Community discussions

MikroTik App

Search found 947 matches

by cdiedrich
Wed May 20, 2020 12:41 pm
Forum: Wireless Networking
Topic: 4k over wifi
Replies: 28
Views: 3387

Re: 4k over wifi

I doubt that will ever work with both peers connected to the same AP. A 4k stream allocates a significant amount of bandwidth - and your AP will have to receive and transmit it at the same time. If there is absolutely no chance to have at least one end wired, the only chance I see is adding a dedica...
by cdiedrich
Mon Apr 27, 2020 12:06 pm
Forum: Scripting
Topic: Each time the LAN IP obtained from dhcp after the host restarts is different from the last time
Replies: 4
Views: 1280

Re: Each time the LAN IP obtained from dhcp after the host restarts is different from the last time

The easiest way would be making the lease static. If not possible for whichever reason, you can retrieve the active IP by mac address with
/ip dhcp-server lease get [find mac-address=00:01:02:03:04:05] address
And use this to adjust the netwatch script.
by cdiedrich
Thu Apr 23, 2020 1:05 pm
Forum: Scripting
Topic: Each time the LAN IP obtained from dhcp after the host restarts is different from the last time
Replies: 4
Views: 1280

Re: After an IP of the intranet goes offline, the following command is automatically executed

/tool netwatch
add down-script="/int pppoe-client set pppoe-out10 disabled=yes
    \n:delay 3s\r\
    \n/int pppoe-client set pppoe-out10 disabled=no\r\
    \n" host=192.168.88.10
by cdiedrich
Thu Apr 23, 2020 10:53 am
Forum: The Dude
Topic: The Dude link Label apparence probleme Ros_command with as-value [SOLVED]
Replies: 3
Views: 1447

Re: The Dude link Label apparence probleme Ros_command with as-value [SOLVED]

I'd say it's about your double quotes - the "inner" double quotes need to be escaped.
try this:
[ros_command(":put ([interface ethernet monitor sfpplus1 once as-value]->\"sfp-vendor-part-number\")")]
by cdiedrich
Fri Mar 06, 2020 11:42 am
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10913

Re: feature request ADVANCED DNS Server

Totally with pe1chl. For the conditional forwarders I'd love to see having this possibility for reverse lookups as well. Like That is not different functionality. To have reverse working for subnet 172.16.16.0/24 you configure an NS record for 16.16.172.in-addr.arpa. (and the router should forward ...
by cdiedrich
Fri Mar 06, 2020 11:21 am
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10913

Re: feature request ADVANCED DNS Server

Totally with pe1chl. For the conditional forwarders I'd love to see having this possibility for reverse lookups as well. Like /ip dns add conditional-forwarders=10.20.30.40,10.20.31.40 domains=test.com,xyz.org subnets=10.20.30.0/23 add conditional-forwarders=172.16.16.16 subnets=172.16.16.0/24,192.1...
by cdiedrich
Thu Mar 05, 2020 10:37 am
Forum: Forwarding Protocols
Topic: Configuring the wlan1 onto a different subnet
Replies: 2
Views: 1873

Re: Configuring the wlan1 onto a different subnet

First, please put config exports into code blocks, makes it much easier to read. For your problem, this should fix it: ## make sure your dhcp sends out dns servers and correct gateways. A Gateway must be in the same subnet to be reachable. /ip dhcp-server network add address=192.168.10.0/24 gateway=...
by cdiedrich
Wed Mar 04, 2020 8:30 am
Forum: The Dude
Topic: Insert Image in Dude
Replies: 2
Views: 2518

Re: Insert Image in Dude

You can do this with the "Static Network Element".
Insert, right-click, select Appearance, select image (previously uploaded to the Dude), choose a proper scale for the image, select rectangle as shape and use white as color.
-Chris
by cdiedrich
Mon Feb 03, 2020 12:16 pm
Forum: Beginner Basics
Topic: IP Neighbor Duplicates
Replies: 9
Views: 2014

Re: IP Neighbor Duplicates

I've seen this a couple of times (count is easily three-digit) and it is really annoying. The interface list for discovery should only contain the bridge the lan-facing interface is bound to. No physical interfaces belonging to the same bridge. In 100% of my cases the issue only appeared on access p...
by cdiedrich
Fri Jan 31, 2020 12:06 pm
Forum: Scripting
Topic: Disabling interface with script
Replies: 3
Views: 1569

Re: Disabling interface with script

With VRRP you already have everything you need. You can use any private network for VRRP, like 172.16.16.0/29. Then use .2/30 and .3/30 for the physical interface addresses and .1/32 for the VRRP address. Then add your public IP with correct subnet mask to that vrrp interface as well. It will follow...
by cdiedrich
Fri Jan 17, 2020 3:32 pm
Forum: General
Topic: Traffic segmentation on an interface level?
Replies: 8
Views: 1298

Re: Traffic segmentation on an interface level?

I have to chime in in not seeing a proper solution but I totally understand the demand. A dodgy solution with a noticeable admin overhead would be bridge horizon and static routes for all hosts in the same subnet via the default g/w. And this being set on each and every host. Far from nice, far from...
by cdiedrich
Fri Jan 17, 2020 3:15 pm
Forum: General
Topic: vrrp and multiple ip.
Replies: 4
Views: 761

Re: vrrp and multiple ip.

Just for the first - the one in the same subnet you're using for vrrp.
The other addresses can be any mask and will follow the vrrp status.

-Chris
by cdiedrich
Fri Jan 17, 2020 7:23 am
Forum: General
Topic: vrrp and multiple ip.
Replies: 4
Views: 761

Re: vrrp and multiple ip.

Yup, that works. But the vrrp address has to be a /32 no matter what the actual subnet size is.
-Chris
by cdiedrich
Wed Jan 15, 2020 9:55 am
Forum: Beginner Basics
Topic: MultiCast between VLANS (Chromecast vlan1) to/from (PC/Mobile vlan2)
Replies: 13
Views: 3780

Re: MultiCast between VLANS (Chromecast vlan1) to/from (PC/Mobile vlan2)

It's just a shame that a capable os doesn't have a process to handle multicast across bridge/vlans!
No, it's not.
The topic is about link-local multicast and that's the way it is supposed to work.
routerOS does in fact offer "real" multicast routing with PIM and multicast package.
-Chris
by cdiedrich
Tue Jan 14, 2020 11:45 am
Forum: General
Topic: Assign static IP address to VPN client problem
Replies: 9
Views: 1260

Re: Assign static IP address to VPN client problem

There is a vpn client who need an IP address from the local address space. The only reason I can see for this being necessary is a service running in your LAN that only accepts connections from the local LAN. So it's not the client that needs the local range address but the service being accessed. ...
by cdiedrich
Mon Jan 13, 2020 4:47 pm
Forum: General
Topic: Assign static IP address to VPN client problem
Replies: 9
Views: 1260

Re: Assign static IP address to VPN client problem

Best and common practice is to have a dedicated subnet for vpn clients.
There's absolutely no reason for vpn clients being located in the same subnet as the local LAN.
-Chris
by cdiedrich
Mon Jan 13, 2020 2:36 pm
Forum: General
Topic: VPN Queue Help
Replies: 3
Views: 533

Re: VPN Queue Help

A simple "Simple Queue" should do the trick. On each end of your tunnel, add a simple queue with the local subnet as target and the remote subnet as as "dst" and fill both "Max Limit" fields with your desired total b/w. like "60M". After reading your post again, I get you want to limit file sharing ...
by cdiedrich
Tue Jan 07, 2020 9:51 am
Forum: General
Topic: Routing Question: Not able to get 1 gbps through our gateway with our router inline can without it
Replies: 8
Views: 1559

Re: Routing Question: Not able to get 1 gbps through our gateway with our router inline can without it

That should be fairly easy - of course it depends on the complexity of your setup. I'd strongly advise to schedule a downtime for doing this b/c you never know... I'd create a script that adjusts all necessary settings (i.e. IP address interface binding, firewall rules with in/out-interface matchers...
by cdiedrich
Fri Nov 22, 2019 11:21 am
Forum: Beginner Basics
Topic: Map Lite wireless bridge
Replies: 13
Views: 1239

Re: Map Lite wireless bridge

You could try station-pseudobridge-clone with your cam's MAC address as station-bridge-clone-mac parameter.
Just to be 100% sure: your main router is not running routerOS, right?

-Chris
by cdiedrich
Thu Nov 21, 2019 12:50 pm
Forum: Forwarding Protocols
Topic: IEEE1588 PTPv2 support for CRS317
Replies: 7
Views: 11078

Re: IEEE1588 PTPv2 support for CRS317

That is great news.
Just thinking further - together with GPS it could become a really nice Master clock or even grand master...
And it could open the CRS range for use with AVB.
by cdiedrich
Tue Nov 19, 2019 10:05 am
Forum: Wireless Networking
Topic: How to make a CAPsMAN redundant?
Replies: 3
Views: 1858

Re: How to make a CAPsMAN redundant?

That's unfortunately true. I have a set of scripts ready that push new new config to the backup capsman. First script exports the current /caps-man config into a file. Then I have another file ready that completely wipes the current /caps-man config. The wipe script is uploaded via ftp as wipecaps.a...
by cdiedrich
Sat Nov 09, 2019 4:07 pm
Forum: RouterOS v7 BETA
Topic: Poll: who wants to have a better /export ?
Replies: 17
Views: 4205

Re: Poll: who wants to have a better /export ?

I also voted for full user export with md5-hashed passwords. +1 for exporting certificates as they are a essential part of the config. And I´m totally with mada3k to have public keys exportable. Now for the import process, I´d love to see an option for error-handling, ideally per config section. Lik...
by cdiedrich
Tue Nov 05, 2019 2:31 pm
Forum: Beginner Basics
Topic: get Alert by email on new Device [SOLVED]
Replies: 18
Views: 4378

Re: get Alert by email on new Device [SOLVED]

Hmmm...
Turn on logging for topics e-mail,debug and trigger that command manually. Then you can see the whole smtp session in your log.
Maybe you find a hint on what's wrong there.
-Chris
by cdiedrich
Tue Nov 05, 2019 1:41 pm
Forum: Beginner Basics
Topic: get Alert by email on new Device [SOLVED]
Replies: 18
Views: 4378

Re: get Alert by email on new Device [SOLVED]

Did you configure /tool e-mail before?

Like:
/tool e-mail
set address=mail.provider.com from=dhcpalerts@provider.com password=youremailpassword port=465 start-tls=tls-only user=dhcpalerts@provider.com
-Chris
by cdiedrich
Tue Nov 05, 2019 10:29 am
Forum: Beginner Basics
Topic: get Alert by email on new Device [SOLVED]
Replies: 18
Views: 4378

Re: get Alert by email on new Device [SOLVED]

You could trigger /tool e-mail from your dhcp server's lease-script
-Chris
by cdiedrich
Tue Nov 05, 2019 10:01 am
Forum: Forwarding Protocols
Topic: ip forwarding with different vlan
Replies: 2
Views: 1545

Re: ip forwarding with different vlan

So both networks are attached to the same router? If so and the config is default-ish, it should automatically route between the networks without any user action required. Your question was a bit ambigious, either a language barrier or typo - or not precisely put. I read your "won't" as "want" In ca...
by cdiedrich
Tue Nov 05, 2019 9:50 am
Forum: General
Topic: Not full gigabit speed
Replies: 3
Views: 702

Re: Not full gigabit speed

Your config looks good to me an first sight. There have been issues in throughput and packet loss on RB3011 with the LCD turned on. Try turning off the LCD screen and see if that helps. As for your plenty dst-nat rules, you can aggregate the ports comma-seperated into one rule for each protocol and ...
by cdiedrich
Mon Nov 04, 2019 1:11 pm
Forum: Beginner Basics
Topic: Two subnets not communicating after Mangle rule [SOLVED]
Replies: 3
Views: 785

Re: Two subnets not communicating after Mangle rule [SOLVED]

Your mangle rule sets the routing mark no matter what the dst-address is. So add a route with the appropriate routing mark like this: /ip route add dst-address=192.168.138.0/24 gateway=ether1 routing-mark=your-routing-mark-eth3-wan add dst-address=192.168.138.0/24 gateway=ether1 routing-mark=your-ro...
by cdiedrich
Fri Nov 01, 2019 5:35 pm
Forum: Beginner Basics
Topic: DHCP only on WiFi
Replies: 2
Views: 702

Re: DHCP only on WiFi

Totally understandable application. I'd say this would work: /interface list add name=nodhcpports /interface list member add interface=ether3 list=nodhcpports add interface=ether4 list=nodhcpports /interface bridge filter add action=log chain=input dst-port=67-68 in-bridge=bridge1 in-interface-list=...
by cdiedrich
Fri Nov 01, 2019 5:05 pm
Forum: General
Topic: Log file spam with failed to pre-process ph2 packet error and wrong password error
Replies: 4
Views: 1014

Re: Log file spam with failed to pre-process ph2 packet error

I've seen this before a couple of times when no ipsec policies and proposals were defined but the other end had some proposals defined already.
Try adding sha1 to auth-algorithms in your proposals.

