Community discussions

Search found 395 matches

  • 1
  • 2
by troffasky
Thu Sep 19, 2019 2:00 pm
Forum: RouterBOARD hardware
Topic: Did Rb 1100AH manage more than 700 Users?
Replies: 3
Views: 739

Re: Did Rb 1100AH manage more than 700 Users?

How about saying how your 3011 is coping with your workload? That will give anyone reading this thread a better idea of how an 1100AH [presumably x4] would handle your workload.
by troffasky
Sun Apr 07, 2019 11:56 am
Forum: General
Topic: IPV6 passthrough rules
Replies: 14
Views: 1721

Re: IPV6 passthrough rules

IPv6 Connection Type: Passthrough WAN IPv6 Address: 2001:568:8561:3800:4a5b:38ff:fe27:120/64 WAN IPv6 Gateway: fe80::72f1:86ff:fe95:1530 LAN IPv6 Address: 2001:568:8561:3800:4a5b:38ff:fe25:120/64 LAN IPv6 Link-Local Address: fe80::4a5b:38ff:fe27:120/64 LAN IPv6 Prefix: 2001:568:8561:3800::/64 DNS S...
by troffasky
Wed Apr 03, 2019 12:40 pm
Forum: General
Topic: IPV6 passthrough rules
Replies: 14
Views: 1721

Re: IPV6 passthrough rules

/ipv6 address add address=2001:568:8561:39ff:82f1:86ff:fe85:1531 disabled=yes interface=ether1 add address=2001:568:8561:39ff:82f1:86ff:fe85:1530 interface=bridge Two IPs from same subnet on LAN and WAN interfaces? What are you expecting to happen here? Perhaps reconnect your old router and "ip -6 ...
by troffasky
Thu Mar 14, 2019 11:47 pm
Forum: RouterBOARD hardware
Topic: MUM Europe 2019: new hardware
Replies: 61
Views: 11969

Re: MUM Europe 2019: new hardware

is a common designation use the term tri band router referring to a 2 x 5ghz + 1 2.4 ghz router
Just because it's common doesn't mean that it isn't idiocy. Shame that Mikrotik perpetuate this. It's like calling gigabit ethernet 2Gbps because it's 1Gbps in each direction.
by troffasky
Wed Apr 04, 2018 11:12 pm
Forum: General
Topic: Any plans to make cross-platform WinBox?
Replies: 33
Views: 2968

Re: Any plans to make cross-platform WinBox?

There doesn't have to be 2 separate apps, Mikrotik can abandon WinBox, it's UI looks a little archaic anyway and release a cross-platform Qt app :) Let's hope Mikrotik don't fix the "archaic" appearance of Winbox by turning it into some low-contrast abomination with gradient blends and animations. ...
by troffasky
Wed Mar 28, 2018 6:01 pm
Forum: RouterBOARD hardware
Topic: LHG 60G
Replies: 63
Views: 13736

Re: LHG 60G

Is 'wireless wire dish' same thing as LHG 60G?:

https://www.mikrotik.com/download/share ... reDish.pdf
by troffasky
Wed Mar 14, 2018 11:34 pm
Forum: Wireless Networking
Topic: CAPs devices working as independent from CAPsMAN as possible
Replies: 5
Views: 810

Re: CAPs devices working as independent from CAPsMAN as possible

I have considered some sort of back up scenario. Where the AP has the config in cap and it is set as the back up.
What we need is CAPsMANMAN to sync configs between main CAPsMAN and backup CAPsMAN. Maybe in v7.
by troffasky
Wed Mar 07, 2018 3:25 pm
Forum: Wireless Networking
Topic: CAPs devices working as independent from CAPsMAN as possible
Replies: 5
Views: 810

Re: CAPs devices working as independent from CAPsMAN as possible

I agree. In scenarios where CAPsMAN is not involved heavily with station traffic [eg local forwarding, WPA2-Personal], CAPs should not freak out because they can't see CAPsMAN. Consider also a scenario where CAPsMAN is centralised and maybe WAN link is congested. There should be a way to tune how lo...
by troffasky
Tue Mar 06, 2018 2:56 pm
Forum: Wireless Networking
Topic: hAP ac + wAP ac (as Wi-Fi coverage improvement).
Replies: 16
Views: 1914

Re: hAP ac + wAP ac (as Wi-Fi coverage improvement).

Yes, you can keep both APs on the same network.
by troffasky
Fri Mar 02, 2018 11:30 pm
Forum: Wireless Networking
Topic: Xiaomi phone low Wifi TX rate [SOLVED]
Replies: 112
Views: 26741

Re: Xiaomi phone low Wifi TX rate [SOLVED]

Do you suggest choosing a phone specifically for the router? Because not all phones work well with your devices. Are you seriously??? He said "Either solution works fine", so you can choose a different phone if you must keep using the RB951, or choose a different AP if you must use a specific incom...
by troffasky
Wed Feb 21, 2018 11:55 pm
Forum: General
Topic: IPv6 is not advertising (over PPPoE)
Replies: 18
Views: 2399

Re: IPv6 is not advertising (over PPPoE)

ROS6 uses kernel 3.3.5.
by troffasky
Wed Feb 21, 2018 6:07 pm
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1831

Re: How to configure MikroTik to be primary router?

The MT should be a router. It should get the public IP. From there onwards the ASUS will be one of the clients of the MT and will be in Bridge mode (as advised by ExpressVPN) , then even more the devices will all be connected to the ASUS. How would the port forwarding look like? What type of VPN it...
by troffasky
Tue Feb 20, 2018 2:46 pm
Forum: General
Topic: Router capacity
Replies: 14
Views: 1067

Re: Router capacity

Should we increase the APs numbers? Should we place them in a certain way allowing users to evenly connect to one of them? Should we work with the hotel’s equipment? Other suggestions? Dual band AP for sure. Hopefully some clients end up on 5G radio and some on 2G. Also, high-density wifi design is...
by troffasky
Tue Feb 20, 2018 2:36 pm
Forum: General
Topic: RB1100Dx4 Multicore issue ?
Replies: 18
Views: 1498

Re: RB1100Dx4 Multicore issue ?

I just want you guys to know the CCR1009 just solved the problem. every single core works!
Did you log a ticket with support? I am sure they would be interested to know.
by troffasky
Tue Feb 20, 2018 2:32 pm
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1831

Re: How to configure MikroTik to be primary router?

"Reasonable" is a question that only you can answer because it's your network. If you explained why you want to use both routers at once, perhaps someone could hazard a guess.
by troffasky
Wed Jan 10, 2018 11:16 pm
Forum: RouterBOARD hardware
Topic: [Solved] Wireless wire indoor use
Replies: 5
Views: 786

Re: [Solved] Wireless wire indoor use

"Same" if you're not bothered about lack of ethernet ports, yeah.
by troffasky
Sat Jan 06, 2018 2:45 am
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 314
Views: 87677

Re: Mikrotik VDSL / DSL Modem?

In case there's any lingering doubt about the economic viability of selling a DSL interface, look at how much red there is in the bar chart: https://www.ispreview.co.uk/index.php/2018/01/examining-countries-advertise-broadband-isp-speeds-vs-uk.html Two thirds of internet connections in the EU are su...
by troffasky
Thu Dec 28, 2017 8:09 pm
Forum: RouterBOARD hardware
Topic: MUM Europe 2017: new hardware incoming!
Replies: 86
Views: 20734

Re: MUM Europe 2017: new hardware incoming!

How is the CRS112-8P-4S coming along?
by troffasky
Thu Nov 30, 2017 2:56 pm
Forum: General
Topic: Forum troubles
Replies: 39
Views: 2748

Re: Forum troubles

I changed my forum theme to a forum theme that doesn't allow changing the forum theme, but as soon as I login to reply to this post, theme has gone back to the old default!
by troffasky
Sat Nov 25, 2017 12:56 am
Forum: Beginner Basics
Topic: Licensing quesiton.
Replies: 1
Views: 249

Re: Licensing quesiton.

All hardware from Mikrotik that runs RouterOS ships with a license key.
License-key-on-HDD is only relevant to non-Mikrotik hardware running RouterOS.
Licensing is not related to management of the router and who has access to it.
by troffasky
Sat Nov 25, 2017 12:53 am
Forum: Announcements
Topic: v6.41rc [release candidate] is released! New bridge implementation!
Replies: 561
Views: 123673

Re: v6.41rc [release candidate] is released! New bridge implementation!

*) firewall - added "tls-host" firewall matcher (CLI only); Sweet. No more Layer 7 for HTTPS blocking :) How it works? Which packet matches? Does it support wildcards? I presume this is just a special case of a Layer 7 with some pre-defined pattern, and only works when SNI is used. No need for SNI,...
by troffasky
Wed Nov 22, 2017 6:05 pm
Forum: RouterBOARD hardware
Topic: mAP and wAP 48v DC Jack 8-57v - FALSE
Replies: 2
Views: 570

Re: mAP and wAP 48v DC Jack 8-57v - FALSE

Probably better to email support if a proper response is required.
by troffasky
Wed Nov 22, 2017 12:38 am
Forum: Beginner Basics
Topic: Cisco ASA change to CCR1072
Replies: 6
Views: 843

Re: Cisco ASA change to CCR1072

Dear Forum Users, I would like to change my two Cisco ASA 5520 for two MikroTik CCR1072-1G-8S+. The Cisco ASA 5520 firewall throughput 450Mbps. This value is few. I'm looking for a device that knows the following: - device redundancy ( High Availability / Failover ) Unfortunately there isn't native...
by troffasky
Wed Nov 22, 2017 12:17 am
Forum: Wireless Networking
Topic: Noise Floor
Replies: 7
Views: 5601

Re: Noise Floor

Do you actually get better speeds/lower packet loss?

A few possibilities:
- Better RF design with improved filtering and rejection will get you a better noise floor
- Perhaps old card wasn't seated/connected properly
- Cards may not be calibrated the same
- Different cards may have different firmware
by troffasky
Mon Nov 20, 2017 7:18 pm
Forum: Announcements
Topic: v6.41rc [release candidate] is released! New bridge implementation!
Replies: 561
Views: 123673

Re: v6.41rc [release candidate] is released! New bridge implementation!

You have 15 sites of a problematic type for which it costs $1000 to make a support visit and you don't have a way to test a similar site from home (a subscription to the same satellite service)? Don't need a satellite dish to emulate the behaviour of a typical satellite link: https://wiki.linuxfoun...
by troffasky
Sat Nov 18, 2017 11:47 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 314
Views: 87677

Re: Mikrotik VDSL / DSL Modem?

BTW, are there any cheap mini-PCI VDSL
I haven't been able to find a mini-PCI(e) VDSL interface at any price, never mind cheap.
by troffasky
Sat Nov 18, 2017 12:11 pm
Forum: General
Topic: Where is my 10 Gb ?
Replies: 4
Views: 626

Re: Where is my 10 Gb ?

Probably CPU can't saturate 10Gbps link, however, those results do seem a little low.
What happens if you try 1G copper link instead?
A more realistic result will be obtained by testing with a device connected to each switch.
by troffasky
Sat Nov 18, 2017 11:25 am
Forum: General
Topic: Global DNS Ping fluctuating in mikroitk ccr1009
Replies: 3
Views: 392

Re: Global DNS Ping fluctuating in mikroitk ccr1009

Any other destinations affected? Even though it is regularly used as such, 8.8.8.8 is not a "monitoring service". I had to switch a customer from pinging 8.8.8.8 to 8.8.4.4 for state tracking, because the former stopped responding [but only on one of their WANs].
by troffasky
Sat Nov 18, 2017 12:21 am
Forum: General
Topic: Bug: SNMP over VRRP interface problem
Replies: 19
Views: 2050

Re: Bug: SNMP over VRRP interface problem

Look further up the page:

viewtopic.php?p=628352#p605812
by troffasky
Fri Nov 17, 2017 6:45 pm
Forum: RouterBOARD hardware
Topic: New hardware - mAP
Replies: 154
Views: 51304

Re: New hardware - mAP

You could read between the lines as follows - this page has been obsoleted:

https://wiki.mikrotik.com/wiki/Supported_Hardware

in favour of this page:

https://wiki.mikrotik.com/wiki/Manual:Peripherals

so you could read that as no, no USB NIC support.
by troffasky
Thu Nov 16, 2017 11:59 pm
Forum: Wireless Networking
Topic: Setup WISP for 1.5km from base...
Replies: 9
Views: 914

Re: Setup WISP for 1.5km from base...

