MikroTik

Larsa

This is just a user forum; please report issues directly to Mikrotik support.

Larsa

It doesn't necessarily have to be the router that's the main problem. A tip is to troubleshoot using the Windows Event Log on both the RDP clients and the server. A good place to start is the guide " Microsoft - Troubleshoot Remote Desktop Disconnected Errors ". This might also be useful: ...

Larsa

@AE8U, try to avoid exposing your internal network devices with open ports whenever possible. Instead, consider using VPN like WireGuard or ZeroTier. MikroTik has a built-in DDNS feature for handling dynamic IP changes called IP Cloud.

Larsa

When I started the thread earlier, the initial handshake had to finish before the connection state became "established"[*] which prevented mangling from working. I see you’re using NAT, which might be affecting things similarly to routing rules. Have you tried running a packet trace (assum...

Larsa

Perhaps you didn't read the whole thread and might have missed the most crucial parts: 1) During WG's initial handshake, there's no "connection state," so mangle rules can't apply 2) The initial handshake response always egresses through the default gateway unless you trick ROS into using ...

Larsa

Same thread that Amm0 posted previously: viewtopic.php?t=205278

Larsa

I just tested the rules as I have quoted on an rb5009 running 7.17rc1, and the mangle absolutely works for the initial handshake. Alright, good to know it works with 7.17rc1. Not sure when this changed, but it didn’t work before. If mangle works, that’s a third option along with NAT and routing rul...

Larsa

@divB, you're absolutely right to point out that this is a flawed implementation of WireGuard and it drove me nuts too before the root cause was identified. The good news is that it’s actually pretty easy for MikroTik to fix if they decide to. WireGuard works perfectly on Linux with the standard too...

Larsa

@Slartybart: Yeah, you’ll probably be just fine sticking with WireGuard. Another reason to go with it is that it’s much easier to manage than IPsec if you’re not experienced. If you somehow need maximum throughput, you might want to look into getting IPsec to work with hardware acceleration. -- @hol...

Larsa

Thank you, but yet again, not a single word about IPsec hardware acceleration which WireGuard completely lacks.

Still, it’s always nice to see such enthusiastic contributions from a cheerful enthusiast.

Larsa

Haha, yeah, that article was really 'professional,' but hey, not bad for a basement hacker who clearly has no clue whatsoever about AES hardware acceleration. Nice try though!

Larsa

Hey @muaazteladia, welcome to the forum! Great to see more knowledgeable and dedicated people joining us. Have a nice weekend!

Larsa

@holvoetn: When testing Tik to Tik with both devices capable of HW offloading IPSEC, WG is still faster. My view ... Well, I’m not sure what you’re basing your claims on, but IPsec with hardware acceleration is always faster than WireGuard— and that’s a fact! :-D Also, all AWS instance types, like ...

Larsa

@Slartybart: As WireGuard relies entirely on ChaCha20, which is a pure software encryption , throughput depends directly on the CPU power, so a slower CPU means slower throughput. For maximum throughput on AWS, consider using IPSec, though be aware that there might be a throughput cap depending on t...

Larsa

You can't just set up one subdomain in cloudflare and keep the rest in another DNS server, the NS servers have to be set to cloudflare, all mikrotik.com DNS will be managed through there. Yes, you can! There are several ways to do this, like DNS subdomain delegation, partial CNAME setups, and more....

Larsa

Aha, now I get what you're asking about! We had the exact same thoughts when we first started testing this feature. It’s really an unfortunate combination of poor documentation and a design flaw in the SMS script execution functionality. You don’t get any info about which number triggered the script...

Larsa

The SMS data contains the phone number of the sender who initiated the script with the ':cmd' syntax. Maybe I'm misunderstanding what you're trying to achieve, but we're using scripts with MT LTE CPEs to perform actions like checking status, reboots, etc, as a last resort if our normal out-of-band m...

Larsa

There's no need to fake anything since there are no restrictions on anonymous access (tho creating a post is). Your suggestion might very well work, but it could end up being like robbing Peter to pay Paul.

Larsa

Long story short, unfortunately you can’t use digits as indexes in scripts, only in the terminal. Instead, you’ll need to use indexes like "id," as shown below, where "id" is just a variable that can be named anything /tool sms :foreach id in=[inbox find where message~"^*.&q...

Larsa

Just an example of Cloudflare's pricing model : Pro - for professional websites that aren’t business-critical, $25 /month. Business - for small businesses operating online, $250 /month. All plans come with unmetered DDoS protection, they just differ in uptime SLA and number of rules for advanced set...

Larsa

No, just " forum.mikrotik.com ". But don’t take my word for it, call or email some of them and they’ll explain how it works. Btw, here's a list of popular DDoS protection service providers. Most providers have their services spread out across all continents, and in many cases, you can pick...

Larsa

Now would be a good time to check the logs for user agents. May come up empty thou since you can use any valid user agents. I’m only gonna say this once: with a proper DDoS firewall that also catches other bad stuff, you don’t have to bother about invalid user agents since they’ll get blocked anywa...

