MikroTik

IntrusDave

I show the same issues with a MikroTik hAP ac (RB962). Unable to exceed 200mbps. This is with the Atheros chipset. It's clear to me that it's something in MikroTik's ac implementation.

IntrusDave

No issues when the Intel 9560 is linked to a Broadcom based access point. It's clear its an issue between Intel and Qualcomm

IntrusDave

Disabling the power management, I was able to get it up to 200mbps, but still it's about 1/4 the speed of the macbook pros.

IntrusDave

Hey guys, I'm having some issues with Intel Wireless. We are planning on moving from Apple Macbook Pro's to Lenovo ThinkPads. The Apple's have Broadcom wireless and can easily pull 800mbps. The Thinkpads are stuck maxing out at 135Mbps. The Apple's are able to saturate out 500/500 fiber, the Lenovo'...

IntrusDave

the 4011 is the only device currently supporting 80+80 and 160, however, I have yet to get either of those modes to work.

IntrusDave

my unmarked traffic defaults to priority 8 (DSCP 0), which is the lowest. Every packet is marked with a DSCP 0 if it is not explicitly marked already. I don't think you want to mark as priority 6, as that is DSCP 16-23, which is fairly high for basic traffic.

IntrusDave

Why are people asking for ext4 on mikrotik devices when they should be asking for f2fs?

IntrusDave

Same basic issue here. But I get a little further. I have "AP Running" but no devices can see the 5GHz network

IntrusDave

Hey guys, I'm working on a problem with the Google smart home gear. I have a client that has Google Home's and Chromecasts in every room. They are having an issue where anytime the AP gets rebooted, the Google devices will not reconnect on their own. The user is forced to power cycle each device. I ...

IntrusDave

When adding devices to the access list "Signal Strength Range" is limited to -1;120, where it should be -120;120.

IntrusDave

Sorry, but I feel no need to disclose my stats and financial needs for a service that is free. I can tell that you 4 servers, 120 honeypots, a CDN, storage and the bandwidth needed for all of it is quite a lot. I wont be open sourcing the code either. it's 100% written by my with no use of any open ...

IntrusDave

Dude, really? My lively-hood is going down the drain, and you pop up to help push the knife in. Nice.

IntrusDave

I regret to inform you all that I have shut down the servers. With over 35,000 routers hitting the server every few hours, and only 10 supporters (totally $50/month), the expenses are not even remotely being covered. I'm putting out almost $500/month now just in bandwidth costs. I'm moving the code ...

IntrusDave

Hey guys, I finally got around to ordering an RB4011 with wifi. It's an international version, being used in a controlled environment. The building is 100% isolated from all outside RF. I've spent the better part of today trying to get the damn thing to use 160Mhz channel width. The 5Ghz radio is se...

IntrusDave

Just an update... I'm still here, and I have hair again.

Well, I have hair for a few weeks at least.

I'm still working on the IPv6 version of the list. My home ISP has finally managed to provide a stable v6 connection, so I'll be able to start testing.

IntrusDave

Now that my ISP has finally enabled IPv6, I've gone back and redone my mangles/queues so that IPv4 and IPv6 both work correctly with DSCP. Here is my config for that. The only things anyone should need to change is the WAN interface name and the WAN upload speed. For coax ISP's, they normally give y...

IntrusDave

that should work just fine, but place it before the Priority 8 line.

IntrusDave

Humans can be truly awfull but using you undergoing your treatment to steal from you then there are no words to describe my feelings about that. I am sorry to read that you are ill and that the outcome is uncertain. I wish all the strength to overcome this horrible time in your life. Thank you. No ...

IntrusDave

It can be paid by Patreon?

Yes, somewhere up above, there is a Patreon link, as well as PayPal links.

IntrusDave

Good Morning and happy April. A few updates for you this morning. Server is running stable with no issues other than the random LetsEncrypt cert error. Once the list's income manages to cover it's costs, I'll be switching to Digicert for ssl certs. I've begun work on adding IPv6 to the service, it's...

IntrusDave

The ReportStatus is 100% optional. It's mostly for stats and being able to ty and tailor the lists to the bulk of the routers. Surprisingly, their are far more CloudCore routers running the blacklist now than the smaller units. I wanted to thank those of you whom have reached out with support. Every...

IntrusDave

Humans are truly awful.
While at my treatment yesterday, I dozed off. (I'm there for 6 hours every 3 days)
While sleeping, someone stole my backpack with my 6 month old notebook.

I'll still be doing some coding at home, but it's hard to sit at my desktop. I'll keep you all posted.

IntrusDave

Hey everyone. I'm sorry for being out of touch. Here is an update. So, life has been pretty rough over the last 12-14 months. I've lost most of my clients, the new government tax code is killing me, and server costs keep going up. On the personal side, I've been dealing some some pretty serious heal...

