MikroTik

Larsa

Looks like the topology image is missing. Just edit the post and add it using the “Attachments” section in the lower left. Anyway, it should be the default setting but can you try setting "match-by=remote-id" on the identity? Also, please export "/ip/ipsec" since it's way easier ...

Larsa

You can easily get a bend-insensitive, UV-resistant, and weatherproof OM3 multimode fiber for about $1.50/ft or less. Just make sure it’s outdoor-rated and ideally armored if you're mounting it along a wall and around corners.

Larsa

@Jetman77, welcome to the forum! Just a quick note: as the name suggests, SPDK (Storage Performance Development Kit) is just a development kit, not a full appliance, so to make use of it, you’ll need an actual SPDK-based app. As for running an SPDK-based app in a Mikrotik RouterOS v7 container, that...

Larsa

Fixed.

Larsa

@wolkenschaufler, you're using the wrong URL. It should be: " https://<username>:<passwd>@dyndns.strato.com/nic/update?hostname=<domain>&myip=<ipaddr>,<ip6addr> ". Check this out for more info: https://www.strato.de/faq/hosting/so-einfach-richten-sie-dyndns-fuer-ihre-domains-ein

Larsa

@PrimeYeti; Even though the CRS520-4XS-16XQ has a pretty decent CPU and 4 GB of RAM, it's mainly a switch. The 4 GB is kind of borderline for handling full BGP IPv4 and IPv6 tables anyway, especially if you want to run other stuff too. If that's the case, take a look at the CCR2116, CCR2216 or the C...

Larsa

Right now its Tarana and nothing else. They take preamble puncturing to the next level....

Well, at $21,500.00, it better puncture preambles, postambles and possibly the space-time continuum: https://www.wavonline.com/Tarana-Wireless-35-0171-001

Larsa

Please read: viewtopic.php?p=1142201&#p1133887

Larsa

An alternative solution that doesn’t require scripting is to enable Netwatch logging with " /system logging add prefix=debug topics=netwatch ", and then check all the values in the log: 07:39:10 netwatch,debug debug: [ type: icmp, host: 1.1.1.1 ] Stats: 07:39:10 netwatch,debug debug: [ OK ...

Larsa

Yes, it would really help to have RouterOS v7 use more recent wireguard sources - it would improve performance considerably. Notable WireGuard changes since kernel 5.6.3, which was released on 2020-04-15: | Date | Kernel | Summary +------------+--------+---------------------------------------------...

Larsa

You need to use curly brackets when running commands in the terminal to keep everything in the same "scope":

{
:local myhost 8.8.8.8
:put $myhost
}

Or:

{ :local myhost 8.8.8.8; :put $myhost }

Larsa

What’s a ”x86 base box AP device” ?

Larsa

Totally agree with the previous speaker!

Larsa

Are you implying that MikroTik just enabled all the drivers available in kernel version 5.6.3 in the x86 release? Obviously not all available on the market, like third-party drivers, but a bunch of Mikrotik legacy and most of the mainstream drivers, like for example the NICs listed below. You simpl...

Larsa

You need to check what hardware those boxes use, like for example network card, storage controller, and so on. Then make sure drivers for those hardware devices are included by default in Linux version 5.6.3. It's not possible to add any custom drivers yourself. If you are not sure how to check this...

Larsa

Znevna/Paternot: Alright, so we’re at the “pics or it didn’t happen” stage now. :-D No one is claiming that hardware acceleration breaks the laws of thermodynamics. Of course it uses CPU resources, just not the main cores in the same way software-based encryption does. That is actually the whole poi...

Larsa

I don't know, seems to have some fixation on hardware acceleration. . . . Are there any tests somewhere to support those hundreds of tunnels without any CPU load posted somewhere and to see that indeed the CPU can do something else just as it did without any tunnels active, and that any other load ...

Larsa

WireGuard pushes impressive single-tunnel speeds on an RB5009UG, but it also comes with high CPU utilization. IPsec with hardware offload is built for a different use case, with hundreds of simultaneous tunnels and barely any load on the CPU.

Bottom line: pick the right tool for the job.

Larsa

The weaker side will always set the pace no matter what, especially when you’re talking about low-end devices used by hobbyists.

In that case, I wouldn’t even consider IPsec. I’d go with WireGuard instead, like I mentioned in my first post.

Larsa

What I was trying to say, if my comment wasn’t clear, is that you’re mixing apples and oranges. A more useful comparison might be something like USD per WG Mbit or along those lines. Since ChaCha20 throughput depends directly on raw CPU power, more power means more $$$, simple as that. Have a look a...

Larsa

WireGuard's ChaCha20 doesn't differentiate between ingress and egress traffic, so performance in either direction just boils down to traffic density and normal stuff like queue depth, tx/rx ring size, etc. Parallelism, on the other hand, is purely an implementation detail, unless you're running the ...

Larsa

Yeah, or maybe the new IBM z17 or why not the El Capitan? You see my point?

Larsa

@pe1chl; While it's true that hardware acceleration generally offloads a VPN concentrator itself, the speed of each connection is still limited by its slower end-point. In other words, to achieve maximum throughput for a IPsec tunnel, both ends still need to utilize AES hardware acceleration.

Larsa

TL;DR - WireGuard encryption performance, general info about hardware acceleration and WireGuard throughput testing.. The WireGuard encryption The ChaCha20 cipher used in WireGuard currently lacks hardware acceleration on most platforms and architectures, which means it runs entirely in software, in...

