Community discussions

MUM Europe 2020

Search found 378 matches

  • 1
  • 2
by mag
Mon Jul 09, 2012 11:41 pm
Forum: Wireless Networking
Topic: q: simultaneous 2.4 and 5.2 GHz
Replies: 5
Views: 1223

Re: q: simultaneous 2.4 and 5.2 GHz

Sorry, forgot to make that point clear: yes, MIMO (2x2) should be used.

(Otherwise it would be a bit trivial ;-)
by mag
Thu Jul 05, 2012 12:51 pm
Forum: Wireless Networking
Topic: q: simultaneous 2.4 and 5.2 GHz
Replies: 5
Views: 1223

q: simultaneous 2.4 and 5.2 GHz

I couldn't find a solution by searching and the question might also be of interest for others, so I am asking it here: Many WLAN-routers/IADs allow simultaneous use of WiFi 2.4 and 5.2 GHz. However, only the usual 2 antennas are build on these devices. Would it be possible to implement that with a R...
by mag
Thu May 13, 2010 12:40 pm
Forum: General
Topic: Best method to load balance 2 internet line?
Replies: 115
Views: 29823

Re: Best method to load balance 2 internet line?

sorry it's years ago i used that stuff... but why not pinging the PPPoE-clients public IP-address? If the corresponding ADSL-line disconnects, the IP-address is unreachable as well. unfortunately this IP-Address will possibly be given to another ISPs client, but usually not within seconds. plus one ...
by mag
Fri Apr 30, 2010 1:38 pm
Forum: General
Topic: RB450G Scrambled serial Text
Replies: 4
Views: 1682

Re: RB450G Scrambled serial Text

i have seen things like that on older USB/serial-adapters, probably caused by the serial controller chip.
only solution i know is trying another adapter.
by mag
Mon Apr 26, 2010 12:15 pm
Forum: RouterBOARD hardware
Topic: RB/750G switch chip features
Replies: 2
Views: 4418

Re: RB/750G switch chip features

Thank you for the answers. 1) Only 450G supports this feature. Ok, i just tried because it seems to have the same chipset. 2) Do you mean adding VLAN tags for specific ports? yes probably. A short example of a 2-port VLAN (id/tag 101), where ether1 is tagged (trunk port) and ether2 is untagged (acce...
by mag
Sun Apr 25, 2010 6:59 pm
Forum: RouterBOARD hardware
Topic: RB/750G switch chip features
Replies: 2
Views: 4418

RB/750G switch chip features

According to http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Port_Switching I am trying some functions. First one is this: Ether1 port on RB450G has a feature that allows it to be removed/added to the default switch group. By default ether1 port will be included in the switch group. This c...
by mag
Sat Apr 24, 2010 4:56 pm
Forum: General
Topic: v5.0 PPPoE cllient wont get ipv6 address?
Replies: 6
Views: 2415

Re: v5.0 PPPoE cllient wont get ipv6 address?

The above described behavior of IPv6CP is correct and standard conform. What we need on MT-ROS is called "prefix-delegation" via PPP or similar links, where a delegating router (CO) gives the CPE a prefix, and the CPE selects subnets for the interfaces from that prefix. I hope MT will work it into R...
by mag
Fri Jun 13, 2008 2:36 pm
Forum: Beginner Basics
Topic: telnet, ssh to RouterOS 3.10 from MacOS X 10.5.3
Replies: 2
Views: 1875

Re: telnet, ssh to RouterOS 3.10 from MacOS X 10.5.3

arghh! thx - you saved my life, at least ;-)
by mag
Fri Jun 13, 2008 1:31 pm
Forum: Beginner Basics
Topic: telnet, ssh to RouterOS 3.10 from MacOS X 10.5.3
Replies: 2
Views: 1875

telnet, ssh to RouterOS 3.10 from MacOS X 10.5.3

After upgrading the Mikrotik OS to 3.10 and MacOS to 10.5.3 (i don't know wchich one caused the change) the build in terminal is no longer working correctly. All output is in one line and unreadable. I tried to change some parameters in the MacOS X terminal but didn't have success. Has anyone solved...
by mag
Sat Jun 02, 2007 5:35 pm
Forum: General
Topic: changing pptp-port or using second one
Replies: 1
Views: 1430

changing pptp-port or using second one

is it possible to change the standard pptp-server port 1723 to another port no., or even better use another port as second?

TIA.
by mag
Sun May 27, 2007 11:13 am
Forum: General
Topic: PPTP connecton wont pass much data
Replies: 1
Views: 582

Re: PPTP connecton wont pass much data

MTU-Problem? Could be tested by increasing ping packet size with don't fragment-bit (DF) set.
by mag
Tue May 08, 2007 11:36 am
Forum: General
Topic: Hotspot issues with Mac
Replies: 3
Views: 872

Re: Hotspot issues with Mac

Tried it a year ago, can't remember any problems.
May be you could post things like arp-cache, netstat -rn, ping- and traceroute-logs.
by mag
Fri May 04, 2007 10:59 am
Forum: General
Topic: Tftp Server
Replies: 10
Views: 3417

Since I don't usuallly use a windows machine, either a Mac or Sun box, I would really like to be able to use a standard tftp server to upgrade the router.
simply use scp. works perfect.
by mag
Tue May 01, 2007 1:54 pm
Forum: Wireless Networking
Topic: Spectrum Analyzer
Replies: 14
Views: 2847

Up!

I think his is VERY interesting for ALL user.
NO, please don't do this. If i want an analyzer i'd buy one. If i want a router i dont't want it to do other tings than routing! (or at least very similar things)
by mag
Tue Apr 24, 2007 5:09 pm
Forum: General
Topic: Route/Ospf Metric/Distance
Replies: 3
Views: 2184

Re: Route/Ospf Metric/Distance


What I am missing is some information in ROS what metrices
my routes actually have.
i'd guess one will see different distances only, when exporting routes from one routing protocol into another.
by mag
Sun Apr 22, 2007 9:45 am
Forum: General
Topic: MPLS - what will you use it for?
Replies: 3
Views: 1698

MPLS - what will you use it for?

i've seen the MPLS-feature on top of the wishes list. i am wondering what do people like to achieve with MPLS? Connecting WLAN to fat MPLS backbone to switch labels with customers or ISPs? personally i am interested in the MPLS ability to build up fully meshed networks with different services (e.g. ...
by mag
Sun Apr 15, 2007 5:12 pm
Forum: General
Topic: OSPF is loosing routes
Replies: 9
Views: 1909

There is no need to set network type on each interface running OSPF unless you need specific network type.
but i would select PtP-interface type whenever possible, cause it saves the router from the whole DR-/BDR-selection work.
by mag
Thu Mar 22, 2007 6:47 pm
Forum: General
Topic: Load balancing 2 links to same ISP
Replies: 3
Views: 1245

Re: Load balancing 2 links to same ISP

Whole idea is agregating all avaliable traffic to single logical link without changing source ip adress. Best would be using some kind of Ethernet-trunk/-channel. That would recommend of course an adequate switch at the ISP-side too. the usual way is (OSPF-) ECMP, but this is working at the IP-layer.
by mag
Thu Mar 22, 2007 2:14 pm
Forum: General
Topic: IP POOL for VPN
Replies: 2
Views: 823

there's an example in the wiki.
by mag
Mon Mar 12, 2007 10:00 pm
Forum: General
Topic: VPN PPTP connections
Replies: 2
Views: 880

by mag
Sat Mar 10, 2007 1:26 pm
Forum: General
Topic: Implementation TFTP Server on Mikrotik
Replies: 2
Views: 1013

Re: Implementation TFTP Server on Mikrotik

BTW, tftp-servers on routers are quite common (Cisco, Juniper, Extreme, and alot more:-), they are easier and smaller to implement into the routers firmware, but a bit more difficult to use than ftp. Both are very unsecure, ftp even more. i prefer using ssh (scp is contained) with public key install...
by mag
Sat Mar 10, 2007 1:03 pm
Forum: General
Topic: OSPF passive interface
Replies: 1
Views: 1051

OSPF passive interface

Is it possible to have an interface in passive mode with router os 2.9?

TIA
by mag
Sun Mar 04, 2007 2:30 pm
Forum: General
Topic: BETA Testing and Feature Suggestions for next routeros
Replies: 329
Views: 76635

Re: 802.11s ?

MPLS would be much better 8)
by mag
Tue May 23, 2006 11:59 am
Forum: General
Topic: IPsec over NAT
Replies: 5
Views: 1770

Re: IPsec over NAT

generally its not possible.
by mag
Tue May 23, 2006 11:52 am
Forum: General
Topic: VPN's
Replies: 3
Views: 1333

Re: VPN's

Has anyonme here been using RouterOS for long term Router to Router VPN's? Is RouterOS reliable for this? Yes, several IPSec-VPNs, some using Tunnel-Mode, others in Transport-Mode with EoIP and a few ones with PPTP. Yes, with MT-ROS 2.9. together with some scripting long uptimes (several months) ar...
by mag
Sat May 20, 2006 6:56 pm
Forum: General
Topic: OpenVPN
Replies: 38
Views: 13918

OpenVPN

Maybe it would be worth to consider implementing OpenVPN in 2.1 or 2.x.
by mag
Fri Mar 31, 2006 8:13 am
Forum: General
Topic: Complex Routing Setup
Replies: 3
Views: 947

is there a BGP feed from the ISP? BGP is (only) for exterior routing between ASes, OSPF will be the right choice for this scenario. How is the green wireless link created, between the APs or between the MTs? Three possible solutions come to mind: Using HSRP/VRRP between the two Ciscos, if a Layer2 c...
by mag
Wed Mar 29, 2006 5:31 pm
Forum: General
Topic: WARNING: 2.9.18 does not pass PPTP traffic properly
Replies: 17
Views: 2673

No problem with PPTP, just upgraded from 2.9.16 to .18. PPTP-Passthrough and -Server tested.
by mag
Sat Mar 25, 2006 2:09 pm
Forum: General
Topic: Problem with http-downloads via loadbalanced lines
Replies: 51
Views: 13349

I actually do have an idea for some simple solution that is distributing users/traffic (only) according to source address... sounds good, i'm looking forward to it ;-) Yes you´re right, but how should I use policy routing, if my source-machine is a webproxy? but not the web-proxy on the MT itself, ...
by mag
Sat Mar 25, 2006 2:02 pm
Forum: General
Topic: DNS cache
Replies: 4
Views: 1407

where's the problem? simply turn remote-requests off, if dns on the MT should not be used.
otherwise it's perfectly normal for DNS to build up a RAM-cache (except TTL=0 entrys, which are used vor dynDNS or NATted DNS-payload)
by mag
Sat Mar 25, 2006 9:54 am
Forum: General
Topic: Cisco VPN 3002 and Mikrotik
Replies: 15
Views: 3378

that's far to complex for an easy answer.
i would check end-to-end connectivity by using portscanner and packet-analyzer, if possible.

