Community discussions

Search found 182 matches

by rmmccann
Tue Jun 11, 2019 7:15 pm
Forum: Beginner Basics
Topic: How to block access vlan from my local network?
Replies: 9
Views: 820

Re: How to block access vlan from my local network?

Regardless of the current layout, it would appear as though the second RB is simply acting as a switch/bridge. Since all traffic is going to the RB750 for routing, you should be able to create a simple IP firewall filter in the forward chain blocking traffic between the subnets. You can do this two ...
by rmmccann
Mon Jul 25, 2016 9:16 pm
Forum: Announcements
Topic: v6.34.6 [bugfix] is released!
Replies: 60
Views: 19123

Re: v6.34.6 [bugfix] is released!

RB2011 problem was fixed today in v6.36rc39
...
*) rb2011 - fixed ether6-ether10 flapping when two ports from both switch chips are in the same bridge;
...
Would be nice to see this make it to the bugfix channel.
by rmmccann
Wed Oct 28, 2015 10:49 pm
Forum: Beginner Basics
Topic: port-forwarding for port 80
Replies: 2
Views: 649

Re: port-forwarding for port 80

You have three options: 1) Hairpin NAT. You should be able to find a few guides on this forum and the wiki to help you set this up. Essentially it translates "internal" requests and reroutes them properly for accessing your website from within the LAN. I've had mixed success with making Hairpin NAT ...
by rmmccann
Wed Oct 21, 2015 11:09 pm
Forum: General
Topic: CenturyLink PPPoE
Replies: 18
Views: 3556

Re: CenturyLink PPPoE

Glad you have something workable. Sure sounds like a crappy modem is to blame for the latency issues.
by rmmccann
Wed Oct 21, 2015 6:25 pm
Forum: General
Topic: 2 default routes (0.0.0.0/0) but one primary and one if primary is down
Replies: 9
Views: 1627

Re: 2 default routes (0.0.0.0/0) but one primary and one if primary is down

Use check-gateway=ping in each of the routes is simpler than recursive route (but only checks the next hop) And doesn't do you any good as failures often happen upstream from the first hop. 49er: The following document describes how to use recursive routing to set up routing failover: http://wiki.m...
by rmmccann
Wed Oct 21, 2015 4:15 pm
Forum: General
Topic: 2 default routes (0.0.0.0/0) but one primary and one if primary is down
Replies: 9
Views: 1627

Re: 2 default routes (0.0.0.0/0) but one primary and one if primary is down

Just use a different cost (distance) for each one. For example use distance=1 for primary and distance=2 for backup.

I then use recursive routing to validate if the routes themselves are working.
by rmmccann
Wed Oct 21, 2015 4:11 pm
Forum: General
Topic: CenturyLink PPPoE
Replies: 18
Views: 3556

Re: CenturyLink PPPoE

Maybe try putting your Mikrotik at the DMZ address on your modem: http://internethelp.centurylink.com/internethelp/modem-c1000a-adv-dmz.html This would (hopefully) eliminate any potential port mapping issues that may still be present. If you want to try some additional steps on the transparent bridg...
by rmmccann
Tue Oct 20, 2015 4:31 pm
Forum: General
Topic: v6.33rc release candidate (final testing)
Replies: 203
Views: 38028

Re: v6.33rc release candidate (final testing)

Are the fixes listed in this release included in the latest CURRENT 6.32.3 (ipsec replay window, for example)?
by rmmccann
Tue Oct 20, 2015 4:26 pm
Forum: General
Topic: DNS no resolving on failover wan
Replies: 5
Views: 833

Re: DNS no resolving on failover wan

Your workaround would be to use public DNS servers instead of your ISP's DNS servers. It's unlikely your ISP will allow queries from outside of their IP space. A lot of people will recommend either OpenDNS (208.67.222.222 and 208.67.220.220) or Google DNS (8.8.8.8 and 8.8.4.4). There are countless o...
by rmmccann
Tue Oct 20, 2015 4:22 pm
Forum: General
Topic: CenturyLink PPPoE
Replies: 18
Views: 3556

Re: CenturyLink PPPoE

What modem do you have? A simple google search on the modem and "IPSec passthrough" might yield any additional info you may need. Otherwise I think you've got the right idea.
by rmmccann
Mon Oct 19, 2015 9:53 pm
Forum: General
Topic: DNS no resolving on failover wan
Replies: 5
Views: 833

Re: DNS no resolving on failover wan

I'm assuming you mean DNS lookups/queries are failing over WAN2? If so, are you using ISP DNS or using something like Google, OpenDNS, UltraDNS, etc? If using ISP DNS, keep in mind some ISP's block resolution from IPs outside their network. If you are trying to resolve DNS from ISP2 using DNS server...
by rmmccann
Fri Oct 16, 2015 10:55 pm
Forum: General
Topic: windows sharing over internet
Replies: 7
Views: 3457

Re: windows sharing over internet

please just go with me now , forget all about security , don't need this right now or forever employees in my firm are dum enough they won't understand how to use/establish vpn connections , well not on their own and it'll be a real headache for me to guide them by phone every time the need it just...
by rmmccann
Fri Oct 16, 2015 10:24 pm
Forum: General
Topic: CenturyLink PPPoE
Replies: 18
Views: 3556

Re: CenturyLink PPPoE

What happens when you run the setup in "double NAT"? Take the modem out of transparent mode and and connect your MT, keeping NAT enabled on it as well. We can then rule out if it's PPPoE related. I've seen strange instances where ports on the 2011 will either refuse to link with another device, or a...
by rmmccann
Thu Sep 24, 2015 10:11 pm
Forum: General
Topic: /ip/route gateway question
Replies: 3
Views: 1010

Re: /ip/route gateway question

Rather than have a static route, why not just use the "routes" entry in your PPP secret config for this user? The route will be added and removed automatically as the user connects and disconnects.
by rmmccann
Fri Aug 28, 2015 6:56 pm
Forum: General
Topic: anyone knows to block "TOR browser" in mikrotik?
Replies: 27
Views: 10096

Re: anyone knows to block "TOR browser" in mikrotik?

Did you ever have success making this work? I've been playing around with it and the example and it appears as though the parse command can't be used on a file larger than 4096 bytes.
by rmmccann
Thu Aug 27, 2015 6:59 pm
Forum: General
Topic: VLAN setup on RB2011 to Engenius EAP-350 - what am I missing?
Replies: 2
Views: 786

Re: VLAN setup on RB2011 to Engenius EAP-350 - what am I missing?

I've run into this before with the EAP350. I think you need to have "Isolation" checked on SSIDs not part of the primary/management VLAN (so enable Isolation on your Guest SSID).
by rmmccann
Wed Aug 12, 2015 4:30 pm
Forum: General
Topic: How to disable rSTP on a port
Replies: 2
Views: 3223

Re: How to disable rSTP on a port

On your router with the customer's bridge port, you could try changing the settings on edge from "auto" to "yes". This may tell your router to ignore the BPDUs coming from that port.
by rmmccann
Thu Aug 06, 2015 11:24 pm
Forum: General
Topic: DHCP Server /22 Pools
Replies: 5
Views: 1581

Re: DHCP Server /22 Pools

Do you have all of the available addresses in the /22 subnet defined in IP>Pool?

If so, perhaps it's hanging up on a large /22 range and needs to be split into multiple pools. You could split it into /24 subnets and use the "Next Pool" option to specify the next pool to utilize.
by rmmccann
Thu Jul 16, 2015 12:29 am
Forum: General
Topic: VPN Server - WAN IP Issue
Replies: 4
Views: 711

Re: VPN Server - WAN IP Issue

Is it possible your ISP is blocking PPTP? If you're able to initiate connectivity inside, that tells me it's set up correctly. If you have the firewall rules opened up to allow connectivity from the outside then the next step would be to see if it's being blocked further upstream.
by rmmccann
Wed Jul 15, 2015 10:10 pm
Forum: Beginner Basics
Topic: Link Redundancy
Replies: 4
Views: 766

Re: Link Redundancy

Read this: http://wiki.mikrotik.com/wiki/Manual:VRRP-examples VRRP seems to be the best solution for you. This is only going to work if User Group1 and User Group2 can communicate directly with both routers. It also won't do anything if a route is flapping or the internet itself is down, only if th...
by rmmccann
Wed Jul 15, 2015 7:52 am
Forum: Beginner Basics
Topic: Link Redundancy
Replies: 4
Views: 766

Re: Link Redundancy

Easiest that comes to mind is some static routes that use the other router as the gateway. When the primary (default) routes are down, it'll forward traffic to the other router and the other ISP/datapath.
by rmmccann
Wed Jul 15, 2015 7:48 am
Forum: Beginner Basics
Topic: help with port address translation.
Replies: 2
Views: 793

Re: help with port address translation.

