MikroTik

solar77

The hEX POE is fairly weak in CPU power, 1 core at 800MHz. so the more routing rule and QoS rule you put on it, the worse the result is going to be: https://mikrotik.com/product/RB960PGS#fndtn-testresults because your hEX is behind ISP router, I suggest you just use it as a bridge. unless there are ...

solar77

I am trying to create virtual AP, and to be managed by capsman, while keep physical interface wlan1 and wlan2 as it is. Would this possible?
It's on Mikroitk hAP AC2. so far I've not managed to do it.
PS: Capsman config is correct and I have mutiple Mikrotik CAP AC devices managed by it.

solar77

By default, mikrotik does not drop traffic between two subnet,if you ping the gateweay of your two subject from another subnet, you will find that you can ping the gateway. so you can ping 192.168.1.1 (gateway of 192.168.1.0/24) from 192.168.20.58. you don't need to go through WAN to access between ...

solar77

Legal netflix users will still get their netflix no?

no, as the public IP appearsto be blaclisted so everyone is affected.

While playing around with it, i was able to "pull" all IP's and Domains for "Germany"

what did you do? just catch the destination IP of your VPN tunnel?

solar77

Block everything.
Someone is going to complain

I'd love to do that....unfortunately we have got a lot more remote workers compared to 2 years ago

solar77

These "free" VPNs turn your PC / network into a VPN endpoint for other users, which is why you get blocked or receive abuse reports. Best solution is to enforce TOS against such clients, this isn't easily solved on a technical level due to wide array of ports and protocols used to bypass ...

solar77

PS: my focus is now on 3 things: how to remove the IP from the black-list if this list is maintained by the BBC or amazon themselves, I have no chance if this is by a 3rd party service, then we can at least try and explaining the situation. in the meantime, I am searching for good deal on leasing pu...

solar77

thank you all for your input, it's much appreciated. here is what I've done so far: as far as blocking Wdinscribe, I've put 300+ destination IP that I've found related to windscribe service, into my firewall and blocked them all. still not working. reading other posts on the forum, I don't think Mik...

solar77

Good afternoon, we started having issues recently where users on our network started see error messages from these streaming service providers. that they are using vpn / proxy . these sites are typicaly residential blocks consists few hondre users. the issue seems to be caused by few users running V...

solar77

my current work around, is to go through the active list, get the username, use this username to find secret, then add a comment "online "on the secret,
then I can print out all secret that comment!=online

very messy but thats the best I've got so far.

solar77

thanks Jotne, sorry I should have given more details. it's PPPoE only. we do have a radius server but the short story is this router has not been added. believe me the script took me nearly 3 hours so far, if adding it to the radius is less time consuming I will do it. I only need the scrip to run ,...

solar77

trying to get a script to display non-active pppoe users. so far I've got foreach pppuser in=[/ppp secret find ] do={ : local pppname [/ppp secret get $pppuser name] :local ip [/ppp active get value-name=address [find name=$pppname]] ##; log warning $pppname } this will stop as soon as it find the f...

solar77

not 100% clear what you trying to do but here is my assumption: connect the hAP AC Lite to an existing wifi connect xbox etc. to the hAP AC by wire here is what you need to do on the hAP AC: 1. remove wlan1 or wlan 2 from the local bridge. which one? depending what the existing wiFi is. if it is 2.4...

solar77

@Sob
thank you for detailed explanation! That's why I keep coming back to this forum !

solar77

I had SXT LTE6 doing the same but it was on a previous firmware. I've changed to SXT LTE4 at same location it stay connected on without any issue.
but I remember reading it here that this bug is fixed in the most recent firmware. Will see what others say.

solar77

viewtopic.php?t=120652

solar77

I'd think this should also work?

/ip firewall mangle
add action=route chain=prerouting passthrough=no route-dst=gateway_ISP2 src-address=IP_of_PC

solar77

Something like this should do the trick:

/ip route rule
add action=lookup interface=<your new special vlan> table=<routing table containing default route to secondary ISP>

I have learned something new today! thank you!

solar77

the problem is certainly the hEX-s. without looking at your config. it's very difficult to guess what might have gone wrong. as soon as you mentioned "I can successfully connect to the hEX-S and machines behind it, just not the other way around.", it started sound like a dst-nat issue. if ...

solar77

we have been informed by our ISP that there are Malware attached originated from our public IP. Dst IP are only few so I've added them to a list and added firewall rule in forward, output and Mangle - Postrouting chain , trying to catch which LAN IP is doing this /ip firewall filter add action=add-s...

solar77

:local variable [/ip firewall mangle get number=1 bytes] :log info $variable; this gives you the value on rule number 1. you can also use find where and use a condition to find a rule but make sure the result is only one rule, otherwise the logic breaks down here: you cannot assign mutiple values t...

solar77

https://wiki.mikrotik.com/wiki/Manual:C ... Based_VLAN
I believe this will help you

solar77

Imagine you have a service for users from your own country only. this is was nearly my user-case. a local WISP. and at one point it was very attempting to do so to fence off all failed authentication to our VPN service. Most of them are from one country. However, I realized that we cannot just bloc...

solar77

the Mikrotik Doc seems new. will have a nose around later on. but as for hairpin explanation, the old wiki does a better job

solar77

good firewall rule stops attacks, picks up IP of attacker, keep them in your Address List for as long as you want and block all future attacks from the same IP.
I'd like to see the IP cloud to include a function so that we can all share these IP address. that would be nice!

