MikroTik

soamz

Hi, we are at v6.43.4 on our CCR1036. There is something weird going on since a week. Many PPPoE users are automatically uploading at more than 100Mbps to one specific IP 185.71.66.40, while their plan speed in queue is less than 10Mbps. Howcome the PPPOE is over riding the queue defined speed of th...

soamz

HI, we currently use CCR1036 and CCR1072 for NAS routers with PPPOE concurrent 1200 and 1600 concurrent users. And both actually dies with high CPU as soon as some 30-40 users are disconnected or reconnected randomly due to any reasons. So, it seems those CCR routers are of no use to be used as NAS ...

soamz

Something is wrong with the latest winbox file on windows.

It doesnt save the connections data, even if you click the icon of save.

Whats the issue ?

soamz

Forgot to add :

CCR1009 where the vlans are working are on latest RoS 6.37.2

And this CCR1016 and CCR1036 are on 6.30.2 and 6.32.4

Can RoS be an issue of VLANs not working ?

soamz

I have a Huawei switch s5700, from where all the microtiks are connected. Microtik CCR1009 VLAN working smooth, where huawei port is access port for vlanX and then vlanX is in a bridge with the physical port in the same BRIDGE and CCR1009 is pinging fine. Exactly the same way, when we do for CCR1016...

soamz

One of our PPPoE Router is Microtik CCR-1036-12G-4S, has close to 900-1100 concurrent PPPoE sessions 24x7, passing 500-600Mbps of traffic, with RoS 6.32.4 All of our PPPoE NAS Routers are connected to a huawei s5700 switch which comes from the Core Router CCR1072. Since the vlan from huawei to 1036 ...

soamz

If 103.75.41.217 is your customer, you're not looking at smtp traffic to them, it's traffic from them to many remote mail servers. So either they went into spamming business or got hacked or something.

yes thats my customer.
I ended up blocking him 25.

soamz

Change the chain to "Input", Forward only blocks traffic passing through the router. If you want to stop from sending email (port 25) from inside your network, change the chain to "Output" which will block all port 25 going out the wan port. Also make sure you specify which inte...

soamz

If I torch my WAN port, howcome multiple different servers are trying to send email to one single customer ?

For sure, the customer is not that famous, who will get 100s of emails every second.

What could it be ?

See screenshot.

soamz

Accept rule = The business customers IP have added to a address-list = verified-smtp-users So, basically accept rule will allow them to send emails from their computer using port 25. Add to src-address-list = Adding the customers who are trying to use port 25 to send emails. drop = dropping the cust...

soamz

And I created the rules again and add to src list for drops = smtp-spammers But instead of my customer IP blocks getting added to the smtp-spammers list, I can see foreign IP blocks too. So, Im kind of confused, what the rule is doing. Is it blocking my customers or the ones who are trying to send e...

soamz

I don't see any errors in your screenshots. mlpauls is right that the accept rule would be counterproductive when you want to drop the traffic. But nevertheless, the counters should show anything but zero. Looking at your SIP drop rules at the bottom proves that the firewall is working. So there mu...

soamz

I simply wanted to block port 25. So I placed the rules as given by Microtik support, but there is absolutely 0 traffic hitting, while I can clearly see the wan port and lan port getting all spammers traffic. Attached is the screenshot of the firewall rule and torch of wan to show that, the rule doe...

soamz

Also tried this, still doesnt read the mac address.

soamz

Here is my current cabling. See attachment. But the traffic and mac address both are not reaching the 1072, over vlan10. 1072 is not even reading the mac address from the 1036 over vlan10. Whats the issue ? Any special config required in CCR1072 to accept traffic and learn MAC address from vlan10 th...

soamz

The solution to the problem is switching to a routed network. You will also have more control of the traffic flowing through the network Thats what we did finally. it would be helpful if you share topology . I explained it in All india ISP Whatsapp group few days back. Are you in that group ?

soamz

The solution to the problem is switching to a routed network.

You will also have more control of the traffic flowing through the network

Thats what we did finally.

soamz

we experienced same problem recently, one of our pop switch unreachable from trunk side .
we isolate switch port by port and find out the problem is looping in one of access port of particular vlan.

Fixed it. It was a faulty DVR of one customer, which was disturbing the whole vlan

soamz

screenshots please.

soamz

Logout and login again. And see.
I doubt.

And screenshots upload please.

soamz

It needs to goto border or edge ?

soamz

What answer do you expect on Mikrotik forum ? Do you ask Toyota dealer which model of Ford or Volvo does he suggest ?

Hahahaha..
No, I mean from experts opinions, I know im staying with mirotik for my PPPoE.
Just I need better hardware for Edge and Core.

soamz

Do you suggest Huawei NE or Juniper MX ?

soamz

The NE20E-S series can hold 12M IPv4 routes in RIB and 4M IPv4 routes in FIB.

Oh wow, may be the sales person did not know.

