Community discussions

MikroTik App

Search found 6969 matches

  • 1
  • 2
  • 3
  • 4
  • 5
  • 24
by pe1chl
Wed Oct 28, 2020 9:54 pm
Forum: Scripting
Topic: Mikrotik Scripting needs to be useful! Requests!
Replies: 5
Views: 225

Re: Mikrotik Scripting needs to be useful! Requests!

In the old days there was LUA. But it has been removed, I think after it caused a security problem (not sure).
Hopefully something like that can return.
by pe1chl
Tue Oct 27, 2020 2:19 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

pe1chl - Of course we do. That is why we always ask to contact support@mikrotik.com and send a supout file if there is a potential software issue. I did that, but although the issue I identified is a possible DoS problem I heard nothing until I solved it myself and sent info about my findings... No...
by pe1chl
Tue Oct 27, 2020 11:27 am
Forum: General
Topic: GRE Tunnel with Hap ac3 LTE
Replies: 11
Views: 320

Re: GRE Tunnel with Hap ac3 LTE

I understand you completely. Let me try and explain exactly what I want to do. At my company we use GRE tunnel between to mikrotiks with a static WAN IP. One mikrotik is placed in our server room and the other in a building we manage. This works well as they have both a Public IP address. Sometimes...
by pe1chl
Tue Oct 27, 2020 11:23 am
Forum: General
Topic: GRE Tunnel with Hap ac3 LTE
Replies: 11
Views: 320

Re: GRE Tunnel with Hap ac3 LTE

I have a public IP but i cannot acces the router, not even with the DDns. I think thats where the problem starts Sounds like that. And as GRE doesn't have the notion of port like TCP or UDP, it cannot be handled by NATs, so the mobile ISPs often block it completely. Well, that is not really correct...
by pe1chl
Tue Oct 27, 2020 10:39 am
Forum: General
Topic: GRE Tunnel with Hap ac3 LTE
Replies: 11
Views: 320

Re: GRE Tunnel with Hap ac3 LTE

Another problem is that (at least in RouterOS) for GRE you need to have a static peer address, and your LTE device likely has a dynamic address. When you want a hub-and-spoke VPN where the hub is on a fixed address and spokes have dynamic addresses, GRE is not very convenient. GRE/IPsec could be a l...
by pe1chl
Mon Oct 26, 2020 12:26 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

I am not entirely sure, but I think we can provoke it, by changing port speed on an interface ex. to "100 half duplex" and back to "auto negotiate". While of course a router should not crash under these circumstances, this is a setting that you normally should not touch. It does not work like most ...
by pe1chl
Mon Oct 26, 2020 11:05 am
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

Send the supout.rif to support@mikrotik.com to help them identify the process which leaks. I wonder if they have better tools to examine the supout.rif than the viewer available online (in your mikrotik.com account). I had a memory leak recently but browsing through the sections of the supout.rif d...
by pe1chl
Sun Oct 25, 2020 7:50 pm
Forum: RouterOS v7 BETA
Topic: rOS 7.1b2 [bug] ip > routes
Replies: 1
Views: 196

Re: rOS 7.1b2 [bug] ip > routes

Has been reported (as it should be) in the release topic before, but it has not yet been fixed.
by pe1chl
Sat Oct 24, 2020 10:56 am
Forum: General
Topic: Wildcard DNS
Replies: 15
Views: 740

Re: Wildcard DNS

I did not mean the implementation in RouterOS, I mean "that people sometimes have wrong expectations about them, or don't understand limitations". There are unfortunate limitations and unexpected results which are defined in the standard but do not correspond to reasonable expectations. For using * ...
by pe1chl
Fri Oct 23, 2020 9:42 pm
Forum: General
Topic: Wildcard DNS
Replies: 15
Views: 740

Re: Wildcard DNS

While it is true that the DNS server in RouterOS is not very well designed, I doubt that the scenario asked above would work well in a standard DNS server. Concepts like wildcards and CNAMEs are defined in a very strange way in the DNS standard, and usually they won't work like you want or expect th...
by pe1chl
Fri Oct 23, 2020 9:36 pm
Forum: General
Topic: Address List Group???
Replies: 3
Views: 408

Re: Address List Group???

The underlying mechanism in Linux does support that, but RouterOS does not expose it in the UI.
It should be relatively easy to add. But so are a lot of things that are requested here, that does not mean it is actually going to happen.
by pe1chl
Fri Oct 23, 2020 4:06 pm
Forum: Announcements
Topic: v6.47.6 [stable] is released!
Replies: 35
Views: 5844

Re: v6.47.6 [stable] is released!

I just updated two of my 3011 and only one had this issue and that is the one that has wireless package disabled. So it might be related to that? Yes, it is the cause. The problem is that the configuration script contains commands that refer to features not available (wireless) and bombs out. It ha...
by pe1chl
Fri Oct 23, 2020 11:05 am
Forum: Announcements
Topic: v6.47.6 [stable] is released!
Replies: 35
Views: 5844

Re: v6.47.6 [stable] is released!

The defconf issue is already resolved. Fix will be included in the next RouterOS release.
It has been resolved before!
I would hope that when such mistakes are made, they are added to the regression testing done before releasing a new version, especially in [stable].
by pe1chl
Thu Oct 22, 2020 5:16 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

You can force a downgrade and then restore the backup you made before you installed the beta (you made a backup, right?). Or you could make an export of the currently running version and keep that as a guide (download it to a PC and open it in notepad) when configuring a 6.x version after you have r...
by pe1chl
Thu Oct 22, 2020 11:04 am
Forum: General
Topic: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2
Replies: 42
Views: 15003

Re: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2

We get told the CPEs have 7.3MB left and 7.4MB are needed. We need a way to package single .npk files into an upgrade package with just what we need. Would we ever consider MPLS on a hAP Lite? Not in a million years... so why not give us the ability to remove it from the upgrade package? In 6.47 th...
by pe1chl
Wed Oct 21, 2020 8:59 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

The external antennas could perform better in the multi-chain setup, the receive SNR could be better when the client is low-power and the environment is quiet, etc. But the promise of "stronger signal" is never going to be realized, that is for sure (unless illegal tweaks to the tx power are made). ...
by pe1chl
Wed Oct 21, 2020 7:08 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

Of course it is only a sales blurb. The ERP (effective radiated power) of an access point has to conform to strict regulations, and all are operating at the max legal limit for the country they are used. Better antennas will make no difference because the tx power has to be decreased the same amout ...
by pe1chl
Wed Oct 21, 2020 11:13 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

there is no chains of any kind in 20MHz 2.4G wifi, as far as I know.
But what do you know? Maybe better to check your router config.
by pe1chl
Wed Oct 21, 2020 10:53 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

You are talking about the power, not the rate. The allowed transmit power is the maximum allowed ERP minus the antenna gain minus 3dB for 2 chains, 5dB for 3 chains, 6dB for 4 chains. So when you have a 2-chain device with 3dB antenna gain, 14dBm is the correct transmit power when 20dBm ERP is allow...
by pe1chl
Tue Oct 20, 2020 11:31 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

Well, according to your calculations, pe1chl's router is 1/5th of the way there. I do have other concerns: Note that this happened because I had "/tool graphing" with store-on-disk=yes running for some time. That caused a lot of flash writes because it writes the graphs to flash every 5 minutes. I ...
by pe1chl
Tue Oct 20, 2020 11:26 am
Forum: RouterBOARD hardware
Topic: Mikrotik VDSL / DSL Modem?
Replies: 368
Views: 125209

Re: Mikrotik VDSL / DSL Modem?

Any news on working SFP VDSL2 (v35b) modem for our MT Routers? I think it will not happen. They live in a part of the world where VDSL is not a thing, they think it is dead and not worth supporting. That already was a problem 4 years ago when this topic was started, so it likely has only become wor...
by pe1chl
Tue Oct 20, 2020 11:22 am
Forum: General
Topic: RB951G-2HnD reset issue
Replies: 10
Views: 369

Re: RB951G-2HnD reset issue

I found this topic, might explain the behavior:
viewtopic.php?t=114200
He already covered that.
by pe1chl
Mon Oct 19, 2020 7:43 pm
Forum: General
Topic: RB951G-2HnD reset issue
Replies: 10
Views: 369

Re: RB951G-2HnD reset issue

The button may be broken. This sometimes happens because there is so little feedback whether you have pressed it correctly, and sometimes people react by pressing it ever firmer... However, many models also have a hole in the circuit board where you can reset the router using anything that bridges t...
by pe1chl
Mon Oct 19, 2020 11:56 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

Come on, guys, it wrote 400k in one year and then 400k in one month on 6.47.4. Is this affecting the lifetime of the internal storage or not?
Probably not. My home router has 36 137 507 total sector writes and it is still going strong.
by pe1chl
Sun Oct 18, 2020 12:17 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

Who could explain me why my phone suffers from intermittent drops. I've updated to the latest version the same issue persists. It usually happens when my internal DNS server is down. You might tell me - there is no internet connection. However I've got AC68U at hand when my phone connects to it pro...
by pe1chl
Sat Oct 17, 2020 10:52 am
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

It is normal that you lose all the files stored in the filesystem and not in the flash directory (and you should not keep a stash of backups there because it fill fill up the small flash space available). However, it is NOT normal that the unit comes back with all the settings set to defaults. Setti...
by pe1chl
Fri Oct 16, 2020 9:08 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

So a general remark: I think cases should remain browseable for the submitter, even after they have been closed by MikroTik. I am pretty sure they are. Log in to the support portal and see your closed cases. Ok now I see that with even more clicking they can be made visible... (it would be so much ...
by pe1chl
Fri Oct 16, 2020 7:51 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

I had reported case SUP-28445 (memory leak in the DNS resolver) and when I now test it, it appears that it is fixed, but I do not remember what the reply size threshold was when I experienced this problem and reported it on the technical support service desk. And there is no mention of this issue in...
by pe1chl
Thu Oct 15, 2020 3:53 pm
Forum: Beginner Basics
Topic: Questions relating to Hotspot, https redirects, certificates + SUP-30646
Replies: 14
Views: 427

Re: Questions relating to Hotspot, https redirects, certificates + SUP-30646

This problem cannot be solved in a hotspot, captive portal, etc. It has to be solved by the client device. And modern client devices already solve that issue. So you should not see it anymore. The solution varies per manufacturer but the common part is that when you open a browser it first fetches s...
by pe1chl
Wed Oct 14, 2020 1:17 pm
Forum: General
Topic: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2
Replies: 42
Views: 15003

Re: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2

I've got two devices with 16meg flash. Looking at "Files" both report around 12.6 used out of 16, but the actual files listed only amount to less than 100k. How do you see what is actually occupying flash? This is not about 16M flash. That is not the problem (yet). You cannot see the RouterOS files...
by pe1chl
Wed Oct 14, 2020 10:31 am
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

Second it is advertised as GPEN, which should be mostly ISPs area, less Enterprise area and almost none of Home area, but it is not usable for ISPs and Enterprise scenarios. I think they are targeting a different kind of ISP than you have in mind... which more resembles home usage than enterprise u...
by pe1chl
Wed Oct 14, 2020 10:28 am
Forum: General
Topic: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2
Replies: 42
Views: 15003

Re: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2

As written in other threads, it was not good to make the "combined package" and thus make it impossible to remove packages and gain space. Indeed as you point out, there are packages on this class of devices that have absolutely no business being there. But they do take up space. In my opinion the p...
by pe1chl
Wed Oct 14, 2020 12:35 am
Forum: General
Topic: single ipv6 /64 range
Replies: 21
Views: 659

