Community discussions

Search found 356 matches

  • 1
  • 2
by mpreissner
Tue Feb 26, 2019 2:34 am
Forum: General
Topic: Need some help...hex setup [SOLVED]
Replies: 7
Views: 910

Re: Need some help...hex setup [SOLVED]

but only bridge is added to LAN, and that means untagged traffic / vlan=1. Ah! The concept of grouping interfaces as LAN is a little odd to me. After assigning the Management VLAN interface to LAN, I'm able to reach my desired management IP address both from an access port on my management VLAN as ...
by mpreissner
Mon Feb 25, 2019 10:42 pm
Forum: General
Topic: Need some help...hex setup [SOLVED]
Replies: 7
Views: 910

Re: Need some help...hex setup [SOLVED]

Here's my export so you can see where I am... /interface bridge add admin-mac=B8:69:F4:AE:58:0E auto-mac=no comment=defconf name=bridge \ vlan-filtering=yes /interface vlan add interface=bridge name=DMZ vlan-id=300 add interface=bridge name=GuestWireless vlan-id=901 add interface=bridge name=Interna...
by mpreissner
Mon Feb 25, 2019 10:38 pm
Forum: General
Topic: Need some help...hex setup [SOLVED]
Replies: 7
Views: 910

Re: Need some help...hex setup [SOLVED]

Thanks! So far so good...but here's the next piece...I've added a DHCP server to my "Management" VLAN (100) interface, and I can get an address, so that works fine. However, I am unable to connect to the address I put on that interface via Winbox (using IP or MAC) or mactelnet. I can still connect t...
by mpreissner
Sun Feb 24, 2019 2:35 am
Forum: General
Topic: Need some help...hex setup [SOLVED]
Replies: 7
Views: 910

Need some help...hex setup [SOLVED]

Hey everyone...it's been a while since I've been active up here...but now I'm in a bit of a bind and need some help with setting up my new hex. Situation: I have an older RB750GL that's been running great for a while (ROS 6.40.5) using the older Master/slave port setup. I recently had to change an a...
by mpreissner
Sat Dec 09, 2017 4:02 am
Forum: General
Topic: SSTP VPN with Win7 'verify client certificate'
Replies: 11
Views: 5304

Re: SSTP VPN with Win7 'verify client certificate'

When you're using EAP, you're not authenticating to the RouterOS system, you're authenticating to a Microsoft NPS server. MikroTik doesn't currently support any EAP methods for their VPN implementations. MikroTik only knows how to pass PAP, CHAP, MSCHAPv1, and MSCHAPv2 to RADIUS in their PPP module,...
by mpreissner
Wed Oct 04, 2017 11:19 pm
Forum: General
Topic: EOIP - If segmenting DHCP is so wrong and stupid... what is right and smart?
Replies: 3
Views: 523

Re: EOIP - If segmenting DHCP is so wrong and stupid... what is right and smart?

If you have to have the same layer 2 domain across both sites, then a split DHCP implementation is the best way to go. It ensures survivability for each site if the tunnel between the sites goes down. You should be able to achieve this with GRE, but if you already have EOIP working, I'd just stick w...
by mpreissner
Mon Apr 24, 2017 2:54 am
Forum: RouterBOARD hardware
Topic: Hardware Bonding?
Replies: 2
Views: 890

Re: Hardware Bonding?

LACP is supposed to be supported in the new version of SwOS (I think version 2.1 and up), and should be supported in a future version of ROS, but only on the CRS 3xx series switches (I think, could be wrong). The current port trunking is static link aggregation, and is not compatible with LACP.
by mpreissner
Sun Mar 19, 2017 11:43 pm
Forum: General
Topic: VPN directly to AVAYA 96xx phone
Replies: 5
Views: 1733

Re: VPN directly to AVAYA 96xx phone

Instead of using the phone's VPN client, why don't you set up an SBC on a public IP with your telephony servers (or port forward to it) and set the phone up to use SIP-TLS and SRTP...you'll achieve effectively the same thing...all RTP and signaling from the phone to any endpoint behind the SBC will ...
by mpreissner
Wed Mar 01, 2017 3:02 pm
Forum: General
Topic: SSTP Mikrotik-to-Mikrotik with RC4
Replies: 3
Views: 563

Re: SSTP Mikrotik-to-Mikrotik with RC4

I would recommend against anything meant to intentionally weaken encryption. RC4 is a deprecated protocol. All the major browsers and OS's have dropped support for it. If you're concerned about AES eating up too much CPU, then use a stronger router. The cost is inconsequential compared to the cost o...
by mpreissner
Tue Feb 28, 2017 2:40 pm
Forum: SwOS
Topic: CSS326-24G-2S+RM + 802.3ad
Replies: 9
Views: 4783

Re: CSS326-24G-2S+RM + 802.3ad

Yeah, I'm talking about SwOS too, given that this is the SwOS forum. You're right, LACP has been around in RouterOS for ROUTERS (i.e. in software), but it's currently unsupported for switches (i.e. in hardware). While you can technically implement it on the CRS line due to the limited layer 3 functi...
by mpreissner
Fri Feb 24, 2017 3:18 pm
Forum: SwOS
Topic: SMB bandwidth limit
Replies: 3
Views: 1216

Re: SMB bandwidth limit

Probably an issue in the queue config. I'm definitely not an expert with how MikroTik does QoS...I have no need for it on my network, so I don't think I can help you any further with it.
by mpreissner
Thu Feb 23, 2017 7:18 pm
Forum: SwOS
Topic: CSS326-24G-2S+RM + 802.3ad
Replies: 9
Views: 4783

Re: CSS326-24G-2S+RM + 802.3ad

LACP is in development. Not sure if it'll be supported on the CSS or other SwOS-only devices, but they do intend to support on the the new CRS3xx series which can dual-boot into SwOS or ROS. Might only be available on the ROS side when it is released.
by mpreissner
Wed Feb 22, 2017 4:29 pm
Forum: SwOS
Topic: SMB bandwidth limit
Replies: 3
Views: 1216

Re: SMB bandwidth limit

SMB uses TCP port 445 by default. The ports you've set up in your mangle rules are associated with NetBIOS.
by mpreissner
Fri Feb 17, 2017 7:08 pm
Forum: General
Topic: Detect Attack
Replies: 12
Views: 2421

Re: Detect Attack

You need to remember that the default action for MikroTik firewall is Accept. If you do not put a Drop All rule at the bottom of each firewall chain, your router will Accept all packets that hit that chain. This is a HUGE oversight from MikroTik in terms of security, but easily correctable. You need...
by mpreissner
Tue Jan 31, 2017 8:07 pm
Forum: SwOS
Topic: Using SwitchOS without ROUTERBOARD.
Replies: 1
Views: 906

Re: Using SwitchOS without ROUTERBOARD.

No. SwOS is a MikroTik proprietary operating system designed to run on specific hardware.
by mpreissner
Wed Jan 25, 2017 7:56 pm
Forum: RouterBOARD hardware
Topic: VPN performance of different RBs
Replies: 16
Views: 14091

Re: VPN performance of different RBs

They're slower because they use TCP instead of UDP, which is what gets them by firewalls...making them a pretty smart choice. As for congestion collapse...I've never had my SSTP tunnel collapse on me, but given that all the encryption is currently done in software, it's not hard to peg a CPU with a ...
by mpreissner
Wed Jan 25, 2017 2:42 pm
Forum: RouterBOARD hardware
Topic: VPN performance of different RBs
Replies: 16
Views: 14091

Re: VPN performance of different RBs

I don't think it's fair to call OpenVPN or SSTP dumb...depending on the environment, some organizations block just about everything outbound except TCP ports 80 and 443. In such situations, things like OpenVPN and SSTP are the only options, as they're the least likely to get block by outbound filter...
by mpreissner
Fri Jan 13, 2017 7:13 pm
Forum: Announcements
Topic: Winbox 3.8 released!
Replies: 47
Views: 18149

Re: Winbox 3.8 released!

Mac version doesn't appear to be available yet. Started Winbox 3.7 on my Mac, hit Check for Updates, came back No new updates available.
by mpreissner
Wed Jan 11, 2017 3:19 pm
Forum: Beginner Basics
Topic: VPN MAC OS
Replies: 15
Views: 5374

Re: VPN MAC OS

where should i find a trusted stable xca application? all the ones on sourceforge look so dodgy Sourceforge is the only reputable place to download XCA. True, the last update to the application was about 15 months ago, but I believe the developer still actively maintains it...just haven't been many...
by mpreissner
Mon Jan 09, 2017 1:44 pm
Forum: Beginner Basics
Topic: Radius server
Replies: 4
Views: 751

Re: Radius server

Look, I appreciate that you're trying to learn something, but this is a forum specifically for RouterOS and MikroTik products. If you want to ask a question about those, go right ahead, but this is not the place to learn general networking concepts and technologies. Sign up for a class at a local co...
by mpreissner
Fri Jan 06, 2017 8:09 pm
Forum: General
Topic: RoadWarrior VPN with certificate & Radius
Replies: 2
Views: 528

Re: RoadWarrior VPN with certificate & Radius

Duo Security is a good option if you need multifactor authentication of your users.
by mpreissner
Thu Jan 05, 2017 5:07 pm
Forum: RouterBOARD hardware
Topic: layer 3 Switch
Replies: 9
Views: 5027

Re: layer 3 Switch

If you actually use the layer 3 functionality of your current switch, the CRS will likely not hold up as it is effectively a layer 2 switch with minimal layer 3 capability (mostly just for management functionality). If all you need is wire-speed layer 2 in a managed switch, the CRS may work well, an...
by mpreissner
Thu Jan 05, 2017 5:02 pm
Forum: General
Topic: Blocking or limiting ICLOUD backup
Replies: 1
Views: 690

Re: Blocking or limiting ICLOUD backup

Intercept all DNS traffic and blackhole anything that goes out to an icloud URL.
by mpreissner
Tue Dec 27, 2016 6:39 pm
Forum: Beginner Basics
Topic: Seems some firewall settings disappear on power cycle
Replies: 10
Views: 1465

Re: Seems some firewall settings disappear on power cycle

Please refrain from making useless posts like this. If you're experiencing a problem, we need a detailed description if you expect any kind of help. What settings are disappearing?
by mpreissner
Fri Dec 23, 2016 9:22 pm
Forum: Beginner Basics
Topic: Please Help me im being attacked RIGHT NOW
Replies: 34
Views: 4915

Re: Please Help me im being attacked RIGHT NOW

If you write firewall rules like that, you'll end up missing things. Best practice is to create a rule that allows your management access, and then create a DROP ALL rule at the bottom of the chain. As you find you need to allow additional traffic, you simply add a rule above the DROP ALL rule. You ...
by mpreissner
Fri Dec 23, 2016 8:04 pm
Forum: Beginner Basics
Topic: Please Help me im being attacked RIGHT NOW
Replies: 34
Views: 4915

Re: Please Help me im being attacked RIGHT NOW

Add a firewall rule on the INPUT chain that only allows WinBox, SSH, and HTTPS from one of your internal networks. Then add a firewall rule right below that to drop all traffic to your device. These two rules ensure that ONLY traffic from you is allowed to go directly to your device.
by mpreissner
Fri Dec 23, 2016 4:30 pm
Forum: General
Topic: RB3011 Switch Chip and Frustration with Support
Replies: 4
Views: 1355

Re: RB3011 Switch Chip and Frustration with Support

Have you tried translating the untagged traffic into another VLAN? I think the biggest problem you're going to have is that Bridge only operates at the CPU...there is no hardware bridging implemented at the switch chip, so any bridging between the two switch chips is going to involve the CPU. I do t...
by mpreissner
Fri Dec 23, 2016 3:57 pm
Forum: Beginner Basics
Topic: VPN MAC OS
Replies: 15
Views: 5374

Re: VPN MAC OS

You can use any number of tools to generate your own certificates. I think MikroTik has the OpenSSL libraries in place to generate your own certs via command line, or you make your own from Terminal on your Mac. I like using the XCA application (available for Win, Mac, and *nix). It's a nice GUI pro...
by mpreissner
Fri Dec 23, 2016 3:54 pm
Forum: Beginner Basics
Topic: Setup with of CRS112-8G-4S-IN with Mgmt VLAN
Replies: 5
Views: 1748

Re: Setup with of CRS112-8G-4S-IN with Mgmt VLAN

So, your egress vlan tag section should only include ether1, ether 8, and switch1-cpu, since you said that you're treating ether2-7 as untagged (access) ports. You'll use the ingress-vlan-translation section to set the default VLAN ID for those ports. You didn't include your ip > firewall section, w...
by mpreissner
Thu Dec 22, 2016 7:06 pm
Forum: Beginner Basics
Topic: Setup with of CRS112-8G-4S-IN with Mgmt VLAN
Replies: 5
Views: 1748

Re: Setup with of CRS112-8G-4S-IN with Mgmt VLAN

If you want wire-speed layer 2 switching, then you need the master/slave relationship in place. It doesn't really matter which port acts as the "master" though, since they all share a single 1 gbps link to the CPU anyway. I'd recommend you do all configuration via the Console port until you have the...
by mpreissner
Wed Dec 21, 2016 5:35 pm
Forum: Announcements
Topic: MikroTik News December 2016 (Issue #74)
Replies: 94
Views: 22207

Re: MikroTik News December 2016 (Issue #74)

Any druthers on pricing for the new CRS317? Will you also start offering your own 10GBASE-T SFP+ module to support Cat-6a copper runs? Cheapest 10GBASE-T module I've found is about $370, with many wanting $500+.
by mpreissner
Thu Dec 15, 2016 9:50 pm
Forum: Virtualization
Topic: oVirt Guest Agent for KVM
Replies: 0
Views: 664

oVirt Guest Agent for KVM

Anyone looked at the possibility of installing the oVirt guest agent into the CHR for use on KVM?
by mpreissner
Thu Dec 08, 2016 5:36 pm
Forum: General
Topic: Strange connection drops
Replies: 1
Views: 410

Strange connection drops

RB750GL and CRS226 both running 6.34.1. Services like Skype and Jabber keep dropping/reconnecting across multiple computers. None of my coworkers (all remote) are experiencing this, so it's got to be either my ISP connection or something in my home network. I'm not seeing any packet drops or errors ...
by mpreissner
Fri Dec 02, 2016 7:47 pm
Forum: General
Topic: Can I allow only specific IPs to login via telnet?
Replies: 5
Views: 843

Re: Can I allow only specific IPs to login via telnet?

