MikroTik

sebastia

I you want some assistance or information you should be a bit more polite. Most of us on this forum are not here because we are paid for it. And how would you explain it then, considering that this test goes right against the results of your tests number 2 & 4 from you first post here??? both we...

sebastia

The 1Gb/s links are full duplex.

Just for posteriority, this is NOT the case: Mikrotik always reports full bandwidth over all directions -> that 1Gb/s is shared for both directions!
(as supported by your own tests)

sebastia

1) If we are talking about 5 independent ports: the two 1Gbps links will be used, as needed. There is no hard assignment of a link to a group os ports.

Don't believe that to be the case: I think the port attribution of all independent links is fixed, (but I haven't tested it...)

sebastia

in tests 1 & 3 you don't go to cpu, but are using the hardware switching in the switch chip (= off-loading) -> hence the limitations of the link to cpu don't apply and you get full bandwidth of the 1Gb/s connection / port

So how about that admission :-D ?

sebastia

you are using it (1Gb/s) already!

see second test:

Tx + Rx ~1Gb/s for ports ether1 & ether4

the 1Gb/s from diagram is TOTAL bandwidth available, for BOTH sending and receiving

I expect an apology now ;-)

sebastia

Just noticed it myself in changelog

Good news indeed

Although regex has been mentioned before by staff to be heavy

sebastia

Thx.

Interesting info. A bit early, as you only got it, but I would like to hear your findings on link / connection stability.

sebastia

For the time being, we have to look to other platforms, ex dnsmasq

sebastia

In a way, the affected owners should be thankful for the wake-up call and that the payload was so benign!
Any updates / new events on the topic?

sebastia

Hey

I'm looking for any and all feedback on field-testing of R11e-LTE6.
Please share your findings.

Kind regards
Sebastian

sebastia

Have a look here wrt L7 config: https://www.youtube.com/watch?v=RtFZKvLKgD0
(+ changes as suggested by mkx)

sebastia

Next to "use-ip-firewall=yes" one could also just add bridge rules under /interface bridge filter.

sebastia

Have a look here too: https://wiki.mikrotik.com/wiki/Manual:I ... hop_lookup

Scope is linked to routing configuration: 10 for local, 30 for static, ...
Target scope is that as well, and by specifying target one can define how next hop can be looked up.

sebastia

Is there a high-level roadmap? Could you share it?

sebastia

is the current beta functionality-wise complete
No, BGP and MPLS are not even enabled.

Thx for reaction. Disabled routing was mentioned with beta1, so that was a given / known. But what about the rest? Once bugs are ironed out and routing added, will that be v7.0?

sebastia

removed in beta3...

sebastia

Hi Mikrotik

Is the scope of the first release of v7 covered by current beta? In other words is the current beta functionality-wise complete?

Thx

sebastia

priority is always active: queue tokens are used for packets from highest to lowest prio. Once pipe is full / tokens are exhausted and priority queues are full, new packets get dropped In effect, if bandwidth is not scarce, all packets are transmitted and one could say that priority is irrelevant, a...

sebastia

Most likely because of this in openvpn config

redirect-gateway def1

sebastia

Update on the implementation above with bridge filter rules: Event though the bridge rules are added for a specific "out-bridge", in my case being the LTE bridge, the rules are evaluated for all bridges. This generates additional load and throughput limitation on the main high bandwidth li...

sebastia

Hi Problem is with the routing indeed the first line shouldn't be there Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 0.0.0.0 0.0.0.0 U 50 0 0 tun0 I would suggest to not let the client set any gateway, and nat outgoing traffic to clients, on the vpn server (so src-nat then), to it'...

sebastia

Have a look here https://mum.mikrotik.com/presentations/MX17/presentation_4265_1495639302.pdf But why not start with this: * masquerade: don't use as you have static ip's -> to be replaced (whenever an ip is lost all connections linked to that will need to be dropped, meaning scanning ALL connection...

sebastia

if it's only 1 of 8 failing, I would be looking AT that failing ap. Is it up-to-date and so on...

sebastia

And the total limit is defined at the parent level, all children "borrow" from parent:

/queue tree add limit-at=0 max-limit=5000000 name=ether1 parent=ether1

sebastia

Do you have a backup or export of your "good" config?

sebastia

Hi

Communicating using your home ip is indeed possible. What you would need to ensure is that all traffic at the vpn client side is routed over the vpn / towards the vpn server endpoint.