Whats the procedure to cover network for whole area ? Can u mention Network diagram and devices ? You need to backhaul your APs with something. You will struggle if you try to provide access and do backhauling in 2.4GHz band. Sure, Wifi repeater products exist [maybe even RouterOS can be persuaded ...
by troffasky
Thu Nov 16, 2017 6:39 pm
Forum: General
Topic: HTTPS does not records in Mikrotik log
Replies: 13
Views: 905

Re: HTTPS does not records in Mikrotik log

Ok, I understand now. is there is a expert way to trace the encrypted HTTPS requests? because I want to record all breached roles. You can monitor encrypted traffic but there are legal and technical obstacles. You need to a) work out if it's legal where you are b) get the monitored devices to trust...
by troffasky
Thu Nov 16, 2017 6:34 pm
Forum: General
Topic: HTTPS does not records in Mikrotik log
Replies: 13
Views: 905

Re: HTTPS does not records in Mikrotik log

How is the squid transparently proxying https without the end user getting problems?
Having re-read the thread, I have misunderstood. I had assumed the OP was using an explicit proxy not a transparent one.
by troffasky
Thu Nov 16, 2017 6:30 pm
Forum: General
Topic: HTTPS does not records in Mikrotik log
Replies: 13
Views: 905

Re: HTTPS does not records in Mikrotik log

This is not possible I have to disagree here. As an example, Squid logs the hostname that it proxied the connection to along with the number of bytes transferred. Hi troffasky, Could you please give me notes about squid logs to Monitoring of web searches and video viewing by employees especially "h...
by troffasky
Wed Nov 15, 2017 6:12 pm
Forum: General
Topic: HTTPS does not records in Mikrotik log
Replies: 13
Views: 905

Re: HTTPS does not records in Mikrotik log

This is not possible
I have to disagree here. As an example, Squid logs the hostname that it proxied the connection to along with the number of bytes transferred.
by troffasky
Wed Nov 15, 2017 6:09 pm
Forum: Wireless Networking
Topic: Band Steering implementation?
Replies: 46
Views: 11440

Re: Band Steering implementation?

How different beacon intervals can assure that one will be always before another if none knows when a client starts to scan and at what frequency it will be and how long he will be scanning before he decides to select an ap to try to connect? You can't be assured [ie 100% certain], but you don't ne...
by troffasky
Wed Nov 15, 2017 6:06 pm
Forum: Wireless Networking
Topic: Setup WISP for 1.5km from base...
Replies: 9
Views: 914

Re: Setup WISP for 1.5km from base...

If you literally mean "wifi repeater" then just give up now, because you won't get anywhere with it. If by "repeater" you mean "2.4GHz AP backhauled to <somewhere> with <something>" where <something> is a cable or a wireless connection on a different band, then you're getting warmer. Just bear in mi...
by troffasky
Sun Nov 05, 2017 11:18 pm
Forum: General
Topic: RouterOS supported hardware
Replies: 29
Views: 24200

Re: RouterOS supported hardware

Works for me.
by troffasky
Sun Nov 05, 2017 11:16 pm
Forum: Beginner Basics
Topic: Help me stop MAC spoofing
Replies: 37
Views: 7905

Re: Help me stop MAC spoofing

Off course someone can give login information to other people.
...which is an improvement on "other people" just taking your login without you knowing about it!
by troffasky
Sun Nov 05, 2017 1:40 pm
Forum: RouterBOARD hardware
Topic: Fastest Router for rough conditions
Replies: 2
Views: 526

Re: Fastest Router for rough conditions

You might want to state what kind of operating temperature range you're seeing and expecting to see.
by troffasky
Sun Nov 05, 2017 1:38 pm
Forum: Wireless Networking
Topic: 5 GHz 360+ km Wi-Fi link via tropospheric ducting propagation
Replies: 2
Views: 628

Re: 5 GHz 360+ km Wi-Fi link via tropospheric ducting propagation

I didn't even know DXing on 5GHz was a thing until I saw this. Impressive stuff!
by troffasky
Sun Nov 05, 2017 12:26 am
Forum: Beginner Basics
Topic: Help me stop MAC spoofing
Replies: 37
Views: 7905

Re: Help me stop MAC spoofing

wifi scanners scans for the ip range therefore if you prevent it from showing ip addresses mac addresses wont be listed too I think you are confused. I linked to a screenshot of a wifi scanner by the name of "kismet", a tool I have used myself [you can also verify this easily enough, because it - a...
by troffasky
Wed Nov 01, 2017 12:28 am
Forum: General
Topic: Ipsec Site to Site, again...
Replies: 14
Views: 1849

Re: Ipsec Site to Site, again...

The only thing i can think is: from terminal in mikrotik the ping is sent from the WAN interface and that's why i see the hops like a traceroute to a normal site. I'm on the right way? Deunan. Yes, you're close. You will probably find that if you add src-address=<LAN IP> to your ping command, it wo...
by troffasky
Tue Oct 31, 2017 2:43 pm
Forum: Beginner Basics
Topic: Help me stop MAC spoofing
Replies: 37
Views: 7905

Re: Help me stop MAC spoofing

what you can do is prevent wifi scanners from showing your clients,s mac addresses by changing the network prefix lenghth from 24 to 32 MAC addresses are not encrypted on wifi. You can confirm this yourself with a tool like Kismet, eg: https://lh6.googleusercontent.com/VjbpXPoLPKGEjt-1WDc7QlOGP9an7...
by troffasky
Tue Oct 31, 2017 11:01 am
Forum: Beginner Basics
Topic: Random Websites Will Not Load\Open
Replies: 5
Views: 1084

Re: Random Websites Will Not Load\Open

The definitive answer will come from your ISP, but generally speaking, 1500 if the service is delivered over ethernet, 1492 if it's coming over DSL. Also, blocking ICMP will prevent Path MTU Discovery from working and PMTUD can be helpful.
by troffasky
Fri Oct 27, 2017 3:12 pm
Forum: Beginner Basics
Topic: Business with limited Bandwidth and out of control usage
Replies: 6
Views: 659

Re: Business with limited Bandwidth and out of control usage

Just looked at squid logs, CONNECT method shows bytes transferred as well. So not useless at all :-)
by troffasky
Fri Oct 27, 2017 5:44 am
Forum: Beginner Basics
Topic: VPN blocked in mikrotik?
Replies: 4
Views: 596

Re: VPN blocked in mikrotik?

The issue with OpenVPN UDP and RouterOS is where RouterOS is terminating the OpenVPN connection, not with OpenVPN endpoints connecting through RouterOS.
by troffasky
Fri Oct 27, 2017 5:34 am
Forum: Beginner Basics
Topic: Random Websites Will Not Load\Open
Replies: 5
Views: 1084

Re: Random Websites Will Not Load\Open

I would start by checking out MTU.
by troffasky
Fri Oct 27, 2017 5:23 am
Forum: General
Topic: VoIP - Implemented in RouterOS
Replies: 23
Views: 2492

Re: VoIP - Implemented in RouterOS

Three points: Mikrotik need to focus on the fundamentals. Phone system probably doesn't belong in RouterOS. Mikrotik could build an "app store" of third-party RouterOS modules, of which one could be a phone system, I guess? The closest thing to a phone system that belongs in RouterOS is a) a SIP ALG...
by troffasky
Fri Oct 27, 2017 5:09 am
Forum: Beginner Basics
Topic: Business with limited Bandwidth and out of control usage
Replies: 6
Views: 659

Re: Business with limited Bandwidth and out of control usage

I would start by just putting Squid on the LAN and blocking web access from everything else. This would require that you explicitly configure the clients to use the proxy server. You can then watch the router to see who is still trying to get out on to the internet directly rather than via the proxy...
by troffasky
Sun Oct 22, 2017 12:17 pm
Forum: RouterBOARD hardware
Topic: Add WiFi interface to RouterOS in VirtualBox environment
Replies: 2
Views: 829

Re: Add WiFi interface to RouterOS in VirtualBox environment

Have you looked in to PCI(e) passthrough? A quick Google suggests that it actually won't be easy, but it should be possible.
by troffasky
Sat Oct 21, 2017 4:28 pm
Forum: Beginner Basics
Topic: Help me stop MAC spoofing
Replies: 37
Views: 7905

Re: Help me stop MAC spoofing

The first thing you should do is re-read every reply you've had in this thread and make a list of all the terms you don't understand. Take each one you don't understand and Google it. Write down some notes about what you find to help cement your knowledge. Nobody is paid to post on these forums and ...
by troffasky
Sat Oct 21, 2017 1:49 pm
Forum: General
Topic: Manufacturer defect on two CCR1016-12S-1S+
Replies: 1
Views: 387

Re: Manufacturer defect on two CCR1016-12S-1S+

Try emailing support.
by troffasky
Sun Oct 08, 2017 10:23 pm
Forum: General
Topic: Odd VOIP Behavior on Mikrotik 3011
Replies: 12
Views: 1034

Re: Odd VOIP Behavior on Mikrotik 3011

Did disabling the SIP ALG make any difference to the observed behaviour?
You need a packet capture of a phone that is failing to register. SIP is quite readable in Wireshark.
by troffasky
Sun Oct 08, 2017 1:25 pm
Forum: RouterBOARD hardware
Topic: hEX NAT performance
Replies: 5
Views: 3279

Re: hEX NAT performance

BTW – MT Wiki says:
Fasttracked packets bypass firewall, connection tracking
So now with Fasttrack conntrack works or not?
Connection tracking is essential for NAT, so either that page is wrong, or there is a subtlety to the phrase "connection tracking" as they use it.
by troffasky
Sat Sep 30, 2017 11:51 am
Forum: Beginner Basics
Topic: Spectrum IPv6 - unreachable? [SOLVED]
Replies: 4
Views: 928

Re: Spectrum IPv6 - unreachable? [SOLVED]

Your router only has one IP address and no link-local addresses. I am not 100% sure but I think you're not going be doing much routing if you only have one IP.
Does anything show up in the neighbour table? [/ipv6 neighbor print]
by troffasky
Tue Aug 29, 2017 5:25 pm
Forum: General
Topic: Internet starts working after i do IP Scan
Replies: 34
Views: 2987

Re: Internet starts working after i do IP Scan

If it didn't work when you connected your PC directly then you've eliminated the switches as the source of the issue.
by troffasky
Sat Jul 08, 2017 9:20 am
Forum: General
Topic: Way to Internet via EoIP is broken for MTU issue?
Replies: 5
Views: 1527

Re: Way to Internet via EoIP is broken for MTU issue?

