Community discussions

Search found 160 matches

by yottabit
Mon Mar 18, 2019 1:51 am
Forum: Announcements
Topic: v6.44.1 [stable] is released!
Replies: 86
Views: 16949

Re: v6.44.1 [stable] is released!

Also, in the release notes, security now depends on dhcp. Maybe having DHCP package disabled is causing the problem. You should remove all of those extra packages that you have disabled.

Sent from my Pixel 3 using Tapatalk

by yottabit
Sun Mar 17, 2019 11:56 pm
Forum: General
Topic: [NETINSTALL] Error - board supports from 0.0
Replies: 1
Views: 376

Re: [NETINSTALL] Error - board supports from 0.0

I'm having the same problem with hap ac (RB962). It bricked itself during the upgrade to 6.44.1, and now I cannot use netinstall to recover. I get the same error, "board supports versions from 0.0". Edit: disregard. Turns out that after you select the device in the upper-left pane, the package selec...
by yottabit
Thu Mar 07, 2019 4:58 am
Forum: Forwarding Protocols
Topic: OSPF Causes IPIP Tunnel Flapping? [SOLVED]
Replies: 3
Views: 324

Re: OSPF Causes IPIP Tunnel Flapping?

are you advertising the tunnel endpoint IPs via OSPF?!
check something like "redistribute connected routes" etc.

Yes, that was it! I had redistribute-connected=yes. The manual isn't clear on why this would break in my situation. Can you explain why it caused the ipip tunnel to flap?
by yottabit
Wed Mar 06, 2019 11:22 pm
Forum: Forwarding Protocols
Topic: OSPF Causes IPIP Tunnel Flapping? [SOLVED]
Replies: 3
Views: 324

OSPF Causes IPIP Tunnel Flapping? [SOLVED]

Hi Everyone, I'm running 6.44, and now attempting to turn on OSPF for route distribution between two routers. Pretty simple setup: rb01: ether1: DHCP WAN bridge1: 172.16.42.0/24, 172.16.43.0/30, 172.27.0.0/24 The 172.16.43.0 is being used for an IP-IP tunnel to rb02 via WAN Static routes are in plac...
by yottabit
Fri Feb 15, 2019 6:26 pm
Forum: Announcements
Topic: v6.44rc [testing] is released!
Replies: 67
Views: 11482

Re: v6.44rc [testing] is released!

While this is true for listening services, you should not have any of those exposed to the WAN side of your router, or you'll be a victim of the next Mikrotik vulnerability. Hey great point. I do expose SSH with public-key-only authentication for remote management in case tunnels go down. So this s...
by yottabit
Fri Feb 15, 2019 6:08 pm
Forum: Announcements
Topic: v6.44rc [testing] is released!
Replies: 67
Views: 11482

Re: v6.44rc [testing] is released!

You make a good point about reboots creating zombie TCP connections on the nodes, but you are wrong about the DoS mitigation. Setting nf_conntrack_tcp_loose to 0 (not the default) stops false SYN-ACK and ACK packets before they hit the “listen” state lock, thereby allowing conntrack to scale much hi...
by yottabit
Fri Feb 15, 2019 5:56 pm
Forum: RouterBOARD hardware
Topic: Passive PoE: MikroTik and Ubiquiti
Replies: 6
Views: 826

Re: Passive PoE: MikroTik and Ubiquiti

MT has two different Passive modes; an older one for up to 100 Mbps links used spare pairs, iirc. For the newer version supporting 1 Gbps, all pairs are used for transmission, so the power is coupled, though I don't know how or on which pairs exactly. Be sure you're not relying on the old spec. Even...
by yottabit
Fri Feb 15, 2019 5:52 pm
Forum: Announcements
Topic: v6.44rc [testing] is released!
Replies: 67
Views: 11482

Re: v6.44rc [testing] is released!

What is the default setting for nf_conntrack_loose? It should be 0 (disabled) for better scaling against TCP DoS attacks. Had it been 0 or 1 before being exposed? Or is it new to the MT kernel branch?

Sent from my Pixel 3 using Tapatalk

by yottabit
Thu Dec 27, 2018 7:32 am
Forum: Wireless Networking
Topic: Google Chromecast
Replies: 4
Views: 762

Re: Google Chromecast

Yep, Chromecast requires station-to-station and/or station-to-node forwarding in order to receive and transmit control messages. You do not need UPnP enabled.

Sent from my Pixel 3 using Tapatalk

by yottabit
Sun Dec 23, 2018 2:16 am
Forum: RouterOS v6 RC and v7 BETA
Topic: v6.43.8 [stable] is released!
Replies: 169
Views: 31319

Re: v6.43.8 [stable] is released!

