MikroTik

Now sorry to say that but I'm thinking about to ditch my Mikrotik hAP router in favor of RPi. I haven't looked into the RPi world for "router" images to use - which one are you considering? It's been a while since I've even touched my router at home. It just works, but I do want to implem...

I could probably work around it by running two OSPFv3 instances, but since we're not really doing much with IPv6 for our customers yet, I'm not too concerned. If one link goes down, the other should form adjacencies and converge within 45 seconds or so. I was just kind of curious if anyone had seen ...

We primarily use Cisco on our network core, but are deploying a CCR1072-1G-8S+ as a PPPoE end-user concentration box. As such, it needs to speak OSPF with the rest of the core network. The design is a fairly straightforward dual-uplink; each uplink network having two core routers as DR/BDR. It's the...

For your nailed-up static routes intended for prefix origination, I'd say the best thing to do would be to add them as distance=254, type=blackhole e.g. /ip route add dst=192.168.0.0/22 type=blackhole distance=254 add dst=192.168.0.0/23 type=blackhole distance=254 add dst=192.168.2.0/23 type=blackho...

Yup - that's what I disabled. Still getting them. I'm suspecting that our recent problem is a combination of things, because we've never had to disable this to fix stuff until very recently. The 10.10.10.x host is a Ubiquiti cloud key, and they definitely go through their strange behaviors with diff...

update - apparently, disabling ICMP redirects does NOT stop the Mikrotik from sending redirects. Does the system require a reboot for this change to take effect? So using the previous example IP addressing, whenever host 10.10.10.66 sends a packet to host 192.168.0.33, the Mikrotik router sends an I...

We've been upgrading some 2011 routers from pre-6.41 versions to the latest 6.43 and 6.43.1 and 6.43.2, and have noticed a change in the behavior with ICMP redirects. We've got a multi-IP-range segment on an interface with two ranges, e.g. 192.168.0.1/22 and 10.10.10.65/28 Starting with apparently v...

The problem with doing this in a single router is that the routing table must ultimately choose one particular interface as the destination for any given IP address. Having the same IP address on multiple interfaces doesn't work in this case. If you don't have a large number of these, then you could...

I can confirm this script works a treat.. I can't believe we're here 3 years later with no other viable resolution to the core problem. This is why our core network is still 100% Cisco routers. We use Mikrotik as CPE routers, but given their 'quirky' behavior in dynamic routing protocols, I don't w...

True on all counts regarding autoconfig, but end-user access segments are a very very rare case for my operation, where yes, SLAAC is the way to go for us. We static-configure all customer attachment circuits at the PE boundary anyway, so doing this in IPv6 is no big deal. The main thing I like to u...

As long as rfc1918 is just used as transport - it will work. ICMP packet's will not work . but traffic in TCP/IP will work. If you use a rfc1918 address as dst inside your net - you need to use nat to have it working. Just to clarify for those following along - ICMP will be forwarded through rfc191...

You cant route public ip's trough rfc1918. You need to ether use nat - or bridge to your internal ip. That's actually not true at all. You can have rfc1918 addresses on links and forward public IP addresses across these links just fine. I used to work for a company whose entire backbone was un-natt...

... or now Cloudflare DNS - 1.1.1.1 / 1.0.0.1

Most likely, your VPN server doesn't know that the 200 network is behind your Mikrotik - i.e. it needs to get a route associated with the connection. I'm not sure about SoftEther VPN server, so unfortunately I can't tell you what button to press, so to speak. Also, if the VPN server is not the defau...

IPv6 packets using Link-local IPv6 addresses are not (and in fact cannot possibly be) forwarded by routers. EVERY network segment has the exact same routing prefix - fe80::/16 - thus it is impossible to communicate with remote link-local addresses even if you wanted to do it. Having these on your ro...

The ability to manually specify the Link-local address can make other things easy than just a consistent default GW on all network access segments. Since our address allocation scheme creates a unique 3-nibble code for each router in our toplogoy, it makes life easy to use that code as the link-loca...

MS-CHAPv2 would also be nice for Winbox AAA login verification.

It's not too hard. Add a VAP interface to your wireless (virtual AP) and set the guest SSID there. Add a "guests" security profile - just copy the main one and change the password to your guest password. Make sure the new VAP is not connected to your LAN bridge. Add a new IP network to the...

I completely understand what you're trying to do. I know why you said "in-interface=wan" in your rule, but in your case, that is a bad thing to use. I'm a fan of using in/out-interface=X wherever possible but this is one of those situations where it's not going to work. If you see no hits ...

Hairpin rules require a little different logic than the way you've done it. Let's look at rule 1: 1 chain=dstnat action=dst-nat to-addresses=192.168.88.183 to-ports=10000 protocol=tcp in-interface-list=WAN dst-port=10000 log=no log-prefix="" This rule says: If the packet arrives on the WAN...

Don't put any IP addressing on the interfaces where you serve PPPoE. Then it is impossible to get IP service w/o PPPoE.
If you have some sort of "management" IP range in use on the same network segment, then your goal should be to move this functionality to a different VLAN.

Remember that the Hotspot feature is a layer3 function - so it's going to see interfaces in terms of "IP interfaces" not "switchport" interfaces (to borrow a term from Cisco and others). Scripting would need to use the bridge hosts table / switch hosts tables to find the exact ph...

Hi @sindy, thanks for your explanation. You are right: the SIP problem is not a SIP problem, but an UDP NAT problem (a more general problem). It isn't even a bug: it's a UDP NAT limitation (a protocol limitation). I made some NAT tests and understood better how NAT works in MikroTik. I'm publishing...

Are you assigning the default GW to your clients?
Do the clients have "use default GW" set to yes on their pppoe-client interface configuration?

Did you check the routing tables during the outage to confirm that all IP routes pointed in the proper direction, and on both routers? I'm having a little trouble visualizing your issue because you speak of two routers, but when you say you checked from "the router" it's unclear which one ...

