MikroTik

RackKing

I have need of a 5G LTE connection to AT&T in the US. I am experienced with Mikrotik routing and wireless but have never worked or utilized and LTE connectivity for primary or failover connectivity. Is the wAP ac LTE6 kit compatible in the US? I believe it is using band n260 at 39GHz, but I am n...

RackKing

@k6ccc - thank you sir.

RackKing

If all you want to do is create a binary backup, but leave it on the router, you don't need to allow that for your limited user group. Create a script to create the file and then a schedule that runs the script at whatever interval that you want. You can also have your script send the file somewher...

RackKing

Hi, I have created a user group with limited rights. What Policies would allow them to to save a backup? To be clear, not to export a script .rsc. I backup pulls the passwords, so even if they dumped it onto the same model they would not have access, right? Even if the backup was functional on the n...

RackKing

I am tying the following, but it is not working: /tool> fetch address=192.168.88.1 src-path=/files/custom.json dst-path=/files/skins/custom.json Sorry I am a fetch newbie. Can anyone help with the correct syntax? Amend paths, etc as per your requirements /tool fetch address=192.168.88.1 mode=ftp sr...

RackKing

I am tying the following, but it is not working:

/tool> fetch address=192.168.88.1 src-path=/files/custom.json dst-path=/files/skins/custom.json

Sorry I am a fetch newbie. Can anyone help with the correct syntax?

RackKing

Moving into folders can only be done in two ways. Winbox (can be used in Linux too, with Wine), or using Fetch to directly download the file into the correct folder. Actually a third way is to download using Fetch from one folder to other folder, locally. SCP and or FileZilla? Thank you for this. I...

RackKing

Moving into folders can only be done in two ways. Winbox (can be used in Linux too, with Wine), or using Fetch to directly download the file into the correct folder. Actually a third way is to download using Fetch from one folder to other folder, locally. Thank you for these three ideas.... it seem...

RackKing

Try Winbox instead, Webfig lacks several other functions too

Thank you kindly for your reply.

I have a linux box on the other end so I cannot. I can explore wine.

So there is no command via terminal to do this?

RackKing

Anyone have feedback on this? Normis?

RackKing

Is this a poor question? Or not possible?

RackKing

Hi, I am using webfig to manage this router. Hi, I have a custom.json file that I have uploaded to the router. How do I move this to the /skins folder? Drag and drop does not work in webfig or at least it does not for me. I am really trying to just move the folder from the root to /skins. Can someon...

RackKing

Thanks for this script.

Quick question - is there any advantage to running this from the script call aka

/system script run DhcpToDns

vs having the whole code in the server script area?

Things all good in 6.47?

RackKing

Sorry I spaced post those filters rules.... I will try to get at it when I get home.

That is strange the new device cannot work.

What is the igmp all for?

RackKing

[/quote] Well, you might be right, so I would try this. You mean to allow traffic only to that device? But: It was the input chain rule which caused Chromecast devices to appear. So I added a rule to the input chain, not forward which allows access to the whole network from guest network. The reflec...

RackKing

So the progress is: Chromecast devices work fully on my main network. Guest network does not seem to work, even with mDNS reflection. On Guest network everything is blocked except WAN traffic. As soon as I enable the vlan_guest network to access everything, devices appear. I don't know what I need ...

RackKing

Jotne - thanks for doing this. Good to have options.

RackKing

Anyone have an updated version of this? It is not working for me on 6.47. Thanks.

RackKing

For failover, I may try a simple netwatch script to enable / disable a nat rule that redirects DNS to the router. If the Pi implodes it simply gets sent to the router. Of course if the service stops on the Pi the IP stack might still respond, so it is not perfect. Instead of netwatch you can schedu...

RackKing

@xvo Thanks to you again - I have this up and running and it works perfectly. Well, I don't really know what kind of advice do you expect from me - using Pi-Hole is quite straightforward, even with some complications like for example cloudflared DoH resolver. As for failover, I guess the best way t...

RackKing

You can always post your NAT rules, maybe something is not right... @Zacharias Thanks for your reply. I only have 3 nat rules - the ones listed above and wan masq rule. To get the host name resolution in Pi-hole and make conditional forwarding work as it should putting the Pi-hole on it's own netwo...

RackKing

You are right: putting PiHole on it's own separate network will eliminate the need for hairpin nat at all. That's how I do it in my setup. @xvo Thanks to you again - I have this up and running and it works perfectly. On the "That's how I do it in my setup" virtuous comment, any other piec...

RackKing

@xvo is right, The client was receiving an answer from your DNS server 192.168.1.20 while it was expecting an answer from 8.8.8.8... So you were getting a time out... Adding the Hair Pin NAT rules, the DNS request is dst-Nated to your DNS server and at the same time the source IP is source Nated wi...

RackKing

You are right in your post's topic: the only thing that is missing are hairpin NAT rules for requests from your main lan, that were intercepted by your existing rules. add action=masquerade chain=srcnat src-address=192.168.1.0/24 dst-address-list=DNS_Servers dst-port=53 protocol=udp add action=masq...

RackKing

I have a Pi-hole DNS server setup on my network. I have a guest network on an separate VLAN. The network has been up and running for some time, the Pi-hole is a new addition. FW address list LAN = 192.168.1.0/24 (local) 192.168.2.0/24 (guest) FW address list DNS_Server = 192.168.1.20 I am using 8.8....

RackKing

Hi!

