MikroTik

blajah

Please post your config and we should be able to help you.

blajah

Hello, We are looking to configure one of our CCR's as LNS as hot standby for our ASR. As i have seen in release notes, it is officially supported in ROS. I have seen couple of examples but noone posted working config. Does anyone have this in production? There are no official examples on wiki. I wo...

blajah

That was solution. I was on stable branch. THX!

blajah

Hello, Can anyone help me with information about WAP LTE kit information/setup? If i configure it in routed mode, i get ip /32 ( 10.0.0.1 ) and its OK. But if i configure it as passthrough and set DHCP client on HEX it does get same IP but with /30 subnet mask and default route to .2. I have another...

blajah

Beside MTU/MSS there is not much to configure. Its unclear why would you get slow dial time while directly connected to router. Only option is "PADO delay" inside PPPoE server if you have set by accident.
Connect PC again and torch that interface. Then post what you got.

blajah

Hi, just rearrange rules: /ip firewall nat add action=dst-nat chain=dstnat dst-port=80 in-interface=ether1-gateway log=yes protocol=tcp to-addresses=192.168.88.88 to-ports=5809 add action=dst-nat chain=dstnat dst-port=1157 in-interface=ether1-gateway log=yes protocol=tcp to-addresses=192.168.88.88 t...

blajah

Ahh, you need to specify source IP when using tunnels. ( so it triggers cryptomap).

blajah

I got it form your first post. Like i said, it could be some broadcast limit. And for reconnection, maybe you have old sessions still up?

blajah

In that case you should not have any issue. Export config from yout router, post it here. We will help.

blajah

Do you NAT on client router?

blajah

Sniff traffic with wireshark or enable PPPoE debug on client side, I assume there is some broadcast issue. PADI is sent to L2 broadcast address, and maybe it gets dropped somewhere on your router on stick configuration. Broadcast storm control ?

blajah

This method does not affect HTTPS traffic. You can try different approach. Intercept and forbid DNS requests containing skype as keyword. They are not encrypted.

blajah

Check interface statistics ( uptime, errors, last downtime, duplex ). Also, it could be issue with routing, but we cannot help wthout topology or configuration.

blajah

If you have S2S tunnel, i doubt you need any additional routes. Router should see theese networks as directly connected. If you are experiencing performance issues, first thing that comes to my mind is MTU, but could be a NAT also. Can you draw a simple diagram of your topology, so we could help?

blajah

Of course,
here it is.

blajah

Hi, can you please start writing without all bold posts? All your posts are bold without any reason. Also, 70% of your questions are answered here on forum as well as on wiki.

blajah

We need configuration so we can help. Blind guess is like you assumed - NAT, but there could be also a lot of other things.

blajah

I can confirm it works as expected. Can you provide export of config or even diagram of what you are trying to achieve?

blajah

Exclude traffic from fast-track.

blajah

Well, downside of masquerading is you have no any log which host form Mikrotik side accessed services. Masquerade rule should be like this: Source IP mikrotik LAN subnet Destination IP Bintec subnet Action masquerade Outgoing interface PPTP_interface Place this rule above your default masquerade and...

blajah

Maybe best would be to ask your ISP to place modem in bridge mode?
In that case you would get public IP on MT, so simple metric can do the job.

blajah

Add static arp entries and prohibit unwanted requests using local-proxy-arp.

blajah

Do you have default deny rule in input chain? What is in your connection tracking table? Sources you added to address list, you can drop in RAW firewall.

blajah

Like CZFan said, you need reverse route ( in any way you preffer to achieve it - on server directly or on router ) and if both subnets know about each other then you do not need a masquerade. In your expample with windows PC, after getting PPTP up, PC is getting IP on virtual adapter and your Bintec...

blajah

Thanks alot.

blajah

Hello all,
I'm getting bit confused about firewall action in subject. After packet is matched with rule criteria, is that packet passed further in firewall or it is not matched against any other rule?

blajah

Firstly you need to know how ISP will provide you with ip address. Is it PPPoE, DHCP, L2TP.... After that we will help you without any problem.

blajah

Hi,

It mainly depends on your topology. Will you use router + couple AP's or combo devices ( like 951 or HAP AC). Go for capsman setup + hotspot and you will be good to go.

blajah

Do you have default route on your MT router?

blajah

Guess not

blajah

Hi,
try latest RC
"*bridge - fixed multicast forwarding (introduced in v6.40rc36);"

blajah

Actually,
way better is to read this:
https://wiki.mikrotik.com/wiki/Policy_Base_Routing

blajah

Is that a windows pc? Try setting network to home if it's not.

blajah

It's this rule

add action=drop chain=forward comment=" Drop all else forward requests!"

