MikroTik

Revelation

Hi, I have default mikrotik router with gateway 192.168.88.1. I have connected to this router a second router, which got local ip address 192.168.88.25. Now, when I connected to to second router, local network gateway is 192.168.0.1. When I try to access ip 192.168.88.250 - I can't reached. How can...

Revelation

What is VLAN 10, 20, 30 not supposed to access? For the second part that is pretty easy: you want a forward rule to permit 192.68.20.0/24 to reach 192.168.10.5-20 you then want a forward rule to deny 192.168.20.0/24 to reach 192.168.10.0/24 I'm not at home so I cannot give the specific syntax just y...

Revelation

You can also use Wine to utilize WinBox on Linux, Unix and MacOS.

Revelation

I'm not sure why you are choosing to not answer my questions, yet you still ask for help.... Based on what you have and have not provided, your answers are in my first post. When you decide to answer my questions I will revisit this thread an provide additional details that I think you will need to ...

Revelation

Internet router installed at my office is not RB 750 it is a satellite router provided by ISP. 1st LANA port is connected with Wifi device for giving internet access to users. The satellite router has 2 LAN ports. From 1st LAN port a wifi router is connected to provide internet to users in office. ...

Revelation

Hi Members I have recently purchased RB750 for my office use. I have an internet router installed in my office with 2 LAN ports. 1st LANA port is connected with Wifi device for giving internet access to users. From second LAN port I have to connect a device that needs to get connected to its peer d...

Revelation

I would also change the "username" of the admin account. Make them have to guess what your account username is in addition to the password.

Revelation

Assuming that you've assigned the cameras a continuous range of addresses, and that the default firewall rules of some recent RouterOS release are in place, it would be: /ip firewall filter add chain=forward action=drop src-address=camera.1.ip-camera.16.ip However, as I'm not sure how default firew...

Revelation

There actually is a physical connection (Cat7 cable) between the two buildings; Each has it's own local network with it's own internet access - and I want to connect these two as routed networks. Easiest way is to add a /30 network on the interfaces between the two routers. You then want to configu...

Revelation

first thanks for ur reply i have from 150 to 180 users in daily basis they connect hotspot about me I need to improve the service we are a hotel and some of our score depend on Wi-Fi service I got 60 M in one line from one of ISP goid one but I feel I have something missing to reach to good service...

Revelation

Are you looking for a complete configuration or looking for pointers? How are your clients connecting and authenticating with you? Are you acting as an ISP / WISP or is this an office type deal? How many users do you expect online at any given minute? (should use queues or mangle rule to distribute ...

Revelation

You can look at using simple queues or mangles.

https://wiki.mikrotik.com/wiki/Manual:Queue

Revelation

Without seeing your configs, couple of things immediately come to mind. Typically when there is another wifi network it is in another vlan. If your GB switch does not support vlan tagging that could be a reason why the guest traffic doesn't get internet access. You could also be running a NAT on you...

Revelation

So I am VERY out of my league here. Our IT guy here installed a mikrotik router then quit. I'm trying to add some new Ubiquiti Access Points using the desktop discovery pool and it isn't pulling anything up. The APs that were active already are still live and showing in the controller but not showi...

Revelation

What you want to do is to block certain traffic: This should get you started 14 ;;; Drop SSH(TCP) to WAN chain=input action=reject reject-with=icmp-network-unreachable protocol=tcp src-address-list=drop_traffic in-interface=ether5 dst-port=22 log=yes log-prefix="" 15 ;;; Drop SSH(UDP) to W...

Revelation

Please help...How to block youtube or facebook for my clients PC's but allow these websites for some selected clients. Easiest way would be to create 2 address lists; one for those that are blocked and one for those that are not. Simply add the IPs to the each respective list. Create a FW rule that...

Revelation

Without seeing how you have your VPN service configured and your existing FW rules and their order, we can only provide generalities.

You will want to ensure that you have a FW permitting the traffic from your VPN IPs to "talk" to your LAN IPs.

Revelation

I am going to assume that your IP from the ISP is not actually 192.168.1.4 as that is a private address and you only put it there not to give out your actual Public IP. This is totally fine and recommended; if that is not the case it can make the requested items much more difficult to impossible. Is...

Revelation

You would set two static routes. First route will point to your first ISP and will be exactly what you use today. The second router will have a higher administrative distance, set it for say 150, and traffic will only follow the second route when the first one goes down.

Revelation

To have a port setup so that VLANs are not tagged at ingress, you must have a device attached to that port that can do VLAN tagging. For instance a server that has a NIC that supports VLAN tagging.

Revelation

I typically use Visio for work.

Revelation

Thanks!
And how to setup dynamic routing?

You need to use a dynamic routing protocol, such as OSPF.

Revelation

Easiest thing is to setup dynamic routing between them and then FW rules to permit the traffic.

For instance:
HQ: 10.0.0.0/24
B1: 10.0.1.0/24
B2: 10.0.2.0/24
B3: 10.0.3.0/24

FW rules accepting 10.0.0.0/22 to 10.0.0.0/22

Revelation

You misunderstand the terms. VLAN trunking what you see in examples on the internet is technically incorrect. Even when configurring Egress VLAN Tag - there is no mention for "trunking" word. "Trunking" is combining multiple links into one to have more speed and/or balance. Yes,...

Revelation

Without seeing the configuration of the VPN Terminator, no one can tell you.

