MikroTik

jacekes

All my routers say 7.12.1 1700221125

jacekes

For me on several 951s and one hap ac2 after the upgrade the "old-gen" wireless package was missing and wifi stopped working.
I needed to install the "wireless" package manually in order to see the interfaces again.

jacekes

Thanks Emils!

jacekes

Why do both v6.45.x and v7beta keep appearing in turns in the development channel?

jacekes

:-O
Now I'm shocked.
I swear I've seen it working properly...

jacekes

Do you mean only smips?
I've been using VRF's on mipsbe, x86 and powerpc since early routeros v5 and it always worked fine.

jacekes

I mean version 6.33.1 of course...

jacekes

Hi, I've been recently doing some basic labs using: - GNS3 running a couple of Cisco 3745 and 7200VXR - RB941 hAP lite RouterOS ver 6.31.1 The topology of the lab network is not really important, the point is I needed a VRF - a pair virtual ciscos had BGP sessions with the main routing table of the ...

jacekes

Are you sure the default route is properly set on the CAP's?

jacekes

Yep, something's changed on the website. Until now there were links to "6latest" package files, without any info about the version of the file. Now v6.31rc7 is openly available on the website, and the "6latest" link still directs to v6.31rc6. Won't the "6latest" links b...

jacekes

No, I haven't tried it. I will. Thanks for the hint. The area is maybe 50 x 30 m ant the route looks like this: /--------\ | | \---\ | | | X | | | | | | | | \----/ X is the access point location, about 4 m above ground level, about 3 m above the station antennas. The access point has a panel antenna...

jacekes

Hi, I know this topic has already been mentioned meany times before, but it seems there was no solution found yet. I have about 25 RB Metal 5SHPn wireless stations. These stations are located in a magazine hall and they are mounted on trolleys which move slowly along a looped route, slower than walk...

jacekes

Export the configuration from your neighbor's CPE and compare it with yours.

jacekes

You're welcome.

jacekes

Happy to hear that.

jacekes

Yes, now I get it.

After what Uldis had written I really wonder how those other two manage to connect.

jacekes

that the others use is 6.16 and 6.18. I have also tested those ones and the result is the same.

You mean it connected on the older version or not?

jacekes

What kind of IP address do you get from the wireless DSL modem? Public or private?
Is the DSL modem acting as router or bridge?

jacekes

I see you're using the best network-diagram software ever! I also like it very much! ;-) The easiest way - add a secondary IP address from the 192.168.88.0/24 network on the LAN interface of the Sagemcom. I don't know that device, maybe it's possible. If you're not able to do that, this should work:...

jacekes

Hmmm... I'd try the same software version as on the connected ones.

What versions do you use?

jacekes

There's no need to configure anything extra on the AP.
And yes, these rules will forbid the station to connect, when these conditions are met.

jacekes

Nope, CRS109-8G-1S-2HnD-IN doesn't have 2 radios. Two antennas ≠ two radios.

jacekes

Encapsulating it into a "/system script add" command is the right way. It's also worth remembering you might need to escape special characters in the script source.

jacekes

No, you have only marked routing, based on a connection mark, that has never been applied. You have no mangle rules with action=mark-connection and these apply the connection mark. I would try adding these before your existing rules: /ip fire man add chain=prerouting in-interf=ISP1 action=mark-conn ...

jacekes

As far as I remember, one mark of each type can be used.
So a packet can have a packet mark, be part of a marked connection and be routed accordingly to a routing mark.

jacekes

It's probably simple: guifi.net is the company website address, so the customers in range can check it out and request services. Ripoll-Catllar-Remei are probably the places, which are in range, or the place where the AP is located. Probably to make it easier to connect new customesr for the radio t...

jacekes

Weird. Should be possible. What version are you running?

