MikroTik

Larsa

@k2dI5umrD9VO: As I tried to explain earlier, since the issue originates from your iOS device, you should contact Apple Support and let them handle the matter accordingly.

I mean, if it worked with iOS 17 but not with iOS 18, you can’t blame MikroTik for it, can you?

Larsa

Link to Driver Log TXT-File from Macbook: https://1drv.ms/t/s!AsOJquxuP-h5hewWtvJA2Rp3Tq-XGQ?e=yTxxJA Just a suggestion; when sharing a log this big, try giving a hint about when the issue happened so people know where to start looking. Also, this log is primarily meant for the Apple Developer foru...

Larsa

Hey folks! Want to know what's really going on when your Apple device is having Wi-Fi issues?? If YES , then check the wifi logs on your DEVICE : 1. iOS Profiles and Logs Wi-Fi for iOS/iPadOS Instructions Profile 2. macOS Profiles and Logs Direct link: Wi-Fi Logs For macOS Wi-Fi issues, please foll...

Larsa

What do you mean by mixed languages? @erlinden: Sorry, I meant to say regional settings. The same company that added deliberate slowdowns to older hardware and it still surprises you? What do you think MS is doing with their Co-Pilot story? Same purpose—push hardware sales (MS license will come wit...

Larsa

Like I said earlier, it's an intermittent issue with Apple iOS 18. And honestly, why waste time with pointless trial and error when you can just check the device Wi-Fi logs to find the real problem faster?

Larsa

Yeah, forgot to mention we're using 7.15.3 with FT enabled. I remember some Apple devices (at least in the past) could have issues with mixed languages on APs within the same SSID domain. Anyway, troubleshooting Wi-Fi on Apple devices can be pretty tricky so instead of wasting time with trial and er...

Larsa

Alright, I’m not sure then. You could check the iOS Wi-Fi logs to find the cause, or if all else fails, roll back to iOS 17.

Look for the section “Wi-Fi for iOS/iPadOS” in iOS Profiles and Logs

Larsa

Did you try forgetting the network and then reconnecting, or is that when you ran into another issue?

Larsa

I had the same issue and I fixed it by following a suggestion I found on Reddit: just disable the private address, forget the network, reconnect, and then re-enable the private address again. Anyway, no one seems to know exactly why this happens with iOS 8.

Larsa

@k2dI5umrD9VO: It’s not related to ROS. This is a known issue with iOS 18 (and also in the previews) but no one has figured out the root cause or how to fix it: https://www.google.com/search?q=%22iOS+ ... reddit.com

Larsa

The issue isn’t with ZeroTier itself but rather the MikroTik implementation which is flawed due to using an older version (v1.10.3) with various bugs and lacking the ability to configure standard ZeroTier features such as custom root servers, multi-path, trusted-path, allow DNS, etc. ZeroTier can ha...

Larsa

we are planning to setup hub and spoke network using Mikrotik and ZeroTier. As a start there will be 500-2000 spokes. And in the next following years will growing up, total it will have up to 30K spokes. ZeroTier is a full-mesh SD-WAN that automatically utilizes point-to-point connections when at l...

Larsa

Many users request return of the Tabs to the top bar. One of my colleagues has nice idea - most of the time, you only work with few selected tabs. So what about an icon in the drop-down list, to open a Tab in a new Window, would in fact pin the Tab to the top bar instead? But of course! That way, e...

Larsa

Exactly my point!

Larsa

The detached window feature would make sense if there is only one Winbox instance running at a time. Since mostly several Winbox instances are running, detaching windows would create even more usability issues. Well, maybe for inexperienced people who don't work with networks and aren't familiar wi...

Larsa

Got it! Please add it to the list for Customer Enhancement Requests. Thanks!

Larsa

Maybe you expect something to happen, that was never intended to happen? This is what is SUPPOSED to happen. As designed: https://imgur.com/a/RwZRKRH Yes, that could absolutely be the case but I suspect there might be some confusion here regarding the terminology. As I tried to explain previously a...

Larsa

Thanks! By any chance, do you have access to the default gateway at 10.20.100.1? If so, could you check if there's a route set up to 10.2.120.0/24 via 10.20.100.15? If it's a MikroTik router, you can run the command: ' /ip/route/print ' and paste the output here. If not, while troubleshooting, we ca...

Larsa

@Normis: That does not make it clearer. The post already shows how to to it. Is there an issue with this button? 1. Yeah, that's correct. There an issue with button. The button shown in the red rectangle below doesn't work as expected. As explained by @STMT: " It is possible to detach the wind...

Larsa

Larsa

Larsa, unclear abut detachment from workspace, can you describe the issue?

You still can't detach a window from the WinBox main workspace and move it around freely on screen. Please check out @STMTs reply here: viewtopic.php?t=210505#p1093920.

Larsa

@normis, could you please add fixing the detachment of windows from the workspace to the list. According to @STMT, this was already provided but currently isn’t working.

Larsa

What's new in v4.0beta3:

*) fix crash on macOS 11

1. I can confirm that v4.0beta3 is working with macOS 11 - thanks! It's blisteringly fast, I must say.
2. Detaching windows from the workspace still doesn't work, though.

