Community discussions

MikroTik App

Search found 3813 matches

  • 1
  • 2
  • 3
  • 4
  • 5
  • 13
by Amm0
Thu Apr 18, 2024 3:25 pm
Forum: Scripting
Topic: Can't Query Graphql site
Replies: 6
Views: 190

Re: Can't Query Graphql site

Well, it the -H 'Content-Type: application/json' that's messing in your /tool/fetch - that's setting it as JSON. :put ([/tool fetch url="https://somewebsite/api/graphql" \ http-method=post \ http-header-field="Content-Type:application/json,Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...
by Amm0
Thu Apr 18, 2024 3:22 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

@Amm0 thanks will give that a shot.
One note, in scheduler script, you might want to use "/log info TEXT" instead of a :put.
by Amm0
Thu Apr 18, 2024 3:14 pm
Forum: Scripting
Topic: Can't Query Graphql site
Replies: 6
Views: 190

Re: Can't Query Graphql site

Hmm unfortunately the same response. It is so weird that it works with Curl or Postman but not with the fetch tool. Can you post the command you're using with `curl` that works? You may also need to add JSON as the content-type to /tool/fetch, since my guess is curl is using a --json (which sets th...
by Amm0
Thu Apr 18, 2024 3:10 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

Or run at CLI, add an other :while (1) do={ ... } around the code, with a :delay 10s before the end of the loop. It take a ctrl-c to exit.
by Amm0
Thu Apr 18, 2024 3:08 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

@Amm0 I am getting somewhere now I need to just get this script to refresh every 10s when the new local pktdata is updated You can put the code into /system/schedule** script with an 10s interval, that starts at "startup". ** likely easier in winbox/webfif to cut-and-paste code than use C...
by Amm0
Thu Apr 18, 2024 2:52 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

Essentially the conversion from hex-in-a-string to an int take the following form today: [:tonum "0x$[:pick $pktdata <index> (<index> + <len>) ]"] So in your code it look like this: # Main function to decode Bluetooth advertisement data /iot bluetooth scanners advertisements { :local adids...
by Amm0
Thu Apr 18, 2024 5:56 am
Forum: General
Topic: question on tunnel performance and getting past single core limits
Replies: 10
Views: 516

Re: question on tunnel performance and getting past single core limits

I suppose you could try the old /ip/packing, as that lets you set an aggregated size. It's old as dirt, but if "packing" smaller packets into a bigger one is the goal, worth a look/try:
https://help.mikrotik.com/docs/display/ROS/IP+packing
by Amm0
Wed Apr 17, 2024 11:10 pm
Forum: Scripting
Topic: Can't Query Graphql site
Replies: 6
Views: 190

Re: Can't Query Graphql site

I believe you need spaces between attributes and brackets in graphql. Might want to try something like this: http-data="{\"query\":\"query accountid { accounts(id:2) { entities { name }}}\"}" or since query is already in the JSON perhaps http-data="{\"query\&q...
by Amm0
Wed Apr 17, 2024 7:14 pm
Forum: Wireless Networking
Topic: Dante Audio over 60GHz
Replies: 7
Views: 570

Re: Dante Audio over 60GHz

Thanks @sirbryan. My knowledge of 60GHz is limited. I do know that it's jitter that kill you for Dante, so great data. The thing that seem limiting is there are not any MCS-like knobs to tweak – since I'm not sure negotiating a higher MCS is helpful for stability. e.g. Changing MCS has to introduce ...
by Amm0
Wed Apr 17, 2024 6:34 pm
Forum: Wireless Networking
Topic: Dante Audio over 60GHz
Replies: 7
Views: 570

Re: Dante Audio over 60GHz

Re UBNT vs MT.... I think it be more physics, than hardware since it's a standard protocol. Only note be that Mikrotik uses a bond on 60Ghz PtP products with 5Ghz backup... For Dante, 5Ghz be worthless as backup, so using bond would add a smidgen of latency that could be avoided. I'm pretty sure Dan...
by Amm0
Wed Apr 17, 2024 6:21 pm
Forum: General
Topic: Mutliple IP on same interface
Replies: 5
Views: 245

Re: Mutliple IP on same interface

Yeah in V6, pref-src is used for everything in routing. In V7, it's ONLY used for router initiated traffic. RouterOS V7's "FIB logic" when multiple IPs in same subnet... IDK for sure. I'm don't think it's documented what happens. I do know pref-src= on a router in V7 works for something li...
by Amm0
Wed Apr 17, 2024 5:12 pm
Forum: General
Topic: Mutliple IP on same interface
Replies: 5
Views: 245

Re: Mutliple IP on same interface

Assuming it's V7. The address used for "local out" traffic (e.g. telnet from router) should be shown a local-address in /ip/route/print... To set it for traffic originated from the router (e.g. /tool/fetch, /system/ssh, telnet out, etc.), then pref-src= can be used to control. If pref-src ...
by Amm0
Wed Apr 17, 2024 5:54 am
Forum: Wireless Networking
Topic: Dante Audio over 60GHz
Replies: 7
Views: 570

Re: Dante Audio over 60GHz

Couple questions: - Were you in AES67 mode? - Did the Dante controller have a specific error on the clock and/or see a lot of jitter in clock's graphs? One thought is by default 60GHz PtP Mikrotiks use a bond with 5Ghz. I'd remove the bond if it was being used, since failover to 5Ghz is not going to...
by Amm0
Wed Apr 17, 2024 1:58 am
Forum: Wireless Networking
Topic: wAP ax?
Replies: 25
Views: 7241

Re: wAP ax?

wAP ac is not discontinued
Perhaps, but it's "brother" with miniPCIe is marked as discontinued (https://mikrotik.com/product/wap_r_ac)
by Amm0
Wed Apr 17, 2024 1:47 am
Forum: Beginner Basics
Topic: Re-programming remote wAP LTE kit as wireless client
Replies: 2
Views: 231

Re: Re-programming remote wAP LTE kit as wireless client

Assuming you have not upgrade the wireless drivers...

There should be a QuickSet mode (in upper left) for "PTP Bridge CPE", you should be able to use that to connect to Starlink Wi-Fi's SSID and should bridge it to ether2 (and I think ether1).
by Amm0
Tue Apr 16, 2024 11:18 pm
Forum: General
Topic: /tool wol - target IP address?
Replies: 11
Views: 566

Re: /tool wol - target IP address?

Fair enough, it is even more confusing. I thought it's just UDP with different ether type. That it might not be UDP was a suprise. With NirSoft's WakeMeOnLAN tool, I can successfully wake-on-lan an MSI Cubi2 system on my LAN. A sniffer trace of what WOL packet gets generated with your tool when usin...
by Amm0
Tue Apr 16, 2024 6:22 pm
Forum: General
Topic: /tool wol - target IP address?
Replies: 11
Views: 566

Re: /tool wol - target IP address?

It may flow via L2 MAC, but it's still formatted as UDP packet AFAIK.

Could be wrong... but I think it's just specific IP address, instead of broadcast 255.255.255.255, in the UDP part of the packet.
by Amm0
Tue Apr 16, 2024 2:35 am
Forum: Announcements
Topic: WinBox v3.40 released!
Replies: 143
Views: 131014

Re: WinBox v3.40 released!

@normis any update on a native mac app for winbox?
Given we're at an icon flashing in task bar: https://youtu.be/sQPlwDSd5LM?t=184 — be a while.

No other proof of life... Like screenshot? Or, at least clue on framework/lang... Can we put rest it's Electron?
by Amm0
Tue Apr 16, 2024 1:15 am
Forum: General
Topic: /tool wol - target IP address?
Replies: 11
Views: 566

Re: /tool wol - target IP address?

Theoretically WOL could be on a BMC with an IP address, and the WOL turns out rest of system. It does not seem like a bad option to have, although perhaps confusing since IP isn't going to help in most cases. Kinda niche, but Mikrotik has the feature request category at help.mikrotik.com.
by Amm0
Mon Apr 15, 2024 6:18 pm
Forum: General
Topic: Is there a problem with IP Cloud? [SOLVED]
Replies: 70
Views: 23603

Re: Is there a problem with IP Cloud? [SOLVED]

Why on the forum?
They should have a services status on the main website.
Agree. Or perhaps some backup host someplace else for geo-redundancy. Not asking 5-nines here.
Well, they should have a status page. I'd suggest Dude and function to update the web site ;)
by Amm0
Mon Apr 15, 2024 2:33 am
Forum: Useful user articles
Topic: How to: Edge router and BNG optimization for ISPs Topic is solved
Replies: 68
Views: 90038

Re: How to: Edge router and BNG optimization for ISPs Topic is solved

Seriously?
LOL. I don't think @DarkNate was even trying to troll [here] – just a lucky guess. If so, you have some eggs from your pizza to throw at him.

Pineapples, like IPv6, aren't everywhere.
by Amm0
Mon Apr 15, 2024 2:10 am
Forum: General
Topic: Hotspot Configurations and on-prem Windows AD
Replies: 6
Views: 392

Re: Hotspot Configurations and on-prem Windows AD

First bet is DNS.
Good to hear.
It really is always DNS.
by Amm0
Mon Apr 15, 2024 1:00 am
Forum: General
Topic: Hotspot Configurations and on-prem Windows AD
Replies: 6
Views: 392

Re: Hotspot Configurations and on-prem Windows AD

Yeah realized after that DNS was already likely MS AD DNS. I suppose another way to skin that are is set the Mikrotik DNS to your AD's DNS? Since I do think hotspot is sending all DNS to Mikrotik regardless of what DNS IP is used. While you can have a firewall rule before that has a hotspot chain ru...
by Amm0
Sun Apr 14, 2024 4:43 pm
Forum: Beginner Basics
Topic: AT&T FTTH, VLANs, CapsMAN Full Config (RouterOS 7 Updated)
Replies: 27
Views: 5291

Re: AT&T FTTH, VLANs, CapsMAN Full Config (RouterOS 7 Updated)

Capacs take minutes to setup and dont change very often Most Wi-Fi APs have some central manager, so it's not unreasonable to want that on Mikrotik. It's the view of all APs in one place that's useful of CAPsMAN. Or if you want to make a change to SSID/password, etc. are all easier down the road to...
by Amm0
Sun Apr 14, 2024 4:35 pm
Forum: Beginner Basics
Topic: router to mail.hamilton.com
Replies: 9
Views: 414

Re: router to mail.hamilton.com

Config may help here, dunno. But ISP upstream may redirect NTP and/or DNS. Might want to try at the Terminal: :put [:resolve pool.ntp.org] I suspect that will get you the same 173.255.241.249. Be curious to see what DNS servers are getting used: /ip/dns print ; /ip/dns/cache print where data=173.255...
by Amm0
Sun Apr 14, 2024 7:00 am
Forum: General
Topic: MSS-clamp equivalent for udp?
Replies: 3
Views: 301

Re: MSS-clamp equivalent for udp?