IntrusDave

Hey guys, sorry for the radio silence, it’s been a pretty tough year but I’m trying to survive it. I’ve been trying to get the automated registration process done but have ran into a few pretty nasty issues that I didn’t foresee. I’m going to put it on hold and process things manually until I can ge...

IntrusDave

Hey guys I need some help. I'm trying to make a printer appear on two subnets, but I'm not sure it can be done. Here is what I have and want... I have a printer at 192.168.0.2 on the LAN. I have a VLAN of 10.0.0.0/24. I want to know if I can make the IP of 10.0.0.2 get forwarded/translated/whatever ...

IntrusDave

Their are no dumb questions! I will for sure have a UI for you to manage your routers. My goal is to have the UI finished by mid December. Though I just missed a pretty big deadline, so I may end up having to hire another developer to work on the front end while I continue on the back end. The UI is...

IntrusDave

Tech Note: 6.44beta20 causes some issues, make sure you update to the current beta, if you are running the betas.

IntrusDave

If you want to support him, please support him in his topics. If you would like to be involved in the me-vs-him debate, please at least do a little background research on the history. My project has been the subject of "IP Theft" several times, and I do my best to keep my server side tech ...

IntrusDave

How to make a payment from Poland?

https://www.patreon.com/IntrusTechnologies

You can go to this Patreon page to sign up.

IntrusDave

The new script will not require any modification, as the server will select the list based on your router's serial number and IP address. As for yearly payments - At this time, I am going to keep it monthly. I don't want to accept a payment for a year of service before I know the service will be ab...

IntrusDave

My goal is January first.

IntrusDave

squidblacklist.org is not included, as it is a pay service. The IP's they have on the free lists are pretty much duplicates of my list 2. OK, now I'll be clear here ;-) Thanks. Will test how much RAM a RB2011 needed. Only with priority 2 or priority 1 + drop.malicious.rsc PS: SBL Malicious IP Black...

IntrusDave

What are everyone's thoughts on using Patreon for the subscription service? I've started setting up a page here: https://www.patreon.com/IntrusTechnologies Once I have everything linked, the existing scripts will stop working and I will post the current scripts on the Patreon page. The new script w...

IntrusDave

It's hard to give accurate numbers, but it looks like the List 1 uses about 768k, List 2 uses 3M, and List 3 uses 54M to load and 50M once the load is done. The other two load too fast on my RB110AHx4 to see the memory load update. What do you think about this service?: https://forum.mikrotik.com/v...

IntrusDave

It's hard to give accurate numbers, but it looks like the List 1 uses about 768k, List 2 uses 3M, and List 3 uses 54M to load and 50M once the load is done. The other two load too fast on my RB110AHx4 to see the memory load update.

IntrusDave

What are everyone's thoughts on using Patreon for the subscription service? I've started setting up a page here: https://www.patreon.com/IntrusTechnologies Once I have everything linked, the existing scripts will stop working and I will post the current scripts on the Patreon page. The new script wi...

IntrusDave

No problem, and I'm sorry about the downtime. I've changed the policy on my servers so that Google can not longer preempt mine to make room for higher paying customers. Not happy that it's adding another $50/month onto my bill, but I can't have them dropping me because someone bigger wants my cpu or...

IntrusDave

I bought a new network "level 3" honeypots online. These are my first located in "hostile" countries. Bringing the current Level 3 list to over 189,000 entries.

IntrusDave

@Dave
Do you have IP blacklists from squidblacklist.org in priority 1 or 2?

squidblacklist.org is not included, as it is a pay service. The IP's they have on the free lists are pretty much duplicates of my list 2.

IntrusDave

The server is hosted on the google cloud platform. It appears that Google has oversold the zone that my servers are in, and my servers have been taking offline to allow others to run. I'll be moving the server to a different zone ASAP.

IntrusDave

The pay service will begin on the 1st of the year

IntrusDave

I’m not sure I understand the question

IntrusDave

If using DNS is a requirement for you, I suggest you look elsewhere for the service. I have no plans to use DNS for this service. It's not a viable distribution method. DNS is not able to send a response of 200,000+ IP addresses. BGP is also not going to happen, as it require a large amount of labor...

IntrusDave

I vote +1 for making all SOHO features a separate package. I consider SOHO features, stuff like: Quick Set SMB Kid Control Detect Internet Default Firewall UPnP I would even go as far to include 'Cloud' in that list, but many will disagree with me on that one. IMHO there is no need for those in an ...

IntrusDave

viewtopic.php?f=9&t=136666

IntrusDave

web and socks proxies get exploited by rogue IT guys to get around company filters. Web proxy is just about useless now, as https can not be proxied. Disabled by default is nice and all, but medical centers that deal with high profile patients have policies that prevent using hardware with certain f...

IntrusDave

I'd like to request that the all of the "home user" features be moved into separate packages.
- Web Proxy / Socks
- upnp / smb

All 4 of those functions have recently causes me issues with using Mikrotik routers in a hospital.