Larsa

ROS can't handle any network cards when running as CHR in a virtual machine. You'll need to configure the WiFi card in Ubuntu first, then add it to VirtualBox as a regular network interface.

Larsa

I agree with what @sirbryan says.

Larsa

It's shown in the window title when you're not connected

Great, thanks! 🙏

Larsa

We are trying to find such an old macbook and will test. So far, no help needed, Larsa. Thanks! Most of our field engineers are forced to use slightly older MacBooks (and you can probably guess why) using macOS 12/13 and equipped with Intel CPUs because we need to run a bunch of Windows-based legac...

Larsa

It is possible to detach window if you open the drop-down menu and click the button next to the submenu name Thanks, but that doesn't work for me because the window is still locked to the WinBox workspace (ie the child window is still locked to the parent workspace) Environment: WinBox 4.0Beta1, Wi...

Larsa

Craches on Intel Macook macOS 11.7.10. Tried several times.

@normis: let me know if the developers want a core dump and I'll sort it out.

Larsa

Feedback:
1. A dropdown menu or similar submenu is currently missing for open windows.
2. Add the ability to detach a window from the WinBox workspace.

Larsa

Craches on Intel Macook macOS 11.7.10. Tried several times. Process: WinBox [4220] Path: /Applications/WinBox.app/Contents/MacOS/WinBox Identifier: my.example.com Version: 0.1 (0.1) Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: WinBox [4220] User ID: 503 Date/Time: 2024-08-29 09:37...

Larsa

Since you're using the same subnet as someone else on the Cisco side you'll need to use src-nat. Btw, why not use 192.168.160.0/24 since the Cisco admin already assigned it to you.

Larsa

FYI, BBR needs to be implemented only on the endpoints (eg like web browsers and servers) where data is being sent and received. It does not require any modifications or implementations in the routers or other network infrastructure. The only tunneling protocol I can think of that uses TCP is OpenVP...

Larsa

It works. Use this simple test below where ether1 sends 192.168.90.255 to port 2000 (but any port will do) => dst-nat broadcast => to ether2 as 192.168.80.255. Bridging the two interfaces with a filter that allows udp with an optional port number works just as well. /ip firewall nat add action=dst-n...

Larsa

One of the ends needs a public IP address. If not, you might use ROS BTH (Back to Home) or ZeroTier which can manage without it.

Larsa

So I'm a white fly compared to everyone else? The basics, like blocking spoofing and blocking incoming connections on standard ports, for me is the a-b-c of civilization... Yeah, you're definitely an angel compared to the typical run-of-the-mill ISPs. At most they block like egress smtp and similar...

Larsa

What type of device are you using and what does the dst-nat rule look like? Have you checked with the built-in packet sniffer to see if any broadcast traffic is reaching the interfaces?

Larsa

ISPs don't offer free protection against botnets, DDoS attacks or anything like that. While they probably should provide it as an option for the general public IMO, these services are mainly for businesses and are usually pretty expensive because they require a lot of investment from the provider. C...

Larsa

The option to add your own user-defined root servers (moons) was introduced back in Zerotier v1.2.0 but unfortunately there’s still no way to manage these settings in ROS. You can add the root servers yourself in a private server, container or VPS.

Larsa

Sorry my bad, I forgot you were on ROS v6. Try the commands below. I'm heading home now so I'll get back to you tomorrow. /ip/route/print /ip/address/print /ip/firewall/nat/export EDIT On your workstation, run the following If Windows: netstat -rn && ipconfig If Linux/Mac: netstat -rn &&...

Larsa

Back up the settings with a full export, reset to the default firewall config, and then rerun the tests again. If everything goes smoothly, you can start adding back the queues one by one and check the speed regularly to find the problematic one. Just curious, why all the static IPs and related queu...

Larsa

Could you log in to the router in cabinet 1 and ping any devices in the 10.2.120.0/24 range? Also, run the following commands in a terminal and paste the output here: /ip route print proplist=dst-address,routing-table,gateway,immediate-gw,distance,local-address /ip address print proplist=address,net...

Larsa

Well, L3 multipath/bonding shouldn't be mixed up with MPTCP which was mainly developed as an endpoint (app) protocol to facilitate transparent handover/failover/bonding. Sure, there are some special hacks to use it as a more general communication protocol but that's not very common ie you won’t find...

Larsa

FYI, HGSMII doesn’t have any magical plug-and-play features. It’s basically like other tech that helps manage internal devices. Since it’s just an internal component, you won’t even notice it and it doesn’t communicate with your ISP or anything.

Larsa

Okay, I'll check it out later. Bwt, have you had a chance to try out the new nat rules I posted earlier?

Larsa

Hey @8023, what's your use case?

MPTCP doesn't need any special support in the router itself, it's generally used between the app connection endpoints like from a mobile device or car to a central service.

Larsa

It looks like you might have missed some details in my last post or misunderstood it. Here's what you need to do; start by removing all five lines and replace them with: add chain=srcnat dst-address=10.20.100.0/20 src-address=10.2.120.0/24 action=masquerade add chain=srcnat dst-address=10.0.0.0/24 s...

