MikroTik

nhalachev

Normis, what about my problem ?

nhalachev

hmmm... when have you bought your RB?..

Actually, this RB is from Mikrotik ROS training from Prague 2009.

nhalachev

Just curious. Have you tried a newer Winbox program?

Yes. Still no go:

"License updating: failed: key for specified software ID not found"

nhalachev

have you tried to upgrade the license in 3.30?

Yes. But "Update license keys" fail with following message:
"failed: key for specified software ID not found"

have you tried 'Request key' option to request your old key to your account at mikrotik.com?

Yes. Key not found!

nhalachev

Well, i successfully downgrade to ROS v3.30 (everything about licensing OK), then tried upgrade to new 4.1, still no luck: After upgrade i get a message saying "License valid for 72 hours, please upgrade" and when i click on the 'upgrade license' button, i get: License updating: failed: ke...

nhalachev

I'have e-mail support@mikrotik.com with attached supout.rif file from upgraded ROS v4. I have open ticket [Ticket#2009101366000602] but no answer from support yet.

Well, can anyone from mikrotik support help me ?

nhalachev

I have one RB433 running 3.30 and i try to upgrade to v4. 1. Update the Bootloader if using a RouterBOARD Done 2. If already running RouterOS v3.25 or newer, Update your RouterOS license I have tried, but without success before and after actual ROS upgrade. "Update license keys" fail with ...

nhalachev

Hi i need to assign uptime limit to my user (no session limit) but i can't find (or not exsist) the voule of attribute for radreply table for setting the uptime limit...

Read freeradius docs and wiki about rlm_sqlcounter module ... hope this helps.

nhalachev

mark internet traffic and then use PCQ.

nhalachev

Vlan transport over wireless bridge (WDS) is working perfectly. No limits.
Plus, you can add management vlan to bridge interface.

nhalachev

egg, read these threads:

http://forum.mikrotik.com/viewtopic.php ... t=filterid
http://forum.mikrotik.com/viewtopic.php ... t=filterid

nhalachev

Why it is impossible so to do?

How you can configure one physical port of L2 switch to be untagged at more than one Vlan ?

nhalachev

Just add bridge interface, put all ethers on bridge.

Then use bridge firewall to prohibit traffic from ether2 <=> ether3.

nhalachev

yes different names is needed
ex. names of location (this will eliminate lag)

If make use of different service names, MT's will not do load balancing.
If you want to do load balacing for pppoe, then use same service names, or better avoid using service names.

nhalachev

We have 6 MT PPPoE Servers load balancing hundreds sessions very well.

nhalachev

bjohns, about your environment.. " * 100Mbit to each room, 1Gbit between campuses * Each campus has approximately 300 units - a total of 950 units" 950 rooms with one MT ?! And loaded with pppoe, hotspot, firewal and queues etc. ? No go. I will go with 3 MT systems, each with one vlan per ...

nhalachev

Anyway i wont to connect 3 APs to work in one network! You may try to use WDS between micronet AP's and Mikrotik. From micronet specs we can see they support WDS mode. Read documetation and search forum for more info about WDS configuration. Also here: http://wiki.mikrotik.com/wiki/Transparently_Br...

nhalachev

Hi The downside with MT is that it doesnt support Ciscos native vlan. For management purposes a ip address is set on a vlan interface. Tried to make vlan interfaces and bridges and set ip adresses on the bridge without success. This only created a mess and loops. Finaly we only created a vlan bridg...

nhalachev

Well, what about Balkan's Mikrotik User Group ?
Let's found it, and setup regular meetings, etc ...

nhalachev

where would i find bridge1 i didnt see that anywhere. i have a wds link. the remote ap connects fine but i cant ping it.

