MikroTik

msatter

ahummmm, field user does not exits in /users and so all users are iterated: Correctly using name : /user> :foreach r in=[find name=test] do={:put "test"} test Incorrectly using user : /user> :foreach r in=[find user=test] do={:put "test"} test test test test test If you want to r...

msatter

Thinking differently and avoiding so unwanted results: Preferred way to do this and I found this in an other topic https://forum.mikrotik.com/viewtopic.php?t=211390 : :foreach r in=[find name="test"] do={reset-counters $r; :put "Counters zeroed"} Older remarks: :local username &q...

msatter

Amm0 Otherwise, the would be no way to express "find everything". you can find all by using a Regex. /user> :put [find name~"."] *1;*2;*4;*6;*9 /user> :put [find] *1;*2;*4;*6;*9 So there was no need to have find only "find" selection being that powerful. It is a shortcu...

msatter

If someone is port scanning you then it's not really legitimate is it. You did not understand!!! When the VPS at IP address a.b.c.25 is scanning for ports and you block a.b.c.0/24 you also affect the legitimate webservice running at address a.b.c.86 that has nothing to do with the portscanning. You...

msatter

My experience with this is that you will soon block subnets from cloud VPS services that host both legitimate webservices and "researchers" (or hackers) that use the VPS to scan for open ports. So your rules will surely block /24 networks but after shorter or longer time you will get comp...

msatter

This is very easy with scripts. Add the visiting IP to a collections list. set a time-out on those detected IP for lets say 15 minutes on the list. Then an other script goes regularly trough the list and takes the first IP in the list. Then it counts how many that IP converted to .0/24 is found in t...

msatter

Hammer...shovel, excellent tools to swat those pesky bugs!

msatter

Looks nice but slow switching between views because of the tabs being gone. Maybe enable switching, between tabs or pull-down.

msatter

Active where?

msatter

Maybe because he is let in the dark about that it was acknowledged and not ignored.

msatter

This one will look at any sync packets (three for each connection) and adapt automatically to the length the other side can handle. Looking only at packets larger than 1380 bytes. add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes packet-size=!0-1380 protocol=tcp tcp-flags=syn...

msatter

To me Mikrotik would no react on a request from blogpost writer.

Mikrotik writes:

We promise you that:

Your notification will be reviewed and if the problem will be discovered, you will be notified within 48 hours with acknowledgement of the issue

msatter

OVH has wrote a blog item on an attack done by Corerouters made by Mikrotik and you can read the article here: https://blog.ovhcloud.com/the-rise-of-packet-rate-attacks-when-core-routers-turn-evil/ Excerpt from the blog item. We have been surprised to discover devices with a recent firmware being po...

msatter

Had to revert to 16.2 due to WireGard not starting. It looked like Current Endpoint could not retrieve static DNS entries. Looking in the cache table the IP was present for the static DNS entry.

msatter

To me it is strange to see portnumbers in the DNS line.

msatter

:global FirewallNatAction do={
:global actionValue;
:set actionValue $actionValue;
:put $actionValue
:execute "/ip firewall nat $actionValue [find comment~\"hack_dns\"]" as-string
}
$FirewallNatAction actionValue=enable

msatter

Ray Bradbury:
Life is trying things to see if they work.

Then, what if nothing succeeds? Do you then know the meaning is of life!? ;)

Thanks Optio.

msatter

Then we return the question of what the meaning of life is?

msatter

My take on this and this is not tested: :global DNSstatus do={ /ip firewall nat $1 [find where comment~"hack_dns"]; } :global Pong do={ :if ($1 = "up") do={ :global DNSstatus enable :log info "DNS status: $1" :return } :if ($1 = "down") do={ :global DNSstatus ...

msatter

Then an other question is, what is the meaning of life?

msatter

@jaclaz: in the meantime we can read files in chunks of 32K and store it in a array. https://forum.mikrotik.com/viewtopic.php?p=1067023#p1067081 I have seen it, but it seems to me that it only moves the limit from 4096 to 32768 (for "simple" commands), or you need the (more complex) "...

msatter

@jaclaz: in the meantime we can read files in chunks of 32K and store it in a array.

viewtopic.php?p=1067023#p1067081

msatter

There are other ways but in the end it can't be sped-up. The address-list uses hashes and when adding it seems the hash is handed to routine in the background that is very fast and it return success of fail and when success it is added. When targeting one specific IP to change something it needs a l...

msatter

Count posts back from yours. Like...one...two and then click the link.

