Community discussions

MikroTik App

Search found 6506 matches

  • 1
  • 2
  • 3
  • 4
  • 5
  • 22
by pe1chl
Sat May 30, 2020 12:42 pm
Forum: Beginner Basics
Topic: Unable to reset router
Replies: 1
Views: 153

Re: Unable to reset router

You need to precisely time your button press, when you press it too long it will not work. You press the button and plugin the power, then you watch the LED to first come ON and then after a few seconds starts blinking. Now IMMEDIATELY release the button. (ignore the spurious blinks that happen imme...
by pe1chl
Sat May 30, 2020 12:38 pm
Forum: General
Topic: IPv6 conntrack issue [SOLVED]
Replies: 5
Views: 1007

Re: IPv6 conntrack issue [SOLVED]

This is the difference between inexpensive equipment like MikroTik and more expensive (or from a manufacturer with longer experience) like Cisco.
Snooping features and other enterprise-level switching features are lacking from MikroTik switches. But of course they are a lot cheaper too.
by pe1chl
Fri May 29, 2020 11:10 am
Forum: Announcements
Topic: v6.47rc [testing] is released!
Replies: 52
Views: 10291

Re: v6.47rc [testing] is released!

once an interface is getting renumbered (read: it looses a certain previous GUA) either automatically (via pool addressing) or manually (/ipva address remove X) RouterOS should send a last RA with the disappearing prefix to the network with valid-lifetime = 0. this shall flush all the caches on the...
by pe1chl
Wed May 27, 2020 7:37 pm
Forum: Announcements
Topic: Winbox v3.24 released!
Replies: 28
Views: 8665

Re: Winbox v3.24 released!

I am running winbox (32-bit) under wine on a Debian system. Maybe it behaves differently on a native Windows system? Sounds plausible. I run Winbox (64-bit) natively on Win10. And (simply out of curiosity) I have just tested 32-bit version, which also works fine for me. It would be interesting to h...
by pe1chl
Wed May 27, 2020 4:10 pm
Forum: Announcements
Topic: v6.47rc [testing] is released!
Replies: 52
Views: 10291

Re: v6.47rc [testing] is released!

When ipv6 changes, win10 can get the new address normally, but it cannot be used. It is necessary to disconnect the network port and restart. When can it be fixed, this problem has been for many years. Does it work after half an hour? That is the RA Lifetime defined in IPv6->ND. A known bug is that...
by pe1chl
Wed May 27, 2020 4:03 pm
Forum: Announcements
Topic: Winbox v3.24 released!
Replies: 28
Views: 8665

Re: Winbox v3.24 released!

I am running winbox (32-bit) under wine on a Debian system.
Maybe it behaves differently on a native Windows system?
I have seen others confirm this problem in the release topics of earlier versions (3.22 and 3.23)...
by pe1chl
Wed May 27, 2020 2:19 pm
Forum: Announcements
Topic: Winbox v3.24 released!
Replies: 28
Views: 8665

Re: Winbox v3.24 released!

The problem with windows that have dynamic updates remains the same, I went back to 3.21 after 10 seconds of test... To reproduce: open a window like "IP firewall filters" in a router that is in active use, and make sure the hit-counts of firewall rules are being displayed (and changing all the time...
by pe1chl
Wed May 27, 2020 1:58 pm
Forum: General
Topic: Malwarebytes flags Winbox as malware
Replies: 8
Views: 995

Re: Malwarebytes flags Winbox as malware

Ok "malware" is maybe a bit of an overstatement, but marking as "unusableware" would be appropriate...
by pe1chl
Tue May 26, 2020 9:40 pm
Forum: Announcements
Topic: v6.47rc [testing] is released!
Replies: 52
Views: 10291

Re: v6.47rc [testing] is released!

Did someone check if the breakage of IPsec in beta60 has been completely fixed? (it is not mentioned in the release notes) I'm a little cautious, but...yes So far so good..at least to the parts of IPSec that I am using. Ok thanks! I updated one router that is not so critical and it appears to work ...
by pe1chl
Tue May 26, 2020 5:03 pm
Forum: Announcements
Topic: v6.47rc [testing] is released!
Replies: 52
Views: 10291

Re: v6.47rc [testing] is released!

Did someone check if the breakage of IPsec in beta60 has been completely fixed?
(it is not mentioned in the release notes)
by pe1chl
Tue May 26, 2020 3:48 pm
Forum: Beginner Basics
Topic: Inter-VLAN Routing problem (VLAN Bridge implementation) [SOLVED]
Replies: 5
Views: 638

Re: Inter-VLAN Routing problem (VLAN Bridge implementation) [SOLVED]

The reason is that the firewall in the PC has some allow rules for traffic that originates on the local subnet, but not for traffic from your other network. That traffic is blocked. When you setup NAT the PC sees a source address in the local network and allows it. You need to fix this in the PC fir...
by pe1chl
Tue May 26, 2020 11:40 am
Forum: Beginner Basics
Topic: Inter-VLAN Routing problem (VLAN Bridge implementation) [SOLVED]
Replies: 5
Views: 638

Re: Inter-VLAN Routing problem (VLAN Bridge implementation) [SOLVED]

Wireshark on the destination PCs shows that Ping request arrives (with correct source and destination addresses). But it generates no response! So the problem is not in the router, it is in the PC! It has no route for your other network, or it has a firewall that blocks ping from outside the local ...
by pe1chl
Sun May 24, 2020 9:09 pm
Forum: Wireless Networking
Topic: 4k over wifi
Replies: 28
Views: 3370

Re: 4k over wifi

I normally have no need for something as complicated as Diffserv, having a couple of different priorities as 802.11e and WMM specify is good enough. So the simple mapping of high-3-bits to priority (and then back to 4 priorities in WMM) is good enough for my usage. When you want it to be complicated...
by pe1chl
Sun May 24, 2020 12:46 pm
Forum: Wireless Networking
Topic: 4k over wifi
Replies: 28
Views: 3370

Re: 4k over wifi

It is a bit of a pity that that article does not contain any examples, and that the "by default usually wanted" configuration of "take priority from DSCP" is not included in the default config of RouterOS (as it is on almost any other manufacturer's WiFi equipment). That can make MikroTik APs look b...
by pe1chl
Sat May 23, 2020 8:57 pm
Forum: General
Topic: NPTv6 / RFC 6296 Support?
Replies: 25
Views: 6424

Re: NPTv6 / RFC 6296 Support?

Yes, it would be good to have.
But without IPv6 policy routing, still not very useful for the use case you present... you need a different default route for each link, selected by source address.
Possible in RouterOS in IPv4, but not in IPv6.
by pe1chl
Sat May 23, 2020 12:21 pm
Forum: RouterOS v7 BETA
Topic: mangle and routing-mark can not work for RouterOS v7
Replies: 9
Views: 2507

Re: mangle and routing-mark can not work for RouterOS v7

I hope Mikrotik implemented SQM and fixed those bugs in beta 6, otherwise why would it take so long?
We hear "v7" already for 10 years or so, why would it take so long?
Apparently it does not have the necessary priority...
by pe1chl
Fri May 22, 2020 7:29 pm
Forum: Wireless Networking
Topic: 4k over wifi
Replies: 28
Views: 3370

Re: 4k over wifi

/interface ethernet set [ find default-name=ether1 ] name=WAN speed=100Mbps set [ find default-name=ether2 ] speed=100Mbps set [ find default-name=ether3 ] speed=100Mbps set [ find default-name=ether4 ] speed=100Mbps set [ find default-name=ether5 ] speed=100Mbps You don't trust the auto negotiatio...
by pe1chl
Fri May 22, 2020 3:10 pm
Forum: General
Topic: Best way to prevent attack from external
Replies: 9
Views: 1249

Re: Best way to prevent attack from external

Of course the solutions that @jvanhambelgium presented are much better than such a generic blacklist, that will only help against mass portscanning and not cater for some targeted attack on his router.
by pe1chl
Fri May 22, 2020 2:24 pm
Forum: General
Topic: Best way to prevent attack from external
Replies: 9
Views: 1249

Re: Best way to prevent attack from external

This kind of solution is a bit risky. Lately I have been seeing several incoming port scans where the source address was spoofed to be e.g. 8.8.8.8 or 1.1.1.1 or 1.0.0.1 etc. These scans apparently assume that you would have some mechanism like that and then those addresses will get added to your bl...
by pe1chl
Fri May 22, 2020 11:49 am
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

I would say that hosting two PBXes behind a NAT router is just asking for big problems... you are just lucky when it works. When you want to host a PBX on a public address (for outsiders to use), and even more when you want to host two of them, get some small subnet (like a /29) and use a routing th...
by pe1chl
Thu May 21, 2020 8:13 pm
Forum: General
Topic: CCR 1009 - IPSEC throughput
Replies: 15
Views: 2073

Re: CCR 1009 - IPSEC throughput

As I said I have no idea how (if at all) it would split the load for multiple sessions in the current version. In the original software for the CCR it just put all cores to work on packets as they arrived and cores were available, which of course resulted in high speeds but also in packet reordering...
by pe1chl
Thu May 21, 2020 1:36 pm
Forum: The Dude
Topic: graphic logging fails when an interface exceeds 3.4Gbps approximately.
Replies: 12
Views: 2455

Re: graphic logging fails when an interface exceeds 3.4Gbps approximately.

I also abandoned the Dude after some evaluation.
It is too cumbersome to get it configured in a large network and I don't want to risk losing all my config work due to e.g. a corrupt database and no documentation on how to repair it.
by pe1chl
Thu May 21, 2020 1:31 pm
Forum: General
Topic: CCR 1009 - IPSEC throughput
Replies: 15
Views: 2073

Re: CCR 1009 - IPSEC throughput

I have no idea how the CCR distributes streams over cores in such cases (if it does that at all). My experience with CCR routers is only in "realistic" networks with hundreds of sessions operating in parallel, not such "benchmarking" cases. (e.g. in our main office at work all user systems are on 10...
by pe1chl
Wed May 20, 2020 11:46 pm
Forum: RouterOS v7 BETA
Topic: Feature Request: GREtap
Replies: 8
Views: 1785

Re: Feature Request: GREtap

I think it is mostly caused by not knowing the invented protocol already exists and is registered under another protocol number. I know a similar case in IPIP tunnel which uses IP protocol 4, but another protocol which is exactly the same was registered much later under protocol number 94. (and fell...
by pe1chl
Wed May 20, 2020 10:33 pm
Forum: RouterOS v7 BETA
Topic: Feature Request: GREtap
Replies: 8
Views: 1785

Re: Feature Request: GREtap

Ok... it should then be possible to make a selection option in the EoIP interface menu and make it compatible. A bit of a pity that MikroTik defined their own protocol type for this, while a "standard" type already existed for a long time (it appears). Of course they now cannot simply change it. But...
by pe1chl
Wed May 20, 2020 9:00 pm
Forum: General
Topic: DNS cache records
Replies: 2
Views: 475

Re: DNS cache records

These are names that a system on your local network requested, and that are cached on the router in case they are requested again.
The gtld-servers.net entries are the root nameservers.
by pe1chl
Wed May 20, 2020 8:57 pm
Forum: Beginner Basics
Topic: RB2011iL bottleneck to 400mbps internet connection
Replies: 5
Views: 661

Re: RB2011iL bottleneck to 400mbps internet connection

You forgot to include your config.
Did you update the RouterOS? Did you recently reset it to defaults?
by pe1chl
Wed May 20, 2020 7:32 pm
Forum: Beginner Basics
Topic: Vendor question
Replies: 8
Views: 988

Re: Vendor question

I did do a full reset with the physical button and have 6.46.6 with a fresh configuration. All my remarks are based on this. I used the physical button for a full hard reset. Then probably you made a small mistake and this full hard reset did not take. You need precise timing to do that successfull...
by pe1chl
Wed May 20, 2020 7:30 pm
Forum: The Dude
Topic: graphic logging fails when an interface exceeds 3.4Gbps approximately.
Replies: 12
Views: 2455

Re: graphic logging fails when an interface exceeds 3.4Gbps approximately.