Many smaller, inexpensive SOHO Mikrotik routers cannot do 100Mbps of throughput. Some routers can do this if you use the fast-track feature (e.g. the 2011 series). The key is to watch the CPU utilization during a speed test (through the router from a PC, not the BTest service in Mikrotik itself). If...

Maybe ask ISP if they could end this changing nonsense and give you permanent prefix? Perhaps they are just new to IPv6 and don't know better. Of course there's also a possibility that they are doing this on purpose, to make you pay more for some "enterprise" connection where prefix does ...

I made the rule: chain=forward src-address-list="ProtectedHosts" dst-address-list="LimitedClients" action=accept which I have dropped before the drop rule and I can not get to the address 192.168.20.110 or even ping if the drop rule ok - go into your router and run this command ...

Probably what happened was that the DDoS attack used radomized ports and IP addresses, which overloaded the connection state tracking table on the router. If you're not using any kind of stateful features, you can disable state tracking which will reduce the load on the router in such situations in ...

Thanks to this, but if I apply this rule, I can not get myself out of range 192.168.20.4-100 to administer clients to addresses 192.168.20.110-114 Dude - you really need to learn what you're doing if you're going to get this picky about stuff and not just expect people to do everything for you. The...

The way to do this is to configure your hotspot with unlimited simultaneous users in the profile section, and create some basic default user/password for the hotspot. Then you create your splash page with a "continue to Internet" button on it. Design the form on this splash page to simply ...

The only way to accomplish that would be to run a metarouter image on your Mikrotik using something like DD-WRT, but I wouldn't recommend that. Neither Mikrotik nor the DD-WRT people work on keeping these things compatible with each other and up to date. So that is to say: Nope - Mikrotik's not an o...

Step1: create a static host route to whatever IP address the VPN endpoint currently uses - make the GW be the preferred IP address. Place a useful comment on this route such as "VPN" Step2: copy this route into all of your routing tables Step3: You could write a script that runs every minu...

Make a direct connection between the routers and number it with some throwaway subnet, such as 192.168.255.0/30
Make R1 have a backup default GW of 192.168.255.2
Make R2 have a backup default GW of 192.168.255.1

this way it won't matter which device is acting as the VRRP master.

Try using OSPF across the tunnel. As long as the two interfaces have the same cost, OSPF will use equal-cost multipath routing (EQMP) to load share between the two paths. If one path fails, OSPF will lose adjacency across it regardless of the interface's up/down state.

Try making the tunnel operate as a layer3 (routed IP hop) connection instead of a bridge.

The easiest thing to do would be to enable the "use IP firewall" option on your bridge so that you can make forwarding filter rules that block the traffic you want. Make an IP address list called "LimitedClients" and list the IP addresses 192.168.20.110-114 Make another IP addres...

Firstly, do not masquerade between internal networks in your router. Masquerade/SrcNat is only needed for access to the public Internet, or for cases where you need to reach some network that you do not control, and it has no routing information on how to reach your actual IP addressing. Since you c...

You should use different IP ranges on different interfaces. The problem is that any device outside of the /29 network (i.e. is on the ether1 10.0.0.0/22 network) does not realize that this block of addresses is not local and must be reached via the router. They simply ARP for 10.0.0.103, which does ...

In the IPv4 world you have NAT. It directly protects your internal devices from being accessed from the internet. Even when the device doesn't have a firewall. In IPv6 there is no NAT. So theoretically everyone can access everything. Of course to prevent this you setup the firewall but i don't foun...

One more point: Make sure that you're not blocking ICMPv6 in your IPv6 firewall filter rules. "ARP" functionality was moved into ICMP for IPv6 (now known as ND - Neighbor Discovery) I have to agree that it's awesome to see an ISP give static assignments like this. The only thing possibly w...

Make a second SSID (create a VAP interface), and make the insecure devices use the second AP, and put that on a different IP range (don't bridge the VAP - put a new IP address directly on it and configure a new DHCP service on this network). Then use the IP Firewall filter to block in-interface=VAP ...

The goal of this design is to use OSPF only for EQMP load balancing between the sites, but BGP as the overall routing protocol. EBGP allows routing policy to be modified and advertised at each tower site. iBGP basically considers the entire AS with a more or less single unified routing policy for eg...

I think the electricity savings would more than pay for a hEX over a powerful PC running 24x7.

In layer 3, each node must have a route to every other IP address in the network. I'm assuming that the PFSense cluster is a layer3 firewall and not acting as a transparent L2 firewall. I'm also assuming that the public IP addresses for your company are on the WAN interfaces of the NG0x nodes (where...

But, this example seems to be a bad practice and for my opinion it doesn't have sense, because, the idea of getting two RR is to increase the uptime of any iBGP solution, so why are you going to configure a Route-Reflect client to only one RR instead of configuring to both of RRs?? I think this is ...

ok - it looks like your NAT rules are to blame. You're using netmap which is a stateless nat action - that means you must use TWO rules to accomplish each mapping. I see why you thought to use this, as it's apparent that you have a 1:1 relationship between a specific public IP address and private IP...

Can you please point out the part in the RFC that says you must use the same ID on all members of the same cluster? I was going to draw a diagram of a scenario that would cause blackholing, but I found one on this website http://network-101.blogspot.co.uk/2011/06/bgp-cluster-id-loop-prevention.html...

The upstream router needs to have a static route to the downstream router.

Add an IP route w/ the dst=10.0.1.0/24 and gateway=wan.ip.of.rb911

Not sure which port you mean by "eth0" as Mikrotik's ethernet interfaces are named "ether1, ether2, ..." but regardless, it is easy to have ports as isloated layer3 ports in Mikrotik. Just make sure that they're not part of any master/slave switch groups (v6.40.5 and earlier) and...