Why do you even have telnet open? It's an old and insecure protocol, you should only be using SSH.
This. Stop using unsecure protocols!
by mpreissner
Tue Nov 29, 2016 7:02 pm
Forum: General
Topic: Setting MTU above 1500 for WAN
Replies: 3
Views: 797

Re: Setting MTU above 1500 for WAN

You need to consult your ISP. There will be absolutely no benefit if they don't support a higher MTU.
by mpreissner
Fri Nov 25, 2016 6:45 pm
Forum: General
Topic: EAP support for SSTP
Replies: 0
Views: 433

EAP support for SSTP

Any chance we can get EAP support for SSTP VPN? I have everything working from Windows 7 clients using MS-CHAPv2, but I'd love to use PEAP with EAP-MS-CHAPv2. Since EAP support is already available to the wireless/hotspot functionality in ROS, I can't imagine it would be a huge development effort to...
by mpreissner
Thu Nov 17, 2016 5:48 pm
Forum: RouterBOARD hardware
Topic: RB3011 right for Dual WAN (Fail Over) and Gig Lan?
Replies: 6
Views: 2364

Re: RB3011 right for Dual WAN (Fail Over) and Gig Lan?

I would add to pukkita's response... 4) Will it support VPN from Windows 10 based clients? About 4-5 VPN users at a time. Yes. It does support "Windows-native" SSTP. While it does support SSTP, it does not support NAP, nor does it support any type of EAP for authentication. If you intend to use the ...
by mpreissner
Thu Nov 17, 2016 5:33 pm
Forum: General
Topic: CRS212-1G-10S-1S+IN used for routing purposes
Replies: 5
Views: 724

Re: CRS212-1G-10S-1S+IN used for routing purposes

You don't want to run bandwidth tests FROM the devices themselves, you want to run the tests THROUGH the devices. All CRS devices have weak CPUs, so they simply can't support the kind of results you're expecting using the traffic generator. The CRS is primarily a layer-2 device, and can pass layer-2...
by mpreissner
Wed Nov 16, 2016 7:38 pm
Forum: Beginner Basics
Topic: Mikrotik Firewall Basics
Replies: 8
Views: 1639

Re: Mikrotik Firewall Basics

If you use Winbox, you can actually filter your rules by chain, so you can work with only one chain at a time. Makes things a little easier to see.
by mpreissner
Tue Nov 15, 2016 12:59 pm
Forum: General
Topic: Why source-based blackhole instead of firewall drop
Replies: 49
Views: 12829

Re: Why source-based blackhole instead of firewall drop

I think what this post really says is DON'T USE A MIKROTIK FOR FIREWALLING.
by mpreissner
Thu Nov 10, 2016 7:58 pm
Forum: RouterBOARD hardware
Topic: SFP+ Switch
Replies: 2
Views: 564

Re: SFP+ Switch

No. All their current products are listed on www.routerboard.com. If it's not there, it doesn't exist yet.
by mpreissner
Tue Nov 08, 2016 2:45 pm
Forum: Beginner Basics
Topic: Port Forwarding Issue
Replies: 19
Views: 2559

Re: Port Forwarding Issue

So here's the thing to remember: RouterOS process NAT rules before it does Filter rules, so an Accept rule on the input chain will never get hit if you're NATing the traffic. If you want to forward external port 8150 to port 80 on your camera, you need to do 2 things: 1) add the appropriate dst-nat ...
by mpreissner
Mon Nov 07, 2016 4:57 pm
Forum: Beginner Basics
Topic: Forward Ports for OpenVPN
Replies: 6
Views: 6916

Re: Forward Ports for OpenVPN

The best thing to do is to end all chains with the following: /ip firewall filter action=drop This drops ALL traffic that does not match an explicit allow rule above it. You can optionally add a log=yes and log-prefix="drop-<chain>-and-log" parameters so you can trace down any dropped traffic that y...
by mpreissner
Mon Nov 07, 2016 3:02 pm
Forum: Beginner Basics
Topic: Forward Ports for OpenVPN
Replies: 6
Views: 6916

Re: Forward Ports for OpenVPN

Proximus - do you have a "Drop All" rule at the bottom of your forward chain? By default, ROS uses an Accept All policy, which you can't actually change, so if you're not dropping unwanted forwarding traffic with an explicit rule at the bottom of your forward chain, then you're correct, you won't ne...
by mpreissner
Mon Nov 07, 2016 1:32 pm
Forum: Beginner Basics
Topic: Forward Ports for OpenVPN
Replies: 6
Views: 6916

Re: Forward Ports for OpenVPN

You need 2 rules to properly port forward. You already have the NAT rule, but now you need a filter rule in the FORWARD chain. Use this...assuming your inbound interface is ether1: /ip firewall filter add chain=forward dst-port=1194 protocol=udp dst-address=10.0.0.3 in-interface=ether1 action=accept
by mpreissner
Sat Nov 05, 2016 1:45 pm
Forum: Virtualization
Topic: Sucessful Amazon CHR RouterOS Test
Replies: 24
Views: 6092

Re: Sucessful Amazon CHR RouterOS Test

I would imagine that if you can emulate any ROS supported CPU, you can probably install that platform into a virtual machine. You'll have to keep in mind, though, that the drivers bundled with any given platform are for the hardware in those supported platforms, so you may not have all the drivers n...
by mpreissner
Fri Nov 04, 2016 12:35 pm
Forum: General
Topic: CVE-2016-5195, DirtyCow
Replies: 4
Views: 903

Re: CVE-2016-5195, DirtyCow

So think of it like this...the vulnerability is present, but it is irrelevant because everything runs as root. The DirtyCOW vulnerability is used to escalate privileges from a non-root user to root. If nothing runs as a non-root user, then there's really no local accounts that would need to escalate...
by mpreissner
Fri Oct 28, 2016 5:09 pm
Forum: General
Topic: Expected throughput on x86 board with 10GBE ports
Replies: 12
Views: 2429

Re: Expected throughput on x86 board with 10GBE ports

If a hardware platform has limitations on handling a physical port, then why that port is even there to begin with? Just my thought of course. I was not expecting much from the CRS, but at least to handling file transfers from two workstations connected to 1GB ports and a SAN connected to the 10GBE...
by mpreissner
Wed Oct 26, 2016 1:21 pm
Forum: Virtualization
Topic: CHR on bare metal
Replies: 13
Views: 2442

Re: CHR on bare metal

A single licensing scheme would be nice. Something to the effect of this: You purchase X number of licenses, which are tracked through a support portal. When you install an instance of ROS (virtual or bare metal), you input a key obtained from the support portal that is linked to your account. The r...
by mpreissner
Wed Oct 26, 2016 1:01 am
Forum: Beginner Basics
Topic: Super EASY VPN for macOS
Replies: 11
Views: 9523

Re: Super EASY VPN for macOS

Use L2TP over IPsec. You should find plenty of documentation on how to set up MikroTik side.
by mpreissner
Tue Oct 25, 2016 1:18 pm
Forum: Virtualization
Topic: CHR on bare metal
Replies: 13
Views: 2442

Re: CHR on bare metal

Hmm...it seems to me that you can do exactly what you're saying. Just buy an ROS license (most people would probably do well with a level 4 license - $45) and install using x86. You just have to remember that even the x86 platform doesn't support all hardware, so you'll need the check for compatibil...
by mpreissner
Mon Oct 24, 2016 8:58 pm
Forum: Virtualization
Topic: CHR on bare metal
Replies: 13
Views: 2442

Re: CHR on bare metal

Oh, he's just upset because he didn't take the time to understand that CHR is virtual ONLY and didn't get appropriate hardware to support it. And apparently it's OUR problem. HAHAHA
by mpreissner
Fri Oct 21, 2016 2:47 pm
Forum: Virtualization
Topic: CHR on bare metal
Replies: 13
Views: 2442

Re: CHR on bare metal

The CHR doesn't have all the drivers it would need to run on bare metal. It is intended to ONLY run in a hypervisor as a guest virtual machine. If your intent was to run virtual machines, you should've picked up hardware that has native support for virtualization. Even cheap $200 barebones systems n...
by mpreissner
Tue Oct 18, 2016 10:42 pm
Forum: General
Topic: Port hybrid CRS226
Replies: 3
Views: 701

Re: Port hybrid CRS226

So there are a few things you need to consider. You're running multiple VLANs, but you haven't made any mention of a router or bridge to allow for inter-VLAN communications. Both the CRS226 and CRS125 have limited routing capabilities (the 125 actually has a stronger CPU), and so they can function a...
by mpreissner
Tue Oct 18, 2016 4:14 pm
Forum: General
Topic: Port hybrid CRS226
Replies: 3
Views: 701

Re: Port hybrid CRS226

How is your DHCP set up? Do you have a DHCP server or relay configured for each VLAN? Have you defined IP Pools/DHCP Scopes?
by mpreissner
Sat Oct 15, 2016 1:30 am
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

Not only that, but the CPU is also optimized specifically for networking functions. The latest numbering scheme with the Xeon CPU's uses the last digit in the product code to identify different CPU optimizations. For instance, the Xeon D-1520 is a general purpose CPU, good for running any OS, virtua...
by mpreissner
Sat Oct 15, 2016 1:20 am
Forum: General
Topic: DHCP in VRRP configuration
Replies: 6
Views: 2819

Re: DHCP in VRRP configuration

Best practice would be to not use the routers as the DHCP server. They don't share any state information with each other when doing VRRP, so I can only assume they wouldn't share DHCP lease information. Set up a DHCP relay on the VRRP interface and point it to a standalone DHCP server.
by mpreissner
Tue Oct 11, 2016 5:38 pm
Forum: Announcements
Topic: Winbox 3.7 released!
Replies: 63
Views: 111345

Re: Winbox 3.7 released!

Interesting how they've release Winbox with support for 6.38 when 6.38 is still only in RC release...I'd think they should release Winbox and ROS at the same time.
by mpreissner
Tue Oct 11, 2016 5:30 pm
Forum: General
Topic: Torch not working with CRS226-24G-2S+
Replies: 5
Views: 717

Re: Torch not working with CRS226-24G-2S+

But, when using Bridge, all ports share a single 1 gbps link to the CPU, so your layer 2 performance will suffer horribly. If you need to see all the traffic from a single port when using Master/slave port configuration, use port mirroring.
by mpreissner
Tue Oct 11, 2016 5:23 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

Don't be that optimistic about that 35W power consumption. A RAM module can draw up to 15W... And there are other parts inside it, too. They did not put that 200W power supply in there for nothing. You're right, but the CPU is typically the most power-hungry component in any computer, short of a hi...
by mpreissner
Sun Oct 09, 2016 3:50 pm
Forum: RouterBOARD hardware
Topic: New CRS hardware? Show us some love
Replies: 23
Views: 4267

Re: New CRS hardware? Show us some love

RB260GSP with outdoor enclosure would be very welcome or RB750P outdoor Powerbox with gigabit ports.

RB260GS in outdoor enclosure with 4x or 5x POE in would be great.
This thread is specifically for CRS hardware, not SwOS based prodcuts...
by mpreissner
Fri Oct 07, 2016 5:48 pm
Forum: RouterBOARD hardware
Topic: CRS226-24S-2S+RM ?
Replies: 3
Views: 762

Re: CRS226-24S-2S+RM ?