Allow icmp in forward chain without more matchers. Just rule
add action=accept chain=forward protocol=icmp

blajah

I think only with some scripting.

blajah

You're right, i wasn't thinking enough

blajah

I just saw, you need to accept ISP's DNS servers in input. You are currently allowing DNS requests only for LAN.

blajah

Ok, one more thing you can try is to use RAW firewall, matching src/dst addresses with no-track action. This would skip connection tracker.

blajah

This means that traffic is hitting rule correctly, but probably host is droping it.

blajah

You can test ports via numerous methods (yougetsignal, portforward as websites, and nmap/zenmap as applications) Regarding your OS, whats your network described as? Public, work or private? Sometimes, you need to set ports in windows firewall also, even if it says its disabled. I had couple of issue...

blajah

Try to disable SIP helper in

/ip firewall service-port

blajah

Consider using port-konocking. No overhead nor increase in CPU usage.

blajah

Show us routing tables on both sides. I assume your routers do not know where are remote neworks, so they are sending traffic via default routes.

blajah

I just have tested it on one side ( latest rOs RC ) and it saves fqdn in remote address field. You should be good to go.

blajah

@idlemind, I know this, and this way is the simplest way if a packet is fragmenting. Thanks, this is clear but I remember seing on older versions of RouterOS an MTU of 1508 on PPPoE and going to dig this up and test if the displayed 1508 was only cosmetical or a real value. Check this out https://w...

blajah

Hello, No, you do not need to bridge VLAN interface and PPPoE client, because PPPoE client is "living" inside VLAN. Can you enable PPPoE debug and show us what gets logged? Also, if you do PPPoE scan from VLAN 100 interface, do you see any PPPoE server/BNG/BRASS/RADIUS/WhateverYourISPIsUsing

blajah

If you create PPPoE client on router, you would see that default value isn't 1460 or 1480, its auto. Why such a big deal? Auto would work even better then fixed value, and assuming you are leaving it @ default value, you do not care about it ( you do not have any specific requirement setting it thi...

blajah

If you create PPPoE client on router, you would see that default value isn't 1460 or 1480, its auto. Why such a big deal? Auto would work even better then fixed value, and assuming you are leaving it @ default value, you do not care about it ( you do not have any specific requirement setting it this...

blajah

HI,
If you have a Mikrotiks on both sides easiest way is to configure EoIP tunnel.

blajah

Thanks alot!

blajah

Please post export of ip fire nat

blajah

Order of firewall rules makes sense only when you are looking in ruleset of specific chain. If you are mixing chain order with global order its bit hard for us to help you. Your default deny rule should be last observing ruleset for INPUT chain. Easiest way to filter rules is via winbox. In right co...

blajah

C'mon guys,

Someone must know something about this

blajah

I have installed it on an old RB750 I use for some test. It shows: Firmware type: ar7240 Factory firmware: 3.02 Current firmware: 3.33 Update firmware: I.e. there is nothing after upgrade firmware and the upgrade button does nothing (no log entry). Edit: I installed 6.40.5, upgraded the firmware to...

blajah

Mangle rules are depending on your rOS version

rOS 6.39
!) ppp - implemented internal algorithm for "change-mss", no mangle rules necessary;

rOS 6.39.2
*) ppp - fixed "change-mss" functionality (introduced in 6.39);

You should be OK without any additional settings

blajah

Illogical ? Forward the Voip traffic to a group of phones: how do you make that ? Why would you do that? VOIP phones register and make their own connection, they do not need un-needed VOIP traffic sending to them. Whoa, i was questioning myself this same question, but actually you wrote it. I thoug...

blajah

Well, there are 2 ways to achieve your goal. If you are keeping bridge interface on your CAP devices, you should use "Local forwarding" option in datapath configuration. If you do not want to keep bridge interface on CAP's, ( its called manager forwarding ) your CAP's need lets say only IP...

blajah

VLANS ( tags) are included in L2MTU so this part is OK. Regarding PPPoE, from 1500 you take out 8 Bytes because all traffic is "wraped" in PPPoE. This leaves you with 1492 MTU for rest overhead + data. Only thing you should consider is MSS change to 1452 ( MTU - 40Bytes ( 20Bytes of IP and...

blajah

What happends if you specify source IP ? It works, i suppose.

