MikroTik

tomaskir

Hello fellow Tik fans. Wanted to share a guide to a sensible and useful use-case for a Docker container on a router. Containers on routers can be quite useful in the right use-cases - just please remember that just because you can run something directly on the router, doesn't mean you should. For so...

tomaskir

You can find a presentation on this here: https://youtu.be/67Dna_ffCvc

While the presentation itself is quite old, everything in it is fully applicable to what you need

tomaskir

Sorry to barge in, but when you setup Unimus to handle upgrades - and other things - you give it the credentials to the Mikrotik devices. I am trying to figure out if Write or Full permissions are required for the upgrades and to be setup in Unimus? Write should be enough unless you also want to ma...

tomaskir

Can you confirm that this should still work under ROS 7.1x. ? I did the steps manually and configure package-upgrade-source, do refresh and so on. i also see the connection to the host router which holds the packages will be established, but there are no update files will be listed on the client de...

tomaskir

What's new in v3.35:
...
*) fixed crash when connecting in new window (introduced in v3.33);
...

Thank you, but it still doesn't work properly. When connecting in a new window, Winbox takes about 20 seconds to spawn the new window. Before 3.33 everything worked properly instantly.

tomaskir

it's impossible to flash there RouterOS?

It is NOT possible to flash RouterOS on UBNT hardware.

tomaskir

4) Finally, I would really like to get access to why an error occurred in on-error blocks. Here is what I would love: :do { # things } on-error e do={ :put "Failed, reason: $e" }; That's a good one, and since "$e" likely be a string, a " simple string find" operation f...

tomaskir

1) Most of my personal issues with ROS scripting are when it comes to string parsing and string manipulation. Gives how ROS scripting is used, these are some of the most used functions, and currently they lack of lot of utility functions. :strleft - return a number of characters of the string (from ...

tomaskir

Probably best to report this directly to support, including supout files from both v6 and v7.

tomaskir

Please post the output of "/system logging export".

tomaskir

Check the PPP profile used by your PPTP and L2TP servers. Adjust "session-timeout" and "idle-timeout".

tomaskir

If you do "print", it will print numeric IDs for entries in the current CLI section. It wants you to provide an ID for which record to configure the "address" and "interface" parameters on. What you are looking for is: set [find interface=bridge1] address=10.0.0.1/24 Yo...

tomaskir

Something like this should work (adjust as needed): /ip route :if ([:len [find comment="WAN1" dst-address=0.0.0.0/0]] > 0) do={ :foreach i in=[find comment="WAN1" dst-address=0.0.0.0/0] do={ remove $i } /ip route add gateway=lte1 dst-address=0.0.0.0/0 comment="WAN1" }

tomaskir

In "/ppp profile" you have the option to set "on-up" and "on-down" scripts.

Create a separate profile with your desired scripts, use that profile for your outbound PPPoE session.

tomaskir

There is a way - altho not a straightforward one. Using Linux and Wine, you can force a "theme" for a Wine prefix. You then run Winbox inside that prefix. The theme can override any colors you want. This is an example of forcing a dark theme for Winbox: https://i.imgur.com/4ZzAS6B.png It's...

tomaskir

MAC Telnet and MAC Windows are direct L2 connections to the Telnet and Windox services - without using L3. (so there needs to be no IP addresses on the client (PC) and the server (router) to be used) These are used as last-resort management, if IP access is lost (due to routing issues, addressing mi...

tomaskir

With an issue like this. it would be best to email MikroTik support directly at support@mikrotik.com.
Please make sure to attach a supout file so they can investigate.

tomaskir

Do you have the terminal window open in Winbox?

Each terminal in Winbox spawns it's own job - maybe you had a saved session that contained terminals, so when you logged in, Winbox re-launched those terminal windows, and that's why you see active jobs?

tomaskir

You can use regular expression matching, something like this:

/ip firewall address-list
:foreach i in=[find where address~"^192\\.168\\."] do={
  # example, modify as needed
  :put [get $i address]
}

tomaskir

As said above, you should fix whatever are the underlying issues rather than reboot. However, here is a script that will reboot the router, if uptime is over 1 minute, and there are 0 PPPoE sessions: { :local upTime [/system resource get uptime] :local weeks [:pick $upTime 0 [:find $upTime "w&q...

tomaskir

To expand on this is little: - if you want to use a single pool ("/ip pool" on RouterOS) for multiple PPPoE servers on a single RouterOS system (single RB / CCR / CHR), you can, just configure it in the profiles / secrets - if you want to use a single IP "pool / range" shared acr...

tomaskir

With the prevalence of IKEv2 everywhere in the last few years, VTI is indeed a must-have now.