Without digging into your configuration, I can say that the most likely cause is that your mangle tables aren't creating connection tracking entries for route marks on new connections originating on the various WAN interfaces. That's the most common mistake I've seen in posts with your problem.

I read the manual page you linked to. By my reading, it's entirely possible that the multicast helper acts in a manner similar to PIM in dense mode - i.e. it sends a copy to EACH client at its individual mod rate, as opposed to sending a copy only to the subscribed stations. Given that they just now...

Sorry, of course I mean multicast traffic. I need IPTV from my ISP to work on a notebook over WiFi. The problem now is: when any device connected to my hAP lite via WiFi start viewing IPTV, all other wifi-clients start receiving multicast traffic simultaneously. IGMP snooping enabled/disabled on br...

Well, IGMP flooding over WiFi is still here. I have a hAP lite with RouterOS 6.41 and even after enabling IGMP snooping on bridge interface I have IGMP traffic on all connected wireless devices. This may be a silly question, but are any wireless devices subscribed to the multicast group? Furthermor...

established = state tracking has seen traffic in both directions. I'd define it as: has passed traffic in one direction. In home NAT environments, if your browser sends tcp syn, the 1st returning syn,ack already is related. (otherwise it would be blocked !) Yeah - but I think "established"...

established = state tracking has seen traffic in both directions. related = state tracking helper has noticed that the packet is part of a connection negotiated in another established connection No packet will match these states as part of an initial connection, so the packet will go past this rule ...

It can be changed if made a filter to discard half of ISP1 prefixes? No, here I mean the route prefixes that I receive from ISP1 and not my advertised networks prefixes. This would only affect your outbound traffic path selection. In fact, the better thing to do about prefixes received from upstrea...

Typically, you do want that first or at least as early as possible for the very reason you're thinking. If you have some filters that you would like to be able to use to cut off existing flows, you can place those in the prerouting chain of the RAW table, which happens before state tracking. The raw...

It can be changed if made a filter to discard half of ISP1 prefixes? If you do that, and ISP2 goes down, then any IP within those prefixes not being advertised to ISP1 will not have Internet connectivity. Let's say that you have a /20 of IP space, all contiguous as a single /20 block, e.g. 100.64.8...

Hallo i want to see if somebody using port-forwarding from witch IP its coming now I only see the IP of the router if i click under IP>Firewall>NAT the option In.Interface:Ether1 now I'm able to see the external IP but this blocks al my outgoing traffic (no access to internet) It sounds like your n...

First of all - are we talking about outbound traffic or inbound traffic? Local_Pref (and other such metrics) will tune your OUTBOUND preference, but only on the prefixes you receive. If you're getting only a few dozen or few hundred prefixes, then you're going to get almost zero load-balancing from ...

Your question is a little bit unclear. Do you mean that users are sharing their wifi password, and multiple people are connecting using that? Or do you mean that people are connecting routers to your network and then sharing it with their own WiFi from those routers? There's not much you can do abou...

I think he's referring to the fact that BGP runs in a single thread - ergo cannot take advantage of multi-core tile platform. It could be that during convergence, his network performance is spotty due to various reasons, but that's just speculation on my part. At the end of the day, though, there ha...

Disable HW forwarding on the interface in question and then you can use the bridge filter rules to block the traffic. Chain = input Ethernet protocol = ip ip protocol = udp ports=67,68 To disable HW forwarding in versions 6.40.5 and below, you set master-port=none / in v6.41 and after, you un-check ...

Thanks for clearing up my explanation, Airbanduk.

It's threads like this which lead to my writing the haiku in my signature line.

Personally, I'm not a fan of hotspots. They cause all sorts of things like this to happen. The biggest issue would probably be the increasing use of SSL everywhere, because transparent redirection of SSL causes warnings to pop up on the customers' screens if the devices aren't silently testing for h...

I haven't tested this lately, but I would suspect that this is on the "fixed in v7" pile of cans being kicked down the road over in Latvia. ;) On this topic, I think it would be nice if the networks list allowed you to assign a routing filter chain per network, similar to the route-map fun...

You'll need to get an IPv6 allocation from your ISP which has at least 4 blocks of addresses in it. The standard subnet in IPv6 is a /64. This means at the very minimum, you should receive at least a /62 but recommended best practice is to avoid subneting except on nibble boundaries - which means th...

Users are not logged out of hotspot when this problem occurs. Keep-alives also fail.. Problem also occurs if phone is added to bypass list and can browse fine without traditional authentication steps. That's not the impression I got reading your original post: Bypassing hotspot - I ping the phone, ...

But I am afraid you were not accurate in one point, the router does not accept the packages because he hasn't join to the the multicast address for RIP v2. 224.0.0.9, you can add any route to RIP, and then it will work, I added 0.0.0.0/0, and then he reports his membership via IGMPv3 to that multic...

If it's just going to be the one interface, and you're only expected to receive routes (not transmit them) then it's going to be really safe to just do this: interface=all passive=yes listen=v2 network=0.0.0.0/0 done. Of course your router will now listen for RIP on all interfaces, but you could eas...

Thanks, but I´m afraid those are the routes that would get sent to your rip neighbours. I´ve already tried to add the remote router as a known neighbour, but no luck neither, ignores the routes receives. Okay - after playing around with RIP a bit, I can say with a little more confidence that I thin...

I've gotten RIP working on RouterOS before and don't recall it being anything difficult at all. It "just worked" - so I'm about to set it up in GNS3 just to see if anything is difficult or unusual...

You could add TCP port 5223 to the walled garden configuration, as that's the port used by the push notification system. https://developer.apple.com/library/content/technotes/tn2265/_index.html#//apple_ref/doc/uid/DTS40010376-CH1-TNTAG2 The above link is more focused on app development, but I would ...