Star connection always best for bandwidth reason, but you can mix daisy with star and create additional fault tolerance with STP.

Thanks for the feedbacK!

RackKing

The interconnection topology should respect the traffic topology at first place. If there is no significant traffic volume between two switches, then there is no need for a direct interconnection between them, so the star topology makes more sense, and even for the backup links it is better that th...

RackKing

@ferdytao

Checking in to see how this is working for you. I am about to set this up for myself. Can you share your setup?

Thanks.

RackKing

Hi, I know this is a trivial question of sorts, but wanted some better feedback. Lets say I am working with a 4011 or CCR1009 copper router. I have a 3 managed switches, 2 in the main rack and one switch in a remote rack. For sake of discussion we can pretend they are 48 port switches. The devices a...

RackKing

Of course you can also write a complete program in Python or whatever that uses API or even telnet/ssh to command the router to do whatever you want. You would then have to run that program on the installer's computer and hope that he will not try to find out what it is doing exactly. It all depend...

RackKing

Of course what I mean is just a script file that does the internet settings (if at all required, i.e. internet is not "ether1 with DHCP"), then it does a fetch to get the real config and an import. You would write it in the RouterOS scripting language and send it as a .rsc file. Ah - I th...

RackKing

Thanks for this.... Then I would have to have a script installed to run the main configuration script.... I don't use fetch much, but it looks like anyone could use that link to pull the script. If anyone else has any ideas please let me know. It depends on whether you want to protect your work fro...

RackKing

If the router is on your network TR069 is designed for remote management. Another option is getting the installer to use Quickset and configure a unique VPN user and basic internet connection. Once you have your configuration with remote access remove the initial VPN config. Configure a Mikrotik MA...

RackKing

Anyone else?

RackKing

@RackKing, are you aware of the fact that any legitimate user with access to the router can issue the command "/export" in the CLI, or look in Webfig or in Winbox to see/get all the configuration? Do you want to allow only yourself to manage the device of the user? If yes, then just don't...

RackKing

scp the rsc script to the device, ssh to the device, and import the rsc, then delete the rsc... Instead of scp you can of course also use "/tool fetch ..." to download the rsc from your own server... Of course the ssh service (default port 22) of the device must first be reachable from In...

RackKing

I'm unfortunately stuck with this. mDNS reflection seems to be working fine, printers, AirPlay devices shows up correctly on every VLAN immediately and works as it should. Though Chromecast devices and Spotify Connect devices don't seem to be working flawlessly. So these devices may need additional...

RackKing

I have looked into this a bit and hit a wall of sorts. I would like to send a script to an installer (remote from me) that is preconfigured and ready to go. They could then "run after reset" and the router would be configured. I do not, however, want them to have access to the configuratio...

RackKing

You can also edit the file in a text editor. Thank you for this - it looks a simple as reordering the entries. Seems to works well. Add specific tabs/entries look a bit different - I can see somethings (ro: true) makes sense, but some of the of other fields I have decided to show are not here. Am I...

RackKing

Are the order of the status page items set by the order in which you click them or there order in the menu? edit: Yes I can answer - it adds them to the status page in the order you add them. Hmmmm can you edit the order? Not really. Webfig is not a dumpster fire after all. I am a slow learner. Some...

RackKing

This is great - RTFM to me "If it is required to use created skin on other router you can copy files to skins folder on the other router. On new router it is required to add copied skin to user group to use it." I must have looked at his 1000000 times in the files area and simply ignored i...

RackKing

So.... I have played around with webfig and it surprisingly.... looks like it will do the job. If anyone can double check me I would appreciate it - 1. I turned on the web service and logged into the webfig page and selected design skin. I then created a "restricted" skin with the options ...

RackKing

Hi, I have some an opportunity to work with an integrator group that wants me to configure the router, support them, upgrade, etc... MSP stuff, but they need access to certain things, specifically the ability to setup DHCP reservations. I do not want hem to be able to export my scripts or see detail...

RackKing

Not sure if is proper way of handling DNS, but I left Cloudflare as DNS under DHCP-Server>Network and use NAT to redirect to my Pi-hole instance. My Pi-hole has the router set as it's DNS so that I could use Static DNS and the router had Cloudflare set for it's DNS. I have some that I don't want go...

RackKing

LOL - 2 days ago Pihole V5 was released and ..... wait for it..... Local DNS records can now be added. Yay - it seems to be working. They have made a number of enhancements. You can read more about it here: if you are so inclined. https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/#page-content I a...

RackKing

Hi, I have been playing around with PiHole on Raspberry Pi. It has been working pretty well as a network wide ad blocker and has certainly increased performance on mobile devices. I am specifying the DNS server in the DHCP server/network/dns servers setting. I have not found a good way to specify st...

RackKing

It's just a shame that a capable os doesn't have a process to handle multicast across bridge/vlans! No, it's not. The topic is about link-local multicast and that's the way it is supposed to work. routerOS does in fact offer "real" multicast routing with PIM and multicast package. -Chris ...

RackKing

Auto upgrade MT routers may fail. There has over the last years been several times bug has been introduced or change to some like Wifi that made the router stopped working. So a delay is minimum thing that should be in the script. But If I had lots of routers and lots of time, I would have setup a ...

RackKing

So, I picked up a hEX and ... the boards are identical size and layout - ports, power, usb, LEDs, etc. The hAP board will fit very nicely into the hEX case for anyone interested :-). Really? Nice find! I had not thought of that. When you say hEX, you mean this one ? Indeed RB750Gr3 - below are some...

