Community discussions

MikroTik App

Search found 177 matches

by Ape
Thu Feb 21, 2019 11:41 am
Forum: General
Topic: vlan question
Replies: 6
Views: 843

Re: vlan question

Hi,

yes you can.

Merge bridges, add appropriate VLAN interfaces, so CPU has access to VLANs and then move your DHCP servers and IP adresse to those VLAN interfaces.What you want to do is doable with one bridge an VLANs.

Regards,
Ape
by Ape
Fri Jan 11, 2019 4:25 pm
Forum: Forwarding Protocols
Topic: OSPF load balancing
Replies: 8
Views: 2428

Re: OSPF load balancing

Hi It depends entirely on your architectural solution. I would not drive client services through ospf. Use mpls + mp/bgp. I second this. Use MPLS/VPLS and centralize your PPPoE dialins to one server. MPLS should be the transport layer for your customer's traffic. It would be possible to just use the...
by Ape
Fri Jan 11, 2019 3:58 pm
Forum: Forwarding Protocols
Topic: 6.4x OpenVPN + OSPF trouble
Replies: 8
Views: 3787

Re: 6.4x OpenVPN + OSPF trouble

Hi,

if you only need to connect MT devices, you could use another VPN technology like IPSec/L2TP.
I like MT very much, but their OpenVPN implementation is known to be rudimentary.

Nonetheless, this should be fixed.

Regards,
Ape
by Ape
Fri Jan 11, 2019 3:54 pm
Forum: General
Topic: ppp,error,critical Encryption got out of sync - disabling
Replies: 4
Views: 3596

Re: ppp,error,critical Encryption got out of sync - disabling

Hi,

AFAIK this could be due to high packet loss or packet reordering.
Can you dismiss these possible issues?

Regards,
Ape
by Ape
Wed Jan 09, 2019 2:09 pm
Forum: Forwarding Protocols
Topic: OSPF load balancing
Replies: 8
Views: 2428

Re: OSPF load balancing

Hi,

it's totally possible with MikroTik and OSPF.

Have a look at this great talk:

Video: https://www.youtube.com/watch?v=dFZz2z6RdQY
Presentation: https://mum.mikrotik.com/presentations/ ... 062656.pdf

Regards,
Ape
by Ape
Wed Jan 09, 2019 1:41 pm
Forum: General
Topic: ethernet - fiber adapter from mikrotik
Replies: 1
Views: 424

Re: ethernet - fiber adapter from mikrotik

Hi, normally, you look at this the other way round: Chose your media converter (copper / fibre) and then chose the SFP(+) transceiver accordingly. There is no need to use a SFP transceiver from the same manufacturer on both ends. It's only necessary to match SM/MM, distance and wavelength. In your c...
by Ape
Fri Dec 21, 2018 3:10 pm
Forum: General
Topic: Selective VPN with different routes?
Replies: 2
Views: 550

Re: Selective VPN with different routes?

Hi,

you could use PPP profiles and execute scripts on Up and on Down to set/unset firewall rules or better adress list entries.
I didn't do it myself, but I think this should be possible.

Regards,
Ape
by Ape
Fri Dec 21, 2018 1:45 pm
Forum: General
Topic: VPN Tunnel Sophos UTM and Mikrotik
Replies: 7
Views: 1815

Re: VPN Tunnel Sophos UTM and Mikrotik

Hi, thank you for providing the additional information. Unfortunatelly, I don't understand what I see as the IP adresses in your config are other IP adresses than in your diagram. From the UTM's log you provided, I can see a peer ID of "192.168.178.84" is used. This looks like an IP from the LAN of ...
by Ape
Fri Dec 21, 2018 12:36 pm
Forum: General
Topic: Problem with OpenVPN client - TLS failed
Replies: 4
Views: 4984

Re: Problem with OpenVPN client - TLS failed

Hi,

what about the remote side?
Any logs from there?

Regards,
Ape
by Ape
Fri Dec 21, 2018 12:33 pm
Forum: General
Topic: Impossibile to downgrade from 6.42.7 ?? [SOLVED]
Replies: 2
Views: 503

Re: Impossibile to downgrade from 6.42.7 ?? [SOLVED]

Hi,

maybe this is related to the bridge functionality change starting with ROS 6.41.
Try netinstalling the devices instead of downgrading.

Regards,
Ape
by Ape
Fri Dec 21, 2018 12:31 pm
Forum: General
Topic: Migrating self signed CA
Replies: 10
Views: 3283

Re: Migrating self signed CA

Hi, I've no idea whats wrong - as you described the situation, everything is good IMO. Nevertheless, the error message clearly says that the server cannot verify the client certificate. Did you try to restart the OpenVPN server? (disabling and reenabling it) and/or restarting the CCR? Regards, Ape E...
by Ape
Fri Dec 21, 2018 12:24 pm
Forum: General
Topic: VPN Tunnel Sophos UTM and Mikrotik
Replies: 7
Views: 1815

Re: VPN Tunnel Sophos UTM and Mikrotik

Hi, I'm sorry, but you didn't provide any useful information about cour config to help you. Please post your config and exclude an sensitive data. What's in the logs of your MikroTik? Add a log rule in "System" -> "Loggin" with "debug" and "ipsec" to see what is happening. Next thing, depending on y...
by Ape
Thu Dec 20, 2018 12:01 pm
Forum: Forwarding Protocols
Topic: VPLS link
Replies: 6
Views: 1401

Re: VPLS link

Hi, thank you for reporting back. I drop just some thoughts: You can try "mtr -n --mpls" to determine the hop causing the packet loss Check if there are devices in the path with high CPU load, respectivly high single core load Is there an rate limit for ICMP packets? Is this limited to ICMP or is th...
by Ape
Wed Dec 19, 2018 4:26 pm
Forum: Forwarding Protocols
Topic: VPLS link
Replies: 6
Views: 1401

Re: VPLS link

Hi, just ping with "dont fragment" option set. Start with a payload if 1472 bytes (ICMP & IP Header is 28 bytes in total, so you have a size of 1500 bytes). Then, decrease payload size till ping goes through unfragmented. Take the value of your payload and add 28. Thats you actual MTU. Edit: Mke sur...
by Ape
Wed Dec 19, 2018 3:09 pm
Forum: General
Topic: slow masquerade ?
Replies: 7
Views: 1030

Re: slow masquerade ?

Hi, thank you for providing the diagram! chain=prerouting action=passthrough chain=prerouting action=accept src-address=192.168.5.0/24 dst-address=10.10.0.0/24 chain=prerouting action=notrack src-address=192.168.5.0/24 dst-address=10.10.3.0/24 chain=prerouting action=notrack src-address=10.0.0.0/8 d...
by Ape
Wed Dec 19, 2018 2:29 pm
Forum: General
Topic: public interface
Replies: 1
Views: 347

Re: public interface

Hi, as you are using a very old release of RouterOS, you are probably affected by some of the security issues discovered in RouterOS. There are several official announcements from MikroTik about these issues: https://blog.mikrotik.com/security/new-exploit-for-mikrotik-router-winbox-vulnerability.htm...
by Ape
Wed Dec 19, 2018 2:13 pm
Forum: General
Topic: problem with firewall
Replies: 2
Views: 400

Re: problem with firewall

Hi,

I don't understand what you try to achieve.
If you have correct firewall rules before your last deny rule, you should be fine.

If you're using winbox, make sure, you display the rules in the order, they will be applied.
To ensure this, you need to click on the "#" column in Winbox.

Regards,
Ape
by Ape
Tue Dec 18, 2018 12:38 pm
Forum: General
Topic: Best VPN
Replies: 24
Views: 17171

Re: Best VPN

Hi, coming back to the intial issue, I would like to contribute some technical facts. You need to chose the VPN technology according to your limiting factors. These could be: - NAT/CNAT (https://en.wikipedia.org/wiki/Carrier-grade_NAT) - dual-stack lite (https://en.wikipedia.org/wiki/IPv6_transition...
by Ape
Tue Dec 18, 2018 11:51 am
Forum: General
Topic: slow masquerade ?
Replies: 7
Views: 1030

Re: slow masquerade ?