solar77

check the Test Result section of each product on Mikrotik website.
for example
https://mikrotik.com/product/rb4011igs_ ... estresults

solar77

2nd non-routing export. I am here because anav messaged me... scenario A, I suggest to use bounding, which respond to line failure quickly, unlike OSPF scenario B. I think I would use OSPF and let it figure out the best path but BGP , from what I understand, would be quicker to recover in the event ...

solar77

@anav I think he wants to use the same public IP to reach the server, whether the laptop is connected to the LAN, or on another internet connection.

as mentioned hairpin NAT address this exact issue. if Steve's video is not clear enough, here is more detail:
https://wiki.mikrotik.com/wiki/Hairpin_NAT

solar77

have a look this
https://wiki.mikrotik.com/wiki/Per-Traf ... _Balancing

solar77

looks like you did not specify scope and target-scope

have a look here:
viewtopic.php?f=23&t=157048

and more details here
https://wiki.mikrotik.com/wiki/Manual:U ... attributes

solar77

good video tutorial
https://www.youtube.com/watch?v=_kw_bQyX-3U&t=177s

or specify in-interface (to be your WAN interface) on your dst-nat rule so you don't mess up LAN connection to the private IP.

solar77

thank you for the test as well!

solar77

glad it worked for you. I got my head stuck in trying to figure out the routing part, only realized bounding is the answer as I type up the last reply.

it would interesting to find how smooth the fail-over is and test if it causes noticeable drop in voip call or online gaming.

solar77

Q: Is it possible to make a VPN between those two, so that MIKROTIK 2 initialize connection to MIKROTIK 1, and Yes, even if the hotel blocks / throttles VPN, you can still use SSTP between Mikrotiks. using port 443, they could not block it. More advanced firewall can, but realy don't think a Hotel h...

solar77

sorry my crystal ball isn't working today, won't be able to help unless you tell me what you need help with.

also there is no need to post the same question mutiple times.

solar77

static route should work , mikrotik need 3 things to get wan interface working: route, correct IP on the interface and NAT. I will setup a lab test and see how to get it working. no pint me trying suggesting something I am not 100% sure. in the meantime, I think a simple bounding would definitely wo...

solar77

what is the negative impact of leaving it with srcnat set as masquerade on the RB2011 check if the traffic counter on this rule is increasing, if yes, it is "effective" and bascaly it means your outgoing traffic is still NATed into the WAN address of the RB2011. in plain words, this rule ...

solar77

torch the interface and you can see what these traffic is that is the source and destination IP , port etc. when in winbox, right click on the interface , then select torch as for firewall , default firewall rule is pretty good out of the box. basically, on input chain, you accept established and re...

solar77

so if I understand correctly, you have two pppoe account, through two ports on the same device (a modem?). yes the CRS326 can be used to establish two pppoe connections and use them as you described. However, CRS326 is an exlent switch, but less of a router. Its routing capacity is limited. looking ...

solar77

https://wiki.mikrotik.com/wiki/Manual:System/UPS

once connected, you need a script to monitor min-runtime and send email , unless you have SNMP to monitor your network devices.

solar77

https://mikrotik.com/product/SFPONU

solar77

I guess this is something to do with the fact both DHCP client share the same gateway, and DHCP server. so when the route changes, the gateway 192.168.144.254 remains the same So they are connecting to the same router for Internet access ? I assume you want some redundancy if ether1 fails. in this c...

solar77

If you only want to use the RB2011 as a switch , NAT needs to be disabled on the RB2011. disable firewall rule, remove all NAT rule add all port to one bridge and enable hardware offloading, beware there are two switch chips on the RB2011. The left 5 Gigabit ports are on one switch chip and the 5 x ...

solar77

I'd agree. Unless there is another reason, you don't need two routers both being "router". you might think the RB2011 is more capable as a router and leaving the SXT just to be CPE. But look at the spec, SXT lite2 actually has got better CPU, same RAM, less storage (yes but you don't reall...

solar77

@dke yes I understand what your request is. I think, with distance on ether1 set to 1 and distance on wlan1 set to 2, as long as ether1 is running, Mikrotik will route all traffic through ether1. this is what you want yes? you will see both route showing up in routing table and both can be dynamic /...

solar77

human, you want them all do you? 8) unless you know exactly when it will be disconnected, there is always a chance the swap will be triggered by this disconnection. you can add another script, check which slot is active and force the system to use your main SIM, run this every 12 hours. again, plan ...

solar77

OK, next
check pppoe client has correct authentication and credential

turn on ppp in system - logging, see more details as of why it won't establish a connection.

solar77

no need to enforce, once you see the correct route is black, that means it's active, and that's what the route for your internet uplink. the other fail-over route, is blue, and while it is reachable, no traffic is routed towards this gateway. to test, just type what is my ip address on google, it te...

solar77

no problem. remember the change the password and make backup.

solar77

Glad to help.

solar77

two things I have picked up: 1. both the sXT and the RB2011 are using the same LAN subnet. so for the RB2011, the WAN gateway is 192.168.88.x and the LAN subnet is also 192.168.88.0/24 I would change one of the subnet to something different. 2. on the RB2011, you are using bridge1 as your WAN interf...

