MikroTik

noib

On some newer devices, the password is not empty : it is written on the sticker on the bottom.

noib

Ok i got it working, here is the procedure if someone has the same problem - Export the CA on Mikrotik1 with a passphrase. It will generate 2 files (CA and key) - Copy the files to Mikrotik2, import the CA, and then the key to have the "K" flag set up - generate a certificate for the ovpn ...

noib

Hello I have a working configuration of OVPN Server (Mikrotik) and Client (OpenVPN Gui@Windows). I have generated certificates on the server, exported and used it with the client, it's working fine. In case this info is useful, the public IP is held by a fiber modem which does NAT on OVPN port to th...

noib

Hello, I have two SXTqc-5ac paired, signal is good, link is stable. When I perform a wireless scan with "background" feature enabled on the AP side, have noticed that traffic stops, client gets dropped for a few seconds and reconnect again. Is it normal behaviour to drop client when doing ...

noib

@sindy, i do not use IPSEC, just plain L2TP, indeed this is irrelevant to this topic, sorry. I will create a new topic.

noib

I confirm this behaviour.
RouterOS 6.47 as L2TP server
Cambium access points as L2TP clients (no IPSEC here)
Works fine with 1 AP. But the second AP, connecting from the same LAN, never gets in.

Reverting server to "long-term" 6.45.9 and woot, both APs connect.

noib

Hello I have an inbound interface, let's call it IN, used by my clients (different MACs) I have an outbound interface (OUT1) which is bridged to IN. Everything is cool. Now I am adding a new interface, OUT2, and I want only 1 client to be bridged to OUT2, the others stay in OUT1 So, Traffic from 00:...

noib

I don't know, i don't have the -E version

My modem info is

[] > /interface lte info 0
         pin-status: no password required
      functionality: full
       manufacturer: ZTEWelink
              model: ME3630
           revision: ME3630E1CV1.0B06

noib

Ok i got your point. Thing is, yes i'm using TCP and L2TP, because this is real life traffic for this future link. I just can't say to my customer "oh! You're not having 400Mpbs? It's your fault, you don't use UDP !". This is precisely why i test before sending to the customers. This post ...

noib

Oh, so i'm a victim of the marketing ?
one more..

noib

Hello I am testing IPSEC hardware encryption between two HEX S (RB760iGS, ROS 6.43.7) Test environment is : PC1 <-> Router R1 <--IPSEC--> Router R2 <-> PC2. PC1 and PC2 run iperf3. Bandwidth test with simple IP routing between R1 and R2: 870Mbps Bandwidth test with L2TP/no encryption between R1 and ...

noib

I'm not sure writing to support will work; backup is not intended to be used between identical devices, it works only with the SAME device.
From RB2011 A to RB2011B -> won't work.
Don't use backup to duplicate configs over devices, use export/import instead.

noib

So for the records:

/system serial-terminal usb1
AT+ZGINIT // init
AT+ZGFIXRATE=10000,1  // "endless" fixes , 1 per second
AT+ZGNMEA=1 // Set NMEA GGA output
AT+ZGRUN=2 // Run the fixes

noib

Indeed, idn't see the NMEA commands at the end of the AT reference guide, thanks.
With GGA display it works.
Thanks for reply

noib

Hello Internet with ZTE LTE module ME3630 is working fine on a RB912 with 6.41cr38. Now i'm trying to make the GPS work. After plugging the passive GPS antenna and setiing the following Init commands AT+ZGINIT // init GPS AT+ZGPSR=1 // enable positioning AT+ZFIXRATE=5,5 // set 5-measures row at 5 se...

noib

Ah yes, indeed. It works now, thanks

noib

Hello
I have put the ZTE ME3630 LTE modem in an RB912 with latest release (6.41rc38), it shows up as LTE device, seems to connect fine to the network but i can't assign a dhcp client to it.. LTE interface does not show up in dhcp-client interface list...
maybe someone has an idea?
Thanks

noib

I had the case with a customer, same symptoms. After some searches it appeared that the customer had made a configuration template, and then duplicated the config using "backup" and "restore" ! Which is not good for different devices, I told him to use export/import with .rsc fil...

noib

Hello, I want to assign specific VLAN to hosts based on their MAC address. So i configured a compatible hardware (RB1200) , added a VLAN 500 on ether1, put an IP and DHCP server on that VLAN and added a switch rule to redirect MAC to this VLAN. When i activate DHDP client on the host, I don't get an...

noib

Posting the result if the "ip export" command for both routers might help.

noib

The 30Mbps are probably capped by RB912 CPU. Bandwith test is CPU-intensive and not adapted to this device.
You should test bandwidth from client to client, not from the RB912 itself. For example, two computers running iperf with traffic passing thru the 912.

noib

The connection fluctuates very much This is normal, the displayed rate in wireless/registration depends on the demand. Initiate a big file transfer between the two sides and monitor your WLAN interfaces. Rate should increase to its maximum. Is the throughput stable ? Have you done a wireless/spectr...

noib

In your case, routes must be parametred on the devices, not the router. on 192.168.0.250 device, add a route to 192.168.1.0/24 via 192.168.0.1. And on the 192.168.1.x device you want to reach, add a route to 192.168.0.0/24 via 192.168.0.1. You have no special configuration to add on the router, as i...

noib

With -96dBm RX sensitivity you can only achieve 6MBit basic rate MAX which is not adequate for the OP needs.