-Chris
by cdiedrich
Fri Nov 01, 2019 11:29 am
Forum: General
Topic: Remote syslog [SOLVED]
Replies: 5
Views: 954

Re: Remote syslog [SOLVED]

Hmmm...
which networks are bound to which interfaces?
And what's the content of the "lan" address list?

You normally just need one masq rule for everything going out to WAN. with proper routing in place, you won't need any internal src-nating as your last rule implies.
-Chris
by cdiedrich
Thu Oct 31, 2019 3:18 pm
Forum: The Dude
Topic: Dude 64-bt version
Replies: 6
Views: 3893

Re: Dude 64-bt version

+1
...and a Dude server with 64bit counters, please :-)

-Chris
by cdiedrich
Thu Oct 31, 2019 11:45 am
Forum: General
Topic: Remote syslog [SOLVED]
Replies: 5
Views: 954

Re: Remote syslog [SOLVED]

post an export of your core router's /ip firewall nat section.
Looks like your default (masquerade) rule is configured too loosely.

-Chris
by cdiedrich
Tue Oct 29, 2019 7:41 pm
Forum: Scripting
Topic: Script to delete itself after executing... [SOLVED]
Replies: 7
Views: 3240

Re: Script to delete itself after executing... [SOLVED]

It's only a guess, but I wouldn't be surprised if the script file is locked during execution and can't be deleted because of that. I could imagine a workaround: in your config script, create a scheduler item that runs on startup and deletes that file. It then removes itself from scheduler with the s...
by cdiedrich
Tue Oct 29, 2019 4:50 pm
Forum: Wireless Networking
Topic: CAPSMAN - How to persuade clients to choose 5GHz over 2GHz?
Replies: 9
Views: 3267

Re: CAPSMAN - How to persuade clients to choose 5GHz over 2GHz?

Access lists will allow you to control what device connects to which AP but you have to manually decide. Perhaps you could do some OUI lookup to determine 5GHZ capable devices or deny access for a while and see if they connect to 5GHz and if not then allow 2GHz ? It would be a good trick if we coul...
by cdiedrich
Tue Oct 29, 2019 1:32 pm
Forum: Scripting
Topic: Script to delete itself after executing... [SOLVED]
Replies: 7
Views: 3240

Re: Script to delete itself after executing... [SOLVED]

If the script is a file on the device, the last line of the script should be
/file remove yourscript.rsc
If the script is in the internal script repository, the last line should be
/system script remove where name=yourscriptname

-Chris
by cdiedrich
Tue Oct 29, 2019 1:27 pm
Forum: Wireless Networking
Topic: Huge wireless speed difference on RB2011UAS-2HnD
Replies: 8
Views: 1779

Re: Huge wireless speed difference on RB2011UAS-2HnD

In such scenarios I recommend to check these options: TX power: your w/l interface has a lot of power. Make sure you're running in regulatory-domain mode for your country. It's not unlikely that your router just saturates your client's RF interface. Adjust TX power downwards in 3dB steps if still ne...
by cdiedrich
Tue Oct 29, 2019 9:10 am
Forum: Beginner Basics
Topic: Worth it to change private IP address early in setup process?
Replies: 4
Views: 882

Re: Worth it to change private IP address early in setup process?

It depends. There´s basically nothing speaking against using the default range - but when it becomes likely that you interconnect with other networks that may be in the same subnet (i.e. deploy a MikroTik network for a friend of yours and set up tunnels between them and your network to service them)...
by cdiedrich
Mon Oct 28, 2019 7:44 am
Forum: Beginner Basics
Topic: Create a VLAN - with no additional hardware
Replies: 4
Views: 809

Re: Create a VLAN - with no additional hardware

vlan tags should be transparently carried through your unmanaged switch, it should work right away. The only drawback would be that every port of you witch will turn into a trunk port and that you can´t create access ports for the other lan on that switch. But looking at the scenario you described t...
by cdiedrich
Sun Oct 27, 2019 1:27 pm
Forum: General
Topic: Several DNS requests at non-existent domain
Replies: 6
Views: 1102

Re: Several DNS requests at non-existent domain

Yeah, in that case I´d recommend unbound as well.
by cdiedrich
Sun Oct 27, 2019 11:11 am
Forum: Wireless Networking
Topic: Capsman manager running on RB2011, but no CAP on it [SOLVED]
Replies: 19
Views: 3338

Re: Capsman manager running on RB2011, but no CAP on it [SOLVED]

In your local CAP settings, remove discovery interface and add 127.0.0.1 as CAPsMAN address.
-Chris
by cdiedrich
Sun Oct 27, 2019 11:08 am
Forum: General
Topic: Several DNS requests at non-existent domain
Replies: 6
Views: 1102

Re: Several DNS requests at non-existent domain

If the domains are foreseeable, I´d implement a basic conditional forwarder with L7 matcher and dst-nat. And in case the returned addresses are all in a foreseeable subnet, you can even add a term for reverse lookup: /ip firewall layer7-protocol add name=„fibusta“ regexp=„fibusta.lib|[0-9]+.195.10.1...
by cdiedrich
Thu Oct 10, 2019 3:40 pm
Forum: Forwarding Protocols
Topic: CCR TO CCR connection with pppoe Server and static IP [SOLVED]
Replies: 5
Views: 3074

Re: CCR TO CCR connection with pppoe Server and static IP [SOLVED]

Is getting the address from CCR1's dhcp server? If so, make the lease static, adjust the address and let CCR2 renew the lease. If it's static on CCR2, first add it to to correct interface (which then has .14 and .1), adjust all routes and peer settings in both routers accordingly, then remove .14 -C...
by cdiedrich
Wed Oct 09, 2019 5:57 pm
Forum: Forwarding Protocols
Topic: CCR TO CCR connection with pppoe Server and static IP [SOLVED]
Replies: 5
Views: 3074

Re: CCR TO CCR connection with pppoe Server and static IP [SOLVED]

Looking at your diagram I can only guess: 103.88.88.13/30 is the transport network between ccr1 and ccr2 ccr2 has a default route pointing to ccr1 103.88.88.1/29 is hosted on ccr2 and ccr1 should be able to talk to 103.88.88.1 Let's assume: ccr1 has 103.88.88.13/30 and ccr2 has 103.88.88.14/30 of th...
by cdiedrich
Tue Oct 08, 2019 3:47 pm
Forum: Forwarding Protocols
Topic: 3 branch offices VLAN over PPTP?
Replies: 5
Views: 2107

Re: 3 branch offices VLAN over PPTP?

Bummer.
No that's no EoIP scenario. Nor vlan - vlans are L2-local as well.
Try setting the tunnel interface as gateway in your routes instead of the remote IP of the tunnel.
-Chris
by cdiedrich
Tue Oct 08, 2019 2:58 pm
Forum: Forwarding Protocols
Topic: 3 branch offices VLAN over PPTP?
Replies: 5
Views: 2107

Re: 3 branch offices VLAN over PPTP?

Routing looks correct.
I'd rather say that this is a Windoze Firewall problem which by default does not accept incoming connections from non-local subnets.

-Chris
by cdiedrich
Fri Oct 04, 2019 1:10 pm
Forum: Useful user articles
Topic: setting change on multiple users with one click
Replies: 4
Views: 3032

Re: setting change on multiple users with one click

You can try MobaXterm. Log into all devices concurrently and then use Multi-Exec. Every character you type will be sent to all Sessions. Or create a .rsc script which contains all the changes and then upload it to all devices by FTP and name it <yourscript>.auto.rsc - it'll thenm be executed automag...
by cdiedrich
Tue Sep 24, 2019 5:35 pm
Forum: The Dude
Topic: Multiple Vlan monitoring
Replies: 7
Views: 2907

Re: Multiple Vlan monitoring

After thinking about this topic for a while, this might be a (part of a) solution: You say that you want to monitor your resident devices that might be shuffled around vlans, but do get an address in the vlan they've been moved to. And I read that the dude is running on the same machine as the dhcp ...
by cdiedrich
Thu Sep 12, 2019 4:37 pm
Forum: Wireless Networking
Topic: 802.11r/k, Band Steering
Replies: 19
Views: 5786

Re: 802.11r/k, Band Steering

I have to agree, pe1chl. But the density of devices with problems drops constantly. I build temporary wireless networks with tens of thousands of concurrent clients on a very regular basis - the last time I had problems with clients with k/r/v was in August 2017 (that was a Meru/Fortinet system). Cl...
by cdiedrich
Wed Sep 11, 2019 11:57 am
Forum: Wireless Networking
Topic: 802.11r/k, Band Steering
Replies: 19
Views: 5786

Re: 802.11r/k, Band Steering

I asked Support mid-July if there are mid-term (i.e. within a year) plans to implement k/r/v roaming and band steering.
The reply was that there's 'no precise schedule'.
That being said, I'm currently replacing a couple of CAPsMAN sites with Meraki. Really a bummer.
-Chris
by cdiedrich
Tue Sep 10, 2019 5:28 pm
Forum: Beginner Basics
Topic: Wireless Wire - VLAN [SOLVED]
Replies: 3
Views: 804

Re: Wireless Wire - VLAN [SOLVED]

Quick solution: create a vlan interface on the bridge interface. Assign an IP address to that vlan interface. Done. A colleague of mine had a similar problem with a D-Link switch. It seemed that LLDP neighbor discovery was causing the problem. Disable neighbor discovery (create a interface list with...
by cdiedrich
Thu Aug 22, 2019 1:19 pm
Forum: Beginner Basics
Topic: mac address/Wifi connection
Replies: 1
Views: 398

Re: mac address/Wifi connection

WhatsApp uses end-to-end encryption, so you're basically safe. Even if an attacker captures your raw data stream of a conversation, they still have to decrypt it. I wouldn't say that it's impossible, but frankly not within reasonable amount of labor, time and skills. Assuming that your WiFi is alrea...
by cdiedrich
Tue Aug 20, 2019 12:56 pm
Forum: Scripting
Topic: Round decimal number [SOLVED]
Replies: 2
Views: 1993

Re: Round decimal number [SOLVED]

Haven't found a real round function, but you may get lucky with this decimal calculation script and specify the decimal point place.
-Chris
by cdiedrich
Mon Aug 19, 2019 5:32 pm
Forum: Wireless Networking
Topic: upload speed down
Replies: 7
Views: 1082

Re: upload speed down

The config looks good so far. There's still a dhcp-client active on wlan1 - since you're using pppoe you won't need dhcp. I can only think of a polarization and/or alignment issue here - check your signal levels, the rx levels on both chains should be pretty close, an imbalance of 6 or more dB is a ...
by cdiedrich
Mon Aug 19, 2019 1:20 pm
Forum: Beginner Basics
Topic: Learning about Dude
Replies: 1
Views: 441

Re: Learning about Dude

The answer to each of your questions is yes.
For testing/learing/evaluating, you should consider deploying a CHR instance via ova in your ESX environment. It doesn't have a 24h limit but is limited to 1MBps throughput in unlicensed state.
-Chris
by cdiedrich
Fri Aug 09, 2019 9:02 am
Forum: General
Topic: unknow packets broadcasted
Replies: 4
Views: 938

Re: unknow packets broadcasted

I'd say it's CDP messages to 01:00:0C:CC:CC:CC. Check your discovery settings and adjust your discovery interface list to just the interfaces really needed for discovery. -Chris Edit: After re-reading the post in terms of timing and looking at the amount of bridges (I now assume that there's a bridg...
by cdiedrich
Fri Aug 09, 2019 8:26 am
Forum: General
Topic: Slow transfer speeds on LAN
Replies: 4
Views: 900

Re: Slow transfer speeds on LAN

From first sight I'd say that it's bridge-related. You have two bridges on the same physical switch chip (which covers sfp and ether1-5). And hw-offload is only available for one bridge per switch chip. So I guess that your link-local traffic is going through the CPU. It looks that you don't really ...
by cdiedrich
Fri Aug 09, 2019 8:12 am
Forum: Beginner Basics
Topic: Split /24 public ip addresses [SOLVED]
Replies: 2
Views: 934

Re: Split /24 public ip addresses [SOLVED]

Pretty straight forward: /ip firewall address-list add list=wan.1 address=192.168.0.2 add list=wan.1 address=192.168.0.3 ... add list=wan.2 address=192.168.0.9 add list=wan.2 address=192.168.0.10 ...and so on /ip firewall nat add action=src-nat src-address-list=wan.1 to-address=add list=wan.1 addres...
by cdiedrich
Wed Aug 07, 2019 3:15 pm
Forum: Forwarding Protocols
Topic: Routing Subnets not published by my router
Replies: 6
Views: 2162

Re: Routing Subnets not published by my router

Copy that - what a bummer. Now it really gets tricky and I'm not sure if it's possible at all. It might be worth a try to assign all addresses of all subnets to the router, give the machines other private subnets and create netmap rules for each and every IP address... Together with hairpin nat... W...
by cdiedrich
Wed Aug 07, 2019 10:27 am
Forum: Forwarding Protocols
Topic: Routing Subnets not published by my router
Replies: 6
Views: 2162

Re: Routing Subnets not published by my router

The best way would be to talk to your ISP and let him give you control over your subnets, these should then typically be routed through a /30 transport subnet - one end their router, the other end your CCR.
-Chris
by cdiedrich
Mon Aug 05, 2019 5:37 pm
Forum: Beginner Basics
Topic: Restrict access to hEX Ethernet port only for wAP
Replies: 21
Views: 2604

Re: Restrict access to hEX Ethernet port only for wAP

I can think of a couple of scenarios: 1. Isolating the AP from the rest: Create a dedicated /30 transport network for this certain AP and make ARP on those two interfaces (ether on hEX, ether1 on AP) static. Configure seperate datapaths for all your WiFi networks for manager forwarding and apply the...
by cdiedrich
Mon Aug 05, 2019 11:49 am
Forum: Beginner Basics
Topic: Please help!!!!
Replies: 5
Views: 887

Re: Please help!!!!