If you're just looking to open a service on the outside and translate it to a different port, it's pretty simple: Let's assume your internal host is 192.168.1.1, the service port is TCP 88. The WAN IP is 10.0.0.1 and service port is TCP 80. You'd create a dst-nat rule as follows: /ip firewall nat ad...
by rmmccann
Tue Jul 14, 2015 7:43 pm
Forum: General
Topic: connect to router using an external IP
Replies: 8
Views: 1094

Re: connect to router using an external IP

O.K I mange to create a L2PT server and client , Thanks ! now I want to do EOIP of both sides so just tell me if this O.K on Router#1 - server side IP:10.0.0.111 this is what I gave : name="Home" service=l2tp caller-id="" password="123" profile=default local-address=172.16.5.254 remote-address=172....
by rmmccann
Tue Jul 14, 2015 5:04 pm
Forum: General
Topic: connect to router using an external IP
Replies: 8
Views: 1094

Re: connect to router using an external IP

If I'm understanding correctly, your 4G connection is using CGNAT (carrier NAT), so you aren't being assigned a public IP directly but instead a private IP address that they manage. They then NAT the traffic out a specific set of IP addresses, probably shared by hundreds to thousands of users/device...
by rmmccann
Tue Jul 14, 2015 4:52 pm
Forum: General
Topic: VPN Server - WAN IP Issue
Replies: 4
Views: 711

Re: VPN Server - WAN IP Issue

You don't have to specify a static IP to utilize VPN or remote connectivity. As long as your IP is a public IP, you should be fine. I have routers out there with DHCP IP addresses that I remote in to all the time - the IPs aren't always the same. Make sure you have allowed the necessary VPN traffic ...
by rmmccann
Wed Jul 01, 2015 12:23 am
Forum: General
Topic: Routing to a specific network when dual wan is active
Replies: 2
Views: 688

Re: Routing to a specific network when dual wan is active

Add a static route to 10.0.0.0/24 via router 1 (WAN1) on router 2. Router 1 knows the route to 10.0.0.0/24, so when it receives a request it can forward it on happily. Router 2 doesn't know this route and will look to its WAN interface (0.0.0.0/0) for the answer. If you add the static route on route...
by rmmccann
Tue Jun 30, 2015 6:17 pm
Forum: General
Topic: Static Routes accross different LANs
Replies: 11
Views: 1162

Re: Static Routes accross different LANs

I suspect that your traffic between 192.168.1.0/24 and 192.168.6.0/24 is being blocked by rule #3. If you want bilateral communication, you need to create a filter rule that explicitly ALLOWS communication between those two subnets. The easiest thing to do would be to create an address list with bot...
by rmmccann
Mon Jun 29, 2015 3:15 pm
Forum: General
Topic: Multiple src addresses in a fireall rule?
Replies: 4
Views: 1388

Re: Multiple src addresses in a fireall rule?

Yes, just use an address list. You can specify the src-address-list in the firewall rule.
by rmmccann
Tue Jun 23, 2015 6:17 pm
Forum: General
Topic: share subnet with no NAT
Replies: 6
Views: 1098

Re: share subnet with no NAT

You can assign a specific IP via the "Remote Address" value in the PPP Secret.
by rmmccann
Fri Jun 19, 2015 5:11 pm
Forum: General
Topic: share subnet with no NAT
Replies: 6
Views: 1098

Re: share subnet with no NAT

I'm not so sure you'd even need to implement OSPF. I'm only using PPPoE on a single router for one of my installations (as a means to distribute a public IP to a router farther inside the network) and when the session connects, it's automatically added to the routing table on the core router. You ca...
by rmmccann
Thu Jun 18, 2015 11:42 pm
Forum: General
Topic: share subnet with no NAT
Replies: 6
Views: 1098

Re: share subnet with no NAT

Sounds like a good application for PPPoE.
by rmmccann
Thu Jun 18, 2015 9:44 pm
Forum: General
Topic: Fully transparent Hairpin NAT
Replies: 10
Views: 4554

Re: Fully transparent Hairpin NAT

That may or may not be part of the problem, but it would be the first thing I would correct. Your internal subnet should be somewhere in either 192.168.0.0/16, 172.16.0.0/12, or 10.0.0.0/8 space. I changed to 192.168.1.0/24, but NAT Loopback still doesn't work. That will eliminate any potential iss...
by rmmccann
Thu Jun 18, 2015 4:34 pm
Forum: General
Topic: Fully transparent Hairpin NAT
Replies: 10
Views: 4554

Re: Fully transparent Hairpin NAT

Don't overthink it - you only need a single NAT rule, but it needs to be the first. Here is what I use: add action=masquerade chain=srcnat dst-address=192.168.88.0/24 out-interface=lan0 src-address=192.168.88.0/24 So, very simply.. src-address and dst-address are both your LAN subnet. out-interface...
by rmmccann
Fri Jun 12, 2015 11:57 pm
Forum: General
Topic: Apply IPSec policy to all traffic on GRE tunnel -- impossible?
Replies: 9
Views: 2261

Re: Apply IPSec policy to all traffic on GRE tunnel -- impossible?

Not knowing exactly what you are doing with the GRE tunnel, could you assign an IP to each end of the tunnel and use IPSec to encrypt that. Then use those IPs for any of your traffic distribution?
by rmmccann
Fri Jun 12, 2015 9:33 pm
Forum: General
Topic: Apply IPSec policy to all traffic on GRE tunnel -- impossible?
Replies: 9
Views: 2261

Re: Apply IPSec policy to all traffic on GRE tunnel -- impossible?

Thank you for your reply. Yeah, I just need to secure the tunnel itself. In fact I tried to specify tunnel endpoints in src-address and dst-address in policy and set tunnel=yes (afaik transport mode only secures traffic originating and destined to the peers themselves, not other hosts) but it got m...
by rmmccann
Fri Jun 12, 2015 9:29 pm
Forum: General
Topic: IPSec
Replies: 11
Views: 1724

Re: IPSec

You may want to verify what level of AES and SHA they are expecting.

You simply list AES for the encryption algorithm and SHA for the hash, however in your peer config you have aes-256 and sha-256 specified. I suspect this is where phase 1 is failing.
by rmmccann
Fri Jun 12, 2015 9:20 pm
Forum: General
Topic: Apply IPSec policy to all traffic on GRE tunnel -- impossible?
Replies: 9
Views: 2261

Re: Apply IPSec policy to all traffic on GRE tunnel -- impossible?

If all you need to do is encrypt the GRE tunnel, then you just create your policy based on the source and destination IPs of the GRE endpoints. This is called IPSec transport mode. Essentially it encrypts the communication between the two routers, which in turn encrypts the information in the tunnel...
by rmmccann
Mon Jun 01, 2015 11:14 pm
Forum: General
Topic: BackUp links
Replies: 5
Views: 781

Re: BackUp links

OK, I think I follow what's going on here now. I missed the RBGW in the diagram, however my suggestion should still apply. What I would do is make sure all routers that have a direct connection to RB1 use RB1 as their default gateway. For routers with a direct connection to RB2, use RB2 as their def...
by rmmccann
Fri May 29, 2015 12:26 am
Forum: General
Topic: BackUp links
Replies: 5
Views: 781

Re: BackUp links

In this case, because RB4, RB5, and RB6 traffic always flows through RB1 or RB2, you can simply disregard their default route and take care of it futher upstream. The packets will still go to R1, however R1 will know if L1 is down and if so, it will re-route that traffic to R2 via the secondary defa...
by rmmccann
Thu May 28, 2015 6:07 pm
Forum: General
Topic: BackUp links
Replies: 5
Views: 781

Re: BackUp links

Seems to me the simplest solution would be an additional default route on RB1 that points to RB2, and an additional default route on RB2 that points to RB1. Set this route with a slightly higher distance. When link1 fails, R1 will reroute all internet traffic to R2. When link2 fails, R2 will reroute...
by rmmccann
Tue May 19, 2015 4:26 pm
Forum: General
Topic: stp o rstp
Replies: 2
Views: 607

Re: stp o rstp

It's fairly straight-forward to configure. After a Google search, I found this video which walks you through a basic implementation: https://www.youtube.com/watch?v=JP8D9tlhX88 You'll probably want to read up a little more on how it works so you can understand what all the values mean and accomplish.
by rmmccann
Tue May 12, 2015 9:45 pm
Forum: General
Topic: CAPsMAN VLAN trunk to AP
Replies: 2
Views: 1648

Re: CAPsMAN VLAN trunk to AP

This is pretty straight forward. You've got half the battle completed by enabling local forwarding and tagging the SSIDs. You'll need to actually log into the CAP (not CAPsMAN but the AP itself), and create a bridge. Create your tagged VLAN interfaces to this bridge interface. Next, assign your trun...
by rmmccann
Tue Apr 28, 2015 6:42 pm
Forum: General
Topic: Firewall rule
Replies: 8
Views: 1179

Re: Firewall rule

Another way to do this is with the NOT (!) logic: /ip firewall filter add chain=input src-address-list=!Trusted action=drop This rule will effectively block traffic on the input chain that is NOT from the source address list "Trusted". You could use this in tandem with your accept rules and place it...
by rmmccann
Thu Apr 23, 2015 9:29 pm
Forum: General
Topic: [Solved] CAPsMANv2 and VLANs
Replies: 3
Views: 786

Re: CAPsMANv2 and VLANs

This turned out to be an antenna placement issue. As soon as the transmitter was active, it overpowered a nearby capacitor on the board itself which caused the ethernet link to drop. This is a special use case with the RB912 installed in an RF Elements InSPOT case. Probably not as likely to happen t...
by rmmccann
Thu Apr 23, 2015 7:08 pm
Forum: General
Topic: Question about Nat rules using IPSEC
Replies: 3
Views: 598

Re: Question about Nat rules using IPSEC

You are correct. When using IPSec transport mode, there is no address translation happening.