Just little hint, torch traffic from router A when you are trying to ping host B, and look in source IP field.

blajah

Hi, First you should hide your IP addresses in your original post. Next, you should check IP->Services, just to make sure there is nothing changed. Your firewall rule is accepting (matching ) some traffic. One additional note, i guess you are not trying to open WebFig from LAN side, just pointing yo...

blajah

Hi, just playing with one of my test devices ( RB750G, ROS 6.41rc52 ) i have found that there is some DSL interface with basic commands : /interface dsl> set arp comment l2mtu mtu vci numbers arp-timeout disabled mac-address name vpi Have i missed this in some release-notes or forum topic? I have go...

blajah

Well, i doubt its issue on MT side. I do not have a way to test whats with DDWRT settings, but can you point ( just for testing purposes) DNS servers of DDWRT to mikrotik and then test resolving,
Do you have some DNS Proxy on DDWRT or some catch-all-DNS firewall rule, or some similar mechanism?

blajah

For me the more important question about boot firmware is: Will the firmware version change with every RouterOS release even if no changes are made? Suppose you installed RouterOS 6.41, then upgraded firmware to 6.41. RouterOS 6.41.1 ships with no changes to the firmware. Is the available firmware ...

blajah

By default DNS uses UDP/53 not TCP. Does your firewall allows DNS queries from outside? Actually it does, if it works on WIN10. There must be issue with DDWRT setup, Hows your OVPNs IP Network described? Do you have DNS Servers in PPP Profile?

blajah

Acutally i do not agree. There is no logic in this request if we are talking about unicast. In Anycast it would make sense. Like, @Steveocee explained, in common scenarios it is useless to have such option, but a lot of routers are used in more complex environment, and still we all have the same fea...

blajah

Its explained in ConTrack settings :) /ip firewall connection tracking> pri enabled: yes tcp-syn-sent-timeout: 5s tcp-syn-received-timeout: 5s tcp-established-timeout: 1d tcp-fin-wait-timeout: 10s tcp-close-wait-timeout: 10s tcp-last-ack-timeout: 10s tcp-time-wait-timeout: 10s tcp-close-timeout: 10s...

blajah

Hi, You do not need VLANs if you do not have reason to use them. Easiest way to accomplish this is to use Eth1 for ISP1, Eth2 for ISP2, eth 3 for 1st LAN subnet ( connection to 1st switch) and Eth4 for 2nd LAN subnet. At this point you have a just phisically connected network segments, and now you w...

blajah

Hi,

Try to resize MSS ( clamp) if you have MTU smaller then 1500.

blajah

Well, just in case, can you ping internet IP's with your LAN IP as source IP?

blajah

Hi, Besides what evince said, you have not told us how you are sending traffic between router and switch. Is VLAN 1 untagged ( native) or tagged on trunk port on both sides? What's configured on EdgeSwitch part? Are VLANs created under correct interface on MT side? Pretty much if you want VLAN 1 to ...

blajah

Hi,
post cidr's of both networks.

blajah

Hi,
If i recall correctly, Hickvision cloud is hosted on amazon. Can you specify what are you trying to accomplish?

blajah

Can you telnet to ftp server from host on your lan?(using port 21)

blajah

I'm not getting why such heat about this "issue". From my point of view DoS and DDoS attacks are mainly directed, and if you do not have dedicated appliance for mitigation, any router based firewall is simply work-around. Even in work around context, creating dynamic firewall matchers, you...

blajah

try to disable dhcp client on ether1, and also post status of ppp-out1 interface, just to see IP you are getting from carrier. Post default route/routes. If you can ping from router itself, can you ping something with source address of your lan? Can you post traceroute from router and PC?

blajah

Hi,
IP->route->print
there you can see where default route points to !

blajah

Hi, 1. "I want to use the Ethernet bonding feature on RouterOS to bond as many DSL connections as possible" - only possible if your ISP's are willing to do so. If no, you can use load-balancing in your favor 2. "Then, I want to configure a PPPoE service on the main router. However, I ...

blajah

Hello,

Why are you trunking ports if you are passing only VLAN 100?

blajah

Tnx for quick fix. Confirming PPPoE is working as expected.

blajah

Confirming PPPoE went down on RC40. Cannot test torch trick atm.

blajah

Whats your DHCP config? Is it authoritative ?