RackKing

So.... I picked up a hEX and.... the boards are identical size and layout - ports, power, usb, LEDs, etc... The hAP board will fit very nicely into the hEX case for anyone interested

.

RackKing

3D printing? You could design a brand new device, RackKingTik ac² ;) Ah... very nice - that has a nice ring to it! I am doing some 3d printing. The OEM hAP ac2 case is anything but square, tapering in all directions - ugh. Modelling that would be a nightmare, but I might be able to do a rectangle f...

RackKing

Can the hAP ac2 board fit into any other case - like a hEX case? Front port connectors look the same. I do not have hex handy to open. The RB450Gx4 is very close to the performance of the hAP ac2..... I need a square case and don't use the Wi-Fi anyway.

Thoughts?

RackKing

Hi - Thank you for all your great work on this! I have been testing it was great (perfect) success. I would like to offer a request for future enhancement. Some background.... The issue for me comes down the risks of auto update VS un-patched and updated systems in the wild. In my experience it is e...

RackKing

My opinion, as you've explicitly asked for it, is "yes to automatic update in terms of not logging in manually to every single device in my network, but no to each device blindly upgrading to the newest LTS release as soon as it appears on Mikrotik web". Whoever manages a large installed ...

RackKing

Since you explicitly asked me to donate my 5 cents ... I've nothing to add to @sindy's endless wisdom.

Wow can I get a refund

You can pile on.

RackKing

It is good and recommended to keep your Device up to date. But i do not think that this means that we should update to every single new release that comes out unless it Fixes a Security issue or a Bug that was causing problems to our setup... But this is just my opinion... Thanks Zacharias that mak...

RackKing

Thanks again for the feedback.

@sindy @mkx - If you two could chime in on my other post I would appreciated it.

I was hoping @anva would have some colorful input

viewtopic.php?f=2&t=160551

RackKing

I suspect his will be somewhat controversial and I hope to get many different "insightful" opinions :-) I have seen and dabbled with some the of the auto update scripts that are out there. Some of them do alerting, backups, stable/long-term channel choice, etc... - really well done. My que...

RackKing

"A huge advantage where there are a lot of LTE users in the area..." Don't they mean LTE service providers? No, users indeed. You have to read the previous sentences properly: It enables carrier aggregation, allowing you to use the LTE connection with speed up to 300 Mbps. It works by usi...

RackKing

I saw this was released in the newsletter today. Is built in LTE designed to be used as a fail-over/aggregation in addition to a traditional broadband connection? I am surprised it does not have an external LTE antenna option. "A huge advantage where there are a lot of LTE users in the area...&...

RackKing

This has really been working out well. Thank you so much again. Jotne's comment is valid - perhaps that could be a tweak in future versions? From a scheduling frequency standpoint, would it be adequate to run this every 7 days? Or is one day more desirable to catch more critical security patches? Ju...

RackKing

I did a quick test and L2TP server in RouterOS doesn't seem to listen on IPv6.

Thank you very much for this.

RackKing

As mentioned unless your ISP provides you with an IPv6 WAN address there is no way they will be able connect directly using IPv6, so that is the starting point. If the Mikrotik L2TP server does not support IPv6 that will be a non-starter too. If they only have IPv6 their provider will be providing ...

RackKing

IPv4 and IPv6 are two distinct protocols. Similar, but not the same. You can't have IPv6 addresses in IPv4 firewall. And since you ask about something so basic, I should point out that most important first step is to have IPv6 connectivity, which is not automatic, your ISP must provide it and many ...

RackKing

HI, I have a 3011 setup with a L2TP/IPSEC VPN server and have create a white-list for remote clients. One of these clients has an IPV6 WAN address. I know I need to add the IPV6 package, but how much more involved is it beyond that. I am just looking for some advice to get started. Can I use the IPV...

RackKing

Hi,

I have a MT router on site with a l2tp/ipsec vpn up and running. I am connected remotely via with W10 client to the site to problem. I have a remote L2 adoption/configuration tool on my remote PC that I am tying to use over VPN. Is there a way to make this work?

Thanks in advance.

RackKing

Here is my version of auto-upgrade script, it has many features such as backup to your email before performing RouterOS upgrade process
https://github.com/beeyev/Mikrotik-Rout ... and-update

This looks fantastic - thank you for this.

RackKing

I would love to see:
RB4011 with M.2 LTE & USB 3 port.

+ change form factor to real rack mount chassis, i.e. 3011rm... and while at it, add the buzzer back.

RackKing

Very nice - thank you. Nice Addition to the script add filter rule to block mac address from using internet :local recipient "someemail@server.com" /ip dhcp-server lease :if (($leaseBound=1) && ([/ip dhcp-server lease find where dynamic mac-address=$leaseActMAC]!="")) do ...

RackKing

double

RackKing

Add an "interface watch" for link-up / link-down functionality to script in. Similar to Netwatch host.

RackKing

Add an "interface watch" for link-up / link-down functionality to script off of. Similar to Netwatch.

RackKing

priority-tagged ... I've never seen ones, but legend goes that if one wants to use QoS field, that one comes as 802.1Q tag (commonly referred to as VLAN tag, but there's more to it) with VID set to some invalid value (e.g. 0) ... which technically makes such frame "not untagged" ... in pa...

RackKing

anyone?