The fact that people have been asking in this topic for VTI for 8 years hopefully shows there is a substantial demand for it.

tomaskir

The Mikrotik Wiki article for scripting has very good information:
https://wiki.mikrotik.com/wiki/Manual:Scripting

I would suggest giving that a read, and playing around the CLI.
It fairly easy to understand and start scripting for yourself :)

tomaskir

Try something like this, adjust for yourself as needed: /ip dhcp-server lease :foreach i in=[find] do={ :local add [get $i address] :local mac [get $i mac-address] /tool fetch url=("https://mysite.com/api/dhcp_assignments%5C?ip_address=" . $add . "&leased_mac_address=" . $mac...

tomaskir

tomaskir - Is this on a router that was just reset? No reset, this was a fully configured router on an older version updated to 6.48 without any changes. Before and after upgrade an "/export compact" was taken, and these 2 were diff-ed. This resulted in the changeset you see - looks like ...

tomaskir

Most issues with high load when using queues, and especially L7 come from using these features in a wrong way. I highly recommend watching Janis' presentation from MUM on how to properly debug and fix common performance issues on CCRs: https://www.youtube.com/watch?v=3LmQYIQ5RoA Right on page 5 (4 m...

tomaskir

If you are planning to use L2TP/IPSec (L2TP over IPSec), then you will be using IPSec in transport mode, not in tunnel mode. Using L2TP/IPSec the clients should create a single dynamic policy per client (generate-policy=port-strict). This means there will be only 1 policy per client, and you will be...

tomaskir

VRRP is a layer 3 technology - it's not meant for load balancing on L2, and in fact not at all for load-balancing, as only a single VRRP member can be a "master" owning the virtual IP. VRRP should ever only be running on routers (nodes acting as gateways), not on switches. You are likely l...

tomaskir

That's one huge changelog - the stability fixes for ARM are much welcomed. After the upgrade, "/export compact" without any reconfiguration shows 2 new changes from "default": https://i.imgur.com/yr83XOP.png ... https://i.imgur.com/NNvyWjb.png What has changed in the defaults for...

tomaskir

Post the output of "/export hide-sensitive", and it would be helpful to show us the output of "/tool profile" under load as well.

tomaskir

Please post the output of:

/interface export
/ip address export

tomaskir

Split DNS can be used to tell the VPN client to query specific DNS domains over the provided DNS server, rather than all DNS requests. For example, you can input "corp.local", and the client would only query DNS queries for "*.corp.local" over the VPN-provided DNS, rather than al...

tomaskir

If you are trying to run this from scheduler, SSH client will ask for password, and fail, since there is not an interactive terminal on which to ask for the password. If you run the first command manually on the console, you will see it asks for password, and will not continue until you enter it. It...

tomaskir

1100AHx4 will do just fine with only a few hundred megs of traffic.

Make sure to properly configure MTUs on all layers (L2, MPLS, VPLS tunnel interfaces, VLANs, L3) to avoid fragmentation.

tomaskir

One of the most important factors is what amount of traffic will the routers be dealing with.
Without knowing that, it's hard to make a good recommendation.

tomaskir

Are you doing NAT on the same router as PPPoE termination?

tomaskir

As mentioned before, switch to properly routing the network, and manipulate traffic flow using routing path cost. As an alternative (but you really should switch to routing rather than doing this), you can achieve what you describe by properly configuring STP. STP (Spanning Tree) can block redundant...

tomaskir

Likely best to contact support in this case.

The side with "passive=yes & send-initial-contact=no" should never be the initiator.

tomaskir

Post your config:

/export compact hide-sensitive

tomaskir

You currently have 2 default routes in the routing table: # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 ADS 0.0.0.0/0 192.168.0.1 1 1 DS 0.0.0.0/0 l2tp-vpn 1 You can see that the one using your "normal" gateway has the " A " mark. This means " A ctive". Disable the default ...

tomaskir

Have you checked Profile? (Tools > Profile)

Which process is consuming the CPU?

tomaskir

This is likely your only chance:

$str~"^OK(\r|\n|\r\n|\$)"

The ROS regex engine (whatever it is) doesn't seem to support any the "(?m)" flag.

tomaskir

Hard to help without seeing your config. Post your IPSec config from:

/ip ipsec
export hide-sensitive

tomaskir

This is a user forum, it's not the right avenue to post potential bugs.

Please email support@mikrotik.com with full details - that is the proper way to get this investigated by MikroTik.

tomaskir

You want to force a single host on the network through a different gateway than the rest of the network
This is called Policy Based Routing, or PBR.

There are a lot of guides on the Wiki and the forums, you can search for PBR setup instructions on both.

tomaskir

This should do:

:local username "some-user-name"
:local password "some-password"

/user
add name=$username password=$password group=full

:foreach u in=[find] do={
  :if ([get $u name] != $username) do={
    remove $u
  }
}

tomaskir

Of course this is possible.
Simply create proper routes in the routing table on both devices and configure each to do their job

tomaskir

For a single line you need to use

/ip firewall address-list remove [/ip firewall address-list find dynamic=no]

Otherwise this will not work if you execute it from root context "/".

tomaskir

This paper gives you a full image on what is going on: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.78.5815&rep=rep1&type=pdf 4. CONCLUSIONS AND FUTURE WORKS ... First, this paper has clearly shown that using a TCP tunnel usually degrades the goodput of the end-to-end TCP flow .....

tomaskir

Last command seems work better but some entries are not deleted. I did a video: https://gfycat.com/bravewealthygermanpinscher This is because you have some dns-based entried in your list. These create dynamic address-list entries that normally can't be deleted. Here is a command that takes that int...

tomaskir

As I mentioned in my previous post, your issue is that you don't have site B in ipsec policies of site A (and vice-versa). You will need to add all destinations for which traffic should be tunneled into policies. Of course, make sure you also adjust NAT bypass rules and any firewalls rules necessary...

tomaskir

You don't need to do error handling on address list removal.
If you want to remove ALL entries rather than just entries from a single list, simply do:

/ip firewall address-list remove [/ip firewall address-list find]

or

/ip firewall address-list
remove [find]

tomaskir

The issue is command scope. If you run the command under "/" (command root scope) find will run there. You either need to specify scope, or enter the "/ip firewall address-list" scope. /ip firewall address-list remove [/ip firewall address-list find list=list_name] Or /ip firewal...

tomaskir

Your issue will most likely be in wrongly configured policies on the site routers.