So, my plan is it change edge and core to Huawei or Juniper next month and only usr microtik for PPPoE routers.

soamz

how will a user see from frontend the ping and trace ?

soamz

We flow a lot of traffic and lot of BGP routes, as we are peered to many CDN and providers. Right now, the current setup is 1072 as edge. I was thinking to change to Huawei NE20E-S2E as my Edge router, but Huawei said, its max limit is 25000 BGP routes only. I was like, WTF!!!! Microtik 1072 is j...

soamz

Did you block chain:INPUT and in-interface:<your external interface>? Make sure you don't apply these rules on your internal interfaces. You're welcome to post your firewall, filter rules so we could have a look My network is : 3 upstreams, so 3 border routers > Then 2 core router in VRRP > Then PP...

soamz

If your router is enabled for DNS ("Allow remote requests"), your router is vulnerable for DOS attacks from all sides, UNLESS you have a deliberate firewall rule to drop all TCP and UDP pot 53 traffic on your external interface(s). On all my routers, especially ones exposed to the Interne...

soamz

Yes, very bad!
You are probably being used as a DDoS reflector because of inappropriate firewalling of your internal DNS resolver.

But my DNS is only open for my own internal network, means my 5 blocks of /22 , not for outside world.

soamz

My core router is getting 70Mbps UDP traffic.

Is it bad ?

And I just applied this,

/ip firewall filter add action=drop protocol=udp port=!53 chain=forward

soamz

Im getting around 30% of my total traffic as UDP traffic as I see in my Netflow.

Is there anything to worry ?

soamz

Added to border router but it doesnt seem to be getting the packets.
Looks like some issue.

soamz

Still did not end to the final code.

soamz

Still not working

soamz

No.

oh badluck

soamz

Hi, we are hosted at a Data center where we have a core router only for PNI only.
We need to host looking glass there.

https://github.com/telephone/LookingGlass

Can we simply upload this to Microtik/Files and access it and get the results ?

soamz

thanks alot very good topic

Did you get it working ?

soamz

Then only option I guess is to recheck if that specific monitoring section is added correctly in cacti side. I haven't used cacti that much to be able to give you some more specific details on problem debugging in that NMS. Did you try in MRTG ? I can do it then, just I did not know the format for ...

soamz

Is snmp configuration correct both on device and NMS sides?

yes perfect, as its listing the ether traffic fine, as Im monitoring each ether traffic from same cacti too.

soamz

It shows blank.

soamz

Okay it works. But what do I use from it ? I got this, [soamxxx@xxxx] > interface print oid where name~"JS080-monitoring1" Flags: D - dynamic, X - disabled, R - running, S - slave 0 R name=.1.3.6.1.2.1.2.2.1.2.28 actual-mtu=.1.3.6.1.2.1.2.2.1.4.28 mac-address=.1.3.6.1.2.1.2.2.1.6.28...

soamz

Okay let me try.

BTW, is it okay to convert all customers to this static bind, or is there any down side of this ?

Why do everyone uses the moral dynamic PPPOE then ?

soamz

Okay fine.
I logged him out and then it auto logged in again. So, I guess login is working fine.
Now what do I copy from this mcirotik user to monitor his graph in cacti or MRTG ?
His MAC ID ?

soamz

For example, I took a customer who is live and using. And simply entered his PPPoE username is username and in service name, placed my service name. I see, his normal PPPOE doesnt show and only the binding one shows, but his account shows logged in and 0 usage. How do we know if its done ? And yo...

soamz

My bad I used incorrect term. I meant that you need to create static PPPOE server bindings for those users that you want to monitor. On next reconnect the dynamic server bindings will no longer appear and this user will now be tied to this static server binding. Then from this entry use oids for mo...

soamz

There is. You just cannot get static oids without interrupting the current the client. * From current dynamic session you can use those oids that it already has. The problem is that they will change on each client reconnect. * IF you add static pppoe server interface for that client the oids will r...

soamz

You cannot. PPPOE client would start using static interface on next reconnect.

So there is no way to get usage traffic graphs of PPPoE customers ?

soamz

I have not done this for that particular application but I faced the same issue in other cases. Of course you need to write a program/script that adds MRTG config for every new interface (customer in your case). But that is quite easy as it is only the addition of a fixed section with simple parame...

soamz

Should not be a problem with the proper MRTG configuration! Is not a MikroTik issue, it is about knowing how to configure and use MRTG. I have used MRTG with many different devices and this issue always occurs. You need to find and use the proper interface reference. Have you done it ? can you sha...

soamz

From winbox PPP > Interfaces > Double Click in a dynamic interface > Copy > Apply > OK

Before applying make sure you REMOVE the previos PPP Interface you are copying.

Sorry, that is confusing.
Can you explain how to do that ?

soamz

Anu succeess yet ?

I need it asap!!!

soamz

Only by creating static server bindings for those pppoe users you would get them to stick with one and the same oids on each connection time.

how to do that without diturbing the clients ?

soamz

Any success yet ?

soamz

Did you find out ?

soamz

Final version works for anyone ?

soamz

which cisco router do you use ? Two CISCO 2951. At this time, i implemented eBGP to redistribute ONLY Static subnets (on NASs) Each NAS have a private AS, like AS65001,AS65002,.... The two Cisco 2951 have public AS. So, this sistem work, but it's a poor solution... Is Cisco 2951 able to handle ful...

soamz

Yeah, I understand your current diagram ... my point was that you could _change_ it and just have everything connected to your switch (both peers and ISP) and then have the CCR "on a stick" just connected to your switch and use VLANs as virtual patch cables to make any logical topology yo...

soamz

which cisco router do you use ?

