MikroTik

rextended

Parenti... serpenti!

[Dearest relatives]

rextended

The last available is:
https://upgrade.mikrotik.com/firmware/EG12-EA/EG12EAPAR01A12M4G/image

No matter if is reported the last as EG12EAPAR01A13M4G

rextended

I use S.I.C.E. (Capannori, ~5Km from Lucca) as distributor for the equipments, they have a lot of well trained staff.

I am in the same region, but Lucca is a little far away...

Curious why you asked...

rextended

@jaclaz

on 3rd comment: ether1 is on LAN bridge and also on WAN

rextended

finally made a personal visit on site... a certain 5hitty tplink did the aforementioned filter... no comment...

Thank you all for your time.

rextended

check my post and tellme if it works for you
viewtopic.php?t=216387

the usual bull~it, nothing new

rextended

Blocking YouTube with DNS is something that works only if you have full control of the devices... By default, for example, when some browsers are installed, they use DoH and not the "classic" DNS... Every now and then someone on the forum brings these topics back into fashion with "so...

rextended

you're right, it's an oversight, and the change is bull–it. It says "accept" in the comment and I got confused add action= drop chain=input comment="defconf: accept ICMP" log=yes log-prefix=fw-3-drop-icmp protocol=icmp anyway for this "problem" I think it doesn't count

rextended

That's the right way to crash your router by running out of memory. (and often they do it on purpose, because the intent is not to break into the network, but to crash the router...) Automatic blacklists are for ISPs (neither, really...), not consumers. You don't have enough resources to stop real d...

rextended

Thanks for the tip.

For DNS, it definitely works at the command prompt, and there are no extensions installed on the browser.
(use my DNS and the servers server other 2000 customers that do not have that problem.
When I have physical access to the device then I will investigate further.

rextended

Just press the wrong button, and goodbye everything... /system routerboard reset-button set enabled=yes hold-time=5s..10s on-event=reset-configuration /system script add dont-require-permissions=yes name=reset-configuration owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensit...

rextended

I'm not sure why you're accepting "untracked" in the first rule (i.e. connection-state=established,related ,untracked )... that is actually all traffic if it's first rule, I'm not sure why that is there... is the default https://forum.mikrotik.com/viewtopic.php?p=856824#p856824 untracked ...

rextended

I wrote "Maybe", not that you are, you just appeared on the forum.
I have been here longer, and maybe I really am...

...

rextended

do 2 VPN and use the adequate route like internet1/internet2 change...

rextended

... thanks ...

rextended

@eltikpad On the CPE if I connect, for example, with fetch on https://mail.yahoo.com it responds, and the https certificate is correct, once passed their tplink router (I really want to say that I neither sold it to him nor configured it), nothing that contains "mail" anywhere in the domai...

rextended

That's right, I provide the connection and public IPs, but I don't control or manage their internal routers. Yes, I checked my devices and there is no filter (stupid filter I would say) that does this thing, but if someone had already had to deal with something like this... maybe it was enlightening...

rextended

For ALL I mean ALL , not 1,3,4, etc............. sorry, almost all Are exactly 1000 tcp port, less than 2%. For almost , at least I expect 90%... Nmap for default scan exactly 1000 "random" ports? The #9 is still valid, till now... https://forum.mikrotik.com/viewtopic.php?p=1139632#p1139557

rextended

NOT MT related: All domains containing "mail" in any part of the FQDN do not work I have a customer who has this problem on his internal PCs. I can't go there to check it out in person right now, I had to limit myself to doing some quick checks with remote desktop. Anyone have any idea wha...

rextended

As you can see ALL ports are shown as opened.

For ALL I mean ALL, not 1,3,4, etc.............

rextended

The VPN (what is it?) does not pass through Internet1 or Internet2?

Redo the graph and you will understand why when the current Internet(1|2) does not work the VPN anymore

rextended

The more I look for the the WAN IP & router, the more I couldn't find it. Please edit your post and include verbatim copy of config using < / > code tags. Remove serials. No need to use external services. Is a spammer for the classical NameSurname and edit some week later the post for add the s...

rextended

WinBOX: "Couldn 't add New NAT Rule - to-addres or to-ports must be specified (6)" Terminal: "failure: to-addresses or to-ports must be specified" I thought so too, but evidently it is a censorship for the rest of the text of the comment which contained private data that was elid...

rextended

I wonder what the chances are that all ports are actually open, it's unlikely. Probably "tarpit" & co. are used by the ISP to avoid the hassles you generate with port scanners. Even my customers end up in blacklist for 24 hours if they start doing scans. Either they warn me beforehand,...

rextended

I reread everything quite carefully, but perhaps not enough, and nowhere did I read that he netinstalled the two routerboards one after the other instead of one the month before and one today. And I don't even think I read that when it fails with that one, putting another netinstall succeeds, etc. o...

rextended

If I try to netinstall 6.49.11 it says "Installing" for about 5 seconds then switches to "READY" it never formats the drive or installs routeros. Go on control panel/ethernet connections and disable all (included eg. bluetooth, wifi, etc.) devices except the ethernet used. Not m...

rextended

Bad assumptions: RouterOS do not support decimal numbers, only integer, so, only string if dot is present, or convert (using strings splitting at the dot) 1.480000 m to 1480 mm or 1480000 µm Use correct syntax, is full of errors and omissions. :local monGPS [/system gps monitor once as-value] :local...

rextended

Obviously the usual firewall considerations need to be made. Per i 2,5G ti consiglio una RB5009, è perfetta... A casa ho una 100M via CPE wireless RBSXTsqG-5acD... con me stesso... e la hEX-S è perfetta... stando in campagna niente fibra.............. Uh, questo è il post #13000, non me ne ero neanc...

rextended

( On v6 web interface exist "add batch" and you can download the list of generated users. )

rextended

He probably demanded an immediate answer... and he just go away...