Hi, what do you mean by within the 10 network, 10.10.3 has default route of the mikrotik (10.10.0.1), the 10.10.0 machines do not, so has to be masqueraded Can you please provide a simple network diagram. I can just guess that you have some sort of asymmetric routing on one site with ICMP redirect i...
by Ape
Mon Nov 26, 2018 11:47 am
Forum: Forwarding Protocols
Topic: OSFP Keeps Losing Routes!!! [SOLVED]
Replies: 11
Views: 3178

Re: OSFP Keeps Losing Routes!!! [SOLVED]

Hi, thank you for the description of your solution. As we have the same tunnel IP setup just with L2TP/IPsec tunnels, I was very interested reading that you changed the tunnel IP addresses. I didn't do that but I set all "non OSPF" interfaces to "passive". Since I did that, the issue with dropped ro...
by Ape
Wed Nov 07, 2018 9:54 pm
Forum: General
Topic: Disable port - "Couldn't change interface"
Replies: 1
Views: 998

Re: Disable port - "Couldn't change interface"

Hi, I can confirm the exact same behavior on a hEX. Did you upgrade from a pre 6.42 RouterOS version? My guess is, that this is an remainder of the auto-conversion of the old master-port configuration method to the new HW accelerated bridge feature. I'll try to reset this device an re-apply an expor...
by Ape
Sun Oct 21, 2018 11:58 am
Forum: Forwarding Protocols
Topic: OSFP Keeps Losing Routes!!! [SOLVED]
Replies: 11
Views: 3178

Re: OSFP Keeps Losing Routes!!! [SOLVED]

Hi there, that's quite interesting, as we've contacted MikroTik regarding a very similar issue with OSPF. It's the same behavior somone mentioned earlier in this thread: OSPF works fine for hours, days, weeks and suddenly the "core" router (hub and spoke VPN setup) stops propagating the route of it'...
by Ape
Sun Jan 21, 2018 12:31 am
Forum: General
Topic: Can someone please check this CRS configuration
Replies: 0
Views: 450

Can someone please check this CRS configuration

Hi, I just bought two CRS210-8G-2S+IN. They configured exactly the same: Ports ether1 to ether4 are access ports for VLAN 100. Ports ether5 to ether8 are access ports for VLAN 200. Port sfp-sfplus1 is the trunk port. I followed https://wiki.mikrotik.com/wiki/Manual:CRS_examples#Port_Based_VLAN to do...
by Ape
Tue Oct 24, 2017 3:52 pm
Forum: General
Topic: L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal
Replies: 4
Views: 1251

Re: L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal

Hi,

thank you for your response!
Good to know.

Any chance to get the ability to see the PFS status in future ROS versions?
I'm okay with your answer but I know for sure some people (customers for example) want to see if PFS is "really" working.

Regards,
Ape
by Ape
Mon Oct 23, 2017 3:55 pm
Forum: General
Topic: L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal
Replies: 4
Views: 1251

Re: L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal

Hi emils, thank you very much for your answer. In fact I was looking for the flag in the SA table. Is there a possibility to check if PFS is used for the established SAs? I used /ip ipsec installed-sa print detail which gives quite a lot of details but no indication if PFS is used or not. Regards, Ape
by Ape
Mon Oct 23, 2017 2:24 pm
Forum: General
Topic: RB2011iL-RM - How many OVPN tunnels ?
Replies: 1
Views: 524

Re: RB2011iL-RM - How many OVPN tunnels ?

Hi,

the RB2011 has a 600MHz CPU.
It won't be able to handle the traffic of 15 branch offices.

Have a look at the hEX, RB1100AHx4 or CCR1009. Those seem to fit your needs.

Regards,
Ape
by Ape
Mon Oct 23, 2017 2:21 pm
Forum: General
Topic: L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal
Replies: 4
Views: 1251

L2TP/IPsec - Perfect Forward Secrecy / use of the default IPSec proposal

Hi, I've a lab setup, where several RouterBoards should connect to a central VPN server (also Routerboard). I successfully configured a L2TP server and the client RouterBoards establish the L2TP tunnel ("Use IPSec" is checked). According to the IPSec SA table the L2TP sessions are encrypted, but not...
by Ape
Wed Oct 18, 2017 6:01 pm
Forum: General
Topic: Weird public IP to private IP problem
Replies: 3
Views: 600

Re: Weird public IP to private IP problem

Hi,

just defining DST-NAT rules isn't the whole thing, because it only handles incoming traffic.
You need to define corresponding SRC-NAT rules aswell.

Regards,
Ape
by Ape
Wed Oct 18, 2017 5:49 pm
Forum: General
Topic: Blocking interVLAN traffic
Replies: 4
Views: 1041

Re: Blocking interVLAN traffic

Hi, in case you have configured the VLANs as VLAN interfaces on a RouterBoard, just add the VLAN interfaces in a interface list and create a block rule in forward chain with this interface list as source and destination. Edit: I just saw the answer posted before mine. This is the simplest solution, ...
by Ape
Tue Oct 17, 2017 4:50 pm
Forum: General
Topic: Forwarding to second External IP
Replies: 5
Views: 1185

Re: Forwarding to second External IP

Hi, it depends on how you realise the forwarding. If you forward traffic on a specific port on 1.1.1.1 to 2.2.2.2 and you use SRC-NAT, the traffic will go through 1.1.1.1. If you don't use SRC-NAT you could end up having an asymmetric path from client to 1.1.1.1 to 2.2.2.2 and from there directly ba...
by Ape
Wed Oct 11, 2017 8:37 am
Forum: General
Topic: NAT helper strange issue
Replies: 3
Views: 744

Re: NAT helper strange issue

Hi,

you can try to disable the ftp service port in the routers's firewall settings.

Is the configuration on both CCR identical regarding NAT and firewall?

Regards,
Ape
by Ape
Mon Oct 09, 2017 3:29 pm
Forum: General
Topic: Odd VOIP Behavior on Mikrotik 3011
Replies: 12
Views: 1300

Re: Odd VOIP Behavior on Mikrotik 3011

Hi, yes, these two values are especially relevant for SIP/RTP. I can't give a general advice which values to set in your case, but it's worth trying to slightly increase these values. Furthermore, have a read of this thread: https://forum.mikrotik.com/viewtopic.php?t=85039 Usually, the problem is th...
by Ape
Mon Oct 09, 2017 1:36 pm
Forum: General
Topic: RB750Gr3 6.40.4 CBWFQ QoS?
Replies: 3
Views: 1003

Re: RB750Gr3 6.40.4 CBWFQ QoS?

Hi,

indeed, without further configuration (mangling your traffic), you cannot use both, queues and fasttrack.

Please read viewtopic.php?t=98133 as reference.

Regards,
Ape
by Ape
Mon Oct 09, 2017 11:46 am
Forum: General
Topic: Odd VOIP Behavior on Mikrotik 3011
Replies: 12
Views: 1300

Re: Odd VOIP Behavior on Mikrotik 3011

Hi, as troffasky already stated, most of the time these issues occur in conjunction with ALG settings. Another thing to look at: As the firewall is stateful and UDP (which is used fpr SIP) is stateless, the firewall emulates stateful UDP connections by maintaining timers for those UDP connections. A...
by Ape
Wed Jul 05, 2017 11:56 am
Forum: Forwarding Protocols
Topic: OSPF stuck at Init State
Replies: 3
Views: 1466

Re: OSPF stuck at Init State

Hi,

your OSPF config export seems incomplete.
Please post a complete OSPF config, so we can try to help you.
Use a code block to format it a little.

Thank you.

Regards,
ape
by Ape
Wed May 31, 2017 4:26 pm
Forum: General
Topic: CCR1072 950 pppoe connection cpu overload when pppoe disconnected
Replies: 11
Views: 2293

Re: CCR1072 950 pppoe connection cpu overload when pppoe disconnected

Thanks Louis.

I had this talk in mind while writing my post.
by Ape
Wed May 31, 2017 4:10 pm
Forum: General
Topic: CCR1072 950 pppoe connection cpu overload when pppoe disconnected
Replies: 11
Views: 2293

Re: CCR1072 950 pppoe connection cpu overload when pppoe disconnected

Hi,

are you using NAT masquerade on the CCR?
If you you do and you have a static public address, use a static srcnat instead.

Regards,
Ape
by Ape
Thu Apr 06, 2017 3:58 pm
Forum: General
Topic: High TX on WAN1 Interface.
Replies: 9
Views: 1226

Re: High TX on WAN1 Interface.

Hi, simply spoken, these "bad guys" use your DNS resolver to amplify there attack. They send DNS "small" requests (just a few bytes) with a spoofed source IP address. Your DNS resolver answers to the spoofed source IP address with a much larger response, resulting in an amplification of the original...
by Ape
Wed Apr 05, 2017 11:02 pm
Forum: General
Topic: High TX on WAN1 Interface.
Replies: 9
Views: 1226

Re: High TX on WAN1 Interface.

Hi,
Yes it was DNS issue. After disabling DNS, it is working normally.
Running the DNS cache is not your problem. It's not having appropriate firewall rules.
Please do yourself and the rest of the internet the favor of securing your device!

Regards,
Ape
by Ape
Wed Apr 05, 2017 2:04 pm
Forum: General
Topic: routed segments traffic pass through backbone router
Replies: 10
Views: 1298

Re: routed segments traffic pass through backbone router

Hi, relying on ICMP redirect is a bad pratice in my opinion. You need to configure your devices to accept ICMP redirects. For the mikrotik routers: /ip settings set accept-redirects=yes /ip settings set send-redirects=yes I suggest, you create some sort of transfer network segment and use OSPF in th...
by Ape
Wed Apr 05, 2017 1:57 pm
Forum: General
Topic: High TX on WAN1 Interface.
Replies: 9
Views: 1226

Re: High TX on WAN1 Interface.

Hi,

please provide the following information:
/ip firewall filter export compact
/ip dns export compact
Additionally, do another torch, this time, check "Protocol" and "Port".

I suppose you're accidentally running an open DNS resolver.

Regards,
Ape
by Ape
Thu Mar 16, 2017 11:55 pm
Forum: General
Topic: Strange behavior - Secure connection failed
Replies: 3
Views: 997

Re: Strange behavior - Secure connection failed

Hi,

thank you for letting us know!

Just one objection: Wouldn't it be nicer to use a mangle rule to change outgoing MSS for these connections?

Regards,
Ape
by Ape
Thu Mar 16, 2017 11:51 pm
Forum: General
Topic: Yet another "dhcp,warning offering lease without success" issue
Replies: 38
Views: 15314

Re: Yet another "dhcp,warning offering lease without success" issue

Hi,

I observed DHCP problems in conjunction with

- wrong MTU setting (expecially along with VLAN),
- no Admin MAC on bridge interface
- STP configured on bridge running DHCP

Apart from layer 1 problems, these points are most of the time the cause of all trouble.