One way would be to use a normally-open relay (It seems your current relay is normally-closed since PoE on = device off) and then reboot the Mikrotik to reboot the modem.... Another would be to do a little scripting - make a script which will turn PoE on, then sleep for 5 seconds or so, then turn it...

Did you add a network to RIP which covers the interface where you want to receive RIP routes?
(I'm actually a greenhorn with RIP, but these are the things I would try if messing around with it)

Unfortunately, I think this is a known issue with Mikrotik users. We are a service provider with SIP phones at our clients' locations, and if we put a backup connection at the site, the SIP connections do exactly what you're describing, and our workaround has been the same - to wipe all SIP connecti...

Your SRCnat rules don't change from the typical default: chain=srcnat out-interface=ether1 action=masquerade (assuming that ether1 is the WAN interface) You then make some filter rules to block the 10.20.20.0/24 network from accessing the Internet: (assumes ether2 = 10.10.10.0/24, ether3 is 10.20.20...

Have you tried disabling the passive setting? I think passive instructs RIP not to learn routes....

The serial port access will only give you the ability to have the router boot into netboot mode so that you can overwrite the flash using this method (as opposed to having to hold down the reset button for some amount of time). Serial access does not have any kind of security override backdoor. If y...

This config worked ok for upload but not for download. The only way i can get it work is setting All-Download Max-limit to 9M, so icmp can take the remaining bandwidth, but that is not the way it is supposed to work right?. Doing download QoS on a device that's south of the bottleneck may not alway...

Honestly, though, it might be a lot easier to just use SSTP instead of IPSEC+IPIP

So for beginning there are no IPSec now and no IPIP. Then "first" router initiates IPIP tunnel (sends packet to "second" router without IPSec, because it's broken). "Second" router for now hasn't seen any packet before and has firewall rule to drop packet received with...

Will it degrate to much the current experience? Will this work behind a NATTed router? 1: It depends on the router you choose and how powerful it is, especially CPU power and whether it has hardware encryption acceleration. Maybe someone else can recommend specific models. It also depends on how mu...

I haven't thoroughly considered your situation, but one thing that jumps off the page at me is the fact that your limit-at is set to 10M on the data download queue. Limit-At is better thought of as "guaranteed minimum" So if you add up the limit-at values of the child queues, and this tota...

It is resolved in newer releases. 6.39 and newer... Apparently I spoke too soon. I had the logging level set too low on my router and saw the RADIUS traffic corresponding with lease renewals. I thought these were AUTH requests/replies, but upon deeper inspection, it appears that this was just RADIU...

What's new in 6.41rc66 (2017-Dec-14 13:53): *) dhcp-server - added basic RADIUS accounting; The RADIUS accounting packets for DHCP sessions do not include the User-Name attribute, which should be set as the MAC address of the client, just as it had been sent in the authentication request. Freeradiu...

We reported this exact issue as a bug and worked with Mikrotik support to fix it recently. It is resolved in newer releases. 6.39 and newer... lol - I have two different versions running in my GNS3 testbed, one is 6.41rc66, and the other is 6.38.5 The 6.38 was the first one I put into the test topo...

Route the end users and do not bridge them. Problem solved before it exists. Agreed - the more you break up your layer2 broadcast domains, the better off you will be and the more impervious to these layer2 issues your network will be. Even if you go with the extreme case where each individual AP is...

Pretty cool link. The firewall syntax they use shows this was designed for a bit older revs of RouterOS, but it will work just fine in modern revs as well. You may also want to cross-check the address lists generated against some other sites with similar lists, because this can change from time to t...

You may need to break out wireshark and do some packet sniffing at the various connection points in your network to verify whether you see the echo requests from the router and/or replies towards the router. Essentially, find out where they're being dropped and then drill down on that point to deter...

I'm sorry I've no answers, but I have a question: :D the lease duration is set by MT dhcp server (settings) or by Radius? I guess deleting leases via script lead to a overlapping addresses risk (can radius take care of this?) Mikrotik uses the DHCP server configuration for lease time unless specifi...

Not to throw out the simplest thing first, but could they just be blocking your pings?

Look in the Switch menu or Bridge menu under the hosts tab. This will show what MAC addresses are connected to which ports.

I'd say that it would be better to get to the bottom of why this happens in the first place, not put a BandAid on it. Have you tried: Switching ethernet cables Switching to a different interface on the Mikrotik Looking at the device's state when not sending packets to the Mikrotik anymore? - e.g. do...

I would think that setting all ports to the same bridge, adding two vlan interfaces to the bridge, and then setting the PVID on each port to match the VLAN you want it to appear in would be the way to do this. That would give full HW-accelerated switching with ports being separated from each other.

There's no built-in geo-reference feature in RouterOS.
You will have to use some other source of data to choose your IP ranges and either manually create an address list to your liking, or you can automate it with scripting or BGP distribution.

In any case it's oddly that ROS always treats IPIP packets as "established, related" even when creating tunnel. Not at all. Whenever you have connection tracking enabled (which is the default) then every connection is evaluated by the engine. The IPIP tunnel packets are in fact a conversa...

There's no need to have a rule to explicitly drop ICMP in your posted filter rules. add action=drop chain=input in-interface=!ether1 protocol=icmp icmp-options=8:0-255 add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=drop ch...

Don't waste your time. I 've got an answer from MT today: ----------------------------------------------- Hello, Is DHCP client receiving DNS server specified under DHCP server network settings and DNS servers used by router itself? If this is correct, then this is how RouterOS works. We will in fu...

The easiest solution would be to use the RAW table. Create a rule in prerouting which matches IPIP traffic from the remote peer and uses the action "no track" This way, the IPIP traffic will never be in the established or related state. Although, I would say that you still run the risk of ...

I'm working on a solution that includes RADIUS-backed DHCP as a component. Unfortunately, the DHCP server in ROS seems to have a behavior that works counter to the goal of this design. In a nutshell, whenever I enable RADIUS on the server, the server will send RADIUS authentication requests for new ...