Revelation

You can also go with a CCR1009. I have one that handles multiple VPNs,numerous firewall rules, 1Gb/1Gb service, multiple streaming, concurrent uploads and downloads without breaking a sweat. So far you haven't provided enough information as to why you should go with the CCR1036. By all means, get wh...

Revelation

Hi, I cannot ping by hostnames, only from the router's terminal. I would like to connect to a raspberry by its hostname not with IP address. How to configure the DHCP in the router? Thank you DHCP will not allow you to ping via hostname. For that you will need to setup some type of DNS. You can rea...

Revelation

What are you using for DNS for each network? From what I read, it reads as though each site has it's own DNS server or service.

Revelation

I didn't see anything wrong with your config, or nothing stood out. If you Torch eth2, do you see traffic coming into or out of the respective VLAN? The Linux box on eth2 has been configured to communicate on both the 250 and the 50 vlans. Packets coming out of it intended for the device on the Rout...

Revelation

So you need to post your configs as I can get it working just fine using simple queues. You can easily set the queue to apply to a range of IPs by simply using CIDR notation. EX; 10.1.1.0/24 would apply to all IP addresses between 10.1.1.1-10.1.1.254. http://i63.tinypic.com/11j0nww.png You can clear...

Revelation

Thanks for reply. Now is more clear. Trunking is the way to go, as it can handle cable fault and load balancing as I've seen from field testing. So when also working with VLANs on this trunk: /interface ethernet switch vlan For each VLAN do I have to add each port (23 and 24) or the trunk-uplink? T...

Revelation

No, trunking is allowing multiple VLANs over a single interface. What is the difference between: /interface ethernet switch trunk /interface ethernet switch egress-vlan-tag The ethernet switch egress-vlan-tag command is for when you want to tag traffic leaving a particular interface with a specific...

Revelation

I have done a little more research and my understanding is that ipsec isn't routing. That its based on policy, it doesn't create virtual interfaces that are added to a route table. https://www.manitonetworks.com/mikrotik/2016/3/5/ipsec-tunnels Since you never posted configs as I asked, I have no cl...

Revelation

I don't see any routing for networks / IPs through a tunnel.

Revelation

What is the difference between bonding and port trunking? I know that in switches trunking is pairing ports to multiply speed between switches. And bonding is the same in unix systems. In case of RouterOS port trunking is working on switch chip and bonding on cpu? Is my trunking configuration corre...

Revelation

A quick masscan of the web I'm sure would prove that they don't, or don't know how to. Look at all the issues with default passwords. Why would telnet need to be open by default.

None of that matters; the USER is responsible for hardening their equipment.

Revelation

I followed all the stuff in that article. I thought it was routing as well but I am not sure what to set. Can you point me at an example of the routing for a site to site ipsec tunnel? Open a terminal window and type: ip route print Post the output of that command. (I recommend that you change the ...

Revelation

You want to make sure you have FW rules permitting the VPN IPs to "talk" with the LAN network and vice-a-versa.

Revelation

I'm looking at open ports on an RB3011 and by default Telnet is open, why? That's horrible. Why is FTP enabled by default? I disabled them both. Also, I noticed port 200 TCP open and a several others, what are they all for? The WebUI says: According to IANA, port 200 TCP is "IBM System Resourc...

Revelation

Hi. Its possible to forward ports by 2 Mikrotik? Incoming internet connection at specified port -> 1st Mikrotik External IP (omnitik) -> 2nd Mikrotik Internal IP(RB750) -> destination machine Standard port forwarding not works for me. Thanks for any advice. Seweryn How are your Mikrotik's configure...

Revelation

Without seeing your config, taking a guess...

Ensure you have FW permit statements for each of the networks. (if this applies in your case)
Ensure you have routes on both routers pointing to the distant network via the tunnel.
Ensure your "interesting" traffic is permitted via IPSEC policy.

Revelation

You haven't actually setup l2tp at all in your configs, you configured pptp which is deprecated and most OS's don't support it anymore. That is probably why your VPN service isn't working.

Revelation

Based on the simplicity of the information provided it looks like a possible network scan.

Revelation

Ignore this suggestion, you are making it to Phase 2 thus this has no bearing on your issue. Try to remove l2tp secret as it is not necessary. There is much more to a VPN configuration than you have posted. This is telling me that you have an unsupported configuration, so you need to post more detai...

Revelation

Your post was very descriptive and informative that I can ID the problem with your setup....

Since you have tried multiple versions of code with the same result, then it is clearly a misconfiguration.

Revelation

Well I am not clicking on a random link by a user with 1 post. So you should post a diagram of your network and a more detailed description of what is going on.

Revelation

Coming from a Data Center background, I'd like to see: Access / Distro #1 24x 1G / 10G Copper 4-6x SFP28 / QSFP28 Access / Distro #2 16x SFP / SFP+ 4-6x SFP28 / QSFP28 Core You could also run a "core" router with: 10x SFP28 / QSFP28 4x 1G / 10G Copper or 4x SFP / SFP+ I'd still love to see...

Revelation

The wiki is your friend.

https://wiki.mikrotik.com/wiki/Manual:I ... dress_list

Revelation

The datasheet is incomplete. It doesn't tell you about any benchmark test about IPSEC, Routing and many other things. It doesn't have information about ACL / Mangle rules capacity/Limit. Here is Mikrotik's datasheet on that device: https://routerboard.com/CCR1036-12G-4S Then your best bet is to rea...

