MikroTik

sam1275

Hello.
I think the bugfix releases have too short life cycles, they do last longer than "current" ones, but it's not long enough as a professional level platform like Mikrotik.
Thanks.

sam1275

Use a firewall rule with the in interface match.

Thanks, but can the firewall only block certain user account?

sam1275

Hello. How can I prevent a system user from login by wireless(from winbox/ssh/anything)? I want the admin account can only be accessed by wired connection. I just thought a solution, I can assign different ip range to wired and wireless, and restrict the user group's ip address. Is there any problem...

sam1275

I just tried winbox on a rb2011 without security package installed, Winbox connects and shows the lock icon, what's happening?
This is a 8.5 years thread, Mikrotik, please do something to protect your customers, thanks.

sam1275

Security is essential, it have to be considered prior to any other functions. No exceptions, no excuse.
People here seems not care much about that, however that's not my business, I care, so I fight for it.
One don't even need to be here if he have as little brain as Jajeblonsky do.

sam1275

I do this in hoping routeros getting better, a hardened security is not only for me, but for every true genius loving Routeros.
If you don't understand, you can keep silent; but if you insult me, I will not respect you any more.

sam1275

Those hours would be better spent working on RouterOS and Winbox.
Damn paranoic morons :-E

Of course encryption and security is not for everyone, especially not for a stupid asshole like you.

sam1275

Hello. There's a secure mode in Winbox, but how can I make sure the machine I'm connecting is not a hacker's setup? Think about SSH, we can check the certificate fingerprint to make sure the target is legit, but Winbox seems not care it, so if a hacker have ANY routerOS certificate(which should not ...

sam1275

Update: Now the download site is all https supported, thank you mikrotik!

sam1275

Here's the update. I emailed to mikrotik support about this issue because it's a pretty important one that affect security, one of the support man kindly enabled https for the download page (I'm not publishing his name in regards of privacy). However the actual download link is still http only and ...

sam1275

Here's the update. I emailed to mikrotik support about this issue because it's a pretty important one that affect security, one of the support man kindly enabled https for the download page (I'm not publishing his name in regards of privacy). However the actual download link is still http only and t...

sam1275

Did you try clearing DNS cache?

sam1275

Hello.
i just realized the Mikrotik download site "http://www.mikrotik.com/download" is http only, and I can't find anywhere to verify the hash/signature securely, so how can I make sure the resources I downloaded are legit?
Thanks.

sam1275

It's not meant to be possible from withing RouterOS itself, unless you "hack" you router in some way.
What do you need this for?

Thank you. I think if I can access those files, then I can change some settings not available without it.

sam1275

Is it possible to access the system files on routeros? The "file" function don't show them.

sam1275

Hello.
I have a RB2011UiAS which LED flashes very slow, and there's no difference between 1kbps or 1gbps, it just flash the same speed and slowly.
Also there's no new routerboot for a long time, when will the next version release?
Thanks.

sam1275

Thank you Normis and everyone!

sam1275

Hello.
When I open a terminal in Winbox, the "active user" will show I opened another login through telnet. So does that mean it opened a unencrypted connection even if I checked "secure mode"?
I saw this long time ago but didn't think much until today, can any one explain?
Thanks.

sam1275

I'm glad my mikrotik comes with Wlan disabled by default. OP is right, default wireless enabled with management access is dangerous, no matter how small the window is, the racing condition is a vulnerability. I always hate consumer routers and some 3rd party firmware have no or simple password with ...

sam1275

This is already implied in 6.37.3

sam1275

Put this in your schedule: /ip firewall nat remove [find dynamic] Thank you very much, It works! But there's another problem, even if I removed the NAT rules, those UPNP rules still shows in a UPNP client such as portmapper, and I cannot find anywhere to view/delete it by winbox or terminal, I can ...

sam1275

Hello. I reported the issues about UPNP: http://forum.mikrotik.com/viewtopic.php?f=1&t=116854&p=577648 I cannot expect Mikrotik to fix them any soon, so I want to manually solve the second problem. It seems to be difficult to delete a rule based on creation time, but at least I want to delet...

sam1275

Hello, there's a few problems with Mikrotik UPNP: 1. The UPNP rules not working after WAN IP changed: http://forum.mikrotik.com/viewtopic.php?f=2&t=110359&p=555301 The UPNP rules are bounds to WAN IP only by default, not the WAN interface. I found a solution in the post, but that need manual...

sam1275

Hello, I noticed in the export file there are many "\" symbols which seems doing nothing, just break the long line to multiple short ones. But I don't want it, is it possible to force export without "\" ? Thank you.

sam1275

After assign multiple IP to my server and not using the NAT method anymore, it's fully working now. The router also can resolve DNS.

sam1275

Thank you so much Sob.
It confused the hell out of me when I see 17 while only 2 listing....
I think I may not use this NAT method and just assign several IPs to the DNS server, that will solve the problem.

sam1275

Can you ping the dns servers?