Larsa

We have disabled the search robots, except biggest ones, but the attacks are regular DDoS attacks going to different IP every time. We are trying to optimize the forum servers to handle bigger loads, but the attacks keep getting bigger too. Since PHPBB is old software, another option would be to mi...

Larsa

Well, here we go again! Now at about 1200 sessions and still climbing. Someone must be really pissed at MT...

Larsa

No problem. We’ll keep using Winbox 3/Wine for now, since v4 still has too many limitations anyway.

Larsa

/dev/null ??

Larsa

Since guest session counts are back to normal, I’m guessing MT introduced some kind of measure, but I doubt we’ll ever find out what it was.

Larsa

If you need serious DDoS protection as a front-end service, it takes massive computing resources, expert skills, and experience.

Normally, IMO that’s not something a company like MT could manage on-premise by themselves.

Larsa

@anav, it’s your call!

Once you figure out what triggers OSPF LSA state changes on a single WireGuard interface (using OSPF type PTP) connected to multiple peers/subnets, adding two tunnels to your VPS will be a breeze.

Larsa

Sorry, my bad!

I meant before MT gives in and adds a third-party DDoS protection service.

Larsa

Haha!

Either way, it really doesn’t matter how it’s done, the pikes in guest session count clearly points to a classic DDoS attack (IMO)

It’ll be interesting to see who holds out the longest in this battle, MT or the DDoS drivers. This kind of volume is pretty cheap to buy on the dark web.

Larsa

Suddenly an OSPF expert!?

Larsa

But I always block all search bot and never had an issue with max session limit hit. And yes even Google misbehaves at times. It’s extremely rare nowadays for big companies using index bots to misbehave. If there’s a problem, it’s usually a misconfiguration on your end. Also, legal index bots don’t...

Larsa

This was a new one:

IMG_2561.jpeg

Larsa

These “legal” index bots don’t cause spikes in guest session counts, so it’s most likely a DDoS attack going on.

EDIT: I still occasionally get “500 Internal Server Error.”

Larsa

Yup, seems like there’s still some kind of DDoS attack going on. The session count keeps bouncing between a few hundred and 1200-1300.

Larsa

A spike in session counts is usually a good indicator of a DDoS attack.

Larsa

No worries ya all!

Should MT decide to keep device mode in its current glorious form, just remember—we’re always here for you! 😄

Button-pushers.com

IMG_2527.jpeg

Larsa

… Sometimes on obscure places (hard, hard to reach physically). Still they insist on the button push confirmation thing.

There must be an alternative approach.

No worries, we rent out specially trained button-pushers worldwide.

IMG_2529.jpeg

Larsa

Yeah, me too!

Larsa

Yeah, that “help” doesn’t do much to stop real DDoS attacks. Pretty sure MT staff mentioned this in the forum too.

A must-read for the MT team: ”Distributed denial-of-service (DDoS) protection”

Larsa

Might be time to try out a frontend like Cloudflare or similar to get rid of the DDoS attacks.

Larsa

I assume you're talking about a radius connection to NPS. If you dont already have it, just set up a tunnel to your Azure AD - oh, sorry, I meant Entra ID ! :wink: Btw, I honestly can’t stand these pointless brand renames.. https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-po...

Larsa

It’s pretty tough to help out if you don’t explain exactly what’s not working, share a brief overview of the network topology and provide a full config export (minus anything that needs to be left out for privacy reasons). Also, using a single WireGuard interface with multiple active peers can be tr...

Larsa

You’re spot on, it’s exactly the vetting process that’s the weak link! There are plenty of techical tools to lock down a GitHub repo, but it’s up to the owners/admins to decide how to use them. In the case of the XZ backdoor, the attacker got in using social engineering which let the villains access...

Larsa

Probably true, but there’s always a chance of hidden backdoors, like the "XZ backdoor". With popular solutions, it’s easier to spot and handle malicious hacks and put in countermeasures because of the sheer number of people involved. But if you’re using less reliable sources, the risk goes...

Larsa

@LAYERWEB - What rextended is suggesting is that you should avoid trusting or automatically downloading third-party ROS scripts. An untrusted source could include elements that compromise your router’s security. If you want to work with scripts, download only raw data and write your own script direc...

Larsa

The interweb grinds to a halt, the family descends into chaos, and Koemleang gets verbally roasted!

Larsa

Just curious if you happened to check the ESXi logs to find the root cause? Anyway, feel free to get back here if you find anything interesting for future reference.

Larsa

And there is MikroWizard:
- viewtopic.php?t=209925
- https://mikrowizard.com

Larsa

If you don’t find any obvious reason in ROS for the VRRP state change, check the ESXi logs for the virtual NIC (referring to my previous post).

Larsa

This might be a good start: ”Using RouterOS to VLAN your network”

Larsa

After discussing the issue internally with some techs, our best guess at this point is that the flip-flop behavior might be caused by a VMware Virtual Network Adapter 'state change' which can happen for various reasons like network congestion, resource constraints, virtual switch misconfigurations, ...