Good luck with that.

msatter

The 4011iGS RM is without WiFi: https://mikrotik.com/product/rb4011igs_rm I have a 4011 and no need to get me a 5009. Having plus 900MB of free memory but not using containers. Got a RaspberryPI for things like that. Update: looked at the L009 RM and that is half the price of a 4011RM and have that ...

msatter

4011 can do containers: https://help.mikrotik.com/docs/display/ ... chitecture

@jaclaz it is ex-WAF here ;-)

msatter

Did made also a ticket with support or did you just put it up here? ;-)

msatter

I have made an other update to the import now being aware of any static entries added by user to the active list. Those will be saved and a count of them being displayed on import. It was not "dirt" but more streamlining the text to be more informative to an user. You are not using the [] ...

msatter

@MTNick optimized logging, and also the displayed text when running in terminal. Updated: shortend the time a list is unavailable on import by generating a temporary list and then after remove of the old one replacing it with temporary one containing the updated list. Advantage is that the old list ...

msatter

@MTNick that is correct, because of the heirule=http. Only importing lines containing "http" in the word(s) after each line.

If you want to import all, then omit the heirule. This way you can create different address-lists from the same source file.

msatter

:global ipaddress [/queue simple get 1 target];
:global test [:global ipaddress; :find $ipaddress "/"];

Inside the function, ipaddress is not known so you have refer to it by :global ipaddress.

msatter

It can be done with additional data buffer variable which holds bytes from previevious chunk which are left after last new line character, new data chunk needs to be apended on that data buffer, parsed by lines and matching by regex (single, since in script two are used on same line, regex is expen...

msatter

@MTNick from the spamhaus topic you need the delimiter=("\_") If you have the link for me then I could have a look at it? Greetings msatter. I have tried that delimiter, several of them, including not listing one. Neither work. Below are the spamhaus links: $update url="https://' . &...

msatter

@optio you really need to cut the chunks because you don't know if you get chunk-cuts in the middle of the IP address. So I re-introduced the cut-back of 512 bytes and early ends of 256 bytes in $data. To read the complete list I have added that the last chunk does not end early, when 256 bytes are ...

msatter

Sorry for still having the src-address-10.10.10.10 in the code, I thought I had removed it. It was more a proof-of-concept than actual production code.

Removing the file after download should be optional and the file could then be reused on reboot, even before the connection comes up.

msatter

Not chunking the download anymore, instead read and chunking the local file after downloaded first: viewtopic.php?p=1067023#p1067023

msatter

And reading to file and import from file: # Turris Import by Blacklister # 20210823 new version that directly downloads from the external server # 20240331 rewritten to fetch the whole file and write it to a local file and then import it { # import config - delay for slow routers #:delay 1m /ip fire...

msatter

Hi Here, I worked on two scripts, where I copied rextended's script (please don't hate me for this). The logic is: 1 fetch the file in X file splits, 2 imports one by one and then deletes them all. The problem is that the first script blocks the entire execution of the second script because it give...

msatter

# :put [:len ([/tool fetch url="https://public-dns.info/nameservers-all.txt" http-header-field="Range: bytes=0-1, a ccept-encoding:" output=user as-value]->"data")] 2 # :put [:len ([/tool fetch url="https://public-dns.info/nameservers-all.txt" http-header-fie...

msatter

@optio I indeed missed the -c Then in the end. I now think that it the webserver does not send the number of bytes request because it might not be supporting chunking and so sent all data in one go. Because the data variable only can fit 64512 bytes is that what you get returned by RouterOS. The res...

msatter

Read it like this: put [:len ...... ->"data")] Curl wc is word count not bytes. Update: ran the line in Terminal and RouterOS always read 64512 bytes and only the first number of 0-1 is used. "downloaded=63;duration=00:00:01;status=finished" and 63 * 1024 = 64512 bytes RouterOS i...

msatter

@optio nothing wrong there, Data is a variable and so 64512 bytes is the max.

I did not succeed in reading chunks from files so I am doing other things in the meantime till it get fixed......some day.

msatter

@Amm0 Read the file in chunks, put each chunk into an array. Then filter the array to obtain higer processing speed. Mikrotik can make that work in the background so that the load is not too high. You have to wait then before the complete list is read in. Now it cuts each line into two parts and dom...

msatter

@Amm0, default support for big files read from storage. RegEX is indeed all being used to recognize different types of entries and extract only what is needed. That it should be 0.0.0.0 "or NXD" is a parameter that could be separated from what is set in the file. Example of a domainPosix: ...

msatter

You are not the first one: viewtopic.php?t=98804 and then the setup did not gain enough support to be continued.

msatter

If decode is remote then decoding needs external access. That needs that the connection to be up.

msatter

Also new feature - IP/DNS/Adlist: https://help.mikrotik.com/docs/display/ROS/DNS#DNS-Adlist Why is it called "Adlist" when in fact it is a method to add a hosts(.txt) file? Sure that is a trick that some people use to block access to certain domain names, but that is not the primary purpo...

msatter

@anis You and sindy are the only ones active here so please, don't qoute so much.