blajah

Actually it's not so big issue. I have blocked ranges announced by FB ASN and from my side there is no way to open FB: 0 fb 204.15.20.0/22 feb/27/2017 12:18:41 1 fb 69.63.176.0/20 feb/27/2017 12:18:41 2 fb 173.252.64.0/18 feb/27/2017 12:18:41 3 fb 31.13.64.0/19 feb/27/2017 12:18:41 4 fb 31.13.96.0/2...

blajah

Hello,

take look at this:
https://wiki.mikrotik.com/wiki/Advanced ... _Scripting
It should give you idea.

blajah

Regarding websites, have you tried to create access list and add url's then drop that access list ( ROS will resolve url's to IP's ) ? Its relative new feature in firewall.

blajah

Can you ping respective interfaces IP addresses from servers - 10.15.x.1?

blajah

Was your PC connected via cable to any of unaccessible AP's?

There could be issue with firewall/filter.
Also, is there any routing protocol involved in your setup? CAPsMAN? Its hard to blind guess issue without posting your config.

blajah

Hi,

i think you can use check-gateway option in existing static route. That would resolve your issue.

blajah

Looks like you need this:
http://wiki.mikrotik.com/wiki/Manual:API

blajah

Not 100% sure, but if i recall correctly on PPPoE interface, if you set up MTU, then router sets by itself MSS rule and it has Dynamic flag.

blajah

Yeah, only on port 53, mainly UDP, but if data is bigger then 512 bytes, then it switches to TCP.

blajah

Maybe this will help: Wiki says: Configure the port which connects switch-chip with CPU, set "vlan-header=leave-as-is" because management traffic already should be tagged and Since the master-port receives all the traffic coming from switch-cpu port, VLAN has to be configured on master-por...

blajah

Well, i'm not sure what do you mean by "my dns changes"? Is your ISP changing IP's of DNS or there is something else? Securing your DNS ( disabling DNS amplification attacks from your router) can be done by various methods, but maybe easiest to maintain is to create access list with IP's o...

blajah · Re: VLAN and IP Management Is cpu port member of VLAN50 on 10.23.3.242?

Is cpu port member of VLAN50 on 10.23.3.242?

blajah

If i do not specify ports in the rule does it just apply to all ports? Yes What is phase 1, 2 and 3 services? Just names of access lists who are created by firewall rules. You can change names whatever you like. One more note, as you see there are no DNS rules involved in this rule-set. You need to...

blajah

Hi,

read this, it would be good start

http://wiki.mikrotik.com/wiki/Per-Traff ... _Balancing

blajah

Well, if you are allowing mgmt from specific pool of ip addresses there is no need to create access list , you can do it directly via firewall rule. It is easier to read if you have access list but at the end its up to you. /ip firewall address-list add list=management-servers address=192.168.0.0[b]...

blajah

Hi, one additional note. This ( what VAN said) will only work if you have SIP helper enabled.
ip-firewall-service ports

blajah

Hi,

What are you trying to accomplish?

blajah

Hi guys,

is there any information about LACP/802.11ad support for CRS series? I know its not currently supported by switch chip, but this is one really nice feature to have. I do not ask for date or anything, just is this in developing process or it's waiting for better times to come?

blajah

HI, you can try this way: *Create access list containing 2 website URL's you want to allow. ip firewall address-list add address=xyz.com list=client_allowed add address=zyx.com list=client_allowed ip firewall filter add action=accept chain=forward comment="" src-address=192.168.2.33 dst-ad...

blajah

Hi,

2nd question is easy. Just block IP addresses from guest VLAN to input chain.
Regarding your first question, try to move rule #6 to bottom. Also, if that does not work, try to allow port 50022 in input.

blajah

I think its issue with route itself ( interface as gateway but no IP from same subnet on interface or masquerade rule). In this case you can take a different approach. If your interface ( ether2-Cable) gets public IP address from your ISP, you need to set private IP from same pool (192.168.100.0/24)...

blajah

Hi,

Your router should route 2 networks happily, that's why is called router. If you do not have any firewall rules blocking this traffic, it should work out of box. Post your config for deeper look.

blajah

Thats pretty much impossible. Can you run some WiFi scanner just to get BSSID and AP MAC so you can be sure its your device? I'm saying this because i use similar script @home and when it turns WiFi off it really goes off. InSSIDer ( windows) or WiFite on linux.

blajah

You should try NAT-T or read relevant issue here

http://forum.mikrotik.com/viewtopic.php?t=36676

blajah

Well,

Because of default deny you need to accept mentioned ports in input chain, and place them above default deny.

blajah

Are you accepting connections to these ports on WAN interface on mikrotik?
Hows your firewall configured?

blajah

You are right. Bridge should be used for this.

