Community discussions

MikroTik App

Search found 336 matches

  • 1
  • 2
by jaykay2342
Sat Dec 31, 2022 3:33 pm
Forum: General
Topic: Radius Disconnect Message Support
Replies: 0
Views: 237

Radius Disconnect Message Support

Hello Everyone, Hello MT, i having a hart time finding out which services support Radius Disconnect Messages (DM). Is it sill just Hotspot? Unfortunately the documentation is not clear about this. Does someone know for sure? Or would Mikrotik be so nice to update the docu do bring more clarity? I'm ...
by jaykay2342
Sat Dec 31, 2022 3:25 pm
Forum: General
Topic: multiple vlan per mac address on one port.
Replies: 1
Views: 440

Re: multiple vlan per mac address on one port.

Hi swaptoo, i would not do mac based VLANs on the switch. Let your APs/CAPsMan drop the clients into the appropriate VLAN. You can do this by sending Mikrotik-Wireless-VLANID in with the Radius Reply. You can use your Radius to authenticate WPA2 Enterprise clients as well as PSK Client based on thei...
by jaykay2342
Mon Jul 02, 2018 10:43 pm
Forum: General
Topic: CRS3xx Fasttrack on VLANs not working.
Replies: 11
Views: 3066

Re: CRS3xx Fasttrack on VLANs not working.

i think mikrotik will end killing CRS line because of situations like this I think The fact CRS switch have routeros dont imply you have to do routing on it, i think a switch is a switch, and must be used like that, the advantages of having routeros on it comes from management perspective, you have...
by jaykay2342
Mon Jul 02, 2018 10:21 am
Forum: General
Topic: CRS3xx Fasttrack on VLANs not working.
Replies: 11
Views: 3066

Re: CRS3xx Fasttrack on VLANs not working.

CRS s a switch the better way to do what you want to do is using a router + switch I know that it's main purpose is switching. But with fasttrack the cpu has no problem to route 1Gbps. So why using a separate device for that? And it's an CRS not a CCS fast- track is for routing, if you are bridging...
by jaykay2342
Mon Jul 02, 2018 9:11 am
Forum: General
Topic: CRS3xx Fasttrack on VLANs not working.
Replies: 11
Views: 3066

Re: CRS3xx Fasttrack on VLANs not working.

CRS s a switch

the better way to do what you want to do is using a router + switch
I know that it's main purpose is switching. But with fasttrack the cpu has no problem to route 1Gbps. So why using a separate device for that? And it's an CRS not a CCS
by jaykay2342
Mon Jul 02, 2018 9:06 am
Forum: General
Topic: CRS3xx Fasttrack on VLANs not working.
Replies: 11
Views: 3066

Re: CRS3xx Fasttrack on VLANs not working.

You say sfp-sfpplus1 is not a member of bridge1 and no vlan on it, but it is configured as untagged for vlan-id = 123?
that's just a left from previous tests.
by jaykay2342
Sun Jul 01, 2018 10:38 pm
Forum: General
Topic: CRS3xx Fasttrack on VLANs not working.
Replies: 11
Views: 3066

CRS3xx Fasttrack on VLANs not working.

I got my first couple of CRS3xx devices and playing around with them in my lab. I ran into the first problem. Following setup CRS317 Using a bridge, as you need to with the CRS3xx series, with vlan-filtering. /interface bridge add name=bridge1 protocol-mode=none vlan-filtering=yes /interface bridge ...
by jaykay2342
Fri Jun 29, 2018 10:05 pm
Forum: Wireless Networking
Topic: CAPsMAN + VLANs + bridge issue
Replies: 0
Views: 741

CAPsMAN + VLANs + bridge issue

There is a problem when using CAPsMAN with a bridge that has vlan-filter=yes. The CAP interface gets added automatically added to the bridge. So far so good. But the CAP interface is not within the list of tagged ports for the vlan it suppose to use. Therefore no traffic is flowing. :( MT can please...
by jaykay2342
Thu Sep 07, 2017 2:21 pm
Forum: Wireless Networking
Topic: CAPsMAN and SNMP
Replies: 4
Views: 1919

Re: CAPsMAN and SNMP

The stats you can finde there are just byte and packet counts. I'm looking for the wireless related values.
by jaykay2342
Sat Aug 26, 2017 7:33 pm
Forum: Wireless Networking
Topic: CAPsMAN and SNMP
Replies: 4
Views: 1919

CAPsMAN and SNMP

Hi, i like to collect more statistics about about CAPs managed by CAPsMAN. I'm used to monitoring noise floor, client count, etc for none CAPsMAN wireless interfaces via SNMP. The information SNMP for CAPsMAN via SNMP is quite limited. Even though the changelog of 3.40 says snmp - added CAPsMAN inte...
by jaykay2342
Sat Jun 18, 2016 6:36 pm
Forum: General
Topic: Private IP's to customers, but NAT each to their own Public IP?
Replies: 12
Views: 3224

Re: Private IP's to customers, but NAT each to their own Public IP?

That would be also my preferred  setup up. You have some bytes overhead on the on hand but with VPLS/MPLS you need less cpu power on your other devices. MPLS was always fastpath. 
by jaykay2342
Thu Jun 09, 2016 1:23 pm
Forum: General
Topic: Private IP's to customers, but NAT each to their own Public IP?
Replies: 12
Views: 3224

Re: Private IP's to customers, but NAT each to their own Public IP?

In such cases many providers use PPPoE to bring the traffic to the customer, so they don't need to waste IPs on small subnets. When using PPPoE to connect 250 customers to a /24 network, each customer needs only a single IP in that network (and the router on your side obviously needs one). A pppoe ...
by jaykay2342
Thu Jun 09, 2016 9:55 am
Forum: General
Topic: Private IP's to customers, but NAT each to their own Public IP?
Replies: 12
Views: 3224

Re: Private IP's to customers, but NAT each to their own Public IP?

I would not NAT at the subscriber module. Just make it a layer2 device by bridging wireless with ethernet. You can use tunnel or mpls/pseudowires to bring the layer2 to a few or one centralized point(s). in such setup you have less tiny dhcp/static pools and should that reduce the wast of addresses.
by jaykay2342
Wed Jun 08, 2016 7:09 pm
Forum: General
Topic: Private IP's to customers, but NAT each to their own Public IP?
Replies: 12
Views: 3224

Re: Private IP's to customers, but NAT each to their own Public IP?

Do you have any good guides you would recommend that pertain to MT? The MT wikis have never been easy to follow for me. Maybe because you're missing some networking basics? i think the MT wiki is usually quite helpful when it comes to routerOS specific things. but you need to know the networking pr...
by jaykay2342
Wed Jun 08, 2016 10:00 am
Forum: General
Topic: Private IP's to customers, but NAT each to their own Public IP?
Replies: 12
Views: 3224

Re: Private IP's to customers, but NAT each to their own Public IP?

Sure you can do a 1to1 NAT between the private IP and one public IP you've assign them. If you build your setup that way you can easily migrate to a one to many NAT when you have too many customers. But if you have to go the carrier grade nat road i suggest to do it the right way from the beginning ...
by jaykay2342
Fri Jun 03, 2016 3:07 pm
Forum: General
Topic: x86 - immediately "demo licence expired" on first boot
Replies: 10
Views: 4329

Re: x86 - immediately "demo licence expired" on first boot

As i don't have a windows computer i'm not able to run netinstall. It would be nice if you would provide the needed files so that someone can use his own pxe server, maybe even a routerboard. As this install was only for a test (speedtest with an other routerboard) anyway i used a different computer...
by jaykay2342
Tue May 31, 2016 8:23 pm
Forum: General
Topic: x86 - immediately "demo licence expired" on first boot
Replies: 10
Views: 4329

Re: x86 - immediately "demo licence expired" on first boot

Motherboard: Supermicro x9scl-f I had thrown in an old HITACHI hdd i had sitting on the bench (hts451010G9A00) Install via the CD. Actually via the ISO file. Supermicro boards have a BMC (Baseboard management controller) that let you mount an iso file into a virtual CD drive while remote control the...
by jaykay2342
Sat May 21, 2016 7:30 pm
Forum: General
Topic: x86 - immediately "demo licence expired" on first boot
Replies: 10
Views: 4329

x86 - immediately "demo licence expired" on first boot

I tried to install routeros on a x86 box. Install went through without a problem, but at the first boot after generating the RSA keys it says "demo licence expired" and turns off. Anyone an idea why that is happening? Maybe someone from Mikrotik here?
by jaykay2342
Sun Mar 13, 2016 10:52 pm
Forum: General
Topic: IPSec issue: already have such address - is this a bug?
Replies: 0
Views: 976

IPSec issue: already have such address - is this a bug?

Hello All, i'm facing following issue. I'm using IPSec tunnels with RouterOS systems on both ends. One is the central system and some CPEs with dynamic IPs on the other end. As the CPEs have dynamic IPs i use a dynamic policies. The CPEs are initiating the connection and get authenticated via xauth....
by jaykay2342
Sat Jan 02, 2016 3:19 pm
Forum: General
Topic: IPSec issues
Replies: 1
Views: 1260

Re: IPSec issues

has no one an idea?
by jaykay2342
Sun Dec 20, 2015 10:10 pm
Forum: General
Topic: IPSec issues
Replies: 1
Views: 1260

IPSec issues

I've following IPSec VPN setup Site A: Dynamic IP due to DSL. /ip ipsec peer add address=203.0.113.185/32 auth-method=pre-shared-key-xauth mode-config=request-only nat-traversal=no secret=sharedkey xauth-login=user xauth-password=password Site B: Has static IP 203.0.113.185 A User for xauth ist setu...
by jaykay2342
Wed Oct 21, 2015 12:57 pm
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?

My two cents on that...I like Mikroik software but the combination of RouterOS and Mikrotik hardware some times in frustraring: to handle PPP over filber having 300/30 Mbits...One needs to go to across 1100 device ? It is crazy: RB850x2 no comments to add to whast has been discused again and again,...
by jaykay2342
Tue Oct 20, 2015 12:59 pm
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?


according to

https://wikidevi.com/wiki/Qualcomm_Atheros

it has crypto accelerator :D

and a packet engine :D
that does not mean that RouterOS is supporting that crypto accelerator. Would be nice to know otherwise i would buy some device from a competitor and stop waiting for RB3011
by jaykay2342
Mon Oct 19, 2015 8:54 pm
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?

i'm curious how much IPSec traffic this thing will be able to handle
by jaykay2342
Fri Jul 10, 2015 10:05 am
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?

It was not posted, because the product is not even available yet. We will publish when device will start shipping.
Can you provide an estimated time for when you start shipping?
by jaykay2342
Wed Jul 08, 2015 12:51 am
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?

RB 2011 was the product in 2011 so i might be that RB 3011 will be released in Q2 of 3011?! :lol: no seriously i'm also waiting for that device. but it's also better if it get postponed rather than a not working release. nevertheless MT could give an update on the state.
by jaykay2342
Mon Jun 22, 2015 6:58 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

If you save the CA certificate as a file on your computer, you can then import it into windows' certificate store. http://www.cs.virginia.edu/~gsw2c/GridToolsDir/Documentation/ImportTrustedCertificates.htm I know about that, but that trusts the certificate for all sites. I was asking if there's the...
by jaykay2342
Thu Jun 04, 2015 11:19 am
Forum: Wireless Networking
Topic: NV2 Security concerns in PTMP Networks
Replies: 3
Views: 1727

Re: NV2 Security concerns in PTMP Networks

NV2 does not support virtual APs. I'm not concerned that they can communicate with each other, i know how to avoid that. My concerns are that they have the encryption keys and can sniff and decrypt traffic from others. As NV2 is a proprietary implementation it's nothing you can do as a script-kiddie...
by jaykay2342
Fri May 22, 2015 7:35 pm
Forum: Virtualization
Topic: Need feedback for KVM and proxmox
Replies: 9
Views: 8264

Re: Need feedback for KVM and proxmox

We also are RouterOS inside KVM users without any issue.
by jaykay2342
Thu May 21, 2015 10:39 pm
Forum: General
Topic: How to set firewall rules in memory temporary, not add (write) as settings?
Replies: 13
Views: 2922

Re: How to set firewall rules in memory temporary, not add (write) as settings?

maybe you want to tell us why you need them. although i don't think routeros can do temp firewall rules there might be an other solution for you problem.
by jaykay2342
Thu May 21, 2015 9:12 pm
Forum: General
Topic: No routing between subnets! Why?
Replies: 20
Views: 4553

Re: No routing between subnets! Why?

have you check your firewall rules?
by jaykay2342
Wed May 20, 2015 11:14 pm
Forum: General
Topic: proxy-arp on VRRP?
Replies: 6
Views: 3425

Re: proxy-arp on VRRP?

i have one vrrp setup (without arp-proxy) and the vrrp interface uses a /32 address sure that works. as long as you have an non /32 ip from the net on the physical/vlan interface. The outbound traffic is than leaving on the physical interface as you have the connected route there. the vrrp interfac...
by jaykay2342
Wed May 20, 2015 7:21 pm
Forum: General
Topic: proxy-arp on VRRP?
Replies: 6
Views: 3425

Re: proxy-arp on VRRP?

take in count vrrp interface has to be a /32 address
it's not need to be a /32. If it is one sure proxy-arp can't work. it's a bit sad. as some redundancy would be nice
by jaykay2342
Tue May 19, 2015 11:29 am
Forum: General
Topic: proxy-arp on VRRP?
Replies: 6
Views: 3425

proxy-arp on VRRP?