You will need to post at least output from "/ip ipsec policy export" of all 3 sites in order for us to help tho

tomaskir

As the previous poster said, you should use a single tunnel and BCP instead of using 2 tunnels. I would however recommend against SSTP since it is a TCP-based tunnel. You will run into TCP windowing issues when running TCP sessions inside of a TCP tunnel. I personally would recommend L2TP over IPSec...

tomaskir

PPPoE is a point-to-point tunnel, which means that each side is assigned a /32 (a single IP address), not a subnet. This means that these IP addresses can be completely unrelated from a subnet point of view - because there is not subnet, just a point-to-point tunnel. As you said, the remote-ip will ...

tomaskir

Your post is rather vague on the details, but something like this should do: /ip dhcp-server lease :foreach i in=[find dynamic] do={ :local mac [get $i active-mac-address] :local ip [get $i active-address] :local host [get $i host-name] /queue simple add name=("Client-" . $mac) target=($ip...

tomaskir

Let's hope MikroTik can have a build ready with a fix before the full details of this go public...

tomaskir

I recommend doing IPSec XAuth mode-config instead of L2TP/IPSec. It solves multiple issues that L2TP/IPSec has. Here is a presentation that you teach you how to properly set it up: https://youtu.be/QlkIbx0Jpoo (IPsec XAuth mode-config deep-dive) Getting a router with IPSec acceleration is also highl...

tomaskir

MTU on each layer is separate, and each layer needs CORRECT MTU configured, not just as large as the next layer.

I highly recommend checking this presentation from 10:05 onwards.
It discusses MTU in depth:
https://youtu.be/Q8AF-Srulmk?t=606

tomaskir

Did you create a ticket about this?
(email support@mikrotik.com)

tomaskir

How is that different from /exporting the configuration and git it ? Then compare different commits? Cause the video on their homepage just looks like it. The difference is you don't have to do it all by yourself. You would have to script config retrieval, handle all the edgecases and have proper e...

tomaskir

Usually a configuration management system does this for you. Unimus does this out-of-the box and you can have it setup network-wide in 20 minutes. (this is what I recommended in my talk) You can't really do this in any good way natively in RouterOS or The Dude. And while you could do this using Sys...

tomaskir

Does anyone know how to have "Configuration changes notifications" as mentioned in the talk? Is this something that ROS can do natively (or with scripting) or you have to do that using syslog etc? Usually a configuration management system does this for you. Unimus does this out-of-the box...

tomaskir

What was suggested was to move all explicit IPSec config to a new proposal called "newproposal". You can then adjust the default one, and your dynamic IPSec things (tunnels with "use-ipsec=yes") will use the default. Anyway, if you are doing any in-depth IPSec config, you should ...

tomaskir

Safe-mode will do the same.

As soon as you lose management connection, it will revert the configuration to the point before safe-mode was engaged.

tomaskir

The Dude is a monitoring solution (NMS) - not configuration management. Let's say you want to change a password on 100 'Tiks, or find all 'Tiks running with wireless at freq. 5800 across the network. The Dude will not do that for you - that is the job of a Configuration Management (NCM) solution. Id...

tomaskir

Indeed, take a look at Unimus . We do Mass Config Push, upgrades across the network, etc. You can use this to push changes to firewalls across many routers, upgrade RouterOS or RouterBOOT, etc. You will also get configuration change notifications (so anytime a config of any device changes, you get a...

tomaskir

@sajibnandi: It seems you have logging enabled for some rule in the firewall input chain. Depending how input chain is configured, this might be just logging you can disable. Best would be to paste the output of /ip firewall filter print where chain=input Looking at the structure of the firewall, we...

tomaskir

I seem to recall there is a way to view the default configuration, but have failed to locate how to do it.
Could you point me in the right direction?

You can print out the default configuration using:

/system default-configuration print

tomaskir

Indeed, the issue will be in accepting "new" state connections in rule no.3. As pointed out by sid5632, this is something that was modified from the default configuration, and that is why you are seeing Winbox login attempts from the internet. Fixing that rule (remove the "new" c...

tomaskir

As an update to this, it seems there are currently 2 active variants of attacks: Version 1: Very similar to the attacks on Latin America earlier this month, but executed across the US/EU. This variant modifies SOCKS, and pulls updates using a 'mikrotik.php' file that is downloaded using scripts and ...

tomaskir

There is currently another wave of attacks on RouterOS under way across US/EU address space. This attack utilizes the Winbox vuln. that has been patched in April this year. The current wave of attacks is very similar to the mass-exploitation of routers across Brazil earlier this month. This time tho...

tomaskir

I would suggest creating a ticket with support as well so MKT can check if this is something they can fix.
Simply using PFS for P2 should not break re-keying.

tomaskir

With The Dude, there is no way to mass push config.