Re: single ipv6 /64 range

To get a working routed setup you need 2 prefixes. Can't the ISP router just use the link-layer address of the OP's WAN (which it has got from the DHCP request for the prefix) as a gateway to the /64 it has assigned to the OP's router? I.e. is the interconnection subnet at the WAN side absolutely n...
by pe1chl
Tue Oct 13, 2020 11:43 pm
Forum: General
Topic: single ipv6 /64 range
Replies: 21
Views: 659

Re: single ipv6 /64 range

Yes when properly configured that should work. But apparently they are beginners and they think that everyone would ask for a prefix via DHCPv6 and then use that directly on their network, just as a DHCPv4 server would be used. To get a working routed setup you need 2 prefixes. In my case on my home...
by pe1chl
Tue Oct 13, 2020 9:16 pm
Forum: General
Topic: single ipv6 /64 range
Replies: 21
Views: 659

Re: single ipv6 /64 range

In a colocation rack that I manage there is "a single /64" as well, but the server are directly on the segment with that /64 (via a switch), not behind a router. There is a /28 IPv4 network as well and a couple of servers (and a CCR) have addresses from that. There is no IPv6 routing beyond that. Wh...
by pe1chl
Tue Oct 13, 2020 8:02 pm
Forum: General
Topic: Some services are not working with pppoe connection
Replies: 19
Views: 1950

Re: Some services are not working with pppoe connection

It starts with understanding what the issue is, how it fits in your network topology, and then debug what is really going on. A network with PPPoE (and no RFC4638) will never be completely trouble-free. It will be worse when there are operators that think that ICMP is dangerous and has to be blocked...
by pe1chl
Tue Oct 13, 2020 6:24 pm
Forum: General
Topic: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2
Replies: 42
Views: 15003

Re: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2

mongobongo: Did you ever try to reboot the device just before trying the update? That may solve it for now. The reason I mention this is that MikroTik claim in many threads that they "always test an upgrade with a device running with default settings" and they claim it works. But we as the users see...
by pe1chl
Tue Oct 13, 2020 12:12 pm
Forum: General
Topic: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2
Replies: 42
Views: 15003

Re: Out of disk space - upgrading hAP Lite from v6.35 to v6.35.2

My question was, does anyone have issues using "check for updates" with a device with factory installed version? Because in the examples I either see custom package sets, or 6.48 beta versions. I had this problem on my hAP mini (MUM freebie) but I solved it by one time doing an upgrade using only t...
by pe1chl
Tue Oct 13, 2020 12:04 pm
Forum: General
Topic: single ipv6 /64 range
Replies: 21
Views: 659

Re: single ipv6 /64 range

I have a single ipv6 /64 range given to me by my isp
That is normally where the problems start. Did you try to ask them why they aren't a bit more reasonable?
I mean, I get a /48 and I don't think that is warranted, but a /56 or at least a /60 should solve many customer's problems...
by pe1chl
Tue Oct 13, 2020 11:52 am
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

Second it is advertised as GPEN, which should be mostly ISPs area, less Enterprise area and almost none of Home area, but it is not usable for ISPs and Enterprise scenarios. I think they are targeting a different kind of ISP than you have in mind... which more resembles home usage than enterprise u...
by pe1chl
Thu Oct 08, 2020 3:13 pm
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

When a device requests a lease from the DHCP server, then its hostname is changed and the device rebooted so the lease is requested again, the Hostname in the DHCP Leases list is not updated. Only when the lease is deleted in the DHCP Leases list and then re-requested by the device, the Hostname is ...
by pe1chl
Thu Oct 08, 2020 2:56 pm
Forum: General
Topic: Problems with traffic (only one way works) in IPSEC tunnel
Replies: 17
Views: 2090

Re: Problems with traffic (only one way works) in IPSEC tunnel

That is not standard IP routing. You normally have a different IP address on each of your interfaces, in this case your LAN interfaces and your tunnel endpoints. In case of L2TP/IPsec there would be a separate subnet where the central router has an IP address (I put it on a separate bridge without a...
by pe1chl
Wed Oct 07, 2020 12:09 pm
Forum: Beginner Basics
Topic: Couple of Quick Questions on Mangle Marks
Replies: 1
Views: 830

Re: Couple of Quick Questions on Mangle Marks

You should be aware that some matches cannot be applied in all places. E.g. in-interface can only be matched in prerouting, out-interface can only be matched in postrouting. So when the use case requires that the in-interface is part of the matching criteria, it has to be applied in prerouting. Inde...
by pe1chl
Tue Oct 06, 2020 5:44 pm
Forum: Scripting
Topic: Force router to reboot in 5 or 10 minutes from now [SOLVED]
Replies: 6
Views: 411

Re: Force router to reboot in 5 or 10 minutes from now [SOLVED]

The scheduler is the advised way to do that. Just enter a one-time (00:00:00 repetition interval) job and set the correct time for it to run. I have a job like this in the scheduler at all times: /system scheduler add name=scheduled_reboot on-event="/system reboot" policy=\ ftp,reboot,read,write,pol...
by pe1chl
Tue Oct 06, 2020 11:04 am
Forum: General
Topic: Problems with traffic (only one way works) in IPSEC tunnel
Replies: 17
Views: 2090

Re: Problems with traffic (only one way works) in IPSEC tunnel

GRE/IPsec is much simpler! You just add the GRE tunnel interfaces on each peer, set an IPsec secret there so all IPsec will be auto-configured. Then you add a /30 network address on each tunnel end, and you can then either set static routes for the remote subnets (a.b.c.d/24 gateway e.f.g.h where e....
by pe1chl
Mon Oct 05, 2020 8:13 pm
Forum: Scripting
Topic: Basic netinstall script "bricking" router [SOLVED]
Replies: 2
Views: 236

Re: Basic netinstall script "bricking" router [SOLVED]

You need to understand that when you provide a configure script, that script has to do all of the configuration. It will be run instead of, not after the normal configuration script. You need to add the further configuration you require to bring up the device and make it able to connect the acs. Lik...
by pe1chl
Mon Oct 05, 2020 7:32 pm
Forum: General
Topic: Not pingable within a bridge
Replies: 3
Views: 222

Re: Not pingable within a bridge

We have a Routerboard [1100AHx2] with 6.32.2 router OS OUCH!! It is time to update that. But of course when it is in a critical place you will need to make sure it will work after the update. This is a version that is many years old and of course lots of things have changes. You could consider to u...
by pe1chl
Mon Oct 05, 2020 7:28 pm
Forum: Scripting
Topic: Force router to reboot in 5 or 10 minutes from now [SOLVED]
Replies: 6
Views: 411

Re: Force router to reboot in 5 or 10 minutes from now [SOLVED]

First, you need to understand that this solution will not work for the same scenario as it is often used in Cisco equipment! In Cisco, any config you have not explicitly saved will be lost when you reboot and the router comes back in the state that was last saved. However, in MikroTik this is not th...
by pe1chl
Mon Oct 05, 2020 2:26 pm
Forum: General
Topic: Problems with traffic (only one way works) in IPSEC tunnel
Replies: 17
Views: 2090

Re: Problems with traffic (only one way works) in IPSEC tunnel

Do you control all the routers in your network? Is there any reason why you need to stick to these direct IPsec tunnels and not use the much simpler to configure GRE/IPsec or IPIP/IPsec tunnels?
by pe1chl
Thu Oct 01, 2020 2:42 pm
Forum: General
Topic: Enable debug logging to specific IPSec peer
Replies: 11
Views: 2905

Re: Enable debug logging to specific IPSec peer

No, there is no change. And while I have made some suggestions for improved log filtering in the feature request (which also have not been picked up...) in the particular case of IPsec it is all even more complex.
I would not hold my breath. Use a separate test router.
by pe1chl
Wed Sep 30, 2020 5:58 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

Yeah, at least you can evaluate the scale of disaster by Monday, not jumping into every small reported bug right after the release :) Also lots of users would probably tend to call or file bugreports immediately when it was during the workweek, while in the weekend they know there will be no immedi...
by pe1chl
Wed Sep 30, 2020 2:28 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

That is correct, unless there is some urgent fix the new releases are normally on friday at the end of their business hours....
Good strategy, it prevents a lot of phonecalls etc.
by pe1chl
Tue Sep 29, 2020 7:52 pm
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

Can I have a link to the Feature requests for SWos I am looking for feature of subnet mask default gateway on SWos software. Without this feature it is impossible to manage/monitor a MikroTik device running on SWos from a different subnet. I am surprised it is omited and is a major limitation. Rega...
by pe1chl
Tue Sep 29, 2020 12:10 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

hAP ac3 looks wonderful!
Now, when will we see these devices at the retailers? 2021,2022 ?? :-)
Our Polish friends say Sep 28! So, next week...
Could you share the store name/web? I could not find anywhere, also not at eurodk as well.
They have removed that availability date now.
by pe1chl
Mon Sep 28, 2020 5:46 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

That is "normal", also for 6.47 versions. It does not always take half an hour but it can take considerable time, being stuck at 7 or 8%.
by pe1chl
Sat Sep 26, 2020 12:31 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

Also not very wise to do. I see the new hAP ac3 and think "well, maybe that could replace my aging RB2011UiAS-2HnD. I need to arrange some larger switch and then I can connect my internet and hamnet directly to the hAP ac3 and the remainder to the switch." But then I see that there also exists a hAP...
by pe1chl
Fri Sep 25, 2020 11:41 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

Those are RouterBOARD bootloader firmware versions ... are you upgrading just that?
What are yours system package versions?
While this is in general a good remark, in this case you can glean the currently running RouterOS version from the firmware versions that he posted!
by pe1chl
Fri Sep 25, 2020 11:39 am
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

That is likely due to an unrelated issue, e.g. there is a NAT router somewhere inbetween or you use connection-tracking and not enough rules to be able to open the connection from both ends. In such a situation the tunnel will fail when there is no traffic for more than the timeout of the connection...
by pe1chl
Fri Sep 25, 2020 11:37 am
Forum: General
Topic: IPSec - routing problem
Replies: 9
Views: 642

Re: IPSec - routing problem

You only need to make an IPIP (or GRE) tunnel and set the IPsec secret in the tunnel config. In that case you also need to set the Local address, it cannot be left blank. RouterOS will then automatically create the required IPsec config. You can also do that manually when you want it to be slightly ...
by pe1chl
Thu Sep 24, 2020 7:24 pm
Forum: RouterBOARD hardware
Topic: hAP ac³ switch chip?
Replies: 11
Views: 1069

Re: hAP ac³ switch chip?

yes, something like that. or have some "reserved VLAN range" (e.g. 4090-4094) that RouterOS can freely use for its own purposes and that can be moved when it is really needed to put a user VLAN in there. then, user defined VLANs can be used in a switching config on ports 2..5 while RouterOS itself c...
by pe1chl
Thu Sep 24, 2020 4:24 pm
Forum: RouterBOARD hardware
Topic: hAP ac³ switch chip?
Replies: 11
Views: 1069

Re: hAP ac³ switch chip?

