MikroTik

900mhzdude

I fixed this on my own it was a simple encryption misconfig and also as you mentioned about the wrong src address

I now have it working with 256 aes encryption

thanks to everyone that helped

900mhzdude

first off thanks for your help 2nd I'm not stubernly refusing to post the full config I just don't have the time to edit the full config right now as its huge I have posted all the short configs you have asked for and I replaced the public IP with "removed" the Mikrotik is sitting on a pub...

900mhzdude

seems my issue now is the default ipsec polices uses port strict and I'm behind NAT

is there a way to change the default as you guys told me to remove the polices that I made..

900mhzdude

getting the mikrotik phase 1 negotiation failed due to time up error now

900mhzdude

OK, So Now when I try to conenct from ether windows 10 or an android I get in the ipsec debug -agreed on pre-shared key auth then it keeps resending packets "sent phase 1 packet (VPN Server IP)[500]<=>(IP of clint)[11809] it retrys he same thing over and over and re send them a few times after ...

900mhzdude

the other issue is I'm out of the country and the firewall is blocking the country I'm in so each time I need to test I have to contact somone in the states to test the VPN if somone understands the country access list (I did not Make it) if you can please give me a terminal command to allow my WAN ...

900mhzdude

So Do I delete the IPsec policies??

what do I need to do to fix it?

I'm a neewbie when it comes to mikrotik sorry

900mhzdude

also that set commnad dose not seem to work

but I already have ipsec debug enabled for the logs

900mhzdude

when client tries to connect I get ipsec error "IP" peer sent packet for dead phase2

that is the only error in the log I see for a client trying to connect

900mhzdude

OK, so I removed what you said

But when I re-enabled the L2TP server the log is showing failed to bind to ::[500] bad file descriptor

and VPN is still now working

thanks for the help by the way

900mhzdude

there is the firewall yes I know its a mess fixing it is a work in progress

900mhzdude

900mhzdude

here is the interface # aug/05/2019 06:46:20 by RouterOS 6.45.1 # software id = A4X7-ER4H # # model = CCR1009-8G-1S-1S+ # serial number = removed /interface l2tp-server server set authentication=mschap1,mschap2 default-profile="L2TP Remote Connection" \ enabled=yes ipsec-secret=removed kee...

900mhzdude

the output is from

ip ipsec export file=

and

ppp export file=

I don't know why there is missing information

I have tried the port settings both ways

the ports are open in the firewall I just tried the override in hopes it would push things through

900mhzdude

Here is the config after I followed online how to guides if you guys can please tell me what I'm doing wrong our road worriers really need the VPN back Thanks! PPP Config # aug/05/2019 05:16:53 by RouterOS 6.45.1 # software id = A4X7-ER4H # # model = CCR1009-8G-1S-1S+ # serial number = removed /ppp ...

900mhzdude

Our working config was scrambled in the upgrade in the ipsec section I have followed the tutorials best I can redoing L2TP ipsec road worrier with 256 encryption Clinet trying to connect gets unsuccessful And the ipsec server logs say ike2 no configuration for the IP of clinet trying to connect I re...

900mhzdude

Hello, We upgraded from a very old version of RouterOS to 6.45.1 it completely scrambled the IPSec settings I have been trying to rebuild it following online how-to guides but the way IPSec settings are now in winbox are completely different than anything I can find online I turned on debug logging ...

900mhzdude

I ended up fixing this issue by finding the old firmware on a driver site

then importing the config and then I upgraded 1 version at a time all the way to the latest version

Thanks for everyone's help

900mhzdude

none of the files in that zip are working for me

what file would you use for a CCR-1009-8G-15-15+

Thanks for the help btw

900mhzdude

yes I checked there if you click on 6.34.4 I get a 404 error

900mhzdude

I exported the config file out of our core router we have a backup same make and model the issue is the main core router is running 6.34.4 the back up is running 6.40.8 I can't seem to downgrade it to 6.34.4 Mikrotik seems to have deleted the firmware from there website Not the owner just work here ...

900mhzdude

issue was someone enabled proxy arp and did not tell me added a bunch of odd things

900mhzdude

anyone?

I forwarded custom ports for both tcp and udp and its still not workin

900mhzdude

that apply when using public IP's?

900mhzdude

We route our public IP's to clients via destination address so we place a Mikrotik at a client with a route statement to .65 address in the public Pool then the client can use any Public IP the issue is the latest Mikrotik Stable firmware seems to block all ports except port 80 and 8080 client also ...

900mhzdude

So, From what I understand our consultant set up our public IP'swith the Destination address method so anything that anything that has a route to 72.x.x.65/27 can bridge one of our Public IP's the issue is internally everything is showing up as .65 the billing server is at .69 with an FQDN but clien...

900mhzdude

Hello, our network is a 172.19.0.0/19 our VPN DHCP Pool is 172.19.3.2 - 10 we are starting to get a short handful of (all have been in the static pool) IP's that will not let you access them over VPN Acts as if the there is an IP Conflict but if I change the IP on the device there is still nothing p...

900mhzdude

if I bridge eth8 the ethWan will this bridge whatever public I want to eth8 or will it create some type of loop?

900mhzdude

Anyone using a Mikrotik get Amplifies teleport to work? I'm getting stuck at the connection to the home network Amplifi Forum post here https://community.amplifi.com/topic/1420/teleport-with-mikrotik-not-working-please-help/4 I'm using a custom port and forwarded the ports in the firewall but its st...

