Community discussions

Search found 359 matches

  • 1
  • 2
by acruhl
Mon Jul 22, 2019 5:21 am
Forum: Announcements
Topic: v6.45.2 [stable] is released!
Replies: 206
Views: 34957

Re: v6.45.2 [stable] is released!

I don't see where to download a zip file, only an npk file. I don't use Windows so I don't use winbox, which is how I assume you can upgrade individual packages? I don't see a way to do it on the command line. At https://mikrotik.com/download, download "extra packages", which is the .zip with all, ...
by acruhl
Sun Jul 21, 2019 4:12 pm
Forum: Announcements
Topic: v6.45.2 [stable] is released!
Replies: 206
Views: 34957

Re: v6.45.2 [stable] is released!

How do I convert it to "separate packages"? I'm not finding that information. I'm trying to remove packages now but the error is "can not uninstall bundled package". I assume this is what you mean by separate packages? I explained how to do this in post #48 There's not enough information. I don't s...
by acruhl
Sun Jul 21, 2019 2:07 am
Forum: Announcements
Topic: v6.45.2 [stable] is released!
Replies: 206
Views: 34957

Re: v6.45.2 [stable] is released!

I've got a hAP-lite and hAP-mini in a test setup for OSPF routing, neither will upgrade. I deleted all files in the "Files" menu entry and it still won't upgrade. I rebooted them, still won't upgrade. The error is "not enough space". Maybe this is the end of the line for lower end devices? Running ...
by acruhl
Sat Jul 20, 2019 7:11 am
Forum: Announcements
Topic: v6.45.2 [stable] is released!
Replies: 206
Views: 34957

Re: v6.45.2 [stable] is released!

I've got a hAP-lite and hAP-mini in a test setup for OSPF routing, neither will upgrade. I deleted all files in the "Files" menu entry and it still won't upgrade. I rebooted them, still won't upgrade. The error is "not enough space". Maybe this is the end of the line for lower end devices? I'd rathe...
by acruhl
Sun Dec 09, 2018 10:33 pm
Forum: Beginner Basics
Topic: DNS ipv6
Replies: 1
Views: 240

Re: DNS ipv6

Post what you're trying to do and what the error is.

You should be able to do ip dns server=2XXX:XXX::53 or whatever the address is. I have done it with no problem.
by acruhl
Sun Dec 09, 2018 4:27 pm
Forum: Announcements
Topic: v6.43.7 [stable] is released!
Replies: 53
Views: 11961

Re: v6.43.7 [stable] is released!

I don't disagree with what pe1chl is saying. I deal with Cisco and Juniper regularly and they provide a way to roll back to a previous version pretty easily. You can't test for every possible configuration customers use. With the ability to roll back you (MikroTik) can utilize customer feedback much...
by acruhl
Thu Nov 22, 2018 5:12 pm
Forum: General
Topic: DNS server in IPv6 router advertisement
Replies: 1
Views: 279

Re: DNS server in IPv6 router advertisement

Answering my own question partially. Once I googled the right terms, I found some help. I was thinking somehow I should be able to completely control what information is sent in the router advertisement, which is what I was searching for. This seems to not be the case. The router mostly decides what...
by acruhl
Thu Nov 22, 2018 4:54 pm
Forum: General
Topic: DNS server in IPv6 router advertisement
Replies: 1
Views: 279

DNS server in IPv6 router advertisement

It seems my router is not sending an IPv6 DNS server in the router advertisement. And I don't know how to control which DNS server it advertises. How do I do this? I can't find documentation for this.
by acruhl
Sat Sep 08, 2018 8:48 pm
Forum: General
Topic: Rate limit all trafffic except for 1 subnet
Replies: 0
Views: 260

Rate limit all trafffic except for 1 subnet

This might be simple, I just don't know where to start. This is hypothetical for now, but it might become reality. There are some sites attached to each other through ipsec tunnels over the internet, let's call it 192.168.200.0/20. It's happening above my router. I just have a single uplink to the d...
by acruhl
Thu Aug 02, 2018 5:26 pm
Forum: Announcements
Topic: Winbox vulnerability: please upgrade
Replies: 329
Views: 87509

Re: Winbox vulnerability: please upgrade

I got a news article about this today through my Google feed. I immediately realized that this is a problem that has been fixed a while. But I agree a short new blog post pointing to the earlier post would reduce confusion. People would be coming here looking for new information. I hope it's clear t...
by acruhl
Tue Jul 24, 2018 3:01 pm
Forum: RouterBOARD hardware
Topic: Serial console on RB450Gx4 not working
Replies: 4
Views: 1148

Re: Serial console on RB450Gx4 not working

No luck with the null cable either.

I'll try some other stuff unless you see something I missed in the output.
by acruhl
Tue Jul 24, 2018 2:35 pm
Forum: RouterBOARD hardware
Topic: Serial console on RB450Gx4 not working
Replies: 4
Views: 1148

Re: Serial console on RB450Gx4 not working

Thanks for the clarification. Yes I am trying to log into the MikroTik's serial port, not log out from it. Ok, based on this info I probably need a null modem cable. Everything else I tried is not working so that makes the most sense. I tried 115200 and that didn't work so the next step is to try th...
by acruhl
Tue Jul 24, 2018 2:09 am
Forum: RouterBOARD hardware
Topic: Serial console on RB450Gx4 not working
Replies: 4
Views: 1148

Serial console on RB450Gx4 not working

I just bought an RB450Gx4 to play with. It's pretty nice. Except I can't get the serial console working. This is my first ever attempt to connect to a MikroTik by serial cable, but far from my first time using a serial device (I've been around a bit). Searching didn't help much. I'm sure this is a s...
by acruhl
Mon Jul 16, 2018 3:53 pm
Forum: RouterBOARD hardware
Topic: RB850Gx2 vs RB450Gx4
Replies: 49
Views: 10168

Re: RB850Gx2 vs RB450Gx4

I should have said that I'd like to use MetaROUTER, which I think is not possible on arm yet? Does it work on PPC?

You can't always have it all I suppose.
by acruhl
Mon Jul 16, 2018 12:18 pm
Forum: RouterBOARD hardware
Topic: RB850Gx2 vs RB450Gx4
Replies: 49
Views: 10168

Re: RB850Gx2 vs RB450Gx4

This post seems like it's getting off topic so I might start another one. I'm looking at the RB850Gx2 and thinking I'd like to use it. But it seems like it might be the last, or nearly the last PPC based board available. If so, will RouterOS support for PPC end shortly after the last PPC based board...
by acruhl
Mon Jun 04, 2018 7:09 am
Forum: General
Topic: VLAN SWITCH
Replies: 38
Views: 2075

Re: VLAN SWITCH

Forget what I said about VRRP if you're trying to use PCC. I didn't see that. If you absolutely need to use both uplinks to get enough bandwidth, then PCC is correct. If not, a master/backup failover setup would be more reliable. I have much better luck with users if the know the uplink bandwidth is...
by acruhl
Mon Jun 04, 2018 6:16 am
Forum: General
Topic: VLAN SWITCH
Replies: 38
Views: 2075

Re: VLAN SWITCH

Yeah, looking at your description I think you should look into VRRP failover. You wouldn't need the extra networks, you would just have the 2 wans and 1 subnet below connected by the link between the routers. Figuring out how to failover based on wan link failure is the problem you would have to wor...
by acruhl
Mon Jun 04, 2018 6:08 am
Forum: General
Topic: VLAN SWITCH
Replies: 38
Views: 2075

Re: VLAN SWITCH

I can't see the diagram. (EDIT: I can see it now) It says I'm not authorized to download it for whatever reason. Can you fix that? A few things: There's no need to worry about if the hardware switch is being used as of 6.41. See the release notes for 6.41: https://mikrotik.com/download/changelogs If...
by acruhl
Sun Jun 03, 2018 1:27 am
Forum: General
Topic: VLAN bridge switch [SOLVED]
Replies: 7
Views: 930

Re: VLAN bridge switch [SOLVED]

As far as I know, switch vlan is the old way to do it. You said before you were using 192.168.80.x/24 on vlan100, but in this case it's 10.10.10.x/24. Not sure you need the service tag. Try without it. Your wan bridge is doing something not 100% clear in regards to eth2. You probably don't want eth2...
by acruhl
Sat Jun 02, 2018 8:12 am
Forum: General
Topic: VLAN bridge switch [SOLVED]
Replies: 7
Views: 930

Re: VLAN bridge switch [SOLVED]

That should work. Make sure eth 2 isn't part of another bridge, if it is and you have other cables connected to the router you might have a spanning tree loop. Send exports: /interface vlan export /interface bridge export /ip address export I suppose it would be useful to set eth2 on both sides as a...
by acruhl
Sat Jun 02, 2018 3:37 am
Forum: Beginner Basics
Topic: Make devices with different LANs Communicate
Replies: 6
Views: 507

Re: Make devices with different LANs Communicate

The picture doesn't make sense until you label the devices with the red arrows. You shouldn't have to do anything to make the 2 networks communicate if both subnets are defined on the same router. If they aren't talking, you are blocking it. You don't need to add any routes, they are already there a...
by acruhl
Sat Jun 02, 2018 1:56 am
Forum: General
Topic: VLAN issues
Replies: 2
Views: 313

Re: VLAN issues

Well, start with basics. 1. UDP will show errors where TCP won't because TCP will do retransmit until the data is complete. You would see that in a Wireshark trace if it was happening. You can do a packet sniffer trace on the interface where the "bad" network exists on the Mikrotik router if you hav...
by acruhl
Fri Jun 01, 2018 6:39 pm
Forum: General
Topic: I can't set a DNS name that starts with a digit.
Replies: 3
Views: 653

Re: I can't set a DNS name that starts with a digit.

Yep, funny that this still comes up. I guess this must still be true after all these years. There was conjecture in the "old days" that www.3com.com was the only exception ever made. I have no idea if that's true but it made a good story. They are long gone now of course. (Edit: It's not true. I jus...
by acruhl
Fri Jun 01, 2018 4:42 pm
Forum: General
Topic: Create multiple trunk ports?
Replies: 3
Views: 1224

Re: Create multiple trunk ports?

If I'm understanding you correctly, this is not so easy. As you say, creating one trunk port with multiple vlans is a piece of cake... Doing multiple ports means you need to find your setup on this page and make a bunch of bridges to make it work: https://wiki.mikrotik.com/wiki/Manual:Interface/VLAN...
by acruhl
Fri Jun 01, 2018 4:34 pm
Forum: General
Topic: VLAN bridge switch [SOLVED]
Replies: 7
Views: 930

Re: VLAN bridge switch [SOLVED]

Just thought of a few things: What I just said is not the only way to do it. There are other ways. Testing on test devices helps. hAP-lite or hAP-mini devices are fantastic for testing... You may have to "undo" the default bridge setup to get this to work. Mikrotik assumes on some devices that you w...
by acruhl
Fri Jun 01, 2018 4:30 pm
Forum: General
Topic: VLAN bridge switch [SOLVED]
Replies: 7
Views: 930

Re: VLAN bridge switch [SOLVED]

What is the vlan id of vlan1? Don't use vlan id 1, use something else to keep from getting confused. Vlan 1 is the default vlan and generally shouldn't be used if you're doing vlans. I'm hoping this is right, from memory: Create the vlan interface using a physical interface as it's "interface". That...
by acruhl
Fri Jun 01, 2018 4:20 pm
Forum: General
Topic: Massive PPPoE Drops
Replies: 8
Views: 1064

Re: Massive PPPoE Drops

Not sure this is relevant with wireless, but is your MTU set correctly on the pppoe-client interface?
by acruhl
Fri Jun 01, 2018 4:16 pm
Forum: Beginner Basics
Topic: Foolishly added filter rule is preventig access to RouterOS.
Replies: 7
Views: 725

Re: Foolishly added filter rule is preventig access to RouterOS.

2 things: 1. Use mac telnet as stated above. You'll need to be in the same layer2 domain and it's probably not activated on the WAN interface. 2. ALWAYS use safe mode when doing anything remotely. You can turn it on, do a few commands and ensure they work, then turn it off. Or leave it on the whole ...
by acruhl
Wed Feb 28, 2018 7:08 am
Forum: General
Topic: RFC 7084
Replies: 8
Views: 851

Re: RFC 7084

If you knew that the addresses were worth more today than tomorrow, you might. For example: https://www.networkworld.com/article/3191503/internet/mit-selling-8-million-coveted-ipv4-addresses-amazon-a-buyer.html There are many private companies that hold class A networks. I work for one of them. Comb...
by acruhl
Tue Feb 27, 2018 4:19 am
Forum: General
Topic: RFC 7084
Replies: 8
Views: 851

Re: RFC 7084

I agree that there are older RFCs, what I'm saying is residential support still isn't standardized from what I can tell. So you have to look at what direction actual implementations are taking rather than trusting a 4 1/2 year old RFC. As for DS lite, the IPv4 space could actually start growing agai...
by acruhl
Tue Feb 27, 2018 1:43 am
Forum: General
Topic: RFC 7084
Replies: 8
Views: 851

Re: RFC 7084

I'm not that up to speed on what exactly IPv6 "standards" are, but I have some (possibly naive?) opinions on using it as a residential end customer That RFC document is about 4 1/2 years old now and I would suggest that stuff has changed. For example, using a tunneling service to get IPv6 over IPv4 ...
by acruhl
Mon Feb 26, 2018 10:45 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

Yeah, that's worth a try next time I'm over there. Setting a static IP is a good start probably. The real problem is I don't know exactly why it's doing this stuff or if it's necessary for it's functionality. In the end the "problem" might only be that MikroTik likes to log messages that this impoli...
by acruhl
Mon Feb 26, 2018 9:15 pm
Forum: General
Topic: VLAN in new "Bridge Only" config
Replies: 64
Views: 16871

Re: VLAN in new "Bridge Only" config

I'm paranoid these days so I turn on packet sniffer on interfaces quite often, open it in Wireshark, then peel back the stuff that I know should be there until I find the stuff that shouldn't be there. It's surprising if you haven't done it or haven't done it in a while. Doing that is so useful and...
by acruhl
Mon Feb 26, 2018 8:58 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

I think he mainly wants to get rid of this type of message: default offering lease 192.168.22.209 for CC:35:40:04:38:1B to BC:8C:CD:46:15:F4 without success The info,!dhcp would get rid of the lease renewal messages which he also wants to hide. There may be other info level messages he wants to kee...
by acruhl
Mon Feb 26, 2018 8:54 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

I bet my left nut you are using some crappy repeaters or a device for switch, that (firmware) is not meant to be a switch. Or connected a freaking Sonos device that makes a loop... Even a laptop, connected both wired and wireless will get 2 separate IPs without problems. Running xp/7/Linux/BD/whate...
by acruhl
Mon Feb 26, 2018 5:55 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

Yeah. I was really hoping to drop log messages based on a regexp string so I don't drop everything from DHCP.