RackKing

Thanks anva -

Any idea what "priority" tag means?
How is the admit all any different from admit untagged and tagged?

RackKing

I have been reading over pcunite's great article - "Using RouterOS to VLAN your network". Many thanks to him, this is a must read. Very, very well done. I am using some of his script to support my questions here. His post has got me thinking about a couple of questions I would like to get ...

RackKing

Is there a simple way to alert on the status of an interface - link up or down? Then do some alerting like you can in Netwatch?

I believe I can create a script to watch the interface and trigger - but it would need to run very frequently to be of value for me in this case.

Thanks in advance.

RackKing

Thank you pe1ch and to all who responded.

RackKing

+1

It would be a useful tool for remote network testing

agree - my +1

RackKing

What eworm wrote is right. Backups on the router itself are lost when the router no longer works, so they should be stored somewhere else. "github" is a webservice that hosts "git", which I use locally. This is a Linux program but it also exists for WIndows. However, there proba...

RackKing

Thanks again - I will look toward windows solutions. I looked at git hub in the past. Sounds like I will revisit it. I do like the idea of something local. It also serves as the backup for your configurations, keeping them in the router is not safe. Can you expand on this? What do you specifically m...

RackKing

There is a feature to set some text notes in the /system note command but it does not seem to be available anymore on the GUI. However, to do what you want I suggest to: - use the comment facility to indicate the purpose of config items like firewall rules etc. - get some version management softwar...

RackKing

Hi,

Is there a way to store text notes for a change log on the router? I could create a dummy script, but that seems odd.

When I make changes and backup/export the configuration I would like to keep track of what I changed on that router. I am too old to remember anymore.....

Thanks

RackKing

I've got this script from a search but also no email sent when a new device connected to network I put it in dhcp server alert with default settings of new alert :local recipient "someemail@soemserver.com" /ip dhcp-server lease :if ($leaseBound = 1) do={ :do { :tool e-mail send to=$recipi...

RackKing

So.... I did some testing with a 4011, 3011, and hAP ac^2. I measured these using a Kilowatt EZ P3 using the appropriate OEM PSU. I had 5 Ethernet devices connected when taking the measurements. RB4011 Specifications PSU: 24V - 1500mA Max Power: 33 W Max without attachments: 18 W Measurements Amps: ...

RackKing

Can someone tell me why the manufacturer gives this product with a 24V 1.5A since as you say it works with no problem at 24V 0.8A? For me the answer is that there is a reason for this. Am just really curious to have your opinion since you easily ignore the PS ratings the manufacturer gives for his ...

RackKing

Can someone tell me why the manufacturer gives this product with a 24V 1.5A since as you say it works with no problem at 24V 0.8A? For me the answer is that there is a reason for this. Am just really curious to have your opinion since you easily ignore the PS ratings the manufacturer gives for his ...

RackKing

Specs say that max power draw without attachments (whatever those might be) is 18W. At 24V that translates to 0.75A. If your old 2011 came with 24V 1.2A power adapter, then you should be fine. Only Krishna knows if the old PA is still capable of delivering its rated current though ... Thanks mxk. O...

RackKing

Since it comes with a PS of 24V 1.5A that is the suggested.
Otherwise you should measure the current draw of the device unter full load and see how much current it draws.

I can do that I was just searching for the simple answer first .....

RackKing

I would never use a Power supply of a lower rating than the manufacturer suggests.
Personally i would extend the cable if needed.

Yes I'm just not sure what the manufacturer suggests

RackKing

Hi, First let me say the rack mount ears for the RB4011iGS+RM are simply terrible. Ugh. Second - I replaced an older 2011 with a 4011. The 4011 PS cable is shorter than the 2011 and too short to reach. Does anyone know the max amp draw of the 4011. I see the amp draw per port - but not the draw for ...

RackKing

It is expected in the latest RouterOS versions. You can disable it with: /system note set show-at-login=no Can i disable it only in Winbox logins? That is a good question - it used to popup every time a new terminal was opened. Now it seems to do both - winbox log in and new terminal. I probably mi...

RackKing

I can create a Static DNS name for the router and use that. Any other ideas?

RackKing

It is expected in the latest RouterOS versions. You can disable it with:
Code: Select all
/system note set show-at-login=no

Ok - thanks

RackKing

one thing you can do is to change default winbox port 8291 to something different in one of the routers in that way you can add two routers with the same IP addreses i tried this and it worked Thanks for this .... but then I would have to use different ports for each one. Looks like no easy way to ...

RackKing

I have updated winbox and am using the latest stable 6.45.7. Every login via winbox reveals the system not popup - not just note at top of terminal.

Is this now the expected behavior and I just missed it?

RackKing

Can anyone provide some feedback? Any work around?

RackKing

Update your winbox, clear its cache and test again.

Thanks for this - unfortunately it did not work. It keeps updating.

Anyone else? Is this the expected behavior?

RackKing

Update your winbox, clear its cache and test again.

I will give the cache a shot.

RackKing

so.... I am creating an entry of 192.168.88.1 with a user name of JimBob and some huge password. I also may add it to a Group like Company XYZ, and perhaps provide a location Note=SunnyPlace. I then use a VPN to access said 88.1 router. Life is good. When I add another router with that same IP (192....

RackKing

For all named objects, you can actually replace [find name=xxx] by just xxx in the get (and other) commands.

Thank you - that is very helpful for me. No I just need to remember

.