However, by not explaining the reason, he doesn't get the right hint.

rextended

The main problem with .backup files is that if there is an error in the various databases where the configuration is, or "surprises" left by the migration from one version to another (you can read hundreds of cases on the forum) they carry the defects of one device to the next , without t...

rextended

He probably demanded an immediate answer... and he just go away...

rextended

It's not a competition . Just curiosity. - You have multiple remote customers Ok, you can (must...) have multiple .rsc for each customer, like you have multiple .backup for each custimer..... - Some of those remote customers may have different parts of the updates already configured. My .rsc script...

rextended

@Paternot Just let us export the backup from (say) RB5009 *DEAD* to *RB5009 NEW* @rextended Great, if you then explain to me how you export the backup from a dead device without extract nand/flash and put elsewhere, etc. And if she's dead, who cares if the new has that old MACs ... (in fact, it coul...

rextended

Maybe the meaning is "you can't use netinstall to install a remote device", if so. Otherwise it seems "You can't use the netinstall remote control "... FALSE: if you have the right devices available and connected properly. It is not the first time I do netinstall remotely from ot...

rextended

Great, if you then explain to me how you export the backup from a dead device without extract nand/flash and put elsewhere, etc. And if she's dead, who cares if the new has that old MACs... (in fact, it could sometimes be an advantage...) But... why? Because it's easier than managing .backup It does...

rextended

/tool user-manager user profile add user=user1

this do not exist and also not work, so, how you do that?

on user section use
/tool user-manager user create-and-activate-profile <username> profile=<profilename> customer=admin

rextended

But I have a total of 10 PPPoE interfaces that need to dial.

What are you waiting for to explain the whole situation, instead of wasting people's time by giving them one crumb at a time???

rextended

It's quicker to do a /export show-sensitive and then delete or reset to default everything that is not needed, it's safer...

If instead it is done to try to clean something "dirty", netinstall should be used...

rextended

[...] As in ISP , we use hundreds/thousands of identically configured Mikrotik routers. [...] [...] When we configure a new Mikrotik CPE [...] [...] the new Mikrotik CPE router is ready to be installed and added to our customer ISP network(s). [...] [..] bulk update newer master configurations to a...

rextended

As usual, no RouterOS version.

rextended

mikrotik default = bridge port 2..5
no default = no birdge...

mikrotik default = firewall OK if pppoe-out1 is added to WAN interface list
no default = NO firewall...

The bridge is internal between ether2...ether5 (+ sfp1)
pppoe-out1 (or ether1) never go on any bridge

rextended

la configurazione è tipo: pppoe 185.21.12.79 185.62.62.104 sprecato mikrotik brdge 185.62.62.105/29 NIC server1 185.62.62.106 / 255.255.255.248 / Gateway 185.62.62.105 NIC server2 185.62.62.107 / 255.255.255.248 / Gateway 185.62.62.105 NIC server3 185.62.62.108 / 255.255.255.248 / Gateway 185.62.62....

rextended

I don't want to sound like @anav with the answer, but you didn't even list a prerequisite or how the IPs are provided. Since NO ONE here in the forum is a fortune teller, but EVERYONE doesn't answer you exactly as you want or expect, BUT first they want to know why they should spend time for you... ...

rextended

Who am I to judge? No one, of course. Delete Facebook and fix the problem. If it's addictive, it will surely ruin your life in one way or another. If you don't have enough willpower, deactivating Facebook on this way (if possible), is like putting the bottle on the high shelf at a certain time for a...

rextended

Useless report without specifing RouterBOARD model (arm/mipsbe, etc.) and RouterOS version , and Useless report on user forum, instead of posting it on relative version topic and report to support@mikrotik.com And please search or read current version topic before post new topic, or at least post i...

rextended

All useless, with MAC randomizer on phone that change every hour...

rextended

I have the VICE of READING documentation, at least the little written, should be read...

At the time of the OP:
https://wiki.mikrotik.com/Manual:SNMP#R ... s_with_GET

Now:
https://help.mikrotik.com/docs/spaces/R ... ptswithGET

rextended

For the OP problem only the solution is simple, add "1" in the right point....