Regards,
Ape
by Ape
Wed Mar 08, 2017 6:01 pm
Forum: Announcements
Topic: Statement on Vault 7 document release
Replies: 92
Views: 54797

Re: Statement on Vault 7 document release

Hi,

thank you very much normis!
This is a real professional handling of the situation.

Regards,
Ape
by Ape
Tue Mar 07, 2017 10:24 am
Forum: Wireless Networking
Topic: Remove RBwAP2nD from CAPsMAN
Replies: 1
Views: 1087

Re: Remove RBwAP2nD from CAPsMAN

Hi Roland,

simply disable CAP for the WLAN interface:
CAP01.png
CAP02.png
Regards,
Ape
by Ape
Mon Mar 06, 2017 10:53 pm
Forum: General
Topic: VOIP failure
Replies: 1
Views: 428

Re: VOIP failure

Hi,

if your can dismiss your router's firewalling / NATing, you'll need a SIP trace from your customers.

Regards,
Ape
by Ape
Mon Mar 06, 2017 10:14 pm
Forum: General
Topic: L2TP Client Default IPsec Settings
Replies: 3
Views: 655

Re: L2TP Client Default IPsec Settings

Hi, thank you for your answer mrz. It would be really nice, if the IPSec parameters could be specified in the L2TP-client interface settings. Regarding the default hashing algorithm, which is curently SHA1, one could say it is absolutely necessary to make the L2TP-clients IPSec parameters configurab...
by Ape
Fri Mar 03, 2017 5:28 pm
Forum: Wireless Networking
Topic: Cannot get wireless virtual interfaces to work, simultaneously in AP and station modes
Replies: 2
Views: 1365

Re: Cannot get wireless virtual interfaces to work, simultaneously in AP and station modes

Hi, maybe I can help. I did this kind of setup myself and I came across the following behavior: Assume, "wlan1" is the physical wifi interface and it is configured as "station". Now, you create a second wifi interface, the virtual AP interface "wlan2", which is the slave interface of "wlan1". At thi...
by Ape
Fri Mar 03, 2017 5:20 pm
Forum: General
Topic: Routerboard
Replies: 2
Views: 460

Re: Routerboard

Hi,

did you try to netinstall it?
Did you connect to the console? What's the ouput during startup?

Regards,
Ape
by Ape
Fri Mar 03, 2017 5:15 pm
Forum: General
Topic: ipsec site-to-site azure
Replies: 3
Views: 1286

Re: ipsec site-to-site azure

Hi,

configure verbose logging on your MikroTik and have a look what's going on. Without details nobody is able to assist you.

Regards,
Ape
by Ape
Fri Mar 03, 2017 5:03 pm
Forum: General
Topic: Strange Issue with EoIP
Replies: 2
Views: 470

Re: Strange Issue with EoIP

Thank your for reporting how you solved the issue!
by Ape
Fri Feb 24, 2017 11:43 am
Forum: General
Topic: DHCP server says "offered"
Replies: 4
Views: 8018

Re: DHCP server says "offered"

Hi,

the DHCP server offering leases to hosts in your net is perfectly fine.
There might be a problem with DHCP in VLANs, caused by faulty MTU settings: If DHCP server offers leases "without success", try increasing the MTU of the VLAN interfaces to 1504.

Regads,
Ape
by Ape
Fri Feb 24, 2017 11:37 am
Forum: General
Topic: ipsec site-to-site azure
Replies: 3
Views: 1286

Re: ipsec site-to-site azure

Hi,

could be a DPD (dead peer detection) problem. Can you find out, what values are used by the Azure gateway and set it on your MikroTik?

Regards,
Ape
by Ape
Sun Feb 19, 2017 9:54 am
Forum: General
Topic: IP GRE tunnel static route
Replies: 1
Views: 590

Re: IP GRE tunnel static route

Hi,

regarding 3DES: You need to change the default proposal. Youl'll find it in"IP" -> IPSec" -> Tab "Proposal". Do it for both sides oft the encrypted GRE tunnel.

Regards,
Ape
by Ape
Fri Dec 16, 2016 11:41 am
Forum: General
Topic: Huge bug: Mikrotik allows adding overlapping networks.
Replies: 15
Views: 2029

Re: Huge bug: Mikrotik allows adding overlapping networks.

Hi, what you're looking for is a feature to add some convenience to handle IP addresses - okay. But it is not a bug in my opinion. My preference is to avoid any auto-magic mechanism because it prevents you from thinking it through. Just my thoughts. Your reasoning is logical but not preferrable for ...
by Ape
Fri Dec 16, 2016 11:19 am
Forum: General
Topic: Huge bug: Mikrotik allows adding overlapping networks.
Replies: 15
Views: 2029

Re: Huge bug: Mikrotik allows adding overlapping networks.

Hi,

my Ford Focus allows me to drive it against a wall. What's Ford's position on this issue?

To be serious: You configure the device, so you're in charge to do it right, no?

Regards,
Ape
by Ape
Tue Dec 06, 2016 1:34 pm
Forum: General
Topic: PPPoE disconnects - why?
Replies: 3
Views: 3338

Re: PPPoE disconnects - why?

Hi, just a blind guess: Do you use connection tracking / stateful firewalling for your underlaying network together with dynamic routing? I ask, because the dnymic routing is agnostic regarding the connection states in firewall. Think about this scenario: EoIP tunnel gets established over a specific...
by Ape
Fri Dec 02, 2016 6:47 pm
Forum: General
Topic: Excessive memory usage - ovpn server
Replies: 2
Views: 693

Re: Excessive memory usage - ovpn server

Hi,

In "System" -> "Logging", tab "Action" "memory": How many lines do you log?
According to the graphics you provided, the RAM eating is quite regular.

Can you please post a "/export compact hide-sensitive".
Thank you.


Regards,
Ape
by Ape
Wed Nov 30, 2016 2:54 pm
Forum: General
Topic: Excessive broadcasts/multicast, probably a loop
Replies: 3
Views: 2030

Re: Excessive broadcasts/multicast, probably a loop

Hi,

I had a similar problem some time ago. There was a bug in the TP Link's firmware regarding IGMP handling, resulting in hughe amounts of IGMP traffic originating from the TP Link units. Check if you're running the latest firmware on the TP Link devices.

Regards,
Ape
by Ape
Tue Nov 29, 2016 7:02 pm
Forum: General
Topic: PCC load balancing didn't use 2 WANs at the same time.
Replies: 1
Views: 853

Re: PCC load balancing didn't use 2 WANs at the same time.

Hi,

PCC means "per connection classifier", so it's a expected behavior that you use only one line for one connection. PCC will use multiple WAN lines if you have multiple connections, but every connection can only use one WAN line.

Regards,
Ape
by Ape
Tue Nov 29, 2016 6:39 pm
Forum: General
Topic: Queue for a Gaming Lounge
Replies: 5
Views: 1941

Re: Queue for a Gaming Lounge

Hi,

use Firewall Mangle Rules to add packet marks as desired. Keep in mind that you need to mark incoming and outgoing packets as there is no connection tracking on packet level.
Afterwards, configure queues for the marked packets as you like.

Regards,
Ape
by Ape
Tue Nov 29, 2016 4:58 pm
Forum: General
Topic: Mikrotik Dynamic IP to Sonicwall VPN
Replies: 2
Views: 1365

Re: Mikrotik Dynamic IP to Sonicwall VPN

Hi,

what's in the logs of the MikroTik and the SonicWALL?
Configuring a syslog server for logging the SonicWALL's messages and the MikroTik's messages would be helpful to correlate the findings.

Regards,
Ape
by Ape
Wed Nov 25, 2015 2:05 pm
Forum: General
Topic: Port forwarding problem
Replies: 16
Views: 5021

Re: Port forwarding problem

Hi,

please post the output of the
/export
command.
Thank you.

Ape
by Ape
Wed Nov 25, 2015 1:31 pm
Forum: General
Topic: Port forwarding problem
Replies: 16
Views: 5021

Re: Port forwarding problem

Hi, this is an example port forwarding for port 80: /ip firewall nat add action=dst-nat chain=dstnat disabled=no in-interface=<your wan interface> dst-port=80 protocol=tcp to-addresses=<IP of host> to-ports=80 /ip firewall filter add action=accept chain=forward connection-state=new \ disabled=no dst...
by Ape
Wed Nov 25, 2015 12:40 pm
Forum: General
Topic: Load balancing two cable modem
Replies: 1
Views: 457

Re: Load balancing two cable modem

Hi, please have a look at: http://wiki.mikrotik.com/wiki/Load_Balancing I recommend PCC oder NTH load balancing in your case. Using the sum of both WAN connections from one client is only theoretically possible. To understand the resulting amount of bandwith you're finally getting, it is important t...
by Ape
Wed Nov 25, 2015 12:15 pm
Forum: General
Topic: Diagnosing this "possible" loop
Replies: 5
Views: 2274

Re: Diagnosing this "possible" loop

In some scenarios with MPLS/VPLS, it might look like a loop but it isn't. It can happen when paths are switching. IMHO, as long as your log is not filling up with this message, you should be okay. Additionally you can enable STP/RSTP on the bridge. For debugging: Capture the traffic on a mirrored po...
by Ape
Wed Nov 25, 2015 12:10 pm
Forum: General
Topic: cell phone and wifi jammer
Replies: 1
Views: 567

Re: cell phone and wifi jammer

Whatever you try to do, keep in mind, that willful disturbance of communication might be illegal in your country...
by Ape
Wed Nov 25, 2015 12:06 pm
Forum: General
Topic: Port forwarding problem
Replies: 16
Views: 5021

Re: Port forwarding problem

Hi,

the port forwarding is just one thing to do.
Propably you must also add a firewall rule in the forward chain to allow the incoming traffic.