Symbol: ` in WLAN SSID brake all wlan interfaces. Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console. Is this new? 802.11 spec specifies SSID can be up to 32 bytes. It does NOT require alpha-n...
by yottabit
Sat Dec 22, 2018 8:03 pm
Forum: Announcements
Topic: v6.43.8 [stable] is released!
Replies: 169
Views: 31319

Re: v6.43.8 [stable] is released!

yottabit - To which IP address does your router resolve upgrade.mikrotik.com (:put [:resolve upgrade.mikrotik.com])? Upgrade should work on this router without any problems. There might be some proxy server between your router and upgrade server causing this. [yottabit@rb1] > /ip dns print servers:...
by yottabit
Sat Dec 22, 2018 6:24 pm
Forum: Announcements
Topic: v6.43.8 [stable] is released!
Replies: 169
Views: 31319

Re: v6.43.8 [stable] is released!

All of my MIPS devices (5x hAP ac, 2x RB951) upgraded automatically last night by script. My one ARM device (hAP ac2) did not upgrade, logging that there were no updates available. I tried to update it this morning from /system packages, and it still reports no updates are available. It's still on 6...
by yottabit
Thu Dec 20, 2018 7:15 am
Forum: Wireless Networking
Topic: AP in client mode
Replies: 1
Views: 380

Re: AP in client mode

If your AP is Mikrotik, set your client device wireless mode to station-bridge. Disable its DHCP. Use any port except ether1 for the wired device. Personally in this config, I like to wipe the client device to no defaults, login with winbox by mac address, create bridge, add all ports to bridge, cre...
by yottabit
Thu Dec 20, 2018 3:46 am
Forum: General
Topic: Chromecast across VLANs?
Replies: 4
Views: 517

Re: Chromecast across VLANs?

Guest mode won't work for this use. Typical Chromecast use sends commands from the phone, tablet, or computer, and the Chromecast fetches the content itself. The controlling device doesn't send content directly. But in screen/tab-casting mode, the controlling device is transcoding the media into a v...
by yottabit
Wed Dec 19, 2018 4:45 pm
Forum: General
Topic: Chromecast across VLANs?
Replies: 4
Views: 517

Re: Chromecast across VLANs?

Bridge the VLANs, but then there may be no point using VLANs. Or you'll need to write a rule that can forward mDNS traffic as this is the protocol Chromecast uses for advertisement and control. Chromecast is not really intended to work outside of a simple LAN environment. An alternative is to enable...
by yottabit
Thu Nov 29, 2018 2:18 am
Forum: General
Topic: Having Problems Matching Host with Firewall [SOLVED]
Replies: 3
Views: 256

Re: Having Problems Matching Host with Firewall [SOLVED]

Alright, here's what I ended up doing, in case anyone else would be interested in the same thing without using queues. Unfortunately I couldn't get the mangle rules to work when trying to 2-step connection-mark and packet-mark. Maybe I will revisit again at a later time. So far the RB962 (hAP ac) CP...
by yottabit
Thu Nov 29, 2018 1:19 am
Forum: General
Topic: Having Problems Matching Host with Firewall [SOLVED]
Replies: 3
Views: 256

Re: Having Problems Matching Host with Firewall [SOLVED]

Thanks for your reply. Turns out I did not fully disable Fast Path, doh. Now that it is off, I have created a Mangle that marks the connection based on the dst-address-list, and a Mangle that marks the packet from the connection. The next issue is that I am attempting to make this more efficient on ...
by yottabit
Wed Nov 28, 2018 11:47 pm
Forum: General
Topic: Having Problems Matching Host with Firewall [SOLVED]
Replies: 3
Views: 256

Having Problems Matching Host with Firewall [SOLVED]

So this test is a pretty simple setup. Single RB962 (hAP ac) serving the whole network. Running 6.43.4. I am attempting to account for the network usage of a Chromecast. I created a firewall rule that matches the Chromecast's MAC address and adds that IP address to an address list. /ip firewall filt...
by yottabit
Mon Nov 26, 2018 11:51 pm
Forum: General
Topic: IPIP+IPSec Local-Address
Replies: 0
Views: 197

IPIP+IPSec Local-Address

When using the preshared key feature of IPIP tunnels to dynamically create the IPSec policy, I am glad that we can using an FQDN for the remote-address parameter. But the local-address parameter is still configured as an IP address. Does this matter? I was under the impression that if the local and ...
by yottabit
Thu Nov 15, 2018 5:49 am
Forum: General
Topic: Bitten by Dynamic Interface Lists
Replies: 0
Views: 245

Bitten by Dynamic Interface Lists

Just a cautionary tale for all of you out there. When the 'detnet' and dynamic interface lists were implemented a while back, I just removed them from the default configs because I didn't trust them yet, and didn't want to bother with the hassle of something trying to automate what I typically didn'...
by yottabit
Thu Nov 15, 2018 5:23 am
Forum: General
Topic: IPIP+IPSec, Where are the Firewall Rules?
Replies: 0
Views: 229

IPIP+IPSec, Where are the Firewall Rules?