True, true... though the OP asked "if this is even possible"... possible, it is; tremendous, it is not

noib

According to mikrotik wireless link calculator,
http://www.mikrotik.com/test_link.php

it should be okay with two dynadishes (1000mW power, -96 RX sensivity, 25dBi gain)
https://routerboard.com/RBDynaDishG-5HacD

If your country allows such emission power (30dBm emission + 25dBi gain = 55 !)..

noib

Radius is not mandatory.
You can define multiple passphrases, one for each client MAC address. Use Wireless/Access List menu and add one entry for each client.

noib

You can put a 3G/4G mini-PCI Express modem in RB912, RB922, this will be a more reliable integration than USB key.

noib

Use a global variable (like "lastRate").
In your script, send the mail only if $rate is different than $lastRate
And of course don't forget to update $lastRate when the rate changes

noib

If it's a 6.37 bug, maybe you can re-install older version like 6.34.
If it works, buy the licence, and then upgrade do 6.37.

noib

You can't.

RB260 has SwitchOS, not RouterOS. SwitchOS can be accessed by Web interface only (and not Winbox).

noib

Is your laptop AC-capable ? Did you try to set up the access point radio to 5Ghz-only-n instead of -only-ac?

noib

Did you try simple dst-nat ? For example, assuming your clients come from 192.168.0.0/24

/ip firewall nat
add action=dst-nat chain=dstnat disabled=yes dst-port=53 protocol=udp src-address=192.168.0.0/24 to-addresses=10.55.22.11

will redirect DNS queries to 10.55.22.11

noib

I am having a problem with the /interface lte info command (routeros v6.37). When I type this command, the first screen is not complete (operator, rssi missing) and a second after, the screen is refreshed with all the infos. looks like there is some async command to the LTE card, and RouterOS decide...

noib

Have you done a spectral history to "see" your radio environment ? Cut off all wlans in RB433 Open a terminal window, maximize it and execute /interface wireless spectral-history wlan2 for a minute or two and post the screenshot here, along with the result of /interface wireless export co...

noib

Have you done a spectral history to "see" your radio environment ? Cut off all wlans in RB433 Open a terminal window, maximize it and execute /interface wireless spectral-history wlan2 for a minute or two and post the screenshot here, along with the result of /interface wireless export com...

noib

Does it still happen when you shut down wlan1 (5Ghz) radio in the RB433 ?

noib

I had similar problems (but worse, with loss) and i found out that i had to disable power saving option on the computer's wifi card driver.

noib

With 6.37 I am unable to set up a wlan interface without SSID; i get error "failure: ssid must be specified for AP mode". Indeed i have no SSID on the real wlan interface, i got 4 virtual APs. Is it normal behaviour? I think it is normal that in this case you use 1 physical and 3 virtual ...

noib

Hello Randall0L

Well i'm having some trouble with 6.37 currently due to the changes they made in wireless packages, so I didn't try yet. Thanks for the info anyway, i'll have a look when 6.37 will become more stable.

noib

With 6.37 I am unable to set up a wlan interface without SSID; i get error "failure: ssid must be specified for AP mode". Indeed i have no SSID on the real wlan interface, i got 4 virtual APs. Is it normal behaviour?

noib

Hello According to 6.36 changelog, Huawei E3531 3G USB dongle is now supported. So i get one and plug it into a RB951G-2hnd and.. nothing happens, no lte showing, nothing particular in logs. ROS 6.36.3, with lte subpackage installed (or not, same result). Is there any trick ? [foor@bar] > /system re...

noib

It should work, something is wrong with your config. Please export it and copypaste it here.

noib

Old topic, old question, but today it works as expected (WPA-EAP, VLAN ID in Radius attribute reply). Check
http://forum.mikrotik.com/viewtopic.php?f=7&t=109431

noib

I didn't test with Freeradius but it should work, i just finally made it after a day of tries :p.. But i'm not in your exact configuration - not using CAPSMAN, just a single AP with Radius client (RouterOS 6.35.4), and my VLANs are sent to the network, i don't have local VLANs interfaces and local D...

noib

2. The ports 6-10 are totally silent

I've had two of these in the last year (on a volume of a dozen approximately). Each time I contacted support and it ended up with a RMA. It's not a new problem, the first one i got with this problem was about 18 months ago.

noib

It's quite easy to do this nowadays (maybe it wasn't in routeros < 6) install Hotspot package add IP on the interface you want to serve files (i.e. 10.211.0.5/24) create a hotspot profile with an HTML directory (i.e. "FILES") create a hotspot with the previous profile on the desired interf...

noib

You have multiple WANs on 192.168.1.1. If you are using firewall marking (like PCC), have you checked to NOT mark packets going to 192.168.21.x ? If they are marked by load balancer, they will be routed via one of your WANs, and that is exactly what you are describing.

noib

I see that you are using VLAN_666 , no need to look further ! y ou are using the beast VLAN number and have probably summoned an angry deamon (a real one, not a background process) which started messing with your ARP table. or you did a IP scan or tried to ping those IPs and got no reply.