Ape
by Ape
Wed Nov 25, 2015 12:02 pm
Forum: General
Topic: VLANs on bridges, or bridges for VLANs?
Replies: 4
Views: 2493

Re: VLANs on bridges, or bridges for VLANs?

Hi, if you're on a MikrotikRouter without VLAN capable switch chip, you should create a bridge for every VLAN an bridge the desired VLAN interfaces in this bridge. As you already wrote, the bridge interfaces must be configured with the desired IP addresses. As kamillo already said, this setup will c...
by Ape
Thu Nov 12, 2015 7:51 pm
Forum: General
Topic: TR-069
Replies: 12
Views: 6147

Re: TR-069

Hi, What could be the use of this TR-069 in MikroTik? Never heard of it before. In short: It's a remote configuration protocol / engine (in fact it's not, TR-069 is just the name of the standard released by the broadband forum, but that's just a detail). An ISP can auto-configure thousands of device...
by Ape
Thu Nov 12, 2015 6:27 pm
Forum: General
Topic: TR-069
Replies: 12
Views: 6147

Re: TR-069

Hi normis, great that you are adding TR-069 to RouterOS! I've just one request regarding TR-069 support: Please add it in the form of a separate package. I think there are people out there (including me) that get scared when thinking about TR-069 running on a core router. It's fine and necessary on ...
by Ape
Thu Nov 12, 2015 6:21 pm
Forum: General
Topic: How to set DNS servers for users connecting through RouterBoard
Replies: 5
Views: 5948

Re: How to set DNS servers for users connecting through RouterBoard

Hi,

Okay. Thank you for clarifying.

Just add the DNS server's IP in your "DHCP server" -> "network" config. That's it.

Ape
by Ape
Wed Nov 11, 2015 3:24 pm
Forum: General
Topic: How to set DNS servers for users connecting through RouterBoard
Replies: 5
Views: 5948

Re: How to set DNS servers for users connecting through RouterBoard

Hi, you already described the solution to your issue: The only workaround I have found is http://wiki.mikrotik.com/wiki/Force_use ... DNS_server which would force all requests on port 53 to go via the RB but this would still leave 192.168.0.1 listed as a DNS server for clients using DHCP eg: This is...
by Ape
Wed Nov 11, 2015 12:13 am
Forum: General
Topic: [solved] how to correctly use qemu. Was: "Packet leakage on bridged vlan interfaces"
Replies: 1
Views: 658

Re: Packet leakage on bridged vlan interfaces

Hi again, sorry MikroTik....it's not a bug in RouterOS, it's a bug in my brain. The described issue has nothing to do with RouterOS! But, there is in fact a bridge, leaking packets from VLAN 100 to VLAN 300 in my network. It's completly unrelated to the described issue, but maybe it is helpful for s...
by Ape
Tue Nov 10, 2015 10:54 pm
Forum: General
Topic: [solved] how to correctly use qemu. Was: "Packet leakage on bridged vlan interfaces"
Replies: 1
Views: 658

[solved] how to correctly use qemu. Was: "Packet leakage on bridged vlan interfaces"

Hi, a RB2011 and a RB750GL are connected as following: https://www.jumping-frog.de/files/theme/img/projects/RouterOS_VLAN_Setup/VLAN_setup.jpg This is the config on the RB2011: /interface export compact /interface bridge add comment=LAN mtu=1500 name=br_vlan100 protocol-mode=none add comment=guests ...
by Ape
Tue Oct 13, 2015 2:23 pm
Forum: General
Topic: SIP phone through VPN
Replies: 9
Views: 1999

Re: SIP phone through VPN

Hi,

I'm glad to hear you managed to solve your issue.

I recommend to avoid TCP based VPNs like OpenVPN in RouterOS and SSTP because they add latency due to the (additonal) TCP handshake.
IPSec is fine.

Ape
by Ape
Mon Oct 12, 2015 9:18 pm
Forum: General
Topic: Half speed in a PPPoE over bridged ADSL modem
Replies: 11
Views: 2536

Re: Half speed in a PPPoE over bridged ADSL modem

Hi, I guess you're always talking about a wired connection from your computer to the router for testing the throughput, right? Another thing I could imagine: You provider artificially limits the bandwidth when another device is connected. Determine the MAC address of the WAN interface of the router/...
by Ape
Mon Oct 12, 2015 4:17 pm
Forum: General
Topic: Half speed in a PPPoE over bridged ADSL modem
Replies: 11
Views: 2536

Re: Half speed in a PPPoE over bridged ADSL modem

Hi, regarding CPU load: Check this with /system resource monitor while pushing traffic through the device. Regarding MTU: A often used way to determine actual MTU of a path is pinging the remote side with a ping of a given sized and the DF (=dont fragment) bit set. Keep in mind, that you have to add...
by Ape
Mon Oct 12, 2015 3:52 pm
Forum: General
Topic: getting "admin prohibited" in ping?
Replies: 2
Views: 8691

Re: getting "admin prohibited" in ping?

Hi,

yes, someone in the path is blocking the packets and informs you with an ICMP "admin prohibited" response.
You can get further information on https://en.wikipedia.org/wiki/Internet_ ... l_messages.

Ape
by Ape
Mon Oct 12, 2015 3:31 pm
Forum: General
Topic: SIP phone through VPN
Replies: 9
Views: 1999

Re: SIP phone through VPN

Hi, Agreed, I need to rout the SIP LAN address through office2 WAN IP. The question is how? or what is the method and I will search? Thanks, /ip route add dst-address=xx.xx.xx.xx gateway=yy.yy.yy.yy xx.xx.xx.xx/xx = IP range of your SIP provider's SIP gateways yy.yy.yy.yy = local IP of the router in...
by Ape
Fri Oct 09, 2015 5:48 pm
Forum: General
Topic: SIP phone through VPN
Replies: 9
Views: 1999

Re: SIP phone through VPN

Hi,

it's a matter of routing.
You must route traffic to your SIP provider's IP range over the gatway of office 2.

Ape
by Ape
Fri Oct 09, 2015 5:42 pm
Forum: General
Topic: FTP-server on MikroTik. Can't upload files.
Replies: 9
Views: 3006

Re: FTP-server on MikroTik. Can't upload files.

Hi, normis already answered the question: MikroTik FTP server is only for uploading NPK files and downloading backups. It is not designed to be a public FTP server for large files and resume downloads. The conclusion is: The embedded FTP server is not intended to be used for anything other than uplo...
by Ape
Thu Oct 08, 2015 1:08 pm
Forum: General
Topic: How to load share a point to point link across several devices?
Replies: 1
Views: 386

Re: How to load share a point to point link across several devices?

Hi,

as long as your links are L2 transparent, you should be able to use the MAC based bonding interface feature.

Ape
by Ape
Thu Oct 08, 2015 12:52 pm
Forum: General
Topic: multi-threaded processes in RouterOS
Replies: 2
Views: 517

Re: multi-threaded processes in RouterOS

Hi,

good question!

Another question would be: Is the profiler displaying processes and/or threads?
Displaying the same process name on multiple CPU isn't necessarily an indicator for multi-threading, the process may be just instantiated multiple times.

Ape
by Ape
Thu Oct 08, 2015 12:09 pm
Forum: General
Topic: Half speed in a PPPoE over bridged ADSL modem
Replies: 11
Views: 2536

Re: Half speed in a PPPoE over bridged ADSL modem

Hi, thank you for providing your config. I can't see anything obviously wrong in your config. Two things came to my mind: 1) PPPoE can handle a MTU up to 1492, but your provider can use a lower value. You could try to successively decerease the MTU on the PPPoE interface. 2) I don't see anything in ...
by Ape
Tue Oct 06, 2015 5:09 pm
Forum: General
Topic: Half speed in a PPPoE over bridged ADSL modem
Replies: 11
Views: 2536

Re: Half speed in a PPPoE over bridged ADSL modem

Hi,

please post your router's config. Everything else would be just guessing.

Thanks.


Ape
by Ape
Tue Oct 06, 2015 2:41 pm
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

Re: hAP lite "losing" config after a while

Hi, thank you for sharing your experience. In my case, the faulty behavior of the unit suddenly disappeared. Still, I don't know what caused the issue and neither what made it stop. I marked the device and I only will use it for testing in future. For my the state of the issue is between "solved" an...
by Ape
Tue Sep 01, 2015 10:43 am
Forum: General
Topic: ssh command error
Replies: 4
Views: 574

Re: ssh command error

Hi, I think you would like to import a user's SSH key. AFAIK you cannot generate the key on the MikroTik router. You have to generate it on another machine and then move the public key via Winbox or ftp to the router's filesystem. Afterwards, you can use /user ssh-keys import public-key-file=id_rsa....
by Ape
Tue Sep 01, 2015 10:35 am
Forum: General
Topic: how to prevent hotspot hack by clients?
Replies: 9
Views: 9419

Re: how to prevent hotspot hack by clients?