I think the switches could operate as full VLAN switches, but the router already uses this to allow the user to configure each port separately. So when you then start to group ports again and want to configure VLAN switching on them, that capability is no longer available in hardware. (maybe it coul...
by pe1chl
Thu Sep 24, 2020 10:28 am
Forum: General
Topic: IPSec - routing problem
Replies: 9
Views: 642

Re: IPSec - routing problem

When you want a plain tunnel between office branches that you can use to route whatever you like and still maintain the option to have local traffic to internet at both sites, it is better to change from direct IPsec tunnel to GRE/IPsec (or IPIP/IPsec) tunnel. That will give you a virtual interface ...
by pe1chl
Wed Sep 23, 2020 5:53 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

hAP ac3 looks wonderful!
Now, when will we see these devices at the retailers? 2021,2022 ?? :-)
Our Polish friends say Sep 28! So, next week...
by pe1chl
Wed Sep 23, 2020 5:22 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

I loved the hAP ac³! And it comes with 128MB storage! Now it will be possible to use partitioning at home! :D Yes it looks good, I am sort-of looking for a router to replace my aging RB2011 at home and this could be it (of course with an additional switch). Unfortunately there are no performance sp...
by pe1chl
Wed Sep 23, 2020 5:16 pm
Forum: Announcements
Topic: Newsletter 97 (September 2020)
Replies: 86
Views: 13443

Re: Newsletter 97 (September 2020)

Excellent videos! Good to see the team and the products, puts a human touch behind the brand.
Normis as a movie star :-)
Of course you can consider to visit a MUM and meet them in person.
by pe1chl
Wed Sep 23, 2020 5:04 pm
Forum: Scripting
Topic: Export over api differs from export over terminal
Replies: 5
Views: 348

Re: Export over api differs from export over terminal

When this is the only difference, maybe it is possible to change the file with some global substitutes? (e.g. using sed or some extra code in your program that calls the API)
by pe1chl
Wed Sep 23, 2020 1:58 pm
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

Nice work pe1chl. Out of curiosity, how did you find out the issue, what did you observe? I happen to have another router on the same network and it had the same problem. That is a CHR with a lot less memory so it crashed a lot sooner. As this router does not pass that much traffic as the CCR (it w...
by pe1chl
Wed Sep 23, 2020 1:02 pm
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

It is caused by the combined package. That was a dumb idea that never should have been introduced. Before that, you could just delete unneeded packages, now you can only disable them but they still take space. When you have this issue, see which packages you need, one time download the zip file with...
by pe1chl
Wed Sep 23, 2020 10:42 am
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

Exactly. In that configuration (and when the switches are indeed from the same manufacturer) it would normally be possible to configure them as a "stack" and save a lot of effort configuring. But of course then you first need to read the manual chapter about the stacking, which lots of users never d...
by pe1chl
Tue Sep 22, 2020 3:13 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

It is a good idea, but it should support redundant connections and redundant switches. I.e. a "controlling bridge" is fine for configuration purposes but it should not be a SPOF in the actually running network.
by pe1chl
Tue Sep 22, 2020 10:54 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

An ipipv6 tunnel problem remains in 6.47.4. When pppoe client disconnect and then reconnect, ipv6 address of device is changed , but local address of ipipv6 tunnel is not changed (ipv6 firewall connection print), and the tunnel is down actually. I didn't configure "local-address" value. I think it ...
by pe1chl
Tue Sep 22, 2020 12:13 am
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

Also note that VLAN 0 is still rejected in v7 even though that is a valid value. Maybe not on a bridge but certainly on an ethernet interface. When VLAN 0 is not going to be implemented there should be some flag that allows you to push an 802.1q tag with the current priority e.g. as an interface- or...
by pe1chl
Mon Sep 21, 2020 10:54 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

Any dates to get the Stable Release? I like to not continue using 6.xx and already push to get 7.xx
There are still so many small issues (and likely some big ones) that it would be foolish to promote it to "stable" anytime soon!
And of course it would have to go via "testing" anyway.
by pe1chl
Mon Sep 21, 2020 10:27 pm
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

do you use doh (dns over https) ? it will reduce the amount of your memory No I don't use it. The router has standard DNS servers and barely uses DNS at all. (it is not a resolver for other systems in the network) I have located the problem and will inform MikroTik in de support case I had opened f...
by pe1chl
Mon Sep 21, 2020 8:17 pm
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

do you use doh (dns over https) ? it will reduce the amount of your memory No I don't use it. The router has standard DNS servers and barely uses DNS at all. (it is not a resolver for other systems in the network) In the meantime I have discovered that another router which is on the same segment ha...
by pe1chl
Mon Sep 21, 2020 11:14 am
Forum: Announcements
Topic: v6.47.4 [stable] is released!
Replies: 68
Views: 14718

Re: v6.47.4 [stable] is released!

One of my CCR1009's appears to have developed a memory leak. It had been running 6.47 and and uptime of 3.5 months and yesterday it crashed due to kernel fault, out of memory. As there was a network interruption anyway I upgraded it, to 6.47.3 as that was the newest available yesterday, and now I se...
by pe1chl
Sun Sep 20, 2020 9:45 pm
Forum: General
Topic: static routing host throu GRE over ipsec
Replies: 1
Views: 142

Re: static routing host throu GRE over ipsec

Make the GRE interface on each router. Put an IP address on the GRE interface in a different network than what you are using for the LAN. (e.g. 10.0.0.1/30 at one end and 10.0.0.2/30 at the other end) Then insert static routes for the other side network range with gateway equal to the other side's G...
by pe1chl
Sun Sep 20, 2020 9:39 pm
Forum: General
Topic: IPSEC with QOS flags transfer
Replies: 6
Views: 668

Re: IPSEC with QOS flags transfer

It does not work with L2TP/IPsec, but it does work with GRE/IPsec (when you set the DSCP option to "inherit").
by pe1chl
Sat Sep 19, 2020 8:50 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

Bug(?) (3.15 -> current): make any changes to an opened window (just moving it is enough) save session, close that window to which you've made changes. try to open that window again -> winbox session crashes. Thanks for explaining how that happens! It has happened many times to me that winbox crash...
by pe1chl
Sat Sep 19, 2020 3:39 pm
Forum: General
Topic: RPKI
Replies: 48
Views: 13800

Re: RPKI

Is it too much trouble for you go google how RPKI works, how the structure of RTR client, RPKI server etc is, and how to obtain and install a server?
by pe1chl
Fri Sep 18, 2020 11:28 am
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

Might make a capture myself in the next days, if I can make time and get some decent software for that. I used Kazam and I ran into the problem that when trying to demo it with column-width dragging the framerate was too low and most of the jumps were not showing in the captured video... I don't kn...
by pe1chl
Thu Sep 17, 2020 9:37 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

Ok, I thought you meant to use address lists as part of routing filters (the other way around) and then distribute those lists via DNS...
by pe1chl
Thu Sep 17, 2020 4:18 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

I have submitted that to support including a screen capture movie of the problem. They are aware of the problem, hopefully a fix is coming. For me it appeared to be solved but it again came back. To test if a new version is affected, I try to drag the column width in such a screen. When the problem ...
by pe1chl
Thu Sep 17, 2020 4:08 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

For this to be of any use, first two changes have to be made: - address list from DNS should allow subnets, via a TXT record containing CIDR subnet notation (in addition to current A and AAAA record support) - address list from DNS should have no unreasonable size limits, i.e. when I can "dig" the D...
by pe1chl
Thu Sep 17, 2020 1:56 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

Does that already split the data on line boundaries into elements of the array? In that case it is equivalent to what Chupaka suggested to be added. However, I prefer solutions that do not have such small arbitrary limits. E.g. when I would like to download a file with lines with addresses or subnet...
by pe1chl
Thu Sep 17, 2020 12:27 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

Oh, I did not know that there was a 64kB limit on arrays. When that is the case, forget about that method and just do the open/read/write/close. It has no such limits, it can loop to read all lines and process them without storage limit issues. (reading and processing lines one by one does not neces...
by pe1chl
Thu Sep 17, 2020 11:10 am
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

Ok, that would likely read the entire fire beforehand and store it into an array in memory, but indeed for many purposes (and with today's typical RAM size) that would already be very good! Of course it would be nice when there also was some way to write-out such an array to a file (1 array element ...
by pe1chl
Wed Sep 16, 2020 12:19 pm
Forum: RouterOS v7 BETA
Topic: Scripted firewall rule ordering fails
Replies: 7
Views: 336

Re: Scripted firewall rule ordering fails

You can use place-before but you should not use a line number. E.g. use place-before=[find where comment="xxx"] You should agree that this is much better than using a line number when it is done in a script. The script cannot know if other lines have been inserted by the admin that move the line num...
by pe1chl
Wed Sep 16, 2020 11:49 am
Forum: RouterOS v7 BETA
Topic: Scripted firewall rule ordering fails
Replies: 7
Views: 336

Re: Scripted firewall rule ordering fails

It is not possible to use ordering sequence numbers in a script! These are only valid in terminal sessions, and only after a print command. When you do a print on the terminal, it shows you the lines with the numbers and at the same time builds a table of numbers and the corresponding line. Then you...
by pe1chl
Wed Sep 16, 2020 11:42 am
Forum: General
Topic: A L2TP bug of ten years
Replies: 7
Views: 467

Re: A L2TP bug of ten years

I have never seen that, and I have quite some L2TP setups. Although always over IPsec. But I don't think that should affect this. I have several L2TP clients that operate over 4G sticks that get a new IP address every day or every 8 hours, and of course at that time they lose the connection. But the...
by pe1chl
Tue Sep 15, 2020 4:28 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

I have a feature request that should be "relatively easy to implement" :-) There is the existing "/ip dhcp-server vendor-class-id" feature in the DHCP server. I would like to match the items not only by class-id but also by MAC address/mask. Preferably as an AND function with two optional fields: yo...
by pe1chl
Tue Sep 15, 2020 2:29 pm
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

- vendor class identifier (a string) Isn't that what's already supported? https://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server#Vendor_Classes Ok I was not aware of that. Indeed it is most like what I need except that I would like an extra match capability on MAC address/mask. - MAC address (a value...
by pe1chl
Tue Sep 15, 2020 11:56 am
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

I wouId like to see some classification options (filters) in the DHCP server, so that one can direct different device classes into different pools/networks. E.g. the ISC DHCP server has a quite powerful mechanism for that, where you can define a "class" based on the DHCP request parameters (like ven...
by pe1chl
Mon Sep 14, 2020 7:39 pm
Forum: Useful user articles
Topic: Whitelisting websites
Replies: 16
Views: 7148

Re: Whitelisting websites

That solution assumes that there is only a single, fixed, address for each website. That may be true for a personal site or the site of a small company (especially when it already exists for a long time), but for more commonly requested sites like facebook, youtube, etc this is not at all the case. ...
by pe1chl
Mon Sep 14, 2020 6:43 pm
Forum: The Dude
Topic: Concatenate - how to properly escape double quotes?
Replies: 3
Views: 290

Re: Concatenate - how to properly escape double quotes?