Well, I learned something today - summary-address DOES in fact aggregate routes during the tpye7 -> type5 translation process. Re-reading your post actually made me think for a moment and it made sense to me that this would work, which is why I tried it. Thanks for the knowledge boost. Furthermore, ...

I designed this using Cisco routers and discovered that the summary-address command only filters more specific prefixes if it matches a type 7 LSA - all type 5 LSAs pass into the backbone even if they match the summary-address prefix. So it only works with NSSAs. However, when I tried this using CC...

In Mikrotik, you need to specify a non-default target-scope on routes that will use recursive lookup. Your recursive default GW (via 1.1.0.1 or whatever address you use) must have target-scope=30.... or whatever scope the route towards 1.1.0.1 has. Basically route targets will only match on routes w...

OSPF really is not a policy routing type of protocol. It picks the link which represents the first hop in the shortest path to a given destination. The only "fancy" thing at its disposal is EQMP - equal cost multi-path, which means to load balance between X links if all of them share the s...

https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

It's just syslog - any Linux host can do this, and there are many syslog server programs available for Windows. Setting up syslog is something you should probably do some research on and come up with your own solution. And the dynamic NAT functions in Mikrotik are src-nat / dst-nat / masquerade Any ...

Cisco summary-address equivalent is /routing ospf area range> That's not true. Cisco also has area range, and it works the same in both ROS / Cisco as far as I can tell. summary-address has no direct equivalent in ROS. Or, is there a way to suppress the translation of NSSA to type 5 at the ABR for ...

tick the logging box on the srcnat rules in your router. (the checkbox is in the actions tab for each rule) The log entries contain the information you want, but the format is defined by the system and the most you can do is put a block of predefined text (log prefix) into each entry. Then set up lo...

Could we expect a setup assistent for IPV6 Nat in Router OS? IPv6 NAT - I bet we have to wait longer than the IGMP snooping people waited before it comes out. . . If Mikrotik _does_ decide to add this in, I would request the following flavors (most-preferred first) - NAT64 protocol translation (sta...

Most likely new IPv6 features will not be added in ROS v6. Thanks for being forthright about that. I do hope that ROSv7 reaches beta soon, in that case. I can't even remember all of the things that are promised to be fixed in v7, but it's a lot, and much of it in the IPv4 side of the house. Mikroti...

... and for the sake of completeness for anyone else reading the thread, IPIPv6 tunnel also works for transporting v4 over v6. (just tested to make sure) Currently only tunnels you can use for transporting IPv4 over IPv6 is EoIPv6 Gre6, and IPSec Given that this thread started quite a long while ago...

Currently you can't connect to the router using IPv6 address. This feature will be added in future versions. This was 7 years ago. How future was that version you were talking about MRZ? I just tried it in CHR 6.41rc and . . . it stiiiil doesn't work. :( I was talking to Janis at MUM 2017 about the...

Add a second IP to your router's WAN interface - if the modem is connected to ether1, for instance: /ip address add address=192.168.1.253/24 interface=ether1 next add a srcnat rule to access the modem: /ip firewall nat add chain=srcnat dst-address=192.168.1.254 action=src-nat to-address=192.168.1.25...

If you're using policy routing to force LAN1 -> WAN1 and LAN2 -> WAN2, then you need to make sure that LAN1 is in LAN2's routing table, and that LAN2 is in LAN1's routing table. More than likely, you're using the main routing table for one or the other LAN - let's say LAN1 is in the main routing tab...

CRS products are primarily switches, so don't get one of these thinking that it's going to be a high-performance router.

If you like the ports/features of a CRS, you might pair it up with a hEX router.

The hAP AC would be my choice of the things you listed.

Hi i am not able to give the command: /ip address add address=10.5.8.200/32 interface=Public. we get result : input does not match any value of interface. Why is this..? When I check ip address interface our address is there but interface is ether1 Thanks Ajith This just means that you don't have a...

Honestly, I'd just opt to get public IP space from them and not have my router be behind NAT if I were in your situation. Comcast Business uses a special router for their connections - it's actually a Cisco from what I understand, and as such they don't offer placing their modem into bridge mode lik...

Thank you for the help.I wish to access my rb950 via winbox which is running on port 8291 and I have a public IP configured in the rb950. How do I add this to the NAT configure? Regards You don't add NAT rules for talking to the router itself. (NAT means to modify the src/dst IP address and/or port...

Sounds like it's being blocked by the ISP - or perhaps your router.

Just to verify, in your router, open a terminal window and run the command: /ip firewall nat export
post the results here

preferably in a code block like this so that it's most readable.

https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT In a nutshell, you want to use the IP > Firewall > NAT configuration. Add rules to the "dstnat" chain. In each rule, you use dst-port=xxxx as the "outside" port you want mapped, action=dst-nat and to-address=x.x.x.x (inside IP...

Do you know how to perform an SMTP transaction using telnet? If so, then you should telnet to port 25 on some mail server out on the Internet where you know the destination is local - especially if you have a gmail account or something - I just did a quick nslookup to discover that the preferred MX ...

I'm not sure exactly what's going on, but off the cuff, I'd say that NAT is the problem. That's because if there's a checksum being generated at the TCP header level, then it's almost certainly including the IP address / port number in that checksum, and there'd be no way for the router to re-calcul...

hello, my routes learned by RR appear unreachable in the peers, why is that? Most likely your border routers' Internet attachement circuits' IP ranges are not being advertised into your OSPF. iBGP does not modify the next hop address when it propagates prefixes. So if you have some Border router co...

Perhaps my understanding of how you're handing out a /32 is different than the way we're doing it. In our setup (Cisco routers, btw - not Mikrotik on the network side): Interface Gi0/0/0.500 encapsulation dot1q 500 ip unnumbered loopback100 ip verify unicast source reachable-via rx ! ip route 192.0....