Larsa

Alright, got it. As for load balancing (ie vrrp load sharing) and grouping, have you checked if the ROS version has what you need? It might be worth a look, since it doesn’t have all the ‘bells and whistles’ of the Cisco IOS XR equivalent.

Larsa

Thanks, but I have to admit I'm pretty confused by the network diagram as the image doesn’t seem to follow a clear visual logic and it’s hard to make sense of it without additional context. For example, how does the red-dashed VRRP relate to the four nodes (VRRP1, VRRP2, CHR1, CHR2)? And what role d...

Larsa

Just curious, but why not fully utilize the VSM functionality since you already have a bunch of ASR 9Ks? I mean, why use CHRs as edge routers?

Btw, this is how you add an image to a post:

how to upload an image.png

Larsa

I will definitely look into it, but at the moment I dont understand how it works and how it could possibly add failover to a mesh topology? i dont have any other vpn service or second ISP with enough bandwidth to handle alternative routes Got it. Just want to add that OSPF isn’t really tied to othe...

Larsa

@digitallystoned - If you think it might be a bug, it’s probably better to check with Mikrotik Support . Otherwise, I’d suggest coming back with a simple network diagram to make it easier to follow your thought process, plus a full export from both devices (minus anything that needs to be left out f...

Larsa

Well, according to Apple Support 'Forget Network' should clear cached auths. Unless there’s a new flaw in iOS 18 I don’t know about..

Larsa

SMTP is always open for business-grade connections and normally closed for regular consumers. If a botnet manages to steal the username and password for your email account, it’ll use ports 587 or 465.

Larsa

Usually, you just need 'Forget Network' to clear cached auths.

Larsa

@akliouev - look for ”Reserved variable names” in the link the link that @Infabo just posted.

Larsa

I wouldn’t call it overkill. OSPF is actually pretty easy to set up and used with the BFD option you get quick failover if a link goes down. You can always add OSPF later if you want, and you can run it on top of the static routes, which then act as backup routing.

Larsa

If each of your 4 nodes is connected to all the others (ie 6 tunnels in your config), then the answer is yes. But if the other nodes only connect to a central node, the answer is no.

Larsa

@Usbuild - Once you’ve made some progress and set up your WireGuard tunnels, you can start considering a true "mesh solution" where all nodes connect with each other. This setup makes the network more redundant in case any link goes down. Wireguard Mesh.png To avoid adding static routes, t...

Larsa

Completely agree! I find it hard to understand why MT doesn’t enable the interface for all standard ZeroTier options that are available on every other platform except ROS.

Larsa

Jinx (well, almost)

Larsa

What's new in 7.17beta2 (2024-Sep-27 10:07):
zerotier - upgraded to version 1.14.0

Larsa

Did you follow the guide? There are about 13 commands listed in the example, which one failed?

Larsa

Btw. setting up SSL decryption is a very common and easy thing, as long as you control all end devices, so that they trust your certificate authority. The most complex part of setting up SSL decryption at a company is to convince the company lawyers and the workers council. At least in Europe. Yeah...

Larsa

If this is for parental control, some endpoint protection software can manage it, and there are also paid cloud services available for this purpose. For corporate setups, ng-generation firewalls using the middle-man model require a highly complex and expensive configuration, which involves intervent...

Larsa

If current IMEI is not accepted by your provider, isn't it more logical to switch provider ? It happens that "obscure" NMOs to try to lock customers into equipment that can only be sold by them through various restrictions. In those cases, you might have change the IMEI to one that unlock...

Larsa

@zionlook: Check this out: https://gist.github.com/Anime4000/e9213bd4eaef502e4675d736c564fb5c # Query which mode /interface lte at-chat lte1 input="AT*PROD\?" "output: *PROD: 0" = production mode "output: *PROD: 1" = non-production mode # Disable LTE interface /interfac...

Larsa

@sambo521: Is your customer really okay with using your own equipment as an in-house, co-located router? TBH, this sounds a bit fishy, especially if it’s a big company that likely already has a remote access VPN solution (probably IPsec-based). I'd recommend using that instead. If possible, please g...

Larsa

I might have missed or misunderstood something when I read the description and checked the config, but it seems like you’re using the same subnet for your local networks and ZeroTier, which can get tricky if you’re not careful. Are you planning to bridge (Layer 2/Ethernet) or route (Layer 3/IP) all ...

Larsa

I suspect you might have missed something, misunderstood, or simply skipped over some posts, so I’ll graciously ignore the grumbling tone. Mr. Znevna, just tell me how I can help you improve your, let’s say, ‘hat-wagering’ skills. Or perhaps you have anything more intriguing to say besides the whini...

Larsa

Can you quote any part of it which mentions drivers for the Host OS? I haven't had time to check the actual references, but if you mean the drivers for PCIe IO-SRV support, you might for example checkout the vfio-pci driver for Linux, the FreeBSD ppt driver or the Microsoft Windows Driver Model ( W...