solar77

sounds like poor / unstable wifi connection between the client and the router.
try connect by network cable to see what happens.

solar77

Hi there CStech, I was wondering could you explain how I would go about changing the APN for the EE Sim Card in The LTX,

Regards
kmac

see this post

solar77

Routes shows two 0.0.0.0/0 routes

Yes it will do this as both are available. but in Winbox you will see one is black (active) and one is blue (inactive)

solar77

/tool netwatch add down-script=":log warning \" Internet Down swapSIM\";\r\ \n/system script run swapSIM;\r\ \n" host=8.8.8.8 interval=30m timeout=2s up-script=":log warning \" Internet Up \";" where swapSIM is the name of the script I find it more manageable...

solar77

i use netwatch, so if a ping to external IP address, say 8.8.8.8, is more than 100ms, I swap SIM. I set the interval to 30 minutes but you can set it how you like it, just remember the swap itself would take few minutes, depending how quickly the other SIM can register on the network, so you don't w...

solar77

http://letmegooglethat.com/?q=reset+SXTsq+Lite2

solar77

this is the script I use to swap SIM when the internet is down, sort of fail-over. #get SIM info and swap :local sim set $sim [/system routerboard modem get sim-slot]; :if ($sim = "a") do={ :log warning "SIM A is active, now switching to B"; /interface set lte1 disabled=no; :dela...

solar77

in this case I would suggest to reset the Mikrotik and re-configure.

solar77

I do this with script . create APN profile for each SIM and the script would swap slot as well as assign correct APN .
otherwise , as soon as you change one of them remotely, you have no Internet.

solar77

have you tried to connect a laptop directly to the LAN port of the POE injector, open winbox, do you see the Mikrotik appear on neighbors section ? this way you bypass Tenda and on the same Layer2 network as the Mikrotik, it should show up on neighbors section and you can connect to Mikrotik devices...

solar77

good luck.
let us know if you have a problem

solar77

first I can tell you how to do it. then I explain why you shouldn't do it. first take these port out of the bridge assign IP address to each port, 192.168.2.1/24, for example create DHCP server on each port by this point, you have achieved what you were asked for and Mikrotik will allow communicatio...

solar77

connect a laptop directly to the router and see if you can see the Mikrotik in winbox's neighbors section ? if yes, click on the MAC address . this does not require an correct IP address to be used. Please connect a laptop directly to the LAN port of the POE injector, open winbox, do you see the Mi...

solar77

@AidasA My dear friend, the forum is where people give general advice, rather than do it for you. I can offer more details but it worries me, when you say you don't know how to create a VPN. I can see that you lack basic understanding to the Mikrotik and strongly suggest start searching on Mikrotik ...

solar77

@SiB

I will be at MUMEUROPE Prague on ?? ?? 202?

interesting

why not have a virtual MUM?

solar77

What I suppose to do if I get a private IP to my SIM, means Mikrotik and public IP address which is shared?:( then you set up the whole VPN topology, basically the Mikrotik LTE start the VPN as a client, then you can access the client from the VPN server side. not worth doing for only a few, in my ...

solar77

connect a laptop directly to the router and see if you can see the Mikrotik in winbox's neighbors section ? if yes, click on the MAC address .
this does not require an correct IP address to be used.

solar77

check Mikrotik official website, each product has a test result section, I generaly see the routing 25 filter rule 512 bytes more close to real throughput: I would say the RB4011 should fit if your budget is tight but would suggest a basic CCR for your core network. https://mikrotik.com/product/rb40...

solar77

PS: try not share your own public IP on the forum. None of us need to know this information and I'd suggest you to double check your firewall before using this IP. :) on second thought, when you mentioned that you are using 100s SIMs, do you need remote access to all of them? If yes, the cost implic...

solar77

this command is to be used in Terminal . can be accessed either via winbox, or webfig yes you need a static IP but essentially you need an public IP that is assigned to the Mikrotik router, meaning this IP belongs to you, even temporarily. what will direct access to your Mikrotik router: static publ...

solar77

it could be a number of things.but first and easiest is to download winbox and try access the Mikrotik
failing that, use ssh or telnet

I can't help thinking your son might also be on this forum. that would be funny

once you get into it, make an backup and change the password.

solar77

/interface lte info lte1 once

type this in the Mikrotik terminal

solar77

create accept rule for this IP address and drag it above all the block rules

solar77

get the static public IP, open up port forwarding to your base station as per this example: https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT#Port_forwarding_to_internal_FTP_server something like this, and change hte protocol to UDP if that is the case. /ip firewall nat add chain=dstnat dst-addr...

solar77

Glad you found the fix. Sorry I find it a bit funny, the problem was that you named a Mikrotik hEX "hex"...

solar77

hostname and clientid are standared. this is to say what the DHCP server would look for when give IP address looks like the DHCP server is actively refusing to give 192.168.1.10 to ether2 of the Mikrotik please check and ensure there is not another client , either static or DHCP, on the same router ...

solar77

@kohral good writing work. I actually enjoyed reading it. althrough I am not 100% clear on what you meant by The remaining two external static IPs are makes not available for pings. So after every reboot router randomly changes its public IP and Zabbix gets error that "ICMP ping is unavailable&...

solar77

interesting problem and I don't have an answer to. maybe some of the options in DHCP client but that's pure guess.

what if you give it an static IP, would it hold it without fail?