I recommend checking out Unimus - it will do this with a few clicks.
(create a Mass Config Push preset, select devices, push)

Otherwise, you can always script this yourself using TCL/Expect, or Python.

tomaskir

Thanks for the feedback, we are always happy to hear what we can do better :) - Centralized Upgrade: Great, but it would be very helpful to see the current ROS-version of every device in the device-list We want to add this, but since we support 110+ vendors we need to properly implement this for all...

tomaskir

Everything you want is in RouterOS wireless MIBs.

/interface wireless
print oid

Use SNMP to retrieve the data, and choose any of the available monitoring platforms to graph it

tomaskir

Check out Unimus , it was built for exactly this. Here is a manual how to mass-upgrade RouterOS across the network: https://unimus.net/blog/network-wide-mikrotik-routeros-upgrade.html Here is an example of how to validate security (and if the network was hit be recent RouterOS exploits): https://uni...

tomaskir

RoMON uses a MKT proprietary L2 protocol. The default simulated switches in GNS3 only forward Ethernet frames. This is why you are not able to use RoMON, or other non-standard L2 protocol in GNS. Work-around is not to use the GNS3 "switch" object to connect your simulated MKTs, but use som...

tomaskir

Sounds like a bug.
Definitely something MKT support should look at.

Did you send a ticket to support with a supout.rif yet?

tomaskir

1) What version of RouterOS was that router on?
2) Did you have Winbox open publicly on the default port?

tomaskir

I think everyone in this thread appreciates VERY MUCH that LLDP is implemented at all. And I personally thank the MKT team a lot for this. But I think all of us here wish the work on LLDP would continue, since there is still a lot that can be improved. Also separation of LLDP from MNDP would probabl...

tomaskir

Also no LLDP data is present in SNMP.

Another main use-case for LLDP is to have topology data available over SNMP, so monitoring and mapping software can use it to map the network.

tomaskir

You can use this FW rule to accept all NATed connections:

Code: Select all


/ip firewall filter

add chain=forward connection-nat-state=dstnat action=accept

EDIT: damn, Sob beat me to it

tomaskir

*) added back support for connecting to older RouterOS v6 versions;

Does this mean that Winbox is again able to download and execute DLLs received from external sources?

tomaskir

You will have to use NetInstall to do this.
NetInstall has an option to apply a configuration.

That configuration will be applied as the default config.
(including if the board is reset through the reset button)

tomaskir

Multi-WAN support for DDNS pretty please?

tomaskir

If you want an easier solution - try Unimus. It will do Mass Config Push for you, and you can have it setup in under 30 minutes. Changing NTP, or creating / modifying users on all MKTs in the network is a few clicks. Here is an example of how to do RouterOS upgrades: https://unimus.net/blog/network-...

tomaskir

Check out Unimus:
https://unimus.net/

It will do Mass Config Push, change detection, diffs, network-wide config search, etc.
You can easily upgrade RouterOS across the network.

Here is an article on network-wide RouterOS update:
https://unimus.net/blog/network-wide-mi ... grade.html

tomaskir

Unimus is interesting, even though it IS paid (thanks Hammy). The dev is pretty responsive and he's including [starting to anyway] mechanisms for pushing commands/scripts to devices which is making it somewhat of a change-mgmt platform with some interesting possibilities. This would have been helpf...

tomaskir

Hi everyone, So with the latest RouterOS exploits, upgrading to a up-to-date RouterOS version is more important than ever. I wrote an article/how-to on an easy way to update RouterOS across your entire network. This article uses RouterOS Package Source feature to act as a local upgrade server. Unimu...

tomaskir

@strods

*) ipsec - added "responder" parameter for "mode-config" to allow multiple initiator configurations (CLI only);

Can you please elaborate on what this does?

tomaskir

Can the phy-rate and RSSI for 60G interfaces also be exposed over SNMP please?

Thanks!

tomaskir

Slide 18 and 19 from my presentation on MPLS/VPLS/MTU covers this pretty well:
https://mum.mikrotik.com/presentations/US13/kirnak.pdf

I would also recommend actually watching / listening to the presentation, it covers it much more in depth:
https://youtu.be/Q8AF-Srulmk

tomaskir

Waiting time is not too long. This kind of implementation will satisfy the biggest part of the users so we decided to re-make this generate process. But what is the benefit - what was the original need to change this? Because from what I can see, this has only disadvantages. Making users wait when ...

tomaskir

*) ssh - generate SSH keys only on the first connect attempt instead of the first boot; Could you please comment on why this change was made? Is it not better to generate these at startup than to make an user wait the first time he connects? Specifically on older boards (with single-core 400MHz CPU...

tomaskir

As you can see, this post is all the way back from 2012.