Software functionality for all tiks is same, and so any tik can do that.

sebastia

in your case the vlan / mgmt traffic is caring same mac as passthrough, and hence gets hijacked by lte interface.

in current setup you'll need a bridge with other mac for the vlan

OR

reverse the config: mgmt over "plain" eth and passthrough over vlan without extra bridge

sebastia

Hi

While CRS305 technically can do what you propose, it's not meant to do that: it can do pppoe but not at speed, as it's not fast enough on cpu side.

sebastia

I didn't say I agree with all comments there

sebastia

see also viewtopic.php?f=3&t=150611 ...

sebastia

Hi

Src-nat and dst-nat are locate in different chains and are executed at different times, dst-nat before routing & src-nat after routing. One can't interfere with the other.

List your full firewall config if you need further assistance (/export hide-sensitive)

sebastia

server=available for all networks configurations
network=only that network

see also manual: https://wiki.mikrotik.com/wiki/Manual:I ... CP_Options

sebastia

Have a look at http://www.firewall.cx/networking-topics/general-networking/107-network-multicast.html or https://www.cisco.com/c/dam/en/us/products/collateral/ios-nx-os-software/ip-multicast/prod_presentation0900aecd80310883.pdf Drop: drop frames to the multicast mac range drop frames with ip protoc...

sebastia

Thx for the info

sebastia

search function helps: https://wiki.mikrotik.com/wiki/Manual:S ... t#SSH-exec (but not a lot yet...)

sebastia

ssh-exec has been added in 6.45.1 (viewtopic.php?t=149786&hilit=ssh-exec), and CAN be called from scripts!

sebastia

Looks ok.
Post full conifg (/export hide-sensitive), maybe something else is interfering.

sebastia

I'm not sure, but as I know, LACP cannot be set when there is only 1 connection between switches (sw1->sw3 and sw2->sw3). How to set LACP in this scenario?

I was thinking LACP between Hyper-V & SW3.

sebastia

Since the Hyper-V is in teaming mode... https://www.vembu.com/blog/configure-nic-teaming-hyper-v/ If Hyper-V ports algorithm is used with Switch Independent teaming mode, the virtual switch can register the MAC addresses of the virtual adapters on separate physical adapters which statically balances...

sebastia

Hey

SW3 should be in bridge mode, as both sw1-2 may be active at any time.

Just a remark: the SW3 is a "single point of failure" in that design.

sebastia

Hey

For general usage, it will do just fine: https://mikrotik.com/product/rb4011igs_ ... estresults
L2TP: don't expect that vpn will be at full speed
bridge: see

sebastia

Hey

have you tried pinging from B to A?

What is the routing table at SXT LTE like?

sebastia

add address=192.168.1.0/24 dns-server=192.168.10.2,1.1.1.1 gateway=192.168.1.254 netmask=24 -> why don't you specify your pi-hole only here? add address=192.168.1.0/24 dns-server=192.168.10.2 gateway=192.168.1.254 netmask=24 try this instead /ip firewall filter add action=accept chain=input comment=...

sebastia

Hey

Maybe some config issue, list your config for review (/export hide-sensitive).

sebastia

add action=accept chain=forward in-interface= bridge out-interface="eht1 Internet"

is enough

for filter table
output = traffic from router itself
(other were correct)

sebastia

these are not needed as dns is on another network
You can force any DNS request to use your DNS by using dst-nat

you're out of context, read last few posts. hint: i've commented on the src-nat!

sebastia

What are you missing, in your opinion? It could be a working config.

sebastia

have a look here https://wiki.mikrotik.com/wiki/Manual:C ... s_switches

sebastia

Can also add a device each side of the wireless devices then use RSTP

will a wireless bridge pass the xSTP related frames?

sebastia

The reason for the Masquerade and DNAT rules are to force any and all DNS query to the Pi that is running PiHole, it's a content blocker based on DNS filter lists. these are not needed as dns is on another network As far as I understand, setting the DNS under IP--> DNS Settings will auto assign the...