Is there a reason why it's not working to configure proxy-arp on a VRRP interface? I have following setup. I simply it a bit net let out all the parts and interfaces which have nothing to do with the problem. 2 networks like this: NET-A: 198.51.100.128/26 and NET-B: 198.51.100.176/28 which is obviou...
by jaykay2342
Mon May 18, 2015 11:27 am
Forum: Forwarding Protocols
Topic: Bonding Two ADSL Lines over VPN
Replies: 11
Views: 6139

Re: Bonding Two ADSL Lines over VPN

Wouldnt it be easier to resolve a dyndns Name on the Router itself and replace the IPs in the Config? The Routerboard has DNS configured. Both of my ADSL Routers have a build in DynDNS Service. And the Server Endpoint wich runs the VM has a Static Web IP Easier? i don't know, i think the effort you...
by jaykay2342
Mon May 18, 2015 9:36 am
Forum: Forwarding Protocols
Topic: Bonding Two ADSL Lines over VPN
Replies: 11
Views: 6139

Re: Bonding Two ADSL Lines over VPN

I cant use EoIP directly because my Two DSL Lines have Dynamic IPs with IP Changings every 24h. Is there a way to use a DynDNS Adress? Maybe a Script wich updates the IP after a Reconnect? I use GRE with dynamic IPs by polling a php-script on one of my servers via fetch tool. This script updates th...
by jaykay2342
Fri May 15, 2015 11:04 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

I still have my test RB260GSP. It's running without any problems. But i only power 2 devices with it.
by jaykay2342
Fri May 15, 2015 11:30 am
Forum: Forwarding Protocols
Topic: Bonding Two ADSL Lines over VPN
Replies: 11
Views: 6139

Re: Bonding Two ADSL Lines over VPN

It looks like your are looking for bonding with a per packet loadblancing. As you would have a lot of packets which arrive out of order it would be bad for the TCP performance.

I suggest to use VPN tunnels as you mentioned. On top of that you can do a ECMP routing or policy based routing.
by jaykay2342
Thu May 14, 2015 4:47 pm
Forum: Forwarding Protocols
Topic: Bonding Two ADSL Lines over VPN
Replies: 11
Views: 6139

Re: Bonding Two ADSL Lines over VPN

A Simple Load Balancing wont do it because i need a Single IP for my Applications.
Can you be a bit more specific what exactly you're trying to achieve? What kind of Traffic/Applications?
by jaykay2342
Thu May 14, 2015 11:09 am
Forum: RouterBOARD hardware
Topic: RB 750UP Gigabit Version
Replies: 19
Views: 7109

Re: RB 750UP Gigabit Version

We would also like a 750UP gigabit version. An SFP port would be nice to have a non conducting link to other equipment on the location.
by jaykay2342
Wed May 13, 2015 11:42 am
Forum: Wireless Networking
Topic: NV2 Security concerns in PTMP Networks
Replies: 3
Views: 1727

Re: NV2 Security concerns in PTMP Networks

Can no one from Mikrotik comment on this?
by jaykay2342
Wed May 13, 2015 11:39 am
Forum: RouterBOARD hardware
Topic: RB3011 Block diagram?
Replies: 230
Views: 73015

Re: RB3011 Block diagram?

I hope this device will have a Hard Disk Connection.
That we finally can add a SSD HD.
What are you going to do with a SSD inside low power router?
by jaykay2342
Tue Apr 28, 2015 2:41 pm
Forum: Wireless Networking
Topic: NV2 Security concerns in PTMP Networks
Replies: 3
Views: 1727

NV2 Security concerns in PTMP Networks

I'm currently researching ways to proper secure PTMP Networks and i’m curious how you guys deal with security in PTMP Networks. I'm also looking for a response from the Mikrotik guys whether my concerns are already addressed. Here my concerns In a NV2 PTMP Network the CPE (e.g. SXT) contains the NV2...
by jaykay2342
Mon Apr 13, 2015 10:16 pm
Forum: Forwarding Protocols
Topic: GRE Tunnel on Dynamic IP address
Replies: 9
Views: 21922

Re: GRE Tunnel on Dynamic IP address

We have some GRE tunnels with a dynamic IP on one site. We doing this by a more or less dirty hack. The Routers with the dynamic IP using the the fetch command+scheduler to poll at script (php). That php script is using the API to talk to the router with the fixed IP and updates the gre interface co...
by jaykay2342
Sun Apr 12, 2015 3:38 pm
Forum: RouterBOARD hardware
Topic: Which hardware to use
Replies: 3
Views: 1312

Re: Which hardware to use

So you basically going to build a VPN network with a central VPN- concentrator, right? You can use all RouterOS devices for that propose. The central device obviously need to be more power full than the clients. To give a good suggestion about the hardware you need to tell us what throughput is want...
by jaykay2342
Sun Apr 12, 2015 3:30 pm
Forum: RouterBOARD hardware
Topic: Outdoor dual band 2.4/5G a/b/g/n/ac 2x2x2mimo device
Replies: 7
Views: 3450

Re: Outdoor dual band 2.4/5G a/b/g/n/ac 2x2x2mimo device

I'm still waiting for a 5Ghz indoor device that I don't have to assemble myself from boards and cases and antennas all bought separately. I also would like to see a indoor AP device with 5Ghz. Some nice looking dualband ceiling-mountable AP would be really awesome. We used some of those APs from th...
by jaykay2342
Sun Apr 12, 2015 2:48 pm
Forum: Wireless Networking
Topic: Ap setup question
Replies: 6
Views: 1598

Re: Ap setup question

For 200 square meters you might get a better result by using more APs. I suggest 2 or even 3. But it totally depends on the building structure.

Often it's better to more APs with small TX power instead of one with high TX power.
by jaykay2342
Sun Apr 12, 2015 9:59 am
Forum: General
Topic: Question about nat 1:1 of about 8000 ip address
Replies: 1
Views: 1037

Re: Question about nat 1:1 of about 8000 ip address

If you have same amount(subnet size) of private addresses as public ones you can do a netmap. Let's say you map 192.168.20.0/24 to 198.51.100.0/24. 192.168.20.1 would become 198.51.100.1 ... 192.168.20.2 <=> 198.51.100.2 and so forth. So there is no need to log the translation as you now it from the...
by jaykay2342
Mon Apr 06, 2015 2:22 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

You can manually trust individual certificates if they're not signed by a CA you recognise. If you trust a CA, however, it can sign certs for *anything* which is what jaykay2342 was worrying about. StartCom do free SSL certs which I think are limited to one per domain. Also there's this Cisco/Mozil...
by jaykay2342
Sun Apr 05, 2015 8:50 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

How cheap? Which models? I can't find an 8 or 16 port managed switch worth a 2 figure sum. Only unmanaged ones. I'm using the "jetstream" devices. For example TL-SG3210 8x Cupper + 2xSFP ~100€. It looks even the "smart switches" have port isolation. At least i found it in the ma...
by jaykay2342
Sun Apr 05, 2015 7:16 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

It would be too expensive to have the entire network with managed switches (i.e. ones that would support this). :? All my cheap TP-Link managed switches have such feature. As far as i can see the Mikrotik CRS support it as well. Even with a RB2011 using the switch rule table you can ensure that a c...
by jaykay2342
Sun Apr 05, 2015 6:18 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

How can users be certain they're not connecting to a rogue PPPoE server? Last I checked, PPPoE supports encryption, but no certificates. Usually you can achieve it with port-isolation on your switch. I now looked a little closer, and it seems Windows at least supports PPPoE with EAP, meaning that t...
by jaykay2342
Sun Apr 05, 2015 5:27 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

AFAIK, if the hotspot certificate is signed by my CA, you need to add the CA too. Unless I'm missing something, and you could just add that one certificate and its chain, without trusting every other thing its CA has signed. If browsers allow for that, then yes, it's better to go for that. I'm not ...
by jaykay2342
Sun Apr 05, 2015 3:37 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

A "random" one, sure. But one that you know belongs to the party you're communicating with, and have verified by other means (e.g. phone or "physical" confirmation by the very person registering you) is not any less secure. Just because i communicating with you as the party who ...
by jaykay2342
Sun Apr 05, 2015 11:48 am
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

If someone would ask me to install a CA just to get rit of a warning i would not use that Hotspot at all. It shows me that the operator of the hotspot has no sense for security. From a security point of view installing random CAs is very dangerous. Think of a person who is travailing a lot, (s)he wo...
by jaykay2342
Sat Apr 04, 2015 2:39 pm
Forum: General
Topic: MikroTIK RADIUS client - multiple access-requests killing OTP
Replies: 4
Views: 2667

Re: MikroTIK RADIUS client - multiple access-requests killing OTP

We're using freeradius + yubikeys for openvpn on a routeros system. i haven't faced such problems with multiple access-requests. Must be a problem with the SSH + radius.
by jaykay2342
Mon Mar 16, 2015 3:14 pm
Forum: General
Topic: [TEST] RouterOS on PC Engines apu1c
Replies: 9
Views: 8429

Re: [TEST] RouterOS on PC Engines apu1c

Sry no wireless cards tested.
by jaykay2342
Fri Mar 06, 2015 9:41 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

No, you can't. You can't impersonate an HTTPS site without either causing a certificate error or getting your own CA certificate onto the client. That's just how HTTPS works.
People don't understand it, i've tried to explain it multiple times in this forum.
by jaykay2342
Wed Mar 04, 2015 10:04 pm
Forum: General
Topic: Connection Tracking
Replies: 20
Views: 16107

Re: Connection Tracking

Hey Mikrotik,

any news on that thing here? We really would like to see the possibility of connection tracking turned off for some traffic.

