Community discussions

MikroTik App

Search found 202 matches

by Jeroen1000
Sun Aug 21, 2022 4:01 pm
Forum: General
Topic: Who's using multi mode and who is using single mode for 100G??
Replies: 2
Views: 482

Who's using multi mode and who is using single mode for 100G??

Hi guys, I keep on reading MM is a dead end. So I was thinking about running single mode fiber (20 meter run). I'd be using an MTP-8 cable and fan out to the 100G SFP. This way I could create 4 x 100G using 1 MTP-8 cable. Using multimode I have to use all 8 fiber strands so only 1x 100G is possible....
by Jeroen1000
Fri May 08, 2020 9:08 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 164
Views: 79278

Re: Just going to leave this here...

I have been running the math and this device does work out somewhat. In my LAN, I only have a 10 gigabit server, a 2.5 gigabit wireless backhaul (which realistically can go up to 1.4 gigabit) and a 10 gigabit desktop. All the slower 1 gigabit legacy gear goes to a CRS326-24G-2SplusRM with would upli...
by Jeroen1000
Fri May 08, 2020 12:49 am
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 164
Views: 79278

Re: Just going to leave this here...

@pe1chl I had read your comments earlier in the thread and I strongly agree. So many ports are begging for a switch chip to be more useful since the port-IO vastly exceeds the routing capabilities. A bit of a wasted opportunity. A cut down model (read: cheaper, maybe passively cooled and smaller) wi...
by Jeroen1000
Thu May 07, 2020 11:35 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 164
Views: 79278

Re: Just going to leave this here...

I do have a use case personally. With WiFi6 (802.11ax), useful speeds will exceed 1 gigabit/sec. And if you have > gigabit fiber internet (dreaming is allowed) that's 2 ports in use. Then a new NAS would likely also interface at > gigabit speeds. And hey, no separate switch needed which is a bonus i...
by Jeroen1000
Thu Apr 23, 2020 1:02 pm
Forum: General
Topic: Site2site IPsec tunnel dies overnight
Replies: 3
Views: 1544

Re: Site2site IPsec tunnel dies overnight

You may be missing an essential thing. IPsec adapts to the network path between the peers. If there is no NAT between them, it uses ESP (or AH, but that's not your case as you talk about a subnet to subnet tunnel) protocol as transport one; if there is NAT on at least one side, it encapsulates the ...
by Jeroen1000
Wed Apr 22, 2020 9:02 am
Forum: General
Topic: Site2site IPsec tunnel dies overnight
Replies: 3
Views: 1544

Site2site IPsec tunnel dies overnight

Simple issue, hard to find the real cause So I have this plain IPsec tunnel running between 2 Mikrotik routers A and B. A has 1 subnet behind NAT and B has 2 subnets behind NAT. There is no traffic over night. When a host behind router A contacts a host behind router B in the morning, it does not se...
by Jeroen1000
Thu Feb 20, 2020 3:58 pm
Forum: General
Topic: IPsec transport mode without GRE/IPIP tunnels
Replies: 0
Views: 1947

IPsec transport mode without GRE/IPIP tunnels

Hi all, Gotten pretty far by myself but I have something I am having trouble with. Apologies for stating the obvious in my explanations but a clear story is easier to read:) .......................................IPsec-traffic .......................................... LAN-traffic Road warrior (2.2....
by Jeroen1000
Thu Sep 06, 2018 9:24 pm
Forum: General
Topic: Is Fasttrack supported on a RB450G?
Replies: 0
Views: 1083

Is Fasttrack supported on a RB450G?

This seems to imply no https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

I do have the "Allow Fast Path" checkbox under IP < Settings which is why I'm a bit confused on it being supported or not.

Thanks for getting back to me!
by Jeroen1000
Sun Dec 24, 2017 3:48 pm
Forum: General
Topic: Ipv6 firewall bug?
Replies: 6
Views: 2275

Re: Ipv6 firewall bug?

Try to drop output; it seems to be skipping forward, and I think if the router originates the packets, it will place directly at output chain. Packets come in from the WAN-BRIGDE (this bridge contains the WAN interface uplink to a cable modem and it also contains VLAN20). By the way, it is a CASA C...
by Jeroen1000
Sun Dec 24, 2017 2:07 pm
Forum: General
Topic: Ipv6 firewall bug?
Replies: 6
Views: 2275

Re: Ipv6 firewall bug?

Mikrotik is not Cisco. Mikrotik doesn't have hardware routing, doesn't have ASIC chip. Mikrotik is software router based on Linux. Everything going to CPU (except L2 configurations on switch chip). Packet sniffer is tcpdump (or similar sw). Working in promiscuous mode - see everything in network (d...
by Jeroen1000
Sun Dec 10, 2017 4:16 pm
Forum: General
Topic: Ipv6 firewall bug?
Replies: 6
Views: 2275

Re: Ipv6 firewall bug?

Packet sniffer see everything. IMHO. It work on lower level than IP stack. Firewall rule is wrong. You droping packet on input, but packets are TX (output). The rule matches, so what is your reasoning behind it being wrong? Most sniffers work by passing the packets up to the CPU. If that does not h...
by Jeroen1000
Fri Dec 08, 2017 7:51 pm
Forum: General
Topic: Ipv6 firewall bug?
Replies: 6
Views: 2275

Ipv6 firewall bug?

Hi everyone, Can anyone verify? I have a drop all input rule but as you can see in the screenshot, traffic destined for ff02::1 still slips through. You can see this in the upper window "Packet Sniffer Packets". Moreover, the 2nd rule blocking traffic destined for ff02::1 is not hit. This ...
by Jeroen1000
Fri Oct 20, 2017 3:58 pm
Forum: Announcements
Topic: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities
Replies: 58
Views: 150052

Re: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities

To summarize, the client does connect to the fake AP. That's why the researcher enabled ip forwarding on his linux box. Actually there are AP's that will do this (mitigate the 4-way handshake problem). I'm not sure it will break anything with compatibility but we administer a ton of AP's and they ar...
by Jeroen1000
Thu Oct 19, 2017 5:49 pm
Forum: Announcements
Topic: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities
Replies: 58
Views: 150052

Re: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities

Hi Andriys Please be constructive instead of just shouting at me. Not looking for an online fight. What do you mean by your last post? Also please note that this attacks do not require wireless clients to connect to a "fake" AP- this "fake" AP just listens and sends you some addi...
by Jeroen1000
Wed Oct 18, 2017 7:33 pm
Forum: Announcements
Topic: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities
Replies: 58
Views: 150052

Re: RouterOS NOT affected by WPA2 vulnerabilities

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. It's not wrong, however, I understand your interpretation. You can...
by Jeroen1000
Tue Oct 17, 2017 4:23 pm
Forum: Announcements
Topic: RouterOS (v6.39.3, v6.40.4, v6.41rc) NOT affected by WPA2 vulnerabilities
Replies: 58
Views: 150052

Re: RouterOS NOT affected by WPA2 vulnerabilities

Hi when I read about the vulnerability this morning I immediatly checked the forum and was very happy to read this announcement. I updated all my access points and was quite relieved this should not concern me anymore. Now that there is more information and as it was already quoted: From the link :...
by Jeroen1000
Tue May 09, 2017 5:13 pm
Forum: Scripting
Topic: Simple script works in terminal but not via RUN script
Replies: 1
Views: 1059

Simple script works in terminal but not via RUN script

:global isIPcurrent; :if ($isIPcurrent!=$currentIP) do={ :log info "YES" :set $isIPcurrent $currentIP; /user set sshuser address=($currentIP,/32,192.168.200.0/24) } So this works when pasted in terminal but not when I paste it in a new script and run it. I really don't understand why? Any...
by Jeroen1000
Tue Nov 08, 2016 11:55 am
Forum: General
Topic: Routerboard 850Gx2 radio tap header
Replies: 2
Views: 1045

Re: Routerboard 850Gx2 radio tap header

Yes I was, but I am supposed to in order to sniff this traffic.
by Jeroen1000
Mon Nov 07, 2016 10:43 pm
Forum: General
Topic: Routerboard 850Gx2 radio tap header
Replies: 2
Views: 1045

Routerboard 850Gx2 radio tap header

Dear all, Got some strange Wireshark packet originating from a R850Gx2 running v6.35 stable. My Wifi router is a run off the mill Netgear R7000. Does anyone know why I'm seeing this packet? It's a router after all and has nothing to do with a WiFi-signal. For those who would like to reproduce: I got...
by Jeroen1000
Sun Oct 23, 2016 1:22 pm
Forum: RouterBOARD hardware
Topic: RB 850Gx2 vs RB750Gr3 performance
Replies: 10
Views: 10553

RB 850Gx2 vs RB750Gr3 performance

This topic was bound to show up sooner or later:-) So the 850Gx2 has a power pc processor running at 533 MHz. RB750Gr3 has a MIPS processor at 880 Mhz. Both are dual core devices. Both offer HW-acceleration although I have the 850Gx2 rev. 1 which doesn't so buyer beware. The 750Gr3 uses the EIP- 93 ...
by Jeroen1000
Sun Oct 23, 2016 12:29 pm
Forum: RouterBOARD hardware
Topic: RB750Gr3 - Report and questions
Replies: 113
Views: 52645

Re: RB750Gr3 - Report and questions

Thank you for your tests. They are most welcome. Maybe try IPsec and L2TP. Just use a Windows 7 or higher client to test. Plain IPsec would require a site-to-site tunnel.