Sent from my Nexus 5 using Tapatalk

Of course not, they are fake addresses.
However if you mean the real address 192.168.88.5, yes I can.

sam1275

Could anyone explain this picture in my previous post?

It shows 17 caches in use but only 2 in the list, I just checked and it's still like that right now... Why?

sam1275

I tried ping from ssh, yes you guys are right, it not work now...

sam1275

Yes, itself can resolve any host, ... But how? Your previous thread was about making fake addresses and redirecting DNS traffic going to them to another host and non-standard ports. It can work fine when other devices try to access those fake addresses. But when you give same fake DNS resolvers to ...

sam1275

Try to use src-nat with dst-nat to guarantee DNS answer passed through the router and then de-nated rightly.

Could you give me a sample script please? Thank you.

sam1275

DNS cache will hapily cache DNS cahce replies, but you have to allow larger packets (I think that default was already changed to 4096 packet size) That usually fixes dnsec issues.

Thanks, but it still not work when it is 4096.

sam1275

If it's the same router that does dstnat for those fake addresses, then it can't work with them, because output packets from router won't go to dstnat chain. I'm wondering where it got address for "mikrotik.com" from... I just tried "check update" in packages and it says "c...

sam1275

If it's the same router that does dstnat for those fake addresses, then it can't work with them, because output packets from router won't go to dstnat chain. I'm wondering where it got address for "mikrotik.com" from... Thank you, so there's no workaround available? Yes, itself can resolv...

sam1275

Hello people. Days ago I setup a DNScrypt server in my network: http://forum.mikrotik.com/viewtopic.php?f=2&t=115965 It works, but the router's built-in DNS service refuse to work with it, please see pictures: https://s29.postimg.org/uezi5k3yv/image.png https://s29.postimg.org/u3i1ssniv/image.pn...

sam1275

Okay I test it my self, very successful, appreciate your help!

sam1275

So the final script will be this: /ip firewall nat add chain=dstnat dst-address=192.168.10.50 protocol=udp dst-port=53 action=dst-nat to-address=192.168.88.5 to-ports=49100 add chain=dstnat dst-address=192.168.10.51 protocol=udp dst-port=53 action=dst-nat to-address=192.168.88.5 to-ports=49101 add c...

sam1275

If you want method #1, this should do the trick: /ip firewall nat add chain=dstnat dst-address=192.168.10.50 protocol=udp dst-port=53 action=dst-nat \ to-address=192.168.88.5 to-ports=49100 add chain=dstnat dst-address=192.168.10.51 protocol=udp dst-port=53 action=dst-nat \ to-address=192.168.88.5 ...

sam1275

I'm probably missing something, but instead of all this, don't you want to just give 192.168.88.5 (DNSCrypt server) as the only DNS resolver to clients? Thank you, problem is the I have many DNScrypt resolver in use for fail over, and in the current version of DNScrypt proxy software, each resolver...

sam1275

I just tried Hairpin NAT: http://wiki.mikrotik.com/wiki/Hairpin_NAT /ip firewall nat add chain=dstnat dst-address=192.168.10.50 protocol=udp dst-port=53 \ action=dst-nat to-address=192.168.88.5 add chain=srcnat out-interface=ether8-gateway action=masquerade /ip firewall nat add chain=srcnat src-addr...

sam1275

Hello. Since Mikrotik have no plan to add a DNScrypt function, I just setup one myself, now the DNS proxy server run several instance at the same IP same time, but on different port, but here's some problems: 1. Neither Mikrotik nor Windows support DNS not on port 53. 2. So I try a workaround: set t...

sam1275

Hello. My router is RB2011UiAS, so no serial port available. 1. How can I know which bootloader is currently in use(main or backup)? 2. Can I downgrade the bootloader, or overwrite it with the same version? 3. If I'm currently using the backup bootloader, and I issue a upgrade command, will the upgr...

sam1275

Update packages are verified by the system for valid signature before installation.

