MikroTik

mixig

VRRP requires the Master and Backup routers to be on the same subnet or VLAN for proper communication. Introducing a routing device between them can disrupt the VRRP operation by blocking or not forwarding the necessary multicast/broadcast traffic. Therefore, to ensure VRRP functions correctly, the ...

mixig

viewtopic.php?t=182188

mixig

Invite from outside should come with public IP not private IP of mikrotik.

Can you put mikrotik config here?

mixig

Still nothing, no bgp multipath... Yet

viewtopic.php?t=181007

mixig

Replace for infinity
https://mikrotik.com/product/ccr2004_1g_12s_2xs

mixig

You need to go with default route only, if you have only one bgp peer to your upstream provider.
And yes full internet routing table is less then 1 milion prefixes

mixig

100% your provider is giving you a private IP (NAT OR CGNAT).
Same will be if you are not using Passthrough.

mixig

Ospf is not establish, need to be in "FULL" state, in your case it is in "2-way" state.

mixig

Provide full config: ip firewall mangle export

mixig

I know it is not same issue but you can try, who knows maybe will work...

What's new in 7.3beta37 (2022-Apr-25 15:29):

*) bonding - fixed LACP flapping for RB5009 and CCR2004-16G-2S+ devices;

mixig

To allow L2TP w/ IPSec traffic, open UDP ports 500, 1701 & 4500

mixig

That help page is for ROS v7. Use old wiki for v6.

mixig

Waiting and use v6 dude, even when dude v7 will be available i will usw v6 fir few weeks / months

mixig

mixig

ROS version?

mixig

I always use 48V adapter for that ourpise, with that I have remote control and ability to shut down port or turn off/on poe if something is wrong with the AP.
With PoE adapter you cant do anything

mixig

Just try few times, and you will get default config

mixig

Which ROS version do you have?
Maybe it is related with this https://help.mikrotik.com/docs/pages/vi ... evice-mode

mixig

ExStart state; in most cases is if different MTU is on the link between routers.
Is there anything in the log?

mixig

Leave default vlan id 1, apply config and test again

mixig

Also nice tutorial here
https://wiki.mikrotik.com/wiki/SWOS/CSS326-VLAN-Example

mixig

It is not supported!

mixig

You need to use 48V adapter, not standard 24V which is delivered with hex devices.

mixig

I assume that maybe some routes are missing in VPN.
If you are using VPN than no NAT is needed if everything is configured properly.
Wireshark dump will tell you more...

mixig

Maybe Cambium APs?

mixig

And one day maybe with band steering (ros v7?)

mixig

Or this
https://mikrotik.com/product/lhgg_lte6_kit

mixig

Post your current config.
/export hide-sensitive file=anynameyouwish

mixig

We are doing all public wifi with cambium and we are very happy with them, specially with poe out on eth2 where we can power up another ap when there is one utp cable outside

mixig

Hold this button before applying power then power the mik and wait flashing leds

mixig

https://mikrotik.com/product/wireless_wire_cube

Thanks

mixig

Hi,

2 ptp links, each link has distance up to 300m, what devices to use (60ghz)

mixig

Dont have any info which otdr, we always outsource company which is doing passive part (utp, fiber, etc.) 😁

mixig

How long is the distance between that two devices?
If distance is less than 10km then i would replace sfp modules.
Also can you check fiber with otdr or any similar equipment?

mixig

Only one bridge can be hw

mixig

As you can see there is no 16 port model.
You will need to use 24 port model.
https://mikrotik.com/products/group/switches

mixig

viewtopic.php?t=130815

mixig

Hi,
from your experience can mikrotik handle 6000+ routes in routing table learned through ospf?
Few ccr 1016 and one or two core router ccr 1072.
Each of them will have up to 20 fw rules and mpls enabled.

Thx

mixig

Dear Mr. Normis, please get your company in order. This doesn't look professional at all, I'm sorry.

+1

mixig

Cube Lite60 is designed to be less visible than a traditional dish CPE, but make no mistake – it’s still a real powerhouse. The effective point-to-point distance between Cube Lite60 units is up to 800 meters, point-to-multipoint – up to 500 meters.

mixig

Hi there, I am here to ask you for opinion based on previous experience regarding local ISP, i am not asking how to configure or something similar... There will be project for local regions, only internet access for now (one of the region is the owner of the project). What I know for now there will ...

mixig

mixig

mAp need 802.3 af to be powered up, so with that you need 48V adapter on hex side.
Ltap as mentioned in post reply, need 12-30V and can be powered with default hex adapter which is 24V oassive PoE.