solar77

few things you have to understand: 1. firewall filter rules are inspected and actioned from top to bottom. so order is important. once the traffic matches one rule, it will be actioned accordingly and the reset of the rules will not apply this probably answers Question 4. 2. also , for the same reas...

solar77

try add this to the top of your firewall filter rules add action=drop chain=forward-from-internet comment=IPTEST log-prefix="IP MAIL BLOCK" \ src-address-list=IP_TEST not sure why you are using this jump rule but all the other rules on forward chain are still unchainged, so they will not a...

solar77

good to know. but in this case, even he assign local IP to DDNS record, he still won't be able to access his wAP LTE remotely (from the internet)
the simple way to get this to work, is that you need to buy a public IP from the ISP

solar77

indeed, the screen capture shows he is behind NAT and the last line gives the answer: "remote connection may not work"
looks like he's got an private IP from the ISP, normal for mobile network.

solar77

Please read my previous suggestion, in this very post! before we get into the practical method of accessing the router, either by VPN or port-forwarding, do you have a public accessible IP address? It does not seems to be the case by the look of it. from your post: 84.15.182.234, belongs to ISP:Bite...

solar77

we do this at work. the solution is that we use a Mikrotik VPN server, where a number of 4G Mikrotik would connect to. our office router also VPN into the same server and we are able to access any of the 4G modem or router behind satellite connections. if you want to access the 4G modem from a PC wh...

solar77

My question is: Is it possible to restart the endpoint device which has a link with router ( RJ 45 cable between) via RouterOs or Winbox? Mikrotik routerOS has build-in SSH and Telnet client, so if your endpoint device can be restarted via either, then you can do this from the Mikrotik. Further, I ...

solar77

what is the upload capacity at HQ? as this will also limit the download capacity for your Branch. assuming it's more than 10 Mbps. hardware looks fine to me but other experts feel free to comment. as for mangle, you could look at https://wiki.mikrotik.com/wiki/Per-Traffic_Load_Balancing#Step_3_-_Usi...

solar77

you need to also drop these traffic on Forward chain, that is where traffic is flowing through the router, in this case, from the Internet, through the router, to your server. The input chain, is traffic that is heading to the router itself , for example, traffic heading to the VPN server on the rou...

solar77

your plan is do-able and might be easier than you think. lets assume few things: site A (HQ) and site B (Branch) both has static IP and good internet connection, not just download but also upload bandwidth as well. What is good? depending on your application. also to do IPSec you need good performan...

solar77

thank you for letting us know it's working. Many poster won't feedback on our suggestions which is a shame.
not important to vote a solution, it's not like we would get paid for it

solar77

I assume OP is concerned that the mobile mobile carrier only allows him to use the SIM in a smart device, not tethered, not in a 4G modem. one of the things they can do is to detect change in TTL, which will decrease after traffic going through a router. then the fix is to increase TTL by 1 or set T...

solar77

https://mikrotik.com/product/RB2011iL-I ... estresults

look under 512 byte, routing performance

solar77

Greetings to Mikrotik user from Ho Chi Minh City! Once pppoe established, interface <pppoe-out1> has local address: 100.91.214.57 and remote address: 100.123.1.62. The dynamic public ip: 183.80.67.230 looks like you don't have a public IP, the one you are using, is shared between a number of users o...

solar77

I would not use the Cisco if it is only 100Mbps. The RB2011 surely will do better than that. My guess is that you can reach 200 Mbps to 400 Mbps throughput: https://mikrotik.com/product/RB2011UiAS-2HnD-IN#fndtn-testresults so a user case is important here, for example, if you have large amount of da...

solar77

en..in this scenario I would use a wsAP ac lite, or a gigabit port version when it comes Lets say for some reason I do need to connect 4 devices over SFP, I'd get 4 x SPE to Base-T dongles. is it the BASE-T side goes to the device and the SPE side goes to one pair of UTP / STP cable that leads to th...

solar77

yes I was expecting the Src port to be a random port, just like when you use web service at 80 or 443, the traffic would be leaving your private IP from port xxxx. windows 10 PC is connecting to time.windows.com I have setup my mikroitk as : /system ntp client set enabled=yes server-dns-names=2.uk.p...

solar77

who said this converter will be in the server room? SPE is new to me, just watched few page and video. it seems to be the technology for industrial IoT use. no point for me to guess what should and what would I'd be interested to know how you managed to split a Ethernet connection and how the perfor...

solar77

@mutluit
192.168.90.98:123 is my PC, which would be an NTP client
also I tested setup the NTP client within Mikrotik, log shows the Mikrotik also use Src Port 123 as well.

solar77

SPE, single pair ethernet, seem interesting but I'd expect some sort of converter to do the job. When it connected to the Mikrotik, it would just like adding a L2 switch to a Mikrotik ethernet port?

solar77

No Mikrotik does not block NTP by default yes Mikrotik seems to want to use 123 as Src. Port. Interesting.... to check Mikrotik has send NTP packat from your PC, add a filrewall rule to show what's going on: in terminal add: /ip firewall filter add action=accept chain=forward dst-port=123 log=yes pr...

solar77

OK....I assumed these two are in different locations, then both ADSL routers can VPN into the same Mikrotik which can forward traffic from one subnet to another. However, both routers needs to be able to do static routing as well so normal traffic would not have to through VPN if they where in the s...