IntrusDave

I vote NO NTFS, and I also vote to remove SMB, or at least make it a package that I can remove.
Better yet, move all of the "home user" features into a separate package so that us enterprise customers don't have to have that type of stuff in our routers.

IntrusDave

I'm in a holding pattern while my lawyer researches the EU "GDPR" laws. It's looking like I will not be able to use 3rd party honeypots, as the GDPR requires companies to allow users to delete any data collected from there. That means that anyone with a honeypot running on their router wil...

IntrusDave

ip Cloud terminal-only when running CHR

IntrusDave

you can start with Level 7 filters here: https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7
or simple content filters here: https://wiki.mikrotik.com/wiki/Manual:I ... all/Filter
Neither are going to work with SSL.

IntrusDave

i haven't gotten far enough on the honeypot side. I've started from scratch on the RouterOS script. I'll post it once it's stable enough to test.

IntrusDave

But I get error in the log: Blacklist Authorization failed Which is the active and good script? IP Cloud is used for identification now. Once the service is live, the serial number from IP cloud will be used for authorization. The script gets the serial number from the IP cloud, submits it via the ...

IntrusDave

Drop or redirect? Which one is better on firewall?

Personally, I use a RAW Drop rule.

IntrusDave

Unfortunately, I don't have IPv6 yet. The system is designed for it, but I have no routers in IPv6 networks that I can test with. My home internet supports it, but it's so unstable, I don't bother with it. OK! Thanks!!! And domain blacklist? I don't find domain blacklisting very effective. Most bot...

IntrusDave

Unfortunately, I don't have IPv6 yet. The system is designed for it, but I have no routers in IPv6 networks that I can test with. My home internet supports it, but it's so unstable, I don't bother with it.

IntrusDave

Oh, and of course there is always the proverbial risk of lightning strike.

IntrusDave

Any time you have electronics outdoors, you should be grounding them. In this case, wind blowing through the grid can cause a static charge to build up, discharging though the ethernet can kill the LGH as well as the switch it's connected to. In addition, it can also hurt someone. I've never witness...

IntrusDave

After a quick glance, I would say that you can do this with awk/gawk in a bash script, or if you wanted to get fancy in php. I was actually looking at this same json to be used for whitelisting office365 in my Blacklist service. I need to earn some money today so I'll be our doing uber & lyft fo...

IntrusDave

ANd yes, you need the RC for the CHR to get IP Cloud. Given that the development is in "beta" it shouldn't be run on production devices (although I do..), the requirement for IP CLoud isn't going away. As for x86... Well, I have one of those too, but it's being moved to CHR to get pasted t...

IntrusDave

Unfortunately, requiring IP Cloud to be enabled is the only way that I have found to try and reducing the amount of piracy and unauthorized redistribution. As at least two of the people in this thread have already shown, they feel my work should be done for free and that they (and the rest of the in...

IntrusDave

I've implemented some of the new security functions. You will need to update the download script. Cloud DDNS is *REQUIRED*. Which means you need the latest CHR with Cloud support. /ip cloud set ddns-enabled=yes Here is the new script. :local destPath "disk1/filterImport.rsc"; :local priori...

IntrusDave

As you can tell, I've slowed down on development. Out of the 100+ people who filled out the notification form, more than 60% says they will not pay for this type of service. Only about 15 say they will pay a commercial product. So, I'm going to take my time with it and try earning some income in oth...

IntrusDave

sorry about that, reboot the server and forgot to start a service.
I don't have anything auto-starting yet.

IntrusDave

*) console - added "dont-require-permissions" parameter for scripts;

How does this one work? Any specific commands that it works with?

IntrusDave

Yes, I've blocked most of the IP's that are trying to leach the lists. Still working on an auth system that is reliable. I think it's going to have to be based on the the Cloud DNS.. [/ip cloud set ddns-enable=yes] is going to be required, unless MikroTik gives me a way to authenticate better than t...

IntrusDave

I still do not see any real benefit of your request. It literally takes 2 seconds to change proposal value for your policies to a different one. /ip ipsec proposal add name=newproposal copy-from=default /ip ipsec policy set [find proposal=default] proposal=newproposal I was just posting this exact ...

IntrusDave

It's limited for now, hoping to have a very basic auth system in place by tomorrow morning. My server logs show at least 2 people trying VERY hard to figure out how to trick the server to sending the list to a wget/curl client. Sorry, but the blaintant abuse won't be tolerated. I'll post a simple Go...

IntrusDave

My point was that many boards do this. Example - the RB450Gx4 reports 994M instead of 1GB. The RB3011 reports 1GB. Both have the same family of IPQ ARM Processor.
Yes, the ac2 did have a bug reporting memory, I do not believe that the 233 vs 256 is representative of that bug.

IntrusDave

I think you missed the topic.

This is more about 256M boards reporting 233M. This is not new to the hAP as2, it happens quite a bit, even more on the CCR's.

