MikroTik

ners

According to RFC 2453 (RIP v2): The router requirements RFC [11] specifies that all implementation of RIP must implement triggered update for deleted routes and may implement triggered updates for new routes or change of routes . So the question is (I couldn't find any info in the wiki and here on t...

ners

Instead of doing the filtering manually, you could also do it through See: https://wiki.mikrotik.com/wiki/Manual:IP/Settings#Properties /ip settings set rp-filter=strict I thought about rp-filter, but it seems I can't. I have two ISPs and two full-view BGP sessions with them, so returning packets m...

ners

Yes, I currently have connection tracking turned off. I don't need it for anything else.
So I'll stick to my current setup. Thanks!

ners

/ip firewall address-list add address=5.43.16.0/20 list=WAN-IN-FILTER /ip firewall address-list add address=10.0.0.0/8 list=WAN-IN-FILTER /ip firewall address-list add address=172.16.0.0/12 list=WAN-IN-FILTER /ip firewall address-list add address=192.168.0.0/16 list=WAN-IN-FILTER I have such an add...

ners

Thank you! Got it.

ners

Did you get it solved?

No, i included R4 and R5 in OSPF eliminating redistribution (and nssa) altogether.

ners

Ok, I'll try to explain it in real life terms. I want to connect to an IX which is a shared L2 Domain with a Router Server (running bird: https://bird.network.cz/) and a dozen of other peers each one with their own AS. The direct BGP session will be established with the Router Server (RS) and not wi...

ners

We don't need to strip our AS from AS_PATH. We want to accept routes from a BGP peer who has their AS stripped from AS_PATH. So if our peer's AS is 43322, and the AS_PATH for a route from that peer is "43322 20324 53221 9098" (our peer's AS first), we want Mikrotik to accept that route if ...

ners

We need to accept BGP routes with the peer's AS removed from AS_PATH on the peer's side. Will RouterOS accept such routes (without peer's AS) or do we need to configure something to enable acceptance of such routes? I haven't been able to find any relevant settings. In Cisco it's called no enforce-f...

ners

You need to tage VLAN 30 trough the bridge as well, so change from

Your suggestion worked. Thank you very much.

ners

So my settings are as following. VLAN-10 is my home trusted network. VLAN-30 is my guest network. ether2 is a trunk port, goes to a 802.1q aware switch. wlan1 is my home wifi network wlan2 is guest wifi VLAN-10 is working perfectly, Hosts in VLAN-30 can't ping their default gateway (10.29.30.1) - ad...

ners

So I'm trying to make a Mikrotik RouterOS 6.40.8 a 7/5 translator for two NSSA zones for which it is an ABR. And it won't work for me: whenever I try to change the type of the other zone to NSSA, it rejects my command with the following error message: [admin@R1] /routing ospf area> set 3 type=nssa f...

ners

I will need to redistribute some static routes from area1 to the backbone area, so the area must be nssa to allow for an ASBR.

ners

Hello, I configured an ABR as following: R1: /routing ospf area add area-id=0.0.0.1 inject-summary-lsas=no name=area1 type=nssa Inter-area routes are now suppressed by R1, however I am still seeing AS external routes in area1 injected by R1. How do I configure a totally nssa area where both Type3 an...

ners

/routing pim interface add interface=sfp-sfpplus2 protocols=pim add interface=ether8 protocols=igmp /routing pim rp add address=10.0.1.2 sfp-sfpplus2 is the uplink interface where the RP can be located. ether8 is the client interface the IPTV receiver is connected to. The receiver subscribes to an ...

ners

I have the following setup, the goal is to prioritize a particular multicast stream on the link so that in case of congestion it would get through without hiccups: /queue simple add max-limit=190M/190M name=parf_all queue=default/default target=vlan2506 add max-limit=190M/190M name=parf_iptv packet-...

ners

It can, using the queues. DSCP is just a way to convey the information about required priority. Any operating system works the same way - classifies the traffic based on some local criteria or accepts external classification received in L3/DSCP or L2/CoS fields, and then uses a queueing mechanism t...

ners

I's impossible to prioritize something without inspecting it.

