MikroTik

sariao

Hi,

This can be done using Firewall-Filter, nevertheless! i support this idea, it is gonging to be useful specially for home users and users with limited network experience

+1 for DNS access list

sariao

DST-NAT wont work for winbox

sariao

Having the ability to connect using Winbox from inside Winbox would be very useful, especially if i have multiple Mikrotik devices in my local network.
We already can do SSH or Telnet from inside Winbox, why not doing Winbox too?!

Best Regards...

sariao

Having "Advanced TAB" in "/Tools Netwatch" would be useful for those having Multiple Gateways

The advanced tab should have same parameters as "/Tools Ping" Advanced TAB, including "Routing Table", "SRC Address", and "Packet Size"

Thnkx

sariao

no, i used web interface to restore the database

sariao

I just migrated from UM V4.X to UM V5.X and it was really hard doing all users manually as i tired auto database update and the results was a mess, so i had to do everything all over manually on another Router with UM5.X then i backup the database and reload it into my updated router. how ever that ...

sariao

Add This /ip fire man add action=mark-routing chain=output new-routing-mark=to_wan1 passthrough=no src-address=41.134.110.0/28 place-before=0 /ip fire man add action=mark-routing chain=output new-routing-mark=to_wan2 passthrough=no src-address=196.212.100.0/28 place-before=0 I have notice another th...

sariao

Talking about RB1100 and PPPOE. I have a serious problem running PPPOe on my RB1100 where the problem seems to be related to MTU and MAX MRU. the users can connect and gain access and ping is working fine. but browsing is not working properly. Websites does not open some times, and some pages open a...

sariao

Yes using Static DNS for local group is not practical specially when your local network is using dynamic IPs.

sariao

Use this

/ip fire nat add chain=src-nat dst-address=192.168.88.0/24 action=accept place-before=0

sariao

Try to use these rule in your preroute chain /ip fire man add chain=prerouting src-add=192.168.88.0/24 dst-address=[put your router public ip 1] action=accept place-before=0 /ip fire man add chain=prerouting src-add=192.168.88.0/24 dst-address=[put your router public ip 2] action=accept place-before...

sariao

in matter fact your dst-nat rule does not specify any in-interface or dst-address in this case any FTP session will be redirected to your local server which is not good. so frist fix your outside dst-nat /ip fire nat add chain=dstnat action=dst-nat to-addresses=192.168.88.2 to-ports=20-21 protocol=t...

sariao

I would like to see your interfaces, ip address binding, and NAT rules if you have any. How ever i will explain the general idea you can later modify it as you like. In your scenario i am going to reserve 4 public IPs for the Router it self, these public ip are going to be used for NAT. i will take ...

sariao

/ip fire man set 0 passthrough=yes set 1 passthrough=yes set 2 passthrough=yes set 3 passthrough=yes /ip fire man add action=mark-connection chain=forward connection-state=new in-interface=ether1-Mweb-Router new-connection-mark=outside1_connection passthrough=no add action=mark-connection chain=for...

sariao

You can work around this issue by ether setting up internet DNS on your group DNS server means on Mikrotik DNS server set only your group DNS, then on your group DNS server put your internet DNS. or! you can set both DNSs on your users computer directly. so primary would be the group DNS and the sec...

sariao

I will assume that your Mikrotik public ip as follow: WAN1: 196.xx.xx.x1 WAN2: 196.xx.xx.x2 WAN3: 196.xx.xx.x3 so you have to add this to your mangle output: /ip firewall mangle add src-add=196.xx.xx.x1 action=mark-routing chain=output new-routing-mark=Rwan1 passthrough=no place-before=0 /ip firewal...

sariao

that can be done i believe
post you current configurations i want to see how do you distribute your public IPs.

sariao

Greetings. Try to paste this code to your terminal. the 1st 2 lines are fixing your original records number 4, and 5 where you assigned wrong in-interface to the rule the 2nd 2 lines are to ignore packets generated by router from being balanced, mangle output will take care of routing this packet to...

sariao

post your NAT, and route config on your RB250.

sariao

post your mangle, NAT and route configurations

sariao

bypassing it would be much easier of course.

but in this case you will be able to access your FTP from one modem only.
so in your dst-nat rule you need to specify the in-interface or dst-address which would be corresponded to WAN1 or WAN2

sariao

Theoretically yes. but x86 is not a bad choice ether. i have been using RouterOS on x86 for more than 10 years with no problems.