soamz

CCR1072-1G-8S+ has 8 SFP+ that can do 10G or 1G. There are also other models with 2 SFP+ and 1G ports as 1G-base-t rather than SFP. But you could also only use a single 10G port for all your uplinks using VLANs on your switch to establish the point-to-point connections to your peers. Or even just t...

soamz

Have a look at the following devices: CCR1036-8G-2S+ - 8x 1G (copper) ports + 2x SFP+ (10G) ports. CCR1036-8G-2S+EM - Same as above, but more memory on board. CCR1072-1G-8S+ - 1x 1G (copper) port + 8 SFP+ (10G) ports, but all SFP+ ports should be compatible with 1G SFP modules. If you need 1G coppe...

soamz

I recently peered to Google and Akamai in a data center and using huawei s5700-28x-li-24s-ac switch for it, but now I have customers there and I need to terminate those CDN providers into a router. Peering to terminate to Router : Google 10G Port (500 routes) Akamai 1G Port (181 routes) AMazon 1G ...

soamz

Can 3011 handle like 500 PPPoe sessions with total throughput of even 700Mbps ?

soamz

Am a newbie here especially on the firewall thing. I have a similar problem where my entire /23 subnet is on PBL. Am more of a routing person but I have to deal with this. Is anyone willing to help with this Mine is still not blocked, very confused. Still, after placing everything, Im able to logi...

soamz

First delete my existing 4 rules. Then , /ip firewall address-list add list=dnsClients address=x.x.x.x/m Goto address list and add my IP blocks first. Then run this, /ip firewall filter add chain=input connection-state=established,related action=accept add chain=input in-interface=ether3 action=...

soamz

Remove the old and place this ? Sorry, Im just afraid to mess it up always, as once for one single click, whole network had gone down for 1 hour,and I had to drive for 22 kms at 2am in the night. So, could you please paste the final version of total code please ? I will remove the old 4 lines, as I...

soamz

My network is this,
3 upstreams > 3 dedicated Microtik edge router
Then it connects to 2 Microtik core routers in VRRP >>
Then it connects to this NAS router >> Customers

soamz

This is the main Router after which there are 2500 customers PPPOE authenticated and using internet.

I think, you call is NAS or BRAS router.

soamz

attached. Thanks!!

soamz

okay - so use the in-interface=!pppoe-interface (not ether3, but pppoe1-out or whatever its name may be in your configuration) PPPoE port is ether3 So you mean this is final ? /ip firewall filter add chain=input connection-state=established,related action=accept add chain=input in-interface=ether3 ...

soamz

Done.
But still Im able to goto my PC and goto telnet domain.com 25

soamz

And this needs to be done for the PPPoE ether or the Microtek's public IP ether ?

soamz

So final version this one ? /ip firewall filter add action=add-src-to-address-list address-list=BAD_SMTP_CLIENTS address-list-timeout=4h chain=forward dst-address-list=!GOOD_SMTP_CLIENTS dst-port=110,995,143,993,25,585 out-interface=ether6 protocol=tcp add action=add-src-to-address-list address-lis...

soamz

Chances are you have the rules in the wrong order, below one that permits the traffic you are trying to log and filter out.

Oops.
Can you clear and paste the final version please ?

soamz

I mean, ether8 is the port which is connected from core router to this Router.
And ether3 is the PPPoE port.

soamz

My WAN is ether8 and my PPPoE port is ether3 So you mean this ? /ip firewall filter add chain=input connection-state=established,related action=accept add chain=input in-interface=ether3 action=accept add chain=input protocol=icmp action=accept add chain=input action=drop /ip firewall filter add cha...

soamz

@ZeroByte, I have this 4 only. /ip firewall filter add chain=input in-interface=ether8 protocol=udp dst-port=53 action=drop add chain=input in-interface=ether8 protocol=tcp dst-port=53 action=drop /ip firewall filter add chain=forward protocol=udp dst-port=53 out-interface=!ether8 action=drop add c...

soamz

I did this in a NAS which has 2500 PPPoE customers. /ip firewall filter add action=add-src-to-address-list address-list=BAD_SMTP_CLIENTS address-list-timeout=4h chain=forward dst-address-list=!GOOD_SMTP_CLIENTS dst-port=110,995,143,993,25,585 out-interface=ether6 protocol=tcp add action=add-src-to-...

soamz

From your port list,

110,995,143,993,25,465,585

I removed the 465, as 25 is blocked, so customers will use 465 with SSL for sending emails.

soamz

/ip firewall mangle add action=change-mss chain=forward comment="Internet MSS Shaping" disabled=\ no new-mss=1452 out-interface=Internet protocol=tcp tcp-flags=syn \ tcp-mss=1453-65535 add action=change-mss chain=forward disabled=no in-interface=\ Internet new-mss=1452 protoco...

soamz

Check it tomorrow. At least the dns server utilisation should be low immediately. Last two rules just prevent the inner devices to talk with other outer dns servers but they are not effective as they are below the general accepting rule for outbound traffic. It depends on you whether you want allow...

soamz

The throughput you get through each unit depends highly on your rules on firewall/nat etc. If you've limited firewall and make use of fastpath then should get throughput close to specified figures. VPNS (with encryption) and lots of firewall rules all act to reduce your throughput. Yes, I know! We ...

soamz

Have you looked at the mikrotik/routerboard website at all? All of the specifications are on there. The amount of memory does not equate to speed/throughput

I had checked it since weeks.
Just wanted to get real life review of it.

soamz

Superb!!!!
And if I get a 3011, then can it handle more than 850Gx2, as it has 1G RAM ?
So, get 3011 or 850Gx2 ?

soamz

You mean, we can do OSPF + MPLS on a 850Gx2 also ?
Clearly you need an understanding of how before you do, but yes.