The reason for the NAT rule with IPSec Tunnel mode has to do with how RouterOS routes packets through its internal system. If you look at one of their packet flow diagrams in the wiki, you'll see why.
by rmmccann
Thu Apr 23, 2015 5:58 pm
Forum: General
Topic: How to keep multiple subnets separated over tunnels ?
Replies: 6
Views: 872

Re: How to keep multiple subnets separated over tunnels ?

I should avoid Vlan use, I wonder if there is any possibility to build two tunnels over a single peer (wan ip address)..... I would just configure firewall rules on the two routers that have the tunnel. Let the data flow over the tunnel unhindered, and let the router's firewall rules decide what tr...
by rmmccann
Thu Apr 23, 2015 4:43 am
Forum: General
Topic: [Solved] CAPsMANv2 and VLANs
Replies: 3
Views: 786

Re: CAPsMANv2 and VLANs

So I've determined this has to be some type of bug. If I enable the integrated wireless interface on my RB912, the ethernet link flaps utilizing the above bridged configuration. If I disable the integrated wireless interface, it works fine. Enabling just the pci-e wireless card does not cause proble...
by rmmccann
Thu Apr 23, 2015 4:40 am
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

And if you use RIP, then go sit in the corner until you're sorry for what you've done! :lol: j/k RIP does have its place - a very unique, limited, specialized place.... Haha. I use it internally because my network isn't big enough nor has enough routers for me to justify OSPF. It was dead simple to...
by rmmccann
Wed Apr 22, 2015 10:37 pm
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

Yeah....up and running easily with gre over ipsec.... But I suppose I need a manual static route for any subnet to manage through the other end of the tunnel (at least I had to do so...) GRE is just the tunnel. You either do like you did with static routes from there, or use a routing protocol like...
by rmmccann
Tue Apr 21, 2015 11:27 pm
Forum: General
Topic: High Availability
Replies: 6
Views: 4495

Re: High Availability

I have a setup very similar to this on a couple of networks, including my own. VRRP, multiple routers and multiple WAN. I also set up separate DHCP servers (putting the backup one on a delay) and it works pretty slick. As boen_robot mentioned, setting up a basic WAN failover with recursive routing a...
by rmmccann
Tue Apr 21, 2015 7:33 pm
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

I don't think you can do it with just static routes on the router because of the IPSec involvement. You'd either need additional IPSec policies as you stated, static routes on the PCs, or SRC-NAT rules to masquerade traffic. On the communication issue with servers/devices on the .101.0/24 subnet - i...
by rmmccann
Tue Apr 21, 2015 6:30 pm
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

Seems like we might have some confusion on the IPSec side of things. IPSec != Routing. When you configure your IPSec policies, you're generally tunneling two subnets. Only the subnets defined in the IPSec policy are going to be able to communicate to each other. 192.168.1.0/24 will be able to commun...
by rmmccann
Tue Apr 21, 2015 5:43 pm
Forum: General
Topic: [Solved] CAPsMANv2 and VLANs
Replies: 3
Views: 786

Re: CAPsMANv2 and VLANs

So I've made some headway with this, however I seem to have created another problem at the same time. Since CAPsMAN doesn't seem to create any interfaces automatically, I created a bridge on the CAP, tagged the needed VLANs and then in Wireless>CAP, told it to add interfaces to this bridge. The prob...
by rmmccann
Tue Apr 21, 2015 12:36 am
Forum: General
Topic: [Solved] CAPsMANv2 and VLANs
Replies: 3
Views: 786

[Solved] CAPsMANv2 and VLANs

Can someone give me a quick primer on what is required to enable multiple SSIDs and VLAN tags using CAPsMANv2? I want to use local forwarding on all CAPs (I believe this is where the CAP actually tags and forwards the traffic to the switch, as opposed to sending all traffic to CAPsMAN for forwarding...
by rmmccann
Mon Apr 20, 2015 7:15 pm
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

This remind me of another scenario i'll have to manage : What if routerboard A and B would be the same machine ?? Pratically I have eth1=192.168.1.1 and eth2=192.168.100.1 on a single routerboard each of this is IPSEC tunneled to two remote sites : 192.168.1.0/24----192.168.1.1-------------ipsec---...
by rmmccann
Mon Apr 20, 2015 5:40 pm
Forum: General
Topic: Two routerboards on the same physical lan and two addresses on client nic
Replies: 29
Views: 2623

Re: Two routerboards on the same physical lan and two addresses on client nic

Via a static route, yes. I'd add a 192.168.0.x/24 address to router B. From there, add a static route in Router A stating that 10.10.10.0/24 is reachable via Router B's 192.168.0.x address. So let's say you put 192.168.0.2/24 on Router B, the static route on Router A would be: /ip route add dst-addr...
by rmmccann
Thu Mar 19, 2015 6:13 pm
Forum: General
Topic: Nat ONLY SMTP (port 25) to a particular interface/IP on MT
Replies: 4
Views: 735

Re: Nat ONLY SMTP (port 25) to a particular interface/IP on MT

Just to clarify what you're doing: You want to src-nat all outbound port 25 smtp traffic to a particular IP on your MT, correct? In other words, if you have an outbound 25 smtp, you want it to appear to always come from the same IP on your MT? If so, I think you can just adjust your rule as follows:...
by rmmccann
Wed Mar 11, 2015 3:46 pm
Forum: General
Topic: DHCP static leases getting lost on reboot/power loss
Replies: 4
Views: 1278

Re: DHCP static leases getting lost on reboot/power loss

System Resources (fourth section) follows: Sector Writes Since Reboot: 9947 Total Sector Writes: 140007 Bad Blocks: 0.0% And upper: Free HDD Space: 110.4 MiB Total HDD Size: 128 MiB Integrated disk seems to be almost unused (by space). Sector writes seems high, but some other working devices under ...
by rmmccann
Tue Mar 10, 2015 4:03 pm
Forum: General
Topic: Setup a second WAN Port
Replies: 3
Views: 894

Re: Setup a second WAN Port

Every port on a MT router can be set up as a separate interface with routable traffic, DHCP, etc. The big thing is to just make sure they aren't slaves to another interface. If you go into the interface list and click on eth2-eth5, if master-port is set, it's part of a switch group. If you change ma...
by rmmccann
Tue Mar 10, 2015 3:19 pm
Forum: General
Topic: DHCP static leases getting lost on reboot/power loss
Replies: 4
Views: 1278

Re: DHCP static leases getting lost on reboot/power loss

Are you noticing any other settings or files not being saved upon reboot? I'd suspect perhaps bad flash memory or storage. If a complete wipe and reinstall fixed, it's entirely possible things were written into different blocks in flash and bypassed the bad ones for a while. You might find some indi...
by rmmccann
Mon Mar 09, 2015 2:52 pm
Forum: General
Topic: SRC-NAT rule for IPSec to work
Replies: 3
Views: 3372

Re: SRC-NAT rule for IPSec to work

Thanks for the link. I must be stupid but still don't understand why the packet will be affected by srcnat. If my public IP resides I the router, won't it just use that address as source? It has more to do with complete processing of the packets than just what source IP to use. Take a look at the p...
by rmmccann
Fri Mar 06, 2015 11:00 pm
Forum: General
Topic: One to One NAT to internal customer router
Replies: 7
Views: 2988

Re: One to One NAT to internal customer router

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

You could try action=netmap for both rules to see if that clears it up. That seems to be MT's built-in method for 1:1 NAT.
by rmmccann
Fri Mar 06, 2015 6:16 pm
Forum: Announcements
Topic: Newsletter 64
Replies: 28
Views: 11483

Re: Newsletter 64

Any plans for a hAP with PoE-in?
by rmmccann
Thu Mar 05, 2015 4:55 pm
Forum: General
Topic: SRC-NAT rule for IPSec to work
Replies: 3
Views: 3372

Re: SRC-NAT rule for IPSec to work

Why do I need an additional rule like this? (seen of system A) /ip firewall nat add chain=srcnat action=accept src-address=<local lan A> dst-address=<local lan B> As far as I know the masquerading rule "should" not catch the outgoing traffic towards the other side of the tunnel, because it is not e...
by rmmccann
Wed Mar 04, 2015 12:31 am
Forum: General
Topic: VPN with NAT to on local host only
Replies: 1
Views: 432

Re: VPN with NAT to on local host only

This shouldn't be too difficult to achieve. Just follow one of the guides on setting up a VPN with an IP pool on MT. From there, you would simply create some firewall rules to only allow the VPN users to access that one specific IP. The public/private IP thing shouldn't pose an issue since your MT w...
by rmmccann
Tue Mar 03, 2015 10:24 pm
Forum: General
Topic: Firewall matcher for locally connected subnet?
Replies: 1
Views: 372

Re: Firewall matcher for locally connected subnet?