You're going to have to give more detailed diagnostic information than "web sites still won't open" if you want a useful response. What troubleshooting have you tried and what was the outcome?
by troffasky
Sat Jul 08, 2017 8:59 am
Forum: General
Topic: Unexpected Local IPv6 Packet
Replies: 8
Views: 737

Re: Unexpected Local IPv6 Packet

/ipv6 neighbour print

Doesn't really look like broadcast though as the destination is not a broadcast address. Perhaps include the port so you get an idea what the traffic is.
by troffasky
Fri Jun 30, 2017 11:58 pm
Forum: General
Topic: Half duplex 100 only and link duplex mismatch on hAP Lite and EPON
Replies: 22
Views: 3692

Re: Half duplex 100 only and link duplex mismatch on hAP Lite and EPON

keep in mind that 100mbps cable speed, on tcp protocol is approx 50-70 mbps.
Nah. I would expect 94Mbps TCP throughput on 100M ethernet. If you're getting 50-70M on 100M ethernet, something's wrong.
by troffasky
Fri Jun 30, 2017 11:52 pm
Forum: General
Topic: Make an ip act like another
Replies: 2
Views: 330

Re: Make an ip act like another

You could NAT it, or you could specifically allow access to the printer's actual IP address.
by troffasky
Fri Jun 30, 2017 11:48 pm
Forum: General
Topic: Mikrotik router duplicates every single IP address on the network
Replies: 12
Views: 1505

Re: Mikrotik router duplicates every single IP address on the network

Do you have proxy-arp enabled on the interface?
by troffasky
Mon Jun 26, 2017 2:33 pm
Forum: RouterBOARD hardware
Topic: LHG 60G
Replies: 63
Views: 13736

Re: LHG 60G

was the internal mikrotik codename xmaster?
Am I the only one that read 'xhamster'? :lol:
Yeah, looks like it!
by troffasky
Sun Jun 25, 2017 12:48 am
Forum: General
Topic: Bug: SNMP over VRRP interface problem
Replies: 19
Views: 2050

Re: Bug: SNMP over VRRP interface problem

I can think of at least one reason why you'd want DNS queries to the virtual IP to work - high availability. If you give out one of the physical router IPs as the DNS server in DHCP options, what happens when that router fails over to the other one?
by troffasky
Mon Jun 05, 2017 7:19 pm
Forum: Beginner Basics
Topic: LAN to LAN NAtting
Replies: 6
Views: 1122

Re: LAN to LAN NAtting

Did you read the thread I posted a link to?
by troffasky
Wed May 31, 2017 12:08 am
Forum: Wireless Networking
Topic: LHG5 P2P and WPS Problem
Replies: 2
Views: 315

Re: LHG5 P2P and WPS Problem

Why use WDS if it's routed?
by troffasky
Tue May 30, 2017 10:10 pm
Forum: Beginner Basics
Topic: LAN to LAN NAtting
Replies: 6
Views: 1122

Re: LAN to LAN NAtting

It can be done:
viewtopic.php?t=72897
I can't see how it'll work with a dynamic IP on your end. You may have to use static or DHCP reserved.
Or just be lazy and NAT the whole /24.
by troffasky
Tue May 30, 2017 9:49 pm
Forum: Scripting
Topic: Getting realtime traffic speeds from interface
Replies: 3
Views: 887

Re: Getting realtime traffic speeds from interface

If it's true that once speed is above 1000kbps, it shows as 1553.0... then report it to support@
by troffasky
Tue May 30, 2017 9:47 pm
Forum: Scripting
Topic: fetch where the site employs redirect
Replies: 2
Views: 820

Re: fetch where the site employs redirect

Fetch it with wget and see where the redirect goes, and use that.
by troffasky
Mon May 29, 2017 1:32 pm
Forum: Wireless Networking
Topic: 12x wAP & controlling frequency
Replies: 9
Views: 940

Re: 12x wAP & controlling frequency

configure them in such a way that the wAP's with the same channel are as far as possible apart from each other. Have you verified that this has been effective? Also 5Ghz has been enabled. This setup is in a harbour, outside on the boot I've good WIFI connection, but inside the boot it still stays a...
by troffasky
Sun May 28, 2017 12:37 pm
Forum: Wireless Networking
Topic: wAP ac compatibility issues intel wifi
Replies: 10
Views: 2128

Re: wAP ac compatibility issues intel wifi

With regards to the rest of the thread, my experience is that the Intel wifi drivers do not allow >20Mhz channels on 2.4GHz, eg: https://communities.intel.com/thread/51241 I poked and prodded the iwlwifi module and settings with iw all I could but it stubbornly stays on 20MHz. My cheap'n'nasty Dynam...
by troffasky
Sun May 28, 2017 11:56 am
Forum: Wireless Networking
Topic: one network including AP and ethernet?
Replies: 7
Views: 608

Re: one network including AP and ethernet?

So if I would use the same range of ip addresses on two networks there would be a problem if I bridge the two? You should bridge (or switch the two) if you want to use the same range of addresses (same L2 segment). I mean if I have one computer on one network with the ip address 192.168.1.10 and on...
by troffasky
Sun May 28, 2017 11:42 am
Forum: Wireless Networking
Topic: Connecting multiple CAPs
Replies: 3
Views: 527

Re: Connecting multiple CAPs

No, you don't need another CAPsMAN:

https://wiki.mikrotik.com/wiki/Manual:C ... Connection
by troffasky
Sat May 27, 2017 10:31 pm
Forum: Wireless Networking
Topic: Dual wireless link - loadbalance/failover
Replies: 5
Views: 839

Re: Dual wireless link - loadbalance/failover

That's the "easy" answer but doesn't fulfil your original requirement of load balancing. Maybe bonding the two links would, however?
by troffasky
Sat May 27, 2017 8:24 pm
Forum: Wireless Networking
Topic: Dual wireless link - loadbalance/failover
Replies: 5
Views: 839

Re: Dual wireless link - loadbalance/failover

Ideally to do what you want, the radio would be connectorised so you can have the two sets of antennae some distance apart [so that when one is obscured, the other isn't, hopefully]. You haven't mentioned which of the two bands you're using at present. Are you able to repeat the obstruction on deman...
by troffasky
Sat May 20, 2017 6:49 pm
Forum: General
Topic: VLAN not working L2
Replies: 19
Views: 1634

Re: VLAN not working L2

i used and It working Maybe i didn't clarify my requirements. The model we are using is only a 2pon OLT. Maybe you used a 4 PON model which may have this function What part of what jimmytam said don't you understand? The datasheet says it will do what you're asking, jimmytam says it will do what yo...
by troffasky
Mon May 08, 2017 5:57 pm
Forum: General
Topic: [6.39.1] Performance-Issue: OVPN-Client + Simple Mangle Rule
Replies: 3
Views: 672

Re: [6.39.1] Performance-Issue: OVPN-Client + Simple Mangle Rule

What is difference between CPU usage on "plain internet" and VPN'ed internet?

Edit: TBH there is probably no point asking here. If an export of the config is identical before/after upgrade, then it's a RouterOS performance regression and nobody on the forums can help you with that.
by troffasky
Thu May 04, 2017 8:28 pm
Forum: RouterBOARD hardware
Topic: Modern hardware
Replies: 7
Views: 813

Re: Modern hardware

mind telling me the point of -> ac <- when your backbone is 100mbps?
If you are a performance junkie, you can either buy something else with gigabit ports, or trunk two 100M ports.
by troffasky
Wed May 03, 2017 1:11 pm
Forum: Beginner Basics
Topic: CRS226-24G-S+ Basic Switch Configuration
Replies: 1
Views: 301

Re: CRS226-24G-S+ Basic Switch Configuration

There will be several different VLANs on all the 24 access ports and I like to use both 10G uplinks to other switches on the campus as trunk ports. I´m not able to configure "/interface ethernet switch egress-vlan-tag add tagged-ports" because I can only specify one of the SFP+ ports. What is diffe...
by troffasky
Tue May 02, 2017 7:00 pm
Forum: General
Topic: EoIP/IPSec poor performance
Replies: 4
Views: 925

Re: EoIP/IPSec poor performance

I finally set it to blowfish and it's working, got around 50Mbps between Windows Station in TCP, but only 1Mbps in UDP From 'man iperf': CLIENT SPECIFIC OPTIONS -b, --bandwidth n[KMG] | npps set target bandwidth to n bits/sec (default 1 Mbit/sec) or n packets per sec. This may be used with TCP or U...
by troffasky
Tue May 02, 2017 6:51 pm
Forum: Beginner Basics
Topic: printer scanner very slow on capsman
Replies: 13
Views: 1307

Re: printer scanner very slow on capsman

What is the mode of printer/scanner ? B ? G? N ?
Unlikely to be B or G if it's connected at 58Mbps.
by troffasky
Sun Apr 23, 2017 12:33 pm
Forum: RouterBOARD hardware
Topic: wAP AC (General questions and experience)
Replies: 118
Views: 44378

Re: wAP AC (General questions and experience)

Could you update this page accordingly?:

https://routerboard.com/RBwAPG-5HacT2HnD {,-BE}

Just says "PoE in 802.3at" [as do the websites of the usual vendors I have checked].
by troffasky
Mon Apr 17, 2017 10:40 pm
Forum: Forwarding Protocols
Topic: VRRP ipv6 vlan/crossover
Replies: 14
Views: 1155

Re: VRRP ipv6 vlan/crossover

Which is why I suggested trying to filter it.
by troffasky
Wed Apr 12, 2017 10:47 am
Forum: Forwarding Protocols
Topic: VRRP ipv6 vlan/crossover
Replies: 14
Views: 1155

Re: VRRP ipv6 vlan/crossover

The idea with the bridge sounds weird, have you ever seen that live?
No, hence describing it as a long shot.
by troffasky
Wed Apr 12, 2017 12:40 am
Forum: Forwarding Protocols
Topic: VRRP ipv6 vlan/crossover
Replies: 14
Views: 1155

Re: VRRP ipv6 vlan/crossover

Bit of a long shot....
Bridge your "crossover" link with your LAN uplink on each router. This is the long shot bit...can you apply a filter to just the LAN uplink that would block VRRP on that interface?
by troffasky
Wed Apr 12, 2017 12:09 am
Forum: General
Topic: Is it possible to create virtual interfaces and separate traffic between them?
Replies: 6
Views: 1642

Re: Is it possible to create virtual interfaces and separate traffic between them?

Perhaps look at exporting flows to a netflow collector instead? Assuming you actually want to do something with this information once you've got it, a collector is a good place to start.

Using a different subinterface for each client won't scale well.
by troffasky
Tue Apr 11, 2017 9:46 am
Forum: General
Topic: RouterOS hot standby via VRRP
Replies: 4
Views: 964

Re: RouterOS hot standby via VRRP

One interesting thing is that it's possible to "mix protocols". Tell VRRP to use IPv6 and it will be happy with link-local addresses. And then you can add your single IPv4 address to virtual interface. I hadn't even thought of IPv6! A good justification for not using IPs in the same subnet would be...
by troffasky
Sat Apr 08, 2017 1:15 am
Forum: General
Topic: RouterOS hot standby via VRRP
Replies: 4
Views: 964

Re: RouterOS hot standby via VRRP

"Yes", some years ago:
viewtopic.php?t=58420

"No", more recently:
/viewtopic.php?f=2&t=95829

I don't see why the virtual IP needs to be in the same subnet as the real IPs. So long as the two real IPs can see each other, why does it matter?
by troffasky
Sat Feb 25, 2017 11:04 pm
Forum: General
Topic: Leaseline (Fibre Ethernet)
Replies: 6
Views: 674

Re: Leaseline (Fibre Ethernet)

It seems it's my option to take the Cisco router or not however they cannot monitor the line without it.
What do you guys think?
Do you want them to monitor the line?
If you want them to monitor it, is the cost of having their router worth it to you?
by troffasky
Sat Feb 25, 2017 4:35 pm
Forum: General
Topic: NetDuma
Replies: 8
Views: 2930

Re: NetDuma

Don't quite see what the problem is?
Perhaps that's because there isn't one?
by troffasky
Sat Feb 25, 2017 12:38 pm
Forum: General
Topic: Subnet prefix capture for traffic analyis
Replies: 3
Views: 332