Checkout: http://wiki.mikrotik.com/wiki/Transpare ... o_Networks

nhalachev

havent heard anything about "PER DESTINATION LOAD BALANCING" From Cisco Documentation: "Per-destination load balancing means the router distributes the packets based on the destination address. Given two paths to the same network, all packets for destination1 on that network go over ...

nhalachev

How to tell radius not to log local traffic?
Can MT do something like that

You cannot log local traffic via radius, but you may make use of /ip traffic-flow :
http://www.mikrotik.com/docs/ros/2.9/ip/traffic-flow

nhalachev

/interface bridge filter add in-interface=wlan1 out-interface=wlan2 action=drop add in-interface=wlan1 out-interface=wlan3 action=drop add in-interface=wlan2 out-interface=wlan1 action=drop add in-interface=wlan2 out-interface=wlan3 action=drop add in-interface=wlan3 out-interface=wlan1 action=drop ...

nhalachev

conchalnet,

use bridge firewall.

nhalachev

2) sometimes they are not disconnected, so that they look connected (on their PC the pppoe interface says connected), but they cannot surf. It happens after some minutes of the connection. Customers disconnect and reconnect, this solve the problem (for some moments and then again..) Try to enable I...

nhalachev

Well.

Mark-id for pppoe will be nice ...

nhalachev

I second that request.

nhalachev

But it's interesting that this wasn't problem for the cisco ap340 :-O

Well, then this is a serius security bug into cisco firmware i think ...

nhalachev

Did you have more than one IP adressess configured at PC running radius server ? May be the case is : 1. nas send access-request to radius server 2. radius server authenticate succefull and send access-accept, but from anoter ip addreess because of routing table. 3. nas is keeping to retransmit acce...

nhalachev

In queue tree i put this name="10.0.0.7-down" parent=<pppoe-user1@tik-AC> flow=07 limit-at=109226 queue=default priority=8 max-limit=327680 OK so user is connected on pppoe server on tik. This <pppoe..> is his out interface. When user disconnect from server this rule is proclaimed invalid...

nhalachev

If any of you guys has a better way of doing this please post your solution.

Use switches with port-based vlans. Connect customers/segments to isolated ports. Place Miktotik bridges with many ethernets at cross points of your network and manage.

nhalachev

How can I limit the bandwidth (via PCQ) for 2 different users group. With PCQ you shoul make use of mangle rules. Checkout this: http://forum.mikrotik.com/viewtopic.php?p=11138&highlight=#11138 But, instead of PCQ yuc can just setup 2 different profiles with different speeds. Then when create n...

nhalachev

What can I do?

Hello,

Just read documtation on Mikrotik web site and search this forums for PCQ .

Regards

nhalachev

I have been trying "framed-ip-address" from my billing software (rodopi) to pass this through my radius (vircom) on to the mikrotik. This is not working customers always get ip form the pppoe-public pool. You may have missconfiguration somewere ... I am using freearadius with mikrotik ppp...

nhalachev

Hello,

This is relative simple task. Checkout this:

http://www.mikrotik.com/docs/ros/2.9/ro ... t#6.54.6.1

Regards

nhalachev

Hello, You can disable ms windows connectivity between PPPoE networked customers with following commands: / ip firewall rule forward add dst-address=:135-139 protocol=tcp action=drop add dst-address=:135-139 protocol=udp action=drop add dst-address=:445 protocol=tcp action=drop add dst-address=:445 ...

nhalachev

THx for you reply, but I really want to avoid to use DHCP...

Then do not use dhcp ... If you are using manual static IP , you can also set netmask to 255.255.255.255 ;-). To test , i just now set my linux workstation netmask to /32 . Now i can access other computers in same lan only via gateway ...

nhalachev

Hm,
Just wonder, if you use DHCP and setup network mask for dhcp users 255.255.255.255.
Will that work ? I remember that was a answer to a question like your somwere ...

nhalachev

Hello,
this topic was discused many times ...
try to search for :
default-forwarding

Regards

nhalachev

hello,

Just set your time zone under /system clock.

Regards

nhalachev

is there a way to make VPN server/network on mikrotik???
on same prism wireless interface where the hotspot is running???

Yes, pptp or l2tp for example.

nhalachev

Well, i think you have 2 choices: 1. Make use of access-list under /interface wireless. Set default-forwarding=on for wireless interface and add wireless stations with needeed default-forwarding ON or OFF under /interface wireless access-list. 2. Think as salesman ;-). Configure VPN server and sell ...

nhalachev

This attribute work for me for sure ... From RFC 2138: 5.22. Framed-Route Description This Attribute provides routing information to be configured for the user on the NAS. It is used in the Access-Accept packet and can appear multiple times. A summary of the Framed-Route Attribute format is shown be...