Mikrotik Rocks!

sariao

where you are trying to connect to your NAS from? internet ? if so? incoming connection should always get back from the same source. means if the request came from DSL modem1 then it must get out thru the same connection other wise the session will be dropped. to fix this you need ether to bypass yo...

sariao

you might need to upgrade your router memory then. the original configuration is 512MB. order it with 1.5Gb

if you plan to switch to RB1100 i will be glad to see your test results

sariao

having more than 1 IP per interface is so common on routers

how many users you have anyway ?

sariao

No not bonding. all what you have to do is to add 2 IPs on each WAN interface! in your current scenario you have 5 WAN interfaces each interface has one IP for one modem. Now if you have a normal 16 port switch just connect all your 10 modems to it, and connect all your 5 ports to the same switch an...

sariao

Hello. Well working with 10x4mb connection would not be a problem to RB1100, i have a similar scenario with 8x20mb serving 100 users using RB1100 with it's original CPU rate 800Mhz and CPU load is not remarkable! For over-clocking chk this Topic: http://forum.mikrotik.com/viewtopic.php?f=3&t=480...

sariao

RB750 can handle 32k, not 400k.
For 400k I suggest RB450G, RB493G, RB800 or RB1100.

ditonet is right. i was looking at RB450 when i said 400K.

sariao

Theoretically you can NAT unlimited number of private IPs using one public IP. because NAT does not assign fixed port for each private IP. what it does it assign one port for every connection(session) and once this session is closed the port is free to be used again for another connection. How ever!...

sariao

As you are using your Mikrotik as Router for public IPs i dont think masquerade is the right option here. you need to use SRC-NAT. so to accomplish that just add one of the public IPs you have to your router WAN interface and use SRC-NAT for local IPs to SRC-NAT using this IP. Example: public IP tha...

sariao

What you need is to is this: 1- set the gateway on PC(A) to 192.168.5.1 2- set the gateway on PC(B) to 192.168.2.1 3- on Mirotik(A) paste this code: /ip route add dst-address=192.168.2.0/24 gateway=192.168.20.2 4- on Mirotik(B) paste this code: /ip route add dst-address=192.168.5.0/24 gateway=192.16...

sariao

if it was me. i would go for normal access point and Mikrotik RB750 or RB750G if you need gigabit.

Regards...

sariao

router deal with Vlans as interfaces so to enable vpn to pass to a VLAN you need to enable proxy-arp for this vlan

sariao

for the voltage i missed the 1. it is 12.5~12.6
for the memory changing i did not have the chance to try that, i will if any problem again reported.

sariao

Max temp reached was 31c the voltage is between 2.5 and 2.6. i am using this router as hotspot along with MAC authentication by usermanager, i am utilizing 10 ports out of 13 i have 8 DSL lines connected to it, each line can reach up to 20mbps, and i have about 80 users with rate limit of 4mbps / us...

sariao

Yes. the router has been rebooted during memory rate changing procedure and it did like the 533Mhz
that was 3 days before the implementation day.

sariao

Well after second thought I am not sure if over-clocking is a good idea! Yesterday i was implementing my 1st RB1100 which i changed the memory rate to 533 and CPU to 1066Mhz. the router stop responding for no reason about 4 times in 6 hours where i had to unplug the power cord to make it work again....

sariao

Mhz rate is not evrything where both RB1000 and RB1100 are using almost the same processors family "PowerPC e500". where RB1100 is using e500v2 which has more advanced key improvements on older e500v1, i am not sure about RB1000 core. i know it is MPC8547 but it could be v1 or v2 how ever ...

sariao

when i reboot my router NTP it needs at least 20 sec to Resync i have more than 100 users authenticate over userman so i dont want to take this risk. unless you tell me that no service will start until date get synchronized?!

sariao

post an export of your Mangle, NAT, and Routing Table

sariao

i did not understand your scenario and you provide a digram of your scenario? also post your router config here [routing table, ip address, nat, ect..]

sariao

post a traceroute to yahoo.com from your computer and a print from your mikrotik routing table

how ever it looks like your DSL modem is disconnecting

sariao

http://forum.mikrotik.com/viewtopic.php ... 51#p247151

sariao

To whom it may concern, this script will save time and date every 10 sec and apply it after system reboot till system get SYNC with NTP Client the script will create 2 disabled users account [date] and [time] only to keep record of date and time. Just paste this code in your router terminal /system ...

sariao

as often as i need to install new update! despite the often rebooting, are you sure that running "user manager" service with wrong date and time would not affect the database even if no users trying to connect? what about graphing? what if the NTP server toke more that 3 sec? what if the i...

sariao

i Really dont understand the concept behind using NTP only! at least you could keep the tame saved on the local disk before it ReSync with NTP server! NTP takes time to reset system time after rebooting the system, what happen to user manager and Hotsopt during this time? they will give false login ...

sariao

i am trying to setup the date and time manually on my RB1100, every time when i restart the box date and time return to it is original setting year 2002!
is that normal? i mean i am not using NTP client and why should i ?!

