MikroTik

MikroTikFan

Fasttrack connection rule deleted and is fine.

Thanks for this solution

MikroTikFan

I can't also remove Filter rules.
Same message ...

mk-error2.png

MikroTikFan

Please help me how to delete Mangle and Raw rules from my router.

How to remove builtin rules and why this exist ?

mk-error.png

MikroTikFan

I prefer to get mikrotik, but I need for remote location 100 from main router just only 3-4 camaeras. For this solution I don't need 8 or 16 port PoE switch but just only for 4-5 ports. That is the reason why I just gave exaple of Ubiquiti which has 5 port PoE switch. If there is any other Mikrotik ...

MikroTikFan

I see... Mikrotik do not offer this type of PoE Switch.
Can I use one of Ubiquiti 5 port PoE device?

ErPoE-5 https://www.ui.com/edgemax/edgerouter-poe/

ES-5XP https://www.ui.com/edgemax/edgeswitch-xp/

for Dahua IP cameras ?

MikroTikFan

In that location only 3-4 camaras and 8 port will be just waste of ports and too expensive.

MikroTikFan

Hi,
I looking for 4-5 port PoE switch to connect and power Dahua IP cameras.
Connected to rest network using cat.6 cables.

Please recomend which Mikrotik switch or router will be the best for this solution.

Thanks in advance!

MikroTikFan

yes, i have both devices (ltap mini, wap lte kit) in operation running 6.43 with dual stack on lte interface. Thank you. I understud that your cellular operator supports ipv6/ipv4 dualstack, you can config your dedicated APN for ipv6 and type of ipv... and finaly you can get ipv6 address for this d...

MikroTikFan

Hi, I just looking for LTE modem which supports natively IPV6 from cellular or IPV6/IPV4 by setting LTE APN. In Poland only Orange celular operator supports IPV6 if you will chose APN:internetipv6 and netwirking IPV6. Mikrotik has many LTE devices which should be configured. - LtAP mini LTE kit - wA...

MikroTikFan

I don't remember name of this cloud provider (not so big like AWS), but it was one with offer 5 USD per month.

MikroTikFan

AWS costs is around 10 EUR per month. Is there any other cheaper Cloud service dedicated or supported for RouterOS?

MikroTikFan

Hi,

I'm looking for advise where in US is the best place to host virtual RourerOS.
I mean also prices and default instalation of RouterOS.

Please share your experience.
Thanks!

MikroTikFan

@MikroTikFan What are you waiting? IKE2 was backported to v6 long time ago. Thanks’, I thought that this should be in the same place together with other VPN services. I will try to follow instructions https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Road_Warrior_setup_Ikev2_RSA_auth Hopefully I will ...

MikroTikFan

+1

Please add this feature.

MikroTikFan

As it was mentioned earlier in this topic ROS v7. by mrz » Thu Oct 16, 2014 11:23 am my grandpa hopes to see ROS7 before he died when can we test ROS7 with ikev2 server Interesting, but now is close to two years later, I hope that your Grandpa is still in great condition ;-) , because we are still ...

MikroTikFan

client to client forwarding enabled?

How to enable this feature in Mikrotik?

MikroTikFan

Openvpn on ios can work too. But only with the certificates that were generated using the utility easyrsa. Staff means mikrotik do not get it. But if you import third-party certificates then certificate revocation does not work. Can anyone tell me with which keys to generate a certificate on the ro...

MikroTikFan

Hi,

Is there any chance that somebody from Mikrotik Team will comment this post/request ?

...

MikroTikFan

I would like to tunnel connection and establish openvpn to my mikrotik router using only wifi. 1. establish connection to the internet comming from public wifi "publicwifi" 2. connect as a openvpn client to my router in different place 3. genetate from mAP secure wifi network "private...

MikroTikFan

Will be implemented in ROS v7

This is hope or you know something more ?

I just wondering which solution became more popular :
- DNS over HTTPS
- DNS over TLS
?

MikroTikFan

Hi, I tried to find solution for the same problem Mikrotik OpenVPN with iPhone. I can't find out how to fix problem - PKCS5 - Requested encryption or digest alg not available [ERR] I found only one post on MikroTik forum. I'm trying to connect to the vpn from my iPhone, but I still can't get working...

MikroTikFan

Thanks! Yes, "Mikrotik" vs. "MikroTik" - works, with following : - MikroTik DNS Live usage - MikroTik DNS request - MikroTik Firewall but is not working with following: - MikroTik Volt/Temperature - MikroTik Live attack - I have to add name to rule "FW_Drop_all_from_WAN"...

MikroTikFan

Sure, that's all is working.
I see this data in splunk stream and I can browse them.

The problem is that on Mikrotik Application there is nothing.
Same problem like before : "No results found."

MikroTikFan

@Jotne I like your solution and examples in Splunk . I think that I followed your instruction, but I still have in Mikrotik App "No results found." Can you please help me to find what I'm doing wrong ? Thanks in advance. Sure I will do. Setup where the logging should go: System->Logging->A...

MikroTikFan

Hi, Last days CloudFlare has annouced new DNS service. This includes also secured DNS - DNS over HTTPS - DNS over TLS https://developers.cloudflare.com/1.1.1.1/dns-over-https/request-structure/ Please advice me if secured DNS can be implemented in Mikrotik. I know that other DNS technology DNSCrypt ...

MikroTikFan

Hi, Few days ago Kaspersky Lab have discovered that on Mikrotik routers somebody has included in Winbox malicious components. The code spies on PCs through a multi-layer attack that targets MikroTik routers. It first replaces a library file with a malicious version that downloads other malicious com...

MikroTikFan

Hi, I have Mikrotik access point - wAP ac (RBwAPG-5HacT2HnD-BE) and I'm trying to connect 2xGoogle Mini and 2xChromecast. Right now I'm having problems to configure this and google suport says that devices in my network are isolated. My hotspots are configured as a "bridge", but same resul...

