MikroTik

mag

Sorry, forgot to make that point clear: yes, MIMO (2x2) should be used.

(Otherwise it would be a bit trivial

mag

I couldn't find a solution by searching and the question might also be of interest for others, so I am asking it here: Many WLAN-routers/IADs allow simultaneous use of WiFi 2.4 and 5.2 GHz. However, only the usual 2 antennas are build on these devices. Would it be possible to implement that with a R...

mag

sorry it's years ago i used that stuff... but why not pinging the PPPoE-clients public IP-address? If the corresponding ADSL-line disconnects, the IP-address is unreachable as well. unfortunately this IP-Address will possibly be given to another ISPs client, but usually not within seconds. plus one ...

mag

http://forum.mikrotik.com/viewtopic.php?f=3&t=41205

mag

i have seen things like that on older USB/serial-adapters, probably caused by the serial controller chip.
only solution i know is trying another adapter.

mag

Thank you for the answers. 1) Only 450G supports this feature. Ok, i just tried because it seems to have the same chipset. 2) Do you mean adding VLAN tags for specific ports? yes probably. A short example of a 2-port VLAN (id/tag 101), where ether1 is tagged (trunk port) and ether2 is untagged (acce...

mag

According to http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Port_Switching I am trying some functions. First one is this: Ether1 port on RB450G has a feature that allows it to be removed/added to the default switch group. By default ether1 port will be included in the switch group. This c...

mag

The above described behavior of IPv6CP is correct and standard conform. What we need on MT-ROS is called "prefix-delegation" via PPP or similar links, where a delegating router (CO) gives the CPE a prefix, and the CPE selects subnets for the interfaces from that prefix. I hope MT will work...

mag

arghh! thx - you saved my life, at least

mag

After upgrading the Mikrotik OS to 3.10 and MacOS to 10.5.3 (i don't know wchich one caused the change) the build in terminal is no longer working correctly. All output is in one line and unreadable. I tried to change some parameters in the MacOS X terminal but didn't have success. Has anyone solved...

mag

http://wiki.mikrotik.com/wiki/Drop_port_scanners

mag

is it possible to change the standard pptp-server port 1723 to another port no., or even better use another port as second?

TIA.

mag

MTU-Problem? Could be tested by increasing ping packet size with don't fragment-bit (DF) set.

mag

Tried it a year ago, can't remember any problems.
May be you could post things like arp-cache, netstat -rn, ping- and traceroute-logs.

mag

Since I don't usuallly use a windows machine, either a Mac or Sun box, I would really like to be able to use a standard tftp server to upgrade the router.

simply use scp. works perfect.

mag

Up!

I think his is VERY interesting for ALL user.

NO, please don't do this. If i want an analyzer i'd buy one. If i want a router i dont't want it to do other tings than routing! (or at least very similar things)

mag

What I am missing is some information in ROS what metrices
my routes actually have.

i'd guess one will see different distances only, when exporting routes from one routing protocol into another.

mag

i've seen the MPLS-feature on top of the wishes list. i am wondering what do people like to achieve with MPLS? Connecting WLAN to fat MPLS backbone to switch labels with customers or ISPs? personally i am interested in the MPLS ability to build up fully meshed networks with different services (e.g. ...

mag

There is no need to set network type on each interface running OSPF unless you need specific network type.

but i would select PtP-interface type whenever possible, cause it saves the router from the whole DR-/BDR-selection work.

mag

Whole idea is agregating all avaliable traffic to single logical link without changing source ip adress. Best would be using some kind of Ethernet-trunk/-channel. That would recommend of course an adequate switch at the ISP-side too. the usual way is (OSPF-) ECMP, but this is working at the IP-layer.

mag

there's an example in the wiki.

mag

http://wiki.mikrotik.com/wiki/PPTPServer

mag

BTW, tftp-servers on routers are quite common (Cisco, Juniper, Extreme, and alot more:-), they are easier and smaller to implement into the routers firmware, but a bit more difficult to use than ftp. Both are very unsecure, ftp even more. i prefer using ssh (scp is contained) with public key install...

mag

Is it possible to have an interface in passive mode with router os 2.9?

