Community discussions

MikroTik App

Search found 338 matches

  • 1
  • 2
by Revelation
Tue Aug 07, 2018 3:06 pm
Forum: Beginner Basics
Topic: Access local LAN via second router
Replies: 2
Views: 490

Re: Access local LAN via second router

Hi, I have default mikrotik router with gateway 192.168.88.1. I have connected to this router a second router, which got local ip address 192.168.88.25. Now, when I connected to to second router, local network gateway is 192.168.0.1. When I try to access ip 192.168.88.250 - I can't reached. How can...
by Revelation
Tue Jul 31, 2018 5:35 pm
Forum: Beginner Basics
Topic: Help Config Firewall Access List, Filter
Replies: 4
Views: 614

Re: Help Config Firewall Access List, Filter

What is VLAN 10, 20, 30 not supposed to access? For the second part that is pretty easy: you want a forward rule to permit 192.68.20.0/24 to reach 192.168.10.5-20 you then want a forward rule to deny 192.168.20.0/24 to reach 192.168.10.0/24 I'm not at home so I cannot give the specific syntax just y...
by Revelation
Tue Jul 24, 2018 4:53 pm
Forum: Beginner Basics
Topic: First mikrotik router-- ned help understanding security instructions.
Replies: 3
Views: 907

Re: First mikrotik router-- ned help understanding security instructions.

You can also use Wine to utilize WinBox on Linux, Unix and MacOS.
by Revelation
Thu Jul 05, 2018 10:00 pm
Forum: Beginner Basics
Topic: Using mikrotik Firewall Feature
Replies: 15
Views: 2176

Re: Using mikrotik Firewall Feature

I'm not sure why you are choosing to not answer my questions, yet you still ask for help.... Based on what you have and have not provided, your answers are in my first post. When you decide to answer my questions I will revisit this thread an provide additional details that I think you will need to ...
by Revelation
Tue Jul 03, 2018 3:02 pm
Forum: Beginner Basics
Topic: Using mikrotik Firewall Feature
Replies: 15
Views: 2176

Re: Using mikrotik Firewall Feature

Internet router installed at my office is not RB 750 it is a satellite router provided by ISP. 1st LANA port is connected with Wifi device for giving internet access to users. The satellite router has 2 LAN ports. From 1st LAN port a wifi router is connected to provide internet to users in office. ...
by Revelation
Sun Jul 01, 2018 8:11 pm
Forum: Beginner Basics
Topic: Using mikrotik Firewall Feature
Replies: 15
Views: 2176

Re: Using mikrotik Firewall Feature

Hi Members I have recently purchased RB750 for my office use. I have an internet router installed in my office with 2 LAN ports. 1st LANA port is connected with Wifi device for giving internet access to users. From second LAN port I have to connect a device that needs to get connected to its peer d...
by Revelation
Tue Jun 26, 2018 1:45 am
Forum: General
Topic: unknown admin with unknown IP address loges in my mikrotik router via API [SOLVED]
Replies: 6
Views: 1278

Re: unknown admin with unknown IP address loges in my mikrotik router via API [SOLVED]

I would also change the "username" of the admin account. Make them have to guess what your account username is in addition to the password.
by Revelation
Tue May 29, 2018 8:00 pm
Forum: General
Topic: Block All activity for an specific IP
Replies: 6
Views: 810

Re: Block All activity for an specific IP

Assuming that you've assigned the cameras a continuous range of addresses, and that the default firewall rules of some recent RouterOS release are in place, it would be: /ip firewall filter add chain=forward action=drop src-address=camera.1.ip-camera.16.ip However, as I'm not sure how default firew...
by Revelation
Fri May 25, 2018 2:54 am
Forum: Beginner Basics
Topic: Combination of two networks
Replies: 6
Views: 847

Re: Combination of two networks

There actually is a physical connection (Cat7 cable) between the two buildings; Each has it's own local network with it's own internet access - and I want to connect these two as routed networks. Easiest way is to add a /30 network on the interfaces between the two routers. You then want to configu...
by Revelation
Sun May 13, 2018 7:13 pm
Forum: General
Topic: ccr1009-8g-1s-1s+
Replies: 5
Views: 914

Re: ccr1009-8g-1s-1s+

first thanks for ur reply i have from 150 to 180 users in daily basis they connect hotspot about me I need to improve the service we are a hotel and some of our score depend on Wi-Fi service I got 60 M in one line from one of ISP goid one but I feel I have something missing to reach to good service...
by Revelation
Sun May 13, 2018 2:29 am
Forum: General
Topic: ccr1009-8g-1s-1s+
Replies: 5
Views: 914

Re: ccr1009-8g-1s-1s+

Are you looking for a complete configuration or looking for pointers? How are your clients connecting and authenticating with you? Are you acting as an ISP / WISP or is this an office type deal? How many users do you expect online at any given minute? (should use queues or mangle rule to distribute ...
by Revelation
Sun May 13, 2018 2:18 am
Forum: Beginner Basics
Topic: Transfer limitation
Replies: 2
Views: 675

Re: Transfer limitation

You can look at using simple queues or mangles.

https://wiki.mikrotik.com/wiki/Manual:Queue
by Revelation
Sat Feb 24, 2018 12:46 am
Forum: Beginner Basics
Topic: Guest Wifi in Quickset no internet
Replies: 6
Views: 1543

Re: Guest Wifi in Quickset no internet

Without seeing your configs, couple of things immediately come to mind. Typically when there is another wifi network it is in another vlan. If your GB switch does not support vlan tagging that could be a reason why the guest traffic doesn't get internet access. You could also be running a NAT on you...
by Revelation
Sat Feb 24, 2018 12:32 am
Forum: Beginner Basics
Topic: New Router, cannot use ubnt discovery and windows SMB
Replies: 2
Views: 509

Re: New Router, cannot use ubnt discovery and windows SMB

So I am VERY out of my league here. Our IT guy here installed a mikrotik router then quit. I'm trying to add some new Ubiquiti Access Points using the desktop discovery pool and it isn't pulling anything up. The APs that were active already are still live and showing in the controller but not showi...
by Revelation
Fri Dec 08, 2017 10:22 pm
Forum: Beginner Basics
Topic: Drop all inbound traffic ouside of my network
Replies: 3
Views: 635

Re: Drop all inbound traffic ouside of my network

What you want to do is to block certain traffic: This should get you started 14 ;;; Drop SSH(TCP) to WAN chain=input action=reject reject-with=icmp-network-unreachable protocol=tcp src-address-list=drop_traffic in-interface=ether5 dst-port=22 log=yes log-prefix="" 15 ;;; Drop SSH(UDP) to WAN chain=i...
by Revelation
Sat Sep 23, 2017 11:13 pm
Forum: Beginner Basics
Topic: Block Websites but allow for some selected clients
Replies: 2
Views: 645

Re: Block Websites but allow for some selected clients

Please help...How to block youtube or facebook for my clients PC's but allow these websites for some selected clients. Easiest way would be to create 2 address lists; one for those that are blocked and one for those that are not. Simply add the IPs to the each respective list. Create a FW rule that...
by Revelation
Sat Sep 23, 2017 11:05 pm
Forum: Beginner Basics
Topic: IPSEC IKEv2 setup cannot access LAN. Only can access router.
Replies: 5
Views: 1893

Re: IPSEC IKEv2 setup cannot access LAN. Only can access router.

Without seeing how you have your VPN service configured and your existing FW rules and their order, we can only provide generalities.

You will want to ensure that you have a FW permitting the traffic from your VPN IPs to "talk" to your LAN IPs.
by Revelation
Sat Sep 23, 2017 11:00 pm
Forum: Beginner Basics
Topic: First router mikrotik and first questions: ps4,balance, port forwarding
Replies: 5
Views: 1168

Re: First router mikrotik and first questions: ps4,balance, port forwarding

I am going to assume that your IP from the ISP is not actually 192.168.1.4 as that is a private address and you only put it there not to give out your actual Public IP. This is totally fine and recommended; if that is not the case it can make the requested items much more difficult to impossible. Is...
by Revelation
Mon Sep 11, 2017 4:24 am
Forum: Beginner Basics
Topic: Backup Link
Replies: 3
Views: 1397

Re: Backup Link

You would set two static routes. First route will point to your first ISP and will be exactly what you use today. The second router will have a higher administrative distance, set it for say 150, and traffic will only follow the second route when the first one goes down.
by Revelation
Tue Jul 11, 2017 3:49 pm
Forum: Beginner Basics
Topic: 1 port in multiple VLANs same subnet.
Replies: 7
Views: 2659

Re: 1 port in multiple VLANs same subnet.

To have a port setup so that VLANs are not tagged at ingress, you must have a device attached to that port that can do VLAN tagging. For instance a server that has a NIC that supports VLAN tagging.
by Revelation
Fri Jun 02, 2017 1:15 am
Forum: Beginner Basics
Topic: Software for designing network diagrams
Replies: 4
Views: 1457

Re: Software for designing network diagrams

I typically use Visio for work.
by Revelation
Mon May 29, 2017 10:04 pm
Forum: Beginner Basics
Topic: LAN to LAN NAtting
Replies: 6
Views: 1520

Re: LAN to LAN NAtting

You haven't posted enough information, one would have to make a lot of assumptions to try and help. Try being more thorough in detailing your network and VPN with your client. Please remove any Public IPs are Passwords.
by Revelation
Mon May 29, 2017 10:00 pm
Forum: General
Topic: Site-to-Site VPN issue
Replies: 3
Views: 757

Re: Site-to-Site VPN issue

Thanks!
And how to setup dynamic routing?
You need to use a dynamic routing protocol, such as OSPF.
by Revelation
Mon May 29, 2017 4:21 pm
Forum: General
Topic: Site-to-Site VPN issue
Replies: 3
Views: 757

Re: Site-to-Site VPN issue

Easiest thing is to setup dynamic routing between them and then FW rules to permit the traffic.

For instance:
HQ: 10.0.0.0/24
B1: 10.0.1.0/24
B2: 10.0.2.0/24
B3: 10.0.3.0/24

FW rules accepting 10.0.0.0/22 to 10.0.0.0/22
by Revelation
Wed May 24, 2017 4:12 am
Forum: Beginner Basics
Topic: Port trunking witj vlan tagged.
Replies: 15
Views: 1947

Re: Port trunking witj vlan tagged.

You misunderstand the terms. VLAN trunking what you see in examples on the internet is technically incorrect. Even when configurring Egress VLAN Tag - there is no mention for "trunking" word. "Trunking" is combining multiple links into one to have more speed and/or balance. Yes, logically a link, w...
by Revelation
Wed May 24, 2017 4:07 am
Forum: General
Topic: A problem connecting to PPTP VPN
Replies: 2
Views: 631

Re: A problem connecting to PPTP VPN

Without seeing the configuration of the VPN Terminator, no one can tell you.
by Revelation
Wed May 24, 2017 4:05 am
Forum: General
Topic: Unsure upgrading to Mikrotik CloudCore 1036-12G-4S
Replies: 5
Views: 827

Re: Unsure upgrading to Mikrotik CloudCore 1036-12G-4S

You can also go with a CCR1009. I have one that handles multiple VPNs,numerous firewall rules, 1Gb/1Gb service, multiple streaming, concurrent uploads and downloads without breaking a sweat. So far you haven't provided enough information as to why you should go with the CCR1036. By all means, get wh...
by Revelation
Wed May 24, 2017 3:59 am
Forum: Beginner Basics
Topic: cannot ping by hostname
Replies: 2
Views: 1511

Re: cannot ping by hostname

Hi, I cannot ping by hostnames, only from the router's terminal. I would like to connect to a raspberry by its hostname not with IP address. How to configure the DHCP in the router? Thank you DHCP will not allow you to ping via hostname. For that you will need to setup some type of DNS. You can rea...
by Revelation
Wed May 24, 2017 3:57 am
Forum: Beginner Basics
Topic: VPN with managed service
Replies: 2
Views: 464

Re: VPN with managed service

What are you using for DNS for each network? From what I read, it reads as though each site has it's own DNS server or service.
by Revelation
Wed May 24, 2017 3:49 am
Forum: Beginner Basics
Topic: VLAN issues
Replies: 12
Views: 1216

Re: VLAN issues

I didn't see anything wrong with your config, or nothing stood out. If you Torch eth2, do you see traffic coming into or out of the respective VLAN? The Linux box on eth2 has been configured to communicate on both the 250 and the 50 vlans. Packets coming out of it intended for the device on the Rout...
by Revelation
Wed May 24, 2017 3:19 am
Forum: Beginner Basics
Topic: Bandwidth limit problem
Replies: 2
Views: 1695

Re: Bandwidth limit problem

So you need to post your configs as I can get it working just fine using simple queues. You can easily set the queue to apply to a range of IPs by simply using CIDR notation. EX; 10.1.1.0/24 would apply to all IP addresses between 10.1.1.1-10.1.1.254. http://i63.tinypic.com/11j0nww.png You can clear...
by Revelation
Mon May 22, 2017 3:48 pm
Forum: Beginner Basics
Topic: Port trunking witj vlan tagged.
Replies: 15
Views: 1947

Re: Port trunking witj vlan tagged.

