MikroTik

flynno

Can anyone confirm if these devices are safe to use outside at this date? It's such a weird design to have to point a device upwards to prevent water ingress. I live in Ireland and was thinking about buying these products, not sure if these devices would last long with the rain we get over here.

flynno

Have you tried using antenna gain to reduce wifi signal from reaching outside the building?

flynno

Devices can use randomise mac addresses while using a hotspot, you might need to use a login username and password

flynno

Possibly an IP conflict, can you change the mac address on port facing ISP on the mikrotik to the previous ISP router mac address

flynno

Why do you need WiFi to be so fast?

flynno

Can you see any port drops on interfaces that the radios are connected to?

flynno

Hey guys, I have an LtAP device and having issues sending the longitude readings to a webserver, I can send the Latitude readings. If I use /tool fetch http-method=post http-header-field="Content-Type:application/json" http-data="{\"lat\":\"$lat\",\"lon\"...

flynno

Had the same issue today, sector went down last night and I drove to site with replacement wireless card but found that the gesp had water ingress and corrosion had set in on the pins. The grommet seems to trap the water once it gets in, this is not good as I have quiet a few of these in operation. ...

flynno

Is the Tik LTE connecting to 3G or 4G, turn off 3G on the device

flynno

Try reducing the DNS cache size, that will free up space

flynno

Could be firewall blocking BT, add input rule accept with port 2000 for BT on both devices, disbale rule once tests are complete

flynno

/interface vlan add comment="VLAN 1 - CCTV" interface=Trunk name=_CCTV vlan-id=1 add comment="VLAN 88 - PPoE" interface=Trunk name=_PPoE vlan-id=88 ether5 is named interface=Trunk and on ether2 is ppoe what port is ether2 been used for? it's named ppoe /interface pppoe-server ser...

flynno

Ok, you have your pppoe server set on a vlan and its set on interface Trunk which is ether5 from what I can see in your config. /interface vlan add comment="VLAN 88 - PPoE" interface=Trunk name=_PPoE vlan-id=88 Can you remove this /ip address add address=192.168.88.1/24 comment="PPoE ...

flynno

I have noticed this also when I use a RoMon secret, I can only see few devices not sure is it a bug

flynno

Have you tried removing the IP address set on the pppoe server? you dont need to have an address set for the pppoe interface just a ip pool for clients

flynno

Hi,
add the route 0.0.0.0/0 via the gateway IP of the main router and try ping 8.8.8.8

flynno

Edited above script to add telegram #set lowvoltalarm to desired alarm voltage in tenths of a volt. 125 = 12.5v :global lowvoltalarm 233 :global highvoltalarm 280 :global highvolt :global lowvolt :global starttime :global hivolttime :global lovolttime :global vh :global lastvoltage :global telegramB...

flynno

What is Eero? :shock: mesh WiFi https://eero.com/ I have 2 in bridge mode. Excellent wireless coverage. I did order Audience to give it a try. Eero is what the guy who has NO BUSINESS AT ALL TOUCHING A NETWORK, is bringing into a commercial install. Sparky, "I use this all the time." Me, ...

flynno

What are you trying to do that needs wifi?

flynno

/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0

Try make the change above

flynno

what vlan does your ISP use for fibre?

flynno

It's possible that the antenna gain has changed on the radio to contry regulations reducing the power causing the signal to change. Did you upgrade both radios or just one?

flynno

6.46beta16 installed on hap mini (smips) using PEAR2\Net\RouterOS; api no longer works to login. PEAR2\Net\RouterOS\DataFlowException: Invalid username or password supplied. in /var/www/html/PEAR2/Net/RouterOS/Client.php:175 Stack trace: #0 /var/www/html/index.php(71):PEAR2\Net\RouterOS\Client->__co...

flynno

In DHCP Client have you set 'Add Default Route:' to yes along with use peer dns

flynno

Add a dhcp client on ether1 in IP >DHCP Client

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN

/ip dns
set servers=8.8.8.8,8.8.4.4

flynno

Set PPPOE to WAN interface and ether1 to LAN if it's an SXT device you are using /ip firewall address-list add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet add add...

flynno

You should get somebody to hold it in the direction of the tower outside the house, then run your tests.

flynno

Have you tried removing the src-address=102.177.16X.X from /radius
add address=102.177.160.3 secret=XXXXXXXXXXXX service=ppp,login src-address=102.177.16X.X

flynno

Is the TP link in bridge mode or router mode?

flynno

Why don't you put routers at the towers and terminate the pppoe connections on the tower that the clients are connected to?
Are the VPLS tunnels back to the core with one PPPoE server and all your clients are terminating at the core?

flynno

That's great glad you got it sorted

flynno

Are you using the dns provided by the sim? try add 8.8.8.8 and 8.8.4.4 as the dns servers
You can remove the LTE dns from the LTE APNs menu untick Use Peer DNS and default route distance to 1

