MikroTik

millenium7

Need further clarification I'm guessing that you are running your own website on a server thats in the LAN? is that correct? And so your existing firewall rule would just be a port forward i.e. /ip firewall nat chain=dstnet in-interface=WAN protocol=tcp dst-port=80 action=dst-nat to-addresses=[SERVE...

millenium7

We run something like a dozen subnets on our office LAN. It's totally legal and a very valid reason for doing so The major use case for us is we deal with a lot of vendors equipment, all that equipment is usually setup for various static IP addresses out-of-the-box or we configure it to go into anot...

millenium7

PTMP has issues on MikroTik

I'd suggest you create a separate VLAN interface for every router to router link over wireless and then use point-to-point type. You'll have far less issues

millenium7

I've never really used The Dude as my bigger priority has been a whole lot of custom work for historical monitoring which is why I mostly use NetXMS However I thought i'd install The Dude to function as a link status monitor that I can put up on a TV The one thing I want to monitor are all the links...

millenium7

This is of course not LHG 60G limited, I'm generally interested in any 60GHz experience. Sure I know crappy plastic LHG is something different to professional grade all-metal antennas/devices etc. but Im interested in any experience Actually it is specifically a problem with the MikroTik 60ghz. The...

millenium7

Thanks, I read through it. If I understand correctly, you are manipulating the traffic direction for a destination subnet. This seems like it could work if a client is given 2 IP addresses, 1 is used for regular data, the other is used for voice traffic This way you can influence voice to use the le...

millenium7

Higher channels would help, but the +3db output is not a solid argument The dishes are already tiny, just make them bigger, much much bigger I would install a 60ghz dish thats 1.5m across if it allowed for significantly improved range in the 6km+ region (reliably in rain, not just on-paper in space)...

millenium7

I don't like OSPF for wireless networks, it really isn't a very good protocol for it at all, EIGRP definitely would be better suited but i've had this discussion before but it seemed to fall on deaf ears The next best thing (and I actually agree for more widespread use, not just wireless networks) i...

millenium7

So if what you described is what the RB4011 does, it would be a quite strange thing to do for a router. I would like to be corrected if someone knows for sure, but I believe it is expected behavior if using nothing more than a masquerade rule. But doesn't happen with src-nat rules, the problem is s...

millenium7

I agree, but although it would be possible to do all kinds of custom scripting for this it would be even more welcome when there would be some standard facility to automatically use link quality metrics in routing protocols. I.e. a worse link can get a lower preference so it is not completely disab...

millenium7

yes, it seems as some of the traffic would maintain the backup path once swapped for the main connection failure. The backup is flawless because there is "no choice".. the sessions are dead for the down of the WAN1, but when WAN1 comes up again you don't have a down of the WAN2 so all tha...

millenium7

Is there such a thing but with ethernet inputs/outputs to go in between regular injectors and devices? Would make things a bit simpler Use your existing POE injectors, but power if from a 24 volt battery plant. Use the same thing to power the routers. Much easier than any sort of UPS. I'm confused ...

millenium7

You can purchase modules designed for just such a use: UPS with battery charging and monitoring, with DC input (from your PSU) and direct battery power when the PSU/mains fails. For instance the DRU-24V10ACZ for 24V: http://www.farnell.com/datasheets/3182601.pdf That one seems to cost around £35; q...

millenium7

MikroTik please fix/implement the SNMP-Get output as standard Currently /tool snmp-get does not allow you to store the output to a string/variable, it remains empty, making it a rather useless command I need to be able to poll other devices in our network and then take action Our main use case is fo...

millenium7

Mikrotik has been good on 60GHz in my opinion They were an extremely mixed bag for us until we finally got some answers (which was like drawing blood from a stone) It's not until we finally figured out we need to run through a specific process that we could actually rely on them. Out of the box the...

millenium7

LHG60 is ok-ish but Ubiquiti's new offering puts it to shame with reports of 8km real world distances without dropping in moderate rainfall, and pushing far beyond that in clear weather I'm frothing at the mouth to get my hands on them to use as backhaul links as it would solve a lot of our problems...

millenium7

I always use 64800 if the links are above about 250m and often even less than thag 58320 is complete garbage. It theoretically should go much further but we've had radios drop out daily at only ~170m (LHG60G units) when it rains. Others have dropped when it's just overcast it doesn't even need to ra...

millenium7

I've managed to get this to work but its a lot of commands and a bit messy. Surely there's a cleaner and simpler way..... The way i'm accomplishing it at the moment is to - Create another VLAN and IP addresses on interfaces between routers - in Route->VRF add those VLAN's with a routing mark like &q...

millenium7

For the moment you can kinda-sorta get away with it by storing variables as comments. The layer7-protocol area is not a bad one because it is practically unused these days so it doesn't clutter up the interface if you put a bunch of variables in there Comments will not store arrays correctly, or rat...

millenium7

Since MikroTik still hasn't implemented 'state changed from Down to Up' i've written a script to simulate it in the meantime. It isn't perfect but it does the job. It relies on running as a script so it doesn't notify you immediately And messages show up under the 'script,info' category not 'route,o...

millenium7

Please make some adjustments to OSPF neighbor reporting First and foremost please take adjacency changes out of the debug,raw log location, its ridiculous. At the moment only 'Down' is included in 'route, ospf, info' so you can see when a neighbor goes down, but you cannot get a log message when nei...

millenium7

Yeah its too little too late hAP AC1/2 level hardware at a minimum needs to get beamforming and mu-mimo as they are insanely popular and widespread consumer devices And all AC devices need the bloody spectrum analyzer. I actually don't know why anyone would deploy MikroTik outdoor gear in a business...

millenium7

At the moment if filtering for a route to i.e. 1.1.1.1 there's no easy way to see it in the routing table if i.e. the best route is 1.1.1.0/24 Using the route filters 'in' will show no results because 1.1.1.1 is too specific. So I have to manually back off my dst-address search criteria to 1.1.1.0/2...

millenium7

Late to this party, but yeah the idea of setting the power output on the AP the same as SM is not a great idea Signal is not just there or not there, people are saying "the client needs to be able to talk back" yes thats true, but its all about Signal to Noise Ratio, NOT just signal If cli...