My experience with RouterOS scripting is that you cannot make expressions more and more complex and expect them to behave like most programming languages would. I.e. you could assign some expression to a variable, you can pass some constant or variable to a function as a parameter, but that does not...
by pe1chl
Sat Sep 12, 2020 11:47 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

A built-in function that broke up files and variables into 4096 byte chunks would be extremely useful. I think the scripting language should be extended with a file open/read/write/close construct where you can open a file (a handle is returned), then read or write it in a loop either line-by-line ...
by pe1chl
Fri Sep 11, 2020 11:05 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

Users claiming netinstall doesn't work normally have made a mistake. It is not wise to try netinstall first on a device that already is in trouble, as when you tried it on a working device you would have found it is usually finicky. You have to get the feel of it, and of course you have to have all ...
by pe1chl
Thu Sep 10, 2020 12:33 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

Session > new, opens up a new session, and will not save upon exit if it's not done manually. osc86 is probably confused what a "session" is and expected that a new session means a new connection (so the same as the New WinBox button). It should open a new winbox window where you can select a new s...
by pe1chl
Wed Sep 09, 2020 5:02 pm
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

Claims are made elsewhere that they do test this and that it works with default config, but that probably is only true for version 6. And even for version 6 you very quickly run into trouble, probably does not require much config at all, likely it is already sufficient to let it run for a month and ...
by pe1chl
Wed Sep 09, 2020 12:02 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

*) ipsec - do not kill connection when peer's "name" or "comment" is changed; Wow. It's possible to make this change for vpls , pptp , openvpn interfaces too? In fact this should be done for every possible item in the config. Don't know what is the exact status now, but I have seen many things go d...
by pe1chl
Wed Sep 09, 2020 11:59 am
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

Yes, of course the easy thing would be to rip out all the features that a "normal" user would not use on such a tiny device (like routing, capsman, hotspot and of course mpls (but that is not yet present in v7) and make those available as separate packages only. Then those that want to use those dev...
by pe1chl
Tue Sep 08, 2020 6:42 pm
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

Read again what I wrote. Do not uninstall packages, install separate packages from the zip file.
(for 6.4x of course. just forget about using version 7 on such a small device, that will not be realistically possible)
by pe1chl
Tue Sep 08, 2020 11:15 am
Forum: Beginner Basics
Topic: Add MGMT Vlan to DMZ
Replies: 14
Views: 565

Re: Add MGMT Vlan to DMZ

When you have an ESXi host that you want to manage, of course you can put the management on another ethernet port. Or you could make both DMZ and MGMT a tagged VLAN, connect it to the virtual switch and make separate portgroups on each VLAN, connect the MGMT to the ESXi kernel and put all DMZ hosts ...
by pe1chl
Mon Sep 07, 2020 7:48 pm
Forum: General
Topic: 6.30 ipsec-policy matcher question
Replies: 12
Views: 1949

Re: 6.30 ipsec-policy matcher question

It is true (and I think it is correct) that ipsec-policy=in,none matches all traffic that is NOT protected by IPsec, and ipsec-policy=in,ipsec matches all traffic that IS protected by IPsec. At least, that is how I always used it. Like this: add action=accept chain=input-inet comment=L2TP/IPsec dst-...
by pe1chl
Sun Sep 06, 2020 2:06 pm
Forum: Beginner Basics
Topic: Add MGMT Vlan to DMZ
Replies: 14
Views: 565

Re: Add MGMT Vlan to DMZ

Note that the vlan-aware bridge is less versatile than the general solution of putting vlan interfaces in a bridge. For example, it is not possible to have different tags on different ports (tag translation). Of course it should not be used in environments with STP. It also does not solve the issue ...
by pe1chl
Sun Sep 06, 2020 12:50 pm
Forum: Beginner Basics
Topic: Add MGMT Vlan to DMZ
Replies: 14
Views: 565

Re: Add MGMT Vlan to DMZ

Only when you have untrusted hosts in the DMZ that can tag their traffic with the MGMT Vlan tag. When you want to guard against the possibility that someone hacks one of your DMZ hosts to get root access and is able to add VLAN interfaces, you should not do that config. But that is a result of your ...
by pe1chl
Sun Sep 06, 2020 12:45 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

I have an issue here with the 7.1 beta 2 on 3 hAp ac^2 devices. Had te return to the stable branch for wireless to become stable again.
On all devices i had serious stability issues.
Such a posting would actually be useful when it included relevant details of what you were experiencing.
by pe1chl
Sun Sep 06, 2020 12:12 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

...
I fully agree with you, and also I think he is mainly a wireguard fanboi and makes false claims about the alternative methods (especially on RouterOS).
But hey, there are many of them.
by pe1chl
Sun Sep 06, 2020 11:55 am
Forum: Beginner Basics
Topic: 2 mikrotik and one CISCO RV082 redundant configuration
Replies: 9
Views: 465

Re: 2 mikrotik and one CISCO RV082 redundant configuration

Your issue is that you have to use an unreasonable setup on your MikroTiks because you have to live with the limitations of your Cisco. Replacing the Cisco with a MikroTik you could throw that entire config away and make some very simple GRE/IPsec tunnels (with a couple of mouseclicks) and an autoro...
by pe1chl
Sat Sep 05, 2020 9:16 pm
Forum: Beginner Basics
Topic: 2 mikrotik and one CISCO RV082 redundant configuration
Replies: 9
Views: 465

Re: 2 mikrotik and one CISCO RV082 redundant configuration

I would recommend to throw the Cisco away (it is end-of-life anyway and support will stop in a few months) and get another MikroTik for that location.
E.g. a RB4011.
Then you can setup an optimal solution without having to cope with limitations of the Cisco.
by pe1chl
Sat Sep 05, 2020 11:38 am
Forum: Beginner Basics
Topic: 2 mikrotik and one CISCO RV082 redundant configuration
Replies: 9
Views: 465

Re: 2 mikrotik and one CISCO RV082 redundant configuration

There is no way to control routing over direct IPsec tunnels with mangle. Routing defined by IPsec policies always takes precedence over any routes in the routing table(s) and any route marking. That is one of the reasons why I do not like direct IPsec tunnels. There is little control, it is more di...
by pe1chl
Fri Sep 04, 2020 9:28 pm
Forum: Beginner Basics
Topic: Add MGMT Vlan to DMZ
Replies: 14
Views: 565

Re: Add MGMT Vlan to DMZ

Put the VLAN interface in a bridge together with ether5 and put the IP config you now have on ether5 on that bridge instead. In fact I recommend to always put a bridge on each used port in the CCR1009, with only 1 port as a member, and put all config on those bridges. That allows you the flexibility...
by pe1chl
Fri Sep 04, 2020 9:20 pm
Forum: Beginner Basics
Topic: 2 mikrotik and one CISCO RV082 redundant configuration
Replies: 9
Views: 465

Re: 2 mikrotik and one CISCO RV082 redundant configuration

For a config that is much like that, I use GRE/IPsec tunnels between fixed IP, L2TP/IPsec for dynamic IP (for LTE) and then I use BGP to route the traffic over the tunnels so it can select a working path. For quick changeover I use BFD (not over the LTE tunnel because it is only used for last-resort...
by pe1chl
Fri Sep 04, 2020 5:38 pm
Forum: Forwarding Protocols
Topic: BGP ECMP (multipathing)
Replies: 43
Views: 16583

Re: BGP ECMP (multipathing)

Similar to what that RFC proposes, I quickly switched to EBGP-only to avoid a lot of strange routing issues that I encountered at first when I had used the same AS for a couple of sites in the same region so there was a mix of IBGP/EBGP. I now use IBGP only between routers at the same site that are ...
by pe1chl
Fri Sep 04, 2020 5:29 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

This issue (autoscroll hiding the last line) actually exists since forever. If you run ping and resize the window a little bit, you can make it hide the last line, just the way you see it now in the log window. It all has to do with the correct window size for autoscroll to work properly. Maybe it ...
by pe1chl
Fri Sep 04, 2020 4:40 pm
Forum: Forwarding Protocols
Topic: BGP ECMP (multipathing)
Replies: 43
Views: 16583

Re: BGP ECMP (multipathing)

It is even worse. RouterOS "BGP" (I am using quotes because it is not RFC 4271 compliant) picks not just the first gateway for equal cost routes, but even for UNEQUAL cost routes, since it does not care whatsoever for IGP costs to reach the BGP next hop gateway. This not only violates RFC 4271 but ...
by pe1chl
Fri Sep 04, 2020 4:14 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

For me, it shows everything when I manually scroll down 1 line, but then when a new logline appears it again is not visible.
The window auto-scrolls when new lines are added, but just a tiny bit too little.
by pe1chl
Fri Sep 04, 2020 2:11 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

Another issue that I see now I use 3.27 for a while (but I think it has been introduced in 3.22 or later): When the log window is displayed, and the number of lines in the window is not a whole number, new log lines at the bottom are not readable. They become readable when the window is scrolled dow...
by pe1chl
Fri Sep 04, 2020 11:07 am
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

It hasn't resolved on my end.
Both on Windows 7 64bit & Windows 10 64bit.
Hmm now that I try again after it has been open for some time, the problem indeed is still there!
Pity...
by pe1chl
Thu Sep 03, 2020 9:19 pm
Forum: Announcements
Topic: WinBox v3.27 released!
Replies: 70
Views: 9218

Re: WinBox v3.27 released!

What's new in v3.27: *) fixed content drawing of read-only tables (introduced in v3.26); I did not try that version at first (because I did not install 3.26) but now I got a message from OskarsK asking if it fixes the column/rule dragging problem, and indeed it seems that this issue is now resolved...
by pe1chl
Wed Sep 02, 2020 4:59 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

You need to turn it off in the DHCP client! For some modem types, the DHCP client is dynamically created and cannot be modified (nor prevented from being dynamically generated and created manually), so this advice is not applicable. For the dynamically created DHCP client, the setting in question (...
by pe1chl
Wed Sep 02, 2020 3:38 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

You need to turn it off in the DHCP client!
by pe1chl
Wed Sep 02, 2020 1:37 pm
Forum: RouterBOARD hardware
Topic: E3372h-320 USB/lte1 problems constantly LTE1 link up-down
Replies: 40
Views: 8465

Re: E3372h-320 USB/lte1 problems constantly LTE1 link up-down

Yes, E3372h-153 works fine.
But last model - E3372h-320 - very not fine... LTE link up/down every 2-3 sec. Supported this model in 7beta2 RouterOS.. Very beta...
Ok I don't know the submodel of mine, but it is already over a year old so probably the model that works fine on all versions.
by pe1chl
Wed Sep 02, 2020 11:35 am
Forum: RouterBOARD hardware
Topic: E3372h-320 USB/lte1 problems constantly LTE1 link up-down
Replies: 40
Views: 8465

Re: E3372h-320 USB/lte1 problems constantly LTE1 link up-down

I found this topic when it was linked in the 6.47.2 release topic.
I am using 2 of these E3372 sticks, one on RB750Gr3 and another on RB962UiGS-... and both of them work OK on RouterOS 6.47.1
by pe1chl
Tue Sep 01, 2020 8:08 pm
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

thanks for your reply pe1chl, the topic title is "HAP mini unable to update" so i chose not to create another post with the same problem. Don't worry i don't plan to install beta versions on production networks. Sorry, i edited my post to add more experiences with the matter in the meanwhile. I thi...
by pe1chl
Tue Sep 01, 2020 5:30 pm
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

i have the same problem, what's the official company answer? It appears the "official" answer is that this problem does not exist, because they test it before release and it works for them (on a default config). do i have to "recall" the routers i have installed to customers to install the separate...
by pe1chl
Tue Sep 01, 2020 1:53 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

You can add a CPU indicator by right-click on the status bar and click "Add CPU". Unfortunately, the CPU is shown as a numeric value and the network traffic has that nice green bar. Of course it should have been the other way around, as CPU is a percentage (so that bar can be black...fully green) wh...
by pe1chl
Sun Aug 30, 2020 11:31 am
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

hAP mini has a mode-button but it is not shown in winbox/webfig under System->Routerboard, only the reset-button is shown. However, the mode-button command works in terminal. For other devices, e.g. the RB750Gr3, the mode-button is shown in winbox/webfig System->Routerboard. Please add the Mode Butt...
by pe1chl
Sat Aug 29, 2020 12:09 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

I have a small issue with DNS over HTTPS. It works perfectly in 6.47.2, but now mikrotik can't verify certificate. I tried to re-import it, but nothing helps.
Are you sure you have imported the entire chain from the root, and not only the server certificate?
by pe1chl
Sat Aug 29, 2020 12:07 pm
Forum: Announcements
Topic: WinBox v3.25 released!
Replies: 68
Views: 5995

Re: WinBox v3.25 released!

