MikroTik

kevinds

actually it is not solved... clamp TCP MSS still not working... MRRU is not supported by my ISP so I add 2 forward rules (one for incoming traffic and another one for outgoing traffic) and clamp-to-pmtu manually. dunno what mechanism Mikrotik use for clamping TCP MSS at interfaces but it is not wor...

kevinds

$update url=http://feeds.dshield.org/block.txt description="DShield" delimiter=("\t") cidr=/24 $update url=http://www.spamhaus.org/drop/drop.txt description="Spamhaus DROP" delimiter=("\_") $update url=http://www.spamhaus.org/drop/edrop.txt description="...

kevinds

Alright, I made some tweaks to allow logins to the download servers, in case the IP list you want to download is password protected.. Variant #1: /ip firewall address-list :local update do={ :do { :local data ([:tool fetch url=$url user=$user password=$password output=user as-value]->"data"...

kevinds

Has this changed at all in the past 7 years?

~2000km to the closest training in English, in a different country. 3600 km to one in my country, but it is a language I don't know...

I just don't see the value of MTCNA being close the cost of the course, nevermind the cost to get there..

kevinds

Collecting ranges of IP addresses that are knocking at the door: https://forum.mikrotik.com/viewtopic.php?f=2&t=152953&p=758068&hilit=list+1+ddos#p758068 I do something very similar to the linked thread.. I have honey-pot IP addresses, anything that attempts to connect to them, gets the...

kevinds

My version: } ; :log warning "Imported address list < $blacklist> from file: $url" } else={:log warning "Address list: <$blacklist>, downloaded file to big: $url" } } on-error={:log warning "Address list <$blacklist> update failed"} Collecting ranges of IP addresses th...

kevinds

Thanks .... I just tested @Shumkov code and it works very nicely .... excellent work. Yeah, I have a couple honeypot IPs that when hit, adds the IP to a drop rule, then a script that runs that expands the /32 to a larger block.. I needed something similar to handle multiple IPs from the same larger...

kevinds

Do you mean this line: on-error={:log warning "Address list <$description> update failed"} ?

comment=$description timeout=1d} on-error={}

kevinds

This error occurs if the file is for some reason not available for download. The address list does not load SOMETIMES? Or always?

They don't load always.

kevinds

What is the recommended way to find out *why* an update failed? Address list <Spamhaus DROP> update failed Is great to see in the logs, but where do I look to try and figure out why it failed? Spamhaus DROP and EDROP are not over 63 kb, so that isn't the reason.. At the moment I am focusing on the I...

kevinds

you should also have internal ip and public ip / 29 ip. would it be better to set 2 nic on the machines? nic1 for lan and nic2 for public address? however I did as you report in the dstnat and srcnat rules however when I do #curl ifconfig.me from the machine I get the public ip of the non-class rou...

kevinds

I'd be curious what your VPN provider has to say - allowing a MRRU of 1600 would allow packets to be broken up at the PPP layer that otherwise couldn't be fragmented. This would assume you want to receive packets that have a total size of 1600 bytes. Based on a MTU / MRU for the interface of 1470 i...

kevinds

so for example:
server1.dns will have 86.yy.yy.10 + 192.168.1.10
server2. mail will have 86.yy.yy.11 + 192.168.1.11
etc

Wait..

Re-reading this...

Do you want your VM servers to have two IP addresses? Or just the 192.168.1.x IP?

kevinds

hei, so I would like to set on the router that the public address 82.xx.xx.xx / 24 does nat with LAN 10.29.22.0/24 and everything works here, the 3 servers connect to this network via eth1 and this is my lan manager. now in addition I have the class 86.yy.yy.yy / 29 (with routing on the 82.xx.xx.xx...

kevinds

Hello, yes I have set 2 nat (dst and scr) rules for addresses /29 plus there is the usual nat masquerade above these 2. I would like every VM to be seen with its address /29. So doesn't that nat sound good? Do you want the VMs to have addresses from the /29? Or do you want them to be seen with addr...

kevinds

Hello, Thanks for the reply. in practice I have to make a network like the one I attach. I set almost the minimum to try: in ether6 the wan with the address 82.xx.xx.xx / 24 in eth7 the lan1 with dhcp in the fpp the lan 2 with dhcp each address / 29 on the WAN. set dst and src for each address seem...