millenium7

Ok it can't be turned off, fair enough
But it isn't a bad idea to turn it off, many other vendors allow you to turn it off for precisely the reasons i'm mentioning, it just adds another variable to troubleshooting
Asymmetrical routing is not a good excuse, it's already asymmetrical with ECMP anyway

millenium7

Looks like it will use bonding for failover https://help.mikrotik.com/docs/display/ROS/Fail-over+PtP+CLIexample Bonding failover is waaaaaaaaaaaaay too slow. Modern day failover times should be less than a second Only 1 way I know of to accomplish this in the MikroTik world, and thats with OSPF and...

millenium7

We can sit here and debate this but here's the simple reality: ECMP does nothing beneficial for us and only introduces even more unknowns My goal is not to say "well we can't be 100% totally guaranteed of everything so lets just give up, close the whole operation down boys" it's to elimina...

millenium7

Vast majority of our environment is wireless. Link speeds are inherently unreliable as they change with conditions. Trees grow, buildings get constructed in the path, others put up radio's that cause interference etc etc etc there's a million possibilities that ultimately mean you cannot predict any...

millenium7

Is there a way to disable ECMP?
Yes I am aware I can change costs but its just yet another administrative overhead, i'd rather just disable ECMP as we don't need it anywhere in our network

millenium7

Maybe there's a industry feature/implementation for this but i'm unaware of what it would be called Essentially is there a way to have a single Wifi SSID yet have private networks inside of it so that i.e. we have devices A/B/C/D/E connected to it A and B are guests, on their own, client isolation, ...

millenium7

Looks like it will use bonding for failover https://help.mikrotik.com/docs/display/ROS/Fail-over+PtP+CLIexample Bonding failover is waaaaaaaaaaaaay too slow. Modern day failover times should be less than a second Only 1 way I know of to accomplish this in the MikroTik world, and thats with OSPF and...

millenium7

but Scan is NOT a spectrum analyzer, it only shows recognized beacons that show i.e. SSID etc. You might pick a channel that looks like it has little or no wireless on it, but in reality its being flooded because something like a Cambium PTP670 is transmitting on that frequency right over your radio...

millenium7

Question to those who actually use MikroTik outdoor radio gear (which we don't except for the 60ghz): What do you actually do? and what are your expectations? Do you just spray and pray and offer 2mbit/s internet services to customers? I cannot fathom how any outdoor gear can be used in pretty much ...

millenium7

Essentially i want to scan the entire network for any devices that allow login with 'MyAdmin / Password123' (not actual credentials) I can either do that with a machine running a program or script (I don't know of one personally, open to suggestions) but that would only test for SSH, ideally i'd als...

millenium7

Is there a method to identify routers which are using a compromised password? I.e. lets say a bunch were originally setup with user account 'MyAdmin' and 'Password123' I want to do a scan of the network and find any routers that allow that login so I can go in and change it Most of our routers use R...

millenium7

Yes. We went up to each and every Mimosa radio in our network, unscrewed its high quality hose clamp fitting and promptly turfed it into the nearest bin so as to not infect any potential eBay 2nd hand buyers with deep regret and seething hatred. We then fit MikroTik/Cambium/Ubiquiti and lived a bett...

millenium7

I hear you, and we're trying to get that to happen. For now the Mikrotik will suffice at the same time however, the reality is the vast majority of smaller businesses do only run a single AD and DNS server without issue. And the reality is with virtualisation and image backups it's not the end of th...

millenium7

Wasn't aware of the DNS changes in 6.47 That would work I've also just setup a lab environment with an AD server and PC It does also work the 'old' way with layer7 protocol and 2x NAT rules /ip firewall layer7-protocol add comment=!!! name=domainrequests regexp="((.*).testdomain.local|(.*).test...

millenium7

Specify two DNS servers and clients will try the first and if not responding, try the next. Windows clients are sticky with their DNS selection If I put i.e. the AD server as the first DNS server, and google/cloudflare as an alternative server, then if the AD server is unreachable yes it will fail ...

millenium7

Is it viable to use Layer7 filtering to selectively route DNS requests to different servers? I want to use a MikroTik router in an organization as the DNS server. This organization runs Active Directory with only a single Domain/DNS server and relies on it for certain internal resources However if t...

millenium7

Bingo, you nailed it. Never would have thought that I did log the packets at the server side and it shows the packets coming in from the 'correct' IP (NAT'd by the LTE router) and packets therefore should get sent back correctly. I guess thats not enough, and would have been a nightmare to troublesh...

millenium7

Can someone help me with this? I have in the mangle rules /ip firewall mangle add action=mark-routing chain=output comment="Establish SSTP via LTE" dst-address=1.2.3.4 dst-port=443 new-routing-mark=LTE passthrough=no protocol=tcp This is placed at the very top, no further mangle rules woul...

millenium7

having the same problem on 6.47 (and many previous versions before that, don't remember one thats 100% stable)

millenium7

Thanks for responding but that just isn't true..... or at least its woefully inaccurate, or isn't explained correctly. I still don't know if its referring to the AP or the SM (assuming logged into the AP) I was physically up onsite at this location, I know for a fact that this particular location th...

millenium7

Those are not simple things and each installation is different and there are much more factors that may affect success with link. We can't simplify those details as they are much complicated compared to regular wireless. Simple explanation is available in our wiki. I disagree. MikroTik engineers do...

millenium7

frequent tx-sector changes indicate, that there is issue related to devices moving in wind or alignment issues. In theory tx-sector should only change on very rare occasions - during first minutes of established connection, rain or on line of sight loss And what about if its rapidly changing but th...

millenium7

Ok so 'frequency=auto' is seemingly a really bad idea. And using the terminal with 'int w60g mon 0' is essential as tx-error rate shows a more accurate picture than signal/MCS/rssi Pretty sure the way auto works is it just picks 58320 regardless, as i've only ever seen it on that frequency. It defin...

millenium7

You're using LHG-60's as AP's? The antenna pattern is 3 degrees. So, across 120 degrees at ~100m, you're running off the RF equivalent of fumes. In theory yes, theoretically it shouldn't even work at all, but so far nothings made sense and matched up with the theoretical data. We used the LHG 60G a...