Any thoughts on whether this on is faster than a 850Gx2?
by Jeroen1000
Thu Oct 20, 2016 9:07 pm
Forum: General
Topic: Public-Mikrotik-Bandwidth-Test-Server(s)
Replies: 1009
Views: 1119643

Re: 3.6 GIG - Public-Mikrotik-Bandwidth-Test-Server

Just wanted to say thanks for your server. I've been able to test both my connections. One weird Mikrotik thing found: when uploading (10 megabit) the test server process makes a routerbord 450G's CPU spike to 100%. When just doing a speedtest on speedtest.net, it does not go over 10%
by Jeroen1000
Wed Oct 19, 2016 11:09 am
Forum: General
Topic: Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread)
Replies: 134
Views: 49161

Re: Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread)

Thanks Alex and Nathan. Since I don't need more than 100 megabit CTR is ok. It's considered safe so there is no security trade off at least. Thanks for maintaining this thread pushing for a fix!
by Jeroen1000
Tue Oct 18, 2016 12:19 pm
Forum: General
Topic: Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread)
Replies: 134
Views: 49161

Re: Is re-ordering fixed yet with IPSec and hardware acceleration? (Updating thread)

Does anyone know whether this occurs with regular TCP/UDP streams too (so without HW encryption)? Secondly, is SSTP working ok or is that HW accelerated too?
Bit of a shocker this thread:-)
by Jeroen1000
Sun Dec 06, 2015 11:28 am
Forum: RouterBOARD hardware
Topic: SXT SA5 ac as client access point?
Replies: 4
Views: 3323

Re: SXT SA5 ac as client access point?

Hi Pukkita Thank's for replying Most important question: How do you mean it will depend on the camera's wireless? Can the SXT 5 SA ac function as a normal (like a home AP) AP and broadcast an SSID? I.e. Say I have 3 laptops (=clients) in range, can the just connect to it and from there on be routed ...
by Jeroen1000
Sat Dec 05, 2015 8:01 pm
Forum: RouterBOARD hardware
Topic: SXT SA5 ac as client access point?
Replies: 4
Views: 3323

SXT SA5 ac as client access point?

Hi everyone I'm looking for directional wireless coverage for a secondary building across the main building. Some wireless camera's will be stationed there. Distance between main building and secondary building is about 30 meters. There is full line of sight. So my plan is to screw a SXT SA5 ac to t...
by Jeroen1000
Sat Sep 19, 2015 9:32 pm
Forum: RouterBOARD hardware
Topic: Real CCR1072 experience?
Replies: 52
Views: 16792

Re: Real CCR1072 experience?

I want to add that this is the reason you have to verify how many packets per second a device can forward at a given packet size . CPU based systems do not behave linear opposed to ASICS. Say you are have a 10 gigabit line at an ISP and the MTU is 1500, your device must be capable of forwarding the ...
by Jeroen1000
Sat Apr 11, 2015 2:01 am
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73227

Re: RB3011 Block diagram?

So both the Tilera and the IPQ are network processors? I.E. CPU's with a special purpose.

Does anyone know how their achitecture differs? I can't really find a definitive source on the Tile achitecture.
by Jeroen1000
Sun Mar 15, 2015 2:56 pm
Forum: General
Topic: Simple queue statistics tab target download: what is this (pictures inside)?
Replies: 0
Views: 1042

Simple queue statistics tab target download: what is this (pictures inside)?

I have started a test, where 1 user over SSTP is using all the upload bandwidth. In order to prevent excessive queueing in the upload direction, I've placed a simple queue on the WAN interface. It shapes to 3700k. Bu then I have noticed the number in target download (kbps) at the simple queue statis...
by Jeroen1000
Tue Feb 24, 2015 8:19 pm
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

i tried rate limiting, it did not seem to really make a difference for me. can you provide the cli export of your ppp? just to confirm, i will test again. what code you running? I'm on ROS 6.27. I'll add the export hopefully in a few hours (I'm testing another config ATM). You must rate limited bel...
by Jeroen1000
Tue Feb 24, 2015 10:09 am
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

Latest update/conclusions: For a WIRED connection: - When rate limiting to 8M/8M, the wired connection is getting 7.3 megabit out of SSTP. So same conclusion as Stefan in viewtopic.php?t=85568 It not ALL that I can get but 7.3 out of 9 megabit is acceptable nonetheless. Speed fluctuates with about 0...
by Jeroen1000
Thu Feb 19, 2015 8:18 pm
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

I got the idea from here: http://forum.mikrotik.com/viewtopic.php?t=85568 kudos to stefan803. It is an excellent read, I promise. You can set the limit going to PPP profiles and selecting the profile that is used for a particular user (see screenshot attached). What I'm going to do next is eliminate...
by Jeroen1000
Thu Feb 19, 2015 9:42 am
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

I've got some more interesting information. A friend has a 10/10 connection and has connected to my 160/10 SSTP-server. Limiting the SSTP connection to 7/7 got a stable 784 kilobyte per second connection (+- 6.3 megabit). Limiting to 8/8 got the connection to 900 kilobyte per second. (+- 7.2 megabit...
by Jeroen1000
Wed Feb 18, 2015 10:23 am
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

latency is 30-40ms, cpu never maxes out, barely breaks 35% on a MAP2N, on a pptp connection with both sides having 28/6 i can see over 600mbit, which is great, simply changing to sstp, both sides see 350mbit max, its a huge hit How can you get over 600 megabit if the maximum upload on both sides is...
by Jeroen1000
Wed Feb 18, 2015 10:20 am
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

@Nathan, To recap: SSTP-server: 850Gx2 on a 160/10 megabit connection (getting about 9 megabit upload on average - untunneled). Running ROSv 6.27 SSTP-client: Windows 7 on a 60/4 connection (getting about 3.2 upload on average - untunneled) My latency is pretty low: 12 - 18 ms without SSTP and aroun...
by Jeroen1000
Tue Feb 17, 2015 9:31 pm
Forum: General
Topic: sstp vs pptp performance
Replies: 27
Views: 16474

Re: sstp vs pptp performance

Same issue here. I've got a rock solid ISP cable connection. SSTP server: It has 160 megabit down, 10 megabit up. I'm connecting from another line with the same ISP. This line's profile is 60 megabit down, 3 megabit up. PPTP: 8-9 megabit per second . Tested for 30 minutes downloading an Ubuntu ISO a...
by Jeroen1000
Sun Feb 01, 2015 10:44 pm
Forum: RouterBOARD hardware
Topic: CCR1009-8G-1S-1S+PC
Replies: 31
Views: 16018

Re: CCR1009-8G-1S-1S+PC

Darn, I almost wish I had not bought a 850Gx2. Anyway it will do for now. Only downside I can see is the low amount of NAND-storage compared to the 850Gx2 and the 450G
by Jeroen1000
Sun Dec 28, 2014 12:11 am
Forum: RouterBOARD hardware
Topic: Advice please, best RouterBoard for site to site SSTP VPN
Replies: 7
Views: 3016

Re: Advice please, best RouterBoard for site to site SSTP VP

Except that the 850Gx2 does NOT have hardware encryption. It's for a later model revision. I got fooled too but it's fast enough for my 10 megabit upload connection:))
by Jeroen1000
Tue Dec 23, 2014 7:11 pm
Forum: Announcements
Topic: v6.24 RC
Replies: 50
Views: 41897

Re: v6.24 RC

Are the NTP fixes related to the recently discovered vulnerabilities? http://www.ubuntu.com/usn/usn-2449-1/

Could you please tell me what version ROS is using? IS it version 4.2.8
by Jeroen1000
Wed Dec 17, 2014 9:31 pm
Forum: General
Topic: LOG SSTP access
Replies: 3
Views: 2474

Re: LOG SSTP access

Doesn't Windows 7/8/8.1 always connect to 443? Must try that asap and I'll post whether or not it can be changed
by Jeroen1000
Mon Dec 15, 2014 11:03 pm
Forum: General
Topic: LOG SSTP access
Replies: 3
Views: 2474

Re: LOG SSTP access

I got a step closer! You can find users that logged in with success via below line of code, pasted in a terminal. Of course, appropriate logging should be enabled first in order for this to work. log print detail where buffer=memory && message~"authenticated" It will produce this o...
by Jeroen1000
Mon Dec 15, 2014 10:18 pm
Forum: General
Topic: LOG SSTP access
Replies: 3
Views: 2474

LOG SSTP access

Hi fellow Mikrotik users, For PPTP I do this for logging: 14 ;;; PPTP-VPN rules chain=input action=accept protocol=tcp dst-port=1723 15 chain=input action=log protocol=gre log-prefix="" 16 chain=input action=accept protocol=gre When a GRE tunnel is established, I know someone logged has in...
by Jeroen1000
Sat Nov 22, 2014 3:01 pm
Forum: General
Topic: Firewall: dynamic VPN rules. Explain the jump rule please
Replies: 0
Views: 1260

Firewall: dynamic VPN rules. Explain the jump rule please

Hi Guys, I'm talking about rule # 18 in the firewall output. Why is that jump rule required? I don't quite understand. Background info: What the PPTP VPN rules do, is block a VPN-user from reaching my LANs. In orde to reach a LAN, you have to move packects out of a VLAN interfaces. Hence, rule #19 b...
by Jeroen1000
Mon Nov 10, 2014 5:49 pm
Forum: General
Topic: Simple routing architecture problem from a newbie. HELP :)
Replies: 13
Views: 2701

Re: Simple routing architecture problem from a newbie. HELP

Could you perhaps make a diagram with IP addressing on it? It's not clear to begin with to which address the 750GL ports forwards. I think it should not really be an issue to give your NAS (1) a public routable IP (DSL) and then (2) an RFC 1918 private IP that is masqueraded using the cable's ISP pu...
by Jeroen1000
Sun Nov 09, 2014 11:36 pm
Forum: General
Topic: Simple routing architecture problem from a newbie. HELP :)
Replies: 13
Views: 2701

Re: Simple routing architecture problem from a newbie. HELP

What is the intend? Active and backup router? Then VRRP is your answer.
by Jeroen1000
Sun Nov 09, 2014 2:08 pm
Forum: General
Topic: 850gx2 on 6.21.1: clearing log not possible anymore?
Replies: 0
Views: 900

850gx2 on 6.21.1: clearing log not possible anymore?

