MikroTik

ivugrinec

Hi,

Does anyone know a reason why would Routeros 7.11.2 keep dynamic ipsec polices from l2tp/ipsec server. There are no L2TP/Ipsec clients connected.

ivugrinec

Just wondering, what is the reason for the change of SSTP with WG? Reason?

ivugrinec

Thank you sob, mkx. The thing is that this has been observed on other (not just WG) mangle's of output chain. I cant' be sure, as i am not on a level you are - but i believe that this part is somewhat different than it was on RouterOS 6. I've started to notice the issues with mangle and output chain...

ivugrinec

Beautiful. Spot on.
Not only it works, i now understand why i didn't work before and there is basic understanding of the routing process here.
You are more than awesome. Kudos!!

ivugrinec

Can someone please try to explain why is that; for Wiregurad in RouterOS 7.1.3 as observed in postrouting log when using mark connection, mark packet and mark routing to route the traffic through PPPoE interface with static ip address there is NAT translation active and therefore the src port is wro...

ivugrinec

Simple question:
On Lora devices tab, i can select "Network Server" from the "Network servers" list.

What happens if i don't select anything? I can enable the LoRAWAN server without selecting. Do they send the data to ALL from the list? Or NONE from the list?

ivugrinec

Is there anyone with long boot delay issue on CCR1036 (or any other Tile)? After flashing firmware 6.49 (RouterOS 6.49) we have very long boot time with our router. Check installation is OK. Router boots but it takes about 8minutes or so. I am unable to test it with default config as this is my only...

ivugrinec

Any progress here?

ivugrinec

Hi, I have an ISP router with several ETH ports. One of this ports is connected to Mikrotik CCR1036 eth1 port. I've added the standard bridge interface named br_pfSense to CCR. Also i added - eth1 as part of the br_pfSense bridge - vlan201 interface with VID=201 as part of the br_pfSense bridge. lea...

ivugrinec

Is this also true for the UDP "connections"?
For example if i have some kind of UDP server behind NAT, would conntrack resolve UDP "connection" and the return IP would be the 220.220.220.3?

ivugrinec

I'dont think you completly understood what i wanted to ask. I will try to explain better: I would like to understand if DST-NAT maintains a NAT connection and return packet of already established connection will obey NAT table entry or it will use the PublicIP set SRC-NAT rule? EG: WAN1=has 220.220....

ivugrinec

When a mikrotik router has multiple WAN facing IPs on the same interface what dictates the source IP when traffic leaves the router..? 1. Traffic generated by the router itself? - The Pref Source defined/listed under default route. 2. Natted traffic using masquerade? - The same as the pref source. 3...

ivugrinec

ivugrinec

Is it possible to extend this setup (export attached in previous posts) to allow communication with host (firmware server) that each unit could establish connection? Example: Unit1 is on port1 and has an IP 192.168.0.100 Unit2 is on port2 and has an IP 192.168.0.100 .... UnitX is on portX and has an...

ivugrinec

It works great. Thank you.

p.s If i remove the IP's as suggested, things don't work anymore.

ivugrinec

Hi, i started using this solution and it works great. I have one little extension of the problem and hope you could help me yet a little bit. Devices can access internet quite nice. I installed NTP server extension packet and enabled unicast. It looks like the client devices with current rules canno...

ivugrinec

First, thank you for trying to help, but i don't think suggested solution will work for me. Let me try to describe the situation: I have CCR router with several public IP's (one subnet). That several public IP's all have the same gateway. When some client sends packet to my network, ho send's it to ...

ivugrinec

Hi, I need a little help. I have a Mikrotik CCR router with interface that has several public IP's. I also have DST-NAT rules (port forward) where i use public IP's and port forward (DST-NAT) external ports to internal server. I need to achieve that a return packet is sent with SRC IP = public IP th...

ivugrinec

Hi, I need to add a specific DHCP option to my DHCP server (On RouterOS). I need to add this (linux example): option root-path "10.0.1.4:/var/tmp/rootfs"; I've done this: /ip dhcp-server option add code=17 name=root-path value="'10.0.1.4:/var/tmp/rootfs'" and added this dhcp-opti...

ivugrinec

It works ! Thank you for all the help.