Thanks for reply. Now is more clear. Trunking is the way to go, as it can handle cable fault and load balancing as I've seen from field testing. So when also working with VLANs on this trunk: /interface ethernet switch vlan For each VLAN do I have to add each port (23 and 24) or the trunk-uplink? T...
by Revelation
Mon May 22, 2017 3:42 pm
Forum: Beginner Basics
Topic: Port trunking witj vlan tagged.
Replies: 15
Views: 1947

Re: Port trunking witj vlan tagged.

No, trunking is allowing multiple VLANs over a single interface. What is the difference between: /interface ethernet switch trunk /interface ethernet switch egress-vlan-tag The ethernet switch egress-vlan-tag command is for when you want to tag traffic leaving a particular interface with a specific...
by Revelation
Mon May 22, 2017 4:19 am
Forum: General
Topic: ipsec tunnel
Replies: 8
Views: 972

Re: ipsec tunnel

I have done a little more research and my understanding is that ipsec isn't routing. That its based on policy, it doesn't create virtual interfaces that are added to a route table. https://www.manitonetworks.com/mikrotik/2016/3/5/ipsec-tunnels Since you never posted configs as I asked, I have no cl...
by Revelation
Sun May 21, 2017 9:26 pm
Forum: General
Topic: ipsec tunnel
Replies: 8
Views: 972

Re: ipsec tunnel

I don't see any routing for networks / IPs through a tunnel.
by Revelation
Sun May 21, 2017 4:46 am
Forum: Beginner Basics
Topic: Port trunking witj vlan tagged.
Replies: 15
Views: 1947

Re: Port trunking witj vlan tagged.

What is the difference between bonding and port trunking? I know that in switches trunking is pairing ports to multiply speed between switches. And bonding is the same in unix systems. In case of RouterOS port trunking is working on switch chip and bonding on cpu? Is my trunking configuration corre...
by Revelation
Sat May 20, 2017 4:08 pm
Forum: General
Topic: Port 200 TCP etc. open and telnet by default?
Replies: 8
Views: 1861

Re: Port 200 TCP etc. open and telnet by default?

A quick masscan of the web I'm sure would prove that they don't, or don't know how to. Look at all the issues with default passwords. Why would telnet need to be open by default.
None of that matters; the USER is responsible for hardening their equipment.
by Revelation
Sat May 20, 2017 3:58 pm
Forum: General
Topic: ipsec tunnel
Replies: 8
Views: 972

Re: ipsec tunnel

I followed all the stuff in that article. I thought it was routing as well but I am not sure what to set. Can you point me at an example of the routing for a site to site ipsec tunnel? Open a terminal window and type: ip route print Post the output of that command. (I recommend that you change the ...
by Revelation
Sat May 20, 2017 6:24 am
Forum: General
Topic: L2TP/IPsec VPN troubles
Replies: 5
Views: 939

Re: L2TP/IPsec VPN troubles

You want to make sure you have FW rules permitting the VPN IPs to "talk" with the LAN network and vice-a-versa.
by Revelation
Sat May 20, 2017 6:16 am
Forum: General
Topic: Port 200 TCP etc. open and telnet by default?
Replies: 8
Views: 1861

Re: Port 200 TCP etc. open and telnet by default?

I'm looking at open ports on an RB3011 and by default Telnet is open, why? That's horrible. Why is FTP enabled by default? I disabled them both. Also, I noticed port 200 TCP open and a several others, what are they all for? The WebUI says: According to IANA, port 200 TCP is "IBM System Resource Con...
by Revelation
Sat May 20, 2017 6:09 am
Forum: Beginner Basics
Topic: Port forwarding by 2 Mikrotik
Replies: 2
Views: 502

Re: Port forwarding by 2 Mikrotik

Hi. Its possible to forward ports by 2 Mikrotik? Incoming internet connection at specified port -> 1st Mikrotik External IP (omnitik) -> 2nd Mikrotik Internal IP(RB750) -> destination machine Standard port forwarding not works for me. Thanks for any advice. Seweryn How are your Mikrotik's configure...
by Revelation
Sat May 20, 2017 5:38 am
Forum: General
Topic: ipsec tunnel
Replies: 8
Views: 972

Re: ipsec tunnel

Without seeing your config, taking a guess...

Ensure you have FW permit statements for each of the networks. (if this applies in your case)
Ensure you have routes on both routers pointing to the distant network via the tunnel.
Ensure your "interesting" traffic is permitted via IPSEC policy.
by Revelation
Fri May 19, 2017 8:46 pm
Forum: General
Topic: Charity workers can't access remote network behind Mikrotik router
Replies: 1
Views: 493

Re: Charity workers can't access remote network behind Mikrotik router

You haven't actually setup l2tp at all in your configs, you configured pptp which is deprecated and most OS's don't support it anymore. That is probably why your VPN service isn't working.
by Revelation
Wed May 17, 2017 8:53 pm
Forum: Beginner Basics
Topic: Interpretation of logs
Replies: 2
Views: 634

Re: Interpretation of logs

Based on the simplicity of the information provided it looks like a possible network scan.
by Revelation
Wed May 17, 2017 6:04 pm
Forum: General
Topic: Unable to connect to L2TP/IPsec VPN from iOS10/macOS Sierre
Replies: 3
Views: 1516

Re: Unable to connect to L2TP/IPsec VPN from iOS10/macOS Sierre

Ignore this suggestion, you are making it to Phase 2 thus this has no bearing on your issue. Try to remove l2tp secret as it is not necessary. There is much more to a VPN configuration than you have posted. This is telling me that you have an unsupported configuration, so you need to post more detai...
by Revelation
Wed May 17, 2017 5:52 pm
Forum: General
Topic: VPN CANNOT BE CONECTED 6.37.5
Replies: 3
Views: 639

Re: VPN CANNOT BE CONECTED 6.37.5

Your post was very descriptive and informative that I can ID the problem with your setup....

Since you have tried multiple versions of code with the same result, then it is clearly a misconfiguration.
by Revelation
Wed May 17, 2017 5:45 pm
Forum: Beginner Basics
Topic: IPSEC VPN connection successful, but does not open cameras
Replies: 2
Views: 588

Re: IPSEC VPN connection successful, but does not open cameras

Well I am not clicking on a random link by a user with 1 post. So you should post a diagram of your network and a more detailed description of what is going on.
by Revelation
Tue May 16, 2017 5:06 am
Forum: General
Topic: Which types of ports would you like to see for a high speed router
Replies: 172
Views: 35481

Re: Which types of ports would you like to see for a high speed router

Coming from a Data Center background, I'd like to see: Access / Distro #1 24x 1G / 10G Copper 4-6x SFP28 / QSFP28 Access / Distro #2 16x SFP / SFP+ 4-6x SFP28 / QSFP28 Core You could also run a "core" router with: 10x SFP28 / QSFP28 4x 1G / 10G Copper or 4x SFP / SFP+ I'd still love to see you guys ...
by Revelation
Thu May 11, 2017 4:42 pm
Forum: General
Topic: Cisco ASA 5516-X Firewall with FirePOWER services VS Mikrotik
Replies: 3
Views: 1414

Re: Cisco ASA 5516-X Firewall with FirePOWER services VS Mikrotik

The datasheet is incomplete. It doesn't tell you about any benchmark test about IPSEC, Routing and many other things. It doesn't have information about ACL / Mangle rules capacity/Limit. Here is Mikrotik's datasheet on that device: https://routerboard.com/CCR1036-12G-4S Then your best bet is to rea...
by Revelation
Thu May 11, 2017 1:14 am
Forum: Beginner Basics
Topic: need help .mikrotik vpn for celfon user(android and apple)
Replies: 14
Views: 1443

Re: need help .mikrotik vpn for celfon user(android and apple)

thank you very much sir revelation. i will try your given instruction. if im going to give a 1 mbps per user, where i am going to config? can you give an example of that? also that example you give is for 3 user only right? if i will add user until 20 celfon, im planning to have 20 celfon user/clie...
by Revelation
Wed May 10, 2017 2:21 am
Forum: Beginner Basics
Topic: need help .mikrotik vpn for celfon user(android and apple)
Replies: 14
Views: 1443

Re: need help .mikrotik vpn for celfon user(android and apple)

thank you very much sir revelation. i will try your given instruction. if im going to give a 1 mbps per user, where i am going to config? can you give an example of that? also that example you give is for 3 user only right? if i will add user until 20 celfon, im planning to have 20 celfon user/clie...
by Revelation
Tue May 09, 2017 5:05 am
Forum: Beginner Basics
Topic: need help .mikrotik vpn for celfon user(android and apple)
Replies: 14
Views: 1443

Re: need help .mikrotik vpn for celfon user(android and apple)

The process is the same. I have L2TP setup on my Mikrotik and the users can use whatever device to connect. okey thank you sir revelation. it would be more great if you provide some steps / procedure in configuring vpn in mikrotik for celfone users. i have no idea of configuring mikrotik so im very...
by Revelation
Sun May 07, 2017 6:24 pm
Forum: Beginner Basics
Topic: need help .mikrotik vpn for celfon user(android and apple)
Replies: 14
Views: 1443

Re: need help .mikrotik vpn for celfon user(android and apple)

The process is the same. I have L2TP setup on my Mikrotik and the users can use whatever device to connect.
by Revelation
Sun May 07, 2017 1:54 am
Forum: Beginner Basics
Topic: Only specific packet using PPTP
Replies: 1
Views: 457

Re: Only specific packet using PPTP

Easiest way would be to setup specific host routes so only certain traffic will go over the VPN:
https://www.howtogeek.com/howto/windows ... ing-table/

Or try this:
https://superuser.com/questions/999196/ ... sites-only
by Revelation
Sat May 06, 2017 10:44 pm
Forum: Beginner Basics
Topic: L2TP server
Replies: 5
Views: 989

Re: L2TP server

You must update your NAT rules. For example, try this: /ip firewall nat add chain=srcnat action=masquerade out-interface=Public Wiki: https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT You are the one! It's working like a charm Many thanks. Another question - how can I allow or block browsing we...
by Revelation
Sat May 06, 2017 10:40 pm
Forum: General
Topic: How may I get monitoring a Mikrotik behind a nat?
Replies: 3
Views: 706

Re: How may I get monitoring a Mikrotik behind a nat?

Your best bet is to setup a VPN.
by Revelation
Sat May 06, 2017 10:28 pm
Forum: General
Topic: IP Cameras on CRS - How To Configure FW Rules?
Replies: 3
Views: 1150

Re: IP Cameras on CRS - How To Configure FW Rules?

One thing I forgot in a previous post, you have to associate each physical interface with the VLAN. So you will need to click on the "interfaces" button on the left side of the WinBox window. Click on the "+" symbol and select VLAN We want to give this a specific name: typically I will use {VLAN nam...
by Revelation
Sat May 06, 2017 10:14 pm
Forum: General
Topic: IP Cameras on CRS - How To Configure FW Rules?
Replies: 3
Views: 1150

Re: IP Cameras on CRS - How To Configure FW Rules?

For the Dynamic DNS, I haven't used that feature on Mikrotik before. If you do a search on the forums, there was a well written up post from a member that had it working fine with a simple script. For the Destination NAT, i.e. the traffic you want coming in for the cameras. You will need to open up ...
by Revelation
Sat May 06, 2017 9:57 pm
Forum: General
Topic: IP Cameras on CRS - How To Configure FW Rules?
Replies: 3
Views: 1150

Re: IP Cameras on CRS - How To Configure FW Rules?

It is going to depend on whether or not your ISP modem / router can be configured in Bridge Mode. Let's assume it can. http://i64.tinypic.com/2z8yf15.png You will need to configure a port on the CRS125 as the WAN port, allow it to get an IP address dynamically from the ISP. You will need to configur...
by Revelation
Sat May 06, 2017 8:29 pm
Forum: Beginner Basics
Topic: PPTP & Routing
Replies: 75
Views: 11163

Re: PPTP & Routing

You're going to have to provide configs for people to figure out what is going on. You simply haven't provided enough information.

