MikroTik

red6

So I added a passthrough rule near the top of the firewall table to count and log UDP dhcp packets (dst port = 67) but nothing seen.

So I guess it is ARP. But why would ARP from the ISP node be going through the Rogers Hitron modem (in bridged mode) too the MikroTik ?

Normal ?

red6

# sep/18/2017 16:23:14 by RouterOS 6.31 # software id = HZ4Z-**** Running RouterBoad 850Gx2. When I use Winbox and click on interfaces->my-ether1-wan and view the traffic graph I see constant RX traffic of 70 kbits per second (about 120 packets per second) This is when all my hosts are shut down exc...

red6

I have a basic firewall ruleset with some very elementary rules at the top of the list as follows... add action=log chain=input connection-state=invalid log-prefix=XXXXX_INVALID_IN protocol=!icmp add action=drop chain=input connection-state=invalid add action=log chain=forward connection-state=inval...

red6

Configuring 2 routers for port forwarding of 1 device is actually twice the work. More to this you need to set your static LAN routes first so that both routers can communicate on LAN. The configuration is basically similar for both routers. Using your DSL as failover simply set the route that uses...

red6

so thats your setup. You only need 1 router unless you are expecting a router to fail or have multiple locations. Using only 1 of the routers you can combine both internets the way you want and than do a general src and dst nat. Is there a reason for having 2 seperate routers? Is your LAN subnet 25...

red6

Here is a hand drawn diagram

I am still thinking that connections/packet marks or routing marks are required but I don't know how to implement them.

red6

Could you perhaps make a diagram with IP addressing on it? I think it should not really be an issue to give your NAS (1) a public routable IP (DSL) and then (2) an RFC 1918 private IP that is masqueraded using the cable's ISP public IP address. It would require 2 interfaces on the NAS though. At fi...

red6

What is the intend? Active and backup router? Then VRRP is your answer. You guys are so far ahead of my knowledge. I just want to have 2 ways to get to the NAS server without having to move it to the other LAN. If I do that then the internal machines on the existing LAN will no longer see the NAS a...

red6

If you own a public ip address you can assign it to another connection. It may seem a lot better to migrate everything to your cable and use dsl as failover. You will need to apply more logic to get port forwarding right. You could for example use 2 ports on your NAS so that you can use a different...

red6

You could also give your other connection your static ip, it may work. I think since you already have port forwarding on your DSL that it would default to that being that the config for it comes first. RouterOS goes through firewall rules linearly from the first rule to the last. First thing - Than...

red6

Here is a setup at one of my customer locations: I have a 6Mbit DSL circuit with static public IP's serving an RB2011. I also have a 150Mbit Cable circuit with 1 dynamic IP serving an RB750GL. The 2 routers are connected together with a "backbone" ethernet connection. I can access a NAS se...

red6

The routers backup every night with Scripts and Scheduler in case of disaster. And this is a disaster because I have customers down. Thanks very much for your help. As for the BIOS update, I see your instructions but I am not sure I really want to take that step. 3.16 or 3.18 ? Will it matter to me?

red6

One of my RB2011 routers crashed after months of up time. I was running pppoe static IP plus a /29 subnet and a /28 subnet. I asked the ISP to delete the smaller unused /29 subnet. Once they got around to this, one morning the RB2011 crashed and just showed 3 or 4 Ethernet leds blinking all in sync....

red6

I did get openvpn running a week ago but I will have to back to my notes to post the steps.

It might be end of the day before I can get to this task though.

red6

I am trying to understand how to configure an OpenVPN client on Router OS to connect to OpenVPN on CentOS 6. I am using Digital Ocean's offering. Nice thing about Digital Ocean is that you get real CentOS under VmWare and 10 TB of transfer per month. Gave up on PrivateInternetAcess.com and OVH.com a...

red6

Thanks for that link. I will try it and post a progress report.

red6

Your plans seem smart to me. I have a 2011 on DSL with many public IP's. Then I also have a 750GL on Cable. For wireless, I use a 951 as an access point to the 750GL. Also, I connect the 2011 and 750GL with a so called 'backbone' cable and enjoy one LAN. Don't have failover working because the DSL h...

red6

I like the suggestion of setting up a VPS. But could I run the VPN client on a Linux box here in my office and also run squid to proxy to the VPN ?