RackKing

Does

/ip dhcp-server alert add alert-timeout=10m disabled=no interface=bridge valid-server=[/interface bridge get [find name=bridge] mac-address]

not work?

Perfect - thank you.

RackKing

I am trying to write a script for rogue DHCP alerting to be used on a new router. I am trying to get bridge MAC address and plug it in automagically. Alert command: If I copy the command from another router that MAC is wrong. /ip dhcp-server alert add alert-timeout=10m disabled=no interface=bridge v...

RackKing

I am writing a new script to add DHCP alerts to a new router. I need to grab the new router's bridge MAC address and use it in the valid servers filed. Is there a command I can use in my script to pull that?

RackKing

Question 1 - What is the difference between these two approaches and their advantage or disadvantages? Is there ever a time you would use both? The firewall rules allow any type of connection to the router from your address list. While "available from" is tied to a specific service. Howev...

RackKing

I use both a. firewall input rule limited by source address list and in-interface list (not port specific as the admin I want full access)*** b. use ip services winbox that limits to specific IP (I add IPs when needed depending on what network I will be working within). c. for login System users d....

RackKing

Question 1 - What is the difference between these two approaches and their advantage or disadvantages? Is there ever a time you would use both? The firewall rules allow any type of connection to the router from your address list. While "available from" is tied to a specific service. Howev...

RackKing

I have a few questions and will try and be as clear and concise as possible. My question is specific to these areas - I am not asking for "securing your router" in general items. Considering that, I understand you can limit router access via winbox with filter rules that look like this for...

RackKing

Thank you for this - are you saying add the user to an interface list? It looks like you can specify an interface list in the profile. I would need to create different VPN profiles as opposed to default. Do i have that right? You can create "L2TP Server Binding" interfaces for every user,...

RackKing

Should I consider a port knock on prior to allowing a VPN connection? That's not needed. L2TP+IPSec will be secure enough. Then allow that IP address via a firewall filter input rule access to Winbox port 8291. Or you can allow access from the l2tp-in interface created for that user instead. Thank ...

RackKing

Just looking for confirmation and/or recommendations to further harden. For remote access, I am planning on using a L2TP/IPSec VPN connection. I am planning on giving the admin VPN user a specific IP address say 192.168.88.5. Then allow that IP address via a firewall filter input rule access to Winb...

RackKing

Do not insert lists that are bigger than 63KiB, those would only will be loaded incomplete. # Written by Shumkov # Adapted by blacklister # 20191108 /ip firewall address-list :local update do={ :do { :local result [/tool fetch url=$url as-value output=user]; :if ($result->"downloaded" != ...

RackKing

Do you have a dedicated link the fullbogons piece? I cannot seem to fined a direct url for it? Fullbogons_IPv4: http://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt All bogon lists: https://www.team-cymru.com/bogon-reference-http.html Bogons via BGP: https://www.team-cymru.com/bogon-refere...

RackKing

Thanks you for that.

Do you have a dedicated link the fullbogons piece? I cannot seem to fined a direct url for it?

RackKing

Is there a way to check the file size and have it trigger the email tool if it gets beyond the max file size?

RackKing

That's right, I took FireHOL Level1 as the basis. I removed “Feodo Tracker” and “Ransomware Tracker”, replaced “Bambenek C2” with “Bambenek High-Confidence C2” (as Bambenek recommended it myself), and also removed “Fullbogons” - I get them using BGP. Makes perfect sense. Thank you again so much for...

RackKing

anyone?

RackKing

malc0de

$update url=http://malc0de.com/bl/IP_Blacklist.txt description="Malc0de" delimiter=("\n")

RackKing

Do not forget about file size - maximum 63 KiB . If the file size is larger than the maximum, only part of the file will be processed ( the first 63 KiB ), and the rest of the file will be discarded. FireHOL Level2 is bigger than 63 KiB :) What is general recommendation on how often to grab new lis...

RackKing

Do not forget about file size - maximum 63 KiB . If the file size is larger than the maximum, only part of the file will be processed ( the first 63 KiB ), and the rest of the file will be discarded. FireHOL Level2 is bigger than 63 KiB :) What is general recommendation on how often to grab new lis...

RackKing

Nice Work! I added FireHOL Level2 to the script as well, in case you're interested. Just added this line: $update url=https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level2.netset description="FireHOL Level2" delimiter=("\n") -zeb This appears to fail fo...

RackKing

Nice Work! I added FireHOL Level2 to the script as well, in case you're interested. Just added this line: $update url=https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level2.netset description="FireHOL Level2" delimiter=("\n") -zeb This appears to fail fo...

RackKing

Nice Work! I added FireHOL Level2 to the script as well, in case you're interested. Just added this line: $update url=https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level2.netset description="FireHOL Level2" delimiter=("\n") -zeb This appears to fail fo...

RackKing

Hi - This looks great. I will give it a try. Update - I just run this and it works great - no errors and works perfectly What is general recommendation on how often to grab new lists - daily? Am I correct it removes or ignores duplicate entries? It would be great to keep this updated with additional...

RackKing

So.... I was asked about DPI statistics as provided by like say a Ubiquiti USG product. Do you have any recommendations for add on solutions to a MT to get this kind of data in a similar dashboard? The target would be for small to medium sized business.

Thanks in advance.