You assume per-customer VLAN, which we're not going to do. One of the goals for this design is to reduce the configuration complexity, and keeping a unique vlan per user is going to run into issues whenever some technician configures a radio with the same vlan as some other customer. We currently gi...

You can skip that local-proxy-arp stuff (just use arp:reply-only) if you are willing to hand out 32-bit subnet-masks (255.255.255.255) to your clients via DHCP. This way the only arp-request a client ever asks for is its default gateway. I understand that. However, I don't want to block east/west c...

Two things: First: I'm considering a network topology model where I want to have strict client isolation at layer2 throughout the customer-access layer of the network, but still allow certain client-to-client communication via the router. That's what local-proxy-arp is for, and it's exactly how to a...

I would set /22 to static on border routers to prevent prefix dumpening on internet. What do you mean? What he means is that if you have some border router (BR1) which advertises your prefix based on reachability via IGP (as you're doing with OSPF) then what can happen is that if your internal netw...

It sounds like you're using a hotspot. . . And your problem sounds to me that the leases and hotspot IP pool are getting out of whack from each other. If you have around 200 users - what IP range / mask are you using inside the hotspot LAN? I'd recommend setting it up as a /22 so that you're not run...

Mikrotik, official answer ? While Mikrotik personnel do participate, this forum is more of a community forum than an official communication medium - so I would suggest that you send an email to support requesting this feature. I did list this as one of the things I consider both important and "...

Suppose the chain is called FilterPrefixes and you want to allow 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, and deny all other prefixes The behavior of FilterPrefixes should be: If the prefix is acceptable, then FilterPrefixes will return to the calling chain. If the prefix is unacceptable, then ...

About ND proxy on mikrotik: contact the support. But it is easier (and correct, IMHO) to inform your ISP about RIPE guidelines. Agree 100% ND proxy is a kludge in this situation. If you had a large network with lots of network segments and hosts, the ISP's ONT could quite easily exhaust its neighbo...

Unfortunately, Mikrotik does not allow manual configuration of the link-local address. It auto-generates the address using EUI-64. You could possibly create a specific link-local address based on this by manually specifying the MAC address of your WAN interface to a value whose EUI-64 conversion is ...

Your traceroute shows exactly that the ISP router has no routes to you for your LAN addresses. Per ISP docs X:X:X:100::/56 is essentially statically assigned to us. that brings us to : X:X:X:0100::0002 - first usable X:X:X:01ff:ffff:ffff:ffff:fffe - last usable. This makes zero sense. Here's what it...

Stop and consider basic routing (regardless of IPv4 or IPv6, the rules are the same). Your ISP's router must know that the next hop to reach X:X:X:102::/64. They must have a route in their router which states that the next hop to reach that destination (your LAN) is X:X:X:100::8. If they have no suc...

OK I'm a bit confused now... does the Mikrotik have an implicit permit all at the end of the firewall rules that we have to explicitly deny? I just inserted a new rule 25 to explicitly drop wan dstnat at the very end.... iptables which I imagine this firewall is based on has an implicit deny all at...

Well, I don't know much about CAPsMAN but from what I gather, it's creating interfaces representing the wlan interfaces of the CAPs, and you need to give them a bridge to join. In this case, you'd make a bridge, let's call it LAN. So tell the CAPs to bridge on the LAN bridge. What you do next is con...

Yep. This is simple from the network configuration side of things. Your hEX PoE will basically be just another switch. In the interfaces menu, make sure that interfaces ether2 - ether5 set as slaves to ether1 (master=ether1) You won't need any IP firewall rules, etc. Just put an IP address on the et...

The first thing to remember is that even though both are called IP, they're pretty much completely separate protocols. The IPv6 firewall rules don't affect IPv4 at all, and vice-versa. What you need to do is obtain a block of IPv6 address space from your provider, apply it to your interfaces, and te...

No, I'd say let the WAN queue trees parent to the proper interfaces and use the same mark for either one - less marks. Basically, the global HTB is one of the last things to happen, and of course interface queue trees happen even later, which is why the postrouting chain is your last chance to mark ...

okay - what you do is make a general priority marking set of rules in the forward chain. Then in postrouting, you can use the existing marks to re-mark the upstream traffic with wan-specific marks. e.g.: out-interface-list=!wan action=accept passthrough=no (for efficiency) packet-mark=prio1 new-pack...

I would think that if you have a global queue tree and a queue tree on an interface that traffic would pass through both queues, and get limited by whichever one runs out of tokens first. I'm having trouble decoding what it is you want to do. It sounds like you want to do a rate-limit queue which ap...

If you use a separate switch, then I'd recommend using the hEX instead of the hEX PoE because the hEX has a more powerful CPU - so it can handle more traffic / firewall complexity / etc. I've got one on my desk that I haven't gotten around to stress testing yet - but it's supposed to be able to hand...

If their network doesn't route the public IP address directly to your equipment, then there's nothing you can do to apply that address to your router. "Thank you Mario, but our princess is in another castle." Chances are good that they've done a 1:1 NAT and forwarded the traffic to your in...

The most likely reason your filter didn't work on the "wide open" dstnat rule is because you're using the input chain for most of the work in your port knocking sequence, and I presume that you are also trying to filter the pinhole the same way. Since your knock-protected port is one which...

I have one comment about your port knock design. This may sound nit-picky, but following best practice and "structured" design helps make things easier to troubleshoot for both yourself and for anyone else who has to administrate a box after you.... May not be an issue if this is a home ro...

I tried the established/related with an IKe2 connection however I can't get it blocked in filters. I assume the IPSEC module establish the connection by itself, and the only way to block is to use RAW filter. Not sure I understand the problem.... Do you mean that IKE2 works even when you have filte...