for a complicated mixture of protocols and applications, maybe installing a direct EoIP-tunnel through IPSec would be the easiest solution.
by mag
Fri Mar 24, 2006 10:01 pm
Forum: General
Topic: Setup MT to pass VPN connections
Replies: 7
Views: 1591

I run both IPSEC and PPTP through an MT with src-nat defined and it works fine using UDP encapsulation for the ESP packets.
I see. Are there many VPN-Clients using the same Protocol e.g. IPSec? Does this work too?
by mag
Fri Mar 24, 2006 9:58 pm
Forum: General
Topic: PPPoE Client How To?
Replies: 3
Views: 1336

this will not work with any Draytek Vigor, cause there's no transparent layer-2 connection.
by mag
Fri Mar 24, 2006 9:32 pm
Forum: General
Topic: Separate traffic over pppoe???
Replies: 2
Views: 923

as RADIUS is accounting traffic per user-session i don't think its possible.

the only thing i know is netflow, which counts traffic on ip-address-tuples:
http://www.mikrotik.com/docs/ros/2.9/guide/accounting.
by mag
Fri Mar 24, 2006 6:12 pm
Forum: General
Topic: 2GB limit
Replies: 7
Views: 1502

Why the heck would you want to upload such a large file TO a router (!) ??? :shock:
Probably the Coffee Machine Control Software ;-)

(no, i don't want to know actually)
by mag
Fri Mar 24, 2006 6:09 pm
Forum: General
Topic: DNS cache
Replies: 4
Views: 1407

AFAIK it stores in memory. I didn't see CF writes increasing while dig'ing my test MT-router.
by mag
Fri Mar 24, 2006 10:41 am
Forum: General
Topic: Problem with http-downloads via loadbalanced lines
Replies: 51
Views: 13349

I was discussing ECMP with some collegues and we are quite unsure if it would be reliable. Problems are known with HTTP and Instant Messenger-applications. One idea was if ECMP could be get to work on src-address only, these problems should disappear. i hadn't the time yet to test anything, but if s...
by mag
Fri Mar 24, 2006 8:42 am
Forum: General
Topic: Setup MT to pass VPN connections
Replies: 7
Views: 1591

That needs "NAT-T". AFAIK not supported by MT yet.
by mag
Fri Mar 24, 2006 8:40 am
Forum: General
Topic: AUTO UPGRADE FUNCTION
Replies: 5
Views: 33084

and it's not working AFAIK. see http://forum.mikrotik.com//viewtopic.php?t=7263
by mag
Thu Mar 23, 2006 9:26 am
Forum: General
Topic: NAT/masquerading question
Replies: 9
Views: 1785

dunno - but what about some firewall rule on outgoing interface? The thing is however, that NAT is being applied after the routing, so not sure what chain you would have to check, as it will be "forward". from the packet flow diagramm src-NAT/Masquerading is applied after that. Or what about loggin...
by mag
Thu Mar 23, 2006 9:21 am
Forum: General
Topic: 2 x PPPOE with Lan??
Replies: 3
Views: 1017

i would suggest policy-based routing. look at the manual http://www.mikrotik.com/docs/ros/2.9/ip/route , and there were examples in this forum.
by mag
Thu Mar 23, 2006 9:13 am
Forum: General
Topic: Proxy and routing
Replies: 4
Views: 1078

i'am doing similar things, but do not understand your question, sorry.
packets can not be splitted.
by mag
Tue Mar 21, 2006 10:38 pm
Forum: RouterBOARD hardware
Topic: New RouterBoard 100
Replies: 34
Views: 8507

I’m completely stupefied by the cheapo $50.00 linksys router getting 25 to 30 mbps with the crappie hardware and tiny cpu’s and then the router boards strain to get this speed
Which Linksys (WRT?) reaches > 20 Mbit througput? Never heard of such data rates.
by mag
Tue Mar 21, 2006 8:48 pm
Forum: General
Topic: Mikrotik and T1
Replies: 17
Views: 2577

SBE T1s are supported.. (DS3 as well)
Last year we tried SBE T3/E3 cards but they didn't work with Router OS.
We ended up using E3-Ethernet-converters.
I'm very interested if any E1 or E3 card is working reliable now.
by mag
Tue Mar 21, 2006 10:40 am
Forum: General
Topic: NAT/masquerading question
Replies: 9
Views: 1785

ok, never mind why this is not working...

but, how can one test NAT working from the router itself then?
by mag
Tue Mar 21, 2006 8:19 am
Forum: Wireless Networking
Topic: Howto improve AP with multi-sectors ?
Replies: 6
Views: 1697

Re: Howto improve AP with multi-sectors ?

I've read many topics where people "split" one AP with omni- antena to 3 or 4 sectors
Don't do this! One radio for each antenna is a must for professional use.

The two connectors are only for diversity or for separating RX and TX (interface wireless antenna-mode)
by mag
Mon Mar 20, 2006 6:48 pm
Forum: General
Topic: SNMP
Replies: 54
Views: 27268

Very good! Looking forward to it. Now we're using Ipswitch WhatsUp (fading out), InterMapper (my favorite:), Nagios (testing) and a few minor tools. SNMP-related things springing to mind are: Traps Configuration access e.g. interfaces, firewall rules, activating scripts,... (one more thing, not sure...
by mag
Mon Mar 20, 2006 6:38 pm
Forum: Scripting
Topic: Mikrotik can be Secondary DNS Server?
Replies: 1
Views: 1539

not really, i.e. it does not do zone-transfers, according to the dokumentation, but it can be used as a forwarder, which will build up a cache.
i would set cache-max-ttl=8h.
by mag
Mon Mar 20, 2006 6:30 pm
Forum: General
Topic: NAT/masquerading question
Replies: 9
Views: 1785

I thought that too ... maybe normally, if you would use ping without the source address parameter, it would be masqeraded, maybe that parameter is overriding it? if the ping is send without src-addr-parameter it goes right out of the WAN interface, originating from the public IP-address the WAN-int...
by mag
Mon Mar 20, 2006 2:47 pm
Forum: General
Topic: pppoe-relay
Replies: 29
Views: 18666

i am using often PPPoE to connect CPEs but had very few problems in using EoIP-tunnels over a routed (wireless) backbone or even through internet. I think its a question of network-design too, personally i like the idea of encapsulating customer traffic into tunnels, instead of flooding them through...
by mag
Mon Mar 20, 2006 11:27 am
Forum: General
Topic: NAT/masquerading question
Replies: 9
Views: 1785

How should this work? Hm, i thought this should match the masqerading rule? Like for any other Client on the internal side of NAT. concerning the packet-flow diagramm, i guessed it should go through local -> output ->postrouting (src-nat/masquerading) -> ... -> out-interface am i wrong? @normis: in...
by mag
Mon Mar 20, 2006 10:52 am
Forum: General
Topic: NAT/masquerading question
Replies: 9
Views: 1785

NAT/masquerading question

i can't see what is causing the following problem: {LAN} -- (MT-router, ROS 2.9.17) -- {WAN} using simple masquerading chain=srcnat out-interface=to-wan src-address=10.10.1.0/24 action=masquerade router has 10.10.1.1. now i do ping www.heise.de src-address=10.10.1.1 193.99.144.85 ping timeout 193.99...
by mag
Mon Mar 20, 2006 8:38 am
Forum: General
Topic: Feature wish - logical interface
Replies: 2
Views: 1814

it is partly possible by using bridges. i don't know how this affects performance, though.

on the other hand, i consider this behavior perfectly normal for a router...
by mag
Sun Mar 19, 2006 8:38 pm
Forum: General
Topic: 3rd party mac auth problem behind routeros
Replies: 2
Views: 581

sorry, sounds very interesting, but i don't understand the problem
by mag
Sun Mar 19, 2006 5:02 pm
Forum: Wireless Networking
Topic: Secure vlan trunk and wisp
Replies: 12
Views: 5027

i do completely agree. very good explanation.
Our goal is to secure bridge our corporate vlans
leads me to suggesting IPSec. (and i do like tunnels ;-)
by mag
Sun Mar 19, 2006 11:34 am
Forum: General
Topic: need help transparent proxy
Replies: 1
Views: 721

i'd guess something like (on the next MT):
add chain=dstnat in-interface=<lan> src-address=!<other-mt-ip> dst-address=!<local-net> protocol=tcp dst-port=80 action=redirect to-ports=3128
by mag
Sun Mar 19, 2006 11:18 am
Forum: Wireless Networking
Topic: Secure vlan trunk and wisp
Replies: 12
Views: 5027

I wouldn't use VLAN-trunks, but directly terminating the IPSec/EoIP-tunnel at the customer, similar to an ATM-PVC. On the AP side it should be possible to group the virtual-AP and the EoIP-tunnel within one particular bridge.

But it depends on the real demands...
by mag
Sun Mar 19, 2006 10:52 am
Forum: General
Topic: minor HCI usability wishes
Replies: 27
Views: 9284

A facility similar to that of IOS which allows piping CLI output through a filter.
you're right but it could be done already, e.g:

ssh admin@192.168.255.1 "/log print without-paging" | grep info
by mag
Sun Mar 19, 2006 10:35 am
Forum: General
Topic: Have we done something stupid? large subnet problem...
Replies: 12
Views: 2352

I would suggest also a redesign. One thing is using one central PPPoE-Server directly connected to the internet-gateway. Then customer-IP-network could be completely separated from the transport/backbone IP-network. Also i found it easyier to use a routed backbone than a bridged one, but this needs ...
by mag
Sat Mar 18, 2006 8:08 pm
Forum: General
Topic: dsa keyed SSH
Replies: 20
Views: 9929

this is really good. thanks to changeip ! just a comment, with Mac OS X 10.4 it becomes even simplier, because the -i parameter defaults to the right file. i prefer the '@' ssh notation, one can e.g. just type: ssh admin@192.168.1.1 "/interface print" and gets Flags: X - disabled, D - dynamic, R - r...
by mag
Sat Mar 18, 2006 3:05 pm
Forum: General
Topic: Have we done something stupid? large subnet problem...
Replies: 12
Views: 2352

So a bridged network design is used, where the routers have only management IP-addresses and WDS for bridging the wireless backbone? Where are the PPPoE-Servers located, on each particular access-point? And is there a central router, connecting the star together, being also def. gateway with IP-addr...
by mag
Sat Mar 18, 2006 1:54 pm
Forum: Wireless Networking
Topic: Secure vlan trunk and wisp
Replies: 12
Views: 5027

How about using EoIP- within IPSec-tunnel?
by mag
Sat Mar 18, 2006 1:47 pm
Forum: General
Topic: Have we done something stupid? large subnet problem...
Replies: 12
Views: 2352

Its very few information. E.g. first IP-subnets are mentioned, then things about bridging... How are the subnets interconnected? What does "no longer access" mean. In networks there are layers and protocols and tools to test layer related connectivity like torch, ping, traceroute, etc. Large bridged...
by mag
Sat Mar 18, 2006 12:07 pm
Forum: General
Topic: dsa keyed SSH
Replies: 20
Views: 9929

Re: dsa keyed SSH

how to use SSH DSA keys? i can't find any documentation?
under "/user ssh-keys " is nothing and there is no .ssh/ in file. so how is it meant to be used?
by mag
Sat Mar 18, 2006 9:12 am
Forum: General
Topic: Bulk configuration tool...
Replies: 12
Views: 5918

I would love to see an open-source API, but I think that would generally be considered the advanced thing for coolhackers. :twisted: there's a well known and standardised way for doing this: SNMP (write), and before adding some proprietary API, it would be much better to complete the existing SNMP-...
by mag
Fri Mar 17, 2006 10:50 pm
Forum: General
Topic: MT+VMware
Replies: 6
Views: 1168

Perhaps as a PPPoE- oder VPN-Server it could be useful.
Routers, of course should be dedicated machines.

