MikroTik

lordkappa

TikTool is not provided or supported by Mikrotik. Try asking around the developer's website. http://www.tiktool.com/

lordkappa

The discovery of local steam clients is done using broadcasts. You'd have to be using a single flat ip range and a TAP VPN setup.

lordkappa

See http://wiki.mikrotik.com/wiki/Manual:Wireless_Station_Modes#Mode_station-pseudobridge . This mode is limited to complete L2 bridging of data to single device connected to station (by means of single MAC address translation) ... bridging of non-IP protocols to more than one device will not work P...

lordkappa

To my knowledge, Users and groups are not exported in the plaintext file exports. If you want to export them to an identical RB Model with the same ROS version, you can use /system backup save These can be encrypted or not, but they are not human-readable and can't be moved between Routerboard model...

lordkappa

A good software/hardware vendor can create enormous impact when it take user feedback seriously. We had to wait almost a decade to get some sense of what update package are we uploading to a tower 500km away... Congratulations, Hellbound! Though faced with negativity and criticism, you have perseve...

lordkappa

You'll want to specify a queue type in the pptp server profile. This is strangely absent from the wiki (http://wiki.mikrotik.com/wiki/Manual:PPP_AAA#User_Profiles) , but it's visible in winbox. Otherwise the command arguments are: /ppp profile add queue-type=" " parent-queue=" " ...

lordkappa

If you are trying to use standard "Magic packet" WOL this will never work. WOL is strictly layer 2. It won't be routeable since it's only addressed to the broadcast address. Also, since it's a layer 2 affair the magic packet doesn't even need to use a port. UDP is only used for programmer ...

lordkappa

Here's a nice visual color guide for cat5 cables - http://www.duxcw.com/digest/Howto/network/cable/cable5.htm I would not recommend this site as it only specifies the cross-wired pattern used for 100BASE-T wiring. This deprecated crosswiring pattern will cause devices that don't implement MDI/MDI-X...

lordkappa

I run cable test and it report the 2nd pairs is open
But I don't know the 2nd pairs's color ?

It's listed in the TIA-568-B specification document.

Here is the table from page 7:

colour codes.png

lordkappa

http://routerboard.com/RB941-2nD-TC

The hAP lite is equipped with a powerful 650MHz CPU, 32MB RAM, dual chain 2.4GHz onboard wireless, four Fast Ethernet ports and a RouterOS L4 license. USB power supply is included.

The text description does specify that it has a level 4 license.

lordkappa

http://wiki.mikrotik.com/wiki/Manual:IP ... on_details

When enabled '/ip cloud' will send encrypted UDP packets to port 15252 to hosts that resolves from cloud.mikrotik.com.

10/10. Would Wiki again.

lordkappa

A lot of people will probably reply that "You can just use 'quick-set' and forget it." I disagree with this. I wouldn't sell someone a plane and say "It's great, just leave it on autopilot." I would expect that they know how (or want to learn how) to fly when something goes wrong...

lordkappa

The MIB is posted on the wiki. http://wiki.mikrotik.com/wiki/Manual:SNMP#Management_information_base_.28MIB.29 From the MIB file: iso.org.dod.internet.private.enterprises.mikrotik.mikrotikExperimentalModule.mtXRouterOs.mtxrHealth.mtxrHlTemperature.0 (OID 1.3.6.1.4.1.14988.1.1.3.8.0) - 350.0.000000 L...

lordkappa

This is explained in the summary of the L7 page on the wiki. http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7

Also, any attempts to layer-7-match either Youtube or Facebook traffic will be fruitless; they both use HTTPS. The router has to be able to see the traffic to match it.

lordkappa

Why would you want to do that? Are you going to mount the router backwards on the rack?

