MikroTik

sdugoten

As it says in the log it's certificate-related or time-related. Maybe the certificate that NordVPN was providing was expired or changed however This is not a complete log for the connection enable your log for IPsec and share it. please do not share any sensitive data or Public IP. thx, your commen...

sdugoten

I have been using NordVPN routerOS 6.46 for a long while. Recently I checked the log and notice it no longer able to connect Here is the log 03:17:57 ipsec,error can't verify peer's certificate from store 03:17:57 ipsec,info,account peer failed to authorize: 100.xx.xx.169[4500]-89.xx. 161.195[4500] ...

sdugoten

OK, I did some more testing, I have a mix of 1. L2TP client connection 2. PPTP client connection 3. L2TP server If I enable 2 PPTP connection and L2TP server, from time to time it will display error message. At least it won't spam the log non-stop xx.xx.xx.xx parsing packet failed, possible cause: w...

sdugoten

I've seen this before a couple of times when no ipsec policies and proposals were defined but the other end had some proposals defined already. Try adding sha1 to auth-algorithms in your proposals. -Chris https://i.imgfly.me/XJQ0sv.jpg https://i.imgfly.me/XJQO5P.jpg I only have this in IPsec polici...

sdugoten

sdugoten

I am running on v6.45.7 on x86. I saw another thread also talking about this, but none of the method helps on the post. You can see that I have 2 L2TP client connection which connect to a VPN provider. Just basic L2TP client connection. It connected to the VPN provider just fine and can be used no p...

sdugoten

I think you should look into the router brand that is for home networking Well, I not really am into home networking... When I use VPN, I use it in the traditional way. To connect two networks over a tunnel across internet. IPsec is normally fine for that. And again, undoubtedly many open source pr...

sdugoten

I think you'll have to agree that the majority of routers do not support OpenVPN, you may be able to find the odd product that does, but not like client and server across the entire product line of the manufacture, which MikroTik does offer. The problem with OpenVPN on RouterOS is that it is a re-c...

sdugoten

@sdugoten: If it goes well, soon you may have some luck with NordVPN and IKEv2 ( see here ). Not that it would be an argument against full OpenVPN support. To be honest, IKEv2 is not as popular as OpenVPN. It's a bit too late. RouterOS in general is late. Having said that, I started to move my stuf...

sdugoten

Been wait OpenVPN + UDP + LZO for at least 4 years. A lot of VPN service provider just stop providing other connection type except OpenVPN. This is getting to a point that I have to move away from Mikrotik router because this is becoming a deal breaker. I mean...just look at this https://nordvpn.com...

sdugoten

http://imageshack.com/a/img922/2701/kVjlvY.jpg Ok, setting PFS group to none seems to let me connect now. However, there is one issue, how do I make the L2TP/IPSEC VPN connection not to use the default proposal? I would like to keep the default proposal to use PFS group "modp1024" while c...

sdugoten

it seems like debug still showing same error. Please check and see if I am correct. 4/18/2018 23:24 Debug 10.0.1.1 ipsec debug Compared: Local:Peer 4/18/2018 23:24 Debug 10.0.1.1 ipsec debug (lifetime = 86400:86400) 4/18/2018 23:24 Debug 10.0.1.1 ipsec debug (lifebyte = 0:0) 4/18/2018 23:24 Debug 1...

sdugoten

That's phase 2. What about the phase 1 proposals under IPSec > Peers? They all need to agree. According to the log (which for some reason was sorted descending by time), phase 1 has succeeded. That's why I've suggested to remove the lifetime from the ph2 proposal. I changed the lifttime to 1 hour a...

sdugoten

If I'm reading your debug correctly, you're offering 3DES and 3DES/SHA1. You should be using the AES family anyway. DES, 3DES, and MD5 are deprecated.

I enabled every single one and still having the same problem.

sdugoten

have your router set DNS to 8.8.8.8 ?

sdugoten

the debug message show

debug 103.46.141.189 notification message 14:NO-PROPOSAL-CHOSEN doi=1 proto_id=3 spi=03f298fd(size=4).

