MikroTik

emikrotik

Hello,

Does anyone have a working config for CHR running in AWS with dual WAN?

I would like to setup CHR at the edge of the VPC with 2 WAN interfaces with 2 Public IP addresses and 1 LAN interface.

Thank you,

emikrotik

Hello, I have an issue with mark-connection being overwritten in my mangle rules. Please see below mangle rules; 361-363 are layer 3, PBR on source and destination IP Addresses. 361 chain=prerouting action=mark-connection new-connection-mark=GOOGLE DRIVE passthrough=yes dst-address-list=GOOGLE DRIVE...

emikrotik

+1

Allows for better management.

emikrotik

Hello, Can any one tell me what the values in the queues-in and queues-out snmp oid represent? name=.1.3.6.1.4.1.14988.1.1.2.1.1.2.559 bytes-in=.1.3.6.1.4.1.14988.1.1.2.1.1.8.559 bytes-out=.1.3.6.1.4.1.14988.1.1.2.1.1.9.559 packets-in=.1.3.6.1.4.1.14988.1.1.2.1.1.10.559 packets-out=.1.3.6.1.4.1.1498...

emikrotik

Hi,

I had the same issue, I believe phase 2 doesn't rekey the SPI. I was not able to come up with a solution.

emikrotik

emikrotik

Hi, Do you need to access your routes from outside of your network? Why not allow connection via ssh or winbox only from your lan subnet and block from all other sources? ;;; Allow Firewall Remote access chain=input action=accept src-address=<LAN subnet> ;;; Drop Firewall Remote access chain=input a...

emikrotik

Have you tried turning off auto-negotiate and setting 1Gbps full duplex?

emikrotik

Agree with the above post.

I would also not recommend using the CRS326 as a core router.

emikrotik

Not sure if this will work?

Add a filter rule to drop connections from the source IP Address then then go to firewall > connections and delete the connection?

emikrotik

Try specifying the routing table on the advanced tab of the ping tool.

emikrotik

I think ether5 is your WAN port? try changing the interface to your LAN port.

emikrotik

Same issue;
viewtopic.php?f=2&t=128006&p=629202#p629202

emikrotik

Upgrading the firmware from bugfix 6.38.7 to bugfix 6.39.3 resolved the issue;

*) switch - fixed multicast forwarding on CRS326;

emikrotik

Hi, I am experiencing an issue where the CRS326 is not passing vrrp traffic. I have two CCR1036 configured with a vrrp interface. When I uplink the two CCR1036 to the CRS326 the vrrp interface on both CCR devices are running master. When I replace the CRS326 with a CRS125 or CRS225 vrrp traffic pass...

emikrotik

Hello,

Does any one have a feature comparison between the CRS125 ( MIPS-BE ) vs CRS326 ( arm ).

I have noticed their is no eg. and in. vlan settings, ingress port policer .etc

Also when rebooting or resetting CRS326 the file system is formatted.

Thanks.

emikrotik

Maybe it booted in to SwOS? try accessing via the web browser.

emikrotik

Hello, I am running a CHR instance as the edge device for my VPC. I am hosting a web server behind CHR, I use a dst-nat rule to NAT the traffic to the server, I would now like to increase the scalability and implement a load balancer. When creating an ELB, you are given a hostname that resolves to a...

emikrotik

Create a script and use a foreach loop to go through every queue.

:foreach i in=[/queue simple] do={
/queue simple set max-limit=10/10M numbers=$i
}

emikrotik

Hello,

Were you able to achieve your desired configuration?

emikrotik

Hello,

Is it possible to load the CHR 6.41rc31 ova in to esxi and then downgrade to 6.38.7?

Thank you.

emikrotik

Hi,

What is the max throughput on the UBNT link?

emikrotik

This is the script I use for multi wan auto failover This is very useful as the gateway is usually your ISP's CPE that is on premise but the ISP may be having an issue upstream. Netwach checks the host every 10 seconds If it goes down it will ping the host 10 times ( verify that it is really down an...

emikrotik

Hi,

Did you add a masquerade rule?

Did you add any filter rules to block access on port 8291?

Did you disable discovery? you should be able to plug your PC into any port and use winbox neighbours to discover the device.

emikrotik

Hello,

6.40
*) ipsec - removed policy priority;

What was the reason for removing priority?

Is there another feature that can achieve the same functionality? ( order of NAT bypass rules? )

emikrotik

Sounds like you want to setup PCQ ( Per Client Queuing )
https://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ

emikrotik

Hi,

You will have to create source NAT rules.