The other possibility is to add vlan subinterfaces on wlan and ether interfaces of all SXT's and bridges to connect them.

jacekes

The 32-character limit is defined in the 802.11 standard.
Your AP does not comply to that limit. You should change the SSID.

jacekes

I guess the incoming connections from the internet don't get marked properly, so the outbound traffic from the server in such a connection uses the wrong (ISP1) default route. You use connection marks in /ip firewall mangle, but I don't see any rule where you would apply these connection marks to th...

jacekes

When I needed managed PoE, I used Ubiquiti's ToughSwitch PoE Pro. They were quite good, but used to freeze once in a while. As far as I remember, they were also not fully transparent for GRE. Out-of-the-box PoE? Used them many times. Never analyzed whether the devices which broke down did it because...

jacekes

Do you accept established and related connections on forward chain? If not, you should.

jacekes

MTU, not L2MTU.
You don't need to add all the vlans on SXT devices. You only need to add these, which you need, for example for management access.

jacekes

Yes, it is.

jacekes

Nice racks. Lately I've been thinking about a way to organize my home lab. I have a couple of devices (some 433's, 411'a and 333's, some PCEngines boards and a 951-2n), none of them is rackmount, most of them don't even have any enclosure. Until now all that stuff is lying around on the desk altoget...

jacekes

Red wire? :-o Actually there's much more writing about it, than configuring... RB951 building 1: create a bridge interface for each vlan add IP addresses to the bridge interfaces and configure respective DHCP server instances create VLAN sub-interfaces on the interface towards the SXTAC add the subi...

jacekes

Remove the "place-before=[find chain=input]" and paste the command again. It should be added wothout any errors. Than open IP->Firewall->Filter in winbox, in the top-right corner choose "input" from the drop down box, and then move the last visible rule as the last one before the...

jacekes

PPTP won't work. Needs TCP handshake on port 1723.
PPPoE sounds better - try to setup a PPPoE server on one side and a PPPoE client on the other. Then establish the TCP (special login or remote access/RFC2217) inside the PPPoE.

jacekes

I wonder if you really need a radius server or usermanager at all.
You can create hotspot accounts in /ip hotspot user. I don't see any limit for these.

jacekes

If you use an external radius server, you will only be limited to 200 active hotspot sessions. There are several scenarios to deploy a radius server, depending on the needs, google it. I can't tell which scenario will be the best for you. On Mikrotik you will need to add the radius IP and ports to /...

jacekes

I can fully understand the need for the serial connection, nothing unusual. I think you might try some kind of UDP tunneling, but unfortunately I can't help you here, I'm no good when it comes to tunneling. Or if everything else fails, you could put another computer before the serial device, open a ...

jacekes

The default settings on RouterBOARD block all input from WAN.

Hmmm... not all, at least not for all boards. As far as I remember the default firewall settings for 75x and 951 allow ICMP on the input chain.

jacekes

That depends on your firewall settings. Do you drop icmp requests?

jacekes

Hmmm... The "no TCP" limitation is really troublesome here. There are functions like: * System -> special login (redirect telnet / ssh session to serial port for a specified user); * System -> ports -> remote access (also a form of telnet session redirection), but they all work over TCP.

jacekes

Hi, what kind of router is it? I would check the firewall first, routers like RB75*, RB95* have a default firewall setup, which prevent from accessing the router from the WAN interface. In IP->firewall->filter, chain input the last rule probably is a drop rule for in-interface=ether1-gateway. I prop...

jacekes

It's possible to use more than one address on one interface of the router - one public and one private. Use the public address as the gateway for premium customers and the private for basic customers. It's a very simple way to do it, the clients are not separated in terms of L2. There are several mo...

jacekes

I don't know how this addon works, I'd install on a known computer and examine what's visible in torch on the router. Then try to come up with a proper blocking rule.

jacekes

Are you sure it's the resolving that fails? I doubt it... Try nslookup myserver.org from a computer inside the local network and also :put [:resolve myserver.org] on your mikrotik router. Try to use http://(your current public I address) from inside the network. If the name resolves ok, I would try ...

jacekes

It's possible to knock a TCP port from Mikrotik.
Use /system telnet <destination IP> port=<port number>
Unfortunately there's no way to execute it with a short timeout.