msatter

If the allow list is smaller than the block list, then allow followed by a general block entry. This has nothing with what I am saying. CIDRs are changed any month and the real trustee here is only RIPE. OK, more simple then. Which list would be larger? Three countries or all countries minus three ...

msatter

If the allow list is smaller than the block list, then allow followed by a general block entry.

msatter

Multiple outgoing connections have different SRC-ports so that will divide the streams. For bandwith tests it will work, real life is a different story. VPN loves multiple connections because ROS can spread the load over more cores of the CPU. So if you have 4 cores and 2 connections then you could ...

msatter

You can create a chain with his name. TS created a chain with the name "forward" in RAW.

msatter

{
:if ([:len [/file find name=1.txt ]] > 0) do={
:local q [/file get "1" contents]
} else={
/file print file=1
:delay 2
:local q 0
}
:log warning [$q] ;
}

msatter

They use dynamic URL so there is no way to filter that. Also you are here wrong asking for such option because that could 'only' be done in a browser.

msatter

Did you use eth1 to optimise bandwith from the CPU?

msatter

So you have 3 times one Gbps speed and it is divided as 1/3 and 2/3. Then you should only connection-mark one third (0/3) of the total traffic and not touch the 2/3 traffic by using PCC. You are so only marking the traffic going through the 1 Gbps connection and all unmarked traffic should then be r...

msatter

Quoting shoold to be used limited, especially when you are first responder to that specific post. Then even do not qoute and just reply directly.

msatter

You have to put extra lines between the code parts so they are displayed separate.

msatter

Is there a hell for labelprinters?

msatter

This AM i upgraded my CCR1009 from version 7.12.1 to version 7.13 now getting the following error when running a script Download from https://view.sentinel.turris.cz/greylist-data/greylist-latest.csv to RAM FAILED: Fetch failed with status 206 The same script was working fine under 7.12.1 and earli...

msatter

When using PMTU you only want look at the returning packets and outgoing are not of interest. So I filter on the interface. Using an interface list settable in the second tab of interfaces. ;;; WireGuard PMTU in chain=forward action=change-mss new-mss=clamp-to-pmtu passthrough=yes tcp-flags=syn prot...

msatter

(^|\\.)mikrotik\\.(com|local)$

Mikrotik alone is not a domain but a hostname, also seen in the hosts file

msatter

I don't think that is possible as the terminal in Winbox only connects to localhost.

msatter

You have to understand that WG is a tunnel and so everything is double.

One set for the tunnel and one for the traffic inside that tunnel.

If you read UDP in the explaination then it describes the tunnel.

msatter

https://help.mikrotik.com/docs/display/ROS/Device-mode

msatter

The last line should be one of the first. Mikrotik brought this on themselves and the customer is scratching his/her head.

msatter

Please write in English. English the required language on this forum.

msatter

I just check if the canary domain is inactive but it it is still there and giving a NXDOMAIN as resolve. So Firefox is clearly not obeying it anymore because they have their head somewhere else all the time. dig use-application-dns.net ; <<>> DiG 9.16.12 <<>> use-application-dns.net ;; global option...

msatter

Or just block based on IP or IP address ranges. Just like always because for years we knew this was coming. The problem is that you cannot block services that run on large CDN or other server farms like Google's in that way. When you even can find all addresses used by Youtube, you may find that th...

msatter

Sorry Normis, I don't want to spy on myself and I don't want to be spied on by others. So DOH is in a internal network a curse and I wrote many times before that DOH is made for war time or for regimes that don't give a sh.. about the rights of their citizen. I seem to live also under that kind of r...

msatter

Till the next itteration where they switch it on again. Better use a third party to be sure that I am still the boss on my own devices.

msatter

Or just block based on IP or IP address ranges. Just like always because for years we knew this was coming. You can also block the IP addresses of the DOH servers like I did today when Firefox always want to inform dooh.cloudflare.com that I just started the browser. And yes, I disable DOH in Firefo...

msatter

Works fine here: :put [ /ip address get [/ip address find interface="ether2" ] address ]

Using: MikroTik RouterOS 7.12beta1

msatter

Mangle, PCC and fastracking works fine as long you work cleanly. Fastracking in Firewall comes after Mangle, so Mangle has more influence. BTW you can also mark tot fastrack traffic in Mangle. Remember that once marked fasttracked some traffic will go the slow way to allow checks and changes. Second...

msatter

The problem is not the variable but that fetch retrieves up 64KB and then you have to use chunking if you want more data.

msatter

Are those not dynamic data and generated on the each connect?

msatter

@amm0 do you remember my implementation of this. I added a help/info line that was displayed underneath and the next input field was shifted down and displayed directly under that help/info.

So if you want to use pre-input as help/info then better ask for that extra line being displayed.

msatter

My version: { :local strstart ";find;" :local data [:tostr {"id":"12345678","hostname":"find","type":"A","priority":"0","destination":"55.77.233.244","deleterecord":false,"sta...

msatter

First you find the location of "find" in and then take that position and find again from the beginning the last "ID before that position.

