MikroTik

nbeacham

We just found that removing all connections in ip->firewall->Connections that this resolved the issue for all clients...Any idea why this would be?

nbeacham

We are running into a problem where a Mikrotik will reload, once it comes back up some clients authenticated through the hotspot can no longer get online unless we remove their DHCP lease and have them reload the router. We are using Hotspot to authenticate and authorize LAN clients with MAC authent...

nbeacham

Is there a way to create a simple queue when using DHCP Radius and User Manager? I've set up the profiles and was able to get DHCP Radius to work with User Manager, but no simple queue is created. Is there a way to go about this?

nbeacham

We have several hotspot deployments and have ran into a problem where they are being used as an Open Resolver in DNS slow drip DDoS attacks. We have tried to mitigate it by dropping input packets destined for UDP and TCP port 53, however this seems to effect our clients. The reason this is impacting...

nbeacham

It's such a minor problem that downgrading isn't necessary. It's a quirky problem thus the post, but not service impacting. Also, it's only on this CCR, we have several deployed that are experiencing no issues with the latest OS.

nbeacham

We actually haven't tried a reboot since this issue popped up. This only started happening after we rebooted it a few nights back after our fiber went down and the Mikrotik didn't recover for some reason. I'm beginning to suspect the Mikrotik may be bad, we've updated the OS to the latest as well.

nbeacham

I just tried to switch it to on and that didn't seem to do the trick. I'm still seeing the same symptoms.

nbeacham

So we ran into a small issue today. We have a CCR that we've configured with the switch settings. One of our devices behind it stopped responding to pings and remote management but was still passing traffic. While troubleshooting I started to torch the interface and it started responding to pings. t...

nbeacham

Have you tried using an EoIP connection instead of a GRE? :D While I've considered it, It's not the technology we want to implement in this case. I don't think it's the GRE causing the problem, I think it's a problem with my routing or firewall. I can ping the IP address of the VLAN 10 interface, b...

nbeacham

I changed the Tunnel but that didn't seem to do it. I'll have a look around, it might be in my firewall rules. Here is one end src-address=207.x.x.29/32 src-port=any dst-address=68.x.x.226/32 dst-port=any protocol=gre action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=207.x.x....

nbeacham

I have a setup where I'm managing some devices behind a GRE IPSEC tunnel. I can ping the VLAN interface itself, but anything behind it I can't ping. I've pasted in my scrubbed config below. Any assistance would help. set [ find default-name=ether1 ] comment="Springs @ Estero" set [ find de...

nbeacham

I ended up doing this via lease scripts. I'm getting the IP and the bound MAC ID and sending it to a remote server to store in a mongoDB collection. I then run that collection against my Subscriber collection to find the associated the MAC ID and reference the IP to that subscriber. Because I can ch...

nbeacham

I'll try to be brief with this. Currently, we have a customer 'walled-garden' in place where a user enters their account number and pin. It authenticates to a mongoDB to verity they are active and then utilizes the Mikrotik API to create the user on the Mikrotik and activate the host. We are looking...

nbeacham

We have a CCR1009-8G-1s-1s+ running version 6.15. Recently, the admin password has been defaulting on it's own leaving a blank password. Nothing in the logs indicates why this is occurring. I don't know what time frame it's happening in, but I know when I set the password back on the admin user and ...

nbeacham

I'm in a situation where I need to log in a database the time, date, IP address, and MAC address every time a DHCP lease is assigned on the Mikrotik. We have several deployed, and I don't have any backend system set up yet but I want to know if anyone is doing anything like this and how they are doi...

nbeacham

RB2011UiAS and SNMP don't seem to get along. I'm running both v6.14 and 6.19 on two seperate devices. Both seem to peg out the CPU when doing an SNMP walk on them, more specifically when it gets to the arp/ndp table portion. It will hang there for about 200 seconds before moving on. Anyone else seei...

nbeacham

We are deploying a new property and offering 100Mbps download and upload to all users. We have the mikrotik serving DHCP from a /25 pool. Typically we use hotspot with MAC authentication for customer queuing, but because we are offering the 100Mbps to all customers, I'm trying to find the most effic...

nbeacham

input - used to process packets entering the router through one of the interfaces with the destination IP address which is one of the router's addresses. Packets passing through the router are not processed against the rules of the input chain

nbeacham

I have a customer who wishes to be able to access their personal Mikrotik that is behind our hotspot via port 8291 and it doesn't appear to be working. They also wish to access port 4242 as that is what they have their SSH services set up as. I've tried the following filter rules and they don't appe...

nbeacham

Are you going to be doing just BGP and routing, or are you going to use filters on the traffic as well? We have 3 in production doing multi gigabit routing, each with full BGP tables from at least 3 peers, and they aren't breaking a sweat. We don't have any queues or firewall filters though, so I c...

nbeacham

We are a small sized ISP looking to expand. Currently supporting +/- 3000 customers with the potential for more in the coming years. We are looking to replace our 7204 core router that currently handles BGP Peering and routing for our entire production and management network with something different...

nbeacham

You can switch to MAC authentication and set their user name as the MAC address.

nbeacham

Is there a routerboard other then the CCR that has duel SFP ports? We are wanting to replace a Edgerouter with a Mikrotik to utilize the hotspot functionality, but require two SFP ports.

nbeacham

certainly, just as soon as I re-install it. I forgot to apply a license to it after I installed it and essentially bricked it until I can re-flash it.

nbeacham

PRTG isn't free, nor do i think you can manage mikrotik with it.