jacekes

It should work also for secured sites.
Check if you have a redirect rule for dst-port 443 in IP -> firewall -> NAT. This rule should be dynamic and automatically added by the hotspot dialog.

jacekes

If it was Mikrotik instead of Cisco, I think I'd know how to do it. ;) I'm not a cisco Cisco expert, but: 1. you can replace the private 192.168.1.0/24 subnet with a public /30 subnet, this will surely work 2. you can set up a loopback interface on the firewall router with a public IP address, confi...

jacekes

But it's worth to mention that wireless equipment shouldn't be mixed.
You can build a wireless bridge with MT on one side and UBNT on the other, but you won't be able to use vendor-specific protocols, which provide much better effectivity. The same with sector and clients.

jacekes

Hi, I am recently helping a small wireless ISP optimize the configuration of their edge router. The ISP is using a RB1200 with RouterOS v6.20. They have a little more than 200 customers, the traffic reaching 50 Mb/s at peak. Mangle and Queue tree is used to limit customer traffic. CPU usage reaches ...

jacekes

I think you need to address the 192.168.x.0/24 subnet gateways on the SFP interfaces and add firewall rules to NAT each 192.168.x.0/24 to a single 1.1.1.(x+1)/29 address, that is:

/ip fire nat add chain=srcnat src-address=192.168.x.0/24 action=src-nat to-addresses=1.1.1.(x+1)

jacekes

The second NAT rule is proper. What subnet mask have you configured on the bridge-routed interface? The rest of your config looks ok. What do you mean by "but traffic returned to the RB2011 didn't make it back to the test device at .23"? For example when you sent ping from 172.16.0.23 to 3...

jacekes

Show the configs of the interfaces on both sides and the NAT rule. A schematic, including IP addressing, would be very helpful. It's difficult to help you, when you don't even say what you want to NAT.

jacekes

In my case it was 100 GB of cleartext logs per 1000 customers yearly.
When packed with ZIP using strong compression the amount went down to about 6 GB.

jacekes

On the router, which is translating the CPE private addresses to public addresses.
Yes, log to a remote server with a large disk or a matrix.

jacekes

Do not enable remote logging on each CPE, it makes no sense.
Enable logging on your edge router, the one, that's doing the NAT.

jacekes

Yes, you can add a third address on an interface.
To set up a VLAN go to interface->vlan and click add. Configure the VLAN ID, and attach the vlan interface to an ethernet interface.

jacekes

There's no need to use VLANs.
You can set up two IP addresses on the ether3 interface to be the default gateways. The public address will be the gateway for the computers with public addresses. The private address will be the gateway for computers with private addresses.

jacekes

No, you only need to add the ethernet interfaces to the bridge.
You should be able to see the MAC addresses of the PCs in Bridge->Hosts.

jacekes

Don't mirror anything. Use RouterOS logging and a syslog daemon on a server. Enable logging on the NATing rule (in RouterOS 6.20) or in older RouterOS versions add a rule: /ip fire filter add chain=forward proto=tcp connection-state=new action=log and move it to the top of the list. You will also ha...

jacekes

A bridge works in layer 2, without routing, in the same subnet. So you're doing routing, not bridging.
Check if the RB2011 masquerades the 192.168.88.0/24 network, by default it does.

jacekes

From my experience from a much larger wireless ISP:
* Set up a linux server.
* For logs use Splunk.
* For bandwidth graphs and device monitoring and email notifications use Cacti.
* Set up bash scripts to collect device backups over FTP to your server

jacekes

Some people here claim to have ~70 customers using NV2 on radios like NetMetal. And I guess it's possible in a carefully and professionaly maintained network, but I have never acheived that much. I have observed problems when having more than 30 clients on one interface, but the signal parameters va...

jacekes

I can also suggest setting the data rates and/or MCS static.