Ok, thanks! I think I'm having larger MTU/MSS issues, as its not working, but I'll post a separate topic for that. Set EoIP to 1500 MTU. It will fragment but almost certainly needed since I doubt the HDHomeRun does PMTUD. Generally there 7 MPEG frames per RTP packet, so I'm guess it like needs 1400...
by Amm0
Sun Apr 14, 2024 5:44 am
Forum: RouterBOARD hardware
Topic: Outdoor Starlink
Replies: 13
Views: 1191

Re: Outdoor Starlink

Mikrotik has a pigtail part: https://mikrotik.com/product/acsmaufl

That get you SMA. Most Wi-Fi things RP-SMA. But AFAIK the wAPac is same as LTE ones with u.fl connectors on board for Wi-Fi.
by Amm0
Sun Apr 14, 2024 5:03 am
Forum: Beginner Basics
Topic: AT&T FTTH, VLANs, CapsMAN Full Config (RouterOS 7 Updated)
Replies: 27
Views: 5291

Re: AT&T FTTH, VLANs, CapsMAN Full Config

It was a serious pain in the ass and took a lot of hours. Good news is the EAP supplicant stuff just worked, no fiddling. Oh I'm sure. But the new drivers likely worth the effort. Used the wifiwave2 (now wifi-qcom-ac) on Audiences for long while, it was night-and-day difference. Welp... my RB4011 b...
by Amm0
Sun Apr 14, 2024 3:01 am
Forum: RouterBOARD hardware
Topic: Outdoor Starlink
Replies: 13
Views: 1191

Re: Outdoor Starlink

Are we talking about this one: https://mikrotik.com/product/wap_ac Yes. I mainly use the https://mikrotik.com/product/wap_r_ac which has miniPCIe slot, so I habitually add the "R". But the wAPac is identical, except no LTE modem. It's the plain "wAP R" you wouldn't want as that'...
by Amm0
Sun Apr 14, 2024 2:50 am
Forum: RouterBOARD hardware
Topic: Outdoor Starlink
Replies: 13
Views: 1191

Re: Outdoor Starlink

The wAPacR is a router, and is an AP by default. The newer wifi-qcom-ac drivers will get you Wave2 support on it. So you should not need the Starlink router - assuming the third-party Starlink+PoE to Ethernet adapter works. The Amazon links seem to do that so the ethernet that be usable can be the W...
by Amm0
Sat Apr 13, 2024 5:20 pm
Forum: General
Topic: USB LTE stick disappear
Replies: 15
Views: 844

Re: USB LTE stick disappear

Some older Huawei modem had issues with IPv6, but you've disabled it in both places, so I dunno.

I'd add lte,!packet,!raw as a topic /system/logging, reboot, and collect a supout.rif file & email that and what you've seen to support@mikrotik.com
by Amm0
Sat Apr 13, 2024 4:21 pm
Forum: General
Topic: USB LTE stick disappear
Replies: 15
Views: 844

Re: USB LTE stick disappear

Fair enough. More that if disabled under /ipv6, you have to change the APN under /interface/lte/apn so the ip-type=IPv4 as well.
by Amm0
Sat Apr 13, 2024 3:58 pm
Forum: General
Topic: USB LTE stick disappear
Replies: 15
Views: 844

Re: USB LTE stick disappear

One thing to try is setting just the "IPv4" option in the APN Profile, instead of "auto", as the "IP Type".
by Amm0
Sat Apr 13, 2024 6:40 am
Forum: General
Topic: Modify the DHCP client of an LTE interface
Replies: 9
Views: 418

Re: Modify the DHCP client of an LTE interface

The only difference is the "LTE way" is there is no scripting actions on it. But if you didn't have that need... I'm not sure what advantage to go through the trouble to "fool" routeros into creating an actual /ip/dhcp-client for an LTE interface? The APN Profile does mimic the o...
by Amm0
Sat Apr 13, 2024 1:49 am
Forum: General
Topic: Hotspot Configurations and on-prem Windows AD
Replies: 6
Views: 392

Re: Hotspot Configurations and on-prem Windows AD

I hear Active Directory. First bet is DNS. I suspect the hotspot clients are using Mikrotik DNS, which isn't going to the know the SRV/etc records needed for AD LDAP. You could confirm by setting a hotspot client's DNS to explicitly use Microsoft AD DNS servers. If that works, it's for sure DNS. Eve...
by Amm0
Fri Apr 12, 2024 9:34 pm
Forum: General
Topic: Modify the DHCP client of an LTE interface
Replies: 9
Views: 418

Re: Modify the DHCP client of an LTE interface

Fair enough. The double-NAT does offer a static config on Mikrotik side, so can see that's being a plus. And L2TP is a different story for the NAT'ed CGNAT going on, than say WG/etc. More note that, in most normal cases (not BGP+L2TP ;) ), likely better if modem operates in MBIM mode if possible in ...
by Amm0
Fri Apr 12, 2024 9:00 pm
Forum: General
Topic: Modify the DHCP client of an LTE interface
Replies: 9
Views: 418

Re: Modify the DHCP client of an LTE interface

V7 support MBIM modems. I'd imagine you'd be able use an AT command to switch it from the "NAT-mode" (Linux ECM driver) to MBIM modem. That get the CGNAT address on the router. If you google for your modem and MBIM (or if specs suggest Windows 8-11 support), I'd imagine there is some AT co...
by Amm0
Fri Apr 12, 2024 8:20 pm
Forum: General
Topic: Modify the DHCP client of an LTE interface
Replies: 9
Views: 418

Re: Modify the DHCP client of an LTE interface

In the LTE Profile, under /interface/lte/apn. /interface/lte/apn/set [find name=default] default-route-distance=2 use-peer-dns=no add-default-route=no Not sure if NTP over MBIM is even possible, but NTP not settable regardless. FWIW, If you're going to use routing tables, set a higher distance for L...
by Amm0
Fri Apr 12, 2024 6:53 pm
Forum: Beginner Basics
Topic: Mikrotik documentation
Replies: 10
Views: 626

Re: Mikrotik documentation

Fair enough. I hate Confluence, as user and admin many years ago. Have you ever looked at AsciiDoc (https://asciidoc.org)? It deals with all the TOC/etc stuff that markdown doesn't. OSS, no Java, and esoteric syntax seems more Mikrotik. Apple uses it for the their new PKL language, https://pkl-lang....
by Amm0
Fri Apr 12, 2024 6:35 pm
Forum: Beginner Basics
Topic: Mikrotik as a backup wireless link with Cisco
Replies: 11
Views: 455

Re: Mikrotik as a backup wireless link with Cisco

Thanks all, I've been playing about with GNS3 last night so might try see if I can lab it out before doing anything and having to get on the roof to reset it! FWIW. You shouldn't have to go to roof, assuming you know the user/password. All Mikrotik support winbox via Layer2, so can connect via MAC ...
by Amm0
Fri Apr 12, 2024 4:55 pm
Forum: Wireless Networking
Topic: Dante Audio over 60GHz
Replies: 7
Views: 570

Re: Dante Audio over 60GHz

I'd see this done once with some UBNT with some AVIO adapters. Venue suggested its work fine. While I believe them... the use case was not something like FOH to a stage where failure be disasterous. Theoretically, 60Ghz should work. You also do have Dante's latency setting to tweak to help. So there...
by Amm0
Fri Apr 12, 2024 12:11 am
Forum: General
Topic: Starlink Chateau LTE18 AX NO Internet
Replies: 7
Views: 594

Re: Starlink Chateau LTE18 AX NO Internet

Your right. I get confused on the Chateau, most are 16MB storage. And I kinda assumed @normis has some reason for his comments however ;)
by Amm0
Thu Apr 11, 2024 11:09 pm
Forum: General
Topic: Starlink Chateau LTE18 AX NO Internet
Replies: 7
Views: 594

Re: Starlink Chateau LTE18 AX NO Internet

@normis has a point: most of the cost on Chateau LTE18 is for the LTE modem. So if LTE is not needed, it's not a great choice. e.g. while starlink is within its routing abilities, it's not a powerful router. A hAPax3 is more powerful router, and has more internal storage, if no LTE is needed. Althou...
by Amm0
Thu Apr 11, 2024 8:02 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

My question is regarding the router! I have never turned it on and it does not prevent my access via iphone. Neither router nor smartphone apps care if disabled. But if do use the app... it quite visible since it kinda looks like there is no internet (e.g. it says "Internet: disabled" or ...
by Amm0
Thu Apr 11, 2024 7:24 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

Hey Ammo, I use an Iphone and have not used this functionality. How would it make the experience better??? Don't enable it using the mobile app is my #1 advice**. The "detect-interface-list" is the only important setting. That setting is where it does the detection. Since there is no poin...
by Amm0
Thu Apr 11, 2024 6:46 pm
Forum: Beginner Basics
Topic: Mikrotik as a backup wireless link with Cisco
Replies: 11
Views: 455

Re: Mikrotik as a backup wireless link with Cisco

Layer 2 vs Layer 3. /interface/vlan creates a Layer3 route on a VLAN. While the critical setting vlan-filtering=yes/no on the /interface/bridge is what essentially converts the software bridge from a.dumb switch and a VLAN-aware switch. The /interface/bridge/vlans is how you set hybrid/trunk/access ...
by Amm0
Thu Apr 11, 2024 6:42 pm
Forum: Beginner Basics
Topic: Mikrotik as a backup wireless link with Cisco
Replies: 11
Views: 455

Re: Mikrotik as a backup wireless link with Cisco

If the VLAN already defined on either end of the link. The 60Ghz LHG should just bridge anything passing over it with the default configuration. e.g. you don't need to set vlan-filtering=yes and define VLANs unless you want to restrict traffic going over the link. So if the Cisco's already have VLAN...
by Amm0
Thu Apr 11, 2024 5:57 pm
Forum: Beginner Basics
Topic: Mikrotik documentation
Replies: 10
Views: 626

Re: Mikrotik documentation

there are not so many new features during these revisions.
Think y'all selling yourselves short. ;) And docs themselves do get updated regularly.