I don't think they offer this. The fans are mounted at the back and I don't see any mounting slots at the front. I also don't think just flipping the fans around would be very effective.

lordkappa

thanks for your reply... in my case I put rate = 0 so that is divide the BW dynamically, and put max limit to be 480 kbps so that the total BW doesn't exceed 480 kbps, but when I monitor the queue status from queue tab---> queue tree I see the Avg. rate raise more than the max limit so I could see ...

lordkappa

there is should a common point (for example in Mikrotik itself) to see how much each device is consuming

Sorry; To my knowledge, there is not.

lordkappa

thanks for your reply... I am using it and had put the PCQ-rate to be 0 as per the manual it should share whatever BW available in between users, but how to make sure what I did is correct or is taking affect? , where in Mikrotik I can prove this ? As explained on the linked wiki page, please make ...

lordkappa

hEX has Gigabit ports http://routerboard.com/RB750Gr2
hEX lite has 100Mbit ports http://routerboard.com/RB750r2

Question was about hEX

Normis is correct. My mistake.

lordkappa

If you want to process this traffic, it will take a toll on the speed. If you don't want any processing, only a private IP in your LAN, you can enable Fasttrack for the LAN IP addresses and get maybe even 900Mbit. Depends on what you need the router for. Likely not on this model, though... Consider...

lordkappa

Ha ha. A ha ha... This guy. That's a good one.

Quote Routerboard.com:

10/100 Ethernet ports - 5
10/100/1000 Ethernet ports - None

lordkappa

Use PCQ. It behaves this way by default.

http://wiki.mikrotik.com/wiki/Manual:Qu ... e_Examples

lordkappa

1. Yes
2. Ostensibly, yes. It will be as-if they were plugged into ether2.

lordkappa

hi guys, we are using OpenDNS to block certain sites. how to implement this? 1. Certain "privilege users" must passthru a another DNS like google. 2. Force all other users to use OpenDNS during office ours and use GoogleDNS on non office hours. Please help. thanks, OcaVid Forward it to IT...

lordkappa

If you're using HTTP, (Bad bad, you should be using HTTPS) then you can use a regular expression to tag the connection in Prerouting, and use NAT rules from there. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html for HTTP GET request structure. This will work because Mangle Prerouting happe...

lordkappa

MTCNA, MTCWE, MTCRE

That's a lot of certs to have without learning out how to use the terminal, dual boot, virtualbox or use wine.

Also, wrong section. -> Forum -> General

lordkappa

I just need to ensure it supported up to 300 Mbps. I'm worry about it can be worked only 54 MB. May be i configured some thing wrong. :D Try installing inSSIDer 2 on a laptop. It will show you exactly what modes your access point supports, given its current configuration, as well as frequencies and...

lordkappa

Hi! I'm afraid I don't understand this fully. :( The problem, is that routers deal with traffic flowing in BOTH directions. The reason you couldn't access the web was because the router was NATing any outgoing traffic destined for port 80 as well as any incoming. As marting pointed out, you need to...

lordkappa

Your results are typical of most Wireless N scenarios. Please bear in mind, 300 is a "perfect world" "dreamland" number. This will never be achieved in the real world.

lordkappa

Let's step through what you're asking the router to do, together. chain=dstnat action=dst-nat DST-Nat protocol=tcp dst-port=80 Any packet with a dst-port of 80. to-addresses=192.168.88.5 to-ports=80 Change its destination IP to 192.168.88.5. Hopefully now the problem is quite clear. ;) Think through...

lordkappa

If your microwave can achieve 1Gbps I'm amazed. I barely mange 35Mbps on high/15Mbps on defrost. Tends to heat up a lot, either way.

This is all without NV2, though. I can't seem to get NV2 to work, might need to upgrade to a new turn-table.

lordkappa

Please note the speed listed on an SFP transceiver, here: http://routerboard.com/S-31DLC20D

See how it the Data Rate says 1.25G and not 10M/100M/1000M/1.25G?

You can't change the 'speed', or Data Rate of an SFP module.

lordkappa

Is your ISP doing some filtering? It's possible certain ports are being blocked at your ISP's ingress and will never make it to you.

Or they may be doing deep packet inspection and blocking inbound telnet connections. (Also, obligatory scolding for using Telnet on the public internet.)

lordkappa

sorry for my ignorance, but how do I enable that log? and how do I look at it?

You can append "log=yes" to your firewall rule, and optionally "log-prefix=" to apply a prefix to those log entries. "/log print" shows log if you're using terminal.

lordkappa

I'd probably look into an RB850Gx2.