millenium7

So to add some more experience and more confusion needing clarification.... Went out to the AP side of a site thats doing multipoint, spread is about 10 degrees between the 2 SM's. Distance is ~170m and ~340m respectively All of them are LHG 60G Found it was a little bit out of alignment, slightly u...

millenium7

I've read through this entire thread and I still don't know exactly how to use these things 'properly'. There's too much confusion We have a few of them out in the field and they are unpredictable. Some links drop in the rain at just 300m, yet people are claiming over 10x that distance Speed doesn't...

millenium7

Thats all well and good in theory, and that is the case for L3 MTU as there is path MTU discovery as well as response mechanisms to indicate the MTU is too large But unless i'm mistaken, L2 MTU will always silently drop. And i'm also not aware of any protocols that specifically go looking for the L2...

millenium7

I'm investigating the same thing at the moment It appears the only way to do this properly and retain failover in both directions (if backup link goes down, should failover to primary) is using MPLS Traffic Engineering. I'm still investigating how to properly implement it with Mikrotik in the most m...

millenium7

Routes are chosen in this order - Most specific route - Administrative Distance (lower is better) - Metric/Cost (lower is better) If a packet has a destination of 192.168.1.2 and you have the following routes in the table... 192.168.0.0/16 - Distance 1 - Cost 0 192.168.1.0/24 - Distance 110 - Cost 5...

millenium7

DSCP on its own is just a tag Yes its used for QoS but its up to each device along the chain to decide what to do, there's nothing stopping it from just entirely ignoring the DSCP number and doing no QoS whatsoever. It's common for most devices to just bundle a range of DSCP values into only 3 or so...

millenium7

Is there a way to use wildcards or a range of MAC addresses in the hotspot bypass?

millenium7

I'm sorry to tell you, but that isn't possible. Addresses have not been assigned that way! I also sometimes thought it would have been much better when it had been done that way, but it hasn't. LIRs have assigned /24.../16 blocks to "users" (companies, internet providers) completely rando...

millenium7

I been labbing MPLS TE and things aren't quite as they seem, and work a little differently to how i'd expect. I'm hoping someone can clarify Reading through the wiki page https://wiki.mikrotik.com/wiki/Manual:Simple_TE It gives some examples, but it's not thoroughly explaining everything in use The ...

millenium7

My first claim is that it is useless. And I will explain that: You have not defined what "the country of an IP address" is, and neither has the internet. You are WAY overthinking this. It's really as simple as an address list generated from IANA that says i.e. 1.x.x.x/8 = Belongs in USA. ...

millenium7

Consider a GeoIP package allowing for firewall filtering by Country I'm against that. It is completely useless, and it tends to racism. lmao, oh god, political correctness has now extended to routers..... There are very good reasons for country blocking, first and foremost is for many people there'...

millenium7

So I have 2 scenario's that I need to find a solution for Scenario A : 1 hop selective routing https://i.imgur.com/rqLBmlo.png RouterA & RouterB are running OSPF to each other, the 60ghz path is set to the default cost of 10 and is running BFD, the 5ghz path is a cost of 15 This works perfectly ...

millenium7

L2MTU is what its actually set to, it will never transmit more than that Max L2MTU is the hardware limit of what its capable of doing. This varies from model to model, some only support ~2000 others support ~11000 etc Removing it would be a really bad idea, its extremely useful for determining the m...

millenium7

Actually i've found NBMA to be quite buggy on MikroTik and I can't think of any upsides to using it. The only 2 possible scenario's I can think it has any merit whatsoever is 1) You have some really antiquated shitty radio equipment or you are leasing a link from another company that does not suppor...

millenium7

We just had a major network outage yesterday due to OSPF's design limitations. We expanded a network that was originally setup as a separate area but now has major transit link in it. That network needs to be in the backbone because of OSPF's limited design restrictions, but its joined to the rest o...

millenium7

Might need a /export of the relevant sections It really depends how you've set your firewall filter rules up, but if you have a typical set of requirements (public IP that the LAN shares, additional public IP's for other devices) you shouldn't need anything at all in 'firewall filter' you just need ...

millenium7

Since PPPoE is something that hits the CPU anyway, you won't have any noticeable performance drop by bridging all the interfaces And PPPoE stability has never been an issue in my experience with MikroTik, it's the one thing thats worked perfectly every single time for me, and I much prefer MikroTik'...

millenium7

I don't dispute its lack of popularity and support But saying things like "I can probably count on one hand the number of times i've seen EIGRP used in a WISP in the last 15 years." is a chicken or egg scenario. It's like me saying "I can count on 1 hand the number of electric vehicle...

millenium7

Devices send as a certain modulation rate, in the case of ethernet this is not variable its fixed at 10/100/1000mbit. It can't drop its speed down to say 800mbit/s if the cable is a little wonky. It can drop down to 100mbit if the NIC detects a missing pair or a poor enough signal ratio, it will nev...

millenium7

This is definitely an antiquated and very closed minded view. Let's look over the fact that EIGRP - regardless of its usefulness - was a closed system with a fairly insignificant (comparatively speaking) install base and is very unlikely to ever make it into other platforms with any level of deploy...

millenium7

How does STP work on MikroTik when you put vlan interfaces into a bridge? And does it work differently when you put the physical interfaces into the bridge but use the 'vlan' tab and then create a VLAN interface on the bridge Take this example which is close to a real world example that was experien...

millenium7

It does work, there will be an explanation for whats going on, why it isn't working for you and a way to fix it. It may be something like your AP is blocking multiple DHCP requests (unlikely but you never know). The mikrotik does not need a lease, so disable that to start with, heck just do a system...

millenium7

I've used station-pseudobridge mode in the past and its worked fine, havn't needed to do anything special just put in a bridge with an ethernet port The wiki does say this This mode is limited to complete L2 bridging of data to single device connected to station (by means of single MAC address trans...

millenium7

That's not suited, I need to test routing performance. If it's in a tunnel its not going to pass traffic in the same fashion

millenium7

Ok very interesting I setup a lab with a CCR as the core a HEX/RB2011/RB3011 as routers connected to it through a gigabit switch Then another CCR behind it that I used as a customer to simulate this In my initial testing I got the expected behaviour, which is slower tests 'from' the router and faste...