Or in the DHCP add dns servers into the network

flynno

/export config here

flynno

When you say "Access Mikrotik Router Externally" do you mean access from devices that are connected to the modem or from anywhere in the world? I use below rules on my Tik device along with port knocking and VPN In terminal copy paste below, It disables services except for winbox and www /...

flynno

Check antenna gain on SXT

flynno

add rule
/ip firewall filter add chain=input action=accept protocol=tcp dst-port=8291
move rule to just below the first input drop rule

flynno

You should just email or text the client and tell her that the internet will end on such a date unless payment is received and reconnection fee will incurr if payment is not made nake the text look automatic and robotic like

flynno

Open Terminal on router and paste firewall rules below /ip firewall address-list add list=Nextiva address=208.73.144.0/21 comment="Nextiva IP Range 208.73.144.0/21" /ip firewall address-list add list=Nextiva address=208.89.108.0/22 comment="Nextiva IP Range 208.89.108.0/22" /ip f...

flynno

You must be suffering from some kind of mac spoofing, if the clients are connecting to the hotspot from AP's, turn off default forward on the AP's If you try connect to the hotspot using your device and see if you can ping other devices connected to the hotspot, if you can ping the devices you will ...

flynno

When did this start to happen?
How are your clients connecting to the hotspot? wireless / wired
Is your hotspot running on a bridge?
What is the IP pool of the hotspot?

flynno

Ok try set it to 2 and see if that helps you out

flynno

Is Addresses Per Mac = 2

flynno

Hotspot Server
Addresses Per Mac ?

flynno

Ok I taught you had FTTB. Might be best to give your ISP a call and see what is going on. It could be something at there end

flynno

Ah ok now I understand your design, the SXT LTE kit has LEDS on it for alignment so you can just adjust it each time you dock. Why dont you try build a custom solution using below; mANT LTE 5o (LTE ANTENNA) 5dBi LTE antenna with 2 x SMA connectors x1 RBM33G Powerful OEM board with three Gigabit LAN ...

flynno

The WAP AC is an access point only, so you connect devices to it. SXT LTE is for internet, you could power up the WAP AC on the second POE port and put the WAP AC outside maybe setup a hotspot on a vlan for other dock users. You could put another indoor Tik device inside the cabin, if you need hardw...

flynno

Do you have a fibre terminal ont with fibre in and ethernet cable out to run to ISP modem? Can you remove the ISP modem and just have the mikrotik device? Alot of fibre connections run on vlan10 so it would just be a matter of you creating a vlan10 on ether1 and request dhcp client using vlan10. You...

flynno

Hey Patrick,

The Groove 52 ac has only single chain and is L3 device, L3 meaning you can only connect one device to it.
If you need the access point to be outside and waterproof you would be best off going for
The SXT 4G kit and a wAP ac (wAP ac duel band 2.4 - 5ghz outdoor or indoor device)

flynno

Is the Tik device to be used as a bridge or main router?

flynno

Disable "allow remote requests" on DNS unless you add a firewall input rule to drop port 53 from wan side You have a vlan 10 on bridge, what is this vlan to be used for? /interface vlan add interface=bridge name=vlan10 vlan-id=10 What type of internet connection do you have i.e. FFTH. FTTC...

flynno

It's possible that you have an ip conflict, check for the mikrotik for duplicate IP's

flynno

PTP link
R2 - R4

R2 side UltraDishTM TP 550 with MikroTik RouterBOARD RB922UAGS 5HPacD 802.11ac 866Mbps
R4 side UltraDishTM TP 400 with MikroTik RouterBOARD RB911G 5HPacD 802.11ac 866Mbps
AP on R4 is QRT AC L4

Detect Radar is causing a lot of issues with frequency selection

flynno

5785/20/an(33dBm) is R2-R4 PTP link 5745/20-Ceee/ac(33dBm) is an AP on R4 facing opposite direction to the PTP R2-R4 link R4 AP was set to AUTO frequency and it set itself to 5745/20-Ceee/ac(33dBm) The AP is running routeros-mipsbe-6.42.11, do I need to change installation is set to "Outdoor&qu...

flynno

PPPoE server on R4 see image attached I left MTU blank on the pppoe server. The client cpe I have it set it to 1480 The client is having the traffic shaping done on R4 and I see very few packet drops in the queue tab, its set to wireless default queue type. The connection to the client cpe is a qrt ...

flynno

R1-R2 5805 5Ghz only AC 5805/20-Ceee/ac(33dBm) Tx / Rx Signal Strenght -29/-28 dBm distance is set to dynamic but the link is 1KM in distance TX fluctuates up and down between 50 to 80% and the RX is fairly consistent between 80% to 90% there is always traffic going through the link Signal to noise...

flynno

Hey Petrb, R1 - R2: 802.11 ac wireless R2 - R4 is set to NV2 as I was creating self interference on the R1 - R2 link NV2 is all I can use on R2 - R4 as nstreme drops to many times due to interference. The link is passing over a small town and is picking up alot of access points in the 5ghz band. I c...