If money is no object, an RB1100AHx2 or CCR1009-8G-1S would be awesome but they're big, have fans, and are way more router than you need.

lordkappa

is there anyway trace that traffic and see what is blocking it? You can try setting the 'log' flag on all your firewall rules and see if anything pops up. Also, clear your counters and watch if any of the NAT rules have their counters incremented when you try to connect. I'm out of ideas; I've trie...

lordkappa

add chain=srcnat dst-address=10.1.1.0/24 src-address=10.1.3.0/24 What is the purpose of this line? Are you trying to stop 10.1.3.0/24 traffic from being masqueraded? Since it isn't going out the gateway interface it wouldn't be, anyway. Its existence might be stopping traffic from hitting your othe...

lordkappa

that didn't work either...

I feel there may be something fundamentally flawed with your testing method. Are you attempting to test it by connecting to the external IP of your router from within your local LAN?

lordkappa

Delete your first firewall rule. Change your DST-NAT action to action=netmap instead. Like this, add action=netmap chain=dstnat dst-port=8016 in-interface=ether1-gateway \ protocol=tcp to-addresses=10.1.3.185 to-ports=8016 Also, best practice is having your masquerade rule at the top of your NAT rul...

lordkappa

Any ideas?

You haven't posted your firewall/NAT config yet.

lordkappa

Most every email provider posts their SMTP server publicly... I didn't think we needed a canonical list.

lordkappa

You could put Eth0 and Eth1 in a bridge. Get a DHCP address on the bridge interface, and use that as your WAN-facing interface.

Bridging is done in software, but provided the throughput is not overly high this is the easiest way.

lordkappa

You did your due dilligence and kept backups of your working configurations, right? ;) Just do a reset and load your backup configuration... Don't forget to lock it down this time. Seriously though, if you don't have a backup from before the hack, I wouldn't use any configuration settings currently ...

lordkappa

Googled "Routerboard Reset".

First result:
http://wiki.mikrotik.com/wiki/Manual:Password_reset

lordkappa

It would help to post your config so we can see what's going on. Also, It would be easier to use the Netmap action, with in-interface specified, to perform port forwarding. This way you won't have to modify your rule if your external IP changes. add action=netmap chain=dstnat comment="Your Comm...

lordkappa

You could possibly add a 'dummy' IP on the Router that forwards all traffic to the target machine on the LAN except that traffic you wish to forward externally, but this will be somewhat hacky. If you were willing to be that hacky, you wouldn't even need the dummy IP. :P Just point your client to t...

lordkappa

No, there isn't. The router can't redirect traffic it doesn't receive. A PC will only send traffic to the default gateway if the destination IP isn't in its own local subnet. You can check your PC's local routing table to see why this makes sense; your local subnet will show up as a separate routing...

lordkappa

Have you enabled UPnP?

Universal Plug n' Pwned? Why hand over control of your router to any internal device that wants it? In that case, Just open up ALL the ports; it's just as secure and at least then nobody else can make changes to your NAT and firewall policies without your knowledge.

lordkappa

Unfortunately, what you are trying to achieve is impossible with only one IP. Let me explain. NAT involves sharing a single external IP with multiple internal devices. To do this, the router swaps the source IP of each outgoing packet with it's own IP, and then makes a note of the original IP, the d...

lordkappa

where to download older relese ? mipsbe

Older releases are considered "Not officially supported" and are not available on the mikrotik download page.

If you have a special need, make your case to support@mikrotik.com; they might send you an older version.

lordkappa

Trivial. The pcq-rate option does exactly this. This page from the Wiki has the information you desire.
http://wiki.mikrotik.com/wiki/Manual:Qu ... e_Examples

lordkappa

This feature should be nixed. Not even optional, just removed.

