MikroTik

kd2pm2

Perhaps try changing the source to 192.168.88.0/24. Its probably trying to allow only 192.168.88.0 access to NAT and not the whole network. Reminder, the source could be an individual IP or a range. Without the CIDR, it assumes you are only allowing 1 address to gain access to the internet.

kd2pm2

Well actually winbox CAN do some magic where it does not need an IP! When you have cleared the config and not loaded any defaults, the router will not have an IP but you can still connect it via the MAC address from a PC directly connected to the LAN port(s). Then you can start the config from zero...

kd2pm2

1. Make sure all your LAN ports are in a bridge and the WAN port it not. 2. Give your Bridge an IP address (which it sounds like you already did) 3. Source NAT/Masquerade (sounds like you already have that) 4. Make sure no firewall rules are blocking anything. Best to allow EST, REL, NEW forwarding ...

kd2pm2

Anyone come up with a script that can be scheduled to go off on the 1st of the month and email me the total bytes uploaded and downloaded on the WAN port and then reset the counters? I want to see how much data I am using with my Comcast ISP and make sure that I am staying within the limits before t...

kd2pm2

You can definitely run scripts and schedulers on ROS but I have not seen any way to do so in SOS. I have both the 750 and 260 (I use for testing but not in production) and I am pretty sure no to your question

kd2pm2

Wireshark on both laptops shows that the icmp packets are getting to them. So routing is ruled out. Torch on both RB's shows flow so the tunnel is working. I may have to do a simple laptop to laptop test to rule out their internal firewalls. Even though they can ping remote addresses/interfaces....t...

kd2pm2

I have (2) RB750's tied back to back and I have a L2TP connection between the 2 and I also have a laptop hanging off each one. The laptops can ping every IP address in-between on each router, except each other. They should be able to ping each other but cant. . I suspect ARP related but cant be sure...

kd2pm2

Upgraded my 2011 and 4011....time to test and see what happens.

kd2pm2

One bit of advice...be sure to use safe mode when changing FW rules...last thing you need to do is lock yourself out of your own router. Once you have all the settings correct, then you can disable safe and log out. Worst case...if you get locked out, just mac-winbox back in to correct the mistakes ...

kd2pm2

Do you have a default route? if you do a 'ip routes print' in a terminal if look in winbox, do you see an entry for 0.0.0.0/0 and is it pointed to ether1 or the public IP you set for ether 1? As satman1w also noted, you need a NAT rule set up as masquerade to allow you to go from private IP to publi...

kd2pm2

Most people have stayed away from 2.12 since it is so buggy. I have not budged from 2.11 until I know release 2.13 is stable...But I am not going to load 2.12

kd2pm2

Sites "A" and "B" should have 5 networks in their OSPF tables. The internet, LAN and the 3 inter-network ones. Sites "C" and "D" should have the 3 networks that connect to those. The 2 inter-network and the LAN Sites A and B should advertise their external int...

kd2pm2

When I originally was putting in the networks, I mistakenly did not put the cidr in there and ROS assumed /32 and nothing would work. I went back to the networks and edited them to be /30 and then ROS know what to do So the thought is that your OSPF networks that you added should show that they are ...

kd2pm2

In order for OSPF to work (and I suspect you already know this)....all sites have to be in the same OSPF area and you need to assign the networks so it can figure out which interfaces have which networks, or you could just do the interfaces directly with what networks they have on them. Make sure th...

kd2pm2

Check your DNS settings in the router. Seems you are advertising in the DHCP lease that your router is a DNS server, which it should be if you want it to be the DNS server. You are also advertising that 1.1.1.1 and 1.0.0.1 are also DNS servers, which is not a bad idea if your router DNS server stops...

kd2pm2

netinstall is probably the only way...but did you confirm that you cannot mac telnet to the router via winbox? When you hard reset the router...it loses its IP address and the default may be set to 0.0.0.0 so you wont be able to get in unless you do a mac telnet 1st to assign the IP to an interface ...

kd2pm2

Hopefully, you have already disabled the admin password and only use a trusted one you created. As noted, you should set up access so that only IP addresses from within your LAN can use winbox or HTTP to the router.

kd2pm2

Is ospf permitted by firewall on both sides?