Hi all,
 /system logging action> set numbers=0 memory-lines=1
 /system logging action> set numbers=0 memory-lines=500
Above should clear the memory log: 0 * name="memory" target=memory memory-lines=500 memory-stop-on-full=no

Can anyone confirm this is no longer working fom them?
by Jeroen1000
Sat Nov 08, 2014 3:30 pm
Forum: RouterBOARD hardware
Topic: RB850Gx2 - Release date?
Replies: 193
Views: 66900

Re: RB850Gx2 - Release date?

@hedele I was not trying to discredit you in any way. Payload is indeed 1500 bytes, but 20 bytes of that comprises the IP header. The more L2 stuff you use (like VLANs) the LESS payload will be transported unless the L2MTU can be augmented. Thus, for 1500 bytes payload + a VLAN tag, the L2MTU has to...
by Jeroen1000
Fri Nov 07, 2014 10:24 am
Forum: RouterBOARD hardware
Topic: RB850Gx2 - Release date?
Replies: 193
Views: 66900

Re: RB850Gx2 - Release date?

http://wiki.mikrotik.com/wiki/Manual:Maximum_Transmission_Unit_on_RouterBoards @hedele It is always better to be very precise with these matters. L2MTU is USUALLY = payload (1480 bytes) + IP header (20 bytes) . This equals 1500 bytes. Here you add 14 bytes MAC header and + 4 bytes FCS. This amounts ...
by Jeroen1000
Thu Nov 06, 2014 12:27 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 MTU issue confirmed by me:)

You can set Cisco's and Junipers's to ignore the DF flag and they will happily fragment away. I'll take a wireshark capture on a windows PC connected to the WAN port. But thanks for fixing this so quickly!
If it is good, it must be said too!
by Jeroen1000
Thu Nov 06, 2014 11:11 am
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 MTU issue confirmed by me:)

I think it is sufficient for all WAN uses. Is there a way to discover whether a router honours the dont fragment flag?:-)
by Jeroen1000
Fri Oct 31, 2014 4:49 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 MTU issue confirmed by me:)


I asked MT about this MTU limitation. They assured me that the hardware supports jumbo frames and MTU should be increased in a future ROS version.
Good news. Better than mine as now we know the limitation can be removed. I hope future means this year though :-)
by Jeroen1000
Fri Oct 24, 2014 8:18 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 MTU issue confirmed by me:)

I've been told it is currently an accepted bug. There is another topic where this was told. I hope it gets fixed quickly too:)
by Jeroen1000
Sat Oct 18, 2014 6:50 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 MTU issue confirmed by me:)

MRZ you were very right! For the VLAN interface you can only set an L2MTU of 1502 bytes (could nog get it to set 1504 or more). The MTU on the VLAN interface has to lowered (from 1500) to 1498 bytes in order for this to work. 1502 bytes - 4 bytes for VLAN header = 1498 bytes. This looks like an issu...
by Jeroen1000
Wed Oct 15, 2014 8:26 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

Re: RB850gx2 VLANs hardware issue?

I'll check that. I have not changed the L2MTU. Perhaps I should set it at 1504. Can't check the defaults now as I'm not near the router

I believe to ping 1500 bytes you need to set the ping size to 1472 in windows? (8 bytes ICMP and 20 bytes ip header makes 1500). Right?
by Jeroen1000
Wed Oct 15, 2014 7:42 pm
Forum: RouterBOARD hardware
Topic: RB850gx2 MTU issue confirmed by me:)
Replies: 18
Views: 7491

RB850gx2 MTU issue confirmed by me:)

Hi Guys, As soon as I create an VLAN-interface on a port and assign an address to it I can no longer manage the router via Winbox. I can ping the address on the infercace though. Sometimes I can't even login to Winbox. When I can login, most tabs are empty (like the interfaces tab, vlans tab, firewa...
by Jeroen1000
Mon Oct 13, 2014 9:26 am
Forum: RouterBOARD hardware
Topic: RB850Gx2 Network interface details
Replies: 36
Views: 24097

Re: RB850Gx2 Network interface details

So, regarding the MTU. You can't even do Q in Q with a layer 3 MTU of 1500 bytes (20 bytes IP header + 1480 bytes payload).

That would yield 1480 + 20 + 4 + 4. Seeing a VLAN-tag is 4 bytes?
by Jeroen1000
Sun Jul 13, 2014 1:39 pm
Forum: General
Topic: RB450G: DHCP-client on master interface not working SOLVED
Replies: 2
Views: 1592

Re: Routerboard450G: DHCP-client on master interface not wor

I've found the problem and solution. However, I don't fully understand it yet. In below configuration, the switch1-cpu port is set to DEFAULT-VLAN-ID 0. Putting is as access-port in VLAN20 solves the issue: 5 switch1-cpu Switch1 secure always-strip 20 Or setting its VLAN-MODE to fallback also does t...
by Jeroen1000
Sat Jul 12, 2014 10:29 pm
Forum: General
Topic: RB450G: DHCP-client on master interface not working SOLVED
Replies: 2
Views: 1592

Re: Routerboard450G: DHCP-client on master interface not wor

This is so weird, what you could NOT see from my first post is that ETHER2 did not have a physical link (there was no device attached to the port). So I've now connected my ISP's cable modem to ETHER2. The modem was previously on ETHER5 (my WAN port). Again, I do not receive an IP address on ETHER2 ...
by Jeroen1000
Sat Jul 12, 2014 9:23 pm
Forum: General
Topic: RB450G: DHCP-client on master interface not working SOLVED
Replies: 2
Views: 1592

RB450G: DHCP-client on master interface not working SOLVED

Pretty strange issue here. I've put ETHER2 as master-port for ETHER5 (=WAN PORT). After a reboot, ETHER2 fails to get a DHCP address from my ISP. When I disable and re-enable ETHER5, DHCP works. ETHER2 now obtains a DHCP-address from my ISP. I'm not sure what I'm doing wrong here. Any ideas fellow M...
by Jeroen1000
Wed May 14, 2014 2:40 pm
Forum: General
Topic: what is the difference between PPTP and L2TP?
Replies: 1
Views: 893

Re: what is the difference between PPTP and L2TP?

I think you should google it, much information is to be found. I can start of with this: In terms of security, PPTP is obsolete. Only use with very long passwords (20 + characters) and not for matters where security matters. Is sometimes blocked by corporate firewalls. Setup is very easy. IpSec in c...
by Jeroen1000
Wed May 14, 2014 2:22 pm
Forum: General
Topic: Freezing / disconnection of Winbox over PPTP VPN
Replies: 10
Views: 6506

Re: Freezing / disconnection of Winbox over PPTP VPN

I've got the same problem. Disconnect within minutes. Tried all kinds of things like turning of the firewall rules that could potentially be a cause.

It seems that connecting to the routers internal LAN IP over a PPTP VPN is causing issues....
by Jeroen1000
Wed May 07, 2014 10:42 pm
Forum: RouterBOARD hardware
Topic: CCR1009-8G-1S-1S+ General info & Questions
Replies: 100
Views: 101718

Re: CCR1009-8G-1S-1S+ General info & Questions

+1 thank you for this excellent overview. Much appreciated. So then, it does not route over 1 gigabit over a single upstream port? What is the 10 gigabit SFP+ port for then?

(sorry I have not updated myself since the Routerboard 450g series)
by Jeroen1000
Tue Apr 30, 2013 3:45 pm
Forum: General
Topic: Best queue type and scheduling algorithm to stop bufferbloat
Replies: 0
Views: 1436

Best queue type and scheduling algorithm to stop bufferbloat

Apparently, my cable modem is introducing about 550ms of buffer bloat (worst case scenario) in the upload direction. This was tested without the router in place. A sensible thing to do is to move the bottleneck to the WAN-interface and then specify a suitable scheduling algorithm. Since my upload is...
by Jeroen1000
Mon Apr 22, 2013 7:06 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

You certainly have a strong handle on the matter. The port left of the router is ether1 (Trunk port). The port to the right is ether5 (WAN-port). But you already figured this out. I've haven't tested this (not at my home so danger of locking myself out) but I think it is also possible to create VLAN...
by Jeroen1000
Mon Apr 22, 2013 11:17 am
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

CelticComms is filling in the blanks in my knowledge gap. So by bridging VLAN20 (attached to ETHER1 if you refer to my screenshot) with the WAN port, I'm basically defining VLAN20 on ETHER 5 as an access port (untagged port). At the same time VLAN10+VLAN20 on ETHER 1 both remain tagged ports? Make s...
by Jeroen1000
Sun Apr 21, 2013 11:05 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

Yes, cloning works as I've tried it with a Draytek router once. Result: the STB had "internet" (read: access to ISP servers) access but non-ISP devices will not be able to reach the internet through that range of course. Using the clone trick, I could give the STB an address in a private r...
by Jeroen1000
Sun Apr 21, 2013 9:19 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

I'm doing the VLAN-solution using the setup above with the screen shot. Unfortunately, it involves a bridge as you can see. Getting it to work inside the LAN is a no go. The ISP decides its IP based on the MAC-address. The only other way I can think of is by using the solution Pellaeon suggested, as...
by Jeroen1000
Sun Apr 21, 2013 6:58 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

I thought of that, but that would require the tv box to be connected to the slaved port directly? So without any VLANs involved, right?
by Jeroen1000
Sun Apr 21, 2013 6:29 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

Clarifying is always hard. Perhaps I can create and upload a drawing if this attempt here is a bit unclear: Forget about the 192.168.0.0/24 LAN and VLAN10 for a minute. - My cable modem is 50 metres away from a TV setup box. This box NEEDS L2 access to the WAN-port of the cable modem in order to get...
by Jeroen1000
Sun Apr 21, 2013 5:29 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

Re: A little help with routed and switched ports please.