So RouterOS is crippled in that regard? It can't do DSCP-based QoS?

ners

I want to be able to give a particular multicast stream higher priority from the rest of the traffic on a link so in case of congestion it would still get through without hiccups. Everything I managed to find in the internet about prioritizing traffic on RouterOS deals with putting the traffic in qu...

ners

CRS, 6.38.7

Neighbor discovery shows all neighbors to reside on the master port. This makes the whole thing pointless. How to make it show neighbors on their actual interfaces? Thanks.

ners

CCR1072-1G-8S+ running on 6.37.5 (bugfix).

I have 5 full-view BGP sessions running on it
Whenever I issue "/routing bgp advertisements print" all BGP sessions go down and get re-established.

What can be done about this?

Thanks.

ners

I have a bunch of /32 routes fed into RouterOS by an OSPF peer. I also have more "general" routes in my routing table installed by BGP. What are some possible ways to force RouterOS NOT to use /32 routes in a specific case (for example based on src-address-list or some packet mark or somet...

ners

I love using overlapping subnets. It sometimes eases deployments and avoids weird NAT-scenarios. Also overlapping subnets can solve IPv4 shortage. It is possible to route between mikrotik routers only wasting one public IPv4 address per Router.... Are you saying that assigning 10.7.19.89/29 (the sa...

ners

To be serious: You configure the device, so you're in charge to do it right, no? A very immature and irresponsible approach. The human brain has a hard time dealing with numbers so mistakes are always possible and they can cost a lot (financially too). RouterOS must do some kind of verification to ...

ners

This is real, this is a serious issue. Mikrotik allows adding networks which overlap each other. For example: [admin@rt-office] /ip address add address=10.9.17.89/29 interface=vlan33 [admin@rt-office] /ip address add address=10.9.17.93/30 interface=vlan120 [admin@rt-office] /ip address print where n...

ners

It is also not as clear cut as the answer suggests. When you have conntrack off but you have a long list of static access list items that needs to be traversed for every packet going through, it might well be slower than having conntrack on and an established/related rule at the top of the list. (e...

ners

SUBJ pretty much says it all. What's better from the performance point of view?

ners

The /ip route check command now only shows the interface which will be used to forward a packet destined for the given ip address. It would be far more useful to include info on the specific route it will use to forward the packet. Right now it's like this: [admin@cr] > /ip route check 8.8.8.8 statu...

ners

Do Mikrotik CRS switches support Q-BRIDGE? Right now I'm trying to get:
http://tools.cisco.com/Support/SNMP/do/ ... oidContent

And it returns empty, what can be done here?

I'm on 6.30.2

ners

RSA support is long overdue! I hate having to keep a separate DSA key just for accessing my Mikrotik hardware (which is plenty).

ners

Guys, I have a network 10.0.0.0/28, I have a router and a L2 switch, to which 2 hosts are connected. I need the hosts 10.0.0.2 and 10.0.0.3 to access each other. Communications between hosts is blocked on the switch but the hosts can access their default gateway. If I set proxy-arp on the Mikrotik's...

ners

Then exclude those ips from fasttrack first.

Too much of a hassle, really, not elegant and is just a duct tape solution to a bad design decision.

ners

Simple queues should override fasttrack for specific IP/Interfaces where it is applicable.

ners

The current implementation is not optimal. It should implemented in such a way, that Fasttrack gets disabled only for such traffic which cannot be fasttracked (due to simple queues, firewall rules etc...). The presence of simple queues for certain targets should not disable Fasttrack for everything ...

ners

In the IPSEC policy just change the protocol from all to GRE . This will then cause only the encryption of GRE packets leaving all other traffic in the clear. Out of curiosity what other traffic are you worried about being encrypted by the more open policy? Wah, I missed that. Thanks, with protocol...

ners

It's basically like this: Two routers: R1 (HQ) <---------GRE----------> R2 (Remote branch) R1 WAN IP: 81.29.10.2 R1 GRE IP: 172.17.1.1/30 R2 WAN IP: 77.232.60.34 R2 GRE IP: 172.17.1.2/30 LAN at remote branch: 10.222.0.0/16 Many different hosts located in different networks are routed through the HQ ...