solar77

before even getting into DDNS and VPN, lets start from the basics, how do you get your Internet? this lead to another question, do you have a public facing IP address? even dynamically (this is where DDNS could work for you) ? if you are on a 4G / LTE network, most likely, you get a private IP from ...

solar77

I have left my crystal ball in the office...

what OP want, is site to site VPN, hence the suggestion.

solar77

what if you un-tick B3 and use B7 only. top speed will be slower but hopefully less disconnection,.
there seems to be frequent speed drops and disconnection issues reported on the forum,

solar77

this is what you need:
https://wiki.mikrotik.com/wiki/Manual:I ... sec_tunnel

have a go and let us know if you run into problems

One of your Mikrotik router needs static Public IP, or at least have DDNS setup so it can be reached from the Internet.

solar77

yes band 20 is what I'd expect. do you notice any signal differences when speed were slow? when it is slow , if you put the SIM in the phone, do you get roughly the same speed? does your television mast move in strong wind? sorry it is a pain to do / check all these but there is no obvious answer to...

solar77

Unifi APs need DHCP server on the same network, so it can get an IP address to start with. you also need the PC running the controller, to be on the same network, so it can see the discovery package, sent by the APs. so you should have both the AC Lite and the PC, connected to the LAN side of the Mi...

solar77

The fact that you sometimes get good speed, means your NAT setup is correct. otherwise it would not work at all. I would personally use the SXT as a router and the other MT as WiFi access point but that's just me. It's just a personal thing and also I'd likely to power up the SXT from ether 5 of the...

solar77

consider this: when PC1 want 1Mbps and PC2 want 7 Mbps CZFan's approach will allow both PC to get the bandwidth they needed Yours, however, because both PCs are active, the queue system would give PC1 1Mpbs and limit PC2 to 5Mbps, while there are 4 Mbps that you are paying for with your hard-earned ...

solar77

Vodafone's words of wisdom are that the SIM has been registered on their network as 2G and therefore is the cause of the problem

You can easy check this ,just look at the LTE interface status on the LHG, it should say Evolved 3G (LTE)

What band are you on?

solar77

few possibilities: 1. more vodafone users are now connected to the same mast . Voda is offering unlimited SIMs so naturally these users would be "open tap" all the way 2. check your signal on the LHG, there is a chance the dish had moved slightly and you are not getting a good enough signa...

solar77

at first glance, your dst-nat rules, should have your WAN interface as their " in-interface", which is traffic coming from the Internet.

you have set "in-interface" to be your bridge, this is the reason

this will also forward their traffic on those ports to my PC

solar77

Mark traffic to and from 192.168.104.114 with a different packet mark and set up queue tree accordingly. personally I would use simple queue, one queue with target of 192.168.104.114 (6M/4M), above the general PCQ rule (10M/10M). Mikrotik apply simple queue from the top to bottom this should work. s...

solar77

you could try adding a source nat rule so traffic from the DMZ PC is masqueraded to 176.76.240.18

for example:

/ip firewall nat
add action=src-nat chain=srcnat out-interface=WAN src-address=192.168.1.5 to-addresses=176.76.240.18

where 192.168.1.5 is the IP of your DMZ PC

solar77

https://wiki.mikrotik.com/wiki/Manual:I ... dress_list

you can also do 192.168.1.10-192.168.1.20 , for example

 /ip firewall filter add chain=forward src-address=192.168.1.10-192.168.1.20 action=drop

solar77

thanks andriys I've been reading on SCA and yes the theory is that, if the whole network "pretends" to be a single AP then there is no "roaming" , the client is associated with the controller which will hand client devices over without it knowing. However, the reason I suggested ...

solar77

@andriys
so how do seamless roaming work in enterprise wifi networks? does it actively disconnect one client and in the hope it will come back to the strongest signal it can discover? or there is a more intelligent way so the AP tells the client devise more about when and who to switch over next?

solar77

when the client device is stationary, it should not be switching between APs. if you are talking about roaming, (walking through the building, disconnecting from one AP as the signal is too weak and re-connect to another AP), you will have a period of disconnection. seamless roaming, is a term where...

solar77

I'd start by removing access list, your device will decide when it's the best time to disconnect from a signal reduce transmit power, by increasing Antenna gain on 2.4GHz radio (so the Mikortik is told there is an more sensitive antenna, therefore reduce the transmit power) keep the 5G radio the sam...

solar77

yes these steps looks correct. what it will look like switching between wireless networks for these two mikrotik? the subnet 192.168.20.0/24, exist on the following physical interfaces as they are all connected and belongs to the same bridge on 1st Mikrotik : ehter 2 to ethe5 and wlan1 and wlan2 on ...

solar77

In contrast, mikrotik has created a new subnet 192.168.20.0/24. I would like it to stay that way. I would like two mikrotiki to form a separate network 192.168.20.0. so your first Mikrotik gets 192.168.10.2 on ether1 and its LAN subnet is 192.168.20.0/24 and you want the 2nd Mikrotik to stay in 192...

solar77

sounds like all you have to do is make the Mikrotik a switch + WiFi access point, then you will have one only subnet, all your IP address on the LAN will be in 192.168.20.0/24 I assume that your home router is doing the NAT, DHCP server, DNS server etc. so on both mikrotik, disable NAT, disable DHCP...