TIA

mag

MPLS would be much better 8)

mag

generally its not possible.

mag

Has anyonme here been using RouterOS for long term Router to Router VPN's? Is RouterOS reliable for this? Yes, several IPSec-VPNs, some using Tunnel-Mode, others in Transport-Mode with EoIP and a few ones with PPTP. Yes, with MT-ROS 2.9. together with some scripting long uptimes (several months) ar...

mag

Maybe it would be worth to consider implementing OpenVPN in 2.1 or 2.x.

mag

is there a BGP feed from the ISP? BGP is (only) for exterior routing between ASes, OSPF will be the right choice for this scenario. How is the green wireless link created, between the APs or between the MTs? Three possible solutions come to mind: Using HSRP/VRRP between the two Ciscos, if a Layer2 c...

mag

No problem with PPTP, just upgraded from 2.9.16 to .18. PPTP-Passthrough and -Server tested.

mag

I actually do have an idea for some simple solution that is distributing users/traffic (only) according to source address... sounds good, i'm looking forward to it ;-) Yes you´re right, but how should I use policy routing, if my source-machine is a webproxy? but not the web-proxy on the MT itself, ...

mag

where's the problem? simply turn remote-requests off, if dns on the MT should not be used.
otherwise it's perfectly normal for DNS to build up a RAM-cache (except TTL=0 entrys, which are used vor dynDNS or NATted DNS-payload)

mag

that's far to complex for an easy answer.
i would check end-to-end connectivity by using portscanner and packet-analyzer, if possible.

for a complicated mixture of protocols and applications, maybe installing a direct EoIP-tunnel through IPSec would be the easiest solution.

mag

I run both IPSEC and PPTP through an MT with src-nat defined and it works fine using UDP encapsulation for the ESP packets.

I see. Are there many VPN-Clients using the same Protocol e.g. IPSec? Does this work too?

mag

this will not work with any Draytek Vigor, cause there's no transparent layer-2 connection.

mag

as RADIUS is accounting traffic per user-session i don't think its possible.

the only thing i know is netflow, which counts traffic on ip-address-tuples:
http://www.mikrotik.com/docs/ros/2.9/guide/accounting.

mag

Why the heck would you want to upload such a large file TO a router (!) ??? :shock:

Probably the Coffee Machine Control Software ;-)

(no, i don't want to know actually)

mag

AFAIK it stores in memory. I didn't see CF writes increasing while dig'ing my test MT-router.

mag

I was discussing ECMP with some collegues and we are quite unsure if it would be reliable. Problems are known with HTTP and Instant Messenger-applications. One idea was if ECMP could be get to work on src-address only, these problems should disappear. i hadn't the time yet to test anything, but if s...

mag

That needs "NAT-T". AFAIK not supported by MT yet.

mag

and it's not working AFAIK. see http://forum.mikrotik.com//viewtopic.php?t=7263

mag

dunno - but what about some firewall rule on outgoing interface? The thing is however, that NAT is being applied after the routing, so not sure what chain you would have to check, as it will be "forward". from the packet flow diagramm src-NAT/Masquerading is applied after that. Or what ab...

mag

i would suggest policy-based routing. look at the manual http://www.mikrotik.com/docs/ros/2.9/ip/route , and there were examples in this forum.

mag

i'am doing similar things, but do not understand your question, sorry.
packets can not be splitted.

mag

I’m completely stupefied by the cheapo $50.00 linksys router getting 25 to 30 mbps with the crappie hardware and tiny cpu’s and then the router boards strain to get this speed

Which Linksys (WRT?) reaches > 20 Mbit througput? Never heard of such data rates.

mag

SBE T1s are supported.. (DS3 as well)

Last year we tried SBE T3/E3 cards but they didn't work with Router OS.
We ended up using E3-Ethernet-converters.
I'm very interested if any E1 or E3 card is working reliable now.

mag

ok, never mind why this is not working...

but, how can one test NAT working from the router itself then?

mag

I've read many topics where people "split" one AP with omni- antena to 3 or 4 sectors

Don't do this! One radio for each antenna is a must for professional use.

The two connectors are only for diversity or for separating RX and TX (interface wireless antenna-mode)

mag

Very good! Looking forward to it. Now we're using Ipswitch WhatsUp (fading out), InterMapper (my favorite:), Nagios (testing) and a few minor tools. SNMP-related things springing to mind are: Traps Configuration access e.g. interfaces, firewall rules, activating scripts,... (one more thing, not sure...

mag

not really, i.e. it does not do zone-transfers, according to the dokumentation, but it can be used as a forwarder, which will build up a cache.
i would set cache-max-ttl=8h.

mag

I thought that too ... maybe normally, if you would use ping without the source address parameter, it would be masqeraded, maybe that parameter is overriding it? if the ping is send without src-addr-parameter it goes right out of the WAN interface, originating from the public IP-address the WAN-int...

mag

i am using often PPPoE to connect CPEs but had very few problems in using EoIP-tunnels over a routed (wireless) backbone or even through internet. I think its a question of network-design too, personally i like the idea of encapsulating customer traffic into tunnels, instead of flooding them through...

mag

How should this work? Hm, i thought this should match the masqerading rule? Like for any other Client on the internal side of NAT. concerning the packet-flow diagramm, i guessed it should go through local -> output ->postrouting (src-nat/masquerading) -> ... -> out-interface am i wrong? @normis: in...

mag

i can't see what is causing the following problem: {LAN} -- (MT-router, ROS 2.9.17) -- {WAN} using simple masquerading chain=srcnat out-interface=to-wan src-address=10.10.1.0/24 action=masquerade router has 10.10.1.1. now i do ping www.heise.de src-address=10.10.1.1 193.99.144.85 ping timeout 193.99...

mag

it is partly possible by using bridges. i don't know how this affects performance, though.

on the other hand, i consider this behavior perfectly normal for a router...

mag

sorry, sounds very interesting, but i don't understand the problem

mag

i do completely agree. very good explanation.