Larsa

Like addressing a FreeBSD request for the unsupported Bhyve? Why not fix the UEFI Boot issue instead? You guys never stop surprising me!

Larsa

Well, @mrz, purely educational as a reply to a previous post. But why do you care? This is a user forum, right?! On a more serious note, though, I genuinely (really!) don’t understand Mikrotik’s priorities here. Why address a FreeBSD request for the unsupported Bhyve when there are more pressing iss...

Larsa

If you're interested in some technical details on SR-IOV, down below are some solid explanations from Red Hat and Intel about different PCI hardware abstraction layers. I’d especially recommend Red Hat’s intro, which covers PCIe Physical Functions (PFs) and PCIe Virtual Functions (VFs), and Intel’s ...

Larsa

Thanks for making that clear once and for all.

And please tell me you didn’t spend an entire weekend just to enable it for FreeBSD!

Larsa

Please stop embarrassing yourselves! My best advice is to start exploring how VM drivers work and the differences between various hypervisors, particularly in handling IO-SRV and how it compares to regular PCI passthrough variants like ESXi DirectPath. And once again, all hypervisors have their own ...

Larsa

if you really pulled off getting MikroTik to add SR-IOV for the T540 in CHR [...] in such a short time in the past i have often complained, loudly and at length, about my issues with MikroTik support. but this case, i opened the ticket on Saturday, and they provided the new build at 10:30 on Monday...

Larsa

@crosswind - I’ll be the first to tip my hat and give you a shoutout (maybe even eat the hat) if you really pulled off getting MikroTik to add SR-IOV for the T540 in CHR running on the unsupported FreeBSD Bhyve in such a short time. Ps..If that’s the case, I have a bone to pick with MikroTik for not...

Larsa

PLAT or CLAT, which runs on the end user’s device, or ROS CLAT for centralized translation, tunneling, or other purposes?

FYI, most pure IPv6 ISPs support MAP-E (RFC 7597), which can be managed by IPIPv6 in Mikrotik ROS.

Larsa

Still trying to get to grips with the eccentricities of Mikrotik VLANs (Much more familiar with Cisco's implementation, so this is a bit of an adjustment for me) Yeah, it's because ROS VLAN bridging is based on Linux DSA (Distributed Switch Architecture) which can be pretty tricky to grasp because ...

Larsa

Just keep in mind that Netwatch might be pretty unreliable on LTE when using Carrier Aggregation (CA), which is the default mode for most connections.

Larsa

I was a bit unclear - I meant an example use case for the type of work the organization does, like a neighborhood association or a security solution with SLAs for emergency response, or something similar, possibly with redundancy requirements, etc. Yeah, 1.5 Gbit/s requires heavy-duty equipment for ...

Larsa

Besides a decent management interface, you will need a proper VPN concentrator that is powerful enough to handle the expected number of concurrent encrypted VPN sessions. What’s the use case?

Larsa

I did my best to help, but it seems like you’re more interested in semantics and playing the ‘I said, you said’ blame game. Please refer to my previous message regarding supported platforms. Good luck!

Larsa

RouterOS as a bare metal x86_64 installation might possibly have drivers for the Chelsio T540, but you need to check with support. If you need help to install CHR on FreeBSD, you can refer to this guide: " Creating a Mikrotik CHR - RouterOS 7 - Bhyve VM in FreeBSD " Depending on what you a...

Larsa

CHR runs fine on FreeBSD as long as you set up the VM with a compatible VF for SR-IOV or configure the standard drivers properly. That said, SR-IOV won’t give you any extra performance unless you’re sharing the NIC with multiple VMs so the easiest way to get started with bhyve with is to bridge a ta...

Larsa

please read my original post, which is about whether RouterOS x86 / CHR has driver for Chelsio T540-CR VF device. i do not get error or warning, but device does not appear in /interface/print. this is nothing to do with FreeBSD - question is whether RouterOS has driver for this device. This is wher...

Larsa

Yep, it’s also up to the host OS drivers to enable SR-IOV support. The virtual machine can check if SR-IOV is available, but if you try to turn it on without driver support, you’ll just get an error or warning. The host OS still needs proper support for everything required by the virtual machine, so...

Larsa

No, virtual machines support only a limited set of virtual drivers required for the virtual guest to function properly. The host OS drivers are responsible for managing this support. You need to configure it properly like: https://forums.freebsd.org/threads/sr-iov-chelsio-error-in-guest.70653/. If y...

Larsa

When using CHR, the NIC drivers must be compatible with and managed by the virtual machine host operating system (ie FreeBSD).

So, MikroTik support won’t really help here - you’ll need to check out the FreeBSD Forums instead.

Larsa

He talked about running into a splice tray and pigtail. Yeah, that's pretty much standard procedure. It's usually not a big deal, but if you ask nicely, they might throw in a 30-foot (or even longer) pigtail that you can roll up in the splice tray. That way, you can move it somewhere else if you ne...

Larsa

Is there any way of knowing if these two are compatible?

When using CHR, the NIC drivers must be compatible with and managed by the virtual machine host operating system. Also make sure to enable SR-IOV.