(MT ROS runs on Virtual PC too ;-)
by mag
Fri Mar 17, 2006 10:46 pm
Forum: General
Topic: Bulk configuration tool...
Replies: 12
Views: 5918

ssh/scp, script, scheduler... what else does one need?
by mag
Fri Mar 17, 2006 7:10 pm
Forum: General
Topic: bridge eoip loses internal lan connectivity
Replies: 13
Views: 2296

ok, i'd guess EoIP is the right tunnel, so i still see a few unanswered questions: ... check if the MAC-addresses for the EoIP tunnels are not the same. Could you ping computers from the router, they are connected to? ... Did you check if the EoIP-Tunnel is working? That is seeing MAC-Adresses from ...
by mag
Fri Mar 17, 2006 6:34 pm
Forum: General
Topic: bridge eoip loses internal lan connectivity
Replies: 13
Views: 2296

All the servers are in the 192.168.0.x/24 subnet, ideally the solution would also allow broadcast packets so the windows servers could identify eachother by name. LAN-Broadcasts could cause a lot of WAN-Traffic, does that matters? AFAIK Windows-server could interconnect without seeing broadcasts, u...
by mag
Fri Mar 17, 2006 5:54 pm
Forum: General
Topic: bridge eoip loses internal lan connectivity
Replies: 13
Views: 2296

I can ping Router1 from Router2 but can not ping any computers connected to the same lan Router1 is conencted to from Router1. The same is true for Router2. i can't see a difference, besides that i have enabled proxy-arp at one side, but this is for PPTP only. Did you check if the EoIP-Tunnel is wo...
by mag
Fri Mar 17, 2006 3:24 pm
Forum: General
Topic: bridge eoip loses internal lan connectivity
Replies: 13
Views: 2296

and the EoIP-Interface should not be in the same bridge with the interface the EoIP-tunnel goes out. an example: / interface eoip add name="tunnel-101" mtu=1500 mac-address=00:00:5E:80:10:11 arp=enabled remote-address=1.1.1.1 \ tunnel-id=101 comment="" disabled=no / interface bridge add name="lan" d...
by mag
Fri Mar 17, 2006 10:07 am
Forum: Wireless Networking
Topic: MESH with MikroTik
Replies: 38
Views: 29813

There are a lot of press releases about IEEE 802.11s WLAN-Mesh proposal
e.g. http://standards.ieee.org/announcements ... posal.html.
by mag
Fri Mar 17, 2006 9:32 am
Forum: General
Topic: RFC 3021 and ROS
Replies: 5
Views: 2656

good! i always missed some kind of "unnumbered" connection.
this should be a perfect replacement.
(it's not mentioned in the manual particularly, is it?;-)
by mag
Fri Mar 17, 2006 9:24 am
Forum: General
Topic: /ip dns static not work
Replies: 4
Views: 914

thx. this one makes it:
add chain=dstnat in-interface=lan protocol=tcp dst-port=53 action=redirect to-ports=53 
add chain=dstnat in-interface=lan protocol=udp dst-port=53 action=redirect to-ports=53 
by mag
Fri Mar 17, 2006 9:19 am
Forum: General
Topic: bridge eoip loses internal lan connectivity
Replies: 13
Views: 2296

should be working.
did you clear the ARP-cache at the client?
maybe posting the configuration could help.
by mag
Thu Mar 16, 2006 8:29 pm
Forum: Wireless Networking
Topic: new problem
Replies: 3
Views: 944

Re: new problem

...
im using my laptop near the MT router 5 meters only
...
what kind of notebook, radio and OS is meant?
the wireless forums are full with Windows having problems with wireless connections, especially using Intel Centrino chipsets and WPA/WPA2.
by mag
Thu Mar 16, 2006 8:18 pm
Forum: General
Topic: /ip dns static not work
Replies: 4
Views: 914

i am trying to use this, but to no success. maybe someone could correct me. using this rule: add chain=dstnat in-interface=lan dst-port=53 action=redirect to-ports=53 gets Flags: X - disabled, I - invalid, D - dynamic 0 ;;; redirect DNS-requests chain=dstnat in-interface=lan dst-port=53 action=redir...
by mag
Thu Mar 16, 2006 4:40 pm
Forum: General
Topic: IPSec
Replies: 1
Views: 745

Re: IPSec

if nothing is in the log, the policy does not match the packet.
by mag
Wed Mar 15, 2006 1:36 pm
Forum: General
Topic: How to avoid dst-nat masquing origin IP address...
Replies: 5
Views: 1097

AFAIK no, thats simply the way NAT works.
by mag
Wed Mar 15, 2006 1:33 pm
Forum: General
Topic: Security Issue
Replies: 9
Views: 2404

it did, of course, while testing it ;-)

i don't think that problem could be solved, if trying to use ssh from internet AND trying to avoid ssh-attacks both. but i see these attacks mostly at night time and tend more and more using VPN-tunnels for management.
by mag
Wed Mar 15, 2006 1:14 pm
Forum: General
Topic: Security Issue
Replies: 9
Views: 2404

ok, i see. a little improvement might be: /ip firewall filter add chain=input in-interface=<internet> protocol=tcp dst-port=22 limit=1/10s,2 action=accept comment="Accept limited SSH" disabled=no add chain=input in-interface=<internet> protocol=tcp dst-port=22 action=add-src-to-address-list address-...
by mag
Wed Mar 15, 2006 9:55 am
Forum: General
Topic: Security Issue
Replies: 9
Views: 2404

just an idea:
/ip firewall filter
add chain=input protocol=tcp dst-port=22 limit=1/10s,2 action=accept comment="Accept limited SSH" disabled=no 
add chain=input protocol=tcp dst-port=22 action=drop comment="Drop excess SSH" disabled=no 
by mag
Wed Mar 15, 2006 9:45 am
Forum: Wireless Networking
Topic: Mikrotik Load Balancing Setup
Replies: 3
Views: 3015

Where's the difference? PPPoE sets a Gateway too. Read it from /ip route print and set it. See scripting examples in the manual. something like: :local DefGw1 "" :local DefGw2 "" :set DefGw1 [/ip route get [find /ip route prefsrc=<ip-isp1>] dst-address] :set DefGw2 [/ip route get [find /ip route pre...
by mag
Tue Mar 14, 2006 1:09 pm
Forum: General
Topic: Weird pptp problem, connected but no traffic past mt
Replies: 5
Views: 1027

this is working configuration-example, using 10.10.10.0 as transfer-net: / ppp secret add name="user" service=pptp password="password" local-address=10.10.10.1 remote-address=10.10.10.2 / interface pptp-server server set enabled=yes / interface pptp-server add user=user /ip route add dst-address=<ip...
by mag
Mon Mar 13, 2006 3:25 pm
Forum: Scripting
Topic: script for moving forced dsl-disconnect to late night
Replies: 3
Views: 1500

thx. edited.
by mag
Mon Mar 13, 2006 3:12 pm
Forum: Scripting
Topic: automated system update
Replies: 9
Views: 14316

thanks for the information! i wrote a little script for my purposes: / system upgrade upgrade-package-source add address=<ip-> user="<user>" password="<password>" /system scheduler add name=sched_upgrade on-event=upgrade start-date=jan/01/2006 start-time=02:00:00 interval=1d /system script add name=...
by mag
Mon Mar 13, 2006 10:07 am
Forum: Scripting
Topic: automated system update
Replies: 9
Views: 14316

Hm, am i alone with this problem? How do other people upgrade their large quantities of MT-boxes? ;-)

I tried to configure and to use "system upgrade mirror" but it seems to do nothing at all.

any hints?
by mag
Mon Mar 13, 2006 9:45 am
Forum: General
Topic: Help for Firewall
Replies: 10
Views: 1792

But that is not the problem and correct for a default-deny strategy.
The problem here is, that only one one way is configured yet, e.g. client-connections and server-answers are missing. (Quite basic IP-knowledge, though;-)
by mag
Mon Mar 13, 2006 9:37 am
Forum: General
Topic: Weird pptp problem, connected but no traffic past mt
Replies: 5
Views: 1027

if PPTP is using the same address-space as the LAN, proxy-arp has to be enabled on the LAN-interface.
by mag
Sun Mar 12, 2006 9:25 pm
Forum: General
Topic: Help for Firewall
Replies: 10
Views: 1792

i would suggest a closer look to the demo-system at mikrotik: http://demo.mt.lv/ there are some firewall-rules.
by mag
Sun Mar 12, 2006 9:16 pm
Forum: General
Topic: netwatch is not working on 2.9.17
Replies: 12
Views: 1977

one example: / tool netwatch add host=x.y.8.158 timeout=1s interval=1m up-script="" down-script="" comment="rt-wil-hs041" disabled=no add host=x.y.8.160 timeout=1s interval=1m up-script="" down-script="" comment="rt-wdn-hm014" disabled=no add host=10.10.1.70 timeout=1s interval=5m up-script="" down-...
by mag
Sun Mar 12, 2006 5:58 pm
Forum: General
Topic: IPsec and Freeswan
Replies: 14
Views: 3203

Turn on ISAKMP debugging on the MT and post the connection log.
how could IPSec debugging be switched on?
by mag
Sun Mar 12, 2006 5:22 pm
Forum: General
Topic: netwatch is not working on 2.9.17
Replies: 12
Views: 1977

netwatch is working for me. (only 4 mt-boxes with 2.9.17 so far )
by mag
Sun Mar 12, 2006 12:03 pm
Forum: General
Topic: AIM not connecting when line balancing
Replies: 2
Views: 954