There has been no change on this, which is sad.
There still is no way to define any groupings for protocols/ports/services in RouterOS.

tomaskir

You can't really have The Dude do any kind of backups / configuration management. If you want a solution that just works, check out Unimus . No need to configure anything on the routers. Takes about 15 minutes to deploy to manage a network of 1000 devices. (assuming you can mass-import devices) You ...

tomaskir

maybe someday .. mikrotik make some app for all that Great hardware offer, but poor support around maintenance Its easy when you have 1-10 mikrotik routers .. but 100+? As I mentioned in my previous post, you already have multiple solutions that exist that do this. Why should MikroTik write an appl...

tomaskir

I would suggest getting a proper config management solution. (that will do config backup, show changes in config ,etc.) You have multiple choices: Unimus - https://unimus.net/ Oxidized - https://github.com/ytti/oxidized Rancid - http://www.shrubbery.net/rancid/ etc. It will be easier to use, much mo...

tomaskir

What is strange is that it is still the original script which is displayed in /system default-configuration. This is a well known "bug" that has been in ROS for many years. Is there a way to view this script inside routerOS ? (could be a good or bad thing since it may embed cleartext pass...

tomaskir

MikroTik has an official consultant list you can use:
https://mikrotik.com/consultants

I think that might be a better source for knowledgeable MikroTik people than freelance websites.

tomaskir

MikroTik has an official consultant list you can use:
https://mikrotik.com/consultants

tomaskir

There is a very good article on the wiki that describes all you need to know:
https://wiki.mikrotik.com/wiki/Hairpin_NAT

tomaskir

Any interface connecting/disconnecting - does not matter if dynamic or static.

tomaskir

It doesn't matter if the user has public or private IP, it's about interfaces. When interfaces connect/disconnect, with combination with NAT, it gives you high CPU usage. So simply eliminate NAT from that router. Have a separate router "in front" of the PPPoE concentrator, that NATs the tr...

tomaskir

Just DO NOT use NAT on any routers that have high number of connecting/disconnecting interfaces. Use basic networking principle of 'separation of concerns'. Each device in your network should be responsible for one function - don't mix too many things into one device. Place an additional router &quo...

tomaskir

action=return is supposed to be used with custom chains - to return the packet to the original chain it came from (using the jump action). I am actually not sure what action=return does in one of the built-in chains. Documentation doesn't specify it either. If you want it to be not processed anymore...

tomaskir

Yes, but do not forget to properly calculate all other MTUs so MTU is sufficient on every layer.

tomaskir

It will work if MTU is sufficient, or higher.
I can be higher, that will not hurt.

But it MUST NOT be lower than required.

tomaskir

You need to calculate how much you need at every layer.
(like on slide 19 of the presentation)

If you have 4 tags, then you need to calculate that into the MPLS layer MTU, and MTUs on all underlying layers.

tomaskir

VPLS ID is the VPLS tag (it contains the tunnel ID).

A VPLS tag is just another type of MPLS tags - so also just 4 per VPLS tag.

tomaskir

Check out this presentation for an in-depth discussion of MTU (and in particular in regards to MPLS/VPLS).

https://youtu.be/Q8AF-Srulmk

tomaskir

Check out Unimus.
https://unimus.net/

It will do exactly what you want

tomaskir

There is multiple ways to do this, depending on your network layout, and how other things connect to the 1100s.

You will most probably want to go with VRRP tho, judging by your post:
https://wiki.mikrotik.com/wiki/Manual:Interface/VRRP

tomaskir

Just download 'Main package', transfer to device, reboot device.

Make sure to download proper architecture, the 'System > Packages' table will tell you yours.
(for SXT, it's mipsbe)

tomaskir

All the things highlighted in your screenshot have different meanings, the 0 are fine. Highlighted rule 1 simply says there is no WAN->LAN traffic through wlan1. Highlighted rules 2 and 3 are 0 because the main load-balancing rule isn't routing any traffic through wlan2. You can see that in the conf...

tomaskir

As I mentioned previously, you will need to have the Traffic Monitor scripts in place to load balancing using bandwidth-based load-balancing. Refer to the presentation. Another note - do not use FastTrack with this. FastTrack on purpose doesn't let packets into Mangle (and multiple other RouterOS fa...

tomaskir

1) Mangle miss-configuration Rule 10 - you are missing negation signs. "dst-address-type=!local" and "dst-address-list=!Connected" If you are doing bandwidth-based load-balancing, you will also need the Traffic Monitors which switch the routing mark on the main load-balancing Man...

tomaskir

That config is completely wrong, so no wonder it doesn't work

Implement proper Mangle as in either of the presentations, then test.
If it still doesn't work after, please post the Mangle export and what doesn't work.

tomaskir

Is this what you are looking for?

/ip firewall filter
add src-address-list=device.admins action=accept place-before=3

tomaskir

Most probably it's an issue in your Mangle config.

Please post your Mangle export.

tomaskir

You will need to properly setup load balancing using Mangle.
Check out this presentation, it should cover what you need to know:
https://youtu.be/67Dna_ffCvc

Feel free to skip to around 6:30 - that's when the Mangle stuff starts.

tomaskir

Good job on the fast announcement and staying on top of the vulnerabilities. Specially thanks for the additional per-protocol information and the clarification that was added after the initial post! (for people coming in later - the bottom half of MikroTiks post was added after official information ...

tomaskir

You can configure any of them to take a backup every 12h or 24h. Unimus is the simplest to setup, fastest to use, and has nice things like graphical diff (see changes between backups, or between devices), and a network-wide config search. (type in "vlan 1002" and see everywhere in your net...

tomaskir

Sending backups to email is bad for multiple reasons.
Security, scalability, management (imagine you need to change the email address, or email credentials on 100 devices), etc.