Ok I misread that...
You need to make sure that the polling interval is such that you cannot have more than 2^32 bytes of traffic in that interval.
The actual interval you need is depending on the maximal speed of your link.
by pe1chl
Wed May 20, 2020 5:40 pm
Forum: The Dude
Topic: graphic logging fails when an interface exceeds 3.4Gbps approximately.
Replies: 12
Views: 2455

Re: graphic logging fails when an interface exceeds 3.4Gbps approximately.

Do you have the admin login for RouterOS devices (or another username you have added) configured, in addition to SNMP?
by pe1chl
Wed May 20, 2020 5:15 pm
Forum: The Dude
Topic: graphic logging fails when an interface exceeds 3.4Gbps approximately.
Replies: 12
Views: 2455

Re: graphic logging fails when an interface exceeds 3.4Gbps approximately.

It does not support it for SNMP but it should support it for RouterOS API in current version.
by pe1chl
Wed May 20, 2020 5:04 pm
Forum: The Dude
Topic: graphic logging fails when an interface exceeds 3.4Gbps approximately.
Replies: 12
Views: 2455

Re: graphic logging fails when an interface exceeds 3.4Gbps approximately.

Your version is very old, time to update...
But that will not solve this problem. It is a known problem, it can only be worked around by selecting a smaller poll interval.
by pe1chl
Wed May 20, 2020 12:25 pm
Forum: RouterOS v7 BETA
Topic: Feature Request: GREtap
Replies: 8
Views: 1785

Re: Feature Request: GREtap

RouterOS has EoIP for that. It is the same thing.
by pe1chl
Wed May 20, 2020 12:22 pm
Forum: Wireless Networking
Topic: 4k over wifi
Replies: 28
Views: 3370

Re: 4k over wifi

Connect PC or TV (or preferably both) using an ethernet cable!
Use WiFi only where it is required, e.g. mobile devices.
by pe1chl
Wed May 20, 2020 12:04 pm
Forum: Beginner Basics
Topic: Does RouterOS block NTP traffic by default?
Replies: 19
Views: 1582

Re: Does RouterOS block NTP traffic by default?

In the original NTP implementation there is (besides the normal "gimme the time" request) a debugging request that asks the timeserver for the last 1000 or so clients it has seen, returning their IP address, number of requests, average time between requests, etc. The reply is obviously quite large, ...
by pe1chl
Wed May 20, 2020 11:15 am
Forum: General
Topic: CCR 1009 - IPSEC throughput
Replies: 15
Views: 2073

Re: CCR 1009 - IPSEC throughput

I knew that for single tunnel only 1 core will be used, what I don't fully understand is that why my "numbers" differ so much from the datasheet for single tunnel and why my CPU won't even max out. I don't know that, I never studied it in that detail. However, I think it is not impossible that the ...
by pe1chl
Wed May 20, 2020 11:09 am
Forum: Beginner Basics
Topic: Does RouterOS block NTP traffic by default?
Replies: 19
Views: 1582

Re: Does RouterOS block NTP traffic by default?

This seems like the right direction, but I'm concerned about one thing. I have multiple devices at my home (4 PCs, 3 cell phones). If I add the src-nat rule, does that mean that my router will route them ALL through the same destination port? Won't that end up confusing everything? Also - where in ...
by pe1chl
Tue May 19, 2020 7:28 pm
Forum: Beginner Basics
Topic: Vendor question
Replies: 8
Views: 988

Re: Vendor question

What do you mean with "firewall options"? Do you mean "firewall rules"? If so, what you find there depends on the RouterOS version that was present when the unit was first initialized. After having update this, you should do a "reset to defaults" to get that aligned to the current RouterOS version. ...
by pe1chl
Tue May 19, 2020 12:37 pm
Forum: Beginner Basics
Topic: Does RouterOS block NTP traffic by default?
Replies: 19
Views: 1582

Re: Does RouterOS block NTP traffic by default?

No, RouterOS does not block NTP traffic by default. Where you go wrong: "however I'm behind a NAT, so the port number visible to my ISP will probably not be 123". That is not the case, at least not for a single NTP session. RouterOS will try to keep the port number unchanged. Only when it cannot do ...
by pe1chl
Tue May 19, 2020 12:29 pm
Forum: General
Topic: CCR 1009 - IPSEC throughput
Replies: 15
Views: 2073

Re: CCR 1009 - IPSEC throughput

The new generation of CCRs are based on ARM64, which means TILE is officially abandoned, so don't expect much. I expect the issue is not as much that it is TILE vs ARM64 but more that a multicore architecture cannot be used for accelerating IPsec in parallel on multiple cores (they tried, and faile...
by pe1chl
Sun May 17, 2020 7:45 pm
Forum: Scripting
Topic: How to auto-start a script at interface link up / down ? [SOLVED]
Replies: 30
Views: 3781

Re: How to auto-start a script at interface link up / down ? [SOLVED]

It is not possible in the generic case. In some special cases it is, e.g. for a PPP-type interface. The workaround is to make a script that is scheduled at some interval, and keep the previous status in a global variable. You script compares the current status with the previous status in the global ...
by pe1chl
Sat May 16, 2020 7:45 pm
Forum: General
Topic: No internet via non-main routing tables if missing default route on main [SOLVED]
Replies: 21
Views: 2227

Re: No internet via non-main routing tables if missing default route on main [SOLVED]

Actually, rp-filter=loose does absolutely nothing in any router config where a default route is present and not explicit "unreachable" routes. I usually put such routes in the table: /ip route add distance=1 dst-address=10.0.0.0/8 type=unreachable add distance=1 dst-address=100.64.0.0/10 type=unreac...
by pe1chl
Sat May 16, 2020 5:56 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

beta60 is seriously broken, I think the situation that it is availble for those who want to test it but is not suggested to others is perfectly fine.
(unfortunately it is still suggested in the system->packages on the router itself)
by pe1chl
Sat May 16, 2020 5:33 pm
Forum: General
Topic: No internet via non-main routing tables if missing default route on main [SOLVED]
Replies: 21
Views: 2227

Re: No internet via non-main routing tables if missing default route on main [SOLVED]

/ip settings set rp-filter is generally unusable. it is too rigid and it cannot be monitored. there is a way to mark packets failing rpfilter in the mangle table in generic Linux but RouterOS lacks that possibility. with that marking it is at least possible to log and view packets that get dropped a...
by pe1chl
Sat May 16, 2020 1:37 pm
Forum: General
Topic: No internet via non-main routing tables if missing default route on main [SOLVED]
Replies: 21
Views: 2227

Re: No internet via non-main routing tables if missing default route on main [SOLVED]

You are providing far to little information to say anything meaningful about it. Likely there are other things involved like IPsec. And it also depends on what your route rules and firewall mangling rules (w.r.t. routing) look like. Please provide a representative export showing what you are doing. ...
by pe1chl
Fri May 15, 2020 4:31 pm
Forum: General
Topic: tool kid-control
Replies: 58
Views: 20659

Re: tool kid-control

I did try this some time ago, and my kid did change his mac, so did not help at all :lol:
You need a different type of kid-control !!
by pe1chl
Fri May 15, 2020 11:46 am
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

I think they are fiddling with the download server, the situation varies by the hour. Earlier today it showed the release notes for version 5.9 !
Maybe it was restored from a backup. Hopefully it wasn't hacked.
by pe1chl
Fri May 15, 2020 10:57 am
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

What would be the purpose of that? I think a more useful addition would be to have more than one IP->DNS instance so you can have different DNS forwarder configuration for different networks. That already was useful before those extra DNS features were added! E.g. I operate some routers where there ...
by pe1chl
Fri May 15, 2020 10:21 am
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

Apparently something has gone completely wrong at the upgrade server...
When checking for upgrades it now displays a change notes list from the 4.x and 5.x age (see above)....
by pe1chl
Tue May 12, 2020 11:45 am
Forum: General
Topic: IPSec SA negotiation failures (RB2011UiAS-2HnD & ZYXEL VMG3313-B10A)
Replies: 9
Views: 1145

Re: IPSec SA negotiation failures (RB2011UiAS-2HnD & ZYXEL VMG3313-B10A)

My experience with "being behind a NAT" is that for symmetric connections (IPsec tunnel, GRE/IPsec tunnel etc) it only works reliably when you make a static port forward in the NAT router. This is less of a problem for asymmetric connections (like L2TP/IPsec) but there still can be issues e.g. when ...
by pe1chl
Tue May 12, 2020 11:38 am
Forum: Scripting
Topic: Find item by ID
Replies: 3
Views: 449

Re: Find item by ID

The numbers you see in "print" output are NOT the same as the ID! When you do a print command, the router constructs an internal temporary table of all numbers and the corresponding ID, then when you do something which references a number it translates that back to the ID. But this works only in an ...
by pe1chl
Mon May 11, 2020 10:25 pm
Forum: General
Topic: Spontaneous reboots
Replies: 22
Views: 4042

Re: Spontaneous reboots

After rebooting the time is always different from what is was. That is actually completely normal for any reboot caused by a crash or power-fail! (on a MikroTik device) These routers do not have a realtime clock chip. They save the current time in the flash memory once every couple of hours, and wh...
by pe1chl
Mon May 11, 2020 1:57 pm
Forum: General
Topic: gre6 interface trouble
Replies: 8
Views: 1128

Re: gre6 interface trouble

I gave it a try on 6.45.7, and first of all, I couldn't find out how to disable keepalive on /interface gre6 . Just click the up-arrow right of the fields that show interval and count. In a /export it shows up as !keepalive Keepalive is troublesome even on IPv4, it is probably a MikroTik patch comp...
by pe1chl
Mon May 11, 2020 11:09 am
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

2. It's $600 RRP - Keep that in perspective, it is exceptional value!
Of course keep in mind that in most cases you will have to add about the same money for SFP modules...
by pe1chl
Sun May 10, 2020 8:45 pm
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

It appears that the "interface slideshow" (configured in the interfaces screen under the LCD menu) on devices like the CCR1009 has stopped working in this release... Anyone else who can confirm that? For me it's working fine. Tested with 2 interfaces, timeout 10 seconds. After disabling LCD and re-...
by pe1chl
Sun May 10, 2020 11:55 am
Forum: General
Topic: Feature requests
Replies: 1216
Views: 262160

Re: Feature requests

Enable using a global "MAX Speed" parameter you expect on your WAN interfaces. This should then be possible to be used within routeros within queue trees, mangle rules, hotspot etc. Today one needs to define each time an absolute value for Max Limit, Buffer Limit, trigger limit etc.! What a nightma...
by pe1chl
Sun May 10, 2020 11:49 am
Forum: General
Topic: Feature requests
Replies: 1216
Views: 262160

Re: Feature requests

Consider a GeoIP package allowing for firewall filtering by Country
I'm against that. It is completely useless, and it tends to racism.
by pe1chl
Sun May 10, 2020 11:43 am
Forum: Wireless Networking
Topic: [SOLVED] Wi-Fi Broadcast ARP/UDP unexpectedly throttled/blocked
Replies: 15
Views: 1917

Re: Wi-Fi Broadcast ARP/UDP unexpectedly throttled/blocked

multicast-helper=full, despite its name, does seem to also help with broadcast. This is a misnomer, but the following forum post gave me the idea, and I was able to confirm that it did improve arp broadcast packet response rate (not exactly my problem, but very similar). Ok but I think the MikroTik...
by pe1chl
Sat May 09, 2020 8:37 pm
Forum: General
Topic: VLan data center management
Replies: 6
Views: 1742

Re: VLan data center management

Of course first you must decide between building-it-all-yourself or using one of the existing commercial (and also free) implementations that do what you want, e.g. using VXLAN. MikroTik has no support for that I think. When you want to do-it-yourself I would say it is required that you have an empl...
by pe1chl
Sat May 09, 2020 7:28 pm
Forum: General
Topic: gre6 interface trouble
Replies: 8
Views: 1128

Re: gre6 interface trouble

I should say I always disable the keepalive at gre level (both on v4 and v6) as it provides me with no extra function as I always run BGP and often even BFD over the links. Maybe keepalive does not work with gre6? Without keepalive the link of course is always up and running once it is enabled (i.e....
by pe1chl
Sat May 09, 2020 6:12 pm
Forum: General
Topic: gre6 interface trouble
Replies: 8
Views: 1128

