MikroTik

marrold

Hi all, I have 5 non-ARM Mikrotik Routers I'd like to create a Zerotier like L3 mesh network with. Each router will have its own subnet and should create a tunnel to all the other routers with some dynamic protocol handling the routing. Ideally I'd like to be able to plug them into any existing netw...

marrold

+1 for MQTT subscriptions and running scripts

marrold

that command is on LTE interface..... not ppp try some of this, hoping RouterOS send NULL... \A0\01\1B\00\A1 \A0\01\1B\40\A1 \A0\01\15\40\A1 They're all sent through as they were sent, without a NULL. Thanks for the recommendations, but it looks like this is a non-starter unless Mikrotik add a feat...

marrold

0x00 on at-chat is null terminating string... "end of the input"??? ( ^@ ).... Ah, that will explain it then... Thanks for the info Perhaps "wait=no" and splitting at the \00's into multiple at-chat commands, might do something here...only thing to try...but highly doubt it. I d...

marrold

Hi all, I'm experimenting with connecting a USB serial relay to a Mikrotik to allow remotely switch off some hardware. The protocol is crude and requires sending Hex to the serial port: On: \A0\01\01\A2 Off: A0\01\00\A1 To send the hex I'm (ab)using at-chat, like so: /interface/ppp-client> at-chat u...

marrold

dumped-saved-advertisements is broken in 7.5 and 7.6beta6 as per this thread viewtopic.php?p=956793#p956793

marrold

I have the same issue. I upgraded to 7.6beta6 and its still present.

Not great...

marrold

I could really do with this feature.

How Mikrotik can tout their new and improved BGP service and change the routing filter setup without any way to troubleshoot it seems crazy.

marrold

For anyone wondering I've had a ticket open with support but no response in almost 2 months. (SUP-69140)

marrold

Hello, I am using a Mikrotik as an LNS in a LAC / LNS setup, the config is very similar to the one documented here but I'd like to offer IPv6 to clients. The documentation here suggests its as simple as creating an IPv6 pool and assigning it to the PPP profile, however the (Debian) client is not get...

marrold

Is anyone else running an L2TP tunnel with a Cisco router as the client and a Mikrotik as the server?

Thanks

marrold

I'd also love to see NAT64 support, now RouterOS 7 is out it seems like a good opportunity to add it

marrold

Hello, I am using a Cisco and Mikrotik router in a LAC/LNS configuration. Despite the L2TP tunnel initialising, traffic over the tunnel fails. With l2tp logging enabled on the Mikrotik, I saw the line "received unsupported protocol 0x2145" Ive gone into more detail on my blog but it seems ...

marrold

Really? Do the other vendors quietly enable the equivalent of multicast helper known as MC2UC? That's plausible, yes (and backed up by your other references). It still feels like a work around to me but as it's common amongst vendors I guess I will eat humble pie and enable it. Thanks for the detai...

marrold

It works! What more can you ask for? It's a better kind of best effort! It's concealing a potential issue with Mikrotik Access Points that isn't observed on other vendors. If your device is asleep or suspended during a broadcast and misses it what are you going to do? The Client announces to the AP...

marrold

Multiple uses are reporting the same issue. My devices are connected to the primary SSID with the same problem. If you get time please could you confirm your ROS version, redacted wifi config, and possibly redacted the output from `status 0` a the Tasmota device? If you could run an nping test even ...

marrold

Try setting Multicast Helper to Full.

It's a bodge / work around. It does work, but Mikrotik should identify / fix the underlying issue.

marrold

> What exactly do you mean by overheat? I won't burn down my house Overheat as in the MCU will reboot and become unstable. It probably won't burn your house down but don't hold me to that. I've seen mixed messages whether this is a general problem or a specific batch of Sonoff Basics. > I read that ...

marrold

sleep 0

should be fine I believe.