Julian
by jaykay2342
Mon Feb 02, 2015 4:52 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

I have a suspicion: As usual a battery/solar setup has some voltage fluctuation this might confuses the overload detection and it turns of a port ? do you guys use the device powered by batteries ?
by jaykay2342
Fri Jan 30, 2015 11:13 pm
Forum: Beginner Basics
Topic: RB2011 slow speed
Replies: 42
Views: 20127

Re: RB2011 slow speed

I would say that if you do not use srcnat or dstnat rules, the nat is off. Generally no rules in nat means no nat. You can use forward, input, output chain or your custom chain rules independently from having or not having nat. If you do not want any forwarding rules, it is better to turn ports fro...
by jaykay2342
Fri Jan 30, 2015 3:50 pm
Forum: Beginner Basics
Topic: RB2011 slow speed
Replies: 42
Views: 20127

Re: RB2011 slow speed

Better use iperf. iperf+nat+1Gbps+rb2011=0.3Gbs crap NAT is a CPU hungry task. What have you expected from the CPU build in the 2011? You can't but a scooter and expect racing car speed. @Mikrotik i would like to see the option to turn off NAT , Firewall and Connectiontracking for forwarded traffic...
by jaykay2342
Fri Jan 30, 2015 3:23 pm
Forum: Beginner Basics
Topic: RB2011 slow speed
Replies: 42
Views: 20127

Re: RB2011 slow speed

speedtest.net uses TCP connection and not the large packet. you should do the test with UDP Torrent traffic if you want to see the 1500 packet result To use torrent is also not that accurate. Better use iperf. It can test TCP,UDP and all kind of packet sizes with multiple dataflows. BTW i love the ...
by jaykay2342
Fri Jan 30, 2015 10:50 am
Forum: Beginner Basics
Topic: RB2011 slow speed
Replies: 42
Views: 20127

Re: Very low performance of RB2011

i would say LCD eats around 5-7% from the CPU. usually i just turn it off.
by jaykay2342
Wed Jan 21, 2015 3:56 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

Ok. I admitted in the beginning that the device doesn't work as designed. But it is not designed to be safety switch for the cases you referred to anyway.
I agree on it and if people use a software based "switch" safety it's a practices but let us keep that topic out of this thread.
by jaykay2342
Tue Jan 20, 2015 4:33 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

Hey guys please keep calm. i still have not faced any problems with the one switch i run for testing. I might be just lucky with it. But it seems ppl here have still problems. I would like to hear something from Mikrotik and what they think about these problems which obviously still existing. @Mikro...
by jaykay2342
Sat Jan 17, 2015 12:19 am
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

OK I've just checked the device again and now find something even more disturbing. A few days ago we were requested to power off one of our high powered 5.8Ghz devices connected to a high gain antenna so people could work safely in the area directly in front of it. Today I check the device and alth...
by jaykay2342
Thu Jan 01, 2015 8:58 pm
Forum: Wireless Networking
Topic: Hardware suggestions?!
Replies: 8
Views: 2460

Re: Hardware suggestions?!

@jaykay2342

Which hardware did you go with?

Also, if you used the stationbox, which board did you use?
we used SEXTANTs for that project
by jaykay2342
Wed Dec 24, 2014 12:50 pm
Forum: General
Topic: VLAN interface as a slave of physical Interface
Replies: 8
Views: 5722

Re: VLAN interface as a slave of physical Interface

Without a switch build into the device i would also suggest to add a seperate switch. Personally i avoid bridges as much as possible. Only use : as a loopback and as a connection of a radio with wired network.
by jaykay2342
Wed Dec 10, 2014 3:59 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

You are wrong because when the client asks to open a https web site (for example Google) the mikrotik WILL INTERCEPT this attempt and redirect the user to ANOTHER page which is https://myhotspot.mydomain.com/?dst=https://www.google.com and the certificate will be valid. The client first makes a TCP...
by jaykay2342
Wed Dec 10, 2014 2:49 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 121607

Re: https problem on hotspot

Hi ! I did this and my certificate is working good on the hotspot login page but I still get the Certificate warning if a Hotspot client has his browser set to open https://www.google.com or any https website... I already put the certificate in www-ssl in "services" too. Does someone has ...
by jaykay2342
Sat Dec 06, 2014 1:14 am
Forum: General
Topic: VLAN interface as a slave of physical Interface
Replies: 8
Views: 5722

Re: VLAN interface as a slave of physical Interface

Do you have a device with a Switchchip? For those I have a different approach to archive that. What i usually do: 1. Only one Masterport all others salve of it. 2. All port on vlan-mode = secure 3. The CPU PORT on vlan-header=add-if-missing After doing that i can handle vlan as i used to from switch...
by jaykay2342
Fri Dec 05, 2014 9:07 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

As this thread feared me to use the RB260GSP in the field. i took the device i bought a while ago and and use it at my own location. It's powering a old groove and a recently mounted sextant. It's running for 20 day. so far it's working.
by jaykay2342
Wed Nov 26, 2014 3:03 pm
Forum: Wireless Networking
Topic: 52km NetMetal-AC Link
Replies: 13
Views: 18474

Re: 52km NetMetal-AC Link

150mbit/s over 52km is nice. Can you tell us more about your setup.
  • How does the are look like?
  • Meters over ground?
  • Output power?
by jaykay2342
Wed Nov 26, 2014 2:56 pm
Forum: Wireless Networking
Topic: https redirect issue
Replies: 12
Views: 17230

Re: https redirect issue

That error is usual and you can't avoid it! From the technical view a man in the middle attack is happening. When you type https://google.com into you browser 1. It resolves google.com into an IP. Lets say it's 203.0.113.57. 2. The browser connect to TCP port 443 on 203.0.113.57. 3. The RouterOS sys...
by jaykay2342
Wed Nov 26, 2014 2:40 pm
Forum: Wireless Networking
Topic: SXT SA experience ?
Replies: 15
Views: 4798

Re: SXT SA experience ?

The previous SXT N based should handle 30 clients with reliable speed. My NV2 AP (RB711) mounted on UB** omni runs great with max throughput around 60-70Mbps TCP, currently handling about 16 clients, its almost same radio s the SXT so it should be working fine, definitely an improvement from CM9. H...
by jaykay2342
Wed Nov 26, 2014 2:31 pm
Forum: Wireless Networking
Topic: 2Km NetMetal5 low bandwidth high latency
Replies: 6
Views: 2931

Re: 2Km NetMetal5 low bandwidth high latency

I tried to used best frequency.
Tx Rx CCQ: 60/43 %
That's quite bad. Looks like interference. Have you checked the spectrum usage ?
by jaykay2342
Tue Nov 25, 2014 8:53 pm
Forum: General
Topic: Philosophy question..... UTMs?
Replies: 5
Views: 2654

Re: Philosophy question..... UTMs?

I was asking how many people deploy a UTM with a Mikrotik router. Is there a UTM everyone likes or a go to unit for a small business, restaurant, church, large residential, (not enterprise) that we should consider using? I am wondering if this would be a good standard practice to just do? I know th...
by jaykay2342
Tue Nov 25, 2014 8:39 pm
Forum: General
Topic: Feature Request: IPerf
Replies: 70
Views: 23975

Re: Feature Request: IPerf

+1 would be a nice feature. I like iperf, do all my tests with it
by jaykay2342
Fri Nov 21, 2014 12:22 am
Forum: General
Topic: 6.22 released!
Replies: 151
Views: 70997

Re: 6.22 released!

Very clever, but you really think that I didn't test new version before I upgrade a critical router? I have tested it on 3 other Routerboards... there is all ok, but on this very important router it ***** everything. So next time please try to think before post some stupidity ;) Why do you the upda...
by jaykay2342
Tue Nov 11, 2014 8:21 pm
Forum: General
Topic: NOT TO DO. Weird instalations?
Replies: 385
Views: 277593

Re: NOT TO DO. Weird instalations?

There are even commercial produced adapters for that. 1 RJ45 plug to 2 RJ45 jack. I have a couple of those in my cable box.
by jaykay2342
Wed Oct 29, 2014 9:58 pm
Forum: Announcements
Topic: Newsletter 62
Replies: 30
Views: 31498

Re: Newsletter 62

for many people it is. if you don't wan a smoke-alarm looking device, but something nice, we will have those too. mAP is a good start, but we will also have other good looking indoor APs i'm really curious about new mikrotik indoor APs. i recently bought some unifi APs. And i'm disappointed regardi...
by jaykay2342
Wed Oct 29, 2014 7:43 pm
Forum: Forwarding Protocols
Topic: Router with OSPF and BGP
Replies: 8
Views: 2736

Re: Router with OSPF and BGP

yeah firewall and OSPF can be complicated. on such routers i suggest no or only a very simple firewall config.
by jaykay2342
Wed Oct 29, 2014 12:05 pm
Forum: Forwarding Protocols
Topic: Router with OSPF and BGP
Replies: 8
Views: 2736

Re: Router with OSPF and BGP

use packet sniffer to fin out whether you see the hello from the other site. turn on debug logging for ospf. there can be other reason why they dont' want to speak with each other. different subnetmask or mtu can be a problem for example.
by jaykay2342
Tue Oct 28, 2014 11:29 am
Forum: Forwarding Protocols
Topic: Router with OSPF and BGP
Replies: 8
Views: 2736

Re: Router with OSPF and BGP

can you post your config?
by jaykay2342
Mon Oct 27, 2014 10:16 am
Forum: Wireless Networking
Topic: Overall TX CCQ with NV2
Replies: 5
Views: 2992

Re: Overall TX CCQ with NV2

Thanks for the info.
Any suggestions to collect the CCQ via SNMP with NV2?
i'm also interested to monitor CCQ via SNMP. I wounder why it's not part of the values we get from the registration table via SNMP.
by jaykay2342
Sat Oct 25, 2014 10:34 pm
Forum: Forwarding Protocols
Topic: Router with OSPF and BGP
Replies: 8
Views: 2736

Re: Router with OSPF and BGP

Your ethernet1 is still called gateway. i think this is from the default config. Ithe default config has also firewall rules which block stuff on the ether1-gateway. If you have not removed those firewall rulese they block the ospf traffic
by jaykay2342
Sat Oct 25, 2014 4:16 pm
Forum: General
Topic: RB2011 v6.04 crashed and now won't stop crashing
Replies: 6
Views: 1853

Re: RB2011 v6.04 crashed and now won't stop crashing

start this crashing all of a sudden? or after which change it starts? if no config change was done. take a spare router and import the config. if the problem gone it's most probably a hardware issue.
by jaykay2342
Sat Oct 18, 2014 1:49 pm
Forum: General
Topic: How to block bots?
Replies: 3
Views: 2756

Re: How to block bots?

There is no general solution to block bots/trojans/etc. They are all different. You can install an IDS to detect suspicious botnet/CnC traffic. There are also couple of lists with known Botnet CnC server ip addresses. For example www.abuse.ch is providing backlists for Zeus/spyeye/palevo/feodo malwa...
by jaykay2342
Sat Oct 18, 2014 1:37 pm
Forum: General
Topic: What is spi? and why does it eat so much cpu?
Replies: 0
Views: 2465

What is spi? and why does it eat so much cpu?

I discovered that 2 of my RB2011 had suddenly an increase on CPU utilization. On one box the profiler was showing 25% CPU was used by spi. I thought it's stateful packet inspection. I was woundering why this can happen as on these boxes not firewall/nat/connection-tracking is configured. At http://f...
by jaykay2342
Sat Oct 18, 2014 12:13 pm
Forum: RouterBOARD hardware
Topic: Use 3x3 mimo radio W/ 3 directionals to improve coverage?
Replies: 5
Views: 2071

Re: Use 3x3 mimo radio W/ 3 directionals to improve coverage

I think it's a bad idea to use mimo with antennas pointing in different directions. For a good mimo you should have a similar signal strength on all chains. He's not talking about using the advantages of MIMO throughput - but using the separate chains as if they were all seperate AP's (in essence) ...
by jaykay2342
Fri Oct 17, 2014 11:26 pm
Forum: General
Topic: Feature Request: DHCP-Client On Lease Script...
Replies: 14
Views: 5809

Re: Feature Request: DHCP-Client On Lease Script...

