alain has a lots of designations so he must be on the right track!!

Me blushing

AlainCasault

Quick suggestions: Band: Use only 11n unless you have old clients to support. Channel width: Use only 20MHz. Period! 40MHz in 2,4GHz is very bad practice!!! Will cause interference. Frequency: Make sure that 2412 is free (or not too busy)... Always stay with 1,6,11 for channels (non overlaping). WPS...

AlainCasault

Hello Duke, Quick answer: Yes, it can be done. Longer answer: It'll depend on what traffic needs to go where. You could manually create a static route while you tell the pppoe clients not to add a default route. The (2) gateway field values (yes, you'll add a 2nd) of that static route would be the I...

AlainCasault

Hello Duke I don't see why the second pppoe should go down when the first is up. Are your isp's two separate providers? The only thing I see from your description is the distance value. I'm assuming you're taking about the distance parameter in dhcp-client (or routing in general). If so, it's normal...

AlainCasault

You haven't said anything about your parameters. Are tx power and antenna gain properly setup? A quick and dirty trick is to close and restart Wi-Fi on your laptop once in your room. If your laptop has a tendency to be a sticky client, this usually solves the issue. As mentioned above, roaming is a ...

AlainCasault

Hello, CAPsMAN should handle this for you. Otherwise you can always set a rule in the connection list to deny a certain signal strength from connecting to the AP. You can find this under Wireless > Connect List (Winbox) or /interface wireless connect-list Hello Do not use connect list. This is to t...

AlainCasault

Hello

A DHCP server is red if it's assigned to a slaved interface (I.e. ether port under a bridge) but it doesn't look like it.

I'll Go with Anav's idea: I'm seeing the bridge and ether5 in the same interface list; not sure...

Envoyé de mon LG-H873 en utilisant Tapatalk

AlainCasault

Hello

You can't assign an address to a slaved port.

You'll have to review your design.

Cheers,

Sent from Tapatalk

AlainCasault

Winbox is to control the router and the router setup. It should not be done via WAN connection (direct), it should be done with a VPN or at the very minimum the Port Knocking technique. Theese are okay if you are using just a few mikrotiks. But when you get plenty of them in different places around...

AlainCasault

To begin with, remove the value entered with "/ip services set winbox address=X.X.X.X/Y". That's just plain bad! Even if you're coming in from other offices, don't see it as coming in through the WAN port. You're coming in through a point-to-point link (L2TP/IPSEC, which is great) from an ...

AlainCasault

Hello,

Do you realize that by giving your public IP address, you basically invited everybody to test your security?

Make sure you have a strong firewall and have secured your router.

Best regards,

Sent from Tapatalk

AlainCasault

Hi guys, i want to know how do you use winbox, because i think it's really hard to use. For example: 1.can't move the sub window out of the main window. 2.can't minimal the sub window. So when opening many sub windows, it's hard to find the window which you want. Anyone else has good idea to operat...

AlainCasault

they should not yes, but i have this issue and also they will be upper of dynamic rules in raw tab
Are you sure they aren't just sorted?

Agreed. I do that sometime by mistake. Just click on the sequencial numbers column and it should be ok.

Sent from Tapatalk

AlainCasault

Hello Mareka, Ya, I think I get you. In this case, create TWO bridges and have 2 EOIP tunnels, one inside each bridge. You don't even have to have IP addresses on your MTK. Well, maybe one for management. Use 0.0/24 if this is your network. So, in general (this in an example only. adapt it to your n...

AlainCasault

Hello, No offence but your setup is... Special. One layer 2 network, remote DHCP, two addresses per computer, no GW for 80.0/24, DHCP assigned address to the bridge and one manually... You're probably having issues with your computers as well as with your mk setup. I know you said that the reason is...

AlainCasault

Well, this sucks. How can you have something solid when your provider changes stuff. It's the first time I hear about a setup like that. I wanted to suggest this : https://alaincasault.com/ca/posts But that setup won't do it either since the default gateway will change on you. Use my idea of renewi...

AlainCasault

As I said, can't be done without another full admin.

Sent from Tapatalk

AlainCasault

Hello

Thing is, you can't delete admin unless you already have an account with full rights. Just recreate admin, give it a password and it's over

Regards,

Sent from my tablet with Tapatalk. Sorry for my typos.

AlainCasault

Hello,

GUI editing is available only for webfig, although this would be great for winbox.

Regards,

Sent from Tapatalk

AlainCasault

Hy

Doing know why, but have you tried netinstall to recover the router?

Sent from Tapatalk

AlainCasault

Well, this sucks. How can you have something solid when your provider changes stuff. It's the first time I hear about a setup like that. I wanted to suggest this : https://alaincasault.com/ca/posts But that setup won't do it either since the default gateway will change on you. Use my idea of renewin...

AlainCasault

Hello

I guess you could script a dhcp client renewal and schedule it every so often, frequency is up to you.

I'm not a scripting expert, so I won't suggest one

but I'm pretty sure it would be ok.

Regards,

Sent from Tapatalk

AlainCasault

Also!!

Assume your router is hacked. Netinstall it to be safe.

The netinstall procedure will format everything and you'll start clean.

Sent from Tapatalk

AlainCasault

Hello Most definitely! As off now, anybody can telnet/ssh/winbox into your router. Your current rule only prevents traffic going into your lan. I suggest you take the default config of a basic RB model and study it. The firewall is fairly basic and offers real protection. Best regards, Sent from Tap...

AlainCasault

Hello

You can try if you want, but I'm sure you will get serious signal loss.

All that you mentioned have serious effect on RF and wals might include some metal studs that'll make it worst.

Regards,

Sent from my tablet with Tapatalk. Sorry for my typos.

AlainCasault

Hello,

No rules? Your router is an open bar for hackers. Why do you do that?

Forget everything, netinstall and start over.

Sent from my tablet with Tapatalk. Sorry for my typos.

AlainCasault

Hello,

By default, all devices in the same router can communicate with each other if you don't have firewall rules blocking anything.

You answered you own question. It works when you disable the Windows firewall. I don't see what else you need??

Regards,

Sent from Tapatalk

AlainCasault

I also read that it wasn't supported, but I also read multiple times, that it can be made to work with an IP of /32, but this hasn't worked for me either. Tom Hello, I've read somewhere (forum, wiki???) that MikroTik does not support /31 :( Try a few searches on the forum to validate this. Regards,...

Search found 584 matches