sebastia

why do you need this? add action=src-nat chain=srcnat comment="UDP DNS Masquerade Network" out-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.10.2 to-ports=53 add action=src-nat chain=srcnat comment="TCP DNS Masquerade Network" out-interface=bridge ...

sebastia

either that or ip stack is not correctly configured
list /export hide-sensitive

sebastia

that won't be immediate

sebastia

hint balance -> balances

over both links

if you want active passive that's a different mode
the "immediate" hand over (subsecond) you can have with active-backup, see viewtopic.php?t=150820#p743780

sebastia

in my experience, netinstall can get "confused" when there are multiple interfaces active

sebastia

you have a problem with connectivity NOT dns resolution

you get an IP for a dns in each kind of test
but ping (icmp) and tcp don't get through..

sebastia

do you want an active-backup or active-active?
xor is the last one

sebastia

there is no problem, it's resolving
ping google.com [216.58.223.142]

sebastia

so your dns resolution works fine

sebastia

have a look at https://wiki.mikrotik.com/wiki/Manual:Interface/Bonding, and especially enable link monitoring, probably arp base
examples: https://wiki.mikrotik.com/wiki/Manual:Bonding_Examples

sebastia

only allow them at specified rate, drop rest

sebastia

in this config mgmt is only possible from "address=192.168.0.0/24"
none of the interfaces have this range, maybe routed from somewhere else (through ospf)?

sebastia

disable www & www-ssl ip services

sebastia

to verify dns functionality and limit the scope try testing with "ping" (udp dns) & "nslookup" (tcp dns). both do minimal functions.

if ping <some dns name> uses an ip -> udp dns works
if nslookup <some dns server> works -> tcp firewal / nat works

sebastia

don't see/have the details, but vpn needs to be src-nat, and if your internet uplink probably as well, so in that sense it might be

sebastia

for masq, out interface should be the vpn interface not ether1
don't use srcaddress list on the rule & just nat all going out over vpn -> less potential for issues

sebastia

The other side doesn't know your internal network, to resolve you need to setup src natting on your vpn interface (src-nat or masq)

sebastia

Have a look at getRTT function here viewtopic.php?t=129294

sebastia

in that case you probably don't need any port forwarding as the camera's are connecting to cloud themselves (from inside to outside)? check it / consult documentation you'll need to verify how is the app finally connecting to the camera, through cloud or some other manner? If "some other" ...

sebastia

do you have some central management console / server?
and how to you "connect" the these devices from outside? directly or through some cloud feature?

sebastia

if you want to access each separately, then yes, port forward different ports to specific devices

sebastia

what is the /tool profile indicating?
could you share details on how the blocking works?

sebastia

there was a presentation by Tik support on some frequent issues with pppoe servers: https://mum.mikrotik.com/presentations/ ... 948376.pdf
have a look if relevant for you

sebastia

how about vlan priority? https://wiki.mikrotik.com/wiki/Manual:W ... t_priority + shaping vlan2 to 95% of bandwidth

sebastia

/ip address add address=192.168.13.1/24 interface=ether2 network=192.168.13.0 => should be on brdige2 mikrotik doesn't have a dmz setting, needs to be done manually basically, any connection to the router which is "new" (so not part of existing connection from router) should be then dst-na...

sebastia

post your config, as it's not clear what is what...
/export hide-sensitive (and replace any public ip's)

sebastia

Hey

On paper it sound all right, only there have been some reports of 317 instabilities when under full load. Then there are also people saying they are rock-solid...

sebastia

And what is your question / request?
Also, post config in between < code > tags

sebastia

Hey * with fast-path disabled, fast-track will not work either * you'll need to exclude 88.200 from fasttrack, or manling for route mark will not work * You seem to have two wans? indihome + oxygen is oxygen some vpn for 88.200 only? * you have in config /interface pppoe-client add ac-name=BRAS3-D2-...

sebastia

I didn't try regex in content, but it does match on plain text.

For https, your current L7 will be working with TCP and SSL handshake which is still unencrypted data

sebastia

Hi

Normally one only import private key on target/server device. The public part can be distributed to the users of that server.