Larsa

Maybe it would be worth building a statically-linked copy of the 'conntrack' userland app, and trying to see if it would work on a jailbroken router... 👀 Not really necessary. Just look into the standard kernel module xx_conntrack and the usual userland tools ("conntrack-tools"). That sho...

Larsa

Again, OT! Please start a separate thread and I’ll respond there, alright? Anyway, just to spice up the debate before the new thread: 256 full-speed IPsec tunnels with almost no CPU impact equal, at most, 5–10 full-speed WireGuard tunnels with 100% CPU consumption [/color] on a CCR2216. And that’s a...

Larsa

@blacksnow, OT – please start a separate thread on the subject. This one's about ROS v7.19rc.

Larsa

I don't agree with this. If you want to say, "vpn concentrators where high throughput and scalability are required, ipsec with offload is the only practical solution on RouterOS" maybe that is true. But if we are talking hardware/software solutions outside of what Mikrotik provides etc, t...

Larsa

I thought I was the only one noticing a performance drop in Wireguard Since WireGuard relies entirely on software-based encryption (ChaCha20), speed is limited by the endpoint with the weakest CPU. It’s good for home setups and out-of-band management for a single connection, but for VPN concentrato...

Larsa

Currently it is hard to impossible - because formal syntax or grammar definitions do not exist. So LLM will deliver bull**t until forever. Yep, they do. It’s pretty much standard practice and kind of an essential building block when constructing compilers or scripting languages. LLM coding models a...

Larsa

We’ve had no stability issues whatsoever with either WireGuard or IPsec for a long time now. IPsec parallel throughput with hardware offload on the high-end models is really solid, with no noticeable drop in performance as long as you stay within the recommended connection limits. The only limitatio...

Larsa

Still it needs to learn by actual good examples which for rsc there are not much available as for other languages which can mislead AI. Exactly. You can create training data in many different formats, like the annotated pseudo code snippets below to complement the AST. There are plenty of other way...

Larsa

Looks like you pushed a release candidate (beta) to production. Probably not the smartest move.

Larsa

Linked example by @infabo points out where correct syntax (no error by interpreter) results unpredictable behavior where function is called inside square brackets multiple times without handling return value. If interpreter doesn't throw error for such written code, then grammar specification langu...

Larsa

It's not hard at all. LLM models just need to be trained with formal syntax or grammar specification languages like EBNF, ANTLR, etc and might be complemented with structured representations such as ASTs. There are plenty of tools and well-documented processes for this online.

Larsa

The models below show the correct syntax, but sources point to forums, not the official docs.

Mistral 7B (mistral.ai)
Claude 3 Opus (claude.ai)
gemini.google.com (Gemini 1.5 Pro)

These don't show the correct syntax:

grock (perplexity.ai)
ChatGPT (copilot.microsoft.com)

Larsa

Haha, yeah, I totally agree!

Larsa

Nice to see you're aiming for some kind of intelligent model but I assume you meant OpenAI's gpt-4.1, since GPT 4.5 is just a ChatGPT preview. That said, the responses from "The Dude AI" are surprisingly bad and do not come close to what you get from public chat models like ChatGPT, Claude...

Larsa

Did you try any of the AI site builders I linked to?

Larsa

Google "AI website builder" or just ask your favorite AI.

Larsa

Well, since you keep repeating yourself over and over again, don't listen to @Amm0's or my advice, and don't even bother to answer my questions, you're on your own. Good luck!

Larsa

Support gave you a proper answer. You can run any L2 traffic you want over Zerotier, but you need to know how to manage it using ZT flow rules together with correct ROS routing and firewall rules. And yes, it works as expected. Have you checked your firewall and the logs for OSPF LSA messages? Have ...

Larsa

Just a tip, @unlikely: make a full network topology diagram, do a complete export, start packet sniffing, turn on OSPF logging, and if you still think there’s a bug somewhere, send everything over to support. But I still don't get why you're insisting on using L2 instead of just doing it the normal ...

Larsa

@xrlls, you should probably open your own thread since it gets complicated when mixing two different use cases in the same thread.

Larsa

@Amm0; Yeah, exactly. It might be something as simple as a firewall blocking the LSA packets. If they sniff the packets and turn on OSPF LSA logging, they should be able to figure out pretty quickly what's actually going on.

Larsa

Absolutely, completely agree!

Larsa

@xrlls, like I told @unlikely, there’s no way to give you a real answer because you haven’t shared a full network topology or explained what you’re actually trying to do. From what I can tell, it sounds like you’re a bit unclear on basic L2/L3 networking. Maybe @Amm0 can help you out here.

Larsa

@unlikely: There is no way to give you a real answer because you have not shared a complete network topology or explained your actual goals.

Without that, any suggestion would be pointless guessing.

Larsa

Since MT already uses Confluence/Jira, they can just publish a link to each page that automatically creates a ticket with a comment. There are also both free and paid add-ons that can create visible comment sections, kind of like the ones you see on Microsoft’s help sites.

Larsa

@unlikely, I get what you are saying about using ZeroTier as backup and your WireGuard links not needing static neighbor setup. BUT still, the same idea I mentioned to @xrlls applies here. If you already have ZeroTier in the mix, running OSPF on top is just extra work without any benefit, quite the ...

Larsa

@xrlls, I think I get your reasoning, but I also think you are unnecessarily complicating things. If you're already using ZeroTier, then running OSPF on top of it is simply redundant. ZeroTier can fully handle dynamic route distribution and failover without needing a separate routing protocol like O...