noib

What will you do with those two networks ? Switching, routing, hotspot, ... ? What speed do you need ? 10, 100, 1000Mbps ?

noib

Not sure about your schema, are your hotspot clients coming from 172.16.100.0/24 network? Is RB411 the hotspot?
What error do you get ?
Did you put 10.0.0.200 to the hotspot walled garden?
Please export your RB411 configuration and copy-paste the redirect page (login.html)

noib

The problem is the choice of CRS machines. They are powered by a weak processor (mipsbe), so if they are used with anything using CPU you will never reach wire speed. You will have better results with a PPC (RB850, RB1100) or the CCR series.

noib

Gotsprings: Doesn't 5G have lower range than 2.4G ? So if i have -85 in 2.4 i'll get like -90 in 5G

R1CH: they are bridged.. but the roaming time is not seamless, the customer lives it like permanent disconnects-reconnects

noib

Thanks, i tried this but it's worse, as the client devices disconnects by itself, tries to reconnect to another AP and gets refused. So the "roaming" time is much much bigger, like 1 minute before the client finally decides to come back to the "right" AP

noib

Hello I have a building with 7 floors, 1 AP per floor, even floors have AP at the left, odd floors have AP at the right. Don't ask me why, it was cabled like this when we came :) topology.png I have attached a PNG with the topology, as you can see there is a client, in a particular place, which &quo...

noib

Did you try with 40Mhz width instead of 80 ?
Did you try to change frequency ?
When doing your tests, did you check if SXT's CPU was not reaching 100%?
Did you run a /wireless spectral-scan wlan1 (not sure if SXT-ac radio supports this command).

noib

Is your WLAN interface set as "station-bridge" or "ap-bridge" ? If you don't do this, it won't work if attached to a bridge.

noib

Can you provide 2 or 3 websites addresses that are not working correctly with proxy ?

noib

I think you can't use "ethernet switch" device with WLAN. You will have to create a bridge and attach your interfaces (VLANs and WLAN).
Global performance might not be the same, as bridging is done by the CPU.

noib

The solution i found so far is to use a convention to name wlans. For example wlan_public_24 for a 2.4Ghz virtual AP, porn_only_5 for 5Ghz, etc.
It's quite dirty but at least with SNMP i can guess the parent of the virtual AP just by fetching the interface name..

noib

Hello I'm sending SNMP requests to grab data about "how are used my wireless interfaces". I can get wireless interfaces list: walk .iso.org.dod.internet.private.enterprises.mikrotik.mikrotikExperimentalModule.mtXRouterOs.mtxrWireless.mtxrWlApTable.mtxrWlApEntry But in this list, real inter...

noib

Oh damn i'm excited now, i'll have to take a look at it this week-end

noib

No OSPF. APs are connected by LAN. We are using a bigger infrastructure so technically packets are using VLANs but the APs and controller are not aware of that. If EoIP is the problem, i need to find something similar to transport layer 2 data over a layer 3 network, something less CPU-intensive (or...

noib

Does that router have fasttrack enabled?

Nope, fasttrack interferes with simple queues, which i need.

noib

@chechito: I'm using simple queues (dynamically generated by hotspot). 147 active queues at the moment. In profile window, queuing takes less than 1%. The only values above 1% (approx 4-5%) are management and networking. @pukkita Fastpath did not give better results; 1 CPU@74% with only 25Mbps bandw...

noib

Yes, Mikrotik on the other side. I'm not familiar with MLPS/VPLS, I'll have a look at it.

noib

I have activated fast path on all EoIP tunnels, will see if things get better.
Firmware is up to date (3.27) on routeros 6.34, and there is no IPsec encryption.

noib

Hello I have a hotspot on a CCR1016. The hotspot is active on a bridge, connected to access points via EoIP tunnels. Bandwith on site is approx 80Mbps/20Mbps. But i have never reached more than 35-40Mbps in real conditions. When there are many clients (150-200 active hotspot users), i notice that CP...

noib

Hello I'm running a scan on a crowded site (>200 people around, bars & food, several shops), with a dual-chain, 4dBi omni-antennas 2.4Ghz mikrotik AP. I get the following results (see attachment). From the spectral scan, we are receiving levels between -49 and -60. Does that mean that 1) there a...

noib

What about: pinging every 5 seconds (for example) the VOIP target server. If ping is above a fixed number (say, 300ms): reduce traffic limit on Bob's interface by 200Kbps (for example) if ping is below a fixed number (say, 100ms): increase traffic limit on Bob's interface by 200Kbps So this would be...

noib

apart from setting the 100k to guarantee the VOIP service and leave the rest of traffic "as is". Mhh in that case, what will happen to VOIP latency when the link will be saturated with Bob watching por.. I mean youtube? In my opinion, if I don't actually limit Bob's traffic, priorities wo...

noib

Yep thanks, i have been thinking about that, but there are two problems with this 1) regular checking the full speed = data consumed = more $$ spent 2) even an hourly check would not be enough, if the link goes 10Mbps-5Mbps-1Mbps-8Mbps within the hour, i would need to do even more regular checks -> ...

noib

Hello I wish to do the following QOS: one WAN, two LANs. LAN1 gets 100Kbps guaranteed with low latency (highest proirity), LAN2 gets the rest with lowest priority. This is rather simple to do if you know your total bandwidth. But here I got a 3G WLAN, with highly varying performance, from.. 500Kbps ...