IntrusDave

I would absolutely love it and it would be a massive help if one of you could paste this code to a new script and run it once. I don't have any units myself that unreport RAM, but I know it's pretty common. So getting a dump of the hardware stats will help me sort out which models do it and which Ro...

IntrusDave

Oh BTW guys, my Honeypots alone are reporting over 37,000 ACTIVE botnet IP's for the last 12 hours.
Those IP's will NOT be included in the free list.

IntrusDave

Has anyone here worked with tr069 at all? I've never played with it and I'm curious if it offers anything useful to this project.

IntrusDave

I will not use it. Or maybe I will, but before I will implement another script that extracts IPs from the file and apply them one by one. Now THAT is funny. I can picture you looking through a list of 150,000 IP address every 24 hours. That's the WHOLE point of this, to have near-realtime protectio...

IntrusDave

Due to people like this guy ^^^ the beta list will be limited to the "free" list of about 1800 IP's.
I do not want my 150,000 IP's collected by my honeypots being used for other people's services.

IntrusDave

Your simplest choice will be to create an address-list of all of the known IP addresses for LinkedIn. Next, Static Map the DHCP for each of the PC's that you to allow access, and have them added to a seperate list. Next, create a Block rule for the linkedIn address-list, and exclude the permitted li...

IntrusDave

on the flip side, if anyone is in Southern California (Rancho Cucamonga / Ontario / Pomona / San Bernardino) you are hit me up and I'd love to grab coffee and chat.

IntrusDave

I do understand the concern, but after 3 years, I'm tired of explaining myself. I do what I do because I love the internet and I want it to be a safer place. My company is based on this principle. I understand that you guys don't know me personally, and you have to trust me. But do know that once th...

IntrusDave

You are 100% welcome to not use it. If you don't have anything to add to the topic, or any input on the development process, please find another topic to post in.

If you followed the previous versions thread, you would see that this has been covered in no less than 5 posts.

IntrusDave

Hi Dave,

In first list first address is 255.255.255.255 . Is that right?

Thanks,
Geo

Yes. Once the system is complete, you will be able to whitelist if needed. I filter 255.255.255.255 because I'm on a cable network and I see a crap-load of broadcast trash.

IntrusDave

Running on my home router. Do you really want it reporting every minute?

The reporting and monitoring service is reported every minute. The client side can change that, depending on that type of response time they want.

IntrusDave

Just an FYI - my blacklist service has been locking those IP's for a few months now.
You can check out the development topic here: viewtopic.php?f=9&t=136666

The botnets attacking MikroTik routers is in the smaller Priority 1 list

IntrusDave

If anyone wants to help out more, I need more routers to report some stats to the server. This is part of the health monitoring and alerting system. If you paste the code into a terminal window, it will setup the script and start reporting. /system scheduler add interval=1m name=reportStatus on-even...

IntrusDave

Hey guys, I'm trying to build a hardware stats/monitoring system that will allow users to register their routers and get an email/SMS when something needs to be looked at. I'm trying to get all of the various fields that the routers report. Here is a sample from my person home router: board-name=RB1...

IntrusDave

currently, the priorities are pretty basic. #1 is a short list of about 2000, consisting of just the most common botnet attacks. If I end up offering a free tier, this will be it. #2 is a longer list of 30,000 to 40,000 IP's and subnets that includes #1, also adds most of the more common crap out th...

IntrusDave

Here is a form to fill out if you want to be notified when the new service goes live:

https://goo.gl/forms/UQMYqKJ54E0iV35l2

IntrusDave

Here is a form to fill out for those that want to be notified

https://goo.gl/forms/UQMYqKJ54E0iV35l2

IntrusDave

please prompt how to change a timeout of blacklist lifetime. for example for 7 days The lists are set for a max timeout of 24 hours. This is required so that false positives are not blocked for too long. The system is designed to be update every 1~6 hours. Once the system goes public, each user wil...

IntrusDave

Script is no longer functioning, no updates since last night.

It's running right now.
As stated above, it's still very pre-alpha, so I can't promise that it stays running while I'm making large code changes.

IntrusDave

Dave, Have you considered using external to your network honeypots as source of offending IPs? I use as the first frontier such RAW drop rules and all the time there are some IPs on the list of attackers. I'm not quite sure I follow what you are saying. I'm always open to more sources. The new syst...

IntrusDave

Thanks! Check out the development topic. I posted an early pre-alpha script to try and start stress testing the database.

IntrusDave

Servers shouldn’t be an issue, I’ve moved my physical servers to google cloud and will be running on google’s CDN

IntrusDave

Use \?

The script in post #9 was wrong.

The script is not wrong, it's intended to be a script, NOT command line.

IntrusDave

[admin@CHR-O] > /tool fetch mode=https dst-path=/disk1/filters.rsc url="https://bl .mikrotikfilters.com/fetch.phppriority=3"; status: failed failure: closing connection: <404 Not Found> 35.236.78.203:443 (4) [admin@CHR-O] > /tool fetch mode=https dst-path=/disk1/filters.rsc url="http...