Re: gre6 interface trouble

I have a similar thing:

add action=accept chain=input in-interface-list=internet protocol=gre src-address-list=gre6tun
by pe1chl
Sat May 09, 2020 5:51 pm
Forum: Beginner Basics
Topic: Router Speed 1/3 of Direct Connection to Modem
Replies: 12
Views: 1582

Re: Router Speed 1/3 of Direct Connection to Modem

It could work better when you included the fasttrack config in the firewall. E.g. try this: /ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related Of course what mkx wrote also applies, but at the moment you have no firewall at all (apart from the bloc...
by pe1chl
Sat May 09, 2020 5:43 pm
Forum: Beginner Basics
Topic: /system backup containing previous version of edited scripts? [SOLVED]
Replies: 5
Views: 1224

Re: /system backup containing previous version of edited scripts? [SOLVED]

Unfortunately rollbacks are not so easy with /export info (it is not a matter of loading a previous version, you would have to reset without defaults which means you can only do that from a tool that allows MAC-level connection e.g. winbox on the local network) but usually one wants to see what has ...
by pe1chl
Sat May 09, 2020 5:34 pm
Forum: Wireless Networking
Topic: [SOLVED] Wi-Fi Broadcast ARP/UDP unexpectedly throttled/blocked
Replies: 15
Views: 1917

Re: Wi-Fi Broadcast ARP/UDP unexpectedly throttled/blocked

Broadcast packets on WiFi are transmitted without handling of link errors. When you do a normal unicast packet exchange (e.g. a download), the receiving end of the WiFi link sends back "I have received that" when it receives some data, and the sending end watches that and re-sends the data when it d...
by pe1chl
Sat May 09, 2020 5:27 pm
Forum: Beginner Basics
Topic: /system backup containing previous version of edited scripts? [SOLVED]
Replies: 5
Views: 1224

Re: /system backup containing previous version of edited scripts? [SOLVED]

I think it is to be expected. Not only for "undo" but also because it is just a dump of binary configuration as it is now. Just like memory in your computer or a dump of a disk, it will include old items that have only some "deleted" bit set but not the actual content erased. As you know, the /expor...
by pe1chl
Sat May 09, 2020 5:18 pm
Forum: General
Topic: gre6 interface trouble
Replies: 8
Views: 1128

Re: gre6 interface trouble

I am not using that exact version but I use gre6 on some routers and it works at least up to 6.46.3.
by pe1chl
Sat May 09, 2020 5:16 pm
Forum: Beginner Basics
Topic: Router Speed 1/3 of Direct Connection to Modem
Replies: 12
Views: 1582

Re: Router Speed 1/3 of Direct Connection to Modem

You need to include your "/export hide-sensitive" information (the config you are using) to get any meaningful reply to such questions. However, you should understand that the router function of such devices is a lot slower than the switching function. When you want to get the full performance of th...
by pe1chl
Sat May 09, 2020 12:21 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

Sometimes I suspect that Mikrotik finds a good SoC on the market, then creates the product of it, regardless of the usage or market research. I agree with that! This is apparently how it works. Of course, this is partly related to the market segment they try to operate in. When your shiny new SoC h...
by pe1chl
Fri May 08, 2020 8:29 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

If your network rely on a device like that has a certain number of interfaces, performance and memory, and that model suddenly vanish because of an architecture-change, then you have a problem. Oh but that happens without architecture-change! The CCR1009 line originally had 8 ethernet ports and 2 S...
by pe1chl
Fri May 08, 2020 7:43 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

In principle it is totally unimportant what chips MikroTik use and how long they are supported. It is THEIR task to release the RouterOS for the chip, and for us as users it does not matter at all whether the architecture is X86, MIPS, TILE, ARM, ARM64 or whatever. Of course they should try to avoid...
by pe1chl
Thu May 07, 2020 11:48 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

I do have a use case personally. With WiFi6 (802.11ax), useful speeds will exceed 1 gigabit/sec. And if you have > gigabit fiber internet (dreaming is allowed) that's 2 ports in use. Then a new NAS would likely also interface at > gigabit speeds. And hey, no separate switch needed which is a bonus ...
by pe1chl
Thu May 07, 2020 7:24 pm
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

What happens when you use the built-in "system->packages->check for updates" on CCR2004? The check for updates in winbox shows latest version 6.46.6 but in the lower left corner it says: ERROR: missing routeros-arm64-6.46.6.npk I can nowhere find a newer arm64 OS than on the CCR2004 delivered 6.46....
by pe1chl
Thu May 07, 2020 5:04 pm
Forum: General
Topic: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]
Replies: 12
Views: 1510

Re: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]

I would say when you used type rsa and it works on the Mac but not on the MikroTik the key type is not the issue.
(either when you use old types that could be no longer supported (dsa) or new types that are not yet supported by some dated equipment (ed25519) that could have been the problem)
by pe1chl
Thu May 07, 2020 3:42 pm
Forum: General
Topic: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]
Replies: 12
Views: 1510

Re: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]

Maybe the key type you generated (dsa, rsa, ecdsa, ed25519, ...) is not compatible with one of the two sides?
by pe1chl
Wed May 06, 2020 7:45 pm
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

It appears that the "interface slideshow" (configured in the interfaces screen under the LCD menu) on devices like the CCR1009 has stopped working in this release...
Anyone else who can confirm that?
by pe1chl
Wed May 06, 2020 7:41 pm
Forum: RouterOS v7 BETA
Topic: NTP server Issue
Replies: 9
Views: 2899

Re: NTP server Issue

I would not recommend opening an NTP server on a router to clients on internet.
Normally you setup the firewall so that the clients on the LAN can access your server, and your server is client to servers on internet (which is covered by an established/related rule in the input firewall).
by pe1chl
Wed May 06, 2020 5:14 pm
Forum: RouterOS v7 BETA
Topic: NTP server Issue
Replies: 9
Views: 2899

Re: NTP server Issue

I would recommend to use only the ntp server(s) of your ISP, and feed it to an own ntp server in your LAN, and let all clients use that your very own local ntp server... You can do that with RouterOS by installing the NTP package, however it does not work very well. In version 7 beta it is much bet...
by pe1chl
Wed May 06, 2020 3:01 pm
Forum: General
Topic: Where to get list of malicious hosts (sim to spamhaus dshield cymru torlist) and what can replace malwaredomainlist.com?
Replies: 17
Views: 2250

Re: Where to get list of malicious hosts (sim to spamhaus dshield cymru torlist) and what can replace malwaredomainlist.

I still would like it when the DNS based address list feature would: - support more addresses in a single DNS name. limited by memory usage on the router (and thus much higher on CCR etc). - support "subnet" results as well as single addresses (e.g. via TXT records containing 1.2.3.0/24 notation) Th...
by pe1chl
Wed May 06, 2020 12:04 pm
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

What happens when you use the built-in "system->packages->check for updates" on CCR2004?
by pe1chl
Wed May 06, 2020 12:01 pm
Forum: RouterOS v7 BETA
Topic: NTP server Issue
Replies: 9
Views: 2899

Re: NTP server Issue

Yes but that should be fine, as usually an internet time server will get you better time than a GPS mouse. (of course assuming the internet connection is decent and not completely overloaded) Remember a GPS mouse gives time that is accurate only to about 1 second. The thing itself has very accurate ...
by pe1chl
Tue May 05, 2020 5:38 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

It is a bit unclear to me how useful it is to have 170Gbps worth of ports connected via 2x25Gbps bottleneck, and without mutual switching capability. With switching I could see that (the device could be used as a combined router/switch) and maybe it could even do "hardware routing" similar to an L3...
by pe1chl
Tue May 05, 2020 2:52 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

Maybe we should just consider it a replacement for the CCR1009 and put it in the same performance category, with a little more peak performance. The SFP+ slots should be primarily populated with 1Gbit/s interfaces and the occasional 10 Gbit/s. Of the 25Gbit/s interfaces only a single one should be i...
by pe1chl
Tue May 05, 2020 2:29 pm
Forum: Announcements
Topic: v6.46.6 [stable] is released!
Replies: 67
Views: 28593

Re: v6.46.6 [stable] is released!

Does L2TP_IPSec now work? :?
I had to downgrade from 6.47.rc60 to 6.44.6 in order to find a version that would behave normally.
That problem is only in 6.47.rc60 all lower versions are OK
by pe1chl
Tue May 05, 2020 2:25 pm
Forum: Wireless Networking
Topic: DPSK/PPSK individual PSK without preconfig
Replies: 1
Views: 406

Re: DPSK/PPSK individual PSK without preconfig

You can use WPA2-EAP with anon_id+username+password and authenticate them in a RADIUS server. So you can assign new devices a username which does not have to be a MAC address. This has been implemented since a couple of years and we use it all the time (at first it was only implemented on the AP sid...
by pe1chl
Tue May 05, 2020 1:01 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

It is a bit unclear to me how useful it is to have 170Gbps worth of ports connected via 2x25Gbps bottleneck, and without mutual switching capability. With switching I could see that (the device could be used as a combined router/switch) and maybe it could even do "hardware routing" similar to an L3 ...
by pe1chl
Tue May 05, 2020 2:24 am
Forum: General
Topic: IPV6 pppoe cliente over double stack - doesn't work well
Replies: 4
Views: 811

Re: IPV6 pppoe cliente over double stack - doesn't work well

You need to use code 23 for that...
However, you can also add one of those 3 fixed addresses (a Windows thing...) to the bridge interface as a static address.
(assuming you have the mikrotik DNS resolver configured)
by pe1chl
Mon May 04, 2020 6:03 pm
Forum: General
Topic: How to config BOGON FW rules not to block "valid" traffic from my ISP's router if my MikroT is behind it?
Replies: 4
Views: 857

Re: How to config BOGON FW rules not to block "valid" traffic from my ISP's router if my MikroT is behind it?

Filtering BOGON addresses normally is not going to bring you any additional security. Of course it can bring you problems.
When your network skills are not good enough to analyze and solve those problems, I would recommend not trying to setup such filters.
by pe1chl
Mon May 04, 2020 5:43 pm
Forum: General
Topic: MAC telnet from terminal stopped working in new versions
Replies: 7
Views: 1580

Re: MAC telnet from terminal stopped working in new versions

Ok... mac-telnet from telnet or ssh should be possible then.
by pe1chl
Mon May 04, 2020 3:53 pm
Forum: General
Topic: IPV6 pppoe cliente over double stack - doesn't work well
Replies: 4
Views: 811

Re: IPV6 pppoe cliente over double stack - doesn't work well

It should work.
First, remove one of the /ipv6 address lines. You should have only one for each interface.
Furthermore, post something better than "doesn't work well". Tell us what happens and what is wrong in your opinion.
by pe1chl
Mon May 04, 2020 3:49 pm
Forum: RouterOS v7 BETA
Topic: NTP server Issue
Replies: 9
Views: 2899

Re: NTP server Issue

Unfortunately USB devices do not give very accurate time. There already is support for "GPS mouse" devices in RouterOS but frankly the time quality is lousy when compared to network devices. Also, the NTP server in RouterOS v6 is not of very good quality, hopefully it is better in v7 (cannot really ...
by pe1chl
Mon May 04, 2020 11:20 am
Forum: General
Topic: Router using incorrect src-address for its own traffic over IPSEC tunnel
Replies: 6
Views: 1253

Re: Router using incorrect src-address for its own traffic over IPSEC tunnel

There you have another problem. Getting an IPsec tunnel to work with another end you don't control is usually an exercise of extreme hair-pulling.
by pe1chl
Sat May 02, 2020 9:31 pm
Forum: General
Topic: DNS Issues with Primary/Secondary
Replies: 1
Views: 597

Re: DNS Issues with Primary/Secondary

Your problem description is a bit incomplete.
Probably you are running a DHCP server for your client?
Make sure you have the checkmark in NO DNS on the page IP->DHCP server->Networks->your network
by pe1chl
Sat May 02, 2020 6:00 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

