Community discussions

MikroTik App

Search found 69 matches

by sash7
Tue May 02, 2017 7:29 pm
Forum: General
Topic: Huge performance drop with mangle + queue tree rules, CPU 50% max
Replies: 22
Views: 6349

Re: Huge performance drop with mangle + queue tree rules, CPU 50% max

Do test: in this simple queue, try to use queue type = sfq. (create new one or simply use wireless-default) and check again.
by sash7
Tue May 02, 2017 5:39 pm
Forum: General
Topic: Huge performance drop with mangle + queue tree rules, CPU 50% max
Replies: 22
Views: 6349

Re: Huge performance drop with mangle + queue tree rules, CPU 50% max

i see firewall use about twice resources than qos. So, probably you can try to optimize your firewall rules (mangle)
by sash7
Mon May 01, 2017 8:41 pm
Forum: General
Topic: Can i queue an interface resp WLAN?
Replies: 5
Views: 1328

Re: Can i queue an interface resp WLAN?

don't use bridge, set different network for wlan and lan, then set simple queue on wlan. also allow communication between these two in firewall forward if you want to see each other.
by sash7
Thu Apr 20, 2017 9:58 am
Forum: General
Topic: Block Internet using MAC address
Replies: 2
Views: 826

Re: Block Internet using MAC address

Should be work. Post your firewall forward rules
by sash7
Tue Apr 18, 2017 10:20 am
Forum: Beginner Basics
Topic: Client isolation - is this possible?
Replies: 3
Views: 7916

Re: Client isolation - is this possible?

you need to set rules in firewall filter forward chain. First, use only 2 rules: rule 1: allow related, established rule 2: drop all now, between these two add separate rule for each vlan you want, for example for vlan10: allow internet only : in-interface=vlan10 out-interface=wan action=accept allo...
by sash7
Sun Apr 16, 2017 10:28 pm
Forum: General
Topic: Help with HTB please
Replies: 8
Views: 1282

Re: Help with HTB please

without network map this is waste of time but... i dont know how many interfaces you have, but if you set simple queue(s) with target=wan interface (internet), then local traffic (between local interfaces) cannot be affected in any way. in simple queue you can also add dst=xxx where xxx=any local in...
by sash7
Sun Apr 16, 2017 10:14 am
Forum: General
Topic: Help with HTB please
Replies: 8
Views: 1282

Re: Help with HTB please

borisk try to use simple queue. it's much easy to understand and configure and work well in most cases. draw some diagram of network to see it
by sash7
Sat Apr 15, 2017 2:31 pm
Forum: General
Topic: Help with HTB please
Replies: 8
Views: 1282

Re: Help with HTB please

well it's strange use of queue tree, no limits, parent with one child...

and where you mark packets for child queue "... local" ? when you have child's you need to drive traffic to them. all traffic
by sash7
Fri Apr 14, 2017 11:27 am
Forum: Beginner Basics
Topic: 951G-2HnD config
Replies: 7
Views: 1127

Re: 951G-2HnD config

NetJohn maybe try this: add new bridge
add static ip on bridge - to acces router in this ip. add all interfaces you want + wlan on this bridge. remove all other and try again.
as i understand dhcp server is on pc, right?
by sash7
Thu Apr 13, 2017 4:52 pm
Forum: Beginner Basics
Topic: Please help with port forwarding!
Replies: 21
Views: 3811

Re: Please help with port forwarding!

little mess in forward chain. Try temporary to disable all rules in forward and test again (use safe mode) . nat rules is ok
by sash7
Wed Apr 12, 2017 6:10 pm
Forum: Beginner Basics
Topic: Please help with port forwarding!
Replies: 21
Views: 3811

Re: Please help with port forwarding!

it's not clear what you have in forward chain.
add accept rule for connection-nat-state=dstnat, or write rule with right address and ports.
by sash7
Wed Apr 12, 2017 5:49 pm
Forum: Beginner Basics
Topic: forwarding stream(IP and Port)
Replies: 6
Views: 1898

Re: forwarding stream(IP and Port)

can't open images...

you also need to accept these nat-ed packets in firewall forward chain.
by sash7
Wed Apr 12, 2017 12:20 pm
Forum: Beginner Basics
Topic: forwarding stream(IP and Port)
Replies: 6
Views: 1898

Re: forwarding stream(IP and Port)

something like this
/ip firewall nat
add chain=dstnat in-interface=your-wan protocol=tcp src-address=145.x.x.x src-port=1234 dst-port=3099 action=dst-nat to-addresses=192.168.88.xx to-ports=3099 
change
in-interface=, protocol=, src-address=, to-address=
with yours
by sash7
Wed Apr 12, 2017 10:33 am
Forum: General
Topic: Is it possible to create virtual interfaces and separate traffic between them?
Replies: 6
Views: 2229

Re: Is it possible to create virtual interfaces and separate traffic between them?