Larsa

You can use bridge filters (i.e bridge ip firewall ) or just set up a simple dst-nat broadcast forwarding like the example below. Use a specific destination port number to limit the scope of the ip directed broadcast: /ip firewall nat add action=dst-nat chain=dstnat in-interface=ether1 dst-address-t...

Larsa

@Sindy, would you mind taking a look at this: viewtopic.php?p=1092257#p1092239

Thanks in advance!

Larsa

/ip firewall nat chain=dstnat dst-address-type=local in-interface= WANX protocol=udp dst-port= YYYYY action=dst-nat to-addresses=ip.of.wan. PRIMARY That look very generic! ;-) Sorry, I forgot about the OSPF example. I'm traveling for a customer visit for a day or two so it’ll have to wait until I'm...

Larsa

That's what I meant when I asked if it's even possible to create a generic solution that's not port-specific.

Larsa

NAT trick is cleaver.

Yeah, totally! @Sindy, what's you take on dst-nat vs policy routing as a fix for the multiwan wireguard bug? Do you think it's possible to create a generic solution that only affects WireGuard's initial handshake?

Larsa

To be picky, the rejection of the return traffic by the originating device is not wireguard specific its networking common... The problem is that the wireguard programming in RoS is doing something weird.............. in that its bypassing standard routing and rules in RoS.,. Anav, how the security...

Larsa

Yeah, the first WireGuard handshake is like a secret handshake between two routers (Peer A and Peer B) that want to communicate securely. Peer A sends a "hello" (handshake initiation packet) to Peer B which responds with a "hello back" (handshake response packet). But because the...

Larsa

Quick question: is the 8 GB RAM requirement an absolute minimum or is there a chance it could run on a Raspberry Pi 4 with 4 GB of RAM?

Larsa

There isn’t a specific setting, you build it using arp proxy, broadcast forwarding and so on depending on what you’re aiming for. What’s the use case?

Larsa

Yeah, it's doable with ROS but you should be aware that it might be a security risk as mentioned in the Cisco manuals. It’s also disabled by default. What's the use case?

Larsa

Yeah, that was the solution I was thinking of but I had NAT in mind and just didn’t have the energy to figure out a good variation like the one you just showed.

Larsa

Great, perfect with an alternative workaround! Any thoughts on the pros and cons compared to policy routing?

Larsa

Does that fix the initial handshake issue?

Larsa

Basically, the ROS implementation has a bug where Wireguard's initial handshake always gets sent back through the default gateway instead of the interface the traffic came from which makes the connection fail due to a protocol error. And since the handshake isn’t tracked, you can’t use mangle to man...

Larsa

That’s a pretty standard setup. I can post an example next week. Have a nice weekend, cheers!

Larsa

OSPF + BFD with two tunnels/routes (one per channel) is really easy to set up, very robust and provides rerouting in just a few milliseconds.

Larsa

Unfortunately it’s pretty tough to figure out what’s wrong just from a couple of screenshots. Try posting an export of both router configurations and maybe someone in this user forum can help out. Check out this guide on how to export and post your configuration: https://forum.mikrotik.com/viewtopic...

Larsa

Okay, I think I’ve got it! The network drawing is a bit misleading (or is actually missing some crucial info) because it turns out that ether5-gateway is actually connected to the operator network 10.20.100.0/20 and the rest of the PLC network seems to be bridged together as a single 10.2.120.0/24 s...

Larsa

About the somewhat misleading wording "Siemens HMI's through their 3rd party website..." it's not actually an external connection but a web-based PLC operator monitor add-on called WinCC/WebUX.

Larsa

Yeah, that's probably correct but in this instance we're talking about an internal router for PLC process control that isn’t connected to the internet. Unfortunately OP inherited the whole setup so it’s not a great idea to make major changes like upgrading to v7 without first having full control of ...

Larsa

So, cabinet #1 router ether5-gateway ( 10.20.100.15/20 ) is connected to the local device network where the S7 PLC and SIMATIC HMI are, but those devices are using different subnet address like 10.2.120.11 according to the network diagram. This is really getting to wierd for me to grasp and I feel l...

Larsa

dst-address=10.20.104.54 => IP address on the controller network side of the router. If that's the router in cabinet 1, shouldn’t it be 10.2.120.1 ? to-addresses=10.2.120.11 => IP address of the SIMATIC HMI. ie, ' /ip firewall nat add action=dst-nat chain=dstnat dst-address= 10.2.120.1 dst-port=443 ...

Larsa

You can skip "in-interface=bridge-local", you should get a match just using "dst-address=10.20.104.54" and "dst-port=443". Btw, you are sure you can reach 10.20.104.54 by pinging it, which btw I asume is one of the cabinet routers?

Larsa

No worries, I was just curious. Let me know how it goes after you’ve tested it.

Larsa

Alright, let me make sure I’ve got this straight: all the devices on the control network (where the laptop is) are on the same subnet (10.20.x.x/16) connected to the "IDF1 PLC Network Switch" but their IP addresses are organized by equipment type. So, back to the original issue: since all ...