Another theory I have with AIM is the MT box is not keeping the session on the same gateway and switches it during the login process, thus causing AIM to reject me. because AIM DOES connect, and This was my first idea too, but the manual states clearly on ECMP that it works with pairs of source-des...
by mag
Sat Mar 11, 2006 3:33 pm
Forum: Scripting
Topic: script for moving forced dsl-disconnect to late night
Replies: 3
Views: 1500

script for moving forced dsl-disconnect to late night

As i don't want the every 24-hours forced T-DSL-disconnects to occur at 10 a.m., i wrote this little script: /system script add name=pppoe_dis source={ /interface pppoe-client disable [find name="<t-dsl-name>"] :delay 10 /interface pppoe-client enable [find name="<t-dsl-name>"] :log info "Script ppp...
by mag
Fri Mar 10, 2006 3:34 pm
Forum: General
Topic: People please help!!!!
Replies: 9
Views: 1777

ähm, is it assured that the PPPoE-client is up and running?
there should be some log-entries and an ip-address assigned to the interface.
by mag
Fri Mar 10, 2006 2:58 pm
Forum: Scripting
Topic: automated system update
Replies: 9
Views: 14316

automated system update

i'm going to automate system update within a few mt-router networks and like to ask a few questions, i could not find answers to yet. there is an undocumented paramter (2.9.x): / system upgrade mirror set enabled=no primary-server=0.0.0.0 secondary-server=0.0.0.0 check-interval=1d user="" anyone an ...
by mag
Wed Mar 08, 2006 5:16 pm
Forum: General
Topic: IPsec and Freeswan
Replies: 14
Views: 3203

http://www.mikrotik.com/docs/ros/2.9/ip ... t#5.44.8.4
"MikroTik Router and Linux FreeS/WAN"

is that not what you are looking for?
by mag
Tue Mar 07, 2006 2:29 pm
Forum: General
Topic: VPN DOWN - After Upgrade
Replies: 7
Views: 1101

any entries in the log?
(why not update to 2.9.14?)


btw. 3 minute key-lifetime is very short.
by mag
Mon Mar 06, 2006 1:25 pm
Forum: General
Topic: bridge interfaces
Replies: 4
Views: 973

Re: bridge interfaces

@sten: where did you see a loop? i can't, sorry. sounds like one, though.
if a switch with STP is in use, it should close only the looping-port and show this as well.
by mag
Mon Mar 06, 2006 9:49 am
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

i didn't resolve it!

get static IP-addresses (which is always the best :) or use another router-system.
by mag
Mon Mar 06, 2006 9:43 am
Forum: General
Topic: bridge interfaces
Replies: 4
Views: 973

Re: bridge interfaces

the switch and a small part of the LAN stops to function untill I "unbridge" the interfaces and reboot the switch. "stops to function" is not very descriptive. The radio on MT1 must not be in station mode for use in a bridge (its stated somewhere in the wireless manual) It might be better using EoI...
by mag
Sun Mar 05, 2006 7:42 pm
Forum: General
Topic: Protect router against attack
Replies: 6
Views: 1621

by mag
Sun Mar 05, 2006 3:56 pm
Forum: General
Topic: Protect router against attack
Replies: 6
Views: 1621

don't block ICMP completly, e.g. MTU-Path Discovery is ICMP-based.
At the demo-system there are some rules concerning ICMP.
by mag
Sat Mar 04, 2006 9:51 am
Forum: General
Topic: ssh
Replies: 3
Views: 858

how about simply entering an IP-address-range into /ip service ssh?

(but ususally it's coming from internet, plus i don't like changing WKS-ports. has anyone written a rule to make a temporary blocking address-list for this kind of attack and likes to share it? tia.)
by mag
Sat Mar 04, 2006 9:47 am
Forum: General
Topic: PPPoE lockups around 200 users connected
Replies: 5
Views: 1306

Re: PPPoE lockups around 200 users connected

Doesn't look like a RADIUS-Problem to me, but did you check the RADIUS-request-response traffic?

(i'm going to build a similar solution, therefore i'm interested in problems with the PPPoE-server

update: as odie wrote, there is a 200-PPPoE-user limit depending on the licence-level.)
by mag
Thu Mar 02, 2006 4:03 pm
Forum: General
Topic: Port Mirroring ?
Replies: 12
Views: 10809

Re: Port Mirroring ?

sorry, not an exact answer but maybe helpful: Simple port-mirroring has some problems, especially with full-duplex traffic, for professional analysis, IDS, etc. therefore a TAP-device is needed, e.g.: http://www.netoptics.com/products/product_family_details.asp?cid=4&pid=123&Section=products&menuite...
by mag
Wed Mar 01, 2006 12:45 pm
Forum: General
Topic: IPsec over PPPoE ...
Replies: 6
Views: 2119

look at the IPSec examples, you should have a firewall-nat-rule with action=accept before the masquerading-rule. maybe this was the problem...
by mag
Wed Mar 01, 2006 12:42 pm
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

i did both changes: exchange-mode=main and proposal-check=strict.

i am going to test the MTU-thing, but never had problems with it before.

thx.
by mag
Tue Feb 28, 2006 7:09 pm
Forum: General
Topic: OSPF MESH NETWORK
Replies: 5
Views: 1565

puh, it was back in 2.8.x times when i last did OSPF with MT.
Will have to do soon again...
by mag
Tue Feb 28, 2006 6:04 pm
Forum: General
Topic: IPsec over PPPoE ...
Replies: 6
Views: 2119

Re: IPsec over PPPoE ...

Static public IP-addresses on both sides? if yes, then everything should be working nicely. I have now a few important and reliable IPSec links up and running with MT-routers. Its quite easy after the first one;-) The only thing i can't get to work yet is with dynamic IP-addresses (using PPTP as a w...
by mag
Tue Feb 28, 2006 12:28 pm
Forum: General
Topic: understanding routes ....
Replies: 13
Views: 1807

(sorry for posting, just a mistake)
by mag
Tue Feb 28, 2006 11:50 am
Forum: General
Topic: block ip address out from router
Replies: 6
Views: 1141

just an idea: would it not be better to use DHCP with static MAC-entries, for doing the management completely on the router.
by mag
Tue Feb 28, 2006 11:11 am
Forum: General
Topic: OSPF MESH NETWORK
Replies: 5
Views: 1565

Re: OSPF MESH NETWORK

AFAIK this will not create a real mesh-wlan-network like the OSLR-based ones. But if there are redundant links it should be working though.
by mag
Tue Feb 28, 2006 11:08 am
Forum: General
Topic: 2.9.12 software anyone?
Replies: 13
Views: 2018

would it not be a good idea to place a little link to the archive on the download page?! ;-)
by mag
Tue Feb 28, 2006 11:03 am
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

thanks for the hints, but still does not work. Same log entries.
I am a bit confused by the log-line:
10:03:57 ipsec,ike,info phase 1 negotiation timed out  
on the client side. it looks to me as if the client did not get the right response even for phase 1.
by mag
Mon Feb 27, 2006 5:00 pm
Forum: General
Topic: EoIP tunnel problems.
Replies: 6
Views: 2094

i meant to use some kind of ip-ip-tunnel if layer-2 is not a must have.
by mag
Mon Feb 27, 2006 12:21 pm
Forum: General
Topic: EoIP tunnel problems.
Replies: 6
Views: 2094

i would suggest using EoIP only if a transparent Ethernet-connection is needed actually.

(of course its MTU is fixed to 1500, cause it's the Ethernet-MTU)
by mag
Mon Feb 27, 2006 8:24 am
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

Scenario looks like: {10.10.1/24} - (R1) - static IP - {Internet} - dyn. IP - (R2) - {192.168.255/24} R1, R2: MT-ROS 2.9.14 Router, R1 is VPN-server, R2 VPN-client configuration at remote site (static IP-address) / ip ipsec policy add src-address=192.168.255.0/24:any dst-address=10.10.1.0/24:any pro...
by mag
Sun Feb 26, 2006 1:24 pm
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

Hm... was my description to confusing;-)
or is no one using IPSec with dynamic addresses actually?

(Its easily possible with many low-cost routers, so i won't believe it couldn't be done with MT.)

TIA.
by mag
Sat Feb 25, 2006 10:41 pm
Forum: General
Topic: Multi pppoe question
Replies: 5
Views: 895

as PPPoE works on layer 2 it is necessary to configure an EoIP-tunnel between the two MTs and the appropriate bridge-groups.
by mag
Sat Feb 25, 2006 10:30 am
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

Many thanks. This solves the first problem, but i cant find this hint anywhere mentioned in the manual, how-to, faq, etc. Maybe it should be added... It is also not possible to set the netmask of the peer-address inside winbox, obviously a bug. I have now the problem that no IP-traffic is passing th...
by mag
Fri Feb 24, 2006 7:27 pm
Forum: General
Topic: IPSec-VPN with dynamic IP
Replies: 11
Views: 3032

IPSec-VPN with dynamic IP

I'm trying to get an IPSec-tunnel up between two mt-routers (ROS 2.9.13). The router at the central-site has a static public IP-address (x.91.97.147) the other router at the remote-site has a dynamic public address. following the manual, as far is i understand, this is the configuration: central-sit...
by mag
Fri Feb 24, 2006 9:50 am
Forum: General
Topic: IPsec over PPPoE ...
Replies: 6
Views: 2119

perhaps this one could help you: http://forum.mikrotik.com//viewtopic.php?t=6102
by mag
Tue Feb 21, 2006 10:12 am
Forum: General
Topic: Quick VPN Help Needed Please!
Replies: 4
Views: 910

Depends on the type of VPN she/he is trying to use, obviously some IPSec-Client. This will not work without NAT-T on the router itself, or a transparent IP-connection without NAT.