Our goal is to secure bridge our corporate vlans

leads me to suggesting IPSec. (and i do like tunnels ;-)

mag

i'd guess something like (on the next MT):

add chain=dstnat in-interface=<lan> src-address=!<other-mt-ip> dst-address=!<local-net> protocol=tcp dst-port=80 action=redirect to-ports=3128

mag

I wouldn't use VLAN-trunks, but directly terminating the IPSec/EoIP-tunnel at the customer, similar to an ATM-PVC. On the AP side it should be possible to group the virtual-AP and the EoIP-tunnel within one particular bridge.

But it depends on the real demands...

mag

A facility similar to that of IOS which allows piping CLI output through a filter.

you're right but it could be done already, e.g:

ssh admin@192.168.255.1 "/log print without-paging" | grep info

mag

I would suggest also a redesign. One thing is using one central PPPoE-Server directly connected to the internet-gateway. Then customer-IP-network could be completely separated from the transport/backbone IP-network. Also i found it easyier to use a routed backbone than a bridged one, but this needs ...

mag

this is really good. thanks to changeip ! just a comment, with Mac OS X 10.4 it becomes even simplier, because the -i parameter defaults to the right file. i prefer the '@' ssh notation, one can e.g. just type: ssh admin@192.168.1.1 "/interface print" and gets Flags: X - disabled, D - dyna...

mag

So a bridged network design is used, where the routers have only management IP-addresses and WDS for bridging the wireless backbone? Where are the PPPoE-Servers located, on each particular access-point? And is there a central router, connecting the star together, being also def. gateway with IP-addr...

mag

How about using EoIP- within IPSec-tunnel?

mag

Its very few information. E.g. first IP-subnets are mentioned, then things about bridging... How are the subnets interconnected? What does "no longer access" mean. In networks there are layers and protocols and tools to test layer related connectivity like torch, ping, traceroute, etc. Lar...

mag

how to use SSH DSA keys? i can't find any documentation?
under "/user ssh-keys " is nothing and there is no .ssh/ in file. so how is it meant to be used?

mag

I would love to see an open-source API, but I think that would generally be considered the advanced thing for coolhackers. :twisted: there's a well known and standardised way for doing this: SNMP (write), and before adding some proprietary API, it would be much better to complete the existing SNMP-...

mag

Perhaps as a PPPoE- oder VPN-Server it could be useful.
Routers, of course should be dedicated machines.

(MT ROS runs on Virtual PC too ;-)

mag

ssh/scp, script, scheduler... what else does one need?

mag

ok, i'd guess EoIP is the right tunnel, so i still see a few unanswered questions: ... check if the MAC-addresses for the EoIP tunnels are not the same. Could you ping computers from the router, they are connected to? ... Did you check if the EoIP-Tunnel is working? That is seeing MAC-Adresses from ...

mag

All the servers are in the 192.168.0.x/24 subnet, ideally the solution would also allow broadcast packets so the windows servers could identify eachother by name. LAN-Broadcasts could cause a lot of WAN-Traffic, does that matters? AFAIK Windows-server could interconnect without seeing broadcasts, u...

mag

I can ping Router1 from Router2 but can not ping any computers connected to the same lan Router1 is conencted to from Router1. The same is true for Router2. i can't see a difference, besides that i have enabled proxy-arp at one side, but this is for PPTP only. Did you check if the EoIP-Tunnel is wo...

mag

and the EoIP-Interface should not be in the same bridge with the interface the EoIP-tunnel goes out. an example: / interface eoip add name="tunnel-101" mtu=1500 mac-address=00:00:5E:80:10:11 arp=enabled remote-address=1.1.1.1 \ tunnel-id=101 comment="" disabled=no / interface bri...

mag

There are a lot of press releases about IEEE 802.11s WLAN-Mesh proposal
e.g. http://standards.ieee.org/announcements ... posal.html.

mag

good! i always missed some kind of "unnumbered" connection.
this should be a perfect replacement.
(it's not mentioned in the manual particularly, is it?;-)

mag

thx. this one makes it:

add chain=dstnat in-interface=lan protocol=tcp dst-port=53 action=redirect to-ports=53 
add chain=dstnat in-interface=lan protocol=udp dst-port=53 action=redirect to-ports=53

mag

should be working.
did you clear the ARP-cache at the client?
maybe posting the configuration could help.

mag

...
im using my laptop near the MT router 5 meters only
...