Larsa

2. The laptop is connected to 10.20.101.x where all the computers connect to. It can currently access all the ethernet connected devices on 10.20.101.x through 10.20.111.x (except the 3. Each cabinet has it's own router, they are wired in series like the diagram shows 2. What subnet is 100.20.101.x...

Larsa

I'd like to be able to access the HMI screens in Cabinets 1,2,3 from their web interface like 2 similar Simatic HMIs in our building... 1. Access from where exactly? 2. Is the controll laptop network 10.20.x.x connected directly to the PLC-network 10.20.100.x ie on the same subnet? 3. Is there a se...

Larsa

Check out my previous post.

Larsa

@chilloutalready; If you're trying to connect to modem #2 from your LAN (which subnet is it btw?) you shouldn't need mangle rules. Your 5G devices are already on different local subnets so you just need regular routing. Or is this a problem that only happens when you connect via VPN? How about posti...

Larsa

Hi @chewbo, welcome to the forum! Aren’t the PLC devices supposed to be managed by the controller (HMI) on the internal bus or do you need to access them separately? This is usually done through a separate gateway which sometimes is built into the controller. As for the technician not bringing his o...

Larsa

This seems like a classic case of an XY problem, made even harder to understand due to an overly complicated network diagram and an even more confusing technical walkthrough.

My understanding is that you want all clients from site 1 to route to the internet via site 2. Is that correct?

Larsa

And what role does BGP play in all of this? Is iBGP used for internal routing?

Larsa

If you're accessing your HEX through something like WireGuard you'll always use the same local IP address for the router no matter where you are.

Larsa

You forgot to mention where all your local devices are connected (bridge?). Generally, this can be solved pretty easily with policy routing or routing marks if the devices are on different subnets. What’s your plan for using ZeroTier? Is it for remote access, site-to-site networking, etc? Btw, expor...

Larsa

Alright, dual stack (hmm...). It might be a routing issue since there aren't any replay packets and I don't see any ICMP packets coming in. As a temporary workaround for IPv4, try a source NAT approach using the command below. Just replace ZZZZZ with your ZT subnet and XXXXX with the name of your LA...

Larsa

Can you spot any traffic from the ZT interface to your LAN using the ROS packet sniffer?

Btw, what does the zerotier-cli peer status say?

Larsa

The ZeroTier interface works just like an Ethernet interface. You need to allow and set up proper routing between your LAN and the ZT subnet, or alternatively use src-nat from ZT to the LAN. I assume you’ve already added your LAN in ZeroTier Central > Networks > Advanced Settings > Managed Routes.

Larsa

And there is also SNMP: https://help.mikrotik.com/docs/display/ROS/SNMP To get multiple values using the rest api, use for example curl: https://forum.mikrotik.com/viewtopic.php?t=184113 https://new.reddit.com/r/mikrotik/comments/11fvtkj/how_to_get_current_link_rate_via_api_call/ There are plenty of...

Larsa

We are creating the docker-compose file and the installation will be changed soon…

Hi, please let us know when it’s ready to be tested.

Larsa

Since CHR is running as a guest virtual machine it can’t access the LTE/NR device directly through ROS. This means device management has to be handled by the host OS and then passed on to CHR as a regular network device. So you’ll need to find an LTE/NR device that’s compatible with your virtual hos...

Larsa

Just a heads-up about the Linux kernel support lifecycle: LTS now typically lasts around 2-5 years while SLTS/CIP is supported for a minimum of 10 years from the initial release but might go on much longer. https://en.wikipedia.org/wiki/Linux_kernel_version_history https://lwn.net/Articles/749530/ h...

Larsa

Put your iPhone in Field Test Mode using *3001#12345#* and compare the IDs (PLMN/NCI ie NCGI, etc) to those on the NR7102 to make sure your antenna is pointed at the right tower. Start by connecting your computer directly to the NR7102 when running the performance tests.

Larsa

And as I’ve tried to explain pretty clearly several times, running a user-space network stack like FD.io/VPP/DPDK in an embedded kernel-based network operating system like ROS just doesn’t work. But it seems like it’s not really sinking in because people either don’t seem to understand the issues or...

Larsa

How to export and post your configuration:
viewtopic.php?p=1051720&#p1051720

Larsa

As I mentioned, these are just L2 helpers for the old v1 which you can manage without using other methods but as most installations are running v3 (UDP) it really doesn’t matter. Anyhow, since this is just a user forum you'll probably get better answers by emailing Mikrotik at 'support@mikrotik.com'...

Larsa

Maybe you should study how RoCE and its different versions work. V1 operates at L2 with various helpers according to DCB (e.g., PFC, ETS, etc.) which sometime is called lossless Ethernet. But you can also manage without it by using other means like standard switches and handling the flow controll in...

Larsa

Re: ... Did you test VyoS 1.5 rolling + VPP addons how is it? ... @TomjNorthIdaho wrote: I have not played around with the VPP addons yet. I only updated to the latest rolling release to get the faster control plane. And wow :) I will be testing the VPP add-on packages on my lab network test router...

Larsa

Hey guys, since this is a MikroTik forum would you mind continuing the VPP/VyOS/pfSense lab discussions elsewhere? Maybe on their respective mailing lists, user forums or perhaps Reddit?