solar77

just tested on a cCR1009, Mikrotik bandwidth test TCP, 1Gbps uplink,
no difference with or without fast-track

solar77

interesting. i am thinking of two things: MTU , but this should have nothing to do with fast-track connection tracking: one thing different with fast-track, is that it bypass connection tracking, would this somehow slow down the process of speed testing server establish mutiple streams? that's why I...

solar77

run

/ ip firewall export

from Mikrotik Terminal

solar77

you can also try this https://forum.mikrotik.com/viewtopic.php?t=132233 using Mikrotik bandwidth test result and then save the outcome as global variable, use it to adjust your routing / queue downside is speed test along with live internet traffic is not accurate, I don't think you want to stop all...

solar77

yes you can. using the same principle, use Mikrotik as a router, (or even just within the customer LAN network) run a VPN client (PPTP, SSTP, L2TP, up to you) from customer site to a VPN server which you have access to, by doing this, you have access from the VPN server to the VPN client (Mikrotik a...

solar77

The only problem is that you're not helping a newbie Looks like my humorous intention has not been understood so well, nonetheless, stay safe and keep the spirit up! while this issue is interesting, it does not actually cause a problem for OP. if your curiosity won't let this go, I'd suggest two th...

solar77

thanks @mkx and @pe1chl quick check on the wiki answers most of my question but thanks for more details on the topic for someone else reading this: layer-2-and-3 - This policy uses a combination of layer2 and layer3 protocol information to generate the hash. Uses XOR of hardware MAC addresses and IP...

solar77

I've actualy setup a lab test (once has some spare time during lockdown) : RB2011 (eth9 and eth10) to hAP ac Lite (eth1 and eth2) so each link is 100Mbps BUT, I can only get 98Mps udp between the two when using 802.3ad when testing with udp, 140Mbps TCP with balance-rr, 190Mbps UDP and 140Mbps TCP h...

solar77

the problem is the lockdonw, all man seek every opportunity to "work" and avoid doing house work. that's exactly what I am doing right now.

solar77

https://wiki.mikrotik.com/wiki/Manual:Packet_Flow this is really fundamental if you want to understand how it works. Look me a while and still not 100%. my understanding for use-ip-firewall, is bridged traffic, by default, does not go through the firewall. by ticking this box, you asking such traffi...

solar77

assuming bounding between two Mikrotiks should not have such problem?

solar77

Do you have access to the Huawei router? if yes, forward PPTP port to your Mikrotik and setup PPTP server on MT. you need forward port 1723 and also Protocal GRE (47) if you don't have access to the Huawei, then the only thing you can do is setup VPN client from your MT to a VPN server 3rd location ...

solar77

my best guess would be authentication, encryption or something in your PPP profile does not match that of the ASUS.
sorry cannot be more specific without actualy seeing the device config

solar77

if you were to get another switch. get a Mikrotik CRS and setup bounding.
out of curiosity, what is the reason for such topology?

solar77

I am also in scotland. don't worry, we will get you set up. few information needed: APN you can check this on the internet : https://kenstechtips.com/index.php/mobile-internet-apn-settings user/pass: in many cases the SIM will register without this. step by step: 1. open webfig 2. find Interfaces on...

solar77

looking at "warning: Router is behind a NAT. Remote connection might not work." this is saying your LTE interface has not got a public IP address and only been given a private IP by your mobile network opeartor. This is very common with many mobile networks, unless you have requested an pu...

solar77

could be a number of reasons, depending on your config but most commonly , if you can ping the VPN router but no the workstation on it's LAN side, that is because the remote client is unable to get ARPs from workstations. The solution is to set up proxy-arp on the local interface. /interface etherne...

solar77

use two queues, one for each interface target, as suggested here
https://wiki.mikrotik.com/wiki/Tips_and ... own_router

solar77

a heavier test could be Flood ping but it is not reliable enough to check bandwidth

you can schedule a script to run bandwidth test
viewtopic.php?t=132233
and then switch between WAN interface

solar77

in the config file posted, you have

/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf

this enables DHCP server on your bridge, which is now part of your LAN.

disable it

 /ip dhcp-server set defconf disabled=yes

solar77

how come if I connect to a Modem with IP 192.168.0.1 with DHCP server on, my Mikrotik can still broadcast wifi, connected cellphones / pc's have ip addresses of 192.168.0.x. and able to surf the web. if i am reading correctly, your wifi clients has ip 192.168.0.x so it's on the same range as your D...

solar77

log print where message ~"user"

in Terminal

solar77

https://ibb.co/4sn34zd
this is the band, cell ID etc. I'd say that's good.

solar77

than you so much SiB for your help!
is there a way to disable CA and just use primary band? I can accept a slower connection as long as it stays connected.

solar77

this time it connected for about 3 hours , then connection dropped again. here is the log 20:34:39 lte,async,raw lte1: sent AT+CFUN? 20:34:39 lte,async,raw lte1: rcvd +CFUN: 1 20:34:39 lte,async,raw lte1: sent AT+COPS? 20:34:39 lte,async,raw lte1: rcvd +COPS: 0,2,"23430",9 20:39:31 lte,asy...

solar77

thanks SiB for your time! I've got all the scrip for switch SIM etc, it works just fine on Vodafone SIM but EE SIM keeps dropping off. I am not expert in LTE connections so hope you can see what the issue is from the Log. EE signal seems fine to me. the script logged this before switching to Vodafon...