Wow, you are making me happy!
but I saw in router board website, it shows RouterOS5 compatible.
I think, MPLS OSPF only there in Router OS Level 6 license.

soamz

I would suggest you check your facts

1) you can run RouterOS 6.x on an RB850Gx2

2) see http://routerboard.com/RB850Gx2 for performance specs

You mean, we can do OSPF + MPLS on a 850Gx2 also ?
Can it handle per port 300-400Mbps even ?

soamz

Hi, i have the same isue i cant open some bank web pages yahoo mail etc. Did anyone find a solution to this problem. I am using MIKROTIK CCR1036

whats the error ?

soamz

Look at RB850Gx2, RB1100AHx2 or CCR1009-8G-1S-PC

RB850Gx2 is not OS6 capable and also cannot handle more than 200Mbps.

soamz

I mean, I kept port 25 open and got my 2000 IP blocked and now dead

soamz

Yes but you need to decide what you want to guard against. You need to be careful. When you implement measures to prevent your customers from being infected in a certain way, and this fails (if only due to advances in attacks), your customers may claim that you have failed in protecting them. So i...

soamz

There is no general advice about that because it depends on your intentions. Do you want to guard your own network, to guard your customer, your ISP's reputation, or all? Do you want to guard against abusers from the internet, from your customers, or both? What OS is your typical customer running? ...

soamz

Please remember if you block any ports > 1024, you should make sure you do them for inbound connections only. Otherwise if a client picks a local ephemeral port number that happens to match a blocked port, suddenly things stop working. Good info. Is there a one stop wiki for what ports should be b...

soamz

Okay KISS!

soamz

No... use KISS rule ... Rules for for e-mail Rules for ssh Rules for WWW Rules for SPI ... Rules for .... whatever you want to filter KISS :P Where do I find more info about it ? I think, there should be a microtik wiki for all this. As every ISP needs this common and it ends up with 1000 confu...

soamz

Of course they allow the use of their own DNS-servers. (This obstructs malware that diverts DNS-requests to DNS-servers operated by the bad guys.) I see, so in address list allow they only keep the DNS IP of their DNS server. so, everything else is blocked. Means, even if someone tries to put Goo...

soamz

Dutch ISP XS4ALL offers its customers customizable firewall settings. Customers can choose the level of protection they want through their support portal. This ranges from Level 0 (all ports open) to Level 4, where all the ports that are susceptible to abuse are blocked (i.e. 25, 53, 136, 137, 139,...

soamz

Dutch ISP XS4ALL offers its customers customizable firewall settings. Customers can choose the level of protection they want through their support portal. This ranges from Level 0 (all ports open) to Level 4, where all the ports that are susceptible to abuse are blocked (i.e. 25, 53, 136, 137, 139,...

soamz

It is your own decision what ports you block to protect your customer and yourself. You CAN block port ranges in MikroTik routers, but not protocol ranges. So you need a separate rule for UDP and TCP each with the range. So so if its 135-139, So, create 2 rule each of TCP and UDP for 135, 136,137,...

soamz

For each device which sends data directly to the Internet ... if there is more than one then for each one but then for each device you need to maintain lists. It is like gates on the airport ... for each gate which passangers are going through you need security officer. If you can pass all the peo...

soamz

For each device which sends data directly to the Internet ... if there is more than one then for each one but then for each device you need to maintain lists. It is like gates on the airport ... for each gate which passangers are going through you need security officer. If you can pass all the peo...

soamz

Rules 1,2 collect data in forward and output chains
Rules 3,4 filter mails in forward and output chains

You can use all of them at the same time.

Amazing.
In Border or Core ?
Or both ?
Or PPPoE routers ?

soamz

Read this once again: http://forum.mikrotik.com/viewtopic.php ... 84#p544328

You wrote it OR.
So, I got confused, whether to run 2 or all 4.

soamz

I was checking Comcast website and I see they have blocked all those ports. https://customer.xfinity.com/help-and-support/internet/list-of-blocked-ports/ Shall, we simply add rule for each port and block them ? And should it be done at the border or core or PPPoE router ? add chain=forward protocol...

soamz

For a global operation of blocking port 25, you're definitely going to want to allow SMTP for some sources - suppose your own company's mail server, for instance, or any customers who are operating their own mail server. You need to create an IP list for hosts that are allowed to use port 25 e.g.: ...

soamz

Done that just now at my PPPoE Router. / ip firewall filter add chain=forward protocol=tcp dst-port=25 dst-address-list=!SMTP-addr action=drop comment="" disabled=no / ip firewall address-list add list=SMTP-addr address=1.1.1.1/32 comment="ISP SMTP" disabled=no add list=SMTP-add...

soamz

I use a simple rule, in this example my main (ISP) Mail server is 1.1.1.1 and a customer has a mail server someone else hosts at 2.2.2.2/32 and another customer at 3.3.3.3/32. This rule blocks an destination TCP port 25 that is not destined for the IP addresses listed in the address List SMTP-addr....

soamz

See attached.

soamz

Okay I did this in CORE ROUTER only. Did not do in Border routers or PPPoE Routers. Only done at core. /ip firewall filter add chain=forward protocol=tcp dst-port=25 src-address-list=spammer action=drop comment="BLOCK SPAMMERS OR INFECTED USERS" add chain=forward protocol=tcp dst-port=2...

soamz

You are checking if port 25 at your site is open. Simply: some server in the Internet tries to open port 25 at your site.
You are not checking if you are transmitting to port 25 somwhere in the internet.