If your router has a serial console, you might get lucky with access from there and probably a script logging you in and disabling your netwatch item. That shouldn't take longer than two seconds.
Good luck!
-Chris
by cdiedrich
Thu Aug 01, 2019 4:47 pm
Forum: Beginner Basics
Topic: AirPrint doesn't work
Replies: 7
Views: 1723

Re: AirPrint doesn't work

If you didn't touch the data rates, then it should be good.
-Chris
by cdiedrich
Thu Aug 01, 2019 4:02 pm
Forum: General
Topic: DHCP error message [SOLVED]
Replies: 4
Views: 658

Re: DHCP error message [SOLVED]

Ooops... sorry, I was too quick reading your post. The error deals with dhcp client. That might be a heritage from the original config when ether1 was WAN.
It looks like you configured your device for bridging only or get WAN through SFP. So it should be safe just to remove that dhcp-client.
-Chris
by cdiedrich
Thu Aug 01, 2019 3:55 pm
Forum: General
Topic: DHCP error message [SOLVED]
Replies: 4
Views: 658

Re: DHCP error message [SOLVED]

Put the dhcp server on the bridge and not on physical interfaces being member of a bridge.
-Chris
by cdiedrich
Thu Aug 01, 2019 3:00 pm
Forum: Beginner Basics
Topic: AirPrint doesn't work
Replies: 7
Views: 1723

Re: AirPrint doesn't work

Setting multicast-helper from 'default' or 'disabled' to 'full' should solve the issue.
Additionally, check if lower rates are disabled - I had this issue more than once when el-cheapo WiFi printers only worked reliably when lower rates were re-enabled.
-Chris
by cdiedrich
Wed Jul 31, 2019 4:24 pm
Forum: General
Topic: DNS setting via DHCP being ingnored on Vlan
Replies: 8
Views: 1040

Re: DNS setting via DHCP being ingnored on Vlan

Post an export of your config and we can have a look at it - everything else will be guessing.
-Chris
by cdiedrich
Wed Jul 31, 2019 2:00 pm
Forum: Beginner Basics
Topic: 2 ISP + L2TP/IPsec
Replies: 3
Views: 884

Re: 2 ISP + L2TP/IPsec

I guess you add routing marks for this PC, correct? You'll need to add a route to this PC with its new routing mark to work. like: /ip route add dst-address=192.168.88.22 gateway=bridge routing-mark=myWan2-mark Edit: And probably (if even not more likely) a route to the vpn client with that routing ...
by cdiedrich
Wed Jul 31, 2019 1:30 pm
Forum: Useful user articles
Topic: Force OpenDNS and Safe Search on a vlan only
Replies: 1
Views: 2280

Re: Force OpenDNS and Safe Search on a vlan only

You should be good to set src-address in your dst-nat rules matching the subnet of your specific vlan.
If you have more address spaces to cover, you might be better off with an address list.

And I think your post is better placed in General.

-Chris
by cdiedrich
Wed Jul 31, 2019 1:04 pm
Forum: Scripting
Topic: Email-script if a certain DSTNAT is used
Replies: 1
Views: 1332

Re: Email-script if a certain DSTNAT is used

You might get lucky with this log parser script.
If you have more than a handful of equipment, it might be worth considering collecting all logs centrally. We're running Graylog to collect the logs from ~200 devices and setting up alerts in Graylog is really easy.

-Chris
by cdiedrich
Wed Jul 31, 2019 8:36 am
Forum: General
Topic: DHCP Server assign IPs to MACs 00:00:00:00:00:00
Replies: 6
Views: 1401

Re: DHCP Server assign IPs to MACs 00:00:00:00:00:00

...assigned by UniFi APs? So you have multiple dhcp servers in a single network?
First step is to disable those dhcp servers.
Second step is to check whether there's one or more devices with proxy-arp configured in your network. I could bet your lan-facing interface has proxy-arp enabled.
-Chris
by cdiedrich
Wed Jul 31, 2019 8:13 am
Forum: General
Topic: MAC Address limitation
Replies: 7
Views: 1205

Re: MAC Address limitation

The definitely best solution is dot1x as @sebastia mentioned. When your switches support it as well you're close to 100% secure.
-Chris
by cdiedrich
Mon Jul 29, 2019 5:49 pm
Forum: Scripting
Topic: DuckDNS Update Script (free DynDNS alternative)
Replies: 17
Views: 16263

Re: DuckDNS Update Script (free DynDNS alternative)

It pretty much looks like a private address - 172.22/16 is within 172.16/12 which is a private range.
And since the initial script is pulling the address from the interface, I'm sure you have a private address and your ISP is NATing your address.
-Chris
by cdiedrich
Mon Jul 29, 2019 5:14 pm
Forum: Scripting
Topic: DuckDNS Update Script (free DynDNS alternative)
Replies: 17
Views: 16263

Re: DuckDNS Update Script (free DynDNS alternative)

Hi - when I try to use this, it appears that there is another private address between the my Mikrotik router and the internet. So it returns a private address. Any other way I can do this? You could get your Ip this way: /tool fetch mode=http http-method=get url=http://icanhazip.com/ dst-path=myip....
by cdiedrich
Mon Jul 29, 2019 4:03 pm
Forum: General
Topic: MAC Address limitation
Replies: 7
Views: 1205

Re: MAC Address limitation

I'd like to add the option of only using static dhcp leases with "add arp for lease" option and setting the arp mode of the lan-facing interface to reply-only.
That at least blocks rogue clients from accessing the internet.
-Chris
by cdiedrich
Mon Jul 29, 2019 10:46 am
Forum: The Dude
Topic: Multiple Vlan monitoring
Replies: 7
Views: 2907

Re: Multiple Vlan monitoring

I get your points and understand your problems - i am in the events industry as well and know the woes with guest productions sharing consoles :-) A possible solution could be HotSpot with IP-binding aka one-to-one-NAT aka "Universal client" - you can translate literally any IP address to a valid ad...
by cdiedrich
Fri Jul 26, 2019 12:21 pm
Forum: Scripting
Topic: Built in function library
Replies: 60
Views: 26452

Re: Built in function library

I'd love to see the terminal object-oriented.
Please stop the off-topic messages, and please delete them if they are yours.
(I will delete this when that happens)
After re-reading my post I have to fully agree. Edited.
Thanks,
-Chris
by cdiedrich
Fri Jul 26, 2019 11:46 am
Forum: General
Topic: Load balancing over dual L2 backhaul fibre
Replies: 4
Views: 511

Re: Load balancing over dual L2 backhaul fibre

Perfect.
So a bonding with balance-rr should absolutely do the trick.
-Chris
by cdiedrich
Fri Jul 26, 2019 11:03 am
Forum: General
Topic: Load balancing over dual L2 backhaul fibre
Replies: 4
Views: 511

Re: Load balancing over dual L2 backhaul fibre

What device is the other end of that link?
Is it a switch? Or another MikroTik router?

You should be absolutely fine with bonding and balance-rr. Unfortunately, the fewest switches do this as well. And be aware that balance-rr can cause a lot of out-of-order packets.

-Chris
by cdiedrich
Thu Jul 25, 2019 5:58 pm
Forum: Scripting
Topic: Built in function library
Replies: 60
Views: 26452

Re: Built in function library

[removed b/c off-topic]
Additionally to all the mentioned functions, I'd consider a basic set of IP calculations very helpful.

-Chris
by cdiedrich
Thu Jul 25, 2019 12:58 pm
Forum: Scripting
Topic: Notification for new DHCP leases [SOLVED]
Replies: 2
Views: 2064

Re: Notification for new DHCP leases [SOLVED]

Sure.
Take a look at "lease-script" in the dhcp-server manual.
Add your matchers against the leaseActIP variable and then trigger an email.

-Chris
by cdiedrich
Tue Jul 23, 2019 5:13 pm
Forum: General
Topic: RSTP, when on lose ability to connect by IP to non root switch
Replies: 5
Views: 861

Re: RSTP, when on lose ability to connect by IP to non root switch

Nope, a root bridge can't have a backup port. It's on the other bridges to turn ports into backup. I guess the 60GHz link is MikroTik? What is the 24GHz link? Is it an AirFiber? Is WDS enabled on it? Is any STP-flavor definitely disabled on the w/l links? I had some similar issues a while ago when S...
by cdiedrich
Tue Jul 23, 2019 2:33 pm
Forum: The Dude
Topic: Multiple Vlan monitoring
Replies: 7
Views: 2907

Re: Multiple Vlan monitoring

You could run a discovery for the given subnets.
But that is a one-time run, either you repeat it every now and then or look for some other solution (NetXMS could deliver what you're looking for as it constantly scans the newtorks).
-Chris
by cdiedrich
Tue Jul 23, 2019 11:55 am
Forum: Wireless Networking
Topic: How to make a CAPsMAN redundant?
Replies: 3
Views: 1858

Re: How to make a CAPsMAN redundant?

If the bridges are replicable on the other router is solely your realm. If so, it's absolutely possible to add a redundant CAPsMAN. Make the two a vrrp cluster and clone the CAPsMAN config over to the other. Make your APs connect to the vrid. Make sure you disable all L2 connectivity for APs and man...
by cdiedrich
Mon Jul 22, 2019 3:38 pm
Forum: General
Topic: Allow trafic from one LAN to another but not the reverse [SOLVED]
Replies: 3
Views: 687

Re: Allow trafic from one LAN to another but not the reverse [SOLVED]

/ip firewall filter add action=accept chain=forward dst-address=172.16.11.0/24 src-address=172.16.10.0/24 add action=accept chain=forward connection-state=established,related dst-address=172.16.10.0/24 src-address=172.16.11.0/24 add action=drop chain=forward connection-state=invalid,new dst-address...
by cdiedrich
Mon Jul 22, 2019 10:46 am
Forum: General
Topic: 19" POE panel with LAN control
Replies: 1
Views: 499

Re: 19" POE panel with LAN control

I was looking into the same challenge recently. There's the Phihong POE370U which offers a network interface for managemengt (web interface) and snmp monitoring.
But looking at the pricing, a decent PoE switch might come in cheaper.

-Chris
by cdiedrich
Mon Jul 22, 2019 10:30 am
Forum: Beginner Basics
Topic: Use eth1, eth2 and WiFi in same network...
Replies: 1
Views: 457

Re: Use eth1, eth2 and WiFi in same network...

Remove all firewall rules in filter and nat sections.
Remove dhcp-client from ether1.
Add ether1 to bridge-local.
Remove ether1 from Interface-list "WAN".
Add ether1 to interface-list "LAN".
Done.

Then you still have a dhcp server running on your device. Disable it if not needed.

