Community discussions

Search found 43 matches

by rkau045
Thu May 02, 2019 1:43 am
Forum: Scripting
Topic: Power out notification
Replies: 11
Views: 918

Re: Power out notification

I believe what you are asking for is a "dying gasp"
Edited to add: this is usually implemented in hardware.
Sent from my Pixel 3 XL using Tapatalk


by rkau045
Sat Mar 02, 2019 11:30 pm
Forum: Beginner Basics
Topic: Does a single touch of reset button reboot the Mikrotik router
Replies: 2
Views: 267

Re: Does a single touch of reset button reboot the Mikrotik router

Just remove the power for a couple of seconds, then reconnect.

Sent from my Pixel 3 XL using Tapatalk

by rkau045
Tue Feb 26, 2019 6:58 am
Forum: Wireless Networking
Topic: LHG 60G experience
Replies: 545
Views: 61123

Re: LHG 60G experience

Cycling timeouts like this are usually caused by STP blocking and reenabling forwarding on a port in my experience.

Sent from my Pixel 3 XL using Tapatalk

by rkau045
Thu Jun 14, 2018 2:02 am
Forum: Beginner Basics
Topic: LAN2LAN ipsec tunnel with Juniper
Replies: 6
Views: 692

Re: LAN2LAN ipsec tunnel with Juniper

The Juniper should be set up as a policy-based VPN, it seems that they have it set up as route-based, and only partially at that, if the cited config is complete. I do not believe that it is possible to use IPSec in a route-based configuration unless both endpoints are Juniper devices. Proxy ID shou...
by rkau045
Mon Jul 10, 2017 8:05 pm
Forum: Announcements
Topic: v6.40rc [release candidate] is released! (New bridge implementation delayed till 6.41rc)
Replies: 207
Views: 35744

Re: v6.40rc [release candidate] is released! (New bridge implementation)

I should have looked at the diagram before posting. You are correct. Sorry.

Sent from my LG-H910 using Tapatalk
by rkau045
Mon Jul 10, 2017 7:41 pm
Forum: RouterOS v7 BETA
Topic: v6.40rc [release candidate] is released! (New bridge implementation delayed till 6.41rc)
Replies: 207
Views: 35744

Re: RE: Re: v6.40rc [release candidate] is released! (New bridge implementation)

@becs On VLAN Example #2 (Trunk and Hybrid Ports) there is a port mismatch /interface bridge vlan add bridge=bridge1 tagged=ether2,ether7,ether8 untagged= ether3 vlan-ids=200 add bridge=bridge1 tagged=ether2,ether6,ether8 untagged= ether4 vlan-ids=300 add bridge=bridge1 tagged=ether2,ether7,ether8 ...
by rkau045
Wed Jan 04, 2017 7:08 am
Forum: Forwarding Protocols
Topic: config public ip in mikrotik for server
Replies: 5
Views: 766

Re: config public ip in mikrotik for server

You may want to change the action to dst-nat in that rule. Also, I would limit it to only the protocols and ports that have services listening on them (tcp/80,443 on a web server, etc.)

Sent from my LG-D850 using Tapatalk
by rkau045
Fri Dec 30, 2016 2:38 am
Forum: General
Topic: How to configure this IP firewall rule?
Replies: 8
Views: 1188

Re: How to configure this IP firewall rule?

If you have rules for Established, Related before these rules, the remaining packets are probably accepted there. These rules would only match the first packets in the connection.

Sent from my LG-D850 using Tapatalk
by rkau045
Thu Dec 29, 2016 7:18 pm
Forum: General
Topic: How to configure this IP firewall rule?
Replies: 8
Views: 1188

Re: How to configure this IP firewall rule?

Those rules are still AND gated. Traffic will only pass to port 3799 from either 1812 or 1813. All other packets will be dropped. The rules here are functionally the same as what was suggested in post #3, but in 3 lines rather than 2.