Thanks for the tip XVO. Just had to accept OSPF on the input chain on the RB4011 since it had the FW in place.

RB2011 can get to the internet so all is good.

kd2pm2

The RB4011 does have a FW active since its also the ASBR. Let me check to see what could be preventing the OSPF messages from passing back and forth.

I actually used GNS3 to make a simple network and it worked 100%, but...no FW on either router there.

Good place for me to start...

kd2pm2

I am having a really odd issue setting up OSPF between my 2 routers running 6.47.4 I have the 2 routers set up using the SFP interfaces. I know the interfaces work w/o OSPF since thats my normal config. The only strange thing though, and it seems to have no impact on connectivity, is that the RB2011...

kd2pm2

Very bad! I have hAP ac, after updating to version 6.47.2 I can no longer connect to the 5GHz network, only the 2.4GHz network is available, although the 5GHz module in the router settings has the status "running". I would never recommend MikroTik products because the software is very uns...

kd2pm2

A few of us have had the same problem so if you search on DOH you will see its not just you. DOH on the MT hardware still seems a bit buggy.

kd2pm2

I have problem with sfp cage that not showing any info even link is OK...

error.PNG

Same issue I have with my 2011. But my 4011 displays just fine

kd2pm2

I just use: chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 address-list=Port_Scanner address-list-timeout=4w2d in-interface=1-Internet log=no log-prefix="" chain=input action=drop protocol=tcp src-address-list=Port_Scanner log=no log-prefix="Port_Scan Drop rule ...

kd2pm2

Pea, I can also confirm that it 'did' work using the proper URL and CRL's. But over time I would start getting errors and it was because the router could not download the updated CRL info cause the old ones were perhaps not valid, so basically I was locked out from getting the downloads since the ro...

kd2pm2

Had the same issue. Stopped using DOH and cloudflare until they sort it out. Guess you could use it without certs and not validate the certs you have and it would be fine. It appears that the certs expire before it can renew them and once they expire you are basically locked out of cloudflare unless...

kd2pm2

Definitely not an ISP issue. 1.1.1.1 works great but when I go to use it for DOH my 2011 throws errors out at me usually the (6) and the (13)'s. Once in a while the 4011 will error but not as bad as the 2011 will. And a reboot will usually take care of it for a while then it comes back eventually Th...

kd2pm2

Got the same error messages trying to use 1.1.1.1 for DOH. I turned off DOH and no more issues. Not going to bother with DOH on 6.47 until MT can figure out what is causing the errors.

kd2pm2

I just basically pulled the plug on DOH for now. Not ready for prime time on MT hardware. Will wait for the point release to see if it gets resolved. Cloudflare standard DNS servers work just fine.

kd2pm2

My 2011 is running @ 35C and my 4011 is running @ 37C. Both are wifi versions.

kd2pm2

I believe I have to go back and get the PEM file for Cloudflare-DNS and load that back in as well...I believe one cant work without the other So its definitely an issue on a reboot that if you dont have a standard DNS server like 1.1.1.1 assigned as well as the DOH server....the DOH cannot and will...

kd2pm2

I believe I have to go back and get the PEM file for Cloudflare-DNS and load that back in as well...I believe one cant work without the other

kd2pm2

remove all those certificates and use just this one: /tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem /certificate import file-name=DigiCertGlobalRootCA.crt.pem passphrase=”” I did and there is no CRL and I am still logging the same DNS error DoH server connection error: SS...

kd2pm2

So here is my current DNS config. When I reboot the RB2011 it goes into infinity with handshake failures. Its trying to validate the CRL's but yet, it should already have it in certificates memory as being valid. I suspect that the certificates setting needs to be changed to perhaps not download the...