MikroTikFan

My problem is to get from DHCP address in virtual wireless interface. I have Mikrotik wAP AC access point in mode: WISP AP Main DHCP server is router Mikrotik RB3011 From main wireless interfaces i-wifi1 and i-wifi2 I'm getting addresses and DHCP is working fine. From v-wifi (virtual interface) I ca...

MikroTikFan

My problem is to get from DHCP address in virtual wireless interface. I have Mikrotik wAP AC access point in mode: WISP AP Main DHCP server is router Mikrotik RB3011 From main wireless interfaces i-wifi1 and i-wifi2 I'm getting addresses and DHCP is working fine. From v-wifi (virtual interface) I ca...

MikroTikFan

Right, after switching off Debug it's gone !

Thanks

Question is why this is included in DEBUG log mode ?

MikroTikFan

This area looks clear. Just one house and to next house 500 m.
Looking to wifi monitor I see that this is not causing this problem.

MikroTikFan

+1 IKEv2

All Cloud Services like Google Cloud, AWS, AZURE need this type to connect VPN

MikroTikFan

Apple tech spec for all 2015 Macbook Air shows

https://www.apple.com/macbook-air/features/

1300 Mbps !

Chipset : Broadcom BCM43xx

MikroTikFan

I know where to check my MacOS device wifi spec, but I don't see over there this dual or triple wording.

MikroTikFan

That is interesting. Friend of mine has same model same time and got 1200-1300 connection from Netgear 5G Router. I just wondering where can I find this information in mac about WiFi card dual/triple ? Other issue is channel, @IntrusDave got this connection but using channel 100 on Mikrotik. I'm get...

MikroTikFan

What can I do to find out this problem?

MikroTikFan

Still only 867 Mb.

How to fix setup up to 1200-1300Mb ?

@IntrusDave how to get Channel 100 on Mikrotik wAP ac ?

MikroTikFan

Please help me how to configure my wAP ac (RBwAPG-5HacT2HnD-BE) to run this same 1300 Mb (MAcBook) speed like in mentoned by IntrusDave? Is this country Switzerland. 5240/20-eeeC/ac/P(20dBm)??? The default config for the wireless should be pretty good. The only thing I changed on my hAP AC is lockin...

MikroTikFan

May 4 20:16:51 192.168.3.250 May 4 20:16:51 Router Host-Name = "Router" May 4 20:16:51 192.168.3.250 May 4 20:16:51 Router Client-Id = 01-XX-XX-XX-XX-XX-95 May 4 20:16:51 192.168.3.250 May 4 20:16:51 Router received Router Advertisement on interface=ether1-gateway May 4 20:16:51 192.168.3...

MikroTikFan

/system logging print Flags: X - disabled, I - invalid, * - default # TOPICS ACTION PREFIX 0 * info remote 1 * error remote 2 * warning remote 3 * critical remote 4 ovpn remote 5 route remote 6 firewall remote 7 certificate remote 8 debug remote

MikroTikFan

I see over there in rows with the title "Router SSH-2.0-ROSSSH?". May 3 20:40:54 192.168.3.250 May 3 20:40:54 Router Msg-Type = discover May 3 20:40:54 192.168.3.250 May 3 20:40:54 Router Parameter-List = Subnet-Mask,Classless-Route,Router,Static-Route,Domain-Server,NTP-Server,CAPWAP-Serve...

MikroTikFan

Thank's for hint. I wondering if there is any solution to block new DHCP lease by same MAC address listed in DHCP Lease list. How can I blocked DHCP pool in firewall from takind double MAC address? Otherwise Blocking all in firewall means manual work each time. Can just block MAC duplication in DHCP ?

MikroTikFan

Please help me how to solve the problem getting access by device to the internet. I have implemented on Mikrotik DHCP server and fixed IP per device. But when I neet to block device on the DHCP Server Leases (for example for kids) and disabling this device same device gets new dynamic IP. This is th...

MikroTikFan

I would like ask also for correct antena gain parameters and power for RBwAPG-5HacT2HnD-BE.

MikroTikFan

Thank's for explanation. I have most current version (6.39 now).

If this not concern to those who have current firmware - so why this message is in my router log ?

MikroTikFan

Hi,

I just wondering why I have in my router LOG still records

including name of Mikrotik router and "SSH-2.0-ROSSSH?"

This looks like something bad ...

https://www.exploit-db.com/exploits/28056/

MikroTikFan

+1 for DNSCrypt - again, again and again ...

Mikrotik developers how long we should wait ?

Customer feedback is this days something important for You ?

MikroTikFan

Yes I'm using DUDE.

I wondering why I need this DUDE DNS ?
I have changed Dude configuration

Dude -> Probes -> DNS and change it from http://www.mikrotik.com to my local DNS on mikrotik router ip.

Is this right ?
Maybe should I delete this record ?

MikroTikFan

 /system clock> print
                  time: 01:32:39
                  date: mar/04/2017
  time-zone-autodetect: no
        time-zone-name: Europe/Warsaw
            gmt-offset: +01:00
            dst-active: no

... and still is doing that, what is responsible for this traffic ?

MikroTikFan

/ip cloud /ip cloud> print ddns-enabled: no update-time: yes status: updated After changing update-time to no ip cloud set update-time=no /ip cloud> print ddns-enabled: no update-time: no status: updated I see in DNS logs traffic to http://www.mikrotik.com Mar 3 20:36:10 192.XXX.YY.ZZZ Mar 3 20:36:...

MikroTikFan

Please help me to explore why Mikrotik router is constntly asking DNS about www.mikrotik.com domain ?

From DNS logs I see that this traffic is generating by router constantly:

MT-DNS: local query: #84709 www.mikrotik.com. A

How to stop this proces ?

MikroTikFan

Please let me know if Mikrotik already supports latest OpenVPN 2.3.3 modes with GCM ?

TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
TLS-DHE-RSA-WITH-AES-128-GCM-SHA256

MikroTikFan

I need other biger switches, one is PoE and other is 24-port localised in other part of building.
In this configuration I need to setup cross devices VLAN networks.

MikroTikFan

Please help me to configure VLAN and connect two Switches with Mikrotik: - Router RB3011 - EdgeSwitch PoE 16 port - TP Link 24 port (managed switches) In this forum I can find informations how to configure VLAN in one Mikrotik device. I don't know how to configure VLAN in this case Miktorik + two sw...

MikroTikFan

I would like ask if there is an option to use two wAP ac and having roaming between them.
I found feature called "Nstreme Dual" http://wiki.mikrotik.com/wiki/Manual:In ... treme_Dual,
but I'm not sure exactly ???

MikroTikFan

I have send e-mail to Mikrotik Support (support@mikrotik.com) and share with community about this USB 3.0 issue. Unfortunately I haven't received any official reply from Mikrotik and either on this forum from Mikrotik employees. Please anyone from Mikrotik who is on this forum to make any statement....

MikroTikFan

The problem is that this very nice USB is not detected in RB3011 and I don't know why ?

MikroTikFan

I decided to use just USB via USB 3.0. Unfortunately one of the best USB SANDISK ULTRA FIT 32GB USB 3.0 (https://www.sandisk.com/home/usb-flash/ultra-fit-usb) is not working with RB3011. Both router and USB drive has USB 3.0 port and should work. I tried to format this drive using exfat and fat32 an...

MikroTikFan

Please help me how to run SANDISK ULTRA FIT 32GB USB 3.0 (https://www.sandisk.com/home/usb-flash/ultra-fit-usb) with RB3011. Both router and USB drive has USB 3.0 port and should work. I tried to format this drive using exfat and fat32 and is still not recognized in disks. Before I have inserted thi...

MikroTikFan

I have found - WWW service has different port ;-) SnifferService.ini [Settings] #Required settings are uncommented #Defaults are shown #Capture packets from this network (ignore internal traffic) #Comma-separated values are accepted. Specify a mask for each network even if they are the same. Network...

MikroTikFan

This speed is needed when I would like to work on some movies 10-20 GB.
Transfer this movie to Mac and back to network drive.

I still wondering what is max bandwidth limit of my wAP ac and how to setup this correctly ?

MikroTikFan

I have MacBook Air which supports 1.3 Bbps AC. "802.11ac network using an 80MHz-wide channel can deliver even higher throughput: 433 mbps over a single spatial stream, 867 Mbps over two, and a staggering 1.3 Gbps over three spatial streams " Mikrotik access point is connected directly to m...

MikroTikFan

Hi Try to change your router IP. ip address you have is used as broadcast. Thank you this is broadcast , It mean 192.168.0.255 this is my understand correct or not , because I use 192.168.0.0/24 You are right! If you use mask 24 (255.255.255.0) you can use the 192.168.0.254 as your router adress. I...

MikroTikFan

Thank's for advise. I have few devices behind which have own ipv6 address. For this ipv6 addresses I need to limit connections on ports. For example limit ports to one of my ipv6 device 2001:....:aaaa 111,139,161,445,548,587 /ipv6 firewall filter add action=accept chain=input comment="Allow est...

MikroTikFan

Please help me to find what I'm doing wrong with ipv6 firewall configuration. After nmap scanning ipv6 address I have still open some ports like : 111,139,161,445,548,587 In my firewall filter rules I have drop for this port but this is not working and after nmap scanning I dont see on this 0) rule ...

MikroTikFan

Google constantly is establishing connection to my router from address list https://db-ip.com/all/104.196.185 I'm trying to drop this connections using /ip firewall filter add chain=input action=drop connection-state=established,new protocol=tcp src-address=104.196.185.0/25 in-interface=pppoe-out lo...

MikroTikFan

Did you increase size of DNS cache? Default 2MB is nowhere near enough for what you want to achieve. If you did not do that, most probably you see no hits because your DNS cache is not working at all. If you did increase the cache size, another firewall rule is interfering with your rule - in this ...

MikroTikFan

You might want to look at the size of your DNS cache. I have not done napkin math to tell you the exact cache size required for almost 150k entries, but I guess you could increase it to 200MB for starters, and if it's still full try increasing it even more. There is enough memory available on the b...

MikroTikFan

What kind of data can I store in additional UDB3.0 memory drive:
- proxy data?
- lists for dns adblock and ddos firewall blocking?
- other?

Can I get your feed back how you are using this additional drives ?

I just want get idea how big this drive should be ?

32G, 64G, ora 128 G?

MikroTikFan

I have been implemented whole stuff like is described in GitHub https://github.com/aziraphale/routeros-dns-adblock I'm using RB3011 and I have 140 k records of static DNS. /ip dns print servers: 8.8.8.8 dynamic-servers: allow-remote-requests: yes max-udp-packet-size: 4096 query-server-timeout: 2s qu...

MikroTikFan

Fine, is there any USB drive limitations 32 Gb will be fine ?
Which file system is prefered ?

MikroTikFan

RB 3011UiAS has Qualcomm Authors Internet Processor. This processor is prefixed IPQ. APQ8064 (Snapdragon 600) and has SATA3 connectivity.

http://images.anandtech.com/doci/7526/I ... 1479656169

I just wondering if there is any chance to connect using SATA3 SSD drive ?

MikroTikFan

Can I use Dude for main network traffic monitoring by domain names ?

MikroTikFan

Why this is not possible to get domain names. Other routers like DD-WRT or Openwrt can do this.
And Tomato Shibby. A list of the last 50(?) web sites visited, with timestamp and LAN IP address. Stunningly useful.

How to implement Tomato Shibby on Mikrotik ?

MikroTikFan

Thanks for this hints. Could you please explain in more details how to implement this. I have also Ubuntu server and maybe there is any solution how to automatically monitor all traffic by Ubuntu software. Important is to resolve all ip connection to domains, Preferred on-line monitoring solution Ad...