millenium7

I don't see a way to do this and all the examples i've come across have 2 routers directly connected I want to measure the packet throughput rate of routers. So I need to send traffic 'through' them and also have packets bounced back to measure jitter, packet loss etc If I have RouterA->RouterB It's...

millenium7

That's not a great fix But would simply increasing the L2MTU and not restoring it back down help? Because there is no harm in setting L2MTU to max. Infact I don't know why it isn't set to maximum (that goes for every single device on the market). Nothing will ever send larger L2 frames unless specif...

millenium7

It wouldn't. But everything is already set to point to point

millenium7

This happened AGAIN in our network at a different location, but to 'ethernet' ports this time. So this bug seemingly doesn't care if its ethernet or SFP modules This happened on a CCR1009-7G-1C-1S+ That site has had issues with VPLS tunnels randomly dropping off over the past couple months. I very t...

millenium7

That distance is nothing for this antenna... https://mikrotik.com/products/ptp Has anyone experience with the unit not being able to reach the full output Full output? Actually you must setup the antenna within the Limits allowed in your Country. I call bulllllllllllllllshit on those graphs lol LHG...

millenium7

CPU usage is very low ~5-15%. It's not even close to maxing out 1 core, yet the actual results of passing packets through it look very much like a lack of processing power So either CPU usage is reported completely incorrectly for routed traffic, or there's something else going on Note that if I use...

millenium7

We use Syslog to get fast notifications of OSPF neighbor state changes pushed to SLACK. Problem is the log entry only contains the neighbor ID When we have a primary and backup path, the messages are identical if primary or secondary fails. Can the message be changed to also include the interface na...

millenium7

Ok well take the following example https://i.imgur.com/WVLFeSx.png RouterA/B/C establish an iBGP session to the core using their physical link addresses (i.e. 10.0.1.1), not loopbacks, so the routes directly to the core should never be affected, they'll use their directly connected links at all time...

millenium7

Bump. Anyone?

millenium7

The topology/setup We have a core router that uses iBGP sessions to the rest of our network, it only establishes iBGP sessions to the sites that have a layer2 fibre connection (We'll call them A/B/C). The core is setup as a route reflector to these sites. Each of these site has its own Layer2 conne...

millenium7

Again you are missing the point that it is a 'backup' Don't need super long range, or particular high performance. 99.99% of the time it is not being used at all It's entire purpose in life is to provide connectivity when there otherwise is none, it's not to be an awesome standalone 5ghz product tha...

millenium7

Yes it doesnt NEED to be high gain Who would install a 60+5ghz radio and want 30db of gain? So you can make a link go 8km on 5ghz only and never use the 60ghz? :lol: that would be stupid It doesn't need much gain, the PRIMARY purpose is the 60ghz radio, so as long as the 5ghz can do the same distanc...

millenium7

Ok its not the btest program, it's something funky going on with the RB3011's in our network. They can do good performance only when passing packets to a directly connected neighbor, but if they have to go more than 1 hop it all turns to shit. Even if packets are being passed 'through' a RB3011 and ...

millenium7

Ok so riddle me this We've been encountering speed issues since starting to migrate off PPPoE client connections inside VPLS tunnels to a PPPoE concentrator, and onto DHCP instead Why are we doing this? - Faster recovery if a link goes down - Faster failover - Multi path selection - Simpler topology...

millenium7

2 devices is vastly inferior to 1 combined device - Need to run extra cables (PoE passthrough does not help if they are different voltages) - More config on switches/routers with more ports or VLANs, extra IP addresses - Need to pay a lot more attention to loop prevention - Need more physical mast s...

millenium7

I figured the routers already have some config on them, MikroTik2 already has a route to 1 or a default route etc. But yes that is needed if there's no existing routes From a routers perspective there are no 'private' or 'public' IP addresses, they are just IP's NAT has changed the way most of us th...

millenium7

Yep, lots of really good products and really good ideas that are only halfway finished. It's like their R&D department do nothing until 4:30pm on a friday then madly come up with something before 5pm beers - 36/72 core router, with no support for MetaRouter/Virtualization and almost everything i...

millenium7

I don't understand this, why no dual 60/80ghz with 5ghz failover products? The 60ghz LHG radios are FANTASTIC, I really, really like them due to the beamforming. You just chuck them in and hey presto you have a 2gbit/s link, I don't even really bother to align them they 'just work', right up until i...

millenium7

umm what the hell lol. HEX/RB750gr3 has PLENTY of grunt, will effortlessly do 140mb/s even with lots of firewall/NAT/mangle rules We use them a lot as distribution routers on small sites that don't yet warrant a CCR running OSPF/MPLS/VPLS as well as DHCP servers, several firewall entries etc and all...

millenium7

Well I work as the lead engineer for an ISP so if it doesn't work i'm out of a job

millenium7

however i had some overthinking since those are Public IPs and i dont know if the ISP has any limitation to the TTL of the packets or anything... Nope, and on that topic.... TTL can be manipulated on MikroTik with mangle rules. It actually does come in very handy if you have known, fixed number of ...

millenium7

Ummm this is super easy. All you do is add a static route on MikroTik 1 pointing to MikroTik 2 But MikroTik 2 still needs to have an address. Normally on the link between MikroTik 1 and 2 you would give them a private IP i.e. 10.0.12.1/30 and 10.0.12.2/30 Then on MikroTik1 you just add your static r...

millenium7

No, doing independent tests from A to B and B to C shows roughly the actual bandwidth available. Testing A to C shows way lower It's not interference, completely different (80ghz one side, 5ghz the other). Radios are not pointing in the same direction A to C should be seeing 150 but it doesn't I tes...

millenium7

Not quite sure of the way to go about this Essentially we have a OSPF+MPLS network, almost all of it is wireless Some sites have 24/60/80ghz primary and 5ghz backup links. The 5ghz always sit idle until used, the main link has BFD for faster failover. But occasionally a link flaps in bad conditions ...

millenium7

use the walled garden section to whitelist the URL or IP address

millenium7

This is something we rely on quite a bit to test for available 'real usable' capacity but 99% of the time we've been using it 1 hop away, either direct router-router connections or across PPPoE connections at customer sites, and for this its fairly accurate especially with UDP However i've been test...