I'm not sure what are you referring to in 2nd question.

blajah

HI, i think this is the issue: add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=10000-20000 protocol=tcp to-addresses=192.168.62.87 to-ports=10000-20000 add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=10000-20000 protocol=udp to-addresses=192.168.62.87 to-ports=100...

blajah

Yes it is possible with 2 rules. One for TCP and one for UDP. chain=dstnat action=dst-nat to-addresses=x.x.x.x to-ports=8220-8335 protocol=udp in-interface=WAN_Interface dst-port=8220-8335 log=no log-prefix="" chain=dstnat action=dst-nat to-addresses=x.x.x.x to-ports=8220-8335 protocol=tcp...

blajah

You should nat 1701, 4500 and 500 UDP, form Billion to MT.

blajah

Lets try this way. All interfaces you plan to use as ports for servers, should be configured as access ports on switch. Hosts on these ports should be able to talk to WAN GW without issues. In 2nd scenario, you need to put private IP to interface, masquerade private traffic to selected public IP, an...

blajah

You can switch modem to bridge ( i just checked in manual for that modem). Path is : Configuration, WAN port - protocol "Pure Bridge". But anyway you need username/pass combo to setup PPPoE client ( assuming your ISP is authenticating you this way). This you can get from your ISP. As for p...

blajah

Like Jarda has said, if you want to get answers, you need to explain what do you have :
*equipment
*configurations
*goal you are trying to reach

Imagine this:
I have problem with my car. I want to drive. Can you help me?

blajah

You are NAT-ing traffic twice. So or you wanna DMZ your Mikrotik or forward ports for VPN to Mikrotik. First solution is easier to configure, 2nd depends on protocol you gonna use. If you do not have any other hosts connected to modem, you can use DMZ form modem to MT, or even reconfigure modem to b...

blajah

Hello,

Is there any way we can get a additional parameter for export which would mask IP addresses. Something like hide-sensitive hide-ip? Auto-masking first 2 octets would be enough. This would allow users to show config without manually editing IP's. ( it would uniform help requests).

blajah

OK, just lets start with your current config. Paste it here, and hide sensitive.

blajah

Does the first method works?

blajah

OK, so your WAN port is configured with 1.1.1.3/24. Default route is pointing to 1.1.1.1/24. Its clear now. Do you want to expose server/s to internet completely ( like assign a address from your pool - 1.1.1.37) or you want to 1to1 NAT public IP's to servers sitting on private pool? Its not complic...

blajah

Sooo,

lets start with your config.
How's WAN configured? How's your public block routed to you? Where is 1.1.1.1 address (interface)? Just share a bit of your config and it will get much more answers in decent timeframe.

blajah

You're welcome.

blajah

Take it nice and slowly. As for masquerade you need this: chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix="" This is all you need. If you have disabled NAT rules it's expected you do not see traffic coming in, because your router does not have a clue what to do with t...

blajah

Whoa :) Well, there can be couple issues. In first place try to change dst-nat rules so it does not contain source IP but interface as criteria, and action should be dst-nat: Your rule #1 chain=dstnat action=dst-nat to-addresses=192.168.201.101 to-ports=5094-5095 dscp=46 in-interface=Your_WAN_interf...

blajah

This looks ok so far. Next time when outage occurs, try to disable enable DHCP client or renew IP. ip dhcp-client renew Looks like issue with DHCP lease. You can also try with script like :if ( [/ping 8.8.8.8 interface=wan count=5 ] = 0 ) do={/ip dhcp-client renew wan} Set it in scheduler to execute...

blajah

I have a PBX behind my RB2011 and it is running SIP trunks. I am having 1 way audio issues (inbound from carrier being blocked). I cannot seem to get the setup correct in IP/Firewall/NAT for this. Here's what I need in a basic description: -UDP ports 10020 through 10531 need to come inbound from th...

blajah

If i got correctly, you can not ping WAN GW? That's issue with A: connection to ISP or B: with config of WAN interface So, can you post relevant config ( just wan side) ? Your assumption is right. Its not FW issue, its WAN side related. It's our goal to find out why there are outages on WAN side.

blajah

Yes it can work, but only what we do not know is whats the termination form your ISP ( what do you mean by ONT) . Is there Media Converter with eth port, or there is terminal like Huawei's HG8245. In 2nd case it depends hows the ONT configured ( routed or bridge mode).