MikroTikFan

Please help me to configure wireless access point wAP-ac (RBwAPG-5HacT2HnD-BE) with router RB3011 (RB3011UiAS-RM) to have fastest possible AC connection. Right now I'm using this access point in mode WISP AP and as wireless: *Band: A/N/AC *Channel with: 20/40/80 eeeC *Mode: Bridge This configuration...

MikroTikFan

Hi, I need to build wireless 50m bridge and I hope that I will be able do this just using wAP ac? Next point is to connect in this remote localisation 2 pcs. X 3M cameras. That all might be enabled just using PoE supply, butI don't know if Miktotik is offering any switch with more than 3 PoE out ? H...

MikroTikFan

Why this is not possible to get domain names. Other routers like DD-WRT or Openwrt can do this.

MikroTikFan

Hi,

I would like to have better control on my online traffic and I'm wondering how to see on-line current traffic.
In firewall we have online connections but only as a IP address.

Is this possible to convert them and see somehow domain list connections ?

MikroTikFan

Thanks for all advice's.
I know that I can give different port to whole webfig and different for winbox app.

To be sure if I understand right webfig separation - is this possible to separate webfig access from webfig access/graphs on different ports ?

MikroTikFan

I need a help how to limit access to my graphs shared through webfig service
When I share access to my router before login I can see my graphics stats.
Is there any way to limit this information after login or switch off ?

MikroTikFan

Can you please add info which is right order ?

MikroTikFan

I just wondering if in my case the only one solution is to use local DNS services ?
This situation should be quite popular if someone is providing web services.

How do you react if user will use externall dns, for example google

Yes I'm blocking google dns and most other dns services.

MikroTikFan

Different because of using DNS services for using different area restricted services for some web pages

MikroTikFan

Can I configure not only DNS local records in ip dns static but also different dns for different URL ?

MikroTikFan

The problem is that this config doesn't work and I can't open this web page from internal network. I'm not sure what you mean to allow packets from bridge-local to bridge-local in forward chain chain=forward action=accept in-interface=bridge-local out-interface=bridge-local log=no log-prefix="&...

MikroTikFan

The last rule is obviously wrong: - dst-address=192.168.20.100.0/24 doesn't really need an explanation :) - it can't have out-interface=pppoe-out1 if it's supposed to do hairpin NAT, the correct interface would be bridge-local But if your WAN address is really 192.168.111.111, i.e. non-public one, ...

MikroTikFan

net1.png Please help me to find reason why my router do not goes to external domains locally. chain=srcnat action=masquerade out-interface=pppoe-out log=no log-prefix="" chain=dstnat action=dst-nat to-addresses=192.168.100.210 protocol=tcp dst-address=192.168.111.111 dst-port=80 log=no lo...

MikroTikFan

All ipv6 test are showing that all is fine ;-) I have changed MTU for he 6to4 tunnel for 1280, L2 MTU for this interface has value 65535 and this valu I can't change. Source interface PPPoE has, Max MTU - 1480, Max MRU - 1480, MRRU - 1480. I tried other lower values but this looks not so sensitive f...

MikroTikFan

I have changed MTU for PPPoE and HE same value 1480 and the result is the same as before. Still most web pages are working properly on IPV6 protocol. I found just by accident that mikrotik.com, forum.mikrotik.com and netflix.com are not working as a web page and are answering for ping as IPV6 addres...

MikroTikFan

If pings work but not HTTP, then you probably have an MTU problem. Try pinging with a full-mtu-sized packet and the DF flag set. If that also fails, then it's MTU. My PPPoE MTU is 1500 and HE interface MTU is the same 1500. How to do this check? BTW: many other web pages are working correct - like ...

MikroTikFan

I allow ICMP on my router's input chain - icmpv6 is much more critical to IPv6 than ICMP is to v4. For instance, the "arp" function (now called ND - neighbor discovery) uses icmpv6 to do its job, so you must at the very least accept ND requests or else nobody's going to be able to transmi...

MikroTikFan

My nd config is below /ipv6 nd export # may/05/2016 20:49:37 by RouterOS 6.35.1 # software id = AEFK-U9CX # /ipv6 nd set [ find default=yes ] advertise-dns=yes other-configuration=yes ra-lifetime=10m /ipv6 nd prefix add autonomous=no interface=bridge-local on-link=no preferred-lifetime=5m prefix=::/...

MikroTikFan

May I ask for any recomendation why mikrotik.com ipv6 site is not working ? Same thing is with the ipv6 site netflix.com Strange thing is that those sites are pinging ipv6 address properly. /ipv6 firewall address-list add address=2001:470:X0:YYY::/64 list=home /ipv6 firewall filter add chain=input c...

MikroTikFan

did you set gateway to be interface ether1-gateway? Yes and now changed to 2001:470:X0:YYY::1 XX@CoreRouter] > ipv6 route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable # DST-ADDRESS GATEWAY DISTANCE 0 A S ::/0 2001:470:X0:YY...

MikroTikFan

I have changed this two interfaces 0 G 2001:470:X 0 :YYY::2/64 1 G 2001:470:X 1 :YYY::1/64 XX@CoreRouter] /ipv6 address print Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local # ADDRESS FROM-POOL INTERFACE ADVERTISE 0 G 2001:470:X0:YYY::2/64 he no 1 G 2001:470:X1:YYY::1/64 br...

MikroTikFan

Your 'default route' should use interface = he, not interface = ether1 gateway. That's the static route: 2000::/3 Thanks for this advise, I have change it XX@CoreRouter] /ipv6 route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreacha...

MikroTikFan

That is fine ;-) I have received IPV6 address :D Now there is next problem - I don't see IPV6 external network thru 6to4 HE tunnel. I'm trying to ping 2620:0:1cfe:face:b00c::3 but without connection :( I just wondering if my routing for this IPV6 HE connection is correct ? ... XX@CoreRouter] /ipv6 r...