Hi there, I'm wondering if there's a way to specify a generic rule that matches an IP address on a directly connected interfaces subnet? ie: something like:- > /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 10.62.5.1/24 10.62.5.0 ether1 1 10.62.255.30/...
by rmmccann
Mon Mar 02, 2015 7:40 pm
Forum: General
Topic: Help with mixed vlan config on rb-2011iL-RM
Replies: 2
Views: 580

Re: Help with mixed vlan config on rb-2011iL-RM

You could go about it a couple of ways: IMO using the switch chip would be a cleaner config and faster. If you use bridging, you'd need a bridge for each VLAN and a bridge for your untagged vlan and ports. I believe the 2011 has two switch chips, so you'd need to bridge the two to allow them to comm...
by rmmccann
Mon Mar 02, 2015 7:24 pm
Forum: General
Topic: VLANs & DHCP - help needed
Replies: 7
Views: 1271

Re: VLANs & DHCP - help needed

It is not "easy solution" to divide 10.10.10.0/24 into two subnets. As VLANS are independent L2 domains there is no reason not to assign them same address ranges. I know that I could set DHCP server on R1, R2, R3 or R4 but WHAT IF I want to have centralized management ? Simple solution...read it as...
by rmmccann
Mon Feb 23, 2015 4:28 pm
Forum: General
Topic: ROS 6.27 is the at the limit? So when to expect ROS 7 beta?
Replies: 10
Views: 1821

Re: ROS 6.27 is the at the limit? So when to expect ROS 7 beta?

Not sure why this is so hard to understand, and there's nothing goofy about it, past or present. Before 3.x, everything was numbered as 2.x.x. Every new "major" version of the software increased the second number instead of the first, so when they went from 2.8.x to 2.9.x (for example) in the past,...
by rmmccann
Sat Feb 21, 2015 12:10 am
Forum: General
Topic: ROS 6.27 is the at the limit? So when to expect ROS 7 beta?
Replies: 10
Views: 1821

Re: ROS 6.27 is the at the limit? So when to expect ROS 7 beta?

Isn'n x.9 smaler than x.27? Or was another numbering method...
Their numbering is goofy. x.NINE is older than x.TWENTYSEVEN.
by rmmccann
Fri Feb 20, 2015 12:05 am
Forum: General
Topic: MIKROTIK -> VPN -> NETGEAR NAT ROUTER -> INTERNET -> VPN MIKROTIK
Replies: 1
Views: 679

Re: MIKROTIK -> VPN -> NETGEAR NAT ROUTER -> INTERNET -> VPN MIKROTIK

This should work in concept. The only issue I can forsee is if the upstream client router (Time warner, netgear, etc) blocks the VPN connection. On some routers you have to explicitly allow VPN passthrough.

You could work around this with perhaps IPSec or SSTP (uses SSL).
by rmmccann
Thu Feb 19, 2015 5:57 pm
Forum: General
Topic: Second internet connection over second RB
Replies: 6
Views: 1185

Re: Second internet connection over second RB

Are you intending of load balancing or just want the 3G/4G as a failover in case the xDSL link is down? The first goal is the failover connection. Maybe in the future load-balancig. But in this case I prefer the dual xDSL link. My question is: I have to use Usb Over Ethernet Adapter or is there any...
by rmmccann
Tue Feb 17, 2015 6:59 pm
Forum: General
Topic: Second internet connection over second RB
Replies: 6
Views: 1185

Re: Second internet connection over second RB

Are you intending of load balancing or just want the 3G/4G as a failover in case the xDSL link is down? If you want to load balance, jarda is right and you will either have to try something with an EoIP tunnel or similar, or perhaps utilize VLANs and a bridge interface to allow you to pass two separ...
by rmmccann
Mon Feb 16, 2015 6:59 pm
Forum: General
Topic: Need help with VRRP
Replies: 14
Views: 1835

Re: Need help with VRRP

I'm referring to the latest RouterOS version, http://wiki.mikrotik.com/wiki/Manual:Interface/VRRP#IPv4 OK - this must've been something that got fixed. I know when I tried it using /32 masks I had troubles as mentioned. Good to know. Thanks. No, this isn't right. I set up and tested this on a coupl...
by rmmccann
Mon Feb 16, 2015 5:21 pm
Forum: General
Topic: Need help with VRRP
Replies: 14
Views: 1835

Re: Need help with VRRP

I'm referring to the latest RouterOS version,
http://wiki.mikrotik.com/wiki/Manual:In ... /VRRP#IPv4
OK - this must've been something that got fixed. I know when I tried it using /32 masks I had troubles as mentioned. Good to know. Thanks.
by rmmccann
Mon Feb 16, 2015 5:14 pm
Forum: General
Topic: Need help with VRRP
Replies: 14
Views: 1835

Re: Need help with VRRP

Note: address on VRRP interface must have /32 netmask. Configuration example, http://wiki.mikrotik.com/wiki/Manual:VRRP-examples Is this something that was fixed since 6.7? If not, you might want to check your own software. I've got VRRP set up on multiple 6.7 installs and /32 masks DON'T WORK (int...
by rmmccann
Fri Feb 13, 2015 5:47 pm
Forum: General
Topic: Issue with ether1-gateway interface
Replies: 6
Views: 1657

Re: Issue with ether1-gateway interface

Set auto negotition to off with 100mb and 1gbps with txflow off/on/auto and with auto negotiation on. Makes no difference at all, also changed network cable twice. And as I said it is working when I plug it in to a PC. Hardware issue with interface 1 maybe? Link shows active in other interfaces. Is...
by rmmccann
Thu Feb 12, 2015 5:06 pm
Forum: Announcements
Topic: RouterOS v6.27 released
Replies: 273
Views: 100836

Re: RouterOS v6.27 released

Can anyone comment if dynamic IPSec policies are being properly removed after disconnect/timeout in these newer versions?

See:
http://forum.mikrotik.com/viewtopic.php?f=2&t=82757
by rmmccann
Wed Feb 11, 2015 4:24 pm
Forum: General
Topic: Struggling with L2TP/IPSec setup
Replies: 3
Views: 1695

Re: Struggling with L2TP/IPSec setup

If you're using IP addresses on your VPN clients in the same subnet as your LAN, you're going to have to enable proxy-arp on the LAN interface. What's likely happening is your VPN client is getting assigned say 192.168.5.230. You are trying to communicate with 192.168.5.10. Your computer knows this ...
by rmmccann
Wed Feb 11, 2015 4:09 pm
Forum: General
Topic: Mikrotik dhcp + Microsoft AD DNS problem.
Replies: 3
Views: 3744

Re: Mikrotik dhcp + Microsoft AD DNS problem.

Your only resolution is to use an AD DNS server if you want your PTR domain updated. Thank you for reply! I'm already use AD DNS servers (natively from Windows server). When I'm setting MK router as dhcp relay and point it to MS dhcp, all works good. When I configure router as standalone dhcp serve...
by rmmccann
Wed Feb 11, 2015 12:20 am
Forum: General
Topic: Issue with ether1-gateway interface
Replies: 6
Views: 1657

Re: Issue with ether1-gateway interface

I've heard about people having issues with port speed/duplex auto negotiation on some types of equipment when connected to a mikrotik router. Most of the time, the solution is either to hard code the speed and duplex settings (disable autonegotiation), or put a "dumb switch" type of device between t...
by rmmccann
Tue Feb 10, 2015 7:08 pm
Forum: General
Topic: Mikrotik dhcp + Microsoft AD DNS problem.
Replies: 3
Views: 3744

Re: Mikrotik dhcp + Microsoft AD DNS problem.

I don't believe you can configure MT's DHCP server to send PTR updates to another DNS server. The reason the /registerdns command works fine is because the CLIENT is doing the leg work - it contacts your AD servers and initiates the update. Your only resolution is to use an AD DNS server if you want...
by rmmccann
Fri Feb 06, 2015 1:02 am
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

You absolutely can, and *should* do so if the member ports that you want the VLAN tagged on are in a bridge together. The golden rule of bridges is that once an interface is a member of a bridge, when it comes to logical network configuration, you no longer consider that port to be a discrete thing...
by rmmccann
Thu Feb 05, 2015 10:28 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

I was able to play around with VLANs under the switch configuration on a 750GL and was able to get everything working as expected (and learned a few things at the same time). With your VLAN configuration, do you have them created under /interface vlan (The VLAN tab in Interfaces on Winbox) or under ...
by rmmccann
Wed Feb 04, 2015 11:29 pm
Forum: General
Topic: New forum look & feel
Replies: 64
Views: 8554

Re: New forum look & feel

oh no again there is no prosilver theme :(
The color contrast on this theme is much better than the other one. I can live with this one.
by rmmccann
Wed Feb 04, 2015 10:53 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

I've always created the VLANs on the individual interfaces. I very well could be wrong, but I don't know if you can actually create the VLAN IDs on a bridge interface directly. Additionally, my routers are x86 so I'm not 100% familiar with the process of using the switch chips on routerboards for VL...
by rmmccann
Wed Feb 04, 2015 7:24 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

What do your NAT rules look like? I've had a problem similar to this before on my lab environment - I borked myself with a masquerade rule that ended up blocking the traffic.
by rmmccann
Wed Feb 04, 2015 6:21 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

If you try a traceroute is it able to find a route to the hosts?
by rmmccann
Wed Feb 04, 2015 6:02 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

I noticed two things: You have Guest/Home traffic blocked, however you've specified the input chain instead of the forward chain. "Input" specifies traffic destined for the router itself. "Forward" is for traffic that is going THROUGH the router and out to other interfaces. Additionally, you have a ...
by rmmccann
Mon Feb 02, 2015 11:02 pm
Forum: General
Topic: Binding multiple wan IP's via one WAN cable to vlans
Replies: 27
Views: 7260

Re: Binding multiple wan IP's via one WAN cable to vlans

Src-nat is inside source to outside source NAT for outbound (to internet) connections. Dst-nat is the reverse for inbound (say making a NAT webserver accessible on a public IP). Masquerade is just quick and dirty outbound NAT. For your config, it's pretty simple. Let's make some assumptions and you ...
by rmmccann
Mon Feb 02, 2015 10:02 pm
Forum: General
Topic: how to block viber!
Replies: 8
Views: 16697

Re: how to block viber!