RackKing

Hi, I just want to make sure I am interpreting this correctly. Here is some basic info copied in from the Tik Site for 512 bytes hAP AC^2 - Routing 25 ip filter rules 986.3 RB3011 - Routing 25 ip filter rules 836.0 RB4011 - Routing 25 ip filter rules 2,560.8 I am looking at these devices for routing...

RackKing

Hi anav - On this - add chain=forward action=accept in-interface=WAN \ connection-state=new nat-connection-state=dst nat Does/should the connection state need to be new? Or does it matter? Thanks ... Okay your individual rules need to be in NAT, only one general firewall filter rule (forward chain) ...

RackKing

Hi, I have a script for hAP ac2 that has wifi settings. I notice that when I create a virtual AP it creates a random (I think) MAC address for it. I realize this a requirement. When I export that config and want to use it in another hAP - can I use the same MAC the original one generated? It has the...

RackKing

I have done some more testing on various versions of this script and typical failures that in my mind simulate a malicious attack.. Here are my findings. The script will work properly if the log messages is in this exact format: x.x.x.x phase 1 negotiation failed I believe this is when the VPN serve...

RackKing

7d does not work, max 24h, since field is just hour. Did you try then end of line $ ? :local loglist [:toarray [/log find message~"negotiation failed.\$"]] Ah - thank you for the clarification on the 24h part. The first time I ran that as I indicated in #22 I go nothing. How when I run it...

RackKing

I also went back to post #6 and re ran those scripts thinking that since we had different "negotation failed" messages these may work. But I did not receive out put from either. I did adjust the time back far enough to grab them. Below is the second one. :put [:toarray [/log find time>([/s...

RackKing

I was working with the script again in an effort to get it going - here is where I at. This: [ :local loglist [:toarray [/log find (message~"negotiation failed" || message~"src_ip")]] :foreach i in=$loglist do={ :local logMessage [/log get $i message] :local ip [:pick $logMessage...

RackKing

Again - thank you for your help. I really appreciate your help like to get his working. Here is the output from the first version https://i.imgur.com/zbjNFkZ.jpg Or this may do, make sure negotiation filed. is at the end of the line The second version did not pull anything. So the first version appe...

RackKing

Here is one where id work the IP and message = is the IP address

RackKing

Thank you for your continued help in this.

This is a sample of what I get.... it is about 20-30 lines longer.

RackKing

For clarity - when I use what I believe is the "within last 24 hour" part of the original script I get no output. [ :local loglist [:toarray [/log find time>([/system clock get time] -24h) message~"negotiation failed"]] :foreach i in=$loglist do={ :local logMessage [/log get $i m...

RackKing

For anyone who may see this - here is some code I have cobbled together to produce the following output. To be clear - this was code that Jotone wrote and is his credit. I am simply trying to find why it does not work for me. [ :local loglist [:toarray [/log find message~"negotiation failed&quo...

RackKing

Ok Jotne - Thank you for the links. I assume the script you posted works on your MTs? I would have thought that I could copy a working script and duplicate the results. I will struggle with it some more, but probably do not have the programming skills to work through it. Thanks again for your efforts.

RackKing

[ :local list [:toarray [/log find message~"negotiation failed"]] :put "ID-List" :put $list :put "" :put "Log lines" :foreach i in=$list do={ :put [/log print as-value where .id=$i]} ] So I ran that - and the log started filling up with lots of lines... I had...

RackKing

When I copy that in CLI I get the following - ID-List Log lines That is it - with two blanks between. The log is filled with at least 10 "negotiation failed" lines in the last 24 hours. Could the clock be causing a problem? The log is stored in memory - I assume that is ok as default? upda...

RackKing

Hi - Here is what happens with the first part - 1. dynamically created a FW address-list rule named IPSEC with and address of phase1. Timeout is correct. 2. Terminal L1: script=IPSEC_failed src_ip=phase1 3. Terminal L2: failure: already have such entry note: I deleted the previous phase1 entries for...

RackKing

Thanks Jotne - I will try it later and report back.

RackKing

I was trying to copy your original post in to the script windows and not CLI. Adding it Via CLI worked better. It ran and gave me a FW entry this time, but it does not pull the IP from the log entry. Here is the log add from the script: script=IPSEC_failed src_ip=phase1 That is the beginning of the ...

RackKing

When I add the all the script code via copy/paste it fails. So this must be some CR issue on my end.

I will try and sort it later.

Thanks for your help

RackKing

Got it - I understand and appreciate your comments.

Your concise explanations are great.

RackKing

Thank you for this!

RackKing

Probably not massively helpful for you but I successfully use the Cisco GLC-SX-MM SFP's in all of my MT devices. Dirt cheap on the second hand market as well.

Thanks for the tip - very helpful

RackKing

Thank you. For a road warrior scenario - is there an approach that will work? Alternative VPN or otherwise? As for firewall handling of the contractor, there is plenty of possibilities: you can set a specific remote-address in the contractor's /ppp secret item, or you can make that item refer to a d...

RackKing

Thanks sindy - Can the address be the address assigned to the them in the /ppp /secrets local-address? So when those credentials are used they always get the same IP that I can use in FW filter rules? I am assuming that "Incoming connection requests from the IP address" refers to the contr...

RackKing

Looks like there has to be a peer and an identity. Did not get it working.

It looks the the key in peer1 is taken from the L2TP server settings.

RackKing

I have an L2TP/IPSec VPN server up and running on our Mikrotik. I would like to add a VPN user who is outside our organization (i.e. not our employee) in order gain access to certain assets for support. I know I can specify a remote address and use firewall filter rules with that address to limit ac...