kevinds

By default (with no firewall rules).. Just set one of the /29 IP addresses on another interface (or the bridge interface) as the gateway IP for your other devices. IP - Routes Have the 0.0.0.0/0 destination the .1 IP of your ISP. Connect the other devices to the same interface (or any of the bridged...

kevinds

Yes I did the ping tests with DF. Also switching to the cable modem had no effect. But yes, it is possible that some websites have broken path MTU discovery. The issue was very noticeable with some SSL/TLS services, but when I found a HTTP server doing it too, I knew something else was going on. The...

kevinds

You mention DSL for Internet. Here in the states I still see the majority of them putting the MTU drop for PPP towards the customer. If that's the case you will want to set the interface MTU facing the DSL provider to 1492. This is fairly easy to test. Just turn off the VPN to go directly out to th...

kevinds

You must set the MRRU = 1600 for example on both sides - try it !

I think this is the answer. On the host that I can consistently re-create the issue on, it seems to have fixed it.

*offers digital beer*

kevinds

When i need some ppp based VPN i use multilink feature instead clamp mss ! You must set the MRRU = 1600 for example on both sides - try it ! Multi-link using both the Cable and DSL is an upcoming project. I only have control of my side though. VPN provider controls the service.. It is another Mikro...

kevinds

Searching MSS in this forum returned 45 pages of results, didn't find anything relevant that I hadn't already tried. I was running 6.42.12, upgraded to 6.43.14, and now stable, 6.44.2. My topology... I have two Mikrotik routers, a RB760iGS. Ether1 connects to my CCR1016-Ether1 through my managed swi...

kevinds

It will probably happen... eventually.

The mystical v7... lol

I'm thinking it would take very little work to add though

kevinds

So far RouterOS just takes IPv6 resolvers from "/ip dns" and sends them to clients. It works, but it bypasses DNS cache on router. When DHCPv6 is used, you can override DNS using DHCP option and set what you want (in a not very admin-friendly way, but at least it's possible). If you have ...

kevinds

https://wiki.mikrotik.com/wiki/Manual:Hurricane_Electric_Tunnel_Broker_Example_for_Home /ip dns set allow-remote-requests=yes servers=2001:4860:4860::8888,2001:4860:4860::4444 When using advertise-dns in IPv6-ND, does RouterOS distribute itself to the clients? Or the list set in IP-DNS? The allow-re...

kevinds

it is possible do using the passthrough option: https://wiki.mikrotik.com/wiki/Manual:Interface/LTE#Passthrough Why it is not possible when using RB951G with Huawei E3372 modem? Because the Huawei modems "suck".. I tried to get this to work originally with the E3372 USB modems too.. They ...

kevinds

Could this not be done with DNS?

Simple hosts file or on the DNS server?

kevinds

My script doesn't deal with deleting entries because I think that is a waste of router's resources. I suggested you set timeout on automatic list, so entries disapear on their own. You are free to see zero value in my approach, I had fun contemplating the solution. I never saw zero value.. :) I did...

kevinds

So, just to confirm,: 1. The MikroTIk Cloud Core router is connected to ether1 of the Cisco and assigned IP 145.45.45.2. 2. The server is connected to ether2 of the Cisco and assigned IP 145.45.45.3. 3. acmetube.com points to 145.45.45.3 When users (connected to the cloud core via LAN) access acmet...

kevinds

I'm not sure how fast hashing methods in RouterOS are, never benchmarked it. My initial idea is to have less entries in the list and (in theory) faster rule processing, because my assumption is, as you stated: less address list entries > faster firewall. Using this method you will only have a netwo...

kevinds

But then again, the article is two years old and back then, not everybody used free SSL certificates from LetsEncrypt ... therefore probability of filtering some traffice was slightly higher than nowadays.

Comments were from last week though

kevinds

I expanded a bit on your idea. - Script takes addresses in your dynamic list - Converts it to clean /24 network address and adds whole statement to new blacklist :foreach addr in=[/ip firewall address-list find list=dynamic_list address~"^[0-9\\.]*\$"] do={ :local ipAddr [/ip firewall add...

kevinds

Not possible unless you own all the client devices and install MITM root certs. That is what I thought too, but this site claims otherwise.. I haven't tested their claims though. https://www.timigate.com/2016/01/stop-downloads-and-punish-offenders.html Layer7 filter only works if Layer7 is not encr...

kevinds

Not possible unless you own all the client devices and install MITM root certs.