Hi, how to Protect your hotspot from hacker 1- go to ip address change the "Local"(out interface) subnet mask to 8 (255.0.0.0) ex: my Local ip is 192.168.10.1/24 change to 192.168.10.1/8 2- go to ip dhcp server - network chane the subnet to 8 I would like to read the explanation too. Thanks. Ape
by Ape
Tue Sep 01, 2015 10:22 am
Forum: General
Topic: ERROR: corrupted list.gum file
Replies: 4
Views: 2420

Re: ERROR: corrupted list.gum file

Hi.

@mbfound:
Thank you for sharing your solution.

@MikroTik
Maybe the MikroTik staff can shed some light in the internal working because I'm really interested in how Winbox's cache results in this error message in the router's log. Thanks.

Ape
by Ape
Mon Aug 31, 2015 11:28 am
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Hi elsev7,

I'm sorry to hear that.

Yes, I agree, you have to exclude external L2 issues.
In the hope we're dealing with deterministic devices, there must a be chain of causality.

If you need further assistance, feel free to ask.

Ape
by Ape
Mon Aug 31, 2015 11:14 am
Forum: General
Topic: VPN over UDP dies over time
Replies: 9
Views: 1024

Re: VPN over UDP dies over time

Hi,

How many connections are NATed on the Metal 2SHP?
Is this legitimate traffic or some sort of attack?

I don't have any real life experience with many NATed connections on a Metal 2SHP, but from the specs (400MHz, 64MB RAM) I guess, it should be able to handle some hundred NATed connections.

Ape
by Ape
Tue Aug 25, 2015 1:33 pm
Forum: General
Topic: Diagnosing performance/throughput issues
Replies: 3
Views: 866

Re: Diagnosing performance/throughput issues

Hi,

if you only experience this issue over PPPoE, then MTU could be the cause.
Whats your path MTU? What MTU is configured for the PPPoE connection?

Ape
by Ape
Mon Aug 24, 2015 6:02 pm
Forum: General
Topic: router rebooted automatically after system shutdown
Replies: 1
Views: 499

Re: router rebooted automatically after system shutdown

Hi,

"/system shutdown" is intended to shut the system down, not rebooting it.
Yesterday I configured a couple RB941 and they properly shut down when "/system shutdown" was issued.

I'm using RouterOS 6.30.2. Please try updating your device.

Ape
by Ape
Mon Aug 24, 2015 5:54 pm
Forum: General
Topic: winbox neighbour empty through vpn
Replies: 3
Views: 2048

Re: winbox neighbour empty through vpn

Hi, thank you for the image. "/ip neighbor" is exactly what's the reason you can see MikroTik devices in Winbox's list. Please have a look at http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery . You can change ether2's arp setting from "proxy-arp" back to "enabled". You use two different IP ...
by Ape
Mon Aug 24, 2015 5:07 pm
Forum: General
Topic: winbox neighbour empty through vpn
Replies: 3
Views: 2048

Re: winbox neighbour empty through vpn

Hi,

according to the How-To you mentioned, ether2 is your LAN interface to which the router's IP is assigned, right?
In this case, enable "proxy arp" on ether2.

Also make sure, the pptp client interface is enabled in IP -> Neighbors.

Ape
by Ape
Mon Aug 24, 2015 4:14 pm
Forum: General
Topic: RB1100AH NAT issue (?)
Replies: 3
Views: 577

Re: RB1100AH NAT issue (?)

Hi. Yes, that's right. You need to enable connection tracking in order to have NAT working. It's not an issue, it's a feature: Connection tracking needs additional resources, like CPU and RAM, so it's up to you to enable or disable it. In order to build a stateful firewall or to use NAT it must be e...
by Ape
Mon Aug 24, 2015 2:57 pm
Forum: General
Topic: [Solved] - CCR1036 upgrade (silently) fails
Replies: 13
Views: 1785

Re: CCR1036 upgrade (silently) fails

Great! It's always a pleasure to help.

Please prefix the title of your first post with "[solved]", so other people looking for a similar problem can see at a glance that this thread describes an approved solution. Thank you!

Ape
by Ape
Mon Aug 24, 2015 2:32 pm
Forum: General
Topic: [Solved] - CCR1036 upgrade (silently) fails
Replies: 13
Views: 1785

Re: CCR1036 upgrade (silently) fails

Hi,

I'm sorry to hear that.

Have a look at http://forum.mikrotik.com/viewtopic.php ... 4&p=472523.
It might be some conflicting files.

If you can dismiss this possibility I think you should write to support@mikrotik.com


Ape
by Ape
Mon Aug 24, 2015 2:15 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Hi, I just read the changelog ( http://forum.mikrotik.com/viewtopic.php?f=21&t=99531 ) for RouterOS 6.31 and found this line: What's new in 6.31 (2015-Aug-14 15:42): [...] *) bridge fastpath - fixed updating bridge FDB on receive (could cause TX traffic flooding on all bridge ports) Maybe this is re...
by Ape
Mon Aug 24, 2015 2:07 pm
Forum: General
Topic: [Solved] - CCR1036 upgrade (silently) fails
Replies: 13
Views: 1785

Re: CCR1036 upgrade (silently) fails

Hi, okay - I understand ;-) Did you upload the new packages via Winbox/FTP or did you used "Check for updates" button? Normally uploading the .npk-File and rebooting the device does the trick. Sorry for asking this dumb question, but did you use the right npk-file for the CCR's system architecture (...
by Ape
Mon Aug 24, 2015 1:56 pm
Forum: General
Topic: [Solved] - CCR1036 upgrade (silently) fails
Replies: 13
Views: 1785

Re: CCR1036 upgrade (silently) fails

Hi,

a pragmatic way to solve this would be:

Export your config.
Do a netinstall with new RouterOS.
Import your config.

If this device is mission critical, try this at first with a spare device to ensure the exported configuration works flawlessly with the new RouterOS version.

Ape
by Ape
Mon Aug 24, 2015 1:47 pm
Forum: General
Topic: RB1100AH NAT issue (?)
Replies: 3
Views: 577

Re: RB1100AH NAT issue (?)

Hi, your routing table shows, that 172.16.250.254 is still the active default gateway. I guess the active default gateway should be 200.85.183.173? Try disabling port 10 (to your Fortigate) and/or the default route using 172.16.250.254. Another thing to consider: Did you adapt your firewall rules to...
by Ape
Mon Aug 24, 2015 1:40 pm
Forum: General
Topic: Muliple PPPoE, only one should be default
Replies: 3
Views: 775

Re: Muliple PPPoE, only one should be default

Hi,

if you unchecked "Add default route" in the PPPoE client's configuration and it still adds a default route for this PPPoE client then yes, it's a bug.

Ape
by Ape
Mon Aug 24, 2015 1:31 pm
Forum: General
Topic: VPN over UDP dies over time
Replies: 9
Views: 1024

Re: VPN over UDP dies over time

Hi, @kuranga I think the traffic does not die totally over that UDP port but gets slowed down towards 0 - asymptotically. Sounds comprehensible, but every udp packet corresponding to the identified udp "connection" should reset the timer, which it obviously does not do. It really looks like a bug to...
by Ape
Sat Aug 22, 2015 5:57 pm
Forum: General
Topic: CRS125 Layer 2 Switching Implementation
Replies: 3
Views: 1085

Re: CRS125 Layer 2 Switching Implementation

Hi, as you already said, I would setup tagged trunk ports (ports 23 and 24 on yoour image) between the switches and one additional trunk port for connecting your router on a stick thing. In your desired setup you must ensure that your workstations can tag the ethernet frames and that the switches on...
by Ape
Sat Aug 22, 2015 5:50 pm
Forum: General
Topic: VPN over UDP dies over time
Replies: 9
Views: 1024

Re: VPN over UDP dies over time

Hi,

is connection tracking enabled and used on one of your Metals? If so, it might be the UDP connection timers.
I have had quite a similar issue with SIP sessions over UDP and I think it is related to the UDP connection timers.

Ape
by Ape
Sat Aug 22, 2015 5:45 pm
Forum: General
Topic: Routerboard 1100AH's failing after being powered by POE ToughSwitch
Replies: 1
Views: 463

Re: Routerboard 1100AH's failing after being powered by POE ToughSwitch

Hi,

you could measure/monitor voltage and current provided by the ToughSwitch to prove your assumption.

I think it is possible that power supply gear (like a PoE switch) will get unable to provide enough power over time due to aging of electronic components like capacitors.

Ape
by Ape
Sat Aug 22, 2015 5:37 pm
Forum: General
Topic: CRS and traffic out with two internet connections,
Replies: 1
Views: 425

Re: CRS and traffic out with two internet connections,

Hi,

you could configure the CRS to do policy based routing. This way you have the control about what host uses which provider for outgoing traffic.
But depending on the desired / required bandwidth the CRS might not be able to handle the traffic load when doing L3 forwarding.