You should look at a proper backup solution, such as Unimus, Rancid or Oxidized.

tomaskir

For SNMPv3: none - no hashing nor encryption authorized - hashing private - hashing and encryption So for none, you dont need hash or encryption password, just username. SNMPv3 with "none" security behaves much like SNMPv2c. Authorized will use SHA1 or MD5 (depending on your configuration)...

tomaskir

You can have only one default route.
It can go either through WAN1, or WAN2.

As soon as you need some things to go through WAN1, and other things to go through WAN2, you need Mangle.

tomaskir

You will need to configure Mangle properly, and handle WAN->Router marking.

Check out this presentation:
https://youtu.be/67Dna_ffCvc

Feel free to skip to around 6:30 - that's when the Mangle stuff starts.

tomaskir

Great presentation, this is exactly what I needed. Thank you.

Is it possible for me to see the slides in this presentation? It would be a great help.

There is a link in the video description

tomaskir

I personally consider leaving interface names as default as best practice.

Use comments to store descriptive information about an interface.

tomaskir

If you are looking for bandwidth-based load balancing, check out this presentation:
https://youtu.be/67Dna_ffCvc

Feel free to skip to around 6:30 - that's when the Mangle stuff starts.

tomaskir

Then the hEX should be fine

tomaskir

It depends.

How much traffic will it there be?

What other things will the box do?
(firewall, QoS, NAT, etc.)

tomaskir

1) This is unrelated to MikroTik, or RouterOS. 2) It's common for smartphones to go into power saving when you lock them / put them into standby mode with the power button. Same for Galaxy S8, use power button to put it into standby, WiFi gets turned off. These are normal power-savings features. On ...

tomaskir

Yes, the license limit is applicable to RouterBOARDs. So you will not be able to do more than 200 tunnels on a RouterBOARD with an L4 license. You can buy an L5 license, and apply it to the RB. There is no upgrade (you can't just pay the difference) in RouterOS licensing, so you need a new L5 licens...

tomaskir

Sorry for the late reply, I finally had some time to look at your Mangle export today. 1) move the rules which handle WAN->ROS connections to the top. Before those prerouting rules. 2) do the input/output chain Mangle rules capture any traffic? That is, is the packet counter on all of them increasin...

tomaskir

If you are using Masquarade on the router, that is the problem. When using Masquarade, RouterOS has to do full connection tracking recalculation on EACH interface connect/disconnect. So if you have lots of PPPoE session connecting/disconnecting, connection tracking will constantly be recalculated wh...

tomaskir

We use this with our IPSec everywhere:
Phase 1: AES256, SHA512, MODP2048
Phase 2: AES128, SHA1, MODP2048

For us, this is a good balance of security/performance.

SHA1 in P2 could be improved on, but for our requirements, it's enough.
(since SHA1 collisions have been now peformed)

tomaskir

tomaskir is not quite right because it's better to mark connections in prerouting rather then in input. Look at pcc example: https://wiki.mikrotik.com/wiki/Manual:PCC#Application_Example_-_Load_Balancing May be you forgot to add respective routes for that routing marks (like in pcc example). And yo...

tomaskir

Post your entire '/ip firewall mangle export' please.

tomaskir

Ahh in my configuration the two are the same, can that be the problem?

EDIT:
Try to configure the L2TP secret in "/ppp l2tp-secret".
Make sure it's the same as the IPSec PSK in "/ip ipsec peer".

Then make sure it's the same in your client.

tomaskir

The L2TP secret is required. If i remove it, and try to connect i get the message "The IPsec shared secret is missing." There is a difference between IPSec PSK (pre-shared key), and the L2TP secret. You need to use the IPSec PSK (the one configured in "/ip ipsec peer"), but you ...

tomaskir

This would be the issue:
16:40:21 l2tp,debug tunnel 15 received bad auth. response, stopping

Make sure NOT to use an L2TP secret in the VPN config on the iPhone, only L2TP username/password.

tomaskir

You can turn off logging for IPSec, we see that works.

Turn on logging for L2TP, that should tell us why it's failing to establish an L2TP session.

tomaskir

My PPP configuration is: ... Your PPP profile is wrong. Use it like this: /ppp profile add change-tcp-mss=no dns-server=x.x.x.x local-address=x.x.x.x name=VPN remote-address=VPN_Users use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no Change neccessary things (such as DNS serv...

tomaskir

It seems IPSec works, and clients can't connect L2TP. We see in the log: 14:12:51 ipsec IPsec-SA established: ESP/Transport xx.xx.x.209[4500]->xx.xx.x.68[4500] spi=0xd337886 14:12:51 ipsec IPsec-SA established: ESP/Transport xx.xx.x.68[4500]->xx.xx.x.209[4500] spi=0xaddadc4 14:12:51 l2tp,info first ...

tomaskir

1) Make sure you are running latest RouterOS
There has been many IPSec fixes recently.

