MikroTik

Ferrograph

Just wanted to ping this as Im still know where on with this. The setup is real simple. SXT-LTE and RB3011 on same /24 subnet. SXT-LTE on .4 and RB3011 on .1. There is EoIP tunnel between the two with the tunnel interface selected as the passthrough interface on the SXT-LTE APN. DHCP client sat on t...

Ferrograph

After upgrading RB3011 from 6.44.3 to 6.45.3, all my PPTP has stopped working, inbound and outbound.

Downgrading one by one PPTP works again only when I got to 6.44.4. Not good!

Ferrograph

I've tried extensively WITH and WITHOUT the SIP helper. You still get zombie connections. Common though is dest-port 5060/5061.

Perhaps there is something in the firewall/NAT that recognises 5060/1 in addition to what the SIP helper does?

Ferrograph

I think we're forgetting that deleting the connections manually or by a script only works some if the time. If the connections get in that wierd state where the timeout starts counting up even deleting them doesn't work - even though they are gone from the connection list I think the that fact they ...

Ferrograph

After some success and failures I refined my small list down to the following which covers a great deal of ads and stuff I dont want curious kids looking at. Extremely low impact on performance.Hope its useful. /ip dns static add address=127.0.0.1 comment="Block Some Bad Stuff" regexp=porn add addre...

Ferrograph

Ive just got RBSXTR. LTE passthrough is broken. I've seen reports that it works on 6.42.7 but I've tried downgrading and it doesn't work. See my post here: https://forum.mikrotik.com/viewtopic.php?f=2&t=139038 Basically the DHCP relay part works but packets dont flow, "host not reachable" etc in tra...

Ferrograph

Doesnt work with 6.44beta6 or 6.42.7 or 6.43 Heres my export: [admin@SXT-LTE] > export # sep/12/2018 23:51:56 by RouterOS 6.42.7 # software id = CF7Q-26RP # # model = RBSXTR # serial number = XXXXXXXXXXXXXX /interface bridge add admin-mac=B8:69:F4:01:2F:47 auto-mac=no comment=defconf name=bridge /in...

Ferrograph

Well spotted about the /32 addressing.

I just noticed that 6.44beta6 was out and guess what is in the release notes:

lte - fixed DHCP relay packet forwarding when in passthrough mode;

Will test and report back.

Ferrograph

Good point. The beefier Tiks don't need fasttrack. I need to save my pennies and get one!

Ferrograph

PPTP with CHAP is fastest, as per the tile of the post. But a gotcha is that you need to prevent fasttrack from working on VPNs cos it screws them up and you get slow speeds surprisingly. I use the mangle to mark traffic on VPN interfaces in+out with connection-mark "DontFasttrack" (use an interface...

Ferrograph

Ive just got SXT LTE Kit. Standard setup works absolutely great. But the main router (RB3011) needs the LTE WAN address in my setup so Ive tried using passthrough mode and it works to a point but I cant actually get any working internet over the interface. Ive setup SXT on my LAN by using DHCP clien...

Ferrograph

Did you ever get to the bottom of this?

Ive got exact same issue with SXT LTE and RB3011.

RB3011 gets WAN address from LTE via dhcp-client but the connection isnt usable and pings fail with host unreachable.

Ferrograph

Im interested in this method of blocking stuff. Ive been experimenting with using a small list of well chosen names and "catch" words. After doing a bit of browsing on sites well know to be littered with ads and looking through the dns cache, I have good results with this small list. Not perfect by ...

Ferrograph

Ok Partly my bad - I was doing TCP tests and the lower speed is down to TCP overhead. Likely Speedtest.net uses UDP. But the reason I was doing TCP was because I couldnt get UDP test to work - however Ive since discovered that UDP only works if I set the direction to "Both", setting it to "Receive" ...

Ferrograph

Ive got a setup (RB941) with roughly 60M/20M wan connection on VDSL (PPPoE). Wired and wireless clients can get upto 58M download speeds from speedtest.net When I test with the built in bandwidth test tool to a btest server than can manage 500M, I only see 20-25M tops. Its pretty standard setup with...