When you copy and paste in your configs, change your WAN IPs to a private IP address.
by Revelation
Sat May 06, 2017 8:24 pm
Forum: Beginner Basics
Topic: need help .mikrotik vpn for celfon user(android and apple)
Replies: 14
Views: 1443

Re: need help .mikrotik vpn for celfon user(android and apple)

good day just want to ask help to those who knows how to configure mikrotik vpn for celfone user i have a new mikrotik router rb951ui. i want to configure a vpn on my mikrotik so that my families and friends in other province can connect to the internet via my vpn set up in mikrotik. i dont know on...
by Revelation
Sat May 06, 2017 8:07 pm
Forum: Beginner Basics
Topic: VPN L2TPi/PSEC to Win 2012 R2 RRAS
Replies: 9
Views: 4474

Re: VPN L2TPi/PSEC to Win 2012 R2 RRAS

Hi people I'm trying to make more or less the same setup described above work, but without success so far. The only difference is my RRAS server is Windows 2003 machine. Like with benjaminb's start situation PPTP over NAT is functional, no problem. I've added all of the mentioned firewall/NAT rules...
by Revelation
Sat May 06, 2017 6:27 am
Forum: Beginner Basics
Topic: Two Devices on the same WiFi don't talk together
Replies: 7
Views: 1304

Re: Two Devices on the same WiFi don't talk together

It reads more like a host-based firewall issue.

If your hosts are windows based, ensure the network type is not set to Public. I have seen them automatically change when Windows thinks it's connected to a new network and assumes it's a public one.
by Revelation
Fri May 05, 2017 1:03 am
Forum: Beginner Basics
Topic: CAPsMAN
Replies: 11
Views: 1701

Re: CAPsMAN

Without seeing the rest of your conifg, I'd start with double-checking your NAT and Firewall.
by Revelation
Thu Apr 27, 2017 2:03 am
Forum: General
Topic: CISCO policy-map equivalent - MikroTik RouterOS
Replies: 5
Views: 1090

Re: CISCO policy-map equivalent - MikroTik RouterOS

Read up up Mangle and Queues for Mikrotik on the wiki. Mangle is closer to policy-maps though simple queues may provide an alternative way.
by Revelation
Sat Apr 22, 2017 7:23 am
Forum: Beginner Basics
Topic: 4 WAN IPs, forward to internal webservers
Replies: 2
Views: 551

Re: 4 WAN IPs, forward to internal webservers

Your destination NATs are incorrect.

Here is an example of how it should look.
add action=dst-nat chain=dstnat dst-address=92.64.122.167 dst-port=80 to-address=192.168.88.248 to=port=80
by Revelation
Wed Mar 22, 2017 11:42 pm
Forum: General
Topic: MicroSd Cards
Replies: 4
Views: 3597

Re: MicroSd Cards

I have read that happens when you use one that is larger than 16Gb. I had the same problem when I tried a 64Gb MicroSD card.
by Revelation
Sun Mar 19, 2017 8:16 pm
Forum: General
Topic: Ring network with Mikrotik and Cisco
Replies: 1
Views: 1105

Re: Ring network with Mikrotik and Cisco

RouterOS does support loop protect mode. RouterOS also supports RSTP on bridging interfaces according to the wiki. I'd avoid that all together, myself. If I were working on your network, I would setup all switches as L2/L3 and utilize OSPF to handle the packets flowing over the links to get around t...
by Revelation
Sun Mar 19, 2017 7:40 pm
Forum: General
Topic: Ryzen build for Routeros
Replies: 3
Views: 980

Re: Ryzen build for Routeros

I concur with the previous replies. I have a CCR1009 that handles my 1Gb symmetrical connection and multiple VPNs / FW rules without ever breaking a sweat.
by Revelation
Sun Mar 19, 2017 6:20 am
Forum: Beginner Basics
Topic: Multi-Tennant setup
Replies: 4
Views: 725

Re: Multi-Tennant setup

Each client will provide, or be provided, a router to connect back to the gateway IP for internet access. Each router will provide local DHCP. The FW rules to prevent cross-talk is intriguing. Which rules would you implement to prevent cross-talk? FW rules would be simple. For instance, let's assum...
by Revelation
Sat Mar 18, 2017 5:23 am
Forum: Beginner Basics
Topic: Multi-Tennant setup
Replies: 4
Views: 725

Re: Multi-Tennant setup

How many separate entities will be getting service through you? If it is 12 (1 for ISP + 1 for your router + 12) or fewer you can simply assign all ports to be slave to your WAN interface and their router will get a public IP that way. You can use FW rules on your Mikrotik to prevent the IPs from cr...
by Revelation
Fri Mar 10, 2017 10:58 pm
Forum: Beginner Basics
Topic: Should I be using Masquerade in my firewall?
Replies: 1
Views: 1124

Re: Should I be using Masquerade in my firewall?

Masquerade is for when you want the router to use its WAN address in place of a host inside your LAN when packets leave your network.
by Revelation
Sat Mar 04, 2017 7:57 pm
Forum: General
Topic: Routing between sites when using IPsec tunnels
Replies: 9
Views: 3803

Re: Routing between sites when using IPsec tunnels

You can build a tunnel between A and C or you can permit their traffic to go over both tunnels and include routes on A and C so they know where to send the traffic. In other words: 1) Router 'A' will need a route pointing to the tunnel between 'A' and 'B' to reach 192.168.30.0/24 2) Router 'C' will ...
by Revelation
Tue Feb 28, 2017 10:41 pm
Forum: Beginner Basics
Topic: Need help adding second wan
Replies: 4
Views: 1067

Re: Need help adding second wan

If you have a specific application or service that you are connecting to. The Application on your device may need both TCP and UDP connections. So let's say that you first establish a TCP connection to service. The application then sends UDP packets, the receiving end would see a different IP and ma...
by Revelation
Tue Feb 28, 2017 8:33 pm
Forum: Beginner Basics
Topic: Need help adding second wan
Replies: 4
Views: 1067

Re: Need help adding second wan

I don't recommend splitting your UDP and TCP traffic across two different ISPs. You can run into the issue where a connection uses both UDP and TCP and it will cause issues when the destination is seeing two different IPs.

I advise finding a better solution to using both ISPs.
by Revelation
Sun Feb 19, 2017 6:44 pm
Forum: Beginner Basics
Topic: How to do port forwarding for online game
Replies: 12
Views: 9776

Re: How to do port forwarding for online game

What are you talking about? I open a new terminal and run this code with the port and my IP: chain=dstnat action=dst-nat in-interface=(put your WAN interface here) dst-port=(Ports Needed for Game/Service) to-addresses=(your LAN IP address here) to-ports=(Ports Needed for Game/Service) protocol=tcp ...
by Revelation
Sun Feb 19, 2017 5:59 pm
Forum: Beginner Basics
Topic: How to do port forwarding for online game
Replies: 12
Views: 9776

Re: How to do port forwarding for online game

Thanks.
I change my IP to static.
I confused a little bit!
LAN IP address = My static IP address, Right?

And I try to run the command and it says "syntax error (line 1 column 6)".
What are you talking about?
by Revelation
Sun Feb 19, 2017 3:38 am
Forum: Beginner Basics
Topic: How to do port forwarding for online game
Replies: 12
Views: 9776

Re: How to do port forwarding for online game

Thanks for the answer, guys. Really appreciate it. How about a port number range? I want to open port for World of Tanks game. 10501 & 10502 TCP and 8251 UDP. Should I create new rule for each port? Port ranges are possible, though I typically do individual ones. Thanks, Revelation. Make IP static ...
by Revelation
Thu Feb 16, 2017 4:02 pm
Forum: Beginner Basics
Topic: How to do port forwarding for online game
Replies: 12
Views: 9776

Re: How to do port forwarding for online game

You will need to configure a dst-nat for inbound traffic. It is recommend that you use a static IP on your PC or at least set a DHCP reservation so your PC pulls the same IP address every time. It should look something like: chain=dstnat action=dst-nat in-interface=(put your WAN interface here) dst-...
by Revelation
Mon Feb 13, 2017 8:10 pm
Forum: Beginner Basics
Topic: Outgoing port 9 for port 2 (second ISP line)
Replies: 3
Views: 677

Re: Outgoing port 9 for port 2 (second ISP line)

Easiest way, setup the server in it's own subnet. Setup a new NAT with masquerade and only allow that server to use that NAT. Ensure the server's subnet is not allowed to use ISP 1's NAT.
by Revelation
Sat Jan 14, 2017 11:04 pm
Forum: Beginner Basics
Topic: changing destination IP of packet
Replies: 6
Views: 3340

Re: changing destination IP of packet

Have you tried using a mangle rule? Here's an example of something you can try. 2 chain=prerouting action=route passthrough=yes route-dst=2.2.2.2 src-address=192.168.100.5 dst-address=1.1.1.1 log=yes log-prefix="" In the above example 192.168.100.5 is your device sending packets to 1.1.1.1; though w...
by Revelation
Fri Jan 13, 2017 2:49 pm
Forum: Beginner Basics
Topic: My first VPN
Replies: 3
Views: 898

Re: My first VPN

You need to provide a bit more information. First off, are both of your networks using the 192.168.1.0/24 address space? If the answer is yes, I recommend that you pick one network and re-address it. You can use NATs if you don't want to re-IP. Without seeing your VPN config, no one can tell you wha...
by Revelation
Thu Jan 12, 2017 11:35 pm
Forum: Beginner Basics
Topic: DHCP Server does not work
Replies: 12
Views: 28527

Re: DHCP Server does not work

Why is your WAN port your Master port for every interface? Do your clients get their IP from your ISP / WAN link?
by Revelation
Thu Jan 12, 2017 3:20 pm
Forum: Beginner Basics
Topic: LAN / WAN setup
Replies: 1
Views: 1942

Re: LAN / WAN setup

Failover WAN: http://wiki.mikrotik.com/wiki/Failover_Scripting Loadbalancing WAN: http://wiki.mikrotik.com/wiki/Manual:PCC https://aacable.wordpress.com/2011/07/27/mikrotik-dual-wan-load-balancing-using-pcc-method-complete-script-by-zaib/ As far as the LAN side, that is pretty simple. Ensure your na...
by Revelation
Thu Jan 12, 2017 3:01 pm
Forum: Beginner Basics
Topic: Route all my traffic through a VPN
Replies: 7
Views: 3633

Re: Route all my traffic through a VPN

Just to make sure I am following correctly... When you are referring to connecting to the VPN on your Mikrotik; are you talking about your Mikrotik is sitting at home and you are attempting to VPN from school to home? Or have you brought your Mikrotik with you and you are connecting it to the school...
by Revelation
Sat Jan 07, 2017 1:24 am
Forum: General
Topic: [Q] Rate limit single server's IP
Replies: 10
Views: 1382

Re: [Q] Rate limit single server's IP

Glad you found what you were looking for. There's always more than one way to "skin a cat."
by Revelation
Fri Jan 06, 2017 2:51 pm
Forum: General
Topic: [Q] Rate limit single server's IP
Replies: 10
Views: 1382

Re: [Q] Rate limit single server's IP

Here's an older thread covering this very topic:

http://forum.mikrotik.com/viewtopic.php?t=98133
by Revelation
Fri Jan 06, 2017 2:47 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

You can use Wireshark to see what packets are coming and going from your PC. You can also use netstat to see what communication is happening. I recommend wireshark as it will give you a ton of information about this communication.
by Revelation
Fri Jan 06, 2017 2:43 pm
Forum: General
Topic: [Q] Rate limit single server's IP
Replies: 10
Views: 1382

Re: [Q] Rate limit single server's IP

One thing I would check is to ensure you have fasttrack disabled. Oh I thought having fast track was good. Are you saying that you can't use fast track if your using any form of rate limit even if it's just for one IP? And fyi it's enabled. Typically fast track is good. When fast track is enabled, ...
by Revelation
Thu Jan 05, 2017 11:47 pm
Forum: General
Topic: [Q] Rate limit single server's IP
Replies: 10
Views: 1382

Re: [Q] Rate limit single server's IP

One thing I would check is to ensure you have fasttrack disabled.
by Revelation
Thu Jan 05, 2017 11:40 pm
Forum: Beginner Basics
Topic: Balance and failsafe
Replies: 8
Views: 1835

Re: Balance and failsafe

The wiki explains how to mark packets as group a and groupb Does this mean one client would have two ip address one from Each group I still dont understand how i can route one wan to group a and one to group b Your original post stated that you were looking at loadbalancing two internet connections...
by Revelation
Thu Jan 05, 2017 3:43 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

I won't be able to personally check out your device until sometime this weekend.