So Block Port 25 on Border or Core or PPPoE router alone ?

soamz

Weird, I just checked in canyouseeme and it says, port 25 is not open.

soamz

Warn/inform users that you will block port 25 Block port 25 and track who is generating traffic to port 25. You can make rules for each customer: add action=drop chain=output dst-port=25 out-interface=ETH-WAN-ISP1 protocol=tcp src-address=IPofClient1 add action=drop chain=output dst-port=25 out-int...

soamz

As /22 subnet owner try to remove whole subnet from PBL. Check who is responsible for mail traffic. Warn/inform users from the top of the usage list about problems. Block 25 port ... leave 587 open You need to choose: difficulties for customers or blocked subnet ..... "To ban or not to ban ? T...

soamz

If they experience problems with PBL (which is, imo, their problem) you can refer them to your relaying server. Not true in 100% ..... If PBL blocks whole subnet instead of particular addresses then it backfires on "good guys". They have no chance to remove themselves from PBL as subnet i...

soamz

Do not try to unblock entire customer subnets on PBL's. They exist for a reason. Customers can unblock themselves based on several conditions (e.g. fixed ip and mx/ptr records). Also, you could host a smtp relay for your customers with a strict enough eula enabling you to get exclusion on most blac...

soamz

So, if I block port 25, will they stop working ? No, they won't. Quick google search shows that both Godaddy and Hostgator use 465/tcp for mail sending. I think I should better block them port 25 and then wait for emails of customers. Whoever says, outlook not working. Simply ask him to use SSL w...

soamz

Do not try to unblock entire customer subnets on PBL's. They exist for a reason. Customers can unblock themselves based on several conditions (e.g. fixed ip and mx/ptr records). Also, you could host a smtp relay for your customers with a strict enough eula enabling you to get exclusion on most blac...

soamz

When I asked some experts at other forums, they say to block port 25 at your PPPOE router and core router. is that a solution ? But I guess, every customer outlook will stop working. No, it won't. Or at least it should not. Nowadays, no ordinary customer should have legitimate reasons to make outg...

soamz

The first step should be monitoring which IP usues 25 port and make some statistics and then you can inform "suspected" users that they generate traffic on port 25 and ask them to check if all is configured properly. So goto PPPoE router and goto CONNECTION TRACKING and see, who are conne...

soamz

Yes try that, however not to disturb service first monitor how the script behaves and if it yields results then implement it.
Don't just jump right in

Oops, I still fear.
Lets wait for some more insights.

soamz

An option is writing a script that pulls IP's off a PBL and updates your block list, later you can inform the user that he might be infected with a virus and limit his service until he takes action, some ISP's do this, not the best option since PBL tend to put the whole subnet in rather than a spec...

soamz

We are an ISP with over 6000 IPv4 addresses and I see, over 2000+ IP are already on PBL, almost 3 of the /22 are completely showing on PBL list. How to avoid this happening or get the whole block whitelisted by PBL ? When I asked some experts at other forums, they say to block port 25 at your PPPOE...

soamz

Thanks.
I think I will first add it to the border routers and then the core and then will add to PPPoE router after 2-3 days.

soamz

Okay in all routers, use the same code
But in PPPoE routers only, change to dst

soamz

So the rule is correct ?
Did you see it full ?

And it should be in all the microtik routers ?
Yes, all of my routers are with public IP always.

soamz

And whether those rules should be on border or core or PPPoE router ??

soamz

I can see my developer had done this to my core router. Screenshot_5.png But I found this in a forum thread, " add action=jump chain=forward comment="SYN Flood protect" disabled=no \ jump-target=SYN-Protect protocol=tcp tcp-flags=\ syn,!fin,!rst,!psh,!ack,!urg,!ece,!cwr add ...

soamz

Can you suggest modifying the above rules for per-destination IP? simply use 'dst-limit' instead of 'limit' parameter add action=jump chain=forward comment="SYN Flood protect" disabled=no \ jump-target=SYN-Protect protocol=tcp tcp-flags=\ syn,!fin,!rst,!psh,!ack,!urg,!ece,!cwr add...

soamz

same problem, so sad

Whats your story ?
Explain.

soamz

How many rules are in your firewall filter/mangle/nat? Queues? I remember an issue I had some time ago: on a 1036 acting just as FW and OSPF gateway, I created a fw rule to check for L7 content. I just restricted by dst-port 80 and enabled it. CPU load was around 25-30% (normal usage is around 7%) ...

soamz

Okay but its hardly 1.5Gbps of traffic flowing for 2500 PPPoE session.
Cannot believe why 1`036 would give up.

soamz

In that case I suggest you reenable ConnTrack, generated some supout.rif files when the problem is happening and contact support@mikrotik.com with as much information as possible. How many PPS and how much bandwidth are we talking about? How many rules do you have in you firewall filter/nat/mangle?...

soamz

But, is it overloaded? Which is the CPU usage? Have you used "Tools, Profiler" to find out which proceses are the most time consuming ones? Why did you tought about disabling ConnTrack? Don't remove the seats of your car suposing it will run any faster! (and you will not be able to bring...

soamz

But, is it overloaded? Which is the CPU usage? Have you used "Tools, Profiler" to find out which proceses are the most time consuming ones? Why did you tought about disabling ConnTrack? Don't remove the seats of your car suposing it will run any faster! (and you will not be able to bring...

soamz

Ouch.
But everything is working fine.
So, do you mean, Connection tracking should be on for PPPoE router ?
Yes, it should. Set it as "auto" and get bigger hardware if load is an issue.