Revelation

Here is Mikrotik's datasheet on that device:

https://routerboard.com/CCR1036-12G-4S

Revelation

thank you very much sir revelation. i will try your given instruction. if im going to give a 1 mbps per user, where i am going to config? can you give an example of that? also that example you give is for 3 user only right? if i will add user until 20 celfon, im planning to have 20 celfon user/clie...

Revelation

thank you very much sir revelation. i will try your given instruction. if im going to give a 1 mbps per user, where i am going to config? can you give an example of that? also that example you give is for 3 user only right? if i will add user until 20 celfon, im planning to have 20 celfon user/clie...

Revelation

The process is the same. I have L2TP setup on my Mikrotik and the users can use whatever device to connect. okey thank you sir revelation. it would be more great if you provide some steps / procedure in configuring vpn in mikrotik for celfone users. i have no idea of configuring mikrotik so im very...

Revelation

The process is the same. I have L2TP setup on my Mikrotik and the users can use whatever device to connect.

Revelation

Easiest way would be to setup specific host routes so only certain traffic will go over the VPN:
https://www.howtogeek.com/howto/windows ... ing-table/

Or try this:
https://superuser.com/questions/999196/ ... sites-only

Revelation

You must update your NAT rules. For example, try this: /ip firewall nat add chain=srcnat action=masquerade out-interface=Public Wiki: https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT You are the one! It's working like a charm Many thanks. Another question - how can I allow or block browsing we...

Revelation

Your best bet is to setup a VPN.

Revelation

One thing I forgot in a previous post, you have to associate each physical interface with the VLAN. So you will need to click on the "interfaces" button on the left side of the WinBox window. Click on the "+" symbol and select VLAN We want to give this a specific name: typically ...

Revelation

For the Dynamic DNS, I haven't used that feature on Mikrotik before. If you do a search on the forums, there was a well written up post from a member that had it working fine with a simple script. For the Destination NAT, i.e. the traffic you want coming in for the cameras. You will need to open up ...

Revelation

It is going to depend on whether or not your ISP modem / router can be configured in Bridge Mode. Let's assume it can. http://i64.tinypic.com/2z8yf15.png You will need to configure a port on the CRS125 as the WAN port, allow it to get an IP address dynamically from the ISP. You will need to configur...

Revelation

You're going to have to provide configs for people to figure out what is going on. You simply haven't provided enough information.

When you copy and paste in your configs, change your WAN IPs to a private IP address.

Revelation

good day just want to ask help to those who knows how to configure mikrotik vpn for celfone user i have a new mikrotik router rb951ui. i want to configure a vpn on my mikrotik so that my families and friends in other province can connect to the internet via my vpn set up in mikrotik. i dont know on...

Revelation

Hi people I'm trying to make more or less the same setup described above work, but without success so far. The only difference is my RRAS server is Windows 2003 machine. Like with benjaminb's start situation PPTP over NAT is functional, no problem. I've added all of the mentioned firewall/NAT rules...

Revelation

It reads more like a host-based firewall issue.

If your hosts are windows based, ensure the network type is not set to Public. I have seen them automatically change when Windows thinks it's connected to a new network and assumes it's a public one.

Revelation

Without seeing the rest of your conifg, I'd start with double-checking your NAT and Firewall.

Revelation

Read up up Mangle and Queues for Mikrotik on the wiki. Mangle is closer to policy-maps though simple queues may provide an alternative way.

Revelation

Your destination NATs are incorrect.

Here is an example of how it should look.

add action=dst-nat chain=dstnat dst-address=92.64.122.167 dst-port=80 to-address=192.168.88.248 to=port=80

Revelation

I have read that happens when you use one that is larger than 16Gb. I had the same problem when I tried a 64Gb MicroSD card.

Revelation

RouterOS does support loop protect mode. RouterOS also supports RSTP on bridging interfaces according to the wiki. I'd avoid that all together, myself. If I were working on your network, I would setup all switches as L2/L3 and utilize OSPF to handle the packets flowing over the links to get around t...

Revelation

I concur with the previous replies. I have a CCR1009 that handles my 1Gb symmetrical connection and multiple VPNs / FW rules without ever breaking a sweat.

Revelation

Each client will provide, or be provided, a router to connect back to the gateway IP for internet access. Each router will provide local DHCP. The FW rules to prevent cross-talk is intriguing. Which rules would you implement to prevent cross-talk? FW rules would be simple. For instance, let's assum...

Revelation

How many separate entities will be getting service through you? If it is 12 (1 for ISP + 1 for your router + 12) or fewer you can simply assign all ports to be slave to your WAN interface and their router will get a public IP that way. You can use FW rules on your Mikrotik to prevent the IPs from cr...

Revelation

Masquerade is for when you want the router to use its WAN address in place of a host inside your LAN when packets leave your network.

Revelation

You can build a tunnel between A and C or you can permit their traffic to go over both tunnels and include routes on A and C so they know where to send the traffic. In other words: 1) Router 'A' will need a route pointing to the tunnel between 'A' and 'B' to reach 192.168.30.0/24 2) Router 'C' will ...

Revelation

If you have a specific application or service that you are connecting to. The Application on your device may need both TCP and UDP connections. So let's say that you first establish a TCP connection to service. The application then sends UDP packets, the receiving end would see a different IP and ma...