+1 nice feature to run updater for dynamic ips
by jaykay2342
Fri Oct 17, 2014 11:00 pm
Forum: RouterBOARD hardware
Topic: Use 3x3 mimo radio W/ 3 directionals to improve coverage?
Replies: 5
Views: 2071

Re: Use 3x3 mimo radio W/ 3 directionals to improve coverage

I think it's a bad idea to use mimo with antennas pointing in different directions. For a good mimo you should have a similar signal strength on all chains.
by jaykay2342
Tue Oct 14, 2014 3:28 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

I have the feeling that there is something wrong with the current-calculation and therefore the switch turns of port to prevent overload. I hope Mikrotik will investigate this issue a bit deeper. This switch can be a awesome device but only if it's stable. :?
by jaykay2342
Mon Oct 13, 2014 3:20 pm
Forum: General
Topic: [BUG] printing routes from main does not work
Replies: 2
Views: 1016

Re: [BUG] printing routes from main does not work

Print all your routes and you will see that there are no routing-mark=main

To print all routes in main table use
/ip route print where !routing-mark
thanks, than it should not tab complete "main" ;)
by jaykay2342
Mon Oct 13, 2014 1:56 pm
Forum: General
Topic: [BUG] printing routes from main does not work
Replies: 2
Views: 1016

[BUG] printing routes from main does not work

Following code is not working as expected:

ros code

/ip route print where routing-mark=main
by jaykay2342
Sun Oct 12, 2014 12:04 pm
Forum: General
Topic: [FEATURE REQUEST] Two Factor Authentication
Replies: 46
Views: 33316

Re: [FEATURE REQUEST] Two Factor Authentication

2 factor auth would be nice. We also using the yubikey on a lot off systems. Even for VPN(ovpn) with radius authentication. Unfortunately for the http(s) logins the radius-authrequest does not include the cleartext password, therefore the radius server can split up the password into the actual passw...
by jaykay2342
Sun Oct 12, 2014 11:55 am
Forum: General
Topic: [Feature request] fastpath with input firewall rules
Replies: 0
Views: 950

[Feature request] fastpath with input firewall rules

It should be possible to have fastpath working even with firewall rules as long as thoes rules are not in the forward or nat. It would be nice as it enables the possibility to protect the router and still having the high performance for the forwarded traffic.
by jaykay2342
Sun Oct 12, 2014 11:41 am
Forum: Forwarding Protocols
Topic: BGP4-MIB
Replies: 14
Views: 9964

Re: BGP4-MIB

+1 also OSPF-MIB would be nice
by jaykay2342
Sun Oct 12, 2014 11:30 am
Forum: General
Topic: MUM 2014 US Videos and slides
Replies: 5
Views: 1881

Re: MUM 2014 US Videos and slides

BTW on some videos on youtube the sound is so bad you can't follow the talk. :-/
by jaykay2342
Sun Oct 12, 2014 11:23 am
Forum: General
Topic: 32Mb RAM devices and ROS 6
Replies: 24
Views: 7806

Re: 32Mb RAM devices and ROS 6

7.8mb is fine. Problems start below 5mb of free ram on 32mb devices. They are not able to produce supout file for instance, having problems with responding to snmp, starting to blacklist programs from snmp, running cpu at full and sooner or later restart by watchdog. Generally I would say that 32mb...
by jaykay2342
Sat Oct 11, 2014 6:17 pm
Forum: Forwarding Protocols
Topic: OSPF Route Filtering
Replies: 1
Views: 1641

Re: OSPF Route Filtering

The filter of ospf-input on Router C are used when the router takes routes from OSPF to use them for the local routing table. Therefore it's normal that D,E and F get those routes. You need to add a filter on these routers as well to avoid router os from putting them into local routing table. Can yo...
by jaykay2342
Sat Oct 11, 2014 1:08 pm
Forum: General
Topic: 32Mb RAM devices and ROS 6
Replies: 24
Views: 7806

Re: 32Mb RAM devices and ROS 6

Well.. when I come to 6mbyte free ram I fear that the router could lock up. I have about 30 simple queues (pcq queues) and nothing else on a RB750... I ended putting 5.26 and I have 14mb free Why are you fearing that? I mean what should suddenly eat all that ram? Look that's one of my 32MiB router ...
by jaykay2342
Sun Oct 05, 2014 8:10 pm
Forum: General
Topic: RB2011UiAS-2HnD-IN CPU bottleneck
Replies: 14
Views: 5320

Re: RB2011UiAS-2HnD-IN CPU bottleneck

Depends totally on your configuration! As long if you turn off FW/NAT/CONNTRACK it can handle it. Take a look on the block diagram, and you see why it is not possible even at theoretical level What is not possible? We might have a misunderstanding here. The RB2011s CPU has one GBit port linked to t...
by jaykay2342
Sun Oct 05, 2014 1:43 pm
Forum: General
Topic: RB2011UiAS-2HnD-IN CPU bottleneck
Replies: 14
Views: 5320

Re: RB2011UiAS-2HnD-IN CPU bottleneck

RB2011UiAS-2HnD-IN CPU bottleneck Hm as I see it right there will be more then one point that is not really matching in this story here, sorry. The story was about a 1000/100 mbit/s connection. Can RB2011 handle this? No, and not even close, sorry. Depends totally on your configuration! As long if ...
by jaykay2342
Sun Oct 05, 2014 1:10 pm
Forum: General
Topic: 32Mb RAM devices and ROS 6
Replies: 24
Views: 7806

Re: 32Mb RAM devices and ROS 6

Have you faced any issues due to filled up ram so far? You have around 31% free that's ok , isn't it? I mean why would you expect your router to start consume more ram as it does right now? As long as you not to turn on more features it should not suddenly consume more ram. You might get some extra ...
by jaykay2342
Sun Oct 05, 2014 10:50 am
Forum: General
Topic: 32Mb RAM devices and ROS 6
Replies: 24
Views: 7806

Re: 32Mb RAM devices and ROS 6

The question is what can eat up ram once the system is booted? Queues maybe a bit also the connection tracking table. But i think you can have a decent amount of connections before this becomes an issue.
by jaykay2342
Wed Sep 24, 2014 9:06 pm
Forum: General
Topic: [TEST] RouterOS on PC Engines apu1c
Replies: 9
Views: 8429

Re: [TEST] RouterOS on PC Engines apu1c

Any more testing done on this? I'm mostly interested in shaping performance. Need something tower side to replace the rb493g for shaping. This *should* be about 4x as fast or better. Would love to see these same tests with a simple queue limiting to 50, 100, 200 until the CPU is maxed. As i have my...
by jaykay2342
Sat Sep 20, 2014 5:58 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

@mikrotik can you please provide more details about the problem?! was this a problem with overload detection? what was the actual change in 1.14? If 1.14 should have solved this issue why do some ppl still report problems?
by jaykay2342
Wed Sep 17, 2014 9:47 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

jaykay2342 I have 6 switches in operation. Version 1.14 does seem to be more stable, but I am still experiencing drop outs. I have ordered some Cisco small business switches that have a secure connection and I will go back to PoE injectors. Sound like i need also to use PoE injectors than. RB260GSP...
by jaykay2342
Wed Sep 17, 2014 11:18 am
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

Can the ppl who had problems with POE report whether 1.14 fixed the Problem? I'm still unsure whether we should deploy a RB260GSP for our next locations.
by jaykay2342
Wed Sep 17, 2014 11:15 am
Forum: Forwarding Protocols
Topic: Filter route by type?
Replies: 3
Views: 1881

Re: Filter route by type?

How about a filter ? e.g. /routing filter add action=accept chain=junk disabled=no invert-match=no prefix=0.0.0.0/0 prefix-length=0 set-bgp-prepend-path="" add action=accept chain=junk disabled=no invert-match=no prefix=10.0.0.0/8 prefix-length=8-32 set-bgp-prepend-path="" add a...
by jaykay2342
Sun Aug 31, 2014 11:36 pm
Forum: SwOS
Topic: RB260GSP ready for prime time?
Replies: 82
Views: 33329

Re: RB260GSP ready for prime time?

Is the power problem solved? I was planing to use the RB260GSP on 4 new locations to power all the on the roof equipment. But now i'm scared.
by jaykay2342
Sun Aug 31, 2014 7:31 pm
Forum: General
Topic: Memory leak
Replies: 6
Views: 2590

Re: Memory leak

I had a similar problem in the past ( 5.X time ) it was a problem with SNMP and is fixed for a long time. It might be a good idea when you guys post your configurations so that we can see what feature you all use in common. Otherwise it's just guessing around where the memory leak might be.
by jaykay2342
Sat Aug 30, 2014 5:02 pm
Forum: General
Topic: [Feature request] src-addr for fetch tool
Replies: 2
Views: 1857

[Feature request] src-addr for fetch tool

It would be nice if it would be possible to define the src-addr/src-interface the fetch tool is using for the outgoing connection. We use a script with the fetch tool poll a our own ddns service. For routers with multiple WAN connections we would like to poll over each path.
by jaykay2342
Sat Aug 30, 2014 4:56 pm
Forum: Forwarding Protocols
Topic: Filter route by type?
Replies: 3
Views: 1881

Filter route by type?

did someone know whether it's possible to filter by route type? I would like to add the non routeable networks (like RFC 1918, RFC6598, etc) as unreachable routes at my network edges. But such routes also get announced via ospf. i like to filter them on ospf-in. But how? Has someone an idea how to f...
by jaykay2342
Thu Aug 28, 2014 5:04 pm
Forum: Wireless Networking
Topic: Hardware suggestions?!
Replies: 8
Views: 2460

Re: Hardware suggestions?!

You are right about that. More gain on the antenna won't hurt. But still both Sextant and SXT can be used at 5-6km with no problem. On a site with multiple antennas it's better to use antennas with narrower beam to avoid self interference. Antennas with more gain usually have a more narrower beam. ...
by jaykay2342
Thu Aug 28, 2014 1:00 pm
Forum: Wireless Networking
Topic: Hardware suggestions?!
Replies: 8
Views: 2460

Re: Hardware suggestions?!

You don't even need Sextant. SXT's antenna is also enough for this distance. i've used the first generation SXT's and if there was not a significant improvement of the antenna i would not use them for a 800m link. for the ~300 meter link it might be ok. but the 5Ghz SXT with gigabit is not much che...
by jaykay2342
Wed Aug 27, 2014 5:15 pm
Forum: Wireless Networking
Topic: Hardware suggestions?!
Replies: 8
Views: 2460

Re: Hardware suggestions?!

Using the distance that you posted, as all of them are less then 1 kilometer, I would use the Sextant. It has the build in antenna and is a one piece device, much easier to work with. Be sure you get the SEXTANT G 5HPnD The big thing to remember is DO YOU HAVE A CLEAR LINE OF SITE? The Fresnelzone ...
by jaykay2342
Wed Aug 27, 2014 12:50 pm
Forum: Wireless Networking
Topic: Hardware suggestions?!
Replies: 8
Views: 2460

Hardware suggestions?!

Hi all, i'm looking for hardware recommendation for the 3 PtoP links which we're currently planning. We start with 150Mbit uplink from location B. So i would like to be able to transport that bandwidth over the PtoP Links in both directions. Location A <= ~692 meters => Location B <= ~830 meters => ...
by jaykay2342
Sat Aug 16, 2014 12:38 pm
Forum: General
Topic: switch chip firewalling
Replies: 1
Views: 1103

Re: switch chip firewalling

good idea to get the packets drop before they hit the cpu. but as the amount of rules and possible conditions are very limited you can'd do everything that way. but for a ongoing flood is think it's a good way to mitigate the impact.
by jaykay2342
Sat Aug 16, 2014 11:56 am
Forum: General
Topic: RADIUS Opinions
Replies: 13
Views: 4712

Re: RADIUS Opinions

FreeRadius with MySQL backend. We also have a module for YubiKeys which authenticates against an internal yubikey server. We build the yubikey setup for a (open)VPN which requires 2 factors for login.
by jaykay2342
Sat Jun 21, 2014 10:28 am
Forum: General
Topic: Blocking countries IP blocks for security
Replies: 8
Views: 6837

Re: Blocking countries IP blocks for security

This is actually a very common feature that many top security gateway vendors offer as a simple point & click option. What can make it ineffective is anonymity networks such as Tor, which can route traffic from an undesirable country to a country you wouldn't think twice about blocking. Additio...
by jaykay2342
Thu Jun 19, 2014 11:35 pm
Forum: General
Topic: Blocking countries IP blocks for security
Replies: 8
Views: 6837

Re: Blocking countries IP blocks for security

I have a fail2ban setup already in place but I can't guarantee when I remote in that I'm not off on vacation in some tropical paradise from an unknown IP. I know I won't be in China lol I just want to drop the amount of traffic used by being a blackhole as far as the Chinese are concerned. If they ...
by jaykay2342
Thu Jun 19, 2014 10:35 pm
Forum: General
Topic: RB750 with seperate WiFi AP
Replies: 1
Views: 1883

Re: RB750 with seperate WiFi AP

I would try to put the dlink router in passthrough mode. That means you only use the ADSL modem of it and it isnt't doing any routing at all. Once you have done that you can/need to configure the pppoe connection on the RB750. If your TP-Link AP is really an AP and not a router everything is fine wi...
by jaykay2342
Thu Jun 19, 2014 10:14 pm
Forum: General
Topic: Blocking countries IP blocks for security
Replies: 8
Views: 6837