Is not it easier to use simple queues for these ip and watch traffic there?
by sash7
Sat Apr 08, 2017 9:56 pm
Forum: General
Topic: Queue Priority Confused
Replies: 2
Views: 684

Re: Queue Priority Confused

IP 192.168.1.5 will use 20mbit. you can first create a parent with target=192.168.1.0/24 20M/20M and then use this parent in child 192.168.1.x

or maybe PCQ will do better job in your case.
https://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ
by sash7
Thu Apr 06, 2017 10:32 am
Forum: General
Topic: Is there a way to share channel bandwidth proportionallIy?
Replies: 3
Views: 492

Re: Is there a way to share channel bandwidth proportionallIy?

about priority. limit-at is always guarantee even there is priority in this setup, up to 1000kbit priority will not work, because two child have guaranteed 300k and 700k. but if try 2000 as limit in tbf, probably those child with 4/4 priority will get all over 1000 up to 2000 =1700, and those child ...
by sash7
Wed Apr 05, 2017 5:56 pm
Forum: General
Topic: Is there a way to share channel bandwidth proportionallIy?
Replies: 3
Views: 492

Re: Is there a way to share channel bandwidth proportionallIy?

use pcq queue in parent is useless - this work only in leaf child. htb work fair only if sum of rate<=parent rate. (htb rate == limit-at in ros) if you don't know current speed, use small limit-at in two child, only proportion between these two matter. so, for example, if expected speed drop to 1000...
by sash7
Wed Apr 05, 2017 1:41 pm
Forum: General
Topic: Simple Queue question
Replies: 13
Views: 1843

Re: Simple Queue question

In simple queue you can select these two: pcq-download-default and pcq-upload-default for download and upload Then in Queue / Queue Types tab you can find these two, click them and edit Rate = 2M https://s7.postimg.org/5abzn19dn/20170405_135559.png https://wiki.mikrotik.com/wiki/Manual:Queue#Queue_T...
by sash7
Tue Apr 04, 2017 8:39 pm
Forum: General
Topic: Simple Queue question
Replies: 13
Views: 1843

Re: Simple Queue question

no, you need one simple queue with target=192.168.0.0/24 and max-limit=10M/10M + set queue type=pcq for upload/download and set these with pcq-rate=2M in both

1 client - 2M, up to 5 client - get 2M each. 10 client - 1M each...
by sash7
Tue Apr 04, 2017 7:34 pm
Forum: Beginner Basics
Topic: 951ui 3G modem... strange
Replies: 13
Views: 1368

Re: 951ui 3G modem... strange

ok, try to add new rule
/ip firewall mangle
 add chain=postrouting out-interface=xxx action=change-ttl new-ttl=set:56
change xxx with your 3g interface

test...
by sash7
Tue Apr 04, 2017 4:38 pm
Forum: Beginner Basics
Topic: 951ui 3G modem... strange
Replies: 13
Views: 1368

Re: 951ui 3G modem... strange

ping google from RB terminal and see TTL, maybe is 1?

Then try to set ttl in number you get from ping - on mangle postrouting, where out-interface="your 3g device"

Maybe this provider block internet access if see different ttl from you (they try to prevent sharing)
by sash7
Tue Apr 04, 2017 10:13 am
Forum: Beginner Basics
Topic: Garanteed Bandwidth per port with priority
Replies: 3
Views: 455

Re: Garanteed Bandwidth per port with priority

I will try... One variant is to use 3 simple queue. - 1 "main" on wan interface, target wan interface, Max Limit 5/5 (this will be parent to 2 and 3) - 2 parent "main", target=wan, dst="your network", Limit At 4/4, Max Limit 5/5 -3 parent "main", target=wan, dst="client network", Limit At 1/1, Max L...
by sash7
Mon Apr 03, 2017 5:26 pm
Forum: Beginner Basics
Topic: PCQ and Queue Tree
Replies: 3
Views: 2117

Re: PCQ and Queue Tree

Hi, in this case queue tree and mark is not needed. Keep things simple, use queue simple with target=192.168.68.0/24 and pcq.