Revelation

I don't recommend splitting your UDP and TCP traffic across two different ISPs. You can run into the issue where a connection uses both UDP and TCP and it will cause issues when the destination is seeing two different IPs.

I advise finding a better solution to using both ISPs.

Revelation

What are you talking about? I open a new terminal and run this code with the port and my IP: chain=dstnat action=dst-nat in-interface=(put your WAN interface here) dst-port=(Ports Needed for Game/Service) to-addresses=(your LAN IP address here) to-ports=(Ports Needed for Game/Service) protocol=tcp ...

Revelation

Thanks.
I change my IP to static.
I confused a little bit!
LAN IP address = My static IP address, Right?

And I try to run the command and it says "syntax error (line 1 column 6)".

What are you talking about?

Revelation

Thanks for the answer, guys. Really appreciate it. How about a port number range? I want to open port for World of Tanks game. 10501 & 10502 TCP and 8251 UDP. Should I create new rule for each port? Port ranges are possible, though I typically do individual ones. Thanks, Revelation. Make IP sta...

Revelation

You will need to configure a dst-nat for inbound traffic. It is recommend that you use a static IP on your PC or at least set a DHCP reservation so your PC pulls the same IP address every time. It should look something like: chain=dstnat action=dst-nat in-interface=(put your WAN interface here) dst-...

Revelation

Easiest way, setup the server in it's own subnet. Setup a new NAT with masquerade and only allow that server to use that NAT. Ensure the server's subnet is not allowed to use ISP 1's NAT.

Revelation

Have you tried using a mangle rule? Here's an example of something you can try. 2 chain=prerouting action=route passthrough=yes route-dst=2.2.2.2 src-address=192.168.100.5 dst-address=1.1.1.1 log=yes log-prefix="" In the above example 192.168.100.5 is your device sending packets to 1.1.1.1...

Revelation

You need to provide a bit more information. First off, are both of your networks using the 192.168.1.0/24 address space? If the answer is yes, I recommend that you pick one network and re-address it. You can use NATs if you don't want to re-IP. Without seeing your VPN config, no one can tell you wha...

Revelation

Why is your WAN port your Master port for every interface? Do your clients get their IP from your ISP / WAN link?

Revelation

Failover WAN: http://wiki.mikrotik.com/wiki/Failover_Scripting Loadbalancing WAN: http://wiki.mikrotik.com/wiki/Manual:PCC https://aacable.wordpress.com/2011/07/27/mikrotik-dual-wan-load-balancing-using-pcc-method-complete-script-by-zaib/ As far as the LAN side, that is pretty simple. Ensure your na...

Revelation

Just to make sure I am following correctly... When you are referring to connecting to the VPN on your Mikrotik; are you talking about your Mikrotik is sitting at home and you are attempting to VPN from school to home? Or have you brought your Mikrotik with you and you are connecting it to the school...

Revelation

Glad you found what you were looking for. There's always more than one way to "skin a cat."

Revelation

Here's an older thread covering this very topic:

http://forum.mikrotik.com/viewtopic.php?t=98133

Revelation

You can use Wireshark to see what packets are coming and going from your PC. You can also use netstat to see what communication is happening. I recommend wireshark as it will give you a ton of information about this communication.

Revelation

One thing I would check is to ensure you have fasttrack disabled. Oh I thought having fast track was good. Are you saying that you can't use fast track if your using any form of rate limit even if it's just for one IP? And fyi it's enabled. Typically fast track is good. When fast track is enabled, ...

Revelation

One thing I would check is to ensure you have fasttrack disabled.

Revelation

The wiki explains how to mark packets as group a and groupb Does this mean one client would have two ip address one from Each group I still dont understand how i can route one wan to group a and one to group b Your original post stated that you were looking at loadbalancing two internet connections...

Revelation

I won't be able to personally check out your device until sometime this weekend.

There are a lot of steps that you haven't taken or simply haven't annotated on here that can help identify the issue - most of those steps have been mentioned in previous posts.

Revelation

Following up with what jarda typed; I recommend that you step up to a CCR. It will give you better performance when it comes to routing, VPN, FW, etc... It will also meet future growth needs without having to upgrade your hardware. The more features you slowly add over time will take a hit, the CCR ...

Revelation

If your packet is going from inside your network to an external source, you need to use a src-nat.

Revelation

Yes, 33.0 and 34.0 are NAT routed to the gateway (33.1) but 33.0 also routed directly to 34.0 without NAT (34.0 can directly communicate with 33.0). Say what? So the gateway on R1 is the NAT for both networks? Where is your ISP connection? If x.x.33.0/24 and x.x.34.0/24 can "talk" directl...

Revelation

For load balancing check out the wiki:

http://wiki.mikrotik.com/wiki/Load_Bala ... e_Gateways

Revelation

Hi, Just a guess. On first rule, chain "forward", would not be corect if you specify the interface ? kind regards, Not really. The way Mikrotik views things, my understanding, is if the packet is destined for the router itself is chain = input; whereas a packet destined for something beyo...

Revelation

Couple of things... Is R1 acting as a NAT for the x.x.34.0/24 network; or is it just a router that routes the traffic? How is routing between R1 and R2 handled currently? Can devices in x.x.33.0/24 "talk" directly with devices in x.x.34.0/24 without the use of a NAT? In my opinion, the eas...