red6

What about mangle rules for change MSS ? I don't have any. Is that a problem?

red6

I am running 5.26 on an RB750GL. I entered an FQDN, username, password and clicked on APPLY. DNS kicked in and an IP address appeared. Problem is that it sometimes does not work depending on the sequence of entry before APPLY. Other problem is that once the lookup is done it may become out of date i...

red6

I have customers that want to use StrongVPN or PrivateInternetAccess or HideMyAss for streaming TV from the USA. Security is not the number one priority but speed is a priority. And does anyone have the proper settings too. I have been able to handshake with PrivateInternetAccess.com but speeds are ...

red6

I can't get a customer's VPN running. He needs to run PPTP to a VPN provider. It would appear that the RB750GL is blocking him even though I have trivial firewall rules that are just for dropping inbound connections from the internet. His VPN was working behind a toy (consumer type) router. How do I...

red6

Thanks. Really helped. Got it working.

red6

I have an RB912 with a USB Dongle connected to an LTE wireless network with WIFI access working properly but ethernet not passing traffic upstream. I must be missing something obvious. Do I need to create a bridge? Here is the important part of my ROS code: /interface ethernet set 0 arp=enabled auto...

red6

I have seen many different approaches on the Wiki and here in the forums. But many scripts I come across are very old. Maybe they still apply but with my customers generally using version 5.26 on a RB750GL (together with some RB912uag) I want to make sure that I am taking advantage of the most up-to...

red6

I just received a http://www.newegg.com/Product/Product.aspx?Item=N82E16856205007&cm_re=oem_mini-_-56-205-007-_-Product from newegg.ca. Put an SSD and 2GB of ddr3 1066 memory in it and loaded ROS 6.15 onto it. The HDMI port seems to be the default video port and the services start and I get a Mi...

red6

But if I run a routerboard upgrade then will I jump up to 6.16 which I don't want to do.

red6

I have had to backout version 6.15 because of kernel panic problems which MikroTik dev team are investigating but I would like to ensure that I am at least running the latest bootloader. How do I download a FWF file from MikroTik? Can't seem to find the files on the download web page. Installing the...

red6

I wonder if the Dual Broadcom 57788 in the OEM PRODUCTION box from Newegg would co-operate with RouterOS?

As for the ALIX boards, I like the idea of no fan and thus NO MOVING PARTS.

red6

Pretty slick and good price. Dual LAN and 12 volt supply.

red6

I don't have to use x86 but I thought it might be a good way to go and when I look at some of the suggested solutions I do see that the SBC units are quite expensive relative to the Routerboard prices. For instance, this unit from Titan Wireless in the USA looks like a much better price/performance ...

red6

Thanks for the info. By USB I was meaning that a USB memory stick would be the main disk.

red6

Can anyone suggest a low power (watts), 2 ethernet (gigabit) port , usb based single board computer to host RouterOS. I like the Mikrotik products and I continue to install and support many in the field but I would like to experiment with an x86 based router. I don't need any wireless support. For i...

red6

Got Netinstall running and reset the RB2011 and booted from ethernet and loaded 6.15.

Router still crashes and i didn't even run pppoe. I ran dhcp client on ethernet port 1 to a different ISP.

Is anyone running 6.15 on an RB2011 with success? I am beginning to wonder !

red6

Thanks.

So a re-install of 6.15 thru Netinstall instead of thru the Winbox Upate (which is how I hosed the older router) ?

And for the new RB2011 that just arrived and already has 6.15 on it and also crashes ?

red6

In a previous post I asked how to do a downgrade. The answer was Netinstall and so I am on the right track but here is a really dumb question... Where do I get/download older revisions? I want to revert from 6.15 on my RB2011 units to 6.07 because they are crashing with kernel panics. I think it mig...

red6

Thanks very much. I will follow your steps. It sounds like a rational approach.

red6

Upgrading to 6.15 on an existing RB2011 (that had incredible uptime - many months) has trashed the router. I had to install a 750GL as a hot standby. I ordered and received another RB2011 from my vendor the other day and it already has 6.15 installed. It too won't run my configuration. How can I dow...

red6

I will try that. Thanks.

red6

Well I have the hotspot working with trial mode which is a nice feature for allowing free usage. But the goal is to get at external URL to load as soon as they click okay on the terms and conditions. So, you walk into the restaurant, find the open wifi AP and try to surf somewhere. Then you get the ...