millenium7

EoIP is going to fragment anyway, it's a Layer2 bridging protocol, not Layer3 MTU (which is a L3 MTU) shouldn't even really be used. It will carry all L2 traffic at an MTU up to ~65535 or whatever its set to So if you put it in a bridge or any standard Layer2 segment with switches etc you're going t...

millenium7

I think 6.45.8 is a mess and feel that MikroTik should withdraw it. There's multiple issues with it and some of them are pretty damn serious

millenium7

err yes there is
agent-remote-id and agent-circuit-id are parameters that are injected into DHCP request packets by another inline device, also knows as DHCP Option 82
Both are supported in MikroTik's DHCP server as read-only parameters

millenium7

At the moment I have a 30 line script to ensure only 1 DHCP lease can be active per Remote-ID at a time, the newest lease clears all other entries that have the same Remote-ID (potential issue if a client plugged a switch into their WAN connection instead of a router) but there's currently a bug in ...

millenium7

The biggest benefit of DHCP for both for us and customers is they can just take any router straight out of the box, plug it in and bam immediately have internet access, as almost all routers are configured for DHCP by default. They can factory reset it, still works just fine. Because MikroTik router...

millenium7

I found no solution, and the amount of outages and customer issues this caused i'll never be trying it again We've had to keep those core routers entirely OSPF and MPLS free. As PPPoE is still terminated on those routers, this means we lose automatic failover if a major site goes down, and we have t...

millenium7

You need to use route filtering I've said it multiple times, OSPF kinda sucks with its design limitations at scale in a WISP but it's what we have so we have to deal with it Note also that additional areas can all be fringe networks but using the exact same area I.e. there's absolutely no problem wi...

millenium7

As far as I can tell the only way to identify a device for a static lease on MikroTik is by MAC address? The 'use src MAC address' option I believe uses the Remote ID information but it still needs to be entered into the 'MAC Address' field of a static lease, meaning it can only accept standard MAC ...

millenium7

Really need help with this. Downgraded all routers in our network that were on 6.45.x back to 6.44.6 and still havn't the same problem Various tunnels (completely different locations this time) are just going down and not coming back up. This is a huge problem I've put in half a dozen EoIP tunnels f...

millenium7

I upgraded some routers from 6.44.x to 6.45.8 and i've been experiencing VPLS issues in our network More information here https://forum.mikrotik.com/viewtopic.php?f=14&t=158525 but the basics are that VPLS tunnels are randomly stopping, won't go into running state. But everything I check manuall...

millenium7

Is stubbing and range/summary mandatory for take advantage of the benefits? At what level (# of routers, # of routes) is an MPLS+iBGP solution a more logical to use than plain OSPF? MPLS LDP does not use BGP routes. So you still HAVE to use OSPF (unless you statically add labels I guess) And LDP al...

millenium7

I can't work out this, I chalk it up to yet another mikrotik bug I have 2 routers in our network that just refuse to bring up a VPLS tunnel now. They were working fine, then suddenly out of nowhere they just flat out refuse to connect to each other. And I can't for the life of me work it out Before ...

millenium7

OSPF works fine for corporate/enterprise IS-IS works far better for 'service provider' environments EIGRP works in both This is **NOT** the way to look at routing protocols. Routing protocols solve problems. We have to stop looking at them as enterprise vs. service provider. You can't separate them...

millenium7

I can't imagine devoting the resources to bring up EIGRP. As networks continue to stop being Cisco-exclusive, the demand for EIGRP drops even more. You can run OSPF and EIGRP in parallel if you wish to make a transition to OSPF. I can't imagine why people are against EIGRP on MikroTik and think OSP...

millenium7

I disagree with this feature request The included DNS features are as functional as they realistically need to be, for what MikroTik routers are You need to keep things in perspective. At the end of the day it is a router, not a server. MikroTik already has a huge amount of quality of life improveme...

millenium7

I've managed to kind-of-sort-of get multicast working in a lab environment but it seems buggy. Like i'll have a working configuration and then i'll reboot a router and all of a sudden, stops working Or I try and break it on purpose, and yet multicast is still flowing I'm just confused with it all, s...

millenium7

If your home network is connected via private network and does not go over the internet. Then your best bet is VPLS This takes a bit more to setup but its not too bad. All routers between you and the destination need to be running MPLS, and you need to make sure your L2MTU on every device (every rad...

millenium7

Script updated and tested. Does exactly what it should (only supports /32 routes)

/32 routes are added for DHCP leases handed out on a specific interface. This script can be copied and used multiple times on multiple instances
Routes will get removed when the lease expires

millenium7

MTU could also be an issue here How are you using EoIP? Is it just native EoIP or is it running inside another tunnel i.e. PPTP or L2TP? If the latter, absolutely only use L2TP as thats the only UDP based VPN that MikroTik supports at this point in time Either way i'd manually set the MTU to 1500 on...

millenium7

Well I stayed up late and adapted a script I made for updating address lists ### DHCP Option 82 route injection script { :local DHCPServerName "DHCP82Clients" ; # Set this to the name of the DHCP Server instance :local Comment "Added by DHCP82 Script" :local Distance 5 ; # Route ...

millenium7

I want to move to DHCP option 82 on MikroTik for easier provisioning of clients, just plug in any off-the-shelf router including MikroTik and bang client is online. However at the moment it is entirely useless for /32 and/or public IP address space because I can't see any way to have the routes inje...

millenium7

Interesting, the multi element array explains why you can just point it practically anywhere and it works So why is it the center is stronger? Why does it matter if its using any other element in the array? And if MikroTik's beam width of 1 degree still holds any validity then that would mean that 6...

millenium7

Ok so we've had a bunch of 60ghz dishes deployed in the field for a while now and they seem to 'just work' which contradicts the information i'm reading on the wiki and is also vastly different to other 60ghz products on the market. I want to get some clarification on how they actually work, and to ...

millenium7

Ah figured it out straight after posting this. I figured that the best place to do this is on the 'in' filter since in my head BGP routes are going 'in' to the OSPF instance and I don't even want them in the internal OSPF route database in the first place, but I guess thats not how it works? It seem...

millenium7

Why does this not work? /routing filter add action=accept chain=ospf-in comment="Allow specific routes" prefix=10.240.254.0/24 prefix-length=24-32 protocol=bgp /routing filter add action=discard chain=ospf-in comment="Drop all other BGP redistributed routes" protocol=bgp Yet as s...