I'll try it. Thanks.
by acruhl
Mon Feb 26, 2018 6:04 am
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

Ok, I'm resurrecting this topic. I finally got to the place where this device exists, and it's a DirecTV DVR/set top box thing. It's apparently doing something on behalf of 2 other "slave" or "client" boxes in other rooms. Super, duper annoying. So I did this: /system logging set 2 topics=warning,!d...
by acruhl
Sat Feb 24, 2018 4:28 am
Forum: General
Topic: VLAN in new "Bridge Only" config
Replies: 64
Views: 16871

Re: VLAN in new "Bridge Only" config

The two addresses, 192.168.33.1 and 192.168.33.2, can ping each other. Other interconnections between the boxes exist, so in order to double-check that the ping cannot get through some other way (which is actually not possible even theoretically but just to be bullet-proof), I've disabled the membe...
by acruhl
Thu Feb 22, 2018 7:10 pm
Forum: Beginner Basics
Topic: How Can I connect to 1st dhcp server from other dhcp server.
Replies: 6
Views: 679

Re: How Can I connect to 1st dhcp server from other dhcp server.

What you wrote in the diagram isn't really in English, maybe you should try in your native language and see if someone can answer.
by acruhl
Thu Feb 22, 2018 4:44 am
Forum: Beginner Basics
Topic: Bridge RouterBoard, using it as a switch
Replies: 2
Views: 418

Re: Bridge RouterBoard, using it as a switch

Don't forget to disable the DHCP server. No need for it if you've just got a bridge. Unless you want it of course. But from your explanation you probably don't want it.
by acruhl
Thu Feb 22, 2018 4:34 am
Forum: Beginner Basics
Topic: How Can I connect to 1st dhcp server from other dhcp server.
Replies: 6
Views: 679

Re: How Can I connect to 1st dhcp server from other dhcp server.

Diagram it please.

You don't really "connect" DHCP servers together, so I don't understand what you are asking.
by acruhl
Wed Feb 21, 2018 6:45 am
Forum: General
Topic: How to turn off spanning tree?
Replies: 4
Views: 2623

Re: How to turn off spanning tree?

A trick I do once in a while is to do /export verbose, then send it to a file. I can then grep (search) the file to see if there is something I missed. Try that while looking for "stp" maybe... If you provide a packet trace showing the STP frame with your mac address as the source, plus /export to s...
by acruhl
Wed Feb 21, 2018 6:29 am
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1783

Re: How to configure MikroTik to be primary router?

(If anyone wants to bring up layer 3 switches, save your typing--they are just misnamed routers.). Yes and no depending on what you need. Cisco 3750 switches have settings that help decide how to allocate resources (is it a switch or a router?) depending on how you use it. There is a difference if ...
by acruhl
Wed Feb 21, 2018 6:21 am
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1783

Re: How to configure MikroTik to be primary router?

There is something very wrong in your post. "Learn about it before asking for help." What could be crazier? Invest tons of time in self educating yourself and finally when you're done post a question on the forums?!?!?! Further: "Hire someone" . Blah. If I were willing to accept the costs for hirin...
by acruhl
Tue Feb 20, 2018 11:58 pm
Forum: General
Topic: VLAN in new "Bridge Only" config
Replies: 64
Views: 16871

Re: VLAN in new "Bridge Only" config

Maybe I'm a bit ignorant... I work with Cisco and Juniper all day, and they make this stuff really easy. You either have a tagged vlan or you don't. You just push those around to whatever port you want them to go, and they go there. There's a little bit more to it than that in areas, but basically t...
by acruhl
Tue Feb 20, 2018 11:45 pm
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1783

Re: How to configure MikroTik to be primary router?

If the ASUS will be in bridge mode, then what do you expect it to do besides function as a switch? Perhaps attach wifi to the bridge I suppose. I think he's referring to that ridiculous article at the link in the first post, which talks about a "router" but it's really a bridge (switch) or access p...
by acruhl
Tue Feb 20, 2018 5:52 pm
Forum: General
Topic: VRRP Delay on restore master
Replies: 3
Views: 428

Re: VRRP Delay on restore master

After thinking about this for a minute, this should be a feature request.

A delay after a reboot solves not only the problem you want to solve, but can also solve "flapping" if one router has a problem and starts rebooting itself. It's a nice feature to have.
by acruhl
Tue Feb 20, 2018 5:41 pm
Forum: General
Topic: VRRP Delay on restore master
Replies: 3
Views: 428

Re: VRRP Delay on restore master

If you don't care which router becomes the master, you can just use preemption-mode=no and that would solve the problem. You could fail it over manually once everything settles. Otherwise, I don't see a way to do it. I'm doing this at work but the routers I'm using have a preemption delay which does...
by acruhl
Tue Feb 20, 2018 7:55 am
Forum: Beginner Basics
Topic: ARP Table is 00:00:00:00:00:00
Replies: 5
Views: 1518

Re: ARP Table is 00:00:00:00:00:00

Have you seen this before? What is doing that? I didn't pick up on the D vs DC, good call. Still, it seems like a single machine trolling the subnet space for something... It's annoying if nothing else. If this was my network I would be looking at packet sniffer traces to see what is doing this and ...
by acruhl
Tue Feb 20, 2018 7:11 am
Forum: General
Topic: Routing Problem
Replies: 33
Views: 1878

Re: Routing Problem

So the question remains, have you put in a static route to the 10.x.x.x network on all of the Ciscos? I think you'll get ICMP redirects on all packets destined for the non gateway addresses in the 192.168 network (the ISP cloud you have drawn) if you use a default route in the 192.168 network. I don...
by acruhl
Tue Feb 20, 2018 6:50 am
Forum: General
Topic: How to configure MikroTik to be primary router?
Replies: 24
Views: 1783

Re: How to configure MikroTik to be primary router?

I'm now dumber after reading the article at that link. The terminology is ridiculous. It's written by someone who is not a network person. Disable the DHCP server in the MikroTik, then attach your links to the LAN ports (not port 1). Those are bridged so the MikroTik will behave as a switch. What ex...
by acruhl
Mon Feb 19, 2018 6:48 pm
Forum: General
Topic: Routing Problem
Replies: 33
Views: 1878

Re: Routing Problem

To the original post author: I don't have much to add except the things labeled "WiFi router" are a problem. If they really are "routers", then they have networks other than 10.0.0.0/20 under them and you would need to route to clients under those as well, which you haven't mentioned yet. If those a...
by acruhl
Mon Feb 19, 2018 6:40 pm
Forum: Beginner Basics
Topic: 2 Separate Vlan / Subnets on one Lan.
Replies: 4
Views: 1091

Re: 2 Separate Vlan / Subnets on one Lan.

Well, "back to basics": You can easily have 2 subnets inside the same layer 2 domain (or physical media, or VLAN, whatever you are calling a single layer 2 network). You just put the gateway addresses on the same interface, for example: /ip address add interface=ether2 address=192.168.1.1/24 /ip add...
by acruhl
Mon Feb 19, 2018 6:33 pm
Forum: Beginner Basics
Topic: ARP Table is 00:00:00:00:00:00
Replies: 5
Views: 1518

Re: ARP Table is 00:00:00:00:00:00

Possibly. I'm trying to think of a legit use of all zeroes as a MAC and I don't know of one. Hopefully someone knows. To me that looks like some kind of a DDoS attack on that subnet. I would sniff it. If a machine is sending out gratuitous arps with all zeroes for all addresses in the subnet, then y...
by acruhl
Sun Feb 18, 2018 6:38 am
Forum: General
Topic: IPSec Tunnel, pingable router but no access
Replies: 9
Views: 648

Re: IPSec Tunnel, pingable router but no access

Yeah, GRE, IPIP, EoIP, whatever works at that point. You can even use the built in ipsec options on the tunnels themselves to make this super easy. Since GRE behaves more like point to point links on a "real" router connection, it's more of a lesson in how routing is supposed to be in my opinion. tu...
by acruhl
Sat Feb 17, 2018 4:23 pm
Forum: General
Topic: IPSec Tunnel, pingable router but no access
Replies: 9
Views: 648

Re: IPSec Tunnel, pingable router but no access

Each MikroTik router has IPSec protocol, NAT-Traversal (4500/UDP) and IPSec IKE (500/UDP) traffic forwarded from its gateway (ISP Router) I think this is assuming that the "WAN" interface on the MIkroTik routers will always get the same IP address, or there is some other way on these routers to ens...
by acruhl
Sat Feb 17, 2018 4:01 pm
Forum: Beginner Basics
Topic: Static Router Config
Replies: 12
Views: 1113

Re: Static Router Config

Subscriber IP - 216.00.14.38 sub - 255.255.255.252 They should be raped with a barbed wire for that subnet size. Those retards are the reason IPv4 is full. I am confused, it is only 2 available host addresses, would you mind to elaborate? At expense of four (one for network address and the other fo...
by acruhl
Sat Feb 17, 2018 3:57 pm
Forum: Beginner Basics
Topic: Static Router Config
Replies: 12
Views: 1113

Re: Static Router Config

Ok, other than access list 101, that's pretty straightforward on the Cisco. Quick detour. This is going to sound like me lecturing: You said "during testing everyone is down" and it's not acceptable. This is not a good business plan, what happens if the Cisco breaks? You should have scheduled downti...
by acruhl
Sat Feb 17, 2018 3:32 pm
Forum: Beginner Basics
Topic: ip neighbor 6.41, interface, discover-interface-list
Replies: 6
Views: 7566

Re: ip neighbor 6.41, interface, discover-interface-list

I'm replying to myself now. Something must have been fixed between 6.41 and 6.41.2, but it's still not working exactly how I would expect. This could be my issue and not it's issue. The interface list generally works how I expect it to (for discovery and mac-server), which was not the case with 6.41...
by acruhl
Sat Feb 17, 2018 6:59 am
Forum: General
Topic: DHCPv6 client problem
Replies: 8
Views: 990

Re: DHCPv6 client problem

Sounds good. I hope I attached it. I anonymized this a bit using a hex editor, I hope I didn't mangle it. A quick look says I didn't. My PD isn't changing anymore (it used to change every few days) so I don't want it out in the open. My ipv6 firewall filter says nobody has found me yet, would like t...
by acruhl
Fri Feb 16, 2018 3:50 pm
Forum: General
Topic: DHCPv6 client problem
Replies: 8
Views: 990

Re: DHCPv6 client problem

A quick look seems the DHCPv6 client on the MikroTik side is at fault. Let me show you my shocked face. What specifically are you looking at? I wiresharked my DHCPv6 request, but I'm finding it hard to match up what I see in the packet vs what you posted here from the RFC. I definitely see IA, I ju...
by acruhl
Fri Feb 16, 2018 3:10 pm
Forum: General
Topic: Mikrotik detecting all traffic to Synology as invalid connections
Replies: 7
Views: 1125

Re: Mikrotik detecting all traffic to Synology as invalid connections

What's even weirder on this is that I couldn't ping the Synology from any other device, but I could go to the synology.me/remote-id link and get on to it. Well, maybe not so weird because that is probably done by using an established outbound connection from your Synology to the Synology website. T...
by acruhl
Fri Feb 16, 2018 2:55 pm
Forum: General
Topic: IPSec Tunnel, pingable router but no access
Replies: 9
Views: 648

Re: IPSec Tunnel, pingable router but no access

That's a pretty cool writeup about doing IPSEC between 2 natted MIkroTik routers. The only part that seems unreliable is this part: Each MikroTik router has IPSec protocol, NAT-Traversal (4500/UDP) and IPSec IKE (500/UDP) traffic forwarded from its gateway (ISP Router) I think this is assuming that ...
by acruhl
Fri Feb 16, 2018 2:31 pm
Forum: General
Topic: Routing Problem
Replies: 33
Views: 1878

Re: Routing Problem

Diagram it. Specifically, show how the MikroTik is connected to the Cisco (what port, and is it the "WAN" port on the MikroTik). We need to know if you're trying to do do NAT or not. If not, it's a simple matter of adding routes to both sides. If you are doing NAT, "it doesn't really work that way"....
by acruhl
Fri Feb 16, 2018 2:21 pm
Forum: General
Topic: Mikrotik detecting all traffic to Synology as invalid connections
Replies: 7
Views: 1125

Re: Mikrotik detecting all traffic to Synology as invalid connections

I have an older Synology that works fine. It's attached to a switch under my MikroTik router. I'm reading what "invalid" means in the wiki and it has a strong association with out of order packets or incorrect sequence numbers with NAT. Are you using NAT to talk to it? Does it work from the same sub...
by acruhl
Thu Feb 15, 2018 6:42 am
Forum: General
Topic: Question about IPv6 (ICMPv6) firewall rules - forward vs. input
Replies: 2
Views: 387

Re: Question about IPv6 (ICMPv6) firewall rules - forward vs. input

Sorry for the noise, I found the answer in the IPv4 section of the manual I think:

https://wiki.mikrotik.com/wiki/Manual:I ... ter#Chains

The input chain is for any packet which ends at any interface on the router itself. Seems counter intuitive to me but anyways.
by acruhl
Thu Feb 15, 2018 6:33 am
Forum: General
Topic: Question about IPv6 (ICMPv6) firewall rules - forward vs. input
Replies: 2
Views: 387

Question about IPv6 (ICMPv6) firewall rules - forward vs. input

I was testing my IPv6 firewall rules a little while ago. I have rules allowing ICMPv6 for input and forward. I'm using PD to assign an address to the interface on my internal network (xxxx::1/64). Using my mobile phone, I decided to ping the address on my internal interface as well as a machine insi...
by acruhl
Thu Feb 15, 2018 2:51 am
Forum: General
Topic: Router debugging and random RST packets.
Replies: 15
Views: 1749

Re: Router is randomly sending TCP Reset packets.