That is what I thought too, but this site claims otherwise.. I haven't tested their claims though.

https://www.timigate.com/2016/01/stop-d ... nders.html

kevinds

4. Should I just connect the server to a LAN port on the Mikrotik, then point acmetube.com to 145.45.45.2 and forward incoming port 80 to the Server? There are still a number of ways to configure it.. But if you are putting the server on the LAN and port-forwarding to the LAN IP.. Be aware you will...

kevinds

I read here https://wiki.mikrotik.com/wiki/Manual:Hotspot_HTTPS_example that Note: Browser will still warn end-user about redirection even with CA signed certificate! This warning message cannot be avoided . Can someone kindly explain if this is the true case. Even with CA signed Certificates? Mayb...

kevinds

Yes, you do... as the link I gave shows, the on-error is just a part of a larger scheme. You take just a part of the script which you expect might fail, and for that part you specify the on-error handling. So it is :do {some script} on-error={some error handling} And you have to bear in mind that i...

kevinds

The correct use of on-error is rather peculiar (although logical, you want the on-error to be targeted to a specific part of the script) so maybe the issue is only that. I would first do my best to make the on-error work because a check whether the result of the /32 to /24 address conversion exists...

kevinds

Is this a homework question? The ISR4431 has a throughput rating of 500 to 1000 mbps.. Connect it to the 'core Mikrotik' to use the 1/10 gbps ports and higher routing capabilities of the Mikrotik. Otherwise it doesn't matter where it is connected. The traffic won't use the internet connection. Throw...

kevinds

Thank you again. This has helped a lot. I am running that line/command every 5 seconds.. It gets stuck though if in that time my system adds two IPs from the /24.. When it tries to add the second... It is getting 'Already exists' and then stops. I tried adding onerror {} to the end but I think it is...

kevinds

Well, ($ipAddress&$cidrMask) suggests that the actual expression would be like (4.3.2.1&255.255.255.0) which yields 4.3.2.0, but what I had in mind was that you have to place 4.3.2.0 /24 to the address-list as e.g. within a /21 network, 4.3.2.0 is not an address of a network but an ordinary...

kevinds

No hope here, you'll have to schedule the script. Just don't forget to add the /x after setting the tail of the address to 0s by bitwise anding it with the mask. That is what this part was for.. :put ($Address&$CIDRnetmask); It should be the approperate /24. As for how to make this flow into a ...

kevinds

Dear sindy, the routerboard RBM11G and RBM33G are not mentioned in that list. What it means? This routerboard doesn't require usb power reset? See if the option is there.. Many mPCIe modems are connected via USB too. I haven't found any that are not. My laptop has a mPCIe WWAN port, only the USB an...

kevinds

I think I need to do this with a script? Run a script that does this every 5 seconds or so? Get the "Drop-IP-List" print where list="Drop-IP-List" For each address in the list, :local Address :local CIDRnetmask 255.255.255.0; :put ($Address&$CIDRnetmask); add list=Drop-These-...

kevinds

Alright.. I have a Raw rule using the 'add src to address list' action. I want to add the /24 of an IP that meets the rule, not just the single /32 Is there a way to do this? If there are multiple ways, what is the best way? add action=add-src-to-address-list address-list=Drop-IP-List address-list-t...

kevinds

Your LTE IP isn't a public IP.. It is NAT'd. It is sending the correct IP to the DDNS server. I will broadly say, and I believe this is the case world-wide, unless you are paying extra for a public IP, using LTE you will not get a public IP. The way your LTE service works, you will not be able to co...

kevinds

My bad Kevinds, I didnt realize it was not a real VPN LOL. The kind where you control both ends of the stick. Relying on a "retail" operation from another source may not be the best approach as you have no control over how they manipulate their infrastructure on a day to day basis. I am a...

kevinds

@kevinds, can you post the result of /ip route print detail taken while the L2TP tunnel is up, of course after sanitizing it? I suspect that the system chooses from several routes with equal distance in a round-robin fashion so it sometimes works and sometimes doesn't. ip route print detail [kevind...

kevinds

What kind of VPN are you using. Try EOIP with security enabled and see if that owrks......... L2TP.. It is in my config above.. It is set by my VPN provider, they provide my static IPs, EoIP with security enabled? IPSec? But to see if what works? I want to understand why/how it is working now.. I t...