Larsa

Those customers who buy these customized solutions operate in a completely different market segment than the current product range Mikrotik offers. Plus, Mikrotik doesn’t have the expertise or resources needed to develop brand a new user-space NOS. Only companies like Cisco have the muscle for that ...

Larsa

VPP/FD.io/DPDK/SNABB, etc. = User space networking. eBPF/XDP = (Semi) kernel space. CHR = RouterOS for virtual machines in kernel space. Going with a user-space solution would require some serious iron and building a brand-new control plane to create a versatile router like ROS used in the current p...

Larsa

Alright, good to know. Have an awesome trip!

Larsa

Now it's my turn to be curious. The cruise ship we went on a few years back had incredibly slow internet (ie no starlink at that time). How's the internet situation on the ship you're on?

Larsa

Check out my previous post, I made some changes.

Larsa

I just realized I made a mistake (10.147.17.100/24 instead of 10.147.17.0/24) so that's probably why the first attempt didn't work. I've corrected the previous posts with 10.147.17.0/24 . But anyhow, 10.147.17.0/24 is intended to match all IP addresses in the entire ZeroTier subnet. The setting ' 19...

Larsa

Disable the previous src-nat command and try the following. Replace XXXX with the name of your LAN interface, like ether1 or bridge etc. ' /ip firewall nat add chain=srcnat src-address=10.147.17.0/24 out-interface=XXXXX action=masquerade ' If that doesn’t work, you’ll need to start tracing the traff...

Larsa

Then you only need the following, assuming the Zerotier interface is still named 'zerotier1': # Allow routing from Zerotier to your local network and access to the router. /interface list member add interface=zerotier1 list=LAN # masquerade all traffic from zerotier to your local network /ip firewal...

Larsa

And the other question: Do you want 1) LAN access only from Zerotier, or 2) access in both directions?

Option 1 is easily solved with srv-nat/masquerade on the MikroTik.
Option 2 requires routing to and from the default gateway.

Larsa

What's the local (LAN) and Zerotier IP address on the MikroTik device? Do you want LAN access only from Zerotier or do you want it both ways?

Larsa

Yeah, that sounds like a good idea! As long as the MikroTik is an ARM-based device running ROS you can install ZeroTier on it.

Larsa

As I explained earlier, you need to add a route for 10.147.17.0/24 to 192.168.1.33 in pfSense and enable packet forwarding on the Windows machine. Since this isn't a Mikrotik issue and if you need further assistance with pfSense routing or fixing Tailscale, I'd suggest checking out the official Netg...

Larsa

Tailscale is available as an official package for pfSense and works just as well as Zerotier. But whether you're using Zerotier on a Windows machine or Mikrotik you'll need to point your default gateway to where you're running Zerotier as I explained earlier. Another option is to use src-nat or masq...

Larsa

I’d install ZeroTier directly on your pfSense (assuming it’s the default gateway). It'll make everything a lot easier and you won't have to worry about the Windows box and Mikrotik at all. Then you'll have access to all the devices on your local network directly from the ZeroTier network and vice ve...

Larsa

Alright. On PFsense which I’m guessing is the default gateway to the internet, add a route for 10.147.17.0/24 that points to the Windows box at 192.168.1.33 (which should have the Zerotier address 10.147.17.100). You have to enable packet forwarding on Windows to allow routing. That's it! What role ...

Larsa

What's the local address of the Windows machine where Zerotier is installed?

Larsa

- You either need to have 10.147.17.100 as the default gateway or add a route for 10.147.17.0/24 on the default gateway pointing to the device where Zerotier is installed. - No extra routing rules are needed. - Add the Zerotier interface 'zt1' to the LAN interface list to allow access to your local ...

Larsa

Well, I've read some (general) articles on VPP ... and I still don't get it: why is it orthogonal to embedded NOS such as ROS? To fully utilize VPP ( What is VPP? ) as a fully-fledged router you need to pair it with a user-space network stack that has all the necessary capabilities using frameworks...

Larsa

Well, it won’t work with the current product line. Study the basics and you’ll understand why.

Larsa

VPP is user-space software, used in projects like FD.io, DPDK and similar. It's not suitable for embedded network OS environments like ROS.

EDIT:
The above applies to OSes like pfSense, VyOS, BSD, and others.

Larsa

1. CHR is designed to run in virtual environments and can easily handle Tbps without any issues. But if you really want to run bare-metal, go for ROS x86_64. But why? Properly set up virtual environments are just as fast as bare metal and are way easier to manage. 2. VPP is a user-space solution and...

Larsa

Since this is only a userforum, please report bugs directly to Mikrotik by opening a ticket at https://mikrotik.com/support or sending an email to 'support@mikrotik.com'.

Larsa

Somewhat OT but remember that MIMO also takes advantage of interference through multipath propagation. So in most cases the quality of the DSP is more important than the antennas, especially for indoor devices.

Larsa

Larsa

Okay, that sounds odd. The IPsec policy is usually pretty straightforward: the src-address and dst-address represent which local networks (subnets) the traffic should be encrypted between. The sa-src and sa-dst addresses are the respective WAN (internet) endpoint addresses for the encrypted tunnel. ...