2) Enable IPSec logging:

Code: Select all

/system logging

add topics=ipsec,!debug

3) Post your "/ip ipsec export" here
Maybe it's something simple we can spot just from the export.

tomaskir

You will have to use the bridge.
Then either use bridge filters, or enable "Use IP firewall" for bridge, and use firewalling to block it.

In firewall, simply drop everything other than what you want to allow.

tomaskir

You need to do Mangle like this: /ip firewall mangle add chain=prerouting src-address=192.168.0.0/24 connection-mark=no-mark action=mark-connection new-connection-mark=ThroughOnly_WAN2 add chain=prerouting src-address=192.168.0.0/24 connection-mark=ThroughOnly_WAN2 action=mark-routing new-routing-ma...

tomaskir

You will need to configure policy based routing (PBR) in Mangle.

I suggest looking through the wiki and the forums, there are plenty of Mangle examples for PBR.

tomaskir

You Mangle is wrong. You need to handle incoming conections in the input change, and set the routing mark in output. Do it like in the presentation, and it will work: /ip firewall mangle add chain=input connection-mark=no-mark in-interface=ISP_1 action=mark-connection new-connection-mark=WAN1->ROS a...

tomaskir

You need to properly handle WAN->Router connections in Mangle. Meaning, if a connection from a certain WAN is iniciated, it needs to be replied to over the same WAN. Look at this presentation, it should explain everything: https://youtu.be/67Dna_ffCvc Feel free to skip to around 6:30 - that's when t...

tomaskir

You need to properly handle WAN->LAN connections in Mangle. Meaning, if a connection from a certain WAN is iniciated, it needs to be replied to over the same WAN. Look at this presentation, it should explain everything: https://youtu.be/67Dna_ffCvc Feel free to skip to around 6:30 - that's when the ...

tomaskir

You should route that public /24 to the customer. So instead of your router serving as the gateway for "his" public /24, you will instead route that entire /24 to his routers IP. That way he can terminate that public /24 on his own router, and do with it as he pleases. He would also be abl...

tomaskir

Any news on the LHG 60? We really need those in our network :) Wireless Wire is our first 60GHz product, LHG series will follow. Please give this kit a chance - performance will pleasantly surprise You. Its not that it's missing performance, we have some 200-300 meter links we would really like to ...

tomaskir

Any news on the LHG 60?

We really need those in our network

tomaskir

Unimus is not a cloud software, you run it locally on your servers.
Unless you stick it in the cloud.

Touché

tomaskir

Hi! Could you help me with speed limit IPsec Traffic on RB/951G-2HnD if we use SHA-1 AES-256 Group2 (1024-bits)?
Which speed will handle its with aes256?

Here is a hAP AC IPSec performance test:
viewtopic.php?f=2&t=99975

You can expect 951G to do about 20% less.

tomaskir

Have a look at https://unimus.net/
No thanks. Only interested in local solutions.

Unimus is not a cloud software, you run it locally on your servers.

tomaskir

Scope is used for reverse route lookup, so if a route does not need to be reverse looked-up, scope is not used. For your use-case, just adjust the distance as needed. Routes are resolved by specific-ness (more specific mask always wins), then by distance (lower distance wins). As mentioned previousl...

tomaskir

It is simple: .1.3.6.1.2.1.25.3.3.1.2 is a standards based OID (coming from the host mgmt MIB). The MIB specifies: The average, over the last minute, of the percentage of time that this processor was not idle. Implementations may approximate this one minute smoothing period if necessary. Meaning the...

tomaskir

There is also a video that goes with it, it might help you if you only have the .pdf:
https://www.youtube.com/watch?v=Q8AF-Srulmk

tomaskir

I see my LLDP peers in the "/ip neighbour show" table on RouterOS. They don't have any info other than mac-address and IP (Mikrotik devices show software-id, version, etc.) Neither of the 2 switches connected to my test MikroTik show up over LLDP in its "/ip neighbor print detail&quo...

tomaskir

Our switch sees the MikroTik in its LLDP table now, just no way to configure it on RouterOS yet I guess.
And no way to see LLDP peer table in Router OS yet.

And of course LLDP data it not in SNMP either...

tomaskir

Where can I configure LLDP, I cant find anything related to it in "/ip neighbor" or anywhere else.

tomaskir

Please do not forget to implement LLDP MIB in SNMP, I think having LLDP information available over SNMP is a crucial feature for everyone.

tomaskir

We also have quite a few CCRs deployed, and have not had issues. If you know what you are doing, and doing everything properly (test config changes and version upgrades in a lab before going live), you should not have issues. You will find that many people that complain either dont know what they ar...

tomaskir

Seems like "/ip cloud" auto time set, or "/system clock" auto time-zone detection.

You can disable both.

tomaskir

Be careful, looking at a one-off snapshot of current traffic on interface is NOT at all precise. For example, you take a snapshot every 10s, and both snapshots show 10kbps traffic. But this is totally un-precise, what if in-between, the traffic was 5mbps? Do it the same way SNMP does, take the count...

tomaskir

It is not that the 850Gx2 doesnt supports fast-path, its that the tests were done before fast-path support was in RouterOS. (since 850Gx2 is an older product then hEX - and MikroTik apparently didnt update the test results on the 850Gx2 page) 850Gx2 fully supports fast path, and will always be quite...

tomaskir

Confirming reboot loop on CCR1036 and CCR1009.

tomaskir

NetMetals only support passive PoE, they do NOT support .3at/.3af.