Anyone know how to fix this?

sdugoten

I recently bought the service from Ivacy VPN , but it seems I can't use L2TP/IPSEC connect to it using RouterOS. However, iphone connect to them using L2TP/IPSEC have no issue at all. Using an Android phone connect via L2TP to them also have no issue. Using Windows 10 create direct VPN connection vi...

sdugoten

I am running routeros on x86 router, and therefore there is no switch chip in the router. In order to make eth2 and eth3 as switch, I have to bridge this 2 port. Eth1 is the WAN port to internet. The problem I am facing is that after bridging eth2 and eth3, the IP hitting the server sitting on eth2 ...

sdugoten

Ok, I found the answer from the Internet The L2TP/IPSEC vpn server would not work correctly with IOS or OSX using the default method on creating the L2TP server with IPSEC support. https://netidy.com/blog/mikrotik-auto-generated-ipsec-working-ios You have to create a custom Ipsec Peer like below (de...

sdugoten

I am having issue with my L2TP/IPSEC server on v6.34.1 X86 RouterOS. I can connect to this L2TP server within the LAN, that means the configuration should be working. However, when I try to connect from the Internet, it will never get me connect. The firewall is already open I am accepting this dest...

sdugoten

PPTP VPN connection issue: Ticket Number: [Ticket#2014122566000139] Post reference: http://forum.mikrotik.com/viewtopic.php?f=2&t=92459 Description: PPTP client VPN connection throw "LCP received ProtRej for unsupported protocol" error message after 30 minutes connection RouterOS versi...

sdugoten

I would like to add that connecting to the same VPN server using LL2P do not have such problem.

Therefore, it's got to be something do with PPTP.

People having the exact same problem here:

http://forum.mikrotik.com/viewtopic.php?f=2&t=81728

sdugoten

I think this problem exist since early version 6 . I have tested on numerous PPTP VPN server and all of those have the exact same behavior. After say around 20 mins to 30 mins connection, the PPTP debug logging will show this: http://i.imgur.com/e4hWNWV.jpg It will keep showing the error message in ...

sdugoten

Like jaytcsd mentioned, it is the pre shared key, on your ipsec configuration

If it is a ipsec configuration, I wonder if you have any example to do that for L2TP? Because most ipsec configuration would need the local IP address of the destination which obviously the VPN company won't provide.

sdugoten

Did you try adding it under IP / IPsec / Peer?
I know that's where it's used as an L2TP server.

For other router, L2TP client should come with a text field called "Secret"...just like the iphone. However, RouterOS just doesn't have it.

sdugoten

You're already made profile pppClient. And Under PPP - Secrets You can create new "user", assign it to that profile. I think the "user" under the secret tab is for creating username that VPN into the Mikrotik router which use as L2TP server . I am trying to use Mikrotik router t...

sdugoten

I have joined a VPN company which only support L2TP connection. There is no problem to configure the L2TP connection on Windows or Iphone, however, when it comes to the RouterOS, I run into a problem. I configure the L2TP connection like the picture below, but there is no option for me to specify th...

sdugoten

I am just following the official document here. http://wiki.mikrotik.com/wiki/Policy_Base_Routing. As far as I understand, only the articles listed here can be considered an official Mikrotik documentation. The rest of the wiki is, generally, user-driven. Anyone can get a write-enabled account by w...

sdugoten

To sdugoten : The content you're matching against is a part of a URL you're connecting to, and thus is included in only a single packet withing the whole connection. You need to mark a connection with your content-matching rule first, then mark routing based on the connection mark you assigned prev...

sdugoten

Testing once again on routing marks on v6.17 on x86 (upgrading from v6.7). Part of the routing marks still doesn't work. Basically, I follow exactly like the official page here http://wiki.mikrotik.com/wiki/Policy_Base_Routing The content is set to "whatismyipaddress" http://i.imgur.com/cH...

sdugoten

It is also broken on RB-450G. Route with routing mark stays blue (inactive), gateway states reachable. Also, marking a packet for the "main" routing table is also gone. Downgrade to 6.7 fixes the problem. Anyone with such issues, please contact support. We have not yet received any inform...

sdugoten

For those had issues with routing marks , i ve seen the issue after upgrading from 6.7 to 6.9,i guess the same happened with 6.10 and 6.11 I was not able to reproduce and show to mikrotik, Although a possible fix(not 100% if that fixed the issue) is to downgrade to 5.26 and upgrade back to latest v...

sdugoten

Does anyone able to use the routing mark + the "Content" field working correctly ? As soon as I add anything inside the field "Content", the connection will timeout . For example, if I type in "facebook" in the Content field, it supposed to mark the route if I go to ht...