The hardware is 1036 16GB RAM and hardly 2600 PPPoE sessions.

soamz

Leave it as "auto" and Mikrotik will wisely choose to enable it or not. If hardware resources are an issue, set it as "auto" and if RouterOS enables it, try to find out why and then if you can move/disable the service which switches tracking on. Many features require ConnTrack t...

soamz

I have recently disabled connection tracking in all of my microtiks, borders routers, peering routers, Core routers, NAS routers, POP routers, everything.
Is it advisable to keep it on or off ?

IT seems to be handing the Microtik a lot, so I completely switched them off.

soamz

CCR1009-8G-1S-PC can handle as a POP router, which would be used for PPPoE + MPLS + OSPF ?

May be atleast handle 500Mbps PPPoE traffic with simple queues 2 queues per user ?

soamz

I would say that this whole issue shows that it's probably time to start re-thinking your network design. Large broadcast domains suffer from this kind of problem - one thing can plug into your network anywhere and bring the whole thing to its knees much more easily in a flat network. At the very l...

soamz

The G point actually seems to be problem. My team said, today they visited 3 clients and all 3 clients router cable was in LAN instead of WAN. Now Im afraid, there might be many out of the the 1800 clients, who might have done the same. How would I find out ? Well, You can be (almost) sure they wi...

soamz

Can a 1072 handle like 10000 PPPoE concurrent session with 2 queue per user ?

And plans upto 10Mbps.

soamz

The G point actually seems to be problem. My team said, today they visited 3 clients and all 3 clients router cable was in LAN instead of WAN.
Now Im afraid, there might be many out of the the 1800 clients, who might have done the same. How would I find out ?

soamz

Is the switch managed switch or unmanaged. If it is managed log in and check the interfaces try locate which customer is causing the issue. Also if it is managed you may be able to use spanning tree or advanced detection to prevent loop backs and port errors from bring down your network Already ena...

soamz

What does the encrytion thing do ? I have PAP only and I just disabled the encrytion thing. Earlier it was set to default. Pap or chap control the handshake of the username and password. Pap is plain text, the others are hashed. Encryption actually effects the pppoe tunnel, encrypting the link af...

soamz

How are you distributing to your customers. Do you have one central router. then a managed switch or wireless ap's. if you have a managed switch look for a port with with errors.

Yes, one NAS router and then switch and then customers.

soamz

I can try to help You. As I said, my knowledge of Mikrotik and Routerboard is zero. There's the network part.

Did You find the problematic router/AP?

Please message me your email or SKYPE or whatsapp ID.

soamz

Wireshark would allow You to see the traffic. The hard part is to know what to look for. I have zero experience with Mikrotik/Routerboard - just bought one, and still waiting to get it. But I have experience with network. I would try something like this: 1) Try to isolate the router/AP hit by the p...

soamz

Is Mac filtering only possible in bridge ?

What about them, who doesnt use a bridge as bridge has his own set of problems.

soamz

Is there a way to block a specific MAC address reaching the Microtik ?

I suspect 2-3 MAC address, which I think is trying to create the loop or broadcast.
I need to block them.
How shall I do that ?

soamz

I just bought my first Mikrotik router (a RB1100AHx2), to use as a router on my work. We have a policy of planned substitution of hardware, in order to avoid problems. But I have no experience with routerboard. What kind of useful service life should I expect from this hardware? 3 years? 5 years? I...

soamz

It could be a client with a problematic ethernet. I have seen one deffective ethernet flood a network until the switch locked. You said this affects a restrict group of clients. They should be the ones served by the same tower. Could You look at the router on this particular tower? There You should...

soamz

What is 192.168.0.100? Problem is between that and next router. It was specially designed that way, so you can start finding problems. Also use traceroute.

Mac, that is his own Wireless router IP, I guess.
As normally the home routers have those IP 192.168.0.xx

soamz

What does the encrytion thing do ?

I have PAP only and I just disabled the encrytion thing.
Earlier it was set to default.

soamz

Since last 12 days, there has been weird things happening in the network. From morning 10am-8pm, random 100-200 customers keeps on disconnecting and connecting. But the same customers immediately get stable after 7-8pm normally. Here is the screenshot of a customer whom I randomly picked. He got...

soamz

I have the same issue. Customers PPPoE disconnects when full bandwidth is being used. or they are experiencing ping cut, means ICMP drop. So, simply add those 3 rules in terminal ??? add chain=forward packet-size=0-128 \ action=mark-connection new-connection-mark=small-packets passthrough=yes \ comm...

soamz

IM on Microtik 6.32.4 and 6.35.2 on 2 of my NAS, which gets a lot of traffic and over 1200-1300 concurrent PPPoe users. Since last 10-12 days, I see all the customers keeps on disconnecting randomly. And when we check their device sys log, we see this, May 26 14:14:34 pppd[888]: Timeout waiting for ...

soamz

same issue here.
ARP shows many 000000000 entries.