900mhzdude

We are a WISP and we are doing 1:1 NAT with Proxy Arp to distribute our public IP's Normally I would set a Mikrotik at a clients house and bridge it with the IP we attached the Public to and works perfect the issue is we have a server plugged into our Core router I can't seem to get working I attach...

900mhzdude

Thanks for the help Issue was an IP conflict with the NAT side of our CPEs changed the office IP range to 192 and working perfectly now Now my issue is no matter what I do to lock down the guest VLAN to block access to the main network it can still reach the router other side of the EOIP I will play...

900mhzdude

nope not will all the Mikrotik security holes lately

I created a guest vlan trying to block it and the vlan works perfectly so I think I just need to create a vlan for it

thanks

900mhzdude

the tunnel is a bridge to the Core network side 172.19.0.0/19 I need to bridge the EOIP tunnel IP to my Local NAT (I Think) but not sure how to do it if I set my laptop a static on the EOIP Tunnel range everything works perfectly I just need a DHCP Pool on the remote Mikrotik that bridges the EOIP t...

900mhzdude

172.19.0.0/19 is the LAN side of our core network EOIP tunnel is 10.10.10.0/29 LAN Side of remote office is 10.0.0.0/24 if I give my laptop a static on 10.10.10.0/29 all works as it should but on the IP Pool (DHCP) 10.0.0.0/24 we can only talk to static IP's in the core network not to any of the DHC...

900mhzdude

an update

I can ping the DCHP Pool from our remote office inside the Mikrotik terminal

but not behind the NAT that is assigned to my laptop

900mhzdude

we moved to EOIP

everything is working but Remote access to our NAT Pool

can use help with that

Thread for that is here

viewtopic.php?f=2&t=141059

Thanks,

900mhzdude

VPN was not working for our remote office so we went with EOIP with OSPF we have a 172.19.0.0/19 at our remote office, we can access any static IP on the 172.19.0.0./19 but our CPE's (We are a WISP) get DHCP from Pool 172.19.10.0 - 172.19.12.0/19 anything in that DHCP Pool we cannot access from our ...

900mhzdude

We have the VPN server on a remote Mikrotik at our remote office I set-up a Mikrotik as an L2TP Client it connects and addresses shows it's getting a remote and local IP from the remote VPN pool but I can't access anything on our remote VPN can only ping the remote router but not open it or any othe...

900mhzdude

That's fine I have a mikrotik I can replace it with

Is it easy as clicking VPN client in the mikrotik and putting in the settings or am I missing something?

900mhzdude

I only see an option to setup EdgeOS as a VPN Server We have an off site office that dose not have a static IP for site to site VPN is there a way to setup Edgerouter as a VPN client to connect to our VPN Server on a mikrotik? We are currently doing L2TP on the mikrotik VPN Server see we are limited...

900mhzdude

UNMS is supporting NETFLOW This router is supporting 500 Customers if I enable Traffic flow on the Mikrotik Cloud core will it create a reboot? any issues to be aware of? running 6.34.4 yes I know its way outdated I have a 2nd unit with config and updated firmware we just can't afford downtime yet T...

900mhzdude

I did do that but it seems that some of the config is still missing like export did not actually export the full config hoping I'm missing something

900mhzdude

Config is 12537 lines long

yes the config is a bit complicated as it binds Public IP's to LAN IP's and I'm very new to Mikrotik

this is a Core router for a WISP so lots of little settings

900mhzdude

OK, I Downgraded to 6.40.8 per recommendation, if I try import file="backup.rsc" I get command error if I paste the full-text config into the terminal at once it reboots the Router and takes none of the config I pasted the first half of config and then the second half from the text file an...

900mhzdude

there are not any MAC Addresses in my export rsc file so not really sure what you're talking about... sorry here is more of the config maybe it will make more sense, thanks. (Note where you see "Edit" is me removing the name of the company and the Fiber Company) /interface bridge add arp=p...

900mhzdude

is there an application that will check config text for compatibilty?

900mhzdude

Thanks!

This is the next line not working

set [ find default-name=ether4 ] advertise=100M-full,1000M-full comment=\
"Database Server" master-port=ether1-Group1-Master name=ether4-Group1

900mhzdude

our in use cloud core is running 6.34testing firmware I have been tasked restoring its config to a backup cloud core router we have same Make/Model but running the latest 6.42 firmware did not do a full backup as I was told it would copy MAC of the old router tried export and import config, also tri...

900mhzdude

+1 for Linux Dude !

it ROS not a port of linux? I'm not seeing why it would be that
difficult

I'm sick of my Dude server getting hacked and would love to
run it on Linux not virus feeding windows

900mhzdude

I have the dude sending me Texts via SMTP to my cell phone
Problem is the texts the dude sends me are all from different
Phone numbers so they Don't group in my iPhone
due it it coming from random numbers

is there anything I can do about this? thanks

900mhzdude

I'm having the Same Problem I have looked all over the forum and wiki I cant get Vlan to Work this is the simple set-up I Need NS2------RB250GS Tag 110--------BH Slave-----BH Master------Trunk Port--------Pfsense I need to put this in tomorrow morning is there anyone that can help me off list? Thanks

Search found 51 matches