For example, if you do "ping some.hostname.tld" in terminal, it uses resolver on router and you'll see it added in cache. If you enter some.hostname.tld in Tools->Ping in WinBox, then it's WinBox doing the resolving on the client where it runs. Why would they do that? There should be no reason for ...
by pe1chl
Fri Aug 28, 2020 3:53 pm
Forum: Announcements
Topic: WinBox v3.25 released!
Replies: 68
Views: 5995

Re: WinBox v3.25 released!

Problem with moving firewall rules and jumping around randomly has not been resolved.
What a pity... it appears they do not consider it important. I cannot believe it is difficult to reproduce because it is
reported by several users and occurs under different operating systems...
by pe1chl
Wed Aug 26, 2020 5:15 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

Probably the problem is related to DFS in the new version 6.47.2, but there were no problems with the previous version. You have not even tested the previous version! You compare it with an older version, from before things changed in the DFS handling. This is not a MikroTik-specific issue. You wil...
by pe1chl
Sun Aug 23, 2020 8:56 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

I've upgraded from 6.46.6 to 7.1beta2 directly (I know, bad) ...and this happend with my static routes.
For now I'd assume that conversion from older versions does not work yet (for those features that drastically changed, like routing) and setup everything from scratch.
by pe1chl
Sun Aug 23, 2020 2:38 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

“ WireGuard securely encapsulates IP packets over UDP. You add a WireGuard interface, configure it with your private key and your peers' public keys, and then you send packets across it. All issues of key distribution and pushed configurations are out of scope of WireGuard; these are issues much be...
by pe1chl
Sat Aug 22, 2020 2:36 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

An ipipv6 tunnel problem in 6.47.2. When pppoe client disconnect and then reconnect, ipv6 address of device is changed , but local address of ipipv6 tunnel is not changed (ipv6 firewall connection print), and the tunnel is down actually. I didn't configure "local-address" value. I think it should b...
by pe1chl
Sat Aug 22, 2020 2:13 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

Wireguard is working well, except for that minor winbox issue with the endpoint port. With how easy it was to setup, I totally get the Wireguard hype now. IPSEC has a frustrating amount of knobs to turn. When you don't like that, just don't turn the knobs! It is always easy (at least at first) to c...
by pe1chl
Sat Aug 22, 2020 2:01 pm
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

That is technically not feasible, I'm afraid. Firewall rules are evaluated inside the kernel and they cannot call something in a user process. The best that could be done is direct some matched traffic towards an NFLOG socket and then have a process listening there and executing the script. But that...
by pe1chl
Sat Aug 22, 2020 1:53 pm
Forum: Beginner Basics
Topic: conmark and pktmark chains
Replies: 6
Views: 531

Re: conmark and pktmark chains

Simple queues are mainly for giving each IP a fair share in the total traffic. You separate traffic by IP address and queues are dynamically created for each address, and traffic shaped to conform to minimum and maximum rates for each client. That is not what you want when you are trying to prioriti...
by pe1chl
Fri Aug 21, 2020 10:37 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

No, it is not too hard. My scripts collection (see signature) has a function for that. Just run... $DownloadPackage wireless I think the system->packages menu should list all available packages, also those not installed, and then allow to download+install them with an install button similar to the ...
by pe1chl
Fri Aug 21, 2020 6:18 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

There is no need to question the possibility of doing L3 routing on a switch, there have been competing switches from other companies that do wirespeed routing for a long time. It must be like 20 years ago when I got my first 3com L3 switch and was amazed at how it could route so fast, for that pric...
by pe1chl
Fri Aug 21, 2020 6:06 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

I have been uselessly asking mikrotik to stop using the combined package and put only the essential packages directly into the routers during the manufacturing process for many years. They had never heard me. I fully agree with that! The router also should have a selection menu where you can select...
by pe1chl
Fri Aug 21, 2020 2:55 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta2 [development] is released!
Replies: 286
Views: 71821

Re: v7.1beta2 [development] is released!

Observations (not really new for this build but maybe off the radar): - when a static route is disabled, it disappears from the listing entirely, as if it has been deleted. when the window is closed/reopened, it appears again in greyed-out status. - the BGP functionality still exists only in CLI and...
by pe1chl
Fri Aug 21, 2020 2:39 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

Maybe some users use them to build a toy lab, but usually they will be running only system and wireless, maybe advanced-tools. But MPLS, BGP, OSPF, IPsec, Hotspot... REALLY? Agreed, maybe MT can make v7 lite and v7 full buillds The same could be done with 6.47. Make the "combined" package (a thing ...
by pe1chl
Fri Aug 21, 2020 2:32 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

The only alternative I can think of is to have some router or VPS "in the cloud" which has the external IP(s) for the company and then configure 2 tunnels from the company site to that place, and figure some way to balance the traffic over those. Then all external access is from one IP (that of the ...
by pe1chl
Fri Aug 21, 2020 12:45 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

ErfanDL, vecernik87 - hAP lite and other SMIPS architecture devices are tested on every release and can be upgraded while running default configuration. I think your test is not OK because this issue is very common and reported everywhere. It probably is not caused by files stored on the flash, but...
by pe1chl
Fri Aug 21, 2020 12:39 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

For a professional production network I'd expect the utilisation of OSPF/ECMP etc. PCC is a hack, not a clean channel bonding solution after all. Like the OP, we use this as a load balancing solution in a multiple ISP scenario. We get fiber from two different providers and we balance the users over...
by pe1chl
Fri Aug 21, 2020 12:31 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta1 [development] is released!
Replies: 103
Views: 41238

Re: v7.1beta1 [development] is released!

It has been a long time since I saw a client that by default preferred 2.4 over 5 GHz connection. Amazon Echo devices do this all the time.. At least 1.Gen ones that I have. The comparable Google devices do it OK. Your device may be too old, it will probably get confused big time by 802.1r/v/k and ...
by pe1chl
Fri Aug 21, 2020 12:18 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

That is right. That is what I mean. You would not want to do an ftp to a site and have the control connection use one WAN address and the data connection using another, because that may be rejected by a firewall at the destination machine. The ftp protocol itself has no problem with it, but stateful...
by pe1chl
Thu Aug 20, 2020 11:43 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta1 [development] is released!
Replies: 103
Views: 41238

Re: v7.1beta1 [development] is released!

And actually, clients should (and will) do that themselves, with less issues than trying to control it from the access point.
It has been a long time since I saw a client that by default preferred 2.4 over 5 GHz connection.
by pe1chl
Thu Aug 20, 2020 11:41 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

I wrote "To avoid any problems". I cannot name an application, but I can envision how there could be problems, and I can be certain there won't be problems when using only source address. With 300-1000 phones and laptops being used on the network with all kinds of applications I don't know about, an...
by pe1chl
Thu Aug 20, 2020 10:05 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

Yes, but that would not only affect http/https (in fact it does not affect those protocols in themselves, but it will affect applications). It will also affect ftp, sip etc that really have multiple connections within the same protocol. To avoid any problems I only use src address for the PCC in the...
by pe1chl
Thu Aug 20, 2020 9:41 pm
Forum: General
Topic: Per Connection Classiefier (PCC) blocks incomming FaceTime calls
Replies: 34
Views: 2540

Re: Per Connection Classiefier (PCC) blocks incomming FaceTime calls

per-connection-classifier=both-addresses-and-ports:2/0 This is normally the risky part with protocols that have multiple connections and expect them to be from the same source address. To be more safe, remove at least the "ports" part from that, and probably also select only source address. (of cou...
by pe1chl
Thu Aug 20, 2020 6:17 pm
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

I gave up with asking mikrotik to stop using combined package and to start with shipping the devices with the 3-4 essential packages only. Never mind. I am always starting with installation of those packages I need everytime I get new device. And I suggest the same to everyone. Yes, but note this t...
by pe1chl
Thu Aug 20, 2020 11:37 am
Forum: General
Topic: DHCP IP can't get
Replies: 4
Views: 400

Re: DHCP IP can't get

Model:RB2011UiAS
OS: RouterOS v6.44.3 (stable)
At least update it to current RouterOS (6.47.2)
Then test again. Maybe it is solved...
by pe1chl
Thu Aug 20, 2020 11:34 am
Forum: Beginner Basics
Topic: conmark and pktmark chains
Replies: 6
Views: 531

Re: conmark and pktmark chains

One big downside is that you often want to do things on both directions of a connection, and you would need two matches with the addresses/ports reversed. Also, some matches are only possible at the beginning of a connection, and you then want to affect the whole connection. The connection mark stay...
by pe1chl
Thu Aug 20, 2020 11:27 am
Forum: RouterOS v7 BETA
Topic: HAP mini unable to update
Replies: 22
Views: 1486

Re: HAP mini unable to update

This device often even is not able to update within the 6.4x versions when using the combined package. The newly downloaded combined package cannot fit due to the situation mafiosa describes (not enough free space). You can see many posts from people with this problem. On my hAP mini (a free one I g...
by pe1chl
Wed Aug 19, 2020 9:46 pm
Forum: General
Topic: RAMdisk
Replies: 15
Views: 2889

Re: RAMdisk

+100

Why this isn't implemented already? I have CRS328-24P-4S+RM, it has 512 MB RAM and only 16 MB FLASH and it does NOT have USB port!
But that one should have a RAMdisk already. I am discussing RAMdisk on 128MB(and more) flash models, like the RB1100, RB2011, old RB750, CCR, etc.
by pe1chl
Wed Aug 19, 2020 8:10 pm
Forum: General
Topic: Blocking web page
Replies: 10
Views: 1566

Re: Blocking web page

It won't work if it's DNS based by someone simply specifying an alternative DNS, it won't work otherwise by bypassing via VPN. Use transparent DNS. Won't help when users use DoH or DoT. You can block DoT but it will become impractical to block DoH. (just like it is impractical to block all VPN opti...
by pe1chl
Wed Aug 19, 2020 5:03 pm
Forum: Announcements
Topic: Winbox v3.24 released!
Replies: 106
Views: 57556

Re: Winbox v3.24 released!

I "always" have 3 winbox windows open to 3 different routers. I have the "log" open full-screen as kind of background, and then usually at least a "Routing->BGP->Peers" window and sometimes another window e.g. IP->Neighbors or PPP->Active connections. But I do not experience this issue at the moment...
by pe1chl
Wed Aug 19, 2020 4:57 pm
Forum: Wireless Networking
Topic: 802.11r/k, Band Steering
Replies: 49
Views: 10939

Re: 802.11r/k, Band Steering

I've heard TILERA architecture was slowing down ROS development cycle since it got deprecated from the mainline Linux kernel. Where have you heard that? Here on the forum, MikroTik said that they did not use the "official" Tilera support in the mainline kernel, but have always used their own. (pres...
by pe1chl
Wed Aug 19, 2020 2:19 pm
Forum: Announcements
Topic: v6.47.2 [stable] is released!
Replies: 90
Views: 16471

Re: v6.47.2 [stable] is released!

*) smb - fixed file path validation (introduced in v6.46);
*) www - improved WWW service stability when receiving bogus packets;
Please include the relevant CVE number for fixes like this, so we can independently evaluate the urgency of an upgrade.
by pe1chl
Tue Aug 18, 2020 5:15 pm
Forum: Wireless Networking
Topic: 802.11r/k, Band Steering
Replies: 49
Views: 10939

Re: 802.11r/k, Band Steering

Does OpenWRT achieve interoperability with old devices when 802.11k/r/v is enabled on an SSID? It is unclear to me if this is completely impossible, or if some workarounds are possible like a fallback in case a device connects that does not support those protocols. I find it a bit cumbersome (and in...
by pe1chl
Tue Aug 18, 2020 5:09 pm
Forum: Announcements
Topic: Winbox v3.24 released!
Replies: 106
Views: 57556

Re: Winbox v3.24 released!