Proxy without caching does not incur write cycles...
by pe1chl
Sat May 02, 2020 12:16 pm
Forum: Wireless Networking
Topic: mikrotik Audience placement [SOLVED]
Replies: 1
Views: 676

Re: mikrotik Audience placement [SOLVED]

It depends on the local obstructions.
Normally it will make no difference, but when this change makes it rise above some large metal obstruction (like a metal filing cabinet) it could make a difference.
by pe1chl
Sat May 02, 2020 10:49 am
Forum: Scripting
Topic: no such item (4) - FQDN address-list find where comment=X
Replies: 7
Views: 977

Re: no such item (4) - FQDN address-list find where comment=X

With "I agree with you that there should be some way to catch those errors, preferably just using on-error= or otherwise by setting some mode where such errors are just ignored for the script." of course I mean that this ignore action is only for the current script or current function in a script, n...
by pe1chl
Fri May 01, 2020 10:15 pm
Forum: General
Topic: MAC telnet from terminal stopped working in new versions
Replies: 7
Views: 1580

Re: MAC telnet from terminal stopped working in new versions

That is correct. You will need to put a MikroTik router (or CHR) between your provisioning system and the router to be configured. Then you can connect to the intermediate router via API and have it connect to the new router via mac-telnet.
It is a bit unfortunate, indeed.
by pe1chl
Fri May 01, 2020 10:11 pm
Forum: General
Topic: convert QoS CISCO to Mikrotik
Replies: 3
Views: 2778

Re: convert QoS CISCO to Mikrotik

Such QoS mapping should not be required anymore. Any decent phone already sends its voice data with DSCP=EF without any special matching. You can derive the priority of traffic from DSCP using: /ip firewall mangle add action=set-priority chain=postrouting new-priority=from-dscp-high-3-bits passthrou...
by pe1chl
Fri May 01, 2020 10:02 pm
Forum: General
Topic: Trying to duplicate a SwOS feature on ROS...
Replies: 9
Views: 1539

Re: Trying to duplicate a SwOS feature on ROS...

Maybe you could write a script that does a similar thing, but of course it will take some time to debug it and it will not be as convenient as a built-in feature...
by pe1chl
Fri May 01, 2020 4:47 pm
Forum: General
Topic: One power supply for 2 devices [SOLVED]
Replies: 9
Views: 1332

Re: One power supply for 2 devices [SOLVED]

Will several Mikrotik devices work stably if connect them, in addition to the main power supply, to a single backup power source (for example, 24 V batteries) through passive PoE.
Please re-read answer number 4.
by pe1chl
Fri May 01, 2020 3:51 pm
Forum: General
Topic: PPPoE reconnect script failed [SOLVED]
Replies: 2
Views: 739

Re: PPPoE reconnect script failed [SOLVED]

Just to illustrate what else can go wrong (I think in your case the diagnosis by sindy is likely correct), I have a problem in my router at home: I am connected to a VDSL network which is provided by a telecom provider, and which connects to several ISPs. Apparently inside this VDSL network there ar...
by pe1chl
Fri May 01, 2020 3:41 pm
Forum: General
Topic: Interface problem
Replies: 1
Views: 570

Re: Interface problem

You are providing too little information.
- router model
- /export of your configuration (at least /interface and the method used to connect)
- type of ISP service
by pe1chl
Fri May 01, 2020 3:39 pm
Forum: RouterBOARD hardware
Topic: Audible Alarm on disconnect
Replies: 4
Views: 1056

Re: Audible Alarm on disconnect

Of course it is possible!
You need to write a script that detects the condition and issues a beep command.
And you can schedule this script to run every 30 seconds and perform its action.
I am not going to write this for you, I only want to counter the remark made by @ingdaka.
by pe1chl
Fri May 01, 2020 1:54 pm
Forum: General
Topic: One power supply for 2 devices [SOLVED]
Replies: 9
Views: 1332

Re: One power supply for 2 devices [SOLVED]

With galvanic isolation, you need to differentiate between "large overvoltage" like lightning strike, and the normal voltage differentials found in a large building. For large voltages, fiber is the only safe way. And of course there is no Power-over-Fiber so you will need to arrange local powering....
by pe1chl
Fri May 01, 2020 11:53 am
Forum: General
Topic: Apple devices flooding DHCP server
Replies: 15
Views: 3265

Re: Apple devices flooding DHCP server

Look into a digital signage solution... :-) But seriously, when you run out of DHCP address space you will have to do something, and setting a very short lease time usually will not work because some (Apple!!) devices will not accept a lease with a short duration. I would not dare to go below 1h for...
by pe1chl
Fri May 01, 2020 11:46 am
Forum: Scripting
Topic: API DHCP leases
Replies: 2
Views: 656

Re: API DHCP leases

The bug is in your PHP program. You retrieve an entire array full of rows with DHCP information per host, then you print only the first one.
You need to write a loop to print all elements of the array.
by pe1chl
Fri May 01, 2020 11:44 am
Forum: Beginner Basics
Topic: Slowness for the first few seconds then fast on download
Replies: 17
Views: 2224

Re: Slowness for the first few seconds then fast on download

Slow speeds at the start of a download and then higher speeds after some time is not a bug of the router, it is a feature of TCP. That is how TCP works, and why you see this so often. The sending server cannot know if you are behind a 33k6 telephone modem or a gigabit fiber, hence it starts sending ...
by pe1chl
Fri May 01, 2020 11:42 am
Forum: Beginner Basics
Topic: Connection between SFP / SFP+
Replies: 7
Views: 1053

Re: Connection between SFP / SFP+

And when it is a local connection you can consider a DAC cable, but also after checking compatibility. I think with a RB3011 there are problems with that.
by pe1chl
Fri May 01, 2020 11:40 am
Forum: General
Topic: One power supply for 2 devices [SOLVED]
Replies: 9
Views: 1332

Re: One power supply for 2 devices [SOLVED]

Also, I have a similar question. I would like to know if I can connect several (3-5-10) Mikrotik devices via PoE to one backup power supply of the required power. Will such a connection cause unstable operation of devices. Always check the specification of the used power of the devices, the max pow...
by pe1chl
Fri May 01, 2020 11:38 am
Forum: General
Topic: One power supply for 2 devices [SOLVED]
Replies: 9
Views: 1332

Re: One power supply for 2 devices [SOLVED]

The specified max power out for PoE output from the RB4011iGS+RM is too low to power the Audience... it is about 22W max. I would say you cannot power the Audience that way. When you want to avoid having a power connection near the Audience I would say you can use a PoE inserter (RBGPOE) and the nor...
by pe1chl
Fri May 01, 2020 11:32 am
Forum: Scripting
Topic: no such item (4) - FQDN address-list find where comment=X
Replies: 7
Views: 977

Re: no such item (4) - FQDN address-list find where comment=X

Your issue probably is that some of your DNS-derived address list items have really short TTL (like when you try to get addresses of CDN servers in an address list), and there is a reasonable chance that your find retrieves a list of items where some of them expire some milliseconds later and the ne...
by pe1chl
Fri May 01, 2020 11:23 am
Forum: General
Topic: Router using incorrect src-address for its own traffic over IPSEC tunnel
Replies: 6
Views: 1253

Re: Router using incorrect src-address for its own traffic over IPSEC tunnel

You are doing it the difficult way. Probably for a reason, but I never recommend plain IPsec tunnels. Instead make a GRE tunnel, with IPsec protection (just put the key in that field on the GRE tunnel config screen and it will automatically create the IPsec config). Put an IP address from a separate...
by pe1chl
Thu Apr 30, 2020 6:58 pm
Forum: Announcements
Topic: Winbox v3.23 released!
Replies: 60
Views: 25894

Re: Winbox v3.23 released!

It is only Thursday today, so we do not know yet. On the other hand, MikroTik are closed tomorrow and monday so indeed likely no release tomorrow. However, I can assure you that posting messages like that will do absolutely nothing to change it. I recommend you to go back to a release that works OK....
by pe1chl
Thu Apr 30, 2020 5:26 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

I can see when using 802.3ad only one link is used for udp but both links are argreated for TCP. why?
Likely because of the way you are testing. The TCP test may use different TCP sessions parallel and the UDP test doesn't.
by pe1chl
Thu Apr 30, 2020 5:24 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

BUT, I can only get 98Mps udp between the two when using 802.3ad when testing with udp, 140Mbps TCP with balance-rr, 190Mbps UDP and 140Mbps TCP @Zacharias: you see, that is how it usually goes. people configure it, and use speedtest to test it, get disappointing results. So that is why balance rr ...
by pe1chl
Thu Apr 30, 2020 4:07 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

Ok when you selec 802.3ad indeed it should work OK but beware that balanced rr is the default selection, not 802.3ad. So I wonder what would happen when a user of the type "can I connect 2 LAN cables to have more bandwidth" will go to the trouble of selecting 802.3ad, and if he would not go and try ...
by pe1chl
Thu Apr 30, 2020 2:54 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

802.3ad (LACP) bonding does not have any negative effect on TCP connections... Every existing connection always chooses the same link, they never get split between links... So there is no misordering... It depends on how you configure it. When you select mode balanced rr, which appears to be the de...
by pe1chl
Thu Apr 30, 2020 12:36 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

This problem does not exist in the router, it exists in the end-systems!
by pe1chl
Thu Apr 30, 2020 12:07 pm
Forum: Beginner Basics
Topic: 2 LAN Cables from Mikrotik to Switch
Replies: 24
Views: 3193

Re: 2 LAN Cables from Mikrotik to Switch

Or each device will saturate one LAN cable and the excess traffic will spill over to another LAN cable? This is normally not done (or not advisable to do) because such dynamic balancing would mean that at the receiving end the packets arrive out-of-order. When using a bad TCP stack this will lead t...
by pe1chl
Thu Apr 30, 2020 11:18 am
Forum: General
Topic: Network security in combination with a home webserver
Replies: 2
Views: 758

Re: Network security in combination with a home webserver

Forget about DMZ, it will definitely weaken your security. You probably are confusing a real DMZ with the term DMZ as used by today's home routers (where DMZ just means "forward all incoming traffic not matching NAT state to this host"). Of course it is possible to configure a separate network on a...
by pe1chl
Thu Apr 30, 2020 11:08 am
Forum: General
Topic: Router using incorrect src-address for its own traffic over IPSEC tunnel
Replies: 6
Views: 1253

Re: Router using incorrect src-address for its own traffic over IPSEC tunnel

You can set the preferred source address in the static route you make for the tunnel.
(when you do not have such a route, you can create it. just create a static route to your destination network via the ISP gateway or in fact any address on internet)
by pe1chl
Thu Apr 30, 2020 11:03 am
Forum: General
Topic: LHG LTE router public IP address mismatch
Replies: 4
Views: 1441

Re: LHG LTE router public IP address mismatch

This issue is likely not related to your LHG LTE... Only in the provider network a thing like this could happen. If anything, you should research if you are maybe using the wrong method of acquiring the WAN address in your router config (as compared to what the ISP defines). Lacking any details (lik...
by pe1chl
Wed Apr 29, 2020 12:04 am
Forum: RouterOS v7 BETA
Topic: IPv6 dhcp finally in v7 ?
Replies: 8
Views: 1664

Re: IPv6 dhcp finally in v7 ?

but if someone explain me how to solve these questions, maybe i will consider using SLAAC I recommend doing your host filtering and classification based on MAC address, not on IPv6 address. Then you do not need to have separate cases for IPv4 and IPv6 either (assuming you support dual-stack on your...
by pe1chl
Tue Apr 28, 2020 8:24 pm
Forum: RouterOS v7 BETA
Topic: IPv6 dhcp finally in v7 ?
Replies: 8
Views: 1664

Re: IPv6 dhcp finally in v7 ?

I'm a client and I'm asking for it.
No, you are not a client of MikroTik. You buy your routers at some distributor or dealer, and THEY are the client of MikroTik.
So you need to convince them to ask to MikroTik for more IPv6 features. Apparently none of them do so right now.
by pe1chl
Tue Apr 28, 2020 8:10 pm
Forum: RouterOS v7 BETA
Topic: IPv6 dhcp finally in v7 ?
Replies: 8
Views: 1664

Re: IPv6 dhcp finally in v7 ?