Rather than trying to block port/protocol combinations, perhaps block outbound traffic to the Viber IP space? I'm not terribly familiar with the application, but I'm sure they have some subnet of IP addresses used for logins and coordination between its users. If you can block traffic to their comm...
by rmmccann
Mon Feb 02, 2015 9:54 pm
Forum: General
Topic: how to block viber!
Replies: 8
Views: 16697

Re: how to block viber!

Rather than trying to block port/protocol combinations, perhaps block outbound traffic to the Viber IP space? I'm not terribly familiar with the application, but I'm sure they have some subnet of IP addresses used for logins and coordination between its users. If you can block traffic to their comma...
by rmmccann
Tue Jan 27, 2015 11:06 pm
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1498

Re: double gw mentioning in dhcp-server? How to use?

-1 to jkarras, -1 to rmmccann; VRRP is for having 2 routers in the same situation/configuration, where one is a backup for the other. The 'slave' should take over 'master's' work when master goes down and give funtion back to master if master comes back online. Its called "Virtual Router Redundancy...
by rmmccann
Tue Jan 27, 2015 6:37 pm
Forum: General
Topic: double gw mentioning in dhcp-server? How to use?
Replies: 10
Views: 1498

Re: double gw mentioning in dhcp-server? How to use?

+1 to jkarras suggestion. Go with VRRP - you will have more control over the desired end result.
by rmmccann
Tue Jan 27, 2015 5:32 pm
Forum: General
Topic: IPsec tunnel with private IP?
Replies: 18
Views: 5170

Re: IPsec tunnel with private IP?

How does Office 2 get out to the public internet? Is there NAT involved somewhere Through NAT or do both offices share infrastructure and private IP space at some point? No As long as both routers can communicate directly with one-another, IPSec shouldn't care if one IP is public and the other is p...
by rmmccann
Mon Jan 26, 2015 9:50 pm
Forum: General
Topic: Mikrotik & Windows Server 2008 Active Directory
Replies: 5
Views: 4271

Re: Mikrotik & Windows Server 2008 Active Directory

I think they don't relate to each other so there would be no problem with them, Imaging mikrotik is your Modem and compare it with Win server, there would be no problem? P.S: I didn't test it yet, but will do in future I think OP is referring to AAA using 2008 Active Directory. I have been able to ...
by rmmccann
Thu Jan 22, 2015 10:14 pm
Forum: General
Topic: need a rule, urgently
Replies: 2
Views: 646

Re: need a rule, urgently

Shot in the dark, but do you have proxy-arp enabled on the WAN-facing interface by chance?
by rmmccann
Wed Jan 21, 2015 7:33 pm
Forum: General
Topic: IPsec tunnel with private IP?
Replies: 18
Views: 5170

Re: IPsec tunnel with private IP?

How does Office 2 get out to the public internet? Is there NAT involved somewhere or do both offices share infrastructure and private IP space at some point? As long as both routers can communicate directly with one-another, IPSec shouldn't care if one IP is public and the other is private. If you'r...
by rmmccann
Wed Jan 21, 2015 7:13 pm
Forum: General
Topic: Dual WAN Failover with DHCP on WAN port.
Replies: 4
Views: 5402

Re: Dual WAN Failover with DHCP on WAN port.

Rather than specifying an IP address as the gateway, can you simply specify the physical interface as the gateway? I just tried this on a PPPoE lab connection I have and it seems to work fine for the default route.

ie:
/ip route add distance=1 gateway=ether1-gateway
by rmmccann
Tue Jan 13, 2015 10:02 pm
Forum: General
Topic: VLAN setup and configuration – please proof my work/process
Replies: 1
Views: 605

Re: VLAN setup and configuration – please proof my work/proc

This *looks* right to me (at least it's how I've done it), but it's always good for someone else to take a look.
by rmmccann
Tue Jan 13, 2015 9:58 pm
Forum: General
Topic: Subnet Isolation Problem
Replies: 9
Views: 2152

Re: Subnet Isolation Problem

Sorry I mean't I used the gui and command line to create the firewall rules. I'm pinging the other subnets gateway address on ether4 from a laptop plugged into ether3. I shouldn't be able to do that right? If you're pinging the gateway addresses, you should get a ping response, yes. The router will...
by rmmccann
Tue Jan 13, 2015 9:47 pm
Forum: General
Topic: Sonic wall speed vs. Mikrotik speed
Replies: 8
Views: 1902

Re: Sonic wall speed vs. Mikrotik speed

Nobody in their right mind is going to start swapping kit out without testing it first
You'd be surprised what some "tech" departments do when the right vendor swoons them. LOL
by rmmccann
Tue Jan 13, 2015 4:36 pm
Forum: General
Topic: Sonic wall speed vs. Mikrotik speed
Replies: 8
Views: 1902

Re: Sonic wall speed vs. Mikrotik speed

About all you can really do is buy one and compare it. Keep in mind that you are comparing two completely different products. Mikrotik is geared more towards routing and advanced networking features. SonicWall is a UTM appliance. Mikrotik doesn't offer much in the way of the UTM functionality that S...
by rmmccann
Tue Dec 23, 2014 9:41 pm
Forum: General
Topic: Feature Request: MSTP
Replies: 3
Views: 1736

Re: Feature Request: MSTP

I'll +1 this.
by rmmccann
Mon Dec 22, 2014 6:40 pm
Forum: General
Topic: use EOIP for backup point to point for same broadcast netwok
Replies: 4
Views: 967

Re: use EOIP for backup point to point for same broadcast ne

I can work it on access vlan in both side cisco switch, but cannot work on trunk mode. how to setup ? Thanks alot. You need to create a bridge for EACH VLAN you intend on having RSTP enabled for. Mikrotik at this time does not support MSTP, so you can't just add the physical interface to the bridge...
by rmmccann
Fri Dec 19, 2014 4:20 pm
Forum: Beginner Basics
Topic: Block traffic from bridge-public to bridge-terminal
Replies: 2
Views: 633

Re: Block traffic from bridge-public to bridge-terminal

This topic was linked (by another user) in a previous topic I commented on and should cover it: http://forum.mikrotik.com/viewtopic.php?f=13&t=61069 You allow "new" connections from the terminal to public and allow "related" and "established" from public to terminal. You should then be able to block...
by rmmccann
Thu Dec 18, 2014 6:20 pm
Forum: General
Topic: Best cache solution
Replies: 3
Views: 907

Re: Best cache solution

This topic looks to address what you're trying to do (including a link on how to configure squid for transparent proxy):
http://forum.mikrotik.com/viewtopic.php?f=2&t=21407
by rmmccann
Thu Dec 18, 2014 4:35 pm
Forum: Beginner Basics
Topic: Using wan ip for vpn connection
Replies: 3
Views: 843

Re: Using wan ip for vpn connection

You'll need to do some policy routing with routing marks to track which connection traffic comes in from so it knows which way to go back out. Right now, it sounds like your traffic is hitting the router at one of the three internet connections but always leaving out the same connection. When you re...
by rmmccann
Thu Dec 18, 2014 4:30 pm
Forum: Beginner Basics
Topic: separate network question
Replies: 2
Views: 741

Re: separate network question

You could create a firewall rule on your router that drops packets destined to 192.168.1.0/24 from 192.168.14.0/23 UNLESS it's to 192.168.1.253 or 192.168.1.254.
by rmmccann
Thu Dec 18, 2014 4:25 pm
Forum: General
Topic: Route cache overflow (x86)
Replies: 14
Views: 2854

Re: Route cache overflow (x86)

Hi, And reboot required, when the route cache will go over 65535 then all IP traffic stops. This is very annoying bug Dec 18 00:02:03 router script,info Actual route cache size: 62500 Dec 18 00:02:03 router script,info Max. route cache size: 65536 Dec 18 00:02:03 router script,info If active route ...
by rmmccann
Wed Dec 17, 2014 9:30 pm
Forum: General
Topic: Best cache solution
Replies: 3
Views: 907

Re: Best cache solution

What are you looking to cache? If you're looking for something like a web cache/proxy, wouldn't a standalone squid (or similar) installation work?
by rmmccann
Wed Dec 17, 2014 9:28 pm
Forum: General
Topic: Dual WAN/Failover
Replies: 7
Views: 1700

Re: Dual WAN/Failover

Now the question is: Which of our two possible faults is rxfoote ready to tolerate? To stay connected to ISP which has not access to internet or rather to flap even it maybe was not needed?
We've at least given the OP some insight into the situation.

rxfoote - please let us know how it works out.
by rmmccann
Wed Dec 17, 2014 7:58 pm
Forum: General
Topic: Dual WAN/Failover
Replies: 7
Views: 1700

Re: Dual WAN/Failover

No need to get snippy, bud. Just a difference of opinion. It's still debatable. If you're using a single router with dual upstream and failover, you can use packet marks to maintain connection history/NAT tables, however if you operate with multiple geographic locations (routers) and upstreams, you ...
by rmmccann
Wed Dec 17, 2014 4:19 pm
Forum: General
Topic: Dual WAN/Failover
Replies: 7
Views: 1700

Re: Dual WAN/Failover

Better to monitor real public ip addresses accessibility then any server inside network of isp.
Debatable. I want something relatively close to that ISP's network connection and I don't trust that outside operators can't have outages just like an ISP.
by rmmccann
Wed Dec 17, 2014 6:55 am
Forum: General
Topic: Dual WAN/Failover
Replies: 7
Views: 1700

Re: Dual WAN/Failover

There are multiple ways, however I personally like this method best: http://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting Just adjust your route distances accordingly to define primary/secondary WAN. I also recommend monitoring ISP DNS servers instead of default gateways as it w...
by rmmccann
Tue Dec 16, 2014 11:13 pm
Forum: General
Topic: use EOIP for backup point to point for same broadcast netwok
Replies: 4
Views: 967

Re: use EOIP for backup point to point for same broadcast ne

Mikrotik routers can be members of a STP/RSTP group, however you must create a bridge. You will need to set this up and configure your port costs.
by rmmccann
Tue Dec 16, 2014 7:20 pm
Forum: Beginner Basics
Topic: NAT question - multiple public IP use on one subnet.(solved)
Replies: 7
Views: 1879

Re: NAT question - multiple public IP use on one subnet.