Thank you, What's signature algorithm does it use(MD5/SHA-?)? Also will the routerboard firmware(routerboot) update also verify before install?

sam1275

Hello.
I want to know whether the auto update (OS and Routerboot) are using encrypted connection or not?
My internet environment is not good and the ISP/government are constantly hijacking DNS and websites, so I'm worrying of download malicious codes to my router by update it.
Thanks.

sam1275

Hello, will the metarouter's RTC auto sync with the host router? Thanks.

sam1275

Still no plan at all?
There's many other people/threads also require this feature.
I live in a bad country that the government/ISP always poison the DNS, I have to try other router/firmware to prevent this.
RouterOS is very good, but lack this feature is a big disappointing.

sam1275

I find the solution myself! Just create a rule manually, all parameter as the same as the previous UPNP rule, except fill the "dst. address" as "!192.168.0.0/16", instead of the WAN address, it works! This solution is limited to the internal network has only one client device No...

sam1275

I find the solution myself!
Just create a rule manually, all parameter as the same as the previous UPNP rule, except fill the "dst. address" as "!192.168.0.0/16", instead of the WAN address, it works!

sam1275

Hi everyone. I forwarded some ports through UPNP, and I want to make them not disappear when router reboot, but I find no "make static" button (just like DNS server lease can), then I try to reproduce the same rule manually so it will not mark as dynamic, but then I find a bigger problem: ...

sam1275

When will this version become release?

sam1275

This is already in the openwrt, ddwrt, cisco IOS, juniper, tomato, pfsense.....and maybe more...
I love routeros very much and I just think this feature should exist, as it is more "basic" than those amazing features in routeros, and it really improve security by prevent many DNS attack.

sam1275

Hello.
Do anybody know when will DNSsec and/or DNScrypt feature add to RouterOs? Or at least any plan? I really want them!
Thanks.

sam1275

It isn't possible. Maximum you can get is use a capable virtual OS on CCR devices with tileGX architecture, when metaROUTER will be available (possibly in RouterOS v7).

Thank u.

sam1275

Hi everyone.
I've got a CCR1016 and I want to use it as a general purpose device, I found someone boot into Debian on a routerboard on google, but he's was not CCR, and he uses ethboot, I want to boot from nand, at least usb HDD, is it possible?
Thanks.

sam1275

Hi. I noticed on the LCD that my router have 2kbps RX and 256-500~bps TX with WAN LED flashing regularly, even no clients are powered on, then I checked: No strange logs except some port flap Only pptp is enabled in firewall/ports No strange connection listed except winbox from my computer to router...

sam1275

Hi. I'm using 6.32.3 budfix, and I find something wrong: even if I set never store DHCP lease on disk, it seems still do, because all leases still exist after a reboot, and the timeout is continue the same before reboot. I'm sure some of the clients is not online so they are not new leases, and if I...

sam1275

Hi everyone.
I just want to know is the cached and buffered RAM calculated as used or free RAM in router OS?
OPENWRT have a dedicated text to show these memory, and tomato can be choose for how to show them, but what about ROS?
Thank you!

sam1275

Removable main storage would be great, at least should be added to CCR series, in fact I don't know why high-end CCRs have removable RAM, but fixed flashes, it is extremely difficult to replace them when fails, and flash do have a life limit.

sam1275

Thank you.

sam1275

Hello. I want to know what will happen if fans inside CCR fails, do those CPU have thermal protection to throttle or hang the system to prevent burn up?

sam1275

Hello. 1. You can look at the log to see if there really anyone got into your router. 2. If yes, you can also check history to see what he did to your router, it will be easier than check the log. ---If yes 3. Restore settings if you have backup. 4. Reset to default if you're really hacked, and don'...

sam1275

Yes you can use that USB adapter to reinstall the DOM. Download netinstall http://download2.mikrotik.com/routeros/6.30.4/netinstall-6.30.4.zip to a windows PC or VBOX image. Do the same with ROS 6.30.4 x86 ( http://download2.mikrotik.com/routeros/6.30.4/routeros-x86-6.30.4.npk Start netinstall, loo...

sam1275

You can try netinstalling it if it has removable storage. I'd stay on bugfix version, 6.30.4 Cannot you get to its BIOS via its console? If its storage isn't removable you could try netinstalling it (bootp)... Hi. Yes it have a removable DOM with 44pin IDE, I installed the OS by connect it to a USB...

sam1275

Ok it's a sad story. I got a Firebox II because I like trying old hardwares, it will not work well even on m0n0wall, but when I try routerOS it really make me shock, high throughput and tons of features with little hardware use. So I buy a L4 license just an hour ago, even the timer seems stuck at 1...

sam1275

Hope one of these features add in v7, to improve DNS security.

sam1275

Hi, both intel and AMD are x86 constructions, but they still have different IPC, now you want to compare different constructions? They of course have diff in speed - not only IPC, but they also run different instructions set. Tilera is ARM based, in my mind, x86 > PPC > ARM > MIPS, but I'm not sure ...