/ip firewall nat add chain=srcnat src-address=10.0.0.1/24 action=src-nat to-addresses=192.168.2.1

/ip firewall nat add chain=srcnat src-address=10.0.1.1/24 action=src-nat to-addresses=192.168.1.1

emikrotik

1 to 1 NAT ;;; RDP chain=dstnat action=dst-nat to-addresses=10.x.x.x to-ports=3389 protocol=tcp dst-address=x.x.x.x in-interface=sfp3 dst-port=3389 log=no log-prefix="" Port Redirection ;;; SSH chain=dstnat action=dst-nat to-addresses=10.x.x.x to-ports=22 protocol=tcp dst-address=x.x.x.x ...

emikrotik

Sometimes, few common ports are silently blocked by the upstream providers,
Try PAT, Example forward port 55510 to your local server ip - port 3389
But why is that so that the common ports are blocked?

To stop people with residential Internet connections hosting mail servers .etc

emikrotik

1 to 1 NAT ;;; RDP chain=dstnat action=dst-nat to-addresses=10.x.x.x to-ports=3389 protocol=tcp dst-address=x.x.x.x in-interface=sfp3 dst-port=3389 log=no log-prefix="" Port Redirection ;;; SSH chain=dstnat action=dst-nat to-addresses=10.x.x.x to-ports=22 protocol=tcp dst-address=x.x.x.x i...

emikrotik

Hello all i also have the same kind of scenario but one thing is different i need to connect my ISP's fibre directly into my CCR-1036 12G-4S SFP port. How can i achieve this any idea i mean how do i configure my SFP port as a internet gateway and currently i have use my ether1 as DHCP server port a...

emikrotik

Yeah.. The Ubiquiti Edgeswitch 16 XG. This is exactly the type of thing I was looking for. Thanks,, Hmm. So Mikrotik did announce an SFP+ CRS huh? Maybe I will wait and see. Hope they don't take too long in releasing it. The Edgeswitch is ~550 USD ...within my range.. a little stretched but managea...

emikrotik

Hello,

I had the same issue, I found it to be ARP.

I copied the MAC address on the toCore interface so they were the same on both devices and disabled / enabled the port when VRRP changed from master to backup on the script tab.

/interface ethernet set sfp1 mac-address=xx:xx:xx:xx:xx:xx;

emikrotik

Any update?

emikrotik

I don't have experience with this, although my concern would be the high volume of writes to the flash disk. I do believe you can change the interval; /ip dhcp-server config store-leases-disk Personally I would lean towards running your DHCP server in CHR on a VM. Would imagine this is also more cos...

emikrotik

Hello, Will you be purchasing devices for redundancies too? I currently use the CCR1009 in active / passive HA supporting 3 ISP's ( 150Mbps throughput ), ~400 users, 40+ IPSec tunnels, layer 7 filtering, mangle rules and queuing CPU usage for last 48 hours: http://imgur.com/QOZrLp5 I would like to t...

emikrotik

Hi,

I don't completely understand your requirement.

You could customize your logging rule and add multiple parameters i.e add route change but exclude rip announcements;

Screenshot: http://imgur.com/Hk9Mkeh

emikrotik

Hi,

Do the SSID's have different subnets?

You could utilize mangle mark packet with simple queue and priority to achieve your goal.

emikrotik

Hello,

Is there any news or draft spec on the hardware of the CRS317-1G-16S+RM and release date?

Will the CRS317 support VLAN ACL? and will it be suitable for use as a core switch in a high throughput network running a RIP, VRRP, bridge?

Thanks.

emikrotik

Hello, I am using a CRS212 with two uplinks to a CRS226, I am using a S-31DLC20D on both sides from the CRS212 to the CRS226 SFP+ 1. Based the SFP comparability matrix; http://wiki.mikrotik.com/wiki/MikroTik_SFP_module_compatibility_table the S-31DLC20D are not compatible with the CRS226 SFP+ 2 port...

emikrotik

Strange Bug: After upgrading my CCR1009-8G-1S-1S+ from 6.37.3 to 6.38 the exported config mixed up the interface IDs: /interface ethernet set [ find default-name=ether 5 ] l2mtu=1520 name=ether 1 -kbd set [ find default-name=ether6 ] l2mtu=1520 name=ether2 set [ find default-name=ether7 ] l2mtu=152...

emikrotik

Hope ya don't mind if I ask ... Would somebody happen to be running a CHR or 32-bit ROS on a Amazon Web Services (AWS) account ? This is not a problem. I just happened to look at who was connected to the 207.32.195.2 btest server and spotted a connection from AWS. My question for you, what kind of ...

emikrotik

Hope ya don't mind if I ask ... Would somebody happen to be running a CHR or 32-bit ROS on a Amazon Web Services (AWS) account ? This is not a problem. I just happened to look at who was connected to the 207.32.195.2 btest server and spotted a connection from AWS. My question for you, what kind of ...

emikrotik

Hi,

Why do you need to have any configuration on Mikrotik? Can't you just create the switching group and then configure teaming on the OS?

emikrotik

As your routers are on different subnets to the LAN networks you will need to add phase two policies and NAT rules to establish connectivity. You won't be able to use /16 as both LAN networks are class C. As mentioned above check filter rules or allow access from Site A's public IP address and conne...

emikrotik

Hi, I have a strange issue when I export the config the Interfaces are being renamed; set [ find default-name=ether5 ] comment="WAN1" name=ether1 set [ find default-name=ether6 ] comment="WAN2" name=ether2 set [ find default-name=ether7 ] comment="WAN3" name=ether3 set ...

emikrotik

Block ICMP packets and allow router to show as a hop on traceroutes;

/ip firewall filter add action=drop chain=forward disabled=yes icmp-options=8:0 protocol=icmp

emikrotik

Packet flow and traffic control?