red6

Understand where your coming from but you appear to be confusing functionality with the user experience. You can setup a Hotspot using trial user where the username and password are passed in automatically and then directed to a URL. The customer connects to the wifi network and gets the menu page ...

red6

I think the title describes my requirements. How do I deploy an AP outdoors for a cafe patio where wifi access will be free but the restaurant's URL for the restaurant menu comes up on the patron's browser as soon as they connect to this open guest network. Hotspot is not good in 2014. Nobody wants ...

red6

As a post script to my posting... I can get the ethernet to come up on my ISP (they use DHCP) but I think there is a problem with the WiFi being bridged to the ethernet. The answer is in the address table. I had the LAN address 192.168.88.0/24 on the 'ethernet' instead of the 'wlan'. So now I have w...

red6

I want to connect to the 912UAG with ethernet initially to set it up so that the ethernet is the WAN and the only client access is via the 2.4 WiFi. But the default script is for the ethernet to be the LAN and the wireless to be the WAN. How do I reverse this? Is there a /export file here on the for...

red6

I have seen and implemented the following from this forum: add chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 limit=1,5 protocol=icmp What does limit 1,5 do? The 1 implements a 1 packet per second rate limit but what does the 5 (shows in the bust field in WinBox) ...

red6

Got your point. Seems that because the checkgateway=ping statement only checks the gateway it is not all that useful. For instance if the facilities closer to upstream are down or dns is down.

red6

I followed the "Quick Start for Impatient" in mikrotik.com/wiki/Manual:PCC to implement load balancing and failover. Attached is the IP Route Table as viewed with Winbox after adding the addresses, the mangles and the routes. Can someone explain what I am viewing. Why so many routes? It se...

red6

Dumb question... What do the colors mean? If I understood what the colors mean (blue, red) in the IP ROUTE display window then maybe I could learn something new.

Any simple answer?

Thanks.

red6

Have you switched the setting from USB to miniPCI-e on ROS? Have not looked at that. Thanks for the tip. I will investigate. Also here is some potentially good info from one of the largest Sierra resellers in North America. This was sent to me when I asked Sierra directly who I should purchase from...

red6

I use the Sierra Wireless MC7710 LTE module with a RB912UAG in DIP mode. I'm very happy with the stability compared to a USB dongle especially in weak signal strength conditions... Thanks for that. Can I ask what kind of antennae you use and what sort of pigtail connects to the Sierra card. (I am a...

red6

Want to take advantage of 4G cards and SIM cards installed directly into Mikrotik models.

Don't want USB type dongles.

But which type of card is required. QMI or DIP (Direct IP) ?

Any help would be much appreciated before I order 100 pieces of the wrong part

red6

I see that the MC7700 comes in many flavours. For instance, It appears to be the best unit available for Bell Canada 4G but you can get in in DirectIP or QMI mode. The respective part numbers are 1101749 and 1101726. Now the 64 million dollar question... Which mode is supported on the MikroTik and w...

red6

While the supported hardware Wiki is a good start it also seems to be a dead end for me. There are no guarantees that any of the devices will work without glitches and I can't have watchdogs, daily resets and workarounds or my customers will laugh at me when they discover that I have built a patchwo...

red6

You need to NAT the PPP interface with:
Code: Select all
ip firewall nat add chain=srcnat out-interface=ppp action=masquerade

Good advice. Thanks.

Link to ISP over 3G now working. I am thinking I might need a PPP mangle setting too even though it is working ?

red6

I have accomplished a few steps. 1. Configured the 912UAG running as a HOME AP connected via ethernet and using DHCP on the main router (RB2011). Works great. Nice outdoor enclosure. Good signal strength. 2. Added a Huawei 397B USB modem and got the PPP to come up. Negotiated the link to Bell Canada...

red6

I followed your recommendation by changing the address table entry : 100.100.100.217/29 100.100.100.100.216 ether1-wan to: 100.100.100.217/29 100.100.100.100.216 bridge-wan Two issues: 1) I can still ping from the 100.100.100.220 (asterisk box) host to the outside but DNS is not working and TCP conn...