IntrusDave

fixed. having issues with mysql terminating

IntrusDave

So, I *JUST* started coding this week, so this is really rough.. like pre-alpha. This is going to take some time.. I can code in python, php, perl, and C. but just because I can, doesn't mean I enjoy it. I really hate coding, it's boring and frustrating. Anyway.. I have the database being populated ...

IntrusDave

I'm really shocked by the number of admins that NEVER update firmware!

IntrusDave

I do plan on continuing to use DNS for versioning. Ultimate goal will be to have the client send the last update date and time, then request the just the changes from that point.

The effect on the client side would be that the client determines it's own update schedule.

IntrusDave

New topic for development of the new service

viewtopic.php?f=9&t=136666

IntrusDave

Hey guys, I wanted to have this a little more open of a discussion, so I made a new thread. So I'm starting to plan out the new system and I'm going SQL based. The old system used a boat load of regex, awk, grep, etc. It was pretty dirty, but it worked. The lists generated were stored in a flat file...

IntrusDave

Not really an update, just information. I'm still trying to figure out what to do with my life. At 43, I started not liking what I was doing for work. I've tried a few different things, including running a large non-profit for a while. Now I'm closing in on 45 and I still don't know. Fact is, I'm be...

IntrusDave

Have you thought about the obvious? Maybe it's being hacked from the inside?
An angry employee trying to cause havoc seems like the logical answer.

IntrusDave

some devices won't work correctly when you mix subnet classes. Mixing Classes isn't a good idea.

IntrusDave

Just right off, a few things... 1) I don't think a RB951G is suitable for this. I would start with an RB3011 at the least, maybe an RB1100AHx4 2) Needing more than 254 IP's means you need a Class B or Class A subnet. I do not recommend simply changing the netmask, as many devices aren't going to tol...

IntrusDave

Buy a used RB2011 from ebay. IIRC it's a surface mount connection, so you are going to need surface mount desoldering and soldering tools. Good chance you are going to need the screen, the cable, the socket, and likely the interface chip from the diner RB2011.

IntrusDave

that is not supported. The Internal LCD's are connected to the CPU, not USB or serial.

IntrusDave

{86% | NotieMcNotebook} ~ @djoyce ~/> dig gwrtdp.tclclouds.com ; <<>> DiG 9.10.6 <<>> gwrtdp.tclclouds.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17895 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;gwrt...

IntrusDave

The tech docs stats 30W TDP with clock rates up to 2.2GHz, and doesn't require a fan.

https://www.nxp.com/docs/en/supporting- ... ticore.pdf

IntrusDave

Wine isn't exactly a little app, it takes some resources to start up. Is 5 seconds of high CPU load really causing a problem? I could understand if it hits 100% while in use, but just 5 seconds on startup doesn't seem like anything to worry about. My notebook (Mac) is quad-core, and I get all 4 core...

IntrusDave

I have the most confusing erection right now... I want this processor is a box... like NOW. Features summary: - Sixteen 32-bit / 64-bit ARM v8 A72 CPUs - Cache Coherent Interconnect Fabric (CCN508 aka “Eliot”) - Two 64-bit 3.2GT/s DDR4 SDRAM memory controllers with ECC. - Data path acceleration arch...

IntrusDave

Not sure what happened.. But something with the repartitioning in the latest rc.

IntrusDave

After about 6 hours, I finally got the Routerboot menu. I'm not sure why I was never prompted (press any-key...) before. I ended up getting a stopwatch and power strip. I was powering the router and timing how long to press the reset. It ended up needed to be pressed for no less than 15 minutes. (wh...

IntrusDave

Tried that.. They said it's past their coverage and to contact Mikrotik.

IntrusDave

tried that. seems to just pause the process, never starts netboot

IntrusDave

No backup loader.. The router had just rebooted after partitioning, so the backup was still blank.
Also, you can see in the console log, it tried booting from partition 1 and 0.

IntrusDave

Here is the console output Annapurna Labs stage 2: stage2_eth3_ram_loader v1.65.1 Executing next! Annapurna Labs stage 2: stage2.5_loader v1.65.1 SPD I2C Address:00000050 Executing next! ----------------------------------------------------- Stage 3 version: 1.65.1 Commit ID: e88c9c4 CVOS commit ID: ...

IntrusDave

My testing unit (RB1100AHx4) was bricked today with RouterOS 6.43rc5. I used WinBox to repartition for 2 partitions (primary and backup) The router went into a reboot loop with no way to stop it. Netinstall will not work, as the console shows that system reboots before the interfaces are initialized...

IntrusDave

I'd like some input on what this is worth to people in $USD.
My thought was $5/month for 5 devices, $10/month for 15 devices.

IntrusDave

One feature for a paid version I would like to implement is a management portal. * Manage your subscription options (Number of devices permitted to use your sub / payment method) * Manage your device serial numbers associated with your subscription * Manage a whitelist of IPs/Subnets that you need e...