Re: Blocking countries IP blocks for security

Personal think blocking country wise is not a prevention against these common bruteforce attacks. They coming from all over the world, yes also from the USA. Most of the time it's done by other host where an attack was successful. It's spread like a worm. Access to mgmt interfaces like ssh or a web-...
by jaykay2342
Thu Jun 19, 2014 9:53 pm
Forum: General
Topic: RB2100UiAS-RM for iSCSI replication traffic
Replies: 3
Views: 2058

Re: RB2100UiAS-RM for iSCSI replication traffic

As you mentioned the you want to encrypted the traffic i would go for the RB1100AHX2. It has hardware based acceleration for encryption.
by jaykay2342
Thu Jun 05, 2014 6:59 pm
Forum: General
Topic: Opinion on P2P limiting approach
Replies: 6
Views: 1895

Re: Opinion on P2P limiting approach

>>> Opinion on P2P limiting approach About the title: If I pay 2M/2M, I want use my limit for everything I want. If you not write on the contract with the notice "the P2P is limited to 64k (for example)", you commit one fraud... Full 100% ack on that! Let the customers decide what they wa...
by jaykay2342
Thu Jun 05, 2014 6:45 pm
Forum: General
Topic: Create disclaimer page like hotspot page to authenticate ?
Replies: 14
Views: 4654

Re: Create disclaimer page like hotspot page to authenticate

Why not use the trial account feature for that? just have a something like 24h trial per day. Just make a login page with a trial link but without showing the usual login fields.
by jaykay2342
Thu Jun 05, 2014 6:23 pm
Forum: Wireless Networking
Topic: SXT concentrator
Replies: 17
Views: 3552

Re: SXT concentrator

Thanks for your reply Jaykay The local regulation is actually pretty clear: the 5470-5725 MHz band is free (unlicensed) for outdoor use as long as DFS is enabled. You're are right, the situation in which they'll all require 100Mbps at the same time is pretty unlikely. It just makes sense to me that...
by jaykay2342
Thu Jun 05, 2014 2:18 pm
Forum: Wireless Networking
Topic: SXT concentrator
Replies: 17
Views: 3552

Re: SXT concentrator

Are you guys noticing that you're all from different countries with different regulations? I think in most countries a WISP using frequencies which are available for everyone have to deal with the interference. As long as you stay below the maximal EIRP allowed for your country you should be fine. B...
by jaykay2342
Tue Jun 03, 2014 7:57 pm
Forum: Wireless Networking
Topic: walled garden + hotspot
Replies: 1
Views: 1250

Re: walled garden + hotspot

It's possible.

First create 2 virtual AP interfaces with different security profiles. One you can bridge or route into the LAN. On the other one you can deploy the hotspot for wall gardening. Don't forget to use a different subnet on the open access point with it's own dhcp-server/ippool
by jaykay2342
Tue Jun 03, 2014 2:59 pm
Forum: General
Topic: identifying what interface client is on
Replies: 4
Views: 1451

Re: identifying what interface client is on

For what purpose do you need that information? is it sufficient to look it up when needed or do you need to log such information somehow? for like lookup you can find the MAC-addresses for all IPs under IP/ARP. But the port listed here will be the Masterport instead of the actual port the client is ...
by jaykay2342
Tue Jun 03, 2014 10:07 am
Forum: RouterBOARD hardware
Topic: PoE RB750GL
Replies: 1
Views: 1133

Re: PoE RB750GL

The RB750GL have no PoE Out function. Only poe in on port 1
by jaykay2342
Mon Jun 02, 2014 11:33 pm
Forum: General
Topic: walled garden for https
Replies: 3
Views: 1849

Re: walled garden for https

whitelist the IP. If you try to redirect https traffic to the proxy the browser will show a certificate warning, because technically you do a man in the middle (attack).
by jaykay2342
Sun Jun 01, 2014 7:55 pm
Forum: Wireless Networking
Topic: 18km PtP wireless link issue
Replies: 21
Views: 7447

Re: 18km PtP wireless link issue

i#m curious as well
by jaykay2342
Sat May 31, 2014 10:13 pm
Forum: Beginner Basics
Topic: VPN bonding = low speed
Replies: 3
Views: 2607

Re: VPN bonding = low speed

Hey,

do you need to have a single TCP connection use all links? Otherwise i would recommend to use ECMP (Equal Cost Multi-Path) on top of a dynamic routing protocol like OSPF.
by jaykay2342
Wed May 21, 2014 11:52 pm
Forum: General
Topic: VirtualAP question
Replies: 9
Views: 1829

Re: VirtualAP question

maybe it's a good idea to show us the code?
by jaykay2342
Wed May 21, 2014 11:47 pm
Forum: Beginner Basics
Topic: What RouterBoard should I be using?
Replies: 5
Views: 1629

Re: What RouterBoard should I be using?

First of all why are you trying to stop torrent? Are you afraid of ppl "stealing" all the bandwidth? Use PCQ queues to divide the bandwidth fair and let everyone to what ever (s)he wants to do with it. And with encryption they will be able to find a way around it anyway. Or is this due to ...
by jaykay2342
Mon May 12, 2014 11:52 pm
Forum: Forwarding Protocols
Topic: How Do I add a link local address?
Replies: 13
Views: 6499

Re: How Do I add a link local address?

Your /112 is a public address, right? Why do you not just add it to the interface? any problems with that? Link local addresses are not added manual. That's the reason for "Couldn't add New Ipv6 Address - can not add link local address (6)" Your interface should already have one, generated...
by jaykay2342
Mon May 12, 2014 11:35 pm
Forum: General
Topic: where are the 3 cpu ports on the switch for on rb2011
Replies: 2
Views: 1217

Re: where are the 3 cpu ports on the switch for on rb2011

http://i.mt.lv/routerboard/files/Block-RB2011.pdf That doesn't explain where the 3rd cpu port is coming from. But might answer your question about whether the speed is shared.

i think the AR9344 has actually 2 GBit interfaces but in the RB2011 only one is used to connect the gbit switch
by jaykay2342
Mon May 12, 2014 3:39 pm
Forum: General
Topic: Alix 2D2 constantly reboots - how to troubleshoot???
Replies: 5
Views: 1438

Re: Alix 2D2 constantly reboots - how to troubleshoot???

as it might be a corrupted ram i suggested to run memtest86+ on it. Check for memtest with serial console ( i'm sure there is such a version )
by jaykay2342
Sat May 10, 2014 9:06 pm
Forum: General
Topic: Logging web traffic to remote webserver
Replies: 33
Views: 13136

Re: Logging web traffic to remote webserver

Are you using the buildin proxy-server? because topics=web-proxy selects the log from the buildin web-server not logs from the firewall
by jaykay2342
Thu May 08, 2014 10:56 pm
Forum: General
Topic: PPPoE server with RADIUS, how to add IPv6
Replies: 13
Views: 9174

Re: PPPoE server with RADIUS, how to add IPv6

Now i was curious how Framed-IPv6-Prefix is handled by RouterOS. So i did some example configs on my lab devices. You're right it's different as a prefix delegation. The router installs a route for that Framed-IPv6-Prefix pointing towards the dynamic generated PPP interface for the user. That's tota...
by jaykay2342
Tue May 06, 2014 6:24 pm
Forum: General
Topic: PPPoE server with RADIUS, how to add IPv6
Replies: 13
Views: 9174

Re: PPPoE server with RADIUS, how to add IPv6

As far as i understand Framed-IPv6-Prefix assigns a static prefix to the ppp-peer. Sure your radius server could pick it from a pool but it's up to you to configure the radius server to always give the same Framed-IPv6-Prefix. just as with Framed-IP-Address. i haven't deployed IPv6 via PPP in my net...
by jaykay2342
Sun May 04, 2014 11:09 am
Forum: Beginner Basics
Topic: RB2011 slow speed
Replies: 42
Views: 20127

Re: Very low performance of RB2011

Have you used the profile tool to finde out what eating up the cpu time? I usually get around 300Mbit/s through a RB2011 when NAT/Connection Tracking/Firewall is enabled. If all that stuff is off and fastpass is possible it can route deal with full 1Gbit/s
by jaykay2342
Sun May 04, 2014 10:47 am
Forum: General
Topic: PPPoE server with RADIUS, how to add IPv6
Replies: 13
Views: 9174

Re: PPPoE server with RADIUS, how to add IPv6

The radius attribute you're looking for is "Framed-IPv6-Prefix". You can find all Radius attributes here: http://wiki.mikrotik.com/wiki/Manual:RA ... Attributes
by jaykay2342
Sat Apr 26, 2014 12:31 pm
Forum: Forwarding Protocols
Topic: Enabling OSPF Authentication on a large network
Replies: 5
Views: 3292

Re: Enabling OSPF Authentication on a large network

as MD5 isn't a good hash for security and can easily cracked it will not add much security to your network. On all layer2 segments where you "speak" OSPF only your devices should be connected. Wireless links should be encrypted anyway. Most important is to turn OSPF off for all interfaces ...
by jaykay2342
Sat Apr 26, 2014 11:31 am
Forum: General
Topic: Certificate problem v6
Replies: 9
Views: 2689

Re: Certificate problem v6

i don't know if this is possible. have you tried a different certificate? maybe a selfsigned
by jaykay2342
Fri Apr 25, 2014 1:59 pm
Forum: Beginner Basics
Topic: Beiginner question for User Public Ip Routing
Replies: 7
Views: 2370

Re: Beiginner question for User Public Ip Routing

When you use 2.2.2.0/24 as your pool for PPPoE the router adds /32 routes dynamically. So userA connects via pppoe and get 2.2.2.10, the router creates pppoe-userA interface adds a router for 2.2.2.10/32 pointing towards this interface.
by jaykay2342
Wed Apr 23, 2014 6:21 pm
Forum: Beginner Basics
Topic: Able to connect to internet before PPPoE authentication
Replies: 2
Views: 1151

Re: Able to connect to internet before PPPoE authentication

Have configured an IP/dhcpserver on the ethernet interface of your PPPoE server?
by jaykay2342
Tue Apr 22, 2014 10:50 pm
Forum: General
Topic: Huge log file
Replies: 5
Views: 1673

Re: Huge log file

Is the DNS server at your router accessible from the WAN? looks a bit like someone tries to abuse it for a DNS Amplification Attack.
by jaykay2342
Tue Apr 22, 2014 10:37 pm
Forum: Beginner Basics
Topic: Beiginner question for User Public Ip Routing
Replies: 7
Views: 2370

Re: Beiginner question for User Public Ip Routing

So your ISP needs to route 2.2.2.0/24 towards your router. e.g. by adding a route for it pointing to 1.1.1.2 ( the wan site of your router ) you just create a 2nd pool/profile for users with public IPs. Important is that you exclude the traffic from those users from the natting. to achieve that your...
by jaykay2342
Mon Apr 21, 2014 4:53 pm
Forum: General
Topic: Certificate problem v6
Replies: 9
Views: 2689

Re: Certificate problem v6

 > /certificate print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key,
A - authority, I - issued, R - revoked, E - expired, T - trusted
 #         NAME               COMMON-NAME              FINGERPRINT
so KT sounds like something you want
by jaykay2342
Mon Apr 21, 2014 1:05 pm
Forum: General
Topic: Certificate problem v6
Replies: 9
Views: 2689

Re: Certificate problem v6

If its corrupted isn't strange that it works on 5.26?
you're right. i thought you reimported it after upgrade and your file get broken while uploading. what about other 6.x versions? newest version i run is 6.11 so far no problems with certificates
by jaykay2342
Mon Apr 21, 2014 10:48 am
Forum: General
Topic: Certificate problem v6
Replies: 9
Views: 2689

Re: Certificate problem v6

sound the certificate is corrupt. which ca issues the certificate? does other browsers show the same/similar error?
by jaykay2342
Sun Apr 20, 2014 11:12 am
Forum: General
Topic: SSH blacklisting improvment posible?
Replies: 11
Views: 3288

Re: SSH blacklisting improvment posible?