ivugrinec

Well, i with all the help form Sob and other fellow - i didn't get far. Can you elaborate your idea? I am willing to try.

ivugrinec

Thank you, but sorry to say - it still does not work. Can you please try?

ivugrinec

@ jspool Well, not quite the IoT device - it's a data collector for IoT sensors we have been asked to design and produce. The default TCP/IP settings need to be tested before packaging and shipping. We need to test hundreds of devices per day - while every device has the same (static) IP address 192...

ivugrinec

Hi, first, I am the client! ;-) I'am very well aware that this goes against all ISO/OSI Layer and TCP/IP standards. But Mikrotik has very powerfull mangle facilities. In need this in our production facility (factory). I've been able to create a way to access EVERY IoT device on the same network (usi...

ivugrinec

Hi, I've been ask to find a way to allow several devices with same static IP address/subnetmask/gateway to access internet. Is there a way to do it? Mangle? DST-NAT, SRC-NAT? So i have a bunch of IoT devices need to be able to access internet over NAT. I have a same device with same IP settings (fix...

ivugrinec

Hi, I am not an expert but, if you are willing to try i can suggest this as a possible solution. First, you shoud create a configuration for 5Ghz network (SSID, channel ..etc) Then you should create two provisining rules. One for 2.4Ghz and one for 5Ghz network with 2-4-config for first provisioning...

ivugrinec

Hi,

I am interested in this change log entry:

!) bridge - reverted bridge BPDU processing back to pre-v6.38 behaviour; (v6.40 will have another separate VLAN-aware bridge implementation);

What happened? Is there a thread about this?

ivugrinec

In RouterOS 6.22 CAPsMANv2 frequency auto-select does NOT work. Every provisioned CAP lands on the same frequency. I haven't tried v2 but it works for me on v1. Did you try it on v1, and did it work for you on v1, too? One thing that I have noticed is that if I boot up all of my CAPs at the same ti...

ivugrinec

I have a 951G-2HnD and a cAP2n both running 6.22.

I downloaded wireless-cm2-6.22-misbe.npk and pushed it to both devices.

The 951G happily installed the package.

The cAP2n ignores it.

What did I miss?

j

Did you enable CAP on a wireless interface?

ivugrinec

There is a bug in 6.22. Auto select frequency on CAPsMAN v2 does NOT work.

ivugrinec

In RouterOS 6.22 CAPsMANv2 frequency auto-select does NOT work. Every provisioned CAP lands on the same frequency.

ivugrinec

I have CAPsMAN in one of our public Highschools. 12 caps. We use EAP-TLS. Works great. CAPsMAN really deserves improvemnts. It is a great addon to RouterOS. It would be great if one of the next releases would include the current (latest) version of CAPsMAN. Uldis, is there a roadmap of CAPsMAN devel...

ivugrinec

Any changes on CAPsMAN?

ivugrinec

Currently you can't use EAP-TLS with the CAPsMAN, but you can forward the EAP authentication to your RADIUS server.

Regards,
Uldis
(answer received via support ticket from Mikrotik)

ivugrinec

Anyone? I've sent exact question to Mikrotik support but no answer.
I can't find evidence or any statement, official or unofficial about anything related to CAPsMAN and EAP-TLS.
Funcionality should be allready embeded in current CAPsMAN as this is indicated through winbox.

ivugrinec

We need CAPsMAN sooo badly.. Please make it work just a little bit better. We just need to be able to configure EAP-TLS. No new features required. I've read your posts that new CAPsMAN is not quite ready. I respect that. But can you make "develepers" edition available? We need EAP-TLS badl...

ivugrinec

Does this work? has anyone been able to make it work? If yes, how and where do you select certificate and make it "verfy certificate"?
Anyone? Any info?

ivugrinec

Anyone? Any hints?

ivugrinec

Hi,

Is there a way to read or calculate WHEN will trial user with expired trial (2h/1d) be able to login again?