millenium7

I'm sure those 500$ patch cords are worth it too. 1.5m of pure zeroes and ones trough those wires.... No, no, thats the thing. There's a big difference between and 1's and 0's. Those audiophile grade cables will tweak them just right so that you get -0.0023's and 1.0067's instead = higher dynamic r...

millenium7

lmao @ the 'audiophile switch' It takes a special kind of ignorance and lack of willingness to understand how things actually work to buy into that crap @OP if you don't want to believe it, go and look into ethernet actually works, how packet flow and processing works etc and you'll realize it makes...

millenium7

You misunderstand, there's been a different config applied that overrides the default configuration. So when holding the reset button it reverts NOT to the factory defaults, but to a config that somebody else applied

I don't want this, I want to restore it truly back to factory defaults

millenium7

We have a bunch of wAP's in storage that were originally flashed with a different default config, hence using the reset method just applies the config I don't want. I want to restore them back to original factory defaults. Is this possible? Alternatively what is the factory default for a device in C...

millenium7

True but my workday does no consist of sitting around twiddling my thumbs wondering what I could do next :) I don't mind tinkering with things but time is limited and if its not viable yet i'm happy to just wait and move onto other things. After all V7 is not production ready just yet anyway, but ke...

millenium7

Can this new user manager (or the old one) be used in a centralized way for multiple sites? We currently use HSNM because it gives us a web UI to setup new sites and generate new voucher codes for any site with an administrative overview. Plus change images etc for the hotspot page But we could very...

millenium7

I don't think theres anything more MikroTik could do (maybe better handling of IPv6 with this? But we don't use IPv6 so it doesn't affect me right now) The industry should move to a better system in general, such as a new DHCP option number that includes a URL. So when a client connects and gets an ...

millenium7

Nope? There is none?

In that case what is the error message generated in the log file when a bad block is encountered? At least that way I can write a syslog alert when its detected. But I need to write a regex match statement and I don't know what the message is

millenium7

I had it configured similarly in the first place and it wasn't working. Turns out you need to disable 'vlan filtering' on the bridge otherwise no traffic passes through when you set the switch VLAN rules, it just stops entirely. I figured it would still work just not have hardware offload until it w...

millenium7

Urgh I absolutely HATE the 'switch' menu its the worst piece of crap configuration i've ever seen. The most basic things like VLAN's go from being simple to overwhelmingly complicated. I'm glad this garbage was scrapped in favor of bridges, however CRS1xx/2xx still don't work properly with bridges! ...

millenium7

Mikrotik continues to make it hard to keep this thing working. :( I'm somewhat surprised and also irritated that they havn't implemented this natively into RouterOS by now. If nothing else they should contact you and ask to work on native implementation (paid of course!) This script is one of the b...

millenium7

Is there an 'unset' command for the speed parameter then? I want to push to hundreds of routers but need a command that will work for them all, I don't mind scripting it either if its fairly straightforward, but don't want to push a bunch of 'set speed=' commands that result in half of them no longe...

millenium7

In RouterOS any other configured speed value than 1Gbps (default) we be included in the export. But I 'DONT' manually set the speed in our network, yet ~50% of devices when running an export show this I suspect its due to something in a firmware update. Yet some of them DO still have the defaults (...

millenium7

Can't seem to find an OID for the bad blocks percentage. I want to add this to our monitoring system to alert on any failing flash memory so we can replace the devices as soon as any are detected

millenium7

Why is this in so many router configs? Very rarely do I ever want to force the interface speed, yet this command appears very frequently for absolutely no reason First question is if auto-negotiation is ticked, does it do anything? (big problem if it does) Secondly why is it being set like that? It'...

millenium7

This is a known issue with MikroTik and other vendors (Cambium and Ubiquiti in particular) with some devices. In my case specifically Cambium PTP radio's connected to a MikroTik router FCS errors are generated with very regular intervals,it's not an actual frame error and is not caused by bad cablin...

millenium7

Well here's hoping that password hashes get included in the /export in a future firmware

millenium7

There's a few things I would like to see - Definitely add options to specify terminal width and not export with any color or other terminal options using the /export command. Right now this only works if adding options to the username when logging in i.e. instead of "admin" you have to use...

millenium7

Bump

Still need a way to audit for out of date passwords

millenium7

Policy based routing is really quite simple - Optionally add all internet services into an Interface List. I.e. I use 'InternetFacing' this way I don't need to duplicate all my firewall rules, i.e. instead of 'in-interface=ether1-ISP1' drop all rule. I just use 'in-interface-list=InternetFacing' wit...

millenium7

I'm confused You can set the PPPoE MTU, but you don't type it in where it says "Actual MTU" you type 1492 into "Max MTU" and "Max MRU" The way MikroTik works with its PPPoE clients, if it can't successfully carry the requested size (or you don't enter one) it will drop ...

millenium7

Part of our monitoring is to log and alert of OSPF state changes. At the moment only the transition 'to DOWN' is logged as a 'route, ospf, info' message but anything else i.e. "state changed from Loading to Full" is in the 'route, ospf, debug' logging category This means I can't generate m...

millenium7

I know the obvious answer is 'no' for security reasons but i'm not actually looking for the password itself to a user account. I'm actually looking for user accounts that match a known password The reason being is I have templates I use to setup distribution routers with a default known password so ...

millenium7

I would recommend using individual VLAN interfaces to each router anyway for the reason you can then apply CoS priority based on DSCP high 3 bits. As many radios will not read DSCP tags. But applying CoS at every hop in the network ensures you have working QoS everywhere and the only way to do that ...

millenium7

the gigabit standard is full duplex. It may be possible to force it on a MikroTik but thats not the case therefore it should always 'fall back' to full duplex if the other side isn't explicitly asking to do half duplex. The opposite of what ethernet/fast ethernet is Either way, it's reporting full d...

millenium7

Riddle me this name="ether1" tx-packet=57 236 390 tx-64=996 840 tx-65-127=7 610 302 tx-128-255=49 379 966 tx-256-511=273 234 tx-512-1023=493 835 tx-1024-1518=15 100 tx-broadcast=559 491 tx-pause=0 tx-multicast=973 397 tx-collision=180 tx-excessive-collision=0 tx-multiple-collision=28 tx-si...