kevinds

Well as I found out its not called anavOS or kevindsOS its RouterOS and it has rules LOL. Of course it has rules, but it would be a lot easier if I knew what these rules were and why they only seem to be followed sometimes and not others. I still can not figure out why I can establish connections t...

kevinds

I don't know the purpose of the VPN tunnel, but if it is not intended to replace the default gateway whenever it comes up, either tell it not to add its own default route at all or at least tell it to add it with distance parameter value higher than the one provided by the ether1 dhcp-client's defa...

kevinds

I don't know the purpose of the VPN tunnel, but if it is not intended to replace the default gateway whenever it comes up, either tell it not to add its own default route at all or at least tell it to add it with distance parameter value higher than the one provided by the ether1 dhcp-client's defa...

kevinds

As the VPN server does not assign the public IP to the Mikrotik end of the tunnel (as some other VPN servers do) but instead assigns a private IP to it an performs a src-nat to its own public address before routing the packet to the internet, it doesn't matter what the Mikrotik sets as source addre...

kevinds

Working on both routers Edit: It isn't working on the edge router DDNS server received request from IP 209.205.90.194 but your local IP was 172.16.3.23; DDNS service might not work 172.16.3.23 is the dynamic IP from the L2TP connection, 209.205.90.194 is the VPN server If I turn on the src-nat rule...

kevinds

I think I solved it with your src-nat suggestion, not needing another route at all.. I made an address list with the three RFC1918 ranges, Added a mangle rule to mark connections new connections not from the RFC1918 list Added a src-nat rule at the top for the marked connections with a src-nat actio...

kevinds

But how exactly do you test what is the source address of the packets as they leave your 'Tik? Mikrotik's Cloud DDNS was an easy way on my edge router, after trying to figure out why some traffic was blocked and other's wasn't (VPN server's public IP frequently gets blacklisted) Well, I'm afraid th...

kevinds

The traffic the router generates itself goes through the output chain, the traffic which the router forwards goes through the forward chain. So a marking rule in chain=output only marks the traffic generated by the router itself, and a marking rule in chain=forward only marks the transit traffic. S...

kevinds

Primary Router 2011UiAS # model = 2011UiAS /interface ethernet set [ find default-name=ether1 ] set [ find default-name=ether2 ] set [ find default-name=ether3 ] set [ find default-name=ether4 ] set [ find default-name=ether5 ] set [ find default-name=ether6 ] set [ find default-name=ether7 ] set [ ...

kevinds

Post your config Kevinds, otherwise playing hide and seek is no fun with bits of information.

I will be posting both routers' configuration today.

Literally doing the redactions now.

kevinds

Each route has a parameter pref-src whose value specifies the local IP address of the router which should be used for locally originated packets sent down that route. I was looking at that with the mangle suggestion.. Added a routing mark on the Output chain, setup a 0.0.0.0/0 route to the gateway ...

kevinds

You can try and add a mangle rule, with chain as output, connection state as new and action as mark routing = NFR (New From Router) Add a default route with routing mark NFR to specified gateway IP The problem is that this still doesn't set the IP used on the outgoing connection, just the gateway.....

kevinds

What I am saying is traffic from the router will use same routes available to it as per what is in the routing table, same as traffic flowing through it, i.e. Forward. Can you provide the route, nat and mangle rules to see where your problem can be. Yes.. Which is what I expect, it is going to use ...

kevinds

As per the routing table Huh? Can you be a little more specific? Any hints? My 0.0.0.0/0 route works for forwarding traffic, but RouterOS uses the wrong IP for it's own traffic, still going out the 0.0.0.0/8 route. My edge RouterOS, I need it to use a different 0.0.0.0/0 route than the forwarded tr...

kevinds

Yeah, probably not clear from the title.. My Mikrotik routers have multiple IP addresses on different interfaces.. How do I specify which IP is used for outgoing traffic for the router itself? For 'fetch' I can use src-address= but how do I set a default for all of the router's traffic.. 'Cloud Serv...

kevinds

Hello Guys, I just joined Mikrotic forum. I have two mikrotic routers using desktop version. According to this thread,there is virtualization for Mikrotic os. This is very good.I have Esxi 6.0. How do i get the right virtual image for mikrotic os so that i can install it on ESXI 6.0 host. Hope to r...

kevinds

So something like this... http://au.rs-online.com/web/p/interface-development-kits/0537420/ Honestly, I have no idea if that would work or not.. I suppose it would depend on how it presents to the USB controller. But USB connection at both ends, but operating at TTL levels? Why would it matter what...

kevinds

How would you connect PC(usb) to Mikrotik(usb) to have console? What type of cable? It's like two usb-serial cables back to back.