Seems like a `cron` job...
by Amm0
Thu Apr 11, 2024 4:57 pm
Forum: Announcements
Topic: WinBox v3.40 released!
Replies: 143
Views: 131014

Re: WinBox v3.40 released!

Winbox, IMHO is the secret sauce, allowing non CLI trained folks to access and modify their configs and view all kinds of information. Agreed. If you BOTH CLI and winbox, or have potentially multiple users making updates, it is really well integrated. e.g. the "live update" of winbox dial...
by Amm0
Thu Apr 11, 2024 4:41 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

Finally a normal reaction to this :D Part of the detect-internet logic includes adding a dhcp-client. Given "Detect" is in name, it is odd it modifies config. And since adding a dhcp-client could effect routing...why folks have negative reaction. But the graph in mobile app is super usefu...
by Amm0
Thu Apr 11, 2024 3:44 pm
Forum: Announcements
Topic: WinBox v3.40 released!
Replies: 143
Views: 131014

Re: WinBox v3.40 released!

But, that is just a "winbox bug", that could be fixed with some additional code in winbox. After all, it knows which items you have changed. As someone who has noticed this behavior and already complained elsewhere: of course it is a bug IMHO. Mikrotik may see it differently. I think winb...
by Amm0
Thu Apr 11, 2024 7:23 am
Forum: Beginner Basics
Topic: KNOT - cant beck to default configuration
Replies: 3
Views: 313

Re: KNOT - cant beck to default configuration

You might just use netinstall to reset it to defaults. But it is critical you do not press reset button MORE than 10 seconds - it should be around 6-7 seconds from power on & normally some light goes from solid to flashing, at which point you release the reset button. While the button reset shou...
by Amm0
Thu Apr 11, 2024 6:45 am
Forum: Scripting
Topic: REST API - is it a bug? [SOLVED]
Replies: 9
Views: 623

Re: REST API - is it a bug? [SOLVED]

But at first I didn't see the detail as I was using Comfortclick's http driver to test it and it only said Internal server error... FWIW, if you use Postman to test request, I created a RAML/OpenAPI scheme that allows testing of the REST API. See https://forum.mikrotik.com/viewtopic.php?t=199476&am...
by Amm0
Thu Apr 11, 2024 6:40 am
Forum: Scripting
Topic: REST API - is it a bug? [SOLVED]
Replies: 9
Views: 623

Re: REST API - is it a bug? [SOLVED]

Your right it's not a server error so 5xx status code is wrong.

Although the specific permission that's missing be more helpful.
by Amm0
Thu Apr 11, 2024 5:45 am
Forum: General
Topic: RoMON - multiple secrets
Replies: 5
Views: 372

Re: RoMON - multiple secrets

i'll go through the wiki once again, then probably i'll ask support I've never used the interface-specific ones. But just re-read docs since I wrote from my memory and my usage ;). https://help.mikrotik.com/docs/pages/viewpage.action?pageId=8978569#RoMON-Secrets One of the rules is For each interfa...
by Amm0
Thu Apr 11, 2024 12:29 am
Forum: General
Topic: Image body email
Replies: 2
Views: 288

Re: Image body email

Short Answer is NO . It kinda up to the mail client to figure it out. For sure, the file extension has to match the file type (e.g. if it's a png, name should end in .png) But how Mikrotik generates the multipart MIME has some effects. Basically all attachments get added using the follow headers for...
by Amm0
Wed Apr 10, 2024 11:57 pm
Forum: General
Topic: RouterOS v7 best route selection problems
Replies: 8
Views: 627

Re: RouterOS v7 best route selection problems

The skimpy docs on select-rule has come up before: https://forum.mikrotik.com/viewtopic.php?t=206072&hilit=bgp+select It can't hurt to open a ticket at support@mikrotik.com about the poor docs on BGP's select-rule. I'm not sure what is not covered by the V7 BGP filter language e.g. what can only...
by Amm0
Wed Apr 10, 2024 11:23 pm
Forum: General
Topic: BTH basic question
Replies: 19
Views: 797

Re: BTH basic question

b. BTH configurations where the Peer (server for handshake) has a public IP and has no need to punch out to the proxy MT WG server. I'm not sure how BTH would interfere with other WG config. BTH with a "real" public IP would still use DDNS, but still does not "punch out" a ports...
by Amm0
Wed Apr 10, 2024 8:02 pm
Forum: General
Topic: BTH basic question
Replies: 19
Views: 797

Re: BTH basic question

Create a routing rule with Source of WAN2 IP address , and force all such traffic to table pointing to WAN2. OR, even sneakier, Dst-NAT traffic to wireguard port to WAN2, to-address=WAN1 This has come up a few times.... Maybe @normis/etc can comment on it somewhere. Although it's WG, not BTH specif...
by Amm0
Wed Apr 10, 2024 7:51 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

FWIW on this one: 1. I know recommendation. This is my decision for App Android. Yeah if you don't use mobile apps, the use of "detect-internet" is unclear. But if you do use the mobile apps...it front-and-center on the app & does enable a nice graph of WAN usage if enabled. And you've...
by Amm0
Wed Apr 10, 2024 7:37 pm
Forum: Announcements
Topic: WinBox v3.40 released!
Replies: 143
Views: 131014

Re: WinBox v3.40 released!

I would have expected some kind of API as that's more efficient (no need to parse command line) and less prone to breaking changes. All the config methods are abstractions over some internal config schema (see /console/inspect). So...I'm just not sure where efficiency comes in — once config change ...
by Amm0
Wed Apr 10, 2024 7:18 pm
Forum: Scripting
Topic: Saving file package version in a variable [SOLVED]
Replies: 5
Views: 321

Re: Saving file package version in a variable [SOLVED]

It's likely better thinking of the RouterOS CLI in terms of a REPL for a programming language, than ANY UNIX shell. It's thinking CLI is more like Linux/UNIX is where the trouble starts ;) FWIW, I'm not sure $() is newer than ``. The $() is more for variable assignment IMO, while backtick works anyw...
by Amm0
Wed Apr 10, 2024 6:57 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

Of course it should, you programmed the router to do so. Geez, there is no accountability in todays youth ;-) And this is why I always think ECMP and routing rules is often a better approach to load balancing. Even though ECMP is "less random" than PCC, changing the default firewall is fr...
by Amm0
Wed Apr 10, 2024 5:44 pm
Forum: Scripting
Topic: Saving file package version in a variable [SOLVED]
Replies: 5
Views: 321

Re: Saving file package version in a variable [SOLVED]

I didn't even think about the use (), i'm kind new to scripting, thanks for the hint!
If you know Linux/UNIX, the [] are similar to `` backtick to run a command and replace result in-place.
by Amm0
Wed Apr 10, 2024 5:36 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

The WAN has a dhcp-client enabled on it. And it goes through prerouting just like eveything else. So it gets marked per your mangle rules.
by Amm0
Wed Apr 10, 2024 4:46 pm
Forum: General
Topic: DHCP Request & PCC Balance
Replies: 14
Views: 599

Re: DHCP Request & PCC Balance

That's DHCP.
by Amm0
Wed Apr 10, 2024 3:50 pm
Forum: General
Topic: RouterOS v7 best route selection problems
Replies: 8
Views: 627

Re: RouterOS v7 best route selection problems

Distance is not the only factor. The scope and target-scope play a role & those are different in some of dynamic routes. See https://help.mikrotik.com/docs/display/ROS/IP+Routing#IPRouting-RouteSelection Routes with a scope greater than the maximum accepted value are not used for next-hop lookup...
by Amm0
Wed Apr 10, 2024 3:38 pm
Forum: General
Topic: RoMON - multiple secrets
Replies: 5
Views: 372

Re: RoMON - multiple secrets

I have a few central routers that use blank and a specific secret (still two entries) that seems to work. At some point, I forgot to set the secret on a group of routers (so it was blank), and I want to say having two secrets (one a blank) worked to get to that group (and then set a RoMON secret to ...
by Amm0
Wed Apr 10, 2024 3:27 pm
Forum: General
Topic: BTH basic question
Replies: 19
Views: 797

Re: BTH basic question

I prefer that users have compl;ete control over the process. It has also a "sharing" feature that the person with router password creates another peer. These additional "BTH users" (e.g. WG peers) can be managed by admin in winbox/CLI. But still more config wizard to create peer...
by Amm0
Wed Apr 10, 2024 3:09 pm
Forum: General
Topic: Mikrotik hAP ax³ adventures with Cable Modem Technicolor CGA4233vdf ( DOCSIS 3.1 coaxial cable) - Working
Replies: 4
Views: 533

Re: Mikrotik hAP ax³ adventures with Cable Modem Technicolor CGA4233vdf ( DOCSIS 3.1 coaxial cable) - Working

Clearly bridge mode is the right call in your case. And in most cases with DOCSIS. Re the TV set-top box, that was my only concern with bridging. I recall some provider in Spain (Movistar?) required some specific setup with multicast based on other posts. But TV box is working, that's good news.
by Amm0
Wed Apr 10, 2024 2:55 pm
Forum: Scripting
Topic: REST API - is it a bug? [SOLVED]
Replies: 9
Views: 623

Re: REST API - is it a bug? [SOLVED]

But what should the post data be? It gives me an error if its left empty but I didn't figure out the correct post data. I do not think it needs a parameters. But the content-type needs to be set to application/json. So the --json '' part does that. If using an older curl, it may not have the --json...
by Amm0
Wed Apr 10, 2024 8:24 am
Forum: General
Topic: RoMON - multiple secrets
Replies: 5
Views: 372

Re: RoMON - multiple secrets

AFAIK, the reason is if segments use a different RoMON secrets, it can use either. Say ether1 had router with "test1" and ether2 had router with "test2", on the central router with both test1 and test2 as secret it will be able to find them both. So I'm not sure why it doesn't wo...
by Amm0
Wed Apr 10, 2024 5:58 am
Forum: Containers
Topic: RouterOS container deletion issue
Replies: 3
Views: 371

Re: RouterOS container deletion issue

Try using root-dir= without the starting "/".

e.g. root-dir=usb1/docker/rootdir/aaa

For mounts, those should be okay, but the root-dir has always been pickier on the path. Or at least that's my guess.
by Amm0
Wed Apr 10, 2024 4:23 am
Forum: General
Topic: BTH basic question
Replies: 19
Views: 797

Re: BTH basic question

Basically a cloud server operated by Mikrotik, connects the two ends, so that they can punch out of a connection they have which is not public and reach other. Well the other benefit to BTH, even with static/public IPs, the Mikrotik BTH apps (for phone/desktop) automatically create the peers from t...
by Amm0
Tue Apr 09, 2024 6:43 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

this is what it gives me back [admin@MikroTik] > system script run test 13;255;89;0;3;94;66;0;0;36;104;78;41;232;3;2;229;254; y=66 x=0 temp=26 now the one that is confusing me is // Returns the measured fluid height (or air height), in mm // scanData - represents the array of raw bytes for the manu...
by Amm0
Tue Apr 09, 2024 3:40 am
Forum: Scripting
Topic: REST API - is it a bug? [SOLVED]
Replies: 9
Views: 623

Re: REST API - is it a bug?