About the memory use, well, of course, if Winbox is displaying something, it will take up memory. I don't suggest use of Winbox for monitoring. It is a configuration tool, use SNMP for monitoring. A generic problem with winbox is that when you open some screen where there are lots of items and a lo...
by pe1chl
Tue Aug 18, 2020 4:26 pm
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs. No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set...
by pe1chl
Tue Aug 18, 2020 4:18 pm
Forum: Scripting
Topic: Built in function library
Replies: 87
Views: 32887

Re: Built in function library

To me the singularly most important addition would be opening this up to the community so that they could create and share functions safely and easily. So that you can leverage all the developers to contribute to a user extensible library. You can always start such a project or join an existing one...
by pe1chl
Tue Aug 18, 2020 11:09 am
Forum: General
Topic: Feature requests
Replies: 1279
Views: 290070

Re: Feature requests

When the reason for the reboot is an upgrade of ROS, the router already logs that...
Maybe it was just an unfortunate example and you want to be able to specify other messages like "shutdown for maintenance in rack #2"?
by pe1chl
Mon Aug 17, 2020 11:56 am
Forum: Announcements
Topic: v6.47.1 [stable] is released!
Replies: 147
Views: 58517

Re: v6.47.1 [stable] is released!

Hi to all
i noticed that option 23 in dhcp v6 does not work anymore

i have
0x2a00ad0010001f000000000000000002 as value for opt 23
but it is not pushed to clients

older version work vell
Works for me! (in 6.47.1)
by pe1chl
Mon Aug 17, 2020 11:53 am
Forum: General
Topic: Feature request: Force sending of DHCP options to clients
Replies: 38
Views: 11645

Re: Feature request: Force sending of DHCP options to clients

I am quite surprised this has not been implemented in RouterOS after all this years... In fact you should be more surprised that the Android developers, after all those years, could not be bothered to put an option request in their DHCP request for all options that they can process. After all, that...
by pe1chl
Mon Aug 17, 2020 11:51 am
Forum: General
Topic: Blocking web page
Replies: 10
Views: 1566

Re: Blocking web page

I have a Huawei B715 LTE modem which has web filtering included, if I enable it for a specific website by simply entering domainame.com, that site will be blocked in seconds, why does it have to be so complicated with Mikrotik? Because you have not envisioned all the possible ways to circumvent tha...
by pe1chl
Sun Aug 16, 2020 11:25 am
Forum: General
Topic: Feature request: Static DNS NXDOMAIN
Replies: 11
Views: 3682

Re: Feature request: Static DNS NXDOMAIN

Note that from version 6.47, RouterOS can now return NXDOMAIN (among some other values) for static DNS records! I have configured it on a wireless network but unfortunately RouterOS does not keep "use counts" for DNS records like it does for firewall rules etc, so it is difficult to see if it is rea...
by pe1chl
Sat Aug 15, 2020 7:49 pm
Forum: General
Topic: Blocking web page
Replies: 10
Views: 1566

Re: Blocking web page

The best way is not to do it!
by pe1chl
Sat Aug 15, 2020 8:46 am
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

But it doesn't with winbox 3.21, that is why I think it may be a winbox bug just as well. Changes were made in winbox for scaling and it also affects me on older RouterOS releases! I cannot reliably "drag" things anymore in winbox, they are dropped at random positions. When I drag a column width, th...
by pe1chl
Fri Aug 14, 2020 8:19 pm
Forum: Announcements
Topic: v6.48beta [testing] is released!
Replies: 136
Views: 52103

Re: v6.48beta [testing] is released!

Is that a 6.48 bug or a winbox bug or a combined bug of these two?
I am still using winbox 3.21 because of big problems with newer versions, and I do not see this problem when connecting to 6.48beta12
by pe1chl
Fri Aug 14, 2020 7:29 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 63
Views: 13120

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

So far I don't see it for something like port forwarding, because it's already simple enough, just one rule and nothing to fill in automatically. That is because RouterOS has no picture of internal systems. Other routers have integration between their DHCP and DNS servers (so they can put hostnames...
by pe1chl
Fri Aug 14, 2020 2:03 pm
Forum: General
Topic: IPSEC Monitoring traffic
Replies: 2
Views: 752

Re: IPSEC Monitoring traffic

Replace your direct IPsec tunnel with a GRE/IPsec tunnel (or IPIP/IPsec) and you will have a separate virtual interface that you can monitor as usual.
WIth a direct IPsec tunnel that is not possible...
by pe1chl
Thu Aug 13, 2020 7:02 pm
Forum: General
Topic: Does this violate RFC?
Replies: 26
Views: 4382

Re: Does this violate RFC?

Recursive resolver is nice thing, but it doesn't seem likely that MikroTik would compete with BIND, Unbound and others. Just simple recursive resolver is not that interesting. I would be interested in a "forward first" setting that would normally forward all queries to the configured nameservers, b...
by pe1chl
Thu Aug 13, 2020 12:12 pm
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 63
Views: 13120

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

I fail to understand how this is easier for anyone, I'm sorry. Those bunch of options will still be address, port, protocol, action. Same options currently used in the Firewall Filter menu. I think what many users mean by "adding a firewall rule" is more like "adding a port forward in a NAT router"...
by pe1chl
Thu Aug 13, 2020 10:44 am
Forum: RouterOS v7 BETA
Topic: FEATURE REQUEST: Add Basic Firewall Rule Wizard
Replies: 63
Views: 13120

Re: FEATURE REQUEST: Add Basic Firewall Rule Wizard

It would likely be a waste of time to setup such a firewall wizard and see it evolve to handle more and more complex cases until it basically is the same as the normal firewall menu, but I would consider it a good idea to have some "user input panel" capability for scripts. I.e. a user-written scrip...
by pe1chl
Thu Aug 13, 2020 10:33 am
Forum: General
Topic: Does this violate RFC?
Replies: 26
Views: 4382

Re: Does this violate RFC?

It looks like cache stores data in a tree and labels are taken from that. Actually I think that is great! It indicates that the resolver is now more like a real full recursive resolver that potentially could work without any forwarder (i.e. from the root servers). I think the old design merely stor...
by pe1chl
Wed Aug 12, 2020 11:14 pm
Forum: General
Topic: Does this violate RFC?
Replies: 26
Views: 4382

Re: Does this violate RFC?

Current v7 beta keeps the case. It doesn't sound as anything too difficult to port to v6, but for some reason it didn't happen.
Normis kept his promise, 3 years later... :-)
by pe1chl
Wed Aug 12, 2020 2:59 pm
Forum: General
Topic: Router "blocks" some SIP INVITES but not all - misconfiguration or bug? [SOLVED]
Replies: 10
Views: 1879

Re: Router "blocks" some SIP INVITES but not all - misconfiguration or bug? [SOLVED]

SIP over NAT is a mess. I put my phone on a routable (public) IP address and all my issues were gone. Before, I had similar problems as you had. It worked fine for one provider, it refused to work for another. Never went down to the bits to analyze what is really going on. Of course I realize that n...
by pe1chl
Wed Aug 12, 2020 2:51 pm
Forum: Beginner Basics
Topic: Can't create l2tp and other vpn servers
Replies: 4
Views: 970

Re: Can't create l2tp and other vpn servers

Maybe you don't have package PPP installed and enabled? (I did not watch video, please when you want forum users to know what you are doing include a /export)
by pe1chl
Wed Aug 12, 2020 9:58 am
Forum: Wireless Networking
Topic: UniFi Guest Network Issue?
Replies: 2
Views: 537

Re: UniFi Guest Network Issue?

I guess he tries to use a MikroTik router with a UniFi WiFi setup (controller and accesspoints).
That is perfectly possible, I do that as well.
But of course it is impossible to answer "questions about the configuration" with so little information given, and not even the actual configuration.
by pe1chl
Wed Aug 12, 2020 9:44 am
Forum: Scripting
Topic: bug in tool fetch? [SOLVED]
Replies: 6
Views: 1375

Re: bug in tool fetch? [SOLVED]

It is not "a Telegram API issue", it is "a HTTP URL issue". A HTTP URL cannot include spaces, they have to be encoded as %20 or + depending on the context. When it appears to work without doing that, likely the part of the message after the first space is not sent in the message. Remember over the H...
by pe1chl
Tue Aug 11, 2020 10:35 am
Forum: Wireless Networking
Topic: radar detected problems
Replies: 60
Views: 33465

Re: radar detected problems

And I did also receive "false positive" radar detects, but found the source as other Mikrotik routers (hAP ac2, wAP ac) where closeby and on a none-DFS frequency. They caused radar detect on higher channels, and those radar detect channels moved up with the set channel. (Harmonics in electronics ar...
by pe1chl
Mon Aug 10, 2020 2:24 pm
Forum: Wireless Networking
Topic: radar detected problems
Replies: 60
Views: 33465

Re: radar detected problems

There is no reason to believe that country "belgium" would avoid any DFS issues. Belgium has DFS requirement the same as everywhere in Europe. I was surprised that this topic became active today but not from northwest Europe. Lately we have warm weather and this usually means increased DFS problems,...
by pe1chl
Sat Aug 08, 2020 11:33 am
Forum: General
Topic: Unresolving pages via IPsec VPN
Replies: 5
Views: 1425

Re: Unresolving pages via IPsec VPN

It is more likely that it is a MTU issue, either because of errors in your own firewall or because of the common errors in firewalls on servers on internet.
by pe1chl
Fri Aug 07, 2020 10:36 pm
Forum: General
Topic: Broadcast Traffic Firewall Filter
Replies: 3
Views: 908

Re: Broadcast Traffic Firewall Filter

yes, you can do that with the "address type".
however, note that some broadcasts will be handled by the router no matter if you filter it or not.
(your filter can still be useful to log and/or count the traffic)
by pe1chl
Fri Aug 07, 2020 7:59 pm
Forum: Forwarding Protocols
Topic: Point-to-point (/31) addresses
Replies: 77
Views: 51698

Re: Point-to-point (/31) addresses

Of course when you have only a simple peering with some other world where they are using /31, you can just change your own side to be a /30 or even larger to make your side contain the addresses from the /31 and neither of them being the "network" or "broadcast" address on that subnet. This will mak...
by pe1chl
Fri Aug 07, 2020 2:32 pm
Forum: General
Topic: VLAN port tagging Hap AC2/Atheros-8327
Replies: 5
Views: 1173

Re: VLAN port tagging Hap AC2/Atheros-8327

"safe mode" is just basic RouterOS knowledge, it is useful for all configuration changes that risk connectivity issues. Of course you need to know about it, but there are tons of other things you need to know. It is not impossible to operate a router with an untagged default VLAN and then some tagge...
by pe1chl
Fri Aug 07, 2020 11:59 am
Forum: General
Topic: IPsec transport not working [SOLVED]
Replies: 5
Views: 1372

Re: IPsec transport not working [SOLVED]

The solution is good, but you should have used IPIP or GRE instead of EoIP. Then proceed the same way (assign /30 nets, use as BGP peer address)
With that, you can make the same solution as you had, except it will be more efficient.
by pe1chl
Fri Aug 07, 2020 11:52 am
Forum: General
Topic: VLAN port tagging Hap AC2/Atheros-8327
Replies: 5
Views: 1173

