MikroTik

bds1904

You can't simplify this. Each situation is different. For example some people may be behind ISP's NAT and use RFC1918 address... blocking bogons might break this... In addition, these "premade" rules may be incompatible with existing setting etc... If you have a single change against defc...

bds1904

I understand that they are there but not logging into the terminal and running a bunch of commands would be nice for the average user. Not looking through the wiki would be nice also. Click button, get firewall rules. There’s nothing wrong with adding some simple features via a wizard. It’s when the...

bds1904

Please add a button that will add certain common, basic firewall rules. For example, on ip/firewall/rules add a winbox button called "add basic rules wizard". Have this button generate a series of check-boxes that can be selected from to add basic firewall rules based on your LAN/WAN lists...

bds1904

I have a very similar SM fiber link that has been in production for a few years. I actually used SFP’s from FS.com because they were the only ones that I could find 10km rated BiDi SFP transceivers they weren’t crazy expensive. The transmit power on the pair I use is -5db and they are currently runn...

bds1904

I have 2 RB3011 devices in the field running Capsman. Attached to the RB3011 there are several different types of CAP's ranging from RB951 to hap AC lite, wAP AC and HAP AC. The issue is whenever "local forwarding" is not enabled a wireless speed test is limited to 75Mb/45Mb on speedtest.n...

bds1904

Now that I have some more experience with using routerboard LTE hardware on the AT&T network I figured I would share my experience. I have an unlimited plan, it’s one of the older plans that they don’t sell anymore. I do have a grandfathered “ZTE home phone with internet” on the account. I have ...

bds1904

That’s the card I use. Did you install the thermal pad? I haven’t had a bit of trouble and the wAP R is exposed to direct sunlight in 100F weather on a regular basis.

The thermal pad goes between the LTE modem and the wAP R board. It dissipates heat in a similar way to the M.2 SSD thermal pads.

bds1904

I put mine between the modem and the mainboard, similar to a M.2 SSD setup that dissipates the heat into the mainboard.

bds1904

My HAP AC is in my non-heated garage, it’s 5C outside and the SFP is running at 43C. My rb3011 is in my basement which is 20C and it’s SFP is running at 31C. Identical SFP modules Yes, the HAP AC does something that makes the SFP run hotter. Does it matter? Not in my experience even using cheap FIbe...

bds1904

I’ve seen this before on non-Mikrotik products before, specifically Pace & Arris products. Pace told me the noise was due to a batch of bad of parts that whine/squeal under load. I don’t remember what part it was but it had something to do with power regulation to the radios.

bds1904

I have 3x WAP AC’s, one HAP AC and 2x WAP’s all running in CAPSMAN controlled by a 3011. That being said I regularly see 250mbit thruput on dual chain AC devices. No issues with stability, latency or thruput. While running capsman the WAP AC is limited to about 250-300mbit before it gets close to ma...

bds1904

Caps man isn’t overkill at all for 2 AP’s, it’s the right way to do it. It actually makes roaming work correctly.

bds1904

If you have any Routerboard devices with an SFP+ port you can add a S+RJ10 and end up with a copper 10Gb port. Not ideal for an entire switch by any means but if you just have a couple devices on 10Gb copper Ethernet it's a decent solution.

https://mikrotik.com/product/s_rj10

bds1904

I would set up a Capsman server on the main router, add the wireless interfaces from the main router as a Capsman client then set up the second device as a Capsman client as well. There are several guides and HowTo's around. Be sure to enable client-to-client forwarding otherwise some devices will h...

bds1904

I don’t use local forwarding because it makes the handoff from AP to AP take longer.

bds1904

You forgot to enable client to client forwarding in datapath

bds1904

Mikrotik has been making them for years.

S-3553LC20D For SFP

S+2332LC10D For SFP+

They come in matched pairs to make it easier to order.

bds1904

Upgrade 3x CRS326's with no issues. 2.5 working with 803.2ad LAG in passive mode, connected device is a NAS 2.5 Fixed the following issues for me: Issue where switch sometimes wouldn't list hosts Now properly reports the FS.com DAC, before a temp and power level would be reported, the DAC does not h...

bds1904

They work just fine in every single Routerboard router and switch over ever put them in. I use them for single-fiber links to outbuildings quite often. I just get the "Generic" fs.com ones. I've even used a 10gb SFP+ BiDi before.

bds1904

Just because it's a router doesn't mean you will be using it for "routing". Many people use the hex Poe Lite for a capsman server, works great. The rb260gsp can't run full RouterOS so it cannot run capsman.

bds1904

The issue with the gpon onu on different providers networks lays with the providers. Gpon provisioning is done on the olt. The ONT works with the olt to handle encryption and upstream time slots. Long story short, you can only use the gpon onu if the provider lets you. No provider with a standard ro...