Sent from my LG-D850 using Tapatalk
by rkau045
Wed Dec 28, 2016 5:35 pm
Forum: General
Topic: How to configure this IP firewall rule?
Replies: 8
Views: 1188

Re: How to configure this IP firewall rule?

Put the accept rule before the drop rule. Firewall rules are processed in order top to bottom.

Sent from my LG-D850 using Tapatalk
by rkau045
Tue Oct 18, 2016 4:12 pm
Forum: General
Topic: CAPSMAN Inaccurate rx signal readings in Registration table? - FAULT?
Replies: 3
Views: 728

Re: CAPSMAN Inaccurate rx signal readings in Registration table? - FAULT?

No change to your tx power will ever affect the signal you receive from the client device, unless the client is adaptive, in which case increasing your tx will get you a lower rx.

Sent from my LG-D850 using Tapatalk
by rkau045
Thu Sep 01, 2016 12:18 am
Forum: RouterBOARD hardware
Topic: How do you fix a broken greentelfth fiber optics line
Replies: 5
Views: 862

Re: How do you fix a broken greentelfth fiber optics line

I can say that if anyone other than one of our qualified technicians tampered with our fiber cables they would soon receive a large invoice for our replacement costs. Call the owning utility...

Sent from my LG-D850 using Tapatalk
by rkau045
Mon Aug 22, 2016 9:35 pm
Forum: General
Topic: fcs error on link?
Replies: 2
Views: 1147

Re: fcs error on link?

Check your speed and duplex.

Sent from my LG-D850 using Tapatalk
by rkau045
Sat Jul 09, 2016 8:03 am
Forum: Beginner Basics
Topic: Proxy ARP on VLAN/Bridge - was working, now isn't
Replies: 3
Views: 2926

Re: Proxy ARP on VLAN/Bridge - was working, now isn't

The behavior you describe sounds like STP disabling an interface on your bridge. Check for loops.

Sent from my LG-D850 using Tapatalk
by rkau045
Sat Sep 19, 2015 6:55 am
Forum: General
Topic: FOrwarding Public IP to local IP Problem
Replies: 40
Views: 62071

You need a dst-address in that rule. It should be the ip for WAN.
by rkau045
Mon Jul 20, 2015 6:38 am
Forum: General
Topic: Mikrotik Mac Addresses
Replies: 6
Views: 1806

http://www.macvendorlookup..com is one source.
by rkau045
Mon Jul 20, 2015 1:21 am
Forum: General
Topic: Mikrotik Mac Addresses
Replies: 6
Views: 1806

Mikrotik Mac Addresses

CompanyRouterboard.com AddressMikrotikls SIA Pernavas 46 Riga LV1009 LATVIA Range 4C:5E:0C:00:00:00 - 4C:5E:0C:FF:FF:FF TypeIEEE MA-L CompanyRouterboard.com AddressMikrotikls SIA Pernavas 46 Riga LV-1009 LATVIA Range D4:CA:6D:00:00:00 - D4:CA:6D:FF:FF:FF TypeIEEE MA-L CompanyRouterboard.com AddressM...
by rkau045
Sat Apr 11, 2015 3:17 am
Forum: The Dude
Topic: Doscover runs and scans - but no map shows up
Replies: 1
Views: 1053

My first thought is that UAC is preventing the scan from finding any hosts. Try running The Dude as Administrator by right clicking, or create a shortcut and set Run As Administrator in the properties. The other option would be to disable UAC for the computer in the Windows Control Panel. Sent from ...
by rkau045
Wed Apr 01, 2015 2:46 am
Forum: Beginner Basics
Topic: Order of firewall rules processing on hardware level / performance
Replies: 7
Views: 3882

I would change the ICMP rule to only allow echo request/reply. ICMP has other functions, and can be a vector for intrusions.

Sent from my LG-D850 using Tapatalk
by rkau045
Mon Mar 09, 2015 1:29 am
Forum: Announcements
Topic: RouterOS v6.27 released
Replies: 273
Views: 99687

I fail to see the problem here. The rules are processed in order from top to bottom.