Re: VLAN port tagging Hap AC2/Atheros-8327

When you do things like this, ALWAYS enable "safe mode" before :-) I copied this from a working environment, where there are several VLANs and one of them is made untagged this way. However, I realize that in that router there is no "default untagged VLAN" (commonly called "vlan 1") and I do not rem...
by pe1chl
Fri Aug 07, 2020 11:10 am
Forum: General
Topic: SYN filtering
Replies: 5
Views: 1178

Re: SYN filtering

It is not very useful, especially when done in this way. The SYN packets that you drop will still setup a connection tracking entry, so they will end up loading the router CPU anyway. The Wiki article was probably written before there were more advanced methods of doing this in RouterOS. It only hel...
by pe1chl
Thu Aug 06, 2020 8:34 pm
Forum: General
Topic: VLAN port tagging Hap AC2/Atheros-8327
Replies: 5
Views: 1173

Re: VLAN port tagging Hap AC2/Atheros-8327

/interface ethernet switch port set 0 vlan-mode=secure set 1 vlan-mode=secure set 2 vlan-mode=secure set 3 vlan-mode=secure set 4 vlan-mode=secure set 5 default-vlan-id=5 vlan-header=always-strip vlan-mode=secure /interface ethernet switch vlan add independent-learning=no ports="switch1-cpu,ether1,...
by pe1chl
Thu Aug 06, 2020 6:46 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

The default ping interval used by netwatch is one minute, and the default ICMP tracking timeout is 10 seconds.
So you probably would have no issue had you not modified one of those two...
by pe1chl
Thu Aug 06, 2020 11:59 am
Forum: Announcements
Topic: v6.47.1 [stable] is released!
Replies: 147
Views: 58517

Re: v6.47.1 [stable] is released!

my Powerbox Pro identifies itself to HEX Poe :)
It is the new name for the device. Apparently it does not have a built-in camera to look at the outside of the case what you have, and include the appropriate name.
by pe1chl
Thu Aug 06, 2020 11:30 am
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

L2TP is easy! I configure a server like this: /interface bridge add arp=disabled auto-mac=no mtu=1500 name=vpn-loopback protocol-mode=none /ip address add address=172.22.32.126/25 comment=l2tp-vpn interface=vpn-loopback \ network=172.22.32.0 /ip pool add name=vpn-pool ranges=172.22.32.1-172.22.32.9 ...
by pe1chl
Thu Aug 06, 2020 11:12 am
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

except when the remote routers are actually behind NAT routers e.g. provided by the ISP, in that case the local address can of course be made static In fact you can do the same thing on the outer routers themselves - you assign an auxiliary local IP to the router and set it as the local-address in ...
by pe1chl
Wed Aug 05, 2020 10:23 pm
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

Ah OK... that is possible, of course. I normally use GRE over IPsec Transport and only with fixed addresses, but it would of course be possible to script the config of the used external addresses. (after reading tippenring's post I tried to use DNS names for the external addresses, and it appears to...
by pe1chl
Wed Aug 05, 2020 9:14 pm
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

Unless there is some "I want to see it at first glance" reason to have an individual local IP for each tunnel to the outer site at the main on, I can see no reason to use it, there is nothing wrong about several GRE tunnels, and several IPsec policies, using just 192.168.99.1 at the main site end. ...
by pe1chl
Wed Aug 05, 2020 7:41 pm
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

One note: of course the local IP addresses on the second tunnel do not appear to be valid. When you use 192.168.99.1/30 (and .2/30) on the first tunnel, on the second tunnel you should use 192.168.99.5/30 and .6/30 But I don't think that causes your problem. MikroTik requires that the remote end of ...
by pe1chl
Wed Aug 05, 2020 7:30 pm
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

I have seen before that people have been successful in using a DNS name as the remote-address. I just tested it and indeed it works. However, it does not work for the local-address! And it is undocumented. So I am not sure if it is really a good idea to use this. Testing a bit more, it appears that ...
by pe1chl
Wed Aug 05, 2020 12:28 pm
Forum: General
Topic: Gre with IPsec - Only One tunnel builds [SOLVED]
Replies: 16
Views: 3272

Re: Gre with IPsec - Only One tunnel builds [SOLVED]

At first, you need to understand that the MikroTik GRE/IPsec tunnel is not going to work with a dynamic address. So when your remote office IP is really dynamic (vs just a static IP that is assigned via DHCP) it is not advisable to use GRE/IPsec. You could work around it using some scripting, e.g. w...
by pe1chl
Wed Aug 05, 2020 10:59 am
Forum: General
Topic: MAC telnet from terminal stopped working in new versions
Replies: 10
Views: 2804

Re: MAC telnet from terminal stopped working in new versions

This is not correct. It still works.
Maybe you have an issue with your computer, e.g. a firewall or other config that prevents you from doing the MAC-level connect.
by pe1chl
Tue Aug 04, 2020 1:51 pm
Forum: Wireless Networking
Topic: Mikrotik ROS and support for AC wave2 MU-MIMO?
Replies: 28
Views: 6744

Re: Mikrotik ROS and support for AC wave2 MU-MIMO?

much better coverage than ROS (higher TX power I guess) For a fair comparison you should only compare legal TX power (depending on channel and sometimes country), not illegal settings that you may be able to do in an uncontrolled environment but you cannot reasonably expect from MikroTik. You can c...
by pe1chl
Tue Aug 04, 2020 11:11 am
Forum: Announcements
Topic: v6.47.1 [stable] is released!
Replies: 147
Views: 58517

Re: v6.47.1 [stable] is released!

We are having issues with the Powerbox Pro in simple bridge mode. Router mode is as expected. Bridged ethernet ports don't pass traffic. Other MT devices can't see the updated devices in IP Neighbors with discovering ports = all. For some time already, there has been an issue with the QuickSet opti...
by pe1chl
Mon Aug 03, 2020 3:27 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta1 [development] is released!
Replies: 103
Views: 41238

Re: v7.1beta1 [development] is released!

Ok I was not aware that it was in a v7 topic (my phpBB skin does not clearly show that anymore), I am running 6.47.1 on the CCR1009 and it works OK there.
Maybe it is a v7 specific issue.
by pe1chl
Mon Aug 03, 2020 12:06 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

But did you already try using recursive routing with route check? As shown in examples.
And also get rid of the bonding interface and try in with a plain ethernet port, maybe there is some difference there too.
by pe1chl
Mon Aug 03, 2020 11:25 am
Forum: RouterOS v7 BETA
Topic: v7.1beta1 [development] is released!
Replies: 103
Views: 41238

Re: v7.1beta1 [development] is released!

Ok, that sounds good!
by pe1chl
Mon Aug 03, 2020 11:20 am
Forum: Beginner Basics
Topic: Cant get all PCs online
Replies: 16
Views: 2797

Re: Cant get all PCs online

It is important to know that when you have a network that should be sort of reliable, you should invest in better switches. You could prevent these mishaps by having switches that have DHCP snooping, but even with the minimal "managed switches" you could have investigated what happened further downs...
by pe1chl
Sun Aug 02, 2020 1:01 pm
Forum: General
Topic: IPSEC tunnels with failover
Replies: 5
Views: 1212

Re: IPSEC tunnels with failover

It is usually not a good idea to use EoIP. Use it only as stopgap solution e.g. in migration scenarios, or when it is inconvenient to renumber at that time. I certainly would not want to join 14 sites using EoIP tunnels!! You really should be considering a solution that uses routing. Renumber everyt...
by pe1chl
Sat Aug 01, 2020 9:58 pm
Forum: Beginner Basics
Topic: Pasting into Terminal on Webfig
Replies: 6
Views: 1711

Re: Pasting into Terminal on Webfig

I fully agree with that! I often paste config fragments in normal terminal sessions (telnet/ssh) as a quick way to copy standard setup, and I was extremely confused with the behavior of the webfig terminal at first, then decided to no longer use it.
by pe1chl
Sat Aug 01, 2020 9:56 pm
Forum: General
Topic: Marking Inbound Traffic in multi WAN .. DO I REALLY NEED IT ?
Replies: 4
Views: 1146

Re: Marking Inbound Traffic in multi WAN .. DO I REALLY NEED IT ?

Just keep the inbound rules, they won't hurt and they will solve problems in case e.g. someone sends a ping to your router address.
by pe1chl
Sat Aug 01, 2020 7:07 pm
Forum: General
Topic: IPSEC tunnels with failover
Replies: 5
Views: 1212

Re: IPSEC tunnels with failover

To make this kind of setup (redundant tunnels between sites), I setup multiple GRE/IPsec or GRE6/IPsec tunnels (IPIP/IPsec would work as well, as written by Sindy it uses a few less bytes, but it cannot route IPv6). Each tunnel gets its own set of /30 endpoint addresses. E.g. 10.0.0.1/30 and 10.0.0....
by pe1chl
Sat Aug 01, 2020 6:55 pm
Forum: Beginner Basics
Topic: Pasting into Terminal on Webfig
Replies: 6
Views: 1711

Re: Pasting into Terminal on Webfig

You would not want to paste in the terminal in webfig! When it would work, it would "expand" the commands as soon as it sees a match with the possible commands/options, and then the remainder of the text in your paste buffer is still appended to the command, resulting in a syntax error. So that is n...
by pe1chl
Sat Aug 01, 2020 6:53 pm
Forum: General
Topic: Marking Inbound Traffic in multi WAN .. DO I REALLY NEED IT ?
Replies: 4
Views: 1146

Re: Marking Inbound Traffic in multi WAN .. DO I REALLY NEED IT ?

When you have a good internet provider, it is really required because they will just drop the traffic when the source address does not match your connection. When you have a lousy internet provider, they will accept the traffic. And they are the facilitator of a lot of abuse on the internet, so they...
by pe1chl
Sat Aug 01, 2020 11:20 am
Forum: RouterOS v7 BETA
Topic: v7.1beta1 [development] is released!
Replies: 103
Views: 41238

Re: v7.1beta1 [development] is released!

Does anyone see a problem with per client queues? When I try to use pcq-upload-default it reboots. I have had trouble with QEMU, I am not sure if it is my settings there.
I am using that on a CCR-1009 without issues.
by pe1chl
Sat Aug 01, 2020 1:08 am
Forum: Wireless Networking
Topic: Mikrotik ROS and support for AC wave2 MU-MIMO?
Replies: 28
Views: 6744

Re: Mikrotik ROS and support for AC wave2 MU-MIMO?

The nice thing about such protocols is that there are so many of them, and every manufacturer has their own ones. That basically makes them mutually incompatible as well. Good for sales. It would be helpful when everyone just implemented universal standards, and nu such nonsense as NSTREME, NV2, AIR...
by pe1chl
Sat Aug 01, 2020 1:05 am
Forum: General
Topic: Can Only Discover Neighbors from AP Interfaces
Replies: 10
Views: 1986

Re: Can Only Discover Neighbors from AP Interfaces

I have no personal experience yet with 6.47 on wireless equipment - I am always very reluctant to update firmware on wireless link devices because there invariably is a struggle to get wireless parameters and performance (e.g power setting, DFS) correct after updates. For me it is "if it works, don'...
by pe1chl
Fri Jul 31, 2020 9:47 pm
Forum: General
Topic: OVPN TLS handshake failed
Replies: 11
Views: 2556

Re: OVPN TLS handshake failed

Does it support OpenVPN?
Did you compare with the cost of other brands (not only low-end like MikroTik but also a bit higher like UBNT or similar)?
by pe1chl
Fri Jul 31, 2020 3:27 pm
Forum: Announcements
Topic: v6.47.1 [stable] is released!
Replies: 147
Views: 58517

Re: v6.47.1 [stable] is released!

