Community discussions

MikroTik App

Search found 7712 matches

  • 1
  • 2
  • 3
  • 4
  • 5
  • 26
by pe1chl
Wed Aug 04, 2021 7:31 pm
Forum: General
Topic: ipsec issue Firmware 6.45+
Replies: 5
Views: 129

Re: ipsec issue Firmware 6.45+

In my case I use ikev1, psk, and no NAT.
by pe1chl
Wed Aug 04, 2021 7:19 pm
Forum: General
Topic: Can VLAN traffic be excluded from routing?
Replies: 6
Views: 226

Re: Can VLAN traffic be excluded from routing?

That is true. The question stated "to act as a router for a small network, and also to act as a switch for VLANs" and so IP forward has to be enabled, else it cannot act as a router. Then firewall filter rules can be used to limit the VLANs for which it will forward. It is not possible to ...
by pe1chl
Wed Aug 04, 2021 5:54 pm
Forum: General
Topic: ipsec issue Firmware 6.45+
Replies: 5
Views: 129

Re: ipsec issue Firmware 6.45+

Ok I have an IPsec tunnel between a RB2011 running 6.48.3 and a Linux system running Strongswan so it should be possible to get it working. Maybe you need to set the policies in strongswan (I did that, but it is a long time ago, I don't know if it was because of an issue). Or check if the proposals ...
by pe1chl
Wed Aug 04, 2021 3:33 pm
Forum: General
Topic: Interface selection for internal/router-generated traffic -- A solution and request for feedback.
Replies: 5
Views: 148

Re: Interface selection for internal/router-generated traffic -- A solution and request for feedback.

Your remarks may be valid for complicated routers you have seen in the past, but in a MikroTik router, setting up a GRE over IPsec tunnel is a minute of work, and setting up BGP is another minute or two. (of course assuming you have done it before) The /30 network is only used for the two peers on t...
by pe1chl
Wed Aug 04, 2021 3:28 pm
Forum: General
Topic: DHCP Offering Lease Without Success
Replies: 13
Views: 363

Re: DHCP Offering Lease Without Success



You're right, he doesn't read
No man i read.
Maybe you read, but the process between reading and doing is not working correctly.
by pe1chl
Wed Aug 04, 2021 12:53 pm
Forum: Scripting
Topic: Failover from wired to bridged wireless
Replies: 1
Views: 72

Re: Failover from wired to bridged wireless

Yes, you can do that with a little re-configuration. You will now have an interface like "wlan1" in your wireless which you have set up as the AP. It is probably member of "bridge". Note the configuration details of the wireless interface (e.g. SSID, security profile etc) and rem...
by pe1chl
Wed Aug 04, 2021 12:42 pm
Forum: Beginner Basics
Topic: GUI columns
Replies: 4
Views: 148

Re: GUI columns

There aren't so many options, to make a special selection interface just for that. All it takes is a few clicks. Come on! There are some windows with many column options and it is a real drag to select them (after having removed useless colums that are enabled by default, like the FP stats in inter...
by pe1chl
Wed Aug 04, 2021 12:36 pm
Forum: General
Topic: Interface selection for internal/router-generated traffic -- A solution and request for feedback.
Replies: 5
Views: 148

Re: Interface selection for internal/router-generated traffic -- A solution and request for feedback.

What you describe is the can of worms that you usually get when using plain IPsec tunnels. Problems with source address selection, tricks required to avoid NAT rules triggering, complicated firewalls because traffic through and outside the tunnel is coming in on the same interface (and has to be sel...
by pe1chl
Wed Aug 04, 2021 12:24 pm
Forum: General
Topic: Generate connected routes with routing marks
Replies: 1
Views: 63

Re: Generate connected routes with routing marks

That is indeed a problem in RouterOS v6. I think it was promised it would be solved in v7. When your routing marks are only for policy routing, you can quite easily work around this because you can setup your policies so that traffic without routing mark is still routed to that interface. Note that ...
by pe1chl
Wed Aug 04, 2021 12:12 pm
Forum: General
Topic: Feature request: Make Quickset to be separate package
Replies: 47
Views: 8662

Re: Feature request: Make Quickset to be separate package

Actually I think the idea of making it a policy is quite good. It could be set for the group "full" (and not for "read" and "write"). So new users with group "write" already are secured against inadvertent use of Quick Set. And when an admin knows he has done ...
by pe1chl
Tue Aug 03, 2021 8:26 pm
Forum: General
Topic: Bridge vlan solution without adding interface vlan
Replies: 30
Views: 818

Re: Bridge vlan solution without adding interface vlan

I think you are not telling us the whole story!
by pe1chl
Tue Aug 03, 2021 6:39 pm
Forum: General
Topic: Bridge vlan solution without adding interface vlan
Replies: 30
Views: 818

Re: Bridge vlan solution without adding interface vlan

My goal is to monitor and control each switch port via Mikrotik. (For security purposes)
I cannot believe you run into CPU performance issues by just monitor and control for this setup, unless you have invested your money in a hAP mini...
by pe1chl
Tue Aug 03, 2021 5:12 pm
Forum: General
Topic: DHCP Offering Lease Without Success
Replies: 13
Views: 363

Re: DHCP Offering Lease Without Success

1. I cant find "always broadcast" in the DHCP server settings, screenshot: https://i.imgur.com/w1inj3l.png
Thanks for help!
Sorry, I cannot help people that cannot read!
by pe1chl
Tue Aug 03, 2021 3:13 pm
Forum: General
Topic: Feature request: Make Quickset to be separate package
Replies: 47
Views: 8662

Re: Feature request: Make Quickset to be separate package

When not making a separate package, consider to add some setting to disable QuickSet on a router or to make it read-only. (not as a skin feature or as a winbox setting, but some setting in the router itself that one will have to manually reset to use QuickSet again) This can then be set by an admin ...
by pe1chl
Tue Aug 03, 2021 2:24 pm
Forum: General
Topic: DHCP Offering Lease Without Success
Replies: 13
Views: 363

Re: DHCP Offering Lease Without Success

Hi, Last two weeks we are getting alot of errors dhcp1 offering lease 192.168.1.XX for XX:XX:XX:XX:XX:XX without success This is happening for wireless clients ony ^ Make sure in the MikroTik router the checkmark "always broadcast" in the DHCP server settings is NOT set. Make sure in the ...
by pe1chl
Tue Aug 03, 2021 12:34 pm
Forum: General
Topic: Can VLAN traffic be excluded from routing?
Replies: 6
Views: 226

Re: Can VLAN traffic be excluded from routing?

My question is in regards to keeping subnet 3 completely independent of traffic on the other two subnets. How do I prevent the swtich, running routeros, from routing traffic between the private VLAN subnet and the other two subnets? By adding a rule in the /ip firewall filter (and /ipv6 firewall fi...
by pe1chl
Tue Aug 03, 2021 12:31 pm
Forum: General
Topic: ipsec issue Firmware 6.45+
Replies: 5
Views: 129

Re: ipsec issue Firmware 6.45+

I'm not sure if it is the reason in this case but it is always a bit risky to make large version jumps in case some feature you use has received a lot of rework. The configuration may get incorrectly converted. As you already noted, IPsec has changed a lot, some config has moved and some things are ...
by pe1chl
Mon Aug 02, 2021 8:38 pm
Forum: General
Topic: Bridge vlan solution without adding interface vlan
Replies: 30
Views: 818

Re: Bridge vlan solution without adding interface vlan

Do you think simply bridging your network would work anyway? 1500 networks into one collision domain?
This remark is of course nonsense, a bridge or switch does not create a collision domain.
by pe1chl
Mon Aug 02, 2021 8:38 pm
Forum: General
Topic: Bridge vlan solution without adding interface vlan
Replies: 30
Views: 818

Re: Bridge vlan solution without adding interface vlan

I need to give 10.0.0.0/16 ip from common pool for all vLans. how can I do that. Could you please consider solving it without creating interfaces. Too many interfaces create high cpu problem. You cannot solve that. Not with MikroTik routers, at least. Maybe with a high-end L3 routing switch it is p...
by pe1chl
Mon Aug 02, 2021 5:56 pm
Forum: General
Topic: Bridge vlan solution without adding interface vlan
Replies: 30
Views: 818

Re: Bridge vlan solution without adding interface vlan

Yoncu, are you trying to bridge together different vlans? Yes. I want to merge all vLan and assign IP. Creating interfaces reduces performance because there are hundreds of vLans. I'm looking for a solution on Bridge without creating Interfaces. So you want to bridge a network of many VLANs and giv...
by pe1chl
Mon Aug 02, 2021 5:53 pm
Forum: General
Topic: Feature Request: Address List use Wildcard FQDN
Replies: 3
Views: 112

Re: Feature Request: Address List use Wildcard FQDN

I think it is too late to add that kind of "trick" as "everyone" is switching to DoH and DoT and that makes this impossible.
And of course a lookup of *.example.net to obtain the addresses for the list is impossible.
by pe1chl
Mon Aug 02, 2021 5:50 pm
Forum: General
Topic: cant update router
Replies: 7
Views: 203

Re: cant update router

You say you do not have DHCP on but in the config export it is ON.
(at least on ether1)
Maybe you have connected the other network to port 2..4 and there is no DHCP client there.
You will need to change that or you will have to configure DNS and default route manually.
by pe1chl
Mon Aug 02, 2021 5:47 pm
Forum: General
Topic: A discussion about UDP hole punching and how to prevent it.
Replies: 9
Views: 297

Re: A discussion about UDP hole punching and how to prevent it.

The NAT will only pass traffic from an address that previously the destination of an outgoing packet. So the scenario you describe will not work. But a scenario where some service tells client A that the other peer is client B and convinces it to send a packet there, while at (about) the same time t...
by pe1chl
Mon Aug 02, 2021 4:13 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Yes I agree! And I keep posting it in every topic where this limitation is discussed and this solution would solve it, hoping that finally some MikroTik employee will pick it up and start considering it. After all, MetaROUTER was implemented at some time. So they are not completely blind to this wis...
by pe1chl
Mon Aug 02, 2021 10:18 am
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 109
Views: 10129

Re: MikroTik RB5009UG+S+IN

Yes, that would be the "spec issue with the inductors" I mentioned. If the frequencies are higher, a perfect inductor would not have problems with that, but in reality we do not have perfect inductors, they have parasitic capacitance, and that could ruin your day at higher frequencies. So ...
by pe1chl
Sun Aug 01, 2021 8:45 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

What's the matter with access to the FS? I mean if user want, they can easily replace the entire OS right? I dont think it will create a hole for a hacker or something like that. Well, I think MikroTik would not like to open a hole for users (even when no hacker) to access the entire FS and gain sh...
by pe1chl
Sun Aug 01, 2021 1:36 pm
Forum: General
Topic: Please add basic portScan tool ( port scanner scan )
Replies: 59
Views: 26698

Re: Please add basic portScan tool ( port scanner scan )

+1
Thx!
Do you now think you have added any value to this topic?
by pe1chl
Sun Aug 01, 2021 1:34 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

it is possible to make usermanager package open source ? It is not possible to make ANY package open source, because it is not possible to compile a package for RouterOS unless you are in possession of the signing key. Ok technically you could release the source, but it would not be possible for ot...
by pe1chl
Sat Jul 31, 2021 8:16 pm
Forum: Wireless Networking
Topic: How many concurrent wireless users can support?
Replies: 22
Views: 28947

Re: How many concurrent wireless users can support?

should I sell the tp link and mikrotik and buy ubiquity or maybe tp-link Omada? It of course depends on what problems you are encountering, what budget you have for new equipment, and (in the context of this thread) what number of users you are dealing with. At work we have a Unifi WiFi system and ...
by pe1chl
Fri Jul 30, 2021 5:03 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 109
Views: 10129

Re: MikroTik RB5009UG+S+IN

The difference only mattered with 100M vs. 1G where half the wires could be missing. Or better: a 100M injector can just connect 4 of the 8 wires directly to power, while a 1G injector has to respect that those 4 wires are used for datatransfer as well so it has to use inductors to couple the power...
by pe1chl
Fri Jul 30, 2021 3:08 pm
Forum: General
Topic: NAT: Masquerade can leak private IP, why&how?
Replies: 24
Views: 913

Re: NAT: Masquerade can leak private IP, how? & shortest masquerade rule possible?