So no RMA, you need to change adapter on hex side

mixig

Only if that linksys switch supports 24V passive poe, 4011 cant be powered with 802.3af/at

mixig

By buying UTM/NGFW product

mixig

Are there any indications for a 48 sfp port switch in the near future?

mixig

Almost year and a half from the first post in this topic... Is there any news about multiport switch, maybe something like old Cisco 6500? With modular slots?

mixig

We are using only UBNT Tough Cable TC-Pro Level 1 FTP Cat5e outdoor.
Sea, solt, wind, it simply lasts...

mixig

+1
++1 for PoE version

mixig

Replace sfp modules on both sides

mixig

mixig

Do you have any firewall rules? When pinging DEVICE from CRS it's output chain, when pinging DEVICE from PC it's forward chain.
Also can you ping from PC ip address of CRS from vlan 10, 192.168.10.1 (input chain).

mixig

Can fritzbox do a routing, if yes then there is no need to use NAT. Also if you test with wireshark on MKT side (where phone is pluged) I believe you would see in SIP mesages that IP for sending RTP is wrong (signaling is passing fine but NAT breaks/change attributes in SIP signaling messages).

mixig

Try netinstall...

mixig

This is great but I have one question regarding this topic (exapmle is from wiki): Add the bridge ports and specify PVID for each access port: /interface bridge port add bridge=bridge1 interface=ether1 add bridge=bridge1 interface=ether2 pvid=20 add bridge=bridge1 interface=ether3 pvid=30 Icon-note....

mixig

Just for test disable your firewall rules (input chain)

mixig

https://wiki.mikrotik.com/wiki/Manual:Kid-control

mixig

IP firewall mangle, do mark routing, check the wiki for more info

mixig

You must allow GRE protocol and port 1723 from WAN (input chain in ip firewall filter)

mixig

+1 for HA

mixig

Hi, I have setup like this (CCR1016) One bridge with port members sfp1-sfp6 3 VLANs, 111,199,200 sfp1 is trunk port with tagged vlans 111,199 sfp6 is trunk port with tagged vlans 111,200 Ports sfp2-sfp5 must be in access vlan 111 I used new way of bridging vlans, router os 6.42.x, it seems to me tha...

mixig

I'm a little curious why you have some rules twice /ip firewall mangle add chain=forward action=mark-connection protocol=udp src-address=192.168.100.5 connection-state=new new-connection-mark="VOIP" comment="IP-PBX" add chain=forward action=mark-packet passthrough=no conne...

mixig

Hi, can someone check this part of my configuration, there are 3 netoworks (3 VLAN) and all of them are going to Internet via fiber optic 50/50Mbps, I need to share bandwidth 2x15Mbps and 1x20, If there is no congestion on wan then they can use all available bandwidth. Packet are matching in mangle ...

mixig

Try with this: /interface bridge add name=bridge vlan-filtering=no /interface vlan add interface=bridge name=vlan_170 vlan-id=170 add interface=bridge name=vlan_171 vlan-id=171 add interface=bridge name=vlan_172 vlan-id=172 add interface=bridge name=vlan_173 vlan-id=173 /interface bridge vlan add br...

mixig

Factory reset and then restore backup then change the password?

mixig

Try to use SIP TCP instead UDP

mixig

Hello, I got a CRS125-24G-1S in control with 6.34.4. I absolutely cant upgrade or change a routerOS at the board. I tried several versions (include a try to downgrade). I put a package file into the router and reboot. And nothing change. Package still on the disk and i have not any records at log, ...

mixig

Hey. Just set src-address as your laptop and set dst-address as a prohibited network. or you can set firewall rule like this: /ip firewall filter add action= accept chain=forward dst-address= !192.168.0.0/24 src-address=192.168.0.22 P.S.: don't forget to lift this rule up above common forward rule....

mixig

Please export the full configuration of your router so that we can see all your settings

mixig

I can confirm that from version 4.x till now 6.4x same thing if PPP interface is in use so I use this one as a script and no more reports from customer:
/ip firewall connection remove [/ip firewall connection find where connection-type=sip and assured=no]

mixig

Any update regarding this topic?