Hi Pellaeon Thanks for your thoughts, I appreciate it. Your summary is kind off how I imagine things but it still has to become real for it to be able to fall together. First restriction, my ISP does not do any L2 VLAN-tagging whatsoever. And so, I'm stuck at first base: You can make a new virtual e...
by Jeroen1000
Sun Apr 21, 2013 3:08 pm
Forum: General
Topic: A little help with routed and switched ports please.
Replies: 16
Views: 3478

A little help with routed and switched ports please.

Hi everyone, I've been trying to get my head around this but pratically doing this, is beyond my Mikrotik knowledge. Please bear with me here and ask questions if my explanation is unclear. PART A 1) I want to keep my WAN-facing interface at L2 and plug my cable modem into the WAN-interface. Moreove...
by Jeroen1000
Wed Feb 06, 2013 9:13 pm
Forum: General
Topic: Does RouterOS support DNSSEC and EDNS?
Replies: 0
Views: 1290

Does RouterOS support DNSSEC and EDNS?

Hi,

From my testing with DIG, I'd say no. The "Max UDP Packet Size" option for the DNS settings does not seem to do anything:-)

Can anyone please confirm?

Thanks,
Jeroen
by Jeroen1000
Sat Dec 22, 2012 12:18 pm
Forum: RouterBOARD hardware
Topic: CLOUD CORE ROUTER
Replies: 1373
Views: 1186449

Re: CLOUD CORE ROUTER

Yes thanks for letting us take a look. Really appreciated. You might want to sent out PM's instead of posting this publicly. I won't mess with it but someone might try:-)
by Jeroen1000
Tue Oct 09, 2012 8:16 pm
Forum: RouterBOARD hardware
Topic: Wanted - New hardware from MikroTik
Replies: 46
Views: 17152

Re: Wanted - New hardware from MikroTik

It was just an example. And I have configured it as you describe Dobby. HOWEVER, you are not using the switch chip.
I do appreciate your effort though. And I know a router is not a switch but full VLAN support would still be a nice feature.
by Jeroen1000
Tue Oct 09, 2012 10:21 am
Forum: RouterBOARD hardware
Topic: Wanted - New hardware from MikroTik
Replies: 46
Views: 17152

Re: Wanted - New hardware from MikroTik

I "had" to buy a VLAN switch because the Routerboard does not allow tagged and untagged frames on the same port + configuring this switch chip for VLANs is ...quite daunting to say the least:) for instance, I couldn't get this simple thing with the switch chip: info: the WAN port is connec...
by Jeroen1000
Mon Oct 08, 2012 10:15 pm
Forum: RouterBOARD hardware
Topic: Wanted - New hardware from MikroTik
Replies: 46
Views: 17152

Re: Wanted - New hardware from MikroTik

Good post. I like it. I for one would like to see a device like a routerboard 450G with VPN-acceleration and a fully featured switch chip.
One which has all or most features of a Dell VLAN switch. Right now there are some limitations that are quite known (I think).
by Jeroen1000
Mon Oct 01, 2012 10:04 am
Forum: Beginner Basics
Topic: firewall action=log not working with certain ports
Replies: 3
Views: 1833

Re: firewall action=log not working with certain ports

It appears the test websites don't work well for every port. Normal SSH login attempts do appear to register.
Weird. Perhaps anybody can reproduce?
by Jeroen1000
Sun Sep 30, 2012 7:19 pm
Forum: Beginner Basics
Topic: firewall action=log not working with certain ports
Replies: 3
Views: 1833

Re: firewall action=log not working with certain ports

Thanks otgooneo but for some reason that does not work either. Note rule 2 is disabled so the log rule at position 9 should work for port 22. If I keep the rule where it is at position 9, it will work for port 7000 for instance, but not for port 100. It will work for port 30000 but not for port 6000...
by Jeroen1000
Sun Sep 30, 2012 7:00 pm
Forum: Beginner Basics
Topic: firewall action=log not working with certain ports
Replies: 3
Views: 1833

firewall action=log not working with certain ports

Hello everyone, I'm trying to log SSH portscan attempts. When I enable rule 2, I can SSH into my router from anywhere. So it appears my ISP is not blocking port 22. Although my log rule works fine with many ports, it does _not_ seem to work with ports 900, 22, 700,... Any idea why it (rule 9) does n...
by Jeroen1000
Wed Jul 18, 2012 10:38 am
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

Good to see you've updated :D . Although this part of the forum is kind of dead. I do also wonder whether SWOS is still being maintained...
by Jeroen1000
Mon Jun 25, 2012 3:32 pm
Forum: General
Topic: Alternative to bridging?
Replies: 1
Views: 1208

Re: Alternative to bridging?

Added an overview of the test setup:-) Actually, simplified: I need to put the WAN-port (ether5) in native VLAN1. And I need my trunk port (ether1) in native VLAN1 and in VLAN10. Devices in VLAN1 will then get a public IP. Devices in VLAN10 will need inter VLAN-routing to reach the internet (which R...
by Jeroen1000
Thu Jun 21, 2012 9:39 am
Forum: General
Topic: Alternative to bridging?
Replies: 1
Views: 1208

Alternative to bridging?

Hi all, On a LAN-interface (ether1), I have created VLAN20 that I bridge with the WAN-interface (ether5). This way, computers in VLAN20 can get a public IP from my ISP (via DHCP). Ether1 has some other VLANs too, but these have internet access via NAT. Is is possible to replace the bridge with somet...
by Jeroen1000
Sun May 27, 2012 10:40 pm
Forum: Scripting
Topic: Changeip script only works 1 time after a reboot
Replies: 5
Views: 2570

Re: Changeip script only works 1 time after a reboot

Thanks Sam. Your script and service are top notch. Much appreciated.

cheers,
Jeroen
by Jeroen1000
Sun May 27, 2012 5:55 pm
Forum: Scripting
Topic: Changeip script only works 1 time after a reboot
Replies: 5
Views: 2570

Changeip script only works 1 time after a reboot

I made a few changes to it, and it seemed to run just fine. It updates my IP after correctly after I reboot the router. But when my IP changes afterwards, it simply does not work anymore until I reboot again. So, when the IP changes and the script runs: - The variable $network is empty (check out th...
by Jeroen1000
Wed Feb 08, 2012 4:26 pm
Forum: SwOS
Topic: Future of SwOS products?
Replies: 8
Views: 6083

Re: Future of SwOS products?

+1 how about it:)
by Jeroen1000
Fri Dec 09, 2011 11:44 pm
Forum: Scripting
Topic: DynDns scripts HTTPS
Replies: 5
Views: 2926

Re: DynDns scripts HTTPS

Sam, Some code of the script did not really work out for me so I changed a bit of coded and added some. Do you see any issues or is this ok? Next line of code yields an error: #:global ddnsip [ /ip address get [/ip address find interface=$ddnsinterface] address ] So I added: :local network [/ip addr...
by Jeroen1000
Fri Dec 09, 2011 11:10 pm
Forum: Scripting
Topic: DynDns scripts HTTPS
Replies: 5
Views: 2926

Re: DynDns scripts HTTPS

Hi Sam, It just happens I already registered after a good look around on the forums here. Are both the sending of username and password and the update secured with SSL? This is probably something Mikrotik support can answer, but would you happen to know whether the certifcate of your site checked by...
by Jeroen1000
Fri Dec 09, 2011 1:56 pm
Forum: Scripting
Topic: DynDns scripts HTTPS
Replies: 5
Views: 2926

Re: DynDns scripts HTTPS

Oh, didn't? so it does know? (off checking the wiki). That's too bad as I don't feel like looking for another solution:))

Nope it still does not. Blast!
by Jeroen1000
Fri Dec 09, 2011 1:31 pm
Forum: Scripting
Topic: DynDns scripts HTTPS
Replies: 5
Views: 2926

DynDns scripts HTTPS

I'm sure there is a reason why all the DynDNS update scripts are HTTP. Can anyone explain why HTTPS is not used?

cheers,
Jeroen
by Jeroen1000
Fri Dec 09, 2011 12:02 am
Forum: Scripting
Topic: dynDNS Update Script
Replies: 158
Views: 132105

Re: dynDNS Update Script

I'm happy to report I've got a working script now (source code below). However, When forcing an update DynDns reports "nochg 84.194.xxx.xxx" And thus it does not update the "Last Updated" timer, which may cause the account to expire. Anyone found a way around this? # Set needed v...
by Jeroen1000
Wed Dec 07, 2011 10:55 pm
Forum: Scripting
Topic: dynDNS Update Script
Replies: 158
Views: 132105

Re: dynDNS Update Script

I found this snippet to get the IP however, it makes the script halt although the console does not indicate an error. :foreach int in=[/ip route find dst-address=0.0.0.0/0 active=yes ] do={ :if ([:typeof [/ip route get $int routing-mark ]] != str ) do={ :global ddnsinterface [/ip route get $int inte...
by Jeroen1000
Wed Dec 07, 2011 9:58 pm
Forum: Scripting
Topic: dynDNS Update Script
Replies: 158
Views: 132105

Re: dynDNS Update Script

Is it possible to avoid disk writes if no update is required?

So avoiding this part:
/tool fetch mode=http address="checkip.dyndns.org" src-path="/" dst-path="/dyndns.checkip.html"
:local result [/file get dyndns.checkip.html contents]
thanks a lot,
Jeroen
by Jeroen1000
Wed Dec 07, 2011 8:23 pm
Forum: General
Topic: Switch to OpenDNS causes DNS problems
Replies: 0
Views: 789

Switch to OpenDNS causes DNS problems

Dear all, Fixed: an inactive rule was the culprit. So I deleted it:-). Must have been active while the gui said inactive... I've changed the DNS-servers in the Mikrotik to OpenDNS and now DNS no longer works. It has worked for some time though, like a week or so. When I remove the router's IP as the...
by Jeroen1000
Mon Dec 05, 2011 12:23 pm
Forum: Beginner Basics
Topic: Port knock with more ports
Replies: 2
Views: 1457

Re: Port knock with more ports

Thanks for the heads up Fewi.