1.2.3.4 1.3.6.1.4.1.14988.1.1.8.1.1.3.3
=>
1.2.3.4 1.3.6.1.4.1.14988.1.1.18.1.1.3.3

rextended

Whatever happens,
RouterOS is still router software, it is certainly not a reliable compilation language for creating reliable programs,
let alone with instructions that are not even documented or whose existence is not even admitted...

rextended

however, as already written, the bug is the same of previous post links, already corrected on v7.something { :local a [:toarray ""] ; # define new empty array :set ($a->"x") "7" ; # on new array set x = 7 :local b $a ; # define a copy of the first array # put both 7 as ...

rextended

{ :local a ({}); :local b $a; :local setx do={ :set $x "X"}; ($setx <%% $b); :put $a} Incorrect: $ in front of an undeclared variable means argument! I know very well what $ is for. And where is the $x argument in all script except on :set ??? You pass only $0 So your error is even worse,...

rextended

The question is vague and there are no valid clues, I would never have used a version higher than 7.16.2 in production in devices that must necessarily have v7 because they are not supported by v6. Given the distance and the same problem, I could forcefully deduce that some configuration, applied on...

rextended

@optio Don't waste your time ("throwing pearls before swine" is rightly a saying that could be misinterpreted by artificial intelligences...) He's focusing on how to leave useless :return instead of understanding that must be removed as he's told from the post #3 (...#2...). Obviously he ...

rextended

Netinstall.

rextended

I have days to get production code running. I wouldn't hire you if you were the last person left. And if I saw any of my employees do something like that, I would have already fired them for incompetence. They both believed ":return" without value was okay. Any intelligent person who read...

rextended

...and without ever once using artificial deficiency to learn it... And of course the author continues to write posts that seem to be written in the same style as ShatGPT... look how conditioned he is... He probably didn't even read my post, let alone understood EVERYTHING that was written... Such a...

rextended

RouterOS Bug - Why Do These Simple Scripts Break? Cause of Mysterious "value:" Prompt? Original title, for future reference Why did you write RouterOS BUG??? Before writing something like that, wouldn't it be better to first ask for advice on the bugs you have ? Do you like large fonts? A...

rextended

The only way to correct inizialize empty array is [:toarray ""] , any other methods do not work as expected and later give only problems. ({}) // ={} // and other frills must not be used. https://forum.mikrotik.com/viewtopic.php?p=973609#p973609 Then inside the function the use of x is not...

rextended

If this is not possible for some reason, please let me know as it takes me some time to save all the scripts posted here...

Thanks.

rextended

It may be a good idea, but... all the content already written on this forum?

rextended

(Not tested on capsman) On interfaces is not needed at all to disable and enable the interface, is automatic when change anything on wifi (also comment...)

rextended

probably you skip "or with a little mod:" on post #9...

rextended

I apologize , not being fully versed in English, I still don't understand the meaning. My concept I think is clear about the MAC address: Anyone, if not directly connected, can't do anything. Then we can talk about compromised ISPs, compromised internal peripherals, etc., but they are already insid...

rextended

Your version have from=num to=hex work only for v7.18 and up. For work also on previous v7.1rc7 and up version using :rndstr is more easy. Do not use for variables names already assigned to something. Ignoring useless logging and useless frills, this suffice: /interface/wifi :foreach item in=[find] ...

rextended

(reply to the first post, before the edit 2025-04-07 11:24:16 and 2nd post) in that case the cycle is done differently, and the variable name should not be the same of one objects (already written)... /certificate :foreach crt in=[find] do={ :local cName [get $crt name ] :local cCommName [get $crt c...

rextended

Even if not exploit it, we are back to the first point: If someone knew my router's WAN port's mac address, and somehow could find it on the Internet, they could simply attack it -- not necessarily 'break in' but certainly bring down the ability of the router to communicate with the Internet. Let's...

rextended

This (previous) example suffice to explain that not always in RouterOS nil = nil, nil = nothing or nothing = nothing...

example nothing is not equal to nothing code

[rex@test-v7.16.2] > :local a ; :put [:typeof $a] ; :put ($a = [:nothing])
nothing
false

rextended

Currently if I am forced to use v7 because the device does not support v6, for me the latest version of RouterOS that works is 7.16.2.

rextended

I see that within your scripts you usually enter the configuration context and handle things there. Example: /log :foreach rlog in=[find where message~"((25[0-5]|(2[0-4]|[01]\?[0-9]\?)[0-9])\\.){3}(25[0-5]|(2[0-4]|[01]\?[0-9]\?)[0-9])"] do={ And I prefer to use the entire path of the comm...

rextended

Hello rextended! I notice you do not use CamelCase ou camelCase in your variable names. To me it is a bit hard to imagine why... Could you elaborate a little on why? Simple: I act according to how I feel like it at that moment. Since these are very simple scripts and not parts of the program that o...

rextended

Is not clear at all on post #2: not mix nil and nothing, because nothing is also different from nothing. I do not have at the moment one precise example, but often nil and nothing are uncomparable. :local a ; :put [:typeof $a] ; :put ($a = [:nothing]) Better check the lenght of returned value. If is...

rextended

Era un tentativo... non capisco perché non dovrebbe funzionare....

rextended

I may make mistakes, but before you write, you better double check what I wrote and what you did... (note: I'm on GMT+02:00) [rex@test-v7.16.2] > :global unixtodatetime do={ {... :local ux [:tonum $1] {... :local Fzerofill do={:return [:pick (100 + $1) 1 3]} {... :local prMntDays [:toarray "0,0...

rextended

@dang21000 please do not write random useless things without any use or any solution. socks: yes what is off is on OP, for example... traffic-gen I'd like to let you know that I'm reporting an issue with the [/flood-ping] tool. I updated to version 7.18.2 and it stopped working. But can I know or n...

rextended

The mistake continues to be the same:
being in such a hurry to connect the device directly to the internet, without caring about protecting it first.