BR,
Mixig

mixig

Your mikrotik routers prioritise nothing with the current configuration

mixig

works as expected: http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server#DHCP_Options you have to set 'random text' (note the quotes) if you want to send a string over as an option value. when everything is set up you can check actual raw value what is going to be sent over. Hi, i put the qoutes and ...

mixig

Hi,

i have option 66 for my phones:

http://192.168.10.1:5000/provisioning

on 5.26 it works, on 6.7 i get error (attach)... to resolve my problems I need to downgrade all my router boards??

mixig

Cab you share with us your Firewall (Filter/NAT) config?

mixig

Hi, this is from your MKT: [admin@MikroTik] /ip ipsec policy> 0 src-address=1.254.0.0/24 src-port=any dst-address=172.16.0.0/24 dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=213.27.221.220 sa-dst-address=95.126.72.72 proposal=default priority=0 ...

mixig

Hi,
can someone check my two config examples and explain me is there any difference between this two setups? (Priorities are different for each client)

Thanks

mixig

http://wiki.mikrotik.com/wiki/How_to_ma ... _web_proxy

http://wiki.mikrotik.com/wiki/Manual:IP/Proxy

mixig

Hi,

it would be nice in Winbox to have some search field (which will look for ip address or note value) so that we dont need to scroll through the list (each day i need to connect to some of mkt and each time i must spend some time to find it on the list

Thanks

mixig

From wiki for ECMP: Known Issues DNS issues ISP specific DNS servers might have custom configuration that treats specific requests from ISP's network differently than requests from other network. So in case connection is made via other gateway those sites will not be accessible. To avoid that we sug...

mixig

no, because last rule is general, so invalid connections will also be in that rule

mixig

Hi, is there any way how I can check is other machine is listening od specific port? If yes do nothing, if not send an email. WIth netwatch I am monitoring the all machinem but i need to monitor specific services: e.g. with telnet command? step 1 -> system telnet 10.160.250.130 1234 (if port is ok m...

mixig

Any experience for how long can it works with this temperature?

mixig

First solved issues with ip addressing....

mixig

mixig

http://forum.mikrotik.com/viewtopic.php?f=1&t=74031

mixig

I added addresses list "Facebokk" and block everything with destination address list, every month or two i go and check is there any new subnet : http://bgp.he.net/search?search[search]=facebook&commit=Search /ip firewall address-list add address=74.119.76.0/22 disabled=no list=Faceboo...

mixig

Go to your LAN interface (192.168.88.0/24) and search ARP then select proxy-arp

mixig

Hi, is it posssible to to dst nat from outisde to some local ip but with changing public ip address to local, so that device on lan see that packet as not public ip? with classic port forward i must NAT public ip which came to mikrotik to private ip and send to local machine I found that possibilty ...

mixig

Step one, if you want push public traffic through VPN create three address list (private ip addresses): /ip firewall address-list add address=10.0.0.0/8 disabled=no list="Local subnet" add address=172.16.0.0/12 disabled=no list="Local subnet" add address=192.168.0.0/16 disabled=n...

mixig

do that in ip firewall nat instead ip firewall mangle

mixig

example:

/ip firewall mangle
add action=accept chain=prerouting disabled=no in-interface=ether1-LAN src-address=192.168.0.100

change in-interface=your lan interface
change ip address

put that rule at athe top of the mangle

mixig

http://tiktube.com/video/GEfq3hCljLoKpm ... uIlGopKGp=

But it will never be real 40mbps

mixig

http://www.tiktube.com/?video=GEfq3hClj ... uIlGopKGp=

mixig

Try with this link:

http://gregsowell.com/?p=1290

mixig

Does traffic is passing through that rule (look at the counter on the right side od the rule) Also does you Mikrotik know how to get to proxy cache? Do you see any traffic on your proxy?

mixig

try this:

add action=src-nat chain=srcnat comment="" disabled=no out-interface=WAN_INTERFACE src-address=YOUR_LAN_SUBNET to-addresses=YOUR PUBLIC_IP

mixig

http://forum.mikrotik.com/viewtopic.php?f=13&t=27571

mixig

From presentatio: http://mum.mikrotik.com/presentations/HR13/kirnak.pdf

You can not have more then one 0.0.0.0/0 peer. If you configure multiple, only one will work.
–Use certificates to solve problems with one PSK for all peers.