Actually, what you can do is make the final rule which opens the protected port do so with only a 60-second timeout. So long as your filter rules have entries which allow established,related connections, then the access to the protected port will continue working even after the knock expires. Exampl...

You can add a src-address=x.x.x.x/m criteria to the first port in the port knock list. Also, if you have more than one range of addresses, you can create an address list called e.g. knock_sources, populate it with the IP blocks you wish to permit and use src-address-list=knock_sources in the first p...

You must find a solution to the problem of Internet theft through the Mac

MAC-based authentication/accounting is broken in general because it is trivial to spoof MAC addresses. The solution is to utilize some higher level of AAA such as PPPoE or WPA2-Enterprise

The point is isolate the clients from each other any way. Segmentation in subnets is solution. I'm not saying client isolation is bad. I'm just saying that doesn't help in the OP's problem. OP's problem is that wireless clients are spoofing the MAC addresses of other customers to have their traffic...

How you sniff the traffic of other devices if they are in another broadcast domain? Your network ends on terminating interface. I go to the other device physically - pull its cable out and sniff it from a direct connection to the device. Then I connect into its port and go online with that MAC from...

ether2 is not the out interface - the vlan interface 463 is your out-interface. Or, if you have a bridge with vlan463 on it as a port, then the bridge interface should be the WAN interface. Whatever interface has the dhcp-client tied to it - that should be the wan. and for any more configuration pos...

How about segment the network in few small int different interfaces and filter hosts in terminating points by src-mac? Okay - so I'll take my laptop there, unplug the expected device, note its MAC address (which I can ultimately learn by plugging my laptop directly into the "mac-verified"...

scroll up..... and see that I would go with WPA2-Enterprise i.e. AAA-backed per-user authentication That STILL doesn't stop the endpoint's ability to spoof MAC addresses but at least you can disable the account of anyone caught doing it and that device won't be able to join the network. At the end o...

Why you don't think to use dhcp-server with adding arp for static leases without arp requests from clients? If its wi-fi, disable default forwarding. This will not stop MAC spoofing. This is a method to enforce the use of DHCP on the LAN, and disabling default forward blocks the clients from direct...

Given the choice between PPPoE and WPA2-enterprise, I'd choose the latter because access to the WiFi network is controlled at the front door by AAA. It still cannot stop MAC spoofing but at least the spoofing client must possess active credentials to join the network before being naughty, and those ...

Hi Yes none of my isps do not offer community so the only way is send smallest prefix? ... or talk to their techs to see if they'll manually apply a special local_pref policy on their peering session with you. One of my transit providers doesn't support communities themselves, but they do pass comm...

It would be pretty neat to have a "pbx" menu where adding phones is as easy as clicking the blue plus sign, assigning a phone number to the new extension and MAC address, etc - but coming from someone who works in the industry, I can tell you that this is a real bottomless pit of features....

Mikrotik routers can do what you're talking about, but they aren't the easiest tool to use for beginners, especially where QoS scheduling is concerned. On the other hand, they're quite inexpensive and quite flexible so if you have a good grasp of networking functions / behaviors, then you can probab...

If my thinking is correct on your post, why will it not be 1.25Gb as that is the theoretical limit for Gb interface and will be closer to Mikrotik's published data? This is because a router can forward more throughput than the maximum data rate of a single port. Suppose you have a router with 4 gig...

Just to be clear: When I say set local_pref, what I mean is use BGP communities. LocalPref itself is a non-transitive attribute on BGP routes - meaning that it only has meaning within the same AS. You could set localpref=999 on a prefix, but that information won't be transmitted to any eBGP neighbor...

You don't need to do any routes for the multicast addresses because multicast routing sort of works backwards from unicast routing. I.e. it routes away from the unicast IP of the source address. Essentially, a multicast packet for a given group will be forwarded to every subscribed port which is not...

That will work. I generally hate this kind of solution because it's part of the reason why the global BGP table is working its way near 1 million routes. . . In your original post you talk about how provider 2 is an indirect BGP connection, and that they don't support communities, etc. Does provider...

You can't. Best path selection uses the following metrics: Highest Weight Metric Highest Local Preference Metric Locally-generated prefix > Learned Prefix Shortest AS-Path Length several more tiebreakers afterwards Thus a prefix with an AS-PATH length of 50 and local-preference 101 would be chosen o...

The new style of bridging is currently only operational in the 6.41rcXX train (RC = release candidate - i.e. "beta")

Looks like you're getting a good handle on things otherwise, though.

It's funny that Mikrotik already had this patched in the most recent bugfix and stable release trains, while Ubiquiti's response on AirMax is that it's "not as easy" on AirMax shots, and that a patched beta will be released later this week.

This is a pretty interesting read. Thanks for sharing.

The drop rule in the bridge filter is not going to help. add action=drop chain=forward dst-address=192.168.1.1/32 in-interface=!ether4 log=yes mac-protocol=ip forward chain only applies to traffic going through the bridge - e.g. in ether1 and out ether2. If you're trying to filter traffic to/from th...

I would suspect that PoE is somehow responsible. If you want to test this, put a switch between ether1 and the ONT. If it works with this in the middle, then probably there's something on the wire coming from the ONT that makes the Mikrotik expect PoE power but get none. Worst case, use another inte...

Other things to check: MTU OSPF Interface type (p2p vs broadcast vs NBMA etc) Passive interface? Both routers have the correct OSPF network defined to include the common interface between them If there is some 3rd party wireless bridge between the devices, make sure it's not blocking multicast proba...

If you don't control your public IP then there's really not much that you can do.

If your device has a static public IP address, then you can either use tunnelbroker, or even get your feet wet using 6to4 addressing.

... assuming OP wants to run beta code on their device. If it's just a lab, then that's cool, but I wouldn't ever want to run RC code on anything production.