ners

[admin@crs] /ip ipsec policy> set 1 tunnel=no failure: transport mode policy must match sa endpoints eh, still no luck. It seems it wants me to make src and sa-src and dst and sa-dst addresses the same. That means that all traffic between the two routers will be matched, not just the GRE tunnel. :-/

ners

Thank you for your reply. Yeah, I just need to secure the tunnel itself. In fact I tried to specify tunnel endpoints in src-address and dst-address in policy and set tunnel=yes (afaik transport mode only secures traffic originating and destined to the peers themselves, not other hosts) but it got me...

ners

Hi, I have a situation where I've got two CCRs with a GRE tunnel between them. The problem is, I need to secure all random traffic which goes over that GRE tunnel with IPSec. In the settings where you define policy, you are only allowed to match packets based on their src/dst-address information, no...

ners

3 full view, 3 gbps, with conntrack enabled 40-50% CPU.

ners

Any plans to introduce support for MST and LACP?

ners

I contacted VanDyke's support and after an investigation they told me the following: > the SSH server is sending a packet with an invalid SFTP request ID. > Here is the malformed packet SecureFX receives from the server: 00 > 00 00 2c 0d 5e 00 00 00 00 00 00 00 15 00 00 00 11 65 73 2d 6d 75 00 > 00 ...

ners

I am using VanDyke's SecureFX for accessing my boxes via SFTP. However SecureFX fails to connect to a Mikrotik RouterOS device. At some point the connection process just stops. People at VanDyke say there is a bug with Mikrotik's SSH server: it is sending a packet with an invalid "request-id&qu...

ners

I need to know what interface a certain packet with dst-address set to x.x.x.x will be routed to. How can I do that?
Even /ip route print where ~"x.x.x.x" takes a horribly long time with BGP full view.

ners

How do I check Mikrotik's SSH keys fingerprint in the RouterOS CLI?

ners

Why do you need mangle in this case? What's the point of marking connections in this particular setup?

ners

Hi, I am trying to redirect all HTTP requests (to any IP address) from users within a specific network to a local web server but apparently my rule is not working. Connection tracking is set to auto , RouterOS version is 6.19, the rule is enabled, no other NAT rules are present in /ip firewall nat M...

ners

RouterOS 6.19, board-name: CCR1036-8G-2S+ Traffic-flow always consumes too much CPU, in the evening it can easily eat up to 70% of the CPU contributing to the lion's share of the total CPU load. What can be done to remedy this? Is there anything? [vysh@crs] > /tool profile NAME CPU USAGE ethernet al...

ners

RB2011UAS + ROS 6.12 + Firmware 3.14 09:51:01 l2tp,info first L2TP UDP packet received from xxx.xxx.xxx.xxx 09:51:01 l2tp,ppp,info,account coaxial logged in, 172.16.12.186 09:51:02 l2tp,ppp,info <l2tp-coaxial>: authenticated 09:51:02 l2tp,ppp,info <l2tp-coaxial>: connected 10:16:41 l2tp,ppp,info <l2...

ners

ROS 6.12 RB2011. no buffer space available... Network doesn't work. After reboot everything ok. I tried to update the firmware but does not help. Same problem here as well after uptime of 4 weeks.... Same here, seems to be tied to L2TP/IPSec since I started experiencing this when I set up L2TP/IPSe...

ners

Yes, I saw Your link. Am I understand correct L2TP connects before IPSec part? I configured IPSec part also, but first of all I understand that L2TP must be up and running. L2TP will try to iniciate the connection - but will NOT be able to connect before IPSec negotiates security. So L2TP trying to...

ners

Is the inability to queue more than 500 Mbit/s in any plans to be fixed? Right now we have to maintain 5 CCRs 1036 to process about 2Gb/sec of shaped PPPoE traffic (350 Mbit/s each) :-/

ners

After resetting the configuration and configuring it from scratch it hangs again after issuing /export and also does not pass any traffic: The configuration is as following: /interface ethernet set [ find default-name=sfp1 ] master-port=ether24 set [ find default-name=ether1 ] master-port=ether24 se...