Routerboard Ver: 2.30
Router Ver: 4.16

Regards...

sariao

Thanks guys that was useful. Another Thing, does anyone tried to utilize the microSD for web caching ? i used it for usermaneger and it worked just fine, but when i use it for web caching the router CPU jump to 100% and the router disconnect every time Webproxy tries to load or save anything to micr...

sariao

Greetings how did you manage to change CPU frequency? when i used change-frequency command it gave me: /system routerboard settings change-frequency frequency=? Frequency ::= 1000MHz | 400MHz | 600MHz | 800MHz when i try to change the frequency higher or lower it say: /system routerboard settings ch...

sariao

in fact, whyaskgh is right i have same problem i dont have any redirect rule in my dstnat, and still all http requests are going to webproxy automaiclly. this behiave is disabling my load balancing senario where all http traffic are travling using one WAN link. thats really a seriuos issue! you have...

sariao

i dont think your question is clear eough!

sariao

yes there was a minor bug. how ever i have update the code, try it and let me know 1- add this code to a script and name it "icmp_scan" :foreach ip in [/ip fire filter find chain=icmp_chk comm=icmp_chk] do {:if([/ip firewall address-list find list="icmp_temp" address=[/ip firewal...

sariao

refer to topic
http://forum.mikrotik.com/viewtopic.php ... 769&hilit=

sariao

or you can just use

to backup the database

/tools user database save

and to restore

/tools user database load

sariao

Dear
have you test the script?
in the address list there is two lists, one called "icmp_temp" which used for temporary scaning but the final list is "icmp_Blacklist" which have all ips exeed the 100pps

dont try to follow up the code, test it in your router and then let me know.

sariao

Thats True, ok i have wrote this script install it and try it. 1- add this code to a script and name it "icmp_scan" :local last :foreach ip in [/ip fire filter find chain=icmp_chk comm=icmp_chk] do {:if([/ip firewall address-list find address=[/ip firewall filter get $ip src-address]]=&quo...

sariao

you can do such thing: /ip fire filter add chain=output add chain=input protocol=icmp limit=100/1s,2 comment="Allow limited pings" add chain=input action=add-src-to-address-list protocol=icmp address-list=ICMP_blacklist address-list-timeout=4d comment="list excess pings" this scr...

sariao

no you can not! you can do such smiliar thing by sending notice to there emails.

sariao

Dear All. This subject is very important, for me at least and for those who is using MT User Manager. First of all, i would like to say that i am using this tool since one month so far, UM is a grate tool to be used and it makes users management a joy. But, and within this month of usage i have seen...

sariao

Time counting start from the 1st user login, so you have to use credit time as 1 week and uptime limit 10 hours.

sariao

Dear All. I have some features which is important and i need them: 1-Credit refunds, or Reversing Credit Adding transaction: using this feature will allow you to a reverse a transaction, so incase you have charged the user by wrong plan or the user want to refund the remaining account that can be do...

sariao

PCQ is used exactly to achieve what you want.

Follow the steps:
http://wiki.mikrotik.com/wiki/PCQ_Examples

sariao

Fine, then post your routing table with full details and your NAT, and Filter Rules.

sariao

yeh this is what i thought. but still it can be done without any additional hardware. what ever once you already bought new hardware it is easier to use it. so what you have to do is to use your new router133c as transparent bridge and apply queue on it. you dont have to enable anything else on that...

sariao

place your configurations.

sariao

I am not sure why you had to use new hardware for your new client? beacuse it sounds it can be done with your exsisting system. what ever if you wanted to allwo your users to authanticate to your central HOTSPOT just use your new hardware as bridge so you can control these users aswell. i am not sur...

sariao

How do you know it is the DLINK card not th internal one which is working? what ever, use: /int eth print /int eth mo 0 and make sure the Link is Ok, usualy the cable must be straight and some times it does not matter. and yes you can use Mikrotik with only one interface do NAT and bandwidth managme...

sariao

You are welcome man, and good luck.