SLAAC is the standard method, almost nobody uses DHCPv6 to assign addresses
by pe1chl
Tue Apr 28, 2020 7:43 pm
Forum: General
Topic: Unexpected IPv6 download rate limit on 1 Mb
Replies: 3
Views: 1232

Re: Unexpected IPv6 download rate limit on 1 Mb

I don't have this issue at all, it must be something particular to your installation.
by pe1chl
Tue Apr 28, 2020 7:38 pm
Forum: RouterOS v7 BETA
Topic: IPv6 dhcp finally in v7 ?
Replies: 8
Views: 1664

Re: IPv6 dhcp finally in v7 ?

I never required IPv6 dhcp to make IPv6 work... do you?
Sure, like you, I would hope that there are IPv6 improvements.
However, it is not likely. IPv6 is not a priority for MikroTik. Their clients do not ask for it.
by pe1chl
Tue Apr 28, 2020 1:06 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

See above, IPsec is broken in this beta, it was still OK in the previous one.
by pe1chl
Sun Apr 26, 2020 10:51 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

I think such dual-purpose NS records would be wrong, confusing. Well, it works like that in all existing recursive resolvers. When the client asks for NS it gets the NS, when it asks for something else the query is forwarded. And as a recursive resolver walks the path from tld down, it also works f...
by pe1chl
Sun Apr 26, 2020 9:02 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

Well, I suggested that it would be implemented as one or more NS records for a certain domain and then optionally including the recursive resolution for that domain in the resolver. (i.e. not return the NS records to the client but instead forward the request to the appropriate server indicated by t...
by pe1chl
Sun Apr 26, 2020 3:29 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

And then each of those users gets a 10G connection to their desktop system, and there is a 100G branch-to-branch connection to link them all the HQ?
Ok, I get it! I agree with you there must be a huge market for devices like that. Everyone in the SOHO business would want or need some.
by pe1chl
Sun Apr 26, 2020 12:59 pm
Forum: General
Topic: Accept established and related connections on Filter or Mangle?
Replies: 4
Views: 974

Re: Accept established and related connections on Filter or Mangle?

Using an action=accept in mangle only ends the walking through the mangle rules, it does not accept the packet for input or forward. That can only happen in the filter or raw table. So yes, an accept in mangle can sometimes improve performance, e.g. when you have a long list of mangle rules which yo...
by pe1chl
Sun Apr 26, 2020 12:20 pm
Forum: The Dude
Topic: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]
Replies: 6
Views: 1610

Re: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]

I installed Dude some time ago and experimented a bit and indeed it looks nice at first, but I found it quite difficult to make it do exactly what I want. Probably should spend a lot more time on it, and as I repeatedly read that it is not really going forward, I use other monitoring systems instead...
by pe1chl
Sat Apr 25, 2020 4:30 pm
Forum: The Dude
Topic: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]
Replies: 6
Views: 1610

Re: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]

I only want to warn you that Dude is basically a dead-end. It gets little or no development anymore. You might want to know that before you sell it to a customer who may come back at you when a new RouterOS version appears that no longer runs or supports Dude. Of course you know you can use the snif...
by pe1chl
Sat Apr 25, 2020 12:17 pm
Forum: RouterBOARD hardware
Topic: Just going to leave this here...
Replies: 139
Views: 23703

Re: Just going to leave this here...

Mikrotik cannot make the ideal device! Why it wasn’t easy to make support for USB, memory cards and several miniPCI-E slots and of course the ability to connect or immediately complete an SSD. In my opinion better to make one universal device that will be easier to maintain. Marketing, damn it ... ...
by pe1chl
Sat Apr 25, 2020 12:02 pm
Forum: The Dude
Topic: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]
Replies: 6
Views: 1610

Re: Dude 10061 Error - No connection could be made since target machine actively refuse it. [SOLVED]

I would not recommend making a huge installation with "One of the key requirements is Dude". It is basically out of support. Also, making such an installation requires network insight and experience, that would allow you to debug such problems on your own. Having to ask such basic questions on a for...
by pe1chl
Sat Apr 25, 2020 11:35 am
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

After upgrade to beta60, L2TP/IPSEC client can't connect to server: *******: terminating... - tunnel was not encrypted I have same issue with connection to remote L2TP server witch IPSEC, in IPSEC i see error "suggestion to use stronger pre-shared key or different authentication method", but i can'...
by pe1chl
Fri Apr 24, 2020 7:22 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

*) dns - added support for forwarding DNS queries of static entries to specific server (CLI only); *) dns - added support for multiple type static entries (CLI only); Finally!!! Can't wait to test this one out! Same for me! I will test on my CHR test router this weekend... Well of course I could no...
by pe1chl
Fri Apr 24, 2020 7:12 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

is it true about the DNS forward ? ip dns static set ns=8.8.8.8 forward-to=1.1.1.1 does this command forwarding the 8.8.8.8 to 1.1.1.1 No. I think you do not understand the purpose and intention of this new functionality. Wait until they have updated https://wiki.mikrotik.com/wiki/Manual:IP/DNS#Sta...
by pe1chl
Fri Apr 24, 2020 4:37 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

*) dns - added support for forwarding DNS queries of static entries to specific server (CLI only);
*) dns - added support for multiple type static entries (CLI only);
Finally!!!
Can't wait to test this one out!
Same for me! I will test on my CHR test router this weekend...
by pe1chl
Fri Apr 24, 2020 2:49 pm
Forum: Announcements
Topic: Winbox v3.23 released!
Replies: 60
Views: 25894

Re: Winbox v3.23 released!

Don't be so pushy! When there is a new version, there will be a new topic on the forum.
As long as there is no new version, there will be no announcement.
That is how it is with MikroTik.
(also, with MikroTik it is common that new versions are posted late on friday afternoon their local time)
by pe1chl
Fri Apr 24, 2020 10:42 am
Forum: General
Topic: Feature requests
Replies: 1216
Views: 262160

Re: Feature requests

Yes indeed. But that would actually one of the use cases I had in mind for the previous feature request I made (on Mar 26, 2020)
by pe1chl
Thu Apr 23, 2020 11:42 pm
Forum: General
Topic: RPKI
Replies: 41
Views: 10923

Re: RPKI

So, as of now - with a STABLE version of ROS (April 23 2020) RPKI is not supported / available on Mikrotik ROS. Is this correct? yes It would be nice to see a time line when this would be available. But no rush - want it to be done correctly! :) MikroTik never gives time estimates to implementation...
by pe1chl
Wed Apr 22, 2020 5:25 pm
Forum: Wireless Networking
Topic: Meaning of: disconnected, received deauth: no activity (4)
Replies: 9
Views: 2318

Re: Meaning of: disconnected, received deauth: no activity (4)

There is a debugging console where you can run dmesg and when I insert some WiFi stick it sees that the device is plugged in but it does not create a new network device from that. (there is no way in the wifi network selector where I can select another network device) I also tried with a USB etherne...
by pe1chl
Wed Apr 22, 2020 12:59 pm
Forum: Wireless Networking
Topic: Meaning of: disconnected, received deauth: no activity (4)
Replies: 9
Views: 2318

Re: Meaning of: disconnected, received deauth: no activity (4)

Remember, it is a Chromebook. Not a Windows laptop. A Chromebook is a Linux laptop with TPM and Google Chrome on it. You cannot mess with it unless you "root" it. But, you can submit problem reports that are actually read by people and often acted upon. To do that, of course I need to present them w...
by pe1chl
Tue Apr 21, 2020 7:41 pm
Forum: Wireless Networking
Topic: Meaning of: disconnected, received deauth: no activity (4)
Replies: 9
Views: 2318

Re: Meaning of: disconnected, received deauth: no activity (4)

Thanks for that pointer. Indeed I think that it is most likely that the disconnect was initiated by the Chromebook. However, there is no reason (other than a bug) why it would do so, as it really is active at that time. It even happens while I am scrolling through comments and it suddenly hangs load...
by pe1chl
Tue Apr 21, 2020 12:02 pm
Forum: Wireless Networking
Topic: Meaning of: disconnected, received deauth: no activity (4)
Replies: 9
Views: 2318

Re: Meaning of: disconnected, received deauth: no activity (4)

My problem still continues. For a long time the connection is steady, and then it starts bouncing like this and the issue keeps coming back every couple of minutes. But after some time it becomes stable again. I have multiple SSIDs (virtual wireless interfaces) on the MikroTik router and I added a s...
by pe1chl
Mon Apr 20, 2020 5:09 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Mikrotik could easily make use of ODM design services from the chipset manufacturers or their partners. But they are not interested in that. This has been te response to several people making this query, I also tried that years ago and even then they were not interested. Here we run in the problem ...
by pe1chl
Mon Apr 20, 2020 11:39 am
Forum: Announcements
Topic: Winbox v3.23 released!
Replies: 60
Views: 25894

Re: Winbox v3.23 released!

I think, that 3.23 is the same soft as 3.21-3.22. Same bugs...
Check your download/install procedure! This is certainly not right!
by pe1chl
Sun Apr 19, 2020 10:13 pm
Forum: General
Topic: IPv6 transition mechanism
Replies: 76
Views: 8234

Re: IPv6 transition mechanism

NPT is not a transition (hence it does not belong in this topic IPv6 transition mechanism). It is a solution to work around the problem of having a dynamic prefix on internet while wanting to have a static prefix on the LAN, or to have two or more ISPs with prefixes handed out by those ISPs, in a ba...
by pe1chl
Sun Apr 19, 2020 2:25 pm
Forum: General
Topic: IPv6 transition mechanism
Replies: 76
Views: 8234

Re: IPv6 transition mechanism

Uxorious tagged his remark on a years old topic that is not even really about what he is remarking about, a mistake that many newbies make on forums. NPT is a desired feature but it is not related to IPv6 transition, the topic. It is desirable in cases where there are multiple external IPv6 prefixes...
by pe1chl
Sat Apr 18, 2020 1:58 pm
Forum: General
Topic: Question on connection and packet marking
Replies: 4
Views: 1250

Re: Question on connection and packet marking

It's the other way round - you can not use separate connection-marks for upload and download, because any single connection has a single connection-mark at a time Yes, this is often quite unfortunate, and the underlying mechanism in Linux would allow multiple marks, so it is only a limitation in Ro...
by pe1chl
Sat Apr 18, 2020 1:27 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

MikroTik does not need to produce a DSL modem, they only have to support DSL SFP modules that other manufacturers already produce and can be used in MikroTik routers that have SFP. Similar to supporting USB sticks for mobile telecom (4G etc). Of course it would not be a good idea to produce a router...
by pe1chl
Fri Apr 17, 2020 4:28 pm
Forum: Announcements
Topic: Winbox v3.23 released!
Replies: 60
Views: 25894

Re: Winbox v3.23 released!