There are a lot of steps that you haven't taken or simply haven't annotated on here that can help identify the issue - most of those steps have been mentioned in previous posts.
by Revelation
Thu Jan 05, 2017 3:23 pm
Forum: General
Topic: Looking to build a home/small business network
Replies: 9
Views: 2474

Re: Looking to build a home/small business network

Following up with what jarda typed; I recommend that you step up to a CCR. It will give you better performance when it comes to routing, VPN, FW, etc... It will also meet future growth needs without having to upgrade your hardware. The more features you slowly add over time will take a hit, the CCR ...
by Revelation
Thu Jan 05, 2017 3:17 pm
Forum: Beginner Basics
Topic: changing destination IP of packet
Replies: 6
Views: 3340

Re: changing destination IP of packet

If your packet is going from inside your network to an external source, you need to use a src-nat.
by Revelation
Thu Jan 05, 2017 3:16 pm
Forum: Beginner Basics
Topic: routing problem
Replies: 8
Views: 1331

Re: routing problem

Yes, 33.0 and 34.0 are NAT routed to the gateway (33.1) but 33.0 also routed directly to 34.0 without NAT (34.0 can directly communicate with 33.0). Say what? So the gateway on R1 is the NAT for both networks? Where is your ISP connection? If x.x.33.0/24 and x.x.34.0/24 can "talk" directly with eac...
by Revelation
Thu Jan 05, 2017 3:11 pm
Forum: Beginner Basics
Topic: Balance and failsafe
Replies: 8
Views: 1835

Re: Balance and failsafe

For load balancing check out the wiki:

http://wiki.mikrotik.com/wiki/Load_Bala ... e_Gateways
by Revelation
Wed Jan 04, 2017 10:52 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

Hi, Just a guess. On first rule, chain "forward", would not be corect if you specify the interface ? kind regards, Not really. The way Mikrotik views things, my understanding, is if the packet is destined for the router itself is chain = input; whereas a packet destined for something beyond the rou...
by Revelation
Wed Jan 04, 2017 10:43 pm
Forum: Beginner Basics
Topic: routing problem
Replies: 8
Views: 1331

Re: routing problem

Couple of things... Is R1 acting as a NAT for the x.x.34.0/24 network; or is it just a router that routes the traffic? How is routing between R1 and R2 handled currently? Can devices in x.x.33.0/24 "talk" directly with devices in x.x.34.0/24 without the use of a NAT? In my opinion, the easiest thing...
by Revelation
Wed Jan 04, 2017 10:25 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

I don't see anything wrong with your config off-hand. Since you noted that you were seeing the dst-nat increment that lets me know that that part is configured correctly. We need to look at your PC and ensure that it is responding to the packets and Windows Firewall is not blocking anything. After t...
by Revelation
Tue Jan 03, 2017 9:24 pm
Forum: Forwarding Protocols
Topic: config public ip in mikrotik for server
Replies: 5
Views: 1035

Re: config public ip in mikrotik for server

There is no picture attached. I assume you want to connect to your server attached to your network behind your Mikrotik. You can accomplish this two ways: Setup a destination nat (I don't recommend in this case - not enough info provided) I would use this option for a webserver or other types of hos...
by Revelation
Tue Jan 03, 2017 8:35 pm
Forum: Beginner Basics
Topic: VPN MAC OS
Replies: 15
Views: 7032

Re: VPN MAC OS

3DES is not very secure anymore. I recommend going with AES256 as your encryption method.
by Revelation
Tue Jan 03, 2017 8:26 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

For simplicity sake lets say your WAN IP is 1.1.1.1 . For the WAN IP is that a public IP or a private IP assigned by an ISP modem? For instance, some ISPs have a modem that does DHCP on the customer side, usually 192.168.1.0/24 or something like that. Have you ran any packet captures or enabled logs...
by Revelation
Tue Jan 03, 2017 8:17 pm
Forum: Beginner Basics
Topic: Site-to-site, can ping but can't pass on connection
Replies: 4
Views: 967

Re: Site-to-site, can ping but can't pass on connection

Your post is not clear as to what you are doing or attempting. You have no configs snippets for peer review. You have no diagram to go by.

All you have so far asked for is a guessing game...
by Revelation
Tue Jan 03, 2017 4:55 pm
Forum: General
Topic: Looking to build a home/small business network
Replies: 9
Views: 2474

Re: Looking to build a home/small business network

CRS are great switches, though when you run them as routers you will find that they typically cannot handle faster internet speeds. What will be your up/down speeds from your ISP? CCR will be a better choice if your expected speeds are greater than 200/200Mbps. About the network. Correct me if I'm w...
by Revelation
Tue Jan 03, 2017 4:43 pm
Forum: Beginner Basics
Topic: Open port (GAMERANGER)
Replies: 16
Views: 5894

Re: Open port (GAMERANGER)

Can you confirm the IP of your PC that is trying to connect via GameRanger?
Are we to assume 192.168.158.254 is the IP of your PC?
What is the network address space that this device lives in?
Based on the config, ether4 is your WAN interface?
by Revelation
Tue Dec 20, 2016 1:33 am
Forum: General
Topic: iPhone VPN AT&T
Replies: 10
Views: 3606

Re: iPhone VPN AT&T

I have an iPhone with AT&T and have L2TP setup for VPN access to my Mikrotik. AT&T does not block VPN service. Couple of Code snippets: /Firewall 21 ;;; Permit L2TP VPN chain=input action=accept protocol=udp in-interface=ether5 dst-port=500 log=no log-prefix="" chain=input action=accept protocol=udp...
by Revelation
Tue Dec 20, 2016 1:30 am
Forum: General
Topic: Move from public to private addressing
Replies: 11
Views: 1664

Re: Move from public to private addressing

Using prIvate iP does make it harder to log traffic because everybody is sharing the wan ip that would be what is logged by most Internet servers. So any illegal activity is tied to that ip which your router uses. So if you had a court order you would need to find which private ip was accessing the...
by Revelation
Thu Dec 15, 2016 3:18 pm
Forum: Beginner Basics
Topic: need help for port forwarding..
Replies: 11
Views: 1383

Re: need help for port forwarding..

You have no forwarding configs in place. What are you trying to forward?

source IP:
destination IP:
port:

Are you running a NAT? If so, then this:
source IP:
WAN IP:
destination IP:
port:

Once we have that we can assist.
by Revelation
Thu Dec 15, 2016 3:14 pm
Forum: Beginner Basics
Topic: Disallow LAN to access configuration of modem using Mikrotik
Replies: 4
Views: 850

Re: Disallow LAN to access configuration of modem using Mikrotik

A simple firewall rule denying traffic to the destination IP will suffice.
by Revelation
Fri Dec 09, 2016 9:47 pm
Forum: General
Topic: Move from public to private addressing
Replies: 11
Views: 1664

Re: Move from public to private addressing

Ok, here is our current situation. I have inherited one network, which is more like two separate networks that are duct taped together. 2 head end providers no HA or failover set up currently. currently 200M pipe from each, but scalable to Gig+ as necessary. 2 /24 public subnets available on each h...
by Revelation
Fri Dec 09, 2016 3:45 pm
Forum: General
Topic: Move from public to private addressing
Replies: 11
Views: 1664

Re: Move from public to private addressing

So, last week I inherited an network that has all of it's devices on a public facing network, yikes. I obviously want to transition them to a routed private network schema and am looking for guidance. Currently there is an EdgeRouter at the head end, and all tower sites are switched only. My plan i...
by Revelation
Fri Dec 09, 2016 3:31 pm
Forum: General
Topic: Move from public to private addressing
Replies: 11
Views: 1664

Re: Move from public to private addressing

Won't the clients prefer a public ip? Most public Internet services offer a public ip so it's not unusual? I would have though better than having a nat private ip as long as client devices are setup correctly there should be no problem? Also by using prIvate ip its much harder to log and check traf...
by Revelation
Tue Dec 06, 2016 11:34 pm
Forum: Beginner Basics
Topic: Cannot route between two private ip ranges on the same router?
Replies: 9
Views: 1571

Re: Cannot route between two private ip ranges on the same router?

Have you checked the local Windows Firewall log? Depending on the network configuration for Windows firewall it could be blocking the other network. Try disabling Windows firewall on a device in the 10.0.5.0/24 range and on the 10.0.6.0/24 range - then ping. Now you should only need to disable it on...
by Revelation
Sat Dec 03, 2016 9:49 pm
Forum: Beginner Basics
Topic: Router cannot get IP Address
Replies: 3
Views: 2149

Re: Router cannot get IP Address

Hi everyone, I recently installied a linksys MODEM DPC3008 for Comcast cable internet. I can get internet if I have my laptop directly wired to modem. But if I add a router (RB750Gr2) connected to the modem , there is no internet. I logged on to the 750, and found the router didn't get WAN IP addre...
by Revelation
Wed Oct 05, 2016 2:58 am
Forum: Beginner Basics
Topic: i am not get full bandwidth
Replies: 2
Views: 810

Re: i am not get full bandwidth

You need to provide a whole lot more details about your "test" before anyone can be of any real assistance.
by Revelation
Wed Oct 05, 2016 2:57 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

No, just add another rule dropping your traffic from reaching any IP in the 192.168.2.0/24 address space. You place that right after your permit to 192.168.2.152 for the printer. Hi Revelation Yep I understand. Isn't that what the second of the two rules above does? (using the !=not) Could you give...
by Revelation
Mon Oct 03, 2016 11:09 pm
Forum: General
Topic: replace Windows PPTP VPN
Replies: 12
Views: 2026

Re: replace Windows PPTP VPN

Maybe I am missing something...

Why not just set up your VPN server on the CCR and then allow that specific traffic to "talk" to the server?
by Revelation
Mon Oct 03, 2016 10:59 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

If you set up your firewall rules to only allow traffic to and from the printer IP, this should not be a problem at all. If you wish to have more access between your networks then you can look at blocking the ports used by Bonjour. You should only need ports 5353, 5297, 5298 blocked. Hi Revelation ...
by Revelation
Sun Oct 02, 2016 6:34 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

If you set up your firewall rules to only allow traffic to and from the printer IP, this should not be a problem at all. If you wish to have more access between your networks then you can look at blocking the ports used by Bonjour. You should only need ports 5353, 5297, 5298 blocked. Hi Revelation ...
by Revelation
Sun Oct 02, 2016 2:08 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi Revelation One minor issue has arisen whereby Macs on both networks can see one another via Bonjour, which as far as I can ascertain uses UDP 5353 Multicast. Do I need to define a specific firewall rule dropping all UDP packets between the two LANs and if so what would that look like? If you set...
by Revelation
Mon Sep 19, 2016 7:58 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi Revelation Well that worked fantastically and exactly as expected. Thank you so much for your help with this. I've learned a lot, which will also apply to other situations I'm sure to face so thank you for your help on the education front also! Best wishes Robin Glad everything is working as exp...
by Revelation
Sun Sep 18, 2016 6:13 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hey Revelation Thanks! I will try this configuration and see how I get on. With my earlier configuration, I was firstly missing the NAT masquerade and additionally did not have ether3 as out/in interfaces on the first two firewall rules. On the drop firewall rule (your #3 above) do I need to specif...
by Revelation
Sun Sep 18, 2016 6:09 am
Forum: Beginner Basics
Topic: Dual WAN In - Dual LAN Out?
Replies: 6
Views: 2218

Re: Dual WAN In - Dual LAN Out?

Easiest way I can think of off the top of my head is configure your NATs to only service one LAN or the other.

i.e. WAN1 NAT services LAN1 / WAN2 NAT service LAN2
by Revelation
Sat Sep 17, 2016 8:33 pm
Forum: General
Topic: Using L2TP/IPSec VPN with iOS 10
Replies: 30
Views: 74156

Re: Using L2TP/IPSec VPN with iOS 10

Guys you need to check your settings.

I am running iOS10, I can connect via L2TP/IPSEC to my Mikrotik - further I can access any device within my network as well as being allowed to access the internet through my Mikrotik.