I'm probably stating the obvious, and I have nothing really to add to sindy's response other than basics: TCP resets are layer 4 and should only be originated by the layer 4 endpoints. You really should rule that out before you blame the router. Sindy's explanation seems plausible (about NAT maybe n...
by acruhl
Thu Feb 15, 2018 2:24 am
Forum: Beginner Basics
Topic: Problems with VLAN accessing Internet
Replies: 3
Views: 701

Re: Problems with VLAN accessing Internet

There's not enough information here. You should do /export hide-sensitive from the cli. It appears that you might have multiple internet connections based on your interface naming, you should explain that. I doubt you're passing tagged packets to your ISP, so I'm not sure what you're saying about pa...
by acruhl
Thu Feb 15, 2018 1:50 am
Forum: Beginner Basics
Topic: Static Router Config
Replies: 12
Views: 1113

Re: Static Router Config

Wow, that doesn't sound very good when I re-read it. Do the basics. Clean up the config completely. Make sure the upstream IP in the /30 can ping. Then try to ping your internal interface in the /24. If you have evidence that basic stuff is working or not working, you can use this to work with your ...
by acruhl
Thu Feb 15, 2018 1:43 am
Forum: Beginner Basics
Topic: Static Router Config
Replies: 12
Views: 1113

Re: Static Router Config

Post your Cisco config. I'm sure someone can look at it and figure it out. You didn't mention any routing protocol peering, so probably your ISP is routing your public /24 to your target ip in the /30. If you remove all config from the router (completely), then put the proper /30 address on the upst...
by acruhl
Tue Feb 13, 2018 5:05 pm
Forum: General
Topic: PPPoE and Dynamic IPs
Replies: 3
Views: 351

Re: PPPoE and Dynamic IPs

Apologies, I read it wrong. Ignore what I said. It was early...
by acruhl
Tue Feb 13, 2018 5:02 pm
Forum: General
Topic: What happened to MAC Server? [SOLVED]
Replies: 4
Views: 1253

Re: What happened to MAC Server? [SOLVED]

You have to use an interface list name in there now.

See /interface list

You can create your own list.

In my experience it wasn't working very well, but I thought there were some fixes around that in 6.41.2.
by acruhl
Tue Feb 13, 2018 4:31 pm
Forum: General
Topic: Q-in-Q
Replies: 2
Views: 346

Re: Q-in-Q

by acruhl
Tue Feb 13, 2018 2:40 pm
Forum: Beginner Basics
Topic: ROS 6.41/6.42 VLAN CCR1009
Replies: 4
Views: 634

Re: ROS 6.41/6.42 VLAN CCR1009

Hopefully I understand what you are asking... Set up the edge ports with tagged (vlan10) and untagged traffic. Then add those interfaces to the bond in the MikroTik. I can tell you that I only have experience doing LACP bonding in this type of situation, but from what I understand the other methods ...
by acruhl
Tue Feb 13, 2018 2:35 pm
Forum: General
Topic: How do I take this? Static routes?
Replies: 12
Views: 739

Re: How do I take this? Static routes?

You are mostly correct. As of 6.40, there is no more master/slave config. But the concept is the same. eth4 cannot be bridged or a slave of any other interface, it becomes separate (a routing interface instead of a switch interface). You put an IP on that interface, say 192.168.100.1/24 from your ex...
by acruhl
Tue Feb 13, 2018 2:19 pm
Forum: General
Topic: PPPoE and Dynamic IPs
Replies: 3
Views: 351

Re: PPPoE and Dynamic IPs

So this doesn't have anything to do with PoE unless I'm missing something. Have you tried playing with lease-time in /ip dhcp-server lease? I'm using the ISC DHCP server because that's what I had before I was using MikroTik. They have a "max-lease-time" option. It's also possible for a client to use...
by acruhl
Tue Feb 13, 2018 2:06 pm
Forum: General
Topic: How do I take this? Static routes?
Replies: 12
Views: 739

Re: How do I take this? Static routes?

Yeah, NAT will work as long as they know the address of the printer in the other network and whatever else they need to get to. Some modern devices assume everything is in the same L2 domain so they can discover each other so you might lose that. mdns, ssdp and such. There might be a way to make thi...
by acruhl
Tue Feb 13, 2018 6:16 am
Forum: General
Topic: How do I take this? Static routes?
Replies: 12
Views: 739

Re: How do I take this? Static routes?

You can. If you want to keep that traffic separate from the rest you would have to put in firewall rules on the hAP that you put the new network on. The rules would keep the 2 subnets from contacting each other. If you look at the default config of a MikroTik, you can see in /ip firewall nat the mas...
by acruhl
Tue Feb 13, 2018 6:03 am
Forum: General
Topic: RouterOS no longer responds to ff02::1?
Replies: 1
Views: 281

Re: RouterOS no longer responds to ff02::1?

I just tested this between my Mac laptop and my RB750Gr3 running 6.41.1. I had no problem connecting to the link local address on the MikroTik. I also see the link local address from the MikroTik when I ping ff02::1%en0 I have lots of stuff in the same L2 domain and lots of stuff is responding Somet...
by acruhl
Tue Feb 13, 2018 12:29 am
Forum: Beginner Basics
Topic: Home router with IPSec and OSPF [SOLVED]
Replies: 1
Views: 416

Re: Home router with IPSec and OSPF [SOLVED]

The RB750Gr3 will work fine for that. I'm doing the same thing between 2 houses. Use transport mode ipsec, then a GRE tunnel between the 2 sites. Add a /30 network to the GRE tunnel, then add that network to your OSPF networks. Plus whatever other networks you want to route locally. That's all there...
by acruhl
Mon Feb 12, 2018 5:23 pm
Forum: Beginner Basics
Topic: ROS 6.41/6.42 VLAN CCR1009
Replies: 4
Views: 634

Re: ROS 6.41/6.42 VLAN CCR1009

I'm not 100% sure I follow your charts, but I see you want to use eth0 and eth0.10 on Linux with bonding, which is pretty much all anyone needs to know. Bonding and VLANs are separate topics and don't have much to do with each other. Once you set up your interfaces for tagged (eth0.10) and untagged ...
by acruhl
Mon Feb 12, 2018 6:56 am
Forum: General
Topic: Mikrotik IPv6 support in Fibra optical fibre network Sweden
Replies: 7
Views: 756

Re: Mikrotik IPv6 support in Fibra optical fibre network Sweden

I'm a command line guy, so here's another way to look at it (with my omission paranoia): [me@MikroTik] /ipv6 dhcp-client> print detail Flags: D - dynamic, X - disabled, I - invalid 0 interface=ether1 status=bound duid="0x(long hex string)” dhcp-server-v6=fe80::stuff:1 request=address,prefix add-defa...
by acruhl
Sun Feb 11, 2018 9:50 pm
Forum: Beginner Basics
Topic: Vlan on RouterOS 6.41
Replies: 4
Views: 563

Re: Vlan on RouterOS 6.41

I forgot to mention: This setup (ether2 setup above) will work if you're just "transporting" vlans across a link and the vlans won't be used to connect to clients on "access" ports. All you're doing on the wireless links is saying "allow this tag to traverse this link". They're not actually using th...
by acruhl
Sun Feb 11, 2018 9:29 pm
Forum: Beginner Basics
Topic: Vlan on RouterOS 6.41
Replies: 4
Views: 563

Re: Vlan on RouterOS 6.41

I think all links should work like the example: /interface vlan add interface=ether2 name=eth2-vlan200 vlan-id=200 add interface=ether2 name=eth2-vlan300 vlan-id=300 add interface=ether2 name=eth2-vlan400 vlan-id=400 In your case, replace ether2 with whatever interface (wired or wireless) you need t...
by acruhl
Sun Feb 11, 2018 3:51 pm
Forum: General
Topic: IPSec VPN Problem
Replies: 14
Views: 1788

Re: IPSec VPN Problem

You could set up routing of the private subnet between the VPN sites over a GRE tunnel possibly. If you're worried about the private address space "leaking" out of a different interface (and it's a legit worry see https://forum.mikrotik.com/viewtopic.php?f=2&t=129771&p=637561#p637561 ), you can put ...
by acruhl
Sun Feb 11, 2018 3:42 pm
Forum: General
Topic: Multi subnet wan help
Replies: 3
Views: 272

Re: Multi subnet wan help

I'll say this another way. There might be 2 possibilities: 1. Your ISP is statically routing the 2nd subnet down to you via the 1st. 2. Your ISP put the 2nd subnet inside the same L2 domain as your current WAN configuration. (or 3: They want you to peer with them with a routing protocol, but you pro...
by acruhl
Sun Feb 11, 2018 3:21 pm
Forum: General
Topic: Master/Slave Ports vs Interface Lists [SOLVED]
Replies: 6
Views: 3721

Re: Master/Slave Ports vs Interface Lists [SOLVED]

There is a point that often gets missed on this forum, so I'm going to explain it. This isn't directed to you, but if it works as a reminder, that's great :) As soon as you put IP addresses on bridge1 and bridge2 from my example above, those L2 domains can now talk to each other over L3 (IP). But th...
by acruhl
Sun Feb 11, 2018 3:12 pm
Forum: Beginner Basics
Topic: Vlan on RouterOS 6.41
Replies: 4
Views: 563

Re: Vlan on RouterOS 6.41

You probably have your terminology wrong. "Untagged" just means the device is plugged into a regular access port (in Cisco language), but configured to be on a certain vlan. Probably all of your devices will be plugged into untagged access ports. If you need more clarification on a tagged vs untagge...
by acruhl
Sun Feb 11, 2018 2:56 pm
Forum: Beginner Basics
Topic: Weird IP's coming from Mikrotik box
Replies: 6
Views: 519

Re: Weird IP's coming from Mikrotik box

I can't see your picture.
by acruhl
Sun Feb 11, 2018 6:37 am
Forum: General
Topic: Master/Slave Ports vs Interface Lists [SOLVED]
Replies: 6
Views: 3721

Re: Master/Slave Ports vs Interface Lists [SOLVED]

So the config you have now doesn't match your description. If you still want separate L2 domains like you had before, you simply create a new bridge and then add ports to it. So from your description, your "old" setup equivalent would have 3 to 5 assigned to bridge1, and 6 to 10 to bridge2. That's r...
by acruhl
Sun Feb 11, 2018 1:54 am
Forum: General
Topic: Master/Slave Ports vs Interface Lists [SOLVED]
Replies: 6
Views: 3721

Re: Master/Slave Ports vs Interface Lists [SOLVED]

Post your version and config. The device is telling you that the interface is a port in a bridge (check /interface bridge port) and it wants you to apply the config to the bridge instead of the slave interface probably. Makes sense when you think about it because a slave interface is bridged to othe...
by acruhl
Sat Feb 10, 2018 11:18 pm
Forum: General
Topic: VPN between IPv6 WANs?
Replies: 2
Views: 310

Re: VPN between IPv6 WANs?