Ferrograph

Actually, I have a theory. I've seen the connections timeout period count upwards which shows they are getting in some weird condition. Maybe the delete doesn't fully delete connections in this state and it gets orphaned and hidden from the list. I theorised that loosing the WAN might do some blanke...

Ferrograph

Still got this issue in 6.41.

I've tried deleting connections but this doesnt always work. In this case the only thing to do is to reboot it. But it gals me to do that - this is about the only thing I have to reboot Mikrotik for. How sad thats its something so basic.

Ferrograph

Set up a default route with the desired gateway (VPN interface or VPN box IP), but add the condition of a routing mark. Say "to_USA"

In the mangle, mark packets with the desired src IPs with the same routing mark. Thats all you need to do.

Ferrograph

If it's pptp, try just CHAP encryption. You might get even more speed.

Ferrograph

Hi all, sorry for trouble, out of sudden I have tried something and fixed it (thinking that the connections that if need to go through "torch" it must be excluded from "fasttrack", which was an idea I read and used on my ipsec to Azure and learnt from somewhere in the internet), the speed now is wh...

Ferrograph

CDC_NCM is in our to-do list but I can't comment when we will start to work on that.

On the todo list will do for me! Thanks uldis.

Ferrograph

+1 for LTE bridge mode. But, I made a post here with some information on possible standardised solution to this bridge mode thing collated from hours and hours of tinkering and research. Unfortunately I didnt give the post a very good title and forgot to put anything to do with LTE in the title. Oh ...

Ferrograph

Ah, kometchtech! That might be the issue - I had to retire an old GB switch and only had a 100M switch so I moved lower speed devices to the 100M switch and the rest to the remaining GB switch. But its possible and I dont recall the flapping before this. Could be big coincidence of course. I will tr...

Ferrograph

Ok I'll try this next time I go to one of my sites, and report results back.

Ferrograph

Im pretty sure I turned those off (none) but its possible I didnt.

What problem could these potentially cause?

Ferrograph

Ive seen this a few times now and I'd really like to get to the bottom of it. I do a lot of remote monitoring for clients and its very useful to have a Mikrotik on site for diagnosing issues for clients that have their own network. I setup a phone home VPN on the box and just give it either a fixed ...

Ferrograph

Thanks Steve.

Makes me feel a little better about downgrading if I need to. Im trying a few things and monitoring count of link-downs against up time to get a read on frequency of occurrence.

Ferrograph

I've been running v6 release candidates for a while now. Currently on v6.41rc38. I'm getting an increasing occurrence of port flapping on ports with cables connected. They all flap at the same time so I know its a flapping issue. Is anyone else experiencing this? My distributor advised to downgrade ...

Ferrograph

Ok Ive spent quite a bit of time on this and reached a conclusion... # Its desirable for our Tik's to get the public IP from a 3G/4G mobile broadband devices - not through HiLink, PPP or other non-ideal method. # A lot of devices now support NCM mode where the public IP is handed over on a special N...

Ferrograph

I get this no matter what I try to connect to. Any clues anyone?

Ferrograph

Are the dynamic rules fixed in later versions? Like 6.38.1 I've not seen any release note related to this and things definitely work better with the rules below instead of the default dynamic Tik ones. But really I'd like to just use the default ones. I found these on the forum a long time ago and b...

Ferrograph

Gigabit PoE issue. Im a big Tik fan. I have two a couple of these, speeds and coverage are great. Run toasty though! However, to get rid of injectors and PSU's and power some other PoE dvices I bought a small Gigabit PoE switch DLink DSG1100-08P and the ports wont come up Gbit, only 100M which kind ...

Ferrograph

The cables you tried, did you try shield and non-shielded? How long are the cable runs? I only have unshielded, the runs are about 20m. But I tried with short 3m patch cables same result. There's some note about the using no shielding with PoE in the spec. It is odd I agree. Thought we'd seen the l...

Ferrograph

Sorry Ive not updated this post. I realised I wasnt using the wireless-rep package. After I replaced that I got the speeds expected. I have yet to try the default wireless config for compatibility, but my experience is Ive always had to fiddle with Mikrotik wireless to get full compatibility with de...