Larsa

There’s a chance some mistakes slipped in by accident, so please post the configuration with the latest suggestions.

Larsa

It could be due to several things, like having a WireGuard peer acting as the initiator (ie you have defined the endpoint-address and port) but the receiver isn't responding, or for some reason an established connection has stopped working. An earlier version of Ros logged way too much by mistake bu...

Larsa

Those settings are protocol-defined standard values that are hardcoded at compile time. Check out: WireGuard on GitHub. Also, read my previous post: viewtopic.php?p=1105092#p1058871.

Why do you want to change these values, which would break the protocol definition?

Larsa

As an AP, bridging is more than adequate and the routing test results don't really matter much as difference isn't that significant anyway. It's only relevant if you're planning to use the AP as your main router.

Larsa

Check your iPhone Wi-Fi logs: viewtopic.php?t=211009#p1098002. If you can't figure it out using the logs, post your AP config in this thread.

Larsa

@mblfone - This is just a user forum. Please open a bug report with Mikrotik support.

Larsa

I’d say it’s way too hard to figure out the network topology without a clear network diagram.

Larsa

And imagine if top management and all the development gurus were on the crashed airplanes!

Larsa

Hey @ToothyGardener, thanks for that LLM-generated response that was pretty much just a reworded version of my last post, but with some extra fluff thrown in. (## SPAM warning ##)

Larsa

Or as someone on Reddit put it: "This device is not intended for the average user, so don’t blame the hardware if you have trouble getting it to work. If you're unable to configure it properly, consider buying a consumer-friendly equipment instead."

Larsa

If using two RB4011s works, check if the TZ500 could be the bottleneck and whether it supports hardware acceleration with AES-256. If not, you’ll need to find an encryption method that both sides can use with hardware acceleration. Take a look at the RB4011s (CPU AL21400) in this table: https://help...

Larsa

I went from openvpn (no udp support in Tik) to ipsec (hardware encryption) to wireguard. Wireguard blows ipsec with hardware encryption out of the water in terms of performance. @NetWorker - WireGuard uses pure software encryption (ChaCha20), so it’ll never beat IPsec when it’s using hardware accel...

Larsa

@FredRoot - You can’t manage USB network devices directly from CHR. You need to set up and manage the TP-Link T4U from the host OS first, then add it to Proxmox like a regular network device. Check this out: add usb network device to proxmox

Larsa

@galvesribeiro, yeah, this is great news and probably essential for MT if they are aiming to enter the data center market with their new 100G switches. It looks like there's support for both the older v1 L2 and current v2 L3 (UDP), with highly configurable ETS scheduling and bandwidth allocation. Ov...

Larsa

You need to use an IPsec encryption setup that matches AES hardware offloading on both sides.

Larsa

The only advice I can give, if you can’t ensure your system is ROS-compliant, is to use CHR. If configured correctly, you won’t notice any difference in performance.

Larsa

I have never used, but I understood that with rose-storage I can fake a disk on RAM, so we could use it to avoid issues on write needs. Just be aware you will lose ALL writes if you are unable to sync a RAM drive to permanent storage. My recommendation is to use at least some kind of delayed-write ...

Larsa

That might be the case, but it really depends on how the developers have set up the SQLite settings, like journal_mode, cache_size, temp_store, synchronous, and how they handle client busy timeouts, etc. And of course, the maximum number of concurrent transactions. If the underlying file system for ...

Larsa

Yeah, the VM should be pretty easy to scale up with standard measures, and depending on how MT implements SQLite caching, you might even be able to use it as an in-memory database if you add a lot of RAM. But since SQLite is single-threaded, how it handles command queuing with a bunch of concurrent ...

Larsa

You're absolutely right, so I've clarified the answer!

That said, it's a pity that RoS User-Manager doesn't offer the same configuration options as for example FreeRadius where you can set it up to use an external database server.

Larsa

I think you’re missing the point, it’s about running a separate RADIUS server. Plus, SQLite isn’t really made for this kind of workload anyway.

Larsa

Just a guess, but your NIC probably isn’t supported. If that’s the case, I’d recommend running RoS using CHR instead.

Larsa

@fischerdouglas; I'm not sure I get the question. Are you asking about: 1) The total number of users in the database, 2) The number of concurrent users connecting to a RAS server, or 3) whether all those hosts are connecting to a single RADIUS server at the same time? For the number of users in the ...

Larsa

I did try run from terminal and this is what I got (sorry, but my knowledge of Ubuntu is very limited)

@Enrico: From the command line, try:
$ chmod +x Winbox
$ ./Winbox

Larsa

Read this thread: viewtopic.php?p=1098572

Larsa

I’d say that’s pretty impressive for an initial alignment of a 31 km link, especially considering it was raining.

Larsa

@Plink4, here's a hint to get you on track. Read this how-to: viewtopic.php?p=1051720&#p1051720

Larsa

What lower latency are you comparing it to, exactly?

There are specialized appliances with userspace networking built using DPDK and similar libraries, if that’s what you’re referring to..

