MikroTik

makkan

E.g can I boot up a Tile GX-version of OpenWRT, copy and replace some folders in the exported image and then import it in the Tile GX?

I don't think there is any support for this, no. But I might be wrong... left this trace pretty quickly after this thread.

makkan

Thank you Janisk!

makkan

Hi again,

Saw that there might not even be any build for Tile GX routers, so I might be screwed on that part already

makkan

Hi, I have a MIPS-BE-router where I have a virtual OpenWRT-machine. I have successfully exported the virtual machine and it works nicely to import it on other MIPS-BE-routers. However - I would like to convert it so that it will work with the Tile GX-platform as well. Would that be possible? E.g can...

makkan

Hi, I am trying to use some telnet-softwares to perform different tasks, like enabling/disabling VPN, making backups with /export etc. However - the telnet output in raw text is always looking like this: [m[36m/ip[m [m[36mpool is it possible to add switches to the login to real clear text output? If...

makkan

Hi, I'm having a minor issue - or rather - an idea. I want to create an account for one of our customers where he / she can login to webfig and enable or disable one specific Interface. However - if I enter IP -> Addresses (or Interfaces for that matter), then I can change the "Enable" che...

makkan

you must enable this option in "system configuration" Method of disconnection: Automatic (NAS) luck Hi, I have that checked already since otherwise the users would not be disconnected until next logon. However - mine says "Disconnect: Remote" and that is working fine. Only the l...

makkan

I have issue with RB1100AH(5.22, unique) and Cisco ASA 5510, but I can't give access. As a workaround I use the script every minute: :local IPWatchServer 10.0.1.2 :local OutInterface ether1-lan :if ([/ping interface=$OutInterface $IPWatchServer count=4]<3) do={ /ip ipsec installed-sa flush sa-type=...

makkan

Do you have level=unique set in ipsec policy? This is required for tunnel to work properly with cisco.

I have never tried that actually - but I am running it now on one of my MT/Cisco solutions. Will turn off flushing SA tonight and see if it works until tomorrow morning.

Thanks!

makkan

If anyone can give access to both Mikrotik and Cisco and describe the way to repeat the problem then it might help to fix the problem. The problem is that the problem is not manually repeatable. It happens randomly and I believe it could be like glucz says - there are phantom SA. I also know that C...

makkan

Hi, Sorry for my bad language, it didn't work before 5.12 either, I started using VPN from version 5.12, it have never worked flawless. I suggest that you contact support@mikrotik.com. One would believe that VPN should work fine between two Mikrotiks as they are using the same RFC. Cisco does not fo...

makkan

Hi, I can confirm that this is also an issue when running mikrotik/Cisco. I have scheduled a flush every 60min and so far it seems to work ok, not perfect but ok. It have been like this since version 5.12 and mikrotik support ignores the existence of the error with saying that it works fine and that...

makkan

Thanks for all your help!
I haven't engaged time enough for all the details of the radius server so I didn't know about these fields.
I will investigate why its not sending this as it is the most likely reason.

Thanks again!

makkan

I don't know right now, how can I tell?
I'm using Radius Manager.

makkan

Hi! I am having some problems with the "session-time-left"-variable, I can't make it work when using my FreeRadius central server. I have opened port 1700 UDP to the NAS, activated "interim updates" and things like that, the FreeRadius server is set to remotely disconnect users e...

makkan

I'm sorry, I missed one bit in my description, please read the edit-post.

makkan

Hi! Normally when I have released a new configuration for our routers (they are all identical) I usually run the following command: /system reset-configuration no-default=yes run-after-reset=myconfig.rsc But the router just resets configuration, it doesn't load the new one. Do you have an idea of wh...

makkan

I'm just running version 5.8, might be some new feature. Mine just says smth like "Cannot aquire port while being used by ppp-client".

makkan

I can get it using this command on my MT:

/interface ppp-client info <3G modem interface>

Are you sure that you can do it while the PPP-client is using the modem?