The problem with Linux NAT and therefore also with RouterOS NAT is that the NAT association is removed too soon at the end of a TCP connection. If there is further traffic past the end of the connection (the end as far as the NAT handling is concerned) it either passes through untranslated or it cre...
by pe1chl
Fri Jul 30, 2021 2:53 pm
Forum: Scripting
Topic: Torrent blocking working in y2020
Replies: 34
Views: 12101

Re: Torrent blocking working in y2020

It is the usual thing with these rules. It is not difficult to make a rule that blocks all Torrent traffic. What is difficult is making a rule that blocks all Torrent traffic but not anything else. When I see those L7 rules above I'm sure it blocks all kinds of unrelated traffic and not all Torrent ...
by pe1chl
Fri Jul 30, 2021 10:17 am
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 109
Views: 10129

Re: MikroTik RB5009UG+S+IN

It has a USB connector, so likely you can make a console port by plugging in a USB-RS232 cable.
by pe1chl
Thu Jul 29, 2021 6:43 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 109
Views: 10129

Re: MikroTik RB5009UG+S+IN

I agree that two SFP slots would be more useful for some scenarios, instead of the 2.5GbE. I think the reason for not doing that is that a 2.5GbE module in an SFP+ slot in a passively-cooled router will be thermally unstable. They want to offer 2.5GbE and have the option of having an OPTICAL module...
by pe1chl
Thu Jul 29, 2021 6:39 pm
Forum: RouterBOARD hardware
Topic: MikroTik RB5009UG+S+IN
Replies: 109
Views: 10129

Re: MikroTik RB5009UG+S+IN

From my perspective the MikroTik RB5009UG+S+IN could be a real winner especially for the home market Well, it looks like it is mainly intended for installations with multiple units in a rack. I am not familiar with such installs, but maybe it can be useful in some situations. Previously (I have see...
by pe1chl
Thu Jul 29, 2021 6:17 pm
Forum: Wireless Networking
Topic: Wifi net work for home with Iot (50 devices)
Replies: 43
Views: 1282

Re: Wifi net work for home with Iot (50 devices)

Well sure after I laboriously converted my 4-bridge setup (separate bridge for each VLAN) + switch config (which resulted after upgrading RouterOS on a setup with master/slave ports) to the "single bridge VLAN-filtering" setup that was supposed to be so much better, I was puzzled a while w...
by pe1chl
Thu Jul 29, 2021 3:55 pm
Forum: Wireless Networking
Topic: Wifi net work for home with Iot (50 devices)
Replies: 43
Views: 1282

Re: Wifi net work for home with Iot (50 devices)

Indeed. When it is not offloaded you see that in the port list. That is also the case for plain bridges without VLAN: you can see which ports are offloaded (i.e. physical ethernet ports for the first bridge on the same switch chip) and which ports are not (e.g. wlan interfaces, EoIP tunnels, more th...
by pe1chl
Thu Jul 29, 2021 2:57 pm
Forum: Wireless Networking
Topic: Wifi net work for home with Iot (50 devices)
Replies: 43
Views: 1282

Re: Wifi net work for home with Iot (50 devices)

The exact same check would be needed for this "translate to switch-chip..." button too. The plain switch offloading works automatically. You select "HW offload" in the port and the device itself checks if it can offload and if so it does it. That is switch programming from the b...
by pe1chl
Thu Jul 29, 2021 11:00 am
Forum: Wireless Networking
Topic: Wifi net work for home with Iot (50 devices)
Replies: 43
Views: 1282

Re: Wifi net work for home with Iot (50 devices)

all comes down to how configured. using switch chip vs bridge-vlan. Why on earth would anyone configure bridge vlan filtering on a device that have a single switch-chip but no hw-offloading for vlans? Well, one could also ask "why on earth does RouterOS not map the simple case of bridg-with-vl...
by pe1chl
Wed Jul 28, 2021 11:59 am
Forum: RouterOS v7 BETA
Topic: v7 launch date
Replies: 125
Views: 14107

Re: v7 launch date

Although of course it is again more work, it could be useful when "known bugs" or "unimplemented features" are made visible to users via a slightly more structured method than the forum. I.e. a tree on the HELP system where bugs that are known and require some time to be resolved...
by pe1chl
Wed Jul 28, 2021 11:47 am
Forum: General
Topic: Udp Packet Size Problem Mikrotik Forward
Replies: 2
Views: 191

Re: Udp Packet Size Problem Mikrotik Forward

When your MTU towards internet is limited (e.g. at the router provided by the ISP) to less than 1500 byte MTU it is certainly advisable to set that MTU on the ethernet interface towards internet (assuming that is how you connect it). That will tell the router to fragment larger packets. Also, in tha...
by pe1chl
Wed Jul 28, 2021 11:37 am
Forum: Wireless Networking
Topic: LHG 5 ac 10 MHz channel width
Replies: 8
Views: 555

Re: LHG 5 ac 10 MHz channel width

Maybe AC mode would not be useful or not defined in 5 or 10 MHz bandwidth, I don't know. However, a UBNT Powerbeam 5AC does support 10 MHz (not 5 MHz)... Anyway, even if that is true, the ac models still support N mode as a mode setting, so I would expect that I still can select N mode with 10 MHz c...
by pe1chl
Mon Jul 26, 2021 11:40 pm
Forum: Wireless Networking
Topic: LHG 5 ac 10 MHz channel width
Replies: 8
Views: 555

Re: LHG 5 ac 10 MHz channel width

Apologies for my previous conclusion, I tinkered around with some additional equipment of mine, it seems that the limitation is tied to ARM RouterOS architecture which has 802.11ac Yes, but I never understood why "ARM architecture" would have any influence on this kind of things as in Rou...
by pe1chl
Mon Jul 26, 2021 11:34 pm
Forum: Wireless Networking
Topic: WI-FI ROAMING 802.11r QUESTION
Replies: 41
Views: 22833

Re: WI-FI ROAMING 802.11r QUESTION

Likely they do not want to make another "SwOS" ("APOS"?) that runs bare accesspoint functionality to make space (i.e. not having RouterOS) as they well know that this means constant requests for "but could you at least add THIS..." and also they cannot compete in that m...
by pe1chl
Mon Jul 26, 2021 4:35 pm
Forum: Wireless Networking
Topic: LHG 5 ac 10 MHz channel width
Replies: 8
Views: 555

Re: LHG 5 ac 10 MHz channel width

Ok thanks for that additional info! I got back to trying my LHG 5 ac after I read a remark "it should work in newer software" and that is why successively tried current v6 and v7 betas unfortunately without success. In this case running v7beta would be an option (those devices are only run...
by pe1chl
Mon Jul 26, 2021 4:30 pm
Forum: Wireless Networking
Topic: WI-FI ROAMING 802.11r QUESTION
Replies: 41
Views: 22833

Re: WI-FI ROAMING 802.11r QUESTION

It's not that "basic functionality" is going away, wireless models will keep their current wireless functionality even with ROS v7. Well, of course what is to be called "basic functionality" changes over the course of time, and so do the expectations of customers. When you buy a...
by pe1chl
Mon Jul 26, 2021 12:15 pm
Forum: Wireless Networking
Topic: WI-FI ROAMING 802.11r QUESTION
Replies: 41
Views: 22833

Re: WI-FI ROAMING 802.11r QUESTION

It has been decided that old equipment will not get r k v and that new equipment, not yet released will get these features. This is based on old stuff using a custom wi-fi code. MT will not back port because the firmware flash storage in those devices is typically too small at about 16MB I believe....
by pe1chl
Mon Jul 26, 2021 12:01 pm
Forum: Scripting
Topic: hacked script
Replies: 4
Views: 458

Re: hacked script

And also: - change the password - make sure your router config interface (telnet,ssh,webfig,winbox,api) is NOT accessible from internet. (using firewall) The default firewall after a recent RouterOS install on "home routers" (not CCR, RB1100 etc) will be fine. Note that updating RouterOS d...
by pe1chl
Mon Jul 26, 2021 11:56 am
Forum: General
Topic: Feature Request: RouterOS Nightly
Replies: 4
Views: 478

Re: Feature Request: RouterOS Nightly

But that already exists! You just aren't one of those persons.
by pe1chl
Mon Jul 26, 2021 11:54 am
Forum: Wireless Networking
Topic: LHG 5 ac 10 MHz channel width
Replies: 8
Views: 555

Re: LHG 5 ac 10 MHz channel width

Yes, as I wrote above, I did that. But currently were are facing the situation of eventually migrating from N to AC as undoubtedly AC equipment will be the only thing available in the future, and also we might like to have the additional performance. So either we would have to change our setup from ...
by pe1chl
Sat Jul 24, 2021 1:52 pm
Forum: General
Topic: iPhone not resolving static dns entries [SOLVED]
Replies: 10
Views: 795

Re: iPhone not resolving static dns entries [SOLVED]

If you are using the current version of IOS for your iPhone there is a Privacy setting that you must turn off so that your static address gets accepted. The Apple setting is called Private Address .... turn that off ... then on your iPhone turn off wireless and then turn it back on and your static ...
by pe1chl
Sat Jul 24, 2021 11:47 am
Forum: Virtualization
Topic: CHR feature requests
Replies: 76
Views: 20547

Re: CHR feature requests

I'm not sure if it would have worked OK when you had enabled it before the license expired and then no longer touched it. However, IP->Cloud->Update time is not something you would want to use anyway. It is often quite inaccurate. Just configure NTP server(s) in System->SNTP servers. When you do not...
by pe1chl
Fri Jul 23, 2021 10:37 pm
Forum: Wireless Networking
Topic: LHG 5 ac 10 MHz channel width
Replies: 8
Views: 555

LHG 5 ac 10 MHz channel width

I have picked up an LHG 5 ac from the storage room that I bought some time ago and decided it was the wrong device to buy, but now I am trying it again. I need to set it to N with 10 MHz channel width. That selection is available in the winbox settings, however as soon as I select that channel width...
by pe1chl
Fri Jul 23, 2021 7:55 pm
Forum: Wireless Networking
Topic: Can't get started with mAP lite [SOLVED]
Replies: 4
Views: 414

Re: Can't get started with mAP lite [SOLVED]

Ok! Well of course these boxes are very versatile, as any MikroTik device. You can configure it as a router intead of bridge, and you can decide to run a DHCP server on it and on which side of the device that should be (ethernet or wlan). So you can either connect it to an ethernet network (and poss...
by pe1chl
Fri Jul 23, 2021 3:46 pm
Forum: Wireless Networking
Topic: Mikrotik - Early Access beta hardware?
Replies: 13
Views: 816

Re: Mikrotik - Early Access beta hardware?

Yup ... buy new model devices from your local MT distributor and you're hooked up for beta testing. Or so it seems ...
:-) :-)
by pe1chl
Fri Jul 23, 2021 2:04 pm
Forum: General
Topic: RouterOS making unaccounted outbound winbox connections [SOLVED]
Replies: 69
Views: 74329

Re: RouterOS making unaccounted outbound winbox connections [SOLVED]

to supplement as i had similar issue. best is to run as stated netinstal but do not restore the config. Actually, nobody above told you to restore the config! They all mention "start from scratch" after netinstall. Restoring the config is not safe, and when you did that you need to repeat...
by pe1chl
Fri Jul 23, 2021 12:27 pm
Forum: Beginner Basics
Topic: Allow Remote DNS Requests
Replies: 6
Views: 552

Re: Allow Remote DNS Requests

When you are serving PPPoE clients, the default firewall may or may not be reasonable for you. You need to evaluate what you want the firewall to do, and how you want to control what it does. (i.e. if you still want to use the simplified "WAN and LAN" classification that is in the default ...
by pe1chl
Fri Jul 23, 2021 12:21 pm
Forum: Wireless Networking
Topic: Can't get started with mAP lite [SOLVED]
Replies: 4
Views: 414

Re: Can't get started with mAP lite [SOLVED]

It looks like it is in bridge mode, i.e. it just relays all traffic between ethernet and wifi. However, it most likely has obtained an IP address from your home network when you connected to it. Check the DHCP server (router) on your home network to see what address it obtained from there, and conne...
by pe1chl
Thu Jul 22, 2021 10:24 pm
Forum: General
Topic: RouterOS Rule tester?
Replies: 18
Views: 903

Re: RouterOS Rule tester?