Specify what exactly you want. what speed download/upload for all users, what for each one?
by sash7
Mon Apr 03, 2017 2:05 pm
Forum: General
Topic: ip firewall rule for logging nat traffic (only 1 connection per host)
Replies: 3
Views: 961

Re: ip firewall rule for logging nat traffic (only 1 connection per host)

Test: /ip firewall filter> add chain=forward in-interface=ether1-wan connection-nat-state=dstnat dst-address-list=!"nat-list" action=add-dst-to-address-list address-list="nat-list" log=yes Correct in-interface name with yours, eventually add out-interface. rule should be first, or better behind "rel...
by sash7
Mon Apr 03, 2017 12:06 am
Forum: General
Topic: ip firewall rule for logging nat traffic (only 1 connection per host)
Replies: 3
Views: 961

Re: ip firewall rule for logging nat traffic (only 1 connection per host)

maybe something like this: in forward chain catch nat connections, compare destination ip with list, add new ip-s to this list.
by sash7
Sun Apr 02, 2017 11:58 pm
Forum: General
Topic: Firewallrule: TTL=1 to block Tethering and private Hotspot
Replies: 2
Views: 2439

Re: Firewallrule: TTL=1 to block Tethering and private Hotspot

these guys who "opening their own hotspot" 100% know how to deal with ttl1 )
by sash7
Fri Mar 31, 2017 2:46 pm
Forum: Beginner Basics
Topic: NAT Forward
Replies: 3
Views: 1020

Re: NAT Forward

Also may check did you have accept rule for these connections. In firewall forward chain.
by sash7
Fri Mar 31, 2017 2:12 pm
Forum: General
Topic: [Solved] PCQ Rate and Simple Queue - Per IP Shaping Problem
Replies: 22
Views: 16745

Re: [Solved] PCQ Rate and Simple Queue - Per IP Shaping Problem

Hi. For me, mistake in your rules in first post is in address mask. pcq-src-address-mask=0 pcq-dst-address-mask=0 If you network is 192.168.88.0/24 - src and dst mask should to be 32 not 0 /queue type> print 5 name="pcq-download" kind=pcq pcq-rate=6M pcq-limit=50KiB pcq-classifier=dst-address pcq-to...
by sash7
Thu Mar 30, 2017 4:56 pm
Forum: Beginner Basics
Topic: HTB question
Replies: 2
Views: 483

Re: HTB question

Hi. If you just try to limit speed, use simple queue. If there are many equal clients, use network as target, and learn about "pcq" queue
by sash7
Wed Mar 29, 2017 11:00 pm
Forum: Beginner Basics
Topic: Need help wifi does not work.
Replies: 2
Views: 510

Re: Need help wifi does not work.

Hi.
in /ip dhcp-client use "Use peer DNS" checked if you want WAN to get dns from your isp.

in /ip dhcp-server network remove all these dns servers and just use dns-server == gateway ip
clients will ask and get dns from router
by sash7
Tue Mar 28, 2017 6:27 pm
Forum: General
Topic: Mikrotik QoS HTB exemple 2 wrong ?
Replies: 2
Views: 539

Re: Mikrotik QoS HTB exemple 2 wrong ?

yes you wrong, queue 4 will get all left to 10mbit : 2 + 4 = 6.
by sash7
Thu May 05, 2016 2:04 pm
Forum: Beginner Basics
Topic: forward chain rules not being implied [SOLVED]
Replies: 4
Views: 1114

Re: forward chain rules not being implied [SOLVED]

they communicate each other directly through switch, you can't stop this in router.
by sash7
Sat Apr 30, 2016 6:14 pm
Forum: General
Topic: Setting Help needed: Other comp connect to mikrotik subnet
Replies: 6
Views: 688