flynno

Hey guys, I'm using this firewall on wireless clients CPE's, anyone have anything else that I should include into it? /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=accept c...

flynno

Hey guys, Just a question in relation to the CCR1016-12S-1S+ PSU. Is it possible to remove the second power supply and connect the pins to a din rail DC 24v 4A output supply? I have the option of battery supply and would like to be able to use it with the CCR1016-12S-1S+ in case of mains power suppl...

flynno

Hey guys, I'm having issues with my network, if anyone can take a look at the design layout and may be able to help with below issues. Bandwidth tests between routers R2-R1 Download speed 100M + (R2 - R1 is over wireless) R4-R2 Download speed 100M + (R4 - R2 is over wireless) R4-R1 Fluctuates betwee...

flynno

Ok see image of network, R4 is router that client is connected to that is having the speed issues

flynno

Hey CZFan,

I forgot to mention that it also goes lower than 10MB also, so it's a high 10M - 11M or can be as low as 3M etc... but never higher than 12M

flynno

Hey guys, I have a LHG XL 5 ac with ROS package v6.42.11 on clients premises. LHG XL 5 ac upgraded with v6.42.11 Client speed is set to 20M download 5M upload download but cannot pass 10MB on the speedtest.net app or website. Bandwidth tests from CPE to Main router show 20M download 5 Upload, so no ...

flynno

The SXT you are using is has a licensed 3 so the wireless will be set to "bridge" mode for one only one wireless device to connect which is the workshop device. The script below has set the wireless security to workshopconnect so on the TP device in the work shop you will need to search fo...

flynno

Ok, what is it you are trying to do with the SXTsq Lite2?
Is it possible for you to reset the device and remove the default setup script.
I can assist you to setup the device without the help of quickset.

flynno

Hi Derek,

Can you do a command export file=PTP-AC hide-sensitive in the terminal of the SXT
Open the file with notepad++ and copy paste contents here or attach the file.

flynno

Can you post the config you are running on it?

Could be something to do with the interface lists and winbox access set to the wlan

flynno

if the sale bad product goberment punish them.

Pure quality stuff right here

flynno

Have you added the nat rule and place it above the current nat rule on your CCR

/ip firewall nat
add action=accept chain=srcnat comment="Client Static IP" src-address=111.111.111.111

111.111.111.111 been the public ip you want to assign to the client

flynno

DHCP. Don't want anything to do with PPPoE.

Have you tried assigning the IP via DHCP leases to the MAC of the clients CPE?

flynno

Are you using PPPoE or DHCP?

flynno

Do you mean setup a nat rule?
/ip firewall nat add action=src-nat chain=srcnat out-interface-list=WAN to-addresses=YOUR PUBLIC IP

flynno

Have you tried using a mangle rule for MTU /ip firewall mangle add chain=forward out-interface= pppoe-out1 protocol=tcp tcp-mss=1440-65535 tcp-flags=syn action=change-mss new-mss=1440 passthrough=yes /ip firewall mangle add chain=forward in-interface= pppoe-out1 protocol=tcp tcp-mss=1440-65535 tcp-f...

flynno

Solution // Receiving variables @$device_name = addslashes($_POST['device_name']); @$profile_select = addslashes($_POST['profile_select']); use PEAR2\Net\RouterOS; require_once 'PEAR2/Autoload.php'; try { $util = new RouterOS\Util( $client = new RouterOS\Client($_SESSION['user']['remoteadd'],$_SESSI...

flynno

Anyone have the correct API to update a current profile to another profile without deleting the existing one. Here is what I have so far; <?php // Receiving variables from filled form @$device_name = addslashes($_POST['device_name']); @$profile_select = addslashes($_POST['profile_select']); use PEAR...

flynno

$util->setMenu('/ip/kid-control/device');
$util->remove(($_POST['device_remove']));

Solved using util

flynno

Hey guys, i require help removing a device using the Pear2 api Two lines of code below that I am using to remove the device. I have a form created to get the name of the device to be removed that passes the variable $device_remove $addRequest = new RouterOS\Request('/ip kid-control device remove'); ...

flynno

Did you try adding the ether port that the ubnt device is connected to the pppoe server bridge

flynno

Is the UBNT connected to the RB750 in the same bridge with the PPPoE server?

flynno

Hi Johannes33, pub and skins are OK in the files, just look out for the mikrotik.php file, also any scripts or schedulers you did not add yourself. Go to IP > SOCK and disable if active. Go to Users and delete any user you did not add, make a new user in a different name other than "admin"...

flynno

Have you correct SFP modules for send and receive? normally blue and yellow bars on them

flynno

Have you tried disable the SIP in ip firewall service ports?

flynno

Hey Mistry7, have you any rules that I can use to prevent this from happening?