Problem of changing column width and row position in active window (i.e. which shows counters that are being updated during the change operation) has NOT been fixed!
Back to 3.21
(using winbox 32-bit under wine Debian buster)
by pe1chl
Fri Apr 17, 2020 12:34 pm
Forum: General
Topic: Feature Request: IPv6 NAT66 Support
Replies: 27
Views: 9551

Re: Feature Request: IPv6 NAT66 Support

Yes indeed, but (unless that has changed by now) MikroTik do not see a need to work on IPv6 features as their customers do not request that. (single requests made to employees do not count, what you need is a big distributor ringing the bell that they lose sales because large numbers of customers re...
by pe1chl
Thu Apr 16, 2020 2:17 pm
Forum: Beginner Basics
Topic: Deny All Set Rule
Replies: 10
Views: 1841

Re: Deny All Set Rule

Sure that is the end goal of the rule set, I also use that method all the time. But: the default behavior of the RouterOS firewall is to ALLOW ALL, so when a chain has no rules at all it will allow everything. You would typically fill the ruleset with an ALLOW established/related, an ALLOW of the tr...
by pe1chl
Thu Apr 16, 2020 1:10 pm
Forum: Beginner Basics
Topic: Deny All Set Rule
Replies: 10
Views: 1841

Re: Deny All Set Rule

The MikroTik firewall behaves as if there is an ALLOW ALL rule at the END of each chain. I would recommend you to explicity add an ALLOW ALL rule at the end of each chain if you do not already have it, then see what the traffic counters do, and if not to wild then add the logging option for that rul...
by pe1chl
Thu Apr 16, 2020 1:06 pm
Forum: Beginner Basics
Topic: Layer7
Replies: 3
Views: 1327

Re: Layer7

This kind of Level 7 matching is from the past. You may find it in old examples and people may still claim that they use it, but it effectively no longer works.
by pe1chl
Thu Apr 16, 2020 1:01 pm
Forum: Forwarding Protocols
Topic: Latency on VPLS tunnel [SOLVED]
Replies: 10
Views: 2482

Re: Latency on VPLS tunnel [SOLVED]

When you are planning to use wireless, you should be prepared for jitter figures like that. When a wireless packet is lost due to interference, it is re-transmitted and this takes time, making 100ms jitter quite typical on a wireless link. I did some work on synchronized audio over UDP (not using an...
by pe1chl
Mon Apr 13, 2020 3:35 pm
Forum: Beginner Basics
Topic: Graphing issue
Replies: 7
Views: 1243

Re: Graphing issue

I mean that my internet connection works fine and I am able to access the router via public IP. That is actually not a good thing! You should not have access to the router via public IP, because it will not take long before the bad guys have access as well. Restrict access to only inside networks, ...
by pe1chl
Mon Apr 13, 2020 2:48 pm
Forum: Beginner Basics
Topic: Graphing issue
Replies: 7
Views: 1243

Re: Graphing issue

What do you mean with "everything else seems to work fine"? Are you able to access your router from the local network via the web interface? Or are you using winbox to manage the router and did you disable the web service? Also, do use http:// instead of https:// unless you have installed a proper c...
by pe1chl
Mon Apr 13, 2020 1:54 pm
Forum: Beginner Basics
Topic: Graphing issue
Replies: 7
Views: 1243

Re: Graphing issue

It is not a good idea to allow remote access to your router http port, also not on a different port number.
You can view the graphs from the internal IP address, normally 192.168.88.1
When you need external access, configure a VPN.
by pe1chl
Mon Apr 13, 2020 1:52 pm
Forum: Beginner Basics
Topic: IPsec Site2Site VPN-Tunnel, both MikroTik-Routers behind NAT-Router
Replies: 2
Views: 1034

Re: IPsec Site2Site VPN-Tunnel, both MikroTik-Routers behind NAT-Router

At first you need to research if you can configure one of those NAT-routers to have "open ports" or "DMZ setting" so you can allow incoming connections from the other one. When this is not possible, e.g. because the ISP does not allow you to configure the routers or because they have their NAT insid...
by pe1chl
Mon Apr 13, 2020 1:41 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Hey vortex, Can you please take your wildly offtopic discussion to a different topic? In this topic we try to discuss the possibility of having a VDSL-capable MikroTik router, e.g. by having a VDSL modem as an SFP module added to an SFP-equipped MikroTik router, and supported in RouterOS so it can b...
by pe1chl
Sat Apr 11, 2020 4:56 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

You should understand that most MikroTik routers with multiple ports have only few ports on the CPU and they are connected to switches. Even when you configure the ports as separate (e.g. a link to another site) the port physically remains part of the switch and there is hidden VLAN configuration th...
by pe1chl
Sat Apr 11, 2020 4:49 pm
Forum: General
Topic: Please add basic portScan tool ( port scanner scan )
Replies: 47
Views: 18036

Re: Please add basic portScan tool ( port scanner scan )

It DOES do a portscan. But it is a bit limited, it tries SNMP and SMBv1 ports only (after it has received a PING reply).
It also does a reverse-lookup in DNS.
by pe1chl
Sat Apr 11, 2020 9:54 am
Forum: General
Topic: Please add basic portScan tool ( port scanner scan )
Replies: 47
Views: 18036

Re: Please add basic portScan tool ( port scanner scan )

People are asking for a tool to identify hosts on their network and to troubleshoot a VPN, and /tool ip-scan can be used for that. Of course there is always one more thing that one can request, but I think the debugging tools available on MikroTik already are way better than industry standard. As I ...
by pe1chl
Fri Apr 10, 2020 4:58 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Many providers give a separate box for TV, including some that previously gave only one for everything. There's little point in replacing an ISP modem router with a VOIP box, which would also cost more than 2 FXS ports in Mikrotik. And you would also have to pay for the SFP, without really reducing...
by pe1chl
Fri Apr 10, 2020 4:42 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

The "Cache used not decreasing when cache flushed" problem occurs without any DoH servers. But I have not seen a crash due to that, and it should be mentioned that in the example the Cache used is still way below the Cache Size value. So it should not cause a memory overusage, unless you have very l...
by pe1chl
Fri Apr 10, 2020 11:26 am
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Why? FXS ports and DSL are totally unrelated. Some phone companies shut down POTS already. And so? Would you want a HDMI connection on your router as well, for the IPtv that most DSL providers have? (at least, here) I don't see why an FXS port is required on a router more than any other "applicatio...
by pe1chl
Fri Apr 10, 2020 1:22 am
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

I imagine many times putting an SFP modem in Mikrotik would not be considered because of the lack of FXS ports in their routers.
Why? FXS ports and DSL are totally unrelated.
by pe1chl
Thu Apr 09, 2020 10:49 pm
Forum: General
Topic: Dhcp server unaswered mac addresses
Replies: 1
Views: 1029

Re: Dhcp server unaswered mac addresses

I did that in the past on ISC DHCP server but it involved having different pools and match classes.
Unfortunately this is a feature that the RouterOS DHCP server does not have...
(it does have vendor ID matching but that is more limited than what ISC DHCPD offers)
by pe1chl
Thu Apr 09, 2020 6:26 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Most important, we do not require any modules from MikroTik when they think it is not worthwile to produce them. We only need support from MikroTik so that parameters of the line can be viewed and possibly tweaked when such a module is plugged into a MikroTik router. Similar to what is now possible ...
by pe1chl
Mon Apr 06, 2020 5:22 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

Then they should cut the old copper pair and drag an cheap fibre instead. Or at least to the basement of the apartment building. In countries with cheap labor, fiber can be laid to every house at little extra cost. In completely socialist countries, the cost of the government installing fiber every...
by pe1chl
Sun Apr 05, 2020 9:28 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

When we are looking for "VDSL support in MikroTik routers" what we realistically mean is "SFP modules working with MikroTik routers". I once bought such a module and while it "worked" with my router, it did not achieve the speed a regular modem would, and there was no way to check the values in the ...
by pe1chl
Sun Apr 05, 2020 12:05 pm
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 365
Views: 113609

Re: Mikrotik VDSL / DSL Modem?

It appears that MikroTik operates in a quite narrow band between "oldfashioned" and "too new". They have no interest at all in supporting DSL, not even via support of SFP VDSL modems from other sources (i.e. integrate some way to monitor the modem into RouterOS) "because today everyone has fiber and...
by pe1chl
Sat Apr 04, 2020 12:30 pm
Forum: Wireless Networking
Topic: Why no 60/80ghz with 5ghz failover?
Replies: 13
Views: 2781

Re: Why no 60/80ghz with 5ghz failover?

The reason is that gain is inversely proportional to opening angle of the antenna, so when you use an antenna with low gain you get a lot more interference from other users of the spectrum. That is especially important on 5 GHz where there are a lot of users, and you want a small opening angle to ge...
by pe1chl
Fri Apr 03, 2020 8:45 pm
Forum: Wireless Networking
Topic: Why no 60/80ghz with 5ghz failover?
Replies: 13
Views: 2781

Re: Why no 60/80ghz with 5ghz failover?

You should not have cut away my remark: (when you think they have it, carefully study the datasheet to see if you can find the catch!) I've examined the datasheet, but no 'catch' is jumping out at me. We've deployed about 12 links in Manhattan and they work great. Is there a ticking time bomb in th...
by pe1chl
Fri Apr 03, 2020 7:48 pm
Forum: Wireless Networking
Topic: Why no 60/80ghz with 5ghz failover?
Replies: 13
Views: 2781

Re: Why no 60/80ghz with 5ghz failover?

It is not so easy to make a dual band (5/60 GHz) wireless device that shares the same antenna for both bands. That is also why most other manufacturer's don't have it either. Actually, they have. The airFiber 60 has 60Ghz with 5 Ghz backup. Works great! You should not have cut away my remark: (when...
by pe1chl
Fri Apr 03, 2020 4:47 pm
Forum: Scripting
Topic: lhg 60g script for 5g failover!!
Replies: 2
Views: 1126

Re: lhg 60g script for 5g failover!!

Disable ethernet port when the wireless link fails may be not the best idea, it would lock you out of the configuration interface when that happens. It could be better to insert some forward rule in the firewall (before all other rules) that blocks the protocol you use to perform the switchover, or ...
by pe1chl
Fri Apr 03, 2020 4:37 pm
Forum: RouterBOARD hardware
Topic: Why is it called "Direct Attach" Cable? [SOLVED]
Replies: 11
Views: 3009

Re: Why is it called "Direct Attach" Cable? [SOLVED]

A follow-up question: In ancient Ethernet times one had to use a "crossover cable" to attach 2 PCs directly (w/o going over a hub or switch). Is such a special crossover cable necessary also with SFP/SFP+ ? (I guess & hope not :-)) When you have two SFP optical modules for multimode fiber and you l...
by pe1chl
Fri Apr 03, 2020 11:13 am
Forum: Wireless Networking
Topic: Why no 60/80ghz with 5ghz failover?
Replies: 13
Views: 2781

Re: Why no 60/80ghz with 5ghz failover?

I agree that these should be more capability for link-quality based routing, but I do not restrict that to only failover on a single link. We are operating a larger network of sites interconnected by various wireless links and sometimes tunnels over internet, and we face the problem that the availab...
by pe1chl
Thu Apr 02, 2020 6:27 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

I went back to 3.21
At first things looked bright but the problems with column resizing and row movement on busy windows like firewall filter are just too severe.
by pe1chl
Thu Apr 02, 2020 1:08 pm
Forum: Wireless Networking
Topic: Why no 60/80ghz with 5ghz failover?
Replies: 13
Views: 2781

Re: Why no 60/80ghz with 5ghz failover?