After upgrading to 6.47.1 and doing a /export, some routers export this: /user group set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\ sword,web,sniff,sensitive,api,romon,dude,tikapp" Others have "dude" not enabled in that group and it is not exported. It is a bit uncle...
by pe1chl
Fri Jul 31, 2020 11:55 am
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

I think it is better to setup an actually working failover system e.g. using recursive routing.
by pe1chl
Fri Jul 31, 2020 1:05 am
Forum: Announcements
Topic: v6.47.1 [stable] is released!
Replies: 147
Views: 58517

Re: v6.47.1 [stable] is released!

I'm running PIM on a CCR-1009 only as an IGMP querier for the IGMP snooping in the switches, and it appears to run as before (on 6.47.1)
No multicast routing between the networks configured.
by pe1chl
Fri Jul 31, 2020 12:50 am
Forum: General
Topic: Can Only Discover Neighbors from AP Interfaces
Replies: 10
Views: 1986

Re: Can Only Discover Neighbors from AP Interfaces

It's a real problem because as I replace units in the field, I loose the capability to discover down the line.
Did you try to setup RoMON and if so, what was the result of that in your network?
(does it build the discovery map, does it allow a RoMON connect)
by pe1chl
Thu Jul 30, 2020 10:31 pm
Forum: Beginner Basics
Topic: Upgrade RAM from 64 to 128mbi ?
Replies: 2
Views: 568

Re: Upgrade RAM from 64 to 128mbi ?

You have bought the about cheapest MikroTik router/ap (except the hAP mini). It is basically just a toy. You could maybe use it as an extra router in a remote room to have some extra coverage there, and connect some wired equipment as well. To do any things for which you would require more memory, y...
by pe1chl
Thu Jul 30, 2020 7:01 pm
Forum: Beginner Basics
Topic: interconnection between several networks in the same mikrotik
Replies: 9
Views: 1490

Re: interconnection between several networks in the same mikrotik

As far as the MikroTik router is concerned, that should work OK. Any problems you encounter are in the firewall of the client PCs (as written above) and in your expectations of what will work. E.g. you might think you can browse the network neighborhood and find servers and their shares, or you can ...
by pe1chl
Thu Jul 30, 2020 6:57 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

Well, there is a netwatch running on the router itself...
Maybe the ping used by netwatch determines the source address only one time, I do not know. I would not expect it.
by pe1chl
Thu Jul 30, 2020 5:57 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

Ok I see you do not perform any connection marking..
Try to set the source IP address on the routes.
by pe1chl
Thu Jul 30, 2020 3:37 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

Show your /export hide-sensitive
by pe1chl
Thu Jul 30, 2020 2:20 pm
Forum: General
Topic: WebFig UI sometimes incomplete
Replies: 4
Views: 837

Re: WebFig UI sometimes incomplete

It is a bug in the current version.
When you really want to use webfig, downgrade to the 6.46.x version.
by pe1chl
Thu Jul 30, 2020 2:18 pm
Forum: General
Topic: Unstopabale unsucessful ping
Replies: 24
Views: 3966

Re: Unstopabale unsucessful ping

It is probably not caused by the netwatch ping itself but by connection and packet marking and routing selection you made elsewhere to make your dual-uplink work.
by pe1chl
Thu Jul 30, 2020 2:15 pm
Forum: General
Topic: OVPN TLS handshake failed
Replies: 11
Views: 2556

Re: OVPN TLS handshake failed

Daily bump. Don't do that! There have been problems with OpenVPN for 10 years already and bumping has had no other effect than that there now finally is an improved version in the RouterOS v7 beta (which had been promised for several years already). You can try the beta (considering the normal thin...
by pe1chl
Thu Jul 30, 2020 2:12 pm
Forum: Beginner Basics
Topic: Which MTU size and what to do with L2 MTU? [SOLVED]
Replies: 3
Views: 684

Re: Which MTU size and what to do with L2 MTU? [SOLVED]

It is always advisable to try to get the PPPoE MTU to 1500 because that solves so many problems. When the ISP supports RFC4638 (ask them, and if they don't submit a request for them to to so) you can set the MTU of the PPPoE interface to 1500 and it will work. (when they do not support it, it will f...
by pe1chl
Thu Jul 30, 2020 12:38 pm
Forum: General
Topic: Mikrotik OS 6.45.6 Hacked
Replies: 10
Views: 5952

Re: Mikrotik OS 6.45.6 Hacked

Ok that is the full info you should have given in your first post. I presume it is still present in your router? You need to netinstall it with format, and NOT restore a backup. So best is to do a clean configuration. At most you can do a /export before you wipe it and keep it as a guide to remember...
by pe1chl
Thu Jul 30, 2020 11:37 am
Forum: General
Topic: Mikrotik OS 6.45.6 Hacked
Replies: 10
Views: 5952

Re: Mikrotik OS 6.45.6 Hacked

Now you have edited the post and added that part (where from?) with tool fetch. I think originally there was only the screenshot with the environment variables and THAT is not a sign the router was hacked, it is the result of a RouterOS bug. When you have some things a developer did not expect you t...
by pe1chl
Thu Jul 30, 2020 11:32 am
Forum: General
Topic: Can Only Discover Neighbors from AP Interfaces
Replies: 10
Views: 1986

Re: Can Only Discover Neighbors from AP Interfaces

Well, it can pass the L3 packets (UDP port 5678 broadcasts) but not the LLDP packets.
Maybe he has blocked UDP port 5678 or broadcast and relied on LLDP.
LLDP is not allowed to be passed by bridges and switches.
by pe1chl
Thu Jul 30, 2020 11:16 am
Forum: General
Topic: Easy way to log proxy bloked urls
Replies: 6
Views: 1195

Re: Easy way to log proxy bloked urls

There is no way to do any filtering on the logging, I have submitted that as a feature request some time ago. The only thing you can do is send all logging to an external device and do the filtering there. (e.g. a Raspberry Pi running the normal rsyslogd with some custom rules or something more adva...
by pe1chl
Wed Jul 29, 2020 11:13 pm
Forum: General
Topic: Easy way to log proxy bloked urls
Replies: 6
Views: 1195

Re: Easy way to log proxy bloked urls

What are you disallowing in the proxy? It is difficult to predict what addresses outlook will connect, they are many different networks and all over the world. Networks I have identified before (and put in an address list): add address=20.180.0.0/14 list=microsoft add address=20.184.0.0/13 list=micr...
by pe1chl
Wed Jul 29, 2020 10:33 pm
Forum: Beginner Basics
Topic: Cant get all PCs online
Replies: 16
Views: 2797

Re: Cant get all PCs online

Are you sure your other router is connected to ether1 and not to some other port, or maybe there is some other crosslink e.g. from one of the other ports also to a port of the other router?
It is obvious that the router is visible from the bridge, which it should not be.
by pe1chl
Wed Jul 29, 2020 10:29 pm
Forum: Beginner Basics
Topic: HEX s as DNS [SOLVED]
Replies: 7
Views: 1473

Re: HEX s as DNS [SOLVED]

Ok you apparently have implemented some form of "port knocking" to access the router, and therefore it does not accept the DNS queries without those additional rules. It would be better to place them lower in the chain, after the established/related rules. And also I think it is not a good idea to a...
by pe1chl
Wed Jul 29, 2020 9:56 pm
Forum: Beginner Basics
Topic: Cant get all PCs online
Replies: 16
Views: 2797

Re: Cant get all PCs online

The config looks fine except for the fact that there are fixed (static) ARP entries, two with a wrong IP address.
I would recommend to remove them all.
/ip arp
remove [find]
This is likely not the problem.
So indeed setup a dhcp alert for "bridge" and see what happens.
by pe1chl
Wed Jul 29, 2020 9:28 pm
Forum: Beginner Basics
Topic: HEX s as DNS [SOLVED]
Replies: 7
Views: 1473

Re: HEX s as DNS [SOLVED]

That is correct, but MAKE SURE that you have a CORRECT FIREWALL set up! The default firewall is OK. When you have changed it (maybe following some bad advice from Youtube) it can be that your DNS service is reachable from internet. If so, you are going to be in big trouble soon. Fix it before it is ...
by pe1chl
Wed Jul 29, 2020 9:25 pm
Forum: General
Topic: Easy way to log proxy bloked urls
Replies: 6
Views: 1195

Re: Easy way to log proxy bloked urls

According to my experience, the issue is probably not that the proxy is blocking traffic, but that the Windows PC is suddenly not honoring the proxy configuration. Outlook has the tendency of trying to connect to Office 365 directly, without using the proxy. After a while it displays a failure to co...
by pe1chl
Wed Jul 29, 2020 9:22 pm
Forum: Beginner Basics
Topic: Cant get all PCs online
Replies: 16
Views: 2797

Re: Cant get all PCs online

I think none of that. There is router before mikrotik not after. When I plug device into Mikrotik directly , device also get adress 192.168.3.x. weird :) up to a certain number of devices everything works ok. I will check rogue DHCP server detection Maybe you have mistakenly configured your router ...
by pe1chl
Wed Jul 29, 2020 9:18 pm
Forum: General
Topic: Can Only Discover Neighbors from AP Interfaces
Replies: 10
Views: 1986

Re: Can Only Discover Neighbors from AP Interfaces

A bridge should not "pass" Neighbor-Discovery packets. Maybe it did in the past. Maybe you used "switch" instead of "bridge" in the past. When you want to get a diagram of network routers using simple methods, configure RoMON everywhere. The RoMON relay agents will relay the neighbor info and you ca...
by pe1chl
Wed Jul 29, 2020 9:14 pm
Forum: General
Topic: RouterOS commands?
Replies: 1
Views: 489

Re: RouterOS commands?

You cannot control the output format of commands, but of course you can write scripts that call commands and do something to display the results. You can do that on the router itself (/system script) or you can wite scripts on other computers that use API to retrieve values and display them in the f...
by pe1chl
Wed Jul 29, 2020 8:44 pm
Forum: General
Topic: VPN ( IPSec ) packet loss
Replies: 8
Views: 3236

Re: VPN ( IPSec ) packet loss

It can be caused by certain filters in the ISP modem, e.g. rate limiting of UDP traffic "to solve gaming problems" or "to alleviate DDoS".
Look for settings like that in the ISP modem and disable those options.
by pe1chl
Wed Jul 29, 2020 8:41 pm
Forum: General
Topic: Mikrotik OS 6.45.6 Hacked
Replies: 10
Views: 5952

Re: Mikrotik OS 6.45.6 Hacked

What do you mean "the same experience"?? That is not the same, it is something completely different!
It is the result of a bug in RouterOS which is triggered by rename of the wireless interface.
by pe1chl
Tue Jul 28, 2020 11:15 pm
Forum: Wireless Networking
Topic: WiFi from an SXT [SOLVED]
Replies: 15
Views: 3481

Re: WiFi from an SXT [SOLVED]

Yes when you have an AP you can let the SXT connect to it as a client and send the data to other clients of that AP.
So it has to be powered but it does not have to be network-wired.
by pe1chl
Tue Jul 28, 2020 9:25 pm
Forum: Wireless Networking
Topic: WiFi from an SXT [SOLVED]
Replies: 15
Views: 3481

Re: WiFi from an SXT [SOLVED]

Of course I never meant to distribute the signal from the SXT... The intention was that the SXT would be a client on your existing WiFi AP and it would send the data to that AP, and the AP would forward it to its users around it. When that is not what you intend to do, you should have explained it m...
  • 1
  • 2
  • 3
  • 4
  • 5
  • 24