I was afraid of that, it does get a lot messier this way but nevertheless still doable. I was hoping on a secret "AND" operator which would have allowed specifying multiple ports like in my faulty rule. :).
by Jeroen1000
Mon Dec 05, 2011 12:12 am
Forum: Beginner Basics
Topic: Port knock with more ports
Replies: 2
Views: 1457

Port knock with more ports

How would one go about this? I'm basing myself on this example I have found in the wiki: add chain=input protocol=tcp dst-port=1337 action=add-src-to-address-list address-list=knock \ address-list-timeout=15s comment="" disabled=no add chain=input protocol=tcp dst-port=7331 src-address-lis...
by Jeroen1000
Fri Nov 18, 2011 9:01 pm
Forum: Beginner Basics
Topic: View DNS query
Replies: 2
Views: 4617

Re: View DNS query

Capturing traffic kind of worked (good enough for confirmation purposes). Every time I trigger an NSLOOkUP from my workstation, the IP of OpenDNS is queried. I see an "IN" and and "OUT" packet so that would be request and response (reply). Perhaps I could try a port mirror and co...
by Jeroen1000
Fri Nov 18, 2011 8:24 pm
Forum: Beginner Basics
Topic: View DNS query
Replies: 2
Views: 4617

View DNS query

Is there any way to view which DNS server Mikrotik is querying? Like an NSLOOKUP command equivalent? I'd like to check whether it is using the DNS server I have specified.

Thanks,
Jeroen
by Jeroen1000
Mon Sep 05, 2011 9:42 am
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

Still a very valuable topic. I find myself checking it too often :D
by Jeroen1000
Mon Sep 05, 2011 9:37 am
Forum: SwOS
Topic: Can you make it possible to change the default "admin" login
Replies: 3
Views: 2795

Can you make it possible to change the default "admin" login

It is still pretty annoying I have to remember to use admin instead of what I use on all my other devices. Please make it so we can change that. I bet it should not be hard?

Best regards,
Jeroen
by Jeroen1000
Fri Jul 22, 2011 11:25 pm
Forum: SwOS
Topic: Clear learned MAC addresses on hosts tab
Replies: 8
Views: 6836

Re: Clear learned MAC addresses on hosts tab

Since it is only on my home LAN, this bug is not critical but it is quite annoying. But, the thing is dirt cheap so you get what you pay for ofcourse. I'm actually a bit tempted to see whether this switch truly offers wire speed with VLANs set. I do hope so because if not, that would be very unaccep...
by Jeroen1000
Sun Jul 10, 2011 12:04 pm
Forum: SwOS
Topic: Clear learned MAC addresses on hosts tab
Replies: 8
Views: 6836

Clear learned MAC addresses on hosts tab

For some reason, rebooting the switch (via the gui) does not clear this. There are a bunch of MAC addresses listed from computers that have not been connected for months.

What can I do about this?
by Jeroen1000
Tue Jun 28, 2011 2:43 am
Forum: General
Topic: Information on VLan Setup
Replies: 5
Views: 1944

Re: Information on VLan Setup

I'll put step 4 and the "why use a brigde" in this post. I don't think Mikrotik routes between VLANs by default (and it looks like you don't wan't this) so I think you only require a route to the internet. If you configure your WAN port correctly, this route will exist and your're basicall...
by Jeroen1000
Tue Jun 28, 2011 2:28 am
Forum: General
Topic: Information on VLan Setup
Replies: 5
Views: 1944

Re: Information on VLan Setup

I don't know how it is with your setup, but over here I need to get a lease from my provider for my WAN port. With this I mean that the Mikrotik router's WAN-port will receive a public IP from my cable modem. In this scenario the router is actually a DHCP client (instead of server) because it will a...
by Jeroen1000
Tue Jun 28, 2011 12:25 am
Forum: General
Topic: Information on VLan Setup
Replies: 5
Views: 1944

Re: Information on VLan Setup

I'll try to be of help. It"s more like a trial and error thing but perhaps I can be of some help. This applies to routed VLANs, which are slower than switched VLANs. 1. You need to create VLAN interfaces (I'd generally not use VLAN 1 as this holds special meaning). You can create the VLANs usin...
by Jeroen1000
Mon Jun 06, 2011 8:50 pm
Forum: RouterBOARD hardware
Topic: Routerboard 450G temperature is way up there
Replies: 5
Views: 2361

Re: Routerboard 450G temperature is way up there

If you read other documentation on routerboard.com, it says it will operate until 65°. So I'm still inside the safe zone :).
Perhaps Normis will favour us with an official kind of reply?
by Jeroen1000
Sun Jun 05, 2011 6:40 pm
Forum: RouterBOARD hardware
Topic: Routerboard 450G temperature is way up there
Replies: 5
Views: 2361

Routerboard 450G temperature is way up there

I'm recording 64° right now and about 61° during evening and night. Will this cause damage?
I don't even know whether it is normal, it isn't that hot where I live. Could there per any chance be heatsink issues?

Best regards,
Jeroen
by Jeroen1000
Sat Jun 04, 2011 1:40 am
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

This feature does seem to generate a lot of interest! Since ROS is basically Linux, the security mechanisms in Linux can be used? Am I seeing this wrong? Linux password are stored pretty secure since they contain a salt. Don't know the details like usual:)
by Jeroen1000
Tue May 31, 2011 3:43 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

Could you just please check with your engineers. This kind of protection is as common as HTTPS websites. I can give you my Trurecrypt encrypted hard drive and you"ll never get access to my data when the drive is at rest (powered off). It also uses local login. Chupaka is not saying at all this ...
by Jeroen1000
Tue May 31, 2011 2:52 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

No, if you input 0FBECDE5 directly (if you use it as password instead of 1234), the hash algorithm will hash 0FBECDE5 and not 1234. This would yield, for instance, FBC3B9A2 and FBC3B9A2 does not equal 0FBECDE5. You have the secure storing of a password on one side (by hashing it as I described), and...
by Jeroen1000
Tue May 31, 2011 2:27 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

Chupaka can explain better I think. You can't log in with the hash. It is used for a different purpose. Basically, say my password is 1234 and the hash is 0FBECDE5. You store the hash. Next time someone inputs, lets say 4567. If you hash 4567 you will never ever ever get 0FBECDE5 but for instance 0F...
by Jeroen1000
Tue May 31, 2011 2:02 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

A lot of confusion about this so I'll bottom line it. It is possible. It is NOT overly hard to do. It is considered safe. One thing is, we want the password stored securely (I.E. hashed) and authenticate against this hash. Authentication exists by hashing the password that the user inputs, if the ha...
by Jeroen1000
Mon May 30, 2011 4:50 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

How so? I'm pretty confident you'll not break the current AES encryption any time soon. Current Linux password storing methods are considered quite safe. So I'm a bit surprised about your comment (and that any kind of encryption can be broken easily is just plain untrue, so you must mean something e...
by Jeroen1000
Mon May 30, 2011 2:46 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

It is not always easy to prevent (physical) access.
I'm just saying, in general, it is good pratice to use strong encryption.

The question can easily be stated the other way around: why not use strong encryption?
by Jeroen1000
Mon May 30, 2011 2:11 pm
Forum: General
Topic: Forgot my password
Replies: 60
Views: 29219

Re: Forgot my password

Still using pretty weak encryption anno 2011? :( ?
by Jeroen1000
Fri May 13, 2011 7:17 pm
Forum: Beginner Basics
Topic: IPv6 issue
Replies: 4
Views: 1456

Re: IPv6 issue

Because IPV4 addresses are almost depleted? So they have to instead of want to:))
by Jeroen1000
Thu May 12, 2011 6:24 pm
Forum: SwOS
Topic: experiences with RB250GS
Replies: 7
Views: 4938

Re: experiences with RB250GS

I agree they are stable (note I only own 1). Do take notice of some of the threads mentioned. There are some limitations.
I also believe that they are capable of wire speed. I can't test this myself due to limitations on my computers.
by Jeroen1000
Thu May 05, 2011 5:47 pm
Forum: General
Topic: Bridging and VLAN isolation problem
Replies: 11
Views: 3625

Re: Bridging and VLAN isolation problem

I believe a physical port on Ros can only either be tagged or untagged. In Linux tagged (virtual) interfaces are eth0.10 or 0.20 for instance, and untagged ones are ethe0:1, eth0:2, etc... Those two 'kinds' of virtual interfaces can exist on the same physical port. This behaviour cannot be achieved ...
by Jeroen1000
Thu May 05, 2011 1:20 pm
Forum: General
Topic: Bridging and VLAN isolation problem
Replies: 11
Views: 3625

Re: Bridging and VLAN isolation problem

I have problems with bridging and VLANs. (Router OS 5.0). Ports of a bridge do have their child VLAN interface bridged togeter, even if other ports of the bridge do not have the same VLANs. You mean you group together ports in a bridge that belong to different VLANs? What is the use for doing that?
by Jeroen1000
Thu May 05, 2011 1:15 pm
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

Damn, I was kind of still hoping on LACP Channels and to a lesser extent remote syslog. The first feature does make more sense on a 8 or 24 port switch anyway:).
by Jeroen1000
Thu May 05, 2011 1:07 pm
Forum: General
Topic: CPU usage percentage incorrect?
Replies: 1
Views: 1015

Re: CPU usage percentage incorrect?

For anyone wondering about this in the feature, here is the answer from support:
CPU freuency and usage is not proportional to throughput, never was and never will
be.
Memory throughput, internal bus speeds, RouterOS configuration also have impact
by Jeroen1000
Sat Apr 30, 2011 1:30 pm
Forum: General
Topic: CPU usage percentage incorrect?
Replies: 1
Views: 1015

CPU usage percentage incorrect?