-Chris
by cdiedrich
Sat Jul 20, 2019 10:34 am
Forum: General
Topic: RB450Gx4 and hAPac spanning tree problem
Replies: 11
Views: 1691

Re: RB450Gx4 and hAPac spanning tree problem

As you can see, we don‘t get any further.
Now is the point to post both your full configs.
/export compact hide-sensitive 
-Chris
by cdiedrich
Fri Jul 19, 2019 1:10 pm
Forum: General
Topic: RB450Gx4 and hAPac spanning tree problem
Replies: 11
Views: 1691

Re: RB450Gx4 and hAPac spanning tree problem

This is not a full config export.
And are you sue about always-strip?
by cdiedrich
Thu Jul 18, 2019 3:43 pm
Forum: Forwarding Protocols
Topic: Can't establish LDP session between two Mikrotik routers
Replies: 7
Views: 2349

Re: Can't establish LDP session between two Mikrotik routers

But if I remove an interface from the bridge, I loose connectivity to that interface. This is why I always add all interface to the default bridge.
You will have mpls connectivity on this interface.
by cdiedrich
Thu Jul 18, 2019 3:33 pm
Forum: Forwarding Protocols
Topic: Can't establish LDP session between two Mikrotik routers
Replies: 7
Views: 2349

Re: Can't establish LDP session between two Mikrotik routers

LDP interface configuration is invalid. Are those interfaces slaves? if yes then you need to add master. Yes, they are all slaves. I run version 6.42.11 and 6.43.9. All my interface all linked to the default bridge: /interface bridge port add bridge=bridge comment=defconf interface=ether2 So you an...
by cdiedrich
Thu Jul 18, 2019 12:57 pm
Forum: General
Topic: configure multiple public IP address on DVR
Replies: 1
Views: 440

Re: configure multiple public IP address on DVR

Add the addresses to your wan-interface. Give the DVR an internal adddress. Then create dst-nat rules with the specific IP as dst-address, netmap as action and the DVR as to-address. (probably better to just dst-nat protocols and ports really needed for the DVR) It might be wise to create a dedicate...
by cdiedrich
Thu Jul 18, 2019 12:55 pm
Forum: General
Topic: encrypted password for mikrotik config
Replies: 19
Views: 5284

Re: encrypted password for mikrotik config

and not to mention to have the user database in an export.
by cdiedrich
Wed Jul 17, 2019 5:05 pm
Forum: General
Topic: RB450Gx4 and hAPac spanning tree problem
Replies: 11
Views: 1691

Re: RB450Gx4 and hAPac spanning tree problem

So as said twice now, post your configs and we can get a grasp of what's going on.
-Chris
by cdiedrich
Wed Jul 17, 2019 3:47 pm
Forum: Beginner Basics
Topic: My NAT forwarding is working, but I don't know how!
Replies: 2
Views: 500

Re: My NAT forwarding is working, but I don't know how!

dst-address is meant to be the WAN address of your router the server is located behind. I assume the 93. address is the remote location, correct? specifying a src-address surely adds some layer of security b/c the dst-nat will only happen when the connection is originated from this particular addres...
by cdiedrich
Wed Jul 17, 2019 1:54 pm
Forum: General
Topic: RB450Gx4 and hAPac spanning tree problem
Replies: 11
Views: 1691

Re: RB450Gx4 and hAPac spanning tree problem

As Anav said, we're fishing in the dark without actually seeing your configs.
I could imagine two more scenarios:

Is it possible that the PVIDs differ between the devices?
Can there be an additional link between them through an access port?

-Chris
by cdiedrich
Tue Jul 16, 2019 5:31 pm
Forum: General
Topic: RB951G & NordVPN (IKEv2/IPsec) / hexS&VLANs&NordVPN [SOLVED]
Replies: 18
Views: 2812

Re: RB951G & NordVPN (IKEv2/IPsec) [SOLVED]

I bet it's your hardware. the 951 is MipsBE and this is far from ideal for encrypting IPsec traffic. You might want to try a 750Gr3, 3011, 4011 or CCR series - these offer hardware acceleration. I personally run a 750Gr3 in my remote office which talks to our main office (CCR1036) through IPsec and ...
by cdiedrich
Tue Jul 16, 2019 5:17 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPP clients

That is an excellent point!
-Chris
by cdiedrich
Tue Jul 16, 2019 5:10 pm
Forum: General
Topic: Why Mikrotik ???
Replies: 32
Views: 8644

Re: Why Mikrotik ???

(c) Do Mikrotik have any limitations? That truly is difficult to answer. I'm managing about 5000 individual devices (covering routers, switches, wireless devices and more from MikroTik, Fortinet, Cisco, Juniper, SilverPeak, PepLink, UBNT and many more) in any given year and I'd say that about 90% o...
by cdiedrich
Sun Jul 14, 2019 12:44 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPP clients

Try adding a static route to your DG as follows:
224.0.1.1 via 172.16.4.17

-Chris
by cdiedrich
Sun Jul 14, 2019 11:38 am
Forum: General
Topic: Routing Question: Not able to get 1 gbps through our gateway with our router inline can without it
Replies: 8
Views: 1559

Re: Routing Question: Not able to get 1 gbps through our gateway with our router inline can without it

Since you stated that you're using a CCR1009-8G-1S-1S+ it is important to know which interfaces you are using for your backhaul and LAN side. That one still has a switch chip which aggregates ether1-ether4 to a single 1G pipe to the CPU. If you have both interfaces in that port range, it might be a ...
by cdiedrich
Fri Jul 12, 2019 2:21 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPP clients

Keep your address space as it is. Then install and configure PIM your router: Add the DG-facing interface to PIM. Add the pptp clients to PIM with their interfaces (create pptp server bindings for each client, these can be added). Your DG should send the multicast traffic to your router (give it sta...
by cdiedrich
Fri Jul 12, 2019 1:53 pm
Forum: Scripting
Topic: WOL PC while it's down [SOLVED]
Replies: 2
Views: 1626

Re: WOL PC while it's down [SOLVED]

I'd say /tool netwatch is your friend. It does exactly what you need, just fill in scripts for up/down that will fire on these events. But it might get tricky b/c the script is only fired once, not every time the target gets checked. So you might add another netwatch item which monitors your UPS. On...
by cdiedrich
Fri Jul 12, 2019 1:29 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPP clients

You shouldn't. That's reserved for IPv4 Multicast and will reliably mess things up in your router. I was asking if the Multicast you want to send to the clients is in that range. And if it is, chances are high that you will have success using PIM on your router. Here's an excellent presentation cove...
by cdiedrich
Fri Jul 12, 2019 12:14 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPP clients

BCP or any "true" layer2 tunnel (EoIP or vpls for example) will surely do. Is that Multicast link-local (224.0.0.0/24) or routable (everything from 224.0.1.0 upwards)? If the latter, you could surely try PIM on your concentrator and make the clients send a join request - this could easily be done wi...
by cdiedrich
Fri Jul 12, 2019 10:21 am
Forum: General
Topic: IPSec VPN (Sonciwall to MTK)
Replies: 3
Views: 575

Re: IPSec VPN (Sonciwall to MTK)

I'm pretty sure it's related to your loose masquerade rule. Traffic from Sonicwall to your subnet works b/c traffic is NATed to your routers internal IP address which is known to your site. And I guess that traffic towards the Sonicwall is mostt likely NATed to your WAN IP address so that traffic wi...
by cdiedrich
Thu Jul 11, 2019 2:01 pm
Forum: General
Topic: IPSec VPN (Sonciwall to MTK)
Replies: 3
Views: 575

Re: IPSec VPN (Sonciwall to MTK)

On first sight I see two issues: Your default masquerade rule is way too loose - it will masquerade everything from anywhere to anywhere. Add your local subnet as src-address and add your WAN-interface as out-interface. Move your NAT accept rules before your masquerade rule. and as a side note: Your...
by cdiedrich
Thu Jul 11, 2019 1:17 pm
Forum: Forwarding Protocols
Topic: Multicast to PPP clients
Replies: 12
Views: 2975

Re: Multicast to PPTP clients

In case the pptp clients are routers and not raod-VPN computers, you could give it a try by using BCP.
-Chris
by cdiedrich
Tue Jul 09, 2019 1:31 pm
Forum: Beginner Basics
Topic: DHCP option by rule [SOLVED]
Replies: 4
Views: 1082

Re: DHCP option by rule [SOLVED]

The lease script is fired after the lease is bound.
Either way you approach it - you would need static leases to assign the right options to the right clients.
Once your lease is static, you can adjust all options or select predefined option sets.
-Chris
by cdiedrich
Fri Jul 05, 2019 3:50 pm
Forum: General
Topic: ISP assigns Static IP addresses via DHCP
Replies: 6
Views: 903

Re: ISP assigns Static IP addresses via DHCP

I'm not sure if your ISP will allocate those reserved (and not changeable) MAC addresses of the VRRP interfaces, but it should be worth a try. If they don't, the next step towards madness is to use a bridge between the VRRP and the physical uplink interface and to set /interface bridge nat and /int...
by cdiedrich
Fri Jul 05, 2019 3:20 pm
Forum: General
Topic: ISP assigns Static IP addresses via DHCP
Replies: 6
Views: 903

Re: ISP assigns Static IP addresses via DHCP

The only way of getting more than one DHCP client on one interface is using VRRP interfaces. Add a VRRP interface to your WAN-port and add a dhcp client to this. You'll need some unused address space on the interfaces to make VRRP work. Like 192.168.171.2/30 on ethernet, .1/32 for vrrp1, vrid 2 192....
by cdiedrich
Fri Jul 05, 2019 11:51 am
Forum: Virtualization
Topic: VMWare Changing Time
Replies: 1
Views: 1846

Re: VMWare Changing Time

Edit vm settings -> VM Options -> VMware Tools -> Time and uncheck "Synchronize guest time with host"
by cdiedrich
Fri Jul 05, 2019 11:41 am
Forum: Beginner Basics
Topic: nat issue on mikrotik routers
Replies: 1
Views: 394

Re: nat issue on mikrotik routers

I'm totally not into gaming but I'm almost certain that it has to do with your loose masquerade rule. This rule catches any traffic and NATs from anywhere to anywhere. Modify it to narrow down matches: /ip firewall nat add action=masquerade chain=srcnat src-address=your.lan.space/24 out-interface=wl...
by cdiedrich
Wed Jul 03, 2019 12:41 pm
Forum: General
Topic: Block .exe from local network
Replies: 5
Views: 739

Re: Block .exe from local network

Proxy can be used to deny access to specific file types.
True, but only on http. Which is not the case on drive shares.
-Chris
by cdiedrich
Wed Jul 03, 2019 10:57 am
Forum: General
Topic: Block .exe from local network
Replies: 5
Views: 739

Re: Block .exe from local network

No, not in routerOS. First, operations in the local network usually don't pass the router. Second, there is no way to block transfers by file extension in routerOS, you'd need an advanced L7 firewall (that could even prevent that content from coming into your network). Best idea would be either bloc...
by cdiedrich
Tue Jul 02, 2019 6:53 pm
Forum: General
Topic: LIMIT FACEBOOK SPEED
Replies: 5
Views: 1523

Re: LIMIT FACEBOOK SPEED

It strongly depends on your organizational structure and what services your staff is supposed to use. Everything that syncs back to a cloud (Like Dropbox, iCloud, Google Drive, etc) is a good start to limit - especially as those syncs happen in background, nobody would really notice that the task is...
by cdiedrich
Tue Jul 02, 2019 5:41 pm
Forum: General
Topic: LIMIT FACEBOOK SPEED
Replies: 5
Views: 1523

Re: LIMIT FACEBOOK SPEED

No :-) Facebook traffic is not really high and not so bandwidth-consuming as it's a lot of GET requests with little transfer per request. I made the experience that limiting sites like this is more labor than you would gain out of it. Limiting sites with big transfers is much more suitable so that a...
by cdiedrich
Tue Jul 02, 2019 3:24 pm
Forum: General
Topic: unwanted change of source IP in my traffic
Replies: 6
Views: 702

Re: unwanted change of source IP in my traffic

As a first guess without seeing your config, I'd say your default srcnat/masquerade rule is too loose (i.e. has no src-address and no out-interface specified) Further I can imagine that your NAT-accept rules for this traffic are below the default srcnat/masquerade rule. Post an export of your config...
by cdiedrich
Tue Jul 02, 2019 2:58 pm
Forum: General
Topic: Firewall software or hardware
Replies: 7
Views: 973

Re: Firewall software or hardware

I agree it's another single point of failure but i guess there is less chances of a hardware firewall failure? That's a misconception. It's built from the same components: power supplies (failure #1), fans (failure #2), semiconductors, physical connectors, HDDs/SSDs, etc that are all subject to the...
by cdiedrich
Tue Jul 02, 2019 1:12 pm
Forum: General
Topic: have a two WAN ports in RB951 Router
Replies: 2
Views: 477

Re: have a two WAN ports in RB951 Router

Verify your default routes if you have check-gateway=ping enabled. If not, interface link state is the only indicator for your router.
-Chris
by cdiedrich
Tue Jul 02, 2019 1:09 pm
Forum: General
Topic: Firewall software or hardware
Replies: 7
Views: 973

Re: Firewall software or hardware

@cdiedrich, do you know how HA clusters/pairs of Fortigate and PA behave in this regard?
I do - absolutely seamless. All connections are always in sync. Dealing with those as my daily business...
by cdiedrich
Tue Jul 02, 2019 10:53 am
Forum: General
Topic: Firewall software or hardware
Replies: 7
Views: 973

Re: Firewall software or hardware

You are correct about the need of duplicating settings, but that counts for every setting, not only Firewall. And once created and proven good, I consider a firewall rather static... And with some scripting you could automate the replication to the other peer. When getting one firewall in front of t...
by cdiedrich
Mon Jul 01, 2019 3:41 pm
Forum: Beginner Basics
Topic: Expose the device name on the upsteam network
Replies: 4
Views: 727

Re: Expose the device name on the upsteam network

Upstream - or, to be more precise: The server that holds the data for your 192.168.0.0 network.
-Chris
by cdiedrich
Mon Jul 01, 2019 2:33 pm
Forum: General
Topic: Route based on latency?
Replies: 3
Views: 726

Re: Route based on latency?