Use :pick to find the location.

msatter

Wrong approach. Look in this forum for how NordVPN data is extracted from a json record.

Update: link to topic
viewtopic.php?p=900540&hilit=nordvpn+json#p900540

msatter

starter: viewtopic.php?p=1001943#p1001943

msatter

It seems popular to attack the person that complains instead of taking it serious....... So you're telling us that you listen and help in the same way, with the same joy and same will a person who comes to you saying "Msatter, you SUCK" and another one saying "Msatter. I have a probl...

msatter

It seems popular to attack the person that complains instead of taking it serious.......

We have here persons that work indirect for the government that act the same and attack and supress opinions from citizen. I get the same feeling here, as with that.

msatter

I think it retrieves the host from active hostnames in leases of the DHCP server by matching the MAC.

msatter

You are writing that think the PCC are taking to much CPU in v7 wiithout any showing us your PCC lines?

It is then difficult to tell you what can be improved.

msatter

viewtopic.php?p=882429#p882429

posting.php?mode=quote&p=882867

msatter

In RouterOS there is no routing cache anymore. That might have a impact in a high load setting.

msatter

If you want to be specific where and what to sniff then better use sniffer in Mangle. When pinging from local through to WireGuard then that traffic passes the sniffed Output twice. Once exiting as ping out and then as being encrypted, and not recognizable as ping anymore. /ip firewall mangle add ac...

msatter

I know GoodWe very well and the WiFi module is not great. Instead of restarting the inverter or push the button on the stick I restart the cAP Lite that I use only for the inverter. And the network cable goes to a switch (POE). I read the the status of the inverter through Node Red and if no respons...

msatter

viewtopic.php?p=1024866&hilit=died#p1024866

msatter

Nice scipt Amm0 and it is two to three times faster than the others. I took the liberty to make the loop even faster and only print the times in only nanoseconds. { :local getconncounts do={ :local startConns [:timestamp] :local connsnapshot [/ip firewall connection print proplist=protocol as-value]...

msatter

And a special one, but here I don't see an improvement in speed but maybe with a huge table it will work faster: { :global udpCount; :global tcpCount; :global icmpCount /ip firewall connection :set $udpCount 0; :set $tcpCount 0; :set $icmpCount 0 :local start [:tonsec [:timestamp]] :foreach k,line i...

msatter

Updated my earlier posting and let me know if that way is faster?

msatter

total - just counted (tcp/udp/icmp) = other connection type. Saves you one complex line (fourth one) And the script: { :local icmpCount [/ip firewall connection print count-only where protocol="icmp"] :local tcpCount [/ip firewall connection print count-only where protocol="tcp"]...

msatter

Those are reverse domains (PTR) and looking at the IP address they arealso local 192.168.x.x

msatter

regex101.com and have a try.

https://regex101.com/r/QPWjwE/1

msatter

Why use IKEv2while there is Wireguard on ROSv7!?

https://nordvpn.com/blog/nordlynx-protocol-wireguard/

viewtopic.php?t=183525

msatter

The concept is great! But there is an error in the post (probably resulting from cut-paste) is that the second example still has PCC lines 2 to 4. so the correct rules would be (assumes that all packets start as not conn-marked): PCC 4/0 ===> connection mark gateway-25 if not marked ==> connection ...

msatter

I see often PCC being defined for every part that should be separated. I see the following lines for example 25% for one gateway and 75% for the second gateway. Then I see these kind of PCC rules: PCC line 1: pcc 4/0 ==> connection mark gateway-25 if not already connection marked PCC line 2: pcc 4/1...

msatter

Yeah, but then it is still at the top of the checklist when working with SFP equipment in Mikrotik devices.

msatter

...nothing changed. This is the FIRST thing to try when a (x)SFP's is not coming up in a Mikrotik.

I recommended in the past, to disable auto negotiation by default.

msatter

Thank for digging up this gem.

msatter

Let me leave this here. PCC 33%/66% connection distribution add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=bridge connection-state=new dst-address-type=!local new-connection-mark=Link-300-conn passthrough=yes per-connection-classifier=src-address:3/0 add action=mark...

msatter

And then, you are on a Beta version. Thing get broken all the time by developers so that not weird at all.

Report it support and they will try to fix that...and try also to not break someting else doing that. ;-)

msatter

Use the power of the TAB.......

:local sysver [/system package get routeros version];

msatter

Miktotik seems to have a special "Testing department" for this and they update the lists on a regular basis as you can see in the Docs history: https://help.mikrotik.com/docs/pages/viewpreviousversions.action?pageId=13500447 Sadly the SFP sections are not recently being tested or updated. ...

msatter

Because it bypasses those, as Mikrotik programmed it. Hoping that the port opened is statefull.