IntrusDave

So, I've thought about this a lot. I was quite surprised by the support generated. So I think I will restart the service as a paid service to pay for the server and backspace. In total, the servers currently cost me about $1750 a month, but I'm downsizing everything and going to try and get it down ...

IntrusDave

Thank you Dave. Could you be so kind and shere your valuable technology? Could you publish all scripts? Unfortunately no. The server side (contrary to what a few hear think) isn't just a "script" it's a network of over 300 honeypots and some very advanced AI code to analyze threats. That ...

IntrusDave

I would be fine with keeping the service alive. Having a 48u rack for such a piss easy and small script is a bit outrageous. I think you're the delusional one. I"m sure you used that rack for way more than this script. I'm simply saying you can keep the script stuff online for way cheaper if y...

IntrusDave

bw is cheap i can get a server for 8 bucks a month with 12TB of bw. i feel its more than cost as to why you're stopping it. Need any help? If you think $8/month is the cost of a real server, a real firewall, real rack space, real bandwidth, real maintenance, real electricity... Then you are either ...

IntrusDave

It's been a nice run. Almost 3 years, and over 2200 active users. But I am shutting down the this service. With the new US tax laws and this new US "sex trafficking law" (which isn't really about sex trafficking) I simply can't afford to keep the service running. Bandwidth and rack space ...

IntrusDave

OKay, after hour of me going mad, it's now working. Turned out the ISP routed the new subnet to the wrong switch port. When I needed more rack space, I was moved to an empty rack. When I asked for the new subnet, they routed it to the switch port in the old rack instead of the new rack. All good now...

IntrusDave

Hey guys, so as some of you already know, I've started moving out of the IT world. I have taken control of a large nonprofit. Anyway - I need routing help. I have my existing Intrus Technologies subnet (172.102.241.56/29) and I've been given a second subnet for my new company. (172.102.241.8/29) The...

IntrusDave

Make sure you blDataPath does not start with a /
i.e. it should read "disk1/blTemp.rsc" NOT "/disk1/blTemp.rsc"

IntrusDave

I had actually started looking into moving the service to a distributed cloud to prevent this, but It looks like I may be shutting down my business and taking over running a nonprofit.

IntrusDave

Very sorry about that guys. I had to upgrade some server hardware, so I migrated the VM's to a different server. The new server didn't import the DNS vm. The old server if back online now and the VM's returned to their home. All should be good now.

IntrusDave

As I’m on vacation, I’ll keep it short. The IP you listed has been serving a malformed PDF with a known Microsoft Edge exploit.

IntrusDave

I think it’s in the wiki under filter command line.

IntrusDave

place-before=7

IntrusDave

This blacklist is blocking, among other things, Github. It has been for a while. It's a great idea, but clearly is not curated or monitored. I would recommend not using it. Welcome to the board. Not sure why your first post would be to trash someone's work instead of asking a question about it, but...

IntrusDave

You will most likely not have to do anything. Pretty much every game for the last 10 years sets the DSCP bits on packets, so the router will prioritize based of what the game developers feel is needed.

IntrusDave

The script is intended to be run as a script, not command line. Copy/Paste the script into a new script and run it from there.

IntrusDave

Dave, which list do we get?

That's your choice. Select the list that fits your needs, and set it in the config file.

IntrusDave

For you and other posters here its obvious, but not for my mother....

It's not really intended for your mother.

Intended for network admins that don't really need help or explanation.

IntrusDave

The scripts are for maintaining an address list that is intended to help filter out as much of the bad crap on the internet as possible. This includes spam, viruses, hackers, etc. the script contacts my servers and pulls the latest list of known bad IPs and subnets. The list comes in three sizes. Th...

IntrusDave

The source isn't open. It's a collection of 140 routers and servers running as honeypots.
You can exclude addresses by creating a whitelist address-list, and a rule to accept those addresses before the blacklist drop rules.

I don't feel that donations are needed, but thank you for the offer.

IntrusDave

You will need to set a static route using the WAN you would like the ping to go though.

IntrusDave

Actually - You should be returning this to the seller and have them advance replace the unit.

IntrusDave

Yes, you are correct. The 1072's have soldered on ECC ram. You will need to RMA the unit.
Send a supout.rif to support@mikrotik.com to start the process.

IntrusDave

Interesting. My 8200 does not have any bonding options at all. Creating a bond is simple, but please keep in mind that the bond is done in software and not hardware slow the MIPS routers are going to have high CPU load. Simpley remove two interfaces from any bridge or master port. Create a new bond ...

IntrusDave

Really? Please post a pic.
Every CCR1072 I’ve worked with has two DIMMs

IntrusDave

That's a very big and complicated question. But you may be looking for a LOT of work, with no gain. First, the modems referenced do not support any type of bonding. At best you will simply be able to get two public IP addresses - and that is only if your ISP allows it. Next, even if you get two publ...