nhalachev

Add into radius database Framed-Route reply attribute for those customer. For example:
Framed-Route = a.b.c.d/27 0.0.0.0 1

nhalachev

Well,
my post was just a example from real world.
You can mangle whatever IP addresses and networks ...
For example you can mangle src-addresss=10.20.130.2/32 wih bronze mark , src-addresss=10.20.130.3/32 with silver mark, etc ...

nhalachev

10 [usb-uhci] 10 WiFi 10 aDSL May be here is your problem ....

nhalachev

One more thing:
/system resource irq print

nhalachev

Please post your config , including:
/interface ethernet
/interface pppoe-client
/ppp profile
/ip address
/ip route
/ip firewall rile | src-nat | mangle
/ip dns

nhalachev

supout.rif file is on the way ...

nhalachev

You should send support-output file from the router taken at high CPU usage time to support@mikrotik.com. There might be some problem in your configuration. Eugene Point 4 from your support policy : Give us your Invoice number, if you purchased MikroTik RouterOS™ online, or information about preins...

nhalachev

In case of using NAT on same box : / ip firewall mangle add src-address=10.0.0.0/22 in-interface=local action=passthrough mark-connection=bronze-up mark-flow=bronze- up add src-address=10.10.0.0/22 in-interface=local action=passthrough mark-connection=bronze-up mark-flow=bronze -up add in-interface=...

nhalachev

i have been reading this example in the maual http://www.mikrotik.com/docs/ros/2.8/root/queue.content#6.54.7.5 well i need to have a similar setup but i need to have different packages for the costumers. for example i need to have 10.20.130.4 5 and 6 have a 32/64 speed and to have 10.20.130.88 and ...

nhalachev

Hello, Thanks for input ;-) Both 2.8.22-26 and 2.9beta16 was a clean install from scratch. There is no wireless cards - only ethernet. OSPF and Radius client parts of setup is working flawlessly. 80% of customers are using 64 Kbps package. Nothing weird in the logs. Test setups of 2.8.x and 2.beta16...

nhalachev

I test latest beta - still no success - pppoe concentrator became unstable after 200 simultenius pppoe sessions - cpu 100% and sporadic traffic thru pppoe interfaces.

Anyone who is using MT as pppoe AC ? All you have not problem with MT pppoe server under many sessions and high cpu load ?

nhalachev

Well, i just need some help with this ....
Anyone ?

nhalachev

Hello, i need some help here ... I have setup pppoe server with multiple services with Mikrotik 2.8.26 and 2.8.22 versions. Hardware is Intel MB, P4 2.4 GHz , Intel gigabit and fastethernet ethernet cards and 512 MB RAM. OSPF is also configured and working for backbone routing. AAA is via radius ser...

nhalachev

If you throttle servers to/from internet, then place mikrotik box between Internet and Cisco router :

| Internet | --->| mikrotik box | ---> | Cisco router | ---> | Summit 4 switch | ---> | summit 48 switch | ---> customers.

nhalachev

Hi! IS there a way to forbid ONLY the widows file sharing between my users. This need to be done to users that are logged in into hotspot, and also to users that are not logged in... how this could be done??? maybe firewall > forward chain???? one thing: i DO NOT want to turn off DEFAULT FORWARDING...

nhalachev

If a mangle for pppoe connections is setup right way and still have a problem, checkout src-nat rules if you have.
I have experienced same problem when have src-nat to range of external IP's.
The solution was to do masquarade or src-nat secure web sites to 1 external IP.

nhalachev

Maybe they are OEM ...

nhalachev

I've found 1430 works best for me, you will want to mangle the others to the same value, how to do this is in the manual I think.

Actualy I already have mangle rule to set tcp-mss=1412 at all interfaces. But Belkin router connecting with MTU=1440 need tcp-mss=1400 ...

nhalachev

Hello, Can anyone tell me why MTU on pppoe interfaces do not follow configured value in /interface pppoe-server server ? For example when i set MTU=1492 for pppoe service, raspppoe and mikrotik clients connect with same value. But native WindowsXP pppoe client set MTU to 1480. Also i have problem wi...

nhalachev

It would be great to integrate trafr into trafshow. trafshow version 4.0 supports Cisco NetFlow, so it will be quite easy to integrate trafr into trafshow. Trafshow gives the ability to monitor trafic from hosts in realtime mode, an I think that many people will like it :) Hey , wait a minute !!! D...

nhalachev

if you use public IPs, how do you use 2 ISPs without bgp ?