red6

I am a Mikrotik newbie... I am trying to achieve the same results as per the title of this thread but on a new RB2011 integrated box. I have 1:1 NAT working for an Asterisk host. But I also need to deploy an Asterisk host directly on a public IP. I have bridged my wan port ether1 to a dedicated ethe...

red6

I forgot about the subnet having to be /24. I will try again. Thanks.

red6

How silly of your provider to give you a static address (/32) that's not already in your static subnet, but that's beside the point, and it gives you 9 static IPs to work with instead of just 8. You get your route from the PPPoE session, so that's taken care of. Now, just put your subnet on your DM...

red6

Now that you say silly - That makes me feel better. Maybe it's the only way they know how. In any event, Thanks for the ROS code. I will try to implement that tonite. I am guessing there are a few other ways to crack this nut. But this is the first meaningful (ie: seems to make sense to me the Mikro...

red6

My ISP has assigned me a PPPoE login and with it they give me a static IP (that never changes) when the router connects. But I also asked for additional static IP's with a /29 bitmask. How do I add those addresses to the router? The pppoe address looks like 206.243.xxx.yyy and the gatweway is 206.24...

red6

But Winbox shows the numbering correctly. Seems like an obvious bug to me but it only shows up in Chrome and not Firefox. I am running Router 6.6 on an RB2011. Don't know what rev of Winbox because I don't know how to find the rev number. All around as a newbie, I prefer Webfig but not sure I trust ...

red6

Thought the title might catch some attention here. Just trying to get my head around a new RB2011 wireless in enclosure. I upgraded my DSL Modem from a $16 TP-LINK 8616 to a $25 TP-LINK 8816 just to get some good DSL line quality stats. Both modems are officially allowed for "bring your own mod...

red6

Give clients only 192.168.88.1.

That made a huge difference. Now my win7 boxes can resolv either a short address like ext125 or ext125.hosts.tik.

Wish I knew why that change made a difference. I always like logical explanations for why a change solves a problem

Thanks.

red6

That worked nicely. Thanks very much. I had already implemented the first part from a reply that you posted on another one of my threads. Things are slowly coming together. But Can I ask what is the purpose of the hairpin rule. If I am on the same subnet doesn't the connection just work by default. ...

red6

I don't understand the default NAT that was created when I set up a new RB2011 with pppoe on dsl. Why is the Out. Interface showing as unknown. default-nat-RB2011.PNG And here is the interface table that was created by default. default-interfaces-RB2011.PNG For now I would like to simplify the setup...

red6

So I have the DNS working for local hosts on the LAN with a FQDN. For example I can use a host name to browse or ping such as ext125.hosts.tik where ext125 is a voip phone on the lan. Now the big BUT. But the dns name resolution is only working on my linux hosts and the router console itself. Window...

red6

I loaded that script put pasting thru webfig terminal. Then lost connection to router on webfig. Can get into router thru winbox but i have really hosed things up with that script because I can't even use the router to get out to the internet. Should I have deleted the default NAT entries that came...

red6

I loaded that script put pasting thru webfig terminal. Then lost connection to router on webfig. Can get into router thru winbox but i have really hosed things up with that script because I can't even use the router to get out to the internet. Should I have deleted the default NAT entries that came ...

red6

Does "IP / DNS / Static" not do what you need?

Tried that but I will try again because I agree that it should (at least the way I interpret to manuals).

red6

Do I need to run a local DNS server on another host such as a Raspberry Pi or BeagleBone as some have suggested ?

red6

Sounds good.

So using Winbox tool or Webfig tool and "new terminal" is a nice way to subvert or get around a potentially closed port 22 I guess (especially after loading your basic firewall script) ?

red6

Thanks for the encouragement and the router script. Can I cut and paste that into a file with an editor in the command line and what file would it be? (Pretty dumb questions!)

red6

Yes, for my home RB2011 I've set port 6 as the gateway (BT's VDSL Modem only links at 100Mbps max by the look of it anyway) and I'm using 1-5 as a straight gigabit switch. For most purposes defaulting to WAN on port 1 is probably a waste of a gig port, although it's consistent with all other Router...

red6

I am a newbie with MikroTik but have lots of experience with OpenWrt and ddWrt. It's now nice to have a supported router with lots of power and functionality. But I can't figure out how to create a table of host names that map to some dhcp addresses that I have made static. For instance, I have abou...

Search found 75 matches