The new 6.38RC software enables STP/RSTP on the CRS...hopefully those features will make it to the final release. I've never seen issues like you seem to be having. The CRS can be tricky to configure, so I'd double check your configs again. Might be something simple you overlooked. Otherwise, nobody...
by mpreissner
Tue Oct 04, 2016 1:26 pm
Forum: SwOS
Topic: Spanning Tree Protocol
Replies: 26
Views: 16417

Re: Spanning Tree Protocol

Since the CRS's run ROS, not SwOS, it would probably be worth posting this info in one of the main ROS forums...probably the General forum. Not a huge number of people troll the SwOS forum, so you'll get more exposure there.
by mpreissner
Mon Oct 03, 2016 6:07 pm
Forum: SwOS
Topic: Spanning Tree Protocol
Replies: 26
Views: 16417

Re: Spanning Tree Protocol

Well, that's promising, but I'm not going to run RC firmware on my production network. Since it appears to require adding your master ports to a bridge to enable the switch-chip functionality, I wonder what the performance impact will be on the CRS CPU as a result of implementing STP.
by mpreissner
Fri Sep 30, 2016 4:39 pm
Forum: SwOS
Topic: Feature Request: Support for HTTPS
Replies: 1
Views: 770

Re: Feature Request: Support for HTTPS

This has been requested before. Not likely to happen. Ever. I have a feeling that the SwOS products are going to get discontinued at some point as MT really doesn't appear to put much time/effort into SwOS development. They're more focused on their CCR and CRS product lines, and ROSv7 dev.
by mpreissner
Mon Sep 26, 2016 3:41 pm
Forum: RouterBOARD hardware
Topic: wAP AC (General questions and experience)
Replies: 118
Views: 44337

Re: wAP AC (General questions and experience)

It can establish a VPN connection, but it doesn't have accelerated cryptography support, and so it's going to max out at several tens of megabits/second. Putting a router on-site with accelerated crypto (850, 1100, CCR), and letting the APs connect to the CHR/VPN through that will help to reach max...
by mpreissner
Fri Sep 23, 2016 2:58 pm
Forum: RouterBOARD hardware
Topic: wAP AC (General questions and experience)
Replies: 118
Views: 44337

Re: wAP AC (General questions and experience)

I'm hoping some of you can answer this question, as I haven't messed around with any MT wireless gear. I'm currently operating a corporate network in the cloud, and we're looking to extend secure wireless access to remote locations. If I've got a CHR acting as a VPN head to our cloud environment, ca...
by mpreissner
Thu Sep 22, 2016 4:33 pm
Forum: General
Topic: NSA and routeros
Replies: 27
Views: 6204

Re: NSA and routeros

The storage is not a problem. Since it is all text based information in a database it can be compacted to the maximum (I have see Oracle databases of 450 Mb been reduced to 14 kB files....). And what LaRP says: Yes, it is a backdoor. Not on Mikrotik or any router, but it is in essence a "door" whic...
by mpreissner
Thu Sep 22, 2016 1:30 pm
Forum: SwOS
Topic: Spanning Tree Protocol
Replies: 26
Views: 16417

Re: Spanning Tree Protocol

I agree...I bought into MikroTik for my home because I thought I was getting a good deal for a switch with 10gb ports, but the inability to make redundant switching paths or do 802.3ad based aggregation has become a serious issue for me. I feel I'd almost be better off switching my core network over...
by mpreissner
Fri Sep 16, 2016 1:14 pm
Forum: Beginner Basics
Topic: Question about VLAN
Replies: 5
Views: 794

Re: Question about VLAN

Switch VLAN settings control what VLAN tags your switch will allow or process. Creating a VLAN interface creates it at the CPU, which is necessary for inter-VLAN routing. The CRS can do some limited routing, but its CPU isn't strong enough for heavy use.
by mpreissner
Tue Sep 13, 2016 7:44 pm
Forum: Beginner Basics
Topic: Help Please - QoS for VoIP over a WAN
Replies: 5
Views: 827

Re: Help Please - QoS for VoIP over a WAN

One way you could go is to procure a SIP trunk service from your ISP. Effectively, this will cause all traffic for your VoIP calls to go over a special network the provider uses specifically for VoIP. If you have an IP PBX at each site with SIP trunk service at each site, you should get great call q...
by mpreissner
Mon Sep 12, 2016 2:50 pm
Forum: General
Topic: Recommended requirments
Replies: 2
Views: 494

Re: Recommended requirments

If you're running a virtual solution, go with CHR instead of x86. Resource requirements aren't really any different, but the CHR is 64-bit versus x86 which is only 32-bit. Will make a difference if you're running BGP or other high memory loads.
by mpreissner
Mon Sep 12, 2016 2:47 pm
Forum: Beginner Basics
Topic: Help Please - QoS for VoIP over a WAN
Replies: 5
Views: 827

Re: Help Please - QoS for VoIP over a WAN

You may not have any issues at all using QoS. Many provider do state that QoS is not supported across the Internet, but especially if all your offices are on the same ISP, and you're using business class Internet service, QoS is likely enabled, but they won't tell anyone about it. Most ISP's now off...
by mpreissner
Thu Sep 08, 2016 6:59 pm
Forum: General
Topic: RouterOS as simple switch using bridge or master port
Replies: 6
Views: 2437

Re: RouterOS as simple switch using bridge or master port

are vlans proccesed in the cpu or in the switch chip directly ? VLANs can be handled at both the switch chip and the CPU. The switch chips are VLAN-aware so you can support multiple logical switches on a single piece of hardware. To route between VLANs, though, you have to make the CPU aware of the...
by mpreissner
Thu Sep 08, 2016 5:13 pm
Forum: Beginner Basics
Topic: Port forwarding doesn't work
Replies: 5
Views: 939

Re: Port forwarding doesn't work

What you need to remember is that packets processed by dst-nat have to come from somewhere. Right now, you only have a dst-port defined. Try adding an in-interface parameter or a dst-address parameter to your NAT rule. If you have a dynamic public IP, I'd recommend simply defining the in-interface a...
by mpreissner
Thu Sep 08, 2016 5:05 pm
Forum: Beginner Basics
Topic: Portforwarding based on DNS name
Replies: 9
Views: 3643

Re: Portforwarding based on DNS name

Thank you, this was helpfull. I am trying to do a similar thing. The proxy works and I get to the user access page on the individual servers behind the one public address using the reverse proxy. The problem is that after logging into my services the API is not http so the connection breaks. I am t...
by mpreissner
Thu Sep 08, 2016 1:48 pm
Forum: RouterBOARD hardware
Topic: New CRS hardware? Show us some love
Replies: 23
Views: 4267

Re: New CRS hardware? Show us some love

I just want to see a low power, low cost 24 port 10gb SFP+ switch...maybe with stacking cables or 40gbps uplinks. Although stacking would be preferred so you could treat multiple stacked units as a single switch and only have one management IP. Or a version of ROS that we could load on ODM switches ...
by mpreissner
Thu Sep 08, 2016 1:43 pm
Forum: Beginner Basics
Topic: CRS 109 without Master Port
Replies: 5
Views: 965

Re: CRS 109 without Master Port

Yes, if you remove the master/slave configuration, it's the same as directly connecting the port to the CPU. Unfortunately, in the CRS, all ports share a singe 1 gbps link to the CPU, so it's a major bottleneck. Using bridging on a CRS is not advisable. The key to working with the CRS is proper conf...
by mpreissner
Wed Sep 07, 2016 1:12 pm
Forum: Beginner Basics
Topic: CRS 109 without Master Port
Replies: 5
Views: 965

Re: CRS 109 without Master Port

While you can use the CRS as a router, the CPU is very weak and you will not get great results depending on your needs. Since port 1 is your WAN, I'd make port 2 the master to all other ports. This allows you to take advantage of the switch chip and run layer 2 communications at wire speed.
by mpreissner
Wed Sep 07, 2016 1:33 am
Forum: General
Topic: Feature requests
Replies: 1159
Views: 207350

Re: Feature requests

Hi There, We are using a Supermicro 5018 MLNT4 (https://www.supermicro.com/products/system/1U/5018/SYS-5018A-MLTN4.cfm) with onboard C2000 SoC I354 Quad Nic. This nic is not supportes... PLEASE ADD THE DRIVERS ! You're best bet there is to install a hypervisor on that server and run the CHR rather ...
by mpreissner
Tue Sep 06, 2016 1:18 pm
Forum: SwOS
Topic: VLANs VS Bridges
Replies: 10
Views: 4775

Re: VLANs VS Bridges

I like to think of the "port" not as the physical interface that I plug a cable into, but rather as an addressable part of the logic board. Remember, even "switch1-cpu" is considered a port. MikroTik's description tripped me up a lot when I first started with RouterOS, but you'll get the hang of it ...
by mpreissner
Mon Sep 05, 2016 5:46 pm
Forum: General
Topic: Feature requests
Replies: 1159
Views: 207350

Re: Feature requests

Please add support for EAP types on VPN connections as you do for wireless. Without EAP support, many security features such as NAP enforcement (using Microsoft NPS as RADIUS) won't work. Specifically, we need support for PEAP and EAP-MSCHAPv2 to get NAP working. Also consider allowing the ability t...
by mpreissner
Sat Sep 03, 2016 2:47 pm
Forum: General
Topic: SSTP with EAP?
Replies: 0
Views: 388

SSTP with EAP?

So, it doesn't look like anyone responded to my thread about implementing SSTP with NAP, but has anyone gotten EAP working with the SSTP server? I don't really care what type, I'll be happy with EAP-MSCHAPv2 or PEAP (eventually want to use smart cards for user certificate based auth), but for now, I...
by mpreissner
Sat Sep 03, 2016 2:42 pm
Forum: Beginner Basics
Topic: CRS226 IP network and SFP+ question
Replies: 1
Views: 280

Re: CRS226 IP network and SFP+ question

Treat the SFP+ ports as normal ports. It all comes down to how you configure them. I have a storage server plugged into one, and a hypervisor plugged into the other on mine. You can use them as either access or trunk ports...that's the beauty of ROS...they let you do what you want with the ports ins...
by mpreissner
Thu Sep 01, 2016 6:15 pm
Forum: General
Topic: Default VLAN (PVID / native vlan) + VLAN on one port
Replies: 14
Views: 11953

Re: Default VLAN (PVID / native vlan) + VLAN on one port

What you're doing is creating a hybrid port. See the wiki...http://wiki.mikrotik.com/wiki/Manual:Sw ... d_Ports.29
by mpreissner
Wed Aug 31, 2016 1:31 am
Forum: General
Topic: SSTP VPN with NAP
Replies: 0
Views: 285

SSTP VPN with NAP

So I've successfully gotten an SSTP VPN set up on my 750GL, authenticating against Microsoft NPS/Active Directory on Server 2012r2. The next step is to see if I can use NPS for NAP enforcement on my remote Windows 7 clients. Has anyone tried this? I have to make sure I can support this to phase out ...
by mpreissner
Mon Aug 29, 2016 7:28 pm
Forum: Beginner Basics
Topic: Firewall high cpu on CRS112-8G-4S
Replies: 7
Views: 1336

Re: Firewall high cpu on CRS112-8G-4S

So I've made an effort to give you a working config that is also, for the most part, secure. It will need tweaking depending on your exact networking needs. There are also a few parts where you'll need to insert information, such as defining NTP servers for your switch. Note that I've made some chan...
by mpreissner
Mon Aug 29, 2016 6:03 pm
Forum: Beginner Basics
Topic: Firewall high cpu on CRS112-8G-4S
Replies: 7
Views: 1336

Re: Firewall high cpu on CRS112-8G-4S

Looks like your firewall is doing a lot of work - way more than it should have to. Give me some time to rework your config...I think we can come up with something a bit simpler. Can you post a full export instead of a compact? Need to look at the full firewall rules to find out what's going on. Quic...
by mpreissner
Mon Aug 29, 2016 3:10 pm
Forum: Beginner Basics
Topic: Firewall high cpu on CRS112-8G-4S
Replies: 7
Views: 1336

Re: Firewall high cpu on CRS112-8G-4S

Yeah, you definitely don't want to user bridging for what seems to be simple layer 2 operations. Better to not use bridging at all...rely on the switch chip for layer 2, and only use the CPU for routing. The CRS really isn't meant for CPU intensive tasks like routing or bridging...the layer 3 functi...
by mpreissner
Thu Aug 25, 2016 1:35 pm
Forum: RouterBOARD hardware
Topic: Super High End/Overkill Home Router Build
Replies: 13
Views: 3491

Re: Super High End/Overkill Home Router Build

Use CCR1009-8S-1S+ for routing, and CRS226 for switching. Link them via SFP+, and run dedicated WAPs instead of something built in. The new wAP AC's look pretty nice and will provide you a much more flexible installation, better wireless coverage, and great speeds throughout the house.
by mpreissner
Thu Aug 25, 2016 1:30 pm
Forum: General
Topic: ROS v6 x86 and SFP cards (Problems?)
Replies: 3
Views: 748

Re: ROS v6 x86 and SFP cards (Problems?)

Sounds like a problem related to MTU vs. L2MTU. Check your settings.
by mpreissner
Tue Aug 23, 2016 7:14 pm
Forum: RouterBOARD hardware
Topic: CRS226-24G-2S+ issue - hangs
Replies: 13
Views: 3100

Re: CRS226-24G-2S+ issue - hangs

First, nobody can begin to postulate on what the issue may be that's causing this behavior, as you haven't provided much information regarding your setup. Second, this is a user forum, and while many MikroTik employees are active here, is not the official MikroTik support channel. If you're having a...
by mpreissner
Tue Aug 23, 2016 1:31 pm
Forum: Beginner Basics
Topic: guest wifi via VLAN
Replies: 13
Views: 2187

Re: guest wifi via VLAN

The switch chip does all the tagging. You have to add switch1-cpu to parts of the configuration so the CPU can understand which VLANs each packet belongs to.
by mpreissner
Mon Aug 22, 2016 8:53 pm
Forum: Beginner Basics
Topic: guest wifi via VLAN
Replies: 13
Views: 2187

Re: guest wifi via VLAN

Since speed isn't really a factor, you can use the CRS as your router, assuming your ISP connects via RJ45 or SFP. Set port 1 as your ISP uplink (assuming RJ45, otherwise set SFP), make port 2 the master port, and all other ports slave. Apply your two VLANs to port 2 from the Interfaces menu. From t...
by mpreissner
Mon Aug 22, 2016 4:04 pm
Forum: Beginner Basics
Topic: guest wifi via VLAN
Replies: 13
Views: 2187

Re: guest wifi via VLAN

Personally, I would ditch the bridges. The CRS is meant as a switch, and as such, it has a weak CPU. Bridging operates at the CPU, so this is a waste of resources at the CRS, especially considering the hardware supports wire-speed switching without touching the CPU. If you don't have a separate rout...
by mpreissner
Thu Aug 18, 2016 7:04 pm
Forum: RouterBOARD hardware
Topic: RouterBOARD 260GS speed on LANS ???
Replies: 2
Views: 601

Re: RouterBOARD 260GS speed on LANS ???