MikroTikFan

I have changed that XX@CoreRouter] /ipv6 nd print Flags: X - disabled, I - invalid, * - default 0 * interface=all ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=unspecified retransmit-interval=unspecified ra-lifetime=10m hop-limit=unspecified advertise-mac-address=yes advertise-dns...

MikroTikFan

I have RB2011UiAS and when I'm testing my connection 100MB I see that CPU is used 80-95% I'm using PPPoE connection to my provider. Because of this I have to change my config to not exceed 100% of CPU. Otherwise I can't fully use my speed. I'm just supposed that this is only on this last version v 6...

MikroTikFan

I have assigned ether1-gateway to ipv6-2001:XXX:X0:XXX::1/64. 1 G 2001:XXX:X0:XXX::1/64 ether1-gateway yes You suggest to change it to bridge ? Can you be so kind and put to update mikrotik code what to update ? Thanks in advance !

MikroTikFan

Please help me to find the reason why I'm not getting ipv6 address from Windows 10 system. I have IPV6 from HE and everything looks fine but I still do not receive ipv6 My ND configuration: XX@CoreRouter] /ipv6 nd print Flags: X - disabled, I - invalid, * - default 0 * interface=all ra-interval=3m20...

MikroTikFan

Thanks for clarifying me how it works. Before I will remove dhcp.v6 server please confirm that rest of my devices like android phones, iPads either will not use this ? As I understand my dhcp.v6 server is not a reason why I'm not getting ipv6 addresses but I'm not sure if this concerns all types of ...

MikroTikFan

After that all hints, changing configuration somehow I just lost my ipv6 address in my LAN clients :? Now I have only ipv4 and local-link without ipv6 :( I have checked all and really I don't know what to change again. I'm trying to find what can cause stopping to share from Mikrotik ipv6 address? M...

MikroTikFan

Windows since Vista work fine with DHCPv6. It's just DNS in RA that Microsoft decided to boycott. But unless you're building pure IPv6-only network, it should not be a problem, because even DNS server with IPv4 address can answer queries about IPv6 records. In my case unfortunately without setting ...

MikroTikFan

automatic DNS - for Windows - you can't with only a Mikrotik router. Mikrotik's only way to assign DNS information is in the RA packets - so Mikrotik expects the SLAAC clients to use this information to configure their dns automatically as well. If you have an Apple device, you'll notice that these...

MikroTikFan

Right! my HE IPV6 data: IPv6 Tunnel Endpoints Server IPv6 Address:2001:XXX:X0:XXX::1/64 Client IPv6 Address:2001:XXX:X0:XXX::2/64 Routed IPv6 Prefixes Routed /64:2001:XXX:X1:XXX::/64 I changed my addresses in IPV6 /ipv6 address print Flags: X - disabled, I - invalid, D - dynamic, G - global, L - lin...

MikroTikFan

The "XXX:XX:XXX" in 2001:XXX:XX:XXX::1 is not exactly the same as "XXX:XX:XXX" in 2001:XXX:XX:XXX::2, right? This XXX:XX:XXX in "XXX:XX:XXX" in 2001:XXX:XX:XXX::1 is exactly the same as "XXX:XX:XXX" in 2001:XXX:XX:XXX::2 /ipv6 address> print Flags: X - disabl...

MikroTikFan

(...)

MikroTikFan

Traceroute checked. All firewall lines disabled. I see only one hoop to my link-local gateway : fe80::4e5e:cff:fe43:8996%18 /ipv6 route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable # DST-ADDRESS GATEWAY DISTANCE 0 A S ::/0 2...

MikroTikFan

IPV6 address received :D 6to4 tunnel enabled and running. ...but only one problem is that I don't have connection to IPV6 sites Strange is that in my IPV6 address list I added only two lines (0,1), but after reboot I have got additional (3,4,5) Flags: X - disabled, I - invalid, D - dynamic, G - glob...

MikroTikFan

How to configure correctly DHCP6 in my case for IPV6 from HE 6to4 tunnel ?
Right now I think that something is wrong with my Mikrotik DHCP6 server configuration.

MikroTikFan

I followed your instruction. I think that my problem is that despite the enabled DHCP6 server my computer doesn't get ipv6 address. Binding # ADDRESS DUID SERVER STATUS 0 2001:XXX:XX:XXX::/64 0xffffff server_dhcpipv6 waiting DHCP # NAME INTERFACE ADDRESS-POOL PREFERENCE LEASE-TIME 0 server_dhcpipv6 ...

MikroTikFan

Thanks - that is almost done, but I don't have in protocol - ipv6. When I tried to put ipv6 is in red, when 41 is accepted, but dont see any ipv6 comment. /ip firewall filter add chain=input comment="IPv6 tunnel (protocol 41)" in-interface=\ ether1-gateway protocol=ipv6 src-address=a.b.c.d...

MikroTikFan

I have HE 6to4 tunnel. My whole LAN is connected to Mikrotik through TP-Link managed switch. My switch supports IPV6 and I have link-local address config fe80::fa1a:67ff:fe48:61ab. From tunnel broker I have different address 64 class : 2001.********** How to setup my whole network to assign for some...

MikroTikFan

Could I ask for help

Thanks in advance !

MikroTikFan

I think that in my case Windows 7, 8.1, 10 VPN client is not problem. I tried also to connect L2TP, PP2P from LAN and this is working fine, after I will switch client station to external network ie. 3G/4G I'm having problem ;-( Something is wrong in Mikrotik Firewall. I don't know what I have to cha...

MikroTikFan

Please consider that DSNCrypt can use a lot of resolvers in different part of the World without establishing payed commercial VPN. https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv Please keep in mind also that for some solutions with big traffic you don't need to use VPN...

MikroTikFan

I thing that I'm step ahead and don't have problems with firewal any more. Still I can't establish pptp connection ;-( 17:09:38 pptp,info VPN pptp: TCP connection established from 37.47. 37.37 17:09:38 pptp,info TCP connection established from 37.47.37.37 17:09:38 pptp,debug,packet VPN pptp: rcvd St...