blajah

Hi, OK, lets start with basic troubleshooting. In moments when connection is down can you ping your WAN GW? ( 69.243.104.1 ) or post output of ip route nexthop pri Also, how's DHCP configured on LAN side? Can you manually set IP on one PC just for testing purposes? Does masquerade rule getting hits ...

blajah

Well, i haven't understood your last post. Can you explain ( like some kind of diagram or picture) where you will mask your private data. Like
WAN IP x.x.x.2/30
WAN GW x.x.x.1

Public LAN pool y.y.y.1/28

Server should get this ip, tplink other. How's cabling done?

blajah

ip services in console

or IP menu, then services submenu on Winbox

blajah

Thanks for answer, i didn't know that.

blajah

Confirming. Currently i have 1096 IP's on ACL, but my timeout is 1d. I have checked random 15 addresses and 13 were DVRs.

blajah

Hmm, thats fairly new information for me. Thanks, and could you maybe point me to thread or elaborate why's that?

Thanks again.

blajah

Consider using 2011 as CAPsMAN and 951s as CAPs.

blajah

Hi,

it should be ok. By default router ( any) will route traffic between directly connected networks without any issue. So, just by defining IP's and rest of net attributes, you should be able to talk between LAN subnets.

Routing answer is here:
http://wiki.mikrotik.com/wiki/Manual:PCC

blajah

That should work.

blajah

Answer depends of your config or what you plan to implement. If your wan is routed via /30, assign first ip from public block to next interface, set 2nd ip to wan card of server and 3rd ip on wan of tp link. Connect devices via switch to mentioned interface and you should be good to go. There are mo...

blajah

Sorry for jumping in, but MT supports hairpinning easily.

blajah

Or you can read http://wiki.mikrotik.com/wiki/Policy_Ro ... erOS_2.9.x

blajah

I'm still trying to figure out is this guy just trolling or he is completely serious with questions. Anyway Mr.Mducharme has nerves made of steel.

blajah

Yes, route should be checked via IP-ROUTES. Status of 0.0.0.0/0.

I haven't understood first part. Is your modem in routed or bridge mode?

blajah

Hi,

Have you tried to explicitly allow RDP in firewall? Like src network, dst network, port 3389 ? Is that rule getting hits? Did you torch rdp connections in current config? Can you connect via RDP to their side?

blajah

Do you have IP on WAN interface when problem occurs? Is DHCP client on WAN interface? Whats the status of default route? Are you NATing traffic twice or MT is getting WAN IP from ISP? ( ISP - WANIP ->ISPModem<-private pool->RB->2nd private pool<-LAN)

blajah

Hi, i just wanna to ask about one issue with RB mentioned in topic name. I have couple of RB's in my lab, and HexLite is one of them. I have enabled bonding( balance rr) between RB750Gv1 and HexLite. There is no any heavy config. Only IP's on 3 interfaces ( eth1,5 and bonding1 - eth 2,3 are slaves)....

blajah

Hi, IIRC its not issue with configuration on MT side, but with PPTP client. You can try to stop PPTP client adding default route to system ( PC ). Click properties on your PPTP connection, select Networking tab, double click IPv4 protocol. Select Advanced , untick "use default gateway on remote...

blajah

What type your WAN connection is?

How's MTU configured on WAN interface?

blajah

Well, in general you have 2 ISP links, and you wan to distribute traffic in some manner over these 2 links. *One link for surfing and stuff, other for crucial traffic ( business related ) * Keep internal users on 1, and infrastructure nodes on 2nd link *etc etc There are a lot ideas, but only you ca...

blajah

Hi,

you do not need LoadBalancing, you need failover.

Something like this:

http://wiki.mikrotik.com/wiki/Two_gateways_failover
or
http://wiki.mikrotik.com/wiki/Advanced_ ... _Scripting

blajah

Hi,

you need to be more specific. Do you wan to drop traffic from internet targeted to your WAN ip or you want to block access from LAN to specific resources on internet?

blajah

Hi,

If i understood correctly, your Linux host is using DNS servers that are not Mikrotik itself. Thats why your router knows where are specific hosts, but your Linux host doesn't. Set mikrotiks IP as DNS server on Linux host and it should be good.

blajah

Hi,

First it would be good to write URL of webiste you are trying to access. After this, why do you think this is Mikrotik related?