SetOption60

is only relevant when there's a sleep time configured.

marrold

I have tried with

wmm-support

enabled and disabled and unfortunately the behaviour doesn't change.

marrold

Disabling sleep with sleep 0 hides the underlying issue but can cause other problems - if devices don't sleep they use more power / release more heat. I've seen one report that the Sonoff Basics will overheat if they do not sleep. If you have time can you run nping and post your redacted wifi config...

marrold

I would guess it's related to this viewtopic.php?f=2&t=154613

Are you using Tasmota?

marrold

I have observed that some devices using WiFi Power Saving features are not reliably responding to ARP. This is affecting an ESP8266, a Huawei P30 and a Samsung Galaxy S9. I am using a hAP AC and have the issue on version 6.44.6 and 6.46 I have configured an un-encrypted wireless network for the purp...

marrold

I could do with this - I need to adjust DTIM

marrold

You're changing the IP address of the router that you're accessing it via. So as soon as you change the IP your connection to the router is lost. If you change the IP on the router, and then the IP on your PC, you should be able to reconnect. Look into using "safe mode" so you don't get lo...

marrold

Thanks, this helped point me in the right direction. The Client requests Option 43 and expects Option 10 in the offer as a "sub" option of 43 So for my case it was: Hex for Option 10: 0A Hex for Len 4: 04 Hex for 95.177.139.87: 5fb18b57 Combined Hex: 0x0A045fb38b56 /ip dhcp-server option a...

marrold

Hi All, I am trying to send DHCP Option 10 with the inbuilt RouterOS DHCP Server, however if I perform a packet capture, option 10 is not being included in the DHCP offer. However if I set the "code" to 12, its sent as expected. Does anyone have any ideas? My config looks like this: / ip d...

marrold

+1, ZeroTier would be nice

marrold

Exports are easier to read than verbose text, please include them.

marrold

Hi, I experimented with 6.41 but I'd like to go back to the bug fix version. Ive successfully reverted the packages, but I am unable to downgrade the firmware.

Is this possible?

Thanks

marrold

Hi, as this is a completely new implementation please could a member of Mikrotik staff comment?

Thanks

marrold

Using the latest bridge vlan implementation, is it possible to drop untagged traffic?

If I create tagged ports, ROS is creating dynamic VLANs forcing untagged traffic to the PVID. I'd rather drop it.

Thanks

marrold

SIP ALG's are bad news. Your provider should handle the NAT traversal.

marrold

+1

marrold

I see a market for a basic VoIP client and built in ATA (analog telephone adapter), so an end user can have a single box for Internet and Telephony, but I would object to a full blown PBX - It's unnecessary bloat.

marrold

What are you trying to achieve?

Limiting to 100 connections in this way makes you susceptible to a DoS attack. Any SIP device on the internet will get scanned multiple times a day by various bots, which could exhaust available connections and block genuine clients.

marrold

I would like to be able to access the virtual BIOs UUID from within the guest CHR. With QEMU / KVM this is unique per VM.

In a linux guest it can be accessed using dmidecode.

I mentioned it in this thread- viewtopic.php?f=15&t=124230

marrold

Hi,

Does anyone have any thoughts on this?

Thanks

marrold

I would like to be able to access the virtual BIOs UUID from within the guest. With QEMU / KVM this is unique per VM.

In a linux guest it can be accessed using dmidecode.

I mentioned it in this thread- viewtopic.php?f=15&t=124230

Thanks

marrold

Hi all, I'd like to be able to find out some kind of identifier for the VM the CHR is running inside from the guest itself. The VM Host is KVM / QEMU based. In a linux machine I can run 'dmidecode' to get the UUID of the guest. This doesn't seem to be exposed in RouterOS. Is this possible? Could it ...

marrold

Or I'm very silly and I do not understand anything.
We are with version 6.39.2 and get bugfix of 6.38.7
How does it apply to 6.39.2?

6.38 = Bugfix, proven to be stable
6.39 = Current, new features, could have bugs

marrold

Was this fixed?

marrold

I was able to get PIM-SM working fine between subnets, but I didn't have NAT in between. Why are you using NAT? Furthermore, I cannot see any multicast packet in RB3011 eth1 by packet sniffer. If the RB3011 is in the same subnet as the Multicast source, it should be seeing the traffic unless there's...

marrold

It would be unusual for a SIP dialog to take over TCP, but not impossible. Do you have the SIP helper enabled? Can you draw a diagram of the network? and as per above, please attach a PCAP.