what kind of notebook, radio and OS is meant?
the wireless forums are full with Windows having problems with wireless connections, especially using Intel Centrino chipsets and WPA/WPA2.

mag

i am trying to use this, but to no success. maybe someone could correct me. using this rule: add chain=dstnat in-interface=lan dst-port=53 action=redirect to-ports=53 gets Flags: X - disabled, I - invalid, D - dynamic 0 ;;; redirect DNS-requests chain=dstnat in-interface=lan dst-port=53 action=redir...

mag

if nothing is in the log, the policy does not match the packet.

mag

AFAIK no, thats simply the way NAT works.

mag

it did, of course, while testing it ;-)

i don't think that problem could be solved, if trying to use ssh from internet AND trying to avoid ssh-attacks both. but i see these attacks mostly at night time and tend more and more using VPN-tunnels for management.

mag

ok, i see. a little improvement might be: /ip firewall filter add chain=input in-interface=<internet> protocol=tcp dst-port=22 limit=1/10s,2 action=accept comment="Accept limited SSH" disabled=no add chain=input in-interface=<internet> protocol=tcp dst-port=22 action=add-src-to-address-lis...

mag

just an idea:

/ip firewall filter
add chain=input protocol=tcp dst-port=22 limit=1/10s,2 action=accept comment="Accept limited SSH" disabled=no 
add chain=input protocol=tcp dst-port=22 action=drop comment="Drop excess SSH" disabled=no

mag

Where's the difference? PPPoE sets a Gateway too. Read it from /ip route print and set it. See scripting examples in the manual. something like: :local DefGw1 "" :local DefGw2 "" :set DefGw1 [/ip route get [find /ip route prefsrc=<ip-isp1>] dst-address] :set DefGw2 [/ip route get...

mag

this is working configuration-example, using 10.10.10.0 as transfer-net: / ppp secret add name="user" service=pptp password="password" local-address=10.10.10.1 remote-address=10.10.10.2 / interface pptp-server server set enabled=yes / interface pptp-server add user=user /ip route...

mag

thx. edited.

mag

thanks for the information! i wrote a little script for my purposes: / system upgrade upgrade-package-source add address=<ip-> user="<user>" password="<password>" /system scheduler add name=sched_upgrade on-event=upgrade start-date=jan/01/2006 start-time=02:00:00 interval=1d /sys...

mag

Hm, am i alone with this problem? How do other people upgrade their large quantities of MT-boxes? ;-)

I tried to configure and to use "system upgrade mirror" but it seems to do nothing at all.

any hints?

mag

But that is not the problem and correct for a default-deny strategy.
The problem here is, that only one one way is configured yet, e.g. client-connections and server-answers are missing. (Quite basic IP-knowledge, though;-)

mag

if PPTP is using the same address-space as the LAN, proxy-arp has to be enabled on the LAN-interface.

mag

i would suggest a closer look to the demo-system at mikrotik: http://demo.mt.lv/ there are some firewall-rules.

mag

one example: / tool netwatch add host=x.y.8.158 timeout=1s interval=1m up-script="" down-script="" comment="rt-wil-hs041" disabled=no add host=x.y.8.160 timeout=1s interval=1m up-script="" down-script="" comment="rt-wdn-hm014" disabled=no a...

mag

Turn on ISAKMP debugging on the MT and post the connection log.

how could IPSec debugging be switched on?

mag · netwatch is working for me. (only 4 mt-boxes with 2.9.17 so far )

netwatch is working for me. (only 4 mt-boxes with 2.9.17 so far )

mag

Another theory I have with AIM is the MT box is not keeping the session on the same gateway and switches it during the login process, thus causing AIM to reject me. because AIM DOES connect, and This was my first idea too, but the manual states clearly on ECMP that it works with pairs of source-des...

mag

As i don't want the every 24-hours forced T-DSL-disconnects to occur at 10 a.m., i wrote this little script: /system script add name=pppoe_dis source={ /interface pppoe-client disable [find name="<t-dsl-name>"] :delay 10 /interface pppoe-client enable [find name="<t-dsl-name>"] :...

mag

ähm, is it assured that the PPPoE-client is up and running?
there should be some log-entries and an ip-address assigned to the interface.

mag

i'm going to automate system update within a few mt-router networks and like to ask a few questions, i could not find answers to yet. there is an undocumented paramter (2.9.x): / system upgrade mirror set enabled=no primary-server=0.0.0.0 secondary-server=0.0.0.0 check-interval=1d user="" ...

mag

http://www.mikrotik.com/docs/ros/2.9/ip ... t#5.44.8.4
"MikroTik Router and Linux FreeS/WAN"

is that not what you are looking for?

mag

any entries in the log?
(why not update to 2.9.14?)

btw. 3 minute key-lifetime is very short.

mag

@sten: where did you see a loop? i can't, sorry. sounds like one, though.
if a switch with STP is in use, it should close only the looping-port and show this as well.

mag

i didn't resolve it!

get static IP-addresses (which is always the best :) or use another router-system.

mag

the switch and a small part of the LAN stops to function untill I "unbridge" the interfaces and reboot the switch. "stops to function" is not very descriptive. The radio on MT1 must not be in station mode for use in a bridge (its stated somewhere in the wireless manual) It might...

mag

http://demo.mt.lv/

mag

don't block ICMP completly, e.g. MTU-Path Discovery is ICMP-based.
At the demo-system there are some rules concerning ICMP.

mag

how about simply entering an IP-address-range into /ip service ssh?