mixig

IPSec traffic must be excluded from NAT (masquerade), can you please also put ipsec configuration here?

mixig

check this settings, if that option is not enabled you firewall rules will not work for bridged traffic

mixig

Maybe firewall issue?

mixig

double post:
http://forum.mikrotik.com/viewtopic.php?f=13&t=71206

mixig

All routerboards have the same RouterOS so they all have the same features, you can take 750/751/951/450, they all have 5 eth ports + wlan interface (except 450 which doesnt have WLAN)...

mixig

Check is the mode on wireless interface set to "ap-bridge"

mixig

go to IP-Routes:

0.0.0.0/0
select your g1 interface to be gateway

mixig

could you post your firewall configuration?

mixig

if you have more than one ip address on port you may have trouble with traffic from outside because of the preferred source.. you will need to do some mangling

http://forum.mikrotik.com/viewtopic.php?f=2&t=71173

mixig

do you have default route in your routing table??? is your gateway to outside g1 interface?

mixig

Hi, if you are using bridge there are 2 ways, on bridge port you can enable IP firewall so with that you can block traffic between that two devices (forward chain), or you can use horizon under the ports which are in the bridge (devices which are on the ports with the same horizon number CAN NOT com...

mixig

for 3G modem in firewall nat section you can put source nat only for DHCP1 LAN, so DHCP2 address will not get to the internet (it will but the internt would not work), or you can block them in firewall (better solution), src add=LAN_DHCP2 out. interface = 3g modem and also src add=LAN_DHCP2 out. int...

mixig

Do you have some rules like this in web proxy:

/ip proxy access
add path=*.jpg action=deny
add path=*.jpeg action=deny
add path=*.png action=deny
add path=*.gif action=deny
?

mixig

Maybe this video will help:

http://gregsowell.com/?p=1290

mixig

Just to confirm... working very nice

mixig

They are in the same subnet so traffic between is not passing through the Mikrotik, you can configure bridge on Mikrotik, with that you can accomplish your task

mixig

in winbox: new terminal-> ip route export

paste routing table here...

mixig

Do you have default route in your routing table?

mixig

http://wiki.mikrotik.com/wiki/Manual:Interface/SSTP
http://wiki.mikrotik.com/wiki/Manual:Cr ... rtificates

http://www.openssl.org/

mixig

Read this post:

http://forum.mikrotik.com/viewtopic.php?f=2&t=42742

Also good link for setup web proxy on MKT:
http://aacable.wordpress.com/2011/12/29 ... arent-mode

mixig

All ports are just a regular ports.. there is no WAN or LAN ports, you can use any port for LAN or WAN

mixig

you can post firewall settings from mikrotik here... but did you try turning off thr firewall on that devices (windows OS ?)

mixig

Hi, you can do routing mark for that server (marking by local ip address of that server), and create default route for that marked traffic to go outside through one of your links, and create destination nat -> evertything which came on that particular link from outisde by port "xy" forward...

mixig

What exactly is not working???

http://wiki.mikrotik.com/wiki/Manual:Interface/PPTP

mixig

IMO it will never happen...

mixig

Thanks for your reply. How do I go about setting up a VPN connection for this?

Mikrotik has few solutions for VPN, take a look on http://wiki.mikrotik.com/wiki/Manual:TOC (L2tp/ispec, pptp, sstp, open VPN)...

mixig

Watch this video:

http://gregsowell.com/?p=1290

mixig

I've never needed to use the wireless feature on the RB951-2N router board i purchased. but now my dLink will be going offline and so i want to use the wireless feature for a couple of days. when i activate the wireless, it bradcasts the SSID alright but i can't get any machine to connect to it sin...

mixig

VRRP and Vlans work perfectly.
Just don't forget to put an ip address on the VRRP interface and on the physical interfaces (vlan xx) as well.

Thanks...

mixig

Hi,

i read old topics and documentation which said taht vrrp doesnt work with vlan interfaces (v2.9/3.0). Is this fixed in version 5.x/6.x?

I will have trunk between mikrotik and cisco switch...