Larsa

@TheCat12 has already hinted at how the policy should look for the LAN src address 192.168.1.0/24.

Larsa

Possibly gold plated coat hangers ...

Yeah, but of course! It’s obvious that the more expensive the cable, the better the quality of the electrons passing through it, which means a better signal -- everyone knows that!

Larsa

Run a speed test with a 5G-enabled phone to get an idea of what speeds you can expect before buying an indoor 5G product from MikroTik. If you need a 5G outdoor device with a directional antenna you'll have to look for another brand.

Larsa

https://help.mikrotik.com/docs/display/ROS/User+Manager

Larsa

Short mode is 16 bits and long mode is 32 bits for path cost. The same mode needs to be set on all switches in the network to function.

Larsa

You still have some incorrect settings with those results. With the correct IPsec settings you should get at least 200 Mbps and the CPU usage should basically be zero with a hAP ac³ at both ends. What WAN speed does the ISP provide?

Btw, don’t run throughput tests with Cake enabled anyway.

Larsa

Weird, because when I mentioned all the fuss on Reddit last fall she said it was just a few customers who had systematically underreported active nodes (which they initially claimed were passive) and got a hefty raise after measuring and presenting the actual numbers. Nothing more to it.

Larsa

Haha Yeah, right?!

Larsa

Glad you managed to solve it! Regarding ZeroTier, there have never been any real issues with the licenses, either for us or our customers. It was just a bunch of clueless morons on Reddit spreading a lot of FUD because of a clumsy/unclear wording from sales that got changed pretty quickly. Reddit is...

Larsa

Surprisingly, WireGuard seems to be best performer!

Then you are doing somthing wrong if you get better speed with WireGuard than IPsec with hardware acceraltion. Check hAP ac³ IPsec single tunnel test result

Larsa

Larsa, I was a huge fan of it... When it was $500 a year. If you check around... About a year ago Zerotier started reaching out to users and telling us they wanted to change the yearly to $7000 or more. What've you been reading lately, Reddit chit-chat? :D The "Pro" business license is $2...

Larsa

@anav - IN TERMS OF JOB SECURITY...

/system clock
set time-zone-name=Europe/Paris

Larsa

Okay, I didn't quite catch the main issue you're facing but ZeroTier is free for personal use with unlimited networks up to 25 devices anyway and the commercial licenses are among the cheapest out there. As for Wireguard, I've never really had any issues with Apple devices and the only problem I've ...

Larsa

Pro tip: Use ZeroTier for a way easier life without worrying about public IPs and all that.

Larsa

To take advantage of hardware acceleration choose a tunnel type that uses IPsec encryption with AES but don't expect blazing speeds with the hAP ac³ , tho it'll definitely be much faster than Wireguard. Regarding EoIP , it's a LAN tunnel that transports Ethernet between two MikroTik routers (ie acti...

Larsa

There is a scroll bar, scroll to the right

Thanks, got it! IMO the UX is pretty crappy in this case but nothing Violentmonkey can't handle..

Larsa

Thanks! It was "System > Resources" I was looking for. Yeah, it's buggy, all right.

EDIT: I wish version info could be presented in a more obvious place as standard so you wouldn't have to hack the webfig "skin" on each new instance to find it.

Screendump.png

Larsa

Pro tip ...

1. Click "Design Skin"
2. Go to Resources
3. Click triangle button next to Version
4. Select "Add to Status page"

Looks promising though I'm unable to locate any tab/menu called "Resources" in Design Skin mode.. (v7.15.1). Anyone?

Larsa

How many places you want?

Somewhere where it's easier (ie obvious) to spot in the ordinary work space, please!

Larsa

Considering the scope of this project (site-to-site tunneling with load balancing, advanced routing, Wi-Fi access points, PBX, Active Directory, etc.) and the technical expertise and experience needed to pull it off, if I were you, I'd pass on this (honestly, you'll never be able to handle this on y...

Larsa

Yes, it’s possible. There are plenty of leads and step-by-step guides if you google: "AWS Mikrotik IPsec"

Larsa

Well, that is something that I try to also figure out, what is is the best approach for this. I did find EOIP implementation/examples quite straight forward, but.... no idea how is in case of zerotier . An IP-based tunnel like IPIP is just as simple to set up as EOIP using ipsec-secret. Also, there...

Larsa

Okay, but why use L2 (EOIP) instead of an IP-based VPN tunnel like WireGuard or even SD-WAN like Zerotier?

Larsa

You sure the radio's on? Sometimes when a device is in config mode the radio gets turned off.

Larsa

To bond you also need to have control over the other side but you might use load balancing instead.

Larsa

Since you linked the two networks together with EOIP it's basically like having two subnets on the same local network. You might want to consider hairpin NAT or a different approach like L3 VPNs (IPSec, Wireguard etc).

Could you explain in simpler terms what you're trying to achieve?

Larsa

@zx128k, you might also use the CALEA package for data collection. There are plenty of analysis tools available for that. There's also a built-in packet sniffer that while somewhat limited compared to CALEA is still pretty useful. https://wiki.mikrotik.com/wiki/CALEA EDIT: @Jotne's Splunk solution i...