If Tik is CA, only import private key.
for opvn server: only import private key
for opvn client: only import private client key

sebastia

hey

and how is the goove connected to 2011?

sebastia

do you have public ip on rb2011? check under "/ip address" in Winbox or through command "/ip address print"

sebastia

That depends on your isp infrastructure (do you have public ip assigned? any ports which are not blocked by isp?) and the configuration of the Tik (what firewall setting do you have there?).

sebastia

Hi

Does that Mikrotik remain ISP's property?

sebastia

that or the "content" packet matching in plain firewall

sebastia

I would expect not as it related to Transport Layer Security which is not used with plain http.

sebastia

Hey Do you have another system to test these changes? In this particular case I would take that "advise" with a HUGE grain of salt, or better yet: just ignore it... Simple queues are processed by multiple cpu cores, which spreads the load. Do you see that? Try monitoring with /tool profile...

sebastia

I am some shocked.
A script on 200+ lines is needed just to create a folder in RouterOS.
This is some MT should add a built in function.
You can always log in via FTP to create a folder and/or copy/move files.

which is exactly what the script does...

NOT a acceptable "solution"

sebastia

This is not Tik related! You should be a asking on Windows forums...

Hint: indicate in windows that the connection is "private"

sebastia

I thought so

sebastia

busted

, I don't own a 4011... Good to know, thx

I meant low-power, based on actual usage: "Max power consumption 44 W"
that's not a lot

sebastia

simple, as a mitigation, firewall / filter the api port

sebastia

- to keep the high speed datastreams away form pfSense (intel Pentium) - to see if it was an option to use the internal router in state of pfSense -> a CRS can't route 10g of data either! -> not with a CRS * to save interfaces between pfSense and the CRS317 -> don't understand that one * to have a l...

sebastia

Hey CRS is not a router, so you shouldn't be using it as one. I would suggest to upgrade the pfsense to "the only router" status: * only bridge on CRS for "data" vlans -> you did say that pfsens is owner of these! if so, CRS should not route (nor firewall) * this means no ip on d...

sebastia

Hey cpu frequency settings requires a reboot to become active (part of boot configuration), so use of script would be limited. Impact-wise, functionally it should do exactly same thing, but slower... Anything running on cpu will be impacted: routing, queuing, firewall, ... Hardware based switching /...

sebastia

Hello From high-level point of view, there would be little difference between udp. And high stream of large icmp packets would be a red flag on it's own. Furthermore, some networks / routers perform icmp "optimisation" / rate limiting, which would result in high packet loss. So far from st...

sebastia

What is your goal? What did you expect?

sebastia

/ip firewall nat set [find where action="masquerade"] !src-address out-interface-list=WAN

sebastia

If you want to have good gaming experience, then indeed you'll need to limit total download from router to all networks together to less than what modem can do. Similar for upload, limit all upload traffic to less what modem can upload. 90-95% is a safe starting point. your wan is ether1, update con...

sebastia

Sniffing takes place "close" to physical layer, and tagging might not have happened yet. Have you tried sniffing a trunk port down the hill? Wrt config, there are few entries, see https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Setup_Examples. Is the vlan 10 already defined unde...

sebastia

Hey

ntp client will determine on it's own how frequently it should poll the upstream server for time update. Usually it starts at 64s and backs down down to 1024s, once clocks are in sync and drift is under control.

sebastia

Hoi
All connections start with dns resolution. Filter / control these and you'll be able to control what connections are made (for most part).

sebastia

Hey

Start with posting your current config (/export hide-sensitive), and indicate what you want to achieve: ip/port/bandwidth/...

sebastia

You keep on stating that, but without any references to back up your case. I on the other hand have proven with above setups that it indeed is the case. When you state that, I'm not so sure if you know what is going on... why don't you then explain to us if you're so sure of yourself what is going o...

sebastia

unmananged switches don't participate in lldp, as said before they don't even have own mac
even this works just fine in any direction and any link interruption

2+2switches.png

see also web: https://networkengineering.stackexchang ... e-switches

sebastia

good plan!

sebastia

Hey, welcome on the forum. hap ac did you connect port 1 to your network. That port if in default config designated Wan, and firewalled. best would be to disable dhcp server on the bridge, within RouterOs, change the ip of the bridge and connect one of these port to your internal network. hex which ...