Larsa

I'm pretty convinced they are using something like Lex/Yacc or Flex/Bison, so it should extremly easy to put together a BNF. You really have to wonder what the actuall problem is, right? Another major issue, as you pointed out, is the amount of unclear information, outright errors, and missing detai...

Larsa

Yeah, it’s probably because MT picked some cheap or freebie version that can’t really handle much, like Gemini 2.0 Flash-mini or similar. ;-) They could have at least trained their own model with BNF or similar first, so we wouldn’t have to deal with all the nonsense answers (hallucinations). But li...

Larsa

I mean some of the routers partecipating in OSPF are connected all to the same ZeroTier network / L2 domain, so brodcast mode should be possible. But every routers also belongs to other networks. Thanks for the clarification. I get that OSPF can work over the shared L2 domain, but that still leaves...

Larsa

What I don't know is whether AI understands the syntax of the language and therefore can write any new code. All AI models fully understand formal syntax descriptions for scripting languages, like standard BNF ( Backus–Naur Form ) and similar. The real issue is that Mikrotik has never bothered to p...

Larsa

Do you get the same result with Google's speed test (just Google "internet speed test") when you're plugged directly into an Ethernet port?

IMG_2908.png

IMG_2910.png

Larsa

@Amm0; Last I checked, Balticnetworks and Wavonline still had a bunch of RDS2216 in stock. Otherwise, you could import directly from the UK/EU/Lithuania, where I think tariffs are still around 10 % (at least for a couple of months more). If you order it from Lithuania, the seller should remove the 2...

Larsa

Mikrotik ROS v7 is currently missing some TE features like fast reroute and link/node protection. I'm just guessing here, but that might be why the TE tunnels don't react properly to the OSPF LSA messges and recover on their own.

Larsa

If you read reasonably carefully, you’ll probably notice that DBC is really just a collective term for a wide range of use cases and protocols, which you can find in the project links for the protocols I mentioned in my previous post. In other words, there is no fixed way to define DBC in terms of w...

Larsa

You can start by reading these and then come back here if you have any futher questions. Mikrotik Help > RouterOS > Bridging and Switching Mikrotik Help > RouterOS > Bridging and Switching > Switch Chip Features Mikrotik Help > RouterOS > Bridging and Switching > Switch Chip Features > Private VLAN ...

Larsa

@syadnom, just curious but is there a particular use case you have in mind for this?

Larsa

The OP said " OSPF over a ZeroTier L2 domain (so mode broadcast), " which sounds a bit contradictory. OSPF is basically a L3 routing helper, so I don't get how Layer 2 fits into the picture after reading the thread. I can understand running OSPF on one of the nodes to expose the ZT network...

Larsa

Haha, classic! Ah yeah, the ol vacation tech support package – been there, fixed that, didn’t get a t-shirt!

Larsa

There is absolutely no distinction in the type of devices used by ZeroTier. It can be ten smartphones or ten routers connecting the same number of subnets. What matters is the number of activated devices listed in the management console. Also, there's no such thing as a "controller route count&...

Larsa

It is extremely extremely extremely difficult to make any modern Windows "shut up" on the network, and this has been true since, gosh, XP? Vista? So darn well near 2 decades, at least. If random ARP requests from the host PC broke Netinstall, then it wouldn't even be possible for it to wo...

Larsa

ZeroTier doesn’t have visible “routes”, just virtual networks and devices/routers associated to a virtual network. Since last year, new free accounts get 10 devices/routers total, while older accounts had 25 (still valid). Extra licenses are very cheap. When someone asks about OSPF or other routing ...

Larsa

Just curious, but why even bother using OSPF on a Layer 2 network? Even using OSPF with IP seems kind of weird since all internal routing is already built into ZeroTier, right? Maybe I’m missing something here...

Larsa

Here are the same exports in code blocks # 2025-04-17 20:43:26 by RouterOS 7.18.2 # model = CRS312-4C+8XG /interface bridge add admin-mac=08:55:31:B1:9C:96 auto-mac=no comment=defconf name=bridgeLocal \ port-cost-mode=short /interface ethernet set [ find default-name=combo1 ] advertise="1G-base...

Larsa

Any particular reason you need to upgrade to v7.18 when everything’s working fine with 7.16?

If you really do need v7.18 and you’re sure you’ve run into a bug, I’d recommend reporting it to Mikrotik support. You could always try the classic Windows trick, a reboot.

Larsa

Alright, then I’ve probably misunderstood what you’re looking for. Anyway, here’s how you enable OSPF logging: " /system logging add action=memory topics=ospf,!packet ". With this setting, you should be able to track both inbound and outbound OSPF LSA messages without being flooded by low-...

Larsa

Check if the default route you see is actually comming from OSPF using ”routes print where ospf”.

If so, enable OSPF logging (without packets, i.e. !packets) to trace the sender.

Larsa

Yeah, it’s unfortunately more common than you might think, especially at small and mid-sized facilities designed by “old-school PLC guys” who lack basic networking knowledge.

Larsa

No, that's just for the CS-series (EIP2 and EIP21S). Most Omron PLCs with built-in TCP/IP support use DHCP nowadays. Gateways, Modbus adapters, and Sysmac controllers require manual configuration using Sysmac Studio or CX-Programmer via USB.