Concur with P1lchi, raw is not to be trifled with...... mind you I dont yet see the need to use jump either on my small config. (would jump chain be a good candidate for knock rules on the input chain?) Jump is useful in general in 2 different cases: - where you want to group some traffic (e.g. com...
by pe1chl
Thu Jul 22, 2021 9:49 pm
Forum: General
Topic: RouterOS Rule tester?
Replies: 18
Views: 903

Re: RouterOS Rule tester?

Do not forget "firewall raw" and move more rules as possible on that sections, I disagree with that. "raw" rules, when not fully understood, cause nasty problems that you do not see in "filter" rules with connection tracking. Only use "raw" rules when necessa...
by pe1chl
Thu Jul 22, 2021 9:35 pm
Forum: General
Topic: RouterOS Rule tester?
Replies: 18
Views: 903

Re: RouterOS Rule tester?

When your firewall is so complex that you no longer understand it, you should redesign it to be more managable. In may cases you can make things a lot clearer using the "jump" action (which is a misnomer, it really should have been named "call"). In the main "forward" a...
by pe1chl
Thu Jul 22, 2021 5:00 pm
Forum: Scripting
Topic: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)
Replies: 86
Views: 52902

Re: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)

I do not want defend my rules,
I want you to stop offend and be more polite.
HAHAHA rextended is offended by others... while usually he is the worst one on the forum, offending everyone who dares to ask a question!
Maybe you can see it as a hint that you need to adjust your behavior?
by pe1chl
Thu Jul 22, 2021 11:02 am
Forum: Scripting
Topic: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)
Replies: 86
Views: 52902

Re: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)

Those ICMP rules of yours will likely break PMTUD. You are right, such firewall rules (and all that blocking of "invalid packets" that do no harm anyway) is not worth the trouble and causes more harm than good. It is all well as long as it is the play garden of some hobbyist and he gets s...
by pe1chl
Wed Jul 21, 2021 3:17 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

We have such routing switches at work, and they are routing between VLANs inside an office. Do you enforce firewall filter for inter-VLAN connections? Without firewall enabled, those connections would be purely routed and for inter-VLAN routing the L3HW routing table is plenty large. Those routing ...
by pe1chl
Wed Jul 21, 2021 11:45 am
Forum: General
Topic: iPhone not resolving static dns entries [SOLVED]
Replies: 10
Views: 795

Re: iPhone not resolving static dns entries [SOLVED]

It is becoming more and more common to have "DNS rebind protection" that is filtering DNS replies to queries outside your LAN domain but returning a LAN or loopback address. I don't know if Apple implements that in their devices. There are routers that implement it in their DNS resolvers. ...
by pe1chl
Wed Jul 21, 2021 11:08 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

if i may ask, what is the expected use case of offloading fasttracked connections? 4k connections seems way too few to me since everything else would be processed on the CPU (which considering the CPUs in these would be effectively dropping all other packets in any decently sized network), unless i...
by pe1chl
Tue Jul 20, 2021 4:27 pm
Forum: Virtualization
Topic: Metarouter images
Replies: 376
Views: 292419

Re: Metarouter images

Metarouter is not available on new-style devices with 16MB flash! It is only available on older devices with 64 or 128MB flash. Hopefully sometime we will get a new style Metarouter that allows users to run their own daemons in a low-privilege chrooted environment in a folder on the flash. That woul...
by pe1chl
Sat Jul 17, 2021 8:59 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

I had some strange export issue with wifi settings on this release , it's just me or someone noticed something similar too? Nothing affecting the normal operation of the devices, but still.. odd. I see exports with nstreme and tx-manual-power variables populated wich I've never set No, I do not see...
by pe1chl
Sat Jul 17, 2021 1:00 pm
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

I hate dark mode! If ever such a thing is implemented, it has to be a setting!
Otherwise, I think dark mode fans should ask their operating system supplier for an "inverted" display (exchange black and white) so they do not have to bother each application maker to do it there.
by pe1chl
Fri Jul 16, 2021 7:15 pm
Forum: Beginner Basics
Topic: IPSEC tunnel instructions
Replies: 18
Views: 880

Re: IPSEC tunnel instructions

added this rule
add action=accept chain=input comment="Allow BGP" disabled=yes dst-port=179 protocol=tcp
Yes you need to allow input to port 179 tcp, of course not disabled like shown above. you can limit the src-address to the range you use on the GRE tunnels.
by pe1chl
Fri Jul 16, 2021 7:13 pm
Forum: Beginner Basics
Topic: IPSEC tunnel instructions
Replies: 18
Views: 880

Re: IPSEC tunnel instructions

no, on each router you only add the networks that are local to that router and that you want other routers to know about.
by pe1chl
Fri Jul 16, 2021 4:53 pm
Forum: Beginner Basics
Topic: IPSEC tunnel instructions
Replies: 18
Views: 880

Re: IPSEC tunnel instructions

BGP is really easy. Under BGP->Instances, set the Router ID of each router to its primary IP address on the LAN. Set the AS to a different number on each router, you can use numbers like the default 65530, then 65531 on another, 65532 on a 3rd, etc. Numbers 64512 – 65534 are available for your use. ...
by pe1chl
Fri Jul 16, 2021 1:58 pm
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

I have a problem
It can show Always wifi password in Quick Set
You should only give the admin password to users who already know the wifi password!
by pe1chl
Fri Jul 16, 2021 1:12 pm
Forum: RouterBOARD hardware
Topic: Precision Time Protocol (PTP, IEEE 1588) Support
Replies: 20
Views: 1316

Re: Precision Time Protocol (PTP, IEEE 1588) Support

I am in depth familiar with (at least one) LTE network. You're right, most vendors support connecting GPS receiver to eNodeB to provide accurate timing. However, times when every base station of a network had clear view of sky is long gone, hence need for protocol that delivers precise timing over ...
by pe1chl
Fri Jul 16, 2021 1:01 pm
Forum: Beginner Basics
Topic: IPSEC tunnel instructions
Replies: 18
Views: 880

Re: IPSEC tunnel instructions

IPsec can sometimes run into trouble when there are NAT routers (or other routers keeping a stateful firewall) inbetween. With GRE you can enable keepalive to guarantee some traffic. I normally use BGP over the GRE tunnels to set the routes between the networks (even when it is a simple network), an...
by pe1chl
Thu Jul 15, 2021 11:57 pm
Forum: RouterBOARD hardware
Topic: Precision Time Protocol (PTP, IEEE 1588) Support
Replies: 20
Views: 1316

Re: Precision Time Protocol (PTP, IEEE 1588) Support

What exactly in typical office environment requires timing precission better than milisecond? Not all environments are office environments! I think he is hinting that it may be e.g. a recording studio environment. Just for information: in LTE network PTP is used for synchronizing different base sta...
by pe1chl
Thu Jul 15, 2021 9:52 pm
Forum: RouterBOARD hardware
Topic: Precision Time Protocol (PTP, IEEE 1588) Support
Replies: 20
Views: 1316

Re: Precision Time Protocol (PTP, IEEE 1588) Support

To get high accuracy time on devices running cheap (or old) hardware, I use NTP in combination with 1PPS. I.e. NTP is used for coarse sync and a 1PPS signal is separately distributed to the devices that require accurate time. Of course that can be impractical when you have many devices or they are s...
by pe1chl
Thu Jul 15, 2021 5:30 pm
Forum: General
Topic: Adding Multiple IP blocks to IP-->Addresses
Replies: 3
Views: 336

Re: Adding Multiple IP blocks to IP-->Addresses

Normally for such a thing I would use a script on my computer to generate the proper commandline config, and then import or paste that into the router. It would also be possible to make a script on the router but that is extremely difficult to debug and likely not worth the trouble. E.g. in bash one...
by pe1chl
Thu Jul 15, 2021 5:24 pm
Forum: General
Topic: Simple Queues for Prioritization
Replies: 4
Views: 473

Re: Simple Queues for Prioritization

"simple queues" are intended to evenly distribute the bandwidth among devices on the same network. When you want to do something else, like what you need: give one network some bandwidth and the remainder to another network, it is better to use "queue tree". You need to mark the ...
by pe1chl
Thu Jul 15, 2021 5:17 pm
Forum: RouterBOARD hardware
Topic: Precision Time Protocol (PTP, IEEE 1588) Support
Replies: 20
Views: 1316

Re: Precision Time Protocol (PTP, IEEE 1588) Support

PTP support requires assistance from hardware, which is normally only available in switch chips. CCR does not have that.
by pe1chl
Thu Jul 15, 2021 11:47 am
Forum: Beginner Basics
Topic: IPSEC tunnel instructions
Replies: 18
Views: 880

Re: IPSEC tunnel instructions

I would advise not to use direct IPsec tunnels but to use a GRE (or IPIP) tunnel with the IPsec secret. That will setup a GRE/IPsec or IPIP/IPsec tunnel which will give you a tunnel interface at each end. You can then put a /30 address on each end of the tunnel (e.g. 192.168.2.1/30 and 192.168.2.2/3...
by pe1chl
Thu Jul 15, 2021 11:04 am
Forum: General
Topic: Firmware mirror and automatic updates
Replies: 23
Views: 1378

Re: Firmware mirror and automatic updates

But how do you grab new firmware from Mikrotik automatically? Thanks! I would't advise to do that. Make the updates to the repository (downloading from MikroTik) a manual operation, only make the updating of the routers in your network from the repository automatic. That way you remain in control o...
by pe1chl
Thu Jul 15, 2021 11:02 am
Forum: Forwarding Protocols
Topic: Point-to-point (/31) addresses
Replies: 85
Views: 58004

Re: Point-to-point (/31) addresses

but they fail when you use protocols that expect to be able to use broadcast over a link, like OSPF. This partially untrue, as OSPF has PtP mode which eliminates address broadcasts, making /32 addresses the absolute simplest and easiest option, but only for PtP mode OSPF. That is what I say, you ma...
by pe1chl
Wed Jul 14, 2021 4:44 pm
Forum: Forwarding Protocols
Topic: Point-to-point (/31) addresses
Replies: 85
Views: 58004

Re: Point-to-point (/31) addresses

Tricks with /32 (or even /31) work OK for point-to-point traffic like static routing or BGP peers, but they fail when you use protocols that expect to be able to use broadcast over a link, like OSPF. You may need additional configuration, you may encounter bugs, etc. As long as you know that, it sho...
by pe1chl
Wed Jul 14, 2021 4:41 pm
Forum: General
Topic: Firewall drop all !LAN is not the same as drop all WAN
Replies: 15
Views: 853

Re: Firewall drop all !LAN is not the same as drop all WAN

When you want a default-block method you can change the "drop all from !LAN" to two rules: "allow all from LAN" and "drop all". It will be no different, but some people like it better. Sure I also setup my firewall like that, but I do not use the default ruleset at all....
by pe1chl
Tue Jul 13, 2021 9:48 pm
Forum: General
Topic: Firewall drop all !LAN is not the same as drop all WAN
Replies: 15
Views: 853

Re: Firewall drop all !LAN is not the same as drop all WAN

3 followup questions: 1) To what list do I add the VPN? 2) What's the risk of using as it is now with 'drop all not coming from WAN" rather than !LAN? 3) Why do you think Mikrotik changed their default config from WAN to !LAN ? I already answered your questions in the post before (#3 above). I...
by pe1chl
Tue Jul 13, 2021 10:03 am
Forum: General
Topic: Static DNS records [SOLVED]
Replies: 9
Views: 665

Re: Static DNS records [SOLVED]

Yes, the resolver really needs to be ditched and replaced with a working opensource resolver (there are several)....
by pe1chl
Mon Jul 12, 2021 8:53 pm
Forum: General
Topic: Firewall drop all !LAN is not the same as drop all WAN
Replies: 15
Views: 853