To check for updates with rest, use POST instead of GET: USER='admin:admin' ROUTER=192.168.88.1 ; curl -k -u $USER -X POST https://$ROUTER/rest/system/package/update/check-for-updates --json '' or to actually download & install: USER='admin:admin' ROUTER=192.168.88.1 ; curl -k -u $USER -X POST h...
by Amm0
Mon Apr 08, 2024 7:03 pm
Forum: Beginner Basics
Topic: Can someone share a full working /29 config
Replies: 6
Views: 509

Re: Can someone share a full working /29 config

There is no firewall is main thing. See https://help.mikrotik.com/docs/display/ROS/Building+Your+First+Firewall but personally the default firewall is better than the docs: /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-...
by Amm0
Mon Apr 08, 2024 6:04 pm
Forum: Beginner Basics
Topic: Can someone share a full working /29 config
Replies: 6
Views: 509

Re: Can someone share a full working /29 config

/ip address add address=x.x.x.178/29 interface=bridge1 network=x.x.x.176 >>> do I add this??: add address=x.x.x.178 interface=sfp-sfpplus1 network=x.x.x.177 No. Leave the address as /29. But you need a route: /ip route add gateway=x.x.x.177 /interface bridge port add bridge=bridge1 interface=ether1...
by Amm0
Mon Apr 08, 2024 5:51 pm
Forum: General
Topic: BTH BUG Bleeding Into Regular Wireguard.
Replies: 13
Views: 671

Re: BTH BUG Bleeding Into Regular Wireguard.

Rplant. I am not using packet marking. I am using mark connections. Sure, but it's same issue. AFAIK I understand this, WG already picked before it enters any firewall services. WG will check routing rules in its decision on what to pick, and if none will use main. I just wish they'd have WG on the...
by Amm0
Mon Apr 08, 2024 5:35 pm
Forum: General
Topic: UTF-8 representation problem?
Replies: 7
Views: 473

Re: UTF-8 representation problem?

(Aside for @Amm0: Did you note the existence proof showing that ASCII is incomplete for encoding all English prose? 😜) Well, my №1 unicode needs are more 18th century — I use the em—dash & en–dash a lot. 😂😜 OP has a point, webfig likely should enforce the same rules. But I too don't expect unic...
by Amm0
Mon Apr 08, 2024 3:54 am
Forum: RouterBOARD hardware
Topic: Gigabit auto-negotiation over 2-pair cable
Replies: 12
Views: 966

Re: Gigabit auto-negotiation over 2-pair cable

I wonder if Mikrotik extender "GePR" at the remote end with small patch cord would help?
i.e. maybe it has higher sensitivity or/and it's negotiation works better than the remote devices chipset in this case.

IDK, just an idea.
by Amm0
Sun Apr 07, 2024 8:36 pm
Forum: Scripting
Topic: Script not working
Replies: 5
Views: 335

Re: Script not working

And changing things in different versions really does add even more complexity. That's why they reverted recently I suspect.
by Amm0
Sun Apr 07, 2024 8:16 pm
Forum: Scripting
Topic: Script not working
Replies: 5
Views: 335

Re: Script not working

Specifically, v7.13 and v7.14 have this changes:
*) console - replace reserved characters in file and script names with underscores;
So sanitize means remove spaces and special characters. The reverted this as a default in 7.15 beta.
by Amm0
Sun Apr 07, 2024 7:09 pm
Forum: Scripting
Topic: Script not working
Replies: 5
Views: 335

Re: Script not working

There were some recent builds that "sanitized" the file names. In latest 7.15beta9, it returns to the "old" behavior. *) console - added "sanitize-names" property under "/console/settings" menu (option for replacing reserved characters with underscores for fil...
by Amm0
Sun Apr 07, 2024 6:54 pm
Forum: General
Topic: BTH BUG Bleeding Into Regular Wireguard.
Replies: 13
Views: 671

Re: BTH BUG Bleeding Into Regular Wireguard.

FWIW, @rplant's policy routing rules is roughly the equivalent of the following mangles: /ip firewall mangle add action=mark-connection chain=input connection-state=new in-interface=WAN1 new-connection-mark=ISP1 add action=mark-connection chain=input connection-state=new in-interface=WAN2 new-connec...
by Amm0
Sun Apr 07, 2024 6:04 pm
Forum: General
Topic: hAP ax³
Replies: 13
Views: 768

Re: hAP ax³

FWIW, one thing that can happen on an hAPax3 is the antennas not being screwed on tight. That be another way make signal worse with ax3 vs ax2.
by Amm0
Sun Apr 07, 2024 5:39 pm
Forum: Useful user articles
Topic: mDNS between VLANs with just bridge filters - Look Mum, no containers!
Replies: 33
Views: 6071

Re: mDNS between VLANs with just bridge filters - Look Mum, no containers!

It also might be obscure as it is only visible in switch rules and nowhere else. But where it is good enough, its simple and fully HW based. That's a good point on this approach, you could do this in a switch rule for L2HW. Now the obscurity is more that requires understanding BOTH the bowels of mu...
by Amm0
Sun Apr 07, 2024 5:24 pm
Forum: General
Topic: UTF-8 representation problem?
Replies: 7
Views: 473

Re: UTF-8 representation problem?

I have now looked a little further and found out that the behaviour is totally different. In some input masks it is coded in others not. :( Oh, I totally agree it ain't consistent. e.g. Mikrotik for sure clarify this better. My point was more it's not really UTF-8 anywhere, other than at the edges ...
by Amm0
Sun Apr 07, 2024 5:32 am
Forum: Forwarding Protocols
Topic: BGP ECMP (multipathing)
Replies: 74
Views: 41710

Re: BGP ECMP (multipathing)

I take @mrz's comment to be that are NOT related other than if their changing BGP code, they want to do both at same time. e.g. I agree that for BGP to install ECMP routes, add path is not necessary , but since both ADD PATH and ECMP would need changes in best path selection code, those features sho...
by Amm0
Sun Apr 07, 2024 1:11 am
Forum: RouterOS beta
Topic: Not Kiev, it's Kyiv (Continuation of the question)
Replies: 9
Views: 3070

Re: Not Kiev, it's Kyiv (Continuation of the question)

V7 has periodic updates to the Linux TZ database used. V6 only gets security or other critical updates... But does seem it's "Kyiv" in 6.49.14 (which came out recently).
by Amm0
Sat Apr 06, 2024 10:45 pm
Forum: General
Topic: BTH BUG Bleeding Into Regular Wireguard.
Replies: 13
Views: 671

Re: BTH BUG Bleeding Into Regular Wireguard.

From RouterOS POV, at least logically, your correct mangle should work in the case. I just think it acts like generic Linux, thus needs routing rules. Certainly possible the BTH introduced some change in this logic. That's kinda the big question. If mangle worked before at some point in this case – ...
by Amm0
Sat Apr 06, 2024 10:03 pm
Forum: General
Topic: BTH BUG Bleeding Into Regular Wireguard.
Replies: 13
Views: 671

Re: BTH BUG Bleeding Into Regular Wireguard.

Both cases will use main. Mangle has no effect in either case is what I'm saying as WG in kernel already processed it. e.g. it not just keepalives that use only main.

Did this setup work in some older versions (e.g. before BTH)?
by Amm0
Sat Apr 06, 2024 9:40 pm
Forum: General
Topic: BTH BUG Bleeding Into Regular Wireguard.
Replies: 13
Views: 671

Re: BTH BUG Bleeding Into Regular Wireguard.

[...] Why do I think there is a BTH bug involved? Because no keep alive is set on this Peer ( server for handshake ) and thus WHY is the wireguard module contacting or using WAN1 despite our mangle? Why is it ACTIVELY trying to reach the wireguard peer ( client for handshake )? Why would you expect...
by Amm0
Sat Apr 06, 2024 7:26 pm
Forum: General
Topic: UTF-8 representation problem?
Replies: 7
Views: 473

Re: UTF-8 representation problem?

Mikrotik for sure clarify this better. AFAIK, in webfig, you're NOT allowed to use the full UTF-8 charset actually. e.g. while web page does use UTF-8 for unicode input — I think it's transformed into [pre-unicode] Windows 1252 codepage for storage when submitted & then on display in webfig back...
by Amm0
Sat Apr 06, 2024 5:08 am
Forum: Beginner Basics
Topic: Can someone share a full working /29 config
Replies: 6
Views: 509

Re: Can someone share a full working /29 config

You can create a new bridge and put Ether1-Ether4 in it. Assign x.x.x.178/29 as /ip/address the new bridge, and the desired static assign on servers. Assuming you have the default firewall/config, you need to add the new bridge interface to the "WAN" interface list (under Interfaces > List...
by Amm0
Sat Apr 06, 2024 3:56 am
Forum: General
Topic: Mikrotik hAP ax³ adventures with Cable Modem Technicolor CGA4233vdf ( DOCSIS 3.1 coaxial cable) - Working
Replies: 4
Views: 533

Re: Mikrotik hAP ax³ adventures with Cable Modem Technicolor CGA4233vdf ( DOCSIS 3.1 coaxial cable) - Working

Bridge mode to hAPax seem like the right call – essentially your turning it into just a cable modem. So while you'd lose Wi-Fi from the Technicolor, I'd imagine the AX from hAPax3 is going to be better than the Technicolor. And routing/NAT on hAPax3 certainly more flexible in this mode. In terms of ...
by Amm0
Sat Apr 06, 2024 12:05 am
Forum: Announcements
Topic: v7.14.2 [stable] is released!
Replies: 573
Views: 137050

Re: v7.14.2 [stable] is released!