Revelation

I don't see anything wrong with your config off-hand. Since you noted that you were seeing the dst-nat increment that lets me know that that part is configured correctly. We need to look at your PC and ensure that it is responding to the packets and Windows Firewall is not blocking anything. After t...

Revelation

There is no picture attached. I assume you want to connect to your server attached to your network behind your Mikrotik. You can accomplish this two ways: Setup a destination nat (I don't recommend in this case - not enough info provided) I would use this option for a webserver or other types of hos...

Revelation

3DES is not very secure anymore. I recommend going with AES256 as your encryption method.

Revelation

For simplicity sake lets say your WAN IP is 1.1.1.1 . For the WAN IP is that a public IP or a private IP assigned by an ISP modem? For instance, some ISPs have a modem that does DHCP on the customer side, usually 192.168.1.0/24 or something like that. Have you ran any packet captures or enabled logs...

Revelation

Your post is not clear as to what you are doing or attempting. You have no configs snippets for peer review. You have no diagram to go by.

All you have so far asked for is a guessing game...

Revelation

CRS are great switches, though when you run them as routers you will find that they typically cannot handle faster internet speeds. What will be your up/down speeds from your ISP? CCR will be a better choice if your expected speeds are greater than 200/200Mbps. About the network. Correct me if I'm w...

Revelation

Can you confirm the IP of your PC that is trying to connect via GameRanger?
Are we to assume 192.168.158.254 is the IP of your PC?
What is the network address space that this device lives in?
Based on the config, ether4 is your WAN interface?

Revelation

I have an iPhone with AT&T and have L2TP setup for VPN access to my Mikrotik. AT&T does not block VPN service. Couple of Code snippets: /Firewall 21 ;;; Permit L2TP VPN chain=input action=accept protocol=udp in-interface=ether5 dst-port=500 log=no log-prefix="" chain=input action=a...

Revelation

Using prIvate iP does make it harder to log traffic because everybody is sharing the wan ip that would be what is logged by most Internet servers. So any illegal activity is tied to that ip which your router uses. So if you had a court order you would need to find which private ip was accessing the...

Revelation

You have no forwarding configs in place. What are you trying to forward?

source IP:
destination IP:
port:

Are you running a NAT? If so, then this:
source IP:
WAN IP:
destination IP:
port:

Once we have that we can assist.

Revelation

A simple firewall rule denying traffic to the destination IP will suffice.

Revelation

Ok, here is our current situation. I have inherited one network, which is more like two separate networks that are duct taped together. 2 head end providers no HA or failover set up currently. currently 200M pipe from each, but scalable to Gig+ as necessary. 2 /24 public subnets available on each h...

Revelation

So, last week I inherited an network that has all of it's devices on a public facing network, yikes. I obviously want to transition them to a routed private network schema and am looking for guidance. Currently there is an EdgeRouter at the head end, and all tower sites are switched only. My plan i...

Revelation

Won't the clients prefer a public ip? Most public Internet services offer a public ip so it's not unusual? I would have though better than having a nat private ip as long as client devices are setup correctly there should be no problem? Also by using prIvate ip its much harder to log and check traf...

Revelation

Have you checked the local Windows Firewall log? Depending on the network configuration for Windows firewall it could be blocking the other network. Try disabling Windows firewall on a device in the 10.0.5.0/24 range and on the 10.0.6.0/24 range - then ping. Now you should only need to disable it on...

Revelation

Hi everyone, I recently installied a linksys MODEM DPC3008 for Comcast cable internet. I can get internet if I have my laptop directly wired to modem. But if I add a router (RB750Gr2) connected to the modem , there is no internet. I logged on to the 750, and found the router didn't get WAN IP addre...

Revelation

You need to provide a whole lot more details about your "test" before anyone can be of any real assistance.

Revelation

No, just add another rule dropping your traffic from reaching any IP in the 192.168.2.0/24 address space. You place that right after your permit to 192.168.2.152 for the printer. Hi Revelation Yep I understand. Isn't that what the second of the two rules above does? (using the !=not) Could you give...

Revelation

Maybe I am missing something...

Why not just set up your VPN server on the CCR and then allow that specific traffic to "talk" to the server?

Revelation

If you set up your firewall rules to only allow traffic to and from the printer IP, this should not be a problem at all. If you wish to have more access between your networks then you can look at blocking the ports used by Bonjour. You should only need ports 5353, 5297, 5298 blocked. Hi Revelation ...

Revelation

If you set up your firewall rules to only allow traffic to and from the printer IP, this should not be a problem at all. If you wish to have more access between your networks then you can look at blocking the ports used by Bonjour. You should only need ports 5353, 5297, 5298 blocked. Hi Revelation ...

Revelation

Hi Revelation One minor issue has arisen whereby Macs on both networks can see one another via Bonjour, which as far as I can ascertain uses UDP 5353 Multicast. Do I need to define a specific firewall rule dropping all UDP packets between the two LANs and if so what would that look like? If you set...

Revelation

Hi Revelation Well that worked fantastically and exactly as expected. Thank you so much for your help with this. I've learned a lot, which will also apply to other situations I'm sure to face so thank you for your help on the education front also! Best wishes Robin Glad everything is working as exp...

Revelation

Hey Revelation Thanks! I will try this configuration and see how I get on. With my earlier configuration, I was firstly missing the NAT masquerade and additionally did not have ether3 as out/in interfaces on the first two firewall rules. On the drop firewall rule (your #3 above) do I need to specif...