So, to start, it looks like your SXT isn't advertising at 1000M. Check the "Ethernet" tab for your SXT interface and ensure that 1000M full and Auto Negotiation is checked. Can't say what's going on at the Lenovo...perhaps you've got an outdated driver, or maybe a bad cable. 100M ethernet only uses ...
by mpreissner
Fri Aug 12, 2016 5:20 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

Hii, just t make sure guys, i want to buy this SuperServer 5018D-FN8T and installed mikrotik on it, is this device support mikrotik ROS? are the built in 10G NICs working fine? You can try to install the x86 ROS on it, but it may not work with all the NICs. Best bet is to run a hypervisor like VMwa...
by mpreissner
Wed Aug 10, 2016 1:29 am
Forum: RouterBOARD hardware
Topic: Mikrotik ATA
Replies: 16
Views: 2940

Re: Mikrotik ATA

Yup, almost everything these days is either H.323 or SIP. If you have an actual POTS line at your home, chances are it's hitting a TDP/SIP gateway of some type at the CO, and then flying across the provider's fiber backbone. I spent several years deploying and managing an enterprise-wide VoIP soluti...
by mpreissner
Mon Aug 08, 2016 8:10 pm
Forum: General
Topic: Problem with V6 and X86 in VMWARE
Replies: 6
Views: 1549

Re: Problem with V6 and X86 in VMWARE

If your use case requires a large amount of RAM, the x86 won't be able to handle it. Max RAM for the x86 ROS is only 2 GB. The CHR is 64-bit, and can address as much RAM as you could possibly need.
by mpreissner
Sat Aug 06, 2016 5:00 am
Forum: SwOS
Topic: Spanning Tree Protocol
Replies: 26
Views: 16417

Re: Spanning Tree Protocol

STP is already supported in ROS when using bridges. STP is currently not implemented on CRS, and it doesn't look like MT has any real plans of implementing it despite a lot of desire for it from the forums.
by mpreissner
Fri Jul 22, 2016 5:00 pm
Forum: General
Topic: Possible YouTube video ideas
Replies: 29
Views: 3571

Re: Possible YouTube video ideas

Love this idea!  I think, though, that you probably will need to get into some How-To's, as theory can be applied across all vendor's equipment assuming they support the same features.  I think where the MT community is lacking is clear understanding on how to implement some of various technologies ...
by mpreissner
Fri Jul 22, 2016 2:24 am
Forum: RouterBOARD hardware
Topic: CRS as PPPoE Server - Low Performance
Replies: 19
Views: 2760

Re: CRS as PPPoE Server - Low Performance

Change the hardware.  The CRS is intended to be used AS A SWITCH.  It's layer 3 capabilities (including PPPoE) run on the CPU, not the switch chip, and the CPU is too weak to do much.  Bridging also runs at the CPU, so not only are you taxing it with PPPoE, but also with the bridging.  You're runnin...
by mpreissner
Fri Jul 22, 2016 2:21 am
Forum: RouterBOARD hardware
Topic: Small switch big performance
Replies: 14
Views: 2475

Re: Small switch big performance

So, give up on LACP on the CRS...it doesn't exist.  CRS only supports static link aggregation (NOT 802.3ad compliant).  You can do 802.3ad at the CCR through bonding, but the CRS doesn't have enough CPU to support even 1 gbps of throughput over bonded ports.  Not sure how it would work if you had LA...
by mpreissner
Fri Jul 22, 2016 2:09 am
Forum: RouterBOARD hardware
Topic: CCR, "enterprise ready", seriously???
Replies: 35
Views: 5786

Re: RE: Re: CCR,

I don't think you know what a core router does. Core routers run routing protocols and mpls. Redundancy is done via these.  Now I agree a firewall should have such a mechanism, but mikrotik are routers. So, I think you and I are thinking of two different types of networks.  You're thinking Enterpri...
by mpreissner
Thu Jul 21, 2016 1:26 pm
Forum: RouterBOARD hardware
Topic: CCR, "enterprise ready", seriously???
Replies: 35
Views: 5786

Re: CCR, "enterprise ready", seriously???

All about risk management. Four letters... VRRP. Sent from my SM-G920I using Tapatalk VRRP is great for edge routers, but not for core routers.  MT really needs to implement a different type of clustering that supports state synchronization for seamless failover without dropping connections.  Then,...
by mpreissner
Wed Jul 20, 2016 1:41 am
Forum: General
Topic: REQ: More Examples for Switch Chip
Replies: 2
Views: 401

Re: REQ: More Examples for Switch Chip

On CRS or other devices with switch chip?
by mpreissner
Tue Jul 19, 2016 3:35 pm
Forum: General
Topic: Mikrotik ha, anyone tried this?
Replies: 5
Views: 2554

Re: Mikrotik ha, anyone tried this?

Looks pretty neat, but without official support, I doubt many would try it.  Personally, I would love to see a CARP implementation, or some other extension of VRRP that supports state synchronization and HA auto-failover.  Also a simplified multi-WAN load balancing capability would be nice.  I'm abo...
by mpreissner
Fri Jul 15, 2016 1:43 pm
Forum: Beginner Basics
Topic: Bond confusion
Replies: 2
Views: 442

Re: Bond confusion

I don't think you're going to have much success doing what you describe.  Bonding is performed at the CPU, whereas master/slave is a switch chip function.  Bonded ports have to be passed through to the CPU instead of using a master/slave configuration.  Now, you could easily pass the two SFP ports t...
by mpreissner
Mon Jul 11, 2016 1:53 am
Forum: General
Topic: core router configuration copying
Replies: 2
Views: 492

Re: core router configuration copying

Keep in mind that the CCR1009 has a switch chip for the first four ports...that part of the config won't be applicable anymore, but there's no reason the rest of the config shouldn't be valid.
by mpreissner
Thu Jul 07, 2016 9:28 pm
Forum: General
Topic: Cloud Router Switch CPU usage 100%
Replies: 7
Views: 2697

Re: Cloud Router Switch CPU usage 100%

Yes, fasttrack is a wonderful thing.  Keep in mind though, that not all connections can use fasttrack, so depending on the specific connections that end up getting routed through your CRS, they may or may not get fasttracked, so user speeds can vary significantly.
by mpreissner
Thu Jul 07, 2016 1:42 pm
Forum: General
Topic: Cloud Router Switch CPU usage 100%
Replies: 7
Views: 2697

Re: Cloud Router Switch CPU usage 100%

You're using a CRS, which is intended to be used as a switch.  It has a very weak CPU, so layer 3 capabilities are minimal - mostly just there for management purposes.  If you run bandwidth tests between two endpoints on the same subnet, you should see wire-speed as that never goes to the CPU.  Depe...
by mpreissner
Thu Jul 07, 2016 1:30 pm
Forum: General
Topic: Serial Console Issue on CRS226-24G-2S+
Replies: 4
Views: 689

Re: Serial Console Issue on CRS226-24G-2S+

Good to know.  I haven't used the serial console.  I typically do most of my config via SSH or WinBox.  You might want to try WinBox, as it can connect at layer 2, so even if you screw something up in the config and lock yourself out of the WebFig or SSH, you usually can still connect with WinBox.
by mpreissner
Thu Jul 07, 2016 1:28 pm
Forum: General
Topic: (Solved) fasttrack connection
Replies: 6
Views: 1236

Re: fasttrack connection

Download iperf to endpoints on either side of your routers.  As said by others, you need to test THROUGH the router, not FROM the router.
by mpreissner
Thu Jul 07, 2016 2:40 am
Forum: General
Topic: Serial Console Issue on CRS226-24G-2S+
Replies: 4
Views: 689

Re: Serial Console Issue on CRS226-24G-2S+

Try 9600 baud.  It's very rare to find a serial connection that runs at 115200.
by mpreissner
Wed Jul 06, 2016 1:48 am
Forum: RouterBOARD hardware
Topic: CRS 226-RM IEEE 802.3ad missing??
Replies: 31
Views: 9080

Re: CRS 226-RM IEEE 802.3ad missing??


I also hope that 8)
Hope is a virtue...even when misplaced haha
by mpreissner
Wed Jul 06, 2016 1:46 am
Forum: General
Topic: 11+ Port Router/Switch
Replies: 4
Views: 773

Re: 11+ Port Router/Switch

If it's not on www.routerboard.com, it doesn't exist.
by mpreissner
Wed Jul 06, 2016 1:45 am
Forum: General
Topic: Configuring VLANs on CRS for Ubiquiti
Replies: 4
Views: 772

Re: Configuring VLANs on CRS for Ubiquiti

I've never had to use egress-vlan-translation to get my Ubiquiti AP's working correctly, so I'm not sure why you did.  As far as you WAN connection dropping, it does seem to be something in the routing.  One thing to remember is that while the CRS does have routing capabilities, it's weak CPU limits...
by mpreissner
Mon Jul 04, 2016 10:51 pm
Forum: General
Topic: VPN Over IPv6 ? How?
Replies: 7
Views: 1259

Re: VPN Over IPv6 ? How?

Your question has little meaning without more detail.  What kind of environment is this?  What is the purpose...are you trying to tunnel your internal network to an IPV6 broker because your ISP only provides IPv4 at this time?  Or just trying to set up a VPN server to listen on an IPv6 address?  Nob...
by mpreissner
Mon Jul 04, 2016 10:49 pm
Forum: General
Topic: Configuring VLANs on CRS for Ubiquiti
Replies: 4
Views: 772

Re: Configuring VLANs on CRS for Ubiquiti

Set up switch port to allow traffic with desired VLAN tags: /interface ethernet switch vlan add ports=ethXX,ethXX,... vlan-id=10 learn=yes /interface ethernet switch vlan add ports=ethXX,ethXX,... vlan-id=20 learn=yes Set up ingress vlan translation to treat untagged traffic as tagged: /interface et...
by mpreissner
Sat Jun 25, 2016 3:34 pm
Forum: RouterBOARD hardware
Topic: CCR1009-8G-1S-1S+PC and FTTH AON with static ip
Replies: 4
Views: 980

Re: CCR1009-8G-1S-1S+PC and FTTH AON with static ip

Is the fiber terminated with an LC connection?  Or is it SC?  ST?  There are multiple types of terminations, and you need to make sure you get the right SFP module to work with the connector that's on your fiber. It's very odd that the ISP wouldn't supply the ONT.  In any case, I can't say whether i...
by mpreissner
Sat Jun 25, 2016 3:24 pm
Forum: General
Topic: Issue with bonding 802.3ad
Replies: 3
Views: 1065

Re: Issue with bonding 802.3ad

That's exactly right.  If the transfer stream is single-threaded, you won't get more than a single link's bandwidth.  Only multi-threaded data streams will be able to take advantage of the aggregated link. Try using the Trunk feature in the switch chip menu.  It's not LACP, but rather is Static Link...
by mpreissner
Sat Jun 25, 2016 3:08 pm
Forum: RouterBOARD hardware
Topic: Wireless performance on hAP ac (non lite)
Replies: 14
Views: 5581

Re: Wireless performance on hAP ac (non lite)

So the one thing to remember is that you will ALWAYS get better performance over a wire than using wireless.  I try to wire everything that I can and minimize my use of wireless, not just for security reasons, but also just for plain old performance.  I can't speak to how good MT's wireless products...
by mpreissner
Sat Jun 25, 2016 2:58 pm
Forum: General
Topic: 802.3ad Bond without using a bridge
Replies: 11
Views: 2081

Re: 802.3ad Bond without using a bridge

In my scenario forget the router or inter-switch communication.  In my case I am attempting to replace the 1810G that is the core switch of my network, where my PC an several other computers/users connect and access a NAS that is connected with a two interface LACP.  Its for multi-computer performa...
by mpreissner
Fri Jun 24, 2016 5:57 pm
Forum: General
Topic: SSTP VPN Smart Card
Replies: 2
Views: 1151

Re: SSTP VPN Smart Card

Hate to resurrect an old thread, but I'm actually pretty interested in this as well.  If you're in a position to do some testing, I would recommend a phased approach. First, get smart card authentication working within your Windows environment.  I'd recommend using Active Directory with AD Certifica...
by mpreissner
Fri Jun 24, 2016 5:06 pm
Forum: General
Topic: Problem with V6 and X86 in VMWARE
Replies: 6
Views: 1549

Re: Problem with V6 and X86 in VMWARE

Also, if you're running in VMware, you could use the CHR instead of the x86 platform.  That would give you a 64-bit instance instead of a 32-bit ROS.
by mpreissner
Fri Jun 24, 2016 4:59 pm
Forum: RouterBOARD hardware
Topic: Wireless performance on hAP ac (non lite)
Replies: 14
Views: 5581

Re: Wireless performance on hAP ac (non lite)

What you have to realize is that the wireless interfaces have to be bridged to the wired interfaces.  The bridge is implemented in software, so it consumes a lot of CPU.  Any high-speed AC wireless transfers will result in a good amount of CPU usage.  Even if you assigned a completely separate subne...
by mpreissner
Fri Jun 24, 2016 4:40 pm
Forum: RouterBOARD hardware
Topic: CCR1009-8G-1S-1S+PC and FTTH AON with static ip
Replies: 4
Views: 980

Re: CCR1009-8G-1S-1S+PC and FTTH AON with static ip

That all depends on your ISP.  If your incoming fiber is two-strand, you've got full-duplex fiber which is great, and the AON has much better potential speed than a PON (surprising the provider opted for this setup because it's much more expensive than PON).  Your ISP should be providing an ONT to t...
by mpreissner
Fri Jun 24, 2016 1:45 pm
Forum: General
Topic: 802.3ad Bond without using a bridge
Replies: 11
Views: 2081

Re: 802.3ad Bond without using a bridge

Exactly. The basic switching is perfectly fine, and I would settle for the 4k frames if I could do bonding without bridging over the CPU.  Its disappointing that the basic features like this don't work as expected. This switch should be plenty for a basic home network.  So, the use of the RB2011 ma...
by mpreissner
Thu Jun 23, 2016 8:56 pm
Forum: General
Topic: New RB3011UiAS-RM - not impressed with throughput...
Replies: 22
Views: 7068

Re: New RB3011UiAS-RM - not impressed with throughput...