Thanks for your reply, I locked connection for me few times in history. What expire time for blacklistng you prefer? You think 10-30 minutes is good enough? Something like that i used in the past, it's usually good enough. Most of those attacks try to find user accounts with weak passwords on linux...
by jaykay2342
Sun Apr 20, 2014 10:50 am
Forum: General
Topic: LAN/WAN showing different Bandwidth( Data rate)
Replies: 21
Views: 7345

Re: LAN/WAN showing different Bandwidth( Data rate)

If 5 Mbps garbage-traffic coming in on the WAN interface and get dropped by firewall-rules this is exactly what i would expect as an result. So you get 25M ( WAN-RX ), you filter out 5M, you send out the remaining 20M ( LAN-TX ). If you really get 5Mbps garbage-traffic which get dropped you should i...
by jaykay2342
Sun Apr 20, 2014 10:41 am
Forum: General
Topic: SSH blacklisting improvment posible?
Replies: 11
Views: 3288

Re: SSH blacklisting improvment posible?

Lighten up. Security by obscurity its not security. The issue i have found with dynamic blacklist for ssh ports is your ip can end up on the list as well even if for a limited time. if you were to do many ssh's within your time frame Does slow down password hack attempts. Best to also only use root...
by jaykay2342
Sun Apr 20, 2014 1:32 am
Forum: General
Topic: SSH blacklisting improvment posible?
Replies: 11
Views: 3288

Re: SSH blacklisting improvment posible?

ssh port on network devices should NOT be accessible from everywhere. to limit the access to any kind of management interface (ssh,web,api,....) is best you can do for security. furthermore it good to monitor logs. once your ssh is only accessible from your office/network operating center/vpn you do...
by jaykay2342
Sun Apr 20, 2014 12:57 am
Forum: General
Topic: Certificate problem v6
Replies: 9
Views: 2689

Re: Certificate problem v6

why did the browser give you that warning? about what is it complaining? signed by an non trusted ca? or you certificate is for a different hostname as the one of your hotspot.
by jaykay2342
Sat Apr 19, 2014 7:41 pm
Forum: General
Topic: the place of hotspot in the network
Replies: 1
Views: 784

Re: the place of hotspot in the network

as the hotspot server deals with the users mac address i think a layer2 connection between both is needed. you could use some layer2 tunnel if you need to have the hotspot server at a different place
by jaykay2342
Sat Apr 19, 2014 7:36 pm
Forum: General
Topic: LAN/WAN showing different Bandwidth( Data rate)
Replies: 21
Views: 7345

Re: LAN/WAN showing different Bandwidth( Data rate)

What i meant was that for one interface the data are from a different "time" as for the other interface. but than it must be also the other way around wrong sometimes. what kind of traffic do you have on the network? belongs the 20M mostly to one tcp connection? how about traffic on the WA...
by jaykay2342
Sat Apr 19, 2014 3:02 pm
Forum: General
Topic: LAN/WAN showing different Bandwidth( Data rate)
Replies: 21
Views: 7345

Re: LAN/WAN showing different Bandwidth( Data rate)

have you some kind of queue configuration? on the other hand i think that this values at the webinterface are not 100% accurate as bandwidth usage is calculate via taking the delta between to countervalue. so the timeframe which was used to calculate WAN might be not the same as the timeframe which ...
by jaykay2342
Sat Apr 12, 2014 8:30 pm
Forum: General
Topic: Static Routing
Replies: 4
Views: 1333

Re: Static Routing

first thing i notice is that 172.24.29.17 is a private ip address. i guess your router also have a IP adresses in that private network, therefore it uses this IP when you trace from the router. when you trace from your server it uses 196.6.242.30. my guess is the provider gateway didn't know the rou...
by jaykay2342
Sat Apr 12, 2014 8:17 pm
Forum: Wireless Networking
Topic: Wireless PPPoE server
Replies: 2
Views: 1344

Re: Wireless PPPoE server

i don't know whether i get this correct: you want a setup where you're able to communicate with the CPE but the customer traffic shall go through a pppoe tunnel? nothing easier than that. it's possible to have an non-routed(filtered) IP network on the same layer2-network as where you're building the...
by jaykay2342
Sat Apr 12, 2014 7:54 pm
Forum: General
Topic: RB for 20 000 users
Replies: 2
Views: 1121

Re: RB for 20 000 users

With a large user base you may want to avoid single points of failure so you may spread the load across multiple servers. Other factors such as the maximum upstream bandwidth available and the source of the clients (wired? wireless?) can help to clarify the design requirements. totally agree, bette...
by jaykay2342
Wed Apr 09, 2014 7:24 pm
Forum: General
Topic: Feature request: Stateful HA with Conntrackd
Replies: 30
Views: 11370

Re: Feature request: Stateful HA with Conntrackd

With using VRRP and OnMaster/OnBackup scripting you could essentially have stateful HA.
no, with scripts you can't sync the connection tracking.
by jaykay2342
Wed Apr 09, 2014 7:02 pm
Forum: General
Topic: [TEST] RouterOS on PC Engines apu1c
Replies: 9
Views: 8429

[TEST] RouterOS on PC Engines apu1c

Hello, Today i got a apu1c board from PC Engines. It's a follower of the well known and awesome Alix Boards. Finally they have a board with Gigabit :) Even if my board will end up as a firewall most properly running pfSense i thought it might be a good idea to test how RouterOS is performing on this...
by jaykay2342
Tue Apr 08, 2014 12:07 pm
Forum: General
Topic: Is ROS using openssl internally?
Replies: 1
Views: 2199

Is ROS using openssl internally?

Hey Guy, Hey Mikrotik, Today is a bad day in an administrators life. There's a bug in OpenSSL which allows the attacker to access memory what might contain the private key as well. What a disaster! I'm wondering whether RouterOS is using the OpenSSL library for SSL ( https,openvpn,... ) and is vulne...
by jaykay2342
Sun Apr 06, 2014 11:48 pm
Forum: Beginner Basics
Topic: pppoe-out dsl client *weird* issue?
Replies: 1
Views: 1150

Re: pppoe-out dsl client *weird* issue?

can you post your configuration? if some websites work and others don't it sounds like a MTU issue. is it possible that you drop ICMP in the situation where it is not working?
by jaykay2342
Sun Apr 06, 2014 4:22 pm
Forum: Beginner Basics
Topic: p2pZeus Connection to C&C
Replies: 1
Views: 1011

Re: p2pZeus Connection to C&C

instead of using the torch tool i would create a firewall rules for the destination ip of c&c server with action log. then you just have to check the log.
by jaykay2342
Sun Apr 06, 2014 4:00 pm
Forum: General
Topic: No idea how this is event possible
Replies: 14
Views: 4195

Re: No idea how this is event possible

RB2011 is not doing 1Gbit/s if you doing firewalling and natting on that box, it just not powerful enough. It was never a high-end router.
by jaykay2342
Sun Apr 06, 2014 3:53 pm
Forum: Scripting
Topic: If you use PHP play in online HOTSPOT users
Replies: 1
Views: 1170

Re: If you use PHP play in online HOTSPOT users

.id is not the username it the id of the session. first get the data with /ip/hotspot/active/print , array("user"=>"abcd") .... that should give you an array of all sessions ( again arrays ) the user currently has. most probably only one. and there you have a the .id field for th...
by jaykay2342
Sun Apr 06, 2014 3:34 pm
Forum: General
Topic: Very bad reliability Mikrotik Products and ROS
Replies: 6
Views: 3232

Re: Very bad reliability Mikrotik Products and ROS

It's really funny that a lot of people here complain about the bugs in ROS and considering to move to so called "enterprise" vendors. I'm using Mikrotik devices at a non-profit, community based WISP and i'm quite happy with it. Sure i also faced some bugs, but in general it works. For ever...
by jaykay2342
Sun Apr 06, 2014 2:20 pm
Forum: RouterBOARD hardware
Topic: OSPF external routes bug
Replies: 6
Views: 3546

Re: OSPF external routes bug

@mikrotik are you guys aware of that bug?
by jaykay2342
Fri Apr 04, 2014 11:40 pm
Forum: General
Topic: MUM Europe 2014 - Italy, Venice, February 20-21
Replies: 145
Views: 73320

Re: MUM Europe 2014 - Italy, Venice, February 20-21

CCR1072 inside :o
are all theses fans really needed? looks like a lot heat needs to be blown away, how is the power consumption?
by jaykay2342
Fri Apr 04, 2014 11:37 pm
Forum: General
Topic: VRRP BGP
Replies: 3
Views: 1979

Re: VRRP BGP

as i mentioned you can reach redundancy by having 2 BGP Sessions. One from each router. if you want a Active/Standby setup might need to make the routing more "expensive" on the backup-link. e.g. by announcing the prefixes with a pretended path from the backup device.
by jaykay2342
Thu Apr 03, 2014 7:02 pm
Forum: RouterBOARD hardware
Topic: OSPF external routes bug
Replies: 6
Views: 3546

Re: OSPF external routes bug

which version of ROS are you running? i had similar issues with default routes not getting deleted/changed after a route(r) with lower costs comes back. ended with routing loops as this only happened on devices with an older version ( something 5.x ). after upgrading those devices to 6.10 the issues...
by jaykay2342
Thu Apr 03, 2014 6:55 pm
Forum: General
Topic: Feature request: Stateful HA with Conntrackd
Replies: 30
Views: 11370

Re: Feature request: Stateful HA with Conntrackd

+1 - would be a nice feature
by jaykay2342
Thu Apr 03, 2014 6:40 pm
Forum: General
Topic: VRRP BGP
Replies: 3
Views: 1979

Re: VRRP BGP

why you want to have vrrp at the "frontend"? usually you would have just two BGP sessions. everytime your routing protocol can do the job you should prefer this over VRRP. VRRP is nice for network segments where no routing protocol is spoken. if you do BGP on a vrrp interface the session w...
by jaykay2342
Sat Mar 15, 2014 6:15 pm
Forum: Beginner Basics
Topic: High CPU usage of Winbox on RB2011
Replies: 7
Views: 5739

Re: High CPU usage of Winbox on RB2011

I'm wondering why this can cause so much cpu usage. mikrotik? is this maybe a bug?
by jaykay2342
Sat Mar 15, 2014 10:14 am
Forum: General
Topic: Unlimited speed for lan connection when using queues
Replies: 4
Views: 3964

Re: Unlimited speed for lan connection when using queues

no W1 is the Wireless interface where all the users are connected at. story behind is we have a community network with smaller uplinks so we need so shape the internet traffic a bit, but we want that internal traffic between the users is unlimited
by jaykay2342
Fri Mar 14, 2014 11:07 am
Forum: Beginner Basics
Topic: High CPU usage of Winbox on RB2011
Replies: 7
Views: 5739

Re: High CPU usage of Winbox on RB2011

as i'm a linux guy i'm not using winbox at all, am i the only who just use ssh and web?

but have you checked what is eating the cpu cycles with the profile tool?
by jaykay2342
Fri Mar 14, 2014 11:01 am
Forum: Scripting
Topic: any way to setup Routeros RB750GL as a phone home device?
Replies: 2
Views: 1114

Re: any way to setup Routeros RB750GL as a phone home device

sounds for me like you want to configure a VPN.
by jaykay2342
Thu Mar 13, 2014 5:15 pm
Forum: General
Topic: License Questions
Replies: 3
Views: 1124

Re: License Questions

Thanks for the information. As i'm going to create virtual disks for those virtual routers i'm wondering what is a good disksize? As the license get invalid once the disk changes this value needs to be chosen wisely. I don't want to wast space and on the other hand i don't want to get problems if a ...
by jaykay2342
Wed Mar 12, 2014 11:05 am
Forum: Beginner Basics
Topic: Multiple IP addr in a single subnet across several ports
Replies: 5
Views: 2826

Re: Multiple IP addr in a single subnet across several ports

i thought he's providing upstream for 4 customers. and those customers have their own firewalls.
by jaykay2342
Tue Mar 11, 2014 11:31 pm
Forum: Beginner Basics
Topic: Multiple IP addr in a single subnet across several ports
Replies: 5
Views: 2826

Re: Multiple IP addr in a single subnet across several ports

Create one bridge and add all 4 Port to it. don't forget that you have to assign 60.60.60.225 to the bridge interface.
by jaykay2342
Sun Mar 09, 2014 10:54 am
Forum: General
Topic: Multi client pppoe on same ISP
Replies: 3
Views: 1224

Re: Multi client pppoe on same ISP

i can't find the inbound nat in your configuration.
by jaykay2342
Sat Mar 08, 2014 7:08 pm
Forum: General
Topic: Ping to 127.0.0.1 > 3ms. It's normal?
Replies: 3
Views: 2463

Re: Ping to 127.0.0.1 > 3ms. It's normal?

just a guess: ROS have priority to handle "real" traffic. by real i mean traffic which enters or leaves the system.
by jaykay2342
Sat Mar 08, 2014 6:29 pm
Forum: Beginner Basics
Topic: QoS & LAN Party
Replies: 10
Views: 2865

Re: QoS & LAN Party

1. 60-70 ppl coming to the lan
2. We got 100/10mbs internet speed and we wan't to limit the user traffic to 1mbs/person.