Thanks

marrold

+1 for an SFP based VDSL module

marrold

When increasing disk sizes for KVM Virtual Machines it's generally necessary to resize the file system with something like resize2fs. I imagine the same applies to the CHR, however I dont know if it has the appropriate tools built in.

marrold

Hi, it's on the latest, 6.38

Thanks

marrold

Hi, I have a hAP ac lite that's regularly loosing connection to the wifi. The logs show- 'lost connection, no beacons received' http://wiki.mikrotik.com/wiki/Manual:Wireless_Debug_Logs indicates this means "no beacons received from remote end of WDS link. Most likely weak signal, remote turned ...

marrold

Please could someone with a proven VPLS / MPLS network try pinging a remote hop with a size greater than the MTU set on the VPLS interface?

Thanks

marrold

marrold

Hi all, I have a MPLS / VPLS question. I know these are quite common so apologies in advance I have the following VPLS interface configured. ltmtu and advertised-l2mtu are configured to 1526 to allow for a 1500 byte frame + MPLS tag + Ethernet Header + VPLS Tag + PW Header - /interface vpls add adve...

marrold

It sounds like you're looking for this - http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

marrold

Both those routers support all the packages shown above, so you can install any you require.

However, you will not be able to emulate the actual hardware performance of those devices.

marrold

I think it's assumed that if you've got the skills to use Linux you can figure out the CLI

Normis has pointed out which area of forum I'm in.. apologies

marrold

A user on reddit suggested increasing the DHCP lease time, and it looks like the issue is now resolved.

It was set to 1 minute (!) due to some previous testing and Id forgot to set it back.

Thanks

marrold

Hi, I have an Amazon Echo Dot that's frequently losing connection to a hAP AC Access Point. The logs indicate that the Echo is de-authenticating. http://i.imgur.com/grs4Jws.png This is occuring on 2.4 and 5Ghz. The Dot is in the the room next to the the AP, so I don't think it's a signal issue- http...

marrold

This usually means your router is being used in a DDOS attack. Please make sure extenal services such as DNS and NTP are disabled or firewalled from the internet

marrold

I'm afraid I can't assist but I'm having the same issue. I've mirrored the configuration shown on the Wiki , which is also very similar to this Blog post . Both clearly show the PE routers responding in a traceroute, however I only see the final destination respond- [admin@RouterA] > / tool tracerou...

marrold

You dont seem to have a default drop rule at the end of your filter rules?

marrold

Hi, Ive been experimenting with VPLS and I've got a couple of questions on best practises. It's my understanding that in the simplified diagram below, traffic will traverse from Router 1 to Router 3 without requiring a bridge configured on Router 2. http://i.imgur.com/GeeTEtN.png However, I have a c...

marrold

Do you have a packet capture?

marrold

Hi,

Does Mikrotik Wireless support IGMP?

E.G - Multicast traffic is only sent to client accessing the stream rather than broadcast to every Wifi client

Thanks

marrold

> Rather real ones.

In a VM?

faked wireless interfaces would allow you to play with Capsman and view the `/ interfaces wireless` settings

marrold

Hi,

It would be nice to see some fake wireless interfaces on the CHR for lab purposes, for playing with CAPsMAN etc.

Thanks

marrold

Thanks to the Mikrotik Team and all those that presented talks today! I'm hoping there will be another next year.

marrold

You cannot bridge mode-station.

You can't, but you can bridge an EoIP tunnel layered over it.

marrold

Hi all, Please could you advise the most efficient method to layer 2 bridge a Wireless and Wired network using all Mikrotik equipment in terms of CPU, Radio time, max MTU etc? From the wiki- If L2 bridging over wireless link is not necessary - as in case of routed or MPLS switched network, basic mod...

marrold

Hi all, I've recently observed I'm unable to SSH into my router from the LAN when the router has no internet connection. I've upgraded to 6.34.6 but the issue is still present. Does anyone have any ideas what's causing this? I don't have any obvious firewall rules that would be effecting this, the o...

marrold

Hi, Does RouterOS's BGP implementation support 'dynamic neighbors'? (I.E not setting IP for remote-address) Cisco equivalent - http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3sg/irg-xe-3sg-book/irg-dynamic-neighbor.html#GUID-40C1CA4F-5669-4495-8FEE-2D641E916858 Thanks

marrold

This appears to be from the LAN side only, do you also have a trace from the WAN side? I can see your device is sending REGISTER requests but doesn't receive a response. This could be because your provider is not implementing NAT traversal and the responses are going back to 192.168.1.22, or it coul...

marrold

Please can you post a proper .pcap packet capture?

marrold

What I am trying to determine is if the C610 -> SIP server passes double or multiple NAT stages, as that will give you problems with SIP. It may cause issues, but the SIP provider should have NAT traversal in place that can work around these issues. Please can you post a proper .pcap packet capture...

marrold

I'd suggest disabling the SIP helper, and as mentioned above grab a packet trace, ideally from the LAN and WAN side of your router.