bds1904

An integrated VDSL modem in mikrotik products would be useless for 90% of providers. Most providers nowdays use a 802.1x certificate for authentication. The authentication certificate renders an aftermarket modem useless as it is provided on the modem by the ISP.

bds1904

Do you know if RouterOS supports these products without hardware driver issue? The quad-nic box is a J1900 (2GHz processor) that has all intel NIC's. There is no reason RouterOS won't support everything natively. The only issue will be the disk. You will likely have to force the disk into IDE mode ...

bds1904

1st issue is that RouterOS only supports TCP OpenVPN, that's it. UDP is not supported in any way and they say it won't ever be. OpenVPN? Mikrotik doesn't have one. OpenSSL is 100% CPU based and single threaded. In order to achieve what you want you will need a high-mhz CPU. X86 is really the only op...

bds1904

ONU.jpg
OLT MK1.png

You are on EPON, the mikrotik onu is a GPON device. Completely different standards.

bds1904

I don't think it's a "lesson" as much as a "warning" and letting mikrotik know there is room for improvement. Water for inside after heavy blowing rain. While that doesn't mean the product is flawed, it means there is room for improvement in the design. The "flap" desig...

bds1904

Here is my general firewall I use, edit address and interfaces as needed of course: /ip firewall address-list add address=xxx.xxx.xxx.xxx/xx disabled=no list=support /ip firewall address-list add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" disabled=no list=bogons add address...

bds1904

Sounds like a DNS amplification attack is being ran off your router. Is TCP/UDP port 53 open to the outside world? Sounds like you need to reevaluate your firewall rules.

bds1904

I always thought my 750up ran hot. It ran 55c indoors with a light load when ambient was 24c.

Crack it open and add some heatsinks.

bds1904

Now if we could get a routerboard based on AppliedMicro X-Gene ARMv8-A architecture. 4x 10Gb SFP+, 2-4 1Gbe interfaces, large amount of memory and 8-16 2.4GHz cores.

That would be the stuff!

bds1904

RouterOS NEEDS OpenVPN UDP support. Every single TCP based site-to-site VPN is SLOW when you are using any ISP provided modem/gateway combo (even if you are using ISP provided static IP's and are bypassing the ISP's hardware's NAT table). Example, AT&T Uverse: If i disable ALL FIREWALL rules and...

bds1904

The crs212 page specifies it comes with rackmount ears

bds1904

Did you configure vlans in the switch menu or through the regular routeros interface? Vlans configured through interfaces> vlan will be handled by the cpu not the switch chip. Refer to the manuals for swos when configuring the vlans, the setup is exactly the same. Routing between vlans will still be...

bds1904

Still use eoip and ipsec. Let's assume the following: Site 1 public ip 1.1.1.1 site 1 public ip 2.2.2.2 site 1 private subnet 192.168.1.0/24 Site 2 public ip 9.9.9.9 site 2 private subnet 192.168.254.0/24 Create your ipsec and eoip tunnels as usual but be sure to include source address as well. Assi...

bds1904

Like others have said, a 2011 can handle 200-300mbps nat with minimal rules. With a good firewall 230mbps is the limit of the 2011. Not 230mbps/230mbps, 230mbps TOTAL. If you need traffic shaping, don't bother with the CRS109. If you just need a NAT router with a good firewall, it'll work but you wi...

bds1904

try making sure that making sure "aes ccm" & "tkip" encryption is enabled.

bds1904

make sure you set the SATA mode to IDE.

The installer should detect the HDD after that.

bds1904

Here we go again. Switch by definition just connects wires. This means that whatever you put in, will go out. Same speed. So ... Throughput and switching capacity is the same, as the number of ports. Wire speed His question is very, very valid. Blowing him off with a smartass answer is very, very u...

bds1904

IMHO the FTC isn't suited to be a proper FTTP device because it doesn't have provisions for a proper fiber demarc. Using the FTC would require mounting a separate fiber demarc enclosure on the outside of the prem.

bds1904

When I get my hands on one I may seriously consider using these in active ethernet fttp deployments. The only downside is that I would still need another box outside the house for the drop to enter and provide slack. If only the bottom compartment was big enough for a few loops of fiber and had a wa...

bds1904

Enable the openvpn client to accept an ipv6 address as a valid target address

bds1904

The RouterOS OpenVPN client does not allow an IPv6 address to be entered into the "Connect to" field.

bds1904

Yes, like that but supported officially by mikrotik and an official supported power supply included. When it comes to powering devices most people want to use an official device to reduce "unknowns". If the majority of mikrotik wap's supported 802.3af to 100% of the specification powering ...

