MikroTik

usdmatt

I'll try going through your comments in order - I think you can delete this default rule which sticks around and is not so easy to find (static tab under IP DNS). I could remove the static DNS entry for "router", but I don't really see any harm in it being there. What is the purpose of the...

usdmatt

Config included below - Lan ports 1-5 are in a bridge Wan is 6 Wifi AP is in 10 simply as a standalone port with its own DHCP Both port10 and bridge-lan are in the lan interface list. Firewall rule for "lan" interface list is matching wifi packets but nothing through bridge-lan # feb/26/20...

usdmatt

Hello, I've just upgraded a router (2011) that was running the older firmware that still used the master/slave options to the current version 6.44. As part of this it automatically created a bridge, and also seems to have added this to the "lan" interface list. However, it seems that the e...

usdmatt

Thanks for the links. I think I'm going to have to do a lot of testing.

usdmatt

Hello, We currently use a couple of CCR routers to handle PPPoE connections from our wireless users. I'm now looking at ways to try and improve our bandwidth management. Currently we just use the Mikrotik-Rate-Limit radius attribute, which sets up a simple queue for each user. This works fairly well...

usdmatt

If the Mikrotik was supplied by the ISP then it's entirely possible they will give themselves remote access by adding an allow rule in the input chain from their network. We often do this as if we provide a Mikrotik, we tend to also look after it - Most people struggle to open a port on a basic web ...

usdmatt

nslookup would just give you the address(es) of the servers providing the basic website. I only get a single address returned, and it's highly unlikely that's the only address. On top of that, there are various other domains such as ytimg.com used to load parts of the website, most of which will be ...

usdmatt

I'm sure you're right but is there any information from Mikrotik which shows that src-nat is preferred over masquerade? All I can find is a post from a few years ago from Mikrotik support saying there should be no visible performance difference. (https://forum.mikrotik.com/viewtopic.php?t=94776). I ...

usdmatt

/ip firewall nat add chain=srcnat action=masquerade out-interface=ether2 /ip firewall nat add chain=srcnat action=src-nat out-interface=ether2 src-address=192.168.2.1 to-addresses=172.16.1.2 Also looks like last reply forgot to change destination network in the default nat rule /ip route add dst-ad...

usdmatt

I have connected my mikrotik CRS125-24G-1S-2Hnd to my home network and port 1 is connected tot het internet. Even though Mikrotik market this themselves as a "perfect SOHO gateway router", their switch products tend to suck at routing. This has a 600Mhx CPU, while a HEX S at 1/3 the price...

usdmatt

If it's just a switch you probably could of got away with the cheaper CSS326 (2/3 the price here in the UK) I would expect the OS to make no difference in regard to switching as it's all done in hardware. SWOS is a bit easier to configure, and you could argue that it's impossible to accidentally con...

usdmatt

Do I really understand this correctly, that when connecting to a router with one of these roaming protocols enabled, it sends out a hash which can be brute-forced to retrieve the PSK? Did no-one making the specs think this might be a problem? It's surprising it took this long to find considering the...

usdmatt

Have a look at the CPU usage when doing the transfer. The absolute max that router can handle according to the test results is 1.4Gbps in the most ideal situation (fast path & 1518 byte packets). It drops off heavily with smaller packets and filter rules. Fasttrack should help. Interestingly the...

usdmatt

This isn't really a surprise for most people. Every service you run will get hit by attacks. Software like fail2ban has existed for years specifically to allow you to run a service (SMTP/HTTP/SSH/whatever) that is going to get abused, and automatically block repeated hack attempts. I've seen the ran...

usdmatt

What's the router you're using and the VLAN config?

usdmatt

Looks like that IP belongs to Mikrotik so it appears to be some cloud/time/package check to their servers. This recent reddit post had a similar issue and tried to establish exactly what connects out from the router - https://www.reddit.com/r/mikrotik/comments/94ru3u/cloudmikrotikcom_dns_queries/ Th...

usdmatt

This seems to be a common issue with the absolute overly secure router os. RouterOS by default functions as a perfectly standard NAT router. There is no reason a device designed to work behind NAT (which an Xbox should seeing as that's 99+% of the install base) should not work just as well as any o...

usdmatt

Probably get some different opinions on this one. I have Mikrotik switches on my LAN with no firewall rules. If I did use the firewall I'd just end up with an allow from LAN ports, so I can get into it, which is the only way to get to it anyway, so any further drop rules would never match anything. ...