What version of ROS are you using?

makkan

Hi guys,

Is there any way to see the signal strength of my 2g/3g connection while ppp is running?

I'm currently on the other side of the globe and the router is having some performance issues but I can't see any signal strength without shutting down the PPP-client.

Marcus

makkan

I believe you have some issues with your firewall in that case. For some reason your routers does not forward traffic to the next interface (that is towards next router).

makkan

Hi, I am having a lot of customers with MT Hotspots, some use local radius and some are using our central radius server (radius manager). They have 5 hours available per day to use the Internet. Those who use our central radius server cannot see how much time they have spent in total, they can only...

makkan

/ip route add dst-address=0.0.0.0/0 gateway=10.1.0.1 distance=1 that should do the trick. Also make sure to check the firewall on router A if you have entered any rules. Edit: Can you ping and telnet from RouterB to RouterA (that is, do you have full access)? You would have thought that this would ...

makkan

If you go to system -> Logging, there you can add logging support and tell the router to send it to remote logserver.

makkan

http://wiki.mikrotik.com/wiki/Manual:Tools/Sms

http://wiki.mikrotik.com/wiki/Send_Backup_email

There you have two very useful wiki-pages, however I don't have any 3G enabled router available so I can't make any tests for you

makkan

You can use /tool netwatch to monitor an IP address and if it becomes unavailable you can run a certain script, then when it's back online you can run another script. Create a script, smth like "GW_DOWN" and make a script that sends sms to you, should be fairly simple. If you need to send ...

makkan

Hi, This script has some file read/write operations in it. Maybe you can come up with something from that :) http://wiki.mikrotik.com/wiki/Dynamic_DNS_Update_Script_for_DNSoMatic.com_behind_NAT There's also a mail client in the Mikrotik so you could do something like 1. Read sms response value 2. Pu...

makkan

/ip route add dst-address=0.0.0.0/0 gateway=10.1.0.1 distance=1

that should do the trick. Also make sure to check the firewall on router A if you have entered any rules.

Edit: Can you ping and telnet from RouterB to RouterA (that is, do you have full access)?

makkan

Then maybe he has only granted you read access to the filesystem?

If you type /users print, is there any other users in there?

Maybe you should ask him for a full access version, that might be easier.

makkan

Then maybe he has only granted you read access to the filesystem?

If you type /users print, is there any other users in there?

Maybe you should ask him for a full access version, that might be easier.

makkan

Hi, I am having a lot of customers with MT Hotspots, some use local radius and some are using our central radius server (radius manager). They have 5 hours available per day to use the Internet. Those who use our central radius server cannot see how much time they have spent in total, they can only ...

makkan

Hi,

I believe you have to make a rule which allows traffic to the public IP rather than to the local IP of the webserver.

makkan

Hi!

I actually haven't tried version 5.2 so it might be solved in that version. will test this immediately!

Marcus

makkan

Hehe unfortunately I suck at scripting too but maybe this can take you somewhere?

http://wiki.mikrotik.com/wiki/Manual:Scripting
http://wiki.mikrotik.com/wiki/Scripts

makkan

Then make a script which adds a static route for 8.8.8.8 (or any other IP), if failed - restart pppoe 1, then make a static route for 8.8.8.8 via pppoe2 and test, if failed - restart pppoe2 ... pppoeN.
Remove static route for 8.8.8.8

Put script in system -> Scheduler

makkan

Try to grab it by using ftp to the router. No clue why you can't do it via Winbox. Are you really logged on as admin?

makkan

Go to tools -> Netwatch, set router to 8.8.8.8. Go to tab "DOWN" and type the string to reset the PPPOE (/pppoe client reset, or whatever)

Enjoy

makkan

typically - you don't do that. But if you really must do it then I suppose you should be able to do a src-nat translation on incomming packets for your inside network port from public IP -> internal IP.

makkan

Can't you use virtual interfaces or make interfaces switched and assign IP-addresses to them? Don't know if the latter is applicable to ROS though, just some ideas.

makkan

Hi again,

Our only solution is that we must setup a Mikrotik VPN concentrator along with our network. There simply is no other solution.