Not really a solution, sorry.
by mag
Fri Dec 30, 2005 6:15 pm
Forum: General
Topic: PPTP with proxy logging
Replies: 8
Views: 2055

yes, sorry. completely misunderstood.
by mag
Fri Dec 30, 2005 2:49 pm
Forum: General
Topic: PPTP with proxy logging
Replies: 8
Views: 2055

it's always possible to use RADIUS authentication/accounting on ppp-type connections.

just try "radius" search on the forum...
by mag
Thu Dec 29, 2005 4:37 pm
Forum: General
Topic: Reporting tool for customers to see their Internet traffic .
Replies: 7
Views: 3450

the usual approach is to use an IETF RADIUS based system, which is good for all types of authentication and accounting. e.g. freeradius is an open source project for many operating-systems and there are also lots of accounting tools for it. (we are using a SBR-RADIUS together with MS-SQL server for ...
by mag
Thu Dec 29, 2005 2:56 pm
Forum: General
Topic: easy way to make netwatch-status visible through web-graphin
Replies: 3
Views: 1378

thx, i know this. but i can't see how this concerns my question?!
by mag
Thu Dec 29, 2005 11:50 am
Forum: General
Topic: easy way to make netwatch-status visible through web-graphin
Replies: 3
Views: 1378

easy way to make netwatch-status visible through web-graphin

is there a simple way to make tools/netwatch-status visible through the web-interface e.g. tools/graphing? i am going to get the customer a quick look whats going on, without lettin her login into the router. (if not possible yet, it would be a quite nice feature expansion to have tools/graphing/net...
by mag
Thu Dec 29, 2005 11:09 am
Forum: General
Topic: Dynamic VPN PPTP & IP Pools?
Replies: 10
Views: 4009

could you post the relevant parts of your pptp-server configuration?

i found it usually helpful too, to look into the pptp-clients log.
by mag
Thu Dec 29, 2005 11:02 am
Forum: General
Topic: securing the Mikrotik router
Replies: 4
Views: 1979

Re: securing the Mikrotik router

Does anyone recall where that info is located?
http://www.mikrotik.com/Documentation/HowTo.html
by mag
Tue Dec 27, 2005 6:44 pm
Forum: General
Topic: EoIP over IPsec problem
Replies: 6
Views: 6142

i see! thanks. therefore it seems necessary to configure a transport-mode-policy for encrypted router to router-traffic containing the routers wan-addresses with /32-mask before the usual tunnel-mode-policies for network to network-traffic?! in my particular EoIP-configuration the transport-mode tun...
by mag
Tue Dec 27, 2005 3:57 pm
Forum: General
Topic: Help with DSBL.ORG
Replies: 11
Views: 1528

if the address was part of a dial-in pool of a large ISP, its very common that it is listed in several black-hole lists.
only way to get out is getting a static ip with correct PTR-record or using a SMTP-gateway.

not exactly a router-specific problem ;-)
by mag
Tue Dec 27, 2005 3:51 pm
Forum: General
Topic: EoIP over IPsec problem
Replies: 6
Views: 6142

Have you tried to add IPSec policy, that encrypts everything between both ends (=addresses) of your EoIP tunnel? yes, if i understood the question correctly. the policy matches the whole LAN-subnet, particularly the routers own lan-ip-address: # r1: / ip ipsec policy add src-address=10.10.1.0/24 ds...
by mag
Tue Dec 27, 2005 10:02 am
Forum: General
Topic: EoIP over IPsec problem
Replies: 6
Views: 6142

What is the problem to have more IPSec policies? more policies are not the problem. matching locally generated packets, i.e. from the router itself, is the problem. if i changed an IPsec-policy to "src-address=0.0.0.0/0" this particular IPsec-connection does not work anymore. Why do you try to use ...
by mag
Mon Dec 26, 2005 8:35 pm
Forum: General
Topic: Redirect All Trafic To Proxy Server in one LAN
Replies: 19
Views: 6628

Re: Proxyyyy :::

i guess one needs an application-proxy to handle this kind of redirection.
otherwise the answer from e.g. the ftp-server comes from an unexpected ip-address to the client and will be discarded.
by mag
Mon Dec 26, 2005 7:32 pm
Forum: General
Topic: EoIP over IPsec problem
Replies: 6
Views: 6142

EoIP over IPsec problem

by trying to create a bridged VPN for a customer i found the following problem. establishing the IPsec-VPN is easy and works like expected. but if one is going to ping from one VPN-router to the LAN-interface of the other, expecting to trigger/use the IPsec-tunnel the packets are sent unencryptetd t...
by mag
Mon Dec 26, 2005 1:09 pm
Forum: General
Topic: Dynamic VPN PPTP & IP Pools?
Replies: 10
Views: 4009

seems that VPN is buggy in 2.9.9/.10 (see recent IPsec-post).
2.9.8 should be working.
by mag
Fri Dec 23, 2005 1:39 pm
Forum: General
Topic: basic IPsec configuration not working in 2.9.10
Replies: 3
Views: 983

hmm, i have a few mt's running IPsec with 2.9.8. and the changelog contains nothing about IPsec!
i just wrote to support, too.

update: i switched back to 2.8.8 and IPsec is working again!
by mag
Fri Dec 23, 2005 12:59 pm
Forum: General
Topic: basic IPsec configuration not working in 2.9.10
Replies: 3
Views: 983

basic IPsec configuration not working in 2.9.10

the IPsec VPN config from the manuals application example (http://www.mikrotik.com/docs/ros/2.9/ip/ipsec.content#5.44.8.2) is not working for me, the packets are discarded scenario is very basic: LAN - 10.10.1.1/24-(R1)-x.y.z.157 - DSL - x.y.z.160-(R2)-10.10.5.1/24 - LAN config of router 1 / ip fire...
by mag
Thu Dec 22, 2005 10:04 pm
Forum: General
Topic: export file=name behavior changed in 2.9.10
Replies: 1
Views: 845

export file=name behavior changed in 2.9.10

after upgrading to 2.9.10 download of saved config files (export file=name) via scp doesn't work, e.g.: [user@Zentrale] > export file=zentrale [user@Zentrale] > file pr # NAME TYPE SIZE CREATION-TIME 0 zentrale.rsc script 9942 dec/22/2005 19:48:40 and then trying to scp the file to my pc, as i alway...
by mag
Mon Nov 14, 2005 2:07 pm
Forum: General
Topic: generic ipsec tunnels
Replies: 6
Views: 1410

Re: generic ipsec tunnels

do you have any suggestions ?
sorry, not at the moment, i am working on it.
by mag
Sun Nov 13, 2005 2:49 pm
Forum: General
Topic: Supported Sangoma T1/E1 PCI cards
Replies: 2
Views: 840

Re: Supported Sangoma T1/E1 PCI cards

a few months ago we were playing around with some (E1- and) E3-cards, having all kinds of problems. at last we decided to use media-bridges (E1/E3 to Ethernet) with good success, building up a celeron 2GHz based MT-system handling easyly three E3.

not exactly what you want but maybe helpful...
by mag
Sun Nov 13, 2005 2:37 pm
Forum: General
Topic: generic ipsec tunnels
Replies: 6
Views: 1410

Re: generic ipsec tunnels

if i understand you correctly, the MT has to be configured as vpn-server in ipsec aggressive-mode. a login with user-id (aka password) is possible then.

sorry to say, i havent't configured this with MT yet, but it works using a few other systems.
by mag
Thu Nov 10, 2005 11:08 am
Forum: General
Topic: DHCP and MacOS problem
Replies: 2
Views: 802

yes, of course, lots of. no problems at all!

(if macos 9 is involved ... this would be the problem;-)
by mag
Sat Jan 22, 2005 10:11 am
Forum: General
Topic: Force traffic out a specific interface
Replies: 4
Views: 3370

Re: Force traffic out a specific interface

setting the preferred source in the routing table will do it.
by mag
Fri Jan 21, 2005 12:55 pm
Forum: General
Topic: default pppoe service name
Replies: 7
Views: 1306

we're using EoIP-tunnels between the access-devices and the access-concentrator, all router os based. so the PPPoE client sees only one AC on layer 2.
by mag
Sun Jan 16, 2005 11:34 am
Forum: General
Topic: Connection Mark and Flow Mark
Replies: 1
Views: 675

Re: Connection Mark and Flow Mark

i asked this a few weeks before, but there was no answer. http://www.mikrotik.com/forum/viewtopic.php?t=1541
also it's not documented.

(i haven't started searching the iptables documentation, maybe there is an explanation)
by mag
Sun Jan 16, 2005 12:14 am
Forum: General
Topic: router with web-proxy enabled crashes
Replies: 5
Views: 1365

router with web-proxy enabled crashes

a few days ago i enabled the web-proxy on a mt router with fairly high traffic. since then the system has crashed completely (hardware reset necessary) every day and the log has often this error line: Web-proxy error while running: squid was killed with signal11, restarting system is a p3 pc with 4 ...
by mag
Thu Jan 13, 2005 9:21 am
Forum: General
Topic: OSPF -> /32 -> WDS
Replies: 4
Views: 1412

You should set the network address exactly the same as the remote point IP address for point-to-point links. The right netmask in this case is /32. i meant the ip-address of the interface itself, not the ospf-interface. a /32 ip-address usually does not make sense. If you don't specify a the router...
by mag
Thu Jan 13, 2005 9:04 am
Forum: General
Topic: Allowing connections between devices on multiple LANs
Replies: 3
Views: 1207

Re: Allowing connections between devices on multiple LANs

in every LAN the .254 (the mt) is set as default gateway on the hosts?

"/ ip firewall rule forward" is empty?

what does a traceroute from a host in on LAN to a host in another lan show?

no other filters or firewall devices between LAN and mt?

regards.
 matthias
by mag
Wed Jan 12, 2005 10:04 am
Forum: General
Topic: OSPF -> /32 -> WDS
Replies: 4
Views: 1412

ospf router id should be the highest ip-addess given to a local osp-interface.

see: http://relcom.net/CURS/OSPF/1.html

the wireless ip subnet is misconfigured (as mentioned by freman). /32 subnets are talking only to themself.
by mag
Wed Jan 12, 2005 9:49 am
Forum: General
Topic: Wireless problems - Slow speeds
Replies: 18
Views: 3225

Re: Wireless problems - Slow speeds

was the system not testet before put into service? or did it work with a few test-clients? the AP hardware looks good to me, but i'm not sure abbout the prism interfaces, as we're using atheros only. there are some questions left open to me: is the AP intended to work as transparent bridge? external...
by mag
Wed Jan 12, 2005 9:16 am
Forum: General
Topic: 2.8.22 problem in signal
Replies: 8
Views: 2377

recently we changed our 5211 and 5212 cards with 5213 (cm9) because they provided us better signal-quality (usually 3 - 5 dB). mostly using 2.8.21 but a few 2.8.22 systems. most links are in upper 5 GHz band.
no problems yet.
by mag
Sat Jan 08, 2005 11:10 pm
Forum: General
Topic: WPA ETA?
Replies: 14
Views: 2941

Not a problem if you are using MT to provide services, but a big "ouch" if trying to sell MT-powered products I guess ...
exactly!
by mag
Sat Jan 08, 2005 12:54 am
Forum: General
Topic: WPA ETA?
Replies: 14
Views: 2941

i`d like to second the request. WPA and 802.11i are important for the market and often asked for.

regards.
    matthias
by mag
Sat Jan 08, 2005 12:41 am
Forum: General
Topic: MacOS problems with MT hotspot
Replies: 4
Views: 1240