I'm not sure if this answers your question but I do transport mode ipsec between 2 IPv6 MikroTik routers without any issue. Then I just do GRE tunnels and route through those. I've also setup ipsec between Linux IPv6 hosts in the PD subnets without any issue as well. Haven't tried any other VPN meth...
by acruhl
Sat Feb 10, 2018 11:13 pm
Forum: General
Topic: Mikrotik IPv6 support in Fibra optical fibre network Sweden
Replies: 7
Views: 756

Re: Mikrotik IPv6 support in Fibra optical fibre network Sweden

Have you tried using /ipv6 dhcp-client yet? set request=address just to see if it works. Probably it will since Windows worked and I think it's doing the same thing. Maybe the translation isn't so good, but in this case I think "native stateful" means DHCPv6 which MikroTik does. I'm not sure about t...
by acruhl
Sat Feb 10, 2018 7:19 am
Forum: General
Topic: LLDP support for neighbor discovery
Replies: 10
Views: 2902

Re: LLDP support for neighbor discovery

So have you opened bugs on this? Regular LLDP works from other name brand switches: me@EX2200-24P-4G> show lldp neighbors interface ge-0/0/15 LLDP Neighbor Information: Local Information: Index: 693 Time to live: 120 Time mark: Sat Feb 10 05:14:59 2018 Age: 16 secs Local Interface : ge-0/0/15.0 Pare...
by acruhl
Sat Feb 10, 2018 7:08 am
Forum: Beginner Basics
Topic: single port support how many OSPF Links
Replies: 1
Views: 206

Re: single port support how many OSPF Links

I don't see any reason why that wouldn't work. OSPF supports broadcast networks... I test with multiple OSPF routers in the same L2 domain.
by acruhl
Fri Feb 09, 2018 5:42 am
Forum: General
Topic: Customers suggestions to RouterOS' IPv6 module
Replies: 6
Views: 672

Re: Customers suggestions to RouterOS' IPv6 module

Heh, you're new.

"Fixed in v7" is a euphemism for "it will be a while", or less optimistic, "it will never happen".
by acruhl
Fri Feb 09, 2018 5:30 am
Forum: Beginner Basics
Topic: Connecting subnet with 2 bridge help
Replies: 6
Views: 533

Re: Connecting subnet with 2 bridge help

The fact that you can ping both PCs from inside the router but not from PC to PC is your first clue. Something in your config is doing this. Start with ping, don't worry that file sharing isn't working. If you can ping both PCs from inside the router, then they should be able to ping each other (thi...
by acruhl
Thu Feb 08, 2018 3:47 am
Forum: Beginner Basics
Topic: [Solved] How to divide 2 VLAN segment that have same network
Replies: 5
Views: 524

Re: [Solved] How to divide 2 VLAN segment that have same network

Ok. I got it. So back to your original question, how to keep PC1 and PC3 together, and PC2 and PC4 together. That's not so difficult if you just separate the VLANs and make 2 separate EoIP tunnels across the R2 and R4 routers. However, if you want them to "talk to the internet" as well, you're going...
by acruhl
Wed Feb 07, 2018 2:31 pm
Forum: Beginner Basics
Topic: [Solved] How to divide 2 VLAN segment that have same network
Replies: 5
Views: 524

Re: How to divide 2 VLAN segment that have same network

You said "all clients can communicate to each other". This should not be the case based on your diagram. I just want you to explain how you can have the same subnet (10.10.10.0/24) talking from R2 to R4, and in vlan 10 and vlan 20 and those machines can talk to each other. That should not be the cas...
by acruhl
Tue Feb 06, 2018 2:14 pm
Forum: Announcements
Topic: v6.41.1 [current]
Replies: 106
Views: 15281

Re: v6.41.1 [current]

This just happened to me on a hAP lite RB941-2nD configured a similar way, but on 6.39.3. So problem appears to be older than 6.41.1. It is configured as a wireless client (station pseudobridge) with all Ethernet ports configured as a switch, a bridge with wlan1, with dhcp-client configured on the ...
by acruhl
Sun Feb 04, 2018 6:20 am
Forum: Beginner Basics
Topic: how to route packets from an ip in a network to an other ip in the same network !(with diagram ) [SOLVED]
Replies: 9
Views: 830

Re: how to route packets from an ip in a network to an other ip in the same network !(with diagram ) [SOLVED]

I don't really understand what you are trying to accomplish with this diagram. I'm guessing the "MikroTik router" is not acting as a router otherwise you wouldn't have 192.168.2.0/24 on both sides of it. As long as you don't mind double NAT, what I would do is plug the cable coming down from your ac...
by acruhl
Sat Feb 03, 2018 11:17 pm
Forum: General
Topic: RB750Gr3 1Gbps w/o Fasttrack?
Replies: 13
Views: 1186

Re: RB750Gr3 1Gbps w/o Fasttrack?

Ahh yes. I was thinking of simple queues. Thanks for the explanation.
by acruhl
Sat Feb 03, 2018 6:29 pm
Forum: Beginner Basics
Topic: [Solved] How to divide 2 VLAN segment that have same network
Replies: 5
Views: 524

Re: How to divide 2 VLAN segment that have same network

There's something missing either from your explanation or from the diagram. Are you saying that all clients can communicate with each other right now even though you have the same /24 on the same switch separated into 2 vlans? There must be more to that story. If you want PC1 to talk to PC3 but not ...
by acruhl
Sat Feb 03, 2018 5:50 pm
Forum: Beginner Basics
Topic: MASTER PORT setting missing
Replies: 6
Views: 24384

Re: MASTER PORT setting missing

Master port no longer exists as of 6.40. This was due to confusion between master port and bridge, they do the same thing but in different ways in the background.

The new way to do master port is to add interfaces to a bridge. See /interfaces bridge and /interfaces bridge port.
by acruhl
Sat Feb 03, 2018 4:16 pm
Forum: General
Topic: RB750Gr3 1Gbps w/o Fasttrack?
Replies: 13
Views: 1186

Re: RB750Gr3 1Gbps w/o Fasttrack?

I'm trying to understand how this works when we know that fast track will break queues. If I fast track all established and related connections, don't they immediately become not eligible for queuing?

This is interesting, there should be a wiki page on it if there isn't already...
by acruhl
Sat Feb 03, 2018 2:58 pm
Forum: Announcements
Topic: v6.41.1 [current]
Replies: 106
Views: 15281

Re: v6.41.1 [current]

acruhl, was the mac address of the bridge originally set as administrative mac address? Or it was just dynamic before the upgrade? Sorry, I meant 6.41 to 6.41.1... I didn't statically set the MAC address. I just added the wired interface to the bridge is all. Looking at my notes on DHCP server conf...
by acruhl
Sat Feb 03, 2018 5:16 am
Forum: Announcements
Topic: v6.41.1 [current]
Replies: 106
Views: 15281

Re: v6.41.1 [current]

Minor issue that maybe not a lot of people will see: My bridge interface MAC address changed after upgrade from 6.40 to 6.40.1, or possibly due to the reboot. This is a wAP-ac. I set it up as a regular access point by adding the ethernet interface to the bridge, then setting dhcp-client to listen on...
by acruhl
Wed Jan 31, 2018 6:27 am
Forum: General
Topic: Host to Host Connection not happening via Mikrotik Router
Replies: 19
Views: 1221

Re: Host to Host Connection not happening via Mikrotik Router

This is very basic routing, it will work if you have it configured correctly because it's just connected routes. Obviously you have something configured incorrectly which you aren't showing us. Start over with a clean config. Make sure the router interfaces you want to use are not bridged. Take them...
by acruhl
Tue Jan 30, 2018 6:43 am
Forum: Beginner Basics
Topic: How to netinstall protected-routerboot [SOLVED]
Replies: 5
Views: 1034

Re: How to netinstall protected-routerboot [SOLVED]

Have you tried resetting it to factory defaults by holding the reset button, powering up, and releasing it about 5 seconds later?
by acruhl
Mon Jan 29, 2018 9:57 pm
Forum: Beginner Basics
Topic: Switch Chip Fun (Vlan 0 issue)
Replies: 9
Views: 2262

Re: Switch Chip Fun (Vlan 0 issue)

I stumbled upon this because I was wondering what the settings are in the "switch->port" area. For example, from the Wiki https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features : check - drop packets with vlan tag that is not present in vlan table. Packets with vlan tags that are present in vlan...
by acruhl
Tue Jan 23, 2018 3:00 am
Forum: General
Topic: how to nat public ip subnet with mikrotik
Replies: 6
Views: 1198

Re: how to nat public ip subnet with mikrotik

Diagram it. Someone asked if you get a public IP for your external router interface. If so, you would assign the /29 to the internal interface of the router and then to 3 servers below that. Then the ISP would be probably statically routing the /29 to your public IP. This is what we're trying to fig...
by acruhl
Tue Jan 23, 2018 2:48 am
Forum: General
Topic: pinging half of my network hosts !!!
Replies: 5
Views: 447

Re: pinging half of my network hosts !!!

Are you using anything other than arp=enabled on your ethernet interfaces? Sorry if I missed something...
by acruhl
Tue Jan 23, 2018 2:45 am
Forum: General
Topic: How to get access to SXT5 again? [SOLVED]
Replies: 12
Views: 834

Re: How to get access to SXT5 again? [SOLVED]

He said that Winbox showed an error when he try to connect by MAC. I didn't read it that way. Said he couldn't connect with Winbox even though he sees a MAC. Not that he specifically tried by MAC with Winbox. It's kinda funny how english is being changed by people who didn't learn english as their ...
by acruhl
Mon Jan 22, 2018 7:08 am
Forum: Beginner Basics
Topic: How to disable Ping in Mikrotix hex rb750gr3?
Replies: 4
Views: 524

Re: How to disable Ping in Mikrotix hex rb750gr3?

Umm.

You don't need to disable ping replies.

You can do it in the firewall if you really want to. But no real need.
by acruhl
Mon Jan 22, 2018 5:55 am
Forum: General
Topic: Obsolete connection table entries
Replies: 11
Views: 1315

Re: Obsolete connection table entries

and so traffic for "existing" SIP connections exits my WAN interface with an obsolete source address and is presumably discarded immediately by my ISP. Sorry, off topic but I couldn't resist. I found a whole range of RFC1918 addresses my ISP (or some other ISP customer?) replies to, and it shouldn'...
by acruhl
Mon Jan 22, 2018 4:54 am
Forum: General
Topic: How to get access to SXT5 again? [SOLVED]
Replies: 12
Views: 834

Re: How to get access to SXT5 again? [SOLVED]

mac-telnet from another MikroTik device or there is source code that will compile on Linux. You can recover anything as long as the interface is set up for mac-server on the non responsive device.
by acruhl
Sun Jan 21, 2018 9:10 pm
Forum: General
Topic: DNS forward based on domain name
Replies: 18
Views: 4026

Re: DNS forward based on domain name

I have an ER-X. The GUI is definitely more "whiz bangy" and you use the web gui (or cli of course), not something like Winbox. MikroTik seems to do a lot more for your money software wise, but hey, if it doesn't support something that this one does, get it. It's a nice little machine. It's a lot of ...
by acruhl
Sun Jan 21, 2018 8:13 pm
Forum: General
Topic: decrease TX-Power
Replies: 8
Views: 3047

Re: decrease TX-Power

Even more obvious (because I'm also fairly new to concepts like EiRP): MikroTik isn't just giving you direct control over radio power, like a lot of other 3rd party firmwares do. To do this might violate regulatory controls. They don't want to do this. And you shouldn't do it. And since you're decre...
by acruhl
Sun Jan 21, 2018 7:59 pm
Forum: General
Topic: Advice router school
Replies: 4
Views: 427

Re: Advice router school

Any one of those should work but the smaller one would not give you any room to grow. Also, other people have said that the MIPS CPUs don't scale well unless they have hardware acceleration for help. The other 2 are ARM.

CZ? Which CZ?
by acruhl
Sun Jan 21, 2018 5:23 pm
Forum: Beginner Basics
Topic: Cannot connect to 192.168.88.1 in setup
Replies: 9
Views: 25446

Re: Cannot connect to 192.168.88.1 in setup

Usually anything that is doing WiFi that is bridged to real ethernet ports (meaning almost any home "router") can work as a WiFi access point. The only warning is that you can "brick" it while changing the IP addressing if you're not careful. And you need IP addressing to be able to change the WiFi ...
by acruhl
Sun Jan 21, 2018 5:07 pm
Forum: General
Topic: /31 bit mask doesn't work on GRE tunnel?
Replies: 3
Views: 570

/31 bit mask doesn't work on GRE tunnel?

(Yes I know you can use /32s with routing and stuff works fine...) This is probably academic because I'm using private addressing, but anyway. I came across this regarding using /31 masks on point to point links: https://tools.ietf.org/html/rfc3021 The short story is, I used this between 2 physicall...
by acruhl
Sun Jan 21, 2018 3:54 pm
Forum: Beginner Basics
Topic: PP2P interface to bypass governments censorship
Replies: 3
Views: 351

Re: PP2P interface to bypass governments censorship

If you're sure that the Windows side is configured "the same" as the MikroTik side (in theory, they don't use the exact same commands obviously), then you know it can work. If it sort of works, then this implies some issue that may or may not be the router's fault. Have you tried a packet sniffer tr...
by acruhl
Sun Jan 21, 2018 12:27 am
Forum: Beginner Basics
Topic: 6.41 bridge problem
Replies: 6
Views: 1659

Re: 6.41 bridge problem

And I reply to myself yet again. When you have the ping issue, get a quick packet sniffer trace from the upstream interface and look at it in Wireshark. It should be obvious if it's a layer 2 or layer 3 loop at that point. If it's layer 2, then the upgrade either made a wrong decision, or an incompa...
by acruhl
Sun Jan 21, 2018 12:15 am
Forum: Beginner Basics
Topic: 6.41 bridge problem
Replies: 6
Views: 1659

Re: 6.41 bridge problem

Wait, I said something wrong, if 8.8.8.8 works at all then it's probably not a routing loop problem, at least for the source subnet you are pinging from. Could be a routing loop for another one though. It's not clear from the description, a diagram and some configs might be needed. Probably you shou...
by acruhl
Sun Jan 21, 2018 12:12 am
Forum: Beginner Basics
Topic: 6.41 bridge problem
Replies: 6
Views: 1659

Re: 6.41 bridge problem

As you know, 6.41 has a different bridge implementation so it's possible that whatever assumptions the code is making about creating the bridge and ports is wrong. The fact that you're pinging and dropping packets seems like a layer 2 loop to me. Although when you said you enabled torch and things s...
by acruhl
Sat Jan 20, 2018 10:56 pm
Forum: Beginner Basics
Topic: How to block SSH attackers after 3 bad logins?
Replies: 16
Views: 2578

Re: How to block SSH attackers after 3 bad logins?

