MikroTik

bkuhn

Are you running a dynamic routing protocol across the backbone or are you static routed?

bkuhn

Your config looks good, but I made a mistake. The NAT entry should be srcnat not forward.

ip firewall nat add src-address=192.168.3.0/24 action=masquerade out-interface=ether2 chain=srcnat

bkuhn

I have never worked with an AirPort router, but are you sure the guest VLAN is routable? For example, are you sure the guest VLAN isn't just a network that is local to the extreme? If the extreme is like other consumer grade APs (Netgear) they create a guest SSID but it is only an internal network f...

bkuhn

RouterOS is a routing platform by default. All interfaces will be layer3 interfaces unless you have added any master/slave relationships or added ports to a bridge interface. To set an IP address on an interface: ip address add interface=ether1 address=192.168.1.1/24 netmask=255.255.255.0 To NAT tha...

bkuhn

I don't think it is a DNS issue because your client is going to resolve the name when you first start the ping. The name is then cached locally until the TTL is reached for the DNS entry.

What happens if you stop the ping when it's failing and start it again?

bkuhn

https://www.arclab.com/en/kb/email/list ... -list.html

bkuhn

Force all clients to use your DNS server. Add static entries for gmail to go nowhere. (127.0.0.1)

bkuhn

When you install the ADDS it will also add the DNS role to the server.

Set the MT DHCP to use the AD domain controller IP address as the DNS server.

On the AD DC set DNS to forward requests to the MT IP address.

Hopefully that makes sense. If not let me know and I can post some screen shots.

bkuhn

Are the ports supposed to be tagged or untagged VLAN members? (are the devices plugged into the port VLAN aware?)

bkuhn

RouterOS is a very powerful routing platform. It does have an option to scan for a wireless network and select the one you want to connect to. There are a lot more options and flexibility with RouterOS, but if you are looking for a simple product to click 2 buttons on a web page and connect to a wir...

bkuhn

Can the RB2011 handle 200Mbps with NAT, Firewall, etc? I don't think you will get that much speed out of a 2011.

bkuhn

Yes, a RB2011 can handle what you have in your topology.

What part do you need help with?

bkuhn

Are you wanting to send all traffic over the IPSec tunnel or just traffic to certain subnets?

bkuhn

That app is using the MAC address of the AP to determine who the manufacturer is. You could change the MAC address of the wireless interface to make it look like something else, but there isn't a way to fool the app into saying anything different. The AP isn't broadcasting that information, the app ...

bkuhn

What ports are you using on the 2011? Ports 1-5 and 6-10 are on separate switch chips. Here is a typical setup: ether1-gateway = to ISP ether2-5 switched by switch chip 1 ether6-10 switched by switch chip 2 bridge-local contains ether2 and ether6 In Winbox, open interfaces and choose ethernet. Selec...

bkuhn

You could remove eth2 from all bridges, then go to ip > addresses and assign an address (192.168.0.2/24) to eth2. This would enable routing between the 2 subnets.

bkuhn

Sounds like you are looking for a feature like the Cisco startup-config and running-config.

What about a script that runs on boot of the MT and removes the firewall rules?

bkuhn

PoE+ on the UBNT switch should be 802.3af compliant. It should not be 48v passive.

bkuhn

What do you have listed in IP > Firewall?

bkuhn

Did the clients already have an active connection when you disabled the rule?

Without that masquerade entry, your clients shouldn't be able to access internet unless there is something else on the network (maybe the ISP modem) providing NAT or the clients have static IP addresses on the internet.

bkuhn

Do you have clear line of sight between locations?

bkuhn

Do you have telnet/ssh acces to the RB?

You could try blocking the winbox port or disable the winbox service then re-enable it.

bkuhn

You could create a skin for webfig, but that is just a view so if the user were to poke around they could still access other settings.

The best option would probably be to setup a metarouter and manage the wireless from there.

bkuhn

Is your DHCP client on ether1 receiving an IP address from the Comcast modem?

bkuhn

I have the setting in my bridge set to proxy-arp and I can see all devices on the lan through the bridge.

bkuhn

Are you seeing any devices via arp at the client when .238 is assigned?