Revelation

Easiest way I can think of off the top of my head is configure your NATs to only service one LAN or the other.

i.e. WAN1 NAT services LAN1 / WAN2 NAT service LAN2

Revelation

Guys you need to check your settings.

I am running iOS10, I can connect via L2TP/IPSEC to my Mikrotik - further I can access any device within my network as well as being allowed to access the internet through my Mikrotik.

Double-check your NAT / Firewall Rules.

Revelation

Hi Again! Just a quick reply with some links for the image... https://s22.postimg.io/4r6uq2kz5/network.png or shortened with Goo.gl: goo.gl/hrXkyX Can you see those? Could aways email… Regards Robin Hey Robin, Got it sorted and what I was thinking was correct. So I am going to assume that you have ...

Revelation

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...

Revelation

To get clarification...

Are you saying your Router can't reach an external IP or that devices connected to your router can't reach external IPs via http / https?

You stated that you can ping your DNS, is that your local DNS on your Router or your ISP's / Google DNS?

Revelation

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...

Revelation

Hi and thanks again for your help. I think I've got my head around this, but I have a problem: the administrators of the Juniper box have given me a fixed IP and basically said that I need to sort it out from there. Additionally, the Juniper side is a busy network for most hours so it's difficult t...

Revelation

Actually if you read my statement again you will see that I never wrote that it was a problem with dhcp relay. What I gave you was a possible workaround to the behavior of the FireTV.

Revelation

Once you have the /30 configured between them, go ahead and ping the remote IP from each box. before we get into configuring routes and FW rules, lets make sure the basics are working. If both ping successfully, move on to creating the static routes. You then want to test that by pinging the Printer...

Revelation

Okay, no problem on the IPs. The information below is based on the diagram to keep things clear, change the IPs to meet your actual environment. The /30 between them is important. Both routers will know of the directly connected route automatically. What you then do is add routing statements to send...

Revelation

If you are using an L2TP interface for your tunnel you can setup a mangle rule to capture the source traffic and "point" it to your L2TP interface.

Revelation

To touch on what kaptain46 wrote. You'll need to setup the NAT with masquerade for your traffic on your LAN to use your WAN IP to get out of your network.

Revelation

I have this RB3011 and (AC) wAP and running CapsMan. I can connect the Brother Printer Wireless, but sometime I can not print from my MacBook or iPhone. My wife can not even add the printer in settings (MacBook) I have enabled "Client to Client" in "Datapath" If I scan my networ...

Revelation

Alright, there are some issues... You can't just rely on a /24 network between the routers to route your traffic effectively. I created a rudimentary diagram to show how you can set this up and have it work. You can adjust the IPs as needed. Now the ip route commands are probably not the correct syn...

Revelation

You could try setting up a relay for the DHCP server. Now typically this is needed when a DHCP server sits in another subnet. Based on the Packet Capture I assume that it is a /24 and the gateway on the router is also the DHCP server. What I would do is setup a relay pointing to the DHCP server for ...

Revelation

That's not how I read it. He wrote that it currently is assigned via DHCP, but he wants to manually assign the IPs from his router. At least that is what I understood his intentions were.

Revelation

You can assign multiple IP addresses to an interface, would work if you were looking at having multiple public IPs on the WAN interface. Depending on what you are trying to achieve, you can assign additional IPs to virtual interfaces on the router itself, such as a bridge interface. It really depend...

Revelation

I have tried - in the state of a static IP almost rendering my Freecom HD untraceable. Had to reset the thing to find it again on the network. For me, it has to be automatic. The IP address assigned by Mikrotik's DHCP server. The standard way, no hustle. The question is why does it not work here (w...

Revelation

any help? just i need help for: number 6 6) Create RouterOS template: Edit -> Preferences -> Qemu VM's -> New -> Type: Default -> Choose a name -> Choose amount of RAM to allocate for one RouterOS instance: 64MB is suggested -> Chose disk image that was downloaded in step 4. Change network adapte...

Revelation

With a cable, of course, running from the port on the MikroTik where that address is configured to any port on the switch. Of course! :D So cable from SRX to Mikrotik port (say) 5. Then configure (in the Mikrotik) port 5 with a fixed IP of 192.168.2.253/24, which would allow the devices on 192.168...

Revelation

Hi ! I'm struggling to get site-to-site IPsec configured between two sites. Both the RB2011UiAS's are behind WAN routers (TP-Link(ADSL) and Ubiquity (WIFI)) in a DMZ configuration. I followed the Mikrotik Manual , including the NAT'ing parts. It seems that the both the RBs are communicating and I...

Revelation

What I can: From HeadQuarter to Location: Ping the Location router - both from HQ router and local machines NOT ping the LAN printer accesspoints etc NOT Access RDP/Filesharing etc from Location LAN From Location to HeadQuarter: Ping the HQ router - both from Location router and local machines P...

Revelation

With a cable, of course, running from the port on the MikroTik where that address is configured to any port on the switch. Of course! :D So cable from SRX to Mikrotik port (say) 5. Then configure (in the Mikrotik) port 5 with a fixed IP of 192.168.2.253/24, which would allow the devices on 192.168...

Revelation

I'm going to assume that you misspoke in regards to the second "route" not being "active." From my point of view if the route is not active, that means it is not functioning / passing data / admin down. I assume by "not active" you mean not configured as your primary ga...