sariao

Here you are, next time try to post your ip configurations: Adjust the values between "[]" : /ip fire man add chain=prerouting action=jump jump=markhttp in-interface=[YOUR LOCAL INTERFACE] dst-port=80 protocol=tcp passthrough=no add chain=prerouting action=jump jump=markhttp in-interface=[...

sariao

yeh thats true, the script is for old version! any how i'v fixed it for you but dont forget to adjust the value of "users" depend on how many users you have, also dont forget to change $traf/1 to $traf/1073741824 :local users :local traf :local i :set users 1 /ip fire filter :for i from=1 ...

sariao

what is your Router/Os version?

if it is 2.9.x correct your line:

:if ($traf>1) do={:log info ("user" . $i . " exceeded 1Gb limit!")}

Regards

sariao

well i dont know if i understand what you mean, how ever using paypal and CC is a grate feature in Microtik Routers.
But, is it practical for your senario!? That’s another story.

Regards.

sariao

I know these are your defualt gateways man, disable them do the trace and sumbit the results. after that you can reenable them! plus sumbit your routing table with detials and submit your NAT rule if you have so.

sariao

Dear Abab

try to disable these two records from your routing table:

0.0.0.0/0 r 2YY.14Y.58.81 Wan 
0.0.0.0/0 r 1XX.10X.38.21 Wan

after that try tracert again, and let me know.

sariao

you have to provide all your firewall ips and gateways.
also never post your real ips on the internet always hide some parts using XX.

please refer to WIKI

http://wiki.mikrotik.com/wiki/Load_Bala ... e_Gateways

Regards.

sariao

to monitor each user traffic you dont need to add simple queue!!
use Tools->Torch to monitor your users activity.

Regards.

sariao

what are you using to manager users account? by Users Manager or by adding users manually in the PPP secrets list? because it seems something related to authentication policy where there MT can not establish new PPPOE for the same user name till the previous session closed, or some one else using yo...

sariao

you have to add prement route record on your gateway 10.10.53.1 to route all request going to 172.17.1.0/24 to 10.10.53.12. so you have to tell me what is your 10.10.53.1? is it windows? if so do the follwing: goto start->run->cmd in command prompt write the following: Route add 172.17.1.0 MASK 255....

sariao

Do a trace route from any of your computers one computer from each segment. and post the results here.

for example, on compter from range 1XX.10X.38.32/28

tracert 2YY.14Y.58.100 -d

sariao

well i dont think it is a DNS problem since if i disconnect the VPN session all pages start working!
What ever i tried to change the DNS and nothing changed.

i will try to reinstall MT Router/OS today and i will update who ever concern.

Thanks, and if any more ideas please post.

sariao

Please post your ip configuration,routing table,filters, and NAT rule on your router..

sariao

Please refer to Wiki user manager payment section

http://wiki.mikrotik.com/wiki/User_Mana ... r_payments

sariao

Cross or Straight it does not matter,since any of your devices ports supports MDI/MDI-X crossover detection,
in another word if the adapter shows link established it does not matter performance never affected.

Regards.

sariao

Greetings. i am facing a strange situation with my MT 2.9.46. recently i have add an PPTP Client Adapter and i applied it as default route so all traffic must travel thru this tunnel to reach internet. now what is happening is something i could not understand, some internet pages such as google.com ...

sariao

I was trying to establish VPN connection between Microsoft windows and a MT router. my computer is behind a MT router as well. the scenario as follow: VPN Client pc ->MT1->INTERNET<-MT2(VPN PPTP Server) the connection drop while trying to verify username and password and it gives ERROR 619 the Debug...

sariao

you can write a script that send the arp list to your email, and then make it schedule

sariao

Can you please re explain your senario!

sariao

well shielder i have a small comment on your routing scenario.

you have to know that once you use "masquerade action" you will not be able to specify the nating source IP, that's mean the field "to src addresses" is ignored.

sariao

well i can have an IDE cd drive also, so i attache it to the system once i want to install RouterOS and then i can remove it again to use it with another system :)

Thanks

sariao

Well thanks for that instant reply.

using netinstall could be a solution, but the idea is.
i dont want to use any local drives, floopy drive or a fixed cd room as well.

thanks again.

sariao

hi.
i am not sure about MT BGP settings ether. but try the following:

/routing bgp set as=64600
/routing bgp peer add remote-as=17800 remote-address=202.58.71.254 multihop=yes
/routing bgp set ena=yes

wish you luck.

sariao

Greetings.

i have tried to install MT thru USB External CD DRIVE, and i seems MT installation is not supported!
after LILO boot and once the setup started it says "no cd found!"

so any idea about this?

Thank you.

Search found 92 matches