What happens if you run a trace route from the client with .238 then .239?

bkuhn

ppp secret unset 0 remote-address

bkuhn

Re-read my post. I did not create a vlan on the bridge interface. Create a vlan on your uplink interface then add it to a bridge with the PC interface.

bkuhn

Add vlan20 to ether1

Interfaces > vlan tab > add
Name=ether1-vlan20
Vlan id=20
Interface=ether1

Add a bridge
Bridge > add
Add ports
Bridge > ports tab > add
Ether5
Ether1-vlan20

Plug your PC in and you should be good.

bkuhn

I just setup a quick lab with a couple of PicoStation M2HP's I had sitting around. My instructions above will do exactly what you are looking for. To build on the explanation, on the UBNT side, network tab you want to select advanced as your configuration type. Expand VLAN down the page and add vlan...

bkuhn

Okay, that makes more sense. I believe this will work, but I can verify when I get home. This weekend I didn't have any UBNT radios at home to test with and now at work all I have available are a couple of MT x86 boxes and a few RB411 that don't have enough ethernet ports to set up a lab here. This ...

bkuhn

Your explanation is confusing to me. What is the end goal? When you say management bridge port are you talking about wireless bridge between locations or an actual bridge interface in the MikroTik?

bkuhn

What about setting up a VPN server on the MikroTik? Then you could be on the local network remotely.

bkuhn

Most likely not possible. The IP address you are assigned still belongs to the ISP, you are just "leasing" it. The MikroTik can certainly load balance / failover between 2 ISP connections easily, but it would not be transparent for the external clients connecting to you. The best option to overcome ...

bkuhn

I asked about the possibility of an iOS app for management, but it sounds like MikroTik is only interested in Webfig for those devices.

bkuhn

If you have access to the upstream routers, you can route the traffic.

If you don't have access to the upstream routers, I would look at NAT for the 192.168.201.X subnet.

bkuhn

My home connection is about 10Mbps/1Mbps but I don't need speed, I need the possibility to access the lan behind the router to control pc and devices as if I'm in local... So RB2011 is ok? But can I use it also for Wakw on Lan to send magic packet? Thank you very much! Yes RB2011 will give you a ni...

bkuhn

What speed is your incoming connection at home?

If not more than 100Mbps, I would recommend the RB2011. That's what I use at home and it has a PPTP server running so I can connect and access my LAN from work.

bkuhn

We've had the same issue before, unfortunately it is a limitation to the remote side's router/firewall.

The solution is to setup a separate SSL VPN or try L2TP/SSTP on the MikroTik since they use port 443.

bkuhn

We use Streakwave. http://www.streakwave.com/ They are strict about giving credit, but they have an application you can fill out. We were in the same boat, needed a distributor that would accept PO numbers. It also looks like Microcom Technologies resells MikroTik. We purchase Microcom equipment thr...

bkuhn

I am lucky in the sense that I have some space between me and my neighbors. I can only see one other network in the far corner of my house so not much interference. I just run my 2 APs on channel 1 and 6 with the same SSID on both and let clients roam on their own. Works well for me. Also, just as a...

bkuhn

Just took a look at the CRS109...

That will be on my list to upgrade my router when it's time. Get that over the RB2011. Looks to be an upgraded model. As long as the hardware has the bugs worked out of it, that sounds like the way to go.

bkuhn

I don't personally have experience with the CCR line and I have never worked with the CAP either. I really prefer the Ubiquiti line of devices for WiFi distribution and the Tik devices for backhaul/point to point outdoors. I am currently running a RB2011 with a single UAP-Pro at home now. You will n...

bkuhn

Depending on wireless needs, I would recommend a RB2011UiAS-2HnD-IN as the router and possibly 2 x cAP 2n as access points in Lounge and Office. The cAP's can be managed from the RB2011 so the wireless SSID and security settings can all be changed in one place, on the RB2011. If you are looking for ...

bkuhn

The PicoStation is single chain.

I have a RB2011 at home, wireless performance is better than my previous 2 routers.

bkuhn

You're looking at the wrong hardware, it's a router at heart.

I would recommend looking at Android based tablets and Bluetooth scanners. You will probably be a couple hundred dollars into each, but way more flexibility.

What about using a USB over Cat6 extender?

bkuhn

I'm a fan of the RB2011 hardware. I have several of these deployed RB2011UiAS2HnDI running site-to-site IPSEC VPNs.
That model has wireless included, there is another variation of the same case/routerboard without wireless.

bkuhn

I will admit, I don't know anything about REGEX expressions.

Could you please tell me how to form the REGEX expression if I wanted a specific domain DNS redirected? Using your example above, it would be domain.com instead of domain.local. What does the /05x mean?

bkuhn

You need to enable NAT for your VPN client or assign them an Internet routable static.

bkuhn

Yes, as long as the 2 ports are not bridged or switched, they will be routed. When routing it keeps the network on separate broadcast domains. You are still limited to the capacity of the MikroTik, but for a SOHO you should be fine.

bkuhn

What is the ether config like? Are the ports switched or bridged?

bkuhn

I've had this happen to multiple 411 boards. Hopefully these are not still in production because running on 12v is a Band-Aid. They will eventually fail completely.