Exactly.. Need to use a Null-Modem (F-F) serial cable. Same as if you were connecting two Mikrotik routers with serial ports together.

kevinds

For those who are running small data centers the MT is the best option. However, You can try Vmware as that is the fastest known virtual environment or KVM as that is part of RouterOS But which hypervisor is best? I need to share the NIC with the host as a bridge, running on a Xeon 3460.. Trying wi...

kevinds

USB-Serial adapter I can make work.. lol Might require a few devices to achieve remote access, but doable.. USB-Serial adapter and a second router with a COM port.. Or a USB-Serial adapter, Serial-Ethernet adapter, and than a second remote router.. Turning off the console of the working one to manag...

kevinds

It is https://wiki.mikrotik.com/wiki/Supported_Hardware#USB_serial_adapters Warning: Page no longer maintained. Please use the new Peripherals page for supported devices This page only kept for archival purposes! https://wiki.mikrotik.com/wiki/Manual:Peripherals Not listed on the supported devices ...

kevinds

yes, RouterOS has supported USB-Serial adapters for quite some time.

I am seriously asking...

Why isn't this documented anywhere?

kevinds

I have the RB411U connected to the router by serial cable. I can ssh to the RB411 which has a 3G card in it (as long as it's connected and working) and use that to connect to the router. I can use EoIP to do a netinstall from my laptop remotely. Yesterday I did this when a customer's CRS109 switch ...

kevinds

That sounds pretty handy. Would be awesome if there were 4G and Ethernet versions. I'm using some RB411U's with 3G cards in them to give me console access to routers that are >400km away (and I just used it to do a recovery this afternoon). Once I add in the mobile broadband card, case and antennas...

kevinds

Seeing the Woobm-USB added to a few online retailers, still with zero stock or coming soon.. My question is, what are they capable of? ESP8266EX CPU says maximum flash is 16MB so this should be enough.. Even 8MB should be sufficient.. My primary question is what all is it capable of and how will it ...

kevinds

So, the problem with your switch - it wants POE-up your router even when that doesn't wants it and he's so stubborn that he doesn't even listen your commands. :D Please don't shout to your router, it works fine. It just can't accept so much power, say thanks to mikrotik engineers - they implemented...

kevinds

Hello everybody. I came here cause i need some information to make my home network some securer. Now i use a FritzBox to connect to internet and I'm bound to that one cause of Provider. I connected an USB Harddisk as NAS on the FritzBox. But there are more and more devices coming on the network, li...

kevinds

Hi All, In the last two weeks there has been three RB2011 series routers running ROS 6.35.2 dead. The symptoms: 1. If you plug a living ethernet cable to ports 1-5, the LED of port is flashing 2. The ports 6-10 are totally silent 3. The display is lighting fully white. 4. There is no beeps from the...

kevinds

It wont help, he still need to buy battery, charger and solar panel.

Unless I am mistaken, you are incorrect..

The mUPS takes care of that. Just need to add a battery. A charge controller is part of it, solar panel completely un-needed

kevinds

+1 for a revision that has a small splice tray inside it.

My desire for a revsion is to allow both types of PoE without needing the cross-over cable.

kevinds

Can anyone answer these doubts? Can we use S-RJ01 (RJ45 SFP 10/100/1000M copper module ) at the SFP port of RB/FTC11? In the Spects you put "Works only with Gigabit SFP connections." The ethernet port can work at 10/100/1000Mbps or only 1000Mbps? Thanks a lot, Sorry, I have to ask.... Why...

kevinds

My guess was that the switch was creating a different ground level than the router, or something along these lines... Not sure how to confirm this though. The 30 second delay has me scratching my head though.. It is bugging me the most. It isn't supplying power (other devices don't get powered by th...

kevinds

So, seems you have a problem with incompatibility of active and passive POE. May you check the voltage at this point:1.jpg when you connect ether1 to your switch? If it exceeds 24 Volts, your router will not work. You may try to desolder diode rectifiers (D4, D6) and check if problem persists, but ...

kevinds

What's the ROS version and System > Routerboard firmware versions?.