How to fix ?

soamz

In forums, everyone asks to keep MTU as 1480 and MRU as 1600 and keep one session per host unchecked.

But in my case, its MTU 1492 and MRU is 1492 and MRU blank and keep one session checked too.

Does that affect ?

soamz

I am getting a similar issues with pptp remote laptop (authenticated to Windows Server 2008) but no problem with a MT router. echo: pptp,ppp,debug <cl.ie.ent.ip>: LCP missed echo reply echo: pptp,ppp,debug,packet <cl.ie.ent.ip>: sent LCP EchoReq id=0x4 echo: pptp,ppp,debug,packet <magic 0x17f25004>...

soamz

This was a problem with Active directory settings. (of which I know nothing, our windows nerd fixed it)

Did you solve this ?

How ?

soamz

Did you solve this ?

How ?

soamz

Did you solve this ?

How ?

soamz

Remove the DHCP Client from ether1- my PPPoE Interface. Then BOOM in the room.

Remove DHCP client fom PPPOE interface ?

Means, where ?

soamz

Im at home and I ran a ping to 3 things : My Router at Home Microtik NAS IP in DC Google DNS When this disconnections happen, google IP stops pinging. But the NAS IP and Router IP is on. That means, the issue is not with connectivity, as NAS IP is pinging fine. But the 8.8.8.8 stops pinging. Its sur...

soamz

More screenshots.

soamz

Our NAS is 1036 GB Model and around 1200 concurrent PPPoE sessions. Since last 2 weeks, users have been complaining that it gets disconnected randomly and gets connected randomly. I enabled the deep logging for PPPoE as instructed by Microtik Support and I get this. How do we debug this ? Who is at ...

soamz

Exactly.
Just to think about it.

Okay thanks, will surely plan for it.

soamz

Sounds like yes. But have you considered the advantages of routed network over the bridged? Remember that RSTP is not implemented in the switch but in the software only so you have to use bridges. That takes your performance effectively down. May easily happen that 2011 will not be able to handle t...

soamz

Hi, Im going to cover a new town whose radius is 11km circular fiber laying calculated distance. And in every 3 km, we have a POP with Switch and power. So, its like 4 POPs for the whole 11km radius. Now, in each POP we have wireless tower and customers conencted from those towers. All 4 towers are ...

soamz

0-80Gbps throughput.

https://www.youtube.com/watch?v=odNkzle-YJ4

I guess thats acting as BGP router and not a PPPoE session router ?

soamz

For example, we have 2 NAS = Fiber NAS , Wireless NAS. Both are Microtik 1072. Now, I have 21 POP in a radius of 100km. Each POP is connected in a ring fiber network of single core. Only one single core which is connected to the DC managed switch. Each POP as one managed and unmanaged switch for acc...

soamz

Can a Microtik CCR handle like 4000 concurrent PPPoE sessions ? Can 1072 10G model ? Lets say, we have users with plans upto 100Mbps, and like 5000 customers, so lets say 4000 concurrent users. Can Microtik 1072 handle it ? has anyone tested it ? Any live review thread of any ISP who is having such ...

soamz

With nagios network monitor.

Uptime shows timed out.
I guess, microtik uptime sensor is not supported well in nagios.
Everything else works great.

soamz

Hi, we use LibreNMS and we monitor all of our microtiks routers and switches in the DC.
IT only monitors the ports

Is there a way we can also monitor a microtik simple queue through SNMP ?

Let me know.

soamz

i suggest you to test in LAB (not production network) this configurations because some times can be tricky to troubleshot Thats fine, I can try with a lab router. but how would I try myself generating broadcast ? in my case i have tested doing a loop on the switch, that is a patch-cord connecting f...

soamz

http://wiki.mikrotik.com/wiki/Manual:CRS_examples#Traffic_Storm_Control Thanks! Lets say, I have 2 ports being used in CRS< one for PPPoE and one for DHCP and then it goes to access layer switches. So only place those 2 codes for both of those ether ? i suggest you to test in LAB (not production ne...

soamz

http://wiki.mikrotik.com/wiki/Manual:CR ... rm_Control

Thanks!
Lets say, I have 2 ports being used in CRS< one for PPPoE and one for DHCP and then it goes to access layer switches.

So only place those 2 codes for both of those ether ?

soamz

You can start thinking about moving from bridged to routed network architecture.

You mean, have each Pop site with a router ?

but we dont have enough Ip to dedicate each POP with specific IP blocks.