Perhaps. It's going from extra attributes in logs — that use memory by default, not disk... to "Use CLI for configuration - keeps the Netinstall away." there is no logical support for. The config isn't some text file — how :export manifests defaults is controllable with options i.e terse o...
by Amm0
Fri Apr 05, 2024 10:33 pm
Forum: General
Topic: Wireguard and, I think, DNS
Replies: 13
Views: 642

Re: Wireguard and, I think, DNS

Perhaps. But TCP MSS adjust doesn't help UDP nor allow normal PMTUD to work.

But running a ping test with DF bits be right call – you'd know if it's an MTU issue.
by Amm0
Fri Apr 05, 2024 10:23 pm
Forum: Announcements
Topic: v7.14.2 [stable] is released!
Replies: 573
Views: 137050

Re: v7.14.2 [stable] is released!

Use CLI for configuration - keeps the Netinstall away.👈 That does not make sense. I'm not sure that's valid advice. It's does matter how you enabled stuff like graphing or dhcp leases or whatever-else needs might cleaning up.... There isn't some magic CLI to free these things once created, only net...
by Amm0
Fri Apr 05, 2024 7:16 pm
Forum: General
Topic: Wireguard and, I think, DNS
Replies: 13
Views: 642

Re: Wireguard and, I think, DNS

Slow network could also be an indication of a MTU/MSS issue. You dont seem to have any change-mss mangle rules? My advise would be to start with a ping and follow those packets to see if they follow the expected path both in FR as UK using torch/tcpdump. If a standard ping works, try to set the siz...
by Amm0
Fri Apr 05, 2024 6:59 pm
Forum: General
Topic: LTE Band priority
Replies: 3
Views: 245

Re: LTE Band priority

LTE speeds are variable... and modem selection is based on signal levels and modems reported CQI/etc. Different modems report different things and tower reacts differently as result. Don't mean sound coy... more that I'm not sure there is much you can do. Perhaps disabling 2G and 3G network modes mi...
by Amm0
Fri Apr 05, 2024 6:49 pm
Forum: General
Topic: VRRP access network also from slave?
Replies: 6
Views: 565

Re: VRRP access network also from slave?

Well, the VRRP part looks right to me. I wouldn't mess with proxy-arp, that shouldn't be needed. Perhaps add the VRRP interface to the LAN interface-list? And/or check your firewall isn't block something. Also, what's exactly happening and not working (e.g. is one VRRP working, in that one one is a ...
by Amm0
Fri Apr 05, 2024 6:38 pm
Forum: RouterBOARD hardware
Topic: Outdoor 5G?
Replies: 13
Views: 1284

Re: Outdoor 5G?

Building your own 5G modem isn't that expensive or challenging. Perhaps. Everything is relative. We've done that for years starting with RB953 before LTE... you'd do have to ignore the time costs, especially for a one-off. And Mikrotik RouterBoard series has languished (e.g. marginal CPUs for true ...
by Amm0
Fri Apr 05, 2024 5:36 pm
Forum: General
Topic: LTE Band priority
Replies: 3
Views: 245

Re: LTE Band priority

On the R11e-LTE, that's how it works AFAIK. e.g. it's essentially of filter on allowed bands. Have you tried without ANY band filters? There is a lot of subtleties in how a band is selected out of your control (e.g. at the end of day, the tower/carrier is in charge what happens)
by Amm0
Fri Apr 05, 2024 5:39 am
Forum: RouterBOARD hardware
Topic: Outdoor Starlink
Replies: 13
Views: 1191

Re: Outdoor Starlink

There is also the new L11ug board, https://mikrotik.com/product/l11ug_5haxd - although the power 12-28V is more limited & only 5Ghz but AX. The wAPacR internal antennas are connected with 2 x U.FL (not MMCX) so you use come pigtails to something else. The 2.4Ghz & 5Ghz are combined. It's a o...
by Amm0
Fri Apr 05, 2024 3:17 am
Forum: General
Topic: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]
Replies: 34
Views: 1439

Re: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]

another example of the eternal crusade of the evangelists of Zerotier, acting like there is no other VPN type in the world the hype for something new in a race to deprecate anything previously existent That's a bit unfair. But these "protocol wars" are silly. e.g. JUST a reminder that wit...
by Amm0
Thu Apr 04, 2024 9:30 pm
Forum: General
Topic: Interface List Nesting Limit?
Replies: 1
Views: 155

Re: Interface List Nesting Limit?

In your snippet, there is no plain "WAN" interface list, e.g.
/interface/list add name=WAN include="WAN ISP1","WAN ISP2","WAN ISP3"
by Amm0
Thu Apr 04, 2024 8:11 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

And if you store the results of print an a variables – by using an "as-value" at end to cause print to return an array – you use a :foreach to get the ->data and then call the hex2ints function shown above to get them as indexed array of bytes. An index array makes "porting" the ...
by Amm0
Thu Apr 04, 2024 7:58 pm
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

Okay, well good news is you're getting the data from the advertisements. And the "hexstring" is 36, so as bytes it's 18 - which matches the C code. :put [:len [:convert from=hex to=raw "0dff5900035e42000024684e29e80302e5fe"]] 18 [admin@MikroTik] > /iot bluetooth decode-ad data=0d...
by Amm0
Thu Apr 04, 2024 5:07 pm
Forum: General
Topic: VRRP Stuck in Master in both devices
Replies: 8
Views: 516

Re: VRRP Stuck in Master in both devices

Don't know if case here... But that can happen if preemption-mode=no. e.g. backup starts up before the master, priority won't matter when preemption-mode=no if backup is running. See docs: preemption-mode Whether the master node always has the priority. When set to 'no' the backup node will not be e...
by Amm0
Thu Apr 04, 2024 4:06 am
Forum: General
Topic: 8.8.8.8 suddenly blocked by my firewall???
Replies: 4
Views: 389

Re: 8.8.8.8 suddenly blocked by my firewall???

From the log it does not look like it's getting NAT'ed.
by Amm0
Thu Apr 04, 2024 1:02 am
Forum: The Dude
Topic: Mouse over devices
Replies: 2
Views: 949

Re: Mouse over devices

I'm not sure you can. Or I don't know how at least.

You can change the REST of the "tooltip" contents in server's "settings", "map" tab. But... the graph of services is just there even without any tooltip defined.
by Amm0
Thu Apr 04, 2024 12:46 am
Forum: General
Topic: VRRP Stuck in Master in both devices
Replies: 8
Views: 516

Re: VRRP Stuck in Master in both devices

It could be version specific. There have been bugs in VRRP in a few releases. You'd have to look at the release notes for "vrrp -". But more with sync-connection-tracking=yes - why I suggest you don't use that unless you really understand how suppose to works. Also, perhaps a cut-and-paste...
by Amm0
Wed Apr 03, 2024 10:59 pm
Forum: General
Topic: Emojis
Replies: 3
Views: 256

Re: Emojis

No emojis. There is no UNICODE support at all (e.g. UTF-8 or UTF-16). RouterOS, essentially, uses single-byte code pages, specifically CP-1252. See https://en.wikipedia.org/wiki/Windows-1252 for your options, mostly latin-based accents/etc. e.g. following add "€×××" as comment to ether1: /...
by Amm0
Wed Apr 03, 2024 7:58 pm
Forum: Beginner Basics
Topic: Need help setting up my RBSXTR-LTE.
Replies: 7
Views: 645

Re: Need help setting up my RBSXTR-LTE.

Good news. I think this went south when you did the netinstall. I suspect it did work orginally and did NOT need netinstall, but if new and not familiar with using MAC address in winbox to connect... it can look like things don't work and need a netinstall.... If you haven't already upgrade the mode...
by Amm0
Wed Apr 03, 2024 7:13 pm
Forum: General
Topic: How to do Inter-VLAN Bridging with MikroTik? [SOLVED]
Replies: 15
Views: 819

Re: How to do Inter-VLAN Bridging with MikroTik? [SOLVED]

Nothing stops your inter-vlan bridging configuration, per se, but you make a mess of STP that needs to be managed (e.g configuring MSTP, or disabling STP everywhere). But certainly the doc aren't going to recommend bridging VLAN together because of all the side-effects. Doesn't mean you cannot do it...
by Amm0
Wed Apr 03, 2024 6:22 pm
Forum: General
Topic: VRRP Stuck in Master in both devices
Replies: 8
Views: 516

Re: VRRP Stuck in Master in both devices

Try it without sync-connection-tracking to confirm it works first. e.g. sync-connection-tracking=no

I'm not seeing where you're specifying the remote address to sync with either. Note that sync-connection tracking will only work if the WAN IP is also same on both routers.
by Amm0
Wed Apr 03, 2024 6:07 pm
Forum: RouterBOARD hardware
Topic: Outdoor 5G?
Replies: 13
Views: 1284

Re: Outdoor 5G?

Not very interested in going off Mikrotik though. Kinda figured. Why a bosun chair and a 2024 wAP-LTE or wAPac-LTE6 seems dirt simple and cheap - let this 5G stuff sort itself out. The ethernet down mast and PoE/DC tie-in be same regardless of 5G, so easy to swap later if more speed was needed. You...
by Amm0
Wed Apr 03, 2024 5:12 pm
Forum: General
Topic: VRRP access network also from slave?
Replies: 6
Views: 565

Re: VRRP access network also from slave?

Your VRRP addresses need to be /32. Preemption mode will cause a router to return to master once it's back online (still based on priority). LAN connections will drop when VRRP flips since you have two routes to internet. Client connections should get reestablished but VRRP failover will be noticeab...
by Amm0
Wed Apr 03, 2024 5:04 pm
Forum: Forwarding Protocols
Topic: Hikvision DVR port forward 1 local and 1 main router.
Replies: 1
Views: 125

Re: Hikvision DVR port forward 1 local and 1 main router.

Your diagram didn't make it here.