Thanks for the hints.
I already considered the scripting way but was unsure if there was something more obvious that I might have missed.
-Chris
by cdiedrich
Mon Jul 01, 2019 2:04 pm
Forum: General
Topic: Firewall software or hardware
Replies: 7
Views: 973

Re: Firewall software or hardware

It depends on your needs. Do you need stateful failover? Do you need DPI? Do you need address collection in the firewall to do further things with on the CCRs? Do you need application control? Is firewall latency an issue? Do you need advanced logging facilities? Do you want it cloud managed? Do you...
by cdiedrich
Mon Jul 01, 2019 1:13 pm
Forum: Beginner Basics
Topic: Expose the device name on the upsteam network
Replies: 4
Views: 727

Re: Expose the device name on the upsteam network

Add a dns entry for your hAP.
-Chris
by cdiedrich
Thu Jun 27, 2019 1:24 pm
Forum: General
Topic: VLAN VRRP
Replies: 18
Views: 2705

Re: VLAN VRRP

It's absolutely possible.
First, add vlans to the bonding interface and then add vrrp interfaces to the vlans.
Or, if you want one vrrp interface being the master of the whole subsequent trunk port, add just one vrrp on the bonding interface and then add vlans to the vrrp interface.
Done.
-Chris
by cdiedrich
Wed Jun 26, 2019 7:55 pm
Forum: General
Topic: Route based on latency?
Replies: 3
Views: 726

Route based on latency?

All, I need to create a self-contained package for a client of ours who will tour with a recurring event. Their guest management system relies on a timing-critical database application running somewhere in a cloud. Due to recent bad experiences with venue internet and partially blocked ports, the pa...
by cdiedrich
Fri Jun 21, 2019 9:21 am
Forum: Wireless Networking
Topic: Need Advice to Cover 300 WiFi Users in Banquet Hall
Replies: 6
Views: 1213

Re: Need Advice to Cover 300 WiFi Users in Banquet Hall

I'd strongly recommend not to use MikroTik wireless devices for high density applications. The lack of any 802.11 roaming, band steering and adjustable beacon interval renders them useless for such deployments. Better look into UBNT, Xirrus, Meraki, Fortinet/Meru, Everest Networks (in ascending budg...
by cdiedrich
Thu May 16, 2019 11:42 am
Forum: Forwarding Protocols
Topic: OpenVPN + IpSec [SOLVED]
Replies: 6
Views: 2780

Re: OpenVPN + IpSec [SOLVED]

Does Site B have a route to 192.168.252.0/24 via Site A?
-Chris
by cdiedrich
Wed May 15, 2019 6:34 pm
Forum: General
Topic: Load balancing 2x WAN on same FTTH gateway
Replies: 3
Views: 519

Re: Load balancing 2x WAN on same FTTH gateway

Multi-WAN with same gateway works as described in this thread.
Regarding the resulting bandwidth, you will have 700/700-ish with multiple flows while one flow cannot be greater than the WAN link it is assigned to.
Look at the examples in this manual page.

-Chris
by cdiedrich
Wed May 15, 2019 5:59 pm
Forum: Beginner Basics
Topic: Multiple Entries for same IPs in ARP table? [SOLVED]
Replies: 2
Views: 564

Re: Multiple Entries for same IPs in ARP table? [SOLVED]

You have the same IP range (10.20.0/24) in br-AP and vlan1002.
-Chris
by cdiedrich
Wed May 15, 2019 10:47 am
Forum: Virtualization
Topic: Server 2019 HV with chr-6.44.3 no bridge function
Replies: 2
Views: 1810

Re: Server 2019 HV with chr-6.44.3 no bridge function

I could bet that it's related to Hyper-V not being configured for promiscous mode.
-Chris
by cdiedrich
Wed May 08, 2019 1:52 pm
Forum: Beginner Basics
Topic: winbox and vlan
Replies: 4
Views: 682

Re: winbox and vlan

If I remember correctly, admin access is restricted to 192.168.88.0/24 in the default config, so access from 10.0.0.0/8 will be dropped and you're seeing the timeouts. Try adding your vlan100 range under IP -> Services in the "available from" field. To do so, either connect from a 192.168.88.0/24 ra...
by cdiedrich
Thu Apr 04, 2019 5:47 pm
Forum: The Dude
Topic: Programmatically adjust devices?
Replies: 8
Views: 2390

Re: Programmatically adjust devices?

Hey Ruben,

that would be great, thank you very much.
DM is not supported here in the forum - feel free to contact me on cdiedrich (at) clairglobal.com

Thanks again,
-Chris
by cdiedrich
Wed Apr 03, 2019 10:19 pm
Forum: The Dude
Topic: Nested functions in probes, numbers in custom fields
Replies: 0
Views: 1686

Nested functions in probes, numbers in custom fields

Hi all, It looks like using nested functions in probes don't work as expected. Runnind the Dude 6.44 in a x86 instance (not CHR). 6.44.1 shows the very same behaviour. These terms are working perfectly when being used individually in a function probe in the "available" line: if(device_property("Cust...
by cdiedrich
Wed Apr 03, 2019 2:02 am
Forum: The Dude
Topic: Programmatically adjust devices?
Replies: 8
Views: 2390

Re: Programmatically adjust devices?

Update:
A colleague of mine is currently writing a Python script that remote controls chrome that then cycles through WebFig where we have access to all relevant device fields in the dude.
Will share the outcome once we have what we need.

-Chris
by cdiedrich
Wed Apr 03, 2019 1:46 am
Forum: The Dude
Topic: Programmatically adjust devices?
Replies: 8
Views: 2390

Re: Programmatically adjust devices?

What a bummer - thanks.
Time to get an apprentice working on updating ~2000 devices with three fields each...
-Chris
by cdiedrich
Wed Apr 03, 2019 1:17 am
Forum: The Dude
Topic: Programmatically adjust devices?
Replies: 8
Views: 2390

Programmatically adjust devices?

Dear all,

is there a way (through script, API or whatsoever) to bulk-update device custom fields?
We have a map with thousands of devices and need to fill custom fields based on either MAC address, device name or IP address.

Any hint is highly appreciated.
Thanks,
-Chris
by cdiedrich
Fri Mar 29, 2019 12:01 pm
Forum: Beginner Basics
Topic: VPN Connect 2 Locations and a few Clients ?
Replies: 7
Views: 797

Re: VPN Connect 2 Locations and a few Clients ?

Now that's a good start. All that's left is adding routes through the tunnel. Assuming 192.168.1.0/24 is on the tunnel local IP of 192.168.99.1 and 192.168.10.0/24 is on the tunnel local IP of 192.168.99.2 do this: #on router 1 /ip route add dst-address=192.168.1.0/24 gateway=192.168.99.1 distance=2...
by cdiedrich
Thu Mar 28, 2019 3:21 pm
Forum: Beginner Basics
Topic: VPN Connect 2 Locations and a few Clients ?
Replies: 7
Views: 797

Re: VPN Connect 2 Locations and a few Clients ?

This Section of the IPsec manual is pretty comprehensive and should exactly do what you want to accomplish.

Since IPsec is a cpu-hog, I'd advise to use it on routers with h/w acceleration olnly (all CCR series, 1100AHx4, RG750Gr3, RB3011).

-Chris
by cdiedrich
Wed Mar 27, 2019 2:14 pm
Forum: The Dude
Topic: graphing MultiGig links from SNMP
Replies: 1
Views: 2778

graphing MultiGig links from SNMP

Hi all, we recently upgraded our infrastructure to Cisco Nexus 3548P and Catalyst 9300 switches. While updating the dude maps (Running 6.44.1 in a CHR) I realized that the link graphs don't scale correctly: I have a couple of links from 9300 TwoGigabit-Interfaces linking to other devices with a 1Gig...
by cdiedrich
Thu Mar 21, 2019 3:13 pm
Forum: General
Topic: wAP ac and wap60g PoE issues on Catalyst 9300
Replies: 2
Views: 942

wAP ac and wap60g PoE issues on Catalyst 9300

I'm facing strange issues powering wAP ac and wap60g devices from a Cisco Catalyst 9300. The devices don't turn on at all. They work well with Cisco 3560, UBNT Edge Switches and Netonix. Now the fix that made it work is really strange: I just insert a passive MTik Gigabit PoE injector on the AP side...
by cdiedrich
Thu Mar 14, 2019 3:10 pm
Forum: Scripting
Topic: How to really make backups (by script) ?
Replies: 15
Views: 2029

Re: How to really make backups (by script) ?

You could add a mini-script at the end of the rsc file which resets all mac-addresses and sets the bridges to auto-mac. This goes into the scheduler, to be run at startup. The script will delete itself from scheduler once finished. Like this: /system scheduler add name=resetmac on-event=":foreach k ...
by cdiedrich
Thu Mar 14, 2019 2:14 pm
Forum: General
Topic: Wirless Managemnt On VLAN and Pass All vlans [SOLVED]
Replies: 4
Views: 618

Re: Wirless Managemnt On VLAN and Pass All vlans [SOLVED]

So you already created a vlan interface. Put this on the bridge, not on physical ports. Then add an appropriate ip address to that vlan interface. Or enable vlan filtering on your bridges, create all allowed vlans for these and their tagged port mappings for both physiical interfaces (ether and wlan...
by cdiedrich
Wed Mar 13, 2019 1:10 pm
Forum: Wireless Networking
Topic: Mikrotik WLAN & CAPsMAN - Bad download perfomance
Replies: 47
Views: 8435

Re: CAPsMAN poor wireless speed

Looking at your first screen shot in your first post, I'd say that's a decent connection. You're connected at VHT MCS 7 with two spatial streams and short guard interval resulting in 650MBps connection rate at 80MHz. Keeping in mind that actual real-life throughput is roughly 50...65% of the w/l con...
by cdiedrich
Wed Mar 13, 2019 12:18 pm
Forum: Beginner Basics
Topic: VPN betwenn 2 Mikrotik behind Router
Replies: 4
Views: 509

Re: VPN betwenn 2 Mikrotik behind Router

Do the Tiks have routes set?

like
#Site B
/ip route add distance=20 dst-address=192.168.10.0/24 gateway=1.1.1.1
#Site A
/ip route add distance=20 dst-address=192.168.1.0/24 gateway=1.1.1.2
by cdiedrich
Wed Mar 13, 2019 11:49 am
Forum: General
Topic: Troubble with a IP Address
Replies: 1
Views: 279

Re: Troubble with a IP Address

Did you specify a subnet mask?
If not, the address is a /32 and can't communicate anywhere.
So it should look like
/ip address add address=172.18.0.1/24 interface=vlan101
I guess your config looks like
/ip address add address=172.18.0.1 interface=vlan101
and won't work.
-Chris
by cdiedrich
Wed Mar 13, 2019 11:43 am
Forum: Beginner Basics
Topic: VPN betwenn 2 Mikrotik behind Router
Replies: 4
Views: 509

Re: VPN betwenn 2 Mikrotik behind Router

Did I get this correctly that the oVPN connection is up and your MTik devices are not acting as routers behind in any way? If so, you'd need to add static routes in the FritzBoxes for the remote subnets pointing to the local MikroTik device as gateway. And the MTik devices should know the remote rou...
by cdiedrich
Tue Mar 12, 2019 1:18 pm
Forum: General
Topic: What is the best method to connect between 2 routers? and How?
Replies: 8
Views: 694

Re: What is the best method to connect between 2 routers? and How?

The exact same question has been asked & solved in this thread just a couple of minutes ago.
by cdiedrich
Tue Mar 12, 2019 11:20 am
Forum: General
Topic: HAP ac bug
Replies: 2
Views: 436

Re: HAP ac bug

Did you tick "Keep old configuration" during NetInstall? Or did you restore a backup (not .rsc) file after installing? I had the exact symptoms on a 2011 a couple of years ago. NetInstalling it freshly without the old config solved it for me. Also check system routerboard if there's something to upd...
by cdiedrich
Mon Mar 11, 2019 3:50 pm
Forum: General
Topic: mikrotik repeat hotspot
Replies: 5
Views: 596

Re: mikrotik repeat hotspot

Yes, you can.
Authentication is simply done through a client device behind that Mkrotik. Done that a couple of times and it's really straight forward.
-Chris
by cdiedrich
Fri Mar 08, 2019 1:11 pm
Forum: General
Topic: wifi AC speed went down from 7xx mbps to 1xx mbps after migrating wlans to CAPsMAN
Replies: 2
Views: 415

Re: wifi AC speed went down from 7xx mbps to 1xx mbps after migrating wlans to CAPsMAN

Are you talking about throughput or connected rates? Connected rates don't give you too much information when the device is idle. They're adjusted dynamically based on load and connection quality. If you're talking about throughput, I'd first check data path which should be "local forwarding" for hi...
by cdiedrich
Wed Mar 06, 2019 4:47 pm
Forum: Beginner Basics
Topic: How to make vpn exclude 1 internet, in a load balancer
Replies: 3
Views: 422

Re: How to make vpn exclude 1 internet, in a load balancer

That already makes sense.
Additional question: is the VPN originated from your router?
If so, set a static route to the vpn peer via default g/w of ether1's ISP.
-Chris
by cdiedrich
Mon Feb 25, 2019 11:28 am
Forum: Forwarding Protocols
Topic: Dual SIP providers one Lan routing on Mikrotik
Replies: 4
Views: 2098

Re: Dual SIP providers one Lan routing on Mikrotik

Add two more default routes with routing marks for both providers. Do I have to create a routing mark first? and then add the route? or how do I add the two more default routes for both providers The sequence of doing this stuff doesn't really matter - you can do it either order. It might be good t...
by cdiedrich
Mon Feb 25, 2019 11:17 am
Forum: Wireless Networking
Topic: Managment ip for cAP
Replies: 5
Views: 866

Re: Managment ip for cAP

Sure thing.
The easiest way would be adding back your vlan interface to the bridge and moving the dhcp-client to that vlan interface.
Make sure you do not use the option "use-service-tag".