Having a do-nothing rule in firewall because your OS can't correctly track fastpathed traffic is just kludgy and unprofessional. As stated before, the same counters are available in ip->settings.

lordkappa

*) wireless - added WMM power save suport for mobile devices;

Wow. I've been forced to run Ubiquiti APs for the last 3 years due to exactly this.

lordkappa

From what I'm hearing, it doesn't sound like you need NAT. If all you want is connectivity between 2 computers you don't need NAT. There are lots of in-depth explanations on what NAT does but here's the short version. NAT is used when you need to change the IP addresses in a packet. src-nat changes ...

lordkappa

Yes, but what is your desired effect? NAT is a tool; it can be used for many things depending on your needs. Saying "I want NAT between these 2 computers" is like saying "I want to saw these wooden boards, where should I cut them?" without telling me what you're trying to build. ...

lordkappa

Well... The reason you can still ping is that the first NAT rule redirects all traffic destined for 192.168.3.11 to the router's 192.168.33.1 interface. The router is responding to your pings, not the PC. Obviously the router isn't running RDP, so that's why it isn't responding anymore. Then, your s...

lordkappa

Use

out-interface=

instead of

to-addresses=

Masquerade used without an out-interface specified is liable to wreak all kinds of havok.

That's likely causing your issue.

lordkappa

Paint?

lordkappa

Cool stuff, thanks for sharing!

lordkappa

If you click on the rule, you can see the full list. It will include the to-address.

lordkappa

In my experience you need to set the master-port to none on a port first before you change it.

Set all ports to master=none. Then retry your script.

lordkappa

IP -> DHCP Server.

Just remove it from the list.

lordkappa

Depends on who you're talking to.
https://en.wikipedia.org/wiki/Units_of_ ... _multiples

In my experience Storage and networking typically use 10^6. Hardware specs, programs, and programmers typically use 2^20.

lordkappa

took this out then put it back to no affect: [admin@<router>] /ip firewall filter> print [...] 7 ;;; 8322 to .29:8322 chain=forward action=accept protocol=tcp dst-address=192.168.29.33 dst-port=8322 log=no log-prefix="" What do the rest of your firewall rules look like? It's very possible...

lordkappa

http://forum.mikrotik.com/viewtopic.php ... 07#p363664

lordkappa

It's classified as Input, unless there is already an associated entry in ip tracking or NAT; Then it's forwarding.

lordkappa

You've done everything you can. IP lists don't work well because TOR Entry and bridge nodes constantly change. Unless you block HTTPS traffic entirely, blocking TOR Traffic from users is impossible. It was designed this way. If you'd like further proof it's efficacy, please contact: State Council In...

lordkappa

Good idea, HTTPS would be welcome.

Posting an MD5 is worthless though; as any attacker who could intercept or alter your download would also be able to modify the downloads page so it showed the new modified file's MD5.

lordkappa

The 2 rules I suggested will only link one external PPPoE interface directly to one internal IP; all ports (Essentially, a DMZ.) If you're asking how you can select which ports are mapped, you can use protocol=<tcp/udp> dst-port=<ports> in your original IN->NAT rule. e.g. add action=netmap chain=dst...

lordkappa

Try using action=netmap instead of dst-nat.

lordkappa

Create 2 pools, create 2 ppp profiles and specify a different profile for each secret based on what access level you'd like them to have.

If there's a conflict between the default profile and the one a user is assigned, the one assigned to that user takes precedence.

lordkappa

/ip address add interface=InterfaceName address=your.desired.ip.here netmask=your.netmask.goes.here You will also have to change your DHCP network so your LAN clients know the new gateway's IP, as well as change your DHCP pool so that the addresses lie within the same subnet. Or, easier, you could ...

lordkappa

the association between interfaces and switches[1|2] if fixed and cannot be modified Correct, the exact association is visible in the block diagram listed on routerboard.com: Example http://i.mt.lv/routerboard/files/Block-RB2011.pdf without further configuration, no switching takes place, all ports...

lordkappa

This is found on version 6.13, but I am sure it will still be there....

How can you be sure? Support won't help you if you can't even be bothered to update your software.

lordkappa

1) They're all ethernet interfaces, so they are the same type.
2) You can name an interface whatever you want, the names 'mean' nothing.
3) Slave, under the default name, means it has master-port set and is part of a switchgroup.

http://wiki.mikrotik.com/wiki/Manual:De ... igurations

lordkappa

The NTP client and server are available as an optional ROS package.