But I want to see in some lists that somebody tried to access to my mikrotik from outside. Is there any way? If "outside" means "internet", this gets tedious and fairly useless very quickly. You should try it though just to prove it to yourself. Add a log prefix for your port 22 tcp block rule (ssh...
by acruhl
Sat Jan 20, 2018 4:27 pm
Forum: Beginner Basics
Topic: Cannot connect to 192.168.88.1 in setup
Replies: 9
Views: 25446

Re: Cannot connect to 192.168.88.1 in setup

I would be very surprised if there was a problem with the device. Another thing to try is if you have another MikroTik, connect it to that and do /tool mac-telnet <MAC> from the other one and see what happens. All this talk of disabling firewalls and other interfaces on Windows seems too complicated...
by acruhl
Fri Jan 19, 2018 5:01 pm
Forum: General
Topic: IPv6 Design Question
Replies: 7
Views: 591

Re: IPv6 Design Question

What Sebastia said is the right method, although instead of /6x I would say /64 because you just said that you only want a /64 on the CRS. So hopefully I can explain this simply: 1. Your ISP hands you a global IPv6 address for the wan side of your hEX, and a /56 prefix through prefix delegation. 2. ...
by acruhl
Fri Jan 19, 2018 3:47 pm
Forum: General
Topic: Routing Issue accross multiple LANs
Replies: 7
Views: 502

Re: Routing Issue accross multiple LANs

Short answer, get rid of all the natting and run a routing protocol, then you don't have to worry at all. It would all "just be connected".

I'm probably missing the reason why you're using so many nats though.
by acruhl
Fri Jan 19, 2018 3:40 pm
Forum: Beginner Basics
Topic: Connect to LAN behind mikrotik router over ipsec
Replies: 4
Views: 478

Re: Connect to LAN behind mikrotik router over ipsec

Show us routing tables on both sides. I assume your routers do not know where are remote neworks, so they are sending traffic via default routes. +1 Start simple. You're assuming this might be ipsec but there's no proof that routing is working. Has it ever worked? What you showed us doesn't line up...
by acruhl
Fri Jan 19, 2018 6:37 am
Forum: Beginner Basics
Topic: IPv6 router settings
Replies: 15
Views: 2645

Re: IPv6 router settings

I don't get what you're saying. Are you saying that once I get my global IPv6 IP and delegated prefix, I should stop listening for router advertisements and define these things statically? I'm already addressing my LAN dynamically from the /56 that is assigned to me. The problem is, the prefix keeps...
by acruhl
Fri Jan 19, 2018 6:16 am
Forum: Beginner Basics
Topic: [IDEA] - New section called Criticize my Config
Replies: 3
Views: 422

Re: [IDEA] - New section called Criticize my Config

Does anything similar exist? Even if there is just a repository of configs that accomplish certain tasks, that would "focus" the new discussion forum on stuff that is really different and requires review. Sort of like how open source software works now. Nobody has to keep reinventing and discussing ...
by acruhl
Fri Jan 19, 2018 5:35 am
Forum: General
Topic: IPv6 Design Question
Replies: 7
Views: 591

Re: IPv6 Design Question

If the IPv6 setup is static, this is a simple matter of turning on OSPFv3 and advertising the route over to the CRS. If not, there are probably a few ways to do this including an elaborate set of scripts to re-advertise the address and re-do router advertisements. I don't know how I would accomplish...
by acruhl
Thu Jan 18, 2018 9:04 pm
Forum: Beginner Basics
Topic: [IDEA] - New section called Criticize my Config
Replies: 3
Views: 422

Re: [IDEA] - New section called Criticize my Config

Yeah, sort of an "open source" router config discussion. Makes sense, probably 80% of what people are trying to accomplish on these boards are pretty much common knowledge. My own experience with these boards suggests that another angle should be taken as well. If you look at the videos in the banne...
by acruhl
Thu Jan 18, 2018 4:53 pm
Forum: General
Topic: Why does my home ISP route RFC 1918 addresses?
Replies: 4
Views: 546

Re: Why does my home ISP route RFC 1918 addresses?

Yeah. I am filtering it in the outbound direction on the WAN interface after I learned about this 10.98.0.2 thing. It's quite interesting to see what tries to get out. I've learned a lot from that. Such as: WhatsApp will try to connect to the RFC1918 address on the "other" side of your conversation ...
by acruhl
Thu Jan 18, 2018 7:05 am
Forum: General
Topic: Why does my home ISP route RFC 1918 addresses?
Replies: 4
Views: 546

Why does my home ISP route RFC 1918 addresses?

My ISP appears to be using a RFC 1918 address for the first hop router, as well as responding to pings to another RFC 1918 address. Why? Maybe they consider the space between me and them "not the internet"? For example: [me@MikroTik] > tool traceroute 8.8.4.4 # ADDRESS LOSS SENT LAST AVG BEST WORST ...
by acruhl
Thu Jan 18, 2018 6:40 am
Forum: Beginner Basics
Topic: How to route WAN to DMZ
Replies: 3
Views: 395

Re: How to route WAN to DMZ

How does routing work? Is it static from your ISP or are you peering with a routing protocol? You have to know that first. Assuming this network starting with 8 really is a public network, and it should be with that address. If not, use RFC 1918. Like the post above says, you can do pretty much anyt...
by acruhl
Thu Jan 18, 2018 5:23 am
Forum: General
Topic: VLAN Trunking Router / SW / SW
Replies: 6
Views: 1049

Re: VLAN Trunking Router / SW / SW

Ok lets say you want to trunk port 2 and 3? It gets messy: https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge Look at example #2 (toward the bottom) but it's doing untagged and tagged traffic. I say this a lot and maybe MikroTik isn't too happy with me but I find Cisco and Juniper switches much...
by acruhl
Thu Jan 18, 2018 5:18 am
Forum: General
Topic: VLAN Trunking Router / SW / SW
Replies: 6
Views: 1049

Re: VLAN Trunking Router / SW / SW

Then create 4 bridges, one for each VLAN. Give the bridges the IP as the gateway. Then setup your NAT and Filter rules as needed. Add each VLAN interface as a port on each respective bridge.
Why use the bridge? Why not just put the IP on the vlan interface? Maybe I'm missing something.
by acruhl
Thu Jan 18, 2018 5:12 am
Forum: General
Topic: TFTP boot configuration
Replies: 8
Views: 2649

Re: TFTP boot configuration

Some netboot experience from me: 1. Don't assume you know what the problem is, even if you see messages on the server end. Do a packet sniff and open it up in Wireshark to see if it looks like the the problem you think it is. It's hard to know exactly what the client is doing because there are usual...
by acruhl
Thu Jan 18, 2018 5:00 am
Forum: General
Topic: Hotspot Mac Cookie security issue
Replies: 4
Views: 665

Re: Hotspot Mac Cookie is just stupid !

It's not useless. It's just not as secure as it could be. This is not solely a MikroTik problem, this has existed a while with other hardware.

Yes, there are methods to fix it. If you paid $10,000 for that router instead of $50, you'd have a legit gripe. Otherwise, wait.
by acruhl
Thu Jan 18, 2018 4:47 am
Forum: Beginner Basics
Topic: RB750Gv3 Dropping Connections [SOLVED]
Replies: 6
Views: 669

Re: RB750Gv3 Dropping Connections [SOLVED]

wow man...

5 MONTHS old.

I think the firmware update may have resolved this problem. I will keep an eye on the log to see if it persists.
Yeah I don't know how I got 5 years.

I don't know what a RB750Gv3 is so I assumed it was old. I have only been using these devices for about 3 years now.
by acruhl
Wed Jan 17, 2018 4:33 pm
Forum: Beginner Basics
Topic: RB750Gv3 Dropping Connections [SOLVED]
Replies: 6
Views: 669

Re: RB750Gv3 Dropping Connections [SOLVED]

You really need to test with other cables.

If possible, you should test other ports as well.

5 years seems past a reasonable warranty period to me, especially when you can get a new one for far less than $100. The RB750Gr3 is pretty nice.
by acruhl
Wed Jan 17, 2018 4:28 pm
Forum: Beginner Basics
Topic: Query about default filter rules of RB750GR3
Replies: 11
Views: 899

Re: Query about default filter rules of RB750GR3

My RB750Gr3 does not have those rules. I have not done a factory reset on it recently though. I know they change firewall rules over time and they arrive after factory reset.
by acruhl
Wed Jan 17, 2018 6:36 am
Forum: Beginner Basics
Topic: Query about default filter rules of RB750GR3
Replies: 11
Views: 899

Re: Query about default filter rules of RB750GR3

They probably are not default. I think MikroTik does not write comments in Spanish, but maybe they should. This could be a feature request. I read the wiki page about the ipsec rules and I'm not 100% sure I understand it. Probably I need the context of why they need these rules in order to understan...
by acruhl
Wed Jan 17, 2018 6:30 am
Forum: Beginner Basics
Topic: IPv6 router settings
Replies: 15
Views: 2645

Re: IPv6 router settings

I have to agree that it's awesome to see an ISP give static assignments like this. The only thing possibly wrong with this is that if you have separate networks on your side (e.g. you have a separate guest network/ssid) then you'll need additional IPv6 space to do that. (each network needs its own ...
by acruhl
Wed Jan 17, 2018 6:23 am
Forum: Beginner Basics
Topic: IPv6 router settings
Replies: 15
Views: 2645

Re: IPv6 router settings

1. With MikroTik with recent firmware, I would say generally yes. The default firewall seems reasonable. But it's your network so it's up to you. I had an Asus router that had a checkbox for "ipv6" and that's it. I did some testing and found that it blocked all inbound connections to the prefix on t...
by acruhl
Tue Jan 16, 2018 11:52 pm
Forum: Beginner Basics
Topic: IPv6 router settings
Replies: 15
Views: 2645

Re: IPv6 router settings

It's pretty cool that you get a static IPv6 setup like that. I have to rely on router advertisements from my ISP and they change my address and prefix every few days, which seems stupid to me but it's my reality. I agree with the above post. That should do it. Don't forget to look at your firewall! ...
by acruhl
Tue Jan 16, 2018 11:43 pm
Forum: Beginner Basics
Topic: Assigning devices with IP addresses from different subnets.
Replies: 7
Views: 823

Re: Assigning devices with IP addresses from different subnets.

Almost correct. 192.168.0.0/30 leaves 2 bits to use, and 2 bits is 0 to 3. This means that 0 is the network number and 3 is the broadcast address. You only get to use 1 and 2 for interfaces. It's effectively a point to point network. Just to continue this discussion, 192.168.0.4/30 is the "next" /30...
by acruhl
Tue Jan 16, 2018 6:31 pm
Forum: Beginner Basics
Topic: Changing Static IP to Dynamic IP?
Replies: 2
Views: 896

Re: Changing Static IP to Dynamic IP?

Yeap. Probably you're going to be "bridging" the DSL "router" (which is a modem and router combination probably) so that you will set up the MikroTik as the router and likely pppoe-client. It's probably not a big deal. The only issue I came across when I did this was MikroTik didn't set the pppoe-cl...
by acruhl
Tue Jan 16, 2018 6:21 pm
Forum: Beginner Basics
Topic: Probably a basic issue not able to network across multiple networks and devices
Replies: 4
Views: 381

Re: Probably a basic issue not able to network across multiple networks and devices

+1. Draw it. Use a pen and paper and take a picture, this is fine.

Pretty sure if you put the route or routes that ZeroByte told you to do in the right place(s), this will "just work".

With a picture any one of us can tell you where to put them.
by acruhl
Tue Jan 16, 2018 6:14 pm
Forum: Beginner Basics
Topic: Assigning devices with IP addresses from different subnets.
Replies: 7
Views: 823

Re: Assigning devices with IP addresses from different subnets.

Yeah, didn't mean to sound condescending but it probably happened. Sorry about that. I'm probably not going to explain this sufficiently, hopefully the documentation plus a few key points will get you there. You're mostly there anyway. When you set up a DHCP server, it sends a few key pieces of info...
by acruhl
Tue Jan 16, 2018 7:01 am
Forum: Beginner Basics
Topic: New install
Replies: 3
Views: 378

Re: New install

What 2frogs said is pretty much right on. Let me make this easier conceptually: 1. The metal52 is your router, the hap ac is just a bridge/access point. I'm not familiar enough with the quick set modes to tell you which ones to use, but others have above. 2. When you pull into some parking spot, you...
by acruhl
Tue Jan 16, 2018 6:30 am
Forum: Beginner Basics
Topic: Assigning devices with IP addresses from different subnets.
Replies: 7
Views: 823

Re: Assigning devices with IP addresses from different subnets.