Im happy to take a look.

marrold

To clarify, you have multiple IP's that MUST be assigned to the same MAC?

Who is your host?

marrold

Would it nor be sensible to fix the export / import rather than producing a page of things to avoid?

marrold

Personally I'd firewall at the L3 edge rather than L2. However, I'm curious what project you're working on? I'm working on something similar myself.

marrold

802.3af would be nice. Even better if it was fanless (Even if this means less ports)

marrold

There was a thread a while ago about adding TR-069 support, that might help

http://forum.mikrotik.com/viewtopic.php ... 69#p507352

marrold

There was a thread a while ago about adding TR-069 support, that might help

http://forum.mikrotik.com/viewtopic.php ... 69#p507352

marrold

I attempted to add the L2TP interface to the bridge and it failed, so a little bit of Googling revealed BCP which worked as planned.

Thanks again for the nudge in the right direction

marrold

Thanks. I solved the mystery using BCP + L2TP

http://wiki.mikrotik.com/wiki/Manual:BC ... _.28CLI.29

marrold

I can't add VLAN tags to an L2TP interface either, so what's the recommend way to bridge VLAN's over a WAN?

I'm aware EoIP works, but ideally I'd like to use an 'open' protocol.

marrold

*face palm*

Its kind of obvious now you mention it, thanks

marrold

* bump *

marrold

Hi all,

I'm curious why VLAN tags can't be assigned to a GRE interface. What's the proper way to do this?

I'm doing it using EoIP but there must be away to send VLAN'd traffic over a GRE tunnel, right?

Thanks

marrold

Nice. It's great to see a business giving something back to community

marrold

I have try this script and indeed it don't work.
Who can help us?

Run it line by line and see where it fails, or add some lines to indicate where if fails, e.g -

:put "The script has made it this far [1]"
:put "The script has made it this far [2]"

marrold

I've had a similar issue in the past on older ROS versions. I also observed when SSH stopped working, the following command would hang and eventually timeout and suggest sending a SUPOUT to support

/ ip ssh print

marrold

Turns out you can add a topic more than once- [admin@router] /system logging> print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info remote 1 * error remote 2 * warning remote 3 * critical echo 4 l2tp remote !packet 5 ipsec remote 6 info memory 7 error memory 8 warning m...

marrold

How? [admin@router] /system logging> print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info remote 1 * error remote 2 * warning remote 3 * critical echo [admin@router] /system logging> set 0 action=memory,remote input does not match any value of action

marrold

Hi all,

Is it possible to log to a remote syslog server AND the memory?

Thanks

marrold

Traffic Flow - http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

marrold

marrold

Any update on documentation for the LNS function?

marrold

Is there any documentation on using the LNS function?
What do you want to know ?

We have tested successfully with IOS & IOS-XE LAC.

I'm curious about the config and topology

marrold

Is there any documentation on using the LNS function?

marrold

Somewhere in the config for the LTE modem I'd expect it to say add-default-route. Turn it off.

marrold

A friend is currently trying to prevent NTP servers being announced to DHCP clients. The NTP sever is disabled, and no NTP server is set in the DHCP network section, but clients are still receiving NTP servers via DHCP (Its using those setup in the NTP client section) Any ideas? Thanks. [matthew@HQ]...

marrold

Sounds err, risky.

marrold

I don't understand I'm afraid. Could you perhaps draw a diagram, or explain what you want to go where?

marrold

A packet capture should help.

marrold

You've not really provided any information.

I suspect this is a config error

marrold

This sounds like a hardware issue, rather than a RouterOS issue

marrold

No problem, I'm glad it's fixed.

marrold

I believe you are seeing a private IP in the SDP because you have set 'SIP Direct Media' I'd try disabling it.