Re: Subnet prefix capture for traffic analyis

ntopng has an AS view but it's not really for reporting, more for a real-time view of stats. Has to beat looking up stuff manually though.
by troffasky
Thu Feb 23, 2017 10:00 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 90741

Re: https problem on hotspot

So what is actually happening, is that router does see the initial request from client and does redirect it, but client is not able to get the certificate and thus the browser displays an error, right? The client always gets a certificate but because the certificate offered doesn't have a common na...
by troffasky
Mon Feb 20, 2017 7:05 pm
Forum: General
Topic: https problem on hotspot
Replies: 97
Views: 90741

Re: https problem on hotspot

To start the SSL connection, doesn't the browser need first to connect to the server? By sending a request for connection, isn't it visible to the router on port 443 and as result redirected to hotspot login page? What am I missing here? When the client wants to connect to https://google.com, the c...
by troffasky
Sun Feb 12, 2017 6:51 pm
Forum: General
Topic: Research on Changing Serial Number for GPON ONU Module
Replies: 26
Views: 10181

Re: Research on Changing Serial Number for GPON ONU Module

Based on the hardware schematic and public available information, there is large chance that the module is more like a linux computer with two bridged interfaces.
This is fascinating, and a little bizarre. Surely running an entire OS on SFP is a massive overhead?
by troffasky
Sun Feb 12, 2017 5:30 pm
Forum: General
Topic: RB750Gr3 - port disable not work after reboot
Replies: 2
Views: 407

Re: RB750Gr3 - port disable not work after reboot

The behaviour you're describing sounds like a bug and as it's a very simple scenario, try reporting it to Mikrotik, however...which behaviour are you expecting?
- Disable interface, reboot, interface is enabled
- Disable interface, reboot, interface is disabled [and lights stay off]
by troffasky
Sun Feb 12, 2017 4:44 pm
Forum: General
Topic: Brand New CRS with High "Management" CPU Usage...
Replies: 14
Views: 3088

Re: Brand New CRS with High "Management" CPU Usage...

What should level of CPU usage for management be?
by troffasky
Sun Feb 12, 2017 3:57 pm
Forum: Beginner Basics
Topic: Problem with access two SXT Mikrotiks in bridge mode in the same network
Replies: 1
Views: 405

Re: Problem with access two SXT Mikrotiks in bridge mode in the same network

Did you perhaps import backup from SXT to the other to speed up your deployment [I know that's exactly what I would have done]? Backup contains MAC addresses so doing this will cause, ahem, interesting behaviour.
by troffasky
Sun Feb 12, 2017 3:33 pm
Forum: General
Topic: Reading a backup
Replies: 5
Views: 1677

Re: Reading a backup

backups are intended for a given routerboard device and ROS version. I sense a business opportunity here - many admins only discover that they should have done an 'export' instead of a 'backup'[1] when their original router dies and they need to restore it on replacement hardware! You could charge ...
by troffasky
Sun Feb 12, 2017 12:46 pm
Forum: Beginner Basics
Topic: If https url is encrypted, how walled garden allows it by regex?
Replies: 2
Views: 669

Re: If https url is encrypted, how walled garden allows it by regex?

I won't claim to understand it, but certificate is not encrypted so common name/alt name can be read from it.
by troffasky
Thu Feb 02, 2017 10:53 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 314
Views: 87677

Re: Mikrotik VDSL / DSL Modem?

If so, this needs to be accessible remotely, ie through the usual RouterOS management tools.
by troffasky
Sun Jan 29, 2017 11:48 pm
Forum: RouterBOARD hardware
Topic: New hardware - mAP
Replies: 154
Views: 51304

Re: New hardware - mAP

So, in summary, can we pass 802.3af PoE in to the mAP2nD and get 802.3af PoE out of it? Not sure about 802.3af in ether2, but an active PoE device turns on instantly and works well... According to the manual for the Yealink W52P it is an 802.3af device, and I doubt that Cisco SB PoE switch is anyth...
by troffasky
Sun Oct 23, 2016 1:16 am
Forum: General
Topic: SNMP LTE signal strength
Replies: 13
Views: 6216

Re: SNMP LTE signal strength

Changing OIDs after a reboot or interface down/up is not a RouterOS bug, it is a problem in understanding how SNMP works. Sure it is an often-made mistake to hardwire OIDs that end in an interface number, assuming that this number is fixed. This is not guaranteed. I think you're under the impressio...
by troffasky
Sun Oct 23, 2016 12:59 am
Forum: General
Topic: Feature request for v7.x
Replies: 269
Views: 63649

Re: Feature request for v7.x

There is this small, not-well-known but very useful tool called "etckeeper" for Linux, which automatically commits all changes you do on your configuration to the version-control-system of your choice (git, svn...). An implementation of that for MikroTik would be interesting I suggest you look at R...
by troffasky
Sun Oct 23, 2016 12:46 am
Forum: RouterBOARD hardware
Topic: New hardware - mAP
Replies: 154
Views: 51304

Re: New hardware - mAP

802.3af PoE is working OK this time. :)
So, in summary, can we pass 802.3af PoE in to the mAP2nD and get 802.3af PoE out of it?
by troffasky
Sat Aug 06, 2016 12:27 am
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 314
Views: 87677

Re: Mikrotik VDSL / DSL Modem?

If it's big enough to fit a PCIE card in, then the box is too big for me. MicroPCIE would work.
by troffasky
Wed May 25, 2016 3:22 pm
Forum: Wireless Networking
Topic: How do you weather proof your feed horn cables?
Replies: 5
Views: 1149

Re: How do you weather proof your feed horn cables?

use two layers and apply one in a clockwise direction and at the end of first layer apply the second in a anti-clockwise direction
Pardon me if this is a silly question, but doesn't that mean that each layer's tendency would be to unwrap the other?
by troffasky
Tue May 10, 2016 7:25 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 314
Views: 87677

Re: Mikrotik VDSL / DSL Modem?

anybody thinking this way about copper pair surely has not see the problems about isolation on outdoor cooper wires or/and induction ac or dc problems i think docsis has a better future because is more resistant to interference Which is all very well, but try explaining that to an ISP with millions...
by troffasky
Sun Jan 31, 2016 1:06 am
Forum: General
Topic: CCR-1036 only get 500mbps through put
Replies: 10
Views: 1906

Re: CCR-1036 only get 500mbps through put

Hmm thats pretty low.
Again, is it? Could be well within the indicated performance envelope, but without knowing the specifics, who knows...
There is a known limit of 1Gb/s on a single tcp stream.
I am certain that somebody from Mikrotik has denied this but I can't find the thread right now.
by troffasky
Sat Jan 30, 2016 12:28 pm
Forum: General
Topic: CCR-1036 only get 500mbps through put
Replies: 10
Views: 1906

Re: CCR-1036 only get 500mbps through put

You say "only" but have you checked the "Performance test results" table for your model? Depending how you do it and how you have it configured [wot Revelation asked], 500Mbps could be well within the expected performance for this model.
by troffasky
Sat Jan 30, 2016 1:04 am
Forum: General
Topic: CRS Vlan translation N-to-1
Replies: 1
Views: 553

Re: CRS Vlan translation N-to-1

The answer to your question is probably "yes". http://wiki.mikrotik.com/wiki/Manual:CRS_features#Ingress.2FEgress_VLAN_Translation Here is a guess: /interface ethernet switch egress-vlan-translation customer-vid=100 new-customer-vid=1000 ports=??? /interface ethernet switch ingress-vlan-translation ...
by troffasky
Sat Jan 30, 2016 12:43 am
Forum: General
Topic: Using an ADSL router as modem only.
Replies: 3
Views: 514

Re: Using an ADSL router as modem only.

I am actually not sure if I should be using a ppp client, a PPPTP client or a PPPoE client.
The example you linked says the Mikrotik would talk PPTP to the modem.
by troffasky
Sat Jan 30, 2016 12:38 am
Forum: General
Topic: Can I open a .backup file locally ??
Replies: 3
Views: 1234

Re: Can I open a .backup file locally ??

Short answer: no. Long answer: Almost. 'strings' will reveal some info from a .backup file but it looks more like status than config, to me [for example, can't see any IPv6 addresses in it]. If you google, you will find a method [mtpass] involving OpenWRT that looks like a proper ball-ache. Actually...
by troffasky
Sat Jan 30, 2016 12:23 am
Forum: General
Topic: PPPoE woes
Replies: 2
Views: 456

Re: PPPoE woes

From what you've posted, this is almost certainly a bug, so you'd be better off emailing support@.

Perhaps some config is hidden in the GUI?

/interface pppoe-client export verbose
by troffasky
Sat Jan 30, 2016 12:17 am
Forum: General
Topic: mikrotik curious about the name
Replies: 7
Views: 903

Re: mikrotik curious about the name

If you can be bothered to post a response, why not include the answer to the question instead of just being a smart-ass?
by troffasky
Sat Jan 23, 2016 1:26 pm
Forum: General
Topic: Halting performance with CRS226
Replies: 3
Views: 436

Re: Halting performance with CRS226

by troffasky
Sat Jan 23, 2016 1:20 pm
Forum: General
Topic: Ping Check All Clients With MikroTik Routers
Replies: 10
Views: 891

Re: Ping Check All Clients With MikroTik Routers

I think "The Dude" is better for your solution. This is a monitoring tool by MikroTik itself.
Quite - it sounds like the OP is trying to implement The Dude himself with scripts :-)
by troffasky
Sat Jan 23, 2016 1:19 pm
Forum: General
Topic: Is there DNS Issue in Microtik ?
Replies: 6
Views: 516

Re: Is there DNS Issue in Microtik ?

The only way to know is to test it. There is no reason to test on your live system either, as there are plenty of ways you can mock up a config in a virtual lab. Assign a test client with a selection of DNS servers, then create ACLs to block access to each DNS server in turn, and see how the client ...
by troffasky
Fri Jan 22, 2016 9:58 pm
Forum: General
Topic: traffic flow TX not see
Replies: 2
Views: 709

Re: traffic flow TX not see

Did this work in previous versions?
by troffasky
Wed Jan 20, 2016 3:43 pm
Forum: RouterBOARD hardware
Topic: Request: Natively manageable DSL modem
Replies: 1
Views: 623

Request: Natively manageable DSL modem

Would like to see from Mikrotik a DSL device that can be managed from RouterOS with some kind of module in ROS itself - similar I suppose to the way that CAPsMAN manages remote APs, although really only for local devices. If it could be powered with passive PoE from a Routerboard that would be great...
by troffasky
Tue Jan 19, 2016 11:34 pm
Forum: General
Topic: 10Gbps Real Life Performance
Replies: 11
Views: 2104

Re: 10Gbps Real Life Performance

...which is certainly not a problem the underlying OS has [64GB on 32-bit x86].
by troffasky
Sun Jan 10, 2016 2:15 pm
Forum: Beginner Basics
Topic: How to set up a "Home VPN" on RouterOS?
Replies: 12
Views: 2631

Re: How to set up a "Home VPN" on RouterOS?

For what exactly do I turn off DHCP? Bridging the LANs of your Mikrotik and your ISP router together would leave you with two DHCP servers running in the same L2 network. At this point only the ISP router's DHCP server would be giving out correct leases, so you turn off the one that's wrong [Mikrot...
by troffasky
Sun Jan 10, 2016 2:07 pm
Forum: General
Topic: Seemlingly Random High Temperatures
Replies: 8
Views: 1574

Re: Seemlingly Random High Temperatures

RB1100AHx2 and CRS125 in the same rack running the same software. Polling temperatures with SNMP. Most of the time the temperatures track each other pretty closely, but occasionally the CRS125 jumps up by about 40 degrees, and then back to where it was on the next poll. This is obviously not the rea...
by troffasky
Sun Jan 10, 2016 1:29 am
Forum: Beginner Basics
Topic: Fire Wall
Replies: 22
Views: 3292

Re: Fire Wall

In my opinion, you need get a professional in to come and have a look at your network. You aren't going to get this fixed via the medium of back-and-forth posts on a forum.
by troffasky
Sat Jan 09, 2016 12:33 pm
Forum: Beginner Basics
Topic: How to set up a "Home VPN" on RouterOS?
Replies: 12
Views: 2631

Re: How to set up a "Home VPN" on RouterOS?