Was there all this urgency?

rextended

Lascia perdere gli script, metti direttamente nello scheduler questo, e guarda se funziona:

:execute "/interface lte at-chat [find where name=\"lte1\"] input=\"at+qnwlock=\\\"common/4g\\\",1,1850,100\""

rextended

Why this "clarification"?
In the previous post the invalid syntax was in the lack of parentheses around true and false...
Obviously it works if the parentheses are used correctly.

rextended

How to fix that? (whitout define global "echo" outside the script) NEVER CALL TWO TIMES THE SAME FUNCTION WITHOUT USE OR ASSIGN THE RETURNED VALUE Simply add void variable for ignore useless return from the function (return everytime something no matter if :return is used [as must be] insi...

rextended

3) do not use " do { } " to completely enclose a script or similar bulls–t. I don't understand how the function, the "do" block, can't be wrapped in curly brackets "{}" Is do { } not do={...} Read better: completely enclose a script do { <all the script here> } ///////...

rextended

As per my previous examples, [ ] is not a condition, it is executed for every single value returned by find/print. > /ip/address/find where [false] > /ip/address/find where [true] > /ip/address/find where [($address~"^192.168.1.1/")] Wrong syntax, do not work, because... is wrong... Correc...

rextended

/ip/arp/find [{ :put $address :put $interface }] Coding style may vary... [rex@test-v7] > /ip arp find [:put "$address\r\n$interface"] 10.11.12.8 ether1 10.11.12.11 ether2 10.11.12.1 ether3 10.11.12.10 ether4 10.11.12.2 ether5 [rex@test-v7] > /ip arp find [:put $address; :put $interface] ...

rextended

I understand that it is not documented, but I have known about it for years. If I had time I should write the manual for "ScriptOS" myself... Then there are other users who by dint of digging also discover new things like >[] , >"" , >{} , <%% etc. even more difficult to discover...

rextended

Other than that, for private DNS I recommend using _____.mqtt.internal instead of _____.local.mqtt
(or intranet, or private, or corp, or home, or lan)
https://www.rfc-editor.org/rfc/rfc6762#appendix-G

rextended

As I already suggested, wouldn't it be enough to use the factory password for security?

rextended

Yes, work as expected. A basic rule is to never use variable names that are the names of <anything> in the system. [rex@test] > /ip/arp/print proplist=address Flags: D - DYNAMIC; C - COMPLETE Columns: ADDRESS # ADDRESS 0 DC 10.10.23.8 1 DC 10.10.23.11 2 DC 10.10.23.1 3 DC 10.10.23.10 4 DC 10.10.23.2...

rextended

mode=https & url="https

rextended

Better the naysayers of those who implicitly suggest deleting the default configuration and therefore the firewall with all that it entails because is more easy,
creating yet another machine that will cause, in one way or another, DDoS...

rextended

:local EMAIL "it@tlpk.com" :local PASSWORD "xxxx" /system clock :local DATE [get date] :local TIME [get time] /system identity :local FILENAME "Backup $[get name]-$DATE.backup" :local MESSAGE "Please see attached file..." /system backup save name=$FILENAME pa...

rextended

You are not telling us the truth. Only that line cannot give that result. I have already seen errors on the second run , they depend on syntax errors made previously, but if you only show that line, no one can help you... or not? [rex@test] > :global testFunc do={ :put "Called with: $1" } ...

rextended

L'apparato è uno switch, non è un router, quindi non ha una configurazione iniziale da router. Penso che la conigurazione è incompleta e che è meglio se ti rivolgi ad un esperto. Attualmente hai configurato lo switch (come se fosse un router) in modo che possa essere sorgente di attacchi DDoS verso ...

rextended

so it's not necessary to set up rules to protect router againt syn flood, ssh brute forcer, port scanner or other? Your ISP should do that job, not your router. And what about bruteforce... bruteforce what? You are the one leaving the door open, by default they are all closed on WAN side... You sho...

rextended

There are dozens of threads on this topic on the forum.
Sorry, but I don't use Telegram and I don't tinker with things I can't test.

rextended

Too many mistakes and too many times to do 2 + 2
do instead (4 / 2) + (((7 + 9) / 2²) * ½)

rextended

And the file content? Perfect, you specified both the RouterOS version and the Router model used. This is how it's done... Have you ever thought of simply opening the plain text file and seeing what's written inside? Nothing to worry about . It's a file that is automatically created when " some...

rextended

There is a detailed explanation written by others on the forum. Aside from that when you notice a problem, it should be minimized to remove as many parameters as possible: { :local y ; # used later :local z 10 :local j 11 :local x (>[:set y 44 ; :local deletek ; :local overwritew 19]) :local k 12 :l...