Ultimately, all SIP ALG's are usually not that great, and you should avoid using them where possible.

marrold

ACPI shutdown is a big one for me.

marrold

> please

Please try and give your posts a relevant title. It may get more attention and assistance, and it means something to other forum users.

marrold

Why not just prevent the user accessing RouterOS at all?

marrold

Post config + logs

marrold

For 10 routes why not use Ospf? Either way, I'm sure sure the HAP will cope

marrold

You have to mangle inbound traffic and make sure it routes back out via the same IP as it arrived on.

marrold

I have never considered this, I've always added separate NAT and filter rules.

Good to know

marrold

You will need NAT and Filter rules in the firewall.

marrold

What are you trying to achieve?

marrold

You'd have to post a full export for better diagnosis

marrold

Make a script, that calls the scripts.

marrold

You probably have the following rule or similar in your config-

/ ip firewall filter add action=accept connection-state=established

marrold

Just run RADIUS over an Encrypted tunnel, it should work fine.

marrold

For my own curiosity, please could you explain what this does that the Mikrotik can't do?

Thanks

marrold

Maybe something is bridging the reset pads on the PCB?

marrold

Can you advise why you're trying to achieve this?

marrold

Have the frequencies pretyped like when setting a plain AP without capsman instead of a text box.

Sent from my Nexus 4 using Tapatalk

You can set the channel rather than the frequency

marrold

I don't have the code to hand, but you might be best using a for loop and running :typeof dst-address

marrold

Have you tried the proposed fix in this thread?

marrold

What are you trying to achieve?

marrold

Interesting, I may well of had the same issue. I tried adding a new SSID to an existing Cap, and I couldn't get it to work.

If it's not possible to update settings, I am a sad panda...

marrold

Still no actual sources...

marrold

Have you ordered the CD containing the GPL licensed source code, and verified it violates the GPL ? http://www.mikrotik.com/downloadterms.html You mean to say that GPL community is lying deliberately to hurt MikroTik? Because there is (or at least there was) a lot of complaints from GPL fans about ...

marrold

Have you ordered the CD containing the GPL licensed source code, and verified it violates the GPL ?

http://www.mikrotik.com/downloadterms.html

marrold

Till November, guys.

Do you have a source for this info?

marrold

It depends on what side should be dynamic...

No it doesnt...

marrold

We're all still waiting, patiently!

marrold

Drop everything except whitelist is the right approach. If you need dynamic whitelist you would need to implement port knocking.

Port Knocking is not the right approach. It's a nasty hacky bodge.

The correct approach for VPN servers with roaming clients is to black list repeat offenders.

marrold

Unfortunately I haven't found a good way to do this with RouterOS alone. Using Certificate Auth will in theory make it incredibly hard to hack, but I'd still like more protection. One way that would work is syslogging logs to another linux server running Fail2ban, and detecting brute force attempts ...

marrold

Run a packet capture, see if DHCP is giving the IP

marrold

Have you done a packet capture?

marrold

We need more info on number of sites, topology, etc

marrold

Could someone help me understand how this is routed / delivered to the CPE? Traditionally with IPv4 I've always had a routed block (E.G a /28) delivered over a /30.

If you're only allocated an IPv6 /64 from your ISP, how do you route it?

marrold

It's called 'The Dude', but don't get too excited. Most people seem to complain it's not kept up to date.

marrold

Setup your masq rules separately, one for each out-interface? Then only NAT new connections? that way 'invalid' connections will die off on their own and start new ones?

But UDP connections don't 'die' as such?

marrold

It's unlikely a DNS server will make anything blazingly fast. It may shave a few milliseconds off...

marrold

Is this for termination / demarc, on the customers site but managed by the provider? These sort of devices are quite common in the UK and allow the provider to monitor both ends of the last mile.

marrold

I have found the same 'issue'. It doesn't just affect VPN connections, it also affects Multi-WAN setups. If a connection fails over to the secondary WAN link, then recovers to the primary, it will have the wrong IP. As you've discovered, you have to clear the connections. The best way to automate th...

marrold

Do not use '=' , use instead '~' to match dst-address and use double quotes .. /ip firewall connection remove [/ ip firewall connection find dst-address~"111.222.333.444:5060"] I'm curious, what benefit is this? You may, thanks. Setup a tik for WAN fail over using netwatch. I want to see ...