Factory Firmware: 3.10
Current Firmware: 3.41
Upgrade Firmware: 3.41

ROS 6.40.2

kevinds

Set the internet router LAN ip for watch address and check if supout is generated after such 30s connectivity loss.

So itself? Or the next router towards the internet?

kevinds

I'd try to generate a supout on those 30 sec (or enable System > Watchdog auto supout generation, check supout date to confirm is created) and email support. Automatic Supout was already checked. There were no files being created. I have now checked 'Watchdog Timer' 'Watch Address' is still blank. ...

kevinds

Yes, and that is why I am trying to promptly answer every question that is asked, I am not sure what information is needed. With the exception of when I need to take it apart, I can only do that in the late evening here. I indicated in my second post that port 1 was connected at 1 gbps, to another d...

kevinds

I am using normal/standard unshielded Cat6 cables. The Enterasys provides 802.3af/at power. I disabled it on the ports being used because I thought it might be an issue. As I discovered, even though the router is still powered on, I lose connection to it during those 30 seconds. I will try the Watch...

kevinds

My ISP modem is connected to ether1 right now, it has a 1 gbps link. No issues with gigabit..

If I connect ether1 to my switch it turns off ~30 seconds later..

Edit: I was wrong, it does continue to respond.

kevinds

For an update.. I tried adding the RBGPOE, thought if it is a power issue, this might separate (additional diodes?) the power from being passed along.. Unfortunately it had no effect what so ever. I did notice today that the hosts lose connection with the RB2011, even before it turns off. Any ideas ...

kevinds

If you connect your router's ether1 port to gigabit device and it fails, but if you connect this router to 100Mbit device and it's working, it may be hardware failure. Check diode rectifiers (marked green) and especially check diode (marked red), if it fails, all power from your DC connector flows ...

kevinds

If you connect your router's ether1 port to gigabit device and it fails, but if you connect this router to 100Mbit device and it's working, it may be hardware failure. Check diode rectifiers (marked green) and especially check diode (marked red), if it fails, all power from your DC connector flows ...

kevinds

Howdy, Yes, I searched, and then searched again, and again... I have not used ether1 on my router in the past, used it for PoE in my previous router (changed from a desktop model to rack-mount), but have not it used as an interface.. I need to now.. I am using the power plug on the back right now as...

kevinds

Argh!! Since making this change, every time an IP changes on the router, drops, reconnects, whatever, the router stops responding for ~10 seconds. ARP -a now shows the bridge MAC rather than the interface MAC.. I see this at my uncle's place too, but I just ignore it because it is pretty much set an...

kevinds

You should not use proxy-arp unless you exactly know what it does and why you would need it for your situation. Set ARP to "enabled". When this causes connectivity problems, look at the configuration of your DHCP service. It should provide the default gateway to your DHCP clients. It is h...

kevinds

Alright, may have this solved.. The physical interface ARP setting was not changed, still set as Enabled. I changed the bridge from proxy-arp to local-proxy-arp. As far as I could tell, there isn't a RouterOS manual page for the local-proxy-arp setting.. If I was to guess, RouterOS is not answering ...

kevinds

Maybe the router has the arp reply only setting on lan interface and makes answers only to those mac addresses that were given an ip by its dhcp server... But maybe not, if it responds to one network range only. Firewall rule, probably. Huh? A firewall rule might be causing it? Or a firewall rule m...

kevinds

Howdy, I think the title is accurate... If I plug a new device into my LAN that is not on the same /24 that I need to configure, I will assign a static IP to my workstation to match the device's default IP. In this case I am using a HPE 1810G-8 switch. My LAN uses 192.168.45.0/24, my RB2011 is assig...

kevinds

Interesting. Would you mind sharing relevant parts of config? Just to make sure that it's not the same (or similar) way as I described in my first post? I tried some tests with latest RC and I see no signs of IPv6 handled directly by RouterOS OpenVPN. But yes, it is 'Ethernet' mode.. So.. Possible ...

kevinds

Interesting. Would you mind sharing relevant parts of config? Just to make sure that it's not the same (or similar) way as I described in my first post? I tried some tests with latest RC and I see no signs of IPv6 handled directly by RouterOS OpenVPN. I shall try.. Tags with forum software is a wea...

kevinds

PPP profiles are used for all VPN types. They do have IPv6 options, but so far those don't do anything for OpenVPN. Mine, RouterOS (server) to CentOS (client) is giving my CentOS VPS IPv6... I'm still trying to figure out how to 'push' certain parameters to the client, but no issue with IPv6 over O...

kevinds

RouterOS does not have any direct support for IPv6 in OpenVPN. But if you run it in ethernet mode, it can transport anything, including IPv6. Really? I am looking at this right now actually.. Trying to give an OpenVPN client (Mikrotik as server) a static IPv4 and IPv6 address.. In the Profile setup...

kevinds

Sorry

Netinstall not Netboot as I said above.