rextended

(Now I'm not going to go into a line-by-line list of what's wrong or not, but the last rule... better no comment...) Really disgusting, to be thrown in the trash. Put back the default ones that are more than enough for you. https://forum.mikrotik.com/viewtopic.php?f=13&t=175129&p=856824#p856...

rextended

Not at all, in fact you teach badly and they learn worse. It is wrong, you should never use numbers or IDs in the script. I understand that was just an example, but wrong examples are still wrong. Because, for example, in the terminal there is no point in doing all this to get the IP, then, if it wo...

rextended

On dhcp-client script:

/ip firewall connection
:foreach idc in=[find where timeout > 60] do={
    remove [find where .id=$idc]
}

rextended

missing space, is "7.18ab244"

rextended

If is just netinstalled... already the history do not exist...

rextended

All complicated steps useless, isn't it better to use :timestamp and relative functions on RouterOS v7??? For v6 there are still my functions to get the exact date going from unix time. https://forum.mikrotik.com/viewtopic.php?p=977170#p977170 (changed / to - on function) [rex@7.16.2v7] > :global un...

rextended

The bug is the same, well know...
do not use other characters than \r, \n <SPACE>! etc. until the ~ because on RouterOS are unsupported and rended differently on various terminal/winbox/script, etc.

rextended

As you can see here "expanded default rules on forward code": https://forum.mikrotik.com/viewtopic.php?t=215733#p1134906 you need to have an overall vision, you can't consider ONLY that rule to understand it. Some things are implied. For example, it considers only new connection attempts f...

rextended

Right, I never realized that the options were unrelated, even if in the same context, because I never needed it.

**********

And it's a good thing you wrote it because I didn't remember that note... from 2007...

rextended

Already exist from 2007...

rextended

This thing comes up often........ https://forum.mikrotik.com/viewtopic.php?p=1126890#p1126622 https://forum.mikrotik.com/viewtopic.php?p=1126890#p1126789 https://forum.mikrotik.com/viewtopic.php?p=1126890#p1126843 /ip firewall filter add chain=forward action=fasttrack-connection connection-state=est...

rextended

the filename is logs.txt , it is more than obvious that if only logs are written it does not work. (the script has a lot of errors, I only highlight the part about quotes and file name) /log print file= " logs .txt" delay 10 /tool e-mail send from="xxxxx@xxxxxxxx.co.uk" to=xxxxx@...

rextended

/interface ethernet find [:if ($name~"ether") do={/interface list member add interface=$name list="VLAN2"}]

(list must already exist)

rextended

(I'm not saying I don't agree...)

...which will further increase the size of RouterOS...

rextended

Nothing changes after hitting renew

The default 30d / 7d are > of default 3d on server side (not MikroTik problem, are default RFC values...)

So for internal network the IPv6 expires 4 day later of what is already expired...

rextended

They started (and still are) adding scripting commands like the functions I wrote, and others.

rextended

Ok, I'll give up before I answer badly.
Of three questions, you didn't answer one.

rextended

I can't thank you enough.

rextended

The lack of respect is very high, like that ignorant person who tried a 40Gbps test....

rextended

https://help.mikrotik.com/docs/spaces/R ... n+RouterOS

rextended

So the certificate is self-renewing or not?
The new one does not apply to the www-ssl service?

Have you tried with any browser?

rextended

The service on port 80 must be active for automatic renewal, as written in the guide, in 7.18.2. (for 7.17x and 7.19 there is also renewal via DNS verification) There is no practical reason why if you expose port 443 to the world, you cannot also leave 80 open. Absolutely nothing changes from a secu...

rextended

If you have a database and you free only some rows, the database is not compactedd for every delete.
If you delete all database, probably is also "compacted"....

rextended

Probably ISP do not asign static IPv6 etc. etc. etc.

Paste this on terminal and reboot, see if solve on long term.

terminal code

/ipv6 nd
set [ find default=yes ] hop-limit=64
/ipv6 nd prefix default
set preferred-lifetime=45m valid-lifetime=1h30m

rextended

Probably free space more than 134217727 bit cause variable overflow.

On your spare time, can you try again the passage from 7.18 to 7.18.[1|2] leaving on purpose free space less of 134217727???

On that devices are expected only 128MiB........

Just for fun and curiosity...........

rextended

Aside from the fact that they banned my account for a week for revealing some things in advance,
I'm not telling you that they shouldn't be published, but that in the face of this news, there needs to be PROOF.
Do you understand what I write or not?

rextended

discussion is just childish.

You are right, I will stop here, or rather there↑↑↑

The point is that it is wrong to provide information WITHOUT PROOF.

rextended

When people say it's rainy in their town, you also asking officials to confirm this? [/color] ... I'm tired of this bullshit. Your words bother you? Then don't say them... I'm fed up too, especially with the wrong examples. I don't care about the information about whether it rains somewhere or not,...

rextended

This absolutely doesn't change the fact, that AMT has appeared in 7.18, as I initially stated. Everything else is another question. And this absolutely does not change the fact that when someone appeared on the forum and writes about new features added to RouterOS, he must always cite the official ...

rextended

No matter, now DNS-over-QUIC is used. ROS supports DoQ??? No, are the browsers that ignore completely the DHCP/fixed DNS settings and use own protocol for show the ads. The final scope of all that is that you must not skip ads on browser, privacy is a big bullsh1ft and has nothing to do with it...

rextended

No matter,
now DNS-over-QUIC is used.

rextended

I won't comment these stupid conclusions. Calm down and don't scream so loud. The conclusion is not stupid, someone passing by, without be one forum admin or post official sources, announces something, it's just bullshit. Not to mention that maybe, as already happened, they remove some features fro...

rextended

Are there partitions used on this router? Two partitions would split the disk.