sdugoten

Does anyone able to use the routing mark + the "Content" field working correctly ? As soon as I add anything inside the field "Content", the connection will timeout . For example, if I type in "facebook" in the Content field, it supposed to mark the route if I go to htt...

sdugoten

You shouldn't set that. Any ip address in the 10.0.1.0/24 subnet will not route correctly. You should let the VPN server assign that ip. Leave that setting blank. BTW, it is only free for a while. I noticed the password changes regularly, and you won't be able to connect using the old password. Min...

sdugoten

I wonder where do I change the testvpn IP? It automatically assign to 10.0.1.1? Mine was assigned by the VPN server (afreevpn.com). Yours should be also. Maybe that is the problem you are having? Ok, can you show me what "Profile" you use on the testvpn? I am talking about this screen htt...

sdugoten

Mine shows a different dynamic ip assigned to the testvpn interface (10.55.0.54/32) with the same network ip as yours. You will have a routing problem with that setting. Yours has 10.0.1.1 as an address on testvpn. That looks like a routing conflict with one of your localnet interfaces (ether2). ??...

sdugoten

Mine shows a different dynamic ip assigned to the testvpn interface (10.55.0.54/32) with the same network ip as yours. You will have a routing problem with that setting. Yours has 10.0.1.1 as an address on testvpn. That looks like a routing conflict with one of your localnet interfaces (ether2). ??...

sdugoten

My bad. It did take a masquerade also. Everything is working fine. I am on a different computer now, but the other computer is up and running using the new VPN route. edit: My localnet is 192.168.3.0/24. After I got the VPN running using the user and password from the afreevpn site using testvpn as...

sdugoten

I'm posting this from a RB433 using afreevpn.com It took a routing mark in "/ip firewall mangle" and a new default gateway using that routing mark, but it seems to be working fine. I checked with whatsmyip.com and it shows the afreevpn.com's public ip. Just a route rule with routing mark ...

sdugoten

Then you have a problem there. You should be able to ping the VPN gateway. Maybe you should contact strongvpn tech support. I don't use strongvpn, I use strongvpn as an example, but I have tried 2 different VPN company, and I can't ping none of them. I just test another VPN company, which you can t...

sdugoten

Can you ping 192.168.120.1? Nope, I ping directly on ROS router terminal [admin@MikroTik] /ip firewall nat>> /ping 192.168.120.1 HOST SIZE TTL TIME STATUS 192.168.120.1 timeout 192.168.120.1 timeout 192.168.120.1 timeout 192.168.120.1 timeout 192.168.120.1 timeout sent=5 received=0 packet-loss=100%...

sdugoten

My route list has always worked, but I don't use an X86 version. Maybe you should post your entries in "/ip route". It appears the recommended mangle rule sends everything (default route) through the VPN connection. Here is the /ip route print http://i.imgur.com/1jErcx3.jpg here is the in...

sdugoten

Is the VPN running? /interface pptp-client print There should be an 'R' after the '0' and before the name. edit: Did you follow all the instructions? There are "/ip firewall mangle" rules also. http://strongvpn.com/setup_mikrotik_pptp.shtml Yes, VPN is running, and I use iphone PPTP vpn c...

sdugoten

I see. Did you add the masquerade as shown in the Mikrotik setup? /ip firewall nat add chain=srcnat action=masquerade out-interface=testvpn I have two masquerade rules: add chain=srcnat action=masquerade disabled=no out-interface=ether1 add chain=srcnat action=masquerade disabled=no out-interface=t...

sdugoten

Did you set up a route in the VPN server to your localnet ips in that VPN client?

The VPN server is a paid service, so I don't own the VPN server. Something like this http://strongvpn.com/

I just try to setup my ROS router to route a specific IP thru the VPN tunnel.

sdugoten

Hi, I have been trying to get a simple VPN PPTP client setup on my x86 ROS router v6.7 but never got it to work. I have setup a VPN PPTP client like this and it is connected http://i.imgur.com/sihAefO.jpg And then my router is already able to access the Internet using the following Masquerade rule a...

sdugoten

I have a very basic setup. Running Version 5.24 x86. I just want to connect to the free VPN server via PPTP and browse Internet thru the VPN tunnel. Router 10.0.1.1 Home PC 10.0.1.2 Free PPTP VPN server from http://www.pptpvpn.org/ (Anyone can try it, no need to register, the IP and username/passwor...

sdugoten

http://forum.mikrotik.com/viewtopic.php?f=13&t=56265

I think you can do it via the web interface too.