E.G. user log in as trial. After the trial period expieres, he asks: when will i be able to connect again?
How can i find out the answer?

ivugrinec

Hi, memory usage is minimal. I have sent supout to support. No response yet.

ivugrinec

Thank you for trying to help! No, i dont have anything connected to USB ports. Is it possible the PC NIC (windows XP with virtualbox and virtual linux instance running on virtualbox) create the kernel issues? there is freeradius instance running on virtualbox. Mikrotik is configured to send hotspot ...

ivugrinec

Mikrotik router model 2011UiAS is having critical system error. System reboots because of a kernel failure. We ordered and deployed the second replacement unit but it has the same issue. What can we do? Any advice? Can configuration exported from one unit and imported to a backup unit create the sam...

ivugrinec

Tried that. It does not work.

ivugrinec

Does CAPsMAN support the EAP passthrough configuration of CAPs? This is the configuration of Security profile Applied to standalone AP radio. Can this bi configured via CAPsMAN? name="SecProfEAP-Win2008R2" mode=dynamic-keys authentication-types=wpa-eap,wpa2-eap unicast-ciphers=aes-ccm grou...

ivugrinec

Same problem on my network. Any advices?

ivugrinec

Are you sure that the upstream ISP doesn't filter certain ports? I have changed the ports to 80, 81, 82, 8080... I have alse checked with the upstream ISP selfservice web site. There is an option to use the ISP firewall, bit it is OFF. I usually use lots of different ports like 22, 222, 1194 .. no ...

ivugrinec

I suggest that you test the port 82 forward on the "working" web site and then return it to the "problem" web site. If the web sites are on the same server and the forward works for one then it should work for the other. Perhaps there are absolute address references in the sourc...

ivugrinec

DId you really mean that the web server is establishing a PPPoE connection or is the PPPoE DSL connection being handled by the Mikrotik unit? Yes, Mikrotik RB is classic PPPoE router and is default gateway for all computers and linux server. Port 8080 is often used for caching. Have you checked tha...

ivugrinec

Hi guys. I have a task to debug why one specific web site doesn't work via port forwarding. What i have: 1. server behind mikrotik with mikrotik router as default gateway. Access to the internet from server is established via PPoE aDSL connection. 2. working script which dynamically updates hostname...

ivugrinec

Can you please give some more detail ... I am stil having similar problems..
Log:

radius,debug,packet Reply-Message = "no valid profile found"
Any advice where to start debuging.
I am trying to setup PPPoE server with radius..

ivugrinec

Thanks guys...

ivugrinec

I am concerned that the open MMCX connector would lead to transmitter damage (because there is no 50ohm load). Can anyone else confirm that it is safe to leave the J5 open?

ivugrinec

Hi, i have spare R52Hn miniPCI card that have two MMCX connectors. I would like to connect chain0 (J4) to Grid parabola antenna. What do i do with chain1 (j5)? Do i need to terminate it with 50ohm load or is it enough to disable the chain1 in RouterOS?

ivugrinec

This works for me. It is not for DynDNS but you can use it for ChangeIP.com. # Written by Sam Norris, ChangeIP.com # Copyright ChangeIP.com 2009 # For support send mail to Support@ChangeIP.com # # 2009-06-22 RouterOS 3.25 Tested # 2009-10-05 RouterOS 4.01rc1 Tested # # OVERVIEW: % # This script will...

ivugrinec

I have a simple antenna questions with maybe not so simple answers. Please help. 1. Between two 5.4Ghz GRID parabola antennas with both having 21dBi gain the better antenna is the one with bigger grid? Does the fact that they both have 21dBi gain make them comparable in performance? 2. Patch antenna...

ivugrinec

Nice post, thank you.

What about standards? Does MIMO work only on 802.11n? What about other standards (nstream for example)?
Does MIMO pay's off? Some experts on this forum say that MIMO can give you 10%-15% max and if you are realy lucky.

ivugrinec

Ohh.Ok.. Does MIMO mean that one antena is V-Pol and the other is H-Pol? Or does MIMO mean both antennas are both H-Pol (or V-Pol)? Does the other side of PtP link need to follow the same scheme? IF YES Does the ITELITE 5GHz enclosure allow adjusting the polarization of antennas? For example rotatin...

ivugrinec

Did you found the answer to this question?

ivugrinec

... and while we are here.. What about the other mmcx connector? Do we need to disable it somehow? On RB52Hn anitstatic bag there was some kind of warning. It said something like:it is not advisable to leave connector without 50Ohm antenna while transmitting.

ivugrinec

what's the difference between two vlan's:

one created with

[admin@MikroTik] /interface vlan> add name=interface_vlan vlan-id=1000 interface=eth03-wifi

and

24.8.2011-2.png

ivugrinec

Sorry, but i did not understand your advice.