Re: Firewall drop all !LAN is not the same as drop all WAN

2) Ask a ROS expert to explain why !LAN is not equal to WAN 3) Am I still adequately protected on my RB3011 after I changed !LAN to WAN in my firewall rules?? The default firewall rules use !LAN instead of WAN because beginning users may add extra interfaces (like an extra bridge, a new internet in...
by pe1chl
Mon Jul 12, 2021 8:48 pm
Forum: General
Topic: Static DNS records [SOLVED]
Replies: 9
Views: 665

Re: Static DNS records [SOLVED]

The DoH function was added to the existing DNS resolver in a completely incorrect way. Of course the correct thing to do would have been to add it as a next-level resolver the same way as the existing resolvers already were. But it appears that once you enable DoH, it does not go as a resolver behin...
by pe1chl
Sun Jul 11, 2021 7:49 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

It's July and we're due for beta7.
beta7 is apparently being sent to invited users at the moment, no idea why it is not distributed using the normal mechanism...
by pe1chl
Sun Jul 11, 2021 2:48 pm
Forum: RouterBOARD hardware
Topic: E3372h-320 USB/lte1 problems constantly LTE1 link up-down
Replies: 56
Views: 20712

Re: E3372h-320 USB/lte1 problems constantly LTE1 link up-down

Yes it apparently is being worked on in v7.
I do have 3 of the older E3372 in operation without any problem, so it must be something that has changed.
by pe1chl
Sun Jul 11, 2021 12:52 pm
Forum: RouterBOARD hardware
Topic: E3372h-320 USB/lte1 problems constantly LTE1 link up-down
Replies: 56
Views: 20712

Re: E3372h-320 USB/lte1 problems constantly LTE1 link up-down

I have same problem. Link up / link down neverending. I don't understand why version 6 is called stable when it makes such a problem and also after about five hours the Mikrotik router ended restarts on its own based on the USB dongle connected in this way. Well, it is not a problem that was design...
by pe1chl
Sat Jul 10, 2021 7:43 pm
Forum: General
Topic: Congestion based QoS
Replies: 4
Views: 474

Re: Congestion based QoS

The only place where a priority-based queueing (e.g. using DSCP or 802.1q) can work with a radio interface, is on the radio device itself. When you have a MikroTik device with LTE card, that would theoretically be possible. E.g. the WiFi interfaces do that, when WMM is enabled. I don't know if the L...
by pe1chl
Sat Jul 10, 2021 1:29 pm
Forum: RouterOS v7 BETA
Topic: L2TP/IPsec tunnel erases configuration
Replies: 1
Views: 451

Re: L2TP/IPsec tunnel erases configuration

You are using beta software. It warns you to make backups, and it may be unstable. It is known that for certain configuration changes, the v7 beta crashes and resets the configuration. This may also happen when you upgrade to a newer v7 beta, it happened to me as well. Luckily, you can now do a /exp...
by pe1chl
Sat Jul 10, 2021 1:15 pm
Forum: Beginner Basics
Topic: Initial setup, ping works, but clients can not reach Internet
Replies: 5
Views: 479

Re: Initial setup, ping works, but clients can not reach Internet

1. How do you disable the autocomplete command in Terminal (I prefer a GUI). I realize it is handy for many, but since I use it as little as possible it tends to be confusing and frustrating. Make a better GUI. 2. Could Terminal be browser sensitive when running WebFig, since it seems to run better...
by pe1chl
Sat Jul 10, 2021 12:49 pm
Forum: General
Topic: Firmware mirror and automatic updates
Replies: 23
Views: 1378

Re: Firmware mirror and automatic updates

However, I haven't seen any practical manner to create an auto syncing firmware repo. Has anyone tackled this challenge? Thank you! There is a menu item "Auto Upgrade" under "System" that seems to be orphaned... it is barely documented. But it appears to do (or have done in the ...
by pe1chl
Fri Jul 09, 2021 3:04 pm
Forum: General
Topic: DNSSEC
Replies: 36
Views: 17328

Re: DNSSEC

At the moment, the DNS resolver in RouterOS is in a sad state. Problems with DoH, problems with the cache integrity, lack of DNSSEC support. We can only hope that the developers at MikroTik have finally noticed this and will switch over to a proven opensource DNS resolver in RouterOS v7 and if we ar...
by pe1chl
Thu Jul 08, 2021 8:53 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1693

Re: "TLS Host" option doesn't work

In a filter rule configured for protocol tcp, you can reject a packet with tcp rst.
by pe1chl
Thu Jul 08, 2021 7:01 pm
Forum: Beginner Basics
Topic: Redirect web proxy traffic to second ISP
Replies: 6
Views: 440

Re: Redirect web proxy traffic to second ISP

Suggestion is to find some other way to know where to send the traffic. E.g. make 2 different user networks (VLAN and/or WiFi SSID) for two groups of clients, and use the source address (which network) to route the traffic. Or, with a single network, assign fixed addresses to the clients you want to...
by pe1chl
Thu Jul 08, 2021 7:00 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1693

Re: "TLS Host" option doesn't work

SYN -> <- ACK SYN ACK -> DATA -> the 4th packet contains the setup of TLS but I am not sure if that immediately contains the TLS Host or if that is even later in the exchange. you would have to reject that packet with a TCP RST reply and also add the destination address to your address list. that st...
by pe1chl
Thu Jul 08, 2021 6:36 pm
Forum: Beginner Basics
Topic: Redirect web proxy traffic to second ISP
Replies: 6
Views: 440

Re: Redirect web proxy traffic to second ISP

The MikroTik proxy does support HTTPS!
Of course only when explicitly configured, not as transparent proxy.
by pe1chl
Thu Jul 08, 2021 6:35 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1693

Re: "TLS Host" option doesn't work

When the connection restarts you will have lost your identifying work (setting connection mark or routing mark) on that connection. You would have to use the "add to address list" construct for the destination address. And likely for the next attempt the destination address will be differe...
by pe1chl
Thu Jul 08, 2021 5:34 pm
Forum: General
Topic: "TLS Host" option doesn't work
Replies: 46
Views: 1693

Re: "TLS Host" option doesn't work

You have to understand that only the (unencrypted!) dns traffic between your Windows Client and the configured DNS Server (I assumed it's the Mikrotik Router) gets inspected/altered. It doesn't matter if you're using DoH on any upstream DNS Resolver. You didn't even come close to what I'm doing. To...
by pe1chl
Thu Jul 08, 2021 5:22 pm
Forum: Beginner Basics
Topic: Redirect web proxy traffic to second ISP
Replies: 6
Views: 440

Re: Redirect web proxy traffic to second ISP

The web proxy is not a routing service, it has an inside that takes the connects to port 8080 and an outside that connects to the desired server. So it is not possible to apply marks to the inside traffic and expect them to work on the outside traffic. It generally is difficult to apply marks and ro...
by pe1chl
Thu Jul 08, 2021 3:02 pm
Forum: RouterBOARD hardware
Topic: Internal power supplies instead of wall warts
Replies: 9
Views: 1241

Re: Internal power supplies instead of wall warts

I think the annoying thing about wall warts is how to properly rack them. If there was a way to tie the wall wart to the back or side of the Mikrotik device, that would be enough for most of us. Thoughts ? In some of the -RM models of devices that also exist as a -IN model, the -RM model actually h...
by pe1chl
Tue Jul 06, 2021 10:29 pm
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

I'd like to be able to queue changes and apply them all at once. Like an inverted safe mode. I often need this when I have to make multiple changes to interfaces / ip addresses. In command (terminal) mode, you already have that! Type a { to open a block, then you can issue a number of commands that...
by pe1chl
Tue Jul 06, 2021 12:27 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

There is no relation whatsoever between existing licensed 6GHz link equipment and the new 6GHz wifi channels.
The new channels are only for indoor use with low power, not for outdoor links.
It requires a suitable conformant indoor access point.
by pe1chl
Tue Jul 06, 2021 12:24 pm
Forum: General
Topic: strange smtp / Mikrotik problem [SOLVED]
Replies: 4
Views: 499

Re: strange smtp / Mikrotik problem [SOLVED]

When this solves the problem, there is a mistake in the firewall of your user machine and/or of the router.
You should not drop all ICMP packets, not even when "experts" on the internet tell you to do so.
Dropping all ICMP packets is the cause of this problem.
by pe1chl
Tue Jul 06, 2021 10:59 am
Forum: General
Topic: strange smtp / Mikrotik problem [SOLVED]
Replies: 4
Views: 499

Re: strange smtp / Mikrotik problem [SOLVED]

Well, this is a user forum, not a support desk. There is no guaranteed reply.

Try to add this rule to your mangle list and move it to the top:
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
    protocol=tcp tcp-flags=syn
Is there any difference?
by pe1chl
Tue Jul 06, 2021 10:01 am
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

Actually from what I was able to reproduce and report to support it seems to be related to CNAME requests. CNAME requests appear to be bypassing the cache (memory leak?) and increasing memory usage. I have reported to support that DNS requests that return a large reply lead to a big memory leak, bu...
by pe1chl
Tue Jul 06, 2021 9:58 am
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

please add email, phone and notes in ppp secret
ppp secret already has a comment field like most of the configuration records in RouterOS!
You can use it for that purpose.
by pe1chl
Sun Jul 04, 2021 2:26 pm
Forum: Beginner Basics
Topic: Firewall DNS instead of IP address
Replies: 14
Views: 881

Re: Firewall DNS instead of IP address

The agressive poster is again playing up. But obviously it is easy to do in RouterOS. He just doesn't know it, and that is when he gets offensive and agressive. For the original poster: Go to the IP Firewall menu tab Address lists. Add a rule, enter a name (e.g. admins) and in the address field ente...
by pe1chl
Sat Jul 03, 2021 2:53 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Besides, my understanding of verbose is that it is printing defaults? But my value is not default. That is correct, what you observed is a bug (I think) but sometimes it is possible to gather more information by checking /export verbose and see what happens then. When the value appears, the export ...
by pe1chl
Fri Jul 02, 2021 4:22 pm
Forum: General
Topic: SSTP vs PPTP poor RDP responsiveness
Replies: 7
Views: 550

Re: SSTP vs PPTP poor RDP responsiveness

Yes, L2TP/IPsec is certainly a much better option than SSTP or even PPTP.
by pe1chl
Fri Jul 02, 2021 2:37 pm
Forum: General
Topic: SSTP vs PPTP poor RDP responsiveness
Replies: 7
Views: 550

Re: SSTP vs PPTP poor RDP responsiveness

RB2011 is an old design (10 years old as you can see from the type number) that does not offer any encryption acceleration. Even a tiny RB750Gr3 will outperform it. And of course also the newer types like RB3011, RB4011, hAP AC3, etc. However, that might not be your problem in this case. Poor perfor...
by pe1chl
Fri Jul 02, 2021 2:28 pm
Forum: Beginner Basics
Topic: How to access a HEX router Webfig from another network?
Replies: 4
Views: 475

Re: How to access a HEX router Webfig from another network?