Have you been able to access specific website via another ISP/CPE?

blajah

Hi,

yeah, masquerade is what are you looking for.

chain=srcnat action=masquerade out-interface=your_WAN_interface_name log=no log-prefix=""

blajah

Can you ping gateway ( Mikrotik's LAN interface) from that MacBook while internet is not working?
Is " Add arp for leases" enabled?
Whats your lease time? According to log, address was used for 2min 29s.

blajah

Hi, First thing i noticed is: / ip service set telnet port=23 address=0.0.0.0/0 disabled=no set ftp port=21 address=0.0.0.0/0 disabled=no set www port=80 address=0.0.0.0/0 disabled=no set ssh port=22 address=0.0.0.0/0 disabled=no set www-ssl port=443 address=0.0.0.0/0 certificate=none disabled=yes S...

blajah

TNX for feedback. Thats what i was thinking also. But question was just in case i have overlooked something. Tnx alot.

blajah

Hi, Recently got question which confused me alot. Network A is on location 1, and network B is on location 2. If you want to move these 2 networks to same physical location it would be easy if address ranges are not overlapping. But, when bot networks are using same range ( lets say 192.168.88.0/24)...

blajah

Then i do not understand what are you trying to accomplish. Two rules i have posted will do the next: 2. Will match and allow up to 2 packets per minute, if ports are not 80 and 443 3. Will match and add source to address list if traffic exceeds rule above I didnt wrote 1st rule , because you have a...

blajah

Hi again, Can you try to access internet from server with masquerade setup instead of src-nat? Can you try to remove 0.0.0.0/0 in dst-add for src-nat rules? Also, when you trace one of your servers public IP's whats your last hop responding to trace? Is it ISP CE routers inside interface(A.B.C.29)? ...

blajah

Yeah, you can connect via winbox, using MAC address.

blajah

You should start with netstat on your machines.

blajah

Tool torch is what you are looking for. I will check up your config later and try to help a bit. edit: From the first quick look, you need to: 1.Mark traffic per public ip and route it back in same manner ( modifying current config) or 2. Assign public addresses to different interfaces and set up ma...

blajah

Seriously, what exactly are you trying to do?

I'm asking the same

Have you changed a webfig port?

blajah

Maybe stupid question, but did you delete default config of 2011?

blajah

Looks like i'm starting to loose concept. Lets try to re-analyze all rules. So, you are trying to catch traffic which is not traffic to ports 80 and 443? In that case, i guess you can do it like this: chain=input action=accept connection-nat-state=!dstnat protocol=tcp dst-port=!80,443 limit=2/1m,0:p...

blajah

Hi,
here is winbox proxy-arp setup:

Are these interfaces in some slave/master relationship? Do you have bridge setup?

blajah

Lets try this way. You need 2 rules: 1st rule is matcher, like if someone gets up to 5 packets per second accept this traffic 2nd rule is drop traffic which excedes rule above ( add to address list). One thing i overlooked: If you are matching web traffic ( http/https) with such strict rule ( 5 pack...

blajah

Are you using winbox or CLI? Also, can you export config( hide sensitive).

blajah

Hi, Have you masked your public ip with 0.0.0.0( in example above) or this address is really in dst-nat rule? Try without IP add action=dst-nat chain=dstnat dst-port=80 in-interface=ether1 log=yes protocol=tcp to-addresses=192.168.88.10 to-ports=80 Also, consider changing webfig port to some other p...

blajah

Hi,

try to set proxy arp on both interfaces. That should do the trick ( considering you do not have any firewall rules in forward chain which could deny communication between subnets).

blajah

One more thing, consider proxy-arp .

blajah

Hi, Let me try to explain "limit" attribute. It matches packets/bytes up to some limit. If you make rule like add action=accept chain=input disabled=no limit=5,5 protocol=icmp it means rule will allow up to 5 pings in 5 seconds. More then this will be processed by next rule, and for this c...

blajah

Are ports eth1 and eth2 in same bridge ?

blajah

Hi,

Try to add remote DNS servers in
/ip dns
set allow-remote-requests=yes servers=8.8.8.8

blajah

Hi,

create management interfaces/VLAN on each device, interconnect them via tunnels. address them as you like. Thats the general idea,

blajah

Hi, it is not clear how do you authenticate on your ISP infrastructure. [*]"My ISP allocates WAN IP address (public IPv4) through DSL router with DNS and NAT on DSL router through private IP network : 192.168.1.0/24, 192.168.1.1 is gateway/DNS" How? - PPPoE, DHCP/MAC,IP Block statically ro...