MikroTikFan

Can I ask in New Year anybody for help

Thanks in advance!

MikroTikFan

IP-CONN.png After some config changes this L2TP VPN works in my LAN. Because of this I don't have any problems with secrets.;-) Maybe there is problem in IPsec configuration and by default this works from inside of the network and from outside not /ip ipsec policy> print Flags: T - template, X - di...

MikroTikFan

I hope than anybody can help me with this problem

Thanks in advance !

MikroTikFan

I found small error in config and now I can establish l2tp vpn from inside of network. Probably something is wrong in firewall config. For this von I have : ;;; OpenVPN chain=input action=accept protocol=tcp in-interface=ether1-gateway dst-port=1460 log=no log-prefix="" chain=input action=...

MikroTikFan

Thank's, I got your point

Now is working

MikroTikFan

So after upgrade command this will download and upgrade firmware ? After run this comand is firmware upgraded. Then is needed restart router for perform upgrade. Where I can find difference between current firmware : 3.18, and new 3.24 ? Do you see a post one before you? Right ;-) but for my 2011Ui...

MikroTikFan

I have done your suggestions and changed webfig port from services to just 443. I have checked from LAN and all works fine on port 443. I have disabled NAT rule and add new one in firewall input filter: ;;; WinFig chain=input action=accept protocol=tcp in-interface=ether1-gateway dst-port=2443 log=y...

MikroTikFan

I tried to get access to my WebFig on port 2443. ;;; Router HTTPS chain=dstnat action=dst-nat to-addresses=192.168.10.101 to-ports=2443 protocol=tcp dst-port=2443 log=yes log-prefix="WebFig" but this is not working 20:37:18 firewall,info WebFig dstnat: in:ether1-gateway out:(none), src-mac...

MikroTikFan

So after upgrade command this will download and upgrade firmware ?
Where I can find difference between current firmware : 3.18, and new 3.24 ?

MikroTikFan

Please advise me what is the difference between

Current firmware : 3.18
Upgrade firmware : 3.24

Should I download somewhere new firmware and put somewhere ? or this is automated proces ?

Should I upgrade my routerboard 2011UiAS?

MikroTikFan

Please help me to find a reason why my VPN L2TP connection is not running. Because I have problem from outside my network to connect first I tried to connect I decided to run first from my LAN. Mikrotik 192.168.29.254 Win7: 192.168.29.180 Firewall ;;; OpenVPN chain=input action=accept protocol=tcp d...

MikroTikFan

Mikrotik Support - can you share witch this community date when Mikrotik Team is going to launch RouterOS v7 ?

MikroTikFan

Sorry, this line I have captured when this was disabled.

If this is enabled still my traffic is not routed.

MikroTikFan

Anyone can help me ?

Thank's in advance

MikroTikFan

Because currently on Mikrotik is impossible to establish UDP openvpn connection I have build solution based on RasPi+Mikrotik (main router). My RasPi has Debian and already established UDP openvpn connection. RasPi has ip:192.168.100.105 and connect to remote VPN connection172.16.199.99. I tried to ...

MikroTikFan

Mikrotik support answer (just now):
Thank you for the suggestion. We are already working on UDP OpenVPN in RouterOS v7

May I ask Mikrotik Support when this will be launched to production and announced to all Mikrotik community?

MikroTikFan

Despite the many constraints I succeed and establish openvpn connection

Now I just wondering how can I restrict access to recources (IP, port, MAC)

1) OpenVPN as a client, restriction by client side

2) OpenVPN as a server, restriction by server side

MikroTikFan

+1 -- UDP
+1 -- LZO

Why Mikrotik stuff is not going to answer or make this happened since so many years ???

Customers votes are not important ???????????????????????????????????????

MikroTikFan

Please anyone from Mikrotik team can confirm if GPON module can work tohether with new RB3011UiAS-RM ?

GPON
http://routerboard.com/SFPONU

+

RB3011UiAS-RM
http://routerboard.com/RB3011UiAS-RM

MikroTikFan

UDP mode is currently unsupported in both openvpn roles client (server other router) and server on Mikrotik ;-(

Why this is so popular in other routers and UDP port is simply faster !

MikroTikFan

I need to setup OpenVPN UDP connection to OpenWRT router.
Afrer last fix to SSL bugs probably I need last version of openwrt.

Please help me and provide last openwrt image for RB2011UiAS

Thank's in advance!

MikroTikFan

Frequent Visitor explained I think you missed the point that unless and until MikroTik implements it, a MikroTik router (as OpenVPN server) accepts only tcp protocol for openVPN connection. that Mikrotik implements this, so I understand that using 1) Mikrotik OpenVPN server I can't use UDP but othe...

MikroTikFan

Solution based on MetaRouter (OpenWRT) is not efficient and quite complicated. I'm owner of Mikrotik router and Mikrotik OS not OpenWRT. I just expect from Mikrotik to support market standards solutions like OpenVPN UDP and TCP. I need to connect to OpenVPN 1194 (UDP) which is a standard solution an...

MikroTikFan

proto tcp-client

but I need UDP, so how can I run ovpn client with udp-proto?

MikroTikFan

I think that I just found reason in post

http://forum.mikrotik.com/viewtopic.php?f=1&t=77898

about problems to use UDP with OpenVPN (1194)

Is there any way to connect as OpenVPN client to UDP 1194 port ?

Default protocol for OpenVPN is 1194 (UDP) and this is not working ?

MikroTikFan

Why Mikrotik stuff is not hearing customers voice ???
How long this should take since 2012-1015, Mikrotik wasted 3 years !

In the same time most of other companies have implemented this feature even in low-end routers/switches !

MikroTikFan

+1 for UDP

Why Mikrotik stuff is not taking into consideration customers votes ???
This times this is unique business strategy ...