Thanks

mixig

you also have ip address on eth2 and wlan?????? they are in bridge, try remove that ip addresses... your nar rule says masquarade src address 172.20.0./24 and you have 172.18/172.19 on eth2 and wlan

mixig

from your computer try ping: www.google.com and 4.2.2.2 also from mikrotik too

mixig

you can try ping your default gateway (ISP side) from mikrotik

mixig

Do you have default route on mikrotik which is pointing to your ISP?

mixig

Do not bridge WAN and LAN ports together, your WAN interface is dhcp client and it gets public ip from your ISP. After that you create bridge interface and put eth2, eth3 and wlan to that bridge interface, put the ip addres to BRIDGE interface from subnet 172.20.0.0/24, enable dhcp server for BRIDGE...

mixig

Also alow UDP 500 on your firewall (input chain), be sure that your nat rule for local networks are above the masquerade rule in ip firewall nat

mixig

L2TP does not require IPSec, IPSec is used to encrypt the traffic

mixig

For central site I'll suggest 1100AHx2: 50$ difference is not so much if you have 70 remote locations. will be pratical not in used... on remote locations will be 1-2 phones.. I don't understand well... you mean there will be little traffic? Sure I'ts true, but don't forget to prioritize it. yes, t...

mixig

Hi, 1 central location + 60-70 remote locations... all remote locations will have 2 PPTP tunnels to the central MKT (arround 120-140 PPTP tunnels on central MKT), half of that tunnels are for voip and there will be pratical not in used... on remote locations will be 1-2 phones.. other half of the tu...

mixig

Router OS is the same for all models, each of them have ability for QoS, check the official mikrotik wiki

mixig

ok, first thing, your wan2 has wrong gateway, it`s not in the same network as your wan2 interface...

mixig

ip firewall mangle export

ip route export

copy/pase the config

mixig

The best way is prevent duplicate mac address at the start-> managed switches with port security is the best option

mixig

A connection mark is a mark that is automatically applied to all packets of a connection. You mark the connection on one packet, and all other packets in the same connection will have the same mark. Packet marks only are applied to one packet, and do not propagate to other packets in the same connec...

mixig

I am using PCC with source address method (about 100 users), it`s not the best method but it works, before that i used src and dst address but there were problems with https/internet banking... with src method more then a year everything is working normally, not 50:50 ratio but ok for me (I enabled ...

mixig

you can see in torch, or you can open the browser and go to www.whatismyip.com

if your address is ip address from WAN2 then it works

mixig

http://forum.mikrotik.com/viewtopic.php?f=13&t=46583

http://www.mikrotik.com/documentation/m ... /EoIP.html

mixig

Hi, if I understood you have two wan ports on MKT (WAN1, WAN2), WAN1 is default route in our scenario, WAN2 will be used for HTTP traffic which will be coming from local computers. 1) we must mark web traffic which is coming to mikrotik (ip firewall mangle)- put that rule on the top of the mangle (c...

mixig

My example:

/ip dhcp-server option
add code=66 name=option66 value=http://192.168.0.56/

/ip dhcp-server network
add address=192.168.1.0/24 comment="" dhcp-option=option66 dns-server=4.2.2.2,8.8.8.8 gateway=192.168.1.1

mixig

Usual problem when we are having SIP/RTP and NAT in the same story. I will start the packet sniffer on mikrotik: Packet sniffer settings->select proper interface, Streaming: ip of local computer which has Wireshark. Then start the wireshark (select proper interface), then start packet sniffer Now wh...

mixig

http://wiki.mikrotik.com/wiki/Manual:Tools/Profiler

mixig

Hi,

after you create address list you can configure only one rule for those servers

mixig

What i ask post above is, when local traffic is going through the internet (there isnt any marking, not using PCC), traffic will go through WAN3 (pppoe-defulat route), but one of the server is mail server and it must be use WAN2 as his default gateway. Mark routing in mangle will do the trick? mangl...

mixig

Hi, i follow the example and it seems that everything is working fine now, thanks :) Just one thing, i will have mail server in LAN at it must be bind with WAN2 ip address (because mx record, srv record), it will be enough to put one rule on the top of the mangle? src-address=ip_of_mail_server src-p...

mixig

On further playing around it looks like the Web Proxy strips the routing mark. If I add an additional gateway that does not have a routing mark, browsing then works again through that gateway. Is there a way I can force traffic from the proxy to another gateway, while not forcing the rest of the tr...

mixig

in your rule you have disabled=yes mistake?

mixig

picture in the attach

mixig

Hi, thanks for the reply i already take a look your link, i see that that example is using PCC for marking local trafiic, which will load balancing local traffic through two links. in my situation i need that all local traffic is go outisde through WAN3 (pppoe), no need for PCC (i think), only traff...