With policy routing.

nhalachev

If you use pppoe to connect to the internet, you generally must specify pppoe out interface in src-nat rule, not Public.

nhalachev

The router is not plugged into the outside world right now. That is why it doesn't show the PPPoe inte running. When I do plug it in, it connects in a matter of seconds so no problem there. [admin@BWRPWA] ip firewall> src-nat [admin@BWRPWA] ip firewall src-nat> pr Flags: X - disabled, I - invalid, ...

nhalachev

RobClem, may be is a good idea to make a testbed in lab and try different configurations and examine results.

Believe me, if you have a clear vision of what you want to do, you can do with Mikrotik and there is not only one way ...

nhalachev

You could bridge the 2 interfaces.

So far Wireless client interface cannot be bridged.

RobClem, you should use routing between Client an AP-Bridge interfaces, or you can use WDS to backbone ( backhaul ) and then bridge wds and ap-bridge interfaces.

nhalachev

You can only make it with firewall rules. But you cann't make the same thing for /ip accounting :(

Well,
then lets move topic to feature request stage ;-)

nhalachev

Hello,
Is there any way to specify more than one value for ADDRESS per service ?

For example, i have to restrict ssh access to xxx.xxx.xxx.xxx/28 and yyy.yyy.yyy.yyy/32 network addresses without using firewall features ..

nhalachev

many thanks but it didn't help I have a LAN with 100 users connected through ethernet cable. So they can of course see one each other. I supposed that using pppoe forced traffic going to the router (gateway) directly and then from there to the destination. is it like that ? Using pppoe you can easy...

nhalachev

This thread may be usefull :
http://www.mikrotik.com/forum/viewtopic.php?t=793

nhalachev

Hmm I didnt think it was going to be a complicated issue, thought by bridging the ethernet and wlan on the Routerboard it will allow pppoe Requrests to go to the AP and get an answer from the AP direct, the way the example is set for wds, i have to set an IP address on the Wlan but for PPPOE securi...

nhalachev

You must use WDS or EoIP to allow PPPoE clients on ethernet interface to reach pppoe-server.
Personaly i will preffer WDS setup.
look at :
How to Transparently Bridge two Networks?
http://www.mikrotik.com/docs/ros/2.8/ho ... to.content

nhalachev

Error: unknown attribute Rate-Limit for user WIRELESS even if i use the Ascend-Data-Rate attrirbute i get the same message Error: unknown attribute Ascend-Data-Rate for user WIRELESS You must load into mysql radius database ascend and mikrotik dictionary. Then you must restart radius daemon.

nhalachev

Traffic between hosts in one ip network generally will not pass trough gateway, in our case hotspot interface of MAT router. Hosts will communicate directly to each other.
And this is why your rules will never count a single byte.

nhalachev

One will setup for example PPTP server listening on that single public IP. This server will give to pptp client ip address from the same internal network where are another MT boxes.

nhalachev

There could be more to this. I'm trying to graph CPU utilization on my MT and getting all zeros as well. Not sure why. Open to suggestions. TIM More to this : Try this - log on to your MT, issue following command : /system resource monitor Wait a while - 15 min for axample and then look at your gra...

nhalachev

Is this mean I must disable port 137-139? thanks 139/TCP 137-138/UDP yes, for example, this will deny SMB/CIFS connections. perhaps with action reject, not drop. I think there is some missunderstanding !!! Mag, please tell/write us exactly firewall rule , wich will disable communications between HO...

nhalachev

I have been told that since my hotspot users are getting Private IPs from the DHCP server, they all have the same subnet mask. As a result, there is no way to keep users isolated from one another. Of course, if I use an AP that has the "disable client-to-client communications" then it wil...

nhalachev

You can use following command to disable Layer 2 communication between wireless clients connected to same Access point:

/interface wireless set wlan1 default-forwarding=no

nhalachev

Yes, it is possible.
You can also use same ip pool for both hotspot and pppoe sessions.

nhalachev

sarky,
read carefully http://www.mikrotik.com/docs/ros/2.8/ip/address.main
and there is also very good simple example about proxy-arp feature.
This example is exactly what you need i think.