Re: Setting Help needed: Other comp connect to mikrotik subnet

maybe simple dstnat rule to server ip/port and you can access it on wan ip address
by sash7
Sun Apr 24, 2016 5:22 pm
Forum: General
Topic: FastTrack Rule and Hotspot
Replies: 5
Views: 1677

Re: FastTrack Rule and Hotspot

irghost post firewall rules with:
/ip firewall filter export
by sash7
Fri Apr 22, 2016 6:40 pm
Forum: General
Topic: how to configure FTP for local PPOE user
Replies: 2
Views: 576

Re: how to configure FTP for local PPOE user

give more info, is 192.168.100.100 ftp server? if yes, you need to add dst-nat rule in nat table, and also accept these packets in forward chain.
by sash7
Fri Apr 22, 2016 6:16 pm
Forum: General
Topic: Better default for firewall filter
Replies: 36
Views: 4762

well, default config is not mandatory. i use variant with rule accepted my local interface (bridge-local) and then last rule drop everything. no chance to mistake )
by sash7
Thu Apr 21, 2016 12:56 am
Forum: Beginner Basics
Topic: webserver isolation on local network
Replies: 17
Views: 1842

Re: webserver isolation on local network

simple use different network on ether5, then drop communication between server and local network in firewall forward chain.

first check is ether5 not to slave - in default config ether2 is master on ether3-5
by sash7
Wed Apr 20, 2016 10:26 am
Forum: General
Topic: Strange PCQ Issue
Replies: 10
Views: 1894

Re: Strange PCQ Issue

Hi TechGuy I must noted that if both limits (pcq-rate and max-limit) are unspecified, queue behavior can be imprecise. So it is strongly suggested to have at least one of these options set. this is from pcq manual. You need to limit upload speed to ~80% of your real upload speed. If you want to have...
by sash7
Tue Apr 19, 2016 9:54 am
Forum: General
Topic: tcp syn-flood
Replies: 9
Views: 2566

Re: tcp syn-flood

syntax is ok, try to add manually, maybe you copy-paste?
by sash7
Mon Apr 18, 2016 8:20 am
Forum: Beginner Basics
Topic: Hi guys im having some issues
Replies: 5
Views: 1151

Re: Hi guys im having some issues

you have too complicated firewall, in my opinion many many ot these rules is useless and do absolutely nothing. nothing good at least. i don't know what is easy - to edit (disabled) they one by one, or rewrite all from zero. about red line i have no answer, maybe some who has more experience with mi...
by sash7
Sat Apr 16, 2016 10:30 pm
Forum: Beginner Basics
Topic: Hi guys im having some issues
Replies: 5
Views: 1151

Re: Hi guys im having some issues

First, who is user Estiaan? Give more information about network - what connection use to internet, local network... then post here your firewall rules.
And better stay with last bugfix version 6.32.4 - do you prefer stability, or want to be beta tester?
by sash7
Sat Apr 16, 2016 4:50 pm
Forum: Beginner Basics
Topic: Traffic Shaping MikroTik Cloud Core Router CCR1009-8G-1S-1S+ for 200Mbit
Replies: 6
Views: 1349

Re: Traffic Shaping MikroTik Cloud Core Router CCR1009-8G-1S-1S+ for 200Mbit

Hi, are you sure that fasttrack is off? Please post rules in your forward chain.

and, or, try simpliest queue - with no dst, only target with wan interface.
by sash7
Fri Apr 15, 2016 6:43 pm
Forum: Beginner Basics
Topic: Firewall Filter Rule before NAT rule
Replies: 12
Views: 16816

Re: Firewall Filter Rule before NAT rule

after dstnat packets to your server which is behind router going to forward chain, not to input.
by sash7
Thu Apr 14, 2016 11:34 am
Forum: General
Topic: Traffic Priority (Queue Tree?)
Replies: 19
Views: 8734

Re: Traffic Priority (Queue Tree?)

i understand what you want, but when use priority there is no "guarantee" nothing for classes with low priority. these with high priority probably may get all bandwidth. in my opinion htb work predictable and fair if you use equal priority and set correct numbers for limit and max limit.
by sash7
Thu Apr 14, 2016 12:22 am
Forum: Beginner Basics
Topic: Help configuring Cloud Router Switch as SOHO gateway
Replies: 4
Views: 1350