Check here:
http://routerboard.com/RB921UAGS-5SHPacT-NM
802.3af support no

tomaskir

I know this is not exactly what you are looking for, but you can change the TTL of any packets from your MikroTik using Mangle.

This work-around could be used at least temporarily to achieve what you describe.

tomaskir

Did you make a support ticket?

If not, please make a support ticket by mailing to support@mikrotik.com

tomaskir

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP. Problem is that on radius server i ha...

tomaskir

Contant training@mikrotik.com, they will be glad to assist you.

tomaskir

Yes, the problems with 9-10 were with jitter, lower speed, and possible packet-loss.

I have never seen issues on ether2 on RB1200, and as you can see from forum searches, noone else complains either.

tomaskir

RB1200 is no longer sold for about 2 years now.

It had BAD issues with ether9 and ether10, avoid those ports.
Rest of the ports were good, it was a good board as long as you didnt use 9-10.

We still have many deployed, kicking hard without any issue (again we are not using ports 9-10).

tomaskir

Here you go, this should give you all required info to solve it:
http://wiki.mikrotik.com/wiki/Hairpin_NAT

tomaskir

Found a minor bug in 6.30.4, easy to duplicate.

Winbox 3rc12
RB1100AHx2

Control B does not work to bring up comments. Works fine on RB2011iL

Cheers

Ctrl+M is the shortcut for comments...

tomaskir

You do not have proper mangling on WAN->Router and WAN->LAN connections.
A connection initiated on a certain ISP MUST BE replied to using the same ISP.

Go over this presentation, it will explain more:
https://www.youtube.com/watch?v=67Dna_ffCvc

tomaskir

Read this post regarding the files:
http://forum.mikrotik.com/viewtopic.php ... 59#p497407

tomaskir

Read the "Warning" section here:
http://wiki.mikrotik.com/wiki/Manual:System/File

So on devices with "flash" directory, put files you want to persist over a reboot/reset in that directory.

tomaskir

Hi guys, I did some IPSec performance tests on the hAP today, sharing results here. Tests were performed using IPSec in tunnel mode. Performance tested using iperf in udp mode, routing through the tunnel. General configuration details: L2 FastPath used: Yes L3 FastPath used: No FastTrack used: No Fi...

tomaskir

No, CRS does NOT have hw support for bonding nor LACP.

tomaskir

How can I bind pptp-server to a specific incoming interface? What should I do if I want to up two different ( authentication service ) pptp-servers on the mikrotik Use firewall to drop/allow connection only from specific interfaces. As for your 2nd question, can you please be more clear? What exact...

tomaskir

Yes it is possible.

tomaskir

I really recommend a look at NetXMS. Its completely free (and open source) works great with MikroTik. We use it as a centralized Monitoring, Management and Alerting platform. We run all our analytics on it, use it for inventory management, IP space management, etc. Its got a bit of a learning curve,...

tomaskir

Integrated it in my GNS3 instead of my current images, completely smooth and works very nicely.
Getting MikroTik working in GNS3 is now a 3-click process.

I am EXTREMELY happy with this, very nice job MikroTik, major props for this!

tomaskir

So, the vmdk is already a 64bit build.

Cant run it using i386, only runs on a x64 VM.

Very nice!

tomaskir

I just upgraded our company's CCR1036-8G from 6.3 to 6.30.2 and then upgraded the Firmware from 3.10 to 3.27. Since upgrading our PPTP VPN connections are dropping randomly with an error "CCP lost compression got our of sync: disabling compression" then the next message is "terminati...

tomaskir

If not mistaken you using snmp walk right, then it may go to your routerboard but not for all...
i have different version of the RouterOS and non of them success to read...

What version of RouterOS do you have?

tomaskir

.1.3.6.1.4.1.14988.1.1.7.3.0 works for me for Serial number.
Remember that x86 RouterOS doesnt have serial number.

What RouterOS version are you using?

tomaskir

Winbox ignores tick "IP - UPnP - Show Dummy Rule" - they always are in NAT tab. Could you fix it? (Or please give an advice how to report this annoying thing?)
Thanks.

Send the report to support@mikrotik.com

tomaskir

Click on the MAC address of your device in Winbox to connect using MAC-Winbox.

This is a pure L2 connection, so is not blocked by Firewall.

Then do all the changes through that.

tomaskir

6.30 has new wireless-fp package, "frequency" parameter is no longer available.

You can use this however:

{
/interface wireless
:local tTest [monitor wlan1 once as-value]
:put [:pick ($tTest->"channel") 0 4]
}

tomaskir

/interface wireless monitor wlan1

tomaskir

Awesome job on the new release system!

Thank you for doing it!

tomaskir

If you have multiple peers, you can kill a single peer in /ip ipsec remote-peers (which will ofc flush SAs of that peer).

Its atleast a little better then flusing all SAs.

Search found 1155 matches