noib

I also use this package and it's working well, here is an abstract of my code <?php> require_once 'PEAR2_Net_Transmitter-1.0.0a5.phar'; require_once 'PEAR2_Net_RouterOS-1.0.0b5.phar'; $client = new PEAR2\Net\RouterOS\Client($IP, $login, $pass); $requete = new PEAR2\Net\RouterOS\Request("/ip/hot...

noib

Go to system/logging and add a log rule with topics "wireless" and "debug".

noib

Then, try this

/ip firewall nat
add action=dst-nat chain=dstnat dst-address=[Router1 WAN IP] dst-port=50080 protocol=tcp to-addresses=172.16.10.x to-ports=80

assuming you want to access port 80 on Router B. If course, replace with real IPs

noib

Give real figures, what internal IP is your router B, what port(s) you want to translate, and export the firewall rule you created.

noib

http://wiki.mikrotik.com/wiki/Forwardin ... nternal_IP

noib

There can be many reasons; first check the log of the AP and client to get more clues. Activate wireless debug logs eventually. It can be a misconfigured security profile It can be a misconfigured country, so client doesn't want to use the AP frequency It can be a connect-list rule It can be an acce...

noib

Check Romon, I believe it's the thing you need
http://wiki.mikrotik.com/wiki/Manual:RoMON

or you can do some NAT in your "front" router, redirecting some random port to the "back" router.

noib

Have you tested with other clients ? other computer, telephone, tablet, anything, same ping problem?

noib

I had a similar problem of instable ping and losses, and it was coming from the client.

Have you checked that there is no "energy save" parameter on the client wireless driver/parameter ?

noib

so where did you put the <form name="contactform" method="post" action="http://xxxx.xxxxxxx.com/send.php"> part ? It should be somewhere in the rlogin.html / <body> And anyway, if you just want to give access to 1 website, replace rlogin.html by this <html> <head> <titl...

noib

then post your hotspot config
/ip hotspot export

and the content of the file rlogin.html

noib

I also found a secret parameter !

roswell-alien-backdoor=enabled

Not sure how it exactly works, but i'm on it.

noib

Setup hotspot
remove all stuff you put in walled garden
add http://xxxx.xxxxxxx.com/ in your walled garden

So, all (http) sites will be redirected to local rlogin.html page, which leads to http://xxxx.xxxxxxx.com/send.php, which is allowed. Problem should be solved.

noib

Zyxel / TP-link is the way to go, they have small AP's with ADSL modem embedded and can be set in bridge mode.
That's a bunch of AP that Mikrotik will never sell, that' s life

noib

Hello We are in increasing need of a single device with AP+ADSL modem , and so far we used boxes with Mikrotik AP + cheap ADSL modem all packaged in an ugly CAOTS box. We need someting better. I had an official meeting with a Mikrotik guy at Venice Mum and i told him but the answer was someting like...

noib

Are you absolutely sure that your OID is correct ?
Have you tested to read it with a simple command like snmpget to check if the returned value is correct?

noib

Have you checked CPU use of the RB951G while doing your tests ?
I think this device can handle Gbps in switching mode, but as soon as you add firewall rules or bridge, it's another story.

noib

Mikrotik routers are LACP-compatible, so you can set up a bonding interface containing multiple ethernet/gigabit links between two devices for aggregation and failover. It's quite easy to configure add bonding interface attach ethernet interfaces to bonding interface set IP on bonding interface &...

noib

I think it's related to all "ac" chipsets. I have miniPCI cards R11e-5HacD with same situation, there is nothing in the "Current Tx Power" tab.

noib

Did you try to check the "use service tag" checkbox ?

noib

Have you checked the DHCP lease ? I think if your lease ends, hotspot disconnects you.
Add hotspot topic in /system/logging and check in logs the reason why you are disconnected.

noib

You'll want to set up both as AP-Bridge with the same SSID and same encryption, etc. Same channel or different channel? I would assume different channels? Different channels, same SSID & security settings, and roaming will be automatic. But roaming is usually decided by the client device so you...

noib

If you just want to link 2 places, use a pair of point-to-point devices and avoid omnidirectional antennas.
My guess is a pair of SXT Lite5 ($59 each), you can even install those devices under the roofs or behind walls (you'll have to test it before, of course)

noib

It does exist :) We have done this and it works. We call this "cheap SDSL". 2 to 4 ADSL one side, and .. 2 to 4 RouterOS virtual machines hosted in the internet, so we have Mikrotik gear at both ends of the "link" and we can set ip eoip & bonding. Total bandwidth is really ag...

noib

The point is just to quickly check Radius connectivity to help you diagnose a problem. As someone points out earlier in thread: -user calling "hey i can't login" -technician; ok, let me see. <performs radius test>. ah, i see the problem, working on it. diagnose in 20 seconds, simple an pla...

noib

+1, useful feature

noib

What would happen if an ethernet interface reaches the limit ? You want to stop connection or lower the bandwidth or ... ?
Are all clients on the same subnet, or in 4 differents subnets?

noib

yes and no.. Contact Mikrotik support, do some tests with them and get a RMA ticket to send the router back to Latvia.