Basic package uses SNTP.

lordkappa

Routerboard product licenses are built-in.
Contact support: http://www.mikrotik.com/support.html.

lordkappa

Factory reset. As per http://wiki.mikrotik.com/wiki/Manual:Password_reset.

lordkappa

/ip firewall connection tracking set enabled=yes /ip firewall filter add action=accept in-interface=<WAN-NAME> connection-state=related place-before=0 add action=accept in-interface=<WAN-NAME> connection-state=new place-before=0 add action=accept in-interface=<WAN-NAME> connection-state=established...

lordkappa

1.) Here http://www.catb.org/~esr/faqs/smart-questions.html 2.) Then here, http://wiki.mikrotik.com/wiki/L2TP_%2B_IPSEC_between_2_Mikrotik_routers http://wiki.mikrotik.com/wiki/Improved_Load_Balancing_over_Multiple_Gateways http://wiki.mikrotik.com/wiki/Monitor_logs,_send_email_alert_/_run_script Th...

lordkappa

Enable connection tracking.
Add 3 firewall rules above your blacklist rule to allow each "new", "established" and "related" connections.

lordkappa

You should be accomplish this by using two different actions; Masquerade for outbound and netmap for inbound. I think masquerade would be the only way to do srcnat with a dynamic IP (Without doing more complicated scripting... Keeping it simple.) /ip firewall nat add action=masquerade chain=srcnat c...

lordkappa

If you're not using VLAN Tags or trunking (You didn't say that you were) and only require that the 2 segments are seperated, you could just set them as 2 groups with different master ports and treat them as 2 different switches; forget VLAN entirely. Just set ports 2-12 as master-port=ether-1 and po...

lordkappa

Yes I have, I've found :
http://wiki.mikrotik.com/wiki/Manual:Interface/SSTP

which just gives the explanation

Really? I see some workable samples at the bottom.
http://wiki.mikrotik.com/wiki/Manual:In ... n_Examples

lordkappa

Thanks for a handy feature! Hopefully it sees more refinement to add the ability to specify which Public IP(s) are ddns'd, and the ability to revoke/delete a domain.

I too use my own scripts for DDNS, but this is a very nice feature for those times you just want a domain and don't need any fluff.

lordkappa

Same issue. To clarify, the issue is being caused by the switch chip behaving as a hub... All traffic coming in any port is being forwarded out all other slaved ports (broadcasts or not). If you have even one 10Mbit link, all links must transmit at that speed. Only affects hardware switched ports, n...

lordkappa

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle

No. As per the documentation, they are only used internally.

lordkappa

Are you trying to bridge the two connections? If so, are the hotspot and the SXT-A Ethernet-interface both added to a bridge? Or are you trying to actually route the packets... If so, where are the hotspot and it's clients getting their IP addresses? DHCP will not reach beyond the SXT-A unless it's ...

lordkappa

There's a Wiki page on setting up PPTP and VPN, did you remember to enable Proxy-Arp as detailed in the Application Examples here?
http://wiki.mikrotik.com/wiki/Manual:In ... n_Examples

lordkappa

Ideally you wouldn't want to expose a service that is not already secure. Trying to add security back in, at the network layer, isn't really the best solution. Do you have reason to believe that the NAS does not offer an acceptable level of security? If someone were trying to brute force a password ...

lordkappa

spoke too soon. Adding a port to a bridge (no matter how I do it) causes the router to switch to bridge mode. :( I'm not sure what you mean by Bridge "mode". The basic steps are to ensure ports 3-5 have their master port set to port 2 in Winbox, thereby making them switched together. Then...

lordkappa

The RB750 series uses the Atheros7240 Hardware switching chip on only ports 2-5; So you'll have to bridge ports 1 & 2 if you wish to use it in this way. Note that bridging increases CPU usage, where switched traffic does not.

lordkappa

It would be easier to use the Netmap action to perform port forwarding. add action=netmap chain=dstnat comment="Your Comment" disabled=no dst-port=8888 in-interface=ether1-WAN protocol=tcp to-addresses=192.168.1.50 This statically maps the external port "8888" on ether-1 to the s...

lordkappa

Had the same problem. The issue seems to be with the TX-Rate selection on Mikrotik products. I've contacted Support and viewed numerous threads about this but never was able to rectify the issue. Sad to see it still hasn't been fixed. In the end, I used separate Ubiquiti AP's and let Mikrotiks handl...