Larsa

@chaosinc; Much better! Just a few quick follow-up questions and suggestions to make the diagram easier to follow: Which VLANs are the different subnets actually connected to? To make the diagram clearer, I’d suggest labeling each subnet with its corresponding VLAN ID right where it applies. For exa...

Larsa

@chaosinc; And since there is no internet connection where you would normally use the term 'WAN', I suggest using ' PLC LAN ' and ' Management LAN ' to describe the different subnets. As @lurker888 pointed out, create a simple but complete network topology that includes IP addresses for all subnets ...

Larsa

All PLCs with TCP support that I’ve worked with allow basic network settings like dynamic or static IP address, subnet mask, DNS, and default gateway. What brand are you using in this case?

Larsa

Thanks, but is there anything new here for @chaosinc to consider, or did I miss something? Anyway, we had a thread about a similar setup for a production plant last year. I’ll see if I can dig it up.

Larsa

@gosha; Managing hundreds of manual tunnels is a nightmare without proper enterprise-grade network management tools. If your Mikrotik routers are ARM based, I strongly recommend checking out ZeroTier that is part of ROS v7. It supports Layer 2 bridging and can scale to manage hundreds or even thousa...

Larsa

Makes sense and I agree that the pattern might indicate something is off with how those models (or a specific ethernet PHY) handle certain flow conditions. That said, it's probably a wise idea at this point to file a bug report with support, and providing a sniffer trace would probably be a good ide...

Larsa

@codelogic; FWIW, most FTTH providers use a soft-cap with line speed set to max, meaning that buffering and traffic shaping are handled upstream in the distribution network at the POP switch.

Larsa

Just to add a few details to what @CGGXANNX explained so clearly. TCP congestion control is indeed smarter and more adaptive, but it only begins to work once packets are actually received by the TCP stack. If frames are dropped earlier due to buffer overflows and the router ignores incoming pause fr...

Larsa

dst-nat only changes the destination address, so when a packet from your laptop (say 10.0.80.50) hits 10.0.80.201, Mikrotik forwards it to the TP-Link at 192.168.250.1, but the source IP still remains 10.0.80.50. If the TP-Link doesn't have a proper gateway or route to 10.0.80.0/24, it won't know wh...

Larsa

Hello @chaosinc and welcome to the forum! The issue is likely that your TP-link doesn't send return traffic back through the Mikrotik, probably because it lacks a proper default gateway or a route back to it. If you can't fix it, you'll need to use src-nat or masquerade on the outbound traffic from ...

Larsa

Yeah, with how slowly the bgp/mpls stuff is getting sorted, it seems they're short on resources in that area..

Larsa

Well, considering you haven’t received any feedback at all, it’s unlikely there’ll be any fix or addition in v7.19, and certainly not in v7.20 either, so what’s the point in trying to rush the closure of v7.19? Btw, are there any threads describing your issues? Would be interesting to read what you’...

Larsa

That's what v7.19.1, v7.19.2 and 7.19.x is for @merkkg: Only if you have an active issue involving existing functionality in v7.19 that has been confirmed by support. Otherwise, you need to request access to v7.20 for internal testing, provided that support has confirmed your request for new functi...

Larsa

No, please don't rush v7.19. Instead, prioritize stability for everyone’s sake. @merkkg, if you have a business case, request access to v7.20 for internal testing.

Larsa

@horasjey, why not post it here, so others can make use of it as well?

Larsa

Yes, since tagging happens at the interface level, through the VLAN or bridge setup. The router first checks the routing table to figure out which interface to send the packet to, and that interface (like vlan50) adds the VLAN tag to the outbound traffic.

Larsa

The simplest approach is probably to go with regular routing: 1. In the Zerotier's management console -> Network Management -> Managed Routes , add 'destination' 10.252.0.0/24 'via' 10.10.10.3 2. On Router 3, add: ' /ip route add dst-address=10.252.0.0/24 gateway=vlan50 ' If you want multiple vlans/...

Larsa

Just to be very clear: the WireGuard protocol requires that the destination address of the initial handshake request MUST match the source address of the initial handshake response , otherwise the session will be dropped. If the handshake succeeds, then it is fine for the address to change, and Wire...

Larsa

You're probably getting the "no policy found/generated" error because a dynamic policy is missing. In road warrior setups like the one you're trying to set up, you normally use a policy template. Try adding a new or modify the IPsec policy with the "Template" option checked (Poli...

Larsa

WireGuard’s philosophy does not mean much unless there is a real issue to solve. If you are referring to a solid issue, like reply packets going out through the wrong WAN interface and the client rejecting them or something similar, could you please clarify what exact behavior you are seeing or refe...

Larsa

If you're trying to catch hammering offenders, it might be best to use a firewall filter with "psd" or alternatively log the handshake source IP using a script tied to interface monitoring. Just be careful not to lock out legit IPs by mistake. Always have a protected OOB management entranc...

Larsa

Just a thought, even if you’ve uploaded the new cert, maybe IPsec still using the old (expired) one. One way to make sure is to remove the expired certs and then check the ipsec settings.

Larsa

...The problem is not with initial handshake where wireguard responds. But with subsequent packets were wireguard initiates the sending. Do you mean the subsequent packets from the clients after they’ve connected to the WireGuard server, or are you referring to when the WireGuard server sends traff...

Larsa

Just to be clear, my post was about fast path via nf_flowtable, not L2MTU. Different features and different context. The idea that MT would deliberately replace or downgrade standard fast path functionality already present in the kernel and supported by current and future mainstream drivers is hard ...