blajah

Hi, Both scenarios are Ok, but i prefer 2nd option ( modem in bridge). That's way better and easier way to get to the goal. In that case, you neet to put DSL to bridge, and then optimize WAN config on 750 according to your ISP requirements. With current config whats the issue you are experiencing? P...

blajah

Hi,

Send us traceroute from pc to internet. Lets see how far it goes.

blajah

Hi there. On order to get good answers please provide:
* simple diagram of your topology - nothing fancy, paint would be ok
* Are you able to access a web-server typing y.y.y.y in browser directly?
* Is web-server already NAT-ed?

blajah

Hello,

you are consuming all of your bandwidth with that download. That's why you can not surf.

blajah

Whoah, your configuration is really confusing. There are 30+ rules of masquerade with unknown interface. You have all servers running on your router ( PPTP, SSTP, L2TP, OVPN). Your ether12 has public and private address. I have not seen logical masquerade. Sorry, i am not able to provide any help. I...

blajah

Just to make this clear, ping is ok, RDP is not? Are there any firewall rules on 192.168.1.1 which could produce this behavior?

blajah

Hi,

check ip->services. Change these "service" ports, or disable for test purposes. You should be good to go.

blajah

Hi,
can you provide more details about your issue. Draw topology, explain who is establishing VPN to where... Its bit odd to expect help without any explanation.

blajah

Hi,
From my point of view you do not need the VLAN in your setup. You can do it different, with what is called VRF-Lite(well very close to it

). In Mikrotik words its all about routing marks.Check this topic out, http://forum.mikrotik.com/viewtopic.php?t=42577 maybe it will fit your needs.

blajah

Hi,

yes, redirects will make a change. Can you post tracertoute from pc to server?

blajah

Hi, If your fritz is NATing traffic, you should disable nat. Then you should create routes between networks, so IP of fritz would be your gateway for 192.168.188.0 network. Default route on fritz should point to IP of Mikrotik's IP and you should be good to go( assuming you configured access on frit...

blajah

You're welcome

blajah

Set DHCP relay and dns to point to your internal services.

blajah

Can you show me a trace from PC to server?
Edit
What's the default route on 172.16.1.1?

blajah

Hi there. Let me first confirm if i get your scenario correct: Host with IP 172.16.1.10 can establish a RDP session to server with IP 10.1.0.1 only if its default gateway is set to 172.16.1.1? And your issue is that when on same host default gateway is 172.16.1.3 you can not establish RDP session? I...

blajah

If you are already blocking all unwanted traffic, you can redirect sites in DNS, and also, you should be OK with creating 1 hosts file with same redirects, and then copy them all way across the network. Its not Mikrotik related, but give it a try.

blajah

Hi,

Its 15.6 inch HP laptop. Native resolution is 1366x768 which is set as display resolution also. Once again, i am 99% sure i didn't have this issue on WIN7. Tnx for replys, guys.

blajah

Hi Milos,

Call your ISP and check if they can see your Mikrotik's MAC address from xDSL port on DSLAM. I have seen couple of issues with only 1 MAC allowed on xDSL port.

blajah

Hi, I have upgraded form WIN7 to WIN10 couple days ago. Ever since i'm having strange issue with winbox, Some windows in winbox i can not see completely ( bottom part is under the taskbar), and there is no way to move/maximize it to be visible. Well, here is the video: http://gfycat.com/WeeklyRealis...

blajah

Hi,

try to block udp requests to port 80,and also block any traffic sourced on port 1900

blajah

RB951G-2ND and RB750G had a NTP client running before the upgrade. After the upgrade, in profiler NTP process was always on 0.5% ( i have waited 10-15 min). After disabling then enabling NTP client, process appears then disappears from profiler after 10-15 seconds (as expected).

blajah

Hi,

glad i was able to help. Enjoy your MT devices

blajah

Hi, check this out http://mum.mikrotik.com/presentations/HR13/kirnak.pdf . Also, what i do not like is your comment "1 951Ui-2HnD to use as "server" ". Its bad practice to relay on only 1 device in such implemetation. Consider VRRP or whatever suits your needs on main location.

blajah

Looks like this is what you are looking for:
http://wiki.mikrotik.com/wiki/Hairpin_NAT

blajah

Try this:

/routing filter
add action=passthrough chain=dynamic-in disabled=no set-check-gateway=ping

Search found 222 matches