Those rules look correct to me, however it may have something to do with the order in which they are entered.

You could try moving your DST-NAT entry above masquerade and see if that helps. You may also want to specify an "in-interface" for that rule.
by rmmccann
Mon Dec 08, 2014 4:00 pm
Forum: General
Topic: VRRP
Replies: 11
Views: 1933

Re: VRRP

Well, first of all thanks for the help, it seems to be that is working perfectly now, the routers are connected via a switch and I had to change a few things in the configuration, basically what I changed was the following: 1- I adjusted the interval to 5s. 2- The R1100AHx2 has the possibility to s...
by rmmccann
Fri Dec 05, 2014 8:58 pm
Forum: Beginner Basics
Topic: How to assign Public Ip to PPoe users?
Replies: 2
Views: 670

Re: How to assign Public Ip to PPoe users?

1:1 NAT will work if you want to manage firewall rules, etc from your main router. If you want to hand out the public IPs to a router downstream you have to do something different: If you want to assign the public IP directly to them, create an address pool with the public IPs you want to hand out. ...
by rmmccann
Fri Dec 05, 2014 8:55 pm
Forum: Beginner Basics
Topic: NAT question - multiple public IP use on one subnet.(solved)
Replies: 7
Views: 1879

Re: NAT question - multiple public IP use on one subnet.

You can do this, however you need to create src-nat rules with action=srcnat for each public IP address you want to use. These need to sit ABOVE the masquerade rule. Masquerade by default uses the first assigned/enumerated IP address of the MT device. So if you have 1.1.1.1, 1.1.1.2, and 1.1.1.3 ass...
by rmmccann
Fri Dec 05, 2014 8:40 pm
Forum: General
Topic: VRRP
Replies: 11
Views: 1933

Re: VRRP

Can you provide some additional configuration information on your setup (including IP addresses, subnets, bridge/switch information)?

Also, are your two routers directly connected to each other or connected via a switch?
by rmmccann
Fri Dec 05, 2014 12:27 am
Forum: General
Topic: VRRP
Replies: 11
Views: 1933

Re: VRRP

Try adjusting your interval a bit - maybe something like 2 or 5. It's possible maybe not all of the packets are reaching the destination (in time) when broadcasting every second so the backup is assuming the master router is down. I use 5 second failover on mine. Fast enough to keep people happy, sl...
by rmmccann
Wed Dec 03, 2014 9:56 pm
Forum: General
Topic: VRRP
Replies: 11
Views: 1933

Re: VRRP

If you're only running a single VRRP instance (one protected gateway), then one router should be listed as master and the rest should be backups. A couple things to verify: 1) Make sure that all routers in the VRRP instance have the same VRID number. This number identifies the VRRP instance. 2) Make...
by rmmccann
Wed Dec 03, 2014 5:02 pm
Forum: General
Topic: 6to4 or EoIP/IPIP/GRE tunnel for IPv6 addressing
Replies: 1
Views: 1001

Re: 6to4 or EoIP/IPIP/GRE tunnel for IPv6 addressing

6to4 is a standard so it's supported on multiple vendors. It's mostly used when you can't get native IPv6 transit from your upstream provider. You create a 6to4 tunnel to a broker and use an IPv6 assignment they give you (example: Hurricane Electric/Tunnelbroker). It also uses smaller MTU to work ac...
by rmmccann
Wed Dec 03, 2014 4:57 pm
Forum: General
Topic: Routing multiple static address
Replies: 2
Views: 648

Re: Routing multiple static address

Assign the 3 public IP addresses from your ISP to your MT. From there, create srcnat rules and don't use action=masquerade. Use action=srcnat. Doing this will allow you to specify which public IP should be used for each subnet. Eg: /ip firewall nat add action=src-nat chain=srcnat comment="Subnet 1" ...
by rmmccann
Sat Nov 29, 2014 7:57 am
Forum: General
Topic: Set static wan ip help
Replies: 14
Views: 3131

Re: Set static wan ip help

The only other thing I can think of (which has gotten me before) is a stale ARP entry on your ISPs routers. How long has it been since you connected your laptop with that static IP? Is it possible their router still shows your laptops MAC address and isn't updating it when you add the IP to your rou...
by rmmccann
Sat Nov 29, 2014 7:52 am
Forum: General
Topic: Redundant IPSec Configuration
Replies: 2
Views: 1695

Re: Redundant IPSec Configuration

Interesting solution, however I was looking for something with pure IPSec Site-to-Site tunneling. Additionally, does your solution take into consideration that "Site1" has two public IPs, two routers in two geographically separate regions. The network is linked together L2 via point-to-point wireles...
by rmmccann
Wed Nov 26, 2014 6:07 pm
Forum: General
Topic: Redundant IPSec Configuration
Replies: 2
Views: 1695

Redundant IPSec Configuration

Hi guys, I have a remove office that I have connected via IPSec and would like to add a redundant link to it via my second internet connection. My network has 2 routers in two separate locations and different ISPs. They are on the same local subnet. I want to be able to set up an IPSec tunnel from r...
by rmmccann
Tue Nov 25, 2014 5:36 pm
Forum: General
Topic: Set static wan ip help
Replies: 14
Views: 3131

Re: Set static wan ip help

Going by your description, that would be what I would do for the correct setup. You could re-enable the default route option on the DHCP client as you intend on keeping that the preferred default route. Keep in mind that second connection is only going to be used in a failover scenario. If you need ...
by rmmccann
Mon Nov 24, 2014 6:35 pm
Forum: General
Topic: IP Camera Subnet
Replies: 36
Views: 6421

Re: IP Camera Subnet

OP never indicated his DVR/NVR was going to sit on his LAN subnet while the cameras would go on a separate subnet. That absolutely matters and will tax the router more than necessary. In this case, I would either move the NVR to the camera subnet or keep everything on one subnet and be done with it....
by rmmccann
Mon Nov 24, 2014 7:43 am
Forum: General
Topic: Set static wan ip help
Replies: 14
Views: 3131

Re: Set static wan ip help

Looking at what you've posted, you have two WANs, correct? One is DHCP and is providing a default route at 192.168.4.1. This route has a distance of 1, therefore it will be preferred over your 1xx.7xx subnet. If you want to use the 1xx.7xx subnet, you will need to remove the "add default route" opti...
by rmmccann
Fri Nov 21, 2014 7:27 pm
Forum: General
Topic: Questions about real ips and static network ?
Replies: 1
Views: 630

Re: Questions about real ips and static network ?

A few ways: 1) Add all of the public IPs to the mikrotik and create some srcnat and dstnat rules for each server. The servers will have internal IPs, but when communicating with the outside world would use the public IPs. You'd also need to account for this with internal DNS by either mapping to the...
by rmmccann
Fri Nov 21, 2014 7:22 pm
Forum: General
Topic: Set static wan ip help
Replies: 14
Views: 3131

Re: Set static wan ip help

You're missing a proper default route.

Ditch the two routes you created and add one using 0.0.0.0/0 as the destination, the gateway as the IP address your ISP says to use for default gateway, and the distance as 1.
by rmmccann
Wed Nov 19, 2014 7:33 pm
Forum: General
Topic: Multiple DHCP assigned public IPs via single interface
Replies: 9
Views: 3200

Re: Multiple DHCP assigned public IPs via single interface

You should ask your provider to either assign you a /29 (five static IPs) or reserve 5 IPs for you on their DHCP server.