kd2pm2

try to follow this holy man's guidance,
https://jcutrer.com/howto/networking/mi ... over-https

Seems pretty close to what I have already done. I may have to go back to plan "B" and make the URL 1.1.1.1 instead of cloudflare-dns.com

kd2pm2

Anyone else getting this? Seems that if its time to get an updated cert file...it cant. Its a chicken/egg scenario where it cant get the info to do the fetch to update the cert. Easy fix is to just add in another dns entry like 1.1.1.1 and immediately DNS query works, it grabs does the fetch and the...

kd2pm2

I am also getting the same error as well as

DoH server connection error: SSL: std failure: timeout (13)

DoH server connection error: SSL: internal error (6)

Using Cloudflare site for DOH lookups

kd2pm2

Just tried it. I can get data when I transmit but I see no stats when I try to do a receive test.

kd2pm2

what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik. What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare? I'm using cloudflare DOH server on raspberrypi https://blog.cloudf...

kd2pm2

This is the actual result of DoH. This build(6.47) is same as 6.47rc2. I'm fetching DoH connection error: idle timeout issue from both versions. This issue solves by rebooting router but not permanently. It starts after sometimes. A.PNG A1.PNG a2.PNG This will continue until reboot and start again ...

kd2pm2

https://jcutrer.com/howto/networking/mikrotik/mikrotik-dns-over-https --> DoH configuration on MikroTik router It is possible to use DoH only with "Verify DoH Certioficate" unchecked, or unchecked "Use CRL". Mikrotik is logging "DoH server connection error: SSL: handshake f...

kd2pm2

Saw that as well this morning having my cup of coffee and I get the pop up on my laptop telling me 3.24 is malware. Never had that with any other version. I suspect the same, just a false positive.

kd2pm2

I never had this happen to me when I downloaded previous versions but now 3.24 is being flagged by MalwareBytes as having Malware.Generic malware. I suspect its a false positive but something changed since Malware Bytes never complained about previous versions...(and yes, I did download direct from ...

kd2pm2

I had that happen to me a few years ago. Thats when I learned to turn off (after I upgraded my package and firmware) pretty much everything including mac telnet, turning off admin user and firewalling port 8291 from the internet. Since then I get the occasional DNS and port scan attacks but no acces...

kd2pm2

Both routers are running latest stable 6.46.6. as ROS and FW. My only thought is that the HW in the RB2011 is not capable of reading the device information. The RB2011 is probably from 2012 or so...the module is 2018. That may be a long shot I will upload screenshots in a little bit so you can see t...

kd2pm2

So I purchased the Mikrotik modules (S-85DLC05D) and put one on the RB4011 and one on the RB2011. When I go to the interfaces then to my SFP interface and the SFP tab, the RB4011 gives me all the details about the module. But on the RB2011 there is absolutely no information, yet I have a link and I ...

kd2pm2

This online course explains it easily.

https://mynetworktraining.com/courses/enrolled/820895

kd2pm2

Wow I just noticed ---> 496,719 Views as of April 15'th 2020 Won't be long till this " Public-Mikrotik-Bandwidth-Test-Server(s) " hits 1/2 million views !!! North Idaho Tom Jones Thanks for hosting the server! Just did a test in NJ on Comcast...actually getting more than advertised. I hav...

kd2pm2

Again, your setup makes no sense. Forget the wifi of the iSP router, put it into bridge mode. Nowhere does your config actually show you have a WAN input into the MT router. He should take Ethernet 1 and remove it from the bridge if thats the interface connected to the modem. Allow the HEX to do au...

kd2pm2

My wild guess is that this message is generated so early after the reboot that the network connectivity has not established yet by that time. And since Mikrotik only supports syslog via UDP, there is no second chance for the message. I think this thinking is correct. And it extends to logging to di...

kd2pm2

I have 6 DNS servers listed and they indeed do rotate based upon other parameters. I also have my query timeout set for 500ms and my total timeout set for 5 seconds. I try not to wait too long for responses and it works for me to move from server to server. If set for 2 seconds (default), I would th...

kd2pm2

What does the message look like in your syslog server? Is it being parsed correctly for your syslog server to see the critical message correctly?