Ferrograph

Gigabit PoE issue. I have two of these, speeds and coverage are great. Run toasty though! However, I bought a small Gigabit PoE switch DLink DSG1100-08P and the ports wont come up at Gbit, only 100M which kind of defeats having AC speeds which I was getting with the supplied injectors and connected ...

Ferrograph

Both APs in the same place on their face (top room aiming downward) and only one powered at a time during tests. Used CH36. Export below. These settings gave best results: add authentication-types=wpa2-psk eap-methods="" management-protection=allowed \ mode=dynamic-keys name=MySecurity supplicant-id...

Ferrograph

I bought a couple of the wAP AC models to try out hopefully to use full time since Im a big Tik fan. I've only configured one so far and Im comparing performance with a Huawia HG635 (configured as AP) and using laptops, tablets and phones. So far Im very disappointed.with performance. With the APs l...

Ferrograph

In our area there is now a FTP broadband with provider TalkTalk UK. They call it Ultra Fibre Optic (UFO) Supposedly its >900Mbps service but that remains to be seen. Its still beta really. I started on the domestic trial which used a DHCP WAN connection. With RB2011 I was getting nearly 600Mbps down...

Ferrograph

If you're struggling to get it to show in netinstall, try an isolated switch in between. Struggled for an eternity with this then put in a call to LinITX my local supplier, and they suggested timing of the port on windows might be an issue. Put a switch in and it showed first time.

Ferrograph

Had a few confusing occasions where I've altered the PPPoE MTU on remote sites to values I know work and ended up being disconnected from the site. Upon attending I found the PPPoE reporting authentication failures. If I retype the password (looks apparently unchanged) and click apply, suddenly the ...

Ferrograph

+1000 this for me too. Use case: I install Mikrotik and Ubiquity Unifi combination for medium to large (but simple) networks with off site Unifi Controller. The Unifi access points do a lookup on "unifi" to find the controller for adoption with is in the cloud with an IP address that occasionally ch...

Ferrograph

Guys,

Upgraded a 951 from 6.17 and some of the config got lost:

# all firewall config
# Interface names
# all wireless
# bridges lost

And a few other odd things like the Wireless SSID was the same as 'Identity', system password was also lost.

Ferrograph

domonic. Thanks for taking the time to post this, I figured it was something like this but not had time to investigate fully and log it as a bug. Important detail is the timeout counting up which I dont believe should ever happen. You should totally log it. Its been plaguing my customers with VOIP f...

Ferrograph

Im just watching the connection list with sip setting in service ports turned off and a filter in the connection table where dst-port is 5060.

Should I be seeing connections with the timeout counting up?

Ferrograph

Im seeing this problem too but with cabled WAN on dhcp. After some time sip connections cant register. Its very frustrating, and Im getting it in the neck from users! Im on v6.12, but I just updated to v6.13. Likely its still an issue in v6.13, as I dont see any fixes related to sip or UDP connectio...

Ferrograph

I presume you want to access the modem web interface to check configuration ADSL stats etc. Depends on how the modems LAN setting work. But try this. Usually these devices, as a minimum you can set the LAN port to a fixed IP. So set it to: Address: 10.0.0.1 Subnet: 255.255.255.0 In the Tik, add an I...

Ferrograph

Im seeing the same issue with 951G and BT OpenReach fibre (well VDSL) modem. Only works with auto negotiation switched on and negotiates 10M. ROS v6.3 + Firm 3.08. Modem is ECI Telecom Ltd. BT Item Code: 061513 Description: NGA ECI-CPE-MODEMS TYPE 1B ECI Model: B-FOCus V-2FUb/I Rev.B ECI Cat No: ON3...

Ferrograph

Rule 4 is for your input chain, so traffic with the router as it's destination. Since you have a NAT rule, the src-address is different and therefor the forward chain should be hit. You only have 2 rules there. I suggest you update your forward chain. Something like /ip firewall filter add chain=fo...

Ferrograph

most simple stuff you can look up in default configuration examples that are posted on the wiki for SOHO routers here: http://wiki.mikrotik.com/wiki/Manual:Default_Configurations FW there is good and protects your router and hosts behind it. Thanks for that. After a bit more reading is it rule #4 t...