lordkappa

Firewall rules still run, even if there is no service listening on that port.

lordkappa

I think you're entirely misunderstanding the concept of 'usable' bandwidth. Link speed is the theoretical maximum transfer rate over the link. The RB751G simply cannot generate 1Gbit worth of traffic, nor could it ROUTE 1Gbit worth of traffic, since every single packet needs to be processed by the C...

lordkappa

But the browser (webfig) I see the second server, the remaining time of 3 hours and 30 minutes door (This means that less time will not stand up to 0 - while both the server settings as well) In Server 5.7 is that good shows like Winbox shows What is the problem? Uh, what? I think you're going to h...

lordkappa

You could block by IP, but many sites like youtube have a slew of ip's. Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com". /ip firewall filter add chain=forward action=reject reject-with=tcp-reset protocol=tcp conten...

lordkappa

Use the "Content" field in your firewall and/or Mangle rules, as per here. http://forum.mikrotik.com/viewtopic.php?f=13&t=63290

Youtube could always get/change ip's, so it's not practical to try and filter them based on that.

lordkappa

Here is something else I was told by my lovely ISP. From ISP demarcation point they told me to put a 8 port switch, run the cable to each location and install something like RB751 there with its own public IP address. Would this setup work ok? Do I have to worry about any traffic/discovery problems...

lordkappa

http://wiki.mikrotik.com. You'd be surprised what's there.

Specifically, see here: http://wiki.mikrotik.com/wiki/Manual:IP ... dress_list.
And Here: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter

lordkappa

Also, TFTP is not FTP. They are not the same and use different ports. You want FTP, under IP->Services. If you're not using TFTP specifically, you should turn it off.

lordkappa

You want station mode.

There's information on it, and the different modes, in the wiki,
Here: http://wiki.mikrotik.com/wiki/Manual:Wireless_AP_Client
and Here: http://wiki.mikrotik.com/wiki/Manual:Wi ... tion_Modes

lordkappa

Hi, As your comment we can block all in network. As I need I want to block by IP address. Some user I don't allow to access website. I'm confused. Did you solve the problem? If my rule didn't work as written, see http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter regarding how to write firewal...

lordkappa

Pretty sure you're looking for Station Bridge mode. http://wiki.mikrotik.com/wiki/Manual:Wi ... ion-bridge Otherwise, if you aren't able to use that mode, you can try Station-pseudobridge.

lordkappa

Are your firewall rules set to allow access to port 1723?

lordkappa

A quick search of the wiki turned up this: http://wiki.mikrotik.com/wiki/NTH_load_ ... pproach%29.

It details what I think you're looking for.

lordkappa

You could block by IP, but many sites like youtube have a slew of ip's. Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com". /ip firewall filter add chain=forward action=reject reject-with=tcp-reset protocol=tcp content...

lordkappa

From the wiki: http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless

AP modes:

    ap-bridge - Basic access point mode.
    bridge - Same as ap-bridge, but limited to one associated client.

You should be using AP Bridge for access points. Station is for PtP and PtM links.

lordkappa

I suggested separate IP spaces because it may make administration a bit easier, and having the proxy on a different port on your router will provide better throughput. If you prefer not to do that, you could create a specific DSTNat rule for the proxy server's IP which immediately hands off the pack...

lordkappa

There's nothing in the patch notes about it, but since updating takes barely a minute, it's easy to just update and find out.

If you have a lot of hardware to update, use The Dude to deploy the updates quickly and easily to all your devices.

lordkappa

Yes, that is why it doesn't work.