(but ususally it's coming from internet, plus i don't like changing WKS-ports. has anyone written a rule to make a temporary blocking address-list for this kind of attack and likes to share it? tia.)

mag

Doesn't look like a RADIUS-Problem to me, but did you check the RADIUS-request-response traffic?

(i'm going to build a similar solution, therefore i'm interested in problems with the PPPoE-server

update: as odie wrote, there is a 200-PPPoE-user limit depending on the licence-level.)

mag

sorry, not an exact answer but maybe helpful: Simple port-mirroring has some problems, especially with full-duplex traffic, for professional analysis, IDS, etc. therefore a TAP-device is needed, e.g.: http://www.netoptics.com/products/product_family_details.asp?cid=4&pid=123&Section=products...

mag

look at the IPSec examples, you should have a firewall-nat-rule with action=accept before the masquerading-rule. maybe this was the problem...

mag

i did both changes: exchange-mode=main and proposal-check=strict.

i am going to test the MTU-thing, but never had problems with it before.

thx.

mag

puh, it was back in 2.8.x times when i last did OSPF with MT.
Will have to do soon again...

mag

Static public IP-addresses on both sides? if yes, then everything should be working nicely. I have now a few important and reliable IPSec links up and running with MT-routers. Its quite easy after the first one;-) The only thing i can't get to work yet is with dynamic IP-addresses (using PPTP as a w...

mag

(sorry for posting, just a mistake)

mag

just an idea: would it not be better to use DHCP with static MAC-entries, for doing the management completely on the router.

mag

AFAIK this will not create a real mesh-wlan-network like the OSLR-based ones. But if there are redundant links it should be working though.

mag

would it not be a good idea to place a little link to the archive on the download page?! ;-)

mag

thanks for the hints, but still does not work. Same log entries.
I am a bit confused by the log-line:

10:03:57 ipsec,ike,info phase 1 negotiation timed out

on the client side. it looks to me as if the client did not get the right response even for phase 1.

mag

i meant to use some kind of ip-ip-tunnel if layer-2 is not a must have.

mag

i would suggest using EoIP only if a transparent Ethernet-connection is needed actually.

(of course its MTU is fixed to 1500, cause it's the Ethernet-MTU)

mag

Scenario looks like: {10.10.1/24} - (R1) - static IP - {Internet} - dyn. IP - (R2) - {192.168.255/24} R1, R2: MT-ROS 2.9.14 Router, R1 is VPN-server, R2 VPN-client configuration at remote site (static IP-address) / ip ipsec policy add src-address=192.168.255.0/24:any dst-address=10.10.1.0/24:any pro...

mag

Hm... was my description to confusing;-)
or is no one using IPSec with dynamic addresses actually?

(Its easily possible with many low-cost routers, so i won't believe it couldn't be done with MT.)

TIA.

mag

as PPPoE works on layer 2 it is necessary to configure an EoIP-tunnel between the two MTs and the appropriate bridge-groups.

mag

Many thanks. This solves the first problem, but i cant find this hint anywhere mentioned in the manual, how-to, faq, etc. Maybe it should be added... It is also not possible to set the netmask of the peer-address inside winbox, obviously a bug. I have now the problem that no IP-traffic is passing th...

mag

I'm trying to get an IPSec-tunnel up between two mt-routers (ROS 2.9.13). The router at the central-site has a static public IP-address (x.91.97.147) the other router at the remote-site has a dynamic public address. following the manual, as far is i understand, this is the configuration: central-sit...

mag

perhaps this one could help you: http://forum.mikrotik.com//viewtopic.php?t=6102

mag

Depends on the type of VPN she/he is trying to use, obviously some IPSec-Client. This will not work without NAT-T on the router itself, or a transparent IP-connection without NAT.