jacekes

Oh, so there's more config than just the PPTP? :D Basically, you have had overlapping addresses - LAN interface address overlapped with remote and local addresses in PPTP. I guess you should fix the overlapping the way I suggested in the previous post and then change src-address in the masquerade an...

jacekes

I don't understand. You say the CCQ went up after the client disconnected? So the CCQ is 95% when there is no client?

jacekes

Set the local-address and remote-address pool to something completely different, for example:
local-address 172.16.105.0/24.
remote-address 172.16.205.0/24
Addresses in pptp can and should be from completely different subnet, than interface address.

jacekes

CCQ at 90-95% is very good.
What kind of stability problems do you have? Do the links disconnect, lose packets or do you mean unstable signal parameters?

jacekes

You want to connect 250 clients to one sector or to one tower (with many sectors)? I would suggest 8 sectors. 250/8~=30 customers per radio interface. That's possible, with NV2 can be quite efficient. I once managed a tower with 8 sectors + 5 point-to-point links to other towers. The spectrum was al...

jacekes

A PC won't manage so many clients too.
I guess you should use more sectors, narrow angle sectors.

jacekes

What interface do you address with 192.168.100.1/23?

Do you use PPTP tunnels to connect customers?

Paste the output of:
/interface print
/ip address print

jacekes

Do you use the pool for local-address or remote-address?
Doesn't the /23 pool overlap with some other address space you use?

jacekes

Using PCs as routers/base stations - this is the origin, where RouterOS comes from. There were times, when the only possibility to use RouterOS was to install it on a x86 PC. Later came RouterBoards. Using a powerful PC with RouterOS makes sense when you want to do a lot of queueing or firewalling. ...

jacekes

You've supplied very little details. What kind of VPN connection are you trying to use? PPTP? SSTP?

jacekes

"400-500 users" is not possible with "low price". Hell, I guess it's not even possible with expensive solutions at that range.

jacekes

What sort of VPN do you want to use? PPTP? SSTP? OpenVPN? IPSec?
Should the PC_VPN be able to access computers in the 192.168.88.0/24 network?
Should it be able to access internet? Or should all the traffic from that computer be tunneled out through the VPN?

jacekes

/ip firewall filter add chain=forward src-address=(the IP you want to block) out-interface=(your WAN interface) action=drop

This rule will drop traffic originated by an internal IP address going out your WAN interface

jacekes

/ip firewall nat add chain=srcnat src-address=(private address pool) action=src-nat to-addresses=(public address pool)

This rule gives per-session NAT. But it's a very bad idea.

jacekes

DSL internet connections are in use, probably with very little upload bandwidth, so the VPN connections would be very slow. Connecting the offices via radio gives significantly more bandwidth.
Moreover, the DSLs are probably also unreliable.

jacekes

You can do it by scripting if you need the timing.
Of course you realize it's going to interrupt all outbound TCP sessions every 60 seconds?

jacekes

What kind of IP address do you get on your LTE interface? Public or private?
Is the connection in Vodafone based on PPPoE?

This issue can be pretty complicated. If you get your proper public address on the modem, you could access your router through port forwarding, if it's configurable on the modem.

jacekes

Use port forwarding - described here: http://wiki.mikrotik.com/wiki/Forwardin ... nternal_IP

jacekes

I guess MrYan suggested addressing the .105/29 address on the bridge2 interface.
It can work, but it's far from correctness...

jacekes

PPPoE-out interfaces don't have MAC addresses.
PPPoE is a layer above MAC layer.

jacekes

How many public IP addresses do you have?
You can even change public addresses even on a per-tcp-session basis by just simply setting up src-nat with a public subnet configured as the to-addresses. But I guess this is highly unrecommended.

jacekes

Please try writing better english. It's very difficult to understand you.

jacekes

Post the output of /ip route print and /ip firewall nat print
Can the PPPoE clients access internet or WAN through the CRS?
From what you've written by now, it should all work properly.

jacekes

The cisco config is not really helpful. ;) Please check your PPPoE connection status if your local address gets a /29 subnet mask. If yes, 1:1 NAT could be a quick solution - translate a private address of a host to a public address from the /29 subnet. There are probably better solutions, but I can...