It is default. WISP AP is says in the quick set. I will try your suggestion too.
Forgot to mention, turn off DHCP on Mikrotik too, otherwise it will work even less :lol:
by troffasky
Fri Jan 08, 2016 11:25 pm
Forum: Beginner Basics
Topic: How to set up a "Home VPN" on RouterOS?
Replies: 12
Views: 2631

Re: How to set up a "Home VPN" on RouterOS?

What configuration is on the Mikrotik? If it's at default, ether1 will be a DHCP client WAN, and if plugged into the existing LAN, will behave just as you've described. Try moving the link between the Mikrotik and the D-Link into something other than ether1 and see if it works.
by troffasky
Thu Jan 07, 2016 10:40 pm
Forum: General
Topic: google dns wierd issues
Replies: 2
Views: 1013

Re: google dns wierd issues

I have been having issues at some but not all of my sites where the captive portal will fail because their default home page is at an https site mostly google.com. Not really sure what you can do about this if the client device doesn't trust you, ie you can't give them a fake certificate for their ...
by troffasky
Thu Jan 07, 2016 10:17 pm
Forum: Beginner Basics
Topic: Mikrotik Asterisk
Replies: 1
Views: 1069

Re: Mikrotik Asterisk

Most likely issue when trying to load balance voice is that you've registered with a SIP peer from one WAN but then the load balancing sends a subsequent connection [signalling or media] out of another IP. Try turning off the load balancing first and see if it's the load balancing or the NAT that's ...
by troffasky
Thu Jan 07, 2016 10:13 pm
Forum: Beginner Basics
Topic: DHCP - lease taken from wrong server
Replies: 5
Views: 1102

Re: DHCP - lease taken from wrong server

it's all default configuration
It isn't, because none of the IPs you've listed are the default.
by troffasky
Thu Jan 07, 2016 10:11 pm
Forum: Beginner Basics
Topic: how to hide ip from arp
Replies: 9
Views: 1629

Re: how to hide ip from arp

ARP is an essential part of IP + Ethernet networking, so no - unless you're prepared to create static ARP entries where required.

What is the security issue that you think a lack of ARP will solve?
by troffasky
Wed Jan 06, 2016 6:14 pm
Forum: Beginner Basics
Topic: How to set up a "Home VPN" on RouterOS?
Replies: 12
Views: 2631

Re: How to set up a "Home VPN" on RouterOS?

For starters, forget VPN because from what you've written I don't think it applies here. What IP address(es) does your routerboard have? It's not obvious to me that the downstairs PC shouldn't be able to see anything. If the upstairs and downstairs segments of your network are bridged together then ...
by troffasky
Wed Dec 30, 2015 12:43 am
Forum: General
Topic: Protected RouterBOOT
Replies: 116
Views: 28432

Re: Protected RouterBOOT

Email support.

But really, economic problem won't be fixed with technical workarounds. If you aren't charging enough to cover your costs, Mikrotik cannot fix this for you.
by troffasky
Thu Dec 24, 2015 2:50 pm
Forum: General
Topic: puplic IP over PPPoE (via NAT) ?
Replies: 13
Views: 1741

Re: puplic IP over PPPoE (via NAT) ?

If the clients get internet access then it's probably not a routing issue. Is there any NAT involved? When a client browses to the web, what public IP do they get? If it's not NAT or routing then perhaps it's a firewall rule.
by troffasky
Thu Dec 24, 2015 12:01 am
Forum: General
Topic: PPPoE and the Zen network in the UK.
Replies: 7
Views: 1649

Re: PPPoE and the Zen network in the UK.

What settings were changed over those three days?
by troffasky
Wed Dec 23, 2015 3:58 pm
Forum: General
Topic: Firewall technique / idea - feedback?
Replies: 13
Views: 1653

Re: Firewall technique / idea - feedback?

I think perhaps the "backwards router" analogy has outlived it's usefulness. The thing that makes it work is the connection/state tracking. You don't have to use NAT to use state tracking.
by troffasky
Wed Dec 23, 2015 12:44 am
Forum: General
Topic: Firewall technique / idea - feedback?
Replies: 13
Views: 1653

Re: Firewall technique / idea - feedback?

What you're doing is eminently possible. Think about it - it's just like a "home" router plugged in backwards; your home router wouldn't allow any traffic in unless it's related to an outbound connection. "What you're doing" should have said "What you're trying to do". I get what your saying, but e...
by troffasky
Tue Dec 22, 2015 4:05 pm
Forum: General
Topic: puplic IP over PPPoE (via NAT) ?
Replies: 13
Views: 1741

Re: puplic IP over PPPoE (via NAT) ?

Scroll up?
by troffasky
Mon Dec 21, 2015 10:11 pm
Forum: Beginner Basics
Topic: Data limit on LAN interfaces
Replies: 4
Views: 852

Re: Data limit on LAN interfaces

this isn't something we will be managing proactively for the client
You wish!
If you can do it from the CLI, you can script it. If you can script it, you can schedule it. If you can schedule it, the router can do it itself.
by troffasky
Mon Dec 21, 2015 6:26 pm
Forum: General
Topic: PPPoE and the Zen network in the UK.
Replies: 7
Views: 1649

Re: PPPoE and the Zen network in the UK.

Does it go back to being slow when you put the routerboard back on?
by troffasky
Mon Dec 21, 2015 4:48 pm
Forum: General
Topic: Firewall technique / idea - feedback?
Replies: 13
Views: 1653

Re: Firewall technique / idea - feedback?

Any feedback on this method / firewall rule? (or maybe im "trying to force a square into a round hole" ?) thanks What you're doing is eminently possible. Think about it - it's just like a "home" router plugged in backwards; your home router wouldn't allow any traffic in unless it's related to an ou...
by troffasky
Sun Dec 20, 2015 9:38 pm
Forum: General
Topic: puplic IP over PPPoE (via NAT) ?
Replies: 13
Views: 1741

Re: puplic IP over PPPoE (via NAT) ?

OK, re-read your post, you were asking for 1:1 NAT :-) Well, if your customers start demanding actual public IPs, you know where to start anyway.
by troffasky
Sat Dec 19, 2015 4:19 pm
Forum: General
Topic: puplic IP over PPPoE (via NAT) ?
Replies: 13
Views: 1741

Re: puplic IP over PPPoE (via NAT) ?

Proxy ARP:

http://forum.mikrotik.com//viewtopic.php?p=2010 [just one of many threads about this]
by troffasky
Sat Dec 19, 2015 1:04 pm
Forum: Beginner Basics
Topic: Cap2n extended home network
Replies: 2
Views: 559

Re: Cap2n extended home network

Use powerline adaptors? If you want to bridge cAP1 to the Cisco, the Cisco will need to support WDS. Generally speaking, WDS throughput halves per-hop [if you're using single-radio devices] so by the time you've done three hops, performance is going to suck. And that's without considering that, with...
by troffasky
Sat Dec 19, 2015 12:50 pm
Forum: Beginner Basics
Topic: Frequent bridged ADSL PPPoE disconnects
Replies: 5
Views: 1642

Re: Frequent bridged ADSL PPPoE disconnects

I have quite a few RB951's deployed with ECI B-Focus and Huawei HG612 DSL modems, with PPPoE being initiated from the Routerboard. I do not see the kind of behaviour you're describing. Not much help to you, I know.

I think your best bet is to turn up the logging and take it from there.
by troffasky
Fri Dec 18, 2015 11:15 pm
Forum: General
Topic: High Speed VPN - 100Mbps +
Replies: 25
Views: 15199

Re: High Speed VPN - 100Mbps +

Publicly available material about RB3011 CPU says it has crypto acceleration. Either public info is wrong or Mikrotik have chosen not to implement it at this point. You have to assume Mikrotik would implement it if they were able to.
by troffasky
Fri Dec 18, 2015 12:34 am
Forum: General
Topic: SNMP LTE signal strength
Replies: 13
Views: 6216

Re: SNMP LTE signal strength

Tried "print oid" in the relevant section of the CLI? I don't have an LTE-equipped device to test with, but some examples: [admin@LivingRoom] > /interface wireless print oid 0 tx-rate=.1.3.6.1.4.1.14988.1.1.1.3.1.2.6 rx-rate=.1.3.6.1.4.1.14988.1.1.1.3.1.3.6 ssid=.1.3.6.1.4.1.14988.1.1.1.3.1.4.6 bssi...
by troffasky
Fri Dec 18, 2015 12:24 am
Forum: Wireless Networking
Topic: 2.4Ghz 3x3 or 4x4 MIMO solution?
Replies: 7
Views: 2350

Re: 2.4Ghz 3x3 or 4x4 MIMO solution?

This 2 could work, anybody tried those? : http://www.compexshop.com/product_info.php/cPath/57_89/products_id/422 https://blog.linitx.com/mikrotik-routeros-6-16-released/ "This is the first release to include support for 802.11ac, using the QCA9880/9882 rev2 (-BR4A) wireless chipsets." http://www.co...
by troffasky
Thu Dec 17, 2015 11:06 pm
Forum: Beginner Basics
Topic: CRS125 as in-house switch
Replies: 2
Views: 603

Re: CRS125 as in-house switch

Pretty sure it works out of the box as a switch, at least on ports 2-24. Port 1 may be a WAN port.
by troffasky
Thu Dec 17, 2015 11:05 pm
Forum: Beginner Basics
Topic: Where do I put the IP, on the ethernet port or the bridge.
Replies: 6
Views: 877

Re: Where do I put the IP, on the ethernet port or the bridge.

Soft bridge = create a bridge interface, add ports to it. Bridged packets traverse router CPU and switch chip to CPU link. master ports = do the switching on the switch chip. Packets going between ports with the same master are switched on the switch chip at wire speed. CPU does not see switched fra...
by troffasky
Thu Dec 17, 2015 10:54 pm
Forum: General
Topic: Join 2 Big Network and use Site 2 Line. Scheme in Attachment
Replies: 4
Views: 567

Re: Join 2 Big Network and use Site 2 Line. Scheme in Attachment

Edit your obnoxiously large PDF to reflect your new addressing scheme, re-upload. It sounds like what you've ended up with is two L3 networks in one L2 network. This can be made to work but obviously you can only have DHCP server, for example. If you want 192.168.178.0 to be able to reach 192.168.2....
by troffasky
Wed Dec 16, 2015 11:23 pm
Forum: Wireless Networking
Topic: Mikrotik router as dhcp + ap from another manufacturer + Active Directory - how to authenticate?
Replies: 8
Views: 931

Re: Mikrotik router as dhcp + ap from another manufacturer + Active Directory - how to authenticate?

It requires you use certificates...unless you tell the clients not to validate them: http://serverfault.com/questions/155760/is-it-possible-to-use-wpa-enterprise-mode-without-having-to-use-or-issue-certifi But I'm not sure how portable this advice is, ie, can you even turn this check off in all clie...
by troffasky
Wed Dec 16, 2015 2:27 pm
Forum: General
Topic: DNS syn flood
Replies: 6
Views: 1964

Re: DNS syn flood

I don't think the concept of SYN even applies to UDP traffic.
by troffasky
Tue Dec 15, 2015 5:38 pm
Forum: General
Topic: How is CRS212-1G-10S-1S+IN for Fiber Ring Network ?
Replies: 18
Views: 2283

Re: How is CRS212-1G-10S-1S+IN for Fiber Ring Network ?