Not really a solution, sorry.

mag

yes, sorry. completely misunderstood.

mag

it's always possible to use RADIUS authentication/accounting on ppp-type connections.

just try "radius" search on the forum...

mag

the usual approach is to use an IETF RADIUS based system, which is good for all types of authentication and accounting. e.g. freeradius is an open source project for many operating-systems and there are also lots of accounting tools for it. (we are using a SBR-RADIUS together with MS-SQL server for ...

mag

thx, i know this. but i can't see how this concerns my question?!

mag

is there a simple way to make tools/netwatch-status visible through the web-interface e.g. tools/graphing? i am going to get the customer a quick look whats going on, without lettin her login into the router. (if not possible yet, it would be a quite nice feature expansion to have tools/graphing/net...

mag

could you post the relevant parts of your pptp-server configuration?

i found it usually helpful too, to look into the pptp-clients log.

mag

Does anyone recall where that info is located?

http://www.mikrotik.com/Documentation/HowTo.html

mag

i see! thanks. therefore it seems necessary to configure a transport-mode-policy for encrypted router to router-traffic containing the routers wan-addresses with /32-mask before the usual tunnel-mode-policies for network to network-traffic?! in my particular EoIP-configuration the transport-mode tun...

mag

if the address was part of a dial-in pool of a large ISP, its very common that it is listed in several black-hole lists.
only way to get out is getting a static ip with correct PTR-record or using a SMTP-gateway.

not exactly a router-specific problem ;-)

mag

Have you tried to add IPSec policy, that encrypts everything between both ends (=addresses) of your EoIP tunnel? yes, if i understood the question correctly. the policy matches the whole LAN-subnet, particularly the routers own lan-ip-address: # r1: / ip ipsec policy add src-address=10.10.1.0/24 ds...

mag

What is the problem to have more IPSec policies? more policies are not the problem. matching locally generated packets, i.e. from the router itself, is the problem. if i changed an IPsec-policy to "src-address=0.0.0.0/0" this particular IPsec-connection does not work anymore. Why do you t...

mag

i guess one needs an application-proxy to handle this kind of redirection.
otherwise the answer from e.g. the ftp-server comes from an unexpected ip-address to the client and will be discarded.

mag

by trying to create a bridged VPN for a customer i found the following problem. establishing the IPsec-VPN is easy and works like expected. but if one is going to ping from one VPN-router to the LAN-interface of the other, expecting to trigger/use the IPsec-tunnel the packets are sent unencryptetd t...

mag

seems that VPN is buggy in 2.9.9/.10 (see recent IPsec-post).
2.9.8 should be working.

mag

hmm, i have a few mt's running IPsec with 2.9.8. and the changelog contains nothing about IPsec!
i just wrote to support, too.

update: i switched back to 2.8.8 and IPsec is working again!

mag

the IPsec VPN config from the manuals application example (http://www.mikrotik.com/docs/ros/2.9/ip/ipsec.content#5.44.8.2) is not working for me, the packets are discarded scenario is very basic: LAN - 10.10.1.1/24-(R1)-x.y.z.157 - DSL - x.y.z.160-(R2)-10.10.5.1/24 - LAN config of router 1 / ip fire...

mag

after upgrading to 2.9.10 download of saved config files (export file=name) via scp doesn't work, e.g.: [user@Zentrale] > export file=zentrale [user@Zentrale] > file pr # NAME TYPE SIZE CREATION-TIME 0 zentrale.rsc script 9942 dec/22/2005 19:48:40 and then trying to scp the file to my pc, as i alway...

mag

do you have any suggestions ?

sorry, not at the moment, i am working on it.

mag

a few months ago we were playing around with some (E1- and) E3-cards, having all kinds of problems. at last we decided to use media-bridges (E1/E3 to Ethernet) with good success, building up a celeron 2GHz based MT-system handling easyly three E3.

not exactly what you want but maybe helpful...

mag

if i understand you correctly, the MT has to be configured as vpn-server in ipsec aggressive-mode. a login with user-id (aka password) is possible then.

sorry to say, i havent't configured this with MT yet, but it works using a few other systems.

mag

yes, of course, lots of. no problems at all!

(if macos 9 is involved ... this would be the problem;-)

mag

http://www.mikrotik.com/Documentation/F ... _licensing

mag

setting the preferred source in the routing table will do it.

mag

we're using EoIP-tunnels between the access-devices and the access-concentrator, all router os based. so the PPPoE client sees only one AC on layer 2.

mag

i asked this a few weeks before, but there was no answer. http://www.mikrotik.com/forum/viewtopic.php?t=1541
also it's not documented.

(i haven't started searching the iptables documentation, maybe there is an explanation)

mag

a few days ago i enabled the web-proxy on a mt router with fairly high traffic. since then the system has crashed completely (hardware reset necessary) every day and the log has often this error line: Web-proxy error while running: squid was killed with signal11, restarting system is a p3 pc with 4 ...

mag

You should set the network address exactly the same as the remote point IP address for point-to-point links. The right netmask in this case is /32. i meant the ip-address of the interface itself, not the ospf-interface. a /32 ip-address usually does not make sense. If you don't specify a the router...

mag

in every LAN the .254 (the mt) is set as default gateway on the hosts?