This is probably not as difficult as you think, or as difficult as you are making it. First, the switch issue. I got a Cisco 2960 48 port 10/100 switch with 2 gigabit uplinks (that I'm using with LACP to the MikroTik router) for $45 shipped to my door. This is a fully managed Cisco switch that can d...
by acruhl
Tue Jan 16, 2018 5:49 am
Forum: Beginner Basics
Topic: How to Block customer private ip address to access core network
Replies: 1
Views: 347

Re: How to Block customer private ip address to access core network

Something like: /ip firewall filter add src-address=192.168.5.0/24 dst-address=172.16.0.0/24 action=drop chain=whichever You could also use in-interface= or out-interface= if you know which interface you'll be blocking traffic on. Probably you should create a test subnet that you're trying to block ...
by acruhl
Tue Jan 16, 2018 1:59 am
Forum: General
Topic: Is it possible to force IP Cloud to a specific WAN
Replies: 1
Views: 554

Re: Is it possible to force IP Cloud to a specific WAN

If you know the IP of the cloud update server, it would be easy. I found elsewhere on this forum that it might be cloud.mikrotik.com. I did a quick sniffer trace while I did /ip cloud force-update and I see one of the IPs for cloud.mikrotik.com in the trace. If you set a static route to that IP out ...
by acruhl
Sun Jan 14, 2018 11:11 pm
Forum: General
Topic: Bridge is like a hub, floods all ports.
Replies: 12
Views: 1181

Re: Bridge is like a hub, floods all ports.

It was said earlier, but I'd like to re-emphasize that low end "switches" have MAC tables that are easily overrun and they start acting like hubs in a hurry in enterprise situations. I have to deal with that all the time. Not to mention when people plug these in and cause L2 loops because they have ...
by acruhl
Sun Jan 14, 2018 11:05 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

Good call. I used to have a wifi extender and it did all kinds of wackiness. When I get over there I'll check it.
by acruhl
Sat Jan 13, 2018 11:34 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

Re: default offering lease without success

Ok, I have a bit more information. I wiresharked this and I see a DHCP Discover frame sent from the BC:8C:CD:46:15:F4 MAC address, but in the DHCP options it's setting the "client" MAC address to CC:35:40:04:38:1B. Or the other MAC 08:95:2A:B8:EC:86 in another DHCP Discover frame. This seems like cr...
by acruhl
Sat Jan 13, 2018 7:26 pm
Forum: General
Topic: default offering lease without success
Replies: 15
Views: 4190

default offering lease without success

I have a hAP-Lite with a dhcp-server problem. My problem is the same as this one, but none of the "solutions" in this thread have worked: https://forum.mikrotik.com/viewtopic.php?f=13&t=119702&hilit=dhcp+without+success I tried setting to the dhcp-server to authoritative, I tried disabling bootp. My...
by acruhl
Wed Jan 10, 2018 6:46 am
Forum: General
Topic: Strange Whats App behavior (possibly)
Replies: 1
Views: 220

Strange Whats App behavior (possibly)

Since I've been studying my WAN connection traffic behavior, I added rules to block any RFC 1918 trying to exit my WAN interface, and I'm logging them. During the time my wife was doing a video chat on Whats App, it repeatedly tried to access a 192.168.x.x address that is not part of my network, so ...
by acruhl
Wed Jan 10, 2018 5:03 am
Forum: General
Topic: Help with writing script!
Replies: 0
Views: 218

Re: Help with writing script!

Why doesn't "check gateway" work when setting a route with ip route? Are your WANs DHCP?
by acruhl
Wed Jan 10, 2018 2:50 am
Forum: General
Topic: Ethertype on WAN interface question
Replies: 0
Views: 200

Ethertype on WAN interface question

I've been especially paranoid about traffic entering and exiting my WAN interface in the last few weeks. Don't know why. I've discovered some interesting stuff though. This question is about ethertype. I have a regular cable based ISP. For the heck of it, I let this sniffer run for a while: [me@Mikr...
by acruhl
Wed Jan 10, 2018 2:32 am
Forum: Beginner Basics
Topic: mAP Lite as travel router?
Replies: 11
Views: 3798

Re: mAP Lite as travel router?

You can probably accomplish what you want to do a little bit easier if you chain the mAP-Lite with a hAP-Lite or hAP-Mini. Or regular mAP. Just be sure to change the default 192.168.88.0/24 net to something else on one of them. The 2nd device works great for mac-telnet in case you mess something up....
by acruhl
Sun Jan 07, 2018 5:19 am
Forum: General
Topic: IPsec IKEv2 Tunnel Tuning
Replies: 10
Views: 2641

Re: IPsec IKEv2 Tunnel Tuning

Cool, thanks for that. I need to learn MikroTik scripting at some point. I've done a few but it's not sticking in my head. On my setup I would have to set: /ip ipsec peer set X address=$variable /ip ipsec policy set X dst-address=$variable sa-dst-address=$variable I have a dyndns account as well, bu...
by acruhl
Sun Jan 07, 2018 12:17 am
Forum: General
Topic: IPsec IKEv2 Tunnel Tuning
Replies: 10
Views: 2641

Re: IPsec IKEv2 Tunnel Tuning

It's a good idea to bridge the modem and use the Mikrotik as the internet facing router. Makes ipsec easier. I'm just doing transport mode ipsec between 2 routers and then I use GRE tunnels to do routing between the sites. Works pretty good. I don't have a script set up to automatically set the publ...
by acruhl
Sat Jan 06, 2018 11:56 pm
Forum: Beginner Basics
Topic: Cannot connect to router
Replies: 2
Views: 273

Re: Cannot connect to router

If you factory reset it with the reset button for 5 seconds at power on, you should be able to connect to 192.168.88.1 with telnet or ssh using user admin and no password.
by acruhl
Sat Jan 06, 2018 5:45 pm
Forum: Beginner Basics
Topic: Reduced Speed When Routing vs. Bridge Mode
Replies: 7
Views: 1774

Re: Reduced Speed When Routing vs. Bridge Mode

Hopefully your "old" D-Link device is not 100 megabit... You would need a gigabit device to get to 300 megabits.

My internet service is only 15 megabits down and 2 megabits up, I don't have such problems :)
by acruhl
Sat Jan 06, 2018 5:20 pm
Forum: Beginner Basics
Topic: Reduced Speed When Routing vs. Bridge Mode
Replies: 7
Views: 1774

Re: Reduced Speed When Routing vs. Bridge Mode

I have this feeling that these "all in one" cable modem devices, especially ones provided by ISPs, are shady. They will do stuff like this so they don't have to field calls about custom setups. My advice - buy a regular cable modem and try again. Also, you could try another brand of router in with y...
by acruhl
Sat Jan 06, 2018 4:43 pm
Forum: Beginner Basics
Topic: Reduced Speed When Routing vs. Bridge Mode
Replies: 7
Views: 1774

Re: Reduced Speed When Routing vs. Bridge Mode

First, to try to understand what you're doing. Setting the cable modem to bridge mode and using your MIkroTik as a router seems straightforward to me. Most people should be doing this. Using your cable modem as a router and the MikroTik as a "bridge" is less clear. Are you really only using the Mikr...
by acruhl
Sat Jan 06, 2018 4:25 pm
Forum: Beginner Basics
Topic: 6.41: When Netinstall just doesn't cut it
Replies: 8
Views: 857

Re: 6.41: When Netinstall just doesn't cut it

So a few things: Did you get the backup from the exact same device you were restoring it to? There was a time when MikroTik renamed interfaces. For example, at one time the external interface was called "ether1-gateway" and this was change to simply "ether1". If you're trying to add an address to "e...
by acruhl
Sat Jan 06, 2018 4:11 pm
Forum: Beginner Basics
Topic: ip neighbor 6.41, interface, discover-interface-list
Replies: 6
Views: 7566

Re: ip neighbor 6.41, interface, discover-interface-list

Yeah, someone had to tell me this. What I found is some interfaces in the list will work, some will not unless I use "all" (which includes the WAN interface which I don't want). For whatever reason, my bonding1 interface doesn't do ip neighbor if I have it in the discover list. It only works when I ...
by acruhl
Sat Jan 06, 2018 4:06 pm
Forum: Beginner Basics
Topic: Update 6.40.5 to 6.41 No internet any more
Replies: 1
Views: 392

Re: Update 6.40.5 to 6.41 No internet any more

Well, the most obvious answer would be the new bridge configuration did something that is not compatible with your setup.

Probably you should get support output and send it to MikroTik or post your config here so someone can look at it.
by acruhl
Sat Jan 06, 2018 4:45 am
Forum: Beginner Basics
Topic: MikroTik Bonding do C3750
Replies: 4
Views: 537

Re: MikroTik Bonding do C3750

Load balancing only happens in the outbound (Tx) direction. Your hash policy on the MikroTik is layer 2 and layer 3. What is it on the Cisco? I have a 2960 with gigabit uplinks ($45 shipped to my door!) set like this: #show etherchannel load-balance EtherChannel Load-Balancing Configuration: src-dst...
by acruhl
Sat Jan 06, 2018 1:48 am
Forum: General
Topic: Flow Control Relevance
Replies: 3
Views: 691

Re: Flow Control Relevance

I believe flow control only starts happening when the interface itself is running out of buffer space, or is otherwise about to degrade performance, so it might be unlikely that it would happen on a wireless link not running near capacity. It might be a good idea on speed mismatched links though. Ye...
by acruhl
Sat Jan 06, 2018 1:19 am
Forum: General
Topic: Flow Control Relevance
Replies: 3
Views: 691

Re: Flow Control Relevance

https://en.wikipedia.org/wiki/Ethernet_flow_control I don't have any WISP experience, but I would guess that this would be most relevant on backhauls. Note that as far as I know, this function only comes into play when one "side" determines that performance degradation is imminent, and flow control...
by acruhl
Fri Jan 05, 2018 2:59 pm
Forum: General
Topic: Bond interface(balance-rr) and bridging
Replies: 13
Views: 3911

Re: Bond interface(balance-rr) and bridging

I'm doing some more testing meanwhile. CRS109-8G with cisco 2960g switch and 6.39.2 works with balance-rr and there are no errors. I'm setting the cisco with etherchannel though..i'll try more tinkering with the other switch( hp 2410-24g) hello, how did you fix it? we are having the same problem to...
by acruhl
Fri Jan 05, 2018 7:38 am
Forum: General
Topic: IPsec IKEv2 Tunnel Tuning
Replies: 10
Views: 2641

Re: IPsec IKEv2 Tunnel Tuning

The topology doesn't make sense. You have a switch attached directly to a modem, and a VPCS (don't know what that is) attached directly to the switch. And a "MikroTik" (with no further description) attached to the switch as well. Is the modem a modem or a router and a modem? Don't guess about if the...
by acruhl
Tue Jan 02, 2018 2:02 am
Forum: General
Topic: Controlling where LLDP is sent
Replies: 4
Views: 2212

Re: Controlling where LLDP is sent

Ok. I'm still trying to understand what "dynamic" means though.

Does that mean I have an interface list called dynamic?

Maybe I'm missing something.
by acruhl
Mon Jan 01, 2018 7:15 pm
Forum: General
Topic: Controlling where LLDP is sent
Replies: 4
Views: 2212

Re: Controlling where LLDP is sent

Seems like when you enable neighbor discovery it also sends out CDP to layer 2 and MNDP to 255.255.255.255 on the public interface, neither of which are desirable as well.
by acruhl
Mon Jan 01, 2018 6:47 pm
Forum: General
Topic: I broke TCP with dst-nat and can't connect to router
Replies: 13
Views: 860

Re: I broke TCP with dst-nat and can't connect to router

Not sure. I think not. Here is a standard router (I think): [me@MikroTik] > /tool mac-server print allowed-interface-list: none [me@MikroTik] > /tool mac-server set allowed-interface-list= AllowedInterfaceList ::= all | none | dynamic | discover | mac-winbox all -- contains all interfaces dynamic --...
by acruhl
Mon Jan 01, 2018 4:59 pm
Forum: General
Topic: I broke TCP with dst-nat and can't connect to router
Replies: 13
Views: 860

Re: I broke TCP with dst-nat and can't connect to router

This is after the fact advice, but it may apply: 1. From the "inside" interfaces: set up /tool mac-server, then use /tool mac-telnet from another MikroTik to connect to it. I have multiple MikroTik routers set up to help recover using mac-telnet. You can find mac-telnet code online that might compil...
by acruhl
Mon Jan 01, 2018 4:42 pm
Forum: General
Topic: Controlling where LLDP is sent
Replies: 4
Views: 2212

Controlling where LLDP is sent

I'm trying to understand the new-ish /ip neighbor discovery-settings options. They are not documented here: https://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery My options are: [me@MikroTik] /ip neighbor discovery-settings> set discover-interface-list= DiscoverInterfaceList ::= [!]DiscoverInt...
by acruhl
Sat Dec 30, 2017 8:15 pm
Forum: General
Topic: Creating a computer network
Replies: 3
Views: 390

Re: Creating a computer network

You should hire a network engineer, or better yet a Mikrotik certified engineer to help you with this. This isn't something that is easy to work out in a forum.
by acruhl
Sat Dec 30, 2017 1:53 am
Forum: Beginner Basics
Topic: Communication between VLANs
Replies: 1
Views: 350

Re: Communication between VLANs

Not enough information.

What device are you trying to ping from and what device are you pinging. Where are they attached?

It looks like you have a trunk port on the router and the addresses are probably configured directly, so it seems like a vlan setup issue downstream from the router to me.
by acruhl
Sat Dec 16, 2017 1:03 am
Forum: General
Topic: IPSEC peers no longer ping (net neutrality?)
Replies: 2
Views: 357

Re: IPSEC peers no longer ping (net neutrality?)

Well, one of the ISPs appears to have reversed themselves. Maybe they got enough complaints from people doing "IoT" that blocking all incoming connections is BS.