noib

Yes, voltage is the problem. Phone expects 48v. Your Mikrotik device delivers the same voltage than it receives via the AC adapter (probably 24v). If you put a 48V power supply on the Mikrotik, you will burn it (max 30v). So you might try to get a 24v-48v DC converter, or use a POE injector with 48V...

noib

probably because Router OS is very rich and flexible, and some other functionality than IP firewall is using it.

noib

Well you can do the test and tell us if there is any difference (i don't think there is any difference).
If you are concerned about performances, try to use a network setup avoiding bridge if possible (wlan1 as private IP + DHCP server + NAT/masquerade, for example).

noib

You applied your drop rule on ether4 which is part of the bridge, so i think your rule is finally applied to the whole bridge, blocking all traffic to your NAS. All rules should be applied on the bridge itself, not the ports.
I'm afraid the only clean solution is to separate networks.

noib

You can also use API to connect to your 50 hotspots and push configurations.. this is how i update my walled garden. PHP + API + loop = win !

noib

Open a tunnel from your NAT'ed device, and use the tunnel IP to connect back with API

noib

Yes, traffic generator tool is the answer, this is what i use to test max bandwith between 2 distant ROS. It's a bit more complicated to set up but you won't be limited by CPU.

noib

How complicated.. You had a problem and posted in a user forum. People (some from Mikrotik support, check their details in the left column) saw that problem and showed you where the problem was. Problem solved. RouterOS is very rich, you can do tons of stuff with it, but the counterpart is that it i...

noib

People from mikrotik support have already helped you, pointing out the problem; you have to work a little also, you know... So one more time : You have mistaken "src-address" and "src-address-list" fields. No big deal, edit your redirect rule, put "192.168.13.0/24" in &...

noib

RB750 (or any similar mipsbe based CPU, RB2011, CRS125, etc) can handle 30Mbps L2TP/PPTP/OpenVPN, but not much more. If you want more than 50Mbps, you will have to get some RB1100 (power PC) or CCR-family (tile CPU) device.

noib

Sure, use Firewall/mangle to mark your traffic and queues to apply limitations on market packets.

http://wiki.mikrotik.com/wiki/Bandwidth ... and_Queues

noib

I have regular problems with MAC-winbox. Between my conputer and the MT device, there is a switch (Dell) which might interfere for some reason. So if you want to use MAC-winbox, be sure to have a direct cable connection or use IP as stated in previous post. Also, try with winbox 2, much more stable ...

noib

Hello Yes, if you replace with a CCR you will get probably wire-speed. But it's not the same budget. From the routerboard website, you can see the throughput you can expect. http://routerboard.com/RB2011UiAS-2HnD-IN (bottom of the page) As you can see it depends heavily on the packet size, and in th...

noib

Hello I have the case on two different pieces of RB2011-UiAS-RM: I am unable to use any of the switch2 ports (eth6->eth10). When i plug a cable, no led, nothing, and of course no "R" on winbox. It just acts like all switch2 ports were not connected at all. Of course, the same ethernet cabl...

noib

Hello I want to pass several VLANS from ether1 to ether5, for example. As usual with mikrotik, there are several ways to do that, so i was wondering which one of the following was your preferred, and why? Way 1: bridge physical interfaces and put VLANs on bridge /interface bridge add name=bridge_glo...

noib

Well divisionmd you are asking for some kind of premium support, that is not free; you can try to contact a local Mikrotik reseller, which usually has competent people, they will be happy to help you.

noib

I got the same problem, it was with a R11e-5AC card; I contacted support and they said it was corrected in 6.30 (or .31). Anyway, upgrade your ROS to latest version, or schedule a daily reboot....

noib

Here is a drawing; as said before i had to create 1 Routeros VM per ADSL line in datacenter.

ADSL Bonding.png

noib

Yes.
The trick is to tell the client part to use "ADSL A" for "L2TP/Eoip A" and "ADSL B" for "L2TP/Eoip B", because the destination IP will be the same.. I had to use multiple IPs at destination to clearly separate traffic, if you can do better i'm interested

noib

We have done this and it works. We call this "cheap SDSL". 2 to 4 ADSL one side, and .. 2 to 4 RouterOS virtual machines hosted in the internet, so we have Mikrotik gear at both ends of the "link" and we can set ip eoip & bonding. Total bandwidth is really aggregated even wit...

noib

You can set up a radius server to manage your accounts, and add a radius client (type = login) on each of your Mikrotik devices.

noib

I have also problems with RB912 + R11E-ac, i found out that lowering the TX power of the 5-ac card (all-rates-fixed, 10 dB for example) solves my problems (to be confirmed in the next weeks)

noib

Humm i have also problems (but not the same ones) with RB912+R11E-5..
http://forum.mikrotik.com/viewtopic.php?f=7&t=97114
Also posted a ticket and waiting for reply.