-Chris
by cdiedrich
Fri Feb 22, 2019 5:40 pm
Forum: Wireless Networking
Topic: Managment ip for cAP
Replies: 5
Views: 866

Re: Managment ip for cAP

Your vlan 99 comes untagged from your switch - so it's native to your cap.
remove the vlan interface from your bridge and move the dhcp-client directly to the bridge.

And as a side note: you wouldn't need the option "use service tag" - wthis is only needed for QinQ tunnels.

-Chris
by cdiedrich
Fri Feb 22, 2019 1:36 pm
Forum: Wireless Networking
Topic: Managment ip for cAP
Replies: 5
Views: 866

Re: Managment ip for cAP

An export of your cap config would be good to see along with a "show int Gi0/xx switchport" off your switch from the port the cap is connected to.
-Chris
by cdiedrich
Fri Feb 22, 2019 1:13 pm
Forum: Forwarding Protocols
Topic: Dual SIP providers one Lan routing on Mikrotik
Replies: 4
Views: 2098

Re: Dual SIP providers one Lan routing on Mikrotik

Keep both default routes. Add two more default routes with routing marks for both providers. Add two src-nat rules for both WAN interfaces. Add routes for both SBCs with above routing marks. Mangle your incoming and outgoing connections from/to those SBCs (first: mark connection, second: mark routin...
by cdiedrich
Thu Feb 14, 2019 4:02 pm
Forum: General
Topic: Multiple Public IP over Same Interface with Same Gateway
Replies: 7
Views: 803

Re: Multiple Public IP over Same Interface with Same Gateway

You won't need routes for this - all IPs of your /29 subnet will talk to the same gateway on your ISP's side. just create dedicated NAT rules: /ip firewall nat add chain=srcnat action=src-nat src-address=your.vlan.10.range/24 dst-address=0.0.0.0/0 to-address=your.public.ip-forVlan10 add chain=srcnat...
by cdiedrich
Thu Feb 07, 2019 9:12 am
Forum: Beginner Basics
Topic: Different DNS to different Mac addresses
Replies: 3
Views: 762

Re: Different DNS to different Mac addresses

Since your devices are already known, you could create static leases for those.
Let the DHCP server add the lease a to an address list and use this list for your rules.

-Chris
by cdiedrich
Mon Feb 04, 2019 5:55 pm
Forum: General
Topic: Question for an expert - Layer 2 / 3 Bridging
Replies: 4
Views: 887

Re: Question for an expert - Layer 2 / 3 Bridging

Besides the mentioned points this sounds like a QoS problem to me. Try to capture packets and take a look at dscp values. If not set up properly on the switch, this can cause undesired behavior - especially when running other dscp-critical protocols like Dante on the same trunk. Since my experience ...
by cdiedrich
Fri Feb 01, 2019 12:17 pm
Forum: General
Topic: Measuring Oracle DB connection bandwidth
Replies: 1
Views: 410

Re: Measuring Oracle DB connection bandwidth

When you say "local network" you mean like client and server being in the same subnet? If so, it has nothing to do with your router but with your infrastructure. Check your switches, link saturation, error counts, QoS settings. In case your switches are smart enough, you might want to allocate bandw...
by cdiedrich
Wed Jan 30, 2019 1:51 pm
Forum: Forwarding Protocols
Topic: Problem while using VRRP between routers with BGP
Replies: 7
Views: 2278

Re: Problem while using VRRP between routers with BGP

In routing filters - as you already did with prepend and MED.
-Chris
by cdiedrich
Wed Jan 30, 2019 9:46 am
Forum: Forwarding Protocols
Topic: Problem while using VRRP between routers with BGP
Replies: 7
Views: 2278

Re: Problem while using VRRP between routers with BGP

I had the same issue with one of our CCR vrrp-cluster peering a SilverPeak VXOA appliance. It turned out that the appliance wasn't interpreting MEDs correctly. I solved it with manually adjusting advertised distances. Not the smart way but it worked. Just to be sure - your two CCRs share the same AS...
by cdiedrich
Wed Jan 30, 2019 7:06 am
Forum: Beginner Basics
Topic: Point to MultiPoint woes
Replies: 4
Views: 468

Re: Point to MultiPoint woes

-27dB is way too loud. They are screaming at each other.
Even for a lab - increase the distance between the two units drastically.
I'm pretty sure that's one (or even your only) of your problems.

Flapping data rates are pretty normal when being mostly idle.

-Chris
by cdiedrich
Tue Jan 29, 2019 11:44 am
Forum: Wireless Networking
Topic: Art-Net / UDP port 6454 over WIFI
Replies: 9
Views: 1147

Re: Art-Net / UDP port 6454 over WIFI

The previously mentioned rates count for .11b and .11g - HT MCS count for .11n, VHT MCS for .11ac (not applicable on your device) I'd suggest to disable MCS 0-2 and 8 - so the lowest rate a .11n device can connect with will be 26MBit with one (HT MCS3) or two (HT MCS9) spatial streams. Find a very c...
by cdiedrich
Tue Jan 29, 2019 9:56 am
Forum: Beginner Basics
Topic: Point to MultiPoint woes
Replies: 4
Views: 468

Re: Point to MultiPoint woes

I'm not sure if that Quickset-CPE setting is the setting you want. Leave quickset aside, remove both configurations and start from scratch: On the AP side, create a bridge, add wired and wireless interfaces to it. Completely disable any flavor of STP on the bridge. Set your wireless interface to ap-...
by cdiedrich
Mon Jan 28, 2019 8:18 pm
Forum: Wireless Networking
Topic: Art-Net / UDP port 6454 over WIFI
Replies: 9
Views: 1147

Re: Art-Net / UDP port 6454 over WIFI

Now that's a bummer.
It's been a while since I last did ArtNet over MTik wireless.
You might try to disable multicast helper and set the lowest basic and common-rates to 24M. Don't forget to adjust ht- and vht- mcs indexes as well.

Good luck,
-Chris
by cdiedrich
Mon Jan 28, 2019 2:44 pm
Forum: Wireless Networking
Topic: Art-Net / UDP port 6454 over WIFI
Replies: 9
Views: 1147

Re: Art-Net / UDP port 6454 over WIFI

I'd say your issues are layer2, no need to add anything to the firewall - just leave it completely blank. First thing to check is TX power - by default routerOS devices come with really high tx power which can easily overload your connected clients. Have a look in registration table - any connection...
by cdiedrich
Mon Jan 28, 2019 1:40 pm
Forum: General
Topic: Tunnel which generates least traffic when IDLE
Replies: 13
Views: 1862

Re: Tunnel which generates least traffic when IDLE

if security is not really an issue, I can recommend pptp which creates just a couple of kilobytes per day when totally idle.
-Chris
by cdiedrich
Fri Jan 25, 2019 3:12 pm
Forum: General
Topic: S-to-S Ipsec tunell comes up, but after 40 minutes I get error
Replies: 9
Views: 983

Re: S-to-S Ipsec tunell comes up, but after 40 minutes I get error

Perfect!
Glad it was so simple.
-Chris
by cdiedrich
Fri Jan 25, 2019 1:49 pm
Forum: General
Topic: S-to-S Ipsec tunell comes up, but after 40 minutes I get error
Replies: 9
Views: 983

Re: S-to-S Ipsec tunell comes up, but after 40 minutes I get error

Try it. IPsec relies a lot on proper synchronization - and even slightest drifts or glitches can break tunnels.
Had this a couple of times before.
-Chris
by cdiedrich
Fri Jan 25, 2019 1:40 pm
Forum: General
Topic: S-to-S Ipsec tunell comes up, but after 40 minutes I get error
Replies: 9
Views: 983

Re: S-to-S Ipsec tunell comes up, but after 40 minutes I get error

Odd.
Do both routers use the same NTP server?
-Chris
by cdiedrich
Fri Jan 25, 2019 1:15 pm
Forum: General
Topic: S-to-S Ipsec tunell comes up, but after 40 minutes I get error
Replies: 9
Views: 983

Re: S-to-S Ipsec tunell comes up, but after 40 minutes I get error

Mismatching lifetimes in proposals?
LifeBytes configured?
-Chris
by cdiedrich
Fri Jan 25, 2019 10:07 am
Forum: General
Topic: MikroTik Bonding under bridge but with loop
Replies: 2
Views: 752

Re: MikroTik Bonding under bridge but with loop

First thing I see is that you're using bondings across devices (connecting Switch 4 to 5-10). That's not possible with MikroTik switches as they aren't stackable in terms of backplane extension. Bondings have to terminate in the very same device. I'd say that's the first source of your problems. -Ch...
by cdiedrich
Thu Jan 24, 2019 2:16 pm
Forum: Beginner Basics
Topic: Help with traffic routing [SOLVED]
Replies: 7
Views: 818

Re: Help with traffic routing [SOLVED]

Setting the route only to one side of the network is not enough. Now your MTik machine knows it, but the two others still don't so nothing will happen. I don't understand your concerns about security - you established a vpn already, isn't this a sign for trust? And be aware that netmapping still pre...
by cdiedrich
Thu Jan 24, 2019 11:56 am
Forum: Beginner Basics
Topic: Help with traffic routing [SOLVED]
Replies: 7
Views: 818

Re: Help with traffic routing [SOLVED]

I don't see a reason for netmapping here. You just need to add routes: FW1: dst-address=192.168.1.0/24 via VPN endpoint on Router1. Router1: dst-address=192.168.242.0/29 via VPN endpoint on FW1 dst-address=192.168.1.0/24 via 172.16.0.3 (MikroTik router) MikroTik: dst-address=192.168.242.0/29 via 172...
by cdiedrich
Wed Jan 23, 2019 4:14 pm
Forum: Beginner Basics
Topic: How to discover a remote device on the network ?
Replies: 6
Views: 714

Re: How to discover a remote device on the network ?

Simple: no way.
-Chris
by cdiedrich
Wed Jan 23, 2019 3:53 pm
Forum: Beginner Basics
Topic: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)
Replies: 9
Views: 926

Re: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)

I think I found a typo in "giganet" router's ipsec policy:
Its address should be 178.x.x.33 but in the policy sa-src-address is configured as 178.x.x.153

The rest is not looking too bad on first sight.
-Chris
by cdiedrich
Wed Jan 23, 2019 3:19 pm
Forum: Wireless Networking
Topic: MultiSSID and VLANS
Replies: 1
Views: 408

Re: MultiSSID and VLANS

remove your vlan interfaces. remove your "Vlan2_bridge" bridge. Enable vlan filtering on your native bridge "bridge" and set it to pvid=2. Then move the IP address to this bridge. Add your virtual APs for guest access to that bridge and keep their vlan setting at vlan-id=2 and set tag mode to use-ta...
by cdiedrich
Wed Jan 23, 2019 2:37 pm
Forum: Beginner Basics
Topic: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)
Replies: 9
Views: 926

Re: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)

Insight: looking at your screenshot, your masquerade rule doesn't have a matcher for src-address. It may happen (that's still my guess, but it's not unlikely) that traffic from the remote network gets caught by this rule and then gets masqueraded, leaving your router via pppoe-out1 (when I read your...
by cdiedrich
Wed Jan 23, 2019 1:33 pm
Forum: Beginner Basics
Topic: Transparent Connection on SIP SERVER, its possible? [SOLVED]
Replies: 3
Views: 543

Re: Transparent Connection on SIP SERVER, its possible? [SOLVED]

Great to hear it works.
I wouldn't say so security-wise.
-Chris
by cdiedrich
Wed Jan 23, 2019 1:32 pm
Forum: Beginner Basics
Topic: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)
Replies: 9
Views: 926

Re: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)

Did you adjust your masquerade rule as well?
And BTW, it's better to post config exports than screenshots. A screenshot only shows a fraction of all possible parameters.