sam1275

Hi everyone, I bought a RB532 from ebay(I like old hardware and I like Mikrotik, so I buy this basically to try and have fun).Seller says it's brand new. When I got it and power it on, I found it seems doesn't boot, the 2 LED (blue and orange) on the bottom of the six lit all the time, the WAN port ...

sam1275

Turning off 'Dial on demand' will cause it to always dial, but I don't think it gets around this issue? Wonder if this is the root cause of my issue with MLPPP not recovering from any of the lines going down.. I am using the same model, and I believe the same firmware version. I'm using my router w...

sam1275

Hi OP.
I have a similar problem post:
http://forum.mikrotik.com/viewtopic.php?f=2&t=97551
Sam

sam1275

Hi everyone. My router is RB1011UiAS-2HnD-IN, but I found I have problems connect to the wireless with 11b devices, my HTC XV6700 can see the AP but cannot connect anyway, even if I allow the TKIP as someone said in another forum; my Palm TX cannot even see my hot spot... How can I solve this proble...

sam1275

Hi everyone. I have a VPN account with several servers available, now I want to archive these with my routeros: 1. Let the router connect as a client to one of the VPN server. 2. Router act as a VPN server and relay the VPN service, allow several local clients use the same VPN service at the same ti...

sam1275

ROS is Linux. Linux is an operating system. Is "powering-off" standard method for closing OS ? Shutdown is much, much better. I know that ROS mostly runs from memory so "power-off" is not so destructive but sooner or later it could be a disaster. Thank you. In fact I never unplu...

sam1275

Thank you very much everyone!

sam1275

Hi everyone. It maybe a stupid question, but I want to know the key reason of why RouterOS needs to shutdown by software first while other routers not, even routers with OPENWRT or other powerful firmware, we just unplug the power if we what to switch them off... So what made RouterOS different at t...

sam1275

I don't need to divide evenly, I just don't want one or more "bad" client to eat up all bandwidth Right. That's why I used the word "fairly" instead of "equally" ;) that router have a auto-QOS which test the upload speed every certain period, and thus don't need to man...

sam1275

If you set your parent queue to be use the hardware negotiated rate (100Mbps or 1Gbps) as the max-limit, you're in essence doing exactly that. But if your ISP is not actually able to give those speeds, you're not going to get any good results. It's not theoretically possible for bandwidth to be div...

sam1275

Hi everyone.
I want to implement QOS function in my router, but all solutions I found need to set a fixed speed in the script, is there any script to archiving QOS without a fixed bandwidth?
Thanks

sam1275

I dont think that last seen is reliable value. At least not for me: lastseen.jpg The 50thousand days is definitely not correct value.... WOW, that's a bug for you.... My last seen time is much more reliable, but it depends on client type, windows 7 clients will renew every several minutes, but XP b...

sam1275

I have provided many options to you. Try them.

Thank you. I'm using DHCP last seen time to see which client active at what when...
It's not that real-time, but it's the best I can find to run with read a only access.

sam1275

what is the problem? you can use the torch to see what traffic goes where... You can also use queues by clients address. Or you can use some NMS, like mikrotik Dude and check the running clients by ping. You can use netwatch to check the clients by ping also. You can shorten the lease time of dhcp ...

sam1275

See the torch.

Thank you, but that tool seems more like firewall / connections, not clients, and it need to "run" and admin access.

sam1275

Hello everyone. There are several computers connected to my router by L2 switch, I want to see who is online. I cannot just look at the LED because they will always stay on because the switch is on, and several clients may on the same interface... DHCP server / leases helps a little but it's not rea...

sam1275

You should ask the government to also block the ads then ;) But seriously, adblocker list will not work the same way in router as in the browser. If you block these URLs in the router, the browser will try to load these pages, you will have longer waiting time, and a lot of 404 or 403 errors in the...

sam1275

So the opendns already blocked the ads? I'm already using it... Thanks. It depends on how you configure it. It will never act as a real adblocker, I think, but at least it can block malicious ads. Thank you, in fact I'm using Adblocker's list in my main computer (by IE's tracking protection), and f...

sam1275

That list looks way too broad, installing that in a webfilter will probably break legitimate sites that happen to have one of those patterns in a URL somewhere. When you want to block at host level instead of URL pattern, I would advise to check filtered DNS services like OpenDNS. You can just set ...

sam1275

you could only use this in conjunction with the transparent webproxy functionality, somehow read the list, and update the proxy access list in RouterOS. I don't think this is a good idea, such large list would overload the device, maybe if you have really powerful hardware Thank you, are there any ...