Larsa

Yes, it does. Look for @Amm0's detailed explanations and examples on the matter.

Larsa

MT should look at DPDK in my opinion Two major things make DPDK unsuitable for the current product line: 1. DPDK is a pure userland solution while ROS is kernel-based. 2. DPDK's resource footprint is way too large to fit an embedded network OS like ROS. DPDK is normally used in highly specialized h...

Larsa

Same problem, after 1 week outside full of water.
20240708_165116_2.png

Judging by the extent of the corrosion I'd wager the device in the picture has been exposed to the elements for quite a bit longer than just a week...

Larsa

I am not using BFD. BFD is pretty lightweight with adjustable timers for how often control packets are sent and it doesn't really strain the CPU. It's highly recommended for L3 like iBGP in your case. You might also check if your upstream providers or IXP offers BFD. If that's the case, I'd definit...

Larsa

Let's see if it's something @skycanfiya might find interesting. Personally, I'm pretty curious where that 25-second delay is coming from in the current setup.

Larsa

I was referring to R1-R3 (L3/BGP). L2 VRRP/LAG should kick in pretty much instantly. BTW, what do you mean by upstream LAG in this scenario?

Larsa

25 seconds sounds like a bit much. Are you using BFD?

Larsa

No, not really. At least not if you want some basic level of decent security protection.

Install ZeroTier, Tailscale or a similar SD-WAN (“from anywhere VPN”) solution on the cloud server for a hassle-free setup and administration.

Larsa

I wish to have the unit behave as if it were 10 physically separate devices, with the only common connection being to the GPS NTP unit. I had originally pitched the idea of just buying more of the same GPS NTP devices (easiest to keep the network segregation), but with a couple of the VLANs having ...

Larsa

Yeah, and the idea that the cache is gone in the current kernel is a myth and misconception. The current V7 kernel uses a more modern and secure network stack that divides the cache into distinct layers to achieve better efficiency where it’s needed most. Some relevant reading on the subject: Routin...

Larsa

No routing whatsoever between routable interfaces, not even to default gateway if I recall correctly.

Larsa

@mbovenka; Yeah, it should work unless routing to other subnets on the plant is needed.

Larsa

@neki, your suggestion won't prevent routing between subnets (i.e VLANs). And why reset the entire config?

Larsa

@XplodingData, just create an address list like 'VLANS_NO_ROUTING'. Then, create a forward rule that drops all traffic coming and going to any address in the list for each corresponding VLAN address range. You can do this in WinBox/WebUI under IP > Firewall > Address Lists and IP > Firewall > Filter...

Larsa

The CHR is totaly unaware if the virtual driver uses SR-IOV or not. It just uses the NIC that is provided by the virtual guest where the CHR is located. So if you can't see the NIC in the virtual guest configuration it won't either appear in the CHR.

Larsa

SR-IOV is built into the device driver for the network card in your virtual host operating system so you won't actually see it in CHR. But you might notice that the CPU load and software interrupt rate are significantly reduced at full network throughput when SR-IOV is enabled. If the NIC doesn't sh...

Larsa

@kendal; you forgott to add the interface list WAN otherwise everything gets redirected:

/ip firewall nat add chain=dstnat action=dst-nat in-interface-llst=WAN protocol=tcp dst-port=80 to-address=10.0.0.246 to-port=80 comment="myconf: HTTP"

Larsa

Sindy, good advice regarding the LAN ports! You only go down in flames once (usually

).

Larsa

@nsarant; This is OT and I’m not trying to hijack this thread. The suggestion below doesn’t really fix your current issue with your own failover solution using scripts, but rather an alternative way to solve it: Set up a separate tunnel (of any type) for each WAN connection like Sindy explained and ...

Larsa

If you’ve already set it to bridge mode it shouldn’t matter since the Mikrotik will handle DHCP for you instead. But to be on the safe side you can disable it.

Larsa

Yeah, hard to say. Btw, since the WAN list name and service type are showing up as TR069xx I'm starting to think this menu might actually be the CPE admin menu, not the regular user interface. If that's the case, VLAN 1493 is hopefully terminated in the CPE. I mean, it's not common practice to force...

Larsa

Hi, I'm just guessing here but try changing the "connection type" to "bridge". Make sure the cable from the HG6145D2 is connected to the MikroTik WAN port. From Winbox, go to the IP menu -> DHCP Client and check if the interface gets a public IP address. Btw, switching to bridge-...

Larsa

@SMARTNETTT, please provide model, hardware config and full ROS export. Otherwise, no one here will be able to help you.

Larsa

Yeah, specially when is was reported on a friday. @SMARTNETTT, I'm pretty sure nobody here at the user forum has the ability to scry with a crystal ball, so please share your server model, hardware configuration (eg type of nics etc) and ROS full export. Otherwise, we won't be able to help you beyon...

Larsa

As I wrote in the other thread , hardware is pretty important when it comes to x86 but you still managed to omit the model and hardware configuration as well as a full export! Anyhow, in the case of 30 identical servers and only one failing I'm pretty sure it's a hardware issue. What's the SUP number?