mixig

I alos try this

http://home.swkls.org/mikrotik-dual-wan ... cket-flow/

but device which i want reach (dst-nat) doesnt work, its working only if traffic is for mikrotik, not some forward to local device behind it

mixig

Hi, i have wan links on mirkotik, two links with static ip, and the third is pppoe (dynamic ip), default route is over pppoe. what i want is when something came to mirkotik on WAN1 or WAN2 i want that that traffic is going back the same side its came. i did some mangle and routing mark, nad when i c...

mixig

When you are trying 3389 from outside to your routerboard, in firewall/nat on mikrotik do you see on your dst rule for 3389 that the counter is growing? if not traffic is not coming to your mikrotik (also you said that in torch there is no that traffic)

mixig

http://wiki.mikrotik.com/wiki/Manual:IP/Proxy

http://wiki.mikrotik.com/wiki/How_to_ma ... _web_proxy

you have more links about mikrotik web proxy on the Internet

mixig

There is a wrong date...

mixig

Hi Guys, until yesterday this rules were working for me: > add action = accept chain = forward src-address-List = Facebook_allow dst-address = 66.220.1.0/20 > add action = accept chain = forward src-address = Facebook_allow dst-address = 69.63.176.0/20 > add action = accept chain = forward src-addr...

mixig

Does your PC 192.168.88.237 have access to the Internet? Can you for this rule:

chain=dstnat action=dst-nat to-addresses=192.168.88.237 to-ports=3000 protocol=tcp dst-port=3000

add "in-interface = pppoe-out1" and try again

mixig

Counters on that dst-rule in firewall/NAT rule (look the attach, on right side), clear the counters then try telnet from outside and see is your traffic hits that rule, if does that traffic is forwarded to you local ip. Default gateway on that local computer is mikrotik?

mixig

Does the counter on your firewall rule for dst-nat is growing?

mixig

What excatly is not working? Did you allow UDP 500 and esp protocol on both side on mkt firewall (input chain)? What the log says (you can turn on ipsec log, System-Logging section)?

mixig

if your traffic is marked with routing mark e.g. WAN 1 (subnets 192.168.1.0/24, 192.168.2.0/24), and you have default route which has routing mark WAN1 which has exit over pppoe1 and WAN1 is down, your marked traffic will go outiside automatically through some other default route. Rule says if there...

mixig

Well, you can accomplished that with two method, as example is showing, step 1 and step 2 if you are using step 2 you can skip step 1. Why? Because in step one we are marking out interesting traffic. How? By selecting the Interface where we want to do "action". In this case this is LAN int...

mixig

Read this first:
http://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ

and after that try with this setup (change the subnet when configuring target addresses):
http://wiki.mikrotik.com/wiki/Manual:Qu ... Q_Examples

mixig

Make sure that your masquerad rule is on the top, that firewall is not blocking the traffic (you can export firewall and mangle rules here), try to ping some internet ip address but with src address of the mikrotik lan ip address

mixig

In firewall mangle you can marking your voip traffic based on src address or port number , DSCP value, what ever and to that traffic give a routing mark, e.g. routing mark=VOIP. Then in ip->routes create defult route 0.0.0.0/0, routing mark=VOIP. p.s. when creating mangle be sure that rule which is ...

mixig

Create address list with your local ip addresses that you want exclude from load balancing, then in mangle in prerouting chani put that address list in src address list and put the routing mark, passthrough set to "NO". Also important is that you must put that rule on the top in mangle. Th...

mixig

go to tiktube and take a look videos from janis megis from 2009 and 2011 and Valens Riyadi 2009 (HTB, QoS)

mixig

Prioritization without set limits not doing absolutely nothing exept the counter is growing...

so, all that for nothing...

mixig

lan1 and lan2 dont have communication between each other (i assume firewall is blocking that traffic), add this rules before that rule which is blocking LAN1 and LAN2: /ip firewall filter add action=accept chain=forward comment="" disabled=no dst-address=10.10.10.5 src-address=192.168.149....

mixig

i think it will be better if not using NAT on mikrotik and put the 192.168.1.0/24 is coming to upstream router, you can get better load balancing. Right now you are doing LB whit which parameters, dst address, port numbers? i am using src address for LB, it is not pure and equal but with another par...