So it's completely awesome that the preshared key option was added to IPIP setup, which automatically creates all of the tedious IPSec configuration parameters. But... how does this work (and it does work*) without 500 (IKE) and 4500 (IPSec NAT) open on the firewall? i.e., everything is configured e...
by yottabit
Thu Aug 16, 2018 8:25 pm
Forum: RouterBOARD hardware
Topic: hAP ac² High temperature
Replies: 50
Views: 9430

Re: hAP ac² High temperature

Sure, the Wi-Fi performance is worse, and by design. Apart from the initial issues that they have fixed, it specifically has lower EIRP and fewer chains. I actually don't use the Wi-Fi on my hAP ac2. I have it enabled for worst-case management connections only; but I feed multiple RB962 (hAP ac) int...
by yottabit
Thu Aug 16, 2018 5:39 pm
Forum: RouterBOARD hardware
Topic: hAP ac² High temperature
Replies: 50
Views: 9430

Re: hAP ac² High temperature

It does not "overheat," in that I have not noticed any performance problems when the router is "hot." As others have said, the heat may contribute to premature failure of the device, but that is conjecture at this point. Mine is serving a 150M/150M Internet connection with periods of high traffic ut...
by yottabit
Thu Aug 09, 2018 7:52 pm
Forum: RouterBOARD hardware
Topic: hAP ac² High temperature
Replies: 50
Views: 9430

Re: hAP ac² High temperature

I upgraded to the hAP ac^2 for the faster CPU over the hAP ac, because my QoS rules were hitting the CPU limit. So I'm using the CPU quite a lot, and have been running this for months in an ambient temperature of 29 C without direct airflow. It feels hot, but it must have been designed for a high op...
by yottabit
Tue Jul 24, 2018 3:11 pm
Forum: General
Topic: Router compromised [SOLVED]
Replies: 21
Views: 4557

Re: Router compromised [SOLVED]

You can sign up for email notifications from Mikrotik. I also follow Mikrotik's Twitter account and a non-Mikrotik Twitter account for release notices. There's a subscription field at the bottom of the downloads page: https://mikrotik.com/download Twitters: @mikrotik_com, @mikrotik_build Sent from m...
by yottabit
Sun Jul 22, 2018 4:20 am
Forum: General
Topic: PCQ Fair Queueing How-To
Replies: 0
Views: 234

PCQ Fair Queueing How-To

I've scoured documentation on the Wiki and in the forum, and constructed a quick tutorial on how to set up ingress PCQ for managing low-rate or quota-limited Internet connections. I've tested the burst and throttling successfully, but I do have a couple remaining questions about the ring buffer beha...
by yottabit
Tue Jun 26, 2018 8:04 pm
Forum: Wireless Networking
Topic: Forcing my TV back to 5Ghz
Replies: 4
Views: 498

Re: Forcing my TV back to 5Ghz

Why not create a connect list rule that disallows the TV from the 2 GHz radio? Then it will not have a choice but to use the 5 GHz. I have found that all of the ChromeOS-based devices in my home (not just computers...) jump around a lot when there are multiple 5 GHz APs available with the same SSID,...
by yottabit
Tue Jun 26, 2018 7:24 pm
Forum: Wireless Networking
Topic: WPA3
Replies: 2
Views: 1410

Re: WPA3

I wonder if RouterOS offloads WPA in any way to the SoC, or whether it's done completely in software. I suspect the latter, so I'm hopeful we can get the upgrade, as long as it isn't driver-blocked by the older kernel used by RouterOS.

Sent from my Pixel XL using Tapatalk

by yottabit
Mon Jun 11, 2018 7:20 pm
Forum: Wireless Networking
Topic: 80 MHz Channel Extension Sequence?
Replies: 2
Views: 422

Re: 80 MHz Channel Extension Sequence?