Larsa

It is a bit of a cat-and-mouse game with these towers/etc. And since part of CA, beyond more bandwidth, is shifting load to other bands. Dropping a band to force CPE like LHG to actually use CA... seems like something the LTE network might do to keep the primary bands clear if possible. Yeah, but t...

Larsa

@Plink4, I think @anav was pretty clear that he's only willing to keep helping if you provide the full router config (i.e., a full export). Otherwise, you’ll need to reach out to a Mikrotik consultant: https://mikrotik.com/consultants.

Larsa

Suggesting either a wireguard VPN connection or a zerotier connection (LARSA can help with), that will allow you to securely access your resources behind the mikrotik router while away. I suppose which is readily available on the CHR would be a starting point. @anav, since this is a ROS installatio...

Larsa

We're managing a bunch of LTE/NR CPEs and have figured out that you need at least two payload packets per second to keep CA running. Some operators skip the ICMP traffic in this. So far, what’s been working best for us is sending BFD Hello packets (24-byte payload) every 300 ms, ie about three packe...

Larsa

So, you do have a public IP after all, but it's dynamic and connected to another Mikrotik router?? To be honest, I'm not sure I fully understand what you're trying to explain! Before we go any further, could you provide a full network topology? It doesn't have to be a super detailed diagram, just a ...

Larsa

Are you kidding, what do you mean by " I don’t have any public IP. The one I have is connected to my MikroTik " ??? Before we move forward, please provide a complete network topology. It doesn’t need to be an advanced diagram, but it should include all the relevant network components, from...

Larsa

@Plink4; it's a bit hard to follow your network setup because, in your first post, you said " my MikroTik CHR does not support ZeroTier, " and then later you mentioned, " Just to clarify, I don’t have a MikroTik Cloud Hosted Router (CHR). " A few questions just to clear things up...

Larsa

Before you made those changes, did you check if CA was really the underlying problem? Just so you know, if you disable CA, your transfer speed will be significantly limited.

Larsa

viewtopic.php?t=184283
viewtopic.php?t=189356

Larsa

@Larsa, I appreciate your input. However, I've already made the decision to go with Mikrotik for my networking hardware (or most of it...I do have a couple of secondhand Netvanta PoE switches), and I like the idea of minimizing the number of fingers in my networking pie. Besides, $45 for a Level 1 ...

Larsa

Sorry @Anav, but for this topology, I’d definitely go with the free version of ZeroTier for an easy setup and administration, without needing a central VPS/CHR or anything like that. ZeroTier also makes it much easier to add mobile devices like phones and laptops, and it handles CG-NAT really well. ...

Larsa

You need to add a route to your local network in ZeroTier Central. Just go to Networks -> Settings -> Advanced -> Managed Routes. For general questions about ZeroTier, check out discuss.zerotier.com . Also, make sure to allow ZeroTier network traffic to the LAN on your router. You can do this by add...

Larsa

You might be losing Carrier Aggregation (CA) when the LTE modem (UE) deactivates a secondary carrier to save power because full aggregation isn’t needed when data usage is low and the device doesn’t require the full bandwidth. This can also happen at the base station for the same reasons, depending ...

Larsa

No need to use OSPF if you're already familiar with BGP. Both protocols use BFD in pretty much the same way to achieve fast failover between routes. Either way, give it a try - it’s not hard to set up. Otherwise, it works as usual: one route for the primary link and one for the backup. Just set attr...

Larsa

I have not worked with OSPF before. It is a shared router, also running BGP, so I am a bit reluctant to try that.

@benw: BFD works just as well with BGP for a quick reroute if you lose the primary link. Manually rerouting with a script is like reinventing the wheel.

Larsa

Mikrotik RoS runs on a slimmed-down Linux kernel that's customized for embedded devices so it doesn't have broad driver support for generic x86-64 hardware. On the other hand, Linux distros like Ubuntu are a whole different story - they usually offer full support for most x86-64 hardware.

Larsa

Each Hyper-V Virtual Switch can only be mapped to one external (physical) NIC at a time. So, if you’ve got multiple physical adapters, you’ll need to assign a new virtual switch for each one.

Each virtual switch can host unlimited virtual adapters for the guest OS.

Larsa

You might use two parallel routes with OSPF/BDF for a seamless failover in just a few milliseconds.

Larsa

I'll bring it up to him, but this wish might be hard to fulfill.

Larsa

@nichky - I think you'll get better attention if you post the issue in the thread v7.17beta [testing] is released!

Larsa

Yeah, and to be more specific – if either end of the IPsec tunnel doesn’t have AES hardware acceleration, that’s going to set the limit for the total throughput you can get.

Larsa

If you have a CCR2004 at both ends, make sure to enable proper AES hardware acceleration for IPsec:

https://help.mikrotik.com/docs/display/ ... celeration

Larsa

Are you sure your hardware setup is supported? If not, you might want to try using CHR instead.