jacekes

I guess you're not being clear enough. You are connected to the same router as the PPPoE clients? Why are you trying to masquerade your traffic when it can simply just be routed? Do the PPPoE clients have any firewall? Are the IP addresses of PPPoE clients properly visible in the status of PPPoE con...

jacekes

So you've got a PPP profile for each tariff? For example profiles like DL1M_UL256k, DL2M_UL512k and so on? If yes, I would suggest writing two scripts. The first script to set the daytime bandwidth to all PPP profiles and the second to set the nighttime bandwidth. Then schedule the scripts to run at...

jacekes

That's not the way it works, you can't configure it on the Mikrotik router. When the computers from the 192.168.20.0/24 network try to communicate with the 192.168.1.0/24 subnet, they don't have it in their routing tables. So they forward the traffic onto the default gateway, 192.168.20.1. That rout...

jacekes

Ok... Do the computers in the 192.168.20.0/24 network have their default gateway set to 192.168.20.254? DO these computers have the firewall enabled? If yes, what kind of firewall is it? Can the computers ping each other inside the 192.168.20.0/24 network? From the terminal of the router run ping 19...

jacekes

This is a forum dedicated to Mikrotik. Please try http://forums.dlink.com/

jacekes

I guess the winbox tools->ping part is able to resolve a name which is not in FQDN format, whereas ping in command line is not.

jacekes

What kind of bandwidth limiting do you use? Simple queues, queue tree or rate-limiting configured on the ppp profiles?

You can find some examples in the Wiki, for instance here: http://wiki.mikrotik.com/wiki/Limit_Dif ... _and_Night

jacekes

1. Add two default routes - one for each ISP. The default route that is listed on position numer 1 should have routing-mark=ISP2 configured. 1 In IP Firewall Mangle you should add a rule in chain prerouting, for the 2nd ISP's subnet as src-address to apply the routing-mark ISP2 to the connections. S...

jacekes

What RB device do you use?
Post the output of /interface export and /ppp export.

Is your pppoe-client supposed to be using vlan 6?

jacekes

Your ether3 port is still a port of bridge-local.
Go to Bridge -> Ports and remove ether3 from the list or disable it.

jacekes

That's weird. What software verison of RouterOS do you use on your 411?

jacekes

Use only authentication-types=wpa-psk,wpa2-psk and check what happens then.

jacekes

Try to set frequency-mode=superchannel country=no-country-set on the wireless interface.

jacekes

Is there any packet loss when you ping the router from the computer?
Are you connected directly when it happens, or are there any devices in the middle?

jacekes

Post the output of /interf wirel sec exp com (remember to remove the password

)
Have you selected the configured profile on the wireless tab?

jacekes

Hmmm... I hope you've noticed, that this is a Mikrotik forum. It's also the Wireless branch of the forum... I guess you need to configure dot1q subinterfaces on an interface of the 7200, configure a trunk port on the switch and connect it together... Then hosts connected to different access vlan por...

jacekes

Set up the security profile correctly, then perform a scan and connect. I would suggest using station-pseudobridge mode rather than station. Station mode is not Layer2 transparent, therefore you would have to additionaly configure NAT, DHCP and routing on the Mikrotik. Station-pseudobridge is (sort ...

jacekes

I think you're not able to bypass it from your RB951.
You can either ask your ISP to bypass your mac-address on his hostpot or set up a linux server and write some scripts to input the credentials automatically.

jacekes

So it's not really a matter for the Mikrotik forum.
Firstly you need to be sure, that the NAS is capable of radius authentication. Then, follow the manual.

jacekes

What kind of NAS is it? If it's a RouterOS device, you need to add a radius server with the service=login parameter
Generally, the radius server will not ask for the password. The network device will prompt for the password and verify it at the radius server.