I'll try do downgrade to 6.18 to see if it solves my problem

noib

All tests failed so far; just created a ticket with Mikrotik support.

noib

R11e-ac to factory default -> fail, still ghost connections in AP.
Firmware was 3.22 already.
Now updated to ROS 6.29

noib

Thanks for the ideas; just resetted the R11e-ac to factory default and reapplied settings.. now waiting 24 hours to see if there is improvement.

noib

Disabling AC and setting mode to 5Ghz-only-N does not improve.
Disabling "frequency: auto" an setting static frequency does not improve.
Now trying different ROS versions..

noib

Hello We have installed full-mikrotik dual band APs: RB912UAG-2HPnD + R11E-5ac, and there is a strange behaviour: some 5Ghz clients stay forever in wireless/registration table (see picture attached). Of course the real devices are long gone, but they are stuck in the list with a virtual "last a...

noib

Sure Cybertod, but 1) the RB2011 is already powered by its own power supply, i don't need that Poe anyway 2) the whole purpose is to avoid sending someone for a 6 hours drive, just to handle a cable :p The 4-wire cable may be a good option for the future.. or just always use RB2011/eth2 instead of e...

noib

Hello I have a RB2011 connected to an ubnt 24vPoE switch. They are connected together via the port 1 of each switch, and this is where i have a problem. I want to reset the ubnt switch. It will get factory default, which are PoE+ on all ports. So after reset, the RB2011 will get some 48v in ether1, ...

noib

You can use an external Radius to handle winbox users, and probably connecting IPs, if that is what you call a "device".

noib

We had the same problems, L2TP and Orange are not friends. with L2TP tunnels working .. sometimes.
We ended up with PPTP tunnels instead, much more stable.

noib

add hotspot topic in log filter and check the "!" checkbox.

console command is like

/system logging
add topics=debug,!hotspot

noib

Dirty way to have system-wide, persistent variable even after reboot: use something like a comment on an interface.

/interface ethernet set ether1 comment=$myData

:local myData [/interface ethernet get ether1 comment ];

noib

"Couldn't start - Modem does not have serial interface! (6)" :( It looks like this new dongle isn't properly recognized by RouterOS. Do you have the latest ROS version with latest firmware ? You might have to send some supout file to support and wait for them to add this dongle in a next ...

noib

Did you add routes on each router to reach the other network?

noib

The dongle is recognized as LTE

Well that's a good start... is that LTE interface in (R)unning mode? If not, have you set the APN or PIN if required and what does show the LTE/info window ?

If LTE is (R)unning, have you added a dhcp client on it ?

noib

Your HQ router must know how to reach the 192.168.4.0/24 network and vice versa.
As your two WAN IPs are not in the same network, I think you have to create some L2TP tunnel between HQ and home, and route your IPSEC traffic through that tunnel.

noib

When i asked that question to a product manager in MUM Venice '14, answer was .. "western Europe is too far from the center of Europe, people would have to drive a too long way". No joke!

noib

But the SIM card alone can't do anything, it's just an ID. You need a 3G modem plugged, which will use the SIM card data to authenticate on GSM network.

noib

If you don't "see" the LTE interface, it probably means that the 3G modem is not powered. On the RB912, you have to choose between powering the USB external port or mini-PCIe slot.
Go to system->routerboard->USB and switch to MiniPCIe
or

/system routerboard usb set type=mini-PCIe

noib

did you change something in the hotspot html files? renaming, moving, deleting?

noib

from the manual, "MikroTik Neighbor Discovery protocol (MNDP) allows to "find" other devices compatible with MNDP or CDP (Cisco Discovery Protocol) in Layer2 broadcast domain." You should use wireshark to understand how packets are formed, see https://www.wireshark.org/docs/dfref...

noib

Hello My hotspot is configured with mac-cookie for 30 days. So if a known/registered user comes back within 30 days, he is automatically logged in by RouterOS and surfs transparently, he does not even see the portal page. I would like to add a page like "Welcome back! your time left is blah bla...

noib

if you don't want to use hotspot, then.. maybe via DHCP
Link the mikrotik DHCP server with a Radius with a 2 hour lease, and configure the radius to respond "no" when the DHCP client tries to renew his lease.

noib

Usually this is made by adding the two gateways in the default route. I.E if your DSL gateway is 192.168.0.254 and your WLAN/Cellular gateway is 10.1.0.254, you will just add /ip route add dst=0.0.0.0/0 gateway=192.168.0.254,10.1.0.254 ROS should automatically switch to second gateway if the first o...

noib

Or, even simpler, the hotspot "trial" mode might do the trick.

noib

Set up hotspot and auth/accounting to a radius server (linux+freeradius) which can handle that kind of limitation (and many many more).
Maybe embedded Mikrotik usermanager can handle this, i don't know it very well.

noib

can you ping the hosts (with IP) from the client computer?

noib

Then it means that your computer does not ask for Mikrotik as first DNS. Have you checked that you don't block by mistake the MT DNS port (53/udp)? Have you checked that MT DNS is first on the DNS list of client computer, or that MT is the only DNS on the computer? Have you done a traceroute from th...

noib

Static local & external DNS works fine for me, here is my config # jan/28/2015 13:28:50 by RouterOS 6.15 # software id = Q19U-9W6Z # /ip dns set allow-remote-requests=yes /ip dns static add address=10.1.10.1 name=local.nas add address=159.148.147.196 name=www.babayaga.dumb [ben@ECH_CT04] > ping ...

noib

I think you need to put a DHCP client on LTE interface.

noib

TheWiFiGuy is right, it's possible using wireless sniffer. The only "problem" with that solution is that when wireless sniffer is active, radio can't do anything else, so you need 2 radios if you want to sniff and provide WIFI. But seen the price of Mikrotik gear, you will be anyway far fa...

noib

It is actually possible with the current ROS, We got our own solution based on Mikrotik APs.
However it requires extra development and servers to aggregate data and compute the position of devices, it's not a one-day task..

noib

Create a L2TP tunnel between the two (public IP = server side) and use the L2TP IPs to set up the IPSEC tunnel

noib

eqx98, what (router)board are you using with the ME609? Can you see the ME609 in the "/port print" command?

noib

Ok problem solved. I moved the NAS network cable from ether10 to ether4 and now i'm almost reaching wire speed.