I've worked with providers that do both methods and neither should be a big deal.
by rmmccann
Wed Nov 19, 2014 4:08 pm
Forum: General
Topic: Multiple DHCP assigned public IPs via single interface
Replies: 9
Views: 3200

Re: Multiple DHCP assigned public IPs via single interface

If I understand correctly you can only change a VLAN's mac address by adding it to a bridge and changing the bridge's MAC address. So I am not sure how to get multiple VLANs with different MAC that are attached to a single bridge. What I managed to do is to add the ethernet port to a bridge and cha...
by rmmccann
Wed Nov 19, 2014 12:02 am
Forum: General
Topic: IP Camera Subnet
Replies: 36
Views: 6421

Re: IP Camera Subnet

We don't know, however I know if there are workstations on the subnet he will see plenty of broadcast traffic. The question was asked "what is the best solution" and IMO I would segregate the traffic. That way the camera system can have its own broadcast domain and DHCP. Down the road security needs...
by rmmccann
Tue Nov 18, 2014 11:36 pm
Forum: General
Topic: IP Camera Subnet
Replies: 36
Views: 6421

Re: IP Camera Subnet

Broadcast traffic is still broadcast traffic. If your cameras, NVR or other devices on your LAN are generating a lot of broadcast traffic, every device on the subnet is going to see that regardless if it's on the same switch or not. In an ideal world, I segregate applications. If you are going to be...
by rmmccann
Tue Nov 18, 2014 11:31 pm
Forum: General
Topic: [Help] Linking Mik Boards To A Domain Name And Subdomains
Replies: 2
Views: 788

Re: [Help] Linking Mik Boards To A Domain Name And Subdomain

If you don't have static IPs, you can make sure you are using at least ROS v6.14 and use IP Cloud. Each routerboard has a unique DNS name in IP Cloud and you can create CNAME records with your domain name to point to each one of these records. IP Cloud will automatically keep the IP address up to da...
by rmmccann
Tue Nov 18, 2014 11:29 pm
Forum: General
Topic: Hotel secure ports with CRS125-24G?
Replies: 5
Views: 1124

Re: Hotel secure ports with CRS125-24G?

Seems like you could assign different subnet to each port and use firewall rules to drop between the subnets? Not sure if that would be the best way but just what came to mind for me.... This is what came to mind for me as well and is how I would do it. Disable switching and bridging, assign a subn...
by rmmccann
Tue Nov 18, 2014 9:35 pm
Forum: The Dude
Topic: Dude v4beta3 released
Replies: 253
Views: 100337

Re: Dude v4beta3 released

while saving power by not having your standard desktops to be kept turned on for monitoring and mapping.

Routerboards use very little watts.
Dude doesn't use much for resources. No reason you couldn't run it in a virtual machine on one of your existing servers.
by rmmccann
Tue Nov 18, 2014 7:40 pm
Forum: General
Topic: Multiple DHCP assigned public IPs via single interface
Replies: 9
Views: 3200

Re: Multiple DHCP assigned public IPs via single interface

DHCP Relay would be for centralizing a DHCP server in a routed or otherwise non-bridged network. What I would try is this: Let's say ETH1 is your WAN interface. You have a DHCP client on that interface. Create a few VLANs on that interface (with a unique MAC) and put a DHCP client on each one. Assig...
by rmmccann
Tue Nov 18, 2014 6:05 pm
Forum: General
Topic: Gateway unreachable when reconnect PPTP
Replies: 3
Views: 2179

Re: Gateway unreachable when reconnect PPTP

Get rid of the static route and do the following: Under the PPP secret for Router A, add a route entry under "routes" for that subnet. When the PPTP connection is dialed and connected, it will dynamically create the route to RouterA's subnet automatically using the tunneled IP address, that way the ...
by rmmccann
Tue Nov 18, 2014 5:55 pm
Forum: General
Topic: Help with Firewall rule for VLAN traffic
Replies: 4
Views: 1186

Re: Help with Firewall rule for VLAN traffic

I don't think you can. In order for TCP/IP to work, you need two-way communication. If VLAN1 can talk to VLAN2, VLAN2 needs to be able to talk back to VLAN1. You can verify this by blocking traffic in one direction and watching it fail (for example, block traffic one-way and try to ping). If you nee...
by rmmccann
Mon Nov 17, 2014 6:14 pm
Forum: General
Topic: Logging a srcnat role
Replies: 1
Views: 540

Re: Logging a srcnat role

Create an entry directly above the srcnat rule and use Action=log. Create a log prefix for this rule (example: srcnatlog). In System>Logging>Actions, create an action for your syslog server. For example, you could give it a name like syslog, use type=remote and enter your syslog IP and port. Next, i...
by rmmccann
Fri Nov 14, 2014 7:29 pm
Forum: General
Topic: New forum look & feel
Replies: 64
Views: 8554

Re: New forum look & feel

Absolutely hate the new format. As others have noted, the contrast is way off so it can be difficult at first glance to find where one post begins and another ends. Also suffering from the lack of screen real estate usage on Chrome. Lots of wasted space that could be used for the topic and replies t...
by rmmccann
Tue Nov 11, 2014 5:45 pm
Forum: General
Topic: Secure EoIP with IPSEC
Replies: 3
Views: 2933

Re: Secure EoIP with IPSEC

Awesome! Glad you got it working.
by rmmccann
Tue Nov 11, 2014 4:50 pm
Forum: General
Topic: Secure EoIP with IPSEC
Replies: 3
Views: 2933

Re: Secure EoIP with IPSEC

I'm doing something similar and I'll give you a run down of what my config looks like: Router1 has a public IP of 1.2.3.4 Router2 has a public IP of 4.3.2.1 I create an EoIP tunnel specifying the Public IP addresses as the source and destination endpoints in the config. I then add the EoIP tunnel to...
by rmmccann
Wed Nov 05, 2014 11:20 pm
Forum: The Dude
Topic: Dude v4beta3 released
Replies: 253
Views: 100337

Re: Dude v4beta3 released

We have a plan to make a completely new dude, that would work with CAPsMAN and have better web interface. Project is still in planning stage.
So, in other words "don't hold your breath" :lol:
by rmmccann
Tue Nov 04, 2014 5:08 pm
Forum: General
Topic: OpenDNS and domain controller
Replies: 2
Views: 1167

Re: OpenDNS and domain controller

I will like to block some of the users with OpenDNS, but let the manager browse freely. I added the OpenDNS forwarders to the Domain Controller (Windows server 2008 R2) and all the clients are using the DC DNS server as their preferred DNS server. OpenDNS is working perfectly on all the computers, ...
by rmmccann
Mon Nov 03, 2014 5:10 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

I've found what was the reason of problem. On bridge of router 2 was set proxy-arp instead of arp enabled.
Well that would certainly do it. Very good, glad you got it resolved!
by rmmccann
Fri Oct 31, 2014 3:18 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

I would recommend shooting an email over to support@mikrotik.com with a supout from both routers and see if they can spot the problem. I've noticed with my EoIP tunnels that internet-destined uplink (upload) traffic gets blasted over the tunnel and can saturate it, so I've had to create similar rule...
by rmmccann
Thu Oct 30, 2014 11:45 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

I'm at a loss as to why it's doing it, however you should be able to create some bridge filters to allow your desired traffic/subnets and broadcast traffic, yet block anything destined for the internet. This won't resolve the underlying problem but should stop the internet traffic from flowing over ...
by rmmccann
Thu Oct 30, 2014 10:27 pm
Forum: General
Topic: Cannot ping gateway when using OpenVPN TAP + bridging
Replies: 5
Views: 2066

Re: Cannot ping gateway when using OpenVPN TAP + bridging

Mikrotik is a peace of **it. All our private network is now disabled after upgrade to the new firmware. We use such bridged openvpn network AND IT MUST WORK. I can't check all nodes from the Mikrotik now. The using of none-bridged openvpn network is also not working due to haven't ping between clie...
by rmmccann
Thu Oct 30, 2014 10:18 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

Very, very strange. Do you see anything change in the routing table when the EoIP tunnel is up vs when it's down? There has to be a route taking preference (or becoming active) when the remote end of the tunnel comes online because the MT router in LAN1 is making the decision to forward traffic, not...
by rmmccann
Thu Oct 30, 2014 7:48 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

So just for clarification-

When EoIP tunnel is up and a PC in LAN1 requests an IP address - does it get assigned an IP from router1 and in that assignment, is router1's IP address listed as the default gateway?
by rmmccann
Thu Oct 30, 2014 3:13 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

Going by your configuration description, the only other thought I had would be if "Add Default Route" was enabled on the PPTP client which would cause traffic to re-route to the other router, however traffic should flow in the opposite direction you've described in this case. Can you provide an "/ex...
by rmmccann
Wed Oct 29, 2014 8:00 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

But this is not the answer for my question - I would like to know what is wrong that I've got ip assigned by proper dhcp and it's not working good, blocking dhcp traffic will not resolve my problem. Well, for starters you can't have two DHCP servers on the same broadcast domain assigning different ...
by rmmccann
Wed Oct 29, 2014 5:29 pm
Forum: General
Topic: Two mikrotiks and EOIP tunnel in bridge
Replies: 16
Views: 2726

Re: Two mikrotiks and EOIP tunnel in bridge

You'd have to set up some firewall rules to block DHCP and enable IP firewall on your bridge. The better question might be - why do you want to use EoIP in this instance? If you are looking for a simple VPN, maybe something like PPTP or IPSec would be a better choice? EoIP is for layer 2 communicati...
by rmmccann
Wed Oct 08, 2014 10:51 pm
Forum: General
Topic: Winbox 3 beta
Replies: 243
Views: 120812

Re: Winbox 3

feature a address book in cloud service for sync with username & password
I wouldn't want my router logins sync'd with the cloud, but the ability to save to a central location would be nice.
by rmmccann
Wed Oct 08, 2014 7:12 pm
Forum: General
Topic: v6.20 released!
Replies: 146
Views: 59086

Re: v6.20 released!