Seriously, where are the dual band high throughput wireless devices? It is not so easy to make a dual band (5/60 GHz) wireless device that shares the same antenna for both bands. That is also why most other manufacturer's don't have it either. (when you think they have it, carefully study the datas...
by pe1chl
Wed Apr 01, 2020 8:32 pm
Forum: General
Topic: Isolating hosts inside vlan [SOLVED]
Replies: 8
Views: 2280

Re: Isolating hosts inside vlan [SOLVED]

When you tag all incoming traffic on the ports with a fixed VLAN just for forwarding across a trunk, it should not matter. When you want mixed tags on a port and want to restrict only traffic from 1 VLAN, it will be more difficult... Switch rules on RouterOS can still filter it, but on the switch pr...
by pe1chl
Wed Apr 01, 2020 5:28 pm
Forum: General
Topic: Isolating hosts inside vlan [SOLVED]
Replies: 8
Views: 2280

Re: Isolating hosts inside vlan [SOLVED]

Your problem is that MikroTik switches do not have this feature. Some other manufacturers do have it, either in a simple configuration where you can just specifiy "port isolation" which means e.g. ports 1-11 can talk to port 12 but not between eachother. Then the router is connected to port 12. More...
by pe1chl
Sun Mar 29, 2020 9:36 pm
Forum: Wireless Networking
Topic: 4G Link problems, impossible connect if cell lock is used
Replies: 11
Views: 2365

Re: 4G Link problems, impossible connect if cell lock is used

Well, when that is what you observe... it could be what is behind it. I remember we had such difficulty when using "GSM dialer" to lower cost of phonecalls to mobile in the past. (when mobile->mobile was much cheaper than fixed->mobile it was often used as a solution, it was a box connected to the P...
by pe1chl
Sun Mar 29, 2020 9:34 pm
Forum: General
Topic: IKE2 NPS Authentication with Azure MFA
Replies: 4
Views: 1228

Re: IKE2 NPS Authentication with Azure MFA

I intended to try radius authentication for IKE2 and of course the first thing I noticed is that there is no documentation for radius attributes sent and expected... But I abandoned the experiment when I found the clients I wanted to use do not support EAP authentication, which made it kind of usele...
by pe1chl
Sun Mar 29, 2020 9:16 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

MikroTik should focus on fixing bugs and introducing new features. Not cater to noobs that cannot be bothered to read the manual. Seriously, the amount of posts asking for stuff like that is annoying. Do you see cisco making it easier to use an ASA? No, there you have to bust your rear, to learn ho...
by pe1chl
Sun Mar 29, 2020 2:42 pm
Forum: Wireless Networking
Topic: 4G Link problems, impossible connect if cell lock is used
Replies: 11
Views: 2365

Re: 4G Link problems, impossible connect if cell lock is used

Ask the provider about the policies they have for connects from a fixed location. Some providers may not allow you to do that, maybe depending on the subscription you use.
by pe1chl
Sun Mar 29, 2020 2:39 pm
Forum: General
Topic: IKE2 NPS Authentication with Azure MFA
Replies: 4
Views: 1228

Re: IKE2 NPS Authentication with Azure MFA

What do you mean with "inability to set the mode-config for IKE2 authentication", I have that working. You can set the mode-config in the identity used for IKE2 access.
The other problem seems more a problem in Windows, try to ask it in the relevant Microsoft forums...
by pe1chl
Sat Mar 28, 2020 7:09 pm
Forum: RouterBOARD hardware
Topic: 10G device needed
Replies: 6
Views: 2439

Re: 10G device needed

When you buy a box with the MikroTik logo on it, it already has a license. Nothing to worry about. And MikroTik licenses usually are not very restrictive. On a switch there is nothing that is restricted, on a router there may be an additional license level you need when you have e.g. > 200 VPN users...
by pe1chl
Sat Mar 28, 2020 11:37 am
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

If you are not using a “standard configuration“ then you likely don’t want to use a firewall rule or wizard. Sorry - what's a standard configuration? I'm serious... what you consider to be standard will not be what someone else does. I consider a "standard configuration" to be the consumer NAT rout...
by pe1chl
Fri Mar 27, 2020 5:45 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

It can look at the existing configuration. E.g. check where the default route is pointing. Remember this is only for the simple "NAT router on a consumer internet connection" case. It manages quite well when you use QuickSet to configure a router, e.g. when you configure PPPoE client that interface ...
by pe1chl
Fri Mar 27, 2020 5:22 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

You have to be careful because the WAN might not be connected to the first port. That's why Interface Lists were introduced: no more "ether1" in firewall rules! Indeed, that is one of the reasons the new default firewall is so much better. Of course, resetting the firewall should also create and po...
by pe1chl
Fri Mar 27, 2020 4:06 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

I think most casual users would be totally fine with the default firewall as it is today.
Of course it is not a button you must click without knowing what you are doing, but that is the case for almost any setting in a router like this.
by pe1chl
Fri Mar 27, 2020 12:33 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

Some of those things are just too simple (e.g. VPN/IPSec needs one to three simple rules). And you add them once. You save nothing with the wizard. It could make sense for something more complex, but then you have the problem how to put things together. You still need to understand what you're doin...
by pe1chl
Thu Mar 26, 2020 8:02 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

Home/End has always worked for me, but I am only using winbox under wine (in Linux). Maybe the Home/End is a feature of wine rather than winbox?
by pe1chl
Thu Mar 26, 2020 5:39 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 41
Views: 7051

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

That is why we have quickset where you can disableenable default firewall ruleset or default NAT rules. It would be helpful when there was a feature (in quickset or otherwise) to reset the firewall to defaults (including the required interface lists) without changing other router config. The defaul...
by pe1chl
Thu Mar 26, 2020 5:05 pm
Forum: General
Topic: Stupidly hit the reset button please help
Replies: 3
Views: 1205

Re: Stupidly hit the reset button please help

Who configured it in the first place?
Call them and ask them to re-configure it...
by pe1chl
Thu Mar 26, 2020 5:02 pm
Forum: Forwarding Protocols
Topic: BGP orgin route are incomplete/invalid
Replies: 7
Views: 1634

Re: BGP orgin route are incomplete/invalid

when Router C receive the route it is not complete and it will not choose as best path, this is the issue
The factor that BGP origin (incomplete/igp) plays in route selection is so minor that it is unlikely that this is your problem.
by pe1chl
Thu Mar 26, 2020 4:58 pm
Forum: Beginner Basics
Topic: Routing multiple VPN networks same subnet HOW?
Replies: 4
Views: 1507

Re: Routing multiple VPN networks same subnet HOW?

While it is possible to fix this problem using NAT (network translation), I would advise you to spend your effort on renumbering the networks from 192.168.1.0/24 to a different network at each location.
by pe1chl
Thu Mar 26, 2020 4:20 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

i second this.
To answer your original remark: you can go to the end of the list by pressing the End key (and to the top by pressing the Home key).
But in remains a difficult UI.
by pe1chl
Thu Mar 26, 2020 2:28 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

when you hover over the "show columns" please make it not to have to click x times to reach what you want. just to scroll automatically. This is why that long list should be replaced by a square input form with multiple columns of column names and associated checkmark... Added advantage is that you...
by pe1chl
Thu Mar 26, 2020 1:52 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

Please add extra parameter "regexp" (including NOT operator) to "/system logging" rules so you can specify a regexp on the logged message to be (not) matched before the specified action is taken. Often there are many messages with exactly the same topics but widely different purpose, and some of the...
by pe1chl
Thu Mar 26, 2020 1:50 pm
Forum: Announcements
Topic: v6.47beta [testing] is released!
Replies: 269
Views: 115941

Re: v6.47beta [testing] is released!

Is there any chance of improvements of the local DNS resolver as discussed in another topic? (I mean: to add more record types for static entries, etc)
by pe1chl
Thu Mar 26, 2020 1:45 pm
Forum: General
Topic: Feature requests
Replies: 1216
Views: 262160

Re: Feature requests

Please add extra parameter "regexp" (including NOT operator) to "/system logging" rules so you can specify a regexp on the logged message to be (not) matched before the specified action is taken. Often there are many messages with exactly the same topics but widely different purpose, and some of the...
by pe1chl
Wed Mar 25, 2020 8:23 pm
Forum: General
Topic: RoadWarrior L2TP VPN Split Tunnel Routing Issue
Replies: 10
Views: 1874

Re: RoadWarrior L2TP VPN Split Tunnel Routing Issue

Well, that was an interesting experience... as usual, when trying to use standards-based VPN in a slightly more complex setting. At first, I configured RADIUS but I wasn't sure what attributes the RADIUS server exactly would have to provide (e.g. how is the IPsec key determined? is that retrieved fr...
by pe1chl
Wed Mar 25, 2020 11:30 am
Forum: General
Topic: RoadWarrior L2TP VPN Split Tunnel Routing Issue
Replies: 10
Views: 1874

Re: RoadWarrior L2TP VPN Split Tunnel Routing Issue

Ok thanks, I see I can select "eap radius" in IPsec identities. RADIUS server is no problem, I already have it for switch port authentication (not using MikroTik switches).
Will see if I can get this working...
by pe1chl
Tue Mar 24, 2020 7:45 pm
Forum: General
Topic: RoadWarrior L2TP VPN Split Tunnel Routing Issue
Replies: 10
Views: 1874

Re: RoadWarrior L2TP VPN Split Tunnel Routing Issue

Is there some documentation on how to setup a config like L2TP/IPsec with PSK but instead using IKEv2? It is not clear to me where the "username/password" would go. The example uses certificates but it is a lot of hassle to make it working in random clients. For L2TP/IPsec I have an empty bridge int...
by pe1chl
Tue Mar 24, 2020 6:30 pm
Forum: General
Topic: RoadWarrior L2TP VPN Split Tunnel Routing Issue
Replies: 10
Views: 1874

Re: RoadWarrior L2TP VPN Split Tunnel Routing Issue

Yes due to current crisis we have some Windows L2TP/IPsec VPN and I see them make a DHCP request just after connection because it is dropped in the firewall. However I did not yet try to get a DHCP server respond to them, that probably requires some trickery if it is at all possible. I also started ...
by pe1chl
Tue Mar 24, 2020 2:13 pm
Forum: General
Topic: RoadWarrior L2TP VPN Split Tunnel Routing Issue
Replies: 10
Views: 1874

Re: RoadWarrior L2TP VPN Split Tunnel Routing Issue

I think it is now possible to set the proper routes to be added to such a VPN via a DHCP server.
How this is to be done exactly, I still have to research.
by pe1chl
Tue Mar 24, 2020 12:54 pm
Forum: Wireless Networking
Topic: Meaning of: disconnected, received deauth: no activity (4)
Replies: 9
Views: 2318

Meaning of: disconnected, received deauth: no activity (4)

Does anyone know what is the exact meaning (and related scenario) of this error message: xx:xx:xx:xx:xx:xx@ssid: disconnected, received deauth: no activity (4) I get this error message irregularly on my RB2011, referring to the MAC address of a HP Chromebook and the SSID where it is connected. The "...
by pe1chl
Mon Mar 23, 2020 11:54 am
Forum: General
Topic: Mikrotik Wireless - Slave only
Replies: 3
Views: 861

Re: Mikrotik Wireless - Slave only

My question: Is this possible? as i understand that they come in matched pairs and i only have the Slave. I'm not aware of any MikroTik hardware that has this restriction. The master/slave mode is entirely in the configuration of the device. When you just reset it to defaults and reconfigure it you...
by pe1chl
Sun Mar 22, 2020 12:34 pm
Forum: RouterBOARD hardware
Topic: Problem selecting CCR
Replies: 8
Views: 2808

Re: Problem selecting CCR

You first need to understand how you want to partition your network, and how much traffic there will be between those partitions. E.g. you have a separate network partition per building, and you also want a separate partition per application (e.g. keep CCTV separate from database and documents). Wit...
by pe1chl
Sat Mar 21, 2020 11:15 am
Forum: General
Topic: Multicast over VPN [SOLVED]
Replies: 3
Views: 2213

Re: Multicast over VPN [SOLVED]

You cannot do multicast over such a setup. You can either use tunnel interfaces (like GRE or IPIP) with IPsec protection and use multicast routing (when you can get it to work for this application), or you can use EoIP to join the two networks at L2 level (so they need to use the same subnet address...
by pe1chl
Mon Mar 16, 2020 2:13 pm
Forum: General
Topic: Feature requests
Replies: 1216
Views: 262160

Re: Feature requests

Give the ability to secure firewall rules. I think it would be more useful as a limited-user capability where users can be created that have precisely defined capabilities for each configuration item. (no access, read-only, add-only, modify, delete) This is not limited to firewall. This would allow...
by pe1chl
Mon Mar 16, 2020 12:09 pm
Forum: General
Topic: Strange issue with IPSEC
Replies: 2
Views: 969

Re: Strange issue with IPSEC

Maybe you have an incorrect NAT setup in your MikroTik?
by pe1chl
Sun Mar 15, 2020 1:38 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

Moving items and changing column widths has become unstable! When moving an item or changing a column width and keeping mouse button pressed for a while to find new suitable position, it suddenly jumps to completely wrong position. I think this happens when the screen is updated in the meantime, e.g...
by pe1chl
Sat Mar 14, 2020 4:43 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

Good day.
Some new bugs:

1. interface window resises to default size, even afer manual resize.
2. same for partition window.
Not here...
by pe1chl
Fri Mar 13, 2020 4:00 pm
Forum: Beginner Basics
Topic: IPV6 configuration form HE tunnel broker
Replies: 3
Views: 1541

Re: IPV6 configuration form HE tunnel broker

Remember that DHCPv6 server is not going to work to assign addresses. It is probably best to remove DHVPv6 server config, at least until you fully understand what that means. Addresses are to be assigned using SLAAC and will obtain the router address from that. You should have a default route "via f...
by pe1chl
Fri Mar 13, 2020 3:49 pm
Forum: Announcements
Topic: Winbox v3.22 released!
Replies: 117
Views: 44881

Re: Winbox v3.22 released!