Re: Help configuring Cloud Router Switch as SOHO gateway

yes, set ether1 to master-port=none then attach dhcp-client on him, if your isp give you automatic settings, or set manually ip address, gateway, dns. then only need to set nat.

router coming without any settings or what?
by sash7
Wed Apr 13, 2016 9:17 pm
Forum: General
Topic: Exclude one IP from FastTrack - to do simple queues on that IP
Replies: 7
Views: 2357

Re: Exclude one IP from FastTrack - to do simple queues on that IP

add chain=forward connection-state=established,related dst-address=192.168.1.251
add chain=forward src-address=192.168.1.251

add action=fasttrack-connection chain=forward connection-state=established,related
add chain=forward connection-state=established,related
by sash7
Wed Apr 13, 2016 3:30 pm
Forum: General
Topic: Traffic Priority (Queue Tree?)
Replies: 19
Views: 8734

Re: Traffic Priority (Queue Tree?)

about upload: lan1 drop because your lan2 has high priority. another: where is limit and max-limit for lan3? if your upload max-limit is 5M, then sum of all tree lan's limit need to be equal to 5M. try in this way, and without different priority. exactly same case in downloads. change and test again)
by sash7
Wed Apr 13, 2016 2:51 pm
Forum: Beginner Basics
Topic: Firewall rule? Only MAC.. HELP
Replies: 3
Views: 757

Re: Firewall rule? Only MAC.. HELP

something like this add chain=forward comment="FW allow related,established" \ connection-state=established,related add chain=forward comment="FW: allow only my phone" \ in-interface=bridge-local src-mac-address=\ 64:BC:0C:91:EC:67 add action=drop chain=forward comment="FW: drop all other" replace "...
by sash7
Wed Apr 13, 2016 8:30 am
Forum: General
Topic: Hotspot User Profile Incoming Packet Mark not working
Replies: 2
Views: 767

Re: Hotspot User Profile Incoming Packet Mark not working

packets mark is ok, you wrong with parents in queue tree. for upload from clients you need to use your wan interface as parent
by sash7
Tue Apr 12, 2016 10:53 am
Forum: General
Topic: How do I monitor the data amount that goes by my ADSL modem?
Replies: 9
Views: 897

Re: How do I monitor the data amount that goes by my ADSL modem?

another problem is that you lose these counters if power off rourer.
by sash7
Mon Apr 11, 2016 6:10 pm
Forum: Beginner Basics
Topic: PCQ unlimited bandwidth for a single IP
Replies: 4
Views: 1023

its not easy just to add two rules in queue simple? /queue simple add name=boss target=192.168.2.33 max-limit=100M/100M add name=all target=192.168.2.0/24 max-limit=512k/512k queue=pcq-upload-default/pcq-download-default do not use unlimited speed for unlimited user "boss" , use your real speed (mea...
by sash7
Sun Apr 10, 2016 10:54 pm
Forum: General
Topic: Traffic Priority (Queue Tree?)
Replies: 19
Views: 8734

Re: Traffic Priority (Queue Tree?)

you have an error in marking - in both places is new-packet-mark=download ?
by sash7
Sat Apr 09, 2016 4:31 pm
Forum: General
Topic: Traffic Priority (Queue Tree?)
Replies: 19
Views: 8734

Re: Traffic Priority (Queue Tree?)

slv simply use forward chain, packet mark and use interfaces in-interface / out-interface for all download like this /ip firewall mangle add chain=forward action=mark-packet new-packet-mark=download in-interface=your_wan_iface out-interface=your_lan_iface passthrough=no comment="all download" disab...
by sash7
Thu Apr 07, 2016 10:41 pm
Forum: General
Topic: firewall rules for OpenVPN?
Replies: 4
Views: 9615

Re: firewall rules for OpenVPN?

yes, problem in rules - you need a rule to accept related,established. in first place! chain=input action=accept connection-state=related,established then remove 1 ;;; ALLOW --> OpenVPN chain=input action=accept protocol=tcp src-address=192.168.10.1 in-interface=ether1 src-port=1194 log=no log-prefi...
by sash7
Thu Apr 07, 2016 9:42 pm
Forum: General
Topic: firewall rules for OpenVPN?
Replies: 4
Views: 9615

Re: firewall rules for OpenVPN?