As Zacharias noted, set each severity separately to go to your syslog server and see if that helps. Thats how I have mine set.

kd2pm2

Afaik either they interfering your DNS request or using DPI (Deep Packet Inspection), try using DoH (DNS Over Https) feature on latest ROS 6.47beta49, sample setup is the following (Credit @CosmosNetwork ) : DoH configuration example. Cacert.pem is CA certificates extracted from Mozilla . /ip dns s...

kd2pm2

El archivo PDF muestra que el 1100 tiene el chipset AR8327. Por lo tanto, creo que puede descargar HW.

https://i.mt.lv/cdn/rb_files/Block-RB1100AHx2.pdf

kd2pm2

Thank you! Where can I find this? I know there already is this option for CAPsMAN, I was hoping to find it in the regular Wireless interfaces too. *) wireless - added "skip-dfs-channels" parameter; You can set this parameter in the command line. I haven't found it in Winbox. [user@hAPac2]...

kd2pm2

[*]Unable to see skip DFS. Looked in wireless but where is it hiding? It is available in command line only, no support in WinBox nor WebFig yet. And next time you post something, would mind reading the whole thread to check if you question has already been answered , please? [*]At least on 5.8, whe...

kd2pm2

[*]Unable to see skip DFS. Looked in wireless but where is it hiding? [*]When I attempt to access quick set, I see one of my wireless parameters is showing blue and then I get kicked out and have to reconnect. Once reconnected, the wireless parameter is fine. Its usually the frequency parameter that...

kd2pm2

I have to believe that cloud backup will be part of winbox in the next release. Just a tad annoying to do it in the terminal

kd2pm2

Upgraded one of my rb4011 6.46.4 to 6.46.5 using winbox 3.22 on my win10 - even though misaligned and missing text is a minor issue it still triggers my ocd. winbox3.22-ros6.46.5.minorissue.png I believe the fix is to drag open the window more to the right and its fixed!!! I just noticed that now. ...

kd2pm2

I have yet to see a reasonable explanation as to why they chose to downgrade the switch chips in favor of going with the CPU approach. Is the design that much different that it doesn't need hardware offload or VLAN switching versus CPU?

kd2pm2

What devices are supported? *) winbox - allow setting "20/40/80/160Mhz-eeeeeeCe" channel under "Channel Width" parameter;

I would hope the 4011....I currently use 80 which is fine, but was hoping to push it a little more

kd2pm2

I need to force option 252 out so that I can let the devices know to use a new or different web proxy. So anything MikroTik can do, sooner the better.

kd2pm2

So I found a problem where I could not check for package updates due to DNS issues. That was a firewall rule on the input chain that was allowing from LAN but from router. So thats taken care of. Now when I click on the manual button to pull of the table of contents from within winbox, I get the 404...

kd2pm2

Ok so finally had to break down and ask the forum since I cant find any logical explanation for what I am seeing (or not seeing) My upgrade from 5.24 to 5.25 caused some corruption and stopped by router dead in its tracks. Tried to go downgrade and that made it even worse. So now I have the panic KI...

kd2pm2

Finally... after many days of trying... I have managed to connect using another laptop to the routerboard. I have reflashed with both 4.17 and 5.18. :D However... after rebooting I cannot access the router on any IP on any Eth port (does a reflash default to 192.168.88.1 ?) Also, winbox still does ...

kd2pm2

Anyone notice this? Not sure if this is new with 5.25 on my RB2011 but instead of seeing the typical 250K file size I only see about 50K or so and I get a critical error in the log that it cant read all the configuration files. I dont want to do a factory reset. I guess I could export everything and...

Search found 66 matches