Revelation

What seems to be the problem? Can you post your current config attempts?

What are you trying to achieve?

Revelation

So I figured out why this is happening (all ports are bridged so that wan and lan traffic resides on the same network). Now how do I solve this? I haven't done anything close to this before so I'm out on a limb. WAN traffic comes in on SFP1. Will need to do more reading I guess.. You don't want yo...

Revelation

Check to see if you have fastback enabled; that will not work with simple queues.

Revelation

The proper hardware selection will be based entirely on what speeds you will offer the residents, your oversubscription rate, number of residents/connections, distance between devices, etc... Without more detail, no one can really answer your question. A $200 Mikrotik may work, or you may need to s...

Revelation

Alright, I'll delete that. Do I also set all ports as masters?
How about DHCP, was that redundant?

David

No, don't setup any master ports for now. A single DHCP with separate pools will work just fine.

Revelation

I did everything Revelation wrote and as far as I can tell nothing has changed. Computers can still see each other and the subnet is still 192.168.88.0/24. I've also added two new DHCP servers and IP pools (10.10.100.0/24 and 10.10.200.0/24) but that didn't change anything either and they're shown ...

Revelation

If you run the command /ip route print, what do you see?

Revelation

Hello, i've just configured a RB750r2 as rooter wit nat. Everthing works fine, as long as Clients configured to use use DHCP server of router. But when i configure a fix ip at client side (IP-Adress, Gatway), client is able to communicate, but is not able to access DNS Server. This is very strange,...

Revelation

How is the VPN setup in regards to interesting traffic allowed over the VPN? So if router1 can ping and reach the server 192.168.0.19 via port 80, then it has to due with how your VPN is configured.

Revelation

I recreated your scenario in a lab and I am not running into any issues. One thing I did do differently is all of the gateways are set for their respective interface versus an IP address. i.e.: [admin@MikroTik] > ip ipsec proposal print Flags: X - disabled, * - default name="default" auth...

Revelation

Thank you I'll do this and let you know how it went. What should I be looking out for with the firewall? NAT masqurade or something more sinister? I only have basic security set up (eg. port scanner and ssh bruteforce drop) and some port forwards. David For the firewall, you will want to have a rul...

Revelation

I think leaving your management open to the outside world is a bad idea. A better idea would be to configure a VPN between the two devices and access the management of the device via that VPN tunnel.

Revelation

Pretty sure you will have to use Queue Trees to set a priority order.

http://wiki.mikrotik.com/wiki/Traffic_P ... lemetation

Revelation

After you did all of that you will need to look at firewall rules to prevent the two networks from "speaking" with each other. You will then need to look at queues or QoS to achieve your desired results for bandwidth management.

Revelation

Couple of things: The unmanaged switch, most likely, cannot have a single port working as a trunk. Most likely the ports can only be access ports, thus you could not trunk multiple vlans to the switch. As far as the bandwidth goes, you can use qos, policies and or queues to obtain your goals. I've ...

Revelation

No it does not depend on traffic passing. It depends on the lease time set in the previous router. When that was set to 1 year, it can take half a year before everyone has re-requested DHCP :-) Actually it does. If the host is sending DHCP requests packets but the DHCP server never sees them thus t...

Revelation

Depends on what your lease timers are set for, if the device is on and passing traffic and/or if it is communicating with the DHCP server.

Revelation

Or create firewall rule permitting the traffic between those two devices.

Revelation

dd address-list="" !bridge !bridge-path-cost !bridge-port-priority change-tcp-mss=yes !dns-server !idle-timeout !incoming-filter !insert-queue-before local-address=192.168.70.1 name=casa-in on-down="" \ ... add caller-id="" disabled=no limit-bytes-in=0 limit-bytes-out=...

Revelation

What is the source? Are you trying to send all traffic hitting your WAN IP of 80.78.65.x:81 to 192.168.0.19:80? You want this traffic then directed over the VPN to the 172.168.14.x network? Or are you trying to get internal traffic over to the 192.168.0.19 address? chain=dstnat action=dst-nat to-ad...

Revelation

Without seeing the configuration it's hard to tell. If the tunnel is up, I would first look at what traffic is allowed over the tunnel.

Revelation

I'm not sure why you are using vlan translation in this scenario, not the right "application" for this. You can do it two ways that I can think of off the top of my head. 1) Set one master port for each port grouping and assign the other three ports as slaves to the master port. I'm not f...

Revelation

Where is the .22 assigned on your Mikrotik? If it is not fully assigned have you created a pool for your NAT and using rules/marks to only allow that specific box to use .22? You could also try assigning .22 to a bridge and setting up a NAT on that interface. You would need to create NAT rules for b...

Revelation

1. There are a lot of topics on firewalls here and in the general section. I recommend a search as it would be too lengthy to type it out here.

2. Are you wanting a point-to-point or something like and end user VPNing into your network? There are others as well...

Revelation

So a couple of questions if you will... This "private WAN" what IPs are you trying to reach? Will they always be in the 172.26.33.x range? I see that you are trying to advertise a large address space of 172.16.0.0/12. Why are you advertising such a large "supernet?" Can you ping ...

Revelation

I assume that the 2960 has the SVI for the 10.168.0.0/24 network?

Can your Mikrotik ping the DG of the 10.168.0.0 network?

What does your route table look like on your Mikrotik and your 2960? Does your 2960 have a route back to the Mikrotik for the 10.168.88.0/24 network?