"/ ip firewall rule forward" is empty?

what does a traceroute from a host in on LAN to a host in another lan show?

no other filters or firewall devices between LAN and mt?

regards.
matthias

mag

ospf router id should be the highest ip-addess given to a local osp-interface.

see: http://relcom.net/CURS/OSPF/1.html

the wireless ip subnet is misconfigured (as mentioned by freman). /32 subnets are talking only to themself.

mag

was the system not testet before put into service? or did it work with a few test-clients? the AP hardware looks good to me, but i'm not sure abbout the prism interfaces, as we're using atheros only. there are some questions left open to me: is the AP intended to work as transparent bridge? external...

mag

recently we changed our 5211 and 5212 cards with 5213 (cm9) because they provided us better signal-quality (usually 3 - 5 dB). mostly using 2.8.21 but a few 2.8.22 systems. most links are in upper 5 GHz band.
no problems yet.

mag

Not a problem if you are using MT to provide services, but a big "ouch" if trying to sell MT-powered products I guess ...

exactly!

mag

i`d like to second the request. WPA and 802.11i are important for the market and often asked for.

regards.
matthias

mag

... You say "forget them" to macOS 9, is that because there is a big problem or are you just being funny. macos x is now around 5 years old and macos 9 support might be a challenge for mac freaks... (yes there are lots of problems with newer hardware, tcp/ip and so on) but, as there is a ...

mag

i did all my mt-configuration and lots of testing -- including hotspot -- at work from a powerbook 400 with airport (802.11b) and macos x 10.3 with no problems at all. plus i have a few other macs connected to my home mt-wlan-router) there were router os versions with wireless-problems concerning at...

mag

Use the WDS example. Then set up a bridge on each side with the ethernet port and WDS interface. or build a routed connection (don't put the wlan interface into the bridge group) and use an EoIP-tunnel (with eth in the bridge group). there are examples in the manual. remember to assign ip-address t...

mag

... /ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1 (xxx.yyy.1.1 being the public address). ... does the public ip-address never changes? on usual dsl-based connections e.g. in germany the ip-address changes at least every 24h, therefore this method won't w...

mag

could you post your dns-cache configuration and router os version?

mag

Will this setting work on a public interface and not drop any legitimate traffic ?? Please advise

i tried it and it is looking good. (had to allow 3128/tcp for squid in rule 18)

mag

just a few quick ideas: if all interfaces are in a bridge, it's necessary to give the ip-address(es) to the bridge, not to the interface(s) itself.

could there be a layer2-loop? stp activated?

mag

no problems (yet) with all kinds of client-systems (unix, mac, windos 2k/xp. lan and wan) and 2.8.22.

what does the dhcp-lease table show when a client doesn't get its address?

mag

...However, I'm not using the router as a bridge, but as a full NAT router. sorry for the OT, but could you comment about NAT'ed payload, particularly DNS requests. are they translated correctly? i.e. will an outside client see the correct public ip-address, if there's a DNS-server behind NAT. i've...

mag

if the connection is ATM, it will be necessary to terminate ATM on your equipment. i havent seen this ability within RouterOS (nor hardware, neither software). if the connection is ethernet, it should be possible with RouterOS. there is of course other equipment then cisco to terminate ATM (e.g. luc...

mag

here is (probably) an example:

http://www.mikrotik.com/docs/ros/2.8/ap ... g1.content

"Gateway fail-over" section.

mag

we've seen that too, downgrading from >2.8.13 to an earlier version didnt't work.
on the other hand we found 2.8.21 to be a very stable and reliable version (we use all types of wireless and tunneling).

mag · Re: 2.8.22 PPTP server no problem with macos x. i'll try windows tomorrow.

no problem with macos x. i'll try windows tomorrow.

mag

on the access concentrator in the interface list delete the dynamic pppoe-in interface.

mag

i am not sure if i understood your demands correctly, but there's a (partly) open source solution: http://developer.apple.com/darwin/projects/streaming/ this system is devided into a coding/working server and a broadcasting server. hi directwireless, yeah I know, that's why I was asking for software...

mag

It is wireless, not wireless-legacy.

after installation "wireless-legacy" and "wireless" both are showing up as "wireless". only the nstreme and some other features are not available in the winbox with wireless-legacy.

mag

2.9 seems to become a real improvement! (if i could only install the beta;-)

anything about the NAT'd payload question?

regards,
matthias

mag

What if I have a third subnet, used by PPTP interface only, which is routed to 10.X.X.X? Can this be done? if i understand the dokumentation correctly, a virtual ip-address could be crated by the local-ip address parameter (first server example), which could be routed to. have you tried this? regar...

mag

is there another way to group the two blocks(x.x.128.0/21 and x.x.136.0/23) together so that they are both NATed to the same block(y.y.105.214 - y.y.105.254) with out using the mangle rule? sorry, i haven't seen this. i think its a good way to handle blocks of ip-addresses. i will do some NAT tests...