Double-check your NAT / Firewall Rules.
by Revelation
Sat Sep 17, 2016 8:05 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi Again! Just a quick reply with some links for the image... https://s22.postimg.io/4r6uq2kz5/network.png or shortened with Goo.gl: goo.gl/hrXkyX Can you see those? Could aways email… Regards Robin Hey Robin, Got it sorted and what I was thinking was correct. So I am going to assume that you have ...
by Revelation
Sat Sep 17, 2016 6:20 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...
by Revelation
Thu Sep 15, 2016 3:54 pm
Forum: Beginner Basics
Topic: Help my router not browsing
Replies: 1
Views: 462

Re: Help my router not browsing

To get clarification...

Are you saying your Router can't reach an external IP or that devices connected to your router can't reach external IPs via http / https?

You stated that you can ping your DNS, is that your local DNS on your Router or your ISP's / Google DNS?
by Revelation
Thu Sep 15, 2016 3:15 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...
by Revelation
Wed Sep 14, 2016 4:34 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...
by Revelation
Sat Sep 10, 2016 3:06 pm
Forum: Beginner Basics
Topic: amazon fire tv not getting dhcp address after lease expires on mikrotik router
Replies: 39
Views: 10035

Re: amazon fire tv not getting dhcp address after lease expires on mikrotik router

Actually if you read my statement again you will see that I never wrote that it was a problem with dhcp relay. What I gave you was a possible workaround to the behavior of the FireTV.
by Revelation
Sat Sep 10, 2016 4:46 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Once you have the /30 configured between them, go ahead and ping the remote IP from each box. before we get into configuring routes and FW rules, lets make sure the basics are working. If both ping successfully, move on to creating the static routes. You then want to test that by pinging the Printer...
by Revelation
Sat Sep 10, 2016 4:43 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Okay, no problem on the IPs. The information below is based on the diagram to keep things clear, change the IPs to meet your actual environment. The /30 between them is important. Both routers will know of the directly connected route automatically. What you then do is add routing statements to send...
by Revelation
Sat Sep 10, 2016 4:36 am
Forum: General
Topic: VLAN traffic trough VPN (L2TP IPSec)
Replies: 3
Views: 2969

Re: VLAN traffic trough VPN (L2TP IPSec)

If you are using an L2TP interface for your tunnel you can setup a mangle rule to capture the source traffic and "point" it to your L2TP interface.
by Revelation
Sat Sep 10, 2016 4:28 am
Forum: Beginner Basics
Topic: How to forward ports from inside my network to the outside world Outgoing and incoming
Replies: 2
Views: 612

Re: How to forward ports from inside my network to the outside world Outgoing and incoming

To touch on what kaptain46 wrote. You'll need to setup the NAT with masquerade for your traffic on your LAN to use your WAN IP to get out of your network.
by Revelation
Sat Sep 10, 2016 4:21 am
Forum: Beginner Basics
Topic: Wireless printer does not work
Replies: 2
Views: 1156

Re: Wireless printer does not work

I have this RB3011 and (AC) wAP and running CapsMan. I can connect the Brother Printer Wireless, but sometime I can not print from my MacBook or iPhone. My wife can not even add the printer in settings (MacBook) I have enabled "Client to Client" in "Datapath" If I scan my network I can see the prin...
by Revelation
Sat Sep 10, 2016 4:08 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

Alright, there are some issues... You can't just rely on a /24 network between the routers to route your traffic effectively. I created a rudimentary diagram to show how you can set this up and have it work. You can adjust the IPs as needed. Now the ip route commands are probably not the correct syn...
by Revelation
Sat Sep 10, 2016 3:44 am
Forum: Beginner Basics
Topic: amazon fire tv not getting dhcp address after lease expires on mikrotik router
Replies: 39
Views: 10035

Re: amazon fire tv not getting dhcp address after lease expires on mikrotik router

You could try setting up a relay for the DHCP server. Now typically this is needed when a DHCP server sits in another subnet. Based on the Packet Capture I assume that it is a /24 and the gateway on the router is also the DHCP server. What I would do is setup a relay pointing to the DHCP server for ...
by Revelation
Sat Sep 10, 2016 3:29 am
Forum: General
Topic: One ISP Modem, multiple dynamic IP addresses
Replies: 14
Views: 2334

Re: One ISP Modem, multiple dynamic IP addresses

That's not how I read it. He wrote that it currently is assigned via DHCP, but he wants to manually assign the IPs from his router. At least that is what I understood his intentions were.
by Revelation
Sat Sep 10, 2016 3:25 am
Forum: General
Topic: One ISP Modem, multiple dynamic IP addresses
Replies: 14
Views: 2334

Re: One ISP Modem, multiple dynamic IP addresses

You can assign multiple IP addresses to an interface, would work if you were looking at having multiple public IPs on the WAN interface. Depending on what you are trying to achieve, you can assign additional IPs to virtual interfaces on the router itself, such as a bridge interface. It really depend...
by Revelation
Sun Jul 31, 2016 9:50 pm
Forum: Beginner Basics
Topic: RB2011 is not working with Freecom NAS drive
Replies: 5
Views: 686

Re: RB2011 is not working with Freecom NAS drive

I have tried - in the state of a static IP almost rendering my Freecom HD untraceable. Had to reset the thing to find it again on the network. For me, it has to be automatic. The IP address assigned by Mikrotik's DHCP server. The standard way, no hustle. The question is why does it not work here (w...
by Revelation
Sat Jul 30, 2016 3:26 pm
Forum: General
Topic: problem instal mikrotik on GNS3
Replies: 9
Views: 1420

Re: problem instal mikrotik on GNS3

any help? just i need help for: number 6   6) Create RouterOS template: Edit -> Preferences -> Qemu VM's -> New -> Type: Default -> Choose a name -> Choose amount of RAM to allocate for one RouterOS instance: 64MB is suggested -> Chose disk image that was downloaded in step 4. Change network adapte...
by Revelation
Fri Jul 29, 2016 1:28 am
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

With a cable, of course, running from the port on the MikroTik where that address is configured to any port on the switch. Of course!  :D So cable from SRX to Mikrotik port (say) 5. Then configure (in the Mikrotik) port 5 with a fixed IP of 192.168.2.253/24, which would allow the devices on 192.168...
by Revelation
Fri Jul 29, 2016 1:23 am
Forum: Beginner Basics
Topic: IPsec vpn Site-to-Site
Replies: 4
Views: 2173

Re: IPsec vpn Site-to-Site

Hi ! I'm struggling to get site-to-site IPsec configured between two sites. Both the RB2011UiAS's are behind WAN routers (TP-Link(ADSL) and Ubiquity (WIFI)) in a DMZ configuration.  I followed  the Mikrotik Manual , including the NAT'ing parts. It seems that the both the RBs are communicating and I...
by Revelation
Fri Jul 29, 2016 1:04 am
Forum: General
Topic: FILTER/NAT RULES FOR IPSEC VPN
Replies: 16
Views: 5476

Re: FILTER/NAT RULES FOR IPSEC VPN

What I can:  From HeadQuarter to Location:  Ping the Location router - both from HQ router and local machines NOT ping the LAN printer accesspoints etc NOT Access RDP/Filesharing etc from Location LAN From Location to HeadQuarter:  Ping the HQ router - both from Location router and local machines P...
by Revelation
Thu Jul 28, 2016 4:12 pm
Forum: Beginner Basics
Topic: [SOLVED] Printer shared to second LAN?
Replies: 37
Views: 10056

Re: Printer shared to second LAN?

With a cable, of course, running from the port on the MikroTik where that address is configured to any port on the switch. Of course!  :D So cable from SRX to Mikrotik port (say) 5. Then configure (in the Mikrotik) port 5 with a fixed IP of 192.168.2.253/24, which would allow the devices on 192.168...
by Revelation
Thu Jul 28, 2016 3:15 pm
Forum: General
Topic: how to allow vpn for not acive route
Replies: 1
Views: 412

Re: how to allow vpn for not acive route

I'm going to assume that you misspoke in regards to the second "route" not being "active." From my point of view if the route is not active, that means it is not functioning / passing data / admin down. I assume by "not active" you mean not configured as your primary gateway? Is that what you meant?...
by Revelation
Mon Jul 18, 2016 3:16 pm
Forum: Beginner Basics
Topic: Port forwarding for nvr
Replies: 1
Views: 593

Re: Port forwarding for nvr

What seems to be the problem? Can you post your current config attempts?

What are you trying to achieve?
by Revelation
Mon Jul 18, 2016 4:29 am
Forum: Beginner Basics
Topic: No internet access after configuring DHCP and a few other questions
Replies: 7
Views: 1193

Re: No internet access after configuring DHCP and a few other questions

So I figured out why this is happening (all ports are bridged so that wan and lan traffic resides on the same network).  Now how do I solve this? I haven't done anything close to this before so I'm out on a limb. WAN traffic comes in on SFP1. Will need to do more reading I guess.. You don't want yo...
by Revelation
Thu Jul 07, 2016 4:34 am
Forum: General
Topic: Please help with Queue
Replies: 2
Views: 539

Re: Please help with Queue

Check to see if you have fastback enabled; that will not work with simple queues. 
by Revelation
Thu Jul 07, 2016 4:29 am
Forum: General
Topic: Choose router?
Replies: 29
Views: 4255

Re: Choose router?

The proper hardware selection will be based entirely on what speeds you will offer the residents, your oversubscription rate, number of residents/connections, distance between devices, etc...  Without more detail, no one can really answer your question. A $200 Mikrotik may work, or you may need to s...
by Revelation
Tue Jul 05, 2016 2:43 am
Forum: Beginner Basics
Topic: Complicated VLAN setup
Replies: 21
Views: 4252

Re: Complicated VLAN setup

Alright, I'll delete that. Do I also set all ports as masters?
How about DHCP, was that redundant?

David
No, don't setup any master ports for now. A single DHCP with separate pools will work just fine. 
by Revelation
Mon Jul 04, 2016 9:33 pm
Forum: Beginner Basics
Topic: Complicated VLAN setup
Replies: 21
Views: 4252

Re: Complicated VLAN setup

I did everything Revelation wrote and as far as I can tell nothing has changed. Computers can still see each other and the subnet is still 192.168.88.0/24. I've also added two new DHCP servers and IP pools (10.10.100.0/24 and 10.10.200.0/24) but that didn't change anything either and they're shown ...
by Revelation
Mon Jul 04, 2016 4:07 pm
Forum: Beginner Basics
Topic: [RESOLVED] Static Route Between Two ether
Replies: 9
Views: 3805

Re: Static Route Between Two ether

If you run the command /ip route print, what do you see?
by Revelation
Sun Jul 03, 2016 2:43 am
Forum: Beginner Basics
Topic: Problems accessing router with client side ip configuration
Replies: 6
Views: 1373

Re: Problems accessing router with client side ip configuration

Hello, i've just configured a RB750r2 as rooter wit nat. Everthing works fine, as long as Clients configured to use use DHCP server of router. But when i configure a fix ip at client side (IP-Adress, Gatway), client is able to communicate, but is not able to access DNS Server. This is very strange,...
by Revelation
Sun Jul 03, 2016 2:33 am
Forum: General
Topic: Port forwarding problem.
Replies: 10
Views: 1573

Re: Port forwarding problem.

How is the VPN setup in regards to interesting traffic allowed over the VPN? So if router1 can ping and reach the server 192.168.0.19 via port 80, then it has to due with how your VPN is configured. 
by Revelation
Sun Jul 03, 2016 2:25 am
Forum: General
Topic: no traffic over IPIP tunnel when encrypted
Replies: 3
Views: 1061

Re: no traffic over IPIP tunnel when encrypted

I recreated your scenario in a lab and I am not running into any issues. One thing I did do differently is all of the gateways are set for their respective interface versus an IP address. i.e.: [admin@MikroTik] > ip ipsec proposal print Flags: X - disabled, * - default  name="default" auth-algorithm...
by Revelation
Sat Jul 02, 2016 11:38 pm
Forum: Beginner Basics
Topic: Complicated VLAN setup
Replies: 21
Views: 4252

Re: Complicated VLAN setup

Thank you I'll do this and let you know how it went. What should I be looking out for with the firewall? NAT masqurade or something more sinister? I only have basic security set up (eg. port scanner and ssh bruteforce drop) and some port forwards. David For the firewall, you will want to have a rul...
by Revelation
Sat Jul 02, 2016 9:43 pm
Forum: General
Topic: Can but cannot login Winbox from WAN
Replies: 3
Views: 1525

Re: Can but cannot login Winbox from WAN

I think leaving your management open to the outside world is a bad idea. A better idea would be to configure a VPN between the two devices and access the management of the device via that VPN tunnel. 
by Revelation
Sat Jul 02, 2016 9:38 pm
Forum: Beginner Basics
Topic: prioritizing simple queues
Replies: 2
Views: 619

Re: prioritizing simple queues

Pretty sure you will have to use Queue Trees to set a priority order. 

http://wiki.mikrotik.com/wiki/Traffic_P ... lemetation
by Revelation
Sat Jul 02, 2016 9:33 pm
Forum: Beginner Basics
Topic: Complicated VLAN setup
Replies: 21
Views: 4252

Re: Complicated VLAN setup

After you did all of that you will need to look at firewall rules to prevent the two networks from "speaking" with each other. You will then need to look at queues or QoS to achieve your desired results for bandwidth management. 
by Revelation
Sat Jul 02, 2016 9:31 pm
Forum: Beginner Basics
Topic: Complicated VLAN setup
Replies: 21
Views: 4252

Re: Complicated VLAN setup

Couple of things: The unmanaged switch, most likely, cannot have a single port working as a trunk. Most likely the ports can only be access ports, thus you could not trunk multiple vlans to the switch.  As far as the bandwidth goes, you can use qos, policies and or queues to obtain your goals. I've ...
by Revelation
Sat Jul 02, 2016 8:56 pm
Forum: Beginner Basics
Topic: [ANSWERED] Is it normal to not see all the DHCP clients in the DHCP lease list?
Replies: 8
Views: 1503

Re: Is it normal to not see all the DHCP clients in the DHCP lease list?