Probably in this case it is safe to allow from 192.168.0.0/24
by pe1chl
Fri Jul 02, 2021 12:20 pm
Forum: General
Topic: MIkrotik Syslog New Format
Replies: 23
Views: 1174

Re: MIkrotik Syslog New Format

As i understood the first post showed an example of the intended format. I would just set the start= and stop= to the whatever the event time is and call it a day. The intention of these requirements (by authorities) is to have a log of sessions made by users behind a (CG)NAT router. So when they h...
by pe1chl
Fri Jul 02, 2021 12:14 pm
Forum: General
Topic: MIkrotik Syslog New Format
Replies: 23
Views: 1174

Re: MIkrotik Syslog New Format

If MT changes their Syslog format, I do have to rewrite my MikroTik for Splunk app (see signature). That is why in principle it is a good idea to, when the format would change, change it to something that a good parser could analyse even when new fields are added. What we have now is just a random ...
by pe1chl
Fri Jul 02, 2021 12:10 pm
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

I am aware that none the existing ROS operating systems with switch chip ASIC drivers and software code are running on x86 CPU hardware - however you have a good head start and there should be no need to start from scratch. How much software work would be involved to take the ROS x86 source code , ...
by pe1chl
Thu Jul 01, 2021 8:28 pm
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

Are you not under-estimating the effort? It should be easy to make a RouterOS version that runs on the management CPU, but it should also be able to manage the switching ASIC in use in the product. When your switch has switching hardware that MikroTik does not already support because the same chipse...
by pe1chl
Thu Jul 01, 2021 6:15 pm
Forum: General
Topic: MIkrotik Syslog New Format
Replies: 23
Views: 1174

Re: MIkrotik Syslog New Format

Anyways, this re-formattning can be done with logstash . Just parse the default messages from the Mikrotik, and re-format as a key=value message, and re-send as syslog. ... but the default messages lack a lot of information. they would have to be expanded and when that is done indeed it should be d...
by pe1chl
Thu Jul 01, 2021 4:24 pm
Forum: General
Topic: MIkrotik Syslog New Format
Replies: 23
Views: 1174

Re: MIkrotik Syslog New Format

What you need is a NetFlow collector. You setup the collector, then configure you router to export the traffic flow information (see the Traffic Flow manual page). Once your traffic data is collected you can export it in whatever format you want. However, please note that: (a) you cannot run a NetF...
by pe1chl
Tue Jun 29, 2021 3:14 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

Of course it could still be used as a plain AP behind a router provided and already configured for the ISP connection. (DHCP-obtained address for the AP and preferably operating in bridge mode) Of course it would be nice when there was a freely accessible database of internet providers worldwide and...
by pe1chl
Tue Jun 29, 2021 11:17 am
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

A customer just wanting to connect to internet using their own router would usually configure only the internet VLAN and PPPoE over that. Wow. My personal opinion, instead of blaming apps, these types of providers should re-think their network setup. Why would home users have to know such stuff? Th...
by pe1chl
Tue Jun 29, 2021 11:11 am
Forum: RouterBOARD hardware
Topic: USB Battery to power routerboard
Replies: 21
Views: 5232

Re: USB Battery to power routerboard

Yes. But be sure to read reply #8 when you think this will bring you a UPS-like solution. It won't.
by pe1chl
Sat Jun 26, 2021 2:42 pm
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4649

Re: Under flood attack, how resolve this ? [SOLVED]

You got it wrong: In MY case was an amplifying NTP DDoS that used an online list of open servers. The guy was using misconfigured NTP servers to do it. This is why I said he had no control over. It's the same principle behind "don't expose Your Mikrotik 53 port to the Internet". One could...
by pe1chl
Sat Jun 26, 2021 10:47 am
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4649

Re: Under flood attack, how resolve this ? [SOLVED]

Now, about the DDoS. I doubt this guy has all these hosts under control: they must be just bad configured/vulnerable hosts on the internet. This means he probably doesn't have control over them - he's just using them. Why does it matter? Because if it's true, these hosts will honor ICMP messages - ...
by pe1chl
Fri Jun 25, 2021 11:42 am
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4649

Re: Under flood attack, how resolve this ? [SOLVED]

B. Longterm solution: Call your ISP and change public IP of your router. I don't think that will be a longterm solution. As soon as the boys that want to shutdown his gaming server discover that the address has changed, they will change the target address of their attacks. A longterm solution would...
by pe1chl
Thu Jun 24, 2021 9:23 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

PPPoE became pointless as soon as dialup got replaced by cable modems and optic fibers. Today, DHCP and plain old ethernet work just as well and you have no PPPoE limitations to deal with. You seem to be confusing it with PPP. PPPoE is PPP over Ethernet. It is widely used over optic fiber and DSL. ...
by pe1chl
Thu Jun 24, 2021 5:23 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

In some models there are health-related settings, e.g. when there are redundant fans you can select the mode and active fan. The RB750Gr3 does not have such settings so when you click the settings button you get a window where you can set nothing and then OK/APPLY/CANCEL it. Of course it would be be...
by pe1chl
Thu Jun 24, 2021 11:25 am
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4649

Re: Under flood attack, how resolve this ? [SOLVED]

Now back to the original topic: You must first determine if the flood of UDP packets is filling your entire line capacity, or if it is only overwhelming your server or router. When it is filling your line, there is nothing you can do! You will have to solve the problem at the other end of the line, ...
by pe1chl
Thu Jun 24, 2021 11:19 am
Forum: General
Topic: Under flood attack, how resolve this ? [SOLVED]
Replies: 107
Views: 4649

Re: Under flood attack, how resolve this ? [SOLVED]

i don't understand why you say this.., but no problem, I really appreciate a lot your help or anyone who gives their advice to avoid this attack problem. you can read my signature for why, sorry but I'm sad about that, but you have nothing to do with it. I think it is time that you stop reacting th...
by pe1chl
Thu Jun 24, 2021 10:04 am
Forum: General
Topic: Wireless backbone stability
Replies: 14
Views: 1002

Re: Wireless backbone stability

You should rather put a ROUTER between the links, not a SWITCH. Do not invest in RB260GS but in routers like RB750Gr3 (when you are on a tight budget) or RB3011/RB4011. This allows you to break up the large broadcast domain. The first place to do that is obviously where you now have SW0.0 but when t...
by pe1chl
Wed Jun 23, 2021 5:04 pm
Forum: RouterOS v7 BETA
Topic: Any release date for 7.x expectation?
Replies: 18
Views: 3563

Re: Any release date for 7.x expectation?

Current available v7beta might be working on many setups, we are working on making routing ready for productions setups, and as well polishing other features. In case you have tried v7.x on your test devices, let us know about any issues. Well frankly it is a little disappointing that there is no a...
by pe1chl
Mon Jun 21, 2021 2:16 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

Those users mostly never change the password that is set initially so, although it may look like a nice touch, it seems like a bit of waste of developers time IMHO... It would be better to spend developers time on a "unique password" scheme. And do it right the first time. Routers with no...
by pe1chl
Mon Jun 21, 2021 11:04 am
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

PPPoE is still widely used here at least (Australia) - and most consumer routers in their quick setup allow for configuring PPPoE as the WAN type I agree though that VLAN id's and the like on WAN is getting a bit involved. So that isn't used in Australia then? Here in the Netherlands you would have...
by pe1chl
Sun Jun 20, 2021 12:18 pm
Forum: General
Topic: IPSec drops and requires reboot
Replies: 9
Views: 815

Re: IPSec drops and requires reboot

Is your MikroTik router directly on an internet connection with the public IP address appearing on the MikroTik? Or is it behind some ISP-provided router with or without "port forwarding", "setting as DMZ", etc? Such configurations often cause problems with IPsec. When you are di...
by pe1chl
Sun Jun 20, 2021 12:13 pm
Forum: Beginner Basics
Topic: Is it possible to set up NTP Server using name address instead of IP address?
Replies: 19
Views: 1264

Re: Is it possible to set up NTP Server using name address instead of IP address?

The problem with RouterOS version 6 is that when you install the optional NTP server package, it also replaces the SNTP client, and the new NTP client is much more limited... (only 2 server addresses, only as literal IP address and not as DNS name). In RouterOS version 7 that problem is no longer pr...
by pe1chl
Sat Jun 19, 2021 7:48 pm
Forum: SwOS
Topic: 16K host entries
Replies: 3
Views: 859

Re: 16K host entries

The 16k hosts are per network segment, not for the entire network.
By the time you get any close to that, you should long have divided the network into multiple segments with routing between them, rather than switching.
by pe1chl
Sat Jun 19, 2021 3:44 pm
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

I had a strange issue tonight. All DNS resolving stopped.
I would say the programmer assigned to the DNS resolver is not the best.
Better avoid new features such as DOH when you want reliability, but even then there still are memory leaks.
by pe1chl
Fri Jun 18, 2021 8:16 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

And the ISP is really asking the end-user to do this? If there are any VLANs and such, normally the ISP technician configures / provides the router and does not give access to the end user. This video is not for that situation. No, instead they provide a router that has a first-start wizard which w...
by pe1chl
Fri Jun 18, 2021 3:51 pm
Forum: General
Topic: Wireless backbone stability
Replies: 14
Views: 1002

Re: Wireless backbone stability

I am managing a similar wifi-linked network and it is quite usual that brief interruptions occur, especially in summertime when there often are tropospheric effects that can influence both your links and the sensing of RADAR (DFS) that causes frequency changes and interruptions. Indeed it is quite i...
by pe1chl
Thu Jun 17, 2021 12:01 pm
Forum: Announcements
Topic: Newsletter June 2021 (#100)
Replies: 54
Views: 15928

Re: Newsletter June 2021 (#100)

Home app - goes thorugh nothing to do with WAN setup. What if its PPPoE? Does this just purely rely on a DHCP WAN? For any kind of funky setups, surely you need the normal MikroTik app, where a lot more options are available. This is for home users with no configuration needs. That should then read...
by pe1chl
Wed Jun 16, 2021 11:10 am
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

It is weird. First time have seen a WiFi router/bridge which is not updating the wireless section and is putting it as an extra. Remember that the same RouterOS is also used on other router models that do not have wireless, you can choose to not install it. However I think it is not the reason of y...
by pe1chl
Tue Jun 15, 2021 3:07 pm
Forum: General
Topic: GRE6 tunnel without local-address does not come up after reboot
Replies: 0
Views: 427

GRE6 tunnel without local-address does not come up after reboot

I configured a GRE6 tunnel on a MikroTik router and entered only the remote address of the tunnel. local-address was left unconfigured. The tunnel came up and worked fine. Then as a final step I updated RouterOS and rebooted. The tunnel now refused to work. I tried lots of things including disabling...
by pe1chl
Tue Jun 15, 2021 12:28 pm
Forum: RouterBOARD hardware
Topic: Battery driven RB get bricked
Replies: 6
Views: 1303

Re: Battery driven RB get bricked

Yes I agree with the above, it is usually no problem to simply cut the power to the RB750, but to slowly decrease the voltage below the minimum really can trigger issues. So as recommended, change the circuitry so that when the battery is below some minimum voltage, the load is suddenly cut. (and ma...
by pe1chl
Mon Jun 14, 2021 7:24 pm
Forum: General
Topic: On IPsec tunnel termination, existing stream impacted [SOLVED]
Replies: 13
Views: 770

Re: On IPsec tunnel termination, existing stream impacted [SOLVED]

The issue is when the public IP changes, there would have to be a script to change the srcnat rule and delete all the connections.
masquerade does this automatically.
by pe1chl
Mon Jun 14, 2021 12:12 pm
Forum: General
Topic: Feature request: Force sending of DHCP options to clients
Replies: 47
Views: 14334

Re: Feature request: Force sending of DHCP options to clients

Yes pe1chl 1000+ incredible how mikrotik decide to approach this feature req. It looks like you do not understand the matter! MikroTik already supports the sending of arbitrary DHCP options to clients. You can define them using the Options, Option Sets, and Vendor Classes tabs of the DHCP server co...
by pe1chl
Mon Jun 14, 2021 10:47 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Anyone else having an issue here with v7.1beta6 and the hap ac^2, where on power loss all configuration is lost?
Thankyou
This means the flash filesystem somehow got corrupted. Re-install with netinstall and use the format option.
by pe1chl
Mon Jun 14, 2021 10:45 am
Forum: General
Topic: On IPsec tunnel termination, existing stream impacted [SOLVED]
Replies: 13
Views: 770

Re: On IPsec tunnel termination, existing stream impacted [SOLVED]

I have no idea why that would happen. Issues that could occur: - quite wide IPsec policy is active and when it terminates it disturbs the connection tracking (that should not occur with GRE/IPsec as the policy covers only protocol-47 traffic between the 2 public IP addresses, nothing related to 192....
by pe1chl
Sun Jun 13, 2021 8:08 pm
Forum: General
Topic: On IPsec tunnel termination, existing stream impacted [SOLVED]
Replies: 13
Views: 770

Re: On IPsec tunnel termination, existing stream impacted [SOLVED]