Official reply, please:
Are discontinued PPC products from year 2011 still fully supported?

Thanks.

rextended

Completely useless note or consideration,
because no matter what happens if it only sees 64MiB out of 128MiB there is definitely some underlying problem...

rextended

Hi: 7.19beta6 is too big for the RB1100AHx2, by a few bytes: ERROR: not enough disk space, 20.7MiB is required and only 20.7 MiB is free. The router was never re-partitioned, i.e. has a single "part0" with 64 MiB size. There are no files or directories under /files. -- azg RB1100AHx2 ( ye...

rextended

Simply that you are writing nonsense and in the user forum.
If you want to contact MikroTik write to support@mikrotik.com
What users think or write matters absolutely nothing.

rextended

They've already invented the "supercazzola prematurata con doppio scappellamento a destra".
hahahaha
Few will understand it...

Like the OP on user forum...

rextended

They've already invented the "supercazzola prematurata con doppio scappellamento a destra".

rextended

Put 7.16.2 back and wait until someone at MikroTik figures out the difference between 16M and 128M...

rextended

The whole kid control thing makes no sense how it is implemented. In short: If you feel the need to use machines to control humans, you are definitely doing something wrong. Long: You are absolutely right, it is the parents who have become incompetent. When my father told me something it was law, n...

rextended

It's like writing "I don't know how to do it, click here, click there"...
What you wrote is completely useless, just read my previous post and you can clearly see what needs to be changed.

rextended

do you have a list of domains or ip used for renewal? it doesn't seem very professional to expose the port to everyone unless there is a service exposed on it. Il servizio non è fornito dalla MikroTik, quindi rivolgiti a Let's Encrypt per la lista... se te la danno. [ The service is not provided by...

rextended

I change one user-manager and one Dude done with RB1100AHx2 (powerpc) to two RB1100Dx4 (arm) when is coming out, but have internal disk, not use mainboard flash.
But RB1100AHx2 still working both...

rextended

full of useless... /ip firewall address-list remove [/ip firewall address-list find list=firehol_L1] /ip firewall address-list add addres=1.10.16.0/20 list=firehol_L1 timeout=2d /ip firewall address-list add addres=1.19.0.0/16 list=firehol_L1 timeout=2d /ip firewall address-list add addres=1.32.128....

rextended

From 2007 i never change a single device for memory wearing,
but also I change obsolete devices, no matter if are working or not.
I have only xxx-ac devices and CCR/CRS. No more RBxxx except "new" RB1100Dx4

rextended

POSIX do not have that at all, not only RouterOS.

rextended

Ignoring why you want to expose a device to the internet with an IP, instead of opening only the necessary ports via NAT, you have not explained how the provider delivers you internet and how they should deliver the second IP to you. Paste this on terminal for join ether1 and ether5 on one bridge, s...

rextended

What’s the meaning of life? 😁 The problem is that if I write it, life for you might no longer have any meaning... The meaning of Life is... to seek a meaning to Life. _ _ _ __ _ _ _ _ _ _ _ _ | | (_) | \_\ | | | | | | | (_) | ( ) | | | __ _ __ ___| |_ __ _ ___ | |__ ___| | | __ _ _ __ ___ _ __ ___|...

rextended

"Karma" has been gone for a while... In fact if you search for old topics you will be able to see everytime at the end of a reply "if it was useful, please add Karma..." which had become boring as "Sent from my phone using Tapatalk Pro" at the end of every post, for laz...

rextended

So what would be the point of this topic?

rextended

You try another PC? If not, what you wait?

Device model?
Winbox version?
RouterOS version?... You update today to 7.18 or 7.18.2?

Do one

/export show-sensitive

on SSH, save the results and netinstall the device.

rextended

Super, much thanks.

rextended

Are you making the same mistake as beginners? Ask directly what you need. In case 1) set allow-remote-requests=yes is completely useless, and the input port from the LAN must not be opened (which by DEFAULT is only allowed from the LAN) In case 2) just leave the DEFAULT rules and the LAN devices MUS...

rextended

The fles are signed, why uselessly use cpu power to encrypt/decrypt what is already signed?

rextended

Understand, but I am not able to read your "version"... This? /system leds find [ :if ($leds=[:toarray "user-led"]) do={ set $".id" type="on" \ disabled=(!$disabled) } ] addedndum on previous post: missing quotes between "trueon", the 2nd pair of [ ]...

rextended

@Josephny

Interesting, but the LEDs are small and you would have to have the device in front of them to attract attention...

rextended

For example, if wifi interfaces are on/off.
Some customers ask me to disable wifi on cAP central button press, that also disable the led...

rextended

Anyone can make a certificate these days. It's all become so trivial... The purpose of https is to encrypt the connection between two points, not to certify what passes through it... However, yes, .npk files have 32 bit of signature at the end (and also .dpk, and also .fwf) so they can't be tampered...

rextended

(no space between do= and {)

I think this suffice... on same set you can set more...