No it does not depend on traffic passing. It depends on the lease time set in the previous router. When that was set to 1 year, it can take half a year before everyone has re-requested DHCP :-) Actually it does. If the host is sending DHCP requests packets but the DHCP server never sees them thus t...
by Revelation
Sat Jul 02, 2016 6:29 am
Forum: Beginner Basics
Topic: [ANSWERED] Is it normal to not see all the DHCP clients in the DHCP lease list?
Replies: 8
Views: 1503

Re: Is it normal to not see all the DHCP clients in the DHCP lease list?

Depends on what your lease timers are set for, if the device is on and passing traffic and/or if it is communicating with the DHCP server. 
by Revelation
Sat Jul 02, 2016 6:24 am
Forum: Beginner Basics
Topic: Conecction between wans
Replies: 2
Views: 638

Re: Conecction between wans

Or create firewall rule permitting the traffic between those two devices.
by Revelation
Sat Jul 02, 2016 6:07 am
Forum: General
Topic: L2TP + IpSec problem
Replies: 8
Views: 1530

Re: L2TP + IpSec problem

dd address-list="" !bridge !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before local-address=192.168.70.1 name=casa-in on-down="" \ ... add caller-id="" disabled=no limit-bytes-in=0 limit-bytes-out=0 !local-address name=xxxxxx p...
by Revelation
Sat Jul 02, 2016 5:45 am
Forum: General
Topic: Port forwarding problem.
Replies: 10
Views: 1573

Re: Port forwarding problem.

What is the source? Are you trying to send all traffic hitting your WAN IP of 80.78.65.x:81 to 192.168.0.19:80? You want this traffic then directed over the VPN to the  172.168.14.x network? Or are you trying to get internal traffic over to the 192.168.0.19 address? chain=dstnat action=dst-nat to-ad...
by Revelation
Sat Jul 02, 2016 5:34 am
Forum: General
Topic: no traffic over IPIP tunnel when encrypted
Replies: 3
Views: 1061

Re: no traffic over IPIP tunnel when encrypted

Without seeing the configuration it's hard to tell. If the tunnel is up, I would first look at what traffic is allowed over the tunnel. 
by Revelation
Sat Jul 02, 2016 5:27 am
Forum: General
Topic: Single VLAN out multiple ports on CRS?
Replies: 1
Views: 797

Re: Single VLAN out multiple ports on CRS?

I'm not sure why you are using vlan translation in this scenario, not the right "application" for this. You can do it two ways that I can think of off the top of my head.  1) Set one master port for each port grouping and assign the other three ports as slaves to the master port. I'm not familiar wi...
by Revelation
Sat Jul 02, 2016 3:13 am
Forum: General
Topic: Static NAT - why does this not work?
Replies: 8
Views: 1528

Re: Static NAT - why does this not work?

Where is the .22 assigned on your Mikrotik? If it is not fully assigned have you created a pool for your NAT and using rules/marks to only allow that specific box to use .22? You could also try assigning .22 to a bridge and setting up a NAT on that interface. You would need to create NAT rules for b...
by Revelation
Sat Jul 02, 2016 3:02 am
Forum: Beginner Basics
Topic: firewall for Public internet c
Replies: 1
Views: 577

Re: firewall for Public internet c

1. There are a lot of topics on firewalls here and in the general section. I recommend a search as it would be too lengthy to type it out here.

2. Are you wanting a point-to-point or something like and end user VPNing into your network? There are others as well...
by Revelation
Sat Jul 02, 2016 3:00 am
Forum: Beginner Basics
Topic: Connect two networks, 3 Routers
Replies: 2
Views: 683

Re: Connect two networks, 3 Routers

So a couple of questions if you will... This "private WAN" what IPs are you trying to reach? Will they always be in the 172.26.33.x range? I see that you are trying to advertise a large address space of 172.16.0.0/12. Why are you advertising such a large "supernet?" Can you ping your DG from your Mi...
by Revelation
Thu Jun 23, 2016 10:58 pm
Forum: General
Topic: Help with routing in mikrotik between two local networks
Replies: 1
Views: 546

Re: Help with routing in mikrotik between two local networks

I assume that the 2960 has the SVI for the 10.168.0.0/24 network?

Can your Mikrotik ping the DG of the 10.168.0.0 network?

What does your route table look like on your Mikrotik and your 2960? Does your 2960 have a route back to the Mikrotik for the 10.168.88.0/24 network?
by Revelation
Tue May 17, 2016 3:53 am
Forum: Beginner Basics
Topic: Same Nat rule differente behaviour: SSH do work; WWW-web does not.
Replies: 13
Views: 1726

Re: Same Nat rule differente behaviour: SSH do work; WWW-web does not.

If your server is seeing the traffic "hit it" in the logs then you need to focus on your server and the return communication. I would pull a packet capture on the server to see what you can find in the headers.
by Revelation
Mon May 16, 2016 10:36 pm
Forum: Beginner Basics
Topic: Same Nat rule differente behaviour: SSH do work; WWW-web does not.
Replies: 13
Views: 1726

Re: Same Nat rule differente behaviour: SSH do work; WWW-web does not.

Just to confirm, you are saying that you are seeing the traffic hitting your apache server?
by Revelation
Fri May 13, 2016 4:08 am
Forum: Beginner Basics
Topic: Multiple Trunk ports on CLoud router
Replies: 3
Views: 1670

Re: Multiple Trunk ports on CLoud router

HI all, can you advice me how to setup cloud router switch 24p, to have multiple Trunk ports? I have setup one as follow: /interface vlan add name=vlan40 vlan-id=1 interface=ether9 disabled=no /interface vlan add name=vlan44 vlan-id=2 interface=ether9 disabled=no /interface bridge add name=br-vlan1...
by Revelation
Fri May 13, 2016 3:58 am
Forum: Beginner Basics
Topic: VLAN setting
Replies: 3
Views: 970

Re: VLAN setting

Thank you Revelation, the VLAN working perfect. I would like to ask you for checking my firewall setings please for a big mistake. In this moment I have no access list for PPTP, I will create it later. The PPTP is open for all IP address for now. Flags: X - disabled, I - invalid, D - dynamic 0 chai...
by Revelation
Sun May 08, 2016 5:17 pm
Forum: General
Topic: Mikrotik Queues
Replies: 4
Views: 792

Re: Mikrotik Queues

Hi Revelation Thank you for your reply. I am a beginner on this and it would help if you could explain how to create one queue and i will manage to create the others. Simple queues are pretty easy, just keep in mind that you can't run Fast Path with simple queues. [Revelation@MikroTik] /queue simpl...
by Revelation
Sun May 08, 2016 5:08 pm
Forum: Beginner Basics
Topic: L2TP/IPsec with firewall rule
Replies: 6
Views: 37271

Re: L2TP/IPsec with firewall rule

Try configuring yours more like mine: (ether5 is my WAN interface) 7 ;;; Permit L2TP VPN chain=input action=accept protocol=udp in-interface=ether5 dst-port=500 log=no log-prefix="" 8 chain=input action=accept protocol=udp in-interface=ether5 dst-port=4500 log=no log-prefix="" 9 chain=input action=a...
by Revelation
Fri May 06, 2016 3:15 am
Forum: General
Topic: Mikrotik Queues
Replies: 4
Views: 792

Re: Mikrotik Queues

Simple queues will work just fine if you aren't using fastpath - if I remember correctly.

Simply create pools for each group of users and you can create simple queues for those pools and assign whatever limits you need.
by Revelation
Fri May 06, 2016 3:09 am
Forum: General
Topic: NTP won't synchronized
Replies: 8
Views: 1279

Re: NTP won't synchronized

Can you ping that url? Can your Mikrotik ping it?
by Revelation
Fri May 06, 2016 3:05 am
Forum: General
Topic: Two IPSEC tunnels on same WAN interface.
Replies: 17
Views: 2434

Re: Two IPSEC tunnels on same WAN interface.

Since you posted the config, I will put it in a lab this weekend and see what I can find.
by Revelation
Fri May 06, 2016 3:04 am
Forum: General
Topic: IP Address on Physical vs Bridge Interface
Replies: 2
Views: 690

Re: IP Address on Physical vs Bridge Interface

I would put the WAN address on the physical link. I cannot think of a reason where the WAN IP would be beneficial on a bridge interface.
by Revelation
Fri May 06, 2016 2:59 am
Forum: Beginner Basics
Topic: Name network or group of networks?
Replies: 6
Views: 1163

Re: Name network or group of networks?

Where would I add that comment in the "/ip service" list?

(That's one of the places I have an extensive set of network addresses).
Really? IP service would be for ports / protocols, not IPs....

You should have your networks under IP addresses....
by Revelation
Fri May 06, 2016 2:56 am
Forum: Beginner Basics
Topic: pptp vpn issue cannot reach private ip subnet via public pptp address
Replies: 1
Views: 662

Re: pptp vpn issue cannot reach private ip subnet via public pptp address

You're going to have to post some of your configuration, there are too many possibilities. Ensure that you 'x-out' the first three octets of any public ip address, i.e. x.x.x.139.

This will allow us to be of further assistance.
by Revelation
Fri May 06, 2016 2:51 am
Forum: Beginner Basics
Topic: L2TP/IPsec with firewall rule
Replies: 6
Views: 37271

Re: L2TP/IPsec with firewall rule

What is your WAN interface / IP? Please do not type out the full public IP. use: x.x.x.(last octet) What do the logs show? The logs are going to be the best bet to find the problem. I don't see anything "wrong" off-hand. Most likely you have a different setting somewhere between the client and the r...
by Revelation
Fri May 06, 2016 2:41 am
Forum: Beginner Basics
Topic: A question about firewall behaviour :
Replies: 1
Views: 882

Re: A question about firewall behaviour :

What do you mean by I can reach a lan host via port forwarding despite a relative accept rule is not present in filter What you trying to reach your LAN host from? What is your WAN interface? What is your LAN interface? Also if I try to connect a port that is not forwarded, the packet is not dropped...
by Revelation
Tue May 03, 2016 2:48 am
Forum: General
Topic: Two IPSEC tunnels on same WAN interface.
Replies: 17
Views: 2434

Re: Two IPSEC tunnels on same WAN interface.

Post your config and use x.x.x.last-octect of your WAN IP address. We will need to see the config to help you.
by Revelation
Tue May 03, 2016 2:38 am
Forum: Beginner Basics
Topic: Clock/Time problem
Replies: 1
Views: 580

Re: Clock/Time problem

You're going to need to post more details on your config for anyone to be of any assistance.
by Revelation
Tue May 03, 2016 2:37 am
Forum: Beginner Basics
Topic: Configuration of Mikrotic router for vpn
Replies: 2
Views: 707

Re: Configuration of Mikrotic router for vpn

Question for you, why is port 2 the master port if you want traffic from port 2 & 3 to only go through the vpn?

It would make more sense to configure ports 2 & 3 in a separate network.
by Revelation
Tue May 03, 2016 2:28 am
Forum: Beginner Basics
Topic: Ping question
Replies: 18
Views: 1988

Re: Ping question

When I ping 8.8.8.8 to wan (internet) also work fine but when I ping from two devices to 8.8.8.8 I got ping time out on first device. So conclusion is can't ping to wan( 8.8.8.8) from two devices simultaneously , only one by time working fine. When simultaneously ping devices between no time out,, ...
by Revelation
Tue May 03, 2016 2:21 am
Forum: Beginner Basics
Topic: Name network or group of networks?
Replies: 6
Views: 1163

Re: Name network or group of networks?