ners

But my management IPs reside not in a VLAN, but rather in the native VLAN, which is not a 802.1q VLAN at all, it is just normal untagged traffic, this is why I put the IP address on the physical master-port (ether24 in my case). IP address on the master-port is correct for untagged traffic, but in ...

ners

michaelahess, The follwing Cloud Router Switch configuration should be applied for your setup: 3) For security disable invalid VLAN forwarding globally or on each port separately like this: /interface ethernet switch set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports="ether2-master-lo...

ners

ners, You should add a VLAN interface to master-port in RouterOS and add IP address to it. From switch point there is switch1-cpu port, not the master-port. /interface vlan add name=vlan59 vlan-id=59 interface=ether24 /interface ethernet switch egress-vlan-tag add tagged-ports=switch1-cpu vlan-id=5...

ners

Has anyone figured out how to set ip a management IP on a CRS in the native VLAN? Simply adding an IP to the physical master port is not enough, apparently. 172.16.16.8 is unpingable and no other hosts in the network see 172.16.16.8. the ARP table is also empty. /ip address add address=172.16.16.8/2...

ners

Old VLAN code working on 6.11: /interface ethernet switch ingress-vlan-translation add customer-vid=0 new-customer-vid=701 ports=ether2 sa-learning=yes /interface ethernet switch egress-vlan-translation add customer-vid=701 new-customer-vid=0 ports=ether2 This correctly exports on a CRS still runni...

ners

CRS on 6.12, ip addresses on physical interfaces ("native VLAN") stopped working: /ip address add address=172.16.16.8/24 interface=ether24 network=172.16.16.0 /interface ethernet set [ find default-name=sfp1 ] master-port=ether24 set [ find default-name=ether1 ] master-port=ether24 set [ f...

ners

In RouterOS v6.10 configure this without a VLAN table entry:
ros code
/interface ethernet switch vlan
add ports=ether1,ether24 sa-learning=yes vlan-id=59

Thank you, that worked. But how do I restrict which VLANs are allowed on trunk ports and which are not then?

ners

Anyone?

ners

I would like to confirm that the CCR1036 is good and stable for 1Gbit/sec NAT on 6.9. uptime: 5w5d20h25m43s version: 6.9 build-time: Jan/31/2014 11:18:19 free-memory: 3483.3MiB total-memory: 3969.0MiB cpu: tilegx cpu-count: 36 cpu-frequency: 1200MHz cpu-load: 15% free-hdd-space: 903.6MiB total-hdd-s...

ners

Hi, just got a brand new CRS125-24G-1S and I'm trying to figure out the configuration. Right now I'm attempting to create a simple setup like this: Cisco3550 <-------trunk vlans 1,59--------> CRS125-24G-1S <-----access vlan 59-----> PC ether24 is a trunk port where only VLANs 1 (default) and 59 are ...

ners

Try same-not-by-dst=yes, it might help and I consider it to be best practice for batting.

ners

anyone tried 6.11 on ccr? i am still stuck at 6.7 because 6.9 and 6.10 run unstable. max uptime was about 4 days. I did and experienced a very weird bug. Suddenly some vlan interfaces stopped working. They just wouldn't pass traffic at all although shown as running and I could ping their addresses ...

ners

ners , thank you for reply! Could you provide please some more details: 1. What is maximum utime? 2. Current version of ROS. 3. Does NAT utilise multi cores or single core? 1. uptime: 1w14h8m27s (I started using it for NAT a week ago). 2. version: 6.9 3. # CPU LOAD IRQ DISK 0 cpu0 7% 7% 0% 1 cpu1 5...

ners

Does anybody use CCR for NAT?

I need about 1G of NAT.