flynno

I think I fell victim to this attack yesterday, my clients had problems watching netflix and appeared to have two IP addresses. One IP was fake and one was the real IP address. Netflix reported the IP as using a proxy or VPN and denied the clients access. My main router was breached before because o...

flynno

Good morning Normis, I amended the Nat rules on the main router to /ip firewall nat add action=src-nat chain=srcnat out-interface=<Public> to-addresses=<Public_IP> on the clients cpe's I have chain=srcnat action=masquerade out-interface=pppoe-out1 log=no log-prefix="" unless they have a st...

flynno

Clients are showing they have two IP addresses instead of one on whatsmyip.net, one real IP and the other IP's are fake here is three IPs that showed up 66.249.81.232, 66.249.81.228, 66.249.81.234. They are not using VPN;s or proxies. I changed the IP of the main router for now and added firewall ru...

flynno

Hey guys,

I masquerade my clients out behind one IP and for some reason Netflix has banned that IP now.

error message
Whoops, something went wrong.Streaming error.You seem to be using an unblocker or proxy. Please turn off any of these services and try again.”

Anyone else having the same problem?

flynno

Ok not sure if it's a bug but when I check "add default route" it auto adds route with the office public IP into route list as dst.address x.x.x.x and as gateway x.x.x.x and is unreachable. I have to add static route 0.0.0.0/0 gateway l2tp-out1 which is reachable, now the vpn is working co...

flynno

The issue I'm having is that LTE device is using its own public IP instead of the public IP of the remote office when browsing the internet. When I visit whatsmyip.net when the vpn is active on the LTE device, the IP is not the IP of the remote office. 0.0.0.0/0 via L2TP gateway or 0.0.0.0/0 via 172...

flynno

The SPF port failed on my RB3011 today, it was working for about 6 months straight. The setup was SC fibre with opton 125G SM WDM31 S3D modules. The RB3011 was connected to a mikrotik powerbox by fibre, I had the sfp port bonded with an ether port but no Ethernet cable connected to that ether port. ...

flynno

see image

flynno

Strange thing happens when I try to use the add default route with the ppp dial out add default route. The office public ip is added to the ip routes but is unreachable. It adds a route Dst gateway x.x.x.x Gateway x.x.x.x which is unreachable so the public ip is been used as the dst address and the ...

flynno

Hi Bram, What kind of dns settings do you use? /ppp secret print Flags: X - disabled # NAME SERVICE CALLER-ID PASSWORD PROFILE REMOTE-ADDRESS LOCAL-ADDRESS ROUTES 0 test l2tp 1234 default 172.16.0.10 172.16.0.1 172.16.0.0/12 LTE reachable now via 172.16.0.10 LTE local network 192.168.1.0/24 Office r...

flynno

Office Router DNS /ip dns print servers: 172.16.0.1 dynamic-servers: 89.101.160.5,89.101.160.4 allow-remote-requests: yes max-udp-packet-size: 4096 query-server-timeout: 2s query-total-timeout: 10s max-concurrent-queries: 100 max-concurrent-tcp-sessions: 20 cache-size: 2048KiB cache-max-ttl: 1w cach...

flynno

LTE Device Office Public IP = X.X.X.X /interface ethernet set [ find default-name=ether1 ] arp=proxy-arp /ip neighbor discovery set lte1 discover=no /interface list add name=discover add name=mactel add name=mac-winbox /interface wireless security-profiles set [ find default=yes ] supplicant-identit...

flynno

Still no luck with the nat rules. When I enable mangle on the LTE device for the private network, I cannot access websites but I can see dns requests populating on the office router

flynno

Hi Chris,

Remote office router nat

/firewall filter nat
srcnat scr address 172.168.1.0/24 action masquerade

New below;

I modified pool to 172.16.0.0/12

/firewall filter nat
srcnat scr address 172.16.0.0/12 action masquerade

flynno

I can reach all devices on the remote office network. I want the LTE device to have its public IP address cloaked as the office network public IP and use the office router as the main gateway for all internet traffic

flynno

I can see the dns populating in the remote office router cache but the websites won't load, I have remote requests turned on for both routers, and the dns on the LTE is 172.168.1.1 which is the private ip of the remote office router

flynno

Hi Bram,

LTE Device Route
/ip route
add distance=1 dst-address=0.0.0.0/0 gateway=172.168.1.1 reachable l2tp-out1 routing-mark= PPTP

172.168.1.1 is the address of remote office mikrotik device, it's the private address of the device

flynno

Is it possible to do this, I must be missing something

flynno

Have you created a loopback bridge with a /32 IP address on it and add the IP address to the PIM RP
On the PIM interfaces you can change the interface IGMP version to the version you need.

flynno

I can winbox into both routers from each end, Remote office side and LTE side.
When I enable the mangle rule on the LTE device the only thing that I cant do is browse a website or ping 8.8.8.8 from the lan PC
Winbox still works from each side

flynno

Have you tried another power supply?

flynno

I bought two of these units, they are now in a landfill

flynno

Turn on multicast helper on the wireless of the hap device, that should fix it

flynno

I can see the traffic going out the L2TP gateway with torch, when the mangle rule is enabled on the LTE device.
On the remote office router dns cache I can see the LTE devices requests in the cache.