Tha's the only thing we need really! :)
have you tried a pcq queue? http://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ
by jaykay2342
Sat Mar 08, 2014 10:15 am
Forum: General
Topic: Newsletter 55 - new products!
Replies: 33
Views: 13258

Re: Newsletter 55 - new products!

I'm sill wondering whether RB260GSp will have an SPF slot or not?
by jaykay2342
Thu Mar 06, 2014 9:39 pm
Forum: General
Topic: License Questions
Replies: 3
Views: 1124

License Questions

Hi, i'm planning to run routeros inside a KVM. Mainly it will be a VPN endpoint. As i understand the routeros license is bound to the hdd. As the virtual hdd of a KVM is just a file i'm wonder how routeros handles such cases. For maintenance pr to scale up hardware, i'm used to move around my VMs be...
by jaykay2342
Wed Mar 05, 2014 7:23 pm
Forum: Beginner Basics
Topic: QoS & LAN Party
Replies: 10
Views: 2865

Re: QoS & LAN Party

I would suggest pcq for limiting the traffic per user. and maybe you can detect game traffic with layer7 and mark it, so you can exclude it from the limitation.
by jaykay2342
Tue Mar 04, 2014 10:53 pm
Forum: General
Topic: Tunnel (v4 & v6) over IPv6-only network with dynamic prefix
Replies: 1
Views: 1359

Re: Tunnel (v4 & v6) over IPv6-only network with dynamic pre

We have a similar problem here, just with a dynamic v4 address. most probably it will change to a dynamic v6 perfix in the future. What we do is sending traffic through gre tunnel to a linux box at the datacenter. We use the http fetch tool to pool a script at the linux box. This script modifies the...
by jaykay2342
Tue Mar 04, 2014 10:12 pm
Forum: Beginner Basics
Topic: Can't ping through bridge
Replies: 13
Views: 10391

Re: Can't ping through bridge

any filter rules in place? check also filter for the bridgedtraffic ( /interface bridge filter )
by jaykay2342
Thu Feb 27, 2014 9:20 pm
Forum: Scripting
Topic: How to "detect" PPPoE user dial-up
Replies: 5
Views: 1992

Re: How to "detect" PPPoE user dial-up

your users get the same IP instead of a new one when they redial? is this your problem?
by jaykay2342
Thu Feb 27, 2014 8:22 pm
Forum: General
Topic: Unlimited speed for lan connection when using queues
Replies: 4
Views: 3964

Re: Unlimited speed for lan connection when using queues

here is how i do it: you local network is 10.182.0.0/16 - i mark the none -local traffic which should be shaped by queues. /ip firewall mangle add action=mark-packet chain=prerouting dst-address=!10.182.0.0/16 in-interface=w1 new-packet-mark=p2m-up-traffic add action=mark-packet chain=postrouting ne...
by jaykay2342
Thu Feb 27, 2014 8:11 pm
Forum: General
Topic: RB260GS and LC to SC Duplex Single mode Fiber cables
Replies: 2
Views: 1651

Re: RB260GS and LC to SC Duplex Single mode Fiber cables

most probably your patch cable was a multimode cable. now you are using multimode SFPs with a single mode cable(the yellow one) this will not work.
by jaykay2342
Wed Feb 26, 2014 8:41 pm
Forum: General
Topic: How to block all traffic from outside to my Router
Replies: 14
Views: 11525

Re: How to block all traffic from outside to my Router

I'm confused. You can't block traffic to your router before the router. If you want to stop it before it gets to you your isp will have to block it. You can only drop the traffic once it arrives Sent from my SCH-I545 using Tapatalk agree, if the in coming traffic fills you uplink it doesn't matter ...
by jaykay2342
Wed Feb 26, 2014 7:36 pm
Forum: General
Topic: Tagging untagged traffic !! vlan
Replies: 4
Views: 1603

Re: Tagging untagged traffic !! vlan

why do you have untagged traffic on a trunk?
by jaykay2342
Wed Feb 26, 2014 7:30 pm
Forum: General
Topic: Policy Routing Question
Replies: 5
Views: 1761

Re: Policy Routing Question

If you're running dual WAN setup using policy routing you should not have any problem with the return traffic. So for example you have a policy to route voice traffic over WAN1. You phones sitting somewhere in the internal network on a LAN interface. The return traffic from the outside will be handl...
by jaykay2342
Sun Feb 23, 2014 12:43 pm
Forum: General
Topic: MUM Europe 2014 - Italy, Venice, February 20-21
Replies: 145
Views: 73320

Re: MUM Europe 2014 - Italy, Venice, February 20-21

Is the S in RB260GSP for SFP? On the photo can be seen SFP led so i am thinking that RB260GSP has SFP port. Normis can you confirm? When RB260GSP will be available? this "photo" looks like it's rendered. i would really like to have an SFP. that's a device i'm looking for. you can power th...
by jaykay2342
Sat Feb 22, 2014 8:13 pm
Forum: General
Topic: Feature Requests for 7.x for improved network security
Replies: 11
Views: 6245

Re: Feature Requests for 7.x for improved network security

Hi! I would love following features specially for the CRS. - Wired MAC Authentication against Radius with dynamic VLAN assignment via Radius - Wired 802.1x Authentication against Radius with dynamic VLAN assignment via Radius - Wired Dual (MAC and 802.1x) Authentication against Radius Following for...
by jaykay2342
Sat Feb 22, 2014 10:09 am
Forum: General
Topic: MUM Europe 2014 - Italy, Venice, February 20-21
Replies: 145
Views: 73320

Re: MUM Europe 2014 - Italy, Venice, February 20-21

New product slides: http://mum.mikrotik.com/presentations/IT14/it14.pdf Thanks :) ccr 1072...smartcard...what will it be used for? console (physical router access) authentication ? Storing certificates. Yeah that's sounds grate. i also would like to see that ROS supports RSA for SSH keys, we have R...
by jaykay2342
Fri Feb 21, 2014 10:27 pm
Forum: General
Topic: MUM Europe 2014 - Italy, Venice, February 20-21
Replies: 145
Views: 73320

Re: MUM Europe 2014 - Italy, Venice, February 20-21

Is the S in RB260GSP for SFP?
by jaykay2342
Tue Feb 18, 2014 1:57 pm
Forum: General
Topic: Logging Local+Remote
Replies: 8
Views: 2815

Re: Logging Local+Remote

I can't speak for Winbox as i'm a Linux guy and just use SSH and Webfig via https. For those is have logs at both locale and remote. Which RouterOS version are you running? newest version i'm running at the moment 6.6. Is this maybe an issue of a recent version?
by jaykay2342
Tue Feb 18, 2014 1:42 pm
Forum: General
Topic: Logging Local+Remote
Replies: 8
Views: 2815

Re: Logging Local+Remote

> /system logging print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info memory 1 * error memory 2 * warning memory 3 * critical echo 4 error remote 5 warning remote 6 info remote 7 critical remote is working for me , local and remote logs.
by jaykay2342
Sun Feb 16, 2014 6:35 pm
Forum: General
Topic: Speed Test Client CPE
Replies: 14
Views: 4380

Re: Speed Test Client CPE

i would not use a routerboard as client as it sophisticates the result. most routerboards are not powerful enough for all the tcp stuff.
by jaykay2342
Sun Feb 16, 2014 9:03 am
Forum: General
Topic: Speed Test Client CPE
Replies: 14
Views: 4380

Re: Speed Test Client CPE

iperf is a cli tool. on most linux distributions you can install it with the packetmanager ( e.g. apt-get ). for info about usage just check http://iperf.fr/. there are also examples and a windows version.
by jaykay2342
Sat Feb 15, 2014 12:13 am
Forum: General
Topic: Speed Test Client CPE
Replies: 14
Views: 4380

Re: Speed Test Client CPE

you mean I will use 100% of cpu usage during bandwith test? yeah that is what i mean. especially when you use the bandwidthtool in tcp mode it took a lot extra cpu cycles to do all that tcp stack stuff. you know packet ordering and so. just forward a packet from one interface to another is much eas...
by jaykay2342
Fri Feb 14, 2014 10:10 pm
Forum: RouterBOARD hardware
Topic: 10 GbE Multiport (more than 2) Mikrotik RouterOS router?
Replies: 5
Views: 2779

Re: 10 GbE Multiport (more than 2) Mikrotik RouterOS router?

wait for the MUM at 20/21 Feb 2014. Mikrotik announces new products usually at the MUM events. maybe they will have such a system then.
by jaykay2342
Fri Feb 14, 2014 10:06 pm
Forum: General
Topic: Speed Test Client CPE
Replies: 14
Views: 4380

Re: Speed Test Client CPE

best way is to use some other tools like: iperf. A tool which transfers traffic between 2 computer. if you use the bandwidthtool on the routers directly it might be that you max you the router cpus ( depends of hardware ) and your test result is inaccurate.
by jaykay2342
Fri Feb 14, 2014 9:58 pm
Forum: General
Topic: eduroam: VLAN assignment based on RADIUS 802.1x reply
Replies: 40
Views: 22626

Re: eduroam: VLAN assignment based on RADIUS 802.1x reply

i think this is not possible with routeros at the moment. but i also would like to have such a feature
by jaykay2342
Fri Feb 14, 2014 9:22 am
Forum: Wireless Networking
Topic: Make Wirelessinterface always "Running"?!
Replies: 3
Views: 1876

Re: Make Wirelessinterface always "Running"?!

In http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless search for disable-running-check

How to apply it:

/interface wireless set [find name~"wlan1"] disable-running-check=yes;
thx , i've not found that flag my self when i check the wireless manual
by jaykay2342
Wed Feb 12, 2014 10:29 pm
Forum: Wireless Networking
Topic: Make Wirelessinterface always "Running"?!
Replies: 3
Views: 1876

Make Wirelessinterface always "Running"?!

Hi, is there a way to make Wirelessinterfaces / virtual APs always running, even when no client is connected? If the interface is not running OSPF stops advertising the network. If there is only one client joining and leaving a Virtual AP it ends with flapping routes in the whole network. it's not a...
by jaykay2342
Sat Feb 08, 2014 9:43 pm
Forum: General
Topic: Access private IP from Public internet
Replies: 2
Views: 1111

Re: Access private IP from Public internet

isn't a security issue to make the DVRs reachable from the internet? i would suggest to use a VPN connection to access the internal devices.
by jaykay2342
Sat Feb 08, 2014 9:40 pm
Forum: General
Topic: is there anyway to know password mistake?
Replies: 20
Views: 4974

Re: is there anyway to know password mistake?

Why do you have ssh on a router open for everyone? I usually manage all devices from my office, via vpn or from a jump box at the datacenter. Therefor only those IP(ranges) are allowed to access the routers via ssh.

If it's possible i would limit the access to as few as possible IPs.
by jaykay2342
Fri Jan 10, 2014 12:10 am
Forum: General
Topic: RB-750gl Need one port to be on wan network SOLVED
Replies: 8
Views: 2974

Re: RB-750gl Need one port to be on wan network SOLVED

i wasn't aware that this switchchip only can handle one master. i would work with vlans then. bridges also work but as the traffic pass the cpu the performance is not as good as just using vlans
by jaykay2342
Tue Dec 24, 2013 4:53 pm
Forum: General
Topic: pcq or simple queues?
Replies: 4
Views: 1960

Re: pcq or simple queues?