I see a performance diference between ports. My setup is the following SFP=> Wan (down 800Mb/s up 250Mb/s bandwith) eth1 Master of eth2-5 eth6 Master of eth7-10 bridge eth1 & and eth6 Speedtest with a cable from eth1 ==> 780Mb/s down 240Mb/s up Speedtest with a cable from eth6 ==> 650Mb/s down 180M...
by mpreissner
Thu Jun 23, 2016 8:31 pm
Forum: Beginner Basics
Topic: Portforwarding based on DNS name
Replies: 9
Views: 3643

Re: Portforwarding based on DNS name

I haven't looked into it specifically, but you can probably set up a single postfix server to act as a proxy/relay for both domains.  Effectively, you would forward all mail ports to this one postfix server which would accept inbound mail for both domains, and then forward them on to their respectiv...
by mpreissner
Thu Jun 23, 2016 2:36 pm
Forum: General
Topic: 802.3ad Bond without using a bridge
Replies: 11
Views: 2081

Re: 802.3ad Bond without using a bridge

The limitation isn't just the CPU itself, but also that all ports share a single 1 gbps link to the CPU.  This means that regardless of the CPU strength, you will never achieve more than 1 gbps of routing performance.
by mpreissner
Thu Jun 23, 2016 1:52 pm
Forum: General
Topic: 802.3ad Bond without using a bridge
Replies: 11
Views: 2081

Re: 802.3ad Bond without using a bridge

Your only option at this point is to use the Trunk feature in the CRS switch menu.  This is Static Link Aggregation, not LACP (802.3ad) which as pointed out, is not yet supported on hardware (even though the hardware is capable of it).  I'm curious why you're using a CRS125 for routing...it does hav...
by mpreissner
Wed Jun 15, 2016 2:53 am
Forum: RouterBOARD hardware
Topic: 10G SFP+ and linux
Replies: 2
Views: 789

Re: 10G SFP+ and linux

Not me, but I'm currently using http://routerboard.com/SplusDA0001 with a SolarFlare SFN5162.  I use both of these on a FreeNAS and a CentOS 6 KVM hypervisor hooked up to a CRS226.  iperf results got me about 9.8 Gbps between the two.
by mpreissner
Mon Jun 06, 2016 4:35 pm
Forum: RouterBOARD hardware
Topic: Calculating what routerboard to use
Replies: 2
Views: 666

Re: Calculating what routerboard to use

You need to know how much total throughput you need to choose the right product. Additional features like QoS, the complexity of your firewall rules, and a number of other things will drag down total throughput much more than the number of users.
by mpreissner
Sun Jun 05, 2016 4:54 pm
Forum: Beginner Basics
Topic: Need help bonding (2) NICs for a ESXi environment
Replies: 1
Views: 1087

Re: Need help bonding (2) NICs for a ESXi environment

You can't use Bonding on slave ports. Bonding is performed at the CPU, but when you designate a port as a slave, that port is now controlled by the switch chip, not the CPU. To use ports 4 and 5 as a bonded pair, you'll need to remove them from the Master/Slave configuration, allowing the CPU to per...
by mpreissner
Fri Jun 03, 2016 1:39 pm
Forum: General
Topic: Trouble creating LACP bond with VLANS in different port group
Replies: 3
Views: 490

Re: Trouble creating LACP bond with VLANS in different port group

So, first, MT doesn't support LACP in hardware on the CRS, only in software. That means that the bonding is done at the CPU. When working with slave ports, those ports are controlled by the switch chip, not the CPU, hence your problem. To enable link aggregation on slave ports, you need to use the S...
by mpreissner
Tue May 31, 2016 10:22 pm
Forum: General
Topic: Feature Request: Application Level Firewall
Replies: 12
Views: 4960

Re: Feature Request: Application Level Firewall

I agree that being able to run Snort or another IDS/IPS function on the router would make for a simplified deployment, but you also have to remember that it would necessitate stronger hardware to maintain a given throughput. Personally, I run pfSense as an inline transparent firewall that sits betwe...
by mpreissner
Tue May 31, 2016 10:10 pm
Forum: General
Topic: Trunk over Bonding
Replies: 6
Views: 3512

Re: Trunk over Bonding

WTF did I just read ? quote from MT Bonding modes manual: 802.3ad 802.3ad mode is an IEEE standard also called LACP (Link Aggregation Control Protocol). It includes automatic configuration of the aggregates, so minimal configuration of the switch is needed. This standard also mandates that frames w...
by mpreissner
Fri May 27, 2016 5:36 pm
Forum: General
Topic: Feature Request: Router Teaming
Replies: 9
Views: 1779

Re: Feature Request: Router Teaming

One of the best clustering setups I've seen is what CheckPoint does with their security gateways. Their management software allows you to deploy your firewall rules to the cluster (so it installs on all cluster members simultaneously), as well as manage individual member configs that get pushed at t...
by mpreissner
Fri May 27, 2016 5:22 pm
Forum: General
Topic: Gigabit Through CRS125 - Slow Speed
Replies: 34
Views: 3813

Re: Gigabit Through CRS125 - Slow Speed

Without firewall, with a simple firewall you max out a half that. True, but either way, the RB2011 still has the ability to outperform the CRS for layer 3 throughput because its physical design allows for up to 1.5 gbps versus only 1 gbps on the CRS. The CPU is not the limiting factor, otherwise th...
by mpreissner
Fri May 27, 2016 1:45 pm
Forum: General
Topic: Gigabit Through CRS125 - Slow Speed
Replies: 34
Views: 3813

Re: Gigabit Through CRS125 - Slow Speed

Except for the fact that the CRS will max out at 1 gig since all ports share a single 1 gbps link to the CPU, whereas the RB2011 can reach up to 1.5 gbps. So, not quite the same, but yes, the RB2011 actually can route more than the CRS because of the physical architecture.
by mpreissner
Thu May 26, 2016 5:36 pm
Forum: General
Topic: Gigabit Through CRS125 - Slow Speed
Replies: 34
Views: 3813

Re: Gigabit Through CRS125 - Slow Speed

The ERL should definitely do a better job than the CRS for routing, but for the price, you probably could've gotten a base RB2011 and the interface for configuration would be much more familiar with the CRS - and the RB2011 would easily have met your needs for gigabit routing. Since the ERL doesn't ...
by mpreissner
Wed May 25, 2016 8:25 pm
Forum: General
Topic: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour
Replies: 10
Views: 7727

Re: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour

Well, I did a bit of reading and see where the problem is (mDNS using link-local-only multicast group) so obviously routing won't fix the issue. Perhaps some interesting nat/mangle gymnastics are possible.... I think the most available solution for ROS users at the moment is to launch a Metarouter ...
by mpreissner
Tue May 24, 2016 7:32 pm
Forum: General
Topic: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour
Replies: 10
Views: 7727

Re: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour

The problem is that the multicast routing that MT supports doesn't properly handle Bonjour/Zero-conf. I've researched and tried a ton of different ways to do it, and it just never worked. But if you have a working setup that does mDNS service reflection between subnets, please write up a how-to and ...
by mpreissner
Tue May 24, 2016 7:29 pm
Forum: General
Topic: Gigabit Through CRS125 - Slow Speed
Replies: 34
Views: 3813

Re: Gigabit Through CRS125 - Slow Speed

The CRS can only achieve 500+ using fastpath...and not every connection can use it! This is why you should use a ROUTER for ROUTING, and a SWITCH for SWITCHING. The Zhone is already doing NAT (most likely), so your internal IPV4 addresses are hidden from the outside world. Unless you've got a shady ...
by mpreissner
Mon May 23, 2016 8:33 pm
Forum: General
Topic: Trunk over Bonding
Replies: 6
Views: 3512

Re: Trunk over Bonding

To begin, MT does not support LACP in any way. They only support static link aggregation. The RB2011 has two switch chips in it...a 5 port 100mbps switch and a 5 port 1gbps switch. The 1gbps switch is connected to the CPU via a single 1gbps link, and the 100 mbps switch is directly attached to the C...
by mpreissner
Mon May 23, 2016 8:25 pm
Forum: General
Topic: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour
Replies: 10
Views: 7727

Re: Feature Request: IP Multicast Routing/mDNS/Zeroconf/Bonjour

It's been asked for a LOT. Really, they could make it work by compiling an avahi-daemon package that would run on RouterOS. Somehow I don't think this would be too difficult, but apparently it's just not at the top of their list.
by mpreissner
Mon May 23, 2016 8:24 pm
Forum: General
Topic: Feature Request: Router Teaming
Replies: 9
Views: 1779

Re: Feature Request: Router Teaming

Yeah, what you're talking about is clustering. Treating two physical routers as a single object that has built-in failover/redundancy and/or load-balancing capabilities. Almost every major routing product out there supports this...Cisco, CheckPoint, PaloAlto, etc. It definitely simplifies configurat...
by mpreissner
Mon May 23, 2016 8:16 pm
Forum: RouterBOARD hardware
Topic: RouterOS x86 Max Memory
Replies: 9
Views: 4033

Re: RouterOS x86 Max Memory

x64 hardware was not very common (especially with regard to network infrastructure devices) when the original x86 ROS was developed. MT developed for the more common platform. Now that almost everything manufactured is x64-capable, and it's more common to see open systems (x86_64) running a variety ...
by mpreissner
Mon May 23, 2016 8:09 pm
Forum: General
Topic: Gigabit Through CRS125 - Slow Speed
Replies: 34
Views: 3813

Re: Gigabit Through CRS125 - Slow Speed

If you use the CRS as a switch (it's intended purpose), you should be able to get the same speeds as when your computer is plugged directly into the router. The CRS has a weak CPU and cannot easily handle the kind of speeds you're looking for. Set up the CRS with ports 2-24 as slave to port 1. This ...
by mpreissner
Thu May 05, 2016 8:03 pm
Forum: General
Topic: CRS switch as Core Switch?
Replies: 2
Views: 1263

Re: CRS switch as Core Switch?

From your described usage, it sounds like the CRS would be a good fit. Of course, we'd all prefer a 48 port version, but if you're OK cascading multiple 24 port units using the SFP+ ports, that should work well for you. I use the CRS226 as my core at home (multiple VLANs, VERY high usage). I do exac...
by mpreissner
Wed May 04, 2016 10:07 pm
Forum: RouterBOARD hardware
Topic: RouterOS x86 Max Memory
Replies: 9
Views: 4033

Re: RouterOS x86 Max Memory

I can't speak specifically to RouterOS, but all x86 platforms are limited to a max of 4GB RAM if they don't support PAE. Since ROS is Linux-based, and Linux has had PAE for a LONG time, it may support more than 4GB, but there aren't too many applications that would require that much.
by mpreissner
Thu Apr 28, 2016 2:43 pm
Forum: Announcements
Topic: SwOS version 1.15 released
Replies: 28
Views: 8415

Re: SwOS version 1.15 released

Can we get https support added to the web interface? And maybe a RADIUS client for centralized authentication? The lack of even minimal security for the administrative interface is troubling...and it shouldn't be hard to correct either of these issues...
by mpreissner
Wed Apr 27, 2016 1:17 pm
Forum: General
Topic: Router OS x86 unable to install on Dell R710
Replies: 4
Views: 1231

Re: Router OS x86 unable to install on Dell R710

You could also deploy it as CHR on VMware. That'll give you a 64-bit install versus the x86 which is only 32-bit. Plus, the advantages of running in VMware are numerous...not being tied to a specific piece of hardware, the ability to increase the hardware resources available to the VM without having...
by mpreissner
Fri Apr 22, 2016 1:46 pm
Forum: Beginner Basics
Topic: Use of rackmount Gigabit Ethernet router?
Replies: 2
Views: 418

Re: Use of rackmount Gigabit Ethernet router?

It also comes in handy when you keep your network gear in a locked server rack instead of on a shelf by the TV.
by mpreissner
Mon Apr 11, 2016 6:47 pm
Forum: RouterBOARD hardware
Topic: Load Balance on a CCR1009
Replies: 2
Views: 899

Re: Load Balance on a CCR1009

Port 1-4 on the CCR1009 share a single 1 Gbps link to the CPU. As long as you ISP links do not add up to more than 1 Gbps, you can definitely use those four ports for your WAN connections.
by mpreissner
Mon Apr 04, 2016 2:46 pm
Forum: RouterBOARD hardware
Topic: I want to run ring network in fibre cabal & V lan Kindly suggest Hardware...
Replies: 4
Views: 918

Re: I want to run ring network in fibre cabal & V lan Kindly suggest Hardware...