Sent from my LG-D800 using Tapatalk
by rkau045
Wed Jan 28, 2015 2:11 pm
Forum: Wireless Networking
Topic: Ethernet Ports
Replies: 2
Views: 521

Re: Ethernet Ports

This behavior typically indicates an issue with your cabling. I would recommend replacing the cables on the affected ports.

Sent from my LG-D800 using Tapatalk
by rkau045
Tue Jan 06, 2015 9:56 pm
Forum: Beginner Basics
Topic: Deny outside DNS on port 53 / Permit Inside DNS?
Replies: 17
Views: 19809

Re: Deny outside DNS on port 53 / Permit Inside DNS?

I block forward as well on the external interface as it allows me to dst-nat port 53 for internal access without having opened that server to traffic from the outside. Your assertion that it will block requests from the he internal network is not correct. Replies are accepted with standard rules for...
by rkau045
Tue Jan 06, 2015 7:23 pm
Forum: Beginner Basics
Topic: Deny outside DNS on port 53 / Permit Inside DNS?
Replies: 17
Views: 19809

Re: Deny outside DNS on port 53 / Permit Inside DNS?

Add rules to drop TCP and UDP port 53 on the external interface. Put them in both the input and forward chains.
Edited to add:
The parameter you want is
in-interface="ether1"
If ether1 is your external interface.

Sent from my LG-D800 using Tapatalk
by rkau045
Sun Nov 30, 2014 4:00 am
Forum: Beginner Basics
Topic: Blocking DNS amplification DDoS is using your routerboard
Replies: 4
Views: 2595

Re: Blocking DNS amplification DDoS is using your routerboar

Unless I am mistaken, your first rule will add all addresses that make DNS requests on ether1_WAN. There doesn't seen to be any metering. Therefore, it would be simpler to just drop all requests on port 53. Either way, you have completely removed your ability to host DNS services behind your firewal...
by rkau045
Mon Oct 06, 2014 10:47 pm
Forum: General
Topic: NAT firewall Chain Input or Forward?
Replies: 2
Views: 1111

Re: NAT firewall Chain Input or Forward?

If the destination address after NAT is not the router address it is processed in the FORWARD chain.

Otherwise it would be processed in the INPUT chain.

Sent from my LG-D800 using Tapatalk
by rkau045
Fri Sep 26, 2014 11:17 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

All you need to do to test this yourself is to connect a PC to the uplink port on your MikroTik device, set it's gateway to be the IP address on the uplink port, and send a packet to any address that is not the router. Capture the forward logs, and your will see the packet route out. So, yes, that i...
by rkau045
Fri Sep 26, 2014 10:41 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

The fallacy in your post is that the packet is only checked in the input chain IF the dst-nat does NOT change the destination to an address that is different from the router IP. If dst-nat does change the destination IP then the packet never touches the INPUT chain. Edited to add: No DST-NAT = INPUT...
by rkau045
Fri Sep 26, 2014 8:47 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

Sorry to double post, but I got a free minute. This is a dropped packet on the input of my WAN for a non forwarded port: firewall,info input: in:ether12-gateway out:(none), src-mac 00:1c:f6:xx:xx:xx, proto TCP (SYN), 208.64.x.x:46070-75.127.x.x:10259, len 60 And here is a DST-NAT'ed: firewall,info f...
by rkau045
Fri Sep 26, 2014 8:01 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

The packet will only flow into the input chain if the destination address is the router address. For other addresses behind the router, the flow is in to the forward chain. So of you source-route a packet to the WAN interface with a destination that is not the router IP it will be forwarded not inpu...
by rkau045
Fri Sep 26, 2014 3:44 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

No, I accept established and related connections only and drop invalid. There is no matcher for SYN packets in these rules. therefore they follow the default policy of ACCEPT. This is how a new connection is established. IMHO this packet is dropped by rule: /ip firewall filter add action=drop chain...
by rkau045
Fri Sep 26, 2014 1:20 am
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

Now I understand why you do not require any additional rules: you are ACCEPTING ALL TRAFFIC transiting your router via the default ACCEPT policy of the router, i.e. you have no firewall for forwarded traffic. Any packet sent to your router with any destination address that is not the router address ...
by rkau045
Thu Sep 25, 2014 11:49 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

I should add:
For established and related connections, UPnP is never necessary. That is the reason for UPnP to exist at all.