Anyone have any input as to how I can get this working?

flynno

I setup a L2TP VPN on a mikrotik LTE device to access my office router Lan. The tunnel is established and I can ping both sides of the tunnel and reach the office router via the LTE device. I want to be able to use the office connection as the main internet connect for the mikrotik LTE device, send ...

flynno

I think you need to check setting poe in long cable, turn it on if it's off

flynno

Hotspot server profiles

Login via Mac, Cookie, Mac Cookie are these ticked?

flynno

Hey guys, I'm having difficulty setting up a VPN between two mikrotik routers. /ip firewall address-list add address=192.168.88.10 list=OutVpn /ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=VpnRoute passthrough=yes src-address-list=OutVpn log=no log-prefix=""...

flynno

Has anyone developed any kind of handheld tool to meter align up CPE's? This could be something similar to a Satellite Meter or CCTV Meter with an LCD touch screen, with Android OS with the Tik App / other network tools, speedtest etc.. running on it. If a company hires staff to do installs, maybe c...

flynno

I supposed im just happy to have it working, would it take much extra configuration to have internet aswel?

flynno

Sindy, I disabled all configuration to do with pppoe-out2. Current Setup IP Route 0.0.0.0/0 pppoe-out1 Gateway Distance 1 Gateway pppoe-out1 for below Rules dst-address=a.a.a.a-IPSEC-Gateway/32 action=lookup-only-in-table table=via-wan-2 dst-address=b.b.b.b-Webserver/32 action=lookup-only-in-table t...

flynno

That's done but still same results with command

/put [resolve the-name-of-b.b.b.b-server]
failure: dns server failure

Id say all solution's must be exhausted by now

flynno

Mikrotik version 6.42.6 (stable) When I enable the pppoe-out1 and run command /put [resolve cloud.mikrotik.com] failure: dns name does not exist When I disable the pppoe-out1, VPN IPSEC PEER and all Policies /put [resolve cloud.mikrotik.com] 81.198.87.240 /put [resolve webserver.domain.com] b.b.b.b ...

flynno

/ip dns print servers: 8.8.8.8,8.8.4.4 dynamic-servers: allow-remote-requests: yes max-udp-packet-size: 4096 query-server-timeout: 2s query-total-timeout: 10s max-concurrent-queries: 100 max-concurrent-tcp-sessions: 20 cache-size: 2048KiB cache-max-ttl: 1w cache-used: 22KiB /ip settings print ip-for...

flynno

Ok Sindy,

When Peer is disabled and I run the three commands I get "failure: dns server failure" on both
/put [resolve cloud.mikrotik.com]
/put [resolve the-name-of-b.b.b.b-server]

Same results when the Peer is enabled and tunnel is established

flynno

z.z.z.z is Public IP 1 m.m.m.m is Public IP 2 b.b.b.b Webserver a.a.a.a IPSEC Gateway Results of /ip route print detail /ip route rule print /ip firewall nat print /ip ipsec policy print /ip route print detail Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o...

flynno

Have you tried adding trial to the hotspot profile on the mikrotik hotspot device, if you are using a custom login page you will have to add the trial code to a login but in the code of the page

flynno

Good morning Sindy :) Below are the results; z.z.z.z is Public IP 1 m.m.m.m is Public IP 2 b.b.b.b Webserver a.a.a.a IPSEC Gateway 0.0.0.0/0 pppoe-out1 Gateway Distance 2 0.0.0.0/0 pppoe-out2 Gateway Distance 1 Route to both are disabled in IP routes b.b.b.b Webserver a.a.a.a IPSEC Gateway Once Pref...

flynno

Still no joy with that change, thanks for your help today Sindy. I get "no phase 2" but the admin requested my static IP for his end to create the VPN, the m.m.m.m (of pppoe-out2) is showing up in the "Installed SAs" this couldn't be right as it would have to be the Public IP 1 f...

flynno

/ip route print detail /ip route rule print /ip firewall nat print /ip ipsec policy print /ip route print detail Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit 0 A S dst-address=0.0.0.0/0 gatewa...

flynno

z.z.z.z is Public IP 1 m.m.m.m is Public IP 2 b.b.b.b Webserver a.a.a.a IPSEC Gateway The nat rule was set to translate the 192.168.0.0/24 to Public IP 1 , which is static ip. add action=src-nat chain=srcnat comment="Public-Ip-1 Src-Nat" src-address=192.168.0.0/24 to-addresses=z.z.z.z The ...