The other one I still can't connect to. Trying to make sure it's not the router's fault...
by acruhl
Fri Dec 15, 2017 3:00 pm
Forum: General
Topic: IPSEC peers no longer ping (net neutrality?)
Replies: 2
Views: 357

IPSEC peers no longer ping (net neutrality?)

I haven't checked my IPsec peers for a few days and I have no automatic notification if they go down, so I can't be 100% sure this just happened. However: I can no longer ping or connect to my IPSEC peers across the internet. I've tried from other devices that are not IPSEC peers and they can't conn...
by acruhl
Wed Nov 29, 2017 2:11 am
Forum: Beginner Basics
Topic: Before I buy questions
Replies: 21
Views: 1626

Re: Before I buy questions

This is a bit off topic, but it's worth saying for someone searching. If you're not sure, just buy a hAP-lite or a mAP-mini or something and play with it. They are super cheap. It's a great way to figure out how to use RouterOS for testing purposes. This is what convinced me that I wanted to use Rou...
by acruhl
Sun Oct 08, 2017 6:11 am
Forum: Beginner Basics
Topic: re-attach cAP
Replies: 3
Views: 429

Re: re-attach cAP

That sounds to me like someone got a hold of it and reset it manually, which is possible for anyone with physical access and the ability to Google.

Can you use mac-telnet to get into it by chance?

I don't know what "MI" is or where you are seeing it.
by acruhl
Sun Oct 08, 2017 6:05 am
Forum: Beginner Basics
Topic: Network Segmentation
Replies: 6
Views: 1059

Re: Network Segmentation

The way I read this, this is just a simple case of routing to connected routes.

Do /ip route print

The router will automatically route packets between directly connected subnets. If you don't want this to be the case you have to firewall it or use a VRF.
by acruhl
Sun Oct 08, 2017 4:38 am
Forum: Beginner Basics
Topic: Vlans + interface bonding
Replies: 4
Views: 1118

Re: Vlans + interface bonding

Turns out there isn't much to learn. The new code just decides in the background if there is hardware bridging ability, and there is a matrix of functions that affect if hardware bridging can work.
by acruhl
Sat Oct 07, 2017 11:59 pm
Forum: Beginner Basics
Topic: Vlans + interface bonding
Replies: 4
Views: 1118

Re: Vlans + interface bonding

So 2 things then:

1. Invest the time in learning the "old" way, creating a bunch of bridges across physical interfaces and vlans as the link I posted shows.

2. Learn the "new" way in 6.41rc which will be the way things work once that code is released. I haven't tried it yet.
by acruhl
Sat Oct 07, 2017 4:15 pm
Forum: Beginner Basics
Topic: One website not accessible
Replies: 3
Views: 452

Re: One website not accessible

What is your local network? NAT or public?

If public, they could be blocking you.

You would have to give us more info to be helpful. These problems are usually caused by some firewall config doing something you don't expect.
by acruhl
Sat Oct 07, 2017 4:11 pm
Forum: Beginner Basics
Topic: Vlans + interface bonding
Replies: 4
Views: 1118

Re: Vlans + interface bonding

Bonding is really the least of your problems. As long as you remove the physical interfaces from their master interface (make them master=none), then create the bonding interface with the 2 ports, it will work. Hook them up together and you should see the bonding interfaces come up. Your VLAN layout...
by acruhl
Tue Oct 03, 2017 7:06 am
Forum: General
Topic: EOIP - If segmenting DHCP is so wrong and stupid... what is right and smart?
Replies: 3
Views: 512

Re: EOIP - If segmenting DHCP is so wrong and stupid... what is right and smart?

Not an answer but that DHCP setup is not necessary. The ISC DHCP server has a primary/backup failover capability and it works fine. Just configure them both the same way and they communicate pool information to each other. The docs have some pretty simple setup information. I kinda wonder why EOIP i...
by acruhl
Sat Sep 30, 2017 3:41 pm
Forum: General
Topic: Why I am not using WinBox!
Replies: 24
Views: 2494

Re: Why I am not using WinBox!

Winbox was incorrectly named from the beginning and ignores users who don't use Windows. I haven't used Windows regularly in over 10 years, and even before that I wasn't using it as much as other stuff. I have been using Linux at work for nearly 20 years now, and BSD and Mac at home. Yes I know ther...
by acruhl
Sat Sep 30, 2017 3:30 pm
Forum: General
Topic: Remote Host Scanning our IPv6 Network
Replies: 50
Views: 5589

Re: Remote Host Scanning our IPv6 Network

So I thought about what I said above, and it wasn't well thought out. I guess what I'm suggesting is that anyone on an IPv6 endpoint, that is trying to run actual IPv6 services to the internet (web, streaming, whatever), might be well served by a honeypot that responds to "everything" on the PD subn...
by acruhl
Sat Sep 30, 2017 5:38 am
Forum: General
Topic: Remote Host Scanning our IPv6 Network
Replies: 50
Views: 5589

Re: Remote Host Scanning our IPv6 Network

A few days ago one of our routers was hitting IPv6 neighbor cache exhaustion. The symptoms were occasional unreachability via IPv6. I pulled up Torch and found someone was actually scanning our network, probing consecutive addresses in a /64 to see if anything responded! .... Hope that helps someon...
by acruhl
Fri Sep 22, 2017 4:16 pm
Forum: Beginner Basics
Topic: Only TCP/UDP port load balancing
Replies: 2
Views: 508

Re: Only TCP/UDP port load balancing

This is not what I would call a "Beginner Basics" question. The only thing I can think of off hand is the LACP layer 2 hash algorithm, but I think the best you can do is XOR between the last bit of the IP address and port number. Not perfectly random, but it works pretty good in the layer 2 link agg...
by acruhl
Fri Sep 22, 2017 4:06 pm
Forum: Beginner Basics
Topic: Access to my LAN from external network.
Replies: 18
Views: 1986

Re: Access to my LAN from external network.

Have your neighbor get a hAP-lite or mini. Or better yet, give one to him. Set up a GRE tunnel between the 2 public IPs (with IPSEC), put a /30 on either side, then route your private subnets to the /30 address on the "other" side of the tunnel. Done. You just need to make sure that the 2 private su...
by acruhl
Fri Sep 15, 2017 2:11 am
Forum: General
Topic: Doing NAT inside a single L2 domain (vlan)
Replies: 3
Views: 525

Re: Doing NAT inside a single L2 domain (vlan)

Thanks. I thought about that. This might be the answer. People generally aren't supposed to run their own routers or switches below mine but this is a good case for it. Something I forgot to mention is that most of the public IPs he needs to access are in the same vlan, and there are only a handful....
by acruhl
Fri Sep 15, 2017 1:17 am
Forum: General
Topic: Doing NAT inside a single L2 domain (vlan)
Replies: 3
Views: 525

Doing NAT inside a single L2 domain (vlan)

I have a user who has his own vlan with a "public" address space, let's say it's 8.254.10.1/24, provided by me. For a while now, he's been running with public IPs as well as his own 10.x.x.x/21 private network with DHCP and all kinds of stuff inside this vlan. I don't need to know about the private ...
by acruhl
Wed Sep 13, 2017 6:16 am
Forum: Beginner Basics
Topic: Is the CRS106 suitable as a router?
Replies: 6
Views: 863

Re: Is the CRS106 suitable as a router?

This is not a complete answer. Check compatibility of your PoE switch/router and the devices you plan on powering. I bought a Juniper 24 port PoE switch for the heck of it because it was cheap, and it won't power most MikroTik devices because they are passive, and the switch is 802.1af/at. There hav...
by acruhl
Mon Sep 04, 2017 7:56 pm
Forum: Beginner Basics
Topic: Guest-wifi
Replies: 8
Views: 7143

Re: Guest-wifi

i created a quick overview of options #2 and #3. i will do a detailed guide on the capsman version, as it might seem a bit complex for the first glance, but maybe easier to control/manage. i'll post it on my blog and drop a link here. i will also include the configuration as well (probably for opti...
by acruhl
Mon Sep 04, 2017 6:54 am
Forum: General
Topic: Looking for a secure alternative to eoip
Replies: 7
Views: 1274

Re: Looking for a secure alternative to eoip

You've got that backwards.

ipsec existed long before WPA anything.
by acruhl
Mon Sep 04, 2017 5:51 am
Forum: Beginner Basics
Topic: Winbox + IPv6 + macOS + CrossOver
Replies: 4
Views: 571

Re: Winbox + IPv6 + macOS + CrossOver

I don't use Winbox much on Mac, but I just tried with Wine Bottle.

IPv4 works, IPv6 does not.

It says "ERROR: Invalid address - <ipv6 address>"
by acruhl
Sat Aug 26, 2017 6:35 am
Forum: Beginner Basics
Topic: Please help me to understand where I wrong on this basic configuration.
Replies: 3
Views: 465

Re: Please help me to understand where I wrong on this basic configuration.

Try using the default masquerade rule. You shouldn't need to edit it.

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=ether1

I have multiple subnets on my lan and they all can get to the internet with this single rule.
by acruhl
Fri Aug 25, 2017 6:09 am
Forum: General
Topic: IPv6 and DHCP and DNS
Replies: 65
Views: 11004

Re: IPv6 and DHCP and DNS

SLAAC was kind of acceptable until "Privacy Extensions" was added. +1 I'm not really smart enough to be debating this among the rest of you, but I'm trying as hard as I can to learn this stuff. I'm all for privacy but at some point I'm hoping to be able to trace an address back to a real person on ...
by acruhl
Fri Aug 25, 2017 1:21 am
Forum: General
Topic: About RB750Gr3
Replies: 8
Views: 1043

Re: About RB750Gr3

What APs you will use ? Do not use cAP Lite, mAP Lite if more devices / more than 5-6 / will connect to each one !
Why? I've had about 15 devices connected to a mAP-lite. Not using a lot of bandwidth but it worked fine.
by acruhl
Fri Aug 25, 2017 1:07 am
Forum: General
Topic: Simple queues
Replies: 2
Views: 476

Re: Simple queues

Disable the fasttrack rule in /ip firewall filter. It's there if you still have some default firewall config.

Otherwise, need more info.
by acruhl
Thu Aug 24, 2017 5:19 pm
Forum: General
Topic: IPv6 and DHCP and DNS
Replies: 65
Views: 11004

Re: IPv6 and DHCP and DNS

Yeah, I should have specified. 1 to many is not needed, prefix translation is. Companies will merge, and address spaces will need to be consolidated. As far as SLAAC in a busniess setting, or what I'm doing specifically at work, I can't see it happening. It may work for general connectivity here and...
by acruhl
Thu Aug 24, 2017 3:53 am
Forum: General
Topic: Troubleshooting router spontaneous restart
Replies: 9
Views: 1018

Re: Troubleshooting router spontaneous restart

It's still worth checking the power supply then. I work with thousands of devices and power supplies of all types commonly go bad. Also, wiggle the power jack and see what happens. It's common for components which are soldered to the board but require physical force to manipulate them to become loos...
by acruhl
Thu Aug 24, 2017 12:20 am
Forum: General
Topic: IPv6 and DHCP and DNS
Replies: 65
Views: 11004

Re: IPv6 and DHCP and DNS

Wow, how did I miss this one? Random thoughts: o MikroTik's motto is "routing the world". Given that, why not take the lead on IPv6 deployment issues from the ISPs perspective using advice from some obviously loyal users in this thread? When there is an opportunity to lead, take it. If you need inve...
by acruhl
Wed Aug 23, 2017 7:45 pm
Forum: General
Topic: High latency on IPv6
Replies: 4
Views: 737

Re: High latency on IPv6

This one is over my head. I'm not a performance guy (yet). You have a pretty clear relationship between routing table size and ping time, although it's not 100% certain that this is the cause, could just be coincidence. You probably need to open a bug for that one unless someone knows something spec...
by acruhl
Wed Aug 23, 2017 7:39 pm
Forum: Beginner Basics
Topic: connect to cAP lite admin
Replies: 4
Views: 1568

Re: connect to cAP lite admin

Sorry, missed this reply.

Which terminal are you trying to paste text into? I use a Mac or Linux and it's pretty simple to do. If you're using the web terminal, not sure. I don't really use it.
by acruhl
Wed Aug 23, 2017 7:33 pm
Forum: General
Topic: Troubleshooting router spontaneous restart
Replies: 9
Views: 1018

Re: Troubleshooting router spontaneous restart

Short answer: 1. Try another router Long answer: 1. Try another power supply 2. Try another power outlet 3. Put it on a UPS If you suspect that your power fluctuates, a power conditioner couldn't hurt. Some UPS devices do this. I had a MikroTik device behave strangely after a lightning strike. This ...
by acruhl
Wed Aug 23, 2017 7:07 am
Forum: General
Topic: telnet on port 80
Replies: 11
Views: 2085

Re: telnet on port 80

you cant telnet from your host with port 80 you can use remote server to telnet through a browser embedded telnet client Umm. You absolutely can telnet to port 80 to test connectivity. This is basic networking 101: $ telnet 192.168.88.1 80 Trying 192.168.88.1... Connected to 192.168.88.1. Escape ch...
by acruhl
Wed Aug 23, 2017 7:00 am
Forum: General
Topic: ddns through dsl modem
Replies: 10
Views: 1378

Re: ddns through dsl modem

Can you put the DSL modem into bridge mode and then use the MikroTik as the router with a public IP? You might need to set up a PPPoE client using your username and login to your ISP.
by acruhl
Wed Aug 23, 2017 6:57 am
Forum: General
Topic: High latency on IPv6
Replies: 4
Views: 737

Re: High latency on IPv6

I'm pinging from a host to another host with 2 MikroTiks and the internet in between using ipv4 and ipv6 and the ping times are very comparable.