Port 5678/UDP is also the Neighbours port to see other Mikrotik routers.

msatter

Have a read overhere: viewtopic.php?t=198614

msatter

IPv4 FastTrack is active if the following conditions are met: no mesh, metarouter interface configuration; sniffer, torch, and traffic generator are not running; "/tool mac-scan" is not actively used; "/tool ip-scan" is not actively used; FastPath and Route cache is enabled under...

msatter

All variables are :local and as soon the script has ende those are destroyed. To make those :global replace :local with :global. The {} allows in terminal to run it as one script. Otherwise every line intepreted on it's own and all variables are destroyed after pressing Enter.....unless you use :glo...

msatter

Indeed, follow-strict does not add any thing different than print already do. It might be interesting to replace it with a option to limited the number of lines shown, beginning from last. follow-last=10 -> shows the last ten lines (.id) from the otherwise printed text. See here for an example for /...

msatter

Delock has nice adapters and 10" frames and cabinets.

https://www.delock.com/produkt/66898/merkmale.html

These are also nice:

https://www.delock.com/produkt/87677/merkmale.html

msatter

Follow should be there to rever to the other two, and strict could be interpreted as fixed, not changing.

I can't think of an other name that would be better in combination with follow.

follow-till-now follow-fixed follow-prev follow-past follow-....

msatter

It distributs connections and how much traffic is going to flow over a connection is not known in advance.

https://m.youtube.com/watch?t=200&v=nlb ... e=youtu.be

msatter

Just by trying:

follow       -> tail -f
follow-only  -> tail --lines 0 -f
follow-strict -> tail

msatter

By the way, uptime is the time the router has been powered on. When you power-off the router, then even if you could store the global, it will be erased on reboot.

msatter

Nope.

msatter

If you want to conrtol all DNS entries then use Static DNS and disable the way to a upstream DNS server.

Stopping DOH used by a client. You can only stop that, if you know the IP address of the DOH server(s) that is being used.

msatter

That all was already exchanged. Connection tracking has no power in this.Firewall it, but how when all are behind a NAT. You might then block on scr-port. Best is session control and on change on user check every active connection if it still has the rights to be connected. So it does not have to be...

msatter

Shows you your problems: { :local t [/system clock get time] :put "time: $t" :local logskeep 31536000000 :foreach f in=[/file find] do={ :local fileTime [/file get $f creation-time] :put "filetime: $fileTime" :if (($t - $fileTime) > $logskeep) do={ #/file remove $f } } } Shows ti...

msatter

If your using a script that runs quickly to do port knock, then the timeout don't have to be so long (e.g. 30s). If you lowered that you'd reduce the window. But there is no "remove from address-list" firewall action, so you're up against that. And there is no action=script in firewall ei...

msatter

In the build it's :tonsec NOT ":tosec", but seems to work:
Code: Select all
:put [:tonsec [:timestamp]]                           
1692285621621

Why they did not name it just :toepoch then if it is sec or nsec would be covered.

msatter

I remembered this from the Wiki / manual:

GlobalWarning.JPG

msatter

@mada3k Thanks and that is something for Mikrotik to adapt in ROS. If returned value == 255 then SFP does not have a temperature sensor. At least Mirkrotik thought of able setting the trigger value to 256 so that you can overwrite the warning. Devices with a fan still get the value 255 C and try to ...

msatter

I can vow that atleast I have no prior knowledgement of any programing models. ;-) Just adapting on my way.

msatter

If you don't have fans in your device you don't hear them running on MAX speed.

msatter

Perhaps when you hit a use cases like that it’s time boot up a linux based NOS: highly introspectable, debuggable and with an arsenal of mature programming languages. You're asking too much, for the most part we don't need this and if we did, having event driven scripts would allow us to also do th...

msatter

having event driven scripts would allow us to also do this. It's for sure flexible, but raises a lot of question. E.g. given a series of related events, what is the proper order? If your action on an event leads to it being re-triggered, then what? If you have multiple actions on an event, how to d...

msatter

For instance, I want to know if a port drops from 1000 to 100. I can poll though through a script routinely, but it would by much nicer to just have that logged change trigger a script. ie, this is something that happened to a port, and it was a speed change. make a script subscribed to 'ethernet p...

msatter

@Amm0 I am open to any suggestions and that also forced me to look deeper in the CLI and then saw an example that I did not understand before for a long time. Am I the first one that discovered the potential of this bit of code that MT just left there to be discovered? To me, MQTT is only polling an...

msatter

A lot of users wish to do something, when a rule is hit in the firewall. That is now possible because you can log it. If you can log it then you can create an event trigger for that. Create a rule and activate logging on the rule and set log-prefix to lets say "IamHit". The you scan the lo...