sebastia

And to remove any doubt, this one works just fine too

2+1switches.png

sebastia

I disagree, an unmanaged switch is essentially invisible on the wire, it just passes packets around and has no own mac. So the above network boils down to this: 2switches.png with STP enabled on both ends, on bridge level, auto fail-over will function # R1 /interface bridge add name=bridge /interfac...

sebastia

well, there are two in this setup CRS & CSS...

sebastia

The only thing that draw my attention was dhcp-snooping on bridge, but its supposed to be done in hardware on AR8327... some other thoughts * check that counters for FastPath are "moving" * check cpu usage during transfer * do you test with multiple streams? * check bridge ports have "...

sebastia

could you post the config?

sebastia

remember something similar

viewtopic.php?f=2&t=126354&hilit=ccr+cpu

sebastia

which version are you running? remember that there was a bug in ROS with regards to that;
Ros 6.45.1:
*) firewall - process packets by firewall when accepted by RAW with disabled connection tracking;

sebastia

Hey

Do you have connection tracking enabled?
was the ddos on ipv6? there was an issue with that not so long ago (implementation in ROS), with a patch release. do you have it?

Edit: just noticed you don't have connection tracking enabled viewtopic.php?f=2&t=151403

sebastia

hey, list your fill firewall rule set, for both ipv4 & ipv6. what I'm wondering: you have fasttrack dummy rule, but not fast track itself..., view is incomplete fasttrack will bypass most of ip processing for bigger part of packets of a connection, but on regular basis packets will be processed ...

sebastia

Anyway, once you put interfaces in a bridge, all configuration related to them needs to be done on the level of bridge. That includes ips, vlans, ... from the sound of it, you would want to bridge the vlans only, 3 and "1" (or another but untagged on ether1) If that's not enough, I would a...

sebastia

And what is the point of all that? These are still separate networks...

At least your footer is totally correct :-p

sebastia

is there a way to set 80/20 for example? Not directly, but you can achieve this by being creative: repeat a link multiple times, for 80/20, pretend you have 5 links each good for 20% of traffic: wan1,wan1,wan1,wan1,wan2 Another option, is bandwidth based load-balancing: https://forum.mikrotik.com/v...

sebastia

the default routes are only relevant in context of fail-over: each connection gets assigned to either Wan1 or Wan2 in mangling, only when that link is not up will the default be relevant. the current load balancing is 50/50 add action=mark-connection chain=prerouting connection-mark=no-mark \ dst-ad...

sebastia

you should remove fasttrack (action=fasttrack-connection, 3 instances), as it's not compatible with loadbalancing "add action=accept chain=prerouting comment=router dst-address-list=router" should be at the beginning of chain / before all LB logic your default routes should have different ...

sebastia

as stated there("conntrack by default is most expensive RouterOS facility"), the high cost of/before "filter" table is the connection tracking logic. If it's disabled, it won't matter whether it's in raw or filter.

sebastia

actually that one

Since RouterOS v6.42 Netwatch is limited to read,write,test,reboot script policies.

To access global variables, "policy" right is needed

sebastia

Let me rephrase: bridge is not what you are looking for = wrong in this case.

vlan3 & lan have different ip ranges so direct communication between devices is not possible -> a router between is needed to do the forwarding. A bridge will not solve that.

sebastia

If you swap the clients, do you also get "reverse" throughput? If so then I would start looking at the clients / software

sebastia

Hey

All port are independent, right? Not sure about the first transfer, but the second test is reaching physical limitation, as both ether1 & ether5 are on same data bus, which is limited to 1gbs.

see block diagram without switching: https://mikrotik.com/product/hex_s#fndtn-downloads

sebastia

netwatch doesn't have enough permissions to invoke a global script, see note on https://wiki.mikrotik.com/wiki/Manual:Tools/Netwatch

sebastia

Hey

For starters, post your current config: /export hide-sensitive (in-between code tags)

sebastia

Hey SXT-4g support ONLY 4G. It will not connect over anything other. SXT-LTE support 4G+3G+2G. Regarding the speed, your phone will have a better modem (if any recent it will support Carrier Aggregation (~bonding for LTE)) than what is in SXT. So most likely you won't get similar rates. On the other...

sebastia

Have a look here: viewtopic.php?f=13&t=149312#p735848

sebastia

Hey

Why would you need the bridge anyway?
There is only one interface of each...