Just FYI, http://www.speedtest.com.hk/en/index.htm still doesn't work with SIP disabled.

sdugoten

Just to update... The problem went away, I think it was fixed by disabling the sip ALG. If we get a chance we'll try enabling the ALG again to be sure. Ran out of time last night..

Hi, I wonder what is the exact command to disable sip ALG? Thanks.

sdugoten

I think my point was that the site works on other router , the site works on direct connection without router. The app will only timeout when it is connected to a RouterOS router. So, I am just wondering what log I can provide you so that I can troubleshoot what packet has been stopped by RouterOS. ...

sdugoten

sdugoten

I wonder if anyone try ? Or know how to solve this problem? Thanks.

sdugoten

Hi, I am running routeros 5.21 and recently I found out I can't run the speedtest on this site. http://www.speedtest.com.hk/en/index.htm The windows version will let you download a binary to test the speed. The Mac version is actually an app run on OSX. None of those would work when I connect thru r...

sdugoten

R52Hn with mmcx to RP-SMA pigtail. And then you can buy antenna that used RP-SMA connector (which is most linksys router use) A lot easier to source for RP-SMA antenna than other type of connector... However, I have yet find a solution to securely lock the mmcx to RP-SMA pigtail on the case...the pi...

sdugoten

Pretty sure it is something do with RouterOS, I used to use a PIX 501 and I can ping just fine. I am thinking if this is something do with the dhcp-client which is not a static IP.

sdugoten

[admin@MikroTik] > /ip address print detail Flags: X - disabled, I - invalid, D - dynamic 0 address=192.168.88.4/24 network=192.168.88.0 interface=ether3 actual-interface=ether3 1 address=10.0.2.1/24 network=10.0.2.0 interface=wlan1 actual-interface=wlan1 2 address=10.0.1.110/24 network=10.0.1.0 in...

sdugoten

Ok, here is my setup on ROS 5.1 Ether1 - dhcp-client with IP 210.x.x.x Ether2 - LAN with IP range 10.0.1.0/24 Ether3 - 192.168.88.0/24 , cable is not plugged in, not in used wlan1 - wireless interface with ip range 10.0.2.0/24 wlan1 NAT to ether2 All interface masquerade to ether1 Web server IP is 1...

sdugoten

I am wondering..if I need to use a RP-SMA antenna for R52Hn, can I buy a adapter cable " RP-SMA male to MMCX female right angle RG316 pigtai" something like this ? R52Hn has a female or male? I can't find reference to it. http://cgi.ebay.com.hk/RP-SMA-male-to-MMCX-female-right-angle-RG316-...

sdugoten

Ok, I end up testing it myself. The setup is like this... Computer A (WAN) ---- RB800 ---- Computer B (LAN) I make 1 computer act like the WAN while another computer act like the LAN. Both on Giga port + i7 CPU machine. The test was copying one 2G size file from computer B to computer A over SAMBA (...

sdugoten

I have a setup something like this: ether1 -- to internet using dhcp-client, so IP is totally random ether2 -- LAN interface with IP 10.0.1.1 wlan1 -- another Wireless LAN interface with IP 10.0.2.1 Since I want client which connect to wlan1 will be able to talk to client on ether2, there is two pos...

sdugoten

gonna place an order now, but would the case CA800 fit both RB800 and R52Hn in it? The uFl antenna is used for R52Hn ? Do I have to buy this antenna separately? I saw you have power supply on the product list as well? Do I have to buy it separately too? Which model I should use? Any all-in-one packa...

sdugoten

You read it correctly. The router has two ports, and the tests that we use utilize the absolute maximum speed possible, in this case, 1.6Gbps out of 2Gbps was achieved. Holy smoke...this is what I am looking for! Before I place an order on RB800, I got one more question. Do you guys have any test o...

sdugoten

Since ethernet frame size is 1500 bytes, so the corresponding NAT WAN to LAN according to the chart is 1615.15 Mbps? How can it be faster than the gigibit 1000Mbps? Or do I read the chart incorrectly?

sdugoten

Actually, I am planning to buy a RB800, but I do have one question from anyone here on the board. What is the estimated NAT WAN to LAN speed for RB800? My local ISP here offer 1000mbs plan and I want to make sure the RB800 will be doing good enough with NAT. I will appreciate for any input. PS. Coul...

Search found 65 matches