/system leds find [:if ($leds=[:toarray "user-led"]) do={set $".id" type="on" disabled=(!$disabled)}]

rextended

Yes, if you configure it properly How about I configure my boot right into your pin hole. You are worthless piece of shi f t, if you have nothing constructive to say then shut the fuc hs' endothelial k ibble up. I think you broke the record for swear words and insults in a single post. Not even a f...

rextended

rextended

Karnaugh
Y N
O 0 1
F 0 0
disabled Yes / No
type On / oFf
LED 0=off 1=on

So the less expensive thing to consider if is at the same time disabled=no and type=on

rextended

It is understood that without scripts/scheduler/on-event/netwatch it does not mean that scripts cannot be used to initially configure the device...

rextended

I'm not getting into the OP's issue, but IPsec is a VPN and using WinBox over IPsec............

rextended

I'll be vague, as I was before the CVE for brute-forcing usernames came out publicly.
I wouldn't use 7.17 even if they paid me, I believe MikroTik got it done with 7.18....
but with 16MB peripherals I wouldn't use 7.18.2 either...
and anyway 7.18.2 is too fresh....

rextended

I think you misunderstood me, it was a compliment for you...

I know you didn't have the idea, but you were fundamental in intuiting the right point of view....

[What can be easy flipped as true/false? Whether it is disabled or not!]

rextended

7.17.x 1) is too fresh ; 2) and deplete completely the 16MB free space after some time.... 7.18 is worse for point 2) and is unstable (see 7.18.2 and is not finished...) 7.17 is no longer being developed or fixed, so if no new fixes come out it's not because there aren't problems... because with eac...

rextended

Simple approach:
Peripherals that have 16MB of NAND/Flash or less leave them at 6.49.18 long-term (for those that can be put v6).

In the rest of the cases put them at 7.16.2 and wait...

rextended

Ok, done.

rextended

Turn on/off the user-led if is already defined,

/system leds find [:if ($leds=[:toarray "user-led"]) do={set $".id" disabled=(!$disabled)}]

obviously is always type="on"

Well, you should be satisfied, today you beat me!!!

rextended

use set 0=on/set 0=off.

no... please no........

at least set [find] type="<on or off>"

While playing with the thingy, there is also the disabled state, the user-led set to on BUT disabled is actually off, and as soon as I enable it, it lights up.

muble, muble.....

rextended

I've got the idea from someone you might know: https://forum.mikrotik.com/viewtopic.php?p=875571#p875571 I know myself well enough not to stay in the same positions if something evolve. If I later notice problems that arise because RouterOS changes or interactions with other functions that were not...

rextended

Open separate topics, don't mix everything in here, it's already hard to understand anything.
When you've done it elsewhere, write the results here.

rextended

place-before=*0 place-before=*0 ERRORS. for 2+1 reasons: 1a) *0 ID do not exist if there are not mangle rules, 1b) never use IDs or "relative numbers" on scripts. 2) Better not move static items over dynamic "special dummy rule to show fasttrack counters" or the RouterBOARD it m...

rextended

[...] The essence is the same :) , bummer :( >>> Why " :( " ? It's better than... I don't want to argue with the AI as usual >>> I hoped there was a clever way to invert the status of a boolean *somehow* without needing to check the current one Exact, can be done, but is not a boolean, ...

rextended

1) If work, is correct and is not too much complicated. 2) See my example. 3) Can be one-line command if accepts true/false (boolean) instead of on/off... 4) Missing a chech if the leds group exist. On my example I add it if is missing (but I do not check hardware if have or not the led) If is somet...

rextended

I'm repeating myself, but unfortunately people don't know how to distinguish L2MTU from MTU and it always creates confusion . If all the machines are under your control, making a PPPoE connection with an internal MTU of 1500 is a walk in the park. If instead you have to go through third-party lines ...

rextended

/interface ethernet switch rule add switch=switch1 ports=ether41-node102 src-address=192.168.1.30/32 comment="Allow only IP 192.168.1.30" add switch=switch1 ports=ether41-node102 new-dst-ports="" comment="Block all other IPs"[/quote] It obviously works fine if it also ...

rextended

Let's not mix apples with oranges. Layer 3 MTU is one thing, Layer 2 (L2MTU) is another. Ethernet MTU refers to how much the IP (and others) data is. VLAN MTU means how much big can be the data that internal ethertype can carry. If you have one ethernet with MTU of 1500, you notice that a VLAN with ...

rextended

This thing made me think so much, that I could write a book about it. A story of a civilization so advanced that no one leaves home, everyone is in a cabin and no one has ever really seen anyone other than their family and the robotic doctor. Everyone would look the way they want to others. People w...

rextended

I'll try to explain better what concerns me, so that no assumptions can be made. If I forgot something, ask... Q) What would change in my life if an AI came out that wrote scripts better than me and others here on the forum? A) Absolutely nothing to me. Q) If the aforementioned AI existed, would I u...