But yes, I am trying to use NetInstall but using ETH6 instead of ETH1..

kevinds

Howdy, Is there any way other than Netboot to install the RouterOS (or other) firmware on a RB2011? From my testing, I think the AR8327 has failed. Ether1 during the bootp phase does not activate.. ETH1 through ETH5 is the same. ETH6-ETH10 do come up, but they will not try bootp. I tried using the l...

kevinds

Howdy, I haven't read this entire thread, I did the first couple and and the last couple pages though. Is V1.0.3 (2014-06-24) the latest version? Is this software posted anywhere else? Looking for a quick place to check for updates. Readme was void of this information. Is it possible to configure ...

kevinds

Have you setup any type of connection tracking, so that traffic that came in on the PPPoE-Out1 conneciton, also leaves through it, and the responce traffic isn't trying to go out your WAN1 conneciton?

kevinds

Trying to figure out how to setup IPSEC for going between networks on Mikrotik routers, not using a tunnel. I am not trying to LAN-LAN connect sites.. Trying to do this with public IP addresses. IPv6 specifically.. I have IPv6 /64 and /48 networks at all my sites, so looking to encrypt the traffic...

kevinds

The only issue is at that point many customers become triple natted, once by the 1 to 1 nat, second from their subscriber module, and a third at their wireless router which most people have these days. Not exactly.. If you are setting up 1:1 NAT, on your edge router you take public IP 26.45.234.65...

kevinds

Alright... For my PoE issue, it says this on th product page.. "802.3af/at support (with unshielded cross cable)" It means a crossover cable.. Not a cross connect cable.. I should have realized this much sooner but oh well.. When was the last time anybody needed a crossover cable for anyth...

kevinds

Howdy, Just received an order of a handful of these RBFTC11 units, have opened the first one Couple issues, a) PoE.. Connecting to my 802.3af/at switch, does not power up. Tried different cables and different ports, including unplugging my desk phone and using that cable. Thought it might be a softw...

kevinds

Turning off 'Dial on demand' will cause it to always dial, but I don't think it gets around this issue?

Wonder if this is the root cause of my issue with MLPPP not recovering from any of the lines going down..

I am using the same model, and I believe the same firmware version.

kevinds

I'm having the issue of a circuit failing, and the connection goes idle. Doesn't matter how long I leave it, until I disable and re-enable the PPPoE interface, it stays idle. If I change the interfaces from two, using Ether8 and Ether9, if I add Ether10, Apply, and then connect a third modem, it con...

kevinds

Thank you, I shall experiment with this. I only have one Mikrotik router and four locations I am trying to connect together, I am thinking Star topology this time, since I am making a major change anyway (last time I set this up, it was Fully-Connected). > Not that this relates to the problem But ne...

kevinds

I think you can, I do it with PPTP and SSTP vpns. OpenVPN is conceptually the same. This article is everything on how to connect one to the other to make a client-to-gateway VPN, are you able to get this part working? http://wiki.mikrotik.com/wiki/OpenVPN IPSec is a better choice for site-to-site V...

kevinds

Tried a MetaRouter?

kevinds

I have read and re-read everything I can search on Google, this is the only relevant thing I can find on the subject, but it is exactly what I want to do.. :) http://forum.mikrotik.com/viewtopic.php?t=72626 Is it possible to use OpenVPN for a Site-to-Site VPN configuration? Everything I click and ty...

kevinds

Did your ISP give you a /29? .208/29? Or did they give you 5 static IPs, and they control the gateway? .209?

kevinds

Well, that is simple then.

Thank you very much.

Hopefully this can help somebody else searching for it

kevinds

This may be a noob question, but I have been searching off and on for two days now. I picked up a used RB2011UAS-2HND-IN unit, but needing to power it. I understand that ideally the 18POW power supply model would be the best choice. But what is the difference between RBGPOE and the RBPOE injectors? ...

Search found 118 matches