MikroTik

johnsilver

did I get it right to mitigate the potential risk all ALG features must be disabled (basically all service ports in ip firewall set to disabled)?

johnsilver

When you need to transfer the configuration from one router to another use /export instead.

Appreciated for this information. I've moved disputable configuration which leads to rebooting to a different router (RB951Ui-2HnD) with 6.38.1 firmware. Will see.

johnsilver

When trying to recover faced another problem. Problem description: Ports order flip when restoring configuration from backup Equipment used in test: A. Mikrotik RB951G-2HnD firmware version 6.38.1 B. Mikrotik RB951Ui-2HnD firmware version 6.37.3 Steps to reproduce: 1. Backup configuration via Files ...

johnsilver

RB951G-2HnD
Reboots every minute after upgrade to 6.38.1. High CPU usage for a short time leads to constant reboots.

johnsilver

Drop client to client talk in bridge, also drop fake dhcp (if dhcp on bridge interface). For guest wifi network /interface bridge filter add action=drop chain=forward comment="Drop all to !bridge self host" in-bridge=bridge-guest out-bridge=bridge-guest packet-type=!host this way you will...

johnsilver

Hi community.

I'd like to post useful information for russian users on a topic about passing provider blocks (from Roscomnadzor).
It's written in Russian, but it's pretty straightforward (with pictures).
Enjoy.

https://drive.google.com/file/d/0BwMIkY ... sp=sharing

johnsilver

Yes, I know. Thank you.

The bug described here fixed in 6.30.2 firmware upgrade.

What's new in 6.30.2 (2015-Jul-22 11:17):

*) pptp & l2tp - fixed problem where android client could not connect if
both dns names were not provided (was broken since v6.30);

johnsilver

What's new in 6.30.2 (2015-Jul-22 11:17):

*) pptp & l2tp - fixed problem where android client could not connect if
both dns names were not provided (was broken since v6.30);

nah cool, found this bug too

http://forum.mikrotik.com/viewtopic.php ... 20#p494520

johnsilver

So i guess this is a bug. If i put two DNS servers in PPP profile than everything works OK. If one then no connection at all.

johnsilver

Here is screenshot with ConfReq/ConfAck/ConfRef

johnsilver

Hi. When i set DNS server (in PPP -> Profiles) L2TP connection can't be established. When i clear DNS server parameter then i can connect. Is it normal behavior? In L2TP logs from router i can see that client in first case asked for ms-dns parameters and didn't get it and then trying again multiple ...

johnsilver

afaik you need to disable sip helper in ip > firewall

johnsilver

If someone would do MRTG on Centos, here is short how-to 1. don't forget to install rpmforge assets (to install additional snmpv3 perl libs) 2. configure mikrotik /snmp community add addresses=0.0.0.0/0 authentication-password=12345678 authentication-protocol=MD5 encryption-password=87654321 encrypt...

johnsilver

Hello. I have RB1100AHx2 and today i've found problems with MRTG and SNMPv3 connection. And i'd like to make some kind of bugreport. I've found similar problems here: http://forum.mikrotik.com/viewtopic.php?f=2&t=42471 (ROS and MRTG and SNMPv3 - anybody know the magic formula?) http://forum.mikr...

johnsilver

Hello. We just bought RB1100AHx2 and got some problems. First is that winbox.exe doesn't show vlan-header option, which we can see in: Flags: I - invalid # NAME SWITCH VLAN-MODE VLAN-HEADER 0 lan172 switch2 disabled leave-as-is 1 ap65 switch2 disabled leave-as-is /interface ethernet switch port pr S...

johnsilver

you can do either, RouterOS supports WPA/2 EAP

And hotspot authorization will work in both AP's? I mean with 802.1x and just with WPA

PS. authentication only by a password, so it must be a PEAP, do i need 802.1x AP?

johnsilver

now i have small question, i wan't to organize wi-fi network with RADIUS-authentication, do i need an access-points which supports 802.1x? or it can be simple access-points with WPA-WPA2?