Sent from my LG-D800 using Tapatalk
by rkau045
Thu Sep 25, 2014 11:45 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

@ditonet Established and related traffic from WAN is allowed in my configs. The problem is that I have devices that should accept New connections on the ports set up by UPnP, but standard firewall rules will drop that traffic without the accept rule added for the local subnet. This is the issue I ha...
by rkau045
Thu Sep 25, 2014 10:38 pm
Forum: Beginner Basics
Topic: UPnP does not create dynamic rules in ip firewall filter
Replies: 30
Views: 6747

Re: UPnP does not create dynamic rules in ip firewall filter

I also noticed this. My solution was to add a filter rule to allow all connections to my local subnet. Not a good solution, and I agree that UPnP should add a dynamic allow rule to the filter for the dst-nat'ed port.

Sent from my LG-D800 using Tapatalk
by rkau045
Tue Aug 05, 2014 11:20 pm
Forum: Beginner Basics
Topic: Firewall Filters
Replies: 3
Views: 811

Re: Firewall Filters

1. Yes
2. Yes, just create a rule with the same matchers and action=log before the rule you want to log.

Sent from my LG-D800 using Tapatalk
by rkau045
Sat Mar 08, 2014 1:25 am
Forum: General
Topic: PPTP phone number
Replies: 5
Views: 1082

Re: PPTP phone number

My guess is that you are configuring a pptp client and want the connect-to parameter. Perhaps the wiki at http://wiki.mikrotik.com/wiki/Manual:Interface/PPTP would be of help. If this is not the case, might I suggest a more detailed description of your application and problem? Sent from my LG-D800 u...
by rkau045
Mon Aug 26, 2013 6:47 am
Forum: General
Topic: Block Ip address
Replies: 6
Views: 2255

Re: Block Ip address

As efaden stated in post 3, the traffic between computer A and computer B never even gets to the MikroTik router, so it has no control in your current configuration.

My name is _______ and I approve this message.
by rkau045
Thu Aug 08, 2013 8:19 am
Forum: General
Topic: Multi WAN NAT Problems
Replies: 2
Views: 1368

Re: Multi WAN NAT Problems

You may want to rewrite your dst-nat rules. /ip firewall nat add action=dst-nat chain=dstnat dst-address=199.0.0.1/30 protocol=tcp dst-port=25 to-address=192.168.11.254 I think NAT works better when you specify the original destination address rather than the interface. Also, you can leave out the t...
by rkau045
Mon Aug 05, 2013 6:00 am
Forum: General
Topic: DNS Amplification attack
Replies: 5
Views: 3799

Re: DNS Amplification attack

You probably should add another identical to the above rule with proto=tcp as well since many implementations will respond to either protocol.
by rkau045
Wed May 22, 2013 1:53 am
Forum: Forwarding Protocols
Topic: Can't Traceroute to extern /27 network OSPF but can connect
Replies: 5
Views: 2612

Re: Can't Traceroute to extern /27 network OSPF but can conn

Is your firewall filtering the icmp requests?

Sent from my XT912 using Tapatalk 2
by rkau045
Fri May 17, 2013 9:12 pm
Forum: General
Topic: New Packet flow diagram
Replies: 103
Views: 72240

Re: New Packet flow diagram

The letters in the circles are jumps. So, for example, the output from mpls chart at H goes back into the main loop at H.

Sent from my XT912 using Tapatalk 2
by rkau045
Tue Feb 26, 2013 4:26 am
Forum: Beginner Basics
Topic: Udp Broadcast over VPN mikrotik
Replies: 8
Views: 6167

Re: Udp Broadcast over VPN mikrotik

The link in post #2 has your answer.

Typed on my phone by 1000 monkeys.