jacekes

I assume you have addressed the untagged interface of the RB951 and the tagged sub-interface in different subnets. These 2 subnets should be visible in the routing table of the RB. If they are, nothing more should be done. Are the hosts from vlan2 visible in the ARP table of the RB? Can they ping th...

jacekes

Your DHCP-server has to be set up on your Mikrotik router and it must have "add ARP for leases" enabled.

jacekes

I've had such a configuration (many VLAN interfaces on an ether interface, all added to a bridge) and it was working as you wish it would - layer 2 traffic was forwarded between the VLANs. I've used it on ROS v. 5.16, 5.19 and 6.10. As for me, I didn't want the traffic to be forwarded and had to set...

jacekes

Post the config of the wireless interface (/interf wirel exp com) of that SXT.
How is the AP configured? Is it a Mikrotik also, or is it something else?

jacekes

Nope, sorry, it won't work the way you described it.

jacekes

You need to bridge the wlan1 and ether1 interfaces and add an IP address or DHCP-client on the bridge interface. /interf bri add auto-mac=no admin-mac=[mac address of ether interface] /ip dhcp-client add interf=bridge1 disabled=no /interf bri port add bri=bridge1 interf=ether1 /interf bri port add b...

jacekes

Using a /32 subnet mask is possible and works properly. I've had a couple of RB's with loopback interfaces addressed that way in my network. Is the ether7-uplink interface up? If it's not up, the routing table will show the connected subnet as unreachable. Post the output of these commands, maybe we...

jacekes

I'm not suggesting to use the 411AR, just the opposite, but I guess the 2,4 GHz band is essential for a wifi hotspot service.

jacekes

I've worked on a large hotspot project some time ago and I used RB411AR enclosed in Cyberbajt sector-box antennas.
If I was supposed to do it today, I'd use Groove or Metal and omni antennas or compact sectors.

jacekes

The setup is fairly easy - assuming that it's possible to add static routes on the existing office routers.
I've attached a simple network diagram.

The wifi AP can be a SXT SA5, the wifi stations SXT Lite 5.

jacekes

The Dude is listed among other packages in /system packages. You could have marked it for de-installation there and just reboot the router.

jacekes

After reading quite a lot about the subject, I came to a similar conclusion - more than 1 access point, but, what if I combined 2011 + AP per room, for example? Benchmarks suggest it would probably handle that. What do you think?

I guess it's a good idea.

jacekes

Do all the clients disconnect at the same time from all VAP's? Are there many other networks broadcasted in the surrounding area? Some details about the place? Office/house/warehouse? How many m^2? In general, 35 to 40 clients is quite a lot for one radio interface. I would try using a different boa...

jacekes

I agree Sextant is not enough. Good grid antennas would also be good if you don't need MIMO. If MIMO is needed - dish antennas. And of course extremely precise alignment. Remember the laws of your country.Concerns the legal broadcast limit Most of the regulatory domains make this kind of link imposs...

jacekes

It's possible and it works, I've tried it a couple of times. Something must be wrong with your config.

jacekes

The Netgear router has a typical omni-directional antenna? What kind of antenna do you plan to use with the RB411? Use winbox to configure the RB411. In the wireless section set up a security profile for dynamic keys, wpa2-psk & AES with a password you use on the Netgear router. Wireless interfa...

jacekes

So how come the firewall was accessible, visible in the bridge table and ARP table, huh?

jacekes

The firewall responds to a ping from the Internet, Packet trace is done on the firewall external interface.

Try to sniff packets on the RB, on it's WAN interface. Apply a filter for the firewall IP address and check if the traffic is visible.

jacekes

It looks like the Layer 2 connection is not continuous for the VLANs. It seems like the 802.1q vlan tagged frames aren't accepted / are dropped by the RB951. This could happen because of a couple of reasons that I can think of: - too small MTU value - check it in interface properties on the RB951, s...

jacekes

Not sure what I am doing differently? I am going to use a PPTP tunnel. I just don't see that I should have all RB450G connected via PPTP at all times. My complication is the establishing of the PPTP connection. Is that what you mean? Thanks! Yes, this is _also_ what I mean. Firstly - you don't need...