johnsilver

Even RB493G will handle your setup just fine, but if in the future you plan to increase customer base, and upgrade your WAN speed, you can go with the RB1100 series

ok then, i'll stop at rb1100

johnsilver

this is a new project with the look into the future

now i'm looking at rb1100ah or rb1100ahx2

johnsilver

Hello. Can somebody help me with choosing proper mikrotik hardware and license for my requirements:
- built-in radius server to store approx. 100 users
- hotspot
- two wan (i'm planning to load-balancing two 20 Mbits channels)

10x

johnsilver

traffic from ether1 is untagged and comes from different subnets, i'm really needed this switch?

johnsilver

i have one interface with two ips, i need to split it, traffic flow on diagram

ps. a lot of details: http://forum.mikrotik.com/viewtopic.php?f=2&t=54424

johnsilver

Hi. Can somebody help me with little advise in RB configuration? I have to do such network configuration, but i'm new to Mikrotik. I'm little confused. My thinking is to create VLANs for each traffic flow: 1) create VLAN on ether1 with VLAN ID 1 (vlan_a) - light blue traffic 2) create VLAN on ether1...

johnsilver

trying to answer my own questions:
3) load balancing over multiple subnets can't be done in v3, but load balancing over multiple gateways can be

and general question is one, i don't know the answer...

ps. but i can keep compex switch and route 172.30/172.31 through it... and say good bye to windows

johnsilver

trying to answer my questions: 2) it must be mangle, i guess, firstly we must mark packets from networks to the ftp server at prerouting chain /ip firewall mangle add action=mark-routing chain=prerouting src-address=172.31.24.5/30 dst-address=172.29.4.5/30 new-routing-mark=ftp_flow_a add action=mark...

johnsilver

ok, i understand, then i'll will setup simple transparent bridge from internet #1 (172.30.6.0/30) to cisco router and refuse to use internet #1 in 64.0/24 network, i'm started with following config: I. define static ip's for all interfaces /ip address add address=192.168.1.32/24 interface=ether1 – d...

johnsilver

i can't pull 1811 because it used to connect 20.0/24 to other offices and hq

can mikrotik route/nat ip aliases?

johnsilver

ok, i contacted with hq and for now 20.0/24 doesn't require to access inner ftp server and cisco network configuration can be changed in this case everything getting simplier, in my opinion we need: 1) network #1: load balance between internet #1 (cable) and #2 (pppoe) 2) network #2: use internet #1...

johnsilver

question of the day, how to split one interface into bridge (A <-> CISCO) and private network (B <-> mikrotik), is it possible? how? can i use this bridge in third network (network #2)?

johnsilver

the story is simple it can be configured by headquarter company only, so we haven't password for it

johnsilver

of course it's possible, but need more info. you will have several uplinks, do you plan to use some load balancing, or send certain users through one, and some through the other? what are the other requirements, bandwidth shaping, firewall? Thanks for fast answer. I'll give any info, just ask. User...

johnsilver

Ours current configuration

johnsilver

Hello, dear community. I'd like that you help me with process decision making. This is my first post here, sorry if i posted it in wrong place. This is my network map and what i want to achieve. Can it be done by using mikrotik? Can someone help with minimal manual how can i do this. I'll be very ap...

Search found 33 matches

Re: slipstream - bypassing NAT/firewall

Re: v6.38.1 [current]

Re: v6.38.1 [current]

Re: v6.38.1 [current]

Re: Best configured Bridge Filter Rules

How to: Bypass Roscomnadzor with ProstoVPN and Mikrotik

Re: DNS assign for L2TP/IPSEC... bug?

Re: v6.30.2 bugfix release

Re: DNS assign for L2TP/IPSEC... bug?

Re: DNS assign for L2TP/IPSEC... bug?

DNS assign for L2TP/IPSEC... bug?

Re: RB751G-2HnD AP seems to block UDP traffic used by 3CX

Re: snmpv3... yes, again

snmpv3... yes, again

RB1100AHx2 and Atheros 8327 switch-chip issue

Re: help with choosing right routerboard

Re: help with choosing right routerboard

Re: help with choosing right routerboard

Re: help with choosing right routerboard

help with choosing right routerboard

Re: One interface split...

Re: One interface split...

One interface split...

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Re: Need help with network organization

Need help with network organization