millenium7

It's a bit of a chicken and egg scenario Because this feature doesn't work, it doesn't get used, people don't even think of it But if it was implemented, there's A LOT of potential power that can be leveraged with a simple MikroTik router I know i'd be writing monitoring templates then just chucking...

millenium7

In all honesty I don't care if its MikroTik based or not. Infact having dedicated boxes we can easily spin up and install onsite to take care of that location i'm all in favor of as it moves that component completely off the main onsite router, easing troubleshooting and management But it must be so...

millenium7

We're currently using HSNM Hotspot Manager which is ok management wise and it ingrates nicely with MikroTik to serve HTML pages and handle logins locally, but there's just too many issues that seemingly cannot be fixed. Such as users having to continually log in (despite having the timeout periods s...

millenium7

Doesn't have to be for the physical counters, but stop it appearing in the log files. This is a known issue between some cambium PTP products and MikroTik routers with neither one taking the blame. Every 30/60 seconds a FCS error happens, its extremely regular its not a physical line issue. It doesn...

millenium7

We have 1 hotel in particular that continually complains about an issue that I can't seem to diagnose thus I can't fix it They keep saying that users are getting logged off and having to re sign in even in short periods of time I would like to know 'everywhere' that can influence hotspot users so I ...

millenium7

We have some WSAP devices that have 2 accessible ethernet interfaces on the front. I want these ports to either be disabled, or bridged with the wireless interfaces so if any guests plug in to these ports they get access to the hotspot network and not the uplink interface that the WSAP is connected ...

millenium7

Awesome response. Thank you for taking the time to clear it up Before I created this thread I had no knowledge of how the actual 'hotspot detection' works outside of a HTTP redirect when the user themselves opens a page and try and browse. But that's really a last ditch effort and in an ideal world ...

millenium7

Yep works perfectly, thanks

millenium7

Ah maybe it does work then. I'll lab it up tomorrow and see how it goes

Nothing for ethernet though I presume?

millenium7

Like said above, you should not be typing anything. Computers and phones have hotspot detection But as I keep saying, I want some actual information on this. Not just 'it should work' HOW does it work? I would like information on how all devices detect hotspot in the first place. Not just a brief o...

millenium7

Is there a way to have scripts run on a triggered event rather than by scheduler? In particular i'm looking for a way to run a script when an interface goes up or down I can see this can be done on VRRP or PPPoE servers (via profile) but I actually need an event to run when the PPPoE Client interfac...

millenium7

Here's a list of domains that devices check. I have no idea if this list is totally accurate and if its missing any (can't see a post date) but its a start https://success.tanaza.com/s/article/How-Automatic-Detection-of-Captive-Portal-works It's all well and good saying what should or shouldn't be d...

millenium7

My main focus here is not in actually trying to redirect HTTPS, I really honestly don't give a flying stuff about that The real issue is simply when hotspot detection fails, the user gets no prompt or no notification in any way that they need to first 'sign in' and the normal behavior is they just o...

millenium7

Yeah its specific to that chip The freezing happens every time a channel is opened. And it can also be slow to be recognised and show up under system ports, sometimes up to 10+ minutes But it does work and is at least $1000 cheaper than a dedicated solution. Good enough for a worst case scenario Tha...

millenium7

If the hotspot server is a mikrotik router, how do you accomplish this? Sorry, no idea, but doing this for long time already, on openwrt-based devices. Which are much better suited for hotspots with "advanced features", like this one. Any recommendations for a package we can put on a low ...

millenium7

In part, HTTPS exists exactly to prevent such silent interception of web browsing. Doesn't change the fact that other hotspot devices have far, far better hotspot handling than MikroTik. It seems to 'just work' far more often. Whereas we constantly get the odd device that just doesn't play ball wit...

millenium7

Make sure your hotspot is intercepting requests to hotspot-detection services that any modern OS has. This includes HTTP requests to URLs such as http://gstatic.com/generate_204 and intercepting all DNS requests eg for invalid / random hostnames like "xgjaiobman" If the hotspot server is ...

millenium7

Mikrotik devices are not always used as expected by many customers. So they try to make the safest configuration possible for customers. I have seen devices just plugged in and not configured, with blank admin password. Last power box i saw like that was at a hotel to power their access points. The...

millenium7

Bump I hope a MikroTik rep sees this and puts it on the drawing board. Would help a lot with the ability to read data off other devices Our primary use case is pre-emptive route failover but I can think of a lot of other use cases i.e. emailing to alert of high temperature of devices that don't supp...

millenium7

Thought i'd post an update to this. The answer is yes its supported (StarTech USB to 4 port RS232 adapter incase link dies) nothing more required other than just plugging it in Serial sessions can be opened via the 'system serial-terminal port=usb1 channel=' command, channel being 0-3 for ports 1-4 ...

millenium7

Are there any instances where /ip ssh set forwarding-enabled=remote would be set automatically? I.e. firmware update etc
I'm seeing this has been turned on for some routers. I'm thinking they may be compromised and this is being used as an attack mechanism

millenium7

MTU is end to end. If the customers session is 1480 they can never send or receive anything larger without fragmentation anyway. There's no reason you can't use 1500 byte PPPoE sessions though, as long as the equipment to the customer supports large enough L2MTU. You set your PPPoE server to Max-MTU...

millenium7

Late response and I'm on a phone so I won't quote specific sections of text but.... PPPoE is staying in place in our network. Because Mikrotik doesnt support /32 DHCP address assignment for customers properly. Or rather the actual assignment of the address works ok but the router doesn't add a route...

millenium7

OSPF suuuuucks for wireless networks, company acquisitions and companies with rapid expansion. It's ok for university campuses or businesses that generally don't change much with a fairly fixed topology, but not for service providers or many modern companies that expand in unpredictable ways Having ...

millenium7

Is there a workaround I can implement for this? We have a network segment that is Mimosa with an A5 access point and C5 radio's. Behind all the C5 radio's are switches and then customers who use PPPoE The Mimosa's have been a constant pain in the ass and the biggest one is they don't even allow half...