I'm looking for something built around the api where i can manage each device.

nbeacham

Again, I think you are confusing throughput with link capacity. The throughput is only what is currently passing through the AF. So what you are seeing may actually be what is passing through. To get a proper performance metric, you would have to run a traffic generator. As I have a production link,...

nbeacham

Note that the throughout is the current throughout across the af. It's doubtful that anyone is pushing near a gig at any one time unless it's a backbone connection.
Our one link is roughly 1km and only ever has about 20Mb going across it. But it has a capacity near 740Mb

nbeacham

Thank you blue

nbeacham

When I get to the office I'll post the current speed and distance. But if the answer is simply that there is no comparable antenna, than thank you. And we are using af24

nbeacham

Yes. However i don't see how that pertains to my question.

nbeacham

Does Mikrotik/Routerboard manufacture an antenna that can get similar link speeds as AirFiber?

nbeacham

Actually, we found that I can remove the compact flash card and netinstall to it.

nbeacham

Is there any other solution other than The Dude and MikroBill that allow me to manage all my Mikrotik's and implement billing in the future?

nbeacham

This worked wonderfully, thank you very much.

ros code

:foreach tmpHost in=[/ip hotspot host find where !authorized] do={
  :local hostMAC value=[/ip hotspot host get $tmpHost value-name=mac-address];
  /ip hotspot user add name=$hostMAC profile=5/5;
  /ip hotspot host remove $tmpHost;
}

nbeacham

I'm trying to write a script that will create a hotspot user based on the unauthorized dynamic hosts in the hotspot. This is a one time script that we will use to quickly turn up a hotspot device and then we will apply proper queuing after the fact. Because we are using MAC authentication, I'm tryin...

nbeacham

How would one go about installing routerOS on a powercode NX216 BMU? We will have a few unused ones and would like to recycle them into routerOS devices.

nbeacham

I've the same problem on 6.11

nbeacham

I'm having this same problem with apple products and the hotspot. I have to create a bypass also. If you build a simple queue targeting the users ip, it at least throttles them. Would be nice to know a walk around. I use Mac authentication for my login.

nbeacham

No one has any performance statistics they are willing to share?

nbeacham

We are looking at options to replace our 7204VXR. The CCR1036 looks more than capable of doing what we need. We only have 1 uplink at 1 GB with one BGP peer. There are approximately 72 sub interfaces configured, this is our core router and all traffic comes through it. My question is, does anyone cu...

nbeacham

this method seems to have worked with both simple queues and PCQ queuing. I appreciate it.

nbeacham

Thank you, I'll give it a shot Monday

nbeacham

According to this mum it can be done. http://mum.mikrotik.com/presentations/US10/FelixWindt.pdf I'm sure it can be done with authorized users, but I've no idea how. It also says it's possible in the official documentation. We are utilizing mac authentication for our clients as it is. http://wiki.mik...

nbeacham

Essentially I want to offload the dns to another sever so that the router isn't handling dns requests. How can this be done? I've seen it mentioned a couple of times, but have seen no examples if how to do it.

nbeacham

With out using user manager, I want to know if there is a way to redirect unpaid users to a page informing them they have been disconnected until they call in to make a payment. I've thought of making a specific profile that will add an incomming and outgoing packet mark and then redirect based on t...

nbeacham

That has been done. Thank you again for all of the assistance.

nbeacham

Okay, so I got it working. I moved ether1-vlan10 and ether1-vlan30 to the ether2-master-local interface. I then added ether1-gateway as a slave of ether2. Vlan table is as such add independent-learning=no ports=ether1-gateway,ether2-master-local,switch1-cpu switch=switch1 vlan-id=10 add independent-...

nbeacham

Thank you very much for the support.

nbeacham

I'm on my phone now, but I can give a mini answer. Basically you can either make all the ports part of the switch group and then use the switch chip to do it... Or you can add vlan10 to ether2 and use a bridge. Sent from my SCH-I545 using Tapatalk Okay, when I tried to bridge it last time I lost al...

nbeacham

Here is a basic pictures of what I mean.

Red = VLAN 10
Black = VLAN 30

The remaining three colors are Vlans 100, 200, and 300.

nbeacham

Okay, this kind of worked. Now, say I have switches on the local side that I want managed in VLAN 10, how can I do that? I currently have one that I cannot get management to on VLAN 10.