Larsa

I'm not sure about VIVO Brazil, but most pure IPv6 ISPs support MAP-E (RFC 7597) which lets you tunnel IPv4 traffic using an IPIPv6 tunnel in ROS, for example like this: viewtopic.php?t=146917#p724273

Larsa

@SwaggerRO - What @mrz meant, to be more precise, is that the 'new-routing-mark' name needs to match the 'routing-table' name. So, for example: /ip firewall mangle add chain=prerouting src-address=192.168.1.1 action=mark-routing new-routing-mark= to_ISP1 passthrough=no add chain=prerouting src-addre...

Larsa

These are really nice examples of various use cases, thank you!

Larsa

Also, consider MikroTik RouterOS Managment Tools like:

Larsa

Mikrotik has fixed a lot of issues over the years so it’s pretty hard to say exactly what you’re referring to in this case. You could run a functionality test using something like GNS3, or describe your network setup with more details about the problem, and share your config files. You can also chec...

Larsa

BGP is a bit more complex than LDP, but it’s a better fit for large-scale VPLS deployments:

https://help.mikrotik.com/docs/display/ROS/VPLS

Larsa

On Android, Connect your phone using the QR. Then hit the share network on your phone. It will display the SSID and password.

This requires Android 10 or iOS 18.

Larsa

I totally agree. Everything should be handled consistently and users shouldn't have to know all the little exceptions that could lead to serious issues. At the very least, the documentation should have clear warnings about these risks.

Larsa

Yeah, and as a workaround, you’ll need to use for example a foreach loop. Something like this:

/ip hotspot user
:foreach user in=[find name~"^adam"] do={
reset-counters $user
another-command $user
etc…
}

Larsa

Yeah, and in some environments it’s enabled by default. @iocampomx; for future reference could you let us know what OS and virtual environment you're running GNS on?

Larsa

Glad you got it working! I'd still suggest upgrading to CHR ROS v7 since there've been major improvements in the new kernel’s network stack. For example it handles LACP better allowing for improved hardware resource utilization especially in dynamic environments with multiple link members and multi-...

Larsa

Same here, I've tried multiple things & parameters. I'm using CHR within GNS3. I'm using Wireshark to monitor traffic. CHR is only sending one package once you disable the bonding interface, example: I'm using version 6.49.17 with the free license. It might be an issue with the configuration se...

Larsa

Yeah, just noticed it!

Larsa

This is the 100th post in this thread!

Edit:
oh no, it became the 101th, dam it!

Larsa

Use the main "WinBox 4 is here" thread for any related issues or questions: viewtopic.php?t=210505

Larsa

@k2dI5umrD9VO:
Link to Apple Support: https://getsupport.apple.com/products

Larsa

@iustin: I have this same problem...

Link to Apple Support: https://getsupport.apple.com/products

Larsa

We've been using both the preview and the latest releases of iOS 18 and macOS 15 (Sequoia) for a while now. I also checked with some colleagues who've spent a lot of time at different customer sites (including some Mikrotik setups) and none of them have had the issues described in this thread. My wi...

Larsa

@k2dI5umrD9VO: As I tried to explain earlier, since the issue originates from your iOS device, you should contact Apple Support and let them handle the matter accordingly.

I mean, if it worked with iOS 17 but not with iOS 18, you can’t blame MikroTik for it, can you?

Larsa

Link to Driver Log TXT-File from Macbook: https://1drv.ms/t/s!AsOJquxuP-h5hewWtvJA2Rp3Tq-XGQ?e=yTxxJA Just a suggestion; when sharing a log this big, try giving a hint about when the issue happened so people know where to start looking. Also, this log is primarily meant for the Apple Developer foru...

Larsa

Hey folks! Want to know what's really going on when your Apple device is having Wi-Fi issues?? If YES , then check the wifi logs on your DEVICE : 1. iOS Profiles and Logs Wi-Fi for iOS/iPadOS Instructions Profile 2. macOS Profiles and Logs Direct link: Wi-Fi Logs For macOS Wi-Fi issues, please foll...

Larsa

What do you mean by mixed languages? @erlinden: Sorry, I meant to say regional settings. The same company that added deliberate slowdowns to older hardware and it still surprises you? What do you think MS is doing with their Co-Pilot story? Same purpose—push hardware sales (MS license will come wit...

Larsa

Like I said earlier, it's an intermittent issue with Apple iOS 18. And honestly, why waste time with pointless trial and error when you can just check the device Wi-Fi logs to find the real problem faster?

Larsa

Yeah, forgot to mention we're using 7.15.3 with FT enabled. I remember some Apple devices (at least in the past) could have issues with mixed languages on APs within the same SSID domain. Anyway, troubleshooting Wi-Fi on Apple devices can be pretty tricky so instead of wasting time with trial and er...

Larsa

Alright, I’m not sure then. You could check the iOS Wi-Fi logs to find the cause, or if all else fails, roll back to iOS 17.

Look for the section “Wi-Fi for iOS/iPadOS” in iOS Profiles and Logs

Larsa

Did you try forgetting the network and then reconnecting, or is that when you ran into another issue?