Re: To: mag

... You say "forget them" to macOS 9, is that because there is a big problem or are you just being funny. macos x is now around 5 years old and macos 9 support might be a challenge for mac freaks... (yes there are lots of problems with newer hardware, tcp/ip and so on) but, as there is a whole set ...
by mag
Thu Jan 06, 2005 11:28 pm
Forum: General
Topic: MacOS problems with MT hotspot
Replies: 4
Views: 1240

Re: MacOS problems with MT hotspot

i did all my mt-configuration and lots of testing -- including hotspot -- at work from a powerbook 400 with airport (802.11b) and macos x 10.3 with no problems at all. plus i have a few other macs connected to my home mt-wlan-router) there were router os versions with wireless-problems concerning at...
by mag
Thu Jan 06, 2005 10:28 am
Forum: General
Topic: Point to Point COnfiguration
Replies: 8
Views: 2116

Use the WDS example. Then set up a bridge on each side with the ethernet port and WDS interface. or build a routed connection (don't put the wlan interface into the bridge group) and use an EoIP-tunnel (with eth in the bridge group). there are examples in the manual. remember to assign ip-address t...
by mag
Thu Jan 06, 2005 8:19 am
Forum: General
Topic: Any way around masquerade?
Replies: 3
Views: 1145

... /ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1 (xxx.yyy.1.1 being the public address). ... does the public ip-address never changes? on usual dsl-based connections e.g. in germany the ip-address changes at least every 24h, therefore this method won't w...
by mag
Wed Jan 05, 2005 6:34 pm
Forum: General
Topic: DNS cache
Replies: 4
Views: 1386

Re: DNS cache

could you post your dns-cache configuration and router os version?
by mag
Wed Jan 05, 2005 10:08 am
Forum: General
Topic: Virus Problem
Replies: 10
Views: 2685

Re: work

Will this setting work on a public interface and not drop any legitimate traffic ?? Please advise
i tried it and it is looking good. (had to allow 3128/tcp for squid in rule 18)
by mag
Wed Jan 05, 2005 9:28 am
Forum: General
Topic: Problems with "Transparent Bridge using EoIP tunnel&
Replies: 2
Views: 1273

Re: Problems with "Transparent Bridge using EoIP tunnel

just a few quick ideas: if all interfaces are in a bridge, it's necessary to give the ip-address(es) to the bridge, not to the interface(s) itself.

could there be a layer2-loop? stp activated?
by mag
Wed Jan 05, 2005 9:19 am
Forum: General
Topic: Is there a DHCP issue again with 2.8.22?
Replies: 2
Views: 935

Re: Is there a DHCP issue again with 2.8.22?

no problems (yet) with all kinds of client-systems (unix, mac, windos 2k/xp. lan and wan) and 2.8.22.

what does the dhcp-lease table show when a client doesn't get its address?
by mag
Mon Jan 03, 2005 11:34 am
Forum: General
Topic: Upload-Limit
Replies: 5
Views: 1290

...However, I'm not using the router as a bridge, but as a full NAT router. sorry for the OT, but could you comment about NAT'ed payload, particularly DNS requests. are they translated correctly? i.e. will an outside client see the correct public ip-address, if there's a DNS-server behind NAT. i've...
by mag
Sat Jan 01, 2005 6:30 pm
Forum: General
Topic: RouterOS vs Cisco to terminate L2TP for ISP providing DSL [SOLVED]
Replies: 1
Views: 910

Re: RouterOS vs Cisco to terminate L2TP for ISP providing DS [SOLVED]

if the connection is ATM, it will be necessary to terminate ATM on your equipment. i havent seen this ability within RouterOS (nor hardware, neither software). if the connection is ethernet, it should be possible with RouterOS. there is of course other equipment then cisco to terminate ATM (e.g. luc...
by mag
Sat Jan 01, 2005 6:19 pm
Forum: General
Topic: One mikrotik - two accesses to internet
Replies: 2
Views: 851

Re: One mikrotik - two accesses to internet

here is (probably) an example:

http://www.mikrotik.com/docs/ros/2.8/ap ... g1.content

"Gateway fail-over" section.
by mag
Fri Dec 31, 2004 9:43 am
Forum: General
Topic: 2.8.22 PPTP server
Replies: 7
Views: 1618

Re: 2.8.22 PPTP server

we've seen that too, downgrading from >2.8.13 to an earlier version didnt't work.
on the other hand we found 2.8.21 to be a very stable and reliable version (we use all types of wireless and tunneling).
by mag
Thu Dec 30, 2004 10:42 pm
Forum: General
Topic: 2.8.22 PPTP server
Replies: 7
Views: 1618

Re: 2.8.22 PPTP server

no problem with macos x. i'll try windows tomorrow.
by mag
Thu Dec 30, 2004 4:10 pm
Forum: General
Topic: howto manually disconnect a pppoe client?
Replies: 1
Views: 721

Re: howto manually disconnect a pppoe client?

on the access concentrator in the interface list delete the dynamic pppoe-in interface.
by mag
Thu Dec 30, 2004 11:13 am
Forum: General
Topic: One-way video broadcast to 5ghz clients
Replies: 7
Views: 2101

i am not sure if i understood your demands correctly, but there's a (partly) open source solution: http://developer.apple.com/darwin/projects/streaming/ this system is devided into a coding/working server and a broadcasting server. hi directwireless, yeah I know, that's why I was asking for software...
by mag
Wed Dec 29, 2004 10:24 am
Forum: General
Topic: nstreme requirements
Replies: 13
Views: 2885

It is wireless, not wireless-legacy.
after installation "wireless-legacy" and "wireless" both are showing up as "wireless". only the nstreme and some other features are not available in the winbox with wireless-legacy.
by mag
Tue Dec 28, 2004 10:19 am
Forum: General
Topic: Questions about Masquerading and NAT rules
Replies: 12
Views: 4213

2.9 seems to become a real improvement! (if i could only install the beta;-)

anything about the NAT'd payload question?

regards,
   matthias
by mag
Sun Dec 26, 2004 12:30 pm
Forum: General
Topic: PPTP Server Without Proxy-ARP
Replies: 3
Views: 2435

What if I have a third subnet, used by PPTP interface only, which is routed to 10.X.X.X? Can this be done? if i understand the dokumentation correctly, a virtual ip-address could be crated by the local-ip address parameter (first server example), which could be routed to. have you tried this? regar...
by mag
Sun Dec 26, 2004 11:47 am
Forum: General
Topic: Questions about Masquerading and NAT rules
Replies: 12
Views: 4213

is there another way to group the two blocks(x.x.128.0/21 and x.x.136.0/23) together so that they are both NATed to the same block(y.y.105.214 - y.y.105.254) with out using the mangle rule? sorry, i haven't seen this. i think its a good way to handle blocks of ip-addresses. i will do some NAT tests...
by mag
Sat Dec 25, 2004 8:11 pm
Forum: General
Topic: can be add l7-layer filter plug ?
Replies: 1
Views: 948

Re: can be add l7-layer filter plug ?

http://www.mikrotik.com/forum/viewtopic.php?t=949

there are lots of open source projects to build up a router.

regards.
  matthias
by mag
Sat Dec 25, 2004 6:59 pm
Forum: General
Topic: Point to Point COnfiguration
Replies: 8
Views: 2116

Re: Point to Point COnfiguration

see: http://www.mikrotik.com/docs/ros/2.8/in ... ss.content
-> quick setup guide.

it's just configuring wireless interfaces (with appropriate band and frequencies), adding ip- addresses, ready.

regards.
   matthias
by mag
Thu Dec 23, 2004 12:38 pm
Forum: General
Topic: MT - BGP - Border Router
Replies: 32
Views: 7226

Re: bgp

anybody worked with mikrotik and multihoming bgp through 2 providers for seamless failover ?
I am sure people have used it for keeping it up and running.
it would be even more interesting, if someone is doing this by using two (or more) mt systems and VRRP.

regards.
   matthias
by mag
Thu Dec 23, 2004 12:31 pm
Forum: General
Topic: Mail server in ver 2.9
Replies: 11
Views: 3160

and please don't forget web-, ftp, samba-, nfs-, print-, antivirus-, mp3-streaming-, sip-, and a few other minor servers ;-))

i'd like to see a mikrotik based appliance, but this would and should be a completely different product...

regards.
 matthias
by mag
Wed Dec 22, 2004 9:46 am
Forum: General
Topic: pp diali in server - modem not answering
Replies: 2
Views: 659

Re: pp diali in server - modem not answering

it would be helpful to know the modem type and vendor;-)
most modem use at commands, so at &fx3s0=1 should work as a starting point.

regards.
  matthias
by mag
Wed Dec 22, 2004 9:37 am
Forum: General
Topic: Web Proxy Problem - Only with Hotmail
Replies: 10
Views: 3976

(sorry i was off for a few days)

some problems using the proxy turned out to be caused by the upstream isp, they never said what it was, but it was fixed. i would guess some faulty traffic shaping.

i found it by testing the same router/config with another isp.

regards.
   matthias
by mag
Sun Dec 19, 2004 11:02 pm
Forum: General
Topic: nstreme requirements
Replies: 13
Views: 2885

Came with 2.8.20, when I did not see it I tried 2.8.21.
did you load by chance the wireless-legacy package or both wireless packages. for nstreme only wireles package has to be used.

regards.
   matthias
by mag
Sat Dec 18, 2004 10:11 am
Forum: General
Topic: nstreme requirements
Replies: 13
Views: 2885

Re: nstreme requirements

which router os version?

regards,
   matthias
by mag
Sat Dec 18, 2004 10:03 am
Forum: General
Topic: Web Proxy Problem - Only with Hotmail
Replies: 10
Views: 3976

Re: Web Proxy Problem - Only with Hotmail

not with hotmail, but some other pages. by deactivating the transparent proxy dst-nat rules the pages load without problem. (i am using transparent mode) did you try 2.8.21 (afaik there's a newer squid in)? what means "cgi-bin \? is blocked", did you change the default cache rule? regards,    matthias
by mag
Fri Dec 17, 2004 8:15 pm
Forum: General
Topic: Winbox using MAC?
Replies: 10
Views: 2223

Re: Winbox on Mac OS X

:D I'd love to see a MAC OSX/Unix version of winbox as well. at least in this professional environment, we should be able do distinguish between MAC and Mac (OS X doesn't run on MACs and there is no Mac-address also ;-)) btw, i am using winbox on VPC with Win2k on a PB G4/400, which works good/fast...
by mag
Wed Dec 15, 2004 6:28 pm
Forum: General
Topic: Secure Websites
Replies: 6
Views: 1371