flynno

The ip addresses are both static IP's

flynno

z.z.z.z is Public IP 1 m.m.m.m is Public IP 2 b.b.b.b Webserver a.a.a.a IPSEC Gateway[/b] /ip route rule print 0 dst-address=a.a.a.a/32 action=lookup-only-in-table table=via-wan-2 1 dst-address=b.b.b.b/32 action=lookup-only-in-table table=via-wan-2 /ip firewall nat print 0 ;;; Wan Src-Nat Public IP ...

flynno

I could try the two public addresses active route first and if that fails, I will try the calculate 32 subnet prefixes solution. if all fails then it's at there end

flynno

0 ;;; allow l2tp chain=input action=accept protocol=udp dst-port=1701 log=no log-prefix="" 1 ;;; allow pptp chain=input action=accept protocol=tcp dst-port=1723 log=no log-prefix="" 2 ;;; allow sstp chain=input action=accept protocol=tcp dst-port=443 log=no log-prefix=""...

flynno

z.z.z.z is Public IP 1 m.m.m.m is Public IP 2 b.b.b.b Webserver a.a.a.a IPSEC Gateway No default route for Public IP 2 Default route for Public IP 1 is 0.0.0.0/0 gateway pppoe-out1 /ip ipsec installed-sa from your z.z.z.z to their a.a.a.a to count packets and bytes but the one for the opposite dire...

flynno

Default Route 0.0.0.0/0 Gatway pppoe-out1 /interface pppoe-client add disabled=no interface=wlan2 keepalive-timeout=60 name=pppoe-out1 use-peer-dns=yes user=*******1 add disabled=no interface=wlan2 name=pppoe-out2 user=*******2 /ip firewall nat add action=src-nat chain=srcnat comment="Public-Ip...

flynno

IPSEC Gateway a.a.a.a Webserver b.b.b.b 0 ;;; VPN src-address=0.0.0.0/0 src-port=any dst-address=192.168.0.0/24 dst-port=any protocol=all action=none 1 ;;; VPN src-address=My-Public-IP/32 src-port=any dst-address=0.0.0.0/0 dst-port=any protocol=all action=none 2 A ;;; VPN src-address=0.0.0.0/0 src-...

flynno

Can anyone tell me where to get a kit to made MikroTik Cloud Router Switch CRS125-24G-1S-2HnD-IN rackable?

flynno

/ip ipsec policy print Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active, * - default 0 ;;; VPN src-address=0.0.0.0/0 src-port=any dst-address=192.168.0.0/24 dst-port=any protocol=all action=none 1 A ;;; VPN src-address=0.0.0.0/0 src-port=any dst-address=b.b.b.b/32 dst-port=any...

flynno

IPSEC Gateway a.a.a.a Webserver b.b.b.b /ip ipsec policy print Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active, * - default 0 ;;; VPN src-address=0.0.0.0/0 src-port=any dst-address= b.b.b.b dst-port=any protocol=all action=none 1 A ;;; VPN src-address=0.0.0.0/0 src-port=any ...

flynno

I have an IP address that is for the VPN use only and not to browse the internet. The IPSEC VPN is used to access the remote webserver login portal page securely, not to browse the internet under the VPN. But when I use the IP of the webserver it will show that I can reach webserver and I can ping i...

flynno

You are correct, you need higher power supply

flynno

So to recap: With tunnel down, you can access web pages by name and ping the servers by name, except the server for which you needed the IPsec, yes With tunnel up, you can access web pages and ping the servers by address, including the server for which you needed the IPsec, yes/no? no, I cannot acce...

flynno

It might be possible to do with the ether1-poe-in-long-cable, but I dont think you can power a device out ether1, think only 2-5 ports
Good idea about the media convertor, I never taught of that before

flynno

Hi Sindy, I am able to ping the webserver domain name and it translated the domain to the IP address. The dns server settings are auto giving to my via PPPoE on the mikrotik and I have remote requests on with the router IP 192.168.0.1 added to the dns list. If I turn off PPPoE "Use Peer DNS&quo...

flynno

Hi Sindy, Thank you for your very helpful detailed reply, I added /ip ipsec policy add place-before=0 action=none src-address=0.0.0.0/0 dst-address=192.168.0.0/24 place-before=0 I can now open up webserver in browser with the IP of the webserver, but when I try to go to the actually webserver domain...

flynno

Hey Sindy,

/ip firewall nat print
0 ;;; Wan Src-Nat
chain=srcnat action=src-nat to-addresses=my-public-ip src-address=192.168.0.0/24 log=no log-prefix=""

flynno

Hey guys, I'm currently having major issues setting up an IPSEC vpn to remote Fortigate router. My setup SXT Lite5 ac cpe running pppoe on wlan for internet Lan is on ether1 with dhcp 192.168.0.0/24 IPSEC Configuration SRC. Address 0.0.0.0/0 DST. Address 0.0.0.0/0 SA SRC. Address my-public-ip SA DST...

flynno

Anyone have any experience with solving this problem, the remote ends equipment used is Fortigate.