This would be the network diagram of such setup? I tryed this but i dont know how to establish VLAN trunk between RB750G switch and RB411AR AP.

ivugrinec

I have a router (RB750G 5 port router/switch). And i have a RB411AR based AP. If i create Virtual AP-s what would be the easiest way to isolate each VirtualAP (VAP) and forward all trafic to RB750G PPPeE connection? So, ROUTER (RB750G) is connected to ADSL modem on ether1. On ether3 via cat5 cable i...

ivugrinec

OVPN Client works better on v5.3

ivugrinec

we managed to fix this problem before version was released, so fix will be included in v5.3

I've tested the pre-release v5.3 (link from support) and the BAD_DATA problem was still there.

ivugrinec

But why would you release a router firmware version with broken (buggy) package?

ivugrinec

I got a replay form support today that they have been able to reproduce the error. Hope they will find the fix soon.

ivugrinec

tested 5.3 release. Problem still exists. Also sent supout files to support team.

ivugrinec

Contact support. Downgrade to 5.0

ivugrinec

Did that...

ivugrinec

Where can i create a bug report?

ivugrinec

OK, great...

ivugrinec

Do i need to report the ticket also?
Can i see the results of your ticket? Is it open for others to see and if yes.. where is it?

ivugrinec

RouterOS 5.0 - OpenVPN client on RouterOS connects every time to OpenVPN server on LinuxBox. ----- After upgrading to RouterOS 5.1 and now RouterOS 5.2 without changing the connection settings OpenVPN still connects OK but ONLY after i reboot my Mikrotik 750G. Then if i disable the open-vpn client a...

ivugrinec

I have a problem entering a "complex" password into Mikrotik RouterOS via WinBox for IPSec PSK Auth Mode:
The password looks like: a§\*t2,\8_k
The problem is that i do not know how to type the second character. I can't even paste it. What can i do?

ivugrinec

Would that happen because one of two possible reasons:?

1. Mismatched password?
2. Old Netgear router is still connected and new router cannot connect until the old one is disconnected?

ivugrinec

I need help. I need to replace NETGEAR FVG318 router with Mikrotik RouterBOARD. I need help transferring IPSec VPN configuration to Mikrotik IPSec conf. Netgear router connects fine, here are the logs: 2011-02-22 : INFO: Flushing SAs for peer "XXX.XXX.dest.ip" with spi 1422077629 2011-02-2...

ivugrinec

On remote server ping at some point there is an entry in log:

malformed cookie received or the spi expired

Any thoughts or ideas?

ivugrinec

Does this looks like established IPSec VPN? [admin@MikroTik] /ip ipsec> installed-sa print Flags: A - AH, E - ESP, P - pfs [admin@MikroTik] /ip ipsec> installed-sa print Flags: A - AH, E - ESP, P - pfs 0 A spi=0 src-address=xxx.xxx.xxx.xxx dst-address=xxx.xxx.xxx.xxx auth-algorithm=none enc-algorith...

ivugrinec

Solved by adding masquerading to PPtP connection.

ivugrinec

1. Created PPPoE connection to ISP xDSL, Desktop client works fine, can access internet OK. 2. Created PPtP VPN connection. PPTP connection is established OK. I can ping remote VPN gateway computer from my RouterBOARD console. That works fine. 3. The problem is that desktop computers on NAT-ed local...

ivugrinec

Thanks. I just need one connection and switching + routing functionality (at the same time).

ivugrinec

Thank you for the answer. Is that all? What about the functionality restrictions? Will 750G suffice for my needs (stated above)?

ivugrinec

What is the diffrence between 450G and 750G boards? Why is 450G more expensive than 750G. Thanks for answers I would like to buy one of them. I need PPoE client to ADSL provider and Gigabit Ethernet switch at the same time (at minimum). I also need static routes and port forwarding. It wolud be nice...

Search found 83 matches