usdmatt

This already addressed for quite some time using interface lists in default configuration As you stated "people to mess with the firewall", default allow changed to default drop will not improve anything. Assuming you know to add the interface to the wan list... But yes this doesn't impro...

usdmatt

As it was already pointed out, the default firewall rules do that. They block all until allowed by the user. I was referring to a implicit block that everything hits even if the firewall is empty (of course thought would have to be put in to what to do if someone deletes all the rules). Lots of peo...

usdmatt

I think he means the default action of "if not filters apply", which is a non issue given the factory "default" firewall filters. I did think which reading this post that maybe the firewall should default to deny with no rules, so you have to explicitly allow everything you want...

usdmatt

I agree Samot and co, I'm not really sure what Mikrotik can do about the kit out there that still isn't patched. These routers probably haven't been logged into at all for years. Unfortunately Mikrotik aren't big enough for this to have been global big news like it might be with Netgear/TPlink or bi...

usdmatt

IT operator workstations and Voip phones connected via Wifi... Is cabling it definitely out of the question?

usdmatt

Since RouterOS v6.43rc11...

Or set up VLANs.

usdmatt

Unless there is other constraints in your network, you should be able to access your mail server even without NAT being involved with simple routing (without your HairPIN NAT) I suspect they're accessing some hostname that resolves to the public IP address of the Mikrotik (1.1.1.1). The router will...

usdmatt

add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address= 192.168.0.0/16 src-address=192.168.0.0/16 out-interface=ether04 You want to be natting traffic going out vlan704 to the server coming from ether04, so that the source gets changed to the router's IP. That will cause rep...

usdmatt

Create a vlan sub-interface on the bridge with your relevant vlan number. In "/switch vlan" create a vlan entry and add ether2 and switch1-cpu. You can also add other ports if they might handle vlan traffic. If it's something like an RB2011 you may need to add switch2-cpu to the list to u...

usdmatt

Documentation seems really bad on this stuff.. It seems to work if the address is quoted: /ip fi fil print where src-address="192.168.10.0/24" Flags: X - disabled, I - invalid, D - dynamic 0 chain=forward action=drop src-address=192.168.10.0/24 dst-address=192.168.0.0/24 log=no log-prefix=...

usdmatt

I wouldn't bother trying to distribute PPPoE to the customers, although I'm not sure exactly what you mean there. I would just do the following - Assign all the addresses to the Mikrotik. (you can just use as /32 netmask for all but the first address) Have a separate lan port for each customer (not ...

usdmatt

What router do you have? I also assume that the router will act as the gateway for these vlans (you want to assign the .254 addresses to the Mikrotik?)

usdmatt

Interesting that you have the exact same CCRs as us. We have a few hundred PPPoE sessions terminated on ours and one of our engineers suspected that DNS load was causing intermittent problems. We decided to just move DNS onto dedicated resolvers (we just set up a couple of linux vms), which accordin...

usdmatt

Having a single port on vlan500 doesn't make much sense as it will be of no use. As far as I can see, all you need to do is create a "vlan500" bridge, and add ether5 to that. You'll end up with that port on its own with no connection to anything else. If you want other ports on the same vl...

usdmatt

I have an RB2011 which at this point just has a gateway connection on ether1, and a link to a LAN switch on ether2. Not that it's important, but I thought I may as well disable the rest of the ports for the time being to stop anyone messing around. However, I am able to disable every port other than...

usdmatt

I think I might actually have it working!! In the end it seemed to come down to needing the cpu interface adding to the relevant vlans on both ends. I guess routeros won't handle packets destined for addresses assigned to itself over a vlan unless the cpu interface is a member of that vlan. If you'r...

usdmatt

At the moment I'm just concentrating on the CRS125 as this is becoming far more of a major undertaking than I expected. I know it's my own lack of routeros understanding, but adding a few access ports and trunks seems far more awkward than anything else I've ever used. I have a device plugged into p...

usdmatt

Thanks for the reply. I assume if the RB2011 has access to both VLANs then routing will *just work*; Not that I actually need it in this instance. All I really need at the moment is a couple of workstations on a separate LAN, with their own gateway address on the RB2011 (which I'll then NAT to a dif...