RackKing

Thank you again.

RackKing

"So either add an interface-list=LAN item to the /ppp profile" This looks like a cleaner way to do it. Should I add the interface-list=LAN to both the default and default-encryption profile? To test, I added it to the default-encryption profile and it worked. I did not realize you could dy...

RackKing

Ok - good idea # jun/09/2019 17:49:01 by RouterOS 6.44.3 /interface vlan add interface=main_bridge name=main-v10 vlan-id=10 /interface list add name=WAN add name=LAN /ip pool add name=main ranges=192.168.254.50-192.168.254.199 add name=vpn ranges=192.168.50.50-192.168.50.80 /ip dhcp-server add addre...

RackKing

Hi - I have an L2TP / IPSec VPN server configured and working (except for internet access) as per these instructions - https://wiki.mikrotik.com/wiki/Manual:Interface/L2TP The VPN tunnel works and I can see the assets on the remote networks - as the firewall allows. The VPN network has a nat Masq ru...

RackKing

You've mixed things together in the filter rules. As you've combined the conditions which "new" packets must meet in order to be accepted with a condition saying they must not be "new" in a single rule, no "new" packet will ever go through, so no connection will ever b...

RackKing

Hi, I have a Unifi controller behind a Mikrotik 3011 that works for my local gear. I want to add another site with APs that are at a friends house. I got the port list from https://help.ubnt.com/hc/en-us/articles/218506997-UniFi-Ports-Used that need to be open. Can someone confirm my firewall rules ...

RackKing

Hi,

I am trying to terminate L2TP/IPSec VPN connections after 15 mins of inactivity.

I tired using PPP/Profile/Limits/Idle Timeout to make this happen it does not seem to work.

Any advice?

RackKing

Thanks guys - that was what I was looking for.

RackKing

Any ideas?

RackKing

anyone?

RackKing

What is the right way to do this - There is an main on premise Unifi server/controller running at 192.168.99.10. I need to allow remote owner Unifi gear in to see the controller for normal operation. Here are the ports Unifi has identified as required. - that all makes sense. https://help.ubnt.com/h...

RackKing

This is more of a subjective questions, but... I want comment out some the DHCP leases the router is giving out. Most of the time this is done in conjunction with assigning a specific IP address outside of the pool/scope. I am not as concerned with what the IP address is - simply who/what the host i...

RackKing

Hi, Question - I have a Tik router connected behind a sonicwall router running a 192.168.33.1/24 network. There is a Windows server running DHCP on that network at 192.168.33.6. I want to get clients connected to my Tik to pick up and address from that HDCP server at 192.168.33.6 - ISP >> Sonicwall ...

RackKing

An update for anyone interested. I've just spent the last few weeks testing several different NMS packages. From licensed to free. Zabbix was a close contender, Solarwinds was simply outside of our price range. We've decided on NetXMS. NetXMS has ticked serveral major boxes for us. It may of easily...

RackKing

Not just for outlook clients, if your DNS is not good in AD setup, it will brake replication, etc. In an AD environment, use Windows for DHCP and DNS, they integrate with each other and serve a much bigger picture than just IP Addressing and Name resolution to browse the web, etc Thanks CZfan. I he...

RackKing

I manage all aspects of a network. Routers, switches, servers, video, VoIP, and pretty much anything else that gets an IP address. If there is a real server (or servers) on the network, one or more will be handling DNS, DHCP, and pretty much any other client/server type of service. Routers are quit...

RackKing

My view: DHCP server and DNS server are L3. If I'm in charge of L3 part of network infrastructure (i.e. address space allocation, perhaps some LAN DNS services[*]), then I'll request to deal with those services exclusively (doesn't matter if it's service running on top of some core router or dedica...

RackKing

Hi, This is more of a general networking questions than a Tik questions for sure. I am curious to know what others are seeing currently and what the trend it. I suspect the answer moves depending on the market we are talking about. I currently deploy Mikrotik in to a wide range of scenarios from res...

RackKing

Thanks for this. I am trying to get a PC to cast a chrome tab. I think the guest features only works with cast enabled apps from ios/android.

I wonder if Avahi works for this. I have never used it....

RackKing

Anyone?

RackKing

How can I do this in ROS?

RackKing

This has become more of a problem recently, particularly when an ISP cable modem and Mikrotik router reset occurs due to power failure. The issue occurs when router's DHCP client makes a request prior to the modem being online and gets a private dhcp IP address from the ISP cable modem. When the lea...

RackKing

I'll report what Wiki says: Script that will be executed after lease is assigned or de-assigned. Internal "global" variables that can be used in the script: leaseBound - set to "1" if bound, otherwise set to "0" leaseServerName - dhcp server name leaseActMAC - active m...

RackKing

I'll report what Wiki says: Script that will be executed after lease is assigned or de-assigned. Internal "global" variables that can be used in the script: leaseBound - set to "1" if bound, otherwise set to "0" leaseServerName - dhcp server name leaseActMAC - active m...

RackKing

I see the DHCP client can execute a script. I cannot seem to make the script execute - under what circumstances should this trigger? I assumed a manual release would trigger the script. Or any change in the DHCP client status - any thoughts? Thanks.

RackKing

I have read this but want to make sure I understand correctly. If I have a "blacklist" created that is dropped bay a rule in raw - there is no need to drop it anywhere else? To put another way - anything in raw that gets dropped will never be seen by the input and forward chains in the fil...