has all the sstp and pptp issues been resolved from the 6.8 debacle? Would like to know as well. Have held at 6.7 because I need to maintain SSTP compatibility with Windows clients. I am using SSTP with 6.20 (and 6.19) with Windows clients and I didn't experienced troubles. What kind of issues shou...
by rmmccann
Fri Oct 03, 2014 7:28 pm
Forum: General
Topic: v6.20 released!
Replies: 146
Views: 59086

Re: v6.20 released!

has all the sstp and pptp issues been resolved from the 6.8 debacle?
Would like to know as well. Have held at 6.7 because I need to maintain SSTP compatibility with Windows clients.
by rmmccann
Wed Aug 27, 2014 12:07 am
Forum: General
Topic: VPN MikroTik-Draytek: Problems with L2TP
Replies: 7
Views: 5251

Re: VPN MikroTik-Draytek: Problems with L2TP

Just a hunch, but maybe change the value of Use Encryption to something other than required. L2TP is a tunneling protocol so it doesn't encrypt - that's what the IPSec portion does. I don't think MT is smart enough to disregard these settings if they do not apply - pretty sure I had that same proble...
by rmmccann
Tue Aug 19, 2014 8:19 am
Forum: General
Topic: [6.10] Dynamic IPsec policies not deleted after disconnect
Replies: 8
Views: 2930

Re: [6.10] Dynamic IPsec policies not deleted after disconne

I realize this is an old thread but I ran across it today on a 6.7 router. Does anyone know if the fact that these dynamic policies are not being removed automatically is a bug or a feature? Having to manually flush SAs to clear them out (or reboot the router) isn't really a great option. Assuming i...
by rmmccann
Fri Jul 18, 2014 9:01 pm
Forum: General
Topic: v6.16/v6.17
Replies: 187
Views: 46903

Re: v6.16/v6.17

I've been sticking with 6.7 because of issues with SSTP and Windows clients - can anyone confirm if these problems are fixed? I know that both reliability and performance issues were noted by other users with SSTP + Windows.
by rmmccann
Thu Jun 26, 2014 6:03 pm
Forum: General
Topic: Feature Request: Specify Source Address in DNS Server
Replies: 4
Views: 1748

Re: Feature Request: Specify Source Address in DNS Server

Possible work-around could be to add a route and specify the pref-src option: /ip route add dst-address=remote.dns gateway=some-gateway.lan pref-src=dns.ip.src.address If you don't want to hard-code the gateway field then you might be able to get away with using another IP on the MT box so it route...
by rmmccann
Tue Jun 24, 2014 4:11 pm
Forum: General
Topic: Feature Request: Specify Source Address in DNS Server
Replies: 4
Views: 1748

Feature Request: Specify Source Address in DNS Server

I think a nice feature would be to specify the source address to use for DNS queries made by the Mikrotik DNS Server. I use DNS based content filtering for several of my clients - many of these clients have multiple IP addresses with different policies for each IP (hotspot network, corporate network...
by rmmccann
Fri Mar 21, 2014 6:46 pm
Forum: General
Topic: v6.11 released
Replies: 260
Views: 80497

Re: v6.11 released

Can someone confirm if SSTP is fixed or still broken?
by rmmccann
Fri Mar 14, 2014 3:05 pm
Forum: General
Topic: Feature Request: Hardware NAT
Replies: 18
Views: 7202

Re: Feature Request: Hardware NAT

I can see how you could get a performance gain, but in reality how much NAT needs to be done before that gain is realized? With as powerful as some of these RBs are (or x86 units), I can't see it benefiting me a whole lot. I imagine this is geared more towards the CGNAT crowd?
by rmmccann
Tue Mar 11, 2014 11:43 pm
Forum: General
Topic: Feature Request: Hardware NAT
Replies: 18
Views: 7202

Re: Feature Request: Hardware NAT

What is "hardware NAT"? I didn't realize there was more than one type.
by rmmccann
Fri Jan 31, 2014 4:24 pm
Forum: General
Topic: 6.9 released!
Replies: 223
Views: 80038

Re: 6.9 released!

If I'm reading correctly, from now on any bridge I create will have RSTP enabled by default? If that's the case, I certainly hope the priority has been defaulted to F000 than as well. I can see problems with this implementation on xSTP enabled networks. IMO, this was fine the way it was before and s...
by rmmccann
Mon Jan 27, 2014 4:00 am
Forum: General
Topic: enhance "check-gateway" feature - use arbitrary check IP
Replies: 34
Views: 29990

Re: enhance "check-gateway" feature - use arbitrary check IP

Maybe I'm misunderstanding your request, but this type of check exists already using recursive routing. I'm monitoring my upstreams DNS servers as a connection check. If I can't ping my upstream DNS, the routes are marked as offline/down and use the next available route. Basically, create a route wi...
by rmmccann
Thu Jan 23, 2014 9:01 pm
Forum: The Dude
Topic: Dude v4beta3 released
Replies: 253
Views: 100337

Re: Dude v4beta3 released

Count me in as a +1 on licensing. I'd have no problem paying for a license for The Dude if it meant product updates and feature enhancements.
by rmmccann
Wed Jan 22, 2014 5:44 pm
Forum: General
Topic: Some Experiences with VRRP
Replies: 5
Views: 1792

Re: Some Experiences with VRRP

Like Ibersystems said, VRRP is for failover. If you want to load balance, you'd have to have a separate system in place. My configuration is setup similar to this wiki entry: http://wiki.mikrotik.com/wiki/Manual:VRRP-examples#Load_sharing I control which default gateway is assigned to my computers v...
by rmmccann
Tue Jan 21, 2014 8:52 pm
Forum: General
Topic: 5.x routing cache bug (?) - dropped packets, lost network
Replies: 28
Views: 9777

Re: 5.x routing cache bug (?) - dropped packets, lost networ

I just learned today that I am suffering from this bug as well. I'm on x86, ROS v6.7. I am not using any Dynamic Routing Protocols. I have some EoIP tunnels, SSTP, PPTP and static routes but that is about it. I have an IP6to4 tunnel as well to tunnelbroker. Can watch my route cache fill up by the m...
by rmmccann
Tue Jan 21, 2014 6:23 pm
Forum: General
Topic: 5.x routing cache bug (?) - dropped packets, lost network
Replies: 28
Views: 9777

Re: 5.x routing cache bug (?) - dropped packets, lost networ

I just learned today that I am suffering from this bug as well. I'm on x86, ROS v6.7. I am not using any Dynamic Routing Protocols. I have some EoIP tunnels, SSTP, PPTP and static routes but that is about it. I have an IP6to4 tunnel as well to tunnelbroker. Can watch my route cache fill up by the mi...
by rmmccann
Tue Jan 21, 2014 4:42 pm
Forum: General
Topic: Some Experiences with VRRP
Replies: 5
Views: 1792

Re: Some Experiences with VRRP

I have it deployed in two locations right now. We use it internally in two instances, one for each of our routers at each end of our network. If router A fails, traffic destined to that gateway goes to router B. If router B fails, traffic to router A, etc. It works as expected and I have not encount...
by rmmccann
Tue Dec 17, 2013 7:02 pm
Forum: General
Topic: (Bug) Winbox isn't showing LCD menu option for RB2011U1AS
Replies: 25
Views: 7619

Re: (Bug) Winbox isn't showing LCD menu option for RB2011U1A

I also don't have a "PoE Settings" button in System>Routerboard
by rmmccann
Mon Dec 16, 2013 9:55 pm
Forum: General
Topic: (Bug) Winbox isn't showing LCD menu option for RB2011U1AS
Replies: 25
Views: 7619

Re: (Bug) Winbox isn't showing LCD menu option for RB2011U1A

This is not fixed. I am running 6.7 and downloaded a fresh copy of Winbox and the LCD screen is missing in action.

Update: added supout for support.
by rmmccann
Mon Jul 22, 2013 10:09 pm
Forum: General
Topic: v6.1 IP address used by MT Router
Replies: 1
Views: 688

v6.1 IP address used by MT Router

Did something change in the v6.x code that tells the Mikrotik router which IP address it should use for outbound communication? In the past, the router always "spoke" on the first public IP listed in the "/ip address print" listing. I have a router with two IPs on different subnets but on the same i...
by rmmccann
Tue Oct 02, 2012 4:40 pm
Forum: General
Topic: Hairpin NAT
Replies: 1
Views: 1797

Re: Hairpin NAT

Anyone have any thoughts on this? I have hairpin NAT configured like shown in the wiki ( see here ) and this was working fine in prior versions of routerOS, however in v6rc1 the rule does not catch any traffic. Are there any alternative rules I could try that would achieve the same result? Thanks!
by rmmccann
Wed Sep 26, 2012 7:14 pm
Forum: General
Topic: RouterOS v6 release candidate 1
Replies: 96
Views: 30184

Re: RouterOS v6 release candidate 1

Can anyone confirm if hairpin NAT is functional in 6.0rc1? My implementation (per the Wiki) was fully functional in 5.19, however it no longer works in 6.0rc1.
by rmmccann
Tue Sep 25, 2012 11:17 pm
Forum: General
Topic: Hairpin NAT
Replies: 1
Views: 1797

Hairpin NAT

Is hairpin NAT confirmed working in rOS 6? It seems to be broken on my installation of rc1. I've disabled all firewall rules and mangle rules to try to see if it was being blocked or filtered somewhere else, but I cannot get it to function as it had been in 5.x and prior.