The only thing I can think of is adding a comment to the address space.
by Revelation
Mon May 02, 2016 4:28 pm
Forum: General
Topic: DMZ for MyQ garage door gateway
Replies: 8
Views: 1935

Re: DMZ for MyQ garage door gateway

I have the same garage door opener. I created a simple /30 network for the Chamberlin. Example: 192.168.5.0/30 ether1 = 192.168.5.1 Chamberlin pulls 192.168.5.2 I also configured the port to only negotiate for 10/100M. Once I setup the above configurations my Chamberlin started working just fine. I...
by Revelation
Mon May 02, 2016 4:24 am
Forum: General
Topic: DMZ for MyQ garage door gateway
Replies: 8
Views: 1935

Re: DMZ for MyQ garage door gateway

I have the same garage door opener. I created a simple /30 network for the Chamberlin.

Example:
192.168.5.0/30
ether1 = 192.168.5.1
Chamberlin pulls 192.168.5.2

I also configured the port to only negotiate for 10/100M.

Once I setup the above configurations my Chamberlin started working just fine.
by Revelation
Mon Apr 25, 2016 3:11 am
Forum: General
Topic: Is this possible?
Replies: 2
Views: 729

Re: Is this possible?

Understand you won't have a combined 30Mbps, you'll have 30Mbps total bandwidth. You and your ISP would have to configure some type of bonding / port-channel for your router to see a single 30Mbps connection.
by Revelation
Thu Mar 03, 2016 7:38 pm
Forum: General
Topic: Firewall or Mangle DST-ADDRESS in ip>route based on gateway ip address
Replies: 10
Views: 1826

Re: Firewall or Mangle DST-ADDRESS in ip>route based on gateway ip address

So are you trying to block IPs from reaching 172.16.30.12 or do you want to block the entire 172.16.30.0/24 network? Further are you trying to block inbound or outbound to that network?
by Revelation
Thu Mar 03, 2016 5:50 pm
Forum: Beginner Basics
Topic: Mark Local Traffic on Specific Route.
Replies: 4
Views: 1043

Re: Mark Local Traffic on Specific Route.

I am new. Can you plz create one nat for me. I'm not in front of my CCR so I cannot confirm the syntax on this. This should give you an idea, at least, of what you need to configure. /ip firewall nat add chain=src-nat action=srcnat src-address=192.168.2.0/24 out-interface="WAN1" For the WAN1 part y...
by Revelation
Thu Mar 03, 2016 3:22 pm
Forum: Beginner Basics
Topic: Mark Local Traffic on Specific Route.
Replies: 4
Views: 1043

Re: Mark Local Traffic on Specific Route.

You can setup your src-nat to only allow the specific network you want routed out of the WAN interface. You can also setup routes for each network going out specific WAN interfaces.
by Revelation
Thu Mar 03, 2016 2:51 am
Forum: General
Topic: External Host Access - Need Help
Replies: 7
Views: 804

Re: External Host Access - Need Help

Setup your Mikrotik in bridge mode.
by Revelation
Sun Feb 28, 2016 1:59 am
Forum: General
Topic: limit Bandwidth on mikrotik
Replies: 2
Views: 602

Re: limit Bandwidth on mikrotik

Yes simple queues would work just fine. You can setup one queue for your specific IP giving yourself whatever bandwidth(speeds) you want. Create a second queue for the entire network with whatever limitations you wish to impose. Ensure that your queue is placed above the network queue. name="queue1"...
by Revelation
Sun Feb 28, 2016 1:50 am
Forum: Beginner Basics
Topic: L2TP over IPsec not working
Replies: 2
Views: 886

Re: L2TP over IPsec not working

If you can post the logs that appear during a connection will help immensely. #2 add 17(udp) accept statement for port 1701. Port 1701 over TCP is not needed, you do need udp though. Also, what error messages are you getting on the client - we really need more information to be of any assistance.
by Revelation
Sat Feb 27, 2016 3:01 pm
Forum: Beginner Basics
Topic: Problem configuring VLANs - please help
Replies: 3
Views: 823

Re: Problem configuring VLANs - please help

I tried that, but it doesn't help because my router can't do switching. Basically, what I want is to connect my router to my "core" switch with a trunk containing all the VLANs, and "core" switch will, let's say, forward all the VLANs to edge switches where I will do VLAN filtering. I thought you s...
by Revelation
Sat Feb 27, 2016 3:34 am
Forum: Beginner Basics
Topic: Connection problem
Replies: 5
Views: 882

Re: Connection problem

Hello and thank you for your answer Computer connected via ethernet cable to the ether port 1 Great, what port is your WAN connected to? What is the configuration of your NAT and does your ISP require PPPoE? I already gave this screenshot http://i84.servimg.com/u/f84/09/01/53/15/th/quick-10.jpg No,...
by Revelation
Sat Feb 27, 2016 1:29 am
Forum: Beginner Basics
Topic: Connection problem
Replies: 5
Views: 882

Re: Connection problem

Can you post configs for your CCR? I do recommend upgrading it to 6.34.

For your public IP, use x.x.x.12 and leave all private IPs in full display. What port is the WAN connected to on your CCR? What is the current run time or uptime on your CCR?
by Revelation
Sat Feb 27, 2016 1:25 am
Forum: Beginner Basics
Topic: choose between 2 rip routes
Replies: 2
Views: 516

Re: choose between 2 rip routes

You can add metrics to adjust the RIP routes, it is not recommended due to the hop limit of 15 for RIP. What is the current hop count for your two routes? Have you thought of just changing to a different routing protocol?
by Revelation
Fri Feb 26, 2016 11:29 pm
Forum: Beginner Basics
Topic: Problem configuring VLANs - please help
Replies: 3
Views: 823

Re: Problem configuring VLANs - please help

This will be a good guide to setup the VLAN and interfaces on the switches. If you have additional questions, feel free to ask.

http://wiki.mikrotik.com/wiki/Manual:CRS_examples#VLAN
by Revelation
Fri Feb 26, 2016 5:17 pm
Forum: General
Topic: MikroTik RouterBoard to replace pfSense Box
Replies: 1
Views: 7665

Re: MikroTik RouterBoard to replace pfSense Box

On the LAN side I have 3 LANs: the internal Office Lan, an internet cafe style LAN for 6 client PCs and an open WiFi (with 8 ddWRT APs and some 200 clients) for guests. If RouterOS would let me, I would like to achieve the following: - MultiWAN LoadBalance the 4 ADSL lines and keep a minimum bandwi...
by Revelation
Wed Feb 24, 2016 6:48 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

I'm sorry but I think that my cable was not good I was able to see connection(the LED was blinking) but not Tx I have change the cable and did reset to the system and now it's working 1 in a million............. SORRY! Thanks, Nothing to be sorry about; that happens to the best of us. Glad you got ...
by Revelation
Wed Feb 24, 2016 5:53 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

yes he can and to make sure nothing is in the way and no windowes issue , I have put an IP camera with the address 10.0.1.100 I can ping from inside Router#2 to 10.0.1.100 Can Router#1 ping 10.0.1.100? On 10.0.1.6 type "tracert 10.0.0.5" and copy and paste what is in the window. On 10.0.1.6 type "i...
by Revelation
Wed Feb 24, 2016 5:48 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

this what I can do from 10.0.0.5 I can ping to 10.0.1.1(the mikrotik router#2) but not to 10.0.1.6(a computer on the network , open to ping) from 10.0.1.6 I can't ping to 10.0.0.254(the mikrotik router#1) or 10.0.0.5 now from inside the routers : Router#1 (10.0.0.254) - terninal I can ping 10.0.1.1...
by Revelation
Wed Feb 24, 2016 5:22 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

o.k but still doesn't work from 10.0.0.0/24 I getting to 10.0.1.1(the router client ) but not to 10.0.1.6 why? the gateway of 10.0.1.6 is 10.0.1.1 Okay, so you can ping the other gateway of 10.0.1.1 from Mikrotik (#1)? Can your mikrotik (#2) ping 10.0.1.6? Can the device 10.0.1.6 ping 10.0.1.1?
by Revelation
Wed Feb 24, 2016 5:19 pm
Forum: Beginner Basics
Topic: Cannot get port forwarding to work
Replies: 10
Views: 2266

Re: Cannot get port forwarding to work

You actually don't need to setup remote access on Plex, which is payware...

Follow pateutz's advice.

Your dst-nat should look something like:
chain=dst-nat action=dstnat in-interface="WAN" dst-port=23444 to-address=192.168.1.5 to-port=32400
by Revelation
Wed Feb 24, 2016 5:08 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

I did it - doesn't work
maybe you mean
router2 has a route 10.0.0.0/24 gateway=192.168.1.254
?
Yes, it was probably a mistype.
by Revelation
Wed Feb 24, 2016 4:57 pm
Forum: General
Topic: VPN PPTP Computers in Server Side Can't Ping Computers in Client Side
Replies: 5
Views: 2216

Re: VPN PPTP Computers in Server Side Can't Ping Computers in Client Side

Based on what you typed it sounds more like there is a firewall filter rule in place on the remote end that is dropping non-established connections. I would start there.
by Revelation
Wed Feb 24, 2016 4:49 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

Just as ZeroByte stated. Also ensure that you update any DHCP scopes with the 10.0.1.0/24 network. If you have any DHCP reservations setup, you can quickly change the third octect to '1' so everything stays the "same." Once the routes are added on both sides you should be able to ping from 10.0.0.5 ...
by Revelation
Wed Feb 24, 2016 4:38 pm
Forum: Beginner Basics
Topic: How do i forward the syslog from my modem to pc on lan.
Replies: 7
Views: 991

Re: How do i forward the syslog from my modem to pc on lan.

Its configured via the web interface syslog access setup to send to 192.168.1.87 port :514 There is part of your problem; your modem doesn't know where 192.168.1.87 is. You need to "point" it at your Mikrotik interface of 192.168.0.1. Here it is [admin@MikroTik] > ip firewall filter print Flags: X ...
by Revelation
Wed Feb 24, 2016 3:57 pm
Forum: Beginner Basics
Topic: How do i forward the syslog from my modem to pc on lan.
Replies: 7
Views: 991

Re: How do i forward the syslog from my modem to pc on lan.

The src-nat rule should, either, use the WAN interface or the WAN IP and not the whole /24 network. There are times when you would, I just don't see any reason you would at the moment. The dst-nat rule looks good. On the modem, how is it configured to send logs? What IP is it sending to? I would als...
by Revelation
Wed Feb 24, 2016 3:43 pm
Forum: General
Topic: help with l2tp client and routing
Replies: 20
Views: 4274

Re: help with l2tp client and routing

David, Do you have management over both networks? IF you do I recommend that you change one of the networks to 10.0.1.0/24. Right now both LANs are using the exact same IP scheme. It would make it much simpler to setup and use. All you would need to do is have routes over the VPN to the other LAN an...
by Revelation
Wed Feb 24, 2016 3:28 pm
Forum: General
Topic: My Private IP Appearing after NAT & MASQURADING
Replies: 2
Views: 562

Re: My Private IP Appearing after NAT & MASQURADING

Post your configs in regards to your nat rules. Use x.x.x.LastOctect as your WAN IP. All private IPs can be fully typed out. Also include your routing, interface configs for 4G modem and both WANs.
by Revelation
Wed Feb 24, 2016 3:14 pm
Forum: Beginner Basics
Topic: How do i forward the syslog from my modem to pc on lan.
Replies: 7
Views: 991

Re: How do i forward the syslog from my modem to pc on lan.

You will need to have a dst-nat rule back into your network to your PC over a specific port. Now keep in mind this is not the correct syntax as I am not in front of my CCR at the moment. Basically: action=dst-nat dst-ip=192.168.0.1 dst-port=xxx to-address=192.168.1.87 to-port=xxx 192.168.0.1 appears...
by Revelation
Tue Feb 23, 2016 10:02 pm
Forum: General
Topic: Connecting to layer3 switch via RouterBoard.
Replies: 13
Views: 2174

Re: Connecting to layer3 switch via RouterBoard.

You're going to have to post pictures of your config.
by Revelation
Tue Feb 23, 2016 9:10 pm
Forum: General
Topic: Connecting to layer3 switch via RouterBoard.
Replies: 13
Views: 2174

Re: Connecting to layer3 switch via RouterBoard.