Larsa

Since when does EOIP have a handshake, I use EOIP within a wireguard tunnel LOL, not outside of it. That's exactly what I was wondering about, especially with that packet capture @lurker888 posted with interface "eoip-wan2" as in: "0 3.736 rx eoip-wan2 192.168.33.1:13231 192.168.112....

Larsa

@lurker888, does EOIP really have the same handshake issue as WG, like I described above?

Larsa

@hannesclp; You could tag internal routes in BGP and filter based on that when redistributing into OSPF, but as StubArea51 pointed out, you’re running into a classic design challenge. Instead of trying to filter millions of routes on R1 and R2, I also think the best solution is to separate network f...

Larsa

Haha, I wouldn’t have asked if I had already tested it. Either way, I agree it’s strange they haven’t made use of 'fwmark' to send the initial handshake response back out through the same interface it originally came from. IMO, the WireGuard implementation in ROS v7 is still flawed in that respect.

Larsa

It’s already part of standard Linux NIC drivers. Fast path (Linux Flowtables) is built-in functionality in modern kernels since 5.1. More details here: viewtopic.php?p=1137088#p1137088

Larsa

I got this info from a friend I met this weekend. Support for " fast path " (aka Linux " flowtables ") is standard functionality in Linux kernel 5.6, which is what ROS v7 runs on. Flowtables were introduced around 2017/2018 with full user-space support in Linux 5.1 and use relate...

Larsa

Okay, but have you actually tested the "hard down" theory? Anyhow, we still use routing rules, which we consider clean and easy, and they work with MACVLAN too. And we'll keep using this approach until Mikrotik fixes the issue where the initial WireGuard handshake always leaves through the...

Larsa

Exporting your config to share in the forum is actually pretty easy. Here's a quick step-by-step guide on how to do it: viewtopic.php?t=203686#p1051720

Larsa

@ehbowen, fixing the export is actually pretty easy. Here's a guide on how to do it: "How to export your Mikrotik config and share it (Step-by-Step guide)"

Larsa

@ehbowen; Yeah, remote access over WireGuard can definitely be a bit tricky to get just right. Here are a few key things to check: 1. Since remote management like Winbox targets the router itself, you need to explicitly allow that in the firewall "input" chain for each router. For example:...

Larsa

I really don’t mind which one is considered the “correct” solution, as long as it works. But feel free to do a deeper analysis of the different options with their pros and cons.

Larsa

You're running into two pretty common IKEv2 issues: - " no policy found/generated " This usually means the router can't generate a matching IPsec policy. Check your peer, identity, and proposal settings. Make sure remote-id and my-id on the Mikrotik match what's coming from the StrongSwan ...

Larsa

@dante4; DCB is just a very vaguely defined umbrella term that says absolutely nothing about the underlying QoS protocols. If you're wondering how Datacenter QoS protocols like ETS, PCP/PFC, AQM, DCBX, or CN are implemented in RouterOS v7, check out the Mikrotik docs, for example the links below: ht...

Larsa

Nah, we're just asking for the mainstream core functionality to be present in MPLS, BGP and OSPF, and for it to actually work.

Larsa

Since you're not acting as an ISP and the BGP session is only with your colocation provider (as your default gateway), you can skip BGP and just go with OSPF for internal routing. Turn on BFD for OSPF to get quick routing failover, otherwise you'll be stuck with the default 40-second delay. You can ...

Larsa

Just a quick follow-up question: why use both BGP and OSPF?

Larsa

That was a pretty broad and general question.

More specifically, what exactly are you wondering about?

Larsa

Yeah, that ghost nexthop might actually be a clue. It usually shows up when the router knows about the route but can’t resolve the next-hop inside that VRF. Most likely, it's because the next-hop isn’t reachable from the guest VRF. That could be why the Azure route isn't showing up properly. Try res...

Larsa

...ROS versions where they supposedly fixed the issue, i.e. that WireGuard’s initial handshake is going out via the default gateway instead of the inbound interface. Might’ve been mentioned in this or the other big thread on the topic. @Mimiko, I found the post. Turns out it was @lurker888 who ment...

Larsa

And multihop and nexthop-choice are configured on the Mikrotik?

Larsa

Unfortunately, MACVLAN still needs either routing rules or @Sindy's NAT trick to work properly.

Larsa

@Mimiko, your only options are either routing rules or NAT, unless you’re on one of the newer ROS versions where they supposedly fixed the issue, i.e. that WireGuard’s initial handshake is going out via the default gateway instead of the inbound interface. Might’ve been mentioned in this or the othe...

Larsa

This is just a user forum. Please report bugs directly to MikroTik support: https://mikrotik.com/support

Larsa

@Josephny, please listen to BartoszP's advice — they're legit. My recommendation: don’t use an external DNS server for your local needs and private addresses (for a bunch of different reasons)

Larsa

Did you read the blogs, and have you also checked how multihop and nexthop-choice are configured on your MikroTik?

Larsa

No need for public A records if you run your own internal DNS server with a split DNS setup. You can map a domain like mqtt-ha.mydomain.local (or whatever) to 10.100.0.1 and have all your IoT devices point to that DNS server. It’s best practice in setups like this and is simple, reliable and fully u...

Larsa

One thing you could try is adding a RAW rule to see if those fragments even hit the router’s CPU. RAW is processed before conntrack or filters, so it might be a good way to check if something’s silently dropping them early. Use something like this: " /ip firewall raw add chain=prerouting fragme...