OSPF has no relevance to what you've said you want to do. OSPF is a routing protocol, but you've said nothing about routing...only that you want to run fiber and use VLANs. VLAN is a layer 2 technology, and doesn't require routers to implement. I suppose you could make a "ring" of routers and use OS...
by mpreissner
Fri Apr 01, 2016 3:05 pm
Forum: General
Topic: VLANs + switch chip under CRS125
Replies: 1
Views: 377

Re: VLANs + switch chip under CRS125

If it works as expected, I think you probably did a pretty good job. One thing to keep in mind is that the CRS products are designed primarily as a switch and have limited routing capabilities. Depending on how much throughput you need between your internal network or how large your ISP link is, the...
by mpreissner
Fri Apr 01, 2016 2:55 pm
Forum: Beginner Basics
Topic: CRS best practice setup with loop protection
Replies: 1
Views: 1617

Re: CRS best practice setup with loop protection

Unfortunately, MikroTik doesn't support STP/RSTP on the CRS hardware at this time. The best ways I know of to add loop protection is to introduce another brand switch into the stack that does support STP/RSTP, or use a CCR or other MikroTik router wired to the top and bottom switches of the stack. B...
by mpreissner
Wed Mar 30, 2016 8:27 pm
Forum: RouterBOARD hardware
Topic: rb44ge is ok to use it in pci-E 1x,
Replies: 12
Views: 1747

Re: rb44ge is ok to use it in pci-E 1x,

Just a quick correction, PCIe is always full-duplex meaning that PCIe 2.0 x1 provides you with 4Gbps full-duplex (So 4 up and down at the same time). So PCIe 2.0 x1 should indeed be enough to be able to saturate all 4 ports at full-duplex Gigabit speeds. Quindor is exactly right. PCIe bandwidth is ...
by mpreissner
Wed Mar 30, 2016 1:40 pm
Forum: General
Topic: CRS switching RSTP functionality
Replies: 2
Views: 1471

Re: CRS switching RSTP functionality

Because MikroTik has not implemented STP/RSTP in the switch chip hardware, you would have to use a software bridge, which is processed at the CPU instead of the switch chip. The CRS line of products does not have a strong enough CPU to get anywhere near wire speed across 24 ports. There is one way y...
by mpreissner
Wed Mar 30, 2016 1:26 pm
Forum: General
Topic: Poor mans config sync: vrrp
Replies: 7
Views: 3448

Re: Poor mans config sync: vrrp

A better option would be some type of unified management platform whereby routers in a VRRP configuration could be managed as a single unit, obviating the need to manually sync all the settings from the master to the slave. Or an automated process whereby a slave unit auto-synchronizes to the master...
by mpreissner
Tue Mar 29, 2016 3:36 pm
Forum: RouterBOARD hardware
Topic: Mikrotik ATA
Replies: 16
Views: 2940

Re: Mikrotik ATA

RouterOS is optimized as a ROUTER and is best used as such. You're better off buying a proper ATA and keeping all telephony functions separate. Keep in mind, if they were to add ATA functionality, they'd have to also add RJ-11 ports to have compatibility with most analog phones. I use a Raspberry Pi...
by mpreissner
Mon Mar 28, 2016 7:11 pm
Forum: RouterBOARD hardware
Topic: I want to run ring network in fibre cabal & V lan Kindly suggest Hardware...
Replies: 4
Views: 918

Re: I want to run ring network in fibre cabal & V lan Kindly suggest Hardware...

Unfortunately, MikroTik does not support ring-type networks with their hardware. Are you trying to set up a Token-Ring, or simply a series of daisy-chained switches that loops back on itself? I can tell you to forget about Token-Ring, but if you plan to loop a series of switches, you'll end up with ...
by mpreissner
Wed Mar 23, 2016 1:42 pm
Forum: Beginner Basics
Topic: Configuration as a SWITCH CRS226-24G-2S+
Replies: 6
Views: 1168

Re: Configuration as a SWITCH CRS226-24G-2S+

If you use port trunking as suggested by Becs, you can reach up to the aggregate of the number of links in bandwidth. When you trunk two ports together, they automatically do load-balancing, but if one of the links fails, all traffic reverts to the one remaining active link. You're still limited to ...
by mpreissner
Mon Mar 21, 2016 5:16 pm
Forum: General
Topic: Firewal drop rule does not work in local network
Replies: 5
Views: 529

Re: Firewal drop rule does not work in local network

Need more information on your setup. Are you actually using Bridging, or are you Routing?
by mpreissner
Mon Mar 21, 2016 5:01 pm
Forum: Beginner Basics
Topic: Configuration as a SWITCH CRS226-24G-2S+
Replies: 6
Views: 1168

Re: Configuration as a SWITCH CRS226-24G-2S+

For VLAN config, this is highly dependent upon your environment. Everything will be configured through the /interface ethernet switch menu. To enable a particular VLAN ID on a port: /interface ethernet switch vlan add ports=enter,ports,here vlan-id=xxx learn=yes To make an access port: /interface et...
by mpreissner
Mon Mar 21, 2016 1:52 pm
Forum: Beginner Basics
Topic: Configuration as a SWITCH CRS226-24G-2S+
Replies: 6
Views: 1168

Re: Configuration as a SWITCH CRS226-24G-2S+

Forget about bridging. The CRS is a wire-speed hardware switch. Bridges run in software, and the CPU on the CRS is really weak. Set all ports as slave to a single master port, and do your VLAN configuration from the switch chip menu.
by mpreissner
Thu Mar 17, 2016 5:35 pm
Forum: Beginner Basics
Topic: How to hide web interface of router from internet?
Replies: 5
Views: 2467

Re: How to hide web interface of router from internet?

Add this firewall rule to the very top of your INPUT chain: /ip firewall filter add chain=input action=accept protocol=tcp dst-address=your.mgmt.ip.address in-interface=!WAN-interface dst-port=22,443,8291 and this firewall rule to the very bottom of your INPUT chain: /ip firewall filter add chain=in...
by mpreissner
Wed Mar 16, 2016 1:45 pm
Forum: General
Topic: Please add HTTPS support on mikrotik.com
Replies: 39
Views: 3594

Re: Please add HTTPS support on mikrotik.com

Good to know. Knowing that your products validate the signature before installing updates should be a great relief to those who were worries about ROS getting hijacked. Unless your code-signing private key gets compromised, we don't need to worry about hacked versions of ROS making their way onto ou...
by mpreissner
Wed Mar 16, 2016 12:45 pm
Forum: Beginner Basics
Topic: SIP ALG vs SIP Helper
Replies: 20
Views: 48636

Re: SIP ALG vs SIP Helper

Personally, I like deploying SBC's instead of enabling SIP ALG's on routers. Of course, this requires multiple public IP's, which are not cheap. For the time being, I simply don't expose my VoIP system directly to the Internet. All my extensions are internal, or routed through VPN into my network, s...
by mpreissner
Tue Mar 15, 2016 7:40 pm
Forum: General
Topic: Please add HTTPS support on mikrotik.com
Replies: 39
Views: 3594

Re: Please add HTTPS support on mikrotik.com

Of course...we've all been there. But if it was that important of an issue, we'd have already taken our business elsewhere by now. Ask yourself this...if R1CH hadn't made a posting about the lack of HTTPS support, would you have made this comment...? I can tell you that there are several companies t...
by mpreissner
Tue Mar 15, 2016 7:17 pm
Forum: General
Topic: Please add HTTPS support on mikrotik.com
Replies: 39
Views: 3594

Re: Please add HTTPS support on mikrotik.com

There are multiple types of MitM attacks. DNSSEC does provide MitM protections for cases of DNS spoofing/session redirection, but not for other types of MitM like browser hijacking. All of your speculation about the security of MT's site is based on specific scenarios you have engineered in your min...
by mpreissner
Tue Mar 15, 2016 6:33 pm
Forum: General
Topic: Please add HTTPS support on mikrotik.com
Replies: 39
Views: 3594

Re: Please add HTTPS support on mikrotik.com

But this IS sensitive data - it's the very operating system of a networking device! If someone were to MitM your connection to the Mikrotik site, and provide a malicious version of RoS, you'd never know. They would be able to back-door your network, or monitor for cleartext pii, credit card numbers...
by mpreissner
Tue Mar 15, 2016 1:49 pm
Forum: General
Topic: Please add HTTPS support on mikrotik.com
Replies: 39
Views: 3594

Re: Please add HTTPS support on mikrotik.com

Just because they're not supporting encrypted connections doesn't mean there's no security or compensating controls. Think about it...you're not downloading any sensitive information, so there's really no reason to encrypt it. MikroTik does provide a hash sum for the downloads, so you can verify the...
by mpreissner
Fri Mar 11, 2016 6:31 pm
Forum: Beginner Basics
Topic: Why are some TCP packets on a DNAT'ed port making it to the Firewall filter?
Replies: 6
Views: 750

Re: Why are some TCP packets on a DNAT'ed port making it to the Firewall filter?

So here's how I have my FORWARD chain configured. It's not as locked down as I intend it to be, but it does everything I need it to at the moment...(note, I've removed the dst. addresses from my "Accept inbound..." rules) Screen Shot 2016-03-11 at 11.18.15 AM.png As you can see, the fasttrack rules ...
by mpreissner
Fri Mar 11, 2016 4:56 pm
Forum: Beginner Basics
Topic: [CCR1009] Can I add ports 5&6 to the switched ports 1-4 via bridge? Or in any other way?
Replies: 12
Views: 1915

Re: [CCR1009] Can I add ports 5&6 to the switched ports 1-4 via bridge? Or in any other way?

You can't include them in the switch because they have no connection to the switch chip. You want to set ports 2, 3, and 4 as slave to port 1 which will create a 4 port wire-speed switch. Any devices connected to those ports will share the 1 Gbps link between the switch chip and the CPU (really, you...
by mpreissner
Fri Mar 11, 2016 3:51 pm
Forum: General
Topic: Integrated Mikrotik with Active Directory
Replies: 7
Views: 5385

Re: Integrated Mikrotik with Active Directory

Search the forum and search Google. Plenty of people have done this.
by mpreissner
Fri Mar 11, 2016 3:47 pm
Forum: Beginner Basics
Topic: Why are some TCP packets on a DNAT'ed port making it to the Firewall filter?
Replies: 6
Views: 750

Re: Why are some TCP packets on a DNAT'ed port making it to the Firewall filter?

The NAT chain is part of pre-routing processing. Every packet that goes through the router goes through a pre-routing, routing, and post-routing process. Your dst-nat rule effectively tells the router that the inbound packet should go to the FORWARD chain, as the packet should transit the router, ra...
by mpreissner
Fri Mar 11, 2016 3:34 pm
Forum: General
Topic: Slow speeds from CRS125
Replies: 57
Views: 4251

Re: Slow speeds from CRS125

You should definitely be able to push more than 20 mbps through NAT, but remember, the CRS is designed primarily as a switch, not a router, so you're only going to get so much out of it at layer 3.
by mpreissner
Fri Mar 11, 2016 1:42 pm
Forum: General
Topic: UPnP?
Replies: 4
Views: 627

Re: UPnP?

Generally, it is. That's why I restrict all my UPnP devices to a single subnet with nothing sensitive. Regardless, it doesn't look like the UPnP function is working correctly when enabled.
by mpreissner
Thu Mar 10, 2016 4:10 pm
Forum: RouterBOARD hardware
Topic: CRS version of CCR1072-1G-8S+
Replies: 7
Views: 1576

Re: CRS version of CCR1072-1G-8S+

Agreed . We are actually moving away from Mikrotik on the distribution routing side due to lack of SFP+ port scalability . Would be awesome if they made some sort of Mikrotik flavor available on the ONIE whitebox platforms. While the lack of a high port density 10gb switch is definitely an issue, c...
by mpreissner
Thu Mar 10, 2016 3:33 pm
Forum: RouterBOARD hardware
Topic: CRS version of CCR1072-1G-8S+
Replies: 7
Views: 1576

Re: CRS version of CCR1072-1G-8S+

+1 in need of a 24 port SFP switch with at least 2 x SFP+. Preferably with e.g a dual core processor. The processor won't make any difference unless you're bridging or routing, which is not the intended purpose of the CRS devices. Personally, I'd rather see a 24 port SFP+ switch, or an upgraded CRS...
by mpreissner
Thu Mar 10, 2016 2:49 am
Forum: General
Topic: UPnP?
Replies: 4
Views: 627

UPnP?

So I have UPnP enabled, but it doesn't seem to be working correctly. I don't have any dynamic dst-nat rules popping up in my NAT chain, and internal devices that rely on UPnP-based port forwarding are not working properly. Specifically, I can see a lot of the traffic that should be forwarded getting...
by mpreissner
Wed Mar 09, 2016 3:25 pm
Forum: Beginner Basics
Topic: Intervlan speed problem with RB2011 and CRS125
Replies: 3
Views: 1512

Re: Intervlan speed problem with RB2011 and CRS125

The CRS is intended as a wire-speed switch (layer 2). It has minimal layer 3 capabilities. If you check the performance metrics on routerboard.com, you'll see that it's only capable of a maximum of 984 mbps bridging/routing, and that's assuming that ALL packets are 1500 bytes. More realistic numbers...
by mpreissner
Tue Mar 08, 2016 8:27 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

Re: HELP!!! Router on the fritz!