MikroTikFan

I have checked informations from OpenVPN server logs. Unfortunately in OpenVPN server logs I don't see any connections tyres from my client. On the other hand from OpenVPN Client side I see that each connection is ended - disconnected Please look at my log (attachment) and help me why Mikrotik is no...

MikroTikFan

Thanks, this is very important, especially user=CN <common name of client cert> Now go to PPP/Profiles and create a new profile named openvpn-client. Set as follows... Use IPv6: no Use MPLS: no Use Compression: no Use VJ Compression: no Use Encryption: yes All other fields can be left empty or at th...

MikroTikFan

Hello, Please help me to configure my OpneVPN connection to OpenVPN Server. I have generated from server my certs: ca.crt my.crt my.key I have found some instructions how to configure ovpn client, but most of them have user name and passwords. My authorization is based on certificates. Please help m...

MikroTikFan

Thanks for so much information.
I have to check all this stuff.

I just wondering how fast this connection could be if I will use QRT 5 ac ?
Anyone can share with me information's from real life ?

MikroTikFan

Why I can get only 150/150 Mbps ...on the other hand I see https://www.youtube.com/watch?v=MWhD2z59ORo ~300/300Mbps

As I understand 5Ghz "Nstreme Dual" can double this transfer ?

MikroTikFan

Thank's, this shows that 300/300 Mbit is possible

https://www.youtube.com/watch?v=MWhD2z59ORo

MikroTikFan

What range of speed can I get using Mikrotik hardware ?

MikroTikFan

+1 for DNSCrypt.

When ?

MikroTikFan

Please recommend me hardware for outdoor 300m Point-to-Point connection.
I need connection with speed t least 500/500Mbit.

Important is also low latency because this connection will be used also for media streaming.
Please suggest system wireless device and antenna for this distance and speed.

MikroTikFan

I'm trying to find gigabit Mikrotik Switch with 8 - 16 port, but I don't see any...

MikroTikFan

Please recommend Mikrotik hardware to have stable wireless connection low ping and high speed (500/500 MBps).
Distance is around 500 m, outside temperature in Winter might be -20 -30 C.

MikroTikFan

Anybody knows if Mikrotik is going to launch new cAP/wAP with double band and AC networks.
If YES - When ?

MikroTikFan

Sob Yor solution works great ! Thanks for help ! Good catch, sob. Adding the 4th rule to "catch the pinhole early" is needed. I didn't think about that case. Honestly, I always hate to find such an installation with double nat. Get the public IP on your own router, or else have static inte...

MikroTikFan

Thank's for your solution. this works same /ip firewall nat add action=masquerade chain=srcnat out-interface=WAN add action=dst-nat chain=dstnat dst-address=192.168.1.101 dst-port=443 protocol=tcp to-addresses=192.168.2.2 add action=masquerade chain=srcnat dst-address=192.168.2.0/24 out-interface=LA...

MikroTikFan

router-wan(internet source)=192.168.1.101 router-lan=192.168.2.254 ssl-device(forward ssl to)=192.168.2.2 The solution works but that depends from where I'm checking the whole solution. 1. OUTSIDE LAN - INTERNET When I'm trying to check from outside to domain mydomain.com (195.123.33.44) and configu...

MikroTikFan

after that additional parameters forwarding from outside to 443 is not working ;-(

MikroTikFan

Hello, please help me to setup incoming forwarding rule for 443 ports. I have to froward incoming traffic on port 443 (SSL - browser) to other device than my router. router-wan(internet source)=192.168.40.1 router-lan=192.168.50.1 ssl-device(forward ssl to)=192.168.50.2 I tried to make it by my selv...

MikroTikFan

+1 IGMP Snooping, so for Mikrotik developers wheeeeeen ?

MikroTikFan

Thanks !!!

MikroTikFan

/ip firewall nat add chain=dstnat protocol=udp src-address=192.168.10.40 dst-address=8.8.8.8 dst-port=53 action=dst-nat
to-addresses=69.42.56.54 to-port=53

???

MikroTikFan

correct? /ip firewall nat add chain=dstnat protocol=udp src-address=192.168.10.40 dst-address=8.8.8.8 src-port=53 action=dst-nat to-addresses=69.42.56.54 to-port=53 to make same as: iptables -I PREROUTING -t nat -p udp -d 8.8.8.8 --dport 53 -j DNAT --to-destination 69.42.56.54 only for LAN IP-192.16...

MikroTikFan

Please help me to implement following iptables instruction which redirect LAN traffic from google dns to other dns provider (69.42.56.54). iptables -I PREROUTING -t nat -p udp -d 8.8.4.4 --dport 53 -j DNAT --to-destination 69.42.56.54 iptables -I PREROUTING -t nat -p udp -d 8.8.8.8 --dport 53 -j DNA...

MikroTikFan

Thanks for explanation. I have account in HE.net and I know that there is a script provided by HE, but doesn't work ;-( I will follow this guide (http://wiki.mikrotik.com/wiki/Manual:My_First_IPv6_Network), I hope this will work. I need access from LAN to outside my network IPV6 and IPV4 access, and...

MikroTikFan

I just wondering where can I found guide how to configure in Mikrotik hybrid LAN network of ipv4 and ipv6 clients.
Solution based on Hurricane Electric WAN.

MikroTikFan

Yeeeeeeeeeeeeeeeees You are The Best ! http://wiki.mikrotik.com/wiki/Hairpin_NAT works in this case. I have also small other problem. I have forwarded port 443 from WAN to LAN (192.168.22.88) and this connection works properly from outside ;-) One important inconvenience is when I will browse other ...

MikroTikFan

All of this ports (995, 465, 993, 25) I have forwarded and this works from outside my network f.e. from 3G connection. But when I tried to connect via Outlook(Windows) or Thunderbird(Ubuntu) from laptops located in my LAN mail clients don't have access to mail server and I can't send or receive any ...

MikroTikFan

I did run the connections from outside my home thru 3G connections, and mail server works properly. The problem is when I tried to send email being connected to my LAN. My current configuration is : 1. My external address: 213.222.33.44 (fake) 2. Then after my edge fiber router: 192.168.11.1 3. Then...