marrold

Whilst we're proposing changes to the LCD, could we also add the ability to add custom image or text?

marrold

Hey guys!!! :D Same thing here, setup the L2TP IPSEC with the MKT and realised people can connect without using the ipsec at all... making it not secure at all :p Found anything on how to "force" it ? Thanks ;) Check out the newish IPSEC policy matcher rules. Make sure you're on a new ver...

marrold

Sounds like you got ripped off

marrold

Sounds like you're using the Web interface. Don't

marrold

The services run locally on the firewall, I.E, The SSH service allows you to SSH into the router itself. Disabling it will prevent you using SSH to access the router.

Be careful when disabling services. I'd use safe mode.

marrold

I think it should be

 /ip firewall connection remove [/ ip firewall connection find dst-address=111.222.333.444:5060]

What's the reason you're doing this by the way? I work as a VoIP engineer so maybe I can help.

marrold

Sounds like some form of proxy-arp going on.

Yup

marrold

How do you manually remove the connection?

marrold

normis, any word on when we might be able to get a trial license w.o the 1mb restriction? would like to see how mikrotik handles 56gbe and 100gbe interfaces. Mikrotik answered this 3 weeks ago - All the details of the licensing scheme are not yet known or cannot be disclosed. For now, you have limi...

marrold

Use a VPN to become a member of the local LAN, and send your WOL packets that way. This is one method. Or you could setup an SSH client to remote into the router and you could run the inbuilt WOL tool on the router. You could probably automate this using something like JuiceSSH http://wiki.mikrotik...

marrold

I dont think this is possible. But, chances are you won't use it any way.

marrold

I only have these 2 rules in place for outside access + I have Faill2Ban configured on freepbx to protect against authentication attacks.

Fail2Ban won't catch everything. Be careful

marrold

Ideally we'd need packet captures to be able to diagnose this.

marrold

I will have to read the RFC's, but Im pretty sure it's Softether that's at fault and needs to be fixed.

marrold

It looks like your server is sending the value 1.0.0.1

Please see packet 19 in your PCAP

Googling "softether 1.0.0.1" suggests this is a common problem for SoftEther

marrold

I'm glad that's worked. However if you leave your PBX open to the world, you're likely to get hacked.

marrold

Thanks for the pointers. One more question if you don't mind, is there any reason to put public transit inside a VRF?

marrold

Ok, least we've clarified and confirmed the issue. I think the next step would be to capture packets of the L2TP tunnel negotiation itself, and see what's different. I can capture packets from a Mikrotik to Mikrotik L2TP tunnel, and we can compare the two.

marrold

Ok, the #1 packet in the sniffer log shows the packet is leaving the Ether2 interface, which is bad news.

Please could you post the output from-

/ ip route print

marrold

Before we can attempt to fix it, we need to know what's causing the issue, and what affect it has. This generally requires packet captures and some detailed diagnosis. Unfortunately this can be time consuming.

If you know a better way, please go ahead and let us know how you fix it.

marrold

I found this entry in the wiki which covers how to set this up - http://wiki.mikrotik.com/wiki/Manual:EBGP_as_PE-CE_routing_protocol I'm interested in both options, private and public transit. This is just for labbing currently, to get a better understanding of the technologies. I guess ideally I'd ...

marrold

Thanks. It could be getting dropped by a firewall, or maybe it's going out the wrong interface due to the incorrect network field. What happens if you run the sniffer on all interfaces? Do you see replies going out?

marrold

I'm afraid that file host site is a bit confusing as there's about 2000 download links, and most of them probably lead to some kind of Malware. Is there somewhere else you can host the file, like Dropbox or Google Drive?

marrold

Which interface did you run the sniffer on? Please could you provide a proper .pcap ?

marrold

When you ping from the VPN server, do you get a response?

Id like to see a packet capture of attempting to ping a remote address

marrold

Moreover, when I'm trying to ping IP address which was assigned to RouterOS client from VPN server side I see that ICMP packets is arriving RouterOS side according to packet sniffering logs. But connection doesn't work as it should (for example I can't ping remote gateway address) - I guess because...

marrold

Hi all,

I've setup a BGP / MPLS / VRF network as per the wiki http://wiki.mikrotik.com/wiki/Manual:La ... PN_example , where customers announce their routes via OSPF.