msatter

You can now write any event catcher you want. You can use the path directly if available, the log or history. Maybe even more and I think MT is even using this themselves, in the background. This still very granular and no event timestamps control avaiable and no .id to know which setting has exactl...

msatter

The execute is there to wrap the print and code. You can't press CTRL-C when it is still following and running in a script. I moved the termination of execute to the top, so that any new start, will first terminate any existing same running event script. Now you can set in scheduler that the event s...

msatter

And watching the log and being able to script on a change: # activate reading the .id from global :global eventPathLogTopicContainer # remove previous running event scripts (:execute) :do { /system script job remove $eventPathLogTopicContainer } on-error={:log error "Script .id eventPathLogTopi...

msatter

So after read and lot of testing I can disconnect a user locally at the moment the change is made in /user. Because the change is made in /user the script is watching that and not /user/active: # activate reading the .id from global :global eventPathUser; # remove previous running event scripts (:ex...

msatter

I liked the implementation idea by pe1chl, it's llike doing a tail -f on the log. Agree. And, "tail -f" == "print follow" ... but there is no pipe | in RouterOS... So, print supporting a "do=" go a long way, IMO... /log print follow do={ :put "$.dead $.id $.nextid...

msatter

@Amm0: I don't know how Mirkrotik has implemented follow on print, and that could be an testing environment before taking the big leap before going system wide. Then you could create a script that is executed when the same has is added to the pint command line featuring following an extra parameter ...

msatter

I did not want to fall back on existing routines because that will complicated things. If you want to have existing routines trigger scripts then a extra unique number has to be present that for example logging from a firewall rule. This already beyond the current proposal I made. I want to keep is ...

msatter

@pe1chl This will show all topics you started and with this it would be easy to check I don't understand what I would need to check and what you are trying to solve. This shows how important it is to always quote the (part of) the article you are replying to. My reply to you was posting #116 and yo...

msatter

Only in the Beta period I would post over there, however since a while I see v7 as current and v6 as legacy. When I post about v6 then I put that in the posting while, before that I put that I was using v7 in my posting. I have still some devices on v6. The closing of active topics is not nice but y...

msatter

@pe1chl This will show all topics you started and with this it would be easy to check: https://forum.mikrotik.com/search.php?keywords=&terms=all&author=pe1chl&sc=1&sf=firstpost&sr=topics&sk=t&sd=d&st=0&ch=300&t=0&submit=Search Replace pe1chl by strods or n...

msatter

While working with scripting in ROS we have to revert to scheduler have a script being executed in a interval or on startup. This leaves time before a script can detect a change and make the its own changes in the setting or give a warning to the user. My proposal is to give each path/option a uniqu...

msatter

I found it very disturbing that this tread was closed while I was still very active with this, even while the problem did not effect me directly. Mikrotik could activate short time, the options to logout removed users/disabled users automaticly. First in local and other services. An other thing is s...

msatter

There is someting like I think I found a bug and like to know if any others have the same expierence on that. Sometimes I was just "holding it wrong" and got info to solve my "bug". The forum is a good filter for bugs, before escalating to actual reporting it as a confirmed bug t...

msatter

Some script lines to logout non-existing/deactivated users and sessions that are left open for a long time. This now apply to only local sessions (terminal). Disconnect users that are are removed as user: :foreach item in=[/user/active find] do={:if ([/user find name=[/user/active get $item]->"...

msatter

@Amm0, thank for finding that and it indeed closes the terminal (CLI) in the Winbox of the user that does not exits anymore. Disabled user is an other possible option. This is can select the correct user to be booted from the terminal. Winbox seems to cache stuff and with that it can reconnect. :for...

msatter

Special policy "license to kill".....the connection and not the user overcourse.

msatter

I wrote a small script that detect logged in users that do not exist in /users: ::foreach item in=[/user/active find] do={:if ([/user find name=[/user/active get $item]->"name"]) do={} else={:put "Warning: found a removed user(s) being still be logged in: $[:tostr [/user/active get $i...

msatter

You should give pe1chl the credits for giving you tips on the fasttrack rule.

msatter

@Amm0 that is a good point and who is answering on the other side, the server/client or the router. When the router answers then on behalve then the VPN connection is
not used.

@all
Run the MTU adjuster on the returning traffic and check that the ICMP can also reach the client on the inside.

msatter

You missed the first question and the second one. I already stated why I think it's a MTU problem.

But you are free to request support from Mikrotik themselves by mailing them on support@mikrotik.com

msatter

You state re-transmissions then the question is your network sending out the request, or the other side because it did not got an acknowledgement from you? Secondly did you see any traffic hitting the MTU rule I gave? With this one you don't need to state a wished MTU and it will adapt to the MTU si...

msatter

When TCP connections are taking long or even not complete then think of MTU problems. For that I have the following rule in Mange: add action=change-mss chain=forward comment="WireGuard & IKEv2 Sync" in-interface-list=PMTU-IN log-prefix=MSS new-mss=clamp-to-pmtu \ passthrough=yes proto...

msatter

Doing this for years now, the list is contains now almost 2200 /24 ranges collected since September 2021.