See this thread:
viewtopic.php?f=13&t=122279

It's exactly the same issue except that you'll do the blocking in the input chain instead of the forward chain

Use of non-standard port numbers (for God's sake, don't use port 80), This isn't really useful in today's world. Port scanners also fingerprint the sockets they discover, so even if it's sshd running on port 9147, they'll find and catalog it. All of the other points are spot-on, though. i don't kno...

You should probably consider switching to PPPoE instead of hotspot if you have such rampant issues with end-user abuse. Another option to experiment with would be cookie logins. Unfortunately, there is nothing much you can do to stop devices from MAC spoofing. Client isolation won't completely fix t...

In their basic modes, it's best (or at least it works for me) to think of the HW switch groups and the software bridges as being simple dumb switches - i.e. they agnostically pass tagged and untagged frames "as-is" So if you bridge ether1 and ether2 with a soft bridge, for instance, then b...

Upon some reflection, I think I see what your problem might be, so let's see if I have this right: There is a set of "on-site" routers which connect to a central router at a central site. You want each on-site router to advertise whatever 10.x.x.x subnet(s) are attached to the on-site rout...

Then the router behind this one will be responsible for originating its own prefixes. There are only a few real ways to filter OSPF routes: 1) Don't allow them into the database to begin with 2) aggregating routes at area borders (only works for interior routes - not external (redistributed) routes)...

You've chosen an interesting time to attempt this because the way it's done is going to change with the next version of ROS. (v6.41) At that point, the bridge will be vlan-aware and you'll be able to do what you want much more easily. In today's version, the best way to go about it, given your requi...

Perhaps the modem has a limit to how many IP addresses it will assign to clients, and it still remembers the MAC address of the laptop? Does it work if you reboot the modem between attempting with PC and attpempting with Mikrotik? Does it work if you set the MAC address on the Mikrotik's wan interfa...

Oh wait - I got it backwards. You want LAN<>LAN but no Internet. Whoops. Delete the forward chain filter rules and use these rules instead: action=drop chain=input in-bridge=bridge1 in-interface=ether4 mac-protocol=ip dst-address=!192.168.0.0/24 action=drop chain=output out-bridge=bridge1 out-interf...

Turn off redistribute connected.

For me, it would depend on several things. In general, the pros/cons are that a single router is easier to manage and produces less configuration complexity in your network's design, but it leads to a single point of failure being the router itself. Generally, though, the circuits and other external...

Okay - so this means that even using IP firewall for the bridge won't allow you to filter on a specific bridge port. It's correct for the interface to become slave when you add to a bridge. Slave means that the interface cannot be used directly as an IP interface because it's acting as a component o...

Previously, I needed to use a Routing Mark and Mangle or Routing Rules to be able access to Mikrotik thru both WAN interfaces. This is correct. Without any kind of policy routing, the Mikrotik is just going to use the default GW to reach you, and if that route points out via ISP1, then requests com...

router ip:192.168.1.1 (i want maintain the router from port 8728 ,8291,80) nas :192.168.1.100 (i want from 8080,21) nintendo switch :192.168.1.18 (need DMZ,because have not UPNP) I have a Mikrotik router at my house and my Nintendo switch works just fine w/o any NAT rules or UPNP whatsoever. FTP to...

Yes on the master=none..... add ether4 to main LAN bridge1? Or I need to create another one, like bridge2? Do I need to add other interfaces to bridge2 like ether2, ether3, ether5? Thanks. If you want ether4 to be in the same network as the rest of the LAN, then yes, add it to the same bridge. If yo...

okay - so this means you're using a bridge for the LAN interfaces? If so, then that's the reason you're not seeing traffic in the forward chain, because the IP firewall only receives packets that flow through IP interfaces. If you're trying to filter traffic between bridged interfaces, then you need...

Earlier in the thread, it was explained that you must un-slave interfaces such as ether4 that you've posted screenshots about.

Furthermore, you will need to add ether4 to the LAN bridge, and then enable "use IP firewall" on the bridge.

Try making the neighbor be ::1 and the Mikrotik be ::2 on that network, instead of ::0 and ::1
::0 has special meaning.

The nieghbor configuration looks strange to me, being that you configured it to be: The BGP Configuration add address-families=ipv6 instance=IPV6 name=WAVEIPV6 remote-address=2600:2105:1:: remote-as=11404 ttl=default 2600:2105:1::/64 is the same as 2600:2105:1::0 . . . which means "segment rout...

Just some silly things to think of: 1) You confirmed the cable works for a 1Gbps link and not just a 100Mbps link, because 1Gbps does use all 8 pins where a 100Mbps link only uses 4 2) You're using ether1 - ether5 on the 2011 (ports 6 - 10 are 10/100 only) 3) There is nothing in the CRS's configurat...

Thanks, ZeroByte. So would only the bridge IP be pingable after I configure the firewall to drop communication between LANS 1 & 2? Correct. Any traffic which is to/from the router itself is processed in the input / output chains and not the forward chain, even if a device on LAN1 is communicati...

Oh yeah, the router will forward packets between IP ranges unless you tell it not to using a firewall filter rule as acruhl states. One more thing to point out: once you add a filter rule to the forward chain to block lan-to-lan communication, you will still be able to ping the Mikrotik's IP address...

Go into bridge > ports and check which interfaces are connected to your bridge. Any interface of the bridge will be in the same layer 2 broadcast (thus the same IP network) with the others. The easiest thing to do is to make a bridge for each LAN segment that you want, and to connect the physical in...

... or if the HAP is strictly acting as an AP (you have some other device working as your router) then make sure the wlan interface is bridged to the LAN interface. If the HAP is all-in-one and the hard-wired computers are getting IP addresses properly, then you probably just need to go into the bri...

The non-hotspot way is not as tight, because it can only block / allow certain IP addresses.... So if a permitted IP address hosts a site you want as well as a site you do not want, then there's no way (using this method alone) to block the other site(s) also being hosted on the same server. Anyway,...

Search found 4036 matches