MikroTik

craigreilly

So it won't actually work?
Or should I try the link?

And how do folks normally have a backup ready?

craigreilly

I tried for about an hour last night to get a backup CCR running - for those "just in case" times. Same make and model as the first one. I loaded the backup file on the second router - but SSTP VPN users could not connect. Can anyone lay out specific steps to do this properly? I do not wan...

craigreilly

It's been solid. All I did was prioritize all of the Zoom IP's using an Address List.

craigreilly

Anyone have a script or console commands that you have used to ensure Zoom is working as best as possible in your network? We are hosting/moderating up to 15 meetings at a time for our customers, with all content coming from laptops here - and want to ensure our Mangle rules and others are set prope...

craigreilly

viewtopic.php?f=13&t=149603&p=738962#p738500 is the way to go...

Or - protect the server by using NAT and only allow the ports that should be passed thru (ie: 80)

craigreilly

I like this idea - perhaps could be set in the User Setup.
This way those techs "don't forget"... but Admin can select it if need be.

"anyway is it possible to have safe mode enable by default? some of our tech had always forget to enable it before work on it."

craigreilly

On remote end, have you looked at whatsmyip to ensure they are not using VPN as Internet Access?

craigreilly

How about this:

/ip firewall filter
add action=drop chain=forward comment="Drop new connections from internet which are not dst-natted" connection-nat-state=!dstnat connection-state=new in-interface=WAN

craigreilly

Phone Server...
Web Server that feeds data from our Oracle Server...
-- client connections to check our live inventory

And yep - thats it.

So - I have these in NAT rules - but I should put in Filter Rules as well?
Sorry - I did not configure this initially and not well versed in Mikrotik.

craigreilly

I have Web Proxy enabled. src address is simply :: (as defaulted) I have a NAT rule to redirect outbound 80 to 8080 for transparent. When I goto a device not on the network and open browser address <external ip>:8080 it opens a proxy page saying error. Is adding a filter rule the proper way here? Or...

craigreilly

change the username too...

craigreilly

So I shouldn't use those 6 lines of code?
Perhaps I should hire someone.

craigreilly

"At this point, I can surf the webs and whatsmyip shows the new ISP IP Address" So the outbound mark is working as intended... So When I mark the traffic coming from ISP2 - it only works on ISP2. So, for example 70.1.1.1 (ISP1) inbound goes to port 80 to server 192.168.3.20 When I add the...

craigreilly

We are transitioning to a new ISP. I want to setup the second ISP while the first is still in place - until we can test everything, and get DNS resolution using the new host names. So far: 1-Added IP Addresses of new ISP and selected interface of ISP2 2-Created a Mangle prerouting for Routing Mark f...

craigreilly

Using a Meraki VPN Concentrator. It is within my network using the same LAN port. It is working as far as connecting to it. It dishes out 192.168.7.0/24 addresses. My network is on 192.168.2.0/23. What information do I need to put into the router so users on the VPN 192.168.7.0 can access the resour...

craigreilly

Are you saying this setup should work for multiple road warriors behind the same NAT using a mix of Windows/Apple devices?
Currently we have ipSec disabled to accomodate our Mac users to overcome this issue on the Mikrotik.

craigreilly

so after more support from Acronis - we determined that the Windows 10 Anniversary yupdate which we just deployed on 1 machine and created new master image - did not use a network driver in the Snap Deploy Server library. So, I had to create a WinPE image for the machine to use. I am not back to 90m...

craigreilly

So since all devices are on the same subnet 10.0.1.0/24 then I'm fine. Mikrotik doesn't block Multicast internally.
Tried different routers, switches, host computer.
Nothing I do gets this back to 90mb when deploying multiple devices.
Argh!

Thanks for your response.

craigreilly

I have a small network consists of a Windows 7 Pro machine as a Acronis Snap Deploy Host and I connect up to 4 laptops to deploy images to. Recently speed went from 90mb on 4 machines to 11mb when imaging. I am not using any other swithches. Just an RB2011. Acronis is telling me I need to enable Mul...

craigreilly

How do I go about setting up L2TP with ipSEC now that we can have multiple peers behind same NAT.
√ I see it is via CLI only. I really need to get this going since Apple dropped support for PPTP.

craigreilly

So I see in 6.38 rc29 that "ipsec - added support unique policy generation which will allow multiple peers behind same NAT (cli only)"
So it seems ipSEC will not work properly - but must be configured from CLI?

Any info on this?

craigreilly

I can confirm I can not use iPhone to tether for connections to L2TP with ipSEC.
Once I turned off ipSEC on the client - the tether connection allowed the VPN.

I can not say wether or not iOS 10 VPN has issues with L2TP with ipSEC or not.

Apple is aware of the first issue and working on it.

craigreilly

For those of you having issues connecting to local network - The interfaces must be set to Proxy-ARP on the LAN Side. Also - there does seem to be an issue with PPTP and L2TP/ipSEC when using the iPhone to tether. Yes - Apple pulled PPTP from supported VPN's - but that does not mean you should not b...

craigreilly

Hi Jan89 - welcome to our nightmare.