Is Mikrotik compatible with Fortigate?

flynno

Your printer is on a different network to your PC? Printer IP 10.31.10.10. PC IP 10.31.0.101
Why don't you just use the RB692 as a wifi-switch and let the CCR do the routing?

Remove IP address from Bridge and DHCP server with IP pool along with firewall rules.

flynno

Is it correct to have 0.0.0.0/0 in Src. Address and 0.0.0.0/0 in Dst. Address, looking at the wiki guides local private network address and remote private network should be used. I wasn't given a remote private network address to use and the tunnel wont establish unless 0.0.0.0/0 in Src. Address and...

flynno

change the bridge address, it should be 10.31.10.1/24 not 10.31.10.0/24

flynno

Router 2
/Ip route 0.0.0.0/0
10.31.0.1 gateway = router1

Try above and see if that sorts it

flynno

I managed L2TP/IPsec server, so there is not need in accept NAT rule. Just try to ping Tik IPsec gateway from remote server and then try to ping your PC behind Tik in LAN. Also you have to be sure that remote server have a static route to your LAN via ipsec gateway IP. Hi Anumrak, When IPSEC is ena...

flynno

Note: It is recommend that the IPSEC address is NATed to public IP addressing. My nat rules /ip firewall nat add chain=srcnat src-address=192.168.0.0/24 action=src-nat to-addresses=x.x.x.x out-interface=pppoe-out1 /ip firewall nat add chain=srcnat src-address=192.168.0.0/24 action=src-nat to-address...

flynno

When the IPSEC tunnel is established, I have no internet on PC that I am trying to ping from, so I cant actually ping anything I guess or even browse to the remote webserver.

When I disabled the IPSEC tunnel internet returns to normal.

flynno

The admin said everything is in order at there end and can see my pings hitting the webserver from the mikrotik router, but I cant ping from my PC or reach the webserver via browser. VPN requirements; Route Based VPN's are the standard VPN build i.e not Policy Based VPN's. VPN selectors should be 0....

flynno

Hi Anumrak,

Remote side admin told me that an extra firewall policy or route might be needed so traffic from PCs on the LAN can pass through the IPSEC

Thanks

flynno

Hey guys, I have been having trouble the past few days trying to setup an ipsec vpn to a remote location, somebody might be able to point me in the right direction. I can get the ipsec connection to establish on phase2 and can ping the remote server from the mikrotik device itself but not from my pc...

flynno

You need to open and forward the public port plex listens on, default port is 32400, it can be changed in the server settings on plex.

flynno

Hi Guys, I have a question regarding setting up a routed network using two SXTs and two Routers. Do I have to bridge both ether1 and wlan together or is there another way without bridging interfaces using IP routes? SXT1 Wireless bridge mode IP on Lan interface is 10.0.0.2/29 IP on Wlan interface is...

flynno

Ok to bypass the Nat rule on R1.
I added an accept rule above the nat on sfp1 with the client static IP

Nat rule below
action accept
chain srcnat
Src. Address add client static IP here

flynno

I enabled proxy arp on interface sfp1 on R1 and proxy arp on interface sfp1 on R2 Then on R2 in /ip arp menu, I added the static address I wanted to give to the client on interface sfp1 Then added the static route to PPP remote address and now the client gets a static IP The client is now reachable ...

flynno

Default routes used on both routers Note: Isp gateway is 100.0.0.169 R1 IP 100.0.0.170 sfp1 Default Gateway 0.0.0.0/0 Gateway 100.0.0.169 reachable sfp1 Dst address 100.0.0.168/29 sfp1 reachable Pref. Source 100.0.0.170 <<< R1 IP reachable via internet Dst. Address 10.0.0.0/21 <<< Network Address sf...

flynno

Maybe you should assign this address in ppp secret user profile as remote address? Hi Anumrak, Thank you for your reply, it was late last night when I wrote this post so I left out the stuff that I did try to solve this. I added the static IP to the ppp secret as remote address and in gives the sta...

flynno

Hello Guys, I require some help. I've received a /29 allocation of IPv4 addresses from my ISP. For sake of discussion, I will call this the 100.0.0.168/29 network. This IP space is divided as follows: 100.0.0.168/29: Subnet 100.0.0.170-174: Give out to customers 100.0.0.169: Gateway 8.8.8.8 DNS 8.8....

flynno

PPPoE termination on tower router would be the way to go imo

flynno

Is it possible to paste in the terminal of woobm, control+V is not working?

flynno

You need to install the UniFi controller software on your laptop / PC
see link
https://dl.ubnt.com/guides/UniFi/UniFi_ ... _V3_UG.pdf

flynno

Can you buy a static IP from your ISP or get them to open / forward ports you need open.

flynno

Create Hotspot user profile called 1hr

Hotspot user profile > Session Timeout > 01:00:00

Check "Add Mac Cookie"
Mac Cookie Timeout > 01:00:00

flynno

Is the master interface of the guest network set to the main in capsman see image

flynno

I had issues before with the router not picking up dns settings from ISP Check to see if the input fields are empty or contain DNS IP's Go to IP > DNS You should have DNS IP addresses in the dynamic input fields, maybe update the router to the lastest bugfix if the inputs are empty System > Packages...