OK cool, so what you wrote indicates that it always extends higher first, and then lower. Indeed, that does change where I think I should put my base channel. For particularly difficult environments, it would be a nice feature if we could control the direction (i.e., allow it to extend lower first, ...
by yottabit
Mon Jun 11, 2018 6:10 pm
Forum: Wireless Networking
Topic: 80 MHz Channel Extension Sequence?
Replies: 2
Views: 422

80 MHz Channel Extension Sequence?

When setting to 80 MHz, you have the C/e notation to pick your base/control channel and extension channels. If I pick 5745 Ceee, it's common sense that the base channel is 5745, and then I would expect the extension channels to grow higher in sequence, e.g., 5745->5765->5785->5805. Likewise, if I ch...
by yottabit
Fri May 11, 2018 6:24 pm
Forum: Wireless Networking
Topic: hAP ac^2 Problems---Extremely Poor Performance found in 2.4G and 5G WiFi
Replies: 281
Views: 53093

Re: hAP ac^2 Problems---Extremely Poor Performance found in 2.4G and 5G WiFi

Since your upstream speed is so low, you'll be just fine using the hAP ac as a router, even if you implement QoS in the future. If you ever get 100M+ upstream, *and* want QoS, you can buy a more powerful router for that when you need it (e.g., hAP ac2, or whatever its successor may be). Sent from my...
by yottabit
Fri May 11, 2018 4:05 pm
Forum: Wireless Networking
Topic: Wireless woes and how to fix em :)
Replies: 16
Views: 2493

Re: Wireless woes and how to fix em :)

Yes, by increasing the antenna gain value, the radio will automatically adapt to proper power levels for the different modulation types, as well as maintain regulatory conformance. Essentially you're "faking" a higher gain antenna, so the radio backs off appropriately to maintain the maximum EIRP th...
by yottabit
Fri May 11, 2018 2:32 pm
Forum: Wireless Networking
Topic: hAP ac^2 Problems---Extremely Poor Performance found in 2.4G and 5G WiFi
Replies: 281
Views: 53093

Re: hAP ac^2 Problems---Extremely Poor Performance found in 2.4G and 5G WiFi

Startus: the hAP ac model has superior wireless over the hAP ac2, with higher radio power and 3 antenna chains per radio instead of only 2. But the hAP ac2 has a much more powerful CPU, quad-core ARM v. single-core MIPS. I am using the ac2 for my router as the ac maxes CPU for me with my QoS rules. ...
by yottabit
Thu May 10, 2018 3:37 pm
Forum: General
Topic: port speed
Replies: 16
Views: 993

Re: port speed

Just don't use the Wi-Fi. I have mine disabled, too, as I use the more powerful hAP ac model for Wi-Fi. The RB3011 is also ARM, but dual-core instead of quad-core, and it costs more. I think the hAP ac2 is still the best fit. But the RB3011 would be adequate, too. Sent from my Pixel XL using Tapatalk
by yottabit
Thu May 10, 2018 12:36 am
Forum: Wireless Networking
Topic: Wireless connection drop in Android 7.0, 7.1.1, 8.0
Replies: 10
Views: 1633

Re: Wireless connection drop in Android 7.0, 7.1.1, 8.0

Cool, let us know. And be sure WMM is enabled on all Wi-Fi interfaces you're running.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 09, 2018 8:55 pm
Forum: Wireless Networking
Topic: Wireless connection drop in Android 7.0, 7.1.1, 8.0
Replies: 10
Views: 1633

Re: Wireless connection drop in Android 7.0, 7.1.1, 8.0

I've had RouterOS default to a 5m lease on DHCP, and this has caused problems with Android and Chromecast devices. Should it? No, but it did.

Increasing the lease time solved that problem.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 09, 2018 2:46 pm
Forum: General
Topic: port speed
Replies: 16
Views: 993

Re: port speed

If you want to keep the config as-is, yes, you'll need a faster router. The hAP ac2 should work nicely for you with its quad-core ARM CPU.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 09, 2018 6:47 am
Forum: General
Topic: port speed
Replies: 16
Views: 993

Re: port speed

The RB450G has 5xGbE ports and should be able to route with fast-path at over 600 Mbps. If you don't know what PCQ is, I advise you to ask the person that configured your router. If you bought it used, you need to reset to default and start over. https://mikrotik.com/product/RB450G#fndtn-testresults...
by yottabit
Wed May 09, 2018 5:40 am
Forum: General
Topic: port speed
Replies: 16
Views: 993

Re: port speed

You have PCQ set to 64/65M. You have a complex set of QoS rules with passthrough=yes on the rules which means the entire list is being processed for each state. I don't think fast-path can work with your QoS rules. You didn't answer to where you tested, using which model of station device, and wheth...
by yottabit
Wed May 09, 2018 5:07 am
Forum: Wireless Networking
Topic: Wireless connection drop in Android 7.0, 7.1.1, 8.0
Replies: 10
Views: 1633