jacekes

I guess you're making it overly complicated for no particular reason.
I advise making it in a more simple way, a way that just works and is used by a lot of people.
If you're worried about the safety of PPTP, you can secure it with a "port knocking" technique.

jacekes

The packet trace was done where? On which device & interface?
What about the firewall being accessible from the internet?

jacekes

Is the mac address of your firewall visible in /interface bridge host print? Is the mac address and IP address of the firewall visible in /ip arp print? Is the firewall anyhow accessible (for example by ping, if it answers ICMP probes) from your LAN subnet (217.x.x.32/29) or from the internet? Which...

jacekes

Me? What for? It's on the wiki I guess and rcampbell can check it by himself.

jacekes

Yes, but it can be a self-signed cetificate, and as far as I remember it can be generated directly on the RB.
I don't have access to any of my RB right now, so I'm bot able to test it.

jacekes

For all the future readers (if any) - in this case the problem wasn't related to PPPoE or IPCP. The cellular signal level was too low and the PPP-client interface wasn't really fully up.

jacekes

Hi, what do you mean by "Port ether6 connects PPPOE and ether 4 is my firewall."? Is this schematic correct? BT Modem LAN port <=> eth6 RB2011 eth4 <=> firewall <=> yout local network Is the IP address obtained correctly on the RB2011 eth6 port? Is it a public IP or private? Do you have in...

jacekes

I guess you need to enable https in /ip services and disable http.
This will affect all web-based interfaces.

jacekes

How are these devices connected? Any switches between them?
Please attach a schematic of the network.

jacekes

A PPTP tunnel would be perfect for that. Set up a PPTP server on the edge RB450G, the one that has the public address. Set up a PPP secret on that RB and a PPTP-client connection on your windows or linux computer. Launch the pptp client, and as jarda said, add a route to the private address space be...

jacekes

That's a lot of config you've applied, especially to the wireless section. But it seems ok. My strategy to debug this problem would be: 1. enable vlan 100 (and next 101) on a ethernet interface of a windows computer, connect it to the interface of RB750 and check if the IP address is obtained proper...

jacekes

You're being a bit chaotic.
Could you draw some schematic of the network?

jacekes

Hi, assuming that ether1 of RB951 is connected to the RB750GL: 1. reset the RB951 to factory defaults, don't load the default settings; don't use quick-set; create the VLANs on the ether interface: /interf vlan add name=vlan100 vlan-id=100 interf=ether1 /interf vlan add name=vlan101 vlan-id=101 inte...

jacekes

Hi, I guess it's you who has called me on friday. Tell me, what modem init string have you used? Addresses served in IPCP can look weird, even though they might work properly, especially on Orange in Poland. Anyway, this is not the case - you get 0.0.0.0 as the IP for your host. I guess I'd really n...

jacekes

Any ideas?

Normis? Sergejs? Anyone?

jacekes

I know I'm covered, but that's not enough for me. The police defines the source and destination IPs and ports. If I had consistent data, I would be able to make the process of finding the customer more automatic. Now I spend a lot of time searching through the logs.

jacekes

Ok, so now I would like to know if it's possible to log the random port number for the tcp session.

jacekes

Hi, My customers get private IP addresses which are translated to public addresses on the edge of the network. The translation is usually many private addresses to one public address using masquerade or srcnat actions. In Poland network operators are obliged to keep information about IP address usag...

jacekes

Solved!