Happens in both Chrome and Safari on OS X, as well as Chrome on Windows 7. Can't even get it to load at all in IE11.
by mpreissner
Tue Mar 08, 2016 7:31 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

Re: HELP!!! Router on the fritz!

I'll have to try that. I was able to get back online after restoring from my backup, but as previously stated, when viewed through Webfig, all my firewall rules constantly shift around. However, if I look at it through Winbox, everything appears normal. At this point, I'm very cautious about making ...
by mpreissner
Tue Mar 08, 2016 7:23 pm
Forum: Beginner Basics
Topic: Two CRS125 switches
Replies: 12
Views: 1218

Re: Two CRS125 switches

Unfortunately, I can't help you there with the LCD. I actually disabled my LCD as I consider it to be a security risk. It allows anyone to walk up to the switch and get interact with it without authentication. As long as the rest of the switch works correctly, that's all I care about.
by mpreissner
Tue Mar 08, 2016 4:22 pm
Forum: Beginner Basics
Topic: Intervlan speed problem with RB2011 and CRS125
Replies: 3
Views: 1512

Re: Intervlan speed problem with RB2011 and CRS125

A few things to keep in mind about this setup... The RB2011 is only capable of between about 700 mbps and 1500 mbps (1.5 gbps) depending on how you have it configured. Additionally, you have a single cable carrying both VLANs to the router. This means they have to contend for bandwidth. Also, the bl...
by mpreissner
Tue Mar 08, 2016 1:10 pm
Forum: General
Topic: VRRP over VLAN over BRIDGE
Replies: 2
Views: 1598

Re: VRRP over VLAN over BRIDGE

Just curious why you're using a bridge at the routers. It's very CPU intensive since you're actively forcing traffic to use the bridges to get from one switch to the other. You could run a link between the two switches so that anything in the same layer 2 domain wouldn't have to cross a software bri...
by mpreissner
Tue Mar 08, 2016 1:02 pm
Forum: Beginner Basics
Topic: Two CRS125 switches
Replies: 12
Views: 1218

Re: Two CRS125 switches

The easiest way to ensure that you're testing the layer 2 bandwidth is to plug two machines into any two ports. You'll get a good 1 gbps. The CRS can be a little tricky to program correctly. I would create a Management VLAN and attach it to the Master port in the switch group. A Master port only mea...
by mpreissner
Mon Mar 07, 2016 7:24 pm
Forum: Beginner Basics
Topic: Two CRS125 switches
Replies: 12
Views: 1218

Re: Two CRS125 switches

While the switch doesn't support dynamic link aggregation, it does support static link aggregation using the interface > ethernet > switch > port > trunk menu. This should not create a switching loop if set up on both switches. I could've sworn jumbo frames were up to 9k on the CRS, but I could be w...
by mpreissner
Mon Mar 07, 2016 5:37 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

Re: HELP!!! Router on the fritz!

Back online, but still seeing some serious wonkiness in the firewall page of webfig. All my rules keep moving around...
by mpreissner
Mon Mar 07, 2016 3:39 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

Re: HELP!!! Router on the fritz!

Is there any way to view the contents of the backup file so that I can at least see the config I had in place to manually rebuild it?
by mpreissner
Mon Mar 07, 2016 3:27 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

Re: HELP!!! Router on the fritz!

So I got back online after a factory reset, but I am unable to restore from my backup. The router keeps telling me "Bad Password" on the backup file, even though I never set a password. This is frustrating, as I had way too much going on in my config to remember...any thoughts?
by mpreissner
Mon Mar 07, 2016 3:06 pm
Forum: General
Topic: HELP!!! Router on the fritz!
Replies: 9
Views: 827

HELP!!! Router on the fritz!

My RB750GL just crashed. Was able to get it back online by rebooting it, but it's acting crazy. Nothing seems to be routing, and if I look at my firewall rules, the rules keep shifting around by themselves. I'm having to hotspot my phone just to get to the forum for some help. Anyone seen this happe...
by mpreissner
Mon Mar 07, 2016 2:22 pm
Forum: General
Topic: Mikrotik+LDAP+OpenVPN+2 Factor Authentication
Replies: 2
Views: 1980

Re: Mikrotik+LDAP+OpenVPN+2 Factor Authentication

I don't think any MikroTik VPN implementation can connect directly to an LDAP directory, but you can proxy to it using a RADIUS server. You can probably also add in a 2FA solution, but that gets more complicate. I'd just stand up an OpenVPN Access Server behind your router, static NAT TCP 443 and UD...
by mpreissner
Mon Mar 07, 2016 2:13 pm
Forum: Beginner Basics
Topic: Two CRS125 switches
Replies: 12
Views: 1218

Re: Two CRS125 switches

For connecting the switches, just run a cable (or multiple cables) between the two. For a single cable, you'll just need to set up a VLAN trunk on both switches for the connected ports. If you use multiple cables, you'll want to set up a port trunk. The port trunk is effectively a static link aggreg...
by mpreissner
Mon Mar 07, 2016 2:01 pm
Forum: Beginner Basics
Topic: Mikrotik VPN server - mobile Router clients
Replies: 3
Views: 756

Re: Mikrotik VPN server - mobile Router clients

Google "Greg Sowell mikrotik vpn dynamic". He has some examples of how to set up a VPN connection when one or both sides of the connection have a dynamic IP address. He focuses on IPSec, but I'm pretty sure you can adapt it for whatever type of VPN you plan to run.
by mpreissner
Fri Mar 04, 2016 8:04 pm
Forum: General
Topic: Failover one Mikrotik Router to another
Replies: 5
Views: 3722

Re: Failover one Mikrotik Router to another

There are a lot of improvements I'd like to see to MT's "clustering" of routers. VRRP is great, but somewhat limited. Many enterprise grade routers can use a dedicated interface between the two physical units for state table synchronization. This would allow the routers to act in either hot/standby ...
by mpreissner
Fri Mar 04, 2016 6:41 pm
Forum: General
Topic: Feature Request: Revamped Firewall UI that groups rules by chain
Replies: 4
Views: 925

Re: Feature Request: Revamped Firewall UI that groups rules by chain

BAM!

I guess I was more looking for command line output in the normal iptables format, but that works.
by mpreissner
Fri Mar 04, 2016 6:33 pm
Forum: General
Topic: Failover one Mikrotik Router to another
Replies: 5
Views: 3722

Re: Failover one Mikrotik Router to another

I have this network map: Untitled Diagram.png Is it possible to fail-over Mikrotik1 to mikrotik 2 automatically, so that if mikrotic1 crashes or goes offline, mikrotik2 can take over as gateway and DHCP server? Obviously we can have it be done manually by booting up an identical copy of RouterOS in...
by mpreissner
Fri Mar 04, 2016 6:31 pm
Forum: General
Topic: Integrated Mikrotik with Active Directory
Replies: 7
Views: 5385

Re: Integrated Mikrotik with Active Directory

Hi friends, I have a RB850Gx2 Router and i configured it as a hotspot. Also I have a active directory domain environment. It is working on Microsoft Server 2012 R2. I want to integrate Active Directory users as a hotspot users. I searched internet about this, there are some articles about Internet ...
by mpreissner
Fri Mar 04, 2016 5:22 pm
Forum: General
Topic: Understanding fasttrack?
Replies: 6
Views: 1726

Re: Understanding fasttrack?

I would suggest to look into this brilliant presentation, PDF http://mum.mikrotik.com/presentations/EU16/presentation_2901_1456413105.pdf video, https://www.youtube.com/watch?v=8bl7V5iFVOc That presentation is awesome! Gave me a much better understanding of how packets flow through ROS...and helped...
by mpreissner
Fri Mar 04, 2016 5:14 pm
Forum: General
Topic: Understanding fasttrack?
Replies: 6
Views: 1726

Re: Re:

Would you really want to log every single packet that goes through the router? If you're trying to log each connection that's made, then you can very easily add logging rules after this. Fasttrack rule only applies to the second packet and beyond in any given connection. This is becuase when the fi...
by mpreissner
Fri Mar 04, 2016 3:43 pm
Forum: General
Topic: Understanding fasttrack?
Replies: 6
Views: 1726

Re:

Switch off the fasttrack and load the router by natted traffic till it reaches 100% cpu. Then enable the fasttrack and check the difference in cpu utilisation and throughput. Very helpful! Can see the difference between the fasttrack rule being enabled/disabled both when using NAT and between inter...
by mpreissner
Fri Mar 04, 2016 2:39 pm
Forum: General
Topic: Understanding fasttrack?
Replies: 6
Views: 1726

Understanding fasttrack?

I'm having a little trouble with this. I've configured fasttrack rules as per the Wiki, placing the action=fasttrack-connection at the top of my forward chain, followed by the action=accept rule (for related/established connections). I can't tell if fasttrack is really working or not. My packet coun...
by mpreissner
Fri Mar 04, 2016 1:51 pm
Forum: General
Topic: Feature Request: Revamped Firewall UI that groups rules by chain
Replies: 4
Views: 925

Re: Feature Request: Revamped Firewall UI that groups rules by chain

Try this: fwfilter.png It's even got the added bonus that when using the view-filter, if you click the blue + to add a rule, the chain will automatically be defaulted to be whatever chain you've chosen in the view filter. Useful, thanks! But doesn't help for Winbox-less environments. I run almost e...
by mpreissner
Thu Mar 03, 2016 9:00 pm
Forum: General
Topic: Feature Request: Revamped Firewall UI that groups rules by chain
Replies: 4
Views: 925

Feature Request: Revamped Firewall UI that groups rules by chain

Anyone else used to looking at IP Tables rules where everything is grouped by chain? I think it's much easier to read and make adjustments than lumping everything into the same table. It would be nice to see a separate rule table for INPUT, FORWARD, and OUTPUT.
by mpreissner
Thu Mar 03, 2016 8:52 pm
Forum: General
Topic: Feature Request: Reverse Proxy
Replies: 5
Views: 3533

Re: Feature Request: Reverse Proxy

Most web servers these days support SNI, which allows a single web server to server different web sites depending on the hostname that is in the HTTP request. A web server set up as a reverse proxy is capable of doing the same thing. See here (https://httpd.apache.org/docs/2.4/vhosts/examples.html) ...
by mpreissner
Wed Mar 02, 2016 8:14 pm
Forum: General
Topic: Feature Request: Reverse Proxy
Replies: 5
Views: 3533

Feature Request: Reverse Proxy

It would be nice to have a Reverse Proxy functionality built into ROS such that dst-nat would forward traffic to different web servers on the internal networks based on the DNS name requested. It would also be pretty cool if this functionality allowed for traffic to be passed to a VPN server interfa...
by mpreissner
Wed Mar 02, 2016 6:47 pm
Forum: Beginner Basics
Topic: Connecting two CRS125-24G-1S-IN switches over SFP on a VLAN
Replies: 1
Views: 522

Re: Connecting two CRS125-24G-1S-IN switches over SFP on a VLAN

Configuring a VLAN in the Interface section creates the VLAN with respect to the CPU. Use this to configure a management VLAN, put it on ether1 (Master port) and the CPU. Since you want to do everything in hardware, you need to configure the VLANs in the Interface > Ethernet > Switch > VLAN section.
by mpreissner
Wed Mar 02, 2016 6:40 pm
Forum: RouterBOARD hardware
Topic: Hacking two internal power supplies into the CRS226-24G-2S+RM
Replies: 22
Views: 4830

Re: Hacking two internal power supplies into the CRS226-24G-2S+RM

Is there a way to just wire the fan directly into the PSU's and not worry about On/Off functionality? Assuming the fan doesn't spin so fast as to create too much noise, why not just run it all the time?
by mpreissner
Tue Mar 01, 2016 3:26 pm
Forum: General
Topic: HOW to access internal devices remotely through the public IP?
Replies: 10
Views: 958

Re: problem with dst-nat

Hi, this my first post here , anyway i have mikrotik network that consist of one RB1200 (IP=1.1.1.1) as a core for the network and this RB1200 is connected with two RB912(10.10.10.1,10.10.10.2) and two SXT(10.10.10.3,10.10.10.4). OK here is the problem : I can access the RB1200 remotely through pub...
by mpreissner
Wed Feb 24, 2016 4:55 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

I was not ready to spend for the CHR license that supports over 1gb You can get trial licenses for all license levels for free (good for 60 days). I'd just request a trial license at the "Unlimited" license level and see how much you can push using CHR. If you can get an idea as to routing performa...
by mpreissner
Wed Feb 24, 2016 1:48 am
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

I have one of the supermicro Atom version of this unit.. http://www.supermicro.com/products/system/1U/5018/SYS-5018A-FTN4.cfm Mikrotik doesn't see the i354 ( the onboard nics ) I have a dual 10gb card in it, and that works, but the onboard nics don't. Had to load it with netinstall, with a intel NI...
by mpreissner
Mon Feb 22, 2016 4:59 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

Has anyone tried taking an image of a CHR's storage and deploying it on bare metal? The CHR is essentially an x86_64 OS, so if one could image the virtual hard disk to bare metal, theoretically, we could have ourselves a real 64-bit ROS for x86_64 hardware...
by mpreissner
Mon Feb 22, 2016 4:56 pm
Forum: General
Topic: CRS125 and trunk ports
Replies: 8
Views: 892

Re: CRS125 and trunk ports

I think you've got every part of this right EXCEPT for using egress-vlan-tag. Unless your endpoints are tagging packets (uncommon when dealing with PC endpoints), you want to use ingress-vlan-translation. Thanks for the reply and sorry for the schematic image. The endpoint devices are using untagge...
by mpreissner
Mon Feb 22, 2016 2:20 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