One quick option is to enable uPnP on the router and NVR. That should open the need ports. Since uPnP will generate dynamic firewall NAT rules, you can use those as examples to create your own [static] rules & disable uPnP later.
by Amm0
Wed Apr 03, 2024 5:44 am
Forum: Beginner Basics
Topic: Need help setting up my RBSXTR-LTE.
Replies: 7
Views: 645

Re: Need help setting up my RBSXTR-LTE.

Normally the defaults leave you a decent place. But that config ain't going to work and it's multiple things. But even in this state LTE should still come up IF it carrier supports a "network apn" — problem is not all carrier support this. At the same Terminal, you might try doing a: /syst...
by Amm0
Wed Apr 03, 2024 4:47 am
Forum: General
Topic: VRRP sharing VRRP-ID [SOLVED]
Replies: 4
Views: 663

Re: VRRP sharing VRRP-ID [SOLVED]

LOL, I was going to mention the more limited IDs. I use scripts for config, so keep VLAN ID under 256 was helpful for subnetting/naming too (e.g. VLAN 100 = vlan100/vrrp100/dhcp100/pool100 = 10.100.0.0/192.168.100.0) so VRRP just follows same scheme. I'm pretty sure all being vrrp-id=1 on separate V...
by Amm0
Wed Apr 03, 2024 3:45 am
Forum: General
Topic: VRRP sharing VRRP-ID [SOLVED]
Replies: 4
Views: 663

Re: VRRP sharing VRRP-ID [SOLVED]

VRRP is scoped to each subnet/VLAN it's attached. So the vrrp-id are not going to "overlap" across VLANs since each has their own broadcast scope. AFAIK RouterOS does not use the VRRP ID, other than in what's send out via VRRP. But setting VRRP ID to match the VLAN ID it's listening on I t...
by Amm0
Wed Apr 03, 2024 1:53 am
Forum: Beginner Basics
Topic: DHCP Server - DNS blank or router IP [SOLVED]
Replies: 8
Views: 463

Re: DHCP Server - DNS blank or router IP [SOLVED]

Still remains the question whether it brings any advantage to have any DNS server on the DHCP's DNS list other than the DHCP server's IP address. The secondary DNS brings only an advantage in the case if the first DNS - the router itself - doesn't reply. FWIW DNS clients are free to use any DNS ser...
by Amm0
Tue Apr 02, 2024 10:48 pm
Forum: Beginner Basics
Topic: DHCP Server - DNS blank or router IP [SOLVED]
Replies: 8
Views: 463

Re: DHCP Server - DNS blank or router IP [SOLVED]

Yeah if you enable "Allow Remote Connections" in /ip/dns, that will add the Mikrotik router as DNS. If that's disabled, it be only the dynamic DNS (or any static DNS servers set).
by Amm0
Tue Apr 02, 2024 9:16 pm
Forum: General
Topic: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]
Replies: 34
Views: 1439

Re: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]

All these point are fair. But the diagram here shows 4 routers. In total, it's ~5-10 lines of config per router for "pure" WG... That seems manageable & I'd listen to @anav on config. It's when these change a lot or you have dozens of routers, then something outside of Mikrotik is ofte...
by Amm0
Tue Apr 02, 2024 8:06 pm
Forum: Beginner Basics
Topic: How to configure LAN IP Pool
Replies: 15
Views: 4489

Re: How to configure LAN IP Pool

Perhaps the better question is do the public IPs need to go through the firewall (option 2 or 3)? Or, do you want the computer with public IPs to be directly on the internet without the Mikrotik firewall (option 1). @qadir52786, I recommend you open a new topic with a diagram, description, and/or an...
by Amm0
Tue Apr 02, 2024 7:51 pm
Forum: Beginner Basics
Topic: DHCP Server - DNS blank or router IP [SOLVED]
Replies: 8
Views: 463

Re: DHCP Server - DNS blank or router IP [SOLVED]

Kinda a preference thing IMO. Leaving /ip/dhcp-server/network's DNS blank is means "inherit" the /ip/dns ones. This allows default config to work... but often being explicit in config is more clear. The central question is whether you want Mikrotik to do DNS caching? If you do, you need to...
by Amm0
Tue Apr 02, 2024 6:10 pm
Forum: General
Topic: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]
Replies: 34
Views: 1439

Re: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]

ZeroTier is easier to setup, but even if idle it ZeroTier does use more bandwidth than WG. In - my - opinion , WireGuard is far easier to setup and far more efficent to run when KISS is applied .... but if you are a Rocket Scientist then ZeroTier is your cup of Tea. :) It's kinda "pick your po...
by Amm0
Tue Apr 02, 2024 3:40 pm
Forum: General
Topic: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]
Replies: 34
Views: 1439

Re: Connectivity to customers mikrotiks via Wireguard. Good idea? [SOLVED]

ZeroTier is easier to setup, but even if idle it ZeroTier does use more bandwidth than WG. Plus as more routers are connect to same ZT network, even more bandwidth is used to maintain the bridge/paths. And the ZeroTier builtin to Mikrotik does not support ZeroTier "low bandwidth mode". If ...
by Amm0
Tue Apr 02, 2024 3:25 pm
Forum: RouterBOARD hardware
Topic: Outdoor 5G?
Replies: 13
Views: 1284

Re: Outdoor 5G?

Well costs is linear largely modem's "category", typically the number after the LTE on Mikrotik's. e.g. The Chateau 5G is $530 retail, Chateau LTE12 is $229, and the LTE6 one is $149. Only major difference is the modem. Now the Chateau LTE18ax uses better CPU and better Wi-Fi at $299 ( LTE...
by Amm0
Tue Apr 02, 2024 8:47 am
Forum: Beginner Basics
Topic: MacOS Winbox issues
Replies: 2
Views: 300

Re: MacOS Winbox issues

It does like switching from a dongle to wi-fi is sometimes flaky. What's odd is wine does deal with multiple interfaces, since I use ZeroTier with wine+winbox+Mac which does show all the discovery with either Wi-Fi or ethernet. Have you tried disabling Wi-Fi when using the Ethernet dongle? And/or re...
by Amm0
Tue Apr 02, 2024 5:30 am
Forum: General
Topic: Multiple WAN - The Third WAN on sfp3
Replies: 22
Views: 864

Re: Multiple WAN - The Third WAN on sfp3

Is everything else working... and the ONLY issue why QuickSet is showing wrong LAN? Yes, the only issue puzzles me would be how come when i added WAN IP : 61.219.84.105 (interface sfp3) into address list, Quickset Local Network would jump right away from 192.168.88.1 (default LAN IP) to 61.219.84.1...
by Amm0
Mon Apr 01, 2024 10:25 pm
Forum: Scripting
Topic: Problem with :pick [SOLVED]
Replies: 4
Views: 309

Re: Problem with :pick [SOLVED]

Figured it was the array.

Anything in winbox with the <> up/down arrows next the control is generally an array in scripting. Some commands will "cast" an array of one element to str/num, but :find doesn't... So it's a bit confusing.
by Amm0
Mon Apr 01, 2024 9:52 pm
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

@anav, did you lose fast-path with IPIP? On the TILE or one of ARM things? READER NOTE: - RoMON needs EoIP to function at Layer 2 — IPIP (at layer 3) will not work for RoMON. @anav is experimenting with IPIP as a "poor-mans WireGuard" for a Layer3 VPN between two Mikrotiks. - All EoIP, GRE...
by Amm0
Mon Apr 01, 2024 9:49 pm
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

Hi Ammo, I was able to establish an IPIP with ipsec secret with one fixed WANIP and one dynamic Wanip ( and gain access to config via winbox ). Dont have any cgnat to test however. The DDNS trick here makes the dynamic WAN IP possible, irrespective of a CGNAT. The nice thing about either EoIP or IP...
by Amm0
Mon Apr 01, 2024 7:52 pm
Forum: General
Topic: Backup to LTE without guest internet access
Replies: 10
Views: 422

Re: Backup to LTE without guest internet access

That looks like the Mikrotik Hotspot rules. So assuming non-guests using a normal SSID, you might be able to use the hotspot= match in a filter rule. I can not test it but something like: /ip/firewall/filter/add hotspot=auth chain=output out-interface=lte1 action=drop /ip/firewall/filter/add hotspot...
by Amm0
Mon Apr 01, 2024 7:28 pm
Forum: General
Topic: Appropriate router for 2G internet routing
Replies: 11
Views: 744

Re: Appropriate router for 2G internet routing

A download (incoming) queue isn't as not as useful IMO. I'd keep the upload (outbound) queues. I presume you're using TCP-based speediest, what happens when your run a speedtest/btest/iperf for 60 seconds. I do suspect you'd see higher speeds even with a download queue when a longer test than someth...
by Amm0
Mon Apr 01, 2024 7:22 pm
Forum: General
Topic: Backup to LTE without guest internet access
Replies: 10
Views: 422

Re: Backup to LTE without guest internet access

About filtering out the guests network, I also suppose netwatch can be a very easy solution, if I can understand how could I ping with a specific source IP (WAN1 and not LTE), is that possible? Then I've just to turn off the public bridge. I'm not using VLAN for it, I'm using a provider which autho...
by Amm0
Mon Apr 01, 2024 6:25 pm
Forum: General
Topic: Appropriate router for 2G internet routing
Replies: 11
Views: 744

Re: Appropriate router for 2G internet routing

It's probably due to the extra processing required for queues. I've read that CAKE is very CPU-intensive? Yeah the queue type might affect things. I'd think fq-codel might be better starting choice. Is the queue dropping anything that might cause less bandwidth? Are you using a queue tree or simple...
by Amm0
Mon Apr 01, 2024 5:27 pm
Forum: Beginner Basics
Topic: How to configure LAN IP Pool
Replies: 15
Views: 4489

Re: How to configure LAN IP Pool

Few options: 1. put the /29 WAN on bridge, either a new one or as a tagged VLAN on existing one, then connect assign bridge ports to use the ISP bridge/VLAN - e.g. switching 2. assign all the IP to the router, and then use a NAT rule for action=netmap between a LAN IP and desired public IP - e.g. on...
by Amm0
Mon Apr 01, 2024 5:13 pm
Forum: General
Topic: Backup to LTE without guest internet access
Replies: 10
Views: 422

Re: Backup to LTE without guest internet access

Is the guest network a VLAN? If VLAN, one way is using routing table with only main WAN and use a lookup-only-in rule (/routing/rule) based on the guest VLAN subnet to select a main-only route table (/routing/table). If not, you can create a /ip/firewall filter rule to create drop rule based on the ...
by Amm0
Mon Apr 01, 2024 3:11 pm
Forum: Wireless Networking
Topic: Point to point link, Audience, wifi (wifiwave2)
Replies: 3
Views: 290

Re: Point to point link, Audience, wifi (wifiwave2)

I did some experiments a while back, kinda came to same conclusion. It's funky, but actually works. Old CAPsMAN used DLTS tunnels to the controller, so tunneling traffic over Wi-Fi isn't exactly that funky. If familiar/using with MPLS elsewhere, all links being the same has some advantage. Theoretic...
by Amm0
Mon Apr 01, 2024 2:58 pm
Forum: General
Topic: Multiple WAN - The Third WAN on sfp3
Replies: 22
Views: 864

Re: Multiple WAN - The Third WAN on sfp3

QuickSet being wrong is NOT going to effect the rest of the config's operation.