sebastia

a port without pvid would be a port with tagged traffic -> trunk port On https://wiki.mikrotik.com/wiki/Manual:Bridge_VLAN_Table doc says PVID - The Port VLAN ID is used for access ports to tag all ingress traffic with a specific VLAN ID. A dynamic entry is added in the bridge VLAN table for every P...

sebastia

Nice investiation - analysis - solution track. Congrats The answer to your question: when a connection is fasttrack-ed, some of it's packets are bypassing among others mangling, and in your case the special routing. The packets arriving at the destination are then discarded as coming from an unknown...

sebastia

Hey

To my knowledge not directly. There is the netwatch, with up & down scripts, but it's no synchronous. It will not be triggered by event, but by (delayed) detection.

sebastia

Hey You should consider nat independent of routing: route decides how traffic should be forwarded, nat specifies if traffic leaving a particular interface should be changed. In your case: Routing /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark ... passthrough=...

sebastia

please list your config: /export hide-sensitive
Also what do you want to limit? upload, download, both?

sebastia

1. if you want to setup / test LTE AP, then yes you'll need a sim to get active LTE uplink 2. indeed 3. in short: it depends. strength of cell tower signal, interference (other users / towers) and quality of clients antenna, for transmissions in both directions. Wrt to wap lte, it's antenna doesn't ...

sebastia

Yes, all can. But if you specifically need wireless, have a look at wap lte kit.

sebastia

Yes it will be slower, if enabled.

But if you won't do vlan filtering on 4011 (= selective vlan bridging) that won't be a problem

sebastia

what do you mean by "Note that the 4011 doesn't doe vlan filtering in hardware."? It could make this any trouble? Or it's just for info?

If you enable "vlan-filtering=yes" on 4011, all vlans will need to pass over cpu. On CSS3xx it's in hardware.

sebastia

With blocking of connection once a volume is reached one can block that connection, but the user can just resume the download with a new connection. So the net effect is slight delay. A more effective approach would be to slow down the connection once a volume has been reached: based on volume, assi...

sebastia

Hi I would think that this will depend on the setting: are the networks / devices in these networks isolated or to they share same spaces port isolation might provide more guarantees from security point of view vlan are more flexible kind of port isolation dictates complexity of configuration: on ro...

sebastia

Agreed with port number change, nat is needed.

@Sob: not sure what would brake with DNSSEC, as the internal dns server, as an authoritative server, would present internal records with own signatures.

sebastia

Hey

...to have an identical hardware...

This is NOT the case, switch chip are different and with different capabilities: nand, ram, cpu

sebastia

@2frogs Split DNS configuration is standard practice in networks with internal and external addressing. It is a proper solution if internal resources need to accessed. The alternative "hairpin" is abusing natting, as two NAT's are needed, first redirect to internal destination (dst-nat) th...

sebastia

Hey # You don't need these add action=accept chain=forward dst-port=80 in-interface=pppoe-out1 protocol=tcp add action=accept chain=forward dst-port=443 in-interface=pppoe-out1 protocol=tcp add action=accept chain=forward comment="Allow Port Forwarding - DSTNAT" connection-nat-state=dstnat...

sebastia

hey, try $"lease-hostname" instead

sebastia

Don't know about the other vlans, but 20 should be carried only over ether5 + cpu, so # only to cpu & ether5 /interface ethernet switch vlan add ports=ether5,switch1-cpu switch=switch1 vlan-id=20 # add cpu port info /interface ethernet switch port set switch1-cpu vlan-header=leave-as-is vlan-mod...

sebastia

Or just set up a dedicated vlan.

sebastia

Hi

No, you'll need to do it (ex: with script) yourself.

sebastia

Hey

Have a look a this thread: viewtopic.php?f=2&t=150535

sebastia

And how about connecting switches over fast(er) trunk ports? Ex: connect 2 CRS326/CSS326 over their SFP+ port(s) and as such generate a 48 port switching plane?

sebastia

4011 + rack = 1100AHx4

sebastia

to start with, move "accept establish & related" to top of forward chain -> stateful part of firewall so rules for forward should be: 1. accept established / related 2. drop invalid 3 (rest) In the rest you can then control from where connections are allowed: ex lan -> guest is allowed...