My 411's had multiple bulged caps and 2 were leaking.

bkuhn

Yes, these are both possible. Have you looked at IP > Firewall > NAT yet?

You can set source IP, protocol, port, etc. and masquerade to a specific IP address.

bkuhn

Are the PCs on the 14.X network using the MikroTik or the ADSL modem as their gateway?

bkuhn

Are you running NAT on the RB2011?

Could it be CPU maxing out on the RB2011? Bridging will use CPU.

bkuhn

I am happy with the RB2011.

I have a few of these:
http://www.streakwave.com/itemdesc.asp? ... DI&eq=&Tp=

bkuhn

I recently started a topic about a similar issue, resolving DNS to "local" DNS servers when a PPTP client came up. I couldn't find a simple way to do it. Somebody mentioned using a Layer7 filter to redirect DNS requests for a specific domain name to a different DNS server, but I couldn't make it work.

bkuhn

They are mainly windows hosts I am trying to resolve, but one of the networks is a small office and all PCs are part of a workgroup. Mikrotik is handling DNS for that office. I would like to be able to resolve computers by name on that network from my laptop connected over the PPTP tunnel. I'm start...

bkuhn

I'm guessing that probably relies on the dhcp client to have use peer DNS checked? EDIT: Yeah, I don't know what my options are...I'm starting to think I might have to script it. One of the tunnels is connected to another RB2011, and I checked the PPTP server and it is handing me DNS server address,...

bkuhn

Well that makes sense why I missed it

Where would I see the information that is passed to my PPTP client from the server? I can see the IP address my looking at the interface, but where can I see if DNS is being advertised by the PPTP server?

bkuhn

I will give that a try when I get home, don't know how I missed that option...

I'll update the post either way. Thanks for the idea!

bkuhn

I am trying to configure a couple of PPTP dial on demand tunnels on my RB2011 at home. Both tunnels come up via my mangle rule and they disconnect with my idle timeout which is nice. My issue...how do I handle DNS resolution? I would like to leave my DNS server set to my home 'Tik and be able to res...

bkuhn

So Wireshark pointed me to the culprit tonight... it was MikroTik discovery protocol probing the PPTP client interface.

So far everything is looking good after disabling discovery protocol on that interface.

bkuhn

I tried that but must have done something wrong with rule creation.

What should the rule look like?

I did chain=forward src=255.255.255.255 out int=pptp interface action=drop

bkuhn

I was playing around with my RB2011 tonight and thought I would create a PPTP client connection to another RB2011 I have deployed at another site. Got the PPP interface configured, set as dial on demand, got routing squared away, NAT enabled, Mangle rule added for a single remote subnet, and everyth...

bkuhn

btest is the bandwidth test utility MikroTik has available for download.

Checked flow control, it is off for tx and rx.

I have another RB2011, maybe I'll connect it via gigabit and run a bandwidth test between the 2 ruling out the Windows boxes.

bkuhn

I was testing throughput with the btest utility between a Windows host on ether2 and the RB2011 with all gigabit ether ports in a bridge group and I was only hitting 80-90Mbit/s at 95% CPU. I was thinking doing my half ass workaround would bypass the CPU for all switching. I also tested between 2 co...

bkuhn

Quick question for the guru's... I know this is an old post, but it is relevant to my issue. Would this be possible? ether1-gateway bridge-local > ether2-master, ether3-5slave interfaces > ether6-master, ether7-10slave Then take a physical cable between ether5 and ether6 bypassing the CPU for switch...

bkuhn

Stopped by a small business that I support last night to swap their core router. Got there about 10pm planning on a fairly simple, straight forward swap to the 'Tik (preconfigured by me). Took a few minutes to jot don't any last minute note (DHCP reservations, port forwarding, etc) and when everythi...

bkuhn

There aren't going to be very many devices (less than 50 mobile units). They will all be Symbol or Intermec wireless scanners.

bkuhn

Hello, We are currently looking at a project to blanket a 27 acre area with wireless coverage. We have light poles with 110V power spaced conveniently throughout the area. My thought was a RB433 with 2 R52H cards installed. One for a wireless backhaul in 5Ghz to a central onmi, and the other for a 2...

bkuhn

Bump...

Nobody has run into this setup before?

bkuhn

Hello, I have been trying to figure this out, but can't seem to get it to work. We currently have a Cisco Aironet AP 1300 configured as a root bridge. I would like to associate a RB411 to the AP 1300 as a CPE unit to connect an offsite building to out network. The Cisco is setup to use the following...

Search found 73 matches