Is everything else working... and the ONLY issue why QuickSet is showing wrong LAN?
by Amm0
Mon Apr 01, 2024 2:51 pm
Forum: Scripting
Topic: Problem with :pick [SOLVED]
Replies: 4
Views: 309

Re: Problem with :pick [SOLVED]

Couple other things too: - The first line use "get 1", however that's not an *id so it depends on print being called to establish the index of 1. Using "get ([find]->0)" or "get [find name=queue1]" instead avoid needing. - There can be multiple "target" from &...
by Amm0
Mon Apr 01, 2024 6:07 am
Forum: General
Topic: Multiple WAN - The Third WAN on sfp3
Replies: 22
Views: 864

Re: Multiple WAN - The Third WAN on sfp3

quickset=quicksand :-) I am wondering would it be possible that Quickset has recognized something wrong? QuickSet might need the comment "defconf" on the bridge for it show the right LAN. Since I use QuickSet as a status page... I know it uses either the name or comment "defconf"...
by Amm0
Mon Apr 01, 2024 1:47 am
Forum: General
Topic: ROMON via vpn
Replies: 41
Views: 4375

Re: ROMON via vpn

What if you wanted to do EoIP on top of wireguard and add RoMON?
Ask and answered below ;). So EoIP + WG with RoMON is discussed here:
viewtopic.php?t=203137&hilit=romon+wg#p1046880
by Amm0
Mon Apr 01, 2024 1:21 am
Forum: General
Topic: ROMON via vpn
Replies: 41
Views: 4375

Re: ROMON via vpn

The above rule is needed for ZeroTier + RoMON.

But I recently wrote up steps for EoIP + IPSec with RoMON here – since not all routers support ZeroTier: viewtopic.php?t=206322
by Amm0
Mon Apr 01, 2024 1:16 am
Forum: General
Topic: ROMON via vpn
Replies: 41
Views: 4375

Re: ROMON via vpn

For ZeroTier with RoMON , you need to modify the flow rules to allow it on at my.zerotier.com. RoMON uses a non-standard ether-type at Layer 2, so this needs to be allowed in the "Flow Rules" for the ZT network. Specifically adding the following at very TOP of the rules (before the drop ru...
by Amm0
Sun Mar 31, 2024 10:52 pm
Forum: General
Topic: Multiple WAN - The Third WAN on sfp3
Replies: 22
Views: 864

Re: Multiple WAN - The Third WAN on sfp3

You should not be using QuickSet if you have multiple WAN. The reason QuickSet show the wrong LAN IPs, is that it's looking for the IP of an interface named "bridge". Since you renamed that, it's just guessing the first interface is the LAN. But this is only an issue if you click OK in Qui...
by Amm0
Sun Mar 31, 2024 7:02 pm
Forum: General
Topic: Can't access Mikrotik website from china
Replies: 12
Views: 726

Re: Can't access Mikrotik website from china

It was kinda rude. You've posted before. And easy to imagine there be problems connecting from China.

I think it more that no one here can help, you should email Mikrotik with output of traceroutes in case it is something on their side.
by Amm0
Sun Mar 31, 2024 6:17 pm
Forum: General
Topic: Can't access Mikrotik website from china
Replies: 12
Views: 726

Re: Can't access Mikrotik website from china

Dont feed the trolls.
It is possible China changed its policy recently. AFAIK, Mikrotik uses the same subnet for BTH as everything else.
by Amm0
Sun Mar 31, 2024 6:07 pm
Forum: General
Topic: Can't access Mikrotik website from china
Replies: 12
Views: 726

Re: Can't access Mikrotik website from china

I think that the question is: Does China blocked Mikrotik's site?
I think so, but ping is OK, http and https can’t be accessed.
But this forum works?

But I'm not sure it's on the Mikrotik side. Other than the Back-to-Home feature might have caused scrutiny.
by Amm0
Sun Mar 31, 2024 5:30 pm
Forum: General
Topic: Can't access Mikrotik website from china
Replies: 12
Views: 726

Re: Can't access Mikrotik website from china

Is it just license.mikrotik.com or does www.mikrotik.com also not work?

If you need to renew/buy a license, and it's not working, you might want to email support@mikrotik.com
by Amm0
Sun Mar 31, 2024 1:41 am
Forum: Scripting
Topic: Convert C sample to KNOT script
Replies: 15
Views: 1095

Re: Convert C sample to KNOT script

Good day i am needing some help I have a bluetooth sensor that i have connected and whitelisted it to a MikroTik KNOT LR8 router Most of that is portable to RouterOS script. The tricker part is the floats. So are you getting data from if you check "/iot bluetooth scanners advertisements print&...
by Amm0
Sun Mar 31, 2024 1:02 am
Forum: Scripting
Topic: Future for posibility of moidular setings
Replies: 1
Views: 170

Re: Future for posibility of moidular setings

Best you can do is use comments today. Those comments could be UUIDs if you wanted, but nothing automatic. Another technique is using functions that do wrap the ":if ([find name=ether1] do={ set name=MyName } else={ add name=MyName }" kinda logic, this can reduce the script size, but not t...
by Amm0
Sun Mar 31, 2024 12:44 am
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

FWIW, I call it "'two passes' through the firewall" ..... but it really just transitions from a physical interface to a logical interface (via the DECAPSULATE? and ENCAPSULATE? boxes) in the Packet Flow diagrams : https://help.mikrotik.com/docs/download/attachments/328227/PacketFlowDiagram...
by Amm0
Sun Mar 31, 2024 12:28 am
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

yes, but in your example the input chain rule (traffic from the other public IP), limits by protocol GRE.......... You can try "protocol=ip-encap" as matcher instead of GRE. I'm not 100% sure that "IPIP" since docs don't say what it is. But worth a try as IPIP is encapsulated IP...
by Amm0
Sun Mar 31, 2024 12:15 am
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

Now what about on the main server MT device with public IP what do I put on its input chain so that the tunnel can be established. anything ???? You need the address-list with remote end's IP address via DDNS to be allowed in filter. See Step 3. The DDNS of remote will be the public IP detected fro...
by Amm0
Sat Mar 30, 2024 11:50 pm
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

Also one can go into the default ipsec config and improve the security settings, for example would change the DEFAULT PROFILE SETTINGS TO a. HASH proposal (from SHA1) to SHA256 Tip: The IPSec proposals do have match on BOTH sides. If they don't, you'll see errors in log. Why I know? I'd forgot one ...
by Amm0
Sat Mar 30, 2024 11:42 pm
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Re: Experiments with EoIP+IPSec & Restricted NATs for RoMON/etc

Not sound like you, but what's use case for IPIP? It won't work for RoMON. RoMON uses a different Layer2 ether-type, so it's not even IP – which kinda why it safe since it's impossible to go via the internet without GRE (or Layer2 VPN like ZeroTier). That is if you trust all the routers connected to...
by Amm0
Sat Mar 30, 2024 11:11 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

AMMO, can you test with IPIP instead or at least tell me how to do so beyond the standard settings. aka. for client site with no static public IP --> what do I put for local address?>> aka. for server site with public IP --> what do I put for remote address?? What additional firewall rules are requ...
by Amm0
Sat Mar 30, 2024 11:10 pm
Forum: General
Topic: Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...
Replies: 12
Views: 592

Experiments with EoIP+IPSec and DDNS/CGNATs for RoMON...

Another thread that evolved into using EoIP+IPSec with RoMON to enable out-of-band management across a secure WAN. @anav asked Id be interested in your only one side needs public IP teaser. Please elaborate!!! and I tried but got: Y:ou have to be more clear than that sir, I have no idea what you me...
by Amm0
Sat Mar 30, 2024 8:18 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

It's actually IPSec, not GRE, that need to be allowed through Ubiquiti UDM-Pro to get to the "hidden hEX" #355. Only the MikroTik Routers be able to see the GRE, since the tunnel is encrypted to even the Ubiquiti UDM-Pro.... Possible the Ubiquiti UDM is accepting, rather than forwarding, t...
by Amm0
Sat Mar 30, 2024 7:08 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

Id be interested in your only one side needs public IP teaser. Please elaborate!!! Just tested with Fiber+Static to LTE+CGNAT with EoIP+IPSec: It works. But still need use the CGNAT'ed remote address on the "static IP" side. But you can use the DDNS name of the CGNAT side in EoIP config (...
by Amm0
Sat Mar 30, 2024 6:51 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

Id be interested in your only one side needs public IP teaser. Please elaborate!!! Here was the post: https://forum.mikrotik.com/viewtopic.php?t=203951&hilit=eoip+nat#p1053229 It suggests when EoIP with an "IPSec Secret" set, that Mikrotik does enable nat-traversal=yes under /ip/ipsec...
by Amm0
Sat Mar 30, 2024 6:45 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

Note that when I added an ipsec key, I was forced to turn off "Allow Fast Path"
Which is okay, you're really just using it for management. But all encryption has to flow through the CPU anyway.
by Amm0
Sat Mar 30, 2024 6:10 pm
Forum: Scripting
Topic: Built in function library
Replies: 142
Views: 137567

Re: Built in function library

I'd love $0 to return the script name. It's this case where $0 being the containing array from a function be useful, :jobname does NOT help here: But in essense you are correct the functions are stored as items in an array. The basic design is to attempts to mimic objects and having the ability to ...
by Amm0
Sat Mar 30, 2024 5:29 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

Dont forget to tick the ipsec security otherwise you are creating an open hole at both ends..... True. It's actually setting the "IPSec Secret" that enables in V7 – I'm remembering V6 I think with checkbox. Someone suggested that EoIP with IPSec enabled, only one side needs to have a publ...
by Amm0
Sat Mar 30, 2024 5:20 pm
Forum: General
Topic: Watchdog, or alternative?
Replies: 8
Views: 452

Re: Watchdog, or alternative?