-Chris
by cdiedrich
Wed Jan 23, 2019 1:04 pm
Forum: General
Topic: Drop forward rules NOT worked between devices connected via Wi-Fi
Replies: 10
Views: 1145

Re: Drop forward rules NOT worked between devices connected via Wi-Fi

Sorry, didn't notice the default-fwd=no in the config.
As OP also set default-authentication=no and created an access list with default-forward=yes per client, this setting overrides the setting in the interface setting.
So we're still talking about a default-forward issue on the w/l interface.
-Chris
by cdiedrich
Wed Jan 23, 2019 12:21 pm
Forum: Beginner Basics
Topic: Two L2TP-tunnels from one WAN
Replies: 5
Views: 615

Re: Two L2TP-tunnels from one WAN

Just add (static) routes with the remote address of the tunnel as gateway. as a side note: L2TP/IPsec or plain IPsec would give you much better results in a site2site tunnel - SSTP is tcp-based and sending acks back and forth has a negative impact on latency and hence throughput. Additionally, SSTP ...
by cdiedrich
Wed Jan 23, 2019 10:46 am
Forum: Beginner Basics
Topic: Two L2TP-tunnels from one WAN
Replies: 5
Views: 615

Re: Two L2TP-tunnels from one WAN

http://macappstore.org/sstp-client/
/Chris
by cdiedrich
Wed Jan 23, 2019 10:33 am
Forum: General
Topic: Drop forward rules NOT worked between devices connected via Wi-Fi
Replies: 10
Views: 1145

Re: Drop forward rules NOT worked between devices connected via Wi-Fi

Your second "unexpected" condition is correct and is totally expected for me. The traffic doesn't even enter the bridge - it remains in the wireless interface, the two devices use your wlan interface as a wireless switch. Mitigation would be disabling default-forward on the AP - this will isolate cl...
by cdiedrich
Wed Jan 23, 2019 10:25 am
Forum: General
Topic: Using DNS instead of IP with MikroTik Router as a VPN Client
Replies: 2
Views: 863

Re: Using DNS instead of IP with MikroTik Router as a VPN Client

I wonder which version of routerOS you are running.
connect-to nicely accepts fqdn. I'm connecting many devices with this.
-Chris
by cdiedrich
Tue Jan 22, 2019 1:50 pm
Forum: Beginner Basics
Topic: Two L2TP-tunnels from one WAN
Replies: 5
Views: 615

Re: Two L2TP-tunnels from one WAN

There's nothing you did wrong. It's the nature of ipsec-esp - the protocol does not contain any information which session it belongs to. So the edge router where your road warriors are located has no idea to which client it has to send incoming packets. Usually the first connected client wins and ge...
by cdiedrich
Tue Jan 22, 2019 12:23 pm
Forum: Beginner Basics
Topic: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)
Replies: 9
Views: 926

Re: IP Sec tunnel alive but no traffic (NAT and Firewall rules are added)

This is just a guess but probably worth a try: Your default masquerade rule in both sites has no src-address specified which leaves plenty of room for interpretation and I wouldn't be surprised if tunnel traffic from the remote site gets masqueraded right away and comes out of your LAN-facing interf...
by cdiedrich
Tue Jan 22, 2019 11:54 am
Forum: General
Topic: Suggestions for allowing only one pppoe connection over a layer2
Replies: 1
Views: 402

Re: Suggestions for allowing only one pppoe connection over a layer2

The first thing in my mind would be bridge filters in your CPE.
You ideally whitelist the MAC address of your customer's router for pppoe discovery and session and drop all other pppoe traffic.
This might get tedious but could be worth a try...
-Chris
by cdiedrich
Tue Jan 22, 2019 11:43 am
Forum: General
Topic: OpenVPN suddenly stopped working
Replies: 2
Views: 417

Re: OpenVPN suddenly stopped working

Looks like the connection attempt is being rejected from your router. Is your ovpn server still running?
Did you apply any changes to your input firewall before that?
by cdiedrich
Mon Jan 21, 2019 4:10 pm
Forum: General
Topic: Unidirectional ethernet on routerOS?
Replies: 0
Views: 394

Unidirectional ethernet on routerOS?

All, Has anyone tried (and successfully implemented) to realize a pair of unidirectional ethernet links like UDE on Cisco 4500/6500 switch platform on a MikroTik router? If so, I'd be very interested on how it was achieved. Manually maintaining host/mac tables is not an option for my application... ...
by cdiedrich
Mon Jan 21, 2019 1:53 pm
Forum: Beginner Basics
Topic: Transparent Connection on SIP SERVER, its possible? [SOLVED]
Replies: 3
Views: 543

Re: Transparent Connection on SIP SERVER, its possible? [SOLVED]

Your default masquerade rule is too ambigious. With your current setting everything will be NATed. It looks like you have multiple ISPs and a bunch of local networks attached. Try to narrow down your masquerade rule. Add all your local subnets to another address list "localnetworks" Adjust your masq...
by cdiedrich
Fri Jan 18, 2019 4:16 pm
Forum: Virtualization
Topic: CHR, LACP, and VMware
Replies: 2
Views: 2261

Re: CHR, LACP, and VMware

If your license allows, do the bonding in ESX. If not, you'll need to dedicate NICs to your CHR instance and then follow these steps: Create a vSwitch per NIC, allow promiscuous mode for vSwitch. Add each dedicated NIC to the corresponding vSwitch as single uplink only. Create port groups on that vS...
by cdiedrich
Fri Jan 18, 2019 2:00 pm
Forum: General
Topic: Attempting to get a MikroTik Powerbox Pro to act as a pure switch for hundreds of VLANs [SOLVED]
Replies: 1
Views: 539

Re: Attempting to get a MikroTik Powerbox Pro to act as a pure switch for hundreds of VLANs [SOLVED]

This Manual article on bridge vlan table should basically clarify you'll need.to get started.
But AFAIR the PowerBox Pro's switch chip doesn't support vlan filtering in hardware. Should not be a problem if all ports are the same vlan-wise.
-Chris
by cdiedrich
Wed Jan 16, 2019 11:31 am
Forum: General
Topic: Large deployment suggestions for event
Replies: 13
Views: 1507

Re: Large deployment suggestions for event

I'd go for router redundancy. Configure both the same and use vrrp. 500/300 is way enough for 5k attendees, I totally second the proposal of using 4G just as failover. I do a lot of festivals (with attendee counts between 10000 and 120000) on a very regular basis and I can tell you from my experienc...
by cdiedrich
Tue Dec 18, 2018 6:24 pm
Forum: Beginner Basics
Topic: i have problem to make my range up to 1022 [SOLVED]
Replies: 3
Views: 635

Re: i have problem to make my range up to 1022 [SOLVED]

Looking at all your other posts on this forum you should basically have all info needed. First, adjust the subnet mask in your IP address: Change it from 192.168.88.1/24 to 192.168.88.1/22 - or whatever your subnet is. Then change your DHCP-Server network definition to the /22 subnet Then adjust the...
by cdiedrich
Thu Dec 13, 2018 4:43 pm
Forum: Beginner Basics
Topic: Mikrotik reserving some of my bandwith and I don't want that
Replies: 18
Views: 2087

Re: Mikrotik reserving some of my bandwith and I don't want that

Yup, just realized and edited my post :-)
by cdiedrich
Thu Dec 13, 2018 4:33 pm
Forum: Beginner Basics
Topic: Mikrotik reserving some of my bandwith and I don't want that
Replies: 18
Views: 2087

Re: Mikrotik reserving some of my bandwith and I don't want that

So let's calm down a bit. Even a CRS series device should be able to pass those 113MBit. First, update the firmware to the latest version (6.43.7 at the time of typing). Then factory-reset it again. This should enable fasttrack by default. After this, upgrade routerboard firmware in system -> router...
by cdiedrich
Thu Dec 13, 2018 4:10 pm
Forum: General
Topic: Performance impact L7 matcher
Replies: 1
Views: 424

Performance impact L7 matcher

All, I'm using a L7 matcher to implement a conditional forwarder as described in my post here . Now I need to add multiple domains and subnets. (about ten pairs) - Which could all be resolved by single remote DNS. Which attempt would be more CPU-friendly? One big L7 matcher (only applied to udp/53 o...
by cdiedrich
Thu Dec 13, 2018 3:56 pm
Forum: Beginner Basics
Topic: Mikrotik reserving some of my bandwith and I don't want that
Replies: 18
Views: 2087

Re: Mikrotik reserving some of my bandwith and I don't want that

I know that the mikrotik is reserving bandwith to use for other devices connected to it
Where do you have that "knowledge" from? It is wrong. Out of the box, no MikroTik router reserves any bandwidth for other usage.
-Chris
by cdiedrich
Thu Dec 13, 2018 7:52 am
Forum: General
Topic: rb4011 - default config has broken DHCP
Replies: 25
Views: 2686

Re: rb4011 - default config has broken DHCP

There's no bridge which would connect wireless to wired to dhcp.

Create a bridge, move ether2 ip address and dhcp server to the bridge
add ether2 and wireless to the bridge

You're done.
-Chris
by cdiedrich
Tue Dec 11, 2018 11:22 am
Forum: Beginner Basics
Topic: PPTP server can't ping windows clients only [SOLVED]
Replies: 4
Views: 615

Re: PPTP server can't ping windows clients only [SOLVED]

Yes, that's what I'm saying. I'm almost certain that your router's firewall is configured correctly. Windoze firewall only considers connected subnets as "local" and allows access from them. Try adding src-nat rules to your routers to verify this. Once verified, remove the src-nat rules and add appr...
by cdiedrich
Tue Dec 11, 2018 10:51 am
Forum: Beginner Basics
Topic: PPTP server can't ping windows clients only [SOLVED]
Replies: 4
Views: 615

Re: PPTP server can't ping windows clients only [SOLVED]

What am I misssing?
Windows Firewall.
It's blocking pings by default on client OS versions. Very annoying.
-Chris
by cdiedrich
Mon Dec 10, 2018 3:23 pm
Forum: Beginner Basics
Topic: Block RDP port on VLAN interface
Replies: 2
Views: 404

Re: Block RDP port on VLAN interface

When workstation and server are located in the same vlan, traffic will be processed by the switch(es) the two are connected to and won't even hit the router.
If it's really of that importance, move the server to a dedicated vlan.
-Chris
by cdiedrich
Mon Dec 10, 2018 3:18 pm
Forum: Beginner Basics
Topic: Failed connecting LAN device via wireless [SOLVED]
Replies: 2
Views: 524

Re: Failed connecting LAN device via wireless [SOLVED]

Use mode station-bridge for the client router.
If you're running CAPsMAN on the main router, then you should go for station-pseudobridge as CAPsMAN unfortunately doesn't support the MikroTik-proprietary bridge extensions.
-Chris
by cdiedrich
Thu Nov 29, 2018 3:38 pm
Forum: Beginner Basics
Topic: B/W transfer capacity in mikrotik router
Replies: 1
Views: 425

Re: B/W transfer capacity in mikrotik router

Click the "Test Results" tab on the poduct page.

-Chris
by cdiedrich
Fri Nov 23, 2018 5:14 pm
Forum: Forwarding Protocols
Topic: Redirect DNS to Local Server
Replies: 12
Views: 13216

Re: Redirect DNS to Local Server

That's a misinterpretation. It doesn't need at least 2k of data or 10 packets but it takes up to 2k of data or 10 packets. DNS requests are small enough to fit into these margins. Working great over here with about 10 satellite offices. For CPUs sake it's important to narrow L7 down to only the pack...
by cdiedrich
Fri Nov 23, 2018 12:31 pm
Forum: General
Topic: IP Routes with "DS" Flags?
Replies: 5
Views: 2108

Re: IP Routes with "DS" Flags?

AFAIR this only happens to routes received by a DHCP server, either the default route only or routes pushed in option 33 for addtional static routes - because they have been assigned dynamically but are static to the system until the lease is renewed. Routes received by forwarding protocols (RIP, OS...
by cdiedrich
Fri Nov 23, 2018 11:29 am
Forum: Forwarding Protocols
Topic: Redirect DNS to Local Server
Replies: 12
Views: 13216

Re: Redirect DNS to Local Server

Or use L7 filtering for a dodgy implementation of a conditional forwarder : /ip firewall layer7-protocol add name="my AD DNS" regexp="xyz.com|[0-9]+.100.168.192.in-addr.arpa" /ip firewall nat add action=dst-nat chain=dstnat comment="AD DNS" dst-port=53 layer7-protocol="my AD DNS" protocol=udp to-add...
by cdiedrich
Thu Nov 22, 2018 12:43 pm
Forum: Beginner Basics
Topic: Blocked router
Replies: 3
Views: 498

Re: Blocked router

If you have a console port, use this.
If you have an USB port, you might try a WOBM.
-Chris
by cdiedrich
Thu Nov 22, 2018 11:20 am
Forum: Wireless Networking
Topic: Devices does not see the wifi [SOLVED]
Replies: 12
Views: 1498

Re: Devices does not see the wifi [SOLVED]

This radio interface supports 5GHz only.
You could add a 2.4GHz card to it , this one will surely do well: https://mikrotik.com/product/R11e-2HPnD
Add two MMCX pigtails and antennas and you have a decent dual-band AP

-Chris
by cdiedrich
Thu Nov 22, 2018 10:54 am
Forum: Wireless Networking
Topic: Devices does not see the wifi [SOLVED]
Replies: 12
Views: 1498

Re: Devices does not see the wifi [SOLVED]

And here's your problem.
Your phone doesn't support 5GHz WiFi: http://en.miui.com/thread-623020-1-1.html
-Chris
by cdiedrich
Thu Nov 22, 2018 10:31 am
Forum: Wireless Networking
Topic: Devices does not see the wifi [SOLVED]
Replies: 12
Views: 1498

Re: Devices does not see the wifi [SOLVED]

As all other responders didn't realize you have a 5GHz model, I still stick with my theory that your gadgets support 2.4GHz only.

post the output of
/interface wireless monitor wlan1 once
and the datasheet of one of the affected gadgets.
-Chris
by cdiedrich
Thu Nov 22, 2018 10:27 am
Forum: General
Topic: RB2001UiAS-2HnD-in poor routing speed
Replies: 3
Views: 578

Re: RB2001UiAS-2HnD-in poor routing speed

Sabastia's answer is definitely the one with the highest probability to find what's causing this.
As a quick one you might consider enabling fasttrack at first and check if you might have enabled "use IP firewall" in bridge settings which is unnecessary in 99% of all SOHO use cases.