bds1904

Offering a multi-port passive POE injector in both surface mount and rack-mount flavors would be great. Have a single 5A AC/DC power supply, 12 ports of LAN in, 12 ports of LAN+POE out on the rack-mount, 8 on the passive. The product would enable customers to use multiple AP's and whatever switch th...

bds1904

Create a ovpn server binding for the associated user. That will make it so the name never changes even if there is a short drop.

bds1904

Delta 250w power supplies? Awesome. If they are delta's then you'll be able to find 48v versions. Delta makes lots of telcom-targeted power supplies.

bds1904

upgrading to 6.19 (from 6.18)broke the config on my x86 box. It broke the mangle rules (i use them for PCC load balancing) and the route rules. I confirmed the problem twice by downgrading, restoring from a backup config and upgrading again. The config remained broken even after downgrade. I was abl...

bds1904

I really like the form factor, but if mikrotik doesn't come out with an indoor dual band ap soon I'll be moving away from mikrotik for ap's. Dual band is even becoming necessary in medium size business and hotspot applications, and it has been for a long time in smb. EVERYONE else has an ap that fit...

bds1904

What is your total bandwidth requirements? You speak of 3 or 4 WAN connections in pcc, that means that you could be looking at 8gbps throughput. At those speeds over x86 hardware you need to start looking at your pcie bandwidth and the block diagram of the motherboard to make sure it can handle the ...

bds1904

MikroTik RouterOS v6, Level 5 license, free product lifetime upgrades Is this the new "official" approach? No more "upgradable to" statement? This has been the case for a long time. The "upgradeable to" field is deprecated. funny, because every device I own still has t...

bds1904

I run a Core2Duo x86 (2x 2.2GHz cores) w/ routeros and it'll route about 1.6Gb effectivly; even with full firewall, vpn servers with 4-5 clients all the time, mangle rules and traffic shaping. It's a HP SFF system I picked up off ebay for about $45, put a couple PCIe NIC's in ($30) plus a $40 Router...

bds1904

Nat performance will depend on your firewall and queue tree settings and size. The more rules you have the more cpu you need. Small Business will be able to get away with a 2011 series (or 951-2nhd). With a good firewall it'll do about 140mbit. If you intend on any kind of queue tree, traffic shapin...

bds1904

Leave auto negotiation on for the 260gsp and uncheck the 10mbps and 100mbps advertize options on the hardware that is gigabit enabled. I have had this problem with a few gigabit 951 boards.

bds1904

Dear Mikrotik, are you planning to release CRS switches with two SFP interfaces? +1 from me for that too. And on top, if you are working it out a nice CRS1072-24S with 24 SFP ports would also be a good idea. more like a switch with 24 sfp and 2 SFP+, perfect for active ethernet ftth deployments. af...

bds1904

Don't get me wrong, I like mikrotik and routerboard products a lot and they have great support. That being said releasing products "on time" isn't one of their strong suits. If they say Q1 2014 first, expect second half of Q2 or Q3. Getting hardware from design to 1st concept to engineerin...

bds1904

This guide assumes the following: "ISP1" is your 1st wan connection name "ISP2" is your 2nd wan connection name "LAN" is your local network name "ISP1" recieves the IP 111.111.111.1/24 on the network 111.111.111.0/24 "ISP2" recieves the IP 222.222.22...

bds1904

Yep, RB1100AHx2 will do it just fine.

The CCR-1009 would also handle it just fine, but that isn't out yet.

bds1904

RB2011UAS-RM 6.7 to 6.9 breaks PCC routing with 2 WAN connections

the second interface is not accessible when the first is enabled

downgrade to 6.7 and it works just fine

bds1904

everything you listed is dst-nat to 192.168.1.1. should be dst-nat source "public address" to "private address" & src-nat source "private address" to "public address" example: dst-nat source WAN 10.1.1.1 to address LAN 192.168.1.1 src-nat source LAN 192.16...

bds1904

Considering 99% of the data transferred with typical file transfers is TCP, your tests are accurate. I have a 2011-UAS and it maxes out at about 130mbps or so TCP routing. If you have two computers on two subnets, you are routing data between them. You are maxing out the CPU. You can confirm that b...

bds1904

Considering 99% of the data transferred with typical file transfers is TCP, your tests are accurate. I have a 2011-UAS and it maxes out at about 130mbps or so TCP routing. If you have two computers on two subnets, you are routing data between them. You are maxing out the CPU. You can confirm that by...

bds1904

rb2011 will do sha aes-256bit ipsec at about 11mbps before maxing the CPU. The RB951G-2HnD has the same processer and wifi.

The RB1100AHx2 is the best option for you because of the hardware aes support.

bds1904

i have the 2011 and it can do about 160mbps NAT routing before it maxes out the CPU.

The RB1100AHx2 will be able to handle that just fine, plus it has hardware encryption capabilities for VPN, very handy.

Search found 63 matches