I would still very much like to see the following changes: - easier widget for selection of columns (a modal panel with checkmarks for all possible columns in a "square" layout where multiple checkmarks can be toggled before clicking OK) - some way to raise windows that are covered by another window...
by pe1chl
Thu Mar 12, 2020 4:29 pm
Forum: Beginner Basics
Topic: RB1100AHx2 upgrade 6.32.4 to 6.46.4
Replies: 6
Views: 1798

Re: RB1100AHx2 upgrade 6.32.4 to 6.46.4

Ok that is a pity... but also makes it less necessary to do the reset. Remember when you want to try the upgrade but need to make sure the change can be rolled back, you can use partitioning. Check if partitioning is already in use, if not make sure that you have way less than half of the diskspace ...
by pe1chl
Thu Mar 12, 2020 10:59 am
Forum: Beginner Basics
Topic: RB1100AHx2 upgrade 6.32.4 to 6.46.4
Replies: 6
Views: 1798

Re: RB1100AHx2 upgrade 6.32.4 to 6.46.4

I'm not really sure if the RB1100 is in the "default settings are completely empty" category (like the CCR) or the "default settings are for NAT router with DHCP server and firewall" category (like most other routers are). Maybe an RB1100 owner can advise on that. If the latter, I would certainly re...
by pe1chl
Wed Mar 11, 2020 5:38 pm
Forum: Beginner Basics
Topic: RB1100AHx2 upgrade 6.32.4 to 6.46.4
Replies: 6
Views: 1798

Re: RB1100AHx2 upgrade 6.32.4 to 6.46.4

It strongly depends on how complex your config is and how much work you want to spend to save problems. My recommendation would be: 1. export and backup the current config and get the files to an external device (PC) 2. netinstall the router to 6.46.4, enable IPv6 when you use it, then reset it to d...
by pe1chl
Wed Mar 11, 2020 2:03 pm
Forum: General
Topic: Page disappeared in the wiki
Replies: 7
Views: 1664

Re: Page disappeared in the wiki

I would have hoped that there is some support for version control and branches in your new flashy documentation system... The fact that there are small changes that have effect on the documentation is precisely the reason that it would be better to do it that way. Without such tracking, there tends ...
by pe1chl
Wed Mar 11, 2020 11:38 am
Forum: General
Topic: Page disappeared in the wiki
Replies: 7
Views: 1664

Re: Page disappeared in the wiki

IMHO "the new documentation" (just like the old Wiki) has the same problem that there is no way to select a version of RouterOS and get the documentation relevant to that version. I don't think it is necessary to maintain a complete historic overview of every version that has ever been available, bu...
by pe1chl
Wed Mar 11, 2020 11:07 am
Forum: General
Topic: RB260GS SFP configuration
Replies: 3
Views: 1180

Re: RB260GS SFP configuration

What I dont really understand, what is this 10.6.0.1? Its some kind of routing? Anyways I cant ping the 1.36. This 10.6.0.1 is a router somewhere in your network where the traffic towards your switch was routed and which does not know how to route it further. It is likely you made a typo in the add...
by pe1chl
Tue Mar 10, 2020 1:07 pm
Forum: General
Topic: Traffic Flow Octets Counter wrap
Replies: 6
Views: 3301

Re: Traffic Flow Octets Counter wrap

Unfortunately it still hasn't been fixed in version 6.46.x I encountered this issue where someone must have downloaded a very large file according to network traffic statistics but this record could not be found in the traffic flow export. After searching it appears there is a record with a large co...
by pe1chl
Tue Mar 10, 2020 12:54 pm
Forum: General
Topic: Traffic Flow incorrect kbit/s
Replies: 3
Views: 1190

Re: Traffic Flow incorrect kbit/s

IPFIX does not contain a kbit/s field. The only way this can be displayed by a graphing package is by taking total bytes transferred over some time interval and dividing that by the interval. So when your total bytes transferred is OK, there is no way the MikroTik can be involved in this. (I have so...
by pe1chl
Mon Mar 09, 2020 5:37 pm
Forum: General
Topic: LoRaWAN forwarding with IPv6
Replies: 7
Views: 2174

Re: LoRaWAN forwarding with IPv6

Did you reset to defaults after enabling IPv6? That is another bug: IPv6 is disabled by default, and at the time the default settings are made there is no IPv6 so its default settings are not made. Only when IPv6 is first enabled and THEN a reset to defaults is done, the IPv6 settings are made. I ag...
by pe1chl
Mon Mar 09, 2020 4:44 pm
Forum: General
Topic: Re-Use of non used L4 licencies
Replies: 7
Views: 1802

Re: Re-Use of non used L4 licencies

When you refer to that court judgement, I think the only matching case within the MikroTik environment is where you have bought an L4 upgrade license in the past and used it to upgrade your device to L4, now your device is defective or unusable due to low performance and you bought a new device. You...
by pe1chl
Mon Mar 09, 2020 4:35 pm
Forum: General
Topic: LoRaWAN forwarding with IPv6
Replies: 7
Views: 2174

Re: LoRaWAN forwarding with IPv6

The ping utility cannot resolve IPv6 addresses from domain name.
Yes, that is a bug. But it is unrelated to the problem you are trying to solve, so don't get distracted by that.
Go back to the solution suggested above (install LoRa only AFTER IPv6 was enabled).
by pe1chl
Sat Mar 07, 2020 11:25 am
Forum: General
Topic: Please add basic portScan tool ( port scanner scan )
Replies: 47
Views: 18036

Re: Please add basic portScan tool ( port scanner scan )

There already is "/tool ip-scan" which scans using ping, arp, snmp and netbios and does IP lookup in DNS.
Maybe you can specify what other features you would want it to have?
(like other services it should scan for, or to have a list of ports)
by pe1chl
Fri Mar 06, 2020 1:21 pm
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10901

Re: feature request ADVANCED DNS Server

Please don't spoil the opportunity of having some functionality enhancements by coming up with so many proposed features that it is going to be put on a "too hard - look at it for v8" list! I purposely have omitted any features that would be required to run an internet-facing DNS server. A router ju...
by pe1chl
Fri Mar 06, 2020 11:31 am
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10901

Re: feature request ADVANCED DNS Server

Totally with pe1chl. For the conditional forwarders I'd love to see having this possibility for reverse lookups as well. Like That is not different functionality. To have reverse working for subnet 172.16.16.0/24 you configure an NS record for 16.16.172.in-addr.arpa. (and the router should forward ...
by pe1chl
Fri Mar 06, 2020 11:28 am
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10901

Re: feature request ADVANCED DNS Server

When you would go "fancy" (but still this is supported in many other home routers): - have an an automatic zone for each DHCP server (a specified domain name, could be .local but can be anything) where assigned addresses are automatically populated with their hostname (forward and reverse) The doma...
by pe1chl
Fri Mar 06, 2020 11:01 am
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10901

Re: feature request ADVANCED DNS Server

I think it should have the following functionality in addition to what it can do now: - for static records, add the capability to install a CNAME, MX, TXT, NS or SRV record (in addition to the A and AAAA that it can do now). - allow to forward queries for a statically inserted domain to a specified ...
by pe1chl
Thu Mar 05, 2020 5:44 pm
Forum: General
Topic: UNTAGGED AND TAGGED VLAN ON HEX LITE
Replies: 6
Views: 3233

Re: UNTAGGED AND TAGGED VLAN ON HEX LITE

The information in this topic is no longer valid.
by pe1chl
Thu Mar 05, 2020 4:18 pm
Forum: General
Topic: feature request ADVANCED DNS Server
Replies: 42
Views: 10901

Re: feature request ADVANCED DNS Server

I have given up on ever getting something simple as a capability to add a record that replies with NXDOMAIN. Instead I filed an enhancement request at Firefox so I can work around it use the specific case of use-application-dns.net, and it was accepted surprisingly easily. I still would like to have...
by pe1chl
Wed Mar 04, 2020 2:53 pm
Forum: General
Topic: L2TP with IPsec MTU settings
Replies: 5
Views: 2263

Re: L2TP with IPsec MTU settings

That is right, there should be difference of 40 between MTU and MSS.
It us better to use the automatic MSS clamping... (clamp to pMTU)
by pe1chl
Tue Mar 03, 2020 5:12 pm
Forum: Forwarding Protocols
Topic: OSPF Drops when adding a comment?
Replies: 13
Views: 3565

Re: OSPF Drops when adding a comment?

Will v7 also solve it for items outside routing protocols? Like interfaces, addresses, etc?
by pe1chl
Tue Mar 03, 2020 2:52 pm
Forum: Beginner Basics
Topic: DHCPDISCOVER and DHCPOFFER spam on DHCP server from Mikrotik router
Replies: 10
Views: 2470

Re: DHCPDISCOVER and DHCPOFFER spam on DHCP server from Mikrotik router

You disabled both DHCP server and DHCP relay? You only need DHCP client.
by pe1chl
Tue Mar 03, 2020 2:50 pm
Forum: Forwarding Protocols
Topic: OSPF Drops when adding a comment?
Replies: 13
Views: 3565

Re: OSPF Drops when adding a comment?

I would think the whole "OSPF Drops when adding a comment" issue is not specific to OSPF at all, but only to the whole RouterOS environment. The same thing happens when adding a comment to an interface, a BGP peer, an IP address, etc etc etc. Is this something that has been fixed or is going to be f...
by pe1chl
Tue Mar 03, 2020 11:45 am
Forum: Forwarding Protocols
Topic: OSPF Drops when adding a comment?
Replies: 13
Views: 3565

Re: OSPF Drops when adding a comment?

Yes it is probably a thing in their configuration framework, where any change to an item will send it a message to update its state, even when the change has no effect on the state at all. Of course it is difficult for us to see what changes exactly affect the state. One would think a comment certai...
by pe1chl
Mon Mar 02, 2020 3:49 pm
Forum: General
Topic: GRE VPNs weird behavior
Replies: 5
Views: 1828

Re: GRE VPNs weird behavior

What I mean: make rules for output and forward that block all packets that do not have the correct (source) address for each of the ISPs.
E.g. when you have address 11.22.33.44 for the ISP connected to WAN1, make an output rule that blocks !11.22.33.44 (not the ! meaning NOT) on WAN1.
by pe1chl
Mon Mar 02, 2020 11:51 am
Forum: RouterBOARD hardware
Topic: Which CCR? Need Advice / Recommendation [SOLVED]
Replies: 22
Views: 6047

Re: Which CCR? Need Advice / Recommendation [SOLVED]

Apparently your modem and the CCR do not like eachother. It is only happening on the internet link to some ISP-provided modem, right? I have not seen this issue with the CCRs I use. But I have seen it with an RB750Gr3. Are you sure there has been no special configuration on the ethernet on both side...
by pe1chl
Sun Mar 01, 2020 9:08 pm
Forum: General
Topic: Automatic MTU/MRU for the PPPoE Client
Replies: 12
Views: 3369

Re: Automatic MTU/MRU for the PPPoE Client

Not necessarily, it may just as well be that the Ubiquiti has client MTU/MRU values of 1492. It is not "following the server side", it still gets the min of server and client and it works out OK in this case. As I explained before, in RouterOS the client default is 1480 and the server cannot overrid...
by pe1chl
Sat Feb 29, 2020 1:32 pm
Forum: Beginner Basics
Topic: [SOLVED] Native VLAN support for MikroTik Hex S RB760iGS [SOLVED]
Replies: 11
Views: 3312

Re: [SOLVED] Native VLAN support for MikroTik Hex S RB760iGS [SOLVED]

yes, you can now delete the VLAN-bridge it is no longer required. note that this solution does not use hardware acceleration. although that should have been possible. maybe later MikroTik will add support for that and it will magically become available when RouterOS is updated. (you can now set the ...
  • 1
  • 2
  • 3
  • 4
  • 5
  • 22