I rebooted my laptop from ubuntu to windows, ran a client of my linux dude server and a new local server. In windows it's possible to copy functions between Dude instances using the clipboard.

jacekes

Hi, I've recently installed The Dude 3.6 as a service under Ubuntu Server 12.04.1 LTS according to this manual: http://wiki.mikrotik.com/wiki/The_Dude/Dude_as_a_Linux_Service It was running perfectly, I've set up my maps, devices, snmp profiles etc., until I had to reboot the machine. Now the Dude s...

jacekes

Hi, I have a similar problem as described above. I guess it's not a bug in RB, but maybe you guys can give me some feeddback. I need a configuration like this: http://104.imagebam.com/download/5J6u8z36IRp8BO0lhjL3FQ/24529/245280737/console-server.jpg I've got everything working except for the USB hu...

jacekes

That's a really bad idea...

jacekes

The floors are over 50cm thick reinforced concrete and the internal walls (blockwork and reinforced concrete) have up to 10dB penetration loss breaking the place into lots of rooms and corridors. A quick computation indicates up to something like 40 AP on some floors and lots of RF issues. There is...

jacekes

I'm curious about the same thing, however those connectors are not u.fl. It would be great if they were usable.

jacekes

Oops, sorry, found it already.

jacekes

Is the CE DoC for the 751U-2HnD already issued? I need it badly.

jacekes

I've tried it only on v5.21. I might have some time next week to downgrade my 433 and check if it works. In the meantime you can try evolving your simple yet working script. For example try to substitute the value of $user to a new local variable , for example: :local tempvar $user; :log info tempva...

jacekes

Of course, here you are: /ip hotspot user profile set [ find default=yes ] idle-timeout=none keepalive-timeout=2m on-login=":local who \$user;\r\ \n:local whomac [/ip hotspot active get [find user=\$who] mac-address];\r\ \n:local whoip [/ip hotspot active get [find user=\$who] address];\r\ \n:l...

jacekes

Yes, the code mentioned above: :local freeuser [/ip hotspot active find user=$user]; :local freemac [/ip hotspot active get $freeuser mac-address]; :local freeip [/ip hotspot active get $freeuser address]; :log info ($freemac." ".$freeip); works correctly and logs the MAC address and IP ad...

jacekes

I got an answer from Maris from Mikrotik Support.
The script source containing the $user variable has to be defined in the /ip hotspot user profile on-login parameter instead of just the name of an external script defined in /system script.
It works as it should.

jacekes

try this (...)

Nope, doesn't work.

jacekes

@c0d3rSh3ll, thanks, I'll try it tomorrow, because I've got my RB433 at my office. But I think I've tried it already. @ditonet, I know that these "*A..." are internal ID's, I'm just confused with not being able to select one particular ID using the $user variable. The example script from t...

jacekes

Grzegorz, have you tried running the script while having more than one user listed in /ip hotspot active? The run counter increments as new users log in, but the script shows no effect if there is more than one active user. Best regards, Jacek EDIT: I'm trying to investigate the meaning of the $user...

jacekes

Hi Grzegorz,

thanks for the code, but unfortunately it doesn't work either. Do you use it? On what version of RouterOS? I've tried it on 5.16 and 5.21.

Best regards,
Jacek

jacekes

Hi, I'm trying to create a script that will send syslog messages once a trial user logs in at a hotspot site. I have configured sending log messages to my syslog server and I've defined a script in /system script. The script name is associated with the on-login action of my hotspot user profile assi...

jacekes

Do I need a USB power injector to use the 3G modem with the 751U-2HnD?
I'm asking because I remember I needed a power injector to use a 3G modem with RB411.

jacekes

Hi, Sorry for bringing up such an old topic, but I've encountered the same problem. However, it seems like it's not the software version that causes the difference. I have several RB411's and RB433's running 5.6 and 5.16 working as outdoor wireless hotspots. I'm using the rule: /ip firewall filter a...

jacekes

Since your external login page will redirect to "/login?username=whatever&password=whatever" already to trigger a log in with the hard coded RADIUS credentials just add more POST variables as per above to send to RADIUS. Ok. Didn't think of that. So it turns out I'm a bit of a dummy. ...

jacekes

Hi, I'm new to this forum, I hope I'll be able to comply with the rules. ;) I have a rather complex issue with a hotspot service I'm supposed to create. I use a RB 411 UAHR, it has the hotspot option set up correctly, it's also set up to use an external radius server for authentication and accountin...

Search found 169 matches