1Gb/sec NAT is fine for 1036.

ners

Looking to understand the impact of the Firewall on high speed routing on a CCR. The benchmark's refer to 25 rules, I assume they are "passing" rules rather than blocks? Ie the traffic is being checked 25 times in a row and passing before being routed on to the end locations. 1. What impa...

ners

Thanks, I will have to load balance them then.

ners

Still capped at 400-500 Mbit/s, one of the cores is constantly at 100%: ners@aad-rt-nas01] > /sys reso cpu pr interval=1 # CPU LOAD IRQ DISK 0 cpu0 31% 31% 0% 1 cpu1 29% 29% 0% 2 cpu2 32% 32% 0% 3 cpu3 27% 27% 0% 4 cpu4 10% 10% 0% 5 cpu5 44% 43% 0% 6 cpu6 100% 100% 0% 7 cpu7 27% 27% 0% 8 cpu8 0% 0% ...

ners

Hi, we are using a CCR1036 RouterOS 6.6 as a PPPoE concentrator with simple queues for shaping. In the evening the number of online PPPoE connections reaches 1500. I started to notice that in the evening when the number of online PPPoE sessions exceeds 1000, clients' throughput starts to degrade. To...

ners

Guys is there a table available for best practice queue size for various speeds? For example I need to limit the WAN interface on my RouterOS 6.7 which is 1Gbit to 500Mbit/sec and I'm puzzled over which queue size would be best for this scenario. 50 packets would be too little, 500 probably too high...

ners

ners, open up '/tool profile' to see what is happening. make sure you are running 6.7

Apparently nothing is happening, Idle is 100% or 99,9% and everything else is 0%...

ners

My brand new CCR1036-8G-2S+EM arrived today and upgraded from v6.1 to v6.7. Now fans are still spinning up and down, up and down continuously. The fans control mode is set to automatic. Is this normal ? I also have a CCR1036-8G-2S+EM and it exhibits the same behavior on 6.7, the fans are spinning u...

ners

A simple queue with default parameters will not work -- it really is not even created. You should change the type of queue from default-small to default, for example, then it will work.

ners

Why can't the client find any policies?
Probably because you have not defined any.
Using 'generate-policy' on client side does not make any sense to me.

Mikrotik is not the client, it's the concentrator (server)

ners

Hello, I'm trying to setup IPSec on Mikrotik RouterOS 6.6 but it isn't coming up, what is wrong with my setup? Why can't the client find any policies? /ip ipsec mode-cfg add address-pool=vpn-pool name=home-vpn /ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-128 /ip ipsec peer add auth...

ners

Hello guys, Two scenarios, one works, the other doesn't. I'm trying to connect to my home LAN based on RouterOS 6.6 (RB751G-2HnD) from my iPhone with iOS 7.0.4 using "Cisco VPN" and from my Mac with OS X 10.9 When I have split-include enabled, I can successfully connect and access my home ...

ners

Thanks, I've done that and it seems to be working: /queue simple add dst=10.10.10.10/32 name=ftp-unlimited-4nat queue=default/default target=192.168.0.0/16 add dst=10.10.10.10/32 name=ftp-unlimited-4real queue=default/default target=192.0.2.0/24 However I still see queued and even dropped packets: [...

ners

Is it possible to make a simple queue or a mangle rule/tree queue which would override any other simple queues which are dynamically created by Mikrotik-Rate-Limit RADIUS attribute and applied to the user's interface in RouterOS 6.x? For example RADIUS sends Mikrotik-Rate-Limit 2048k for a user, a d...

ners

I am running a PPPoE server on a CCR-1036. My /ppp profile is: /ppp profile add dns-server=192.168.2.2 local-address=192.168.255.1 name=my-pppoe only-one=yes use-compression=no use-encryption=no use-vj-compression=no I use RADIUS for authentication. I see that the only-one parameter is ignored and o...

ners

Can anyone tell if CCR1036-8G-2S+ will accept SFP modules in its SFP+ slots? I couldn't find any relevant info in the brochure.

ners

Hi, I'm running a PPPoE server on Mikrotik 1100AHx2 ROS 6.2 Users authenticate via RADIUS, the RADIUS sends Mikrotik-Rate-Limit attribute to shape user's traffic, thus creating a dynamic simple queue tied to user's virtual interface. However I need to NOT shape traffic to certain IP blocks. How can ...

ners

ros code

/ip firewall filter add chain=forward protocol=gre action=reject reject-with=icmp-protocol-unreachable

Should block GRE protocol which is used by PPTP for data transfer, no other traffic should be affected.

ners

Block destination port TCP 1723 in the forward chain, or better block protocol type 47 (GRE) which is used by PPTP. That way you will also block PPTP services on non-standard ports.