sebastia

For queues to make sense you need to have a global maximum, if there is non, each subqueue can borrow without limit, and there won't be any prioritisation. such queue tree needs to be attached to independent interface, ex wan, lan. This can be "naked" interface, etherX, or a bridge groupin...

sebastia

So how can i receive untagged traffic in the bridge (to use local LAN) ...? untagged of ether5 will just be "forwarded" to bridge and cpu So how can i receive ... and tagged traffic (vlan-20) out of the bridge ? tagged will be received by vlan on the bridge Todo: migrate vlan to bridge mi...

sebastia

Have a look at this thread for general info: viewtopic.php?f=13&t=143620
and this wiki for switch based: https://wiki.mikrotik.com/wiki/Manual:S ... p_Examples

sebastia

If you can do, then the gateway will be explicit / unique. Right now that's not the case. Otherwise qualify the interface that should be used: gateway="IP%interface"

sebastia

Try this: content="\03abc\03com" Just tried, no working. Working fine here (from terminal): /ip firewall mangle add action=passthrough chain=prerouting content="cnn\03com" dst-port=53 in-interface=e1_int log=yes log-prefix="DNS catch: " \ protocol=udp "ping cnn.co...

sebastia

Try this:
content="\03abc\03com"

sebastia

Hello

wrt hac
ether5 participates in bridge (is a slave): it cant operate as an independent interface: not for ip address, vlan, firewall, ...

* hence the vlan should be defined on bridge.
* vlan ip should be assigned to "vlan-guest" interface

sebastia

Hey

If I got your question right, it's the "lease-time": duration of ip assignment.

sebastia

Thx for info

sebastia

Hoi

What kind of throughput do you get over the links?

sebastia

Hey You're firewall rules: * add action=reject chain=forward comment="Reject HOME from GUEST" dst-address=192.168.5.0/24 reject-with=icmp-host-prohibited src-address=192.168.20.0/24 add action=reject chain=forward comment="Reject MGMT from GUEST" connection-state=new dst-address=...

sebastia

Hey your vlan20 is "hosted" by bridge1, with all of it's interfaces. So any traffic over ether5 / vlan20 will be propagated to all possible participants. The config seems to be pre 6.41, right? Upgrade to post 6.41+ and depending on switch chip capabilities use brdige vlan or switch vlan f...

sebastia

You don't seem to be very good at hiding addresses.

lol

sebastia

Hoi

The network is unclear, could you post a diagram?

sebastia

Hey

Do you have access to it's management functionality? If you do, run "/export hide-sensitive" and paste it here between < code > code goes here </ code > tags.

sebastia

Hey, the recursive routing paths, map to same gateway .1.1

sebastia

* proxy-arp, I don't remember when and why I activated this, could it be because of VPN or mDNS ? should I remove it ? * Ok that's what I tough, but that weren't mentioned in the how-to linked above. Will try a different config with this. * I followed the how-to above, and it adds bond to the bridg...

sebastia

Hey There is an extensive vlan how-to on this forum, have a look. (https://forum.mikrotik.com/viewtopic.php?f=13&t=143620&hilit=vlan) Some remarks: * why need for proxy-arp on bridge? * vlan-filtering=yes (on non-CRS3xx hardware) is in software, if you want it hardware, you'll need to do it ...

sebastia

Hey

firewall is ip based, not domain.

What you want to do is normally done on the webserver itself, as the requested domain is part of the request.

sebastia

Need NAT + LTE not enough for NAT -> NAT somewhere else -> pass-through is the ONLY option

sebastia

See ssh-exec
https://wiki.mikrotik.com/wiki/Manual:S ... t#SSH-exec

sebastia

Hey

two options:
* lte passthrough
* or just route (and don't nat) traffic to lte modem. lte modem would need to know how to reach your internal network, so you'll need to add route table entries for internal ranges.

sebastia

At any given time, the bandwidth should not fall below this committed rate That's from manual, not mine. What I think is meant: the total bandwidth of the interface should be at least the sum of "limit-at" see examples here https://wiki.mikrotik.com/wiki/Manual:HTB if you reserve 1M (limi...