Is it possible for a customer to announce their routes via BGP?

Also, what is the 'proper', real world way to do this?

marrold

add chain=input dst-port=5060 log=yes protocol=udp
add chain=input dst-port=10000-20000 log=yes protocol=udp

These rules should be in the forward chain.

marrold

I'm not 100% sure, but I belive you need to place files you want to survive a reboot in the /flash dir

marrold

I'm not 100% sure, but I belive you need to place files youbwajtbto survive a reboot in the /flash dir

marrold

Bumping for visibility

marrold

Please post

/ file print

marrold

voip + nat = problem

Complete bullshit. It can be a problem, but 9 out of 10 times it can be made to work.

Especially with a Mikrotik

marrold

it doesn't seem to work

This is incredibly vague, we need more info.

marrold

you can easily create an issue where trafic comes in the one interface and leaves the other.

If this happens unintentionally, you've made a mistake I'm your config.

marrold

This was added recently but I can't find the relevant change log

marrold

The statement is true, but I dont understand how it applies to forcing IP Cloud to use a specific interface? Traffic would go in and out the same IP.

marrold

I've not come across the 2048 limit but I deal with a low number of connections usually.

Quickest way
/ ip firewall connection tracking set enabled=no
/ ip firewall connection tracking set enabled=yes

marrold

If that option existed you would very easily force cyclic data, Its better for the Tik to communicate back out the interface it receives the data especially for secure data.

I dont understand what you're saying, sorry

marrold

Have you tried the latest firmware?

marrold

It could be someone attempting to brute force your VPN

marrold

Only on old Firmware Versions.

On newer Firmware only with verbose the Mac Address will be copied.

Wow, I didn't know this. Is there a source / link ?

marrold

All of it, if possible.

marrold

Please could you post your config?

marrold

This option exists but I can't test it -

/interface wireless wps-push-button

The hAP lite also has a WPS button

marrold

Do you know any other manufacturer that has an open forum to debate and discuss new products? Apple release the same handset in a slightly different case with a handful of extra features that other handsets have had for years, and people go crazy and queue up to buy one. So long as Mikrotik are prof...

marrold

I think it's a bit early to be screaming for Mikrotik Support.

What methods have you used to debug this issue? Do you have packet Captures?

What aren't you able to access on the remote side? Do you have a diagram?

marrold

basically you have a DynDNS style service for your remote site... run a script on your main site to grab the new IP and then update the IPSec policy, proposal, etc

The IPSEC server could generate a dynamic policy.

We could do with more information, or a network diagram ideally.

marrold

It was a NAT issue. Problem solved.

marrold

So I've made some more progress, the GRE tunnel isnt hitting the IPSEC Policy because it's coming from the wrong IP address. Does anyone know why this is? /tool sniffer> packet print # TIME INTERFACE SRC-ADDRESS DST-ADDRESS IP-PROTOCOL SIZE 0 0.322 WAN01 80.229.147.168 198.18.0.1 gre 84

marrold

Use RADIUS? http://wiki.mikrotik.com/wiki/Manual:Router_AAA

marrold

Hi all, Ive spotted an issue with my IPSEC policy matching and Im struggling to fix it. Currently traffic that should hit the policy is being sent out the default route. This same configuration is working on another router, and was working previously. The intention is that a IPSEC tunnel is configur...

marrold

@marrold: Why ? Whats wrong with sandwich-like router+server. People are asking MikroTik for WWW, HSF+, print-server, AFP, barbecue grill, coffe-machine etc. integrated into RB. RB mAP 2n seems to be good start for such project. If you want a 'sandwich-like' router + server, get some half decent ha...

marrold

I use something similar to the below, scheduled to run at a regular interval. The script assumes your "WAN" interface is called "01 - WAN". It also sets the policy src-address and dst-address to /32's assuming an L2TP connection is encrypted between the two. You could edit this i...

marrold

DNS providers do get upset if you send to many queries.

https://help.dyn.com/standard-dns/i-rec ... r-queries/

marrold

Sure, I'd only be updating the IP address everynow and then, but I'd also be querying it every 10 seconds too

Search found 428 matches