mag

http://www.mikrotik.com/forum/viewtopic.php?t=949

there are lots of open source projects to build up a router.

regards.
matthias

mag

see: http://www.mikrotik.com/docs/ros/2.8/in ... ss.content
-> quick setup guide.

it's just configuring wireless interfaces (with appropriate band and frequencies), adding ip- addresses, ready.

regards.
matthias

mag

anybody worked with mikrotik and multihoming bgp through 2 providers for seamless failover ?
I am sure people have used it for keeping it up and running.

it would be even more interesting, if someone is doing this by using two (or more) mt systems and VRRP.

regards.
matthias

mag

and please don't forget web-, ftp, samba-, nfs-, print-, antivirus-, mp3-streaming-, sip-, and a few other minor servers ;-))

i'd like to see a mikrotik based appliance, but this would and should be a completely different product...

regards.
matthias

mag

it would be helpful to know the modem type and vendor;-)
most modem use at commands, so at &fx3s0=1 should work as a starting point.

regards.
matthias

mag

Came with 2.8.20, when I did not see it I tried 2.8.21.

did you load by chance the wireless-legacy package or both wireless packages. for nstreme only wireles package has to be used.

regards.
matthias

mag

which router os version?

regards,
matthias

mag

:D I'd love to see a MAC OSX/Unix version of winbox as well. at least in this professional environment, we should be able do distinguish between MAC and Mac (OS X doesn't run on MACs and there is no Mac-address also ;-)) btw, i am using winbox on VPC with Win2k on a PB G4/400, which works good/fast...

mag

Just test and you'll see that :) I just change the MSS of client interfaces to 1400, and everithing is working fine but MSS should be MTU - 40. usually i set MTU for pppoe-links to 1480 bytes, MRU also. the dynamic mangle rule (created by choosing change tcp-mss in the ppp profile) sets MSS to 1420...

mag

Problem is in TCP MSS.. don't change it and it will work

could you please explain this? if the MTU was set to a smaller value by a mangle rule, i thought the MSS has to be adjusted also.

thx.
matthias

mag

...
So 3COM nics are junk, Realtek nics are junk and I need to build up a couple of $400 boxes just to test if my hardware is a problem?
...

i wouldn't call them junk, but doing bandwith or performance tests it's always important to know about hardware issues.

regards.
matthias

mag

the realtek nics are causing more cpu-load, which is the limiting factor already.

our pc staff told me getting some cheap intel 845/celeron 2 ghz boards with on-board intel-nic will give full throughput. after testing, better or less energy-consuming hardware might be choosen.

regards.
matthias

mag

how did you try it with Tab button? Maybe DND settings are incorrect in your router. Try, for example:

you are right, i tried the winbox, terminal is of course working.

but the problem is still (as written before) that the ip-address is changing on an irregular basis.

thx.
matthias

mag

of course this is a cheap workaround and mikrotik will work on a solution in upcoming versions

thanks, that sounds good to me!

matthias

mag

i tried a simple VPN (using PPTP) with DNS-name instead of ip-address, but afaik it cant't not work this way. this is the running configuration: interface pptp-client pr Flags: X - disabled, R - running 0 X name="pptp-client" mtu=1460 mru=1460 connect-to=x.y.129.62 user="test" pa...

mag

why so complicated? (the mangle rules)
(and i would suggest upgrading to 2.8.21)

regards.
matthias

mag

/ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1-xxx.yyy.1.15

where xxx.yyy is the public part, i'd guess.

will this provide the inbound mapping (dst-nat) automatically?

(these things are poorly documented)

regards.
matthias

mag

are you saying create a bridge and only bind the LAN interface to it then modify the bridge firewall rules to allow the MAC's I want? yes. btw, is it possible to use MAC-address wildcards in the rules? i tried "*" but these are not accepted. or does it use some boolean test e.g. 0 matchin...

mag

...open their browsers and get re-directed to a login page before internet access is granted sessions will need time out limits etc. Also i need to limit bandwidth to 64k. Also some users will need a pre-assigned public ip address. Smtp re-direction would be nice. sounds like the usual hotspot feat...

mag

which firmware version is in use? i had similar problems with some pages which turned out to be caused by a particular ISP (traffic shaping) masqerading means matching many private ip-addresses to one public ip-address. http://www.mikrotik.com/Documentation/HowTo.html#How_dstnat ; dst-nat: src-addre...

mag

Eugene, thanks for the catch of the comma vs. the dash. mag, I'm in the process of upgrading my routers to 2.8.21. Any suggestions on the incoming/outgoing filters? argh, i was really blind there;-) i'd guess http://www.mikrotik.com/docs/ros/2.8/guide/aaa.content shows profile specific filters. but...

Search found 376 matches