MikroTik

CTrain

SFP Modules in all Mikrotik Gear that I have used including the CCR, CRS and RB2011are hot swappable.

So you can switch to fiber live.

Hope that helps

CTrain

Hi All, I have two CCR1016-12-1S+, I have successfully utilized on the CCR's without problems Mikrotik 10G SFP+ using both single mode (S+31DLC10D) and multimode (S+85DLC03D) SFP/fibers. I have also successfully used 1G multimode (S-85DLC05D) from one of the CCR1016-12-1S+ to several NetMetal5 (with...

CTrain

Hi, Just some suggestions for you I am not at work so any suggestions that I make will be untested. VLAN's on MIkrotik are reasonably easy to understand and utilize. First just to ensure we are on the same page. Your interfaces are all configured as trunk ports not access ports, Thus an external swi...

CTrain

Also the firewall rule should be the forward chain because the packet is not finishing at the router and the in interface or public ip of the network should be specified.

CTrain

If you have configure the master port / slave port configuration correctly it should be wire speed now between devices on those ports in the master/slave group.

CTrain

You are using CPU bridging under the bridge menu to join the ports, thus the cpu is performing the switching. If you want the ports to act like a switch the interfaces need to be configure to use hardware switch chip by removing them from the bridge and configuring like this article says http://wiki...

CTrain

We need more information, do you have a firewall/nat setup and what is the configuration, do you have the routes added under ip/routes are the firewalls on the computers blocking network connections from computers on other subnets etc.

CTrain

You need to configure your firewall filter rules to accept the packet as well

CTrain

Yes WDS can have Hardwired connections however I generally use a separate access point with the same auth on a different channel, the handover takes slightly longer ie if a device moves from access 1 to access 2 area and cannot access 1 anymore the change over is almost instant. whilst if access 2 &...

CTrain

Mikrotik equipment has a GUI both Webpage based and a Local Program. It also has a custom scripting language that it uses, the command line can be accessed via the GUI or SSH. Mikrotik also have an API to allow interaction with programs. I don't know of any routers with 2 POE have a look at the RB20...

CTrain

;;; srcnat LAN private IP's traffic to be masquerade
chain=srcnat action=masquerade to-addresses=106.51.187.89 src-address=192.168.2.0/24 out-interface=pppoe-out2

You should remove the to and src address as they are not required and my be causing problems when your IP changes

CTrain

Yes it is always the firewall on the machine that you are connecting to and not the computers doing the connecting. turn the office firewall back on and add an accept rule for rdp traffic

CTrain

Did you disable the firewall on the system that you are connecting to?

CTrain

can you please post your nat and firewall export

CTrain

are you behind an ISP based NAT or DO you have a modem performing NAT Duities

CTrain

Have you got an allow in your firewall on both your computer and the mikrotik. Try turning windows firewall and anyother firewalls off and disable the rules in the mikrotik firewall

CTrain

ros code

add action=dst-nat chain=dstnat comment="Remote SSH Access" dst-port=\
    22 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.0.164 \
    to-ports=22

Here is an example DST NAT with Dynamic IP see instead of using Packets IP I read which port the packet comes in on

CTrain

You are correct so far you will now need to remove the Bridge unless you have a AP on the CRS. Also you need to add the firewall and NAT entries to allow masqueraded internet access. /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN Once you added that line you will have internet...

CTrain

A single subnet CRS setup is easy enough to achieve. we will need to configure eth1 as the internet gateway (ie NAT traffic to the port, create a firewall etc) then we need to create a switch group to allow network switching functions between eth2-eth24. If you create a bridge in winbox it will do t...

CTrain

I have a CRS as a router/switch in a configuration that seems similar to yours and it works perfectly. Can you please post an export of your firewall rules, nat rules, routing. Do you have a DSL modem or another form of ISP gateway between the CRS and the internet or is your ISP nating your traffic.

CTrain

Currently all bonding on the CRS needs to be done on the CPU.

CTrain

Just as a note based upon my experiences channel bonding on the CRS is currently done in the CPU, which is limited by a 1Gb/s uplink from the switch chip and the speed of the CPU chip. I have found that bonding on the CRS actually achieves a slower speed than not bonding, and using the hardware swit...

CTrain

CRS running 6.6 and 6.7 have a bug where in all the interfaces run at the slowest negotiated link on the switch, so if a 10mb/s computer or printer is attached the entire switch runs at the slowest speed. Downgrade your routeros version back to 6.5 and retest. http://forum.mikrotik.com/viewtopic.php...

CTrain

The mikrotik server should be ethernet mode and the client should be dev tap, thus the client computer acts like a local computer , whilst tun is for routing which wont allow game play (UPnP).

CTrain

http://forum.mikrotik.com/viewtopic.php?f=13&t=77635

CTrain

ohara did it suit your purpose?