IntrusDave

Have you tried any troubleshooting yourself while you wait? Maybe try reseating the memory, or try swapping the memory with the good unit to verify bad memory vs bad cpu? Have you tried swapping the memory with known good memory? Most Sys Admins would keep known good memory on hand for just these si...

IntrusDave

have you tried remove the scripts and schedules and reinstalling?
There is not much I can do to help, as I have no access to your router.

IntrusDave

At this time the script is IPv4 only. The servers are able to deal with IPv6, but the client script is not.

IntrusDave

Still nothing. As of 6.41rc16, my standard IpSec and my IKEv2 tunnels still die every 2~3 days. My only solution was power cycling the sites every night at the same time. I use DLI Web Power Switches to automatically power cycle them at 3am every day. It's the only way I can guarantee that the VPNs ...

IntrusDave

enable IP fireless on the bridge, then block ports 67-68 on the forward chain.

IntrusDave

Did you try entering the RouterBOOT menu and format the drive?
It's a little concerning because /var/run is normally tmpfs (ram based)

IntrusDave

This is the Observer effect as known in physics. Just running a script to monitor the load will increase the load and therefore make the results invalid. The more complicated the script, the higher the load, and the weaker the cpu, the higher the load. A better way to do this would be a use fetch an...

IntrusDave

This is expected. Because the address list is dynamic, the timeout is constantly changing. This causes WinBox to reload the entire address list output every second. I'll see if I can find a fix, but I don't think there is much you can do about it, other than not leaving the Address List tab open.

IntrusDave

I don't know - my Virtual Desktops use about 2 to 5mbps for RDP. Maybe 10mbps if they are doing video playback too.
I have a few that do UHD 4k video editing, but they use Thunderbolt 3 DAS.

IntrusDave

what does REST API offer the the current doesn't?

The current API takes 3~5 minutes to setup and is very simple to use.

IntrusDave

I can confirm that this happens on 6.41rc11

IntrusDave

I think 5 or 10G copper would be more realistic.
Unless you are in a VERY controlled environment, fiber is going to get damaged.

IntrusDave

Is it an option to change script to download file to USB drive and use external flash drive instead of internal NAND?

Yes, the path is set in the config file.

IntrusDave

THE solution is to output only raw ip addresses' list. But this solution collides with the length of variables in routeros. :( Thanks for your efforts. Unfortunately, it's only a solution if it's possible. The amount of 4kb files needed to be downloaded and processes would cause so much wear on the...

IntrusDave

That would truly be bad. My solution is to isolate the server that generates the scripts from the rest. The generation server is not accessible from the internet. For me to access it, I must connect to my firewall via VPN, then SSH to the database server, then ssh to the blacklist server. The second...

IntrusDave

Very interesting. You should do a supout.rif and email it to support@mikrotik.com. I think you may have found a bug.

IntrusDave

I've found that forcing rates is almost always a bad idea, and should only be a used to lower the rate, never raise. If you are not getting a 1G link, there is a reason for it. Something is wrong. Step 1 would be to use a network cable tester. (not the cheap kind that just lights up) Usual causes ar...

IntrusDave

Power cycle... Try another power supply...
If that fails, you can make a backup and save it on a USB stick. Then reset the device and do a clean netinstall. If a clean install doesn't work, then the switch chip has failed.

IntrusDave

Either your firewall is blocking DNS to my server, or your IP is blocked by the list already. What is your public IP? 181.225.100.117 190.253.66.37 Your ISP /AS262186 is UCEPROTECT-Level3 listed for hosting a total of 462 abusers. Your ISP COLOMBIA TELECOMUNICACIONES S.A. ESP/AS3816 is UCEPROTECT-L...

IntrusDave

Yes, that is what I do.

Unfortunately, no linux for NetInstall. I use WinBox on the Mac (I prefer Mac for my system). But I have never gotten NetInstall to run correctly under Wine.

IntrusDave

I would recommend looking at the RB1100AHx4 or CCR1009 over the smaller units. It sounds like uptime and reliability will be more important than the low cost of the the hEX. The dual power supplies and more powerful CPU's will end up providing you better stability with the dual power supplies and mo...

IntrusDave

Router is not firewall . Try a UTM firewall.

Correction: It IS a firewall. It is NOT a UTM firewall.

IntrusDave

when static, I've always used 192.168.88.1 as the gateway

Windows 7 should be okay, but make sure you run as Administrator. NetInstall will need to bind to port 67 and 68, which require running ad admin.

IntrusDave

I would set the notebook to 192.168.88.2, router at 192.168.88.1.
If you can, run Windows XP - not in a virtual machine. Disable any software firewall.

IntrusDave

Due to a bug in RouterOS, versions below 6.36 are now blocked on the server side. It appears they they are not able to compare the local blacklist serial with the server side serial. This is causing the 6.35 and earlier routers to update constantly. So, to save the NAND as well as bandwidth, I've ch...