Not exactly sure why, it might have a link with the switch chip eth1-2-3-4-5, but in that case i'm not using the switch feature..

noib

Yes they are both at gigabit; scroll down the picture from the original post, i have put the ether1 and ether10 interface panels. No collisions nor drops are shown in RX/TX Stats page.

noib

Hello I have a NAS in my office, and for some reason I had to move its subnet. The routing between the LAN subnet (192.168.0.0/24) and the NAS subnet (10.1.10.0/30) is done by a RB1100ahx2, which is also used as gateway for the office. My computer has SSD disk and Gigabit LAN. NAS has gigabit LAN an...

noib

Hello I have set up several access points in 2Ghz-B/G/N mode associated with Hotspots. At test time, all is ok (with 1 to 3 WLAN clients). But when the environment gets crowded (concert hall, waiting hall, etc), problems appear. Clients can't associate, Apple devices don't always "see" the...

noib

Sure it can. But it can't pass the hotspot login, except if you define its MAC or IP address as "passthrough" in the hotspot parameters

noib

I had also some problems with quickset on SXT devices acting as bridge; I just opened Quickset and it revered to default wifi configuration (i did NOT click apply). Happened twice in something like 1 month. Now i never click Quickset on production environments :p

noib

-is the RB750GL capable to handle VPN on fast connection of 50 MBit/s ? I think it depends on the encryption level you use. last time i benchmarked a 750 (UP, not GL), i was capped around 35Mbs with 100%CPU, using a IPSec link with aes-128 encryption. 750's are entry products with veeeery small pri...

noib

Dia; open source

http://sourceforge.net/projects/dia-installer/

noib

You can use SNMP requests to get the data you want from the router.
http://wiki.mikrotik.com/wiki/Manual:SNMP

There are several well known SNMP clients like Nagios to collect and display data. If you don't find what you need, you can build your own solution to collect and display data.

noib

You can use comments to store data permanently.

/interface ethernet set ether1 comment=$myData

and retrieve them later (even after reboot etc)

:local myData [/interface ethernet get ether1 comment ];

It's a bit dirty but it works :p

noib

If you really want the same subnet, create a L2TP or PPTP connection, put a EOIP tunnel on it and bridge all (LAN bridged with EOIP on both sides). But i'm not sure it's a clean solution, your link will be polluted with broadcast traffic.

noib

Your clients in house1 must have a route to 192.168.2.0/24 via the local mikrotik (10.0.0.1 ? 10.0.0.254?) Your clients in house2 must have a route to 10.0.0.0/24 via the local mikrotik (192.168.2.1 ? 192.168.2.254?) Your mikrotik@house1 must have a route to 192.168.2.0/24 via 10.8.0.2 Your Asus@hou...

noib

With winbox Wireless->interfaces, double-click on wlan1 and go to Wireless tab. Click on "Advanced mode" Then go to "TX power" tab and set tx power mode to "all rates fixed"; change the value and test. Or with a console command /interface wireless set wlan1 tx-power-mod...

noib

Have you tried using the scheduler to start your second bonding interface some seconds after the first ? i.e. /system scheduler add disabled=no name=schedule1 on-event="/interface disable bonding1\r\ \n/interface disable bonding2\r\ \n/interface enable bonding1\r\ \nping count=5 127.0.0.1\r\ \n...

noib

MU609 will always show as LTE interface.
Once registered, just add a dhcp client on the lte interface and you should be good.

noib

did you set up a masquerade rule for the LAN1 network?

/ip firewall nat add action=masquerade chain=srcnat src-address=10.10.49.0/24

noib

Well each environment is unique; so.. test different power values and make your mind. You can decrease power output by 3dB, test, decrease again, etc. Another solution is to choose who can connect to your AP: If you don't want some specific MAC addresses (the in-house devices) to connect to your out...

noib

Have you checked that the mikrotik has working internet access via wlan1?
Have you checked if your ethernet-connected devices get IP adresses from the mikrotik?
Can your ethernet clients ping 159.148.147.196 (http://www.mikrotik.com) ?

noib

1) Wireless client part: -put the security profile (if any), station mode, right SSID, band, country, and apply. Your wlan interface should be in "R"(unning) state. -add a DHCP client on the wlan interface. You should get an IP address (if wireless provides DHCP) and be able to ping some h...

noib

Thanks for your answers. I found out what was wrong: the CPU ! :p I was doing a real ftp test with "tool fetch url='....'" and i was capped at 14Mbps due to CPU at 100% (probably for writing to flash card). Then i tried a bTest and was capped around 40Mbps (tcp), again with 100% CPU. Then ...