rextended

Your emotional resistance won't change that trajectory. How cute, the emotions, the love, the envy, the joy... It has nothing to do with it. Do you want to explain whether or not a black hole exists.. with a fart??? :lol: :lol: :lol: You are fear of this, you are fear of that, you are envious of th...

rextended

typists had toward word processors switchboard operators had toward automated exchanges Two examples that require determinism, against something not determinate, as you yourself wrote. I don't want a word processor to correct my sentences as someone else likes, just because someone else whose LLM h...

rextended

PLEASE do not quote SO USELESSLY... The actual ping/https process have it's connection taken down, for restart ping/https from that process, stop and start again, for create a new connection. The fix is close... (wait...) add this on "disable NAT" part of the script... do not alter timeout...

rextended

/ip ipsec policy get [find where peer="NordVPN"]
alone do not do nothing

:put [/ip ipsec policy get [find where peer="NordVPN"] ph2-state]

rextended

I added the answers in the post after your questions.

The previous posts have been integrated.
Always check the IPsec status, only that it is no longer based on commenting dynamic routes...

The scheduler is put on the same previous topic where is the script.

rextended

1) I use winbox, not the command line. The dynamic route created by LTE lost the comment everytime. 2) Is not cpu expensive, so every 2 second suffice. I add the "copy & paste" for create the schedule 3) If you bring down the LTE, how the IPsec can go up? I miss something on your confi...

rextended

Schedule this: :if ([/ip ipsec policy get [find where peer="NordVPN"] ph2-state] = "estabilished") do={ /ip firewall nat enable [find where comment="defconf: masquerade" and disabled] } else={ /ip firewall nat disable [find where comment="defconf: masquerade" ...

rextended

I don't want to bother you in this thread, but wouldn't it be better to find the safe-mode active by default (maybe it can be disabled with an option when launching winbox) and ask for confirmation of the changes when exiting winbox? (at most from the browser if you forget to confirm or the operatin...

rextended

As already written, I'm an ordinary user (and not even a moderator as you thought), you have to write directly to support@mikrotik.com if you want to contact the staff, this is a user forum where sometime staff appear here. But, as already written, RouterOS uses an old kernel and I don't know if the...

rextended

Not to insist, but I've been writing this since the beginning I wrore about compatibility...

rextended

Thanks for the explanation, in this case you have my total understanding. A suggestion for the future: If it were possible to introduce automatic measures to prevent permalocks, such as preventing deleting or disabling a bridge if there are still ( active ) ports connected. It always makes me think ...

rextended

Throw everything in the trash and start over. The configuration is unwatchable, all the BASIC firewall rules are missing... And if you want help, but hide the rest of the configuration, you can do it yourself. You have to show everything with "/export file=myexport", even vlan, ip (censore...

rextended

it's released to public, so someone's gotta test it and report when things don't go as planned

I would really like to know what quality control they do, since it takes very little to block an updated routerboard.

Do they expect the user to just do netintall to update them???

rextended

I don't understand the blame,
the software is beta,
if you didn't want risk to brick the device, why did you put it in?

rextended

You have time machine, Feb/7/2106...

rextended

*) console - added on-error to "for" and "foreach" loops;
*) console - do not treat return values as errors in scripts run from scheduler;

rextended

That switch is used on:
RB750Gr2 (hEX)
RB962UiGS-5HacT2HnT (hAP ac)
RB960PGS (hEX PoE)
RB960PGS-PB (PowerBox Pro)
RB3011 (all series)
RB OmniTik ac (all series)

rextended

I'm missing something... Why you do not want fasttrack UDP?

rextended

https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features#SwitchChipFeatures-Introduction https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching#BridgingandSwitching-BridgeHardwareOffloading So, in that models: C52iG-5HaxD2HaxD-TC (hAP ax2) C53UiG+5HPaxD2HP...

rextended

Ah, on RouterOS??? Do not write on forum, but to support@mikrotik.com At least [rex@7.23.5] > :put [:timestamp] ; # timestamp give already "time" 2879w18:16:44.037086370 [rex@7.23.5] > :put [:tonum [:timestamp]] 1741285004 [rex@7.23.5] > :put [: todate [:timestamp]] 2025-03-06 18:16:44.037...

rextended

Already exist this: https://forum.mikrotik.com/viewtopic.php?p=977170#p977170 and also consider TIMEZONE... [rex@7.16.2v7] > :global unixtodatetime do={ {... :local ux [:tonum $1] {... :local Fzerofill do={:return [:pick (100 + $1) 1 3]} {... :local prMntDays [:toarray "0,0,31,59,90,120,151,181...

rextended

Can a pc read tags, NO, so we have to untag the traffic leaving the port that is connected to the PC.

But... that's not quite right...

rextended

Aside from wanting to hurt yourself with bullshit (not censored on purpose, this time), the most logical thing to do is to allow all the traffic that is done by a "clean" device, and the traffic destination is logged and then is allowed permanently by the other devices as well. So one devi...

Search found 13734 matches

example nothing is not equal to nothing code

terminal code