Ferrograph

1 ;;; Forward established connections chain=forward action=accept If this is your complete firewall output, you need some serious thoughts. Your second rule is allowing all traffic to pass through the router, so nothing is blocked!!! Lol, off topic but, yes you are right. Its missing the connection...

Ferrograph

This is probably blocking the connection. Look at the forward chain in firewall, or post "/ip firewall filter export compact". /ip firewall filter> print Flags: X - disabled, I - invalid, D - dynamic 0 ;;; Accept established connections chain=input action=accept connection-state=established 1 ;;; F...

Ferrograph

Thanks for your time. Is firewall on the RB allowing the NATed connection? How can I check this? Does the device you NAT to have a gateway configured? Yes, its a PC and I can RDP and other stuff to it from outside. Does the device you NAT to allow connections from other subnets if it has its own fir...

Ferrograph

I have a fairly simple setup on RB2011. A small handful of NAT rules forwarding ports to some TCP services on the LAN - all working fine. Today I added a UDP forwarding rule to the NAT for an inbound video stream. I can see the packets hitting the WAN and they show in "Connections" but they are not ...

Ferrograph

Doesnt ether1 on some Mikrotik's have some sort of PoE feature? Perhaps that is causing negotiation problems?

Look down the spec list here: http://routerboard.com/RB2011UAS-RM

# "PoE: 8-28V DC on Ether1"

Does it work ok if you use port 5, commonly used as WAN2 on Mikrotiks?

Ferrograph

I found a nice easy solution to this. Psted the details on this thread:

http://forum.mikrotik.com/viewtopic.php?f=1&t=68302

Ferrograph

Update.

Tested this on the remote RB450. It worked!

No more 4hr drive looming over my head.

Ferrograph

Ok I think I found a nice easy solution. Tried this a couple of times on my test router and it worked both times. # Make a backup of current config in winbox or by CLI. /system backup save name=myconfig # Upload rc6 npk upgrade package # Now do a restore with the backup you just made in winbox or fr...

Ferrograph

I tried upgrading to rc6 on a test router (RB450) but the old config gets restored. However subsequent reboots restore the latest configuration, so yes fixed. Thats good. I now need a way to get the desired config to be the one that come up after rc6 upgrade. I cant get auto.rsc to work - anyone got...

Ferrograph

Thanks that looks like the exact issue. Presumably it always restores the first backup restored after upgrading to rc5? So to avoid my 4hr drive I should simply upgrade to rc6? or should I do something else first before upgrading? Like, Ive been reading about *.auto.rsc, and Ive created a compact ex...

Ferrograph

Im seeing this too and I started a thread specifically for it. Is it possible there is some command or procedure that will force the config to be saved so that after reboot/power loss the config comes back. I have a site 4hrs drive away and if the power goes the config will go back to one that will ...

Ferrograph

Ive posted this in the General forum, but its more appropriate here since it is rc5 Im running: This is a weird one. So brand new RB450G. Take out its box and allow it to boot up and set itself to the default config from the in built script. After this I upgrade to v6rc5 and then restore from .backu...

Ferrograph

Thanks for the quick reply. cant find post from normis where this is confirmed Is this the post? http://forum.mikrotik.com/viewtopic.php?f=2&t=68221&p=347325#p347325 I have an RB450 here on v6rc5, so I tried making some changes and rebooting - the changes I made persisted. I daren't reboot the remot...

Ferrograph

This is a weird one. So brand new RB450G. Take out its box and allow it to boot up and set itself to the default config from the in built script. After this I upgrade to v6rc5 and then restore from .backup file from another RB450 I have as a good starting point/template for initial config. I then ju...

Ferrograph

Has anybody had any success with these 3G dongles? They are HiLink dongles so need the modem switch which I have done and I can use terminal to talk to the modem, send AT commands etc. But cannot get the thing to connect and get a WAN IP address, despite trawling the forums for ideas from other huaw...

Ferrograph

Only bandrich chipset LTE modems and Sierra modems that have direct-ip firmware with product ID 0x68a3 will appear in LTE menu. Others will appear in port menu, for PPP connection. The mentioned devices when recognized in the LTE menu, will work faster than devices that are usable only from PPP men...

Search found 65 matches