Underneath the log when a range is placed on the block list when reaching the set limit which is set to three.

PermBlock.JPG

The last address ranges added to the block list:

PermBlock2.JPG

msatter

Yes. Yours and submit a support request with Mikrotk.

viewtopic.php?p=1008211#p1008211

msatter

I have to admit to see all those postings was funny, while I already posted here the script for that, years ago.

But then, I would out of place to post a direct link.

msatter

The tunnel is one and the connection is two.

msatter

25 Seconds is the same as the advised keep-alive for WireGuard.

msatter

msatter

I assume the wrong interface is the first WAN. Traffic answered on behalf by the router is related. In a earlier topic it was just dropped or set to TTL:0

viewtopic.php?p=1010043

msatter

Example: I hire a expert to setup my router. That person needs access on admin level and that person could gain "super-admin" level and makes changes that are not logged and normally not allowed. When the temp. account is deleted the changes stay in place. My impression from what I read he...

msatter

Ok. ;-)

msatter

Thanks. :-)

msatter

RegEx is a mask that is moving over an "text" and can be hooked to the end of the beginning but not on a specific point in a "text".

A dot is a single position so ^..... ....v1 (55 dots in total) provides you the location of the 56 position. Or if supported ^.{56}v1

msatter

... it isn't clear if that CVE-2023-30799 was only addressed in 6.49.7 onwards, or also in 6.48.7 LTS which was released at a later date - there is nothing in the release notes. No, post #22 above probably sums up the status completely (not mentioning 6.4 8 .7 does mean something). But since 6.49.8...

msatter

All for the views. ;-)

msatter

As stated in the CVE - "MikroTik RouterOS stable before 6.49.7...". Yes, 6.49.8 is built on 6.49.7. Thus it includes the same fix.

I visited a lonely page that feels completely neglected by Mikrotik: https://blog.mikrotik.com/security/ also supplies RSS feed for Mikrotik.

msatter

@mike548141 It is even simpler:

@> /system/hardware print
bad command name hardware (line 1 column 9)
@> /system/hardware/print 
syntax error (line 1 column 17)

Try

 /system/routerboard print

msatter

Looks like lighting and Mikrotik have a product for that protects: https://mikrotik.com/product/rbgesp GESP is Gigabit Ethernet Surge Protector that can be used to protect the network from lightning or surge damages. Here’s what a typical use-case would be like. You have a mast with some antennas. A...

msatter

@mike548141 When you have commands that could not work on every device then you can avoid errors by using do {} on-error={} :do { /system/hardware } on-error={ :error "error: script not executable on this device " } :do { /system/hardware } on-error={ :log "error: script X not executa...

msatter

This assumption by me was wrong. The value is treated as a boolean and then 0 = false and any other number is true.

msatter

@own3r1138

When completely manual then there should still be a sanity check applied and also any DNS stated checked, that the returned IP is matching any of the local addresses of that router.

msatter

nil is a bit more complex, when I thought about it later: > :local a false; :put [:typeof $a] bool > :local a ; :put [:typeof $a] nothing > :local a nil ; :put [:typeof $a] str > :local a [:toip 192.168.88.999]; :put [:typeof $a] nil > :local a [:toip 192.168.88.1]; :put [:typeof $a] ip So to me &qu...

msatter

Thinking out of the box here. When the board is not matching the case then you have this problem. Did you check if the replied MAC is still as the one on the box, after a reset?

msatter

/file/remove [find name~"flash/\\.xyz\$"]

Update: thanks Amm0 and I removed the first "/" and added a \ before $.

msatter

Well done, Although It would be awesome if Mikrotik could implant the WG Wizard in the main Wireguard section so one could use it for peer config generation like what we have now in OVPN. Then WG needs more enties to do that. The external IP-address/domain and the allowed address range to be able t...

msatter

Some scripting tips (v6/v7): :toip6 returns a valid IP address and if not valid it returns "nil" which is an :if compare the same as "false/invalid", first a direct usage and the second one is a indirect usage. FROM: if ([:typeof $address] = "nil") do={ :error "\&q...

msatter

Hi not my 'friend', From the manual: Value of none-dynamic (00:00:00) will leave the address in the address list till reboot Value of none-static will leave the address in the address list forever and will be included in configuration export/backup https://help.mikrotik.com/docs/display/ROS/Filter#F...

msatter

What did I just read!?

msatter

@4lphanumeric five is indeed just a number abd I could have chosen two or any number higher. It just allows to block a specific up to five times before starting again as long the dst/src address is on the list syncreset. All traffic goes througha VPN so my ISP only sees the outside off a tunnel and ...