If you want to use NAT instead of configuring each individual PC with the IP of the proxy, You could solve it by putting the proxy on a different port on the router, and giving it an IP in a different subnet which won't hit the DSTNat rule.

lordkappa

Check here: http://wiki.mikrotik.com/wiki/Manual:System/Time

Which command you use depends on whether you installed the optional NTP package or not.

lordkappa

1. On the wiki, there is a page about PPTP. http://wiki.mikrotik.com/wiki/Manual:Interface/PPTP Which tells you what port PPTP uses. 2. Also on the wiki, there is a page about IP Firewall. http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter which tells you how to accept packets on a given port.

lordkappa

Likewise. I have also sent this file to support along with my supout.

lordkappa

Why not? While you're there, you may as well upgrade them all to 5.18 so you're current.

lordkappa

You should be able to create 3 VLAN interfaces, with VLAN ID's and assign them to one physical interface. As per: http://wiki.mikrotik.com/wiki/VLAN /interface vlan add name=VLAN2 vlan-id=2 interface=ether1 disabled=no add name=VLAN3 vlan-id=3 interface=ether1 disabled=no add name=VLAN4 vlan-id=4 in...

lordkappa

Not currently. SMB filesharing was only added recently, so who knows what the future holds, but with the proliferation of wifi capable printers, I don't think this feature would be a priority.

lordkappa

Not to preach but you really shouldn't use uPnP; it's not secure. Port forwards should be done as-needed, by hand. But anyway, did you check your firewall rules to see if traffic is being dropped by a rule in there? It's also entirely possible your ISP blocks incoming port 80 requests, as many do (r...

lordkappa

Did you punch 192.168.88.1 into the DNS page, like the example showed? If so, that's your problem.

Beyond that, more information about your specific configuration would be needed. an "export compact file" would help.

lordkappa

By using srcnat I will also have to put dstnat rules, right? Not for normal surfing. Connection tracking will automatically DSTnat any return traffic which is expected. If you need so-called "Port Forwarding", you will need to set up manual DSTNat rules. - What about RB2011L performance i...

lordkappa

I have the same problem Matt does with my 751u-2hnd. It's an intermittent problem where the TX rates will drop to abysmal levels, (1-10mbps) stay there for some period of time (Between 1 and 10 minutes) then eventually rise back to normal rates. It happens with all clients, on any combination of set...

lordkappa

Use the export command.

Export compact file %name%

then

import %file%

on the new box.

lordkappa

I think insyne just wanted to block public addresses from entering his router from the outside; not set up VLANs.

Looks like your problem is that your first firewall rule is not set up correctly. You seem to have transposed the src and dst ip's.

lordkappa

For specifics, reference here: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall . -Create an address list with the 2 PC's you want to exclude in it. -Create a "forward" chain firewall rule to drop packets arriving at your LAN-facing interface and originating from machines *NOT* on the addr...

lordkappa

So, if you are getting 2MB/s with G, then it is pretty close to the max. If you are getting 2MB/s with N, then something is definately wrong. +1. The max with 802.11g is, of course, 54mbit but typically you only get just over half that due to overhead. I usually average no more than 2.6MB/s over G.

lordkappa

I assume you've set up a master SRC-Nat rule to NAT all your privately addressed traffic over your outbound interface. Your issue is only that the examples used a specific external destination IP for the DST-Nat rule? When you're setting up the specific DST-Nat rule, about halfway down the window, t...

lordkappa

Forgive me, but It sounds like you're running a NAT within a NAT, and I think you're asking how to forward packets bound for a certain TCP port on Router-1 to a certain computer behind Router-2. Assumptions: Current setup ISP ----------- Router-1 ------------ Router-2 ---------- PC Router-1: Eth1- F...

lordkappa

If you're using NAT and don't want to expose your entire network by bridging to the internet, you could add an explicit NAT-All rule at the end of your nat config to create a DMZ to a required machine. The advantage being that you could enable and disable the rules only when you needed them. /ip fir...

lordkappa

The system health command shows system monitors such as CPU/System temp and/or voltages. As per the product page, http://routerboard.com/RBOmniTikU-5HnD , this board does not have those sensors built-in. Connection strengths for each client can be seen under wireless registration. I believe the exte...

lordkappa

Lots of places have online training There are online courses, and some free training videos at www.mikrotikuniversity.com, for example.

lordkappa

I'm having trouble understanding your exact problem. Have you enabled Proxy Arp on the local-LAN-facing Ethernet port?

lordkappa

Are my expectations of MikroTik and their "community" too high? Should I not expect quick responses? No need to be condescending. None of us are paid to be here to fulfill your expectations. We take time out of our schedules to help each-other out where and when we can. Some more informat...

Search found 133 matches