MikroTikFan

ether1 is WAN interface.

MikroTikFan

Outgoing messages from my mail server in LAN IP 192.168.22.2
Regarding port 25 I have also same forwarding rule in mikrotik for this port and same for others (POP3SSL-995, IMAPSSL-993).
I have also forward/accept rule for 465 and 25 port.

Mail server stil from 192.168.22.2 cant send out e-mails.

MikroTikFan

I have problem to setup my firewall. I need to configure my local mail system. Queue message: connect to mail.domainX.com[213.222.33.44]:465 Connection time out ip firewall nat add chain=dstnat protocol=tcp dst-port=465 action=dst-nat to-addresses=192.168.22.2 to-ports=465 where: 213.222.33.44 - is ...

MikroTikFan

Accepted ;-(
Dude forgotten ..

MikroTikFan

Right, this is possible but why this is not working automatically ?
Workaround you proposed ;-( ,
but I'm asking for support and advice

MikroTikFan

Mikrotik Router is added, scanning process finish properly but without any results.

MikroTikFan

I'm glad that this problem occurs not only for me. The problem is that after scanning my network I getting only my Mikrotik router address. I have additionally more than 20 devices (switches, routers, NAS, any other devices but scanning did not recognise ...) I don't wana add manually that all stuff...

MikroTikFan

Thx, but My Windows Dude did not recognise my network.
Only router but I don't see any of devices connected to the network.

MikroTikFan

How to install dude on MikroTik MT RB2011UiAS-RM?
Current npk package do not include dude.

How can I install dude npk package to run Dude and connect to the router?

MikroTikFan

I Did that all steps but didn't disable 80 port. After that all I just tried to go to https:/192.168.1.1 (router) but I got Kod błędu: ERR_SSL_VERSION_OR_CIPHER_MISMATCH What key usage must be set? I have set on: -digital signature -key encipherment -ctrl sign -data encipherment -key cert. sign -tls...

MikroTikFan

By setting first hot spot (this is first) I didn't set up user and password ;-( After apply this settings of this first hot spot I just got login page to hotspot, and I don't know user/pass Is there any default user/pass ? So is there any chance to login without resetting whole config from the route...

MikroTikFan

Please help me how to login to hotspot. By my mistake I have add new bridged hotspot without setting new user and password. I can't login to Webfig because hotspot ask me for user and password. My webfig login and password don't work with hotspot. What can I do not to reset my whole router and lose ...

MikroTikFan

Please help me how to configure WWW https (webfig) access to management console from my WAN (eth1) interface.
I have access from my lan but from my external ip address I can't login to webfig

MikroTikFan

Thank's for help.

Probably I have done something wrong because after your procedure (after COPY and OK) I got the message " Couldn't add New DHCP Lease - already have static lease for this clieny (6)"

I don't know what to do next, and why this happened ?

MikroTikFan

I'm beginner in Mikrotik and I need a help how to setup DHCP server to lease two different DNS (normal Google and Unotelly-USA-DNS) depending on devices (by MAC address). Please help me to setup (better in WinBox). I tried to find this solution in forum but found only one post http://forum.mikrotik....

MikroTikFan

BTW anyone can help me how to configure DHCP to use different DNS for different devices (by MAC address) ?

MikroTikFan

Yes, I know that I can use VPN, but in my opinion DNS is better: - don't have any limitations to the speed limit, with VPN always you will have slower connection after VPN - some of services like Hulu don't work with many VPN providers - DNS service for this case do not charge so much router CPU - i...

MikroTikFan

I'm using two Roku devices (Roku 2 and Roku 3) with unotelly.com DNS service.
That is the reason why I need to have more sophisticated router.
I have to configure DHCP service for different MAC different DNS provided by DHCP.

MikroTikFan

Now the connection is 50 Mbps and I don't think that I will need more than 100/100 Mbps in next 12-24 months

This all is for home users, streaming internet TV (Netflix, etc) and standard web browsing.

MikroTikFan

FTTH router means DASAN endpoint FTTH router.
Sorry, I can't run it as a bridge ;-(

MikroTikFan

I'm going to run HE ipv6 tunnel, OpenVPN server, some HTTPS and HTTP services. If you have also some concerns to use double NAT I will use option B, but please help me to clarify some questions: 1. gateway will be this FTTH router and can I use RB2011UiAS-RM in this case same class network in both r...

MikroTikFan

Please give me some advice regarding my home network architecture. I have nice FTTH fiber connection, but my provider gave me router with NAT ;-( This router has some basic configuration possibilities: DMZ, port forwarding, DHCP, etc. One of 4 LAN ports is for internet, second for TV and next for fu...

MikroTikFan

I just found post http://forum.mikrotik.com/viewtopic.php?f=3&t=88019

and there is described this sample device

https://apps.fcc.gov/eas/GetApplication ... id=2300408

That is what you mean ?

MikroTikFan

Anyone can tell if Mikrotik is going to produce or have in near planes wall or ceiling mounted Access Points like Ubiquiti ? (f.e. http://www.ubnt.com/unifi/unifi-ap-ac/ )

MikroTikFan

Number of WiFi clients is up to 5-10 (Tablets, Phones, TV), but same time work usually 3-5 devices. Distance is not so long, just standard home environment up to 10-15 m and thru one or two walls (first and second floor). My network center is in one corner of the home so is difficult to have full ra...

MikroTikFan

Sorry for this exact frequency requirements. This is not so important.
Coverage and maximum transfer is in this case most important.

MikroTikFan

Ok, right. I will describe my needs. I would like have same class network in my wired network and my wireless. Might be dual band WiFi (2,5 and 5 GHz), LAN connection based from my LAN sockets, maybe is possible to have something similar f.e. http://www.cyberbajt.pl/download/ubiquiti/airgateway/airG...

Search found 203 matches