msatter

Think about it you sitting, and waiting for the correct bus. one, is take the first bus and if you not get on that bus you have to wait again for bus six or then eleven.... two, get on the second bus and if you don't catch that one, take bus seven or even twelve.... It is not timing out, you hide (d...

msatter

This is the sample function for adding to an address-list in filter/mangle/raw rules: :global ruleAddresToList do={ /ip firewall address-list add list=$listName address=$Address timeout=$Timeout } This is then the call to the function with the name "ruleAddresToLIst" from a rule to add and...

msatter

The first reset will be matched and and dropped in a period of 5 seconds. The next four will be accepted or accepted because the address-list entry has timed out. By adding more nth you can filter more reset replies. Underneath the first two reset replies are dropped within 5 seconds. /ip firewall r...

msatter

Thanks for the disclaimer. ;-)

Try with line 8 in NAT disabled.

msatter

https://mikrotik.com/products/group/60-ghz-products

Newsletter: https://www.mt.lv/news104 about 60GHz and the second device is multipoint.

msatter

Second request on bigger variables. Using fetch I can write a bigger file to disk in one go. But then I can't read those back when the file is bigger than 4KB, despite the variable in not a limiting factor anymore in ROS. This could be first one, so the request above for direct download in variable ...

msatter

Now the 4096 byte limit on variables is lifted and variables are now limited by the amount of available memory. https://help.mikrotik.com/docs/pages/diffpagesbyversion.action?pageId=47579229&selectedPageVersions=29&selectedPageVersions=28 :too fetch is still limited to 64512 bytes when using...

msatter

Press TAB for options or F1 for help: @ > [:terminal/ .. -- go up to root cuu -- move cursor up el -- erase line inkey -- read key style -- set output text style Small menu example with active help and (audio) feedback on error: { :local readKeyString do={ # written by msatter 2020-2021 # keyFlag sh...

msatter

If you look at the input screen as a CRT TV then you can redrawn the page with the lines and entered data once on confirmed line, or even every key. Then you can correct previous entered data by using the cursor buttons by using the [:te cuu] for example to go up after redrawn page. The page with li...

msatter

Example script of reading a file from a webserver directly into a variable and generate a address-list from it. # Turris Import by Blacklister # 20210823 new version that directly download from a http(s) server # 20230712 new variable length allows to read big files in one go { /ip firewall address-...

msatter

I was browsing through help.mikrotik and noticed the removal of the notice in scripting about limit for variables in RouterOS. https://help.mikrotik.com/docs/pages/viewpreviousversions.action?pageId=47579229 v. 29 Apr 04, 2023 16:13 Testing Department Remove deprecated note on variable size limit. N...

msatter

They are warnings and not error.

msatter

Then show that to us. Don't sit on it.....share.

msatter

No you not doing anything wrong. It is protecting you from locking yourself out of the router. You first have to create or have a second user with full access, and as you have already done. Then set the Admin to read, apply, expire the password and then disable it. I prefer to expire the password af...

msatter

You can disable it, after taking away any rights to make changes.

Newer router come with a default password printed on the device so you need to register that also for each router.

msatter

Thank Mikrotik for making the path in v7 backward compatible with v6.

I learned yesterday a new way to find active setings in v6, so still things to be found in v6. Please use the suggestion about the TAB and you can do your scripting yourself the next time.

msatter

If Unimus execute line by line you could use this for v6 and v7: # v6 & v7 compatible /ip firewall nat #shows enabled rules with no src-addres-list :foreach r in=[find where !disabled !src-address-list] do={:put [get $r]} # shows disabled rules with a src-address-list :foreach r in=[find where d...

msatter

@idgolstein All you need to know, is stated when you start terminal in Winbox. MikroTik RouterOS 6.49.2 (c) 1999-2021 http://www.mikrotik.com/ [?] Gives the list of available commands command [?] Gives help on the command and list of arguments[i][/i] [Tab] Completes the command/word. If the input is...

msatter

ROS v6: :foreach item in=[find list=<LIST NAME> timeout~"."] do={:put [get $item]} :foreach item in=[find list=<LIST NAME> !timeout] do={:put [get $item]} Flags: X - disabled, D - dynamic # LIST ADDRESS CREATION-TIME TIMEOUT 0 ;;; test test 7.7.7.7 jul/10/2023 19:46:53 1 D test 1.1.1.1 jul...

msatter

Again, check status not value! With timeout: /ip/firewall/address-list> /ip/firewall/address-list/; :foreach item in=[find list=<LISTNAME> timeout] do={:put [get $item]} Without timeout: /ip/firewall/address-list> /ip/firewall/address-list/; :foreach item in=[find list=<LISTNAME> !timeout] do={:put ...

Search found 3063 matches