-Chris
by cdiedrich
Wed Nov 21, 2018 3:54 pm
Forum: Wireless Networking
Topic: Devices does not see the wifi [SOLVED]
Replies: 12
Views: 1498

Re: Devices does not see the wifi [SOLVED]

When you say gadgets, are you talking about some (cheaper) smart home devices?
Fewest of them support 5GHz WiFi and have 2.4GHz interfaces only.

-Chris
by cdiedrich
Thu Nov 08, 2018 10:35 am
Forum: Beginner Basics
Topic: I am still strugling with bonding and failover
Replies: 2
Views: 517

Re: I am still strugling with bonding and failover

I was facing the same problem a couple of months ago.
I finally ended up using VPLS and it's working like a charm.

This presentation is a very good point to start with.

-Chris
by cdiedrich
Mon Nov 05, 2018 2:05 pm
Forum: Scripting
Topic: Script works differently if scheduled.
Replies: 1
Views: 464

Re: Script works differently if scheduled.

AFAIR, the numbers only reference a previous print command - and are pretty rigid, though. Imagine adding new rules to your f/w or just rearranging them without updating your script.
I'd rather use comments and match those in your scripts...

-Chris
by cdiedrich
Tue Oct 30, 2018 4:37 pm
Forum: General
Topic: masquerade with protocol=icmp and to-ports
Replies: 4
Views: 1207

Re: masquerade with protocol=icmp and to-ports

Sorry - I guess I was a bit too quick :-)
by cdiedrich
Tue Oct 30, 2018 3:58 pm
Forum: General
Topic: masquerade with protocol=icmp and to-ports
Replies: 4
Views: 1207

Re: masquerade with protocol=icmp and to-ports

icmp doesn't use ports.
-Chris
by cdiedrich
Mon Oct 22, 2018 1:20 pm
Forum: Beginner Basics
Topic: in VRRP tow master router at same time
Replies: 1
Views: 421

Re: in VRRP tow master router at same time

Looks like your input firewall rules on the vrrp-carrying interface are blocking vrrp traffic.
-Chris
by cdiedrich
Thu Oct 18, 2018 4:37 pm
Forum: General
Topic: VPN S2S Azure - Slow to open files in shared folders
Replies: 2
Views: 381

Re: VPN S2S Azure - Slow to open files in shared folders

Get a different router.
The 951 is mipsbe and their IPsec performance is really bad.
Check a 750Gr3 or CCR series, they have hardware acceleration for IPsec.
-Chris
by cdiedrich
Thu Oct 18, 2018 3:37 pm
Forum: General
Topic: firewall rules for WAN interface - DHCP firewall rules without effect
Replies: 8
Views: 1923

Re: firewall rules for WAN interface - DHCP firewall rules without effect

Well, the firewall is L3, DHCP happens on L2 until the lease is ack'ed by the DHCP server. dhcp discover goes from your WAN-facing MACaddress to ff:ff:ff:ff:ff:ff, that's a L2 broadcast. dhcp offer is L2 unicast from DHCP-server's MAC to your WAN-facing MAC dhcp request is L2 unicast from your WAN-f...
by cdiedrich
Wed Oct 17, 2018 1:54 pm
Forum: Beginner Basics
Topic: Dt. Telekom VDSL BNG & IPTV (igmp v3)
Replies: 6
Views: 2336

Re: Dt. Telekom VDSL BNG & IPTV (igmp v3)

According to this manual entry SSM is supported.
by cdiedrich
Fri Oct 12, 2018 2:42 pm
Forum: General
Topic: New Neighbor discovery
Replies: 4
Views: 775

Re: New Neighbor discovery

I see. I'd say clients can discover all CPEs on all other Access Points but not on the AP they're connected to. Does this make sense? So you need to isolate the APs from each other as well. Either through routed networks per AP (i.e. one client subnet per access point, no NAT, just routing to your n...
by cdiedrich
Fri Oct 12, 2018 2:26 pm
Forum: General
Topic: New Neighbor discovery
Replies: 4
Views: 775

Re: New Neighbor discovery

Disable default-forward
-Chris
by cdiedrich
Fri Oct 12, 2018 2:16 pm
Forum: Beginner Basics
Topic: Move from dhcp to static by client
Replies: 2
Views: 507

Re: Move from dhcp to static by client

DHCP server indeed checks if the potential lease is already in use before leasing it out. It sends out an ARP query to check. So this abvioulsy works that the client machine in question is on at that time. There's only way to stop leasing this out other than Anumrak mentioned: Create a static lease ...
by cdiedrich
Thu Oct 11, 2018 2:56 pm
Forum: Beginner Basics
Topic: Cannot connect to router using winbox
Replies: 1
Views: 342

Re: Cannot connect to router using winbox

Did you specify a subnet mask // prefix length for the router's IP address?
When omitting those it'll take a /32 address.
Assuming your network is a /24 it should be
/ip address add interface=ether1 address=192.168.10.1/24
-Chris
by cdiedrich
Tue Oct 09, 2018 12:35 pm
Forum: Beginner Basics
Topic: Downstream slowdown due to config [SOLVED]
Replies: 3
Views: 733

Re: Downstream slowdown due to config [SOLVED]

First action to take would be enabling fasttrack. You could gather your cameras in an address list and aggregate your single forward drop rules for the cams to one with matching the address list. And finally, a 2011 will be too weak to reliably cope with a 1Gig link. Probably a 3011 or 4011 would do...
by cdiedrich
Tue Oct 09, 2018 10:40 am
Forum: Beginner Basics
Topic: 10G Switch model required
Replies: 1
Views: 542

Re: 10G Switch model required

As you posted in a MikroTik Forum, you won't get any recommendations for MikroTik Gear b/c there is no MikroTik switch model with more than 16 10G ports. Then, it depends on your definition of "high end configuration" and your budget. I just deployed a couple of fully populated Cisco Nexus 36180YC-R...
by cdiedrich
Mon Oct 08, 2018 3:31 pm
Forum: Beginner Basics
Topic: Not allowing one certain IP address to see the rest of the network
Replies: 14
Views: 1261

Re: Not allowing one certain IP address to see the rest of the network

Well, it was talked about L3 communication in the same subnet on the same L2 domain. Which technically makes it L2 communication. So link-local traffic (i.e. in the same subnet) will not hit the router L3-wise. And L2-wise only if the router is used as a bridge that has to be passed for this communi...
by cdiedrich
Mon Oct 08, 2018 2:31 pm
Forum: Beginner Basics
Topic: Not allowing one certain IP address to see the rest of the network
Replies: 14
Views: 1261

Re: Not allowing one certain IP address to see the rest of the network

It will. Beacause destination address won't be router's IP. It will be router's mac, but not IP. It won't. And the router's MAC is not in the game at all. This will only work if the laptop in question is connected to the router directly (w/o a switch in between) and if "Use IP firewall" is active u...
by cdiedrich
Fri Oct 05, 2018 3:46 pm
Forum: Forwarding Protocols
Topic: IPSEC and routing issue
Replies: 6
Views: 1042

Re: IPSEC and routing issue

Well, I'm far from being an IPsec expert, but I could imagine that it could be done with dedicated policies for the local address side.
I just had a brief look at the manual here but it might be worth a try.

Good luck,
-Chris
by cdiedrich
Mon Sep 17, 2018 2:55 pm
Forum: General
Topic: Stopping connections to TCP port 1720
Replies: 6
Views: 1617

Re: Stopping connections to TCP port 1720

Same counts for UPnP.
by cdiedrich
Mon Sep 17, 2018 2:45 pm
Forum: Beginner Basics
Topic: 4G/LTE SIM card
Replies: 2
Views: 666

Re: 4G/LTE SIM card

You would need USB for this.
The smartCard slot is for certificates only.
-Chris
by cdiedrich
Thu Aug 30, 2018 2:22 pm
Forum: Beginner Basics
Topic: L2tp error 789
Replies: 5
Views: 2344

Re: L2tp error 789

Try setting the iftetime of your IPsec proposal to 8h.
-Chris
by cdiedrich
Thu Aug 23, 2018 10:49 am
Forum: Forwarding Protocols
Topic: L2TP to remote office
Replies: 27
Views: 4678

Re: L2TP to remote office

In the office router I'm missing a route for the remote network.
Your default masq rule there is already good, you can delete the dedicated one for the remote network.
Your main office DNS config does not make sense.

Both exports are missing ppp profile and ppp secrets.

-Chris
by cdiedrich
Wed Aug 22, 2018 10:44 pm
Forum: Forwarding Protocols
Topic: L2TP to remote office
Replies: 27
Views: 4678

Re: L2TP to remote office

I'd say it'll be the best support for us to help when you post a compact export of both routers.
by cdiedrich
Wed Aug 22, 2018 3:28 pm
Forum: General
Topic: Block traffic same subnet VLAN
Replies: 35
Views: 2788

Re: Block traffic same subnet VLAN

@cdiedrich you've figured out you're that problem! ACL ( in cisco switch) are probably a good solution but I would prefer to centralize the firewall rules within the mikrotik to avoid duplicating the rules or having strange behaviors. Good to know that I am the problem ;-) As said - ACL on the swit...
by cdiedrich
Wed Aug 22, 2018 3:16 pm
Forum: Forwarding Protocols
Topic: L2TP to remote office
Replies: 27
Views: 4678

Re: L2TP to remote office

Makes sense now.
But I just read your first post again where you were talking about 192.168.1.0/24 and 192.168.0.0/24 networks.
Whichever networks you are currently running - make sure the remote network range is covered in your office router's srcnat rules.

-Chris
by cdiedrich
Wed Aug 22, 2018 2:47 pm
Forum: General
Topic: Block traffic same subnet VLAN
Replies: 35
Views: 2788

Re: Block traffic same subnet VLAN

That diagram makes it a bit clearer. So you are able to block traffic in all vlans from your access points to wired devices on the switches and vice versa, correct? All link-local (i.e. same subnet) traffic is handled by the switch itself. You just can't block traffic between two devices hooked up t...
by cdiedrich
Wed Aug 22, 2018 2:17 pm
Forum: Forwarding Protocols
Topic: L2TP to remote office
Replies: 27
Views: 4678

Re: L2TP to remote office

Look at the srcnat rules in your office router. It's probably configured to (srcnat | masquerade) the office address pool only.
and as a side note: 172.168.1.1 is not in the IANA private address space 172.16.0.0/12 which ends at 172.32.255.255

-Chris
by cdiedrich
Tue Aug 07, 2018 1:23 pm
Forum: General
Topic: Client MAC over the network with Hotspot
Replies: 1
Views: 347

Re: Client MAC over the network with Hotspot

Looks like you've set up your 951 as a router, not as a bridged IP.
-Chris
by cdiedrich
Thu Jul 12, 2018 2:52 pm
Forum: Wireless Networking
Topic: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]
Replies: 11
Views: 3440

Re: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]

## cap config /interface wireless cap set bridge=bridge1 caps-man-addresses=172.10.11.12 enabled=yes interfaces=wlan1,wlan2 /interface bridge add name=bridge1 /interface bridge port add bridge=bridge1 hw=no interface=ether1 add bridge=bridge1 interface=wlan1 add bridge=bridge1 interface=wlan2 ## ma...
by cdiedrich
Thu Jul 12, 2018 12:42 pm
Forum: Wireless Networking
Topic: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]
Replies: 11
Views: 3440

Re: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]

Yes, this can be done in datapath.
I jumped on the "do it manually per interface" train b/c you said that vlans differ from site to site for the same ssid... And this can only be done by hand ;-)

-Chris
by cdiedrich
Wed Jul 11, 2018 5:53 pm
Forum: Wireless Networking
Topic: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]
Replies: 11
Views: 3440

Re: CAPsMAN + local forwarding CAP + SSID/Vlan? [SOLVED]

/int bri po set (number) pvid=808
-Chris