Larsa

I had the same issue and I fixed it by following a suggestion I found on Reddit: just disable the private address, forget the network, reconnect, and then re-enable the private address again. Anyway, no one seems to know exactly why this happens with iOS 8.

Larsa

@k2dI5umrD9VO: It’s not related to ROS. This is a known issue with iOS 18 (and also in the previews) but no one has figured out the root cause or how to fix it: https://www.google.com/search?q=%22iOS+ ... reddit.com

Larsa

The issue isn’t with ZeroTier itself but rather the MikroTik implementation which is flawed due to using an older version (v1.10.3) with various bugs and lacking the ability to configure standard ZeroTier features such as custom root servers, multi-path, trusted-path, allow DNS, etc. ZeroTier can ha...

Larsa

we are planning to setup hub and spoke network using Mikrotik and ZeroTier. As a start there will be 500-2000 spokes. And in the next following years will growing up, total it will have up to 30K spokes. ZeroTier is a full-mesh SD-WAN that automatically utilizes point-to-point connections when at l...

Larsa

Many users request return of the Tabs to the top bar. One of my colleagues has nice idea - most of the time, you only work with few selected tabs. So what about an icon in the drop-down list, to open a Tab in a new Window, would in fact pin the Tab to the top bar instead? But of course! That way, e...

Larsa

Exactly my point!

Larsa

The detached window feature would make sense if there is only one Winbox instance running at a time. Since mostly several Winbox instances are running, detaching windows would create even more usability issues. Well, maybe for inexperienced people who don't work with networks and aren't familiar wi...

Larsa

Got it! Please add it to the list for Customer Enhancement Requests. Thanks!

Larsa

Maybe you expect something to happen, that was never intended to happen? This is what is SUPPOSED to happen. As designed: https://imgur.com/a/RwZRKRH Yes, that could absolutely be the case but I suspect there might be some confusion here regarding the terminology. As I tried to explain previously a...

Larsa

Thanks! By any chance, do you have access to the default gateway at 10.20.100.1? If so, could you check if there's a route set up to 10.2.120.0/24 via 10.20.100.15? If it's a MikroTik router, you can run the command: ' /ip/route/print ' and paste the output here. If not, while troubleshooting, we ca...

Larsa

@Normis: That does not make it clearer. The post already shows how to to it. Is there an issue with this button? 1. Yeah, that's correct. There an issue with button. The button shown in the red rectangle below doesn't work as expected. As explained by @STMT: " It is possible to detach the wind...

Larsa

Larsa

Larsa, unclear abut detachment from workspace, can you describe the issue?

You still can't detach a window from the WinBox main workspace and move it around freely on screen. Please check out @STMTs reply here: viewtopic.php?t=210505#p1093920.

Larsa

@normis, could you please add fixing the detachment of windows from the workspace to the list. According to @STMT, this was already provided but currently isn’t working.

Larsa

What's new in v4.0beta3:

*) fix crash on macOS 11

1. I can confirm that v4.0beta3 is working with macOS 11 - thanks! It's blisteringly fast, I must say.
2. Detaching windows from the workspace still doesn't work, though.

Larsa

ROS can't handle any network cards when running as CHR in a virtual machine. You'll need to configure the WiFi card in Ubuntu first, then add it to VirtualBox as a regular network interface.

Larsa

I agree with what @sirbryan says.

Larsa

It's shown in the window title when you're not connected

Great, thanks! 🙏

Larsa

We are trying to find such an old macbook and will test. So far, no help needed, Larsa. Thanks! Most of our field engineers are forced to use slightly older MacBooks (and you can probably guess why) using macOS 12/13 and equipped with Intel CPUs because we need to run a bunch of Windows-based legac...

Larsa

It is possible to detach window if you open the drop-down menu and click the button next to the submenu name Thanks, but that doesn't work for me because the window is still locked to the WinBox workspace (ie the child window is still locked to the parent workspace) Environment: WinBox 4.0Beta1, Wi...

Larsa

Craches on Intel Macook macOS 11.7.10. Tried several times.

@normis: let me know if the developers want a core dump and I'll sort it out.

Larsa

Feedback:
1. A dropdown menu or similar submenu is currently missing for open windows.
2. Add the ability to detach a window from the WinBox workspace.

Larsa

Craches on Intel Macook macOS 11.7.10. Tried several times. Process: WinBox [4220] Path: /Applications/WinBox.app/Contents/MacOS/WinBox Identifier: my.example.com Version: 0.1 (0.1) Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: WinBox [4220] User ID: 503 Date/Time: 2024-08-29 09:37...

Larsa

Since you're using the same subnet as someone else on the Cisco side you'll need to use src-nat. Btw, why not use 192.168.160.0/24 since the Cisco admin already assigned it to you.

Larsa

FYI, BBR needs to be implemented only on the endpoints (eg like web browsers and servers) where data is being sent and received. It does not require any modifications or implementations in the routers or other network infrastructure. The only tunneling protocol I can think of that uses TCP is OpenVP...

Search found 1774 matches