post your rules in input chain (Router2)
by sash7
Thu Apr 07, 2016 8:29 pm
Forum: General
Topic: High ARP Incoming
Replies: 12
Views: 1613

it's normal, probably have windows machines on this interface, try to "took" each other)

Sent from my LG-H502 using Tapatalk
by sash7
Wed Apr 06, 2016 2:11 pm
Forum: Beginner Basics
Topic: allow access WebFig from public ip
Replies: 4
Views: 2216

Re: allow access WebFig from public ip

mac address is not possible from internet. I also use my phone for remote access. my ip is also dynamic, but vary only in last numbers, 202.5.0.xxx and i use in rule src-adreess=202.5.0.0/24. only 256 ip can try, much better than all world)
by sash7
Wed Apr 06, 2016 12:38 pm
Forum: Beginner Basics
Topic: allow access WebFig from public ip
Replies: 4
Views: 2216

Re: allow access WebFig from public ip

add chain=input action=accept in-interface=wan_iface src-address=remote_ip protocol=tcp dst-port=80

Move in over your drop rule in input chain. Is risky if you not specify src-address!
by sash7
Tue Apr 05, 2016 6:58 pm
Forum: Beginner Basics
Topic: hidden Harbour
Replies: 12
Views: 1477

k750 two more questions : what is the name of your wan (connected to internet) interface? what is the name of your lan (192.168.1.1) interface? i try to write rules for you later when back to home) ---------------- well, if you want test this 1. Save your config Remove all rules in input, forward, o...
by sash7
Tue Apr 05, 2016 5:14 pm
Forum: Beginner Basics
Topic: hidden Harbour
Replies: 12
Views: 1477

k750 maybe you need to start from beginning. add rules and rules in firewall just like that is not good. Previously in another theme you ask to open ports 80 and 443 for server or something, now misunderstand why these ports is open... make network map with all computers, servers, addresses, ports.....
by sash7
Mon Apr 04, 2016 7:45 pm
Forum: General
Topic: Problem to enable Simple Queue
Replies: 4
Views: 657

Re: Problem to enable Simple Queue

I try this in my MT - same as your case. But start working well when set any speed in max-limit, i try 100M/100M :D
by sash7
Mon Apr 04, 2016 6:19 pm
Forum: General
Topic: Problem to enable Simple Queue
Replies: 4
Views: 657

Re: Problem to enable Simple Queue

Try to add max-limit to first queue, even max-limit=0/0
by sash7
Mon Apr 04, 2016 8:28 am
Forum: Beginner Basics
Topic: Open ports for outside access
Replies: 12
Views: 4350

Too many information, but you also need to accept this ports in forward chain.
by sash7
Tue Mar 29, 2016 10:28 am
Forum: Beginner Basics
Topic: New to MikroTik
Replies: 15
Views: 1678

Re: New to MikroTik

1. It's really bad idea to open winbox, http and telnet from all internet. 2. Put "related, established" rule on second place in input chain right behind 'invalid' rule. And this is not from "connection orginated from lan". This rule accept most traffic in input chain, so, move it ahead. 3. In forwa...
by sash7
Fri Mar 25, 2016 11:05 pm
Forum: Beginner Basics
Topic: Disabling Mikrotik visibility via public IP
Replies: 4
Views: 841

mikrot1ker post your firewall rules here (input only) Check your IP here http://www.yougetsignal.com/tools/open-ports/ Here is my Input rules ) 0 ;;; IPT: allow related,established chain=input action=accept connection-state=established,related log=no log-prefix="" 1 ;;; IPT: allow all from lan chain...
by sash7
Wed Mar 23, 2016 8:06 am
Forum: RouterBOARD hardware
Topic: How to reset RB450G?
Replies: 11
Views: 27730

https://youtu.be/G-iIxxXcYq0

Sent from my LG-H502 using Tapatalk
by sash7
Mon Mar 21, 2016 12:46 am
Forum: Beginner Basics
Topic: Configuration Help for Network
Replies: 9
Views: 1255

you can't use 20.0.0.0/24 (Kids) in private network, use these in ZeroByte post, or something like 10.0.10.0/24 and 10.0.20.0/24
by sash7
Mon Mar 21, 2016 12:27 am
Forum: Beginner Basics
Topic: Routerboard remote access
Replies: 4
Views: 1050

post all firewall rules:

/ip firewall filter print