So you suggest yes or no ?
Neither, because I don't understand your network topology, or how to you intend to use your switch(es).
by troffasky
Tue Dec 15, 2015 12:22 pm
Forum: General
Topic: WISP core router configuration
Replies: 14
Views: 2616

Re: WISP core router configuration

FSP-150 is basically a glorified media converter - fibre in, copper out. It's probably a little more complex than that in reality [eg allows BT to monitor the state of the circuit]. No, you can't have access to it, and it doesn't do anything at L3 [possibly not even L2 for that matter]. BT will mana...
by troffasky
Tue Dec 15, 2015 12:15 pm
Forum: General
Topic: mikrotik dns static host without dot
Replies: 2
Views: 653

Re: mikrotik dns static host without dot

I have tested this on my router [RB951, 6.33.3] and it works as expected. Try testing from a different client or use a packet capture to see what query the client is really sending.
by troffasky
Tue Dec 15, 2015 12:33 am
Forum: General
Topic: How is CRS212-1G-10S-1S+IN for Fiber Ring Network ?
Replies: 18
Views: 2283

Re: How is CRS212-1G-10S-1S+IN for Fiber Ring Network ?

Switching will be wirespeed, anything that gets passed to CPU on this switch will not be [pay attention to "Performance test results"]. I am having a hard time picturing your topology, however. Where in your network would the switch(es) go? At each tower + the CO? The confusion is because you say 5G...
by troffasky
Mon Dec 14, 2015 6:17 pm
Forum: General
Topic: CRS226 - loop protect, how?
Replies: 13
Views: 3379

Re: CRS226 - loop protect, how?

Yeah, this seems to work for mitigating loops. Just wish I'd known about it a few days ago - I installed a CRS125 at a remote site and put everything into a bridge!

Is there any way to monitor the state of this, eg see which ports are hitting the limit?
by troffasky
Mon Dec 14, 2015 12:40 am
Forum: General
Topic: WISP core router configuration
Replies: 14
Views: 2616

Re: WISP core router configuration

At this moment i had complaints from a few customers that they cant access sony playstation's portal. I assume this has to do with the vlans. Is my thought correct so far? VLAN = method of segmenting a L2 network playstation portal = a website? a range of IP addresses? some specific TCP and/or UDP ...
by troffasky
Mon Dec 14, 2015 12:33 am
Forum: Beginner Basics
Topic: Zen in the UK
Replies: 2
Views: 531

Re: Zen in the UK

by troffasky
Sun Dec 13, 2015 12:33 pm
Forum: General
Topic: Tool>Graphing cannot graph more than 2.1Gbit
Replies: 4
Views: 688

Re: Tool>Graphing cannot graph more than 2.1Gbit

Sounds like 32 bit signed int overflow. Normally I would say "just use ifHCinOctets" because it's 64-bit but the built-in graphs don't give you this level of control. Yes, it sounds like a bug so log it with Mikrotik.
by troffasky
Sun Dec 13, 2015 12:16 pm
Forum: General
Topic: Dynamic i.e. automatically use address list by VLAN on one network with two DHCP servers?
Replies: 2
Views: 382

Re: Dynamic i.e. automatically use address list by VLAN on one network with two DHCP servers?

Are you expecting your tagged and untagged clients to end up in the same network [L2 broadcast domain]? If you've already separated them by VLAN then surely it makes more sense just to have two different networks rather than trying to bodge it with one network and different DHCP options.
by troffasky
Sun Dec 13, 2015 11:45 am
Forum: General
Topic: PPPoE and the Zen network in the UK.
Replies: 7
Views: 1649

Re: PPPoE and the Zen network in the UK.

Should be fairly straightforward, eg:

https://support.zen.co.uk/kb/Knowledgeb ... oyager-205

If you're lucky, you won't be restricted to an MTU of 1492:

http://forum.mikrotik.com/viewtopic.php?t=100918
by troffasky
Sat Dec 12, 2015 10:10 pm
Forum: General
Topic: CRS226 - loop protect, how?
Replies: 13
Views: 3379

Re: CRS226 - loop protect, how?

You can do this by putting the ports into a bridge, but unfortunately that means the CPU is handling every frame, which will lead to performance that is somewhat less than wirespeed [as CPU has 1G link to switch chip].
by troffasky
Sat Dec 12, 2015 9:55 pm
Forum: General
Topic: Join 2 Big Network and use Site 2 Line. Scheme in Attachment
Replies: 4
Views: 567

Re: Join 2 Big Network and use Site 2 Line. Scheme in Attachment

NAT on the hAP interface connected to the powerbeam, use the hAP as the default gateway at site 1. This would fulfil the "only use second site line" bit easily enough. With NAT enabled, site 2 won't be able to see into site 1's network without [for example] port forwards on the hAP. Adding the much ...
by troffasky
Thu Nov 26, 2015 11:52 pm
Forum: Beginner Basics
Topic: Another help me with L2TP/IPSEC proxy-arp...
Replies: 11
Views: 3243

Re: Another help me with L2TP/IPSEC proxy-arp...

I would start by checking NAT and access rules. As you have access to the web interface on the outside IP while you are connected with VPN, this should be simple enough.
by troffasky
Tue Nov 17, 2015 11:19 pm
Forum: Forwarding Protocols
Topic: Assign public IP's to computers in LAN
Replies: 10
Views: 2441

Re: Assign public IP's to computers in LAN

A router with an interface in each of two subnets and not doing any NAT is just about as basic as it gets. How have you configured your router? What troubleshooting have you done?
by troffasky
Mon Nov 09, 2015 11:44 pm
Forum: Beginner Basics
Topic: Isolating Guest WifI/wlan2 or wlan1
Replies: 9
Views: 1726

Re: Isolating Guest WifI/wlan2 or wlan1

Absent an appearance from chechito to expand on what he was saying, I'm going to carry on down the firewall rule path. Let's say your "modem" network is 192.168.1.0/24 and your "pub customers" network is 192.168.2.0/24, your RB2011 lives in each network and does NAT between them. A rule that blocks ...
by troffasky
Sun Nov 08, 2015 12:18 am
Forum: General
Topic: Could not connect to [MAC] (port 20561) - timed out!
Replies: 7
Views: 13913

Re: Could not connect to [MAC] (port 20561) - timed out!

I have two RB751U-2HnD as WiFi bridge (Mikrotiks without ip-addresses)
Bridge work, but i can connect only to one Mikrotik!
Can you mactelnet from one to the other?
by troffasky
Sat Nov 07, 2015 7:03 pm
Forum: Beginner Basics
Topic: DHCP Relay
Replies: 15
Views: 19278

Re: DHCP Relay

Yes, it's possible to do what you've asked.
by troffasky
Sat Nov 07, 2015 12:55 pm
Forum: Wireless Networking
Topic: Great news ROS v6.33, wireless transfers over single stream TCP connections will have nearly double the speed.
Replies: 9
Views: 1606

Re: Great news ROS v6.33, wireless transfers over single stream TCP connections will have nearly double the speed.

When we will expect improvements for nv2 protocol? Why does it apply only for ac chips ''at the moment''? "Standard" protocol support would be implemented by chipset vendor in wireless chipset. NV2 would have to be at least partly implemented on CPU. So CPU is more of a bottleneck for NV2 than for ...
by troffasky
Sat Nov 07, 2015 12:23 pm
Forum: General
Topic: Add VoIP Support
Replies: 11
Views: 5650

Re: Add VoIP Support

Not sure about having an actual PBX built into RouterOS [because you can already do whatever you want with metarouters], but more options on the SIP ALG would be useful.
by troffasky
Sat Nov 07, 2015 12:13 pm
Forum: Beginner Basics
Topic: DHCP Relay
Replies: 15
Views: 19278

Re: DHCP Relay

I would also like to add VLANs to the STUDENTS interface and forward them to other switches and AP's (restrict traffic with firewall), but do not if it's possible. Are you still intending to use the same subnet on all these VLANs? If you want to firewall traffic at L2, check out '/interface bridge ...
by troffasky
Sat Nov 07, 2015 1:27 am
Forum: Beginner Basics
Topic: 2 Networks.
Replies: 1
Views: 297

Re: 2 Networks.

In what way would you like to 'see' the traffic?
by troffasky
Sat Nov 07, 2015 1:25 am
Forum: Beginner Basics
Topic: DHCP Relay
Replies: 15
Views: 19278

Re: DHCP Relay

Do you intend your Routerboard to actually do anything at L3? From your description it just sounds like you want to use it as an L2 device [ie a basic switch/AP].
by troffasky
Fri Nov 06, 2015 6:14 pm
Forum: Beginner Basics
Topic: About Cloud Core Router
Replies: 6
Views: 729

Re: About Cloud Core Router

In some countries all service providers are obligated to log such data and keep it for few years ;)
Yes, I understand that bit. When I asked what the mechanism for this is, I was asking karincanet how does one log such data to USB in RouterOS.
by troffasky
Thu Nov 05, 2015 11:56 pm
Forum: General
Topic: Two RB493G, different S/N but same MAC address???!?!?
Replies: 6
Views: 1456

Re: Two RB493G, different S/N but same MAC address???!?!?

A simple "don't import MAC addresses" option when restoring backups would help immensely here. The "principle of least astonishment" doesn't seem to have much of a following at Mikrotik :-)
by troffasky
Thu Nov 05, 2015 11:52 pm
Forum: General
Topic: LPR/LPD Printing over VPN
Replies: 6
Views: 1371

Re: LPR/LPD Printing over VPN

It's been a while since I've seen this, but I seem to remember it being something to do with MTU or fragmentation. The fix was to replace the ancient [they only had 10M ethernet ports] Jetdirect print servers with something else.
by troffasky
Thu Nov 05, 2015 11:36 pm
Forum: General
Topic: router and switch on crs125
Replies: 1
Views: 250

Re: router and switch on crs125

Generally speaking the CRS125 is very flexible so it can handle almost any scenario you throw at it, so the answer is probably yes. However, I'm not entirely clear what you're asking for so I can't offer any specifics.
by troffasky
Thu Nov 05, 2015 11:14 pm
Forum: Beginner Basics
Topic: About Cloud Core Router
Replies: 6
Views: 729

Re: About Cloud Core Router

Out of interest karincanet, what is the mechanism for point 1? What do you define as "user activity"?
by troffasky
Thu Nov 05, 2015 11:10 pm
Forum: Beginner Basics
Topic: Isolating Guest WifI/wlan2 or wlan1
Replies: 9
Views: 1726

Re: Isolating Guest WifI/wlan2 or wlan1

If I understand you right, you just want to use the RB2011 as an AP? To isolate wireless clients from each other, untick the 'default forward' box on the wireless interface. To prevent the wireless clients from being able to see anything on the "modem" network, you will need to create a firewall rul...
by troffasky
Thu Nov 05, 2015 10:59 pm
Forum: Beginner Basics
Topic: winbox + SOCKSv5 proxy?
Replies: 22
Views: 7570

Re: winbox + SOCKSv5 proxy?