When you cannot control what the remote end does, you cannot simply switch to GRE tunneling. You need cooperation from the other end. To control the settings of the encryption parameters, you need to setup the IPsec manually instead of by setting it in the GRE interface. You can look what is created...
by pe1chl
Sun Jun 13, 2021 6:03 pm
Forum: General
Topic: On IPsec tunnel termination, existing stream impacted [SOLVED]
Replies: 13
Views: 770

Re: On IPsec tunnel termination, existing stream impacted [SOLVED]

You could try to replace masquerade with src-nat and the external address that is on wan1. Hopefully it is static.
This can sometimes fix problems, sometimes it can introduce new problems.
by pe1chl
Sun Jun 13, 2021 11:37 am
Forum: General
Topic: DHCP Offering Lease Without Success
Replies: 83
Views: 52004

Re: DHCP Offering Lease Without Success

That is because it is not really a MikroTik issue. It is a combination of server, client, and the medium between them.
by pe1chl
Sun Jun 13, 2021 11:35 am
Forum: General
Topic: Issue with DST-NAT (RouterOS 6.47.10)
Replies: 16
Views: 805

Re: Issue with DST-NAT (RouterOS 6.47.10)

Ok understood. So there's no way to achieve what I am trying to do. So either i need to use Proxy feature of MikroTik or I am out of luck. No you don't understand! You either need to configure the proxy in each computer or you are out of luck. It does not matter if you use the proxy feature of Mikr...
by pe1chl
Sat Jun 12, 2021 5:29 pm
Forum: General
Topic: On IPsec tunnel termination, existing stream impacted [SOLVED]
Replies: 13
Views: 770

Re: On IPsec tunnel termination, existing stream impacted [SOLVED]

There is no way to troubleshoot that without configuration included. However, I would recommend you instead of using a direct IPsec tunnel, to use a GRE or IPIP tunnel with IPsec encryption between the two LAN networks. That will solve many problems, including the workarounds you need for NAT etc. J...
by pe1chl
Sat Jun 12, 2021 5:21 pm
Forum: General
Topic: Issue with DST-NAT (RouterOS 6.47.10)
Replies: 16
Views: 805

Re: Issue with DST-NAT (RouterOS 6.47.10)

This issue is not caused by the MikroTik dst-nat but by the HTTP protocol. It is simply not possible to make a proxy that way! When you fetch a HTTP page the browser splits the URL into its parts: http://site.com/path is split into site.com and /path The browser then does a DNS lookup for site.com, ...
by pe1chl
Sat Jun 12, 2021 12:38 pm
Forum: General
Topic: Suggestion: Ability to Create New Tables (like iptables) or at least group rules
Replies: 7
Views: 539

Re: Suggestion: Ability to Create New Tables (like iptables) or at least group rules

Remember it is named "jump" but it is actually "call" (for those who know about programming). So, indeed you can "return" to the place where the "jump" was done, and in fact this is what happens automatically when the jumped table just ends without a terminati...
by pe1chl
Sat Jun 12, 2021 12:30 pm
Forum: General
Topic: SFP auto disabled due to high temperature
Replies: 6
Views: 834

Re: SFP auto disabled due to high temperature

I would recommend (and MikroTik recommend this as well) to use some types of SFP only in devices that have an internal fan. There are some devices that do not come with a fan but have the possibility to install it (there already is a cut-out and connection point). This should force some air along th...
by pe1chl
Fri Jun 11, 2021 12:29 pm
Forum: General
Topic: Feature request: Force sending of DHCP options to clients
Replies: 47
Views: 14334

Re: Feature request: Force sending of DHCP options to clients

It is still my opinion that it is pretty lame that devices support some DHCP option but they do not put the option number in the request. That plainly is a bug in the device, the maintainer should fix that rather than rely on the DHCP server breaking the protocol and sending option values that weren...
by pe1chl
Thu Jun 10, 2021 8:50 pm
Forum: General
Topic: pppoe connection was already active closing previous one [SOLVED]
Replies: 22
Views: 17853

Re: pppoe connection was already active closing previous one [SOLVED]

Do you do NAT on the same box and do you have a "masquerade" rule for that? If so, replace it by a suitable "src-nat" rule.
by pe1chl
Tue Jun 08, 2021 3:03 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Thank you for your suggestion, we already have such system where the hAP lite upgraded successfully from 6.47.9 to 6.47.10, so it is not like all of the devices are affected not allowing us to spot the issue before releasing the version. I think further checking has to be done in that testcase. It ...
by pe1chl
Mon Jun 07, 2021 6:39 pm
Forum: General
Topic: DHCP Offering Lease Without Success
Replies: 83
Views: 52004

Re: DHCP Offering Lease Without Success

I had very rare occurrences of this problem on our guest WiFi network and I think they were only caused by clients with marginal signal. However, starting last friday there came more and more logs of this problem, all from Samsung client devices. On this network the MikroTik DHCP server had the &quo...
by pe1chl
Mon Jun 07, 2021 4:06 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Those messages are related to IPv6 on your local network. Unfortunately they do not include enough info to hunt down what device is causing them.
(there should be a MAC address or IPv6 address in those messages...)
by pe1chl
Mon Jun 07, 2021 4:04 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Well, the testing being done clearly is not sufficient, but it appears that in this case a requirement to reproduce it is: - install some version - upgrade to 6.47.9 - then upgrade to 6.47.10 Apparently such scenarios (which are common) are not tested. And with "netinstall 6.47.9, then upgrade ...
by pe1chl
Mon Jun 07, 2021 10:50 am
Forum: General
Topic: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]
Replies: 14
Views: 3213

Re: BUG? ssh with key from Mikrotik to Cisco switch - error:0D078079:lib(13):func(120):reason(121) [SOLVED]

Sometimes the key storage is corrupted and you have to re-generate and reload it.
by pe1chl
Mon Jun 07, 2021 10:17 am
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

After the update, the DHCP-Client stopped working. Problem with obtaining an address from the provider. Back at 6.47.9 Did you also try other things, like rebooting the 6.47.10 after some time? It may well be that it is not caused by a software change but just by a bad state on the network that got...
by pe1chl
Mon Jun 07, 2021 10:16 am
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

The typical problem situation I have come across is that when the bundle+tr069 package are uploaded, the disk is basically almost full - it shows either 15.9 MiB in use out of 16 MiB or 16.0 MiB in use out of 16 MiB. The ones that show 16.0 MiB in use out of 16.0 MiB typically fail to upgrade. Yes ...
by pe1chl
Sun Jun 06, 2021 11:25 am
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

Nope........ do not remove quick set. If u do not like it, just do not open it. As has been requested so many times, there should be some setting in the router to disable the QuickSet feature or at least make it read-only. So an administrator who has configured advanced features in the router can p...
by pe1chl
Sun Jun 06, 2021 11:21 am
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

10 replies, nothing regarding this version. forum done right.
That is not correct, in reply #7 I mentioned that an important bug is not fixed in this version, I am sure that helped at least two other forum members so they do not need to waste their time to install 3.28.
by pe1chl
Sun Jun 06, 2021 11:17 am
Forum: General
Topic: DoH corrupting DNS cache? DNS cache full with invalid data?
Replies: 26
Views: 4854

Re: DoH corrupting DNS cache? DNS cache full with invalid data?

Or simply forget about DoH...
by pe1chl
Sun Jun 06, 2021 11:16 am
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

No that is not at all true, please read back the previous replies and replies given in other topics about this issue. When you now have 7.9MB in use on a hAP mini, you are right on the edge of being able to update because during update twice the amount of space is required temporarily. Remember the ...
by pe1chl
Sat Jun 05, 2021 7:55 pm
Forum: General
Topic: CPU high utilization due to the Queue .CCR
Replies: 5
Views: 495

Re: CPU high utilization due to the Queue .CCR

That is right, and it would be advised to read about updating RouterOS, firmware, how to use partitions, backup of configuration (how/where), etc.
by pe1chl
Sat Jun 05, 2021 7:51 pm
Forum: Beginner Basics
Topic: Changes on the configuration - security
Replies: 11
Views: 819

Re: Changes on the configuration - security

Connection to WiFi (both preference of 5GHz/2.4GHZ and connecting to another device in the same network which has stronger signal) has to be configured in the client, or the client should have your desired behavior by default.

Older clients often prefer 2.4, newer often prefer 5 GHz.
by pe1chl
Sat Jun 05, 2021 7:48 pm
Forum: RouterBOARD hardware
Topic: RAID & Specs
Replies: 5
Views: 2494

Re: RAID & Specs

Install a VM host and use CHR.
by pe1chl
Sat Jun 05, 2021 7:47 pm
Forum: General
Topic: DELL R430 compatibility with MikroTik RouterOS x86?
Replies: 4
Views: 2107

Re: DELL R430 compatibility with MikroTik RouterOS x86?

Still the same answer. Install a VM host (e.g. VMware ESXi) and run CHR under that.
by pe1chl
Sat Jun 05, 2021 7:33 pm
Forum: General
Topic: CPU high utilization due to the Queue .CCR
Replies: 5
Views: 495

Re: CPU high utilization due to the Queue .CCR

Well your first issue of course is running ancient RouterOS in production. First fix that!
But likely it will not solve the other issue, that will require further research.
by pe1chl
Sat Jun 05, 2021 7:31 pm
Forum: Wireless Networking
Topic: Questions about TKIP
Replies: 10
Views: 1079

Re: Questions about TKIP

The solution can be cable Yes, that is of course not a generic solution that can be used in all cases, but if possible connect such broken printers using a cable. In an install at work where we have some external people renting space and bringing such crap with them, I also did that and in that cas...
by pe1chl
Sat Jun 05, 2021 6:42 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Mikrotik really should come up with a "lean bundle" NPK, without MPLS/Hotspot/Routing, that really have no place in SOHO. I fully agree! Also note that any space gained is effectively doubled as you need both the space for the installed version and the same space for the download of the n...
by pe1chl
Sat Jun 05, 2021 6:35 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

for our the training classes, i always give the students the hap lite router and i always remind them *DO NOT* load bundle package as most of the packages never be used on daily used; such as routing, mpls, hotspot, ipv6...... I could agree that "mpls, hotspot, ups..." are not the "d...
by pe1chl
Sat Jun 05, 2021 2:57 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

The V7 NPK still brings Hotspot, but Routing and MPLS are gone. Why not do the same for V6? In v7 some of the packages that were optional in v6 went into the main system package, so that only makes the problem worse for those SMIPS devices. I can understand that putting everything in one package ma...
by pe1chl
Sat Jun 05, 2021 11:46 am
Forum: SwOS
Topic: help me recover this old Rb250GS
Replies: 5
Views: 1148

Re: help me recover this old Rb250GS

I would guess the easiest is to use Linux. But although I once used a Rb260GS switch I have never tried what you are doing now, so I am not familiar with the details. I only see your loop of: DHCP: proposed address 10.0.0.2 [05/06 18:56:39.785] Rcvd BootP Msg for IP 0.0.0.0, Mac 00:00:00:00:00:01 [0...
by pe1chl
Sat Jun 05, 2021 10:59 am
Forum: General
Topic: Problems with updating firmware on smips devices
Replies: 5
Views: 559

Re: Problems with updating firmware on smips devices

Why doesn't the microtik this? This is what "netinstall" does, and it works. When you can use netinstall you do not have problems. The people that have problems with updating many devices are using these devices as customer routers, and they cannot use your method because they want to do ...
by pe1chl
Sat Jun 05, 2021 10:55 am
Forum: RouterBOARD hardware
Topic: Grounding of outdoor devices
Replies: 6
Views: 2671

Re: Grounding of outdoor devices

About 3-4 mm hole size. the screw is M3.
by pe1chl
Sat Jun 05, 2021 10:49 am
Forum: SwOS
Topic: help me recover this old Rb250GS
Replies: 5
Views: 1148

Re: help me recover this old Rb250GS

Maybe your DHCP server does not properly reply to BOOTP requests?
by pe1chl
Fri Jun 04, 2021 4:07 pm
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

Whilst we all love the flexibility of Mikrotik devices and can often stretch them in amazing, unintended ways, sometimes we need to take stock of the fact that some elements of the platform have their limits and it is better to deploy external, heavier duty solutions, where the specific context of ...
by pe1chl
Fri Jun 04, 2021 3:18 pm
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

Unfortunately the bug that occurs when holding down mousebutton on a window which is frequently updated, e.g. to change column width or to move a line up or down, is still present! It has been reported so many times already and I think it also was reproduced at MikroTik, please fix it. (back to vers...
by pe1chl
Fri Jun 04, 2021 3:09 pm
Forum: Announcements
Topic: WinBox v3.28 released!
Replies: 34
Views: 13829

Re: WinBox v3.28 released!