Revelation

If your server is seeing the traffic "hit it" in the logs then you need to focus on your server and the return communication. I would pull a packet capture on the server to see what you can find in the headers.

Revelation

Just to confirm, you are saying that you are seeing the traffic hitting your apache server?

Revelation

HI all, can you advice me how to setup cloud router switch 24p, to have multiple Trunk ports? I have setup one as follow: /interface vlan add name=vlan40 vlan-id=1 interface=ether9 disabled=no /interface vlan add name=vlan44 vlan-id=2 interface=ether9 disabled=no /interface bridge add name=br-vlan1...

Revelation

Thank you Revelation, the VLAN working perfect. I would like to ask you for checking my firewall setings please for a big mistake. In this moment I have no access list for PPTP, I will create it later. The PPTP is open for all IP address for now. Flags: X - disabled, I - invalid, D - dynamic 0 chai...

Revelation

Hi Revelation Thank you for your reply. I am a beginner on this and it would help if you could explain how to create one queue and i will manage to create the others. Simple queues are pretty easy, just keep in mind that you can't run Fast Path with simple queues. [Revelation@MikroTik] /queue simpl...

Revelation

Try configuring yours more like mine: (ether5 is my WAN interface) 7 ;;; Permit L2TP VPN chain=input action=accept protocol=udp in-interface=ether5 dst-port=500 log=no log-prefix="" 8 chain=input action=accept protocol=udp in-interface=ether5 dst-port=4500 log=no log-prefix="" 9 ...

Revelation

Simple queues will work just fine if you aren't using fastpath - if I remember correctly.

Simply create pools for each group of users and you can create simple queues for those pools and assign whatever limits you need.

Revelation

Can you ping that url? Can your Mikrotik ping it?

Revelation

Since you posted the config, I will put it in a lab this weekend and see what I can find.

Revelation

I would put the WAN address on the physical link. I cannot think of a reason where the WAN IP would be beneficial on a bridge interface.

Revelation

Where would I add that comment in the "/ip service" list?

(That's one of the places I have an extensive set of network addresses).

Really? IP service would be for ports / protocols, not IPs....

You should have your networks under IP addresses....

Revelation

You're going to have to post some of your configuration, there are too many possibilities. Ensure that you 'x-out' the first three octets of any public ip address, i.e. x.x.x.139.

This will allow us to be of further assistance.

Revelation

What is your WAN interface / IP? Please do not type out the full public IP. use: x.x.x.(last octet) What do the logs show? The logs are going to be the best bet to find the problem. I don't see anything "wrong" off-hand. Most likely you have a different setting somewhere between the client...

Revelation

What do you mean by I can reach a lan host via port forwarding despite a relative accept rule is not present in filter What you trying to reach your LAN host from? What is your WAN interface? What is your LAN interface? Also if I try to connect a port that is not forwarded, the packet is not dropped...

Revelation

Post your config and use x.x.x.last-octect of your WAN IP address. We will need to see the config to help you.

Revelation

You're going to need to post more details on your config for anyone to be of any assistance.

Revelation

Question for you, why is port 2 the master port if you want traffic from port 2 & 3 to only go through the vpn?

It would make more sense to configure ports 2 & 3 in a separate network.

Revelation

When I ping 8.8.8.8 to wan (internet) also work fine but when I ping from two devices to 8.8.8.8 I got ping time out on first device. So conclusion is can't ping to wan( 8.8.8.8) from two devices simultaneously , only one by time working fine. When simultaneously ping devices between no time out,, ...

Revelation

The only thing I can think of is adding a comment to the address space.

Revelation

I have the same garage door opener. I created a simple /30 network for the Chamberlin. Example: 192.168.5.0/30 ether1 = 192.168.5.1 Chamberlin pulls 192.168.5.2 I also configured the port to only negotiate for 10/100M. Once I setup the above configurations my Chamberlin started working just fine. I...

Revelation

I have the same garage door opener. I created a simple /30 network for the Chamberlin.

Example:
192.168.5.0/30
ether1 = 192.168.5.1
Chamberlin pulls 192.168.5.2

I also configured the port to only negotiate for 10/100M.

Once I setup the above configurations my Chamberlin started working just fine.

Revelation

Understand you won't have a combined 30Mbps, you'll have 30Mbps total bandwidth. You and your ISP would have to configure some type of bonding / port-channel for your router to see a single 30Mbps connection.

Revelation

So are you trying to block IPs from reaching 172.16.30.12 or do you want to block the entire 172.16.30.0/24 network? Further are you trying to block inbound or outbound to that network?

Revelation

I am new. Can you plz create one nat for me. I'm not in front of my CCR so I cannot confirm the syntax on this. This should give you an idea, at least, of what you need to configure. /ip firewall nat add chain=src-nat action=srcnat src-address=192.168.2.0/24 out-interface="WAN1" For the W...

Revelation

You can setup your src-nat to only allow the specific network you want routed out of the WAN interface. You can also setup routes for each network going out specific WAN interfaces.

Revelation

Setup your Mikrotik in bridge mode.

Revelation

Yes simple queues would work just fine. You can setup one queue for your specific IP giving yourself whatever bandwidth(speeds) you want. Create a second queue for the entire network with whatever limitations you wish to impose. Ensure that your queue is placed above the network queue. name="qu...

Search found 336 matches