Just test and you'll see that :) I just change the MSS of client interfaces to 1400, and everithing is working fine but MSS should be MTU - 40. usually i set MTU for pppoe-links to 1480 bytes, MRU also. the dynamic mangle rule (created by choosing change tcp-mss in the ppp profile) sets MSS to 1420...
by mag
Wed Dec 15, 2004 4:43 pm
Forum: General
Topic: Secure Websites
Replies: 6
Views: 1371

Problem is in TCP MSS.. don't change it and it will work
could you please explain this? if the MTU was set to a smaller value by a mangle rule, i thought the MSS has to be adjusted also.

thx.
   matthias
by mag
Tue Dec 14, 2004 6:00 pm
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

Re: EoIP

...
So 3COM nics are junk, Realtek nics are junk and I need to build up a couple of $400 boxes just to test if my hardware is a problem?
...
i wouldn't call them junk, but doing bandwith or performance tests it's always important to know about hardware issues.

regards.
   matthias
by mag
Mon Dec 13, 2004 6:44 pm
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

Re: EoIP

the realtek nics are causing more cpu-load, which is the limiting factor already.

our pc staff told me getting some cheap intel 845/celeron 2 ghz boards with on-board intel-nic will give full throughput. after testing, better or less energy-consuming hardware might be choosen.

regards.
   matthias
by mag
Mon Dec 13, 2004 3:23 pm
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713


how did you try it with Tab button? Maybe DND settings are incorrect in your router. Try, for example:
you are right, i tried the winbox, terminal is of course working.

but the problem is still (as written before) that the ip-address is changing on an irregular basis.

thx.
   matthias
by mag
Mon Dec 13, 2004 12:34 pm
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

of course this is a cheap workaround and mikrotik will work on a solution in upcoming versions
thanks, that sounds good to me!

   matthias
by mag
Mon Dec 13, 2004 11:21 am
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

i tried a simple VPN (using PPTP) with DNS-name instead of ip-address, but afaik it cant't not work this way. this is the running configuration: interface pptp-client pr Flags: X - disabled, R - running 0 X name="pptp-client" mtu=1460 mru=1460 connect-to=x.y.129.62 user="test" password="******" prof...
by mag
Thu Dec 09, 2004 8:33 pm
Forum: General
Topic: Questions about Masquerading and NAT rules
Replies: 12
Views: 4213

why so complicated? (the mangle rules)
(and i would suggest upgrading to 2.8.21)

regards.
   matthias
by mag
Thu Dec 09, 2004 12:45 pm
Forum: General
Topic: Questions about Masquerading and NAT rules
Replies: 12
Views: 4213

/ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1-xxx.yyy.1.15
where xxx.yyy is the public part, i'd guess.

will this provide the inbound mapping (dst-nat) automatically?

(these things are poorly documented)

regards.
  matthias
by mag
Thu Dec 09, 2004 9:56 am
Forum: General
Topic: MAC Filtering - ethernet network
Replies: 6
Views: 2006

are you saying create a bridge and only bind the LAN interface to it then modify the bridge firewall rules to allow the MAC's I want? yes. btw, is it possible to use MAC-address wildcards in the rules? i tried "*" but these are not accepted. or does it use some boolean test e.g. 0 matching all? reg...
by mag
Thu Dec 09, 2004 9:42 am
Forum: General
Topic: Can MikroTik RouterOS V2.8 do this
Replies: 4
Views: 1154

Re: Can MikroTik RouterOS V2.8 do this

...open their browsers and get re-directed to a login page before internet access is granted sessions will need time out limits etc. Also i need to limit bandwidth to 64k. Also some users will need a pre-assigned public ip address. Smtp re-direction would be nice. sounds like the usual hotspot feat...
by mag
Thu Dec 09, 2004 9:29 am
Forum: General
Topic: Questions about Masquerading and NAT rules
Replies: 12
Views: 4213

which firmware version is in use? i had similar problems with some pages which turned out to be caused by a particular ISP (traffic shaping) masqerading means matching many private ip-addresses to one public ip-address. http://www.mikrotik.com/Documentation/HowTo.html#How_dstnat ; dst-nat: src-addre...
by mag
Wed Dec 08, 2004 8:35 pm
Forum: General
Topic: PPPoE running for 2 users but will not work for anyone else
Replies: 5
Views: 1357

Re: Thank You!! Sometimes you just need another pair of eye

Eugene, thanks for the catch of the comma vs. the dash. mag, I'm in the process of upgrading my routers to 2.8.21. Any suggestions on the incoming/outgoing filters? argh, i was really blind there;-) i'd guess http://www.mikrotik.com/docs/ros/2.8/guide/aaa.content shows profile specific filters. but...
by mag
Wed Dec 08, 2004 1:21 pm
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

:put [:resolve www.example.com]
Doesn't it say you something? :)
i am not sure. does it mean i can resolve a dns name in a script? does it mean too, i could configure dns-name-based vpn-connections only by scripting? (or can i put the command into the ip-address field?)

thx.
  matthias
by mag
Wed Dec 08, 2004 10:56 am
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

have you tried to enter a DNS name and, before accepting this, press Tab button?
i tried this of course. all i got is an error, stating a non zero ip-address is needed. tried with pptp and ip-tunnel.

regards.
  matthias
by mag
Wed Dec 08, 2004 10:44 am
Forum: General
Topic: PPPoE running for 2 users but will not work for anyone else
Replies: 5
Views: 1357

why using 2.8.11? i would recommend upgrading to 2.8.21.

regards.
  matthias
by mag
Wed Dec 08, 2004 8:18 am
Forum: General
Topic: MAC Filtering - ethernet network
Replies: 6
Views: 2006

Re: MAC Filtering - ethernet network

perhaps the bridge firewall could help:
http://www.mikrotik.com/docs/ros/2.8/in ... ge.content

"/interface bridge firewall" section.

regards.
   matthias
by mag
Tue Dec 07, 2004 9:53 am
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

Re: Re-Transmissions

Best way to check for re-tranmissions?
a manageable switch or protocol analyzer in the ethernet segment between modem and router and between router and pc.

regards.
  matthias
by mag
Tue Dec 07, 2004 9:23 am
Forum: General
Topic: pptp tunnel strange problems
Replies: 1
Views: 711

Re: pptp tunnel strange problems

there were all kinds of tunnel problems with early 2.8 firmware. i would recommend updating to 2.8.19 (or later).

regards.
  matthias
by mag
Mon Dec 06, 2004 10:32 pm
Forum: General
Topic: 50 - 75 km , 10 mbps , PtP
Replies: 16
Views: 4766

there was a contest (i think in the USA) for link-range a few months ago. the winning team did 85km at 11mbit/s, using 3m 50dBi dishes.
by mag
Mon Dec 06, 2004 8:57 pm
Forum: General
Topic: PORT FORWARDING
Replies: 7
Views: 2191

Re: PORT FORWARDING

see documentation: http://www.mikrotik.com/docs/ros/2.8/ip/nat.content
under redirect

example (192.168.255.10 is local webserver):
in-interface=pppoe dst-address=:80 protocol=tcp action=redirect to-dst-address=192.168.255.10 to-dst-port=80
regards
   matthias
by mag
Mon Dec 06, 2004 5:38 pm
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

Re: Test result

DSL connection is symmetrical, fractional T1 hmm, t1 is not dsl, i guess you got 384 kbps with symmetric dsl (hdsl, sdsl)? Results testing from local (cable) to remote (dsl) were strange, tx kept dropping to zero then jumping back up: i don't think it's the mt. i would check everything between mode...
by mag
Mon Dec 06, 2004 12:23 pm
Forum: General
Topic: Radius with 2/more servers defined...
Replies: 12
Views: 2854

... We have a system with a local RADIUS server for people who want to use their prepaid cards for Internet access. But we also have customers who should have access to our system because they're a member of a certain organisation. These records are being kept by another/external RADIUS server. tha...
by mag
Mon Dec 06, 2004 9:24 am
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

no problems with tunnels anymore. we're using a lot of EoIP and PPTP tunnels and do not have speed problems (up to several mbit/s per tunnel).

i haven't tested ipsec yet, but using tunnels has become a very important MT feature for us.

regards.
   matthias
by mag
Sun Dec 05, 2004 10:35 pm
Forum: General
Topic: EoIP
Replies: 23
Views: 4743

Re: EoIP

what router os version is in use?
what means slow in kbyte/s? 384 kbps will give you a throughput of around 20 kbyte/s.

regards.
  matthias
by mag
Sun Dec 05, 2004 10:59 am
Forum: General
Topic: Web Proxy Woes (Again)
Replies: 2
Views: 1089

Re: Web Proxy Woes (Again)

... upgraded two routers to 2.8.19. so decided to try it again.... Am I the only one with this problem? Any ideas? same problem to me. i set the mss according to the mtu (1480) which works on the dsl-line. but no web-site is working through the proxy anymore. with 2.8.16 it has been working. as far...
by mag
Sun Dec 05, 2004 10:50 am
Forum: General
Topic: connection vs. flow mark
Replies: 2
Views: 1060

thanks, so connection-mark marks connections and flow-marks marks a flow. i thought as much ;-)
but seriously, i liked to know what the differences are on a thourough technical level.

regards
  matthias
by mag
Sat Dec 04, 2004 11:37 am
Forum: General
Topic: connection vs. flow mark
Replies: 2
Views: 1060

connection vs. flow mark

hello, i'm looking for a thourogh explanation of connection mark and flow mark. some examples use connection marks and combine them in another rule into a flow mark, some are using flow marks directly and another one states that in NAT'ed situation flow marks could not be used. so i'm a little confu...
by mag
Sat Dec 04, 2004 11:15 am
Forum: General
Topic: connection refused
Replies: 2
Views: 1083

Re: connection refused

why not trying 2.8.19?
by mag
Sat Dec 04, 2004 10:06 am
Forum: General
Topic: Radius with 2/more servers defined...
Replies: 12
Views: 2854

may be radius realms are the feature whats needed here: a radius can act as proxy for other realms.

it does not make sense to have different user databases on radius'es within the same realm.

regards.
   matthias
by mag
Fri Dec 03, 2004 1:28 pm
Forum: General
Topic: MT Access Point with more than 2 antennas
Replies: 5
Views: 1271

2. With difference of how many MHz should the antennas be set ? usually 20 MHz or more, but depends on wireless protocol and local regulations. Can I use 2 antennas with freq. 1 and 2 antennas with freq. 2 ? no, you shouldn't. they will interfere. polarisation will help somewhat, but a pair of ante...
by mag
Tue Nov 30, 2004 10:10 am
Forum: General
Topic: Translating Cisco Config
Replies: 1
Views: 837