*) fixed WinBox disconnect when large text was pasted into terminal window; *) fixed problem where optional field disappeared if window was maximized; FINALLY... i can paste all 12000 lines of DNS entry (blocked for Italian law) instead to paste 3/400 lines per time I am still trying to get them to...
by pe1chl
Fri Jun 04, 2021 9:34 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

AFAIK ECMP depends on connection tracking (and NAT too here). While not privy to the internals, I assume ECMP the same as unweighted PCC. So yeah ECMP works better with both a greater number and diversity of connections with different IP/ports, & ideally shorter in length - stuff like dozens of...
by pe1chl
Thu Jun 03, 2021 9:27 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

How does that actually work? I presume you rely on the ECMP only for the first packet of each connection to be routed to a random external connection, and then the connection tracking (NAT table) will force all the other traffic out of the chosen interface? Otherwise it would only be useful for UDP ...
by pe1chl
Thu Jun 03, 2021 7:02 pm
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

I am not able to login to webfig on Firefox. Anyone else with the same problem? Yes, for some reason FFox becomes picky with some specific devices and doesn't log in anymore. With Chrome or FFox "Private Window" no problems. I can login with FFox in other same model devices. The problem i...
by pe1chl
Thu Jun 03, 2021 1:58 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

For now, just report the problem to MikroTik support so that they cannot claim "nobody ever reports problems with upgrades and in our testing it always goes well". Pointless. The anwser will be "Netinstall it". Of course. But they can no longer reply in the release thread that i...
by pe1chl
Thu Jun 03, 2021 12:42 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

In the vast majority of cases SMIPS upgrade problems are caused by RAM shortage and not flash shortage. The error message may be misleading, when it talks about disk space it is usually complaining about RAM drive. I think that is actually not true for those SMIPS devices that have both 16MB flash ...
by pe1chl
Thu Jun 03, 2021 12:35 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

If anyone can confirm that downgrade from 6.47.9 to 6.40 is safe, I can try it later this evening. I would not risk that, especially not for an upgrade from 6.47.9 to 6.47.10 It would be different when you were further behind on upgrades. For now, just report the problem to MikroTik support so that...
by pe1chl
Thu Jun 03, 2021 10:53 am
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Features like Graphing take up space on the disk without actually displaying as files. In previous cases I have had to disable Graphing so that the graph data is deleted in order to successfully upgrade 16MB flash devices. Also it is best to not enable the "store on disk" checkmark becaus...
by pe1chl
Wed Jun 02, 2021 6:32 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Required packages also don't fit (dhcp + ppp + security + system + wireless = 6.7 Mb). Did you try to first disable all packages you do not need in the installed combined package, and then reboot and try if you can upload only those packages? That could bring it just below the mark. Disabling packa...
by pe1chl
Wed Jun 02, 2021 5:51 pm
Forum: Announcements
Topic: v6.47.10 [long-term] is released!
Replies: 145
Views: 21172

Re: v6.47.10 [long-term] is released!

Sooo, hap lite no longer support upgrade, is that it?
It is more likely the often discussed problem with upgrade of these toy devices, you either need to netinstall or install separate packages (only those that you require).
Explained many times in release threads.
by pe1chl
Tue Jun 01, 2021 1:03 pm
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

Please provide us an example of how to reproduce such an issue with the DNS cache with the supout.rif file to support@mikrotik.com Thanks in advance. I created SUP-51076 with a 5-line config example. When you need a supout.rif file as well I can add it later tonight when I have access to that envir...
by pe1chl
Tue Jun 01, 2021 11:41 am
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

*) dns - fixed CNAME query when target record is not in cache; DNS resolver is further broken than before! When resolving a DNS name with ~425 addresses for an address list, nothing happens anymore. The address list remains empty and the DNS name does not appear in the cache tab of IP->DNS. In the ...
by pe1chl
Mon May 31, 2021 3:24 pm
Forum: Beginner Basics
Topic: Site to Site VPN [SOLVED]
Replies: 8
Views: 803

Re: Site to Site VPN [SOLVED]

It all depends on if you use IKEv1 of IKEv2, if you want to use separate keys for each peer, if you can live with L2TP over IPsec or not, and what method you want to use to route the traffic. So there are many variables. I use L2TP/IPsec with a single key for everyone, but a different username/passw...
by pe1chl
Mon May 31, 2021 10:30 am
Forum: Useful user articles
Topic: Which VPN protocol is best?
Replies: 28
Views: 15231

Re: Which VPN protocol is best?

OpenConnect would be a great addition to Mikrotik. Mikrotik should support all VPN protocols without regard to which network religion originally developed the VPN.
First it was OpenVPN. Then it was Wireguard. Now it is OpenConnect. You people will NEVER be satisfied with ANY VPN technology!!!
by pe1chl
Mon May 31, 2021 10:29 am
Forum: General
Topic: VLAN or port isolation?
Replies: 14
Views: 5568

Re: VLAN or port isolation?

Yes, it appears that things have changed after I originally wrote that. However, always be aware that some features on RouterOS are done in software and can only be enabled when the entire switch is done in software (bridge). I.e. once you enable them, all traffic passes through the CPU. That depend...
by pe1chl
Sun May 30, 2021 1:20 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

They have removed IP accounting. Fortunately I had migrated from IP accounting to netflow some time ago. I do not need an expensive netflow analyzer package, I just want to keep some logs, but I wanted to include port numbers. So I wrote a simple netflow receiver in perl using the Net::Flow package...
by pe1chl
Sun May 30, 2021 1:08 pm
Forum: General
Topic: warm spare: design question
Replies: 11
Views: 766

Re: warm spare: design question

Point 2. is currently only provided by the HA approach, again regardless the RouterOS version. As of writing this, I don't know any way to parse the configuration export row by row using RouterOS scripting and selectively update it on the other router(s) in the group. Hopefully in v7 there will be ...
by pe1chl
Sat May 29, 2021 8:39 pm
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

Screenshot in post #51 above shows winbox UI displaying "ms" as unit for that field. I confused reachable time and lifetime... still, a unit of seconds seems to be reasonable for this time. When it is set to its default (unspecified), the winbox UI displays s (seconds) as the unit. Appare...
by pe1chl
Sat May 29, 2021 12:09 pm
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

minor problem ipv6 nd reachable time (this also happen in previous version) Seems to me that it's (esthetic) problem of winbox ... on my 6.47.9 default setting is "unspecified" and if I try to set it to "30ms", I get [admin@router] /ipv6 nd> set 0 reachable-time=30ms Warning: va...
by pe1chl
Sat May 29, 2021 12:06 pm
Forum: Announcements
Topic: v6.48.3 [stable] is released!
Replies: 117
Views: 26069

Re: v6.48.3 [stable] is released!

I am not able to login to webfig on Firefox. Anyone else with the same problem?
Works fine here!
by pe1chl
Sat May 29, 2021 11:27 am
Forum: General
Topic: warm spare: design question
Replies: 11
Views: 766

Re: warm spare: design question

I think I read sometime that there are plans to cover this in version 7. But then, haven't we all read how version 7 would be heaven where all problems are solved? Anyway, it appears that Linux now supports a protocol to synchronize connection tracking state, and they are making it available in Rout...
by pe1chl
Fri May 28, 2021 11:26 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Having contributed to the Kernel before I would say the process works pretty well, as long as you are able to align your own development processes with it. I would argue MikroTik has about as much work with maintaining a fork of their own as it would have putting everything upstream. I don't mean w...
by pe1chl
Fri May 28, 2021 11:22 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

keep in mind that mikrotik doesn't have to 'port' a lot of things from v6, they have up-to-date mainline packages they can bring in and just 'port' the UI for it. ie, they aren't going to re-implement openvpn from v6.... they'll bring in mainline openvpn w/o having to do any weird stuff to it becau...
by pe1chl
Fri May 28, 2021 11:07 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

Although I don't know what their priorities are, one issue that i might see with where you place #1 is that to finish porting everything that is in v6 (meaning the various kernel modifications), they would lock themselves down to a particular kernel version. They might have to redo the modification...
by pe1chl
Fri May 28, 2021 11:02 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

In other words, the development takes time, and assigning more developers to the same task is not always effective and sometimes even counterproductive. For example, if we had moved developers from Wireguard or L3HW Offloading to aid in routing protocols development, would the latter be finished by...
by pe1chl
Fri May 28, 2021 12:14 am
Forum: RouterOS v7 BETA
Topic: v7.1beta6 [development] is released!
Replies: 341
Views: 48393

Re: v7.1beta6 [development] is released!

@raimondsp thanks for the info. Do you guys expect this by year end? (HW IPv6) That's the plan. Unless something utterly goes wrong. Well I do not determine the priorities and I do not know about that big customer that wanted hw acceleration, but I would (and I think I am not the only one) prefer t...
by pe1chl
Thu May 27, 2021 7:00 pm
Forum: RouterOS v7 BETA
Topic: Feature Request : IPv6 Fasttrack
Replies: 19
Views: 2495

Re: Feature Request : IPv6 Fasttrack

I’m starting a new WISP now and I’m shocked to learn that IPv6 fast track is not yes available. That seems nuts. I advise you to buy routers that can run your workload without fasttrack. IMHO fasttrack is more targeted towards home routers where the user wants to get the high bitrate of their moder...
by pe1chl
Wed May 26, 2021 8:30 pm
Forum: General
Topic: HEX PoE leds
Replies: 5
Views: 470

Re: HEX PoE leds

Use black adhesive tape (or even "metalized"), that works for all hardware that I tried it on (including my RB2011). Dos it work for the blue LED of RB4011 as well? Or does that one burn through adhesive tape? LOL Well the normal black adhesive tape shows a dark blue spot when taped over ...
by pe1chl
Tue May 25, 2021 8:51 pm
Forum: General
Topic: How to Access Mikrotik onboard TTL interface
Replies: 2
Views: 375

Re: How to Access Mikrotik onboard TTL interface

On the models that have the serial port available on the outside (as DB-9 or RJ-45) it still works, so it is a bit strange that it does not work on models that have only the TTL signals...
by pe1chl
Tue May 25, 2021 8:49 pm
Forum: General
Topic: HEX PoE leds
Replies: 5
Views: 470

Re: HEX PoE leds

Use black adhesive tape (or even "metalized"), that works for all hardware that I tried it on (including my RB2011).
by pe1chl
Tue May 25, 2021 8:47 pm
Forum: RouterOS v7 BETA
Topic: Feature Request : IPv6 Fasttrack
Replies: 19
Views: 2495

Re: Feature Request : IPv6 Fasttrack

I have no problem with IPv6 performance (Fasttrack is always the first thing I disable) but I think IPv6 deserves way more attention from MikroTik, the "our customers never ask for it" no longer cuts it. When that includes Fasttrack development for some people, I welcome it to be included ...
by pe1chl
Sun May 23, 2021 1:01 pm
Forum: Beginner Basics
Topic: do you let 1U between routers and switches? [SOLVED]
Replies: 7
Views: 1269

Re: do you let 1U between routers and switches? [SOLVED]

Ok and when you have passive cooled devices (I did not check exactly which devices are passive cooled) from MikroTik there usually is the option to mount a small fan in the rackmounted version, even when it is not fitted from factory. That should help a lot.
by pe1chl
Thu May 20, 2021 11:23 am
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

Could you please merge the standard NTP client code with the NTP server package code so that both support using DNS FQDN's for the source. This has been resolved in the version 7 beta so I guess you will have to wait until that becomes the stable version. It also allows more NTP servers and the ser...
by pe1chl
Tue May 18, 2021 11:13 am
Forum: RouterBOARD hardware
Topic: RB4011
Replies: 385
Views: 134409

Re: RB4011

There have apparently been some software fixes since then to fix the compatibility with certain modules, but it still is not advisable to use them in the fanless routers like the RB4011. SFP modules often run quite hot and the airflow created by the case fan really is required to keep them from over...
by pe1chl
Mon May 17, 2021 10:18 am
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

Ok I only have CCR1009 and I do not bridge all ethernets together. However, I routinely use bridges for each interface (like 6 or 8 bridges in total) so I can tie all configuration to a bridge named with the network (purpose)name, and then have a single ethernet port in that bridge for the connectio...
by pe1chl
Sun May 16, 2021 12:24 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta5 [development] is released!
Replies: 293
Views: 47572

Re: v7.1beta5 [development] is released!