So I set my CPU to 100 MHZ. At that point the router can route + nat about 10 megabit (I can go to about 40). Strangely, the CPU indicates it is being used for about 30%. Same usuage then when it is on 680 MHZ. So I could conclude the CPU is not being maxed out at 100 MHZ but the fact I can only get...
by Jeroen1000
Wed Apr 27, 2011 8:58 pm
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

How about fixing the discovery protocol while you guys are at it? Take a look here http://forum.mikrotik.com/viewtopic.php?f=17&t=50595

Also will we be able to change the username? Last question, what is 802.1q Tunneling?

Thanks,
Jeroen
by Jeroen1000
Wed Apr 27, 2011 8:55 pm
Forum: General
Topic: VLAN via switch chip: how do I reach the router?
Replies: 4
Views: 5128

Re: VLAN via switch chip: how do I reach the router?

Nice find actually! I do prefer having a real switch in front of the router now. Makes life so much easier. Routerboards are great though, but they do have their oddities. I'd say you get a lot more than you pay for but at times to many bugs exist.
by Jeroen1000
Fri Apr 22, 2011 1:14 am
Forum: SwOS
Topic: VLAN Tagging on SwOS
Replies: 5
Views: 14365

Re: VLAN Tagging on SwOS

What are you trying to do exactly? Can't figure it out from your post.
by Jeroen1000
Wed Apr 20, 2011 4:36 pm
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

Owww, I may have been so frightened by my previous "biased" tests I didn't realized something: hardware switching isn't occuring at all unless master-port feature is used, and then occurs only within this defined virtual switch? That is what I make of it, without a master-port every ether...
by Jeroen1000
Sun Apr 17, 2011 3:11 am
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

If you can make a setup without the UPNP variable which leaks broadcasts, I'll setup my router the exact same way for verification. I don't think my current setup was a good indication for the switch leaking broadcasts. I just wanted to see whether it worked correctly. In the meantime I propose we t...
by Jeroen1000
Sat Apr 16, 2011 8:03 pm
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

I'll try to recreate what you are doing when I have some more time. I can't break my current setup now as I have to many other stuff waiting to be done. So, ATM I do not have a master port and stuff. My setup is very very simple actually. I just created 2 VLANs on ether1 (ether1 is a trunk port, the...
by Jeroen1000
Fri Apr 15, 2011 8:41 pm
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

I'll read this thoroughly. Looks like this may be an issue. Hmm ^^

Seeing I'm not a network specialiast or anything I'll voice some wild guess first thought. It is a bug and UPNP gets enabled on every interface? Can you also get normal broadcast traffic to show up on the TEST interface?
by Jeroen1000
Thu Apr 14, 2011 11:52 pm
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

Exellently put. I enjoyed reading it! Greg is confused about the order of the chains through which packets travel. It seems he thinks it will hit the input chain first because packets coming from the WAN travel to the public address on the router. And the reason why it does not hit the input chain f...
by Jeroen1000
Thu Apr 14, 2011 12:39 pm
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

For the rest of your problem, could you present some more information? Ip addresses and your testing secenario would be of a lot of help. I think you are not getting many replies because it is a bit vague. I'm sure we can figure out what is happening.
by Jeroen1000
Thu Apr 14, 2011 12:32 pm
Forum: General
Topic: RouterBoard: lvl 2 switching threatening lvl 3 security
Replies: 16
Views: 5081

Re: RouterBoard: lvl 2 switching threatening lvl 3 security

If you read around a bit, you will see that ROS cannot support tagged and untagged frames on the same interface (supposedly a hardware limitation). I practically wrote a book on it here on the forums before support said it could not be done. Read my threads and all this may become a lot clearer (it ...
by Jeroen1000
Thu Apr 14, 2011 2:20 am
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

I think I know what Greg's question is now. My penny dropped from reading his last post. The raw socket stuff has indeed little to do with it. I think he wants to know how to filter a WOL packet when forwarding a port (any port) to a host. Greg, is my assumption correct? @fewi, a site called depicus...
by Jeroen1000
Thu Apr 14, 2011 2:00 am
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

Sorry for my english. I don't mean wrong as in 'your fault'. I mean I think the rules are simply behaving correctly. If the NAT table is hit first, you might not be able to stop the packet anymore... This tought me everything I know about raw sockets. I fail to see how they are an immediate threat f...
by Jeroen1000
Thu Apr 14, 2011 12:56 am
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

After reading up I must conclude a raw socket can only be opened on a host where you have root access. A raw socket indeed bypasses the TCP/IP stack (and perhaps this way you can bypass iptables on the router) but I don't see how this can be done over the internet (unless someone has access to your ...
by Jeroen1000
Wed Apr 13, 2011 10:05 pm
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

Thanks I'll try that. And I meant forward chain in my previous post. I think I can explain what happens but I'll need to see it first.
So from the outside you mean I can just send a WOL packet from a site like depicus.com?

http://www.depicus.com/wake-on-lan/woli.aspx
by Jeroen1000
Wed Apr 13, 2011 9:54 pm
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

Then I should find out what a raw packet is also. Can you explain how you test? I want to try this 4 myself...

I do not know how intimate your knowledge with IP Tables is, but packets _not_ destined for the router can be filtered at the input chain (I'm not very good with IP Tables either lolz).
by Jeroen1000
Wed Apr 13, 2011 8:25 pm
Forum: General
Topic: Wake On Lan (magic packet) - how is it getting through?
Replies: 39
Views: 18681

Re: Wake On Lan (magic packet) - how is it getting through?

I don't quite get your question m8. Could you please explain more clearly? Perhaps a more concrete example would help. I even want to test it for you on my setup. If a connection is initiated from the WAN, the firewall should not allow this traffic (so it should block it) unless you forward specific...
by Jeroen1000
Wed Apr 13, 2011 1:26 pm
Forum: SwOS
Topic: Mikrotik Discovery Protocol on SwOS
Replies: 6
Views: 11345

Re: Mikrotik Discovery Protocol on SwOS

Hi,

any word on this yet?
by Jeroen1000
Sat Apr 09, 2011 9:53 pm
Forum: General
Topic: RouterOS 5.1 is out!
Replies: 93
Views: 22109

Re: RouterOS 5.1 is out!

I'll post my Q here too, has the VLAN-bug been resolved now (mentioned here)
by Jeroen1000
Sat Apr 09, 2011 9:48 pm
Forum: General
Topic: OS v5.0 - VLAN bugs - No GO
Replies: 26
Views: 5917

Re: OS v5.0 - VLAN bugs - No GO

Is the VLAN-bug fixed now? I see no mention of it in the ROS 5.1 changelog.
This bug is fixed. Currently it needs to be tested internally. This issue will be resolved in v5.1.
by Jeroen1000
Wed Apr 06, 2011 1:25 pm
Forum: SwOS
Topic: Mikrotik Discovery Protocol on SwOS
Replies: 6
Views: 11345

Re: Mikrotik Discovery Protocol on SwOS

v4.17 (as there is said to be a bug in 5.00 regarding VLANs). It seems to age until 143 seconds on the routerboard. Then the entry disappears. On SwOS I'm using firmware 1.4.
by Jeroen1000
Wed Apr 06, 2011 1:12 pm
Forum: SwOS
Topic: Mikrotik Discovery Protocol on SwOS
Replies: 6
Views: 11345

Re: Mikrotik Discovery Protocol on SwOS

Hello,

No, the default IP on the switch has been changed to 192.168.0.251. The Mikrotik Discovery Protocol option has been checked.

I only get to see the switch on my routerboard 450G when I disable and then reenable discovery on its VLAN10 interface (= trunk to the 250GS)
by Jeroen1000
Tue Apr 05, 2011 5:38 pm
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

This is probably the place to add another request so here goes:

Make the user login name configurable. I'd like to change it from "admin" to something more suitable as per my username/password policy.
by Jeroen1000
Tue Apr 05, 2011 5:25 pm
Forum: SwOS
Topic: Mikrotik Discovery Protocol on SwOS
Replies: 6
Views: 11345

Mikrotik Discovery Protocol on SwOS

When I enable this protocol on the correct interface on my RB450G, it finds my 250GS switch. However, the entry for the 250GS ages, and then disappears from the RB450G's neigbor list (this was after > 120 seconds). Isn't the 250GS supposed to send (broadcast?) neighbor messages to the router at some...
by Jeroen1000
Mon Apr 04, 2011 10:21 pm
Forum: General
Topic: OS v5.0 - VLAN bugs - No GO
Replies: 26
Views: 5917

Re: OS v5.0 - VLAN bugs - No GO

bug has been mentioned here also: http://forum.mikrotik.com/viewtopic.php?f=2&t=49810

I'm sure there will be a fix. Any time frame on this?
by Jeroen1000
Fri Apr 01, 2011 9:30 am
Forum: General
Topic: RouterBoard Documentation and Mikrotik
Replies: 19
Views: 7168

Re: RouterBoard Documentation and Mikrotik

macgaiver, I'm not expecting that at all. It is (and probably was, judging from our testing) just not clear that certain setups can be accomplished. The questions are just to match the expected behaviour with the options' description. The main issue at play here is that it is rather hard to get a st...
by Jeroen1000
Thu Mar 31, 2011 1:29 pm
Forum: General
Topic: RouterBoard Documentation and Mikrotik
Replies: 19
Views: 7168

Re: RouterBoard Documentation and Mikrotik

I'm wondering whether we are experiencing the same issue with VLANs and reaching an IP-address on the router. I think this has to do with the /interface ethernet switch rule menu. You list it as issue f: "f, in 4.x series you cannot make rules to switch cpu port, and you can't communicate with ...
by Jeroen1000
Thu Mar 31, 2011 5:41 am
Forum: General
Topic: RouterBoard Documentation and Mikrotik
Replies: 19
Views: 7168

Re: RouterBoard Documentation and Mikrotik

Willy, are you dutch? I would like to get in contact with you if possible.
by Jeroen1000
Thu Mar 31, 2011 4:33 am
Forum: SwOS
Topic: Switch VLANs control
Replies: 3
Views: 3970

Re: Switch VLANs control

Darn:-) could you explain your last post? What does this have to do with all of this? I'm very curious as I'm as stuck as stuck can be!