FYI, I have seen just the motherboard listed online for about $515 US. Throw in some RAM, an M.2 SSD, 1U chassis of your choice...
by mpreissner
Mon Feb 22, 2016 2:15 pm
Forum: General
Topic: CRS125 and trunk ports
Replies: 8
Views: 892

Re: CRS125 and trunk ports

I think you've got every part of this right EXCEPT for using egress-vlan-tag. Unless your endpoints are tagging packets (uncommon when dealing with PC endpoints), you want to use ingress-vlan-translation.
by mpreissner
Sat Feb 20, 2016 3:35 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Re: Beast x86 hardware

Yeah, I can't wait for these to become available. I have to imagine that it will crank out 30 Gbps...the Xeon-D 1518 CPU is optimized for network performance (denoted by the xxx8 CPU code), and they gave it 2x SFP+ and 10x 1Gb RJ-45's...I have to imagine they wouldn't have configured it that way if ...
by mpreissner
Fri Feb 19, 2016 2:32 pm
Forum: RouterBOARD hardware
Topic: Beast x86 hardware
Replies: 29
Views: 7285

Beast x86 hardware

Recently announced by SuperMicro, the 5018D-FN8T looks to be a beast of a 1U machine to run ROS on. New Xeon-D 1518 CPU (4 core, 8 thread) at 2.2 GHZ, only 35W, and loaded with 30 Gbps worth of interfaces! I think this could give the CCR line a run for its money. If it performs as expected, it ought...
by mpreissner
Tue Feb 16, 2016 9:20 pm
Forum: Beginner Basics
Topic: 3 buildings 1 internet
Replies: 16
Views: 1363

Re: 3 buildings 1 internet

I agree, unless you need the 10gb ports for specific endpoints at each location, use them to create high speed VLAN trunks between the buildings. If the RB2011s provide enough routing performance for your application, I would actually repurpose two of them and use VRRP at your primary site to provid...
by mpreissner
Tue Feb 16, 2016 1:52 am
Forum: RouterBOARD hardware
Topic: x86 or CCR for 10Gbps
Replies: 6
Views: 1908

Re: x86 or CCR for 10Gbps

Pretty sure the CCR1072 will easily do what you want it to...it can handle up to 80 Gbps, as verified by other members on this forum. Might even be considered overkill...
by mpreissner
Fri Feb 12, 2016 6:50 pm
Forum: General
Topic: Server bonding on 2 Different Mikrotik Switches
Replies: 4
Views: 1303

Re: Server bonding on 2 Different Mikrotik Switches

I think when he's talking about bonding, he's referring to Active/Backup NIC teaming. A lot of Linux/UNIX systems handle this using the bonding kernel driver. This is great for organizations running fully redundant switching fabrics (I've seen many that do this). A dual-point failure like you descri...
by mpreissner
Fri Feb 12, 2016 3:11 pm
Forum: General
Topic: Server bonding on 2 Different Mikrotik Switches
Replies: 4
Views: 1303

Re: Server bonding on 2 Different Mikrotik Switches

First of all, your switches are going to need different IP addresses. Second, you need to put a bridge containing the two router interfaces that act as up/downlinks to the switches, and enable spanning-tree on that bridge. What you're doing is setting up a redundant switching fabric. If your link fa...
by mpreissner
Thu Feb 11, 2016 10:20 pm
Forum: RouterBOARD hardware
Topic: Performance on newer Intel Atom boards?
Replies: 1
Views: 719

Performance on newer Intel Atom boards?

Anyone have any experience working with ROS on the newer Intel Atom (Avoton/Rangeley) 8-core C2750/2758 boards like the SuperMicro A1SAi-2750F or A1SRi-2758F? Considering the CPU uses only 20W max, I'm curious what kind of routing performance it can achieve versus the CCR's. Anyone played with these?
by mpreissner
Wed Feb 10, 2016 2:23 pm
Forum: RouterBOARD hardware
Topic: Router vs Bridge on cloud router switch?
Replies: 2
Views: 1074

Re: Router vs Bridge on cloud router switch?

Leave it in "Router" mode unless you need Bridge features like STP. If you only need one VLAN, slave all ports to port 1 (or any port really) and enjoy!
by mpreissner
Wed Feb 10, 2016 2:19 pm
Forum: General
Topic: Feature Request: mDNS Repeater for ROS
Replies: 9
Views: 4660

Re: Feature Request: mDNS Repeater for ROS

So is the entire forum community. MT, however, doesn't base their development efforts strictly on what their active forum users want. They weigh our requests against what they get through the normal support channels, talking with customers at MUM events around the world, etc. If enough people haven'...
by mpreissner
Wed Feb 10, 2016 2:16 pm
Forum: General
Topic: dynDNS SCRIPT THAT WORKS
Replies: 13
Views: 20945

Re: dynDNS SCRIPT THAT WORKS

First, try not to double NAT...always causes problems. Either get rid of the ISP router, or put it in bridge mode. Second...here's my script. :global ddnsuser "username" :global ddnspass "password" :global theinterface "name of external interface, i.e. ether-1-gateway" :global ddnshost1 your.dyndns....
by mpreissner
Tue Feb 09, 2016 9:40 pm
Forum: General
Topic: Feature Request: mDNS Repeater for ROS
Replies: 9
Views: 4660

Re: Feature Request: mDNS Repeater for ROS

I believe people have been requesting a native Avahi-daemon compiled for ROS for a while. Your best bet is to get a Raspberry Pi, configure it with multiple VLAN interfaces, and put it on a trunk port on your switch.
by mpreissner
Tue Feb 09, 2016 9:37 pm
Forum: General
Topic: Feature Request: ETA on Feature Requests
Replies: 5
Views: 1129

Re: Feature Request: ETA on Feature Requests

The thing is, we're ok with unfirm dates. If you tell me (and most forum members) that your intent is to have xyz feature implemented by the end of 2016, we'll be happy with that. Even if MT can't get it finished in that time, as long as there's communication saying that the feature was delayed but ...
by mpreissner
Tue Feb 09, 2016 4:34 pm
Forum: RouterBOARD hardware
Topic: Crappy LACP support (802.3ad) for the High-End Switches like CRS226-24G-2S with QCA8519 chipsets
Replies: 3
Views: 1005

Re: Crappy LACP support (802.3ad) for the High-End Switches like CRS226-24G-2S with QCA8519 chipsets

Yeah, unfortunately, 802.3ad compliant LACP is not supported in hardware yet, despite the community railing at MT for A WHILE to get this done. You can use bonding (which won't give you the throughput you want because the CPU in the CRS is too weak), or you might try trunking (/interface ethernet sw...
by mpreissner
Tue Feb 09, 2016 4:20 pm
Forum: General
Topic: Feature Request: ETA on Feature Requests
Replies: 5
Views: 1129

Feature Request: ETA on Feature Requests

I'd love to get some kind of timeline on expected completion of current features that are in the works. Or even an authoritative list of features that ARE in the works. I think one of the biggest issues users here on the forum have is that there's no transparency regarding what is and is not being w...
by mpreissner
Tue Feb 02, 2016 4:09 pm
Forum: Beginner Basics
Topic: InterVLAN Routing CRS125-24G-1S-RM
Replies: 2
Views: 445

Re: InterVLAN Routing CRS125-24G-1S-RM

You should be able to bridge or route. The CRS has limited layer 3 capabilities, i.e. about 300 Mbps max. If you need more than that, get a real router like a CCR or one of the other ones. Even the RB750GL can do about 1 Gbps max.
by mpreissner
Mon Feb 01, 2016 2:16 pm
Forum: Beginner Basics
Topic: How to add a 802.3ad LACP bondng on ether16 and ether17 in this config?
Replies: 6
Views: 1143

Re: How to add a 802.3ad LACP bondng on ether16 and ether17 in this config?

You can't. MikroTik currently does not support 802.3ad on any of their products. You can use Bonding to aggregate the links together, but Bonding puts port control up at the CPU, rather than the switch chip. Even if the CRS devices had enough CPU to run wire-speed on bonded interfaces, there's only ...
by mpreissner
Thu Jan 28, 2016 3:09 pm
Forum: RouterBOARD hardware
Topic: Any new CRS switches comming out soon?
Replies: 4
Views: 972

Re: Any new CRS switches comming out soon?

The CRS226 is exactly what you're describing...24x 1 Gbps ports with 2x SFP+ 10 Gbps ports. What we really need is something with 12x or more SFP+ 10 Gbps ports, a switch with 48x 1 Gbps ports, or even 24x 1 Gbps with 4x 10 Gbps ports. Of course, with any of these, we'd also like simple features fou...
by mpreissner
Fri Jan 22, 2016 4:46 pm
Forum: RouterBOARD hardware
Topic: RB44Ge performance?
Replies: 3
Views: 640

Re: RB44Ge performance?

Really? Nobody uses this card? How about the MT folks? Any more info you can share on this card?
by mpreissner
Wed Jan 20, 2016 3:16 pm
Forum: RouterBOARD hardware
Topic: RB44Ge performance?
Replies: 3
Views: 640

RB44Ge performance?

Anyone using this card? Which generation PCIe is it? 1, 2, 3 (1 should be enough for wire-speed on 4 ports)? Max MTU size/jumbo frame support? Anyone achieving wire-speed across all 4 ports? Does it support TOE? The details on this card are very scarce...trying to figure out if it will work for my a...
by mpreissner
Mon Jan 18, 2016 8:04 pm
Forum: Virtualization
Topic: Cloud Hosted Router
Replies: 583
Views: 187964

Re: Cloud Hosted Router

Anyone have performance metrics related to AWS instance size? I'm looking at using the CHR as a VPN/Router for a corporate cloud infrastructure, and want to be able to price out the instance sizes in terms of routing performance within the VPC as well as number of concurrent users I can support via...
by mpreissner
Fri Jan 15, 2016 2:43 pm
Forum: Virtualization
Topic: Cloud Hosted Router
Replies: 583
Views: 187964

Re: Cloud Hosted Router

Anyone have performance metrics related to AWS instance size? I'm looking at using the CHR as a VPN/Router for a corporate cloud infrastructure, and want to be able to price out the instance sizes in terms of routing performance within the VPC as well as number of concurrent users I can support via ...
by mpreissner
Wed Jan 13, 2016 1:30 pm
Forum: General
Topic: CHR performance in AWS?
Replies: 2
Views: 1045

Re: CHR performance in AWS?

bump...

Nobody's tried this? Anyone from MT have some metrics?
by mpreissner
Wed Jan 13, 2016 1:29 pm
Forum: General
Topic: joining domain windows 2003 through Mikrotik
Replies: 1
Views: 297

Re: joining domain windows 2003 through Mikrotik

Unless you've changed the default setup, the firewall should allow anything through from an internal LAN to another internal LAN. Since it sounds like your provider is VLANing your two offices together, you theoretically should be able to do this, but I'd imagine that your VLAN connection is over yo...
by mpreissner
Mon Jan 11, 2016 8:05 pm
Forum: General
Topic: Problem with CCR1009
Replies: 2
Views: 692

Re: Problem with CCR1009

Chechito is right on if you're using ports 1-4. Since they all share a single 1 Gbps link to the CPU, they're great for aggregating multiple small ISP links (i.e. 250 mbps from each of 4 providers) without wasting the Direct-to-CPU ports 5-8.
by mpreissner
Mon Jan 11, 2016 7:55 pm
Forum: General
Topic: CHR performance in AWS?
Replies: 2
Views: 1045

CHR performance in AWS?

Looking at possibly using CHR in AWS as a router/VPN to a cloud-hosted corporate infrastructure. Curious about instance sizing and performance, specifically, how large an instance do I need to support x users with SSTP VPN. Curious to see any metrics anyone can provide.

Thanks!
by mpreissner
Mon Jan 11, 2016 5:46 pm
Forum: Beginner Basics
Topic: DHCP - how to block IP offer to the client ?
Replies: 6
Views: 1451

Re: DHCP - how to block IP offer to the client ?

The default behavior on Windows (and Mac) computers is that a wired connection is always given preference over a wireless when both connections are active. I agree with ZeroByte...use a larger IP space. Or, you could set your wireless up to use a different subnet than your wired network. Either way,...
by mpreissner
Mon Jan 11, 2016 3:02 pm
Forum: SwOS
Topic: Help !!! Need Config help for crs mikrotik switch
Replies: 5
Views: 2226

Re: Help !!! Need Config help for crs mikrotik switch

You should post over in the Beginner Basics or General forums. The CRS runs RouterOS, not SwOS, so you'll get much more visibility over in those forums.
by mpreissner
Mon Jan 11, 2016 2:29 pm
Forum: Beginner Basics
Topic: Bonding SFP with CRS226
Replies: 1
Views: 712

Re: Bonding SFP with CRS226

Since you're using bridges, you need to enable Spanning Tree Protocol. By running redundant links between the switches, you're creating a switching loop. Turn on STP, and it should clear up. Or, disconnect one of the links, set up your bonding interface to include the two SFP's, and then reconnect t...
by mpreissner
Thu Dec 31, 2015 2:40 pm
Forum: SwOS
Topic: Basic ip addressing use and bridge setup
Replies: 1
Views: 1437

Re: Basic ip addressing use and bridge setup

Try posting in the Beginner Basics or General forums. This forum is only for SwOS devices, and the CRS is ROS.
  • 1
  • 2