Re: Wireless connection drop in Android 7.0, 7.1.1, 8.0

Increase group key TTL to 1h and increase DHCP lease to 1h. This nearly always fixes problems I've experienced like you describe.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 09, 2018 5:03 am
Forum: General
Topic: Advanced Routing Failover without Scripting questions:
Replies: 3
Views: 652

Re: Advanced Routing Failover without Scripting questions:

Google DNS is highly reliable and globally diverse. 8.8.8.8 and 8.8.4.4.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 09, 2018 5:00 am
Forum: General
Topic: port speed
Replies: 16
Views: 993

Re: port speed

What? The model number is on the label, in Webfig, in Winbox, and in the CLI. Post the output of "/export hide-sensitive" and we can also check to see if you have fastpath enabled, and expensive QoS rules, etc. Also let us know how you're testing the speed, e.g., to which sites, using Wi-Fi on which...
by yottabit
Tue May 08, 2018 4:38 am
Forum: General
Topic: Unusual traffic from your computer network.... I'm not a robot
Replies: 2
Views: 1011

Re: Unusual traffic from your computer network.... I'm not a robot

This is caused by a computer, or other device, on your network sending a flood of requests to Google. They are classifying the requests as a denial of service attempt and blocking you from the rest of their network. I've had this caused once by sending logs to myself via Gmail from an automated syst...
by yottabit
Mon May 07, 2018 3:47 pm
Forum: General
Topic: Wired connection was flaky with MikroTik hAP ac2.
Replies: 19
Views: 1797

Re: Wired connection was flaky with MikroTik hAP ac2.

I've never met a router I liked that defaulted to 192.168.0.0 or 192.168.1.0! [emoji38]

Sent from my Pixel XL using Tapatalk

by yottabit
Sat May 05, 2018 9:55 pm
Forum: RouterBOARD hardware
Topic: How to PoE power CCR1009-7G-1C-1S+PC [SOLVED]
Replies: 3
Views: 1118

Re: How to PoE power CCR1009-7G-1C-1S+PC [SOLVED]

802.3af/at standard is "active" PoE. It requires negotiation by the devices. Passive PoE is a different, incompatible standard. Mikrotik makes Gigabit Passive PoE injectors you can use if your switch doesn't provide *passive* PoE output. Also, most Mikrotik devices accept PoE input on port ether1 on...
by yottabit
Fri May 04, 2018 8:37 pm
Forum: General
Topic: Wired connection was flaky with MikroTik hAP ac2.
Replies: 19
Views: 1797

Re: Wired connection was flaky with MikroTik hAP ac2.

I'm using 6.42.1 on my hAP ac2, and haven't had any problems with DHCP server or client. My ISP is Frontier neé FiOS, and I have about 40 devices on the LAN. I have APs subtended from the router and am not using the router's Wi-Fi.

Sent from my Pixel XL using Tapatalk


by yottabit
Fri May 04, 2018 8:33 pm
Forum: Wireless Networking
Topic: bulk disconnected, group key exchange timeout
Replies: 7
Views: 2068

Re: bulk disconnected, group key exchange timeout

Check your encryption settings, too.

Use WPA2+AES (only), or WPA+TKIP (only). Don't mix them, if at all possible.

Sent from my Pixel XL using Tapatalk

by yottabit
Fri May 04, 2018 3:17 am
Forum: Wireless Networking
Topic: bulk disconnected, group key exchange timeout
Replies: 7
Views: 2068

Re: bulk disconnected, group key exchange timeout

Make sure WMM is set to enabled. This fixes problems with iOS devices on my network, and makes battery life much better on Android devices.

Sent from my Pixel XL using Tapatalk

by yottabit
Thu May 03, 2018 2:39 am
Forum: General
Topic: "Optimal Mangle" from "RouterOS by Example" performance?
Replies: 16
Views: 1956

Re: "Optimal Mangle" from "RouterOS by Example" performance?

For those that aren't understanding why this method is easier on the CPU, it's because tracking a connection, and then looking it up in the conntrack table is far faster, and far less CPU-intensive, than deep-inspecting values in the individual packets.

Sent from my Pixel XL using Tapatalk

by yottabit
Wed May 02, 2018 9:04 pm
Forum: General
Topic: "Optimal Mangle" from "RouterOS by Example" performance?
Replies: 16
Views: 1956

Re: "Optimal Mangle" from "RouterOS by Example" performance?

Here's my setup, only slightly out-of-date. I have thorough comments added as a teaching aid. This should help.

https://docs.google.com/document/d/1G6o ... p=drivesdk

Edit: link permissions fixed.

Sent from my Pixel XL using Tapatalk