Re: Translating Cisco Config

i would use something like: /routing rip interface add interface=ether1 /routing rip network add address=64.0.0.0/8 see also http://www.mikrotik.com/docs/ros/2.8/routing/rip.content but i wouldn't use RIP anymore, OSPF is the better choice. (http://relcom.net/CURS/OSPF/1.html) regards    matthias
by mag
Wed Nov 17, 2004 11:08 pm
Forum: General
Topic: Any V2.8.18 Issues?
Replies: 7
Views: 1814

... severe problems with 2.8.18. and 2.8.19 using the "new" wireless package and Atheros 5213 chipsets on 802.11g. To give you an impression: On point-to-point links just about 600 meters apart using 14 dBi directional antennas and a signal level of about -42 dBm I had ping times up to 600 ms on an...
by mag
Tue Nov 16, 2004 3:59 pm
Forum: General
Topic: ACK timeout problem - users cannot connect or get kicked out
Replies: 5
Views: 1812

Re: ACK timeout in interface settings

did 2.8.19 or anything else solve the problem? (we have a similar problem, but changing ack-timeouts didn't help).
regards.
   matthias
by mag
Tue Nov 16, 2004 12:10 am
Forum: General
Topic: v2.8.19 change
Replies: 1
Views: 843

Re: v2.8.19 change

it is in the wireless manual (http://www.mikrotik.com/docs/ros/2.8/interface/wireless.content) disconnect-timeout (time; default: 3s) - how long after the disconnect to keep the client in the registration table and keep trying to sending packets and some information from mikrotik: The v2.8.19 will b...
by mag
Sat Nov 13, 2004 10:38 am
Forum: General
Topic: public IP to fourth AP in a chain
Replies: 1
Views: 718

Re: public IP to fourth AP in a chain

one solution would be using NAT on the AP1.
another some kind of tunnel between AP 4 and AP1, e.g. with PPTP.
PPTP could also hand out the public IP-/network-address.

regards.
  matthias
by mag
Sat Nov 13, 2004 10:26 am
Forum: General
Topic: Transparent proxy
Replies: 5
Views: 1824

I have my mikrotik configured as a bridge, not doing any routing or firewalling, i just shape traffic on this machine. I just wanted to activate proxys work on layer 3 (IP, to be strictly: on layer 5) and bridges on layer 2, therefore no device is talking ip the bridge by default. afaik transparent...
by mag
Sat Oct 30, 2004 11:22 am
Forum: General
Topic: Wireless client ethernet bridge?
Replies: 7
Views: 3259

Re: Wireless client ethernet bridge?

How can I bridge the wireless card to the ethernet card? The manual said that you can't do this in station mode. ... Is there a way that I can do this that I am overlooking? this question was in the forum quite a lot. try searching. and no, you can't. using wds may be an option (i haven't used wds ...
by mag
Sat Oct 30, 2004 11:17 am
Forum: General
Topic: HotSpot / Multiple Interfaces / login-mac-universal support
Replies: 2
Views: 1065

Re: HotSpot / Multiple Interfaces / login-mac-universal supp

on a similar configuration i simply put all hotspot interfaces in a bridge-group. seems to be working. (changing all rules and dhcp to the hotspot-bridge interface)

regards.
  matthias
by mag
Sat Oct 16, 2004 12:31 pm
Forum: General
Topic: L2TP vs DynDns
Replies: 1
Views: 1289

Re: L2TP vs DynDns

no you can't. look in the beta forum there's a thread.

regards.
 matthias
by mag
Wed Oct 13, 2004 12:22 pm
Forum: General
Topic: Strange problem with src-nat
Replies: 7
Views: 2398

i would suggest this too. i.e. masquerading for usual clients, src-/dst-NAT pairs for servers.

regards.
 matthias
by mag
Tue Oct 12, 2004 4:20 pm
Forum: General
Topic: Strange problem with src-nat
Replies: 7
Views: 2398

Re: Strange problem with src-nat

if you are going to map ranges of different sizes together, it will not work. the ip-address range size have to match.

regards.
 matthias
by mag
Tue Oct 12, 2004 4:04 pm
Forum: General
Topic: Syslog from RouterOS to FreeBSD
Replies: 1
Views: 1574

Re: Syslog from RouterOS to FreeBSD

perhaps syslogd has to be startet with "-u" parameter to enable reading from remote sources.
(see man syslogd too)

regards.
 matthias
by mag
Thu Oct 07, 2004 8:59 am
Forum: General
Topic: Cloneing Configuration
Replies: 1
Views: 866

Re: Cloneing Configuration

just a proposal: i made a configuration text file (export file=config) and changed it a bit to give the interfaces always the same name. this depends on a quite similar hardware configuration, but changes are easily done with a text editor. example: ... / interface ethernet print set 0 name="ether1-...
by mag
Wed Oct 06, 2004 9:07 am
Forum: General
Topic: DHCP lease that never expires
Replies: 8
Views: 3870

do you use dst-nat to make them having a high ID?
what do you mean by high ID? i'd guess this is something p2p-specific.
do you limit the connections per user ?
no.

regards.
 matthias
by mag
Wed Oct 06, 2004 8:59 am
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

We've provided a mikrotik script in one of the forums ... yes, i have seen this script, but i dont think it helps for the task i had in mind. to explain: in germany there is a growing number of highspeed connections (3mbit) over telekom dsl, it is quite cheap so a lot of business customers do use i...
by mag
Tue Oct 05, 2004 11:35 pm
Forum: General
Topic: DHCP lease that never expires
Replies: 8
Views: 3870

ok many thanks, I did it ands it seems it works ok.
Do you also have people using p2p on your network? what do you do with them?
until now -- nothing. we are counting ip-volume;-)

regards.
matthias
by mag
Tue Oct 05, 2004 9:00 pm
Forum: General
Topic: XR - when?
Replies: 8
Views: 2897

but wouldn't squeezing a couple extra db out of a link be worth a simple switch? as i said: a nice to have low-cost-market feature. i know what a good receive-amplifier with -105dB costs, therefore i do not think atheros is using such one. the white paper does not mention any other radio parameters...
by mag
Tue Oct 05, 2004 8:15 pm
Forum: General
Topic: DHCP lease that never expires
Replies: 8
Views: 3870

Re: DHCP lease that never expires

i would suggest to use a "normal" lease time, e.g. 48h and create fixed dhcp entrys see: http://www.mikrotik.com/docs/ros/2.8/ip/dhcp.content section dhcp-server, dhcp leases. this will assure, that a given client (MAC) always gets the same ip-address, but still enables a central management of netwo...
by mag
Tue Oct 05, 2004 9:00 am
Forum: General
Topic: Get a list of connected PPPoE Sessions
Replies: 5
Views: 2496

Re: Get a list of connected PPPoE Sessions

probably per snmp.

connected pppoe-sessions are listed in /interface and
/interface pr oid
gives the snmp oid.
by mag
Mon Oct 04, 2004 4:38 pm
Forum: General
Topic: web-proxy and https
Replies: 2
Views: 1356

yes, thanks.

i checked for the squid documentation also and there seems to be this "CONNECT" command, which is mentioned in the web-proxy docs too.

regards.
matthias
by mag
Mon Oct 04, 2004 2:43 pm
Forum: General
Topic: Cannot surf some website when use PPPoE in client side
Replies: 1
Views: 900

Re: Cannot surf some website when use PPPoE in client side

i have a problem with the PPPoE users they cannot surf some sites
search for "MTU" in the forum, there are many answers (adapting MTU, MRU and MSS)

regards,
matthias
by mag
Sun Oct 03, 2004 7:03 pm
Forum: General
Topic: Bond two wireless cards???
Replies: 4
Views: 1586

Re: Bond two wireless cards???

afaik that could not be done at all.

you can do some load-balancing by entering more than one gateway, this has been mentioned in the forum before.

and there will be some channel-bundling features in 2.9 (see beta forum).

regards.
matthias
by mag
Sun Oct 03, 2004 1:04 pm
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

yes, this is a usual question for dns. but there is a solution already: TTLs

any resolver has to respect them.

e.g. dyn-dns.org sets a ttl of 60s, cisco NAT sets a TTL of 0s (which is RFC compliant too).

regards.
matthias
by mag
Sun Oct 03, 2004 12:55 pm
Forum: General
Topic: difference btw wireless & wireless-legacy?
Replies: 3
Views: 1239

Re: difference btw wireless & wireless-legacy?

afaik 2.8.16 wireless-legacy is identical with 2.8.13 wireless package.

(see change log too)

regards.
 matthias
by mag
Sun Oct 03, 2004 1:04 am
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

Re: DNS names

This is unsecure...
yes, right, but i didn't say to change everything from ip-addresses to dns-names, only to have the option to use dns-names too.

(by now, mikrotik ros is mostly unusable for dyn-dns based connections, and due to t-dsl we have lots of them in germany...)
by mag
Sun Oct 03, 2004 12:32 am
Forum: General
Topic: XR - when?
Replies: 8
Views: 2897

Not sure whether this is supported in MT, I guess not yet, I would expect to see an 'XR' switch to enable/disable. thanks for the links, i have seen d-link has boxes (e.g. DWL-2100AP) claiming to use XR. as the white paper states, it works by improving sensibility down to -105 dB and lowering bandw...
by mag
Sat Oct 02, 2004 11:55 am
Forum: General
Topic: web-proxy and https
Replies: 2
Views: 1356

web-proxy and https

is it possible to use the build-in web-proxy (2.8.16) for https-connections? what would the ip firewall rule look like? i tried: 0 ;;; transparent http-proxy in-interface=lan dst-address=!192.168.254.0/23:80 protocol=tcp action=redirect to-dst-port=3128 1 X ;;; transparent https-proxy - doesn't work...
by mag
Sat Oct 02, 2004 10:38 am
Forum: General
Topic: Short link Max throughput. Nstreme the answer?
Replies: 13
Views: 4984

Re: Short link Max throughput. Nstreme the answer?

if "50megs" means 50mbit/s half-duplex, this could be done with one nstreme link (802.11a-turbo, perhaps with 802.11g-turbo too), but more powerful hardware than routerboard is needed.

with dual nstreme 50mbit/s full-duplex should be possible.

regards.
matthias
by mag
Sat Oct 02, 2004 10:17 am
Forum: General
Topic: XR - when?
Replies: 8
Views: 2897

Re: XR - when?

could you explain a bit, what feature this is and why it would be important to have it?

tia.
matthias
by mag
Sat Oct 02, 2004 10:16 am
Forum: General
Topic: feature request: dns-names instead of ip-addresses
Replies: 28
Views: 8713

feature request: dns-names instead of ip-addresses

imho it would be helpful to have the opportunity of entering dns-names instead of ip-addresses in destination-fields, e.g. configuring tunnel-, ppp-type-clients. of course only if dns-cresolver is configured. most operating systems allow this too for there vpn-clients and it becomes essential for us...
  • 1
  • 2