Mikrotik - please make an official statement that your routers are not compatible with Cisco VPN's.

Marcus

makkan

have you try to set "level=use" instead of "level=require" or "level=unique" in a ipsec policy?

Yep - that did no difference for me.

makkan

Thanks for sharing Dan!

I actually saw the same thing just some hours ago. Tunnel were running fine for 20min with constant Ping via tunnel but as soon as i terminated the ping it went down.

Seems like a workable solution is to keep a constant icmp ping going.

makkan

I'm not 100% sure about which RFC - but thats what I have been told by some highly decorated Mikrotik technicians ;-) it is strange that Cisco doesn't follow the RFC, which was created by themselves. maybe, there can be another explanation? If "cisco - mikrotik" IPsec is a real problem, w...

makkan

Hi Sergejs,

Sorry to bring this really old post alive - but using DPD does not work. My Cisco <-> Mikrotik VPNs are still going down 3-100 times per day. All I can do is to flush all SA and then they might come back online. Sometimes I have to kill the connections completely, very frustrating.

makkan

Hi,

Yes - IPSec between two Mikrotiks should work without any issues but I've never tried it.

I'm not 100% sure about which RFC - but thats what I have been told by some highly decorated Mikrotik technicians

makkan

Hi, To be concise - there is no good solution for this. Cisco does not follow the RFC for IPSEC and Mikrotik does. Therefore the Mikrotik will want to create a new SA everytime that the VPN lifetime is reached. The Cisco doesn't care about that and keeps using the old one - hence new tunnel cannot b...

makkan

http://wiki.mikrotik.com/wiki/Supported ... mory_cards

makkan

Yesterday I checked the box "Generate Policy" and after that it was almost up for 24 hours!

Unfortunately the vpn died at 17:18 today and got back online at 17:30 when my scheduled flush ran.
Nothing in the logs as far as I can see, attached.

makkan

Hi! I am having some issues with my VPN-tunnel and I have been searching the forum without finding anything usable. The tunnel works perfectly but 2-3, maybe 4-5 times a day sometimes, the tunnel is disconnected and it's not re-established until i have ran "/ip ipsec installed-sa flush sa-type=...

makkan

Just mark the card and hit format in winbox

makkan

1st configure a radius server on mikrotik, then add it under /tools user-manager router. After this create a customer under /tools user-manager customer Then browse to the user-manager web interface and add users. The reason to why admin works is because it's not a radiilus account, it's a local hot...

makkan

I think you should start a new thread, but anyway, first describe your network and then try to express your problem further.

makkan

Are you sure that the IP isn't changing during this disconnect? E.g that you receive a new IP from a DHCP-server. In that case it seems reasonable that the radius server might be unavailable until the ARP-cache at the radius server has timed out

makkan

By using my imagination and some awesome tricks, this was finally solved. NAS is now running fully functional behind NATed router.

makkan

CobblinGoblin What happends if you do what I said in my previous post? Test 2: Place this NAT rule after the proxy NAT rule: chain=input, src address=local-net (e.g. 192.168.1.0/24), action=accept I have seen this rule + the one in my previous post to really slow down the INet. The one in my previou...

makkan

Thats a really long time until v6

makkan

Hi!

Can you Do this:
1. Run proxy at port 8080
2. Redirect tcp port 80 to8080 on your local interface.
3. Add this input filter rule in firewall:
In interface=local net interface, action=accept
4. Make speed test

It's just a funny bug that I found on some router os, can't remember which though.

makkan

Hi, One thing that I am really missing is the possibility to move configs "out of the box". Meaning that I would want to save the config and then move it to another router without removing content or caring about the config structure. if I want to create multiple routers with the same conf...

makkan

By the way, if it is a 450G I know that it has a second power supply on the mainboard inside of the device so you can go all nuts and have 3 powersupplies!

makkan

Normal working temperature for Mikrotik could be up to 70-75C

makkan

Regading the amount of users: http://wiki.mikrotik.com/wiki/Manual:License_levels