flynno

Hotspot > Users

Select the User you want to limit to 1hr by double click they name

Go to "limits" tab

Select "Limit Uptime" and type in 01:00:00

flynno

Did you check your IP > Router List

guests route should look like

Dst. Address 10.10.20.1/24
Gateway guests reachable
Pref. Source 10.10.20.1

flynno

Sounds like some kind of OSPF setup maybe

flynno

IP > Addresses
10.10.10.1/24
10.10.20.1/24

Instead of 10.10.20.0/24 and 10.10.10.0/24

flynno

Try these rules

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN
add action=masquerade chain=srcnat out-interface=main
add action=masquerade chain=srcnat out-interface=guest

flynno

Try below rule

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN src-address=10.10.10.0/24

flynno

Hi boen_robot,

That worked like a charm, thank you!

flynno

Hi guys, Just wondering is it possible to use a form to increase the Hotspot http-cookie-lifetime via input field I am using below code but no joy with it. ===Form Code=== <form id="cookie" class="form-horizontal" action="cookie.php" method="post"> <input type...

flynno

If you put the web server IP address into the browser address bar on your device does it not bring you to the web-server? Are you looking to give your web-server an address like mywebserver.dns.com or something like that? if so you need to put the IP address into the STATIC DNS settings of the mikr...

flynno

Have you tried removing facebook login and see if that works?

flynno

If you put the web server IP address into the browser address bar on your device does it not bring you to the web-server? Are you looking to give your web-server an address like mywebserver.dns.com or something like that? if so you need to put the IP address into the STATIC DNS settings of the mikro...

flynno

You would want to get onto the "guy" and get login details for the router.

flynno

Hey guys, I need some advise on a new network design, I'm currently going with OSPF, MLPS/VPLS, and a PPPoE server on CCR router, Clients use PPPoE client to get IP address when connected to AP's and radius server to manage queues, bandwidth and accounts etc... I was told by an advisor that PPPoE is...

flynno

Printers are cheap these days, just buy another one

flynno

Connect the fibre to your core router then connect the switches to router with cable and connect the APs to your switch, bridge the Aps and get the same SSID for all of them In router run a pppoe server and make a account for client or you can other config that you like for your network My only iss...

flynno

Why not use 2 x QRT2 ?

flynno

How many customers does he have on the network?

flynno

I guess you could try using the new REP wireless package, an extend the signal from one room to another using 2 hAP lites, that way you will have wireless and ethernet in the desired room

flynno

Have you tried to use ethernet power plug, something like "Powerline (One Tenda PA202 + One Tenda P202) Wireless Power line Adapter Extender WiFi hotspot 200Mbps Ethernet Network Adaptor" this might be an option

flynno

Have you tried turning off "TKIP" on the wireless "Secruity Profiles"?

flynno

Great, thank you

flynno

/ip firewall nat
add action=masquerade chain=srcnat comment="bridge configuration" \
out-interface=bridge-local

flynno

Can you put the Gopro in AP Bridge?

Your ISP Router main DHCP
>
Repeater - RBMetal2SHPn
>
AP - Gopro Hero 3 black
>
Client - Android 6 phone

flynno

Ok that's great, looking forward to hearing your progress, remember to backup all your scripts when you have your network complete using the /export file and save on your comp

flynno

Ok glad you sorted it,

The Omnitik is used as an AP so no dhcp is needed

you can use the Quickset to config it, Wisp AP
Don't forget to "Set your country"

Bridge > Automatic
Address Source > Any

flynno

Here is a new script, I need you to reset your config on the RB951G without a default config System > Reset Configuration Tick "No Default Configuration" Press "Reset Configuration Button" When that is all done, winbox back into the RB951G New terminal and paste below script /int...

flynno

Ok I need you to reset your config on the RB951G without a default config System > Reset Configuration Tick "No Default Configuration" Press "Reset Configuration Button" When that is all done, winbox back into the RB951G New terminal and paste below script /interface bridge add a...

flynno

Ya looks to be a bit of a mess, I try clear it up for you

flynno

You are using the whole RB951G router as a hotspot, all ports bridged with wlan. Run the hotspot setup on bridge instead of the wlan. If you can post the RB951G config here, go to terminal /export file = hotspot Drag file from router to your desktop Open the file using notepad++ or sublime text edit...

flynno

What is the purpose of the Omnitik?

Is it to transmit the hotspot to surrounding areas or for private clients to connect without having to go through the hotspot?

flynno

try add your router ip address to the dns settings

flynno

Maybe the Metal 52 ac (RBMetalG52SHPacn) be the best option for you

flynno

Add a wirless router to the second GrooveA-52HPn

flynno

Why dont you try and see

Search found 257 matches