Do you have a long chain of IPv6 firewall rules or something?
by acruhl
Wed Aug 23, 2017 6:51 am
Forum: General
Topic: EoIP tunnel not getting 1500 MTU [SOLVED]
Replies: 13
Views: 5935

Re: EoIP tunnel not getting 1500 MTU [SOLVED]

Sniff it and wireshark it. Just for the sake of clarity, you are aware that you can't get a full 1500 byte payload inside of a 1500 byte MTU right? Your payload still has to fit in minus whatever headers you have wedged in there, IP, EoIP, whatever. Also, as was said above, does it really matter tha...
by acruhl
Tue Aug 22, 2017 3:30 pm
Forum: General
Topic: IPSec. IP Tunnel int.
Replies: 6
Views: 1220

Re: IPSec. IP Tunnel int.

Well, unless this person wants to use the tunnel interface. I find using transport mode ipsec between wan IPs is easier, then you can use whatever tunnels you want and they will be encrypted. tunnel=no proposal src-address=Y.Y.Y.Y Consider using a GRE tunnel as well, although not sure if that matter...
by acruhl
Tue Aug 22, 2017 3:13 pm
Forum: General
Topic: Convert 802.3af/at PoE to Passive?
Replies: 2
Views: 879

Re: Convert 802.3af/at PoE to Passive?

I missed that, thanks.

I also see another device (from someone else) which is a "splitter" and has enough power for a hAP AC lite (12V) according to the documentation.

I will try one of them.
by acruhl
Tue Aug 22, 2017 6:33 am
Forum: General
Topic: Convert 802.3af/at PoE to Passive?
Replies: 2
Views: 879

Convert 802.3af/at PoE to Passive?

I got a "real" PoE switch (802.3af/at) finally. It's a Juniper. While looking for PoE adapters to power my Raspberry Pi, I was thinking about converting 802.3af/at to passive to work with a MikroTik router. I found a device made by a competitor to MikroTik, but nothing from MikroTik. Is this somethi...
by acruhl
Tue Aug 22, 2017 5:58 am
Forum: General
Topic: About VRRP configure
Replies: 3
Views: 420

Re: About VRRP configure

Diagram it. My setup at work has ISP routers above me running HSRP. The provider gives us a /29 for the "in between" network. So for example the default gateway we route to is 10.250.0.1 (virtual), and the ISPs HSRP physical addresses are 10.250.0.2 and 10.250.0.3. They provide the layer 2 connectiv...
by acruhl
Sun Aug 20, 2017 5:05 pm
Forum: Beginner Basics
Topic: Crs226 Sfp bonding so that multiple floors can be interconnected
Replies: 9
Views: 787

Re: Crs226 Sfp bonding so that multiple floors can be interconnected

Where does this info come from? I might buy one of these. I don't see any indication on the front panel that this is the case, and the documentation says both SFP+ ports support "1.25G or 10G" SFPs... Not disputing what you're saying, I just can't find this information to confirm.
by acruhl
Sun Aug 20, 2017 7:09 am
Forum: Beginner Basics
Topic: ❓ Share public IP pools between routers ?
Replies: 5
Views: 826

Re: ❓ Share public IP pools between routers ?

The ISC dhcp server is pretty flexible but I'm not sure if it does this exact thing. It probably can solve the problem in some way. It does failover and management of pools between servers. I'm running it with failover to a peer on 2 raspberry pi's.
by acruhl
Sun Aug 20, 2017 6:55 am
Forum: Beginner Basics
Topic: Having Trouble Creating DHCP Server
Replies: 4
Views: 427

Re: Having Trouble Creating DHCP Server

Do this:

/interfaces
export

Compare the setup of the ports closely. There should be no reason why one works and not the other. Unless the port is bad for some reason. I had a lightning strike and it took out a port on a MikroTik...
by acruhl
Sat Aug 19, 2017 5:04 pm
Forum: Beginner Basics
Topic: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?
Replies: 8
Views: 922

Re: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?

Someone smarter about MikroTik switches should answer before you listen to me. I haven't ever owned a MikroTik switch unfortunately. I've never touched SwOS. I want to at some point. They have a 5 port one for $40 but I doubt that is going to cover you. If it was me, I'd probably go for this one: ht...
by acruhl
Sat Aug 19, 2017 6:09 am
Forum: Beginner Basics
Topic: Queue's for mobile devices
Replies: 3
Views: 494

Re: Queue's for mobile devices

I'm not a scripting expert, someone else would have to answer that. If the host name has some indication of what the device is, it should be possible. Would be easy to defeat once someone found out though. Is it possible to assign static DHCP leases via the mac address? The mac address could have a ...
by acruhl
Sat Aug 19, 2017 6:06 am
Forum: Beginner Basics
Topic: static route issue
Replies: 1
Views: 309

Re: static route issue

Probably 192.168.1.101 thinks there is a better route to the 10.42.0.0/16 network. Have you looked at that?

Try other addresses in on the openstack machine to see if one works.

You might need to study what's going on in the openstack machines at work. Look at physical connectivity.
by acruhl
Sat Aug 19, 2017 4:03 am
Forum: Beginner Basics
Topic: IP nat to 2nd sub-net
Replies: 2
Views: 417

Re: IP nat to 2nd sub-net

Just a point to make about your explanation: xxx.1/24 and xxx.2/24 looks to me like you just have 2 IPs in the same subnet. You should probably clarify that without giving away exactly what the subnets are (although that doesn't really matter if they are private). Like 192.168.1.x/24 and 192.168.2.x...
by acruhl
Sat Aug 19, 2017 3:53 am
Forum: Beginner Basics
Topic: AP in LAN powered by POE on WAN
Replies: 1
Views: 308

Re: AP in LAN powered by POE on WAN

I don't really understand your explanation that well. But probably: Make ether1 a slave of ether2 on the one you want to behave as an access point. /interface ethernet set 0 master-port=ether2-master (assuming 0 is the ether1 port) You might need to do other stuff like turn off the dhcp client and s...
by acruhl
Sat Aug 19, 2017 3:35 am
Forum: Beginner Basics
Topic: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?
Replies: 8
Views: 922

Re: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?

A little more explanation about what your goal is with all of this would be nice. Assuming the LTE is "just another" WAN connection in addition to the 2 you already have: (This is off the top of my head, I don't even know if this is possible) Make a tunnel interface on the LTE router going back to t...
by acruhl
Fri Aug 18, 2017 6:58 am
Forum: General
Topic: is LACP stable enough at the moment?
Replies: 2
Views: 629

Re: is LACP stable enough at the moment?

I use an RB750Gr3 with LACP to a Cisco and more recently a Juniper. No problems at all. I haven't seen these reports of problems.
by acruhl
Fri Aug 18, 2017 6:18 am
Forum: Beginner Basics
Topic: Change Network Setup from "normal" to vlan based?
Replies: 6
Views: 770

Re: Change Network Setup from

You don't have to use vlans. You can just add another subnet as well. Just put 192.168.33.1/24 on the same interface as your other network, and then you have 2 subnets. Alternately, you could set up 192.168.22.0/23 and change all the subnets on your current devices, or set up the DHCP server to hand...
by acruhl
Fri Aug 18, 2017 6:13 am
Forum: Beginner Basics
Topic: Revive a Brick
Replies: 2
Views: 448

Re: Revive a Brick

Did you change the default ports by chance? Watch the traffic to see what IP it gets, then nmap that IP. I've saved a few devices using mac-telnet. You would have to attach the "brick" to your network using it's LAN interface because the mac-server isn't set up on the WAN port by default. If you don...
by acruhl
Fri Aug 18, 2017 6:03 am
Forum: Beginner Basics
Topic: Route IP / subnet down ipsec tunnel
Replies: 11
Views: 2300

Re: Route IP / subnet down ipsec tunnel

Why use ipip? Use GRE. Set up ipsec in transport mode (not tunnel mode) between the CCR and the SRX. Set up a GRE tunnel between the WAN IPs (it will be secured by ipsec). Put a /30 on each side of the GRE tunnel. Route IPs to the /30 address on the "other" side. Exceedingly simple when you get it s...
by acruhl
Mon Aug 14, 2017 8:04 pm
Forum: General
Topic: Question about new(-ish?) default IPv6 firewall rules
Replies: 3
Views: 1204

Re: Question about new(-ish?) default IPv6 firewall rules

I always enable the ipv6 package as soon as I get a device. What I think happened was one of my recent upgrades noticed the package was enabled and added this long list of default IPv6 rules. I didn't have any rules already defined on this device. Going forward I will ensure that all of my "LAN" int...
by acruhl
Mon Aug 14, 2017 8:29 am
Forum: General
Topic: Question about new(-ish?) default IPv6 firewall rules
Replies: 3
Views: 1204

Question about new(-ish?) default IPv6 firewall rules

I did a factory reset on my mAP-lite recently and noticed that there are now lots of "defconf" IPv6 rules. This is a good thing. I see it allows UDP port 546 which allows the dhcp client to work, this is great. However, I found this rule: ;;; defconf: drop everything else not coming from LAN chain=i...
by acruhl
Mon Aug 14, 2017 1:24 am
Forum: General
Topic: RB750Gr3 slow gigabit performance
Replies: 6
Views: 2010

Re: RB750Gr3 slow gigabit performance

Yet another example of if you want to do anything other than watching Netflix, you're a "business" customer.
by acruhl
Sun Aug 13, 2017 8:08 pm
Forum: General
Topic: RB750Gr3 slow gigabit performance
Replies: 6
Views: 2010

Re: RB750Gr3 slow gigabit performance

Difficult to say unless you post an export. Are you using fasttrack? (you should) As a side note: using DMZ is far from optimal, you'd better put the AT&T router in bridge mode, and setup the RB750Gr3 so that it takes the public ip, i.e. ATT will be a mere modem . +1 Your AT&T "router" is probably ...
by acruhl
Sun Aug 13, 2017 8:02 pm
Forum: General
Topic: Which types of ports would you like to see for a high speed router
Replies: 168
Views: 25390

Re: Which types of ports would you like to see for a high speed router

Way, way off topic, sorry: but OpenBGPd is making a comeback. We have built ours on OpenBGPd and are loving it. What OS and what hardware? I played with it on a PC just to see how it worked but it's been a while. Would be cool to deploy that on OpenBSD on beefy hardware, should be solid based on wha...
by acruhl
Sun Aug 13, 2017 7:44 pm
Forum: Beginner Basics
Topic: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?
Replies: 8
Views: 922

Re: Adding 3rd WAN but no dedicated LAN port - is VLAN solution ?

Yes, it can be done. This example isn't 100% the same as yours but it should be similar. I made a mAP-lite (1 ethernet port) into my home router by using the physical ethernet interface as the WAN link, and a VLAN interface on top of the physical interface as the internal facing network. Just as an ...
by acruhl
Sun Aug 13, 2017 6:19 am
Forum: Beginner Basics
Topic: VLAN not working
Replies: 7
Views: 938

Re: VLAN not working

You've got the wrong forum it seems.
by acruhl
Sun Aug 13, 2017 6:15 am
Forum: Beginner Basics
Topic: connect to cAP lite admin
Replies: 4
Views: 1568

Re: connect to cAP lite admin

Yeah, the cAP-lite is just a bridge and it gets a DHCP address. I just confirmed it: /interface bridge port add bridge=bridge comment=defconf interface=ether1 add bridge=bridge comment=defconf interface=wlan1 /ip dhcp-client add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\ ...
by acruhl
Sun Aug 13, 2017 5:17 am
Forum: Beginner Basics
Topic: connect to cAP lite admin
Replies: 4
Views: 1568

Re: connect to cAP lite admin

If I remember right, the cap lite is set up to get a DHCP address isn't it? I thought it was set up in sort of a classic access point mode. You might try resetting it and seeing if that works. If not, try mac-telnet. It should be enabled by default as well. Do a /tool mac-scan to find it, and then u...
by acruhl
Sun Aug 13, 2017 5:09 am
Forum: Beginner Basics
Topic: VLAN not working
Replies: 7
Views: 938

Re: VLAN not working

The diagram isn't labeled very well, but I will assume that your vlan interfaces are on the WiFi interface of the device attached to the unmanaged switch? You probably don't need those masquerade rules. One should do: /ip firewall nat add action=masquerade chain=srcnat out-interface=WAN If your clie...
by acruhl
Sat Aug 12, 2017 6:37 am
Forum: Beginner Basics
Topic: Limiting Bandwidth (New to Mikrotik)
Replies: 2
Views: 645

Re: Limiting Bandwidth (New to Mikrotik)

The only reason I even have this router is because my friend won it in an IT competition and we needed a router for the house so he lent it to me.
Awesome. Which model? They make cool home routers.
by acruhl
Sat Aug 12, 2017 5:46 am
Forum: Beginner Basics
Topic: VLAN Trunk between CRS125 and RB260GS
Replies: 5
Views: 1832

Re: VLAN Trunk between CRS125 and RB260GS

It's actually pretty easy. I work on Juniper and Cisco all day, plus a few others, and I don't find MikroTik easy at all. Maybe I'm missing some simple concept that will tie it all together. I understand the concepts in the documentation, it just requires a whole lot more thought and planning than ...
  • 1
  • 2