usdmatt

I'm currently trying and failing to get a simple vlan working between a few Mikrotik devices (Unfortunately I seem to have ended up with a mix of devices which doesn't help). The more I look into it, the more different configuration guides I come across, and the whole lot is just making less and les...

usdmatt

Adding my own experience to this. Just had a reason to use this feature as I have a router on an ADSL connection and the user (aka my boss) wants a fixed name to access it. Thought no problem, I can use the cloud option, then just set him a nice dns entry under our domain with a cname to xyz.mynetna...

usdmatt

Probably not of interest to a lot of people but I was surprised to see a single line about bhyve on the CHR wiki saying it will not be supported as it's paravirtualised. I was able to get CHR running using the raw image and the following configuration file for vm-bhyve. (I basically created a guest ...

usdmatt

I've just been looking at using CHR on bhyve as I want to run a few tests that need more routers than I have lying around. Was a bit surprised to see the Wiki say it will never be supported as it's paravirtualised, especially as it's not paravirtualised. Thought I'd give it a go as I've had quite a ...

usdmatt

Hello, We currently use a couple of CCR routers to handle PPPoE connections from about 200 users. So far we are using simple queues to enforce bandwidth limits as it's pretty much completely automated (we return Mikrotik-Rate-Limit from radius when users connect), and it 'just works'. There are a co...

usdmatt

Just to add some more to this, I've tested by replacing the London end with a test Mikrotik in our office. So I've assigned the 192.168.114.0/24 network to a test Mikrotik, disabled all the London VPN policies and recreated new policies pointing at my test device. With this everything works as expec...

usdmatt

I am currently having a lot of trouble trying to get traffic to pass between two IPSec VPNs on our Mikrotik RB2011. The setup looks a bit like this - Site A - USA Dell Watchguard Subnet: 192.168.12.0/24 Site B - London Draytek 3900 Subnet: 192.168.114.0/24 Data Centre - Midlands UK (Us) Mikrotik RB2...

usdmatt

I suspect the camera uses 'normal' PoE (802.3af/at) which most off-the-shelf PoE switches provide. The Mikrotik kit all uses 'Passive PoE'. It's all incredibly confusing and I'm surprised the industry hasn't been forced to stop calling them both 'PoE'. The first converter you list seems to accept 80...

usdmatt

I'm pretty sure you need to drop packets coming from the ppp interface. If it were me I'd just have my last rule as a drop all (no criteria/interface specified). That way nothing is getting through unless you've specifically allowed it. Just make sure you have an allow rule for traffic from your loc...

usdmatt

The manual says "Hotspot default profile for Hotspot users" so that value may only be valid for the Hotspot function. I'm not 100% on that but if you can get it working fine for hotspot but not PPPoE then it sounds likely. I know from my own testing that there are a lot of supported radius...

usdmatt

Opening an old-ish thread but does anyone have any updates on this? Did Mikrotik ever respond? We had exactly the same problem last year (would probably be around the same time as the rest of the posts here) on a CRS-1036. We have two of the units and they were running 6.0 when installed (performing...

usdmatt

Yes, for my home RB2011 I've set port 6 as the gateway (BT's VDSL Modem only links at 100Mbps max by the look of it anyway) and I'm using 1-5 as a straight gigabit switch. For most purposes defaulting to WAN on port 1 is probably a waste of a gig port, although it's consistent with all other RouterB...

usdmatt

Hello, I'm slowly getting up to speed on the intricacies or RouterOS/RouterBoards but one thing intrigues me about the default configuration on RB2011 devices (and maybe others). My understanding is that bridging ports involves the CPU (unless any RouterBoard's have fancy bridging hardware I'm not a...

usdmatt

Thanks leonset. Usually big companies are near impossible to get help from directly as an end user, which is why I thought I'd ask in the forums. That doesn't appear to be the case with Mikrotik though :D. They replied within minutes that this process is mainly involved with disk read/write and that...

usdmatt

The ifInOctets, ifOutOctets (Octets = bytes) SNMP values are counters that will continue to rise while the interface is up. What usually happens is that you read the value every few minutes (5 is common), then use the difference between the current value and the last reading to see the average trans...

usdmatt

Hello, we have 2 Cloud Core routers (the original 4GB RAM ones) which are configured almost identically providing the following functions: PPPoE Server DNS Server Simple Firewall (Blocking P2P on forward chain and restricting access with about 10 input chain rules) Small OSPF Area (Makes sure PPPoE ...

Search found 52 matches