So, with (for example), a ping-start-after-boot of 10m and a ping-timeout of 2m, the system will wait 10m after a boot, then start pinging the watch-address. If after 6 attempts in 2 minutes the watch-address does not respond to the ping, the system reboots. Correct? Yup. My situation does not use ...
by Amm0
Sat Mar 30, 2024 4:17 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

I like the idea of EoIP because of the advantages of layer 2 connectivity to all devices, but I am concerned about traffic or taxing the MT devices with firewall rules. The idea is EoIP just carries RoMON protocol. If EoIP is NOT bridge to anything, and each end has a unique IP address in same subn...
by Amm0
Sat Mar 30, 2024 4:06 pm
Forum: General
Topic: Watchdog, or alternative?
Replies: 8
Views: 452

Re: Watchdog, or alternative?

Fair point @anav. More LTE can be finicky for a variety of reasons. And watchdog will capture the logs in supout.rif – kinda ready for a support case since LTE should recover after a hard powerfail. I kinda view watchdog as something that really shouldn't happen. But with LTE, there is a lot of thin...
by Amm0
Sat Mar 30, 2024 3:34 pm
Forum: Wireless Networking
Topic: Point to point link, Audience, wifi (wifiwave2)
Replies: 3
Views: 290

Re: Point to point link, Audience, wifi (wifiwave2)

This was to resolve airtime being wasted with multicast traffic, being sent at a much lower data rate. Although this has resolved issues of hung webpages, the throughput has gone down from 400Mb+ to around 200Mb. I haven't tested it, but did you try multicast-enhance=yes ? This wifi option converts...
by Amm0
Sat Mar 30, 2024 12:08 am
Forum: Beginner Basics
Topic: Need help setting up my RBSXTR-LTE.
Replies: 7
Views: 645

Re: Need help setting up my RBSXTR-LTE.

There are two SIM slots, so you may need to set the alternative one (or swap the SIM cards inside work too). If it's V6, the SIM slots is under System > RouterBoard, or in V7 under Interfaces > LTE tab > Modem. No Wi-Fi on RBSXTR, just ethernet. Is this going to another router, or is the idea the SX...
by Amm0
Fri Mar 29, 2024 8:08 pm
Forum: General
Topic: Which features are NOT essential to RouterOS?
Replies: 8
Views: 509

Re: Which features are NOT essential to RouterOS?

My opinion is we don't need another pointless thread about removing feature. It only adding new ones that gets them in trouble. Mikrotik has explain numerous times that breaking up is hard to do ;). Most people want stable V7 with the features it originally shipped with working. I'd say most profess...
by Amm0
Fri Mar 29, 2024 7:27 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

EOIP works between two IP addresses and doesn't care about how its packets move from point A to point B. So one can use any kind of connectivity to do the job. Since EOIP doesn't do any encryption, it's wise to use something that does it. IPsec is fine, wireguard is fine, etc. Only point was EoIP i...
by Amm0
Fri Mar 29, 2024 6:38 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

If you have some central Mikrotik router, another option might be EoIP+IPSec connected from remotes to the central router. If you enable RoMON on all the routers... then you connect the central router via winbox+romon, you'd see all the remotes via the EoIP tunnels. The EoIP do NOT need to be bridge...
by Amm0
Fri Mar 29, 2024 6:31 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

Yup, some backup VPN might be a good idea. Beyond ZeroTier. If you have two Mikrotik, SSTP is pretty trivial to setup between them. L2TP is also pretty easy to configure if you need VPN from a desktop. Or even a container with CloudFlare ZeroTrust WARP tunnel be another option too, although way more...
by Amm0
Fri Mar 29, 2024 6:26 pm
Forum: General
Topic: Wireguard education needed
Replies: 7
Views: 764

Re: Wireguard education needed

If it's multi-homed ISP part... it might be similar to viewtopic.php?t=205278
by Amm0
Fri Mar 29, 2024 6:21 pm
Forum: General
Topic: How insecure of 8791?
Replies: 39
Views: 1728

Re: How insecure of 8791?

ZeroTier if ARM since it will try a few different path to connect, and not as exposed to configuration issues that WG would be firewall/etc. Winbox does not use very good encryption and does not have robust DoS features is why it's not generally recommended to be open to internet. But same logic kin...
by Amm0
Fri Mar 29, 2024 5:58 pm
Forum: Beginner Basics
Topic: hAP ac² - can't import just exported configuration
Replies: 12
Views: 729

Re: hAP ac² - can't import just exported configuration

Personally, I think it's better to start with the newer default configuration of hAPax, and use the old config as a guide what to add on the hAPax manually. And compare the two configs after done to see if anything was missed (since they should look similar) If you add more hAPax, then it should imp...
by Amm0
Fri Mar 29, 2024 5:43 pm
Forum: General
Topic: Purchasing on Amazon
Replies: 11
Views: 651

Re: Purchasing on Amazon

It's the "Get it by Tomorrow" [even Sat/Sun] that's useful about Amazon IMO. In general, if you're ordering a few units, the total cost likely be lower without Amazon - or at least that's what I've found. And Amazon often limits purchase to only one or two units is the 2nd problem (or they...
by Amm0
Fri Mar 29, 2024 4:58 pm
Forum: General
Topic: Drop all from WAN not DSTNATed
Replies: 13
Views: 4933

Re: Drop all from WAN not DSTNATed

Interesting, but who uses UPNP,,,,,,, I mean do games actually still require that?? I do everything off steam, nothing fancy required, just works. Camera systems and VoIP use uPnP a fair bit. More pointing out RouterOS does have some feature that modify the firewall dynamically... and that where mo...
by Amm0
Fri Mar 29, 2024 4:36 pm
Forum: General
Topic: Drop all from WAN not DSTNATed
Replies: 13
Views: 4933

Re: Drop all from WAN not DSTNATed

Well for an advanced user fill yer boots with ! rules. Well, if beginners enabled uPnP (or NAT-PMP recently) that !dst-nat rule is what makes it work. I guess "newbies" should only need to add lines (either accept or drop) and leave the rest alone if they don't understand. Agrueably, thre...
by Amm0
Fri Mar 29, 2024 4:20 pm
Forum: General
Topic: Drop all from WAN not DSTNATed
Replies: 13
Views: 4933

Re: Drop all from WAN not DSTNATed

Lets be honest most beginners look at that rule and dont have a sweet clue what it does. Perhaps. Or the rules added BTH or PPPoE's MSS, etc. adjustment for that matter. ;) More saying the default config is not meant to be an example. Three rules likely use more CPU than one. And Mikrotik generally...
by Amm0
Fri Mar 29, 2024 4:05 pm
Forum: Beginner Basics
Topic: hAP ac² - can't import just exported configuration
Replies: 12
Views: 729

Re: hAP ac² - can't import just exported configuration

It's really not a "config" — it a script file used to setup a router. So when you :export, that more "script generator" & :import similarly just a script runner. Only backup is "full copy" of everything. As script, the order can be anything you want. Now if a called...
by Amm0
Fri Mar 29, 2024 3:28 pm
Forum: General
Topic: Drop all from WAN not DSTNATed
Replies: 13
Views: 4933

Re: Drop all from WAN not DSTNATed

! sure negation is particularly hard in context of rules. It connection tracking "established" part that make things trickier to understand than !. Keep in mind, QuickSet and Mobile Apps have UI for "Port Forwarding": which just add a dst-nat rule, but this only work because of ...
by Amm0
Fri Mar 29, 2024 2:40 pm
Forum: General
Topic: Precision Time Protocol (ieee 1588) CRS326-24G-2S+
Replies: 6
Views: 1826

Re: Precision Time Protocol (ieee 1588) CRS326-24G-2S+

That info was removed from the doc under the comment “Formatting” in the most recent update. You have to roll back to the prior version or diff them to recover the info. Perhaps the docs came before the code on the HW QoS side, dunno. I take it as good news...kinda means they been looking at/testin...
by Amm0
Fri Mar 29, 2024 2:22 pm
Forum: General
Topic: Wireguard from MT to client (win10) with several users to several VLAN's [SOLVED]
Replies: 42
Views: 4361

Re: Wireguard from MT to client (win10) with several users to several VLAN's [SOLVED]

And also routes for each VLAN? @anav means when you add an IP address to a VLAN, it includes a prefix like /24. That a subnet mask of 255.255.255.0. It will then automatically create a /24 "connected route" for test VLAN in /ip/route (marked with a "D"). A connected route means ...
by Amm0
Fri Mar 29, 2024 2:10 pm
Forum: Beginner Basics
Topic: Forum rules
Replies: 19
Views: 35188

Re: Forum rules

True. But private messages aren't allowed for anyone since I've been, so it's not a new user restriction. The idea of the forum is its for asking the community a question, so if a thread switches to PMs, the solution may be lost & forum become a catalog of broken configs without answers/discussi...
by Amm0
Fri Mar 29, 2024 3:28 am
Forum: Wireless Networking
Topic: Can I safely uninstall wireless package - hEX [SOLVED]
Replies: 17
Views: 767

Re: Can I safely uninstall wireless package - hEX [SOLVED]

Ok, than why not 4) device families w/o wireless -> uninstall any wireless package [Legacy] CAPsMAN — which CONTROLS access points — was always an included feature & does not require an hardware, since it's a controller. Recently, CAPsMAN moved to the wireless package, but [Legacy] CAPsMAN stil...
by Amm0
Fri Mar 29, 2024 3:08 am
Forum: General
Topic: How can I switch wireless to wifiwave2?
Replies: 3
Views: 510

Re: How can I switch wireless to wifiwave2?

Check the logs and see if there is a message about disk space, or some other message? e.g. Do you have any other extra-package like zerotier or iot? Or other files on the router. The wAPac has only 16MB and with the new wifi-qcom-ac, RouterOS barely fit. A lot of folk need to use the netinstall, whi...
by Amm0
Thu Mar 28, 2024 4:20 pm
Forum: Virtualization
Topic: Plan to port BTH to CHR?
Replies: 7
Views: 