Regarding the size of CF disks I don't know. I have used micro-sd cards with 16GB without problems and I've had a friend who have used a 32GB micro-sd card without problems.

makkan

You probably shouldn't encourage people to break the rules of their Internet contract in this forum.

makkan

/ip firewall filter add action=accept chain=input comment=\ "Allow Local Traffic Between Router Applications" disabled=no \ dst-address-type=local in-interface=ether2-local-master src-address-type=\ local action = what to do with the packets chain = can't really explain, but "input&qu...

makkan

Use a null modem-cable to monitor the console during boot, then you will see what is wrong.

makkan

Read this: http://wiki.mikrotik.com/wiki/Securing_ ... A_Firewall

makkan

Actually, if I'm not totally wrong, all UPS-devices are AC which is then "converted" to DC with a huge powerloss as a result

Edit: sorry for off topic!

makkan

Reboot the Mikrotik.

makkan

Well, Im not sure what I am doing wrong, but I have set online time per say to 30sec bit i can still browse for 2-3min or more. I were also Roos that the client will receive the time limit and disconnect the user. About the ip, the radius server receives 192.168.1.1 (MT local ip) and i also think th...

makkan

Hi, I am facing a problem where I have a radius server and many mikrotik radius clients for hotspot. The problem is that these MT radius clients are behind a NAT translation so when they authenticate the radius server catches the local ip (nas-ip-address). Is there any way of solving this? For examp...

makkan

Hi,

Thank you!
Sounds reasonable, but can e.g. the dude upload a file to multiple routers?

makkan

Hi,

I am wondering if there is any way to send custom remote commands/scripts to the Mikrotik by using the dude (or smth else)?

For example, sometimes I would want to add a firewall rule to 5 of my Mikrotik routers and I would want to automate this. Is this possible?

makkan

Make a script?

Make a while-loop that use "get" to retrieve the id and then use it to remove the post. Shouldn't be any problem.

makkan

Question is still relevant: can you ping hosts on the other segment?

makkan

In winbox, go to system-> scheduler.
Schedule a script like: ip proxy access ..... To block the sites. I actually dont know the command in My head and i cant google it right now.

makkan

It is not a bandwidth issue, I have been running 15-20 users/interface with a 64kbit internet-connection and it is running just fine. Also, a 450 routerboard can easily handle 1gbit/s in bandwidth without any problems.

makkan

Run some scheduled scripts, one at 08:00am to block the sites and one at 05:00pm to unblock them.

makkan

You should do this in your firewall: RDP is using port 3389 <anything else that you want to permit, ICMP for example> Segment B ---RDP--> Segment A - Permit Segment A ---RDP--> Segment B - Permit established ANY ------> ANY Deny Established means that it will permit traffic where SRC is sending resp...

makkan

how should it work if it can't bind to necessary ports? how can a apache-webserver work if it can't bind itself to port 80? so get yourself comfortable with sudo (which is tricky sometimes) and resolve the permission problems with chmod (which is ugly but works), if you have no possibility to reall...

makkan

Hi, I can only give you some ideas regarding the backup. Since the router os support scripting, you should be able to do backup. First of all, you can export the user database with the export command.l or choose to backup the whole um with router settings etc. This is done by this command: tool user...

makkan

There shouldn't be any problems with that design. Are you sure you have done the nat and firewall rules correctly? Radius is using udp port 1812 and 1813. Edit: Sorry, you don't need incoming nat since you are on the same network. My bad! I also want you to consider what mikrotik license you got (on...

makkan

I think that you can also reset the board to factory settings by opening up the box and putting a screwdriver between to metal pads at the top right, just next to the screw and power up the device. (The pads look like two beans facing each other like this: () :P ) Hold the screwdriver there for a mi...

makkan

You can at least limit it per user in user manager, in web interface you find it under each user->rates, and in console you set the user variables rate-limit="rx/tx" E.g to limit a user to 100kbit download speed: /tool user-manager user add name="test" password="test" r...

Search found 82 matches