Can we do without assigning dedicated IP blocks ?

soamz

Hi, our network is like coomplex core network with multiple routers working with all the protocols and then directly access layer with CRS125 and then customers switch by switch on wireless. To avoid any kind of broadcast storm, is there an option in CRS125 which I should keep it on, so whenever it ...

soamz

I just got a new ISP Feed and tested it with a singapore IP, which is the most used in our network. It gives 72ms to that singapore IP, when Im connected to a direct PC with there ISP WAN IP. Now, my IP blocks were advertised by the ISP and they said, its done and over. So, I have configured my micr...

soamz

Hi, we have 2 WAN - 800Mbps each. 1 is very unstable and goes down every week. But the 2nd one is rock solid and gives very good latency to USA and Singapore and everything. We have 1 for all the residential customers torrents downloads and everything. I just got a Microtik 1036 16GB Model. Now I wa...

soamz

Then try the other method using PCC:

http://mum.mikrotik.com/presentations/US12/steve.pdf

Let me go through. Hope it works, as we cannot afford Cisco.
We have to use Microtik only.

soamz

There were two talks about load balancing at MUM USA 2012. The one that allowed proportional load sharing based on actual throughput is this one: http://mum.mikrotik.com/presentations/US12/tomas.pdf Its behavior was more like: fill up link 1 then use link 2 if link 1 is full, then use link 3 if lin...

soamz

Can someone Moderator or core developer throw some light how to do this ?
Or shall we consider this as a limitation for microtik ?

soamz

I agree with scampbell - you should use routing and not bridging for your backhaul.

A large broadcast domain can lead to all kinds of problems.

On confused how to do it

soamz

We already tried PCC, but it doesnt choose the best path, so we have to force a particular WAN for upload. Is there a way, we can make the settings that mikrotik takes the best path for upload ??

soamz

Search for pcc load balancing. Start here. http://wiki.mikrotik.com/wiki/Load_Balancing

He said, ECMP doesnt happen in CCR1009 , which he is using now.

Means he is not able to select 2 WAN for upload.

soamz

It will easily fulfil your needs as described.

Okay!
But how do I configure ?
Which is the option ?

I asked a friend and he said, Microtik has limitation to use only 1 WAN for upload.
It cannot use more than 1 WAN for upload.

Is that true ?
If false, how do I fix his situation ?

soamz

Hi, we have 3 ISP feeds. 200Mbps each. And your average peak hours usage will be like 500-550Mbps download and 500Mbps upload, as we sell our upload to a some mini data center clients. We need all 3 ISP feeds to be simultaneously and the packet request should automatically choose which WAN has the b...

soamz

No it is not possible! Note the "https" which means "secure" communication. The communication is encrypted and the router never sees the URL. Even when you setup a proxy server, the router sees only the hostname not the part after it. So then you can block entire facebook but no...

soamz

If you are doing that much traffic then the ccr1016-12s might be a better investment. The crs switch chips are good but I'm pretty sure don't support features like RSTP or LACP yet without using the CPU which architecturally is limited to 1gps to/from the CPU. The ccr would allow you to run ospf an...

soamz

I would try using a L7 firewall rule but these are high CPU cost. Lucky you have a ccr

So possible to do with CCR ?
How ?

soamz

CRS - make very very very sure that you're ONLY using the hardware switch features. - i.e. no bridge interfaces, no bonding interfaces, etc. CRS cpu absolutely can not handle high traffic. CRS switch chip can do well, but make sure your traffic is hardware-switched. Confused. Seems CRS cannot handl...

soamz

RSTP will work, but if you have any wireless bridges that support spanning tree, they're going to need to participate in the spanning tree as well. Every bridge must participate or else you get weird behavior. Okay I dont want to make this complex. I just need to setup the RTSP thing among those 3 ...

soamz

We have like 12 POP locations and each POP will run around 2Gbps traffic at peak hours. We have fiber ring link to each POP and we also have wireless. We are looking to make it auto fail over switch system. Right now, if the fiber gets cut, we have to drive and connect the wireless cable manually. I...

soamz

Hi, we need to block https://www.facebook.com/abs/ssd
from our microtik CCR1009.

How do we do that ?

soamz

Sure DHCP can serve many DNS addresses, but the question is: how many will your clients pick up from that. Try connecting a computer like your typical client uses, and look in the network information to see what it has done. Sure it would be an idea to try to reduce the list in DHCP to 2 servers, o...

soamz

There may be a limit on the number of DNS servers your clients are taking from the DHCP reply. Some OS may have a limit of 2 DNS servers. So when you list 4 DNS servers, the clients make take only the first two and when they are both down they never see your other two (google) servers. PPP profile ...

soamz

I use a Microtik CCR1009 in my access layer for PPPoE authentication and hotspot both in the same router. I have my own DNS server. So, I have defined the DNS entries in 3 areas : IP > DNS Server PPP > Profile > DNS Server DHCP Server > Networks > DNS Server I have defined this, My DNS IP A My DNS I...

soamz

I have one ISP link in my CCR1009 and if a fiber cut happens or anything, my BGP takes like 5 minutes to get back to action. I hope, when I advertise other 2 ISP links in the same router, its not going to take forever :( And BTW, my core router is only used for BGP and ISP feed. All the queue, logi...

soamz

I have one ISP link in my CCR1009 and if a fiber cut happens or anything, my BGP takes like 5 minutes to get back to action. I hope, when I advertise other 2 ISP links in the same router, its not going to take forever :( And BTW, my core router is only used for BGP and ISP feed. All the queue, login...

soamz

Do you have a need to take full BGP tables from your ISP's? If all you are looking to do is advertise your networks for upstream reliability, then you could take all three into one CCR 1009 without injected routes (only default) from them. Or you could write some inbound filters to split the tables...

Search found 430 matches