ners

I am testing a PPPoE NAS on Mikrotik 1100AHx2, ROS 6.1 Radius sends Mikrotik-Rate-Limit attribute for each newly connected user. A dynamic simple queue is created like this: 0 D name="<pppoe-mikrotik_4m>" target=<pppoe-mikrotik_4m> parent=none packet-marks="" priority=8/8 queue=d...

ners

Hi, i'm having rouble setting up L2TP+IPSec on RouterOS 6.1 I've been banging my head against a wall over the past couple of days. Please tell me what is wrong with my setup? As I see it, the client does not get any L2TP control responses from the server. My configs: /ip ipsec peer add exchange-mode...

ners

On every business day of the week I get a default route via DHCP which looks like 0.0.0.0/0 via 209.165.200.1 which gives full access, and on every weekend I get 0.0.0.0/0 via 10.120.0.1 instead which enables limited access. Also I have a static default route via a PPPoE link which is always active....

ners

I'm very disappointed with the CCR-1036, it is being advertised as a carrier grade router, yet it cannot do NAT more than 250Mbit/sec (around 30k packets/sec) without falling throughput

This is probably enough for a small business, but certainly not for anything serious.

ners

Odd.. Ive used plain jane PCQ via simple rules minus the mangle rules with speeds as low as 512k/256k before without issue... someone else will have to chime in, im totally stumped. Yes, minus the mangle rules. Something tells me this problem is related to packet marking. Something in that departme...

ners

Hmmm, was just reading through mikrotik wiki looking for info on simple queues and noticed this: Flow Identifiers target-addresses (multiple choice: IP address/netmask) : list of IP address ranges that will be limited by this queue. interface (Name of the interface, or all) : identifies interface th...

ners

The other thing you could do since you are using PPPOE... what does your pppoe authentication, radius? you can set user speeds via radius attributes too. All they do is dynamically create a simple queue tho. Yes, I authenticate users via RADIUS. Right now RADIUS supplies MT-Address-List attribute w...

ners

Thank you, derr12 . I'll try your suggestion with queues as soon as I complete testing of NAT performance. Ultimately, I'm afraid simple queues are not an option for me, since I expect the amount of as many as 1000+ pppoe users to be connected to the NAS at the same time. I read somewhere here a pos...

ners

I use dynamic address-lists (radius sends attribute MT-address-list when a client connects which puts the client's address into an address list). Users connect as PPPoE clients to my Mikrotik which acts as a PPPoE server. My Mikrotik is the 36 core CCR, RouterOS is 6.0rc11. Well, everything works fi...

ners

Thnks, derr12

I got it sorted out. However there's still one problem left. I guess a new thread is needed.

ners

Thank you, derr12. I've altered my configuration and now it seems to be working as needed (two users get 1Mbit each). I have eliminated connection marking completely, still not sure why it was needed in the first place, and also in the queue tree I changed parent interface from "ether2" to...

ners

I'm trying to set up a PPPoE server on a Mikrotik router, 6.0rc11 I'm using PCQ queues to limit traffic for each separate user. For example, let's take the queue "TEST_1MB_DOWNLOAD". All users which are processed by this queue should receive 1 Megabit/sec download. However it's not working...

ners

hm, do I understand this correctly, that this rule: add action=jump chain=forward connection-state=new dst-port=80 jump-target=anti-ddos protocol=tcp add action=return chain=anti-ddos dst-limit=40/5s,70,src-and-dst-addresses/1h will match from a single IP up to 70 new connections (burst) and then 40...

ners

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter Read about 'dst-limit' matcher. HTH, I read about it, but it does not solve my problem since it doesn't differentiate between separate source IPs. I mean it doesn't support a separate counter for each source IP, it's a global counter. And also...

ners

Hello, i'm moving from a FreeBSD-based router to a RouterBoard. I'm currently on 6.0rc11 I've been trying to implement anti-ddos protection for my servers, but I can't quite figure it out. Is there a way to mimic this set of PF rules?: # anti ddos from 80 port table <ddos80> persist block in quick f...

Search found 100 matches

ros code

ros code