CTrain

You appear to have the setup correct with a few problems, 1.IP addresses should be /ip address add address=192.168.14.1/24 interface=ether2 network=192.168.14.0 add address=192.168.15.1/24 interface=private_bridge network=192.168.15.0 So that the router has a real IP address. 2. Also firewall rules ...

CTrain

LACP with Hardware for the CRS has not been implemented into the software yet, as such the only LACP support for the CRS is with the CPU and the limitation on the CPU performance make such a config worse than a single non teamed interface on the hardware. My advice until the LACP is created using ha...

CTrain

Not that I am aware of, other than possible enabling UPnP under IP-> UPnP

CTrain

You must create a pool under ip ->pool once that is completed create a dhcp server with the wizard under ip-> dhcp

CTrain

In RouterOS to perform hardware (No CPU Utilization) based packet switching you create a master/slave switch, if any packets are routed to a different subnet or utilize cpu feature it will go out of ether3 to the CPU which is limited to 1Gb/s on the NIC and 1Gb/s on the backbone from the hardware sw...

CTrain

Ports 1& 14-24 are switched together at wire speed, the DHCP settings are from the internetrouter. I assume that the public network is on ether2 with the drop firewall rule is to stop communication between the public ether3-12&wlan1 (Bridge1) and ether2. So any data on the private network is...

CTrain

Connect to the router and download the winbox utility for the easiest configuration. I have some questions on what you want Do you really want VLANs or are you happy to segregate with Firewall Rules and Subnets much easier and less headache? I will outline how to build with out VLANs here using subn...

CTrain

In your first image, the bottom left corner ether8 is receiving traffic from the computer with VLAN ID 0 and not altering the VLAN ID, it should be configured such that the Customer VID = 0 and New Customer VID = 81, if you are working on another router board connected to ether8 the VLANs should be ...

CTrain

The post below has how to utilize OpenVPN on the Meta Router to provide UDP and LZO compression, and all other openVPN Linux features.

http://forum.mikrotik.com/viewtopic.php?f=2&t=78793

CTrain

UDP Traffic is just sent their is no checking between the sender and receiver acknowledging order or receipt, it has a lower overhead on traffic due to that runs slightly faster(Bandwidth utilisation) because of no resending or waiting for acknowledgments, also has fast 'ping' times due to no error ...

CTrain

After importing please logon to the console and change the password with passwd Then ensure the date time is being accuratly set via NTP vi /etc/NTP.conf vi /etc/rc.local OpenVPN cert wont work unless an accurate time is present finally upload your configuration files to /etc/openvpn with ssh or wge...

CTrain

The admin password is changeable. If no one knows the password you will have to perform a reset. When you rest the password will be changed back to nothing, however all configuration will also be changed back to the default. The attachment is the official guide that comes with the router board telli...

CTrain

I generally run OpenVPN on the MetaROUTER openWRT image so that I have full openVPN functionality. Just because I am familiar with it and I prefer OpenVPN with UDP of course.

CTrain

Does the mikrotik on your network handle the masquerading nat on your network? If yes it needs to dstnat any traffic from the lan to the squid server. Use winbox to build the rule based upon my post in the below topic. you should be able to specify IP range or in/out interfaces based upon your exact...

CTrain

@walkbyfaith Try Enabling UPnP under IP-> UPnP. The port forwarding will only work for one Xbox at a time. If that doesn't work port forward Port 88 (UDP) Port 3074 (UDP and TCP) Port 53 (UDP and TCP) Port 80 (TCP) to the xbox360 by using a dstnat like the one below: /ip firewall nat add chain=dstna...

CTrain

On all the router boards that I own the Master port is still fully functioning (RB2011, CRS & RB493G), I believe that the line in the wiki page is a typo.

CTrain

When you set up the firewall initially there are accept commands for established and related connections. I believe that because those rules that the packets are accepted.

CTrain

Yes that is correct however in my experience the IP-> firewall forward rule is not required when a dst-nat is in place. Also the SMTP on mail servers typically only work on port 25 so with your current configuration the mail will be sent but not received to your server other server will send to the ...

CTrain

I already answered the question in this post.

http://forum.mikrotik.com/viewtopic.php?f=7&t=78725

CTrain

If the access points are routerboards or other mikrotik products, you will just need to place the wireless interface on a bridge with the Ethernet port. and configure the wireless to your companies settings. remeber to assign the IP to the bridge and any routes the router should know. Let me know if...

CTrain

What exactly are you trying to do with the routerOS? Is it an office firewall router, or multiple sub net multiple site configuration.

The routerOS has many functions of which I have very good knowledge and others I have never touched or are likely to touch.