Different applications for simple queues and tree queues and how to setup PCQ.

emikrotik

Hi,

Was there any solution to this issue?

I am having the same issue with using CRS226 as DHCP relay and having CRS125 as access switches.

emikrotik

+1 would like to see this feature

emikrotik

You will also have to setup your MX record priorities

emikrotik

Since you use AD, you could just define the proxy setting in domain policy. If you want it done transparently, then make an address-list for hosts that may go directly to http, and add the proxy server to this list as well as other hosts that may be approved for non-proxy. Then make a dstnat rule i...

emikrotik

Do you have a static or dynamic public IP Address?

If it is dynamic, depending on your ISP's configuration you may not be able to force it to change as it maybe a 7 day lease.

emikrotik

Not sure of the speed and number connections,, the complexity of mangle rules, routing and firewall rules, VPN's .etc you will configure. I have a CCR1009-8G-1S-1S+ supporting; 3 Internet connections 300+ users 25+ VPNs 80+ mangle rules Current resource utilization is: Uptime: 58 days ( last down ti...

emikrotik

At Site1 create a netwatch script that monitors Site2 ISP 1.

When Site2 ISP 1 connections goes down it disabled the the ISPec peer for ISP 1 and enabled the IPSec peer for ISP 2.

When Site2 ISP 1 connections comes back up it enables the the ISPec peer for ISP 1 and disables the IPSec peer for ISP 2.

emikrotik

0-80Gbps throughput.

https://www.youtube.com/watch?v=odNkzle-YJ4

emikrotik

Hello,

Is your VPN established 24/7? Or do you only want to establish the VPN if the wireless link goes down?

If it is the latter, you could configure netwatch to poll the wireless AP at the remote site, if it goes down; write a script to enable the IPSec peer.

emikrotik

Hello,

I am currently experiencing an issue where the queue is exceeding the the allocated bandwidth.

Please see screenshots.

emikrotik

I think you should put queues (separate ones, tuned for the actual speeds) on the ISP links, and not on the LAN. So create simple queues for each ISP and then create a child queue for each protocol based on the packet marks? How would you mark the packets of the incoming web traffic specific to an ...

emikrotik

Is it as simple as the queue is displaying the 'Download Average Rate' and the Interfaces is showing the actual rate?

emikrotik

Hello, I would like to enquirer what the best configuration for queues in a multiwan configuration is? Current port configuration: WAN ether1 - ISP 1 ether2 - ISP 2 ether3 - ISP 3 LAN ether7 - LAN Currently I am using queue tree with the following setup; DOWNLOAD bandwidth limiting LAN-Main L-HTTP L...

emikrotik

+1 please implement.

emikrotik

Apologies;

Using
/export file=export compact resolves the issue.

Please close thread.

emikrotik

Hello, I think there is a bug in v6.32.2 If you export the config: /export file=export.rsc Then run the command: /system reset-configuration no-defaults=yes run-after-reset=export.rsc The import will fail on: /ip ipsec mode-config /ip ipsec policy group As it is trying to import default values that ...

emikrotik

Hello, I have two CCR1009-8G-1s-1s+ configured with VRRP configured for auto fail over - all is working well. I am looking for a why to have the configuration from the primary device automatically replicated to the secondary device. The desired configuration is to reduce the IT overhead and eliminat...

emikrotik

Hello, I am trying to script the output of a configuration to make changes to it before setting it to the content of a file. I am able to receive the value of each property but I am unable to get the property name - it always returns the first first character of the value. I have based my script off...

emikrotik

Bump! I would really appreciate some feedback on this. Regards, Henry. This should be fairly easy. I'm not sure you have understood vlan trunking though. There is no intervlan trunking and the term suggests a misconception on your part. Thank you for your constructive answer! You are correct, I hav...

emikrotik

Bump!

I would really appreciate some feedback on this.

Regards,
Henry.

emikrotik

Router / Switch configuration.

emikrotik

Thank you, I will post topology shorty.

I just edited my original post and now it has been deleted?

emikrotik

Hello, I have been trying to configure InterVLAN trunking for over a week now and am still having difficulties. Current setup: 2x CCR-1009-8G-1S-1S+ in VRRP configuration - Gateway 10.35.1.5 Connected to the 'Core Switch' CRS-125-24G-1S-RM via port 23 and 24. I then have a 'Distribution Switch' CRS-...

Search found 71 matches