IntrusDave

It it works, the storage will be cleared. it should then default to NetInstall. I've found it's best to have a Windows 7 notebook with no firewall enabled to run NetInstall.

IntrusDave

How about using the built in DNS and put in a regex that resolves 127.0.0.1 for everything but the .ir TLD?

IntrusDave

Wow, that sounds like a pretty bad situation.
You've done the basics that I would have recommended...

Next would be holding the reset button for 300 seconds and thus forcing the router to format itself. Hopefully the RouterBOOT is still running and able to do that.

IntrusDave

Yes. If you notice in your log, it is telling you that the script is out of date. The server inserts an alarm into the script when your local script version is out of sync with the server. You can run the code in the first post to keep your script up to date with the latest big fixes.

IntrusDave

FCS errors are caused by bad cables, bad cable installation, or a failing port. Check the cable and the device at the other end.

IntrusDave

Wireless standards 802.11b/g/n

IntrusDave

Why not just block DHCP from passing through the SXT?

IntrusDave

Does RBMetal9HPn Works with 802.11ah?
Or Why not?

No, that device an an 802.11b/g/n 2.4GHz device. 802.11ah is 900Mhz.
They are not compatible.

IntrusDave

use the router's built in DNS server, point it at OpenDNS and then block the LAN from using outside servers. I

IntrusDave

I've updated to 2.0.5. This update moves the server to tcp port 6501 and udp port 6502. These ports are excluded from being blocked by the list on my end, and should allow users on "bad" subnets to pull the list.

make sure to give positive rating if you are using and like this service

IntrusDave

can you post the export for the firewall?

/ip firewall export compact

IntrusDave

Understandable. Let me know what you are offering it for, I can always use a spare.

IntrusDave

It's hard to say without seeing the config.
But did you open the ports in the firewall too?

IntrusDave

The most weird it that version 6.33.3 is written for ARM device and after rebooting it for downgrade I see the following message in the log screen: "system, error omitting package routeros-arm.6.33.3 min RouterOS version is 6.35.3. That's correct. 6.35.3 was the first RouterOS version that sup...

IntrusDave

MikroTik never stated that user manager was available for the ARM units.

IntrusDave

Shouldn't this topic be in the Ookla forums?

IntrusDave

The DNS address is "mikrotikfilters.com" port 6502. The IP changes, based on current load - so if you add it to an address-list, just put the domain name and let it resolve. The port shouldn't be blocked, unless you are doing level 7 DNS filtering. you can post the last 3 octets of your IP...

IntrusDave

The CCR routers have MUCH higher throughput than the RB1100AHx4. The CCR's are intended for core routing, with multiple networks attached. The RB1100AHx4 is geared more towards a larger business network. You can check out the block diagrams for each to see the design differences. On the CCR's, each ...

IntrusDave

I missed that. Thank you.

That brings the entry cost down to $425usd for all-wire-speed ports.

IntrusDave

Why would you rate me negatively for that??

IntrusDave

Even the latest RB1100AHx4 may not be just right.. Each switch group (1~5, 6~10, 11~13) each only have a 2.5G link. To get full wire-speed, you would need 2GBps per port. The CCR1009, the first 5 ports are in a switch group. The CCR1016, each port has a dedicated wire-speed connection to the CPU. Bu...

IntrusDave

Oh man, I didn't catch that one. Thanks for point it out.

IntrusDave

Currently Metarouters are only available on single core routers.
I believe that MikroTik stated somewhere that they hope to bring the feature to RouterOS 7.

IntrusDave

I found this on the CPU. It does show the 3x 1Gbps links in the processor, as well os the PCIe links. It looks to me that ports 12 and 13 would likely each have a dedicated PCIe x1 link. Assuming that the processor only supports PCIe v1.0 or v1.1, then the links would only support about 250Mbps (125...

IntrusDave

Hi, I try to understand the difference AC wifi device. I want to recommend to my clients the device for there needs. Some client ask me what is the maximum speed for wifi. They look to other vendor and they see 1200Mb/s, 900MB/s or 450Mb/s. With that I don't tell anything just I see one mikrotik pr...

IntrusDave

Either your firewall is blocking DNS to my server, or your IP is blocked by the list already.

What is your public IP?

IntrusDave

Glad to head you got it worked out.

IntrusDave

use the failsafe.

Remove the power.
Press and hold the reset.
Apply power.
Hold the reset for 300 seconds.
Once the router is reformatted, you will need to NetInstall the current routerOS to boot again.

IntrusDave

Sorry, forgot the answer. You will need to disconnect pins 1 and 2 to cut the power to the unit. can you explain more You want me to explain how to disconnect and reconnect two wires? I'm sorry, please don't take this as rude, but if you do not understand that, you should be be trying to do this.

IntrusDave

We will need to see your Bridge, Filter, and NAT config at the minimum to understand what is going on. From the sounds of it, you are filtering on the bridge or have separate subnets and not routing between them. For LAN devices not to be able to ping each other, then they either are not on the same...

Search found 1286 matches