mixig

is there any example / tutorial for /ip Ipsec setting?
is it possible to connect mikrotik client to windows server (ipsec configured on win server).?
tnx for reply

L2TP/IPSec
http://gregsowell.com/?p=4389

IPSec
http://gregsowell.com/?p=1290

mixig

hello :- ihave proplem in subnet (/?) i try more and more but i can`t understand as example ihave range x.x.x.5-x.x.x.10 what subnet i must put and why ? anyone have topic or something give me it i search about it but didn`t found this thing I assume that x.x.x.5-x.x.x10 are usable ip addresses, wi...

mixig

Hi,
if you put ip address manually? Is there connectivity then?

169.254.x.x is APIPA, dhcp server works?

mixig

Maybe your ISP is blocking ICMP traffic, if not check your firewall on 2011 (input chain)

mixig

Hi, in your routing table you have two default routes, each route is default route for packets that has routing mark (my, and small), wehn your are pinging from mikrotik that ping packet doesnt have routing mark because it is not defined in the mangle (mikrotik address is not in you src address list...

mixig

Just for test, in firewall put the output and input chain allow

mixig

put the some public dns servers on mikrotik and/or on your PC˙s

mixig

Maybe this will help you

http://wiki.mikrotik.com/wiki/Manual:Interface/EoIP

mixig

you have installed router os on pc? what is the CPU usage? what is your link bandwith? Is your link out of free bandwith?

mixig

i am not familiar with scripting can anyone help me out.

Try to ask here:
http://forum.mikrotik.com/viewforum.php?f=9

mixig

your cisco and mikrotik are connected through switch, there is no layer 3 connectivity, cisco is on one subnet and mikrotik on another subnet but they need to be connected somehow...

mixig

Could you try with this command:

ip firewall service-port set sip ports=5060,5061 disabled=yes

mixig

It seems that your link is broken

mixig

Hi All, I am new to RouterOS, actually just got RB2011 (5.21) as my SOHO gateway. I was experimenting with marking packets by firewall: [admin@Border1] > /ip firewall mangle print Flags: X - disabled, I - invalid, D - dynamic 0 chain=prerouting action=mark-packet new-packet-mark=voip-sip passthroug...

mixig

I have a managed L2 switch, and currently running a 802.1Q trunk (with about 6 VLANs on this) between the switch and Mikrotik's port number 10. I would like to increase bandwidth between the switch and Mikrotik, but still have VLANs. Any advice on how can I do this please? Create bonding interface ...

mixig

only security what i know is to setup ip address or subnet which will be allowed to access to web server/graphs

mixig

it is works without any problem, on the remote side try to install some softphone on PC on the subnet where is panasonic phone right now (but reading the post once again pc and phone are on the same subnet?) and start the wireshark.. you will see what is happeing with SIP REGISTAR mesage.. also on s...

mixig

your LAN subnets will be marked in mangle with wan1 and wan2 because you are mangleing only by source address, so when mirkotik need to decide where to route the traffic it will look into the routnig table and search the right routing mark, and it will pass to wan1 or wan2... you must exclude traffi...

mixig

i would try to figure out where is a problem with wireshark, first yu can install softphone on PC behind 2011 MKT and see what is happening, after that run packet sniffer on mkt which will sent you a copy of traffic to your PC which has wireshark... After that try to see where is the problem

mixig

no i am just guessing, so traffic is passing through that rule, passthrough is set to no, so traffic is not moving through the manlge, it get to the routing decision... you get timeout... i would say dns is the problem (second provider is using another dns then first provider) but i see that you are...

mixig

add action=mark-routing chain=prerouting comment="Forced Test Route To WAN2" disabled=no dst-address-list=TEST \
    new-routing-mark=SMALLNETBLDER passthrough=no src-address=192.168.68.0/24

Does this rule has matching traffic, does the counter is growing?

mixig

Check this:

http://www.tiktube.com/video/GEfq3hCljL ... uIlGopKGp=

and pdf from that video is here http://mum.mikrotik.com/presentations/US12/steve.pdf

mixig

Hi, ip firewall nat rule where you redirecting web traffic to web proxy under the Extra tab you can put time when this rule be active, you can put in your case 8-5pm monday-friday, so the rule will be always in your config but it will be active only for the time you specified, when it is inactive yo...

Search found 316 matches