You see, I open an SSH connection through which I access the HTTP webfig and ftp.
Are you saying you have already got this working, or you wish to do it?
by troffasky
Thu Nov 05, 2015 10:48 pm
Forum: Beginner Basics
Topic: DHCP Relay
Replies: 15
Views: 19278

Re: DHCP Relay

I think you really need to start a new thread for this as your issue doesn't seem to have anything to do with this thread, but I'll bite anyway.... The most obvious problem I can see here is that you have two interfaces on your router in overlapping subnets. This is a fundamental obstacle to getting...
by troffasky
Tue Nov 03, 2015 11:48 pm
Forum: General
Topic: established connection but webserver had no entry
Replies: 5
Views: 664

Re: established connection but webserver had no entry

Why not just reduce the timeout? 24h is a little generous.
by troffasky
Sun Nov 01, 2015 11:57 pm
Forum: General
Topic: IPsec does not work without kernel route for destination network
Replies: 9
Views: 1578

Re: IPsec does not work without kernel route for destination network

Have you observed any difference in behaviour when testing client-client rather than router-router or client-router?
by troffasky
Sun Nov 01, 2015 11:52 pm
Forum: Beginner Basics
Topic: Hairpin NAT - 2nd Router
Replies: 4
Views: 775

Re: Hairpin NAT - 2nd Router

It's a Huawei B593 and I was trying to use it as a "modem only" If it really was "modem only", then your Mikrotik would have the public IP and you could do the hairpin NAT there. As you've described it, the B593 is functioning as just another router. So I set the DMZ in the b593 for the mikrotik's ...
by troffasky
Sun Nov 01, 2015 3:51 pm
Forum: General
Topic: established connection but webserver had no entry
Replies: 5
Views: 664

Re: established connection but webserver had no entry

My web server doesn't log connections where a client doesn't send enough information to actually initiate a request, so I wouldn't be too surprised to see nothing logged for this kind of connection. Where do you get 5 minutes from? If the state of the connection is Established, then 24h is what appl...
by troffasky
Sun Nov 01, 2015 3:43 pm
Forum: General
Topic: IPsec does not work without kernel route for destination network
Replies: 9
Views: 1578

Re: IPsec does not work without kernel route for destination network

I was going to say "check the packet flow diagram", but I did it myself and I'm not 100% clearer: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6 My interpretation of it is, if you're pinging 10.64.12.1, the first routing decision is on how to reach that network, the packet is encrypted [and enc...
by troffasky
Sun Nov 01, 2015 3:18 pm
Forum: General
Topic: DHCP Flooding
Replies: 20
Views: 2679

Re: DHCP Flooding

arpwatch alerts you when a MAC address changes IP address, or when an IP address changes MAC address. If a "bad guy" assumes somebody else's MAC and IP addresses, you aren't going to be able to know who the "real" one is. Perhaps you could set hotspot interface ARP mode to reply-only, populate ARP f...
by troffasky
Sun Nov 01, 2015 3:04 pm
Forum: Beginner Basics
Topic: How do I get closer to wire speed with my RB2011?
Replies: 10
Views: 1222

Re: How do I get closer to wire speed with my RB2011?

5e should be all I need, right? Not having Cat6 isn't what's holding me back?
If you're getting more than 94Mbps then you're running at a gigabit, so I doubt that this is a cabling issue.
by troffasky
Sun Nov 01, 2015 12:57 pm
Forum: Beginner Basics
Topic: Hairpin NAT - 2nd Router
Replies: 4
Views: 775

Re: Hairpin NAT - 2nd Router

Nobody is going to be able to tell you have to do hairpin NAT on this outside router without knowing the make/model. You might find it easier to do this with DNS rather than hairpin NAT.
by troffasky
Sat Oct 31, 2015 10:23 pm
Forum: Beginner Basics
Topic: Static NAT from external seems to hijack VPN traffic on same port
Replies: 4
Views: 710

Re: Static NAT from external seems to hijack VPN traffic on same port

At a guess, I would say that your inbound NAT rule for the printer is either not specific enough.
by troffasky
Sat Oct 31, 2015 8:59 pm
Forum: Beginner Basics
Topic: Layer 7 Transparent Proxy
Replies: 2
Views: 1265

Re: Layer 7 Transparent Proxy

I could be wrong, but...if the conversation is far enough along to recognise the protocol at L7 to be HTTP, surely it's too late to rewrite the port?
by troffasky
Sat Oct 31, 2015 7:56 pm
Forum: General
Topic: 10Gbps Real Life Performance
Replies: 11
Views: 2104

Re: 10Gbps Real Life Performance

You mentioned it can only see 2GB, but I see CCR spec sheet mentioning it can support up to 16GB. How is this possible if both of them are running the RouterOS?
Different CPU arches so different capabilities, although I doubt the underlying OS has a problem with using more than 2GB of RAM on x86.
by troffasky
Sat Oct 31, 2015 7:51 pm
Forum: General
Topic: Re-route a port to router.....
Replies: 5
Views: 504

Re: Re-route a port to router.....

Or you could just change the web service port from 80 to 8080.
by troffasky
Sat Oct 31, 2015 11:59 am
Forum: General
Topic: DHCP Flooding
Replies: 20
Views: 2679

Re: DHCP Flooding

I think this:

https://github.com/davidnutter/mikrotik-arpwatch

will do what you want but a) documentation for it is thin on the ground and b) it requires an external server to run it on [although I guess you could run it on an OpenWRT metarouter]
by troffasky
Sat Oct 31, 2015 11:20 am
Forum: General
Topic: Half speed in a PPPoE over bridged ADSL modem
Replies: 11
Views: 2123

Re: Half speed in a PPPoE over bridged ADSL modem

Hopefully this may help someone else having this issue.
Curious indeed...I'm pretty sure this behaviour is limited to whoever your provider is. I have never seen this before. So, who is the guilty provider?
by troffasky
Fri Oct 30, 2015 12:08 pm
Forum: General
Topic: Forwarding to different ports based on certificate
Replies: 2
Views: 288

Re: Forwarding to different ports based on certificate

I doubt RouterOS can do this, and even if it could, you probably don't want to offload your SSL to a router with little CPU [relative to contemporary server hardware]. You are much better doing this on a server with some kind of reverse proxy.
by troffasky
Fri Oct 30, 2015 11:59 am
Forum: General
Topic: ARP mikrotik logic?
Replies: 4
Views: 477

Re: ARP mikrotik logic?

I have seen instances where if a host doesn't get an ARP response for its gateway, it will just "broadcast" traffic for hosts it is trying to reach that are outside its subnet. The other thing to bear in mind is that the packet on the wire doesn't contain the netmask of the sending host, so there is...
by troffasky
Fri Oct 30, 2015 11:47 am
Forum: General
Topic: Wireshark with mikrotik
Replies: 2
Views: 558

Re: Wireshark with mikrotik

Wireshark is a packet capture tool and as such will only receive packets, not transmit them [it is passive]. You may use it to look at ARP responses and manually check if the sending MAC addresses is what it should be. There may even be an "expert info" entry that highlights where ARP entries are cy...
by troffasky
Tue Oct 27, 2015 7:20 pm
Forum: Beginner Basics
Topic: First attempt at making VLANs work in Router OS
Replies: 14
Views: 1514

Re: First attempt at making VLANs work in Router OS

I'm no expert on this but why would the master port for 24 be a port that is in a different VLAN if you only want one VLAN on that port?
by troffasky
Mon Oct 26, 2015 11:11 pm
Forum: General
Topic: SSL for routerOS?
Replies: 2
Views: 426

Re: SSL for routerOS?

When you buy a commercial certificate, pretty much all you're paying for is that the CA that issues your cert has their CA cert in all the major browsers. If you have to install the issuer's CA cert on your client devices to make them work, then there's no point spending the money, you might as well...
by troffasky
Mon Oct 26, 2015 10:54 pm
Forum: Beginner Basics
Topic: First attempt at making VLANs work in Router OS
Replies: 14
Views: 1514

Re: First attempt at making VLANs work in Router OS

You might get a bit further if you make your VLAN testing a bit more VLAN-focused, as there are non-VLAN reasons why a DHCP server might not work. For example, if you do a packet capture on a troublesome port, are you seeing packets being VLAN tagged when they shouldn't be or vice versa?
by troffasky
Mon Oct 26, 2015 10:15 pm
Forum: Scripting
Topic: Roque DHCP-server block
Replies: 9
Views: 1048

Re: Roque DHCP-server block

DHCP traffic doesn't traverse routers without assistance. Splitting a L2 broadcast domain into smaller networks limits the damage that can be done by rogue DHCP servers [and other L2 annoyances, eg netcut]. Once you've divided your network into as many networks as is sensible [1], you can further re...
by troffasky
Mon Oct 26, 2015 10:05 pm
Forum: Beginner Basics
Topic: One Wifi Multi Lans
Replies: 5
Views: 881

Re: One Wifi Multi Lans

This should be fairly straightforward. Is it just LAN1 that wifi can't see? Can the wifi clients see LAN2? What firewall rules do you have?
by troffasky
Sun Oct 25, 2015 1:24 pm
Forum: Wireless Networking
Topic: wireless debug message explanation please.
Replies: 5
Views: 1612

Re: wireless debug message explanation please.

Have you tried asking support? Pretty sure they don't read every thread in this forum.
by troffasky
Sun Oct 25, 2015 12:10 pm
Forum: Beginner Basics
Topic: How to Hide Gateway from customer
Replies: 16
Views: 2433

Re: How to Hide Gateway from customer

If you "hide" the gateway from the clients, how do you expect the clients to get any internet access? You asked about protecting against the 'netcut' attack. A quick google suggests netcut is an ARP poisoning attack, where a malicious user sends out ARP packets pretending to be the gateway. If you i...
by troffasky
Sat Oct 24, 2015 1:22 pm
Forum: Beginner Basics
Topic: How to Hide Gateway from customer
Replies: 16
Views: 2433

Re: How to Hide Gateway from customer

Certainly wireless client isolation would help here, but I guess it's not going to help protect a client on AP1 from attacks by a client on AP2 - unless CAPsMAN is clever enough to cover this? Other ideas - make every ethernet port on the router routed [it's not clear from your diagram if eth3-eth9 ...
by troffasky
Fri Oct 23, 2015 9:52 pm
Forum: Beginner Basics
Topic: Merging two networks by PPTP client
Replies: 9
Views: 1285

Re: Merging two networks by PPTP client

Sure, crack on, see how long it takes you to get two sites connected together with MPLS/VPLS vs. "generic VPN" :lol:
by troffasky
Mon Oct 19, 2015 10:56 pm
Forum: General
Topic: Hotspot and browser caching "website not available"
Replies: 3
Views: 586

Re: Hotspot and browser caching "website not available"

That's a possibility. If the user has the site in their history and they start typing it, the address bar will complete to the actual site [eg https://hotmail.com] whereas if they haven't visited it, the browser is going to assume HTTP and take them to http://hotmail.com, which can then be redirecte...
by troffasky
Sun Oct 18, 2015 12:31 pm
Forum: General
Topic: Hotspot and browser caching "website not available"
Replies: 3
Views: 586

Re: Hotspot and browser caching "website not available"

Is this repeatable with every browser on every client OS?
by troffasky
Sun Oct 18, 2015 12:18 pm
Forum: General
Topic: CRS124-24G-1S Link Aggregation vs Bonding
Replies: 2
Views: 1281

Re: CRS124-24G-1S Link Aggregation vs Bonding

I have referred to this example: http://wiki.mikrotik.com/wiki/Manual:CR ... s#Trunking, but I have not been able to get it working.
How far did you get, what did you try and what aspect of it is not working?
by troffasky
Fri Oct 16, 2015 11:44 pm
Forum: General
Topic: How can drop connectify hotspot
Replies: 2
Views: 571

Re: How can drop connectify hotspot

How can drop connectify hotspot program that meaning of sharing internet in computer buz i don't that any one sharing internet in our computer,, I doubt you can do this reliably, unless it has some unique characteristic that will make it obvious on the network. About the best thing I can suggest is...
by troffasky
Fri Oct 16, 2015 11:04 pm
Forum: Forwarding Protocols
Topic: Forwarding CCTV ports - problem
Replies: 5
Views: 1353

Re: Forwarding CCTV ports - problem

The only thing I've done was to disable forwarding port 5000
Is there a reason why you don't want to forward 5000? Bear in mind that not every protocol will "just work" if you change the ports with a port forward.
by troffasky
Sun Oct 11, 2015 8:47 pm
Forum: General
Topic: SNMP doesn't return through standard NAT (BUG?)
Replies: 8
Views: 1361

Re: SNMP doesn't return through standard NAT (BUG?)