RackKing

It appears there is a limit to log prefix from a FW rule. Is there a way to increase this? They seem to get cutoff with a ":"

RackKing

@ mkx

"Order matters only within same chain. src-nat and dst-nat are different chains."

That makes perfect sense - thank you

RackKing

I have multiple masquerade rules but they are for each WANIP in a failover setup so its pretty clear cut. All LAN users are affected. However if I want to have specific users have their private IPs translated by a specific WANIP, then using source address list in the equation OR source interface li...

RackKing

Hi - this is probably a silly question, but... I know the default NAT masq rule is: /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" \ ipsec-policy=out,none out-interface-list=WAN Is the this single rule the defector standard? I have read/seen where this ha...

RackKing

I use a mixture of both. As you mentioned, Interface List is like "Zone" based, "trusted", "untrusted", etc. but sometimes need to be more granular, then I use Address Lists, etc Thanks CZFan - the granular part makes good sense. Never thought of it like that. I am sti...

RackKing

I too do similar with my setup. Interface list as an example "WANs" for my 2 WAN interfaces which is good for firewall & NAT rules and make use of address lists in multiple ways. I think of it more as interface-list for hardware interfaces and address-lists for IP related. Sometimes b...

RackKing

I was thinking about how to use these more effectively and efficiently. I typically use an interface-list for WAN and MGMT but use firewall address-list for LAN segregation. Most of the time ether1 is the only interface in the WAN list so I am not sure what I am really saving. I suppose it is easier...

RackKing

Furthermore, you can associate a RADIUS to manage the mac-address/password association. There are few presentations that covered this topic. MikroTik was there for ages, too bad they didn't use it as a good advertisement. Do you have a link to the presentations? I assume you mean youtube, but I can...

RackKing

Are you saying that the smart phone and the SONOS will have to be on the same VLAN in the house?? Yes. Unless you implement either of the two solutions above (properly configured igmp-proxy or PIM) thus allowing you to connect controllers PCs, iPhone app, etc... with Sonos equipment Connects, Amps,...

RackKing

mDNS server for Chromecast/Bonjour/ZeroConfig across VLANs.

WiFi networks are too big to have all the available devices all bridged to the LAN.

Would be nice to then firewall what devices are discoverable.

m2

RackKing

Hi anav - Sorry for the late reply. Yes the sonos is very different and relies the controller PC or app to see broadcast/multicast traffic in order to work. Control is all local and the services come through the cloud. They can create there own hidden "sonosnet" wi-fi mesh on 2.4 which can...

RackKing

@RackKing: Yes, My Sonos Speakers are in VLAN30 and the controllers are accross different Subnets.It works for me, but sometimes it takes some time until a controller finds the Sonos players (especially the Android widget). For updates it is recommended to join one controller to VLAN30, otherwise y...

RackKing

I guess the reason for things stopping with use-ip-firewall-for-vlan is that you allow DNS requests from interface list LAN, but that one doesn't contain ether ports ... and those are ports seen by firewall when used for vlan filtering.. I gave the above a shot and moved to and scr address list as ...

RackKing

Out of curiosity, why do you want to use firewall on traffic between hosts in vlan90 iff they communicate via routerboard? Vlan firewall doesn't add security for devices which are not in same vlan (their traffic will pass the usual IP firewall anyway) and doesn't filter anything if devices can talk...

RackKing

Well, when I started writing my response, your configuration export wasn't there yet, and I haven't noticed it to appear while sending my response. The dstnat chain of nat is also part of the "prerouting" path through the IP firewall, so I would suspect that the action=redirect may get co...

RackKing

Hi sindy,

The only thing running in the raw on mangle section are the dummy Fasttrack counters. I assume those would not cause any issue?

Anything else I should check?

Thanks.

RackKing

Hi sindy - thanks for taking the time to help. Well yes - to put it a different way. The firewall works as I desire, but when I added the NAT redirect rule the clients stop getting DNS resolution from the router. This is with the use-ip-firewall and use-ip-firewall-for-vlan enabled on the bridge. Th...

RackKing

Thank you all for your replies. I have narrowed it down some, but must admit I am not sure why it is failing to work. I have a NAT redirect rule for DNS. That is the rule the stops the DNS from resolving with IP firewall and VLAN use turned on. When they are disabled DNS works fine. In torch - the m...

RackKing

@Spartacus I was thinking about your FW - nice. I have some questions to pile on :-). Sonos - do those rules allow another user on one subnet to control and connect via the Sonos ap to the hardware on a different subnet? Seems like a good idea to keep the "noisy" sonos equipment on its own...

RackKing

Thank you for your reply. The system is working with this unchecked. I have an input rules working that allows in UDP, TCP requests from the lan port 53 while blocking WAN requests. Name resolution is working properly. When I turn on Bridge / use IP firewall /use VLAN that rule stops running. There ...

RackKing

Hi, I have some VLANs running on one main bridge. Everything is working with use IP Firewall turned off, but when I turn it on DNS resolution stops working. I have the appropriate DNS rules to allow input to router from these networks specified with address lists. Vlan filtering is used on the bridg...

RackKing

Good stuff - great read!

RackKing

So - I took the case apart and indeed the board was not seated into the slots at the back of the case properly. It also explains why the LEDs were not very bright as well. I gently pried up in the bottom slot by the power input with a thin screwdriver and the front retaining bracket came off. I have...

Search found 380 matches