Ape
by Ape
Sat Aug 22, 2015 5:30 pm
Forum: General
Topic: Routing help needed
Replies: 2
Views: 485

Re: Routing help needed

Hi, it is a little unclear what you try to achieve. If you simply want a failover for your internet connection, add two default routes with "check gateway" set to "ping". The preferred default route with distance 1 the second (backup) route with distance 2. As long as the gateway for the preferred r...
by Ape
Fri Aug 21, 2015 6:59 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Are you sure, the switch is the origin of the unicast flood?
Is your backup software possibly using (excessive) broadcasts / weird multicasts?
by Ape
Fri Aug 21, 2015 6:06 pm
Forum: Forwarding Protocols
Topic: MPLS/VPLS/MTU Question
Replies: 5
Views: 1308

Re: MPLS/VPLS/MTU Question

Please share the URL to the MikroTik documentation where you got the VLAN thing from, so I can have a look and reply to your question, thank you.

Debugging LDP: Got to "System" -> "Logging" and add a rule with the topic "ldp" and "debug". This ways you should see LDP debug messages.

Ape
by Ape
Fri Aug 21, 2015 4:35 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Okay, some causes could be: ARP timers on hosts are longer than the switch's address cache - so the switch basically forgets what MAC is associated to which port, resulting in flooding. But this should not be a matter of hours of unicast flooding like in your case. MAC table of switch/bridge is full...
by Ape
Fri Aug 21, 2015 4:13 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Ah!

You are bridging all ports - not using the switch chip.
I use the "real" switch feature, in my FDB table there are entries for every port/MAC association known to the switch.

Why are you bridging all your ports instead of using the switch chip?

Ape
by Ape
Fri Aug 21, 2015 3:52 pm
Forum: Forwarding Protocols
Topic: MPLS/VPLS/MTU Question
Replies: 5
Views: 1308

Re: MPLS/VPLS/MTU Question

Hi, looks good to me. The most important part, besides MPLS/VPLS is running, is the L2MTU on the physical interfaces. It must be at least the size of your MPLS MTU. You configured the MPLS MTU to 1530 which is fine when the physical interfaces on your routers support an L2MTU of at least 1530 and al...
by Ape
Fri Aug 21, 2015 3:37 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Hi,

as far as I understand this, ARP has nothing to do with the FDB.
I also have a CRS125-24G-1S, the only entry in my ARP table is the MAC from the computer I'm accessing the switch for management.
So, AFAIK the entries in ARP table and FDB table are not related.

Ape
by Ape
Fri Aug 21, 2015 2:25 pm
Forum: General
Topic: Bonding with ALB
Replies: 5
Views: 1157

Re: Bonding with ALB

Hi, what do you mean with "all my traffic"? TLB/ALB bonding works per MAC address, so a connection from host A to host B will always use only link #1 for example. A connection from host A to host C might use link #2. So, only in the case host A has connections to hosts B and C, both links will be us...
by Ape
Fri Aug 21, 2015 1:04 pm
Forum: General
Topic: Unicast Flood Prevention
Replies: 17
Views: 2935

Re: Unicast Flood Prevention

Hi,

I'm not completly sure, but maybe
/interface ethernet switch set unicast-fdb-timeout=300
is what you are looking for?

If you're interested in further reading:
http://wiki.mikrotik.com/wiki/Manual:CR ... nicast_FDB


Ape
by Ape
Fri Aug 21, 2015 12:11 pm
Forum: General
Topic: FTP-server on MikroTik. Can't upload files.
Replies: 9
Views: 3006

Re: FTP-server on MikroTik. Can't upload files.

Hi,

the FTP APPE command means "append to file".
I think MikroTik's FTP server implementation simply does not support this ftp feature.

Unfortunatelly, I doubt that you can change the behavior of the ftp client (IP camera in your case) - sorry :-(

Ape
by Ape
Wed Aug 19, 2015 1:20 pm
Forum: General
Topic: What is the best option Virtual private network for my case?
Replies: 1
Views: 645

Re: What is the best option Virtual private network for my case?

Hi, if I understand your question correctly, you're asking what topology would be the best. If this is the case, this is my thought: If you don't want to create multiple VPNs in Azure, you should go with a hub and spoke (or star) topology regarding your VPN connections. In this setup you will be abl...
by Ape
Wed Aug 19, 2015 1:13 pm
Forum: General
Topic: Redundant Link between two Mikrotik Routers
Replies: 3
Views: 791

Re: Redundant Link between two Mikrotik Routers

Hi,

as long as the ports are configured as switch ports or bridge ports and you use STP / RSTP, you'll get the desired redundancy (and of course a loop free topology).
A more sophisticated setup would be bonding the interfaces, this way you get redundancy and more throughput.

Ape
by Ape
Wed Aug 19, 2015 1:08 pm
Forum: General
Topic: RB2011 dropping speed
Replies: 3
Views: 608

Re: RB2011 dropping speed

Hi, please check if the speed and duplex auto-negotiation actually negotiated 1GB/100MB full duplex on the affected port. It looks like there might be a negotiation problem between your RB and the AP you're using. You can try disabling auto-negotiation for this ethernet port and setting it to 100MB ...
by Ape
Wed Aug 19, 2015 12:59 pm
Forum: General
Topic: Looking for a network sniffer - please advise
Replies: 3
Views: 726

Re: Looking for a network sniffer - please advise

Hi,

although I'm a MikroTik fan, I would go with the "PC running Linux" solution.
It will be better suited to your needs and more flexible.

Ape
by Ape
Wed Aug 12, 2015 11:22 am
Forum: General
Topic: ERROR: corrupted list.gum file
Replies: 4
Views: 2420

Re: ERROR: corrupted list.gum file

Hi,

out of curiosity: What device / kind of hardware do you use?

Corruption may be defined as "file does not contain what it is supposed to contain". Just guessing: Maybe the file got corrupted in a crash situatiom, maybe flash storage is defective, and so on.

Ape
by Ape
Wed Aug 12, 2015 11:10 am
Forum: General
Topic: MikroTik Firewall
Replies: 17
Views: 2940

Re: MikroTik Firewall

Hi MTusewk, I cannot give you a walk-through for your torrent blocking task, but I want to share some thoughts: - devices using torrent file sharing typically open many connections in a short time period on specific ports (these port numbers are AFAIK client software dependant), this should be detec...
by Ape
Mon Aug 10, 2015 10:54 am
Forum: General
Topic: Wireless clients slow to dhcp address on all MT versions
Replies: 5
Views: 2845

Re: Wireless clients slow to dhcp address on all MT versions

Hi Micat, I'm glad to hear your problem is solved. The setting was "rstp". Changing it to "none" did the trick. What if I do not want to disable STP? It's a good question. IMHO, the timeout for getting an IP address by DHCP is configured to short on the devices - I know you won't be able to change t...
by Ape
Mon Aug 03, 2015 6:13 pm
Forum: General
Topic: LAN In vs Gateway Out
Replies: 3
Views: 472

Re: LAN In vs Gateway Out

Probably you have allowed external requests to you DNS on the MikroTik but you didn't have restricted the access to your LAN. So everyone from the internet can access (and will acess) your DNS. As jarda already stated, this topic is covered multiple times in this board. The last thread I remember co...
by Ape
Mon Aug 03, 2015 6:01 pm
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

Re: hAP lite "losing" config after a while

Hi,

just to keep this updated:

Another unit that arrived today works stable for hours now with the excat same config.
As soon as I can recover the defective unit from the customer, I'll open the ticket.

Ape
by Ape
Fri Jul 31, 2015 2:12 pm
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

Re: hAP lite "losing" config after a while

Okay, I'll create a ticket and give you remote access next week.
Thanks for your support!

Ape
by Ape
Fri Jul 31, 2015 1:46 pm
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

Re: hAP lite "losing" config after a while

HI normis, okay. Thank you. I just ordered two devices and will configure them exactly the same as I did with the malfunctioning device (I was able to export the initial config before the issue occured the second time). Nice piece of hardware by the way :-) (I just notice this could be interpreted a...
by Ape
Fri Jul 31, 2015 12:57 pm
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

Re: hAP lite "losing" config after a while

Hi normis, thank your for answering. I setup the device yesterday ~ 6pm. After a while the devide became unresponsive and I notice the empty windows in WinBox. Then I netinstalled the device right after this happened the first time. After netinstalling, I configured the device and it was running til...
by Ape
Fri Jul 31, 2015 10:53 am
Forum: General
Topic: hAP lite "losing" config after a while
Replies: 9
Views: 1340

hAP lite "losing" config after a while

Hi, I just bought a bunch of hAP lite. I use them for VPN and OSPF in a SoHo environment. No problems so far - I like them. Yesterday I set up a hAP lite (RouterOS 6.30.2 / Firmware 3.24) and when I tried to add a static lease, the device became unreachable by ip. First I thought I did a configurati...
by Ape
Tue Jul 28, 2015 5:00 pm
Forum: General
Topic: Wireless clients slow to dhcp address on all MT versions
Replies: 5
Views: 2845

Re: Wireless clients slow to dhcp address on all MT versions

Hi, two things come to my mind: - if you use input rules on firewall, allow input for port 67 and 68 UDP (https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#Operation) - is your DHCP server acting on a bridge interface which has STP enabled? STP takes time to establish loop free conne...
by Ape
Tue Jul 28, 2015 4:23 pm
Forum: General
Topic: Am i getting data loss or is it a bug in the traffic grapher see image
Replies: 5
Views: 560

Re: Am i getting data loss or is it a bug in the traffic grapher see image

Hi opalit,

please enable debug logging for "pppoe" and "interface". Maybe you'll get some helpful additional information.

And again, please tell us your RouterOS version and your RouterBoard firmware version. AFAIK, there were port flapping issues in the past.