solar77

hi @SiB, any chance you could have a look this?
viewtopic.php?f=13&t=156164&p=769883#p769883

solar77

@SiB ?

solar77

I have recently installed an SXT LTE6 Kit . EE SIM in slot A and Vodafone SIM in slot B. what i have added to the default config: Netwatch with script to monitor internet drops and to switching APN Profile and SIM Slot . VPN connection is just there for me to get remote acess. Normal Internet traffi...

solar77

what is your internet speed? what is the distance between wired AP and repeaters ? do you have line of sight? what is the number of clients you expect to connect on each AP? what package you wish to provide to your customers? the equipment choice will be very diffierent , depending all these things....

solar77

to be honest sir, you don't come across as knowing much about networking. My best advice is to hire a consultant to set up the network for you. I may be expensive at the start but the long term it is going to cheaper, less time consuming, and avoid possible problems for customers, in summary, good f...

solar77

you should add rate limit in their PPPoE Profile, this will create dynamic simple queue as soon as the PPPoE session is established.

solar77

Establish an VPN connection between the Mikrotik and the cloud server. which is the serve and which is the client is up to you.

solar77

thanks ava, good reading. in particular there is a link within the text, to "Manual:Layer2 misconfiguration"

solar77

that I think is to give the CPU (Router) access to your managed VLAN
I have not tried it yet but that's my understanding.

solar77

hi, I have only started to look at VLAN recently . My understanding is that, the switch VLAN only comes into consideration if you wish to have hardware offload for VLAN (the traffic between VLAN ports would be near wire speed because the swhich chip feature support this). note on the wiki: For devic...

solar77

you can use a virtual wlan interface to be the AP. then add this interface to your LAN bridge for example, now I add wlan5 as a AP while I am using wlan1 as station /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no distance=indoors frequency=2462 frequency-mode=regulato...

solar77

https://wiki.mikrotik.com/wiki/Manual:Basic_VLAN_switching#Other_devices_with_built-in_switch_chip is for VLAN on RB3011 but I think you can still use bridge VLAN as well. also check this https://wiki.mikrotik.com/wiki/Manual:Switch_Router#VLAN_switching so you will need to add VLAN to the bridge an...

solar77

as suggested by flynno, easy way would be contact the customer and get paid, instead of spending time on a solution that you only need for few days. PS: you can make her IP static on the DHCP server so it is the same IP every time. you can argue that she could then change IP to another static IP but...

solar77

create a schedule and excut script , like this one (instead of reboot, you shutdown)
viewtopic.php?t=19985

don't think you can schedule it to switch on again.
however, you can schedule it to disable all it's ports and enable again.

solar77

what I'm trying to achieve is a router that connects over third party wifi APs and if none are available, it will fall back to LTE. you are looking for " dual WAN fail-over". Many many tutorial and posts avaiable but starts from wiki https://wiki.mikrotik.com/wiki/Advanced_Routing_Failove...

solar77

instead of paste config in terminal, you can also use
https://wiki.mikrotik.com/wiki/Manual:Flashfig

solar77

Hi, having done it few times, I'd suggest export is the way to go. backup is meant to be for the same router. best practice, 1. to make sure the destination router is on the same firmware level as the master router. 2. you would want to check the config over, remove any MAC address. unfortunately if...

solar77

1. How to make redirection to local auth page automatically, without filling any address in the browser after the session time would stopped? 2. How to make full dissconection from wifi, after session time stops? 1. I don't think you can. redirection means re-directing something the user has filled...

solar77

disable fastrack and test again. FastTracked packets bypass firewall, connection tracking, simple queues, queue tree with parent=global, ip traffic-flow(restriction removed in 6.33), IP accounting, IPSec, hotspot universal client, VRF assignment, so it is up to administrator to make sure FastTrack d...

solar77

I would not think the CPU usage on any of the router would be too high? RB3011 should be able to handle 200Mbps VPN with ease. sorry I am not sure what the problem might be so the following is pure guess work: check for MTU isue so make sure, on both point 2 and point 3, MTU is correct and change MS...

solar77

Dynamic VLAN Assignment with RADIUS and CAPsMAN Configuration Example
https://mum.mikrotik.com/presentations/ ... 137144.pdf

hope this helps.

solar77

connect to the router from port 5,
remove port 2 to port 4 from local bridge (default name would be "bridge")
create a bridge. say "uplink", then add port 1 to port 4 to it
disable default DHCP client on port 1
done

solar77

I may give that a go, for the time being, I just re integrated my asus router and put my modem in bridge mode. So im hoping my ASUS router will allow me to open up the protocol that I need for L2TP-IPSec!! if your ISP modem can be in bridge mode, then why not use the Mikrotik behind it, instead of ...

solar77

queue rule seems fine to me.
do you have fast track enabled in firewall?

solar77

for l2tp + ipsec, you will need /ip firewall filter add chain=input protocol=udp port=1701,500,4500 add chain=input protocol=ipsec-esp your ISP router is probably not capable of allowing protocol so this won't work. I have not tried but it might work without ipsec. and SSTP requires certificate if y...