Larsa

Larsa

@SMARTNETTT: ROS on x86 has nothing to do with Haplite. Please create your own thread and include information about both hardware and software configuration (i.e. a full export). Regarding ROS on x86 bare metal, please be aware it's a tricky business thus you really MUST know what you're doing. Othe...

Larsa

Since this is only a user forum, please report bugs directly to MikroTik by emailing 'support@mikrotik.com' or opening a ticket at their service desk: https://help.mikrotik.com/servicedesk/servicedesk.

Larsa

Since this is only a user forum, please help others by reporting bugs directly to MikroTik by emailing support@mikrotik.com or opening a ticket at their service desk: https://help.mikrotik.com/servicedesk/servicedesk.

Larsa

Since this is only a user forum, please help others by reporting bugs directly to MikroTik by emailing support@mikrotik.com or opening a ticket at their service desk: https://help.mikrotik.com/servicedesk/servicedesk.

Larsa

@pe1chl
Yeah, and a couple of outdoor units wouldn't hurt. One with a directional antenna for rural areas and one omnidirectional for urban areas.

Larsa

Impressive switches! Looking forward to new hw offload capabilities for data center use. Hopefully RAM can be configured for traffic buffering..

Larsa

@felix34, remove the brackets from the first line ie: /interface/wireguard/peers :foreach Id in=[find disabled=no] do={ :put [get $Id comment] :put [get $Id last-handshake] } or: :foreach Id in [/interface/wireguard/peers find disabled=no] do={ :put [get $Id comment] :put [get $Id last-handshake] }

Larsa

Since this is a user forum, you'll probably get better help directly from Mikrotik by emailing 'support@mikrotik.com' or opening a ticket at their service desk: https://help.mikrotik.com/servicedesk/servicedesk

Larsa

I'v used a zlan Modbus gateway a long time ago but I remember we configured it locally for TCP before deploying it. But if I get it right you want to be able to perform the initial configuration with the device already in place on the other subnet, right? If you are absolutely sure you don't want to...

Larsa

@adamantasaurus, here are some links to what appears to be a clear pedagogical explanation with step-by-step instructions:
- https://blog.shaharia.com/mikrotik-nat- ... m-internet
- https://99rdp.com/using-winbox-to-set-u ... orwarding/

Larsa

Here are some examples of affordable 5G/NR routers for outdoor use with PoE power: Zyxel FWA710, D-Link DWP-1010, Huawei 5G CPE WIN and Huawei CPE Pro 2.

Larsa

Already a thread about it here: viewtopic.php?p=1083460

Larsa

As a general guideline, don’t rely on Mikrotik IP Cloud (xxxx.sn.mynetname.net) for mission-critical operations.

Larsa

@homtec: for your own good, don't rely on Mikrotik IP Cloud (xxxx.sn.mynetname.net) for mission-critical operations. Also, there is no support for dual stack environments.

Larsa

Please don’t cross-post. Check out my answer here: viewtopic.php?t=208918#p1083306

Larsa

Ping "support@mikrotik.com"...

EDIT
Since there doesn't seem to be any redundancy, we're only using IP Cloud as a backup and have already migrated production to Cloudflare DNS.

Larsa

255.255.255.255 (limited broadcast) is by default designed to work only on the local subnet (broadcast domain) otherwise you need to setup specific forwarding rules. As an alternative, you can use directed broadcast (e.g 192.168.1.255) or multicast. Is there a specific reason you can't have eth1 and...

Larsa

Yeah, it looks like the people who managed the “refactored DNS service internal processes” didn't carry out the most basic tests. It makes me wonder if they're even conducting CI/CD pipeline test automation at all..

Larsa

I had the same issue with WG DNS endpoints. Maybe this drop has the "overhauled" DNS?

Larsa

Then I’m afraid you can’t use that either other than as a pure Linux router module.

Larsa

Did you read my comment about requirements for IPsec?

Larsa

@tilda, If you don’t need 24 Ethernet ports and can settle for 16, I’d definitely go for a CCR2004. It's so much easier to manage just one device for home use since it minimizes the hassle factor according to Murphy's Law. Plus, if you want to connect an SFP module it’s no problem at all as long as ...

Larsa

" Aside from higher-end features, the MikroTik CRS520-4XS-16XQ-RM will be a higher-priced switch at $2795. At that price range, it is going to offer something very unique. A new switch with a management web GUI for the price of a used Mellanox SN2100 16-port 100GbE switch with a bit less connec...

Larsa

Mac80211_hwsim is a Linux kernel module designed for 802.11 development ie used by hw/sw developers. It would require highly specialized device drivers for ROS in order to interact with any type of virtual environment. Read this: https://www.gns3.com/community/featured/open-source-alternatives-for-w...

Larsa

Jinxee!

Larsa

Any L2 ethernet frame size larger than the standard 1500 bytes (excluding the header) on your local network requires all other devices on the same network to have the same size. L3/WAN (PPPoE) is a different story. https://www.packetstreams.net/2018/07/t ... 3-mtu.html

Larsa

Hey @Ryuu19, I'm pretty sure GMO has some guidelines on the protocols they use for IPv6/IPv4 tunneling. Come back here once you've found the info and we'll help you configure your router.

Search found 1607 matches