I don't have any experience with the RouterBoard 952Ui 2hd GUI interface. Is it web based only or can you use CLI or WinBox? The same configuration should be possible with that device. What you want to look at doing is configuring the 172.20.123.2/30 address on port 1 and plug your cable into that i...
by Revelation
Tue Feb 23, 2016 3:29 am
Forum: General
Topic: Connecting to layer3 switch via RouterBoard.
Replies: 13
Views: 2174

Re: Connecting to layer3 switch via RouterBoard.

They gave just these VLAN IPs 172.20.123.0/30 and 10.1.200.0/24 to use Internet. When a client has 10.x.x.10 IP then it can connect to Internet through Layer3 switch. Same thing If possible I want to use it on Mikrotik. So it looks like your ISP gave you a WAN IP in the 172.20.123.0/30 scope and yo...
by Revelation
Mon Feb 22, 2016 10:35 pm
Forum: General
Topic: bandwidth-test vs speedtest.net? Different results?
Replies: 5
Views: 1931

Re: bandwidth-test vs speedtest.net? Different results?

There could be some differences. For one, the clients behind the Mikrotik, do they go through any NATs or firewall rules, queues or anything else? That could slow down their speeds - depends on what the hardware is capable of. Then you have general internet routing. What you want to do is get a trac...
by Revelation
Mon Feb 22, 2016 10:29 pm
Forum: General
Topic: Connecting to layer3 switch via RouterBoard.
Replies: 13
Views: 2174

Re: Connecting to layer3 switch via RouterBoard.

I need a solution to connect this board to Layer 3 switch (cisco). I tried several steps but I failed. Can anyone tell me how to configure it? What have you tried? Details: Cisco VLAN IPs: 172.x.x.1 (cisco) and 172.x.x.2 (should be mikrotik interface ip) Cisco IP range given to me: 10.x.x.0/24, gat...
by Revelation
Mon Feb 22, 2016 3:40 pm
Forum: General
Topic: SNAT
Replies: 1
Views: 749

Re: SNAT

Just for clarification... Are you talking about allowing private IPs to go out of your network or are you talking about having random IPs on the internet come into your network? Further, if you are talking about Public IPs coming into your network, can you clarify what you mean by "any public from S...
by Revelation
Mon Feb 22, 2016 3:21 pm
Forum: Beginner Basics
Topic: Mikro Tik Problems.
Replies: 2
Views: 644

Re: Mikro Tik Problems.

If I understand you correctly you are trying to turn x3 4Mb connections into x1 12Mb - correct? If that is in fact the case, it won't happen. For your device to see the three connections as one "big pipe" you would have to talk with your ISP to implement some type of port-channel / bonding and then ...
by Revelation
Mon Feb 22, 2016 3:17 pm
Forum: Beginner Basics
Topic: RB2011uIAS-RM configuring two networks with there own gateway
Replies: 1
Views: 546

Re: RB2011uIAS-RM configuring two networks with there own gateway

As described above the Router should not route between the Subnets (i would just delete the Routing Rules or do a Blackhole) The RB2011UiAS should be able to utilize firewall rules to deny traffic between the different networks/subnets. That is the only way to prevent the communication as the devic...
by Revelation
Sun Feb 21, 2016 7:28 pm
Forum: Beginner Basics
Topic: Initial setup hurdles - modem not recognized
Replies: 22
Views: 1709

Re: Initial setup hurdles

First off you don't want any ports slave to your WAN port. There are exceptions, but those are rare. Two, I see no place in the config where you have assigned an IP address to ether6 nor where it would get a DHCP address from your ISP/modem. Make sure you remove all slave ports before proceeding. We...
by Revelation
Sun Feb 21, 2016 7:03 pm
Forum: Beginner Basics
Topic: Basic setup of CCR-1009-8G-1S router
Replies: 2
Views: 686

Re: Basic setup of CCR-1009-8G-1S router

Are you looking at completing this task via CLI or winbox? What DHCP scope needs to be configured? Does your client have a Static IP or uses DHCP from ISP?
by Revelation
Sat Feb 20, 2016 4:41 pm
Forum: General
Topic: Remote IPsec tunnel access with pptp clients
Replies: 2
Views: 617

Re: Remote IPsec tunnel access with pptp clients

I have a Mikrotik that is in one office that pptp clients connect to, I have a site to site vpn with a second mikrotik. I have been unable to get the pptp client to see the remote network across the site to site vpn. If I setup the pptp client to use the remote gateway, it traces to the external in...
by Revelation
Sat Feb 20, 2016 5:17 am
Forum: Beginner Basics
Topic: One Vpn two Wans
Replies: 2
Views: 598

Re: One Vpn two Wans

There's a lot missing from the "picture you are painting." First off, what do you mean route traffic back to WAN2? What is WAN1 and WAN2 connected to? Is this like a test-lab or something? Why don't you setup a route to point your PPTP traffic out your WAN2 interface while leaving the default route ...
by Revelation
Fri Feb 19, 2016 6:00 pm
Forum: General
Topic: IPSEC LAN to LAN
Replies: 7
Views: 3707

Re: IPSEC LAN to LAN

Yes, that is another way to do it. I, personally, prefer to use tunnel interfaces - easier to wrap my head around especially when I have multiple VPNs.

When I get home I will work on a non-tunnel interface setup to give you more details.
by Revelation
Fri Feb 19, 2016 5:02 pm
Forum: General
Topic: IPSEC LAN to LAN
Replies: 7
Views: 3707

Re: IPSEC LAN to LAN

I have 2 internal network 192.168.1.0/24 and 192.168.6.0/24 with both routers internal interface at 192.168.x.1. Noted. Both routers have a default route like 0.0.0.0/0 to public ip gateway. Let's say external IP address are 1.1.1.1 and 2.2.2.2.... Great, can each router ping the WAN interface of t...
by Revelation
Fri Feb 19, 2016 4:01 pm
Forum: General
Topic: IPSEC LAN to LAN
Replies: 7
Views: 3707

Re: IPSEC LAN to LAN

If you want to post more details about the networks and the current configs we can chime in. Based on what you typed the possibilities are too numerous to begin troubleshooting. Basics though: Ensure you have routes on each side for each remote network Ensure you have rules in place permitting the t...
by Revelation
Fri Feb 19, 2016 3:34 pm
Forum: General
Topic: Do I need to get a CCR?
Replies: 4
Views: 835

Re: Do I need to get a CCR?

I can recommend the CCR1009. I am running one with a 1Gb symmetrical connection, and it is running just fine. I run with multiple VPNs, NAT and firewall rules in place and it doesn't break a sweat.

I typically see speeds of 850-925Mbps depending on other side of the speed test and Ethernet overhead.
by Revelation
Wed Feb 17, 2016 10:11 pm
Forum: General
Topic: VPN IPSec - Reach 2nd Remote site (2 hops)
Replies: 2
Views: 601

Re: VPN IPSec - Reach 2nd Remote site (2 hops)

I'm not a fan of using NATs on VPNs - simply a matter of choice. Without seeing any of the configs: Ensure that the routes are populated and correct. For instance MK should have a route to the Remote network pointing over the MK<->FGT VPN. You would need to ensure the FGT has a route to the Remote n...
by Revelation
Wed Feb 17, 2016 4:53 pm
Forum: Beginner Basics
Topic: I cann't use ftp server on router from outside after change default ftp port
Replies: 15
Views: 2469

Re: Re:

You need to set up a firewall rule that blocks traffic from that ip if such bruteforce attempt is made. The attempt are from different IP every time. The another way is the last 3 rules in my firewall settings (they are disable, because they are not work properly). But more easy way is change defau...
by Revelation
Wed Feb 17, 2016 4:47 pm
Forum: Beginner Basics
Topic: VPN with acces form broadband wi-fi router to main lan
Replies: 16
Views: 1921

Re: VPN with acces form broadband wi-fi router to main lan

The "out interface = none" simply means that an outbound interface has not been specifically set in the configuration. That should not be an issue here. I would look at your firewall. Ensure that you have an accept statement going into your WAN interface for these ports. If that does not work, then ...
by Revelation
Mon Feb 15, 2016 12:44 am
Forum: General
Topic: Disable internet access for LAN and PPTP
Replies: 3
Views: 676

Re: Disable internet access for LAN and PPTP

Your best bet is to create a nat_permit address list and a nat_denied address list. You can name them anything you want. You can then assign the nat_permit address list to the NAT and everything else will be denied. You will want to use static IPs or DHCP reservations. Granted, that is without knowi...
by Revelation
Sat Feb 13, 2016 2:25 am
Forum: General
Topic: Disable internet access for LAN and PPTP
Replies: 3
Views: 676

Re: Disable internet access for LAN and PPTP

Set your NAT config to specifically only "nat" certain traffic. If the LAN and PPTP traffic is not configured to access your NAT, then they will no reach the internet.
by Revelation
Sat Feb 13, 2016 1:45 am
Forum: General
Topic: Queue Not Limiting Download
Replies: 10
Views: 3484

Re: Queue Not Limiting Download

Not sure how the rest of your config works.... Here's an example that I threw together where I can limit the download and upload of a specific IP behind my Mikrotik using simple queues. Flags: X - disabled, I - invalid, D - dynamic 0 XI name="Test" target=10.10.25.66/32 parent=none packet-marks="" p...
by Revelation
Sat Feb 13, 2016 1:17 am
Forum: Beginner Basics
Topic: VPN with acces form broadband wi-fi router to main lan
Replies: 16
Views: 1921

Re: VPN with acces form broadband wi-fi router to main lan

but why is rejected? Here is my whole config, it is very simple: /ip address add address= 192.168.2.3 /24 comment="default configuration" interface=ether1 network=192.168.2.0 add address=192.168.100.1/24 interface=ether2 network=192.168.100.0 add action=dst-nat chain=dstnat comment="Impresora Canon...
by Revelation
Fri Feb 12, 2016 3:20 pm
Forum: Beginner Basics
Topic: VPN with acces form broadband wi-fi router to main lan
Replies: 16
Views: 1921

Re: VPN with acces form broadband wi-fi router to main lan

Typically when you see a reset immediately after the SYN, or the start of the communication it is due to the connection being refused.

Basically it means the communication is not permitted.
by Revelation
Mon Feb 08, 2016 11:40 pm
Forum: Beginner Basics
Topic: BR1100Hx2 Bridge ports using ETH 13
Replies: 3
Views: 635

Re: BR1100Hx2 Bridge ports using ETH 13

Do you have your NAT setup correctly with masquerade?
by Revelation
Sun Feb 07, 2016 9:06 pm
Forum: Beginner Basics
Topic: 2 lines 4 M = 8 M. how i can merge the two line RB2011 please ?
Replies: 4
Views: 1000

Re: 2 lines 4 M = 8 M. how i can merge the two line RB2011 please ?

So to have two 4Mb links look like one 8Mb link; you and your ISP would have to enable some type of bonding for the links. i.e. etherchannel, bonding, etc... Different vendors call it different names - sometimes. Not sure where you live, here in the states it is hard to find an ISP that will do just...
by Revelation
Sun Feb 07, 2016 7:11 am
Forum: Beginner Basics
Topic: 2 lines 4 M = 8 M. how i can merge the two line RB2011 please ?
Replies: 4
Views: 1000

Re: 2 lines 4 M = 8 M. how i can merge the two line RB2011 please ?

Really all you can do is load sharing/balancing. The only way to get your two links to "equal" 8Mb is to have your ISP setup some type of bonding on their side and you would set it up on your side as well.
by Revelation
Sun Feb 07, 2016 7:08 am
Forum: General
Topic: VLANs on a CCR?
Replies: 3
Views: 3424

Re: VLANs on a CCR?

I'm trying to figure out how VLANs should be working on my CCR1009. I have a few setup already but they are all trunked to my downlink port to my CRS109 which made things pretty simple. But for the next VLAN I want to use, I need to trunk it to both my downlink and to a port on my CCR1009 that my N...
by Revelation
Sat Feb 06, 2016 3:17 pm
Forum: Beginner Basics
Topic: So, where is the definitive guide to bridging firewalls.
Replies: 10
Views: 1809

Re: So, where is the definitive guide to bridging firewalls.

OK, I thought I either needed to use a NAT or a route or bridge to filter. Nope, NATing can be used for various things, most commonly it is to mask an internal (private) IP address with an external (Public) IP address. Bridges, on Mikrotiks, are like SVI's on Cisco. It allows you to create a virtua...
  • 1
  • 2