noib

Hello I can't get more than 13-14Mbps with my LTE/4G configuration, using RB912UAG + Huawei ME909u-521 (miniPCI-E) and good signal (-57dB). I think I read somewhere in this forum that max speed was 14.4Mbps (not sure why.. USB interface?) Question: what causes this limitation, how can I bypass this ...

noib

Because when you get hit by a scan, the target is "your" IP. There is no forwarding/routing involved, the packets are directly for your machine, therefore the input chain.

noib

Answer is: Wireless sniffer option in RouterOs.

noib

Yes, for blocking only the proxy it's enough. But usually, scanners try different ports; they try not only 8080 but all "standard" ports (80,443,125,5060,53, etc). So you have a chance that the same people/bot try to scan all your ports. This is where blocking all traffic from the "ba...

noib

Use firewall/mangle to mark your packets related to the sip traffic (either source IP, either traffic type UDP 5060, either destination server.. depends on your environment) Then assign a different route for your SIP traffic Example can be found there : http://wiki.mikrotik.com/wiki/Per-Traffic_Load...

noib

Hello For a tender, someone asked me if Mikrotik was doing wireless probing... i.e. detecting client MAC addresses when they probe, even before they connect to the WLAN. This means you can detect your client even if it does not actually connect to your network (provided he has WIFI on, of course). I...

noib

Get a random IP internet address ( like http://www.mikrotik.com 159.148.147.196 :p), or one of yours if you own one. Add a route to force route to 159.148.147.196 via the 4G interface Use netwatch tool to monitor connectivity to 159.148.147.196 ( = connectivity of 4G interface) UP event script = dis...

noib

RB951G-2HnD is a router just like RB750GL; it's labelled "access point" because of the extra wifi module.

noib

I don't see ZTE636 in
http://wiki.mikrotik.com/wiki/Supported_Hardware

maybe that's the cause

noib

In you dst-nat rule you can add

src-address=192.168.5.0/24

to limit port forwarding to your "VPN addresses". "192.168.5.0/24" has to be tuned to your needs.

noib

not that much different (Ros is linux-based); commands are very similar /ip firewall nat add action=dst-nat chain=dstnat dst-address=[EXTERNAL_IP] dst-port=6112 protocol=tcp to-addresses=[CLIENT_IP] to-ports=6112 add action=src-nat chain=srcnat dst-address=[CLIENT_IP] dst-port=6112 protocol=tcp to-a...

noib

It's been a long time since i did those warcraft 3 things.... :) you just need 2 firewall/NAT rules to redirect tcp "battle.net" traffic to your IP Linux iptables commands were /sbin/iptables -t nat -A PREROUTING -i [EXTERNAL_IP] -p tcp --dport 6112 -j DNAT --to-destination [CLIENT_IP]]:61...

noib

You just need a queue tree with "sip traffic" and "non-sip traffic" queues, disregarding the numbers of CPE

noib

If you know the total bandwith you have (and if it's reliable), you can limit all non-SIP traffic to be sure that the bandwith will not be used "after" your router i.e if you have 5Mbps, limit all non-sip to 4.5Mbps so you will be sure that SIP traffic always have 500k Other solution; chec...

noib

On the interface, you can only set a limit to TX: routerboard can only control the amount of data it sends from the interface. It might be sufficient with your needs, as your TX is your tenants' RX (download). If you need to throttle also your tenant' upload, you will have to use queues; check this ...

noib

Trial licence expired?

noib

I think you miss some routes : On site 1: /route add dst=192.168.15.0/24 gateway=172.16.1.2 On site 2: /route add dst=192.168.100.0/24 gateway=172.16.1.1 Your "clients" behind the routers must also have those routes (if their default gateway isn't the local mikrotik device). I don't see t...

noib

try this

/ip firewall filter
add chain=input protocol=tcp dst-port=8080 in-interface=pppoe-out1 action=drop

if your proxy listens on port 8080

noib

If your device has an IP directly accessible from Internet, you might have been scanned by a bot on port 8080/3128/whatever, and if there is no firewall rule blocking this traffic, your router is probably used for bouncing spam or stuff like that..

noib

Can you post the result of
/ip export

from both your routers?

noib

I think you miss some routes :
On site 1: /route add dst=192.168.15.0/24 gateway=172.16.1.2
On site 2: /route add dst=192.168.100.0/24 gateway=172.16.1.1
Your "clients" behind the routers must also have those routes (if their default gateway isn't the local mikrotik device).

noib

If you use bonding, disable the switch feature. All 8 ethernet links must be independant and with no IP assigned. On each side, add 1 bonding interface in balance-rr mode and add all 8 ethernet ports as slaves. Then add 1 IP adress to the bonding interface. You can use the 3 other available ports fo...

noib

Yes; on your Mikrotik device put something like /interface l2tp-server server set default-profile=default enabled=yes /ppp secret add local-address=10.200.4.2 name=l2tp_radius password=123456etc remote-address=10.200.4.1 service=l2tp Then on the radius side, use a pptp/l2tp client to connect to your...

noib

You can create a L2TP ot PPTP connection between your Radius (ptp Client) and your Mikrotik device(Ptp Server). If the radius server IP changes, the PtP connection reconnects and you will still have the same Ptp IP.

Search found 291 matches