Ape
by Ape
Tue Jul 28, 2015 4:16 pm
Forum: General
Topic: Am i getting data loss or is it a bug in the traffic grapher see image
Replies: 5
Views: 560

Re: Am i getting data loss or is it a bug in the traffic grapher see image

Hi,

do you see ethernet port status changes in the router's log?
Did you notice connection drops?

What RouterOS, what RouterBoard firmware? To what kind of device ether1 is connected to?

Ape
by Ape
Tue Jul 28, 2015 4:04 pm
Forum: General
Topic: Subnet Routing problem!!!
Replies: 9
Views: 1007

Re: Subnet Routing problem!!!

Hi Mashal, what you stated is right for routing in layer 3. But you have connected two overlapping networks to your router. Without understanding subnetting and the internal working of the IP stack on a device, you won't be able to understand why your setup is not working and why "By default forward...
by Ape
Tue Jul 28, 2015 3:52 pm
Forum: General
Topic: Subnet Routing problem!!!
Replies: 9
Views: 1007

Re: Subnet Routing problem!!!

Hi Mashal, I'm afraid, without changing one of your network addresses / subnet masks you really won't get this working. This is the fundamental working of IPv4 networks. You must create a setup, where the network address space you want to route to, is not contained in the originating network address...
by Ape
Tue Jul 28, 2015 3:19 pm
Forum: General
Topic: Subnet Routing problem!!!
Replies: 9
Views: 1007

Re: Subnet Routing problem!!!

Hi,

you won't be able to get this working with plain routing because 10.10.1.252/30 is a subnet of 10.10.1.0/24.
If you don't need the whole /24 range, you could configure 10.10.1.1/25, now 10.10.1.0/25 and 10.10.1.252/30 are really different nets between you can route.

Ape
by Ape
Mon Jul 27, 2015 11:20 pm
Forum: General
Topic: MikroTik Firewall
Replies: 17
Views: 2940

Re: MikroTik Firewall

Hi, yes, to log messages remotely you need to create a logging action "remote" with the correct settings for your syslog server. Afterwards you can copy an existing or create a new log rule with the desired topic and the remote action. To address your filesharing problem: It is not that easy. In gen...
by Ape
Mon Jul 27, 2015 11:11 pm
Forum: General
Topic: how do detect mikrotik rb from command line (CLI)
Replies: 2
Views: 798

Re: how do detect mikrotik rb from command line (CLI)

Hi, if the have SSH enabled, you can find the with their ssh server string. user@server:~$ nmap -A -T4 -p 22 -n 192.168.0.1 Starting Nmap 6.40 ( http://nmap.org ) at 2015-07-27 22:12 CEST Nmap scan report for 192.168.0.1 Host is up (0.00034s latency). PORT STATE SERVICE VERSION 22/tcp open ssh Mikro...
by Ape
Mon Jul 27, 2015 10:52 pm
Forum: General
Topic: RB1100AHx2 - slow upload
Replies: 2
Views: 832

Re: RB1100AHx2 - slow upload

Hi inteq, I have a RB1100AHx2 too, but still on 5.26. Yo could try to log debug messages (topic "debug" in /system logging) and log these messages to a external syslog server (in case the router crashes you still have access to the last log messages). Maybe the debug messages can help to trace the c...
by Ape
Mon Jul 27, 2015 10:47 pm
Forum: General
Topic: Connecting to Router with No Default Configuration
Replies: 23
Views: 4825

Re: Connecting to Router with No Default Configuration

Hi,

did you already try to netinstall your device?
The file system may be corrupted.

If this strange behavior continues after netinstall, I would say the device is a candidate for RMA.

Ape
by Ape
Mon Jul 27, 2015 10:34 pm
Forum: General
Topic: Syslog Server
Replies: 3
Views: 905

Re: Syslog Server

A linux system.
If it should be low energy and low cost, a raspberry pi can do the job.

Ape
by Ape
Sat Jul 18, 2015 9:15 pm
Forum: General
Topic: MikroTik Firewall
Replies: 17
Views: 2940

Re: MikroTik Firewall

Hi, Secondly since we are on topic. I want to know is it possible to log every connection attempt of users to anywhere on the internet in MikroTik? Regardless of whether it was failed/successful connection attempt? If it is possible then how can I do it? Yes, it is possible. You can configure firewa...
by Ape
Sat Jul 18, 2015 8:45 pm
Forum: General
Topic: OpenVPN Client -> Mikrotik
Replies: 4
Views: 788

Re: OpenVPN Client -> Mikrotik

Hi,

thank you for sharing your finding.

I'm glad that you have figured out how to solve your problem.

That is in fact interesting, a MTU mismatch should not make the tunnel unusable but lead to fragmentation on the transport connection.


Ape
by Ape
Sat Jul 18, 2015 6:28 pm
Forum: General
Topic: OpenVPN Client -> Mikrotik
Replies: 4
Views: 788

Re: OpenVPN Client -> Mikrotik

Hi,

your description of the topology is not detailed enough.
We need a plan of your network topology and some information about your adressing scheme to help you.

It could be possible that you need to use proxy arp. As I do not know your topology and adressing, this is just a guess.

Ape
by Ape
Sat Jul 18, 2015 5:52 pm
Forum: General
Topic: Route port 25 out VPN
Replies: 2
Views: 599

Re: Route port 25 out VPN

Hi, you need to create a mangle rule to mark connections to port 25. Then, you need to apply a routing mark to this connections and add route which will route the so marked connections over your VPN tunnel. Have a look at: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle http://wiki.mikrotik....
by Ape
Sat Jul 18, 2015 5:19 pm
Forum: General
Topic: PPTP not working behind nat
Replies: 1
Views: 1289

Re: PPTP not working behind nat

Hi, I think it's a GRE issue. As your router is also acting as a PPTP client, it seems the GRE packets from the VPN server to the client connected to the AP do not arrive. To debug this, you could capture the GRE packets on the WAN interface and look for the addresses. Another thing: Your firewall r...
by Ape
Sat Jul 18, 2015 4:40 pm
Forum: General
Topic: MikroTik Firewall
Replies: 17
Views: 2940

Re:

Hi, @jarda You need two rules. Unfortunately it is so. I would also like multiple choices in other fields... I guess ROS is using iptables as firewall and iptables does not support specifying multiple protocols. It also would be very difficult to implement because many other options of a firewall ru...
by Ape
Fri Jul 17, 2015 2:50 pm
Forum: General
Topic: Winbox 3RC12 connecting to ROS 5.26 -> no secure mode
Replies: 0
Views: 363

Winbox 3RC12 connecting to ROS 5.26 -> no secure mode

Hi,

with WinBox 3RC12 I can connect to a device using ROS 5.26, but secure mode does not work.
Connecting to a ROS 6.30.1 device, I get a secured connection.

Of course I checked "secure mode" in WinBox.

Anyone else experiencing this?

Ape
by Ape
Thu Jul 16, 2015 5:39 pm
Forum: General
Topic: CCR - All interface down
Replies: 1
Views: 479

Re: CCR - All interface down

Hi,

you probably hit the leap second bug.
Please see: http://forum.mikrotik.com/viewtopic.php?f=21&t=98224

Ape
by Ape
Wed Jul 15, 2015 9:11 pm
Forum: Wireless Networking
Topic: [solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"
Replies: 6
Views: 2402

Re: [solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"

Hi,

i just tried using RSTP and it's working fine.

As the "R" in RSTP stands for "rapid", I think the time it takes to achieve loop free connection is short enough so the WiFi device gets an IP before it sends the disassociation.

Ape
by Ape
Wed Jul 15, 2015 12:36 am
Forum: Wireless Networking
Topic: [solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"
Replies: 6
Views: 2402

Re: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"

Hi, I solved my issue. In our server room, there is a sign on the rack "Thinking helps" and ideed it does! My issue is not related to WiFi or DHCP but to STP! I have to share this: I configured a bridge "loopback". I configuren ports ether1, ether6 and wlan1 as slaves of this bridge. I also configur...
by Ape
Tue Jul 14, 2015 7:37 pm
Forum: Wireless Networking
Topic: [solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"
Replies: 6
Views: 2402

Re: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"

Hi jarda, thank you for your input. I forgot about wireless debug logging - noob error. Yes, I do run a DHCP server on the bridge-interface, which bridges wlan0, ether1 and ether6. Thanks for the hint. This could be the explanation why the clients do the disassociaten by themselves. Next question is...
by Ape
Tue Jul 14, 2015 1:36 pm
Forum: Wireless Networking
Topic: Bridge or not Bridge?
Replies: 2
Views: 438

Re: Bridge or not Bridge?

Hi, a single broadcast domain with 50 clients is okay in my opinion. Most MikroTik devices have a built in switch chip, so this is probably the better way to interconnect the ports of your device. If you do not need any bridge features, you can lower CPU usage / improve throughput by configuring you...
by Ape
Tue Jul 14, 2015 10:27 am
Forum: Wireless Networking
Topic: [solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"
Replies: 6
Views: 2402

[solved] DHCP on a bridge using STP. Was: RB2011UiAS-2HnD "received disassoc: sending station leaving (8)"

Hi, I'm running a RB2011UiAS-2HnD for a year now (running ROS 6.29.1 and the wireless-fp package). This morning, I suddenly got problems regarding the clients connecting to wifi. I can't connect WiFi devices to the AP anymore. The log shows 07:15:51 wireless,info 84:63:D6:B4:46:CC@wlan1: connected 0...
by Ape
Thu Jul 09, 2015 5:51 pm
Forum: General
Topic: Pretty High CPU usage
Replies: 2
Views: 890

Re: Pretty High CPU usage

As it onloy has a 400MHz CPU, I think it is designed to handle a modest amount of L3 traffic, but certainly not for all ports at full wirespeed, especially if firewall rules come into play.