Larsa

I might’ve missed or misunderstood something, but here are a few quick follow-up questions: 1. Is the Azure route (10.130.0.0/20) completely missing in the guest VRF, or is it there but inactive? If it’s inactive, it could be due to an unreachable next-hop or a higher route distance. 2. Are you usin...

Larsa

True word or gossip?

As Amm0 mentioned, check out the latest RFC as they’re working on now: RFC 9759 – Unified Time Scaling (synchronizing timers for MPLS). 😉

Larsa

Ah, but of course, I totally missed that screenshot detail, good catch!

That clears it up then. The connectivity issue clearly has nothing to do with that, so yep, looks like it was just a red herring.

Larsa

please don't scare me, I got 8 BGP connections and a AS on a CCR running 7.15 since July I think and just considering to update and saw this :P

We’re still on 7.15 and won’t upgrade until there’s a long-term version with at least three patch releases.

Larsa

It would also be valid to ask why input src-nat is omitted from the official packet flow diagrams by Mikrotik, while being fully and correctly supported.

Yeah, that question has come up a few times before. Personally, I think those packet flow diagrams have a lot of room for improvement!

Larsa

Hello @thomasz and welcome to the forum! Yes, both the RB5009 and L009 can handle this setup just fine. You can create two separate networks (either using VLANs or by assigning different ports) and connect each mesh system to its own network while still sharing the same internet connection. The RB50...

Larsa

@lurker888: Great summary! Just wondering, why go with a bridge instead of assigning the addresses straight to the wg interface in this case? @Mimiko: You’ve probably already thought about it, but just a heads-up that each client still needs a unique public key in a separate peer entry, otherwise Wi...

Larsa

Just a thought, and maybe I'm missing something, but can't you give full access just between the Chromecast and Streaming Host 1?

Larsa

It seems you're running into a weird issue caused by multiple RA ULA prefixes being advertised on the same network. Your Mikrotik is advertising fd9d:..., but your Apple TV is also sending out RAs for fdf7:.... Devices like Home Assistant, the Apple Home app, and the HomeKit bridge might end up usin...

Larsa

Okay, but first try to explain what you're trying to accomplish without using too many technical terms.

Larsa

I want my router public ip address to be always that from nisp - regardless if aips is in use, my public ip should be that from nisp. That won’t work, unfortunately. You can’t use the public IP from nisp while sending traffic through aisp, since they’re on different networks and ISPs only route IPs...

Larsa

It works. With routing rules, you force outbound traffic to use a specific egress interface, which automatically sets the source address to that WAN’s IP. But you can also use the Sindy NAT trick: "/ ip firewall nat chain=dstnat dst-address-type=local in-interface=WAN2 protocol=udp dst-port=wg-...

Larsa

Have you tried policy routing using routing rules, with separate routing tables for each WireGuard instance?

Larsa

It might actually happen sooner than you'd expect. Word is Mikrotik has recently brought on about 15 people, supposedly working full-time on developing business-oriented features.

Larsa

Mikrotik’s known VRRP’s been broken for a few releases now, but why it’s still not fixed is anyone’s guess. Still there in v7.19, apparently.

Pretty remarkable that a mission-critical HA (high availability) feature isn’t fixed right away, if you ask me.

Larsa

Anything about the VRRP bug yet?

Larsa

Hi @kanwhoa and welcome to the Mikrotik user forum! Thanks for the detailed post but a few things are a bit unclear though: You mention "full access between all bridge ports", but also describe firewall filtering between trusted and untrusted bridges. That sounds contradictory unless you m...

Larsa

Great, that means Mikrotik has at least acknowledged the issue. The next step is to push the matter further and raise awareness in the two release channels that are currently active: v7.18.2 [stable] is released! v7.19beta [testing] is released! Post a short description of the problem, like in this ...

Larsa

@kryptonian; this is most likely coming from an Apple device on your network. Apple HomeKit/Thread devices (especially early builds) can accidentally leak IPv6 prefixes via RA, like the 2103::/64 you're seeing. It’s not intentional, but it's a known quirk that’s been brought up in IPv6 and HomeKit d...

Larsa

@jojorock If you really want help figuring this out, you need to be a lot clearer about what’s actually working and what’s not. Right now, some of what you're saying just doesn’t add up. You say the router isn’t even connected to the internet, has no local IP, no DNS, no DHCP… but then you show an a...

Larsa

You have three L2TP clients enabled at the same time, all set to add-default-route=yes and dial-on-demand=yes. That creates multiple default routes which might cause unstable behavior, especially if another tunnel is added on top of this. The output from "ip route print" confirms it: 0 ADS...

Larsa

@eomcsqwipik: Once you’ve cleaned up your firewall, or preferably reset the entire router to factory default settings, and still see abnormally high outbound traffic, my guess is that you might have a compromised PC on your LAN that’s part of a botnet. P.S. Never, ever open any ports from the router...

Larsa

I just glanced through your config very briefly and might be totally off or missing something here, so take this as a guess but it looks like both delegated IPv6 prefixes are being advertised on all VLANs. You're assigning one prefix to vlan10-lan and another to vlan20-iot, but the default /ipv6 nd ...

Larsa

@jojorock; as @tdw pointed out, the DAC route is expected since it's created by the VPN tunnel. The remote and local IPs (i.e. 10.64.64.105 and 10.112.112.153) are assigned by the VPN server and the client might have limited control in this case. To figure out why the connection drops, here are a fe...