The default masquerade rule should have "interface list" WAN and the WAN interface should be member of that interface list.
Probably you are familiar with old defaults where the masquerade rule has an explicit interface and that has been changed some time ago.
by pe1chl
Sat May 15, 2021 11:31 am
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

Under what scenarios does this performance degradation occur, and how badly is the performance degraded? We were supposed to upgrade our TILE devices to the latest long term and I'm trying to figure out if we need to go to an older long term or hold off for now. I am running two CCRs with 6.47.7 an...
by pe1chl
Fri May 14, 2021 4:28 pm
Forum: Announcements
Topic: v6.49beta [testing] is released!
Replies: 169
Views: 43653

Re: v6.49beta [testing] is released!

When you use beta versions you have to read the text in the start post: Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; So you have a backup of the (beta or stable) version you were running before you got problems (that is before ...
by pe1chl
Fri May 14, 2021 1:57 pm
Forum: Announcements
Topic: v6.48.2 [stable] is released!
Replies: 154
Views: 30429

Re: v6.48.2 [stable] is released!

It's what _in short_ I say ;) Actual standards is 2000 max MTU + VLAN TAGS, original standard is 1500 + VLAN TAGS Actually on Gigabit ethernet the "jumbo frame" standard is often supported and the max MTU is 9000. That is to allow significantly larger frames and improve throughput, althou...
by pe1chl
Fri May 14, 2021 11:46 am
Forum: Announcements
Topic: v6.48.2 [stable] is released!
Replies: 154
Views: 30429

Re: v6.48.2 [stable] is released!

Because on CRS109-8G-1S-2HnD-IN mtu can be set to 4064 and the think is: bigger the MTU, bigger the speed... That is actually correct, but of course it will only work when you can increase the MTU over the entire path between systems. So in practice it is only useful to do this in a local network b...
by pe1chl
Thu May 13, 2021 12:00 pm
Forum: Beginner Basics
Topic: How to disable firewall completely
Replies: 11
Views: 1221

Re: How to disable firewall completely

You can delete all rules except some "automatically created rules for tracking" but when you delete all others and then reboot the router, those automatic ones are gone as well.
by pe1chl
Tue May 11, 2021 12:05 pm
Forum: Wireless Networking
Topic: Wireless Wire Cube and Wireless Wire connect to each other?
Replies: 3
Views: 671

Re: Wireless Wire Cube and Wireless Wire connect to each other?

Well that isn't necessarily enough. You need to check the license for the devices you are using, because some devices can only make 1 connection at the time and so they cannot be used as an inbetween on a link, unless you upgrade the license. Of course when you are a MikroTik fan you may have visite...
by pe1chl
Tue May 11, 2021 12:00 pm
Forum: General
Topic: Mikrotik VPN server behind ISP router
Replies: 12
Views: 6926

Re: Mikrotik VPN server behind ISP router

As mentioned above, it is quite doable to make a VPN from a customer router that is behind all kinds of NAT, but it is not really easy to do the same thing with the "central server". So either get a more professional connection for just that server (where you can have your external IP on t...
by pe1chl
Tue May 11, 2021 12:37 am
Forum: General
Topic: L2TP IPSEC site to site behind NAT [SOLVED]
Replies: 17
Views: 2093

Re: L2TP IPSEC site to site behind NAT [SOLVED]

In my experience, to make double-NAT (and other obscure NAT situations) working you need to relax the checking of port numbers in IPsec. Assuming that you have made the L2TP server with default IPsec settings, note down what entries it has created under IP->IPsec for that, then remove the IPsec from...
by pe1chl
Mon May 10, 2021 12:35 pm
Forum: General
Topic: Block domains using wildcard [SOLVED]
Replies: 9
Views: 1019

Re: Block domains using wildcard [SOLVED]

In the example that Normis gave, the new rule for BLOCKLIST in the forward firewall has to be moved to the top of the forward rules. When it is below the "accept established/related" rule it will not work. I advise you to keep the forward rules together, so move the two forward rules that ...
by pe1chl
Mon May 10, 2021 12:30 pm
Forum: Beginner Basics
Topic: How to disable firewall completely
Replies: 11
Views: 1221

Re: How to disable firewall completely

Just delete all the rules in the firewall filter and you will have no firewall.
by pe1chl
Sat May 08, 2021 9:11 pm
Forum: Beginner Basics
Topic: do you let 1U between routers and switches? [SOLVED]
Replies: 7
Views: 1269

Re: do you let 1U between routers and switches? [SOLVED]

There is almost no heat transfer through the top- and bottom plate, so for heat it will not make much of a difference. The heat should be transferred out of the units by airflow through front and back. You can leave the space when you have it, e.g. using cable organizers or other panels (like the RJ...
by pe1chl
Sat May 08, 2021 9:06 pm
Forum: Beginner Basics
Topic: TCP connection established from XXX vpn
Replies: 1
Views: 439

Re: TCP connection established from XXX vpn

Use something else than PPTP. E.g. SSTP, L2TP/IPsec, OpenVPN, etc.
PPTP is a bit tricky to get going when NAT is involved, and it is not very secure anyway.
To make it working you need to open the GRE protocol as well, as PPTP uses that.
by pe1chl
Sat May 08, 2021 9:04 pm
Forum: General
Topic: WeBfig as default page in the management page [SOLVED]
Replies: 3
Views: 563

Re: WeBfig as default page in the management page [SOLVED]

In WebFig you can make a "skin" that removes certain parts of the configuration interface. Quite interesting mechanism in fact, unfortunately it does not work in WinBox. However, I think that "Quick Start" should be made a separate package or selectable feature that can be disabl...
by pe1chl
Sat May 08, 2021 1:38 pm
Forum: RouterOS v7 BETA
Topic: v7.1beta5 [development] is released!
Replies: 293
Views: 47572

Re: v7.1beta5 [development] is released!

The problem is that those default routers only exist in the RouterOS for the consumer-oriented routers.
When you have e.g. CCR or CHR the default configuration is much much smaller and does not include things like firewall settings.
by pe1chl
Fri May 07, 2021 4:31 pm
Forum: General
Topic: Decrease in software quality from mikrotik?
Replies: 16
Views: 1698

Re: Decrease in software quality from mikrotik?

WiFi OTOH is technical problem and technically it would be failry easy to use 6GHz band instead of 5.5GHz. Unfortunately 6GHz is assigned to licensed fixed point-to-point networks here (in Europe). While one can argue that this usage is outdated and mostly replaced or replaceable by fiber links, th...
by pe1chl
Fri May 07, 2021 2:19 pm
Forum: General
Topic: Decrease in software quality from mikrotik?
Replies: 16
Views: 1698

Re: Decrease in software quality from mikrotik?

Yes, that is of course the reason for DFS! The authorities and radar operators do not care if our WiFi network would be disturbed by radar pulses (and thus suggest us to go somewhere else)... what they care about is that we evacuate the frequency to avoid such disturbance of the operation of the rad...
by pe1chl
Fri May 07, 2021 1:10 pm
Forum: General
Topic: Decrease in software quality from mikrotik?
Replies: 16
Views: 1698

Re: Decrease in software quality from mikrotik?

@mkx yes you are right, the receiver front-ends of WiFi APs are really sh*t. Another issue is that we receive RADAR all over the band at an access point placed at 220m height in a radio transmitter tower, located about 20km from a weather radar. It does not matter what channel is used, DFS detects r...
by pe1chl
Fri May 07, 2021 11:25 am
Forum: General
Topic: Decrease in software quality from mikrotik?
Replies: 16
Views: 1698

Re: Decrease in software quality from mikrotik?

Apparently regulators did not understand the reason for having certain frequencies reserved for special purposes and allowed incompetent manufacturers to pollute the spectrum with shitty RF transmitters. That surprises me too. How could anyone think that co-existence of an unlicensed transmitter sy...
by pe1chl
Thu May 06, 2021 4:08 pm
Forum: Announcements
Topic: v6.48.2 [stable] is released!
Replies: 154
Views: 30429

Re: v6.48.2 [stable] is released!

The issue is likely that they made many patches that are not "to support some hardware" but to introduce specific features. What we see now in v7 is that things that were enabled by kernel patch do not yet work or came only in later betas (apparently someone migrated the patch). And some o...
by pe1chl
Thu May 06, 2021 3:23 pm
Forum: General
Topic: Decrease in software quality from mikrotik?
Replies: 16
Views: 1698

Re: Decrease in software quality from mikrotik?

Yes it indeed is a common problem. It must be due to letters from the regulators to increase the DFS sensitivity. It affects different manufacturers. Apparently the regulators and manufacturers don't understand that making the system unworkable will only result in users running ancient software or e...
by pe1chl
Wed May 05, 2021 11:23 am
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

Try to remove the check mark for BSD Syslog format and see if it changes. I do log to Splunk directly, but I have tested it with rsyslog server and it works there as well. Well, when I do not set BSD Syslog I cannot set Syslog Facility. That is required because I use that to direct the logs on the ...
by pe1chl
Wed May 05, 2021 11:16 am
Forum: General
Topic: Assign static IP's from ARP not DHCP Leases to stop MAC Clonning
Replies: 7
Views: 804

Re: Assign static IP's from ARP not DHCP Leases

Solutions exist, 802.1x (dot1x) and PPPoE. With a capable RADIUS server of course (freeradius, maybe RouterOS v7 usermanager). My setup doesn't require user authentication (user/pass) That is where you go wrong! You say you have a problem with people stealing your internet, yet you do not require y...
by pe1chl
Tue May 04, 2021 4:47 pm
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

Can you post an example on how it looks like and how you would like it to be. When I look in the logging that my BSD syslog server writes to disk I see: May 2 10:43:20 MikroTik Connection closed When I look in the Log viewer in Winbox I see: May/02/2021 10:43:20 | route, bgp, info | Connection clos...
by pe1chl
Tue May 04, 2021 12:14 pm
Forum: General
Topic: How to do Policy mapping in Mikrotik
Replies: 1
Views: 337

Re: How to do Policy mapping in Mikrotik

You can do similar things in the /queue tree menu. See the wiki: https://wiki.mikrotik.com/wiki/Manual:Queue#Queue_Tree Of course there are many more capabilities than this simple config that is shown in the Cisco example. You should be able to mimic that with something simple like: /queue tree add ...
by pe1chl
Tue May 04, 2021 11:01 am
Forum: General
Topic: Feature requests
Replies: 1374
Views: 343712

Re: Feature requests

That is fixed text. I want to see the topics that are visible when logging in memory. These differ per message. E.g. [system,info,account] or [ipsec,error] See my post here from 2017. MT has not fixed anything of this yet. https://forum.mikrotik.com/viewtopic.php?t=124291 Support has only sad that ...
by pe1chl
Mon May 03, 2021 8:12 pm
Forum: General
Topic: Assign static IP's from ARP not DHCP Leases to stop MAC Clonning
Replies: 7
Views: 804

Re: Assign static IP's from ARP not DHCP Leases

so there's no way to achieve the thing i asked for, on such a powerful system like MikroTik, that's sad .. like over 15+ years there's no Fix for MAC-Clonning/Spoofing on Hotspot. This is not related to MikroTik, it is just a property of using MAC as identifier and users that are not cooperative. S...
  • 1
  • 2
  • 3
  • 4
  • 5
  • 26