solar77

for PPTP, you will need to forward TCP 1723 and protocol 47 (GRE) to the Mikrotik
where SSTP only requires port 443

solar77

please can you show your queue rules with

queue export

solar77

May I ask why you wish to assigne one IP address to a user? I am not aware of any way to do this with Mikrotik DHCP server but you might be able to do it with hotspot. where the same user authentication will always get the same IP from the hotspot pool. The laptop will get different IP on wirelss, e...

solar77

can i do this with just one router?? possibaly yes, if you can physcally have the hex router at the same location Aruba switch. so that network 1 is plugged in one port and network 2 is plugged in another. this way the hex will handle the inter-vlan routing. or if you have a router uplink from the ...

solar77

thanks Sob for further explaination . Much appreciated!

solar77

@Sob, thanks for the correction.

if each subnet / vlan is masqueraded behind the IP of it's interface. would this rule block traffic between them?

solar77

I think this will block traffic between any IP that is assigned to a local interface, except within the same bridge

/ip firewall filter
add chain=forward src-address-type=local dst-address-type=local action=drop

solar77

keep a backup config each step of the way . so you can always reset the router to factory default and come back to your latest backup again. This made me been very brave in my early days with Mikrotik

solar77

what is the actual throughput without VPN between point 2 and point 3? when i connect point3 to point2 that is connected to point1 do you mean a client from Point 3, connect to the VPN server at Point 1, but the link is via point 2? if yes, is Point 2 just a bridge? do you have fast forward enabled?

solar77

Glad it worked. opening all these UDP port and the word P2P seems be a "risky game" :-) I'd suggest to put this device in it's own VLAN so whoever has access to it, cannot access anything else on your network. PS: use good measure to protect your router as well. close down services you don...

solar77

it does seem to bypass policy based routing, I am not sure why but hopefully someone can tell me in this thread.

what port forwarding do you have to do? is it to the Nintendo ? this rule should only affect traffic originated from this particular IP address.

solar77

you can see use Winbox to access the device by using it's MAC address.

you will need to to connect to the router directly by network cable, you should see it comes up in Neighbors tag.

solar77

It would normally work but I am not 100% in your case because you already have PCC.

I'd suggest to try

 
 /ip firewall mangle
 add chain=prerouting src-address=IP_of _ Nintendo dst-address-type=!local action=route dst-address=gateway_WAN2

solar77

use fast track on forward chain, established and connected traffic.

https://mikrotik.com/product/RB3011UiAS ... estresults
this is some indication for you.

solar77

I am little confused here. when you say "some ips that are attacked ", I assume they are public IP address so you have a pool of public IP, they are not static to individual PPPoE client, and you want each PPPoE client to pick up a different public IP each time they connect? I'd think prop...

solar77

The alternative is post nothing.

Why's this such a dreadful option?

Ha ....

sorry, in the business of helping OP. if the dst-nat rule has no traffic passing through, you need to check why the traffic is not reaching. complete config would give us more idea

solar77

I have followed up another device on this network having similar issue. It is also a Nintendo device. Here is my thought: I have hotspot running so it can connect to wiFi (both devices has -60dBm signal level and low channel utilisation ) but they cannot authenticate on the hotspot portal. /ip hotsp...

solar77

@ pe1chl thanks for reply. I am looking into it a bit more: more often than not, before an "offering lease without success" error, Mikrotik repeately deassign and assigne DHCP over and over this happens to a range of devices. I did consider an wireless connection issue but my question is: ...

solar77

having this issue as well. first thought it was caused by my Unifi APs but now it seems to be pointing towards Mikrotik. It is now affecting non Apple devices (so far 2 x windows 10 laptops, one of which is ASUS).
I am running CCR1009, ROS 6.43

any one has a fix yet?

solar77

ok I see what you mean now. So the URL will just be an Internal IP if you connected to it from LAN.
somehow i think the OP is using IP address not URL though

I set up the camera live view application from the outside IP address

solar77

It's not the repeater does not have access to the internet, it's the app (the device where the app is running on) does not see the repeater.
by default hotspot client does not see other clients and LAN network.

solar77

we have done similar projects, using both Ubiquiti products and mikrotik, and combination of both. Here is my contribution: 1. if you have the option, go with fibre. search posts here for reasons but when you do a new install and running cables anyway, use fibre. 2.lets focus on Mikrotik, you can us...

solar77

Isn't it supposed to work just by creating some firewall rules ? Not really, you need NAT rule and routing rule. Because load balancing by definition seems more than what I need now, I just need to separate them in a fixed way. Its the type of load balancing where part of your network uses one conn...

solar77

not sure why you want to do this but you can.
add the MAC address of any device within your Local Area Network, in IP - Hotspot - IP Bindings
then set the Type to "bypassed"

solar77

the bridge is created by the router on default. it's normally the LAN ports all joined under this bridge. now you have 2 x PPPoE session, what you need is load-balancing. it's been discussed often on the forum. and there is a document you can read first to get the idea https://wiki.mikrotik.com/wiki...

solar77

not sure why you cannot use 10.10.10.0/28 range as VPN Local address, I don't think it matters but happy to learn otherwise. in my view, you can use either 192.168.78.1 or 10.10.10.1 as local IP for VPN. use the matching pool . double check you have Add Default route and user peer DNS on the DHCP cl...

solar77

Plug one ethernet cable into a port on one router and plug the other end of the ethernet cable on the other router.

Sorry I laughed.

that is exactly what came to my mind on reading the subject, even before got to the actuall post itself....

Search found 586 matches