Larsa

If you haven't already, please report it to Mikrotik support (this is just a user forum).

Larsa

Hi @FrancoisBellec and welcome to the forum! Azure usually requires EBGP multihop (typically TTL=255 for GTSM). Make sure multihop is enabled for the Azure peer. Routes might not be propagated across VRFs if the next-hop remains unreachable. It might also be worth checking if the Azure routes are ac...

Larsa

Hi @Ishe and welcome to the forum! Are you running ROS v6? I'm not entirely sure, but I think ROS v6 had some issues with IP reassembly back in the day. Also (and this is just speculation) I vaguely remember reading somewhere that if fast-path was enabled, fragmented UDP packets might get dropped or...

Larsa

What makes you think starting a v8 branch would change anything? IMO (and just speculating here) MT would really benefit from reorganizing and establishing an R&D department dedicated specifically to enterprise networking. Of course, priorities and development direction naturally depend on their...

Larsa

Hi @Turmoil3489 and welcome to the forum! Firstly, not all SFP modules are automatically compatible with Mikrotik devices. Please check if your module is on Mikrotik’s official compatibility list or is known to work with RouterOS. Incompatible or high-power modules may either not show up at all or r...

Larsa

It's likely caused by newline or whitespace characters in the output returned by ssh-exec. Even if the visible result is '1', the actual string might include hidden characters like '\r' or '\n', which would explain the length of 3. The built-in :tonum doesn’t handle end-of-line characters well. You ...

Larsa

Yeah, your first rule is enough i.e. you don’t need to create each port mapping separately. When you omit the to-ports parameter, Mikrotik ROS automatically assumes that the destination port on the internal IP (in your case, 192.168.81.108) should be the same as the one on the external request. So: ...

Larsa

Yep, just predefine topic=dns and enable it when needed. It might still be a good idea to create your own action=DNSLOG. That way, you can easily filter out just the DNS requests once logging is enabled.

Larsa

Hi Alex and welcome to the forum! From your description, it sounds like you're running ROS v7 on a Mikrotik HeX (RB750Gr3) on the local side, but just to confirm, is the remote side a Bintec RS353? If so, that means there's only a Mikrotik device on one end of the IPsec tunnel, correct? That might b...

Larsa

Your device might be hacked!

Larsa

I just don’t get why they still go with only 16MB. Not exactly future-proof, if you ask me. If you look at the cost for 32MB, the difference is basically pocket lint. The only explanation I can come up with is that they’re sitting on some massive warehouse full of 16MB chips they’re desperately tryi...

Larsa

@infabo: Not the new LMP 5G that was announced with just 16 MB of storage(!)

Larsa

I was hoping there would be a simpler way to see the DNS requests passing through my router. It's actually pretty easy! Just create your own logging action (output), for example called DNSLOG , and then add a logging rule for DNS requests using that action. After that, check all DNS requests by ope...

Larsa

I don’t mind paying a bit extra for enterprise-level functionality. This could serve as an additional revenue stream that helps fund continued development and support, especially with a focus on advanced functionality for businesses and service providers.

Larsa

.. I am able to venture that perhaps MikroTik will have to think about different Software and Firmware (Routerboard) for the same hardware for different applications. ... If the fight to split the main software package is already big, imagine thinking about multiple flavors of firmware? It's going ...

Larsa

Are you referring to MPLS L3 VPN RFC 4364, a generic IPv6 VPN RFC 4213, or tunneling methods like those in RFC 2473 or 2784/2890?

If you’re talking about MPLS, there are plenty of other mainstream capabilities I’d prefer to see implemented as well like EVPN, SR, TE and OAM.

Larsa

Hard to say exactly what’s going wrong, but an easy way to troubleshoot is to run "/system telnet" from a router that's having issues. This guide shows how to Testing SMTP using Telnet . It’ll let you see where the SMTP process is failing and should give you a proper error message in plain...

Larsa

That's an even better alternative! Makes sense to balance the load and get the most out of both routers/providers while still keeping failover in place.

Larsa

If you're sending on behalf of "<user>@<myowndomain>.com" from a new IP address that isn’t part of Google Workspace’s infrastructure, you’ll need to manually add that IP address to your domain’s SPF record. Otherwise, Google (and other receivers) may reject or flag the message as unauthori...

Larsa

Just a quick follow-up to clarify: A Google app password usually works fine out of the box for regular Gmail addresses (like xxxxx@gmail.com). But if you're sending from a custom domain (like xxxx@yyyyy.com), it won’t work unless a proper SPF record is set up for that domain.

Larsa

Just to add to what's already been said: Google has become much stricter to prevent spam and abuse. An AUTH failure might not only mean wrong credentials. It can also happen if the sender is not authorised to send on behalf of the domain used in the "MAIL FROM:" during SMTP. Make sure the ...

Larsa

I think option 2 might be cleaner and easier to maintain, especially with multiple VLANs. Fewer VRRP instances means less config overhead. Plus, tying VRRP directly to the main bonded interface ensures proper failover behavior. Unless you have a specific reason to isolate each VLAN with its own VRRP...

Larsa

To me, the key question still is: Does FastPath require a hard dependency on patched drivers, or can ROS use skb with standard hooks? Yes, of course. That's what we are discussing. Yeah, but you forgot to add my mighty conclusion: I’m still convinced it’s the latter — meaning this can be abstracted...