Why would a VLAN have a MAC address?
by Jeroen1000
Wed Mar 30, 2011 11:04 pm
Forum: SwOS
Topic: feature requests / bugs summary (RB250GS/ RB260GS)
Replies: 38
Views: 35927

Re: feature requests / bugs summary

+1 good job!
by Jeroen1000
Wed Mar 30, 2011 10:58 pm
Forum: SwOS
Topic: Switch VLANs control
Replies: 3
Views: 3970

Re: Switch VLANs control

Isn't port membership justs setting a default VLAN-ID? I too am noticing Mikrotik to be rather unsuportive with this:(

FIPtech how VLAN savvy are you? I could use some help determining whether a simple thing is possible:).
by Jeroen1000
Wed Mar 30, 2011 10:56 pm
Forum: SwOS
Topic: please do not tag default vlan in "add if missing" mode
Replies: 24
Views: 21729

Re: please do not tag default vlan in "add if missing" mode

Can someone explain this issue more clearly please?
by Jeroen1000
Wed Mar 30, 2011 2:54 am
Forum: General
Topic: ROS not implementing full switch functionality on RB450G?
Replies: 0
Views: 1044

ROS not implementing full switch functionality on RB450G?

I've noticed something that has been bothering/driving me a bit mad. I'm not 100% sure but the Mikrotik 250GS switch seems to be based on the same Atheros switch chip that is in the RB450G. However, with Router OS, a very important option appears to be missing. Please read on if you are interested:)...
by Jeroen1000
Mon Mar 28, 2011 7:48 pm
Forum: General
Topic: VLAN via switch chip: how do I reach the router?
Replies: 4
Views: 5128

VLAN via switch chip: how do I reach the router?

Hi everyone, I've never seen anyone attempt this and together with andrewluck I've been trying to get a wire-speed VLAN working. The "easy" part is setting up the VLAN itself (communication between hosts in the same VLAN). Mikrotik documentation has an example on how to do this. The hard p...
by Jeroen1000
Mon Mar 28, 2011 5:43 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

====> Discussion going on here I'm "closing" this topic down because it is getting way to complicated to follow. I've made some more advances and pinpointed where things go wrong. I do feel I'm very close to a solution but I have not been able to crack the (hopefully) final piece of the pu...
by Jeroen1000
Sat Mar 26, 2011 1:25 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Some success:)

Update: So in the previous post I did: /interface vlan> print Flags: X - disabled, R - running, S - slave # NAME MTU ARP VLAN-ID INTERFACE 0 R VLAN10 1500 enabled 10 ether5 /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 192.168.0.250/24 192.16...
by Jeroen1000
Sat Mar 26, 2011 2:39 am
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Hi Andrew, I've got some good news to report. The devices * in VLAN 10 attached to the Cisco switch can now reach the router (and also have internet). What I did was as simple as everything but just a lucky shot to be honest: 1)I created a VLAN 10 (with corresponding VLAN ID 10)on the ether5 interfa...
by Jeroen1000
Fri Mar 25, 2011 11:47 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

haha so true, being concise is my expertise :D What you said did work though! I must admit I don't yet understand why this works. Does the CPU-port only accept untagged packets? However, to keep it clean I put my IP (192.168.0.251/24) on the trunk port (ether 5). So that's the only IP configured on ...
by Jeroen1000
Fri Mar 25, 2011 12:25 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

VLAN via swtich chip: cannot ping router interface

Good idea Andrew, I've had no luck getting everything to work. It's not a very complicated setup. I'll try to explain very clearly, do ask if I'm not doing so :) I've got following devices: 1) A correctly configured Cisco VLAN switch with a VLAN 10 (192.168.0.x) and a VLAN 20. VLAN 20 is special bec...
by Jeroen1000
Thu Mar 24, 2011 8:01 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Well yeah, I shouldn't have called it a side-effect lol. However, you can't just put a port in a VLAN with Mikrotik. It is the rule table that decides (by the means of defining rules) where a tagged frame is allowed to go to. Say you have 3 ports on the Mikrotik that are in VLAN 10, lets call these ...
by Jeroen1000
Thu Mar 24, 2011 2:57 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Andrew, I've set ether3 as master port and assigned an IP to it. Ether4 and 5, the slave ports, can now communicate with the CPU port (=the IP on the master port). However, as a side effect ether4 can now talk to ether5 without me allowing this. If I would like these ports to behave as in different ...
by Jeroen1000
Thu Mar 24, 2011 2:00 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Thanks Andrew, I'll try that. I have made some progress though. It does show some quirky behaviour :lol: /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 192.168.0.240/24 192.168.0.0 192.168.0.255 ether4 /interface ethernet switch rule> print Fl...
by Jeroen1000
Tue Mar 22, 2011 5:52 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Yep, I've got a gateway. I can ping between devices on the same network just fine (if I add rules to the rule table to allow this). I just can't ping any IP assigned to the router itself.

I.E. I do not know how to pass packets from the switch logic to the cpu port.
by Jeroen1000
Mon Mar 21, 2011 7:19 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Still stuck:(. Does anyone know how to fix this one?
by Jeroen1000
Sat Mar 19, 2011 12:03 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

I had once(and at the time I thought I shouldn't worry about that), but I'm not at all sure whether it is really needed. I think you can just write rules to allow access to the CPU port. You see, with Mikrotik you need to write a rule to allow one access/untagged port, access to another. That is why...
by Jeroen1000
Sat Mar 19, 2011 1:00 am
Forum: General
Topic: weird problem:WAN-IP becomes unreachable [solved]
Replies: 3
Views: 2219

Re: weird problem:WAN-IP becomes unreachable [solved]

I've found what was wrong. A Nat rule was forwarding all trafic to an internal host. Very stupid of me to overlook this. Oh well, another thing well learned I guess. The reason it takes a while for the issue to turn up after a reboot, is that a script was putting the correct (dynamic) WAN-ip in the ...
by Jeroen1000
Fri Mar 18, 2011 8:08 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Oh oh master port? I'll check what it is but I've not tinkered with whathever that is. I only put an IP on ether3-local and tried to reach that:).
So I forgot a vital step if I understand you correctly:-)?
by Jeroen1000
Fri Mar 18, 2011 7:53 pm
Forum: General
Topic: weird problem:WAN-IP becomes unreachable [solved]
Replies: 3
Views: 2219

Re: weird problem:WAN-IP becomes unreachable

I dare not say in all respects. I can access the router from within my LAN. All LAN hosts can reach the internet. There is no high CPU load (on the router). Browsing is very snappy and without lag (on the hosts). So as far as I can tell, every else is normal. The only option left I can personally th...
by Jeroen1000
Fri Mar 18, 2011 5:56 pm
Forum: General
Topic: weird problem:WAN-IP becomes unreachable [solved]
Replies: 3
Views: 2219

weird problem:WAN-IP becomes unreachable [solved]

Support is already on this, but perhaps someone has been through this before me. I'm running the Ros v4.17. When I restore my configuration, and the router comes online, I can ping its WAN-ip just fine (I'm pinging it from a workstation to which I connect using Radmin). All of the sudden it stops re...
by Jeroen1000
Thu Mar 17, 2011 11:07 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

I'm pinging from a computer connected directly to the mikrotik (port ether2-local). I'm having problems pinging any IP on the router itself. But client computers can ping eachother just fine.

And if the clients can't reach the router I can't even manage it apart from using the serial console.
by Jeroen1000
Thu Mar 17, 2011 10:36 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

Unfortunately, no dice. Must be something wrong with the rules themselves. I wonder what it could be as it all seems to logically fit.
by Jeroen1000
Thu Mar 17, 2011 9:32 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

Re: VLAN via swtich chip: cannot ping router interface

I'm sure I rebooted but now I'm not sure I really did. I'll check out the table just to be sure.
by Jeroen1000
Thu Mar 17, 2011 4:48 pm
Forum: General
Topic: VLAN via switch chip: cannot ping router interface
Replies: 26
Views: 10645

VLAN via switch chip: cannot ping router interface

Hi everyone, I've followed the article about the VLAN-switch chip on the wiki to create a VLAN that can take advantage of the full wire speed the switch chip offers. My VLAN is in essence working however, I cannot ping a single interface on the router. Please take a look at following: /interface eth...
by Jeroen1000
Tue Mar 15, 2011 4:53 pm
Forum: General
Topic: SSH not working to WAN IP
Replies: 2
Views: 4214

Re: SSH not working to WAN IP

Blast, sorry for the posting frenzy but it stopped working after a reboot. If I do not assign the public IP to the WAN interface (ether 5) I cannot ping the routers' WAN IP.

So the question is: why does assigning the public IP to the WAN-BRIDGE cause the router to stop responding to pings?
by Jeroen1000
Tue Mar 15, 2011 3:18 pm
Forum: General
Topic: SSH not working to WAN IP
Replies: 2
Views: 4214

Re: SSH not working to WAN IP

I've deleted my bridge and assigned the WAN IP to my WAN interface instead assigning it to the brigde. Then everything decided to work. I've then recreated the brigde and set everything to what it was when it did not work, except now it does work.