Have you tried emailing Mikrotik support?
by troffasky
Sun Oct 11, 2015 12:34 pm
Forum: General
Topic: SIP phone through VPN
Replies: 9
Views: 1498

Re: SIP phone through VPN

Create route on office1 to SIP provider's network via office2. Make sure you have NAT policy on office2 router to handle this traffic.
by troffasky
Sun Oct 11, 2015 12:19 am
Forum: General
Topic: Mikrotik - limitations for enterprise solutions
Replies: 16
Views: 8531

Re: Mikrotik - limitations for enterprise solutions

Mikrotik don't do a UTM product, and quite possibly never will do. Accept Mikrotik stuff for what it is, and if you need UTM, look elsewhere.

On the other hand, the CCRs have the CPU power for this kind of job and if they were to introduce a UTM license then I can see this being popular.
by troffasky
Sun Oct 11, 2015 12:14 am
Forum: Beginner Basics
Topic: Merging two networks by PPTP client
Replies: 9
Views: 1285

Re: Merging two networks by PPTP client

as for "uniting networks" - why not VPLS or MPLS instead ? :/
That would be overkill for connecting two sites together.
by troffasky
Sat Oct 10, 2015 8:50 pm
Forum: Beginner Basics
Topic: Merging two networks by PPTP client
Replies: 9
Views: 1285

Re: Merging two networks by PPTP client

Issue #1: Your RB1100 gets assigned an IP by the TL-R600VPN. I am going to assume here that the TP-Link just gives a single address to PPTP clients, and doesn't expect other networks to be reachable through it. RB1100 on the other hand, is assigned a route so knows how to reach TP-Link's network. Is...
by troffasky
Tue Oct 06, 2015 11:25 pm
Forum: Forwarding Protocols
Topic: Forwarding CCTV ports - problem
Replies: 5
Views: 1353

Re: Forwarding CCTV ports - problem

Packet capture on the client and see what ports it's trying to connect to. Not sure I understand this bit: - DVR1 - yyy.yyy.yyy.yyy:8001 -> zzz.zzz.zzz.zzz:80 - DVR1 - yyy.yyy.yyy.yyy:8001 -> zzz.zzz.zzz.zzz:5000 How can 8001 be forwarded to two ports at once? Why haven't you forwarded port 554? Per...
by troffasky
Sun Oct 04, 2015 11:13 pm
Forum: General
Topic: [SOLVED] - Cable modem, multiple dynamic public IPs through one cable.
Replies: 4
Views: 927

Re: Cable modem, multiple dynami public IPs through one cable.

I though of VLANs but I have no access to the Arris modem and it doesn't support VLANs either.
Your VLANs would be untagged on the ports facing the Arris modem [ie, whatever plugs into them would not be VLAN-aware]. You would tag VLANs on the trunk between the two hAP Lite's.
by troffasky
Sun Oct 04, 2015 12:20 pm
Forum: General
Topic: Dishnet ISP double NAT - They do provide IPV6, but....
Replies: 4
Views: 731

Re: Dishnet ISP double NAT - They do provide IPV6, but....

If what DrCows says is true, then you'll need to ask your provider if they assign a v6 subnet for your use as well. We might even be able to work it out if you can give us a screenshot from the modem showing what v6 address[es] it has. I can understand why a provider would use v6 to manage CPE - it ...
by troffasky
Sun Oct 04, 2015 12:54 am
Forum: Forwarding Protocols
Topic: freepbx / asterisk firewall and nat rules
Replies: 17
Views: 12231

Re: freepbx / asterisk firewall and nat rules

Is there anything else on a MikroTik you would recommend to make this more secure? Use ACLs to restrict SIP access to only the IP addresses that need access. Use VPN for anything that doesn't have a static IP address [Snom handsets - for example - support OpenVPN, although I suppose you don't reall...
by troffasky
Sun Oct 04, 2015 12:38 am
Forum: Forwarding Protocols
Topic: Assign public IP's to computers in LAN
Replies: 10
Views: 2441

Re: Assign public IP's to computers in LAN

From what you've posted, it appears that is already the case. Presumably you have an ACL that prevents the access, so all you need to do is remove it?
by troffasky
Sun Oct 04, 2015 12:16 am
Forum: General
Topic: Dishnet ISP double NAT - They do provide IPV6, but....
Replies: 4
Views: 731

Re: Dishnet ISP double NAT - They do provide IPV6, but....

Yes, you can run dual-stack [v4 and v6] with RouterOS. Do you have admin access to the modem? If so you can 'port forward' regardless of how many addresses it has.
by troffasky
Sat Oct 03, 2015 2:55 pm
Forum: General
Topic: ethernet ports overrunning - default interface queue (only-hardware-queue) not working well
Replies: 9
Views: 2958

Re: ethernet ports overrunning - default interface queue (only-hardware-queue) not working well

There are still a number of web sites that don't come up completely or streaming that doesn't start, etc..
Sounds a bit like an MTU problem.
by troffasky
Fri Oct 02, 2015 12:01 am
Forum: General
Topic: PPPoE connection to UK BT ADSL, MTU with RFC 4638
Replies: 4
Views: 2196

Re: PPPoE connection to UK BT ADSL, MTU with RFC 4638

You'll need to be on the bleeding edge if you want RFC4638:

http://forum.mikrotik.com/viewtopic.php ... 50#p501049
by troffasky
Tue Sep 29, 2015 10:35 pm
Forum: Beginner Basics
Topic: Send DHCP leases every day
Replies: 22
Views: 3679

Re: Send DHCP leases every day

You might be able to poll such a parameter with SNMP, and that being the case, you can do it from the NMS of your choice.
by troffasky
Tue Sep 29, 2015 10:31 pm
Forum: Beginner Basics
Topic: PoE switch not powering SXT AC
Replies: 5
Views: 1768

Re: PoE switch not powering SXT AC

"While PDs must support BOTH Mode A and Mode B to be compliant with the 802.3af standard". The brochure clearly states its 802.3af/at compliant. There was a pretty similar discussion about the mAP2n and in the end, they changed the documentation not to mention 802.3 PoE. Plenty of websites only eve...
by troffasky
Tue Sep 29, 2015 10:22 pm
Forum: Beginner Basics
Topic: accessing pc with dynamic ip
Replies: 1
Views: 366

Re: accessing pc with dynamic ip

Mikrotik have their own dyndns-type thing:

http://wiki.mikrotik.com/wiki/Manual:IP/Cloud

If you meant the PC itself has a dynamic IP, create a DHCP reservation for the PC.
by troffasky
Tue Sep 29, 2015 10:12 pm
Forum: Beginner Basics
Topic: CRS226 basic config
Replies: 1
Views: 327

Re: CRS226 basic config

If you find you've lost L3 connectivity with something that you're plugged in to, use Winbox to try and discover the device. That should help you recover.
by troffasky
Fri Sep 11, 2015 12:41 am
Forum: Beginner Basics
Topic: Connecting a single LAN port directly to WAN.
Replies: 2
Views: 509

Re: Connecting a single LAN port directly to WAN.

How many public IP addresses would you expect to have from your modem?
Really if you have IP addresses, NAT rules, etc on eth1 then you should move them all to the bridge that you put eth1 into.
by troffasky
Fri Aug 21, 2015 9:56 pm
Forum: General
Topic: hEX performance numbers? Some clarification for a newbie...
Replies: 7
Views: 1024

Re: hEX performance numbers? Some clarification for a newbie...

IMIX is an attempt at answering your question: https://en.wikipedia.org/wiki/Internet_Mix From that, we can assume that 58% of your traffic will be <58Mbps , 33% will be <~480Mbps and 8% will be 986Mbps. With any luck your existing equipment might let you work out the distribution of packet sizes ac...
by troffasky
Thu Aug 20, 2015 11:11 pm
Forum: RouterBOARD hardware
Topic: mAP 802.3af support
Replies: 47
Views: 21532

Re: mAP 802.3af support

Cisco phone will want 802.3af PoE [ie, 48VAC]. mAP2n will not supply that.
by troffasky
Thu Aug 20, 2015 11:07 pm
Forum: RouterBOARD hardware
Topic: ADSL bridge modem
Replies: 10
Views: 2826

Re: ADSL bridge modem

These must be used in pairs, with a CL-SFP module installed at both ends of the connection, or a CopperLine unit installed at one end.
How many ISPs are going to plug one of these in at their end for you to connect to?
by troffasky
Thu Aug 13, 2015 11:24 pm
Forum: General
Topic: Assigning Static IP to WAN from /29 subnet
Replies: 5
Views: 1143

Re: Assigning Static IP to WAN from /29 subnet

Did you try a packet capture?
by troffasky
Sun Aug 02, 2015 12:33 pm
Forum: Beginner Basics
Topic: ARP entries not populated
Replies: 4
Views: 1025

Re: ARP entries not populated

A switch won't learn ARP entries for devices that it doesn't talk L3 to. If you ping a device from the CRS [and assuming it actually responds to ping], do entries appear for them in the ARP table?
by troffasky
Sun Aug 02, 2015 12:15 pm
Forum: Beginner Basics
Topic: I have a Mikrotik routerboard 951G, how can I configure the wireless network to cover a three storey building
Replies: 2
Views: 514

Re: I have a Mikrotik routerboard 951G, how can I configure the wireless network to cover a three storey building

It's difficult to answer your question without knowing the construction of the building. Even then, it's just going to be guesswork, and my guess is that it will struggle. Placing the router as close the centre of the desired coverage area as possible and then testing it is the only way to find out.
by troffasky
Sun Aug 02, 2015 12:12 pm
Forum: Beginner Basics
Topic: Router boards appear twice
Replies: 2
Views: 389

Re: Router boards appear twice

From your screenshot I can see that you're seeing one entry for the IPv4 address and one entry for the IPv6 address. Seems sensible to me.
by troffasky
Sat Aug 01, 2015 10:33 pm
Forum: General
Topic: Assigning Static IP to WAN from /29 subnet
Replies: 5
Views: 1143

Re: Assigning Static IP to WAN from /29 subnet

A few things: subnet 74.165.169.163/29 to my clients. ( 4 ips) /29 isn't 4 IPs in any scenario I can think of. If you've been assigned a subnet that's routed to your outside IP and you're just going to NAT it rather than route it, then you can use the broadcast and network addresses, giving you two ...
by troffasky
Wed Jul 15, 2015 2:48 pm
Forum: Beginner Basics
Topic: use MAC Authentication on 2 RB951 with one auth DB
Replies: 2
Views: 450

Re: use MAC Authentication on 2 RB951 with one auth DB

Have you looked at CAPsMAN?
by troffasky
Fri Jul 10, 2015 11:37 pm
Forum: Beginner Basics
Topic: Admin options missing from Webfig, unable to connect with Winbox
Replies: 1
Views: 476

Re: Admin options missing from Webfig, unable to connect with Winbox

You've been given a limited-access username for your router. Have you asked your provider for the 'real' admin username?
by troffasky
Fri Jul 10, 2015 11:30 pm
Forum: Beginner Basics
Topic: Firewall SIP port
Replies: 3
Views: 887

Re: Firewall SIP port

Difficult to answer without knowing where these subnets are in relation to each other, and how they are connected.
by troffasky
Fri Jul 10, 2015 11:27 pm
Forum: Beginner Basics
Topic: Port Forward to Network not connected directly to Mikrotik
Replies: 2
Views: 421

Re: Port Forward to Network not connected directly to Mikrotik

Break it down into steps to try and work out where it's going wrong.
If you forward port 8080 on D-Link to the Mikrotik, does that work?
  • 1
  • 2