Larsa

It sounds like there might be some kind of misconfiguration. If you're absolutely sure everything is set up correctly, I’d recommend reaching out to support for further assistance. I don't have the time or resources to set up a test environment to check this for you, I hope you understand. A few add...

Larsa

/disk test utility clears caches before running tests. Just a quick follow-up on the cache clearing part: even if /disk test flushes some caches before the run, that doesn't necessarily eliminate caching effects—especially in short burst tests where you're still likely to hit RAM-level buffers or c...

Larsa

Just a quick note on the short bursts: those are most likely hitting cached data rather than reflecting sustained transfer speeds from storage to user space. The comparison to dd might be useful for Linux users, though both tools are fairly synthetic and don’t always reflect real-world I/O patterns....

Larsa

Hey, good points and nice digging! It’s fair to point out that Mikrotik has patched drivers, as you mentioned with L2MTU — but that was mostly with ROS 6.x. When ROS v6 was built on Linux 3.3.5, there were quite a few limitations around L2MTU handling, both in the networking stack and in many driver...

Larsa

My take: Honestly, I think “ interface driver extension ” most likely refers to using something like the skb->cb[] control buffer to tag packets internally. That buffer is explicitly designed for storing temporary, per-packet metadata and is commonly used by various subsystems (including Netfilter a...

Larsa

@NathanA: Fastpath and Fasttrack generally speaking do NOT work on x86....however, both of these features require specific support to be added to the network interface driver (ethernet chip, etc.). Do you know how it actually works under the hood? My guess is that Mikrotik uses their own skb attrib...

Larsa

I just realized I wasn’t clear enough. I meant running a disk speed test directly on the RDS2216 inside a container, if that’s possible.

Larsa

Would be interesting to see the same tests run directly on the RDS2216. Any chance you could give that a try?

Larsa

Thanks for great feedback and for sharing your hands-on experience! Looking forward to seeing what you come up with next.

Larsa

Normis, if Mikrotik is still serious about developing a storage solution, it might be more practical to offer it as an add-on "install package" using one of the well-established open-source storage platforms rather than building a proprietary system from scratch. I strongly advise against ...

Larsa

Some troubleshooting tips: Enable BFD on all links to get a fast response when toggling links or making other changes. Set up OSPF logging on all routers to check if they are sending and receiving proper LSA messages. ( /system logging add topics=ospf,!packet action=memory ). If you can't spot inbou...

Larsa

The following recommendations are general since you haven’t described the overall topology of the solution. With over 500 subnets, I’d definitely consider using multiple OSPF areas, particularly Stub Areas or NSSA for your LTE links if they are not part of a transit path. Use area summarization at A...

Larsa

Putting lipstick on a pig but since someone called it "Kermit the NAS," I guess it’s more like putting lipstick on Miss Piggy! 😉

Larsa

No need to use multiple areas, loopback interfaces, Stub, NSSA, or filters. In your scenario, just use a single area, and costs will work as expected. (Routing->OSPF->Interface Templates)

Larsa

Normis, thanks for the reply and details on existing features. But let’s be real here—while these are basic storage functions , they’re nowhere near the administrative tools that actual enterprise (or even small office/home office) NAS solutions provide. Restructuring – More than just RAID Restructu...

Larsa

Managing storage requires administrative tools for restructuring, error handling, and backup/restore. All of these are missing in ROS. In other words, this solution is not suitable for mission-critical applications.

Larsa

Thanks for the feedback!

Anyone know if it's only web-wwl that works with automatic renewal of LE certificates using the DNS-01 challenge, or if it will also work for IPsec and cloud domains (ie, "type=cloud-dns")?

Larsa

Just for the record, in case this wasn’t reported to support: The Let's Encrypt DNS-01 challenge has stopped working. Ref: viewtopic.php?p=1133904

Larsa

Just for the record, in case this wasn’t reported to support: The Let's Encrypt DNS-01 challenge has stopped working. Ref: viewtopic.php?p=1133904

Larsa

It is. And actually worked without port 80 open when I first issued the certificate with type=cloud-dns. This was introduced in 7.16. But maybe is broken now. I dont know.

Yeah, sounds like a bug to me. Maybe someone should open a ticket or mail "support@mikrotik.com" about it.

Larsa

I thought the whole idea of the Let's Encrypt DNS-01 challenge was that it doesn't require port 80 at all. Have I missed something?

Larsa

@wispmikrotik; This is just a user forum. You should get in touch directly with Mikrotik sales at "sales@mikrotik.com" or their support team at "support@mikrotik.com" for official information and assistance.

Larsa

@wmeibers: XFRM has been a standard part of IPsec since Linux 2.6, which was released in December 2003.

Larsa

Unfortunately no wireless or anything else, just plain CHR.

Larsa

Well, congrats on guru status! Now, the real test: What’s the meaning of life?

Larsa

GNS3 is like ROS, pretty easy once you connect the dots!

It runs just as well on Windows Hyper-V.

Larsa

Yeah, I feel you. Times are rough, so enjoy all your slaps while you can!

Larsa

@anav, you gotta forgive me, but that was seriously hilarious!! ROFL

Ps..
@anav, you officially have 10 slaps reserved!

Larsa

I just built an Ampere 80-core 3GHz machine and, now that I came across this thread, I'll be testing 40Gbps NICs, and eventually 100Gbps (if I can justify the expense; have zero need for it yet). You don’t need an 80-core 3GHz CPU to handle 100Gbps! Less than 16 cores are enough with proper NIC acc...

Search found 2194 matches