Must be some glitch:-). :?
by Jeroen1000
Tue Mar 15, 2011 1:36 pm
Forum: General
Topic: SSH not working to WAN IP
Replies: 2
Views: 4214

SSH not working to WAN IP

Me again:) with a semi-bizarre issue. I've gotten my entire configuration working (with quite some help :) ) so I thought it might be useful to be able to manage the router when I'm not home. SSH, WINBOX, ... - you name it - all work as long as I'm in the LAN. But I can't even ping to the WAN IP at ...
by Jeroen1000
Tue Mar 08, 2011 7:59 pm
Forum: General
Topic: RouterBoard Documentation and Mikrotik
Replies: 19
Views: 7168

Re: RouterBoard Documentation and Mikrotik

I too could use some more explanation about the switch chip in my 450G regarding VLANs. Any current plans to expand this section?
by Jeroen1000
Tue Mar 08, 2011 12:05 am
Forum: General
Topic: How should NTP-server behave?
Replies: 2
Views: 1630

Re: How should NTP-server behave?

If the stratum of Windows is 2, it will not accept the Mikrotik as a more reliable source. I had that issue first:). That kind of resolved itself after a reboot (Windows reboot that is). The Mikrotik has stratum 3, and Windows now (correctly) says it has 4. My question is specifically with the large...
by Jeroen1000
Mon Mar 07, 2011 6:09 pm
Forum: General
Topic: How should NTP-server behave?
Replies: 2
Views: 1630

How should NTP-server behave?

I've set up NTP-client on my RouterBoard 450G and it is synchronised with a server. Then I installed the NTP-server package and configured it as follows: /system ntp server> print enabled: yes broadcast: no multicast: no manycast: no My Windows client update just fine from the server but I've notice...
by Jeroen1000
Sun Mar 06, 2011 5:14 pm
Forum: General
Topic: Firewall logging not working as expected
Replies: 6
Views: 1799

Re: Firewall logging not working as expected

I'm thinking UPnP is kind of risky. I briefly tried it and couldn'd be bothered to make it work. You are correct about the XBOX 360 not needing a "full DMZ host", I could simply look up the specific ports it uses. However, I've puzzled a script together that appears to be working. It's far...
by Jeroen1000
Sun Mar 06, 2011 1:30 am
Forum: General
Topic: Firewall logging not working as expected
Replies: 6
Views: 1799

Re: Firewall logging not working as expected

That destination NAT rule forwards all new connections established from the WAN to your WAN interface to 192.168.0.5. It does that by changing the destination IP address from your public IP to 192.168.0.5. At that point the destination IP address is no longer an IP on a router interface, so that tr...
by Jeroen1000
Sun Mar 06, 2011 12:13 am
Forum: General
Topic: Firewall logging not working as expected
Replies: 6
Views: 1799

Re: Firewall logging not working as expected

Alright :) , I've made some progress. I've determined what part of the config is causing my problem. I wanted to set a game console as DMZ. The problem with this is, is that my WAN interface has a public IP. This IP is dynamic. So I could not specify a destination address for the dstnat chain: Flags...
by Jeroen1000
Sat Mar 05, 2011 10:30 pm
Forum: General
Topic: Firewall logging not working as expected
Replies: 6
Views: 1799

Firewall logging not working as expected

Well, probably it's just me doing something wrong. I have following rules set up: Flags: X - disabled, I - invalid, D - dynamic 0 ;;; Drop invalid connections chain=input action=drop connection-state=invalid 1 ;;; Allow established connections chain=input action=accept connection-state=established 2...
by Jeroen1000
Thu Mar 03, 2011 4:30 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Valid points although for (1) the RB450 and RB493 should be able to do this (you can divide the switch chip). Doesn't make all too much sense since port count is pretty low.

and (5) is a really cool option.
by Jeroen1000
Tue Mar 01, 2011 7:20 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

What features are you missing? if you check out http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features the Atheros8316 seems to be a fully featured switch chip. And I do agree entirely, using the routerboard just for routing (or inter vlan routing) is more powerful yet less complex. I know L3 swi...
by Jeroen1000
Tue Mar 01, 2011 4:39 am
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Glad to hear you got it working. Thanks, just for clarity, my LAN now looks like so: Cable modem -------- (ether 5=WAN) Mikrotik (ether 1 = trunk) ------- -Cisco switch ------- VLAN 10 + VLAN 20 ......................................................(ether 2) ------ 'dumb' switch The ....... are jus...
by Jeroen1000
Mon Feb 28, 2011 11:35 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Indeed, just enabling them made everything work. Many thanks for helping me achieve this. Something I found out is, that if you want more ports of the Mikrotik in VLAN 10 (internal lan) you must: 1) create a bridge 2) assign an IP to that bridge 3) assign VLAN 10 to the bridge 4) assign any port you...
by Jeroen1000
Fri Feb 25, 2011 3:19 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Darn, I've setup the VLAN thing and no dice. Could you please take a look for potential errors? I had internet access _before_ I configured the VLANs, so most of this works apart from the actual VLAN stuff. On the cisco I put a port in VLAN 10 (access port) with matching PVID 10 and I configured the...
by Jeroen1000
Thu Feb 24, 2011 5:05 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Most interesting topic this is. It all looks so easy, in theory. Basically what VLANs are is a way to logically divide up the same hardware so each section acts as it's own independent piece of hardware where one VLAN cannot see or talk to another VLAN. So with an untagged port any traffic leaving t...
by Jeroen1000
Thu Feb 24, 2011 4:49 pm
Forum: General
Topic: Switch chip VLAN
Replies: 0
Views: 709

Switch chip VLAN

Continuing my VLAN experiments, I've realised switching will give me full wire speed and bridging won't. Right now, I've got a 4-bay NAS connect and a 20-bay NAS connected to my network. One of both might end up on the MicroTik switch so wire speed will be a real plus when the 4-bay unit is being ba...
by Jeroen1000
Thu Feb 24, 2011 12:10 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Thanks Feklar, I'll have lots of fun tinkering with it. Just out of curiosity (you seem to be a VLAN-expert) and not Mikrotik related, what would Cisco mean by this (I hope I'm not bothering you with all these questions) Tx Force untag: when this option is enabled, all egress frames from this port b...
by Jeroen1000
Wed Feb 23, 2011 11:24 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

Re: (tagged) VLAN high level configuration question

Hi Feklar. First of all, thank you for taking the time to type up such an informative reply. I had discovered you explaining this somewhere else too, but I'm not sure I really thoroughly understand what is going on. Thank god I'm starting off relatively simple. I hope you can help me some more on th...
by Jeroen1000
Wed Feb 23, 2011 8:19 pm
Forum: General
Topic: (tagged) VLAN high level configuration question
Replies: 16
Views: 4841

(tagged) VLAN high level configuration question

Hey everyone, I just got my MikroTik device and I'm very excited. I've just created a WAN-port which asks DHCP from my cable modem (=asking a public IP)and I've assigned the remaining 4 LAN ports to a bridge. My internal 192.168.x.x/24 network is being NATTED just fine. I owe the wiki and forum my t...
by Jeroen1000
Mon Feb 21, 2011 1:20 pm
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

Re: 450G question about NAND memory + POE interface

So we can't brick the unit that way. That's a good thing.

Will it affect the license? There are some posts saying it does, and others saying it does not.
by Jeroen1000
Mon Feb 21, 2011 12:56 pm
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

Re: 450G question about NAND memory + POE interface

Thank you for clearing this up Normis. Is the boodloader present on a seperate chip or is it on the storage NAND also? (I believe bootloaders only take very little space as a fully fledged BIOS is less than 10 MiB). I'm asking because I'm curious and as to what will happen if one opts to format the ...
by Jeroen1000
Sun Feb 20, 2011 7:52 pm
Forum: RouterBOARD hardware
Topic: can't connect to router
Replies: 2
Views: 991

Re: hi

I don't know to answer but a better topic title than "hi" may lead to faster answers.
by Jeroen1000
Sun Feb 20, 2011 7:10 pm
Forum: RouterBOARD hardware
Topic: Asus RT-N16
Replies: 5
Views: 6475

Re: Asus RT-N16

I could be wrong but I've been searching for a good router also so I could give you lots of info but too keep it short, I believe the answer is "NO".
by Jeroen1000
Sun Feb 20, 2011 3:07 pm
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

Re: 450G question about NAND memory + POE interface

HDD is another word for NAND(meaning storage here) then. 1 GiB for the OS :shock: isn't that total overkill? Oh, sorry I didn't connect the HDD to the NAND thing.

Can you find any reference connecting that 64 MB to the bootloader? It would make sense though.
by Jeroen1000
Sun Feb 20, 2011 2:34 pm
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

Re: 450G question about NAND memory + POE interface

@InoX, I can see the SDRAM, 256MB. That's just the system memory as it is used in computers.
But I'm trying to figure out the purpose of both the 512 MB NAND and the 64 MB NAND (both mentioned in the PDF I linked to).
by Jeroen1000
Sun Feb 20, 2011 1:58 am
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

Re: 450G question about NAND memory + POE interface

Can anyone offer some more information about the other numbers?
by Jeroen1000
Sat Feb 19, 2011 2:24 pm
Forum: RouterBOARD hardware
Topic: 450G question about NAND memory + POE interface
Replies: 10
Views: 2825

450G question about NAND memory + POE interface

I'm a bit confused about the spec's:-). Since my unit is just in the mail, I'm what you could call very new:) so I hope I can ask some more questions. In this PDF (http://www.routerboard.com/pricelist/download_file.php?file_id=143) it states "512MB onboard NAND memory chip, microSD card slot (o...
by Jeroen1000
Fri Feb 18, 2011 2:16 pm
Forum: RouterBOARD hardware
Topic: Routerboard 450G performance
Replies: 1
Views: 1370

Routerboard 450G performance

Dear community, Are there numbers about the expected LAN - > WAN and WAN -> LAN throughput (NATTED)? I'm looking for at least 100 megabit throughput (well in both directions if fiber to the home takes off). Also, can the switch (grouping 4 ports together) be configured for wire speed? At this moment...