I understand that it's possible to add let's say a /29 network per substream, but I would like to add for example 192.168.0.2, 192.168.0.4 and .5 to one substream and 0.3, 0.6, 0.7 to another substream. Is this possible with pcq? If yes, how? that's not possible. if you want to do that you have to ...
by jaykay2342
Tue Dec 24, 2013 1:55 pm
Forum: General
Topic: pcq or simple queues?
Replies: 4
Views: 1960

Re: pcq or simple queues?

pcq is used different as other queues, it works with sub-streams. so you can configure one upload and one download queue which is used for multiple customers. instead of having one queue per customer you have one sub-stream per customer. you can limited the bandwidth per sub-stream. sub-streams are ...
by jaykay2342
Tue Dec 24, 2013 10:42 am
Forum: General
Topic: RB-750gl Need one port to be on wan network SOLVED
Replies: 8
Views: 2974

Re: RB-750gl Need one port to be on wan network

Default setup is:

ether1 - wan
ether2 - lan
ether3-5 -lan ( configured as slave ports of eth2)

easiest way for your case is just make one port a slave of ether1 instead of ether2. you have to change the master-port setting of that port
by jaykay2342
Tue Dec 24, 2013 10:31 am
Forum: Beginner Basics
Topic: Anybody can help? RB750GL
Replies: 2
Views: 2028

Re: Anybody can help? RB750GL

sounds like a misconfiguration. there are a lot of mistakes which can triggered such errors. please post a export of your configuration on the routeros device
by jaykay2342
Tue Dec 24, 2013 10:22 am
Forum: Wireless Networking
Topic: Question in the comparison of nv2 802.11
Replies: 2
Views: 1725

Re: Question in the comparison of nv2 802.11

on an idle nv2 link fluctuation is normal. if you run the bandwidth-test one the "small" MT routers the result is unreliable, at least it's my experience. nv2 sometimes needs a bit tuning but than the throughput is often much better than 802.11. i suggest to read http://wiki.mikrotik.com/w...
by jaykay2342
Mon Dec 23, 2013 11:23 am
Forum: Beginner Basics
Topic: Block all incoming traffic
Replies: 3
Views: 5240

Re: Block all incoming traffic

Try input in place of forward
The Input chain is only for traffic which belongs to the router ( towards IP-addresses configured on some router interface ) not for traffic which is forwarded by the router
by jaykay2342
Sun Dec 22, 2013 11:55 am
Forum: Beginner Basics
Topic: Block all incoming traffic
Replies: 3
Views: 5240

Re: Block all incoming traffic

please check whether connection tracking is on
by jaykay2342
Sun Dec 22, 2013 10:22 am
Forum: General
Topic: Routing Between Two WAN And Subnet
Replies: 1
Views: 1371

Re: Routing Between Two WAN And Subnet

your chains a wrong, INPUT and OUTPUT a used for traffic which terminates/originates at the router itself.

thinks as marking connetion / packets you do in mangle ( post/pre-routing ) i suggest to have a look to the packetflow diagram
by jaykay2342
Sat Dec 21, 2013 9:48 am
Forum: General
Topic: Wich SFP SC for RB2011?
Replies: 1
Views: 1482

Re: Wich SFP SC for RB2011?

This table maybe helps with choosing a SFP
http://wiki.mikrotik.com/wiki/Supported ... FP_modules
by jaykay2342
Thu Dec 19, 2013 6:37 pm
Forum: General
Topic: Policy Routing Question
Replies: 5
Views: 1761

Re: Policy Routing Question

dynamic routes get added to the main routing table. if you do policy based routing you have usually additional tables ( with static routes ). with your rules/policies you select the other tables for specific traffic. maybe you describe your setup a bit more in detail than it's easier to give an help...
by jaykay2342
Sun Dec 15, 2013 1:58 pm
Forum: General
Topic: GRE Tunnel Problem
Replies: 12
Views: 17008

Re: GRE Tunnel Problem

SSTP will work as is build a new tcp connection. but you loose a lot of performances. if you need to transport a high mbps rate i suggest to dig deeper to find the gre problem. MTU problems are often pain in the a**. sooner or later you will face such problems again. have to tried to find out the pa...
by jaykay2342
Fri Dec 13, 2013 4:14 pm
Forum: General
Topic: GRE Tunnel Problem
Replies: 12
Views: 17008

Re: GRE Tunnel Problem

sry that it haven't work but it was just my first idea whats going wrong. as a next step i would do a deeper troubleshooting like doing a packet capture on different places at the network and so.
by jaykay2342
Thu Dec 12, 2013 1:33 pm
Forum: General
Topic: GRE Tunnel Problem
Replies: 12
Views: 17008

Re: GRE Tunnel Problem

As the static IP of both rotuers are belong to the same subnet i assumed they have a direct connection
by jaykay2342
Wed Dec 11, 2013 7:02 pm
Forum: General
Topic: GRE Tunnel Problem
Replies: 12
Views: 17008

Re: GRE Tunnel Problem

Every Tunnel add additional headers to the Packet which reduce the actual payload size. So using IPIP or EoIP will not fix your problem. I just notice that your Router A and Router B have a direct link. if it is a ethernet link with is capable to handle bigger frames you could raise the MTU of the i...
by jaykay2342
Wed Dec 11, 2013 12:27 am
Forum: General
Topic: GRE Tunnel Problem
Replies: 12
Views: 17008

Re: GRE Tunnel Problem

i agree this sounds like a mtu problem. you loose some bytes due to the gre tunnel. you should get an ICMP(fragmentation needed) responses once the traffic tries to go through the tunnel. i experienced issues with icmp fragmentation needed if NAT is used "in front" of the tunnel. Like: Rou...
by jaykay2342
Sat Dec 07, 2013 10:26 pm
Forum: Forwarding Protocols
Topic: Redundant Link
Replies: 3
Views: 1850

Re: Redundant Link

not easy to recommend the right material to study without knowing your background. You can find a lot of videos regarding OSPF and Link-State-Routingprotocols in general. Also the at Cisco website you can find couple of good articles about OSPF. My recommendation: only use AREA 0, at least in the be...
by jaykay2342
Sat Dec 07, 2013 7:07 pm
Forum: Beginner Basics
Topic: Full speed intern, limited speed extern. How to do this?
Replies: 1
Views: 1226

Re: Full speed intern, limited speed extern. How to do this

PCQ queuing can do what you want. I have a similar case in my network. Internal network: 10.182.0.0/16 ( distributed over multiple locations ) without limits For external traffic we have: 5M Down / 384k UP ( per IP ) additionally Also a 10M/786k limit for all client behind 1 rounter/ap how we config...
by jaykay2342
Sat Dec 07, 2013 6:31 pm
Forum: General
Topic: 100% CPU on bonded link with link monitoring
Replies: 3
Views: 2578

Re: 100% CPU on bonded link with link monitoring

have you used the "profil" tool to investigate what is eating all the cpu cycles?
by jaykay2342
Sat Dec 07, 2013 6:29 pm
Forum: Forwarding Protocols
Topic: Redundant Link
Replies: 3
Views: 1850

Re: Redundant Link

Instead of change routes manually i would use OSPF. i have good experiences with OSPF in a routeros enviroment.
by jaykay2342
Tue Dec 03, 2013 7:23 pm
Forum: General
Topic: Weird connection tracking behavior
Replies: 1
Views: 996

Re: Weird connection tracking behavior

found reason my self. IPv6 fw-rules caused the tracking.

i just had some rules in the input chain to protect the router. it's sad that this cause the router to track :(
by jaykay2342
Mon Dec 02, 2013 11:20 pm
Forum: General
Topic: HOw do you Remotly Accessing Wireless access point
Replies: 3
Views: 2043

Re: HOw do you Remotly Accessing Wireless access point

When i use TP-Links as cheap APs i usually throw away that TP-link firmware and replace it with openwrt. in openwrt it's possible to add vlan interfaces to the ethernet and also add virtual aps. i usually add multiple vlans interfaces : 1. management - i assign an mgmt ip here 2. hotspot network - b...
by jaykay2342
Mon Dec 02, 2013 8:57 pm
Forum: General
Topic: Weird connection tracking behavior
Replies: 1
Views: 996

Weird connection tracking behavior

I'm facing strange issues with connection tracking on a RB2011. Running ROS 6.6 Connection Tracking is set to Auto. I have no FW-rules at all. But it's still tracking connections. :? /ip firewall connection tracking> print enabled: auto tcp-syn-sent-timeout: 5s tcp-syn-received-timeout: 5s tcp-estab...
by jaykay2342
Wed Nov 27, 2013 6:50 pm
Forum: General
Topic: VLAN bridge -Switch
Replies: 1
Views: 1122

Re: VLAN bridge -Switch

as soon as your traffic is going over a bridge it's processed by the cpu. if you just want a trunk port (ether1) with tagged traffic and port ether2-ether5 simple untagged traffic which belongs to VLAN20 you can let the switchchip do all the work. i configured something like this on my rb2011 lab de...
by jaykay2342
Mon Nov 25, 2013 1:53 pm
Forum: General
Topic: Can ROS become infected?
Replies: 10
Views: 3376

Re: Can ROS become infected?

i would put this like that: Using all means provided by RouterOS to protect itself it is impossible to execute 3rd party malicious code on it. can you tell us more about what Mikrotik does to minimize the possibility that it executes malicious code? i would also say that it's unlikely that this hap...
by jaykay2342
Mon Nov 25, 2013 12:14 pm
Forum: RouterBOARD hardware
Topic: rb750up with sfp and more ports
Replies: 6
Views: 2492

Re: rb750up with sfp and more ports

You can use rb2011UiAS. + poe injectors. Then you don´t need mediaconvertor. RB2011 with POE on all port = nice product ! Our solution now is - http://forum.mikrotik.com/viewtopic.php?f=3&t=49976&p=388250#p388250 i use RB2011 already. but at some places rb750 is sufficiant. getting rid of t...
by jaykay2342
Mon Nov 25, 2013 11:58 am
Forum: General
Topic: mikrotik hotspot with SSL
Replies: 8
Views: 2916

Re: mikrotik hotspot with SSL

Maybe if you explicitly send a "511 Network Authentication Required" HTTP status code? Some older browsers will still have the same problem, but at least new ones may follow the redirect. As the http-request is send after the SSL handshake is done i doubt that a browser will its request i...
by jaykay2342
Sun Nov 24, 2013 3:37 pm
Forum: General
Topic: mikrotik hotspot with SSL
Replies: 8
Views: 2916

Re: mikrotik hotspot with SSL

yes i know but how to fix it ? is it any way to use HTTPS in hotspot login without got that issue ?
Unfortunately there is no way to "fix" it. if you find a way to "fix" it you find also a way to "hack" https.
by jaykay2342
Sun Nov 24, 2013 10:53 am
Forum: General
Topic: configuring users database on my own
Replies: 3
Views: 1098

Re: configuring users database on my own

we use freeradius on to of a mysql database for wireless and hotspot users. works pretty well.
by jaykay2342
Sun Nov 24, 2013 10:38 am
Forum: General
Topic: mikrotik hotspot with SSL
Replies: 8
Views: 2916

Re: mikrotik hotspot with SSL

This happen due to the interception of the https connection to facebook. Technical it's a man-in-the-middle "attack" and the router is presenting it's own certificate and the browser is doing what it should do when this happen: show a warning.
by jaykay2342
Sun Nov 24, 2013 10:27 am
Forum: RouterBOARD hardware
Topic: rb750up with sfp and more ports
Replies: 6
Views: 2492

Re: rb750up with sfp and more ports

yeah and gigabit ports as well. At the moment we use RB750GL + power injectors + mediaconverter to connect the stuff on the roof (sxt,grooves...) and the build. it would be awesome to have one device doing all that stuff. a switch like RB260GS but with build in gigabit poe injection would also be ni...
  • 1
  • 2