Make test MT box with 2 ethernet interfaces and follow example.[/quote]

nhalachev

Why are you using bridge interface in case of proxy-arp bridging ? It will be more clear to use one of them.
post /interface bridge port print
Maybe is good idea to start configuration from scratch ...

nhalachev

Please give us more detailed explanation...
Post output of following commands:

/ip route print
/ip address print
/interface ethernet print detail
/interface pppoe-server server print
/ppp profile print

nhalachev

I have successfully tested WDS configuration betwen MT 2.8.6 ( ap-bridge mode with prism card ) and Linksys WAP11 v2.6 fw1.07( bridge P-t-P mode ).

nhalachev

If i understood correctly , you have 2 locations connected via single line and at each locations you have 3 IP networks. Next, you want to bridge ipnet1 from location1 with ipnet2 from location2 etc.? In this case you do not need MT at all. You need only one 802.1q capable switch per location. Then ...

nhalachev

Are you suggesting adding more WDS interfaces to one host, how is that possible? I've thought about it but when i tried to add more WDS interfaces pointing towards the same MAC address winbox complained. If that works i would be more than happy to use this solution. _// Sten Daniel Sørsdal No, my s...

nhalachev

... My question to you is how are you doing the bridging? It looks like your able to create the Vlans and associate them to the wlan cards. Just not sure how it would function. Thats my point, i havent been able to do it. In my opinion the VLAN interfaces should be bound to WDS interfaces but that ...

nhalachev

nhalachev:
You may use system scripts for it.

Check /ppp active some times
and make some actions

Yes , i can check with scripts - there is also an example at Mikrotik web site in scripting examples.
But i think checking regulary for active ppp connections is not right way to go.

nhalachev

If you want routing setup , then you must have proxy-arp for ether1. But there is another possibility - to use MT as bridge in your case ( offcourse if you do not need 10.x.x.x addresses ). i have mikrotik v 2.7 wit demo key ethre1 80.x.x.178 mask 255.255.255.240 getaway 80.x.x.177 ether2 10.x.x.1 ...

nhalachev

If you want routing setup , then you must have proxy-arp for ether1.
But there is another possibility - to use MT as bridge in your case ( offcourse if you do not need 10.x.x.x addresses ).

nhalachev

Or, maybe better will be to have a way to specify a login/logout scripts in ppp profiles and/or via radius ...
http://forum.mikrotik.com/phpbb2/viewtopic.php?t=119

or
http://forum.mikrotik.com/phpbb2/viewtopic.php?t=93

but no answers at all ....

nhalachev

Hi all i have little problem i have router without wirlescards i have only 2 ether cards ether1 - 80.*.*.178 [80.*.*.178-80.*.*.190] with ntemask 255.255.255.240 and getway 80.*.*.177 ether2 - 10.10.0.1 nemask 255.255.255.0 i use masquerad and works fine when i set ip like 10.10.0.2 but when i set ...

nhalachev

Yes. they still be able to communicate with eachother even with default forwarding turned off.

nhalachev

Hi,
would be nice to have in user profiles login-script/logout-script attribute.
when user login -> login-script is executed
when user logout -> logout-script is executed

nhalachev

Anyone?

nhalachev

Hi, Is there a way to implement DiiffServ QoS for PPPoE users with MT ? Let say - all incoming packets from internet are allready marked in diifserv/tos filed for example - international,national peering,local peering, voice etc. For example some pppoe user must have 256 kbit/s local peering, 128 kb...

nhalachev

Hi,
Will Mikrotik RouterOS act as netflow exporter in future ?
Any plans ?

Search found 99 matches

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Licence updating failed after upgrade ROS 3.30 to ROS v4

Licence updating failed after upgrade ROS 3.30 to ROS v4

Re: Mikrotik+Freeradius+MySql -> No Uptime Limit Attribute???

Re: how to split network trafic from internet trafic

Re: Separate traffic over pppoe???

Re: Traffic stops on PPPoE connections

Re: How to limit Bandwidth to PPPoE clients?

Re: Framed-ip-address question

PPPoE server - cpu overloaded, not stable data flow

Re: hot to forbid Windows file sharing in wireless ???

Pppoe server and MTU

Re: New trafr

ip services

Re: PPPoE bandwidth control with ic-radius

Re: I just finished a project with MT as "Router on a s

Re: I just finished a project with MT as "Router on a s

Re: Mayne someone can explain me!!!

feature request: run script on user login/logout

DiiffServ QoS for PPPoE users

netflow