sam1275

Hi everyone. I just got my routerboard finally works well, now I want to use it to do more powerful and automated firewall, and even ADs block. I known some common methods to easily do this, such as host file or url blocking, but they are too limited, I mean, they cannot block many ADs and they are ...

sam1275

You can change that under IP>Firewall>Connections Thank you, do you mean shorten the TCP time out? but I don't want them to time out when using, I want the router to delete idle connections, for example, a client disconnected from the router 10 minutes ago, then delete all connection with that clie...

sam1275

Hi everyone, I found I have over 1000 connections in the firewall connection list, and most of them are generated by clients already disconnected from my router, but they are still waiting the 24h time out.
Is there any way to remove them automatically after clients disconnected?
Thank you.

sam1275

Issue: PPPoE Bug?-"terminating" Forever Description: PPPoE dial-out won't reconnect automatically after failing when "dial on demand" is enabled. Versions affected: Metal 2SHPn with OS 6.28, RB2011UiAS-2HnD-IN with OS 6.29.1 How to reproduce: First factory reset to default, then ...

sam1275

Code: Select all
/export verbose 

Thank you very much!

sam1275

Hi everyone.
I just found this: http://forum.mikrotik.com/viewtopic.php ... 49#p417649
Now I want to know how to force export everything, not the new default compact mode?
Thank you.

sam1275

Thank you everyone, I just read my rsc file and find it doesn't content any user password, but it do show WIFI and PPP passwords, what else I need to configure manually if I recovered by rsc file from default resetting?

sam1275

Hi everyone, there seems 2 different method to backup/restore RouterOS configuration: use "file" to generate a .backup file, or "/export file=12345.rsc" in console to generate a .rsc file. I found .backup file is bigger and contains more information, for example, it will become b...

sam1275

Hi all! I found a problem when using routerOS in home environment, here's how to reproduce it: First factory reset to default, then setup to "Home AP" mode in quick setup, choose PPPoE for WAN, then setup a few WLAN and admin password. Now go to the PPP and open your PPPoE interface, in &q...

sam1275

Hi.
I'm using RB2011UiAS-2HnD with 6.29.1, no problem at all...

sam1275

OK then: http://youtu.be/a3uJ8AbaLjA

Success!!!!!
Thank you very much...

sam1275

https://www.youtube.com/watch?v=t8eHJwDdnGk

He just block the Lens for a few seconds, then already opened...

sam1275

I took off 2 screws and cannot go any further... Please help.

sam1275

Yes. There are openwrt metarouter packages for example.

Thank you, but Openwrt is also a router system, I want to know is it possible to run a more general-propose OS like debian...

sam1275

Hi everyone.
Is it possible to virtualize a general-propose OS inside RouterOS? Such as running BOINC...
Thanks.

sam1275

is the only difference is the 512MB ram instead of 2GB? Any other difference?
No.
use "at least DDR2 667" RAM to replace, but the picture showing bootloader shows it can work as high as DDR2 533, why is that?
Who cares? Why use something slower?

Thank you, I'm just curious.

sam1275

Hi forum.
Is there a protection if a router board overheat? Will it slow down the CPU or suspend the system, or just continue full speed running? Thanks.
Sam

sam1275

Hi everyone, comparing the RB1100AHx2-LM to standard version, is the only difference is the 512MB ram instead of 2GB? Any other difference? Also, in the manual it says one should use "at least DDR2 667" RAM to replace, but the picture showing bootloader shows it can work as high as DDR2 53...

sam1275

Yes, in that case you do this with vlans.

Thank you.

sam1275

Hi everyone, I have a few questions about my Metal 2SHPn. 1. Are there any low gain antenna for it? I want one made by Mikrotik but I cannot find any. 2. I have powered it on a few minutes without an antenna, but it works OK now, I've heard this will damage the RF chip, what's the truth? 3. I want t...

sam1275

If I understood correctly you want one wireless interface to be station and AP at the same time? That is not possible. wireless interface can be eiter AP or station but not both. Thank you, but sorry I mean I want one wireless interface to be station and client at the same time, it receives from an...

sam1275

I want to dial PPPOE through WLAN1 to internet while use WLAN1 as the router LAN port at the same time.

sam1275

What do you want to accomplish exactly? A wireless link between both APs?

Thank you, I want it to dial PPPOE to ISP using WLAN1 instead of ETHER1 while remain the wireless router function on WLAN1.

sam1275

Hi everyone. I'm using Metal 2Shpn now, it basically running in home AP mode, so the WAN is ether1 with PPPoE to my ISP, the LAN is wlan1. Now I want to change PPPOE form wired to wireless connection, I'll setup another pure AP with wired to modem, to be more clear: Now: Internet---modem---Mikrotik ...

Search found 110 matches