millenium7

Must be a bug then. Switch is a CRS317 running 6.44.3 so its a recent firmware. Definitely does not show up in a normal /export
It doesn't even show if I do a '/interface ethernet switch export'
I have to specifically do '/interface ethernet switch port export'

millenium7

Yeah I managed to set it, wasn't messy

Thing I really don't like though is switch commands don't show up in a /export

millenium7

Setting a horizon value on a bridge port disables hardware offload on that port, so this isn't an option But I have a setup that requires ports to be isolated from each other to prevent any accidental loop and reduce unnecessary broadcast traffic How else can it be achieved without lots of messy fil...

millenium7

As present I don't have any PTP failover links ! So not sure if should still use BFD! Unfortunately MikroTik just isn't as stable as Cisco/Juniper etc. In an ideal world BFD would just work flawlessly all the time and then its an an easy answer of enable it everywhere in the network Sometimes its n...

millenium7

Have started getting setup for this but its quite a long process adding VLAN tags to all router links - especially when there's a switch like a Netonix in between as their default policy is drop all unknown VLAN's, takes a fair bit more time per link to change But this is also a good opportunity to ...

millenium7

So you're carrying the VLAN all the way through the network? Been there, seen that, it's really really bad and not scalable. I would make getting extended bridges out of your network a top priority, as it becomes much harder to remove the bigger you get. VLAN's shouldn't go any further than the dire...

millenium7

Hello, I am well on my way to make our MikroTiks environmentally friendly. I have reduced their power output, assigned the mode button to switch wlan on or off, and now I would like the router to disable wlan when all users have disconnected from wlan. Have you done the calculations to determine ho...

millenium7

Just regarding NBMA OSPF type. I would advise against it. I've had issues with NBMA being unreliable for no apparent reason I've found the best option on MikroTik if you have a point-to-multipoint setup is to instead create separate VLAN interfaces (1 for each neighboring router) and then use the po...

millenium7

Just curious asking why on our network that a previous techie would create both OSPF and MPLS loopbacks on routers each with there own ip range ?

Cause he was a massive goose?

millenium7

Need more info on the topology For instance are PPPoE sessions terminated closest to the customer, or are they all terminated at a central PPPoE concentrator? If the latter are you using VPLS tunnels (or something else like EoIP?) Do you have BGP running internally in the network? These answers chan...

millenium7

I don't know why this wouldn't have been the default since like ROS v1.0 Can you change it so that by default in the neighbors tab of OSPF it shows the adjacency time column? That's right in your face on any other routing platform when doing a "show ip neighbor" and is a really useful bit ...

millenium7

I setup a lab using 1 of the existing routers, leaving config exactly the same. Used other devices to simulate switches and other routers Setup BGP+OSPF+MPLS routers as good as I can but obviously not as big as the actual network. Added 200 PPPoE sessions with traffic generator across several router...

millenium7

The way I do this in our network is first make sure you aren't bridging the 60ghz and 5ghz together. You want to use routing Set IP addresses on 60ghz and 5ghz links in different subnets i.e. 10.0.0.0/29 for 60ghz and 10.0.1.0/29 for 5ghz Set up OSPF for both networks. Use type point-to-point (most ...

millenium7

This would be great if we could spin up small servers running on the RouterBoard hardware i.e. network monitoring collectors

However the downside is massive potential for security holes at the hardware and kernel level so thats why I think they would never implement it

millenium7

NetXMS is IMO the very best 'free' platform out there, by quite a long margin. But its the best 'theoretically' That's the problem with it. It's not the best out of the box, it actually is really difficult to get it to do some pretty basic things like 'just start monitoring bandwidth on all interfac...

millenium7

We have this problem, but for us it happens every 30-90 days or so. It last happened 57 days ago. We have a ping watchdog to reboot the router when this happens. Disabling and re-enabling the interface might fix it too. Same CCR1036-8G-2S+, first generation. We have two CCR's connected to each othe...

millenium7

We only do this queue tree setup on links from 3rd party connectivity vendors where they guarantee us a certain bandwidth amount where we are at risk of actually maxing out that amount. It doesn't make sense to set up these queue trees and packet marks if the router is only connected to radio links...

millenium7

Just with the default 'disk' action which creates file beginning with 'log.' then the sequence number, then ends in txt i.e. log.0.txt and log.1.txt by default The reason for logging to disk is incase connectivity is lost i.e. interfaces locking up, at least logs would be stored if theres no other w...

millenium7

Further details are here https://forum.mikrotik.com/viewtopic.php?f=3&t=149273&p=735586#p735586 But the short version is we have plenty of MikroTik routers out there all working fine with OSPF, MPLS and BGP just fine. But the ones in our data center have their SFP+ interfaces partially lock ...

millenium7

replaced with brand new CCR1016's and the same problem happens! This is caused by either OSPF or MPLS in combination with what's already running (eBGP, iBGP, PPPoE, IPSec). When OSPF+MPLS are disabled it's fine. But when enabling them the network is perfectly stable and looks totally fine for a few ...

millenium7

I noticed the copying of files to be a problem. Is it possible for you to change that in your script to exclude anything beginning with 'log.' ? Reason is I was logging to disk any errors to try and help troubleshoot the issues we were having when we couldn't catch it in time, but when the router re...

millenium7

Ok i'm liking this QoS implementaiton, its quite simple to implement and elegant. However couple more questions I've been labbing this just with a couple of routers connected via 100mbit ethernet to first get the queueing correct then i'll test with radio's in between Baseline was just to have no Qo...

millenium7

Ok. As I said I don't think its the script because I can't think of any way to even make an interface do that, even if intentionally trying Good to know the reboots are a normal thing. It was happening more than once a day but knowing that its also caused by 'system history print' answers why becaus...

millenium7

Ok but I have heard its best practice to use QoS tags at Layer3 as opposed to Layer2 so why not use DSCP tags instead of CoS?

And does a MikroTik router actually do anything with DSCP tagged packets by default or does it need to configured with mangle or queue's to apply prioritization to traffic?

millenium7

The router-router links don't use VLAN's though They just speak to each other on the ethernet link i.e. ether5 on RouterA connects to PTP670 link connects to ether7 on RouterB So using the set priority mangle rule wouldn't do anything? Or would it still tag packets with native VLAN id so that priori...

Search found 348 matches