sebastia

Hey "Limit-at" of a queue is always respected (even if it doesn't make sense). So yes you can use it to guarantee assignment, but be careful wrt total bandwidth available. "CIR (Committed Information Rate) – (limit-at in RouterOS) worst case scenario, flow will get this amount of traf...

sebastia

Hey

1. use simple queues: these relate to the local user(s) = target
2. what's "vpv"?

sebastia

It's an active device, product page mentions it already = Gigabit Passive Ethernet Repeater. repeater = 2-ports switch => datagram receiver and re-transmit.
I don't see how this would introduce noise.

sebastia

See https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack Fasttrack bypasses among other things, simple queues. But you could enable (=> flag) connections for fasttrack selectively. These will then bypass mangling as well. Total output can then be controlled by Queue Tree attached to outgoing interface...

sebastia

Hey

Do you ship to Belgium?

Looks like your mgmt network and guest vlan are hosted by same bridge. Only difference is that vlan is tagged. Question: is that vlan untagged somewhere and offered through access port?

Note: mgmt ip is linked to interface ether5 instead of parent bridge

sebastia

try this

/ip dhcp-client set use-peer-dns=no [find]

sebastia

Hey As I understand your goal, I would put the "old" devices in an isolated subnet / vlan and not allow any outgoing traffic. I would also put fileserver in there, so it's accessible to these devices. Then within firewall only allow traffic to that fileserver's ip, using stateful firewall:...

sebastia

Hi I see two options: * disable arp on the relevant interface: this will prevent unknown client from accessing router. This could mean no dns/dhcp/... But its not "air-tight", client could configure a static ip. Further client will still be able to contact other clients on same subnet., ov...

sebastia

Hey @elico, you obviously use sub-optimal config for your hardware.
Furthermore, the link you provided suggest 1Gbps routing performance for gr3...

Wrt testing, have a look at https://mum.mikrotik.com/presentations/ ... 080654.pdf & https://youtu.be/rQX0inNcPuM

sebastia

Hey

I would do a loop with "foreach" over all entries of a list given by find.

:local vlans [/interface vlan find interface=<interface> ];
:foreach vl in=vlans do={
# do some magic
};

See also https://wiki.mikrotik.com/wiki/Manual:Scripting

sebastia

I wouldn't recommend it from economy point of view, but also being completely on your own / unsupported config. Get some off-the-shelf mesh wifi, which already had some prime time, and received some firmware updates. I don't have experience with any, so google is your friend: https://www.google.be/s...

sebastia

dnsmasq will do exactly what you need, and a gr3 (+other hw) with openwrt can run dnsmasq

sebastia

Hoi

Mikrotik has hinted at a mesh product, but it hasn't been released/offered yet.
You could do it on your own (with some multi radio devices), but I wouldn't recommend it.

sebastia

Hey

You should at least share some configuration details (queue config, topology, ...) for others to be able to help you. Your intent is clear, but your environment is not.

sebastia

tcp connection is the first step in establishing a vpn session. Then comes authentication of the server and user, and finally ip layer configuration.
this just means that somebody established the first step.

sebastia

Hi I think it would improve readability of how interfaces are presented in Winbox, if the ports, members of a bridge, would be presented as children of that bridge. Just like it's the case now for vlan interfaces linked to an interface: these are shown right under the parent interface, and indented....

sebastia

sure, almost all switch chips used by Mikrotik support mirroring.
https://wiki.mikrotik.com/wiki/Manual:S ... troduction
https://wiki.mikrotik.com/wiki/Manual:S ... _Mirroring

sebastia

did what? the above is NOT an instruction what to do

The instruction was: "why don't you just stick to default firewall, it's more that enough in this case..."

sebastia

upload queue needs to be attached to WAN interface, the queue type used needs to be pcq-upload, for that type define src-address as grouping criterium

download -> LAN interface -> pcq-download -> dst-address

and no need for mangling

sebastia

Yes: there is no stack optimisation (=fasttrack) for ipv6

sebastia

Indeed noticed, edited post

gr3 should be able to do close to 1gbps cpu-wise, you're nowhere near that, so there must be something else that's causing it.

sebastia

Some interesing parts:
* why queue with 1GBS = interface speed?
* dns server on PRIVATE=WAN? -> just forwarding to upstream

Other than that looks default.

Search found 1782 matches