So we should all email John Tully and ask him when they are going to release v7. These forums show that this release is sorely needed and should be top of mind for them.
I'm about to jump ship and find a new partner.

craigreilly

Still... sounds like v7 is the ultimate answer - just no timeline in sight.

craigreilly

So when can we get v7? With Apples removal of PPTP from macOS and iOS, I need to replace my VPN. L2TP with IPsec would be the natural progression - except it doesn't work with multiple people using the same public ip (road warriors at the same hotel).

craigreilly

Do you have routers at the location that you manage? In that case, let the router setup the VPN, not the end systems. Any provider that is keeping up with technology is giving you IPv6 (but most of them are not, they apparently do not exist for clients or for internet, but only for shareholders) Th...

craigreilly

The team of workers could bring a mAP lite with them, and make the tunnel from there + use it as an AP in the room. As a workaround. Because in this case you would only need on tunnel. While this sounds like a good idea at $20 - I see a few issues: 1) Working in your guestroom - 10 different floors...

craigreilly

Apparently same issue. I ended up doing the L2TP on the Mikrotik. Only 1 client per location can log on at the same time. The second person bumps the first. Does IPv6 solve this? My provider, Cox, didn't give me any IPv6 addresses when they installed this year. Does that mean I do not have any assig...

craigreilly

You can not have multiple VPN Connections from same remote location if not using unique translated public IP adresses for each user/Connection. Then what is the point of having a VPN? I have a small office on the east - coast - just 4 people... no need for a Mikrotik for P2P VPN and also when my te...

craigreilly

Are you saying Remote devices can not access network once connected to VPN? Do you have the Chain rules for UDP 500,4500,1701? Also - on the WAN and LAN interface = the ARP should be set to "PROXY-ARP" However - I am still on 6.29.1 and plan to update to 6.37.1 tonight. I am having issues ...

craigreilly

So if not "port override" - how do we get multiple users from same remote location to connect to l2TP over IPsec VPN ?

craigreilly

yes - when do we expect v7 release to fix L2TP with IPsec issues?

craigreilly

EDIT -> I finally got connections going - set the IPsec peer Generate Policy to "port override". One guy has been on for 3 hours from his home. Another 2 guys on and off from the same remote office. Me and someone else tried using a shared Verizon hotspot - and it was hit or miss. I would ...

craigreilly

So - my choices are
PPTP - no as Apple devices no longer support it
L2TP - the protocol does not work for remote users behind a firewall
OpenVPN - requires more hardware

Oh - so no choices.

craigreilly

ok - here you go.

https://www.dropbox.com/sh/chaw7f5i4g1c ... 5W6ta?dl=0

craigreilly

So - I'd be happy to get the Mikrotik VPN going. It fulfills our need and the Radius Auth was working fine.

TCP MSS is on.
https://www.dropbox.com/s/cop548c7uxiur ... t.rif?dl=0

Thanks for your guidance.

craigreilly

1701 didn't make a difference. protocol 50 isn't needed from what I have read. I have also tried setting up the Mikrotik VPN - and sometimes it works, sometimes it doesn't. I had it working. Then it stopped. I reloaded old config. Reset from scratch. It worked. Then it stopped. I am not sure if this...

craigreilly

Is this using the Mikrotik L2TP VPN?

I'm trying to setup a Windows Server VPN. It works internally - but not from home or another office.

craigreilly

Anyone have any insight on using a Windows L2TP Server? I have it set up and clients can connect when at the office. But remotely, I can not get the traffic to pass. I have 2 DST-NAT Rules destination 70.x.x.x. (Public IP) for UDP 500,4500 to Windows Server 192.168.3.252. What am I missing? (Just ad...

craigreilly

I have added dst-nat for UDP 500 and UDP 4500 from the Public IP 70.x.x.x to my server 192.168.3.252. Internally I can connect to the L2TP VPN from Mac and Windows clients. However, externally (from home), I can not connect to the L2TP VPN. I see some traffic hit port 500 but that is it. What am I m...

craigreilly

As I mentioned in my initial post - I have to replace PPTP since Apple is removing support in upcoming iOS10 and macOS Sierra.

craigreilly

When I started this job - the company was already using Windows PPTP along with a small Sonic Wall Router. I replaced the router with a CCR1009 when we went to VoIP. So it is fairly new. I am hoping it can support our latest need. Our dear friends at Apple is getting rid of PPTP support in their new...

craigreilly

Went live with my bridge config last night and it's all working great... Thanks for the replies.

craigreilly

If you have the default config loaded - generally you will be able to get online... You say your modem has a static IP - LAN or WAN?

Also to note: Is the WAP a WAP or a ROuter with a WAP? If a router with WAP - be sure to turn DHCP off and plug a LAN port into the Mikrotik.

craigreilly

So What I would like is to plug my ISP into Port 1 where I have a /28. I would like to be able to use any of those Public IP addresses on port 2 - for testing from time to time, or needing a Public IP on a device. Mikrotik support told me to use a Bridge. My VoIP Provider said No - that is the wrong...

Search found 46 matches