IMHO, the naming "Cloud Router Switch" is more a marketing thing than an appropriate product description.

Ape
by Ape
Thu Jul 09, 2015 5:46 pm
Forum: General
Topic: wireless registration table
Replies: 1
Views: 459

Re: wireless registration table

AFAIK this is not possible, because the AP must keep track of the associated clients in order to be able to send data as efficient as possible over the air.
by Ape
Thu Jul 09, 2015 1:14 pm
Forum: General
Topic: Router reboots
Replies: 2
Views: 627

Re: Router reboots

Hi, reboots may occure if watchdog triggers. One possible reason for this is (very) high CPU load. To find the reason, I suggest you configure the "error", "warning" and "critical" topics to be logged on disk. Another way is to use a syslog server to collect the log messages (personally I prefer thi...
by Ape
Thu Jul 09, 2015 1:10 pm
Forum: General
Topic: [HOW] One DHCP for RB1100's two switch group
Replies: 2
Views: 523

Re: [HOW] One DHCP for RB1100's two switch group

Hi,

without a
/export compact
it is hard to help.

I suggest you configure the DHCP server on the bridge interface instead of ether1.


Ape
by Ape
Tue Jul 07, 2015 4:55 pm
Forum: General
Topic: I have many packet 34916 are send via PPPoE client interface.
Replies: 8
Views: 1140

Re: I have many packet 34916 are send via PPPoE client interface.

Hi,

in WinBox, go to "Interfaces", open the PPPoE interface window by double-clicking and click on "Torch".
There you can see what traffic is flowing on this interface.

The next steps depend on what kind of traffic you'll see.

Ape
by Ape
Mon Jul 06, 2015 7:55 pm
Forum: General
Topic: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports
Replies: 17
Views: 4291

Re: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports

Hi, I'm sorry to hear your problem persists. What OS the server is running? I had the problem with Ubuntu 10.4, but not with a Windows 7 laptop on the exact same port. This was the scary part I did not unterstand. Changing the switch port the pbx was connect to did not change the ARP issue. I could ...
by Ape
Thu Jul 02, 2015 11:37 am
Forum: General
Topic: what does dual chain wireless card mean?
Replies: 1
Views: 2359

Re: what does dual chain wireless card mean?

Hi gabak, the non-technical explanation for "dual chain" is, that there are "two sources of and two inputs for" the wireless signal. Dual chain therefore also means "MIMO" (multiple in, multiple out). "Dual band" means, that the device will send at for example 2.4GHz and 5GHz at the same time. The "...
by Ape
Thu Jul 02, 2015 11:00 am
Forum: General
Topic: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports
Replies: 17
Views: 4291

Re: CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports

Hi, thanks for sharing your experience Pe3ucTop! I restored the VLAN config with a freshly installed (netinstall) 6.29.1. No more ARP issues - rebooted the unit several times - seems to be stable now. For reference I'll drop the running config: [admin@ASW-07] > /interface ethernet switch export /int...
by Ape
Tue Jun 30, 2015 8:59 pm
Forum: General
Topic: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports
Replies: 17
Views: 4291

Re: CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports

Hi, I just want to drop an update on this: After re-updating to 6.29.1 with netinstall, the booting process does not stop at "starting services" anymore. I think this might be due to the firmware (3.22) I also updated during my first update to 6.29.1. I think 6.12 is somehow incompatible with the ne...
by Ape
Sat Jun 27, 2015 8:38 pm
Forum: General
Topic: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports
Replies: 17
Views: 4291

Re: CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports

Thank you for your input on this. Unfortunatelly I wasn't able to do an export because of the "starting services" issue. The unit was shipped with ROS 6.12, updated to 6.29.1 and then downgraded back to 6.12 with netinstall. I tried waiting about 10 minutes before re-powering the unit - no change. I...
by Ape
Thu Jun 25, 2015 7:35 pm
Forum: General
Topic: [solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports
Replies: 17
Views: 4291

[solved] CRS 125-24G-1S-RM / issues with ARP "forwarding" between tagged and untagged VLAN ports

Hi all, I'm running a CSR 125 24G-1S-RM. Port 24 is master port for all ports as it is a VLAN trunk port to another switch. There are VLANs on the trunked port: VID 10, VID 20, VID 30 and VID 100. Ports 1 - 4 are untagged ports for VLAN 10, ports 5 - 8 untagged for VLAN 20, ports 9 - 12 untagged for...
by Ape
Sat Jun 13, 2015 10:05 pm
Forum: General
Topic: 6.29 750UP running MPLS / VPLS crashes and keeps rebooting
Replies: 2
Views: 1181

Re: 6.29 750UP running MPLS / VPLS crashes and keeps rebooting

Hi, although this is an old post, I would like to share my own experience. As you're not very precise when unit is rebooting, I guess it could be related to too much traffic, maxing out the CPU. I observed the same behavior with ROS 5.26. RB750GL keeps rebooting when passing ~200MBit/s traffic over ...
by Ape
Sun Nov 17, 2013 4:08 pm
Forum: General
Topic: [SOLVED] policy based routing and port forwarding / mapping
Replies: 2
Views: 2049

Re: policy based routing and port forwarding / mapping

Hi,

I figured it out myself: I must add a accept rule for dst ip on router in mangle table (chain prerouting).

Ape
by Ape
Sun Nov 17, 2013 3:42 pm
Forum: General
Topic: [SOLVED] policy based routing and port forwarding / mapping
Replies: 2
Views: 2049

[SOLVED] policy based routing and port forwarding / mapping

Hey guys, I've to WAN uplinks. Default route goes over WAN1 (Telekom VDSL) and for WAN2 (clara.net SDSL) I set up policy based routing, so connections to WAN2 leave on WAN2. The problem: port forwarding for the "Telekom WAN" works fine, port forwarding for the "clara.net WAN" which is routed based o...
by Ape
Wed Oct 30, 2013 12:23 am
Forum: General
Topic: What happens to mikrotik with routeros?
Replies: 12
Views: 2913

Re: What happens to mikrotik with routeros?

You're missing the intended modular concept of the MikroTik devices. They're not an out of the box solution for your problem, I like to see them as advanced router construction kits. It's up to your configuration skills to make them doing what you think they're supposed to do. So yes, this flexibili...
by Ape
Tue Oct 29, 2013 7:37 pm
Forum: General
Topic: What happens to mikrotik with routeros?
Replies: 12
Views: 2913

Re: What happens to mikrotik with routeros?

True that InoX. It's the same thing with almost every software. In this business, if you have critical infrastructure, you stick with the older stable things if they don't lack security and/or needed features. To be honest, I think you wont get any other so rich featured device for the same amount o...
by Ape
Sun Oct 27, 2013 1:34 pm
Forum: General
Topic: I can not install multiple simultaneous PPTP session
Replies: 1
Views: 1175

Re: I can not install multiple simultaneous PPTP session

Hi,

Error 721 is GRE related: GRE packets cannot reach destination. I ran in similar problems trying to redirect the PPTP ports. Since I use OpenVPN, everything works pretty well.

If you habe to stick to PPTP investigate why GRE cannot pass.

Ape
by Ape
Thu Oct 24, 2013 4:21 pm
Forum: General
Topic: Strange log lines
Replies: 7
Views: 1519

Re: Strange log lines

Hi,

at least for the proxy I would assume the following:

The proxy creates a special directory structure for optimized file access speed. I would guess, the creation of this directory structure is meant by "Oct 23 13:15:53 192.168.88.1 web-proxy1: disk setup finished successfully".

Ape
by Ape
Thu Oct 24, 2013 3:14 pm
Forum: General
Topic: Dual wan: connection marks only when using mangle input
Replies: 1
Views: 2169

Re: Dual wan: connection marks only when using mangle input

Or maybe I should have asked: Is there a difference in prerouting and input chain for an incoming connection which will be terminated in the router?

The packet flow diagram says no, because it's "prerouting -> routing decision -> input". Am I missing something?

Thanks.

Ape
by Ape
Thu Oct 24, 2013 10:16 am
Forum: General
Topic: Dual wan: connection marks only when using mangle input
Replies: 1
Views: 2169

Dual wan: connection marks only when using mangle input

Hi, I dual WAN config (PPPoE & leased line with static public ips) on my RB750G running ROS 6.1 I tried to set up mangle rules to route a incoming connection over the WAN interface it was coming in. I know, that I have to use mangle rules to mark the connection and to mark the routing. It's working,...
by Ape
Wed Oct 09, 2013 2:33 pm
Forum: Forwarding Protocols
Topic: Port forwarding/redirection
Replies: 1
Views: 2201

Re: Port forwarding/redirection

Hi, I see no need to change the listening port of your touch screen, because the NAT rule can also do port redirection. I assume following things in your setup: All touch screens listening on port 80. WAN connection is NATed. So, you have to configure a NAT rule: On tab "General" Chain: dstnat Proto...