CTrain

Try this

http://wiki.mikrotik.com/wiki/Manual:In ... o_internet

If that doesn't work I will need you to post your address list, your routes lists, your firewall and Nat rules

CTrain

You can't easily bridge to the wireless network if station mode is utilised. Station mode is generally used for back haul wireless links. If want a wifi access point for iPads, phones and laptops, etc you should change the mode to wireless AP and create a bridge with ether, wlan etc

CTrain

Making an access point out of the router board is reasonably easy I will talk you through the winbox step to avoid any problems you may have with the terminal. Step 1 Create a bridge of the ethernet ports and wlan of the routerboard. If you require wire speed switching and the routerboard supports i...

CTrain

As what has been stated above you will need a rule that allows the servers to communicate with all lans, a rule that allows all lans to communicate with the servers and finally a rule that drops all packets not meeting these rules. the drop rule needs to be last.

CTrain

The RB2011 has two hardware switch chips, these are the 1Gb/s switch and the 100Mb/s switch. I generally do a master slave configuration of the entire switch chip together followed by the two hardware chips bridged in software with the wireless LAN. If the RB2011 is used as a gateway to the internet...

CTrain

The Cloud Core Router are a seriously powerful piece of hardware. The CPU is powerful enough to do full wire speed switching between all the ports. I would setup the DHCP and bridge the ports as you have suggested. If the router does not have the through put you are expecting or require. Try placing...

CTrain

You can easily separate the client wifi network from the corporate WiFi network running under the same router board as the WiFi AP. The router boards support virtual Access points were in you can have multiple 'networks' with different SSID and Security options including hotspot etc. The virtual Acc...

CTrain

dfine The DHCP client configurations will need to be updated by restarting the client computer. Also for a windows computer to accept a dns name it needs to be a fully qualified domain name i.e ( nasgear.home.local), the dns suffix is to ensure that you will be only required to type nasgear for the ...

CTrain

dfine The DHCP client configurations will need to be updated by restarting the client computer. Also for a windows computer to accept a dns name it needs to be a fully qualified domain name i.e ( nasgear.home.local), the dns suffix is to ensure that you will be only required to type nasgear for the ...

CTrain

The wiki post is to stop SSH/FTP attacks on the router try changing the chain to forward and the port to RDP prot, however that may not work if the connection failed packet is different. If that is the case the connection failed packet contents will need to be sniffed using a packet capture software...

CTrain

Their will be no problems unless you set up a virtual wire speed switch group, by specifying a common master port in the interfaces menu. Otherwise the ports will be separate. Almost all router boards with the exception of the cloud core routers are built this way. /interface ethernet print will lis...

CTrain

Can you post the previous IPtables? and your current firewall configurations form the mikrotik including NAT details Also your routing table on the Mikrotik Is the ISP gateway performing the NAT? Is your router performing a NAT? Can the Mikrotik router currently ping the web? Is the router getting i...

CTrain

I have previous answered the same style of question in

http://forum.mikrotik.com/viewtopic.php ... 35&start=0

Let me know if that dosn't work

CTrain

You also have to perform a srcnat for all traffic leaving the client so that its traffic goes through the proxy server. i.e. chain=srcnat action=dstnat to-addresses=192.168.1.2 to-ports=3128 src-address=192.168.1.3 dst-port=80 protocol=tcp Out-interface=eth1(Gateway) Your Dstnat should not be requir...

CTrain

Left Switch First So first you must create a switch of ports you can add all the switches ports here /interface ethernet set ether7 master-port=ether2 set ether8 master-port=ether2 Tag Traffic /interface ethernet switch ingress-vlan-translation add port=ether8 customer-vid=0 new-customer-vid=400 Unt...

CTrain

Is it possible on the cloud router switch to perform bonding/link aggregation/teaming using protocols such as 802.3ad (LACP). I know it is possible to perform the bond using the routerOS functions however that requires a CPU based bond. is it possible to perform the bond with the layer 3 switch chip...

CTrain

As you have the route to the 172.16.0.0 network in your route list the routerboard will route any traffic it receives to that location by default . That route would have been auto added when the interface IP of 172.16.0.1 was assigned. That traffic can be easily stopped by creating a firewall rule. ...

CTrain

In Winbox under IP -> DNS ensure that Allow Remote Request Box is checked, that should be the first step. Then under IP -> DHCP Server -> Networks and the configurations that the DNS server is set to the IP of the router board, also specify a Domain suffix (eg Home.local). Then enter in your DNS ent...

CTrain

The RB2011 CPU cannot process packets at Gb/s Speeds it generally maxes out at about 100Mb/s from my experience (You can confirm by performing your test and watching the CPU monitor in Inbox). However you can gain wire speed switching ability (1Gb/s) by utilizing the switch chip. This is achieved by...

Search found 66 matches

ros code