So I want VLAN 10 to also be trunked along side VLAN 100, 200, and 300.

nbeacham

Thank you for this. Would I then set my IP address that is currently tied to Ether1 onto VLAN30?

nbeacham

What about NAT? ... and traffic between the VLANs? DHCP servers for the VLANs, etc. Oh... and what model RB is this? -Eric NAT is not required, nor is traffic between VLAN's 100,200, and 300. DHCP is being handled by the hotspot. One hotspot will be set up per VLAN. Note, the customers get a public...

nbeacham

Here is my goal. Please take note, this is all being done in a lab environment at this point. The site has three VLANs 100,200,300 Each corresponds to a floor in the building, each floor with it's own switch. Currently, those switches are managed with a public IP address from the customers scope. I ...

nbeacham

i've since taken the bridging out. I had a management bridge with MGMT and Ether3 on the bridge. Here is my entire config as of now. /interface ethernet set [ find default-name=ether1 ] name=ether1-gateway set [ find default-name=ether4 ] master-port=ether3 set [ find default-name=ether5 ] master-po...

nbeacham

I'm trying to pass the management VLAN 10 from the WAN side to the LAN side so we can manage all devices (switches, AP's) on one single VLAN. This VLAN is trunked from our core network to the site, however I can't seem to get it to work. I have set VLAN 10 on the Mikrotik under the ether1-gateway in...

nbeacham

Be sure you allow remote requests in the dns settings.

Sent from my C5170 using Tapatalk

nbeacham

There are 68 hotspot users. I haven't disabled any services or packages. OSPF is running on the Mikrotik advertising 4 networks but not receiving any advertisements itself.

nbeacham

Whenever we do a bulkwalk on RB2011 running 6.5, we see a spike in CPU load ranging from 20 to 30%. This is not acceptable during high utilization times when users are most active.

I have no idea where to start debugging this and would greatly appreciate some assistance.

nbeacham

That's what I'm doing now, dropping all input traffic.

Sent from my C5170 using Tapatalk

nbeacham

Well, I guess that's what we will have to do. I believe we may have found what was happening in our initial run. Even with no customer traffic on it, the CPU was at 100%. Because it was acting as a DNS server, a foreign address was sending multiple DNS requests to it. I've since mitigated that and h...

nbeacham

Is there a way to do a performance test using the traffic generator and another Mikrotik to measure the performance based on x-amount of hotspot users? I want to see what the limitations of my RB2011 will be before deploying it in a production environment as our last run didn't go so well. I also wa...

nbeacham

Is it possible to utilize the hotspot and switch chip features in one? Say i have to route 4 vlans, would it be beneficial to set vlan trunks in the switch chip for better performance and then set a hotspot under the vlan interface.

Sent from my C5170 using Tapatalk

nbeacham

We are trying to use just the hotspot with no PPPoE. We have 4 VLAN's coming in on one interface that then route out the WAN interface. It works, but users are getting slow speeds and we can't seem to figure out why.

nbeacham

If you not really need that,
set transparent-proxy to yes
and check how many RAM you have onboard

and upgrade to 5.26 [and better to 6.7]

What impact does transparent proxy have on it? I to am having similar issues where users are getting very slow speeds.

nbeacham

Regularly have 200 users on rb2011 / rb951 with circa 45% CPU Seen 2000+ on a RB1100AH peaking around 14% CPU These are concurrent users, not total paying customers. Thats using lots of VLANS, bridge firewall and software buffer on the interface (slower) I know this is an older topic, but I want to...

nbeacham

I'm looking for the best setup to get 200 plus users that will be queued on a hotspot. Our first solution with a rb2011 doesn't seem to hold up to the demands.

Sent from my C5170 using Tapatalk

nbeacham

That was my assumption. The 600mhz processor just isn't enough. We want to use this application at bigger sites. Is there a model you recommend that won't break the back?

nbeacham

We have a rb2011uas running as a hotspot with roughly 190 users. They come in on one interface from 4 vlans. During peak traffic time the cpu is maxed at 100% and users complain of slow speeds. Each is applied a profile to be shaped accordingly however they are getting well below what they should be...

nbeacham

So we had the WAN point to point on a private IP. Once we changed that to a public IP it worked jsut fine. Is there a way to change the source address for DNS requests from the mikrotik?

nbeacham

I'm in need of assistance. We are trying to implement a hotspot at a property and users can ping and browse by IP but DNS is not working. Let me know what information you need and I can supply it.

nbeacham

Okay, so what I'm looking for is something similar to this Core router interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 10.10.10.1 255.255.255.252 Site router interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 10.10.10.2 255.255.255.252 The site router will be a mikro...

nbeacham

I've a bit of a dilemma. I'm trying to uplink to a Cisco subinterface that is encapsulated with dot1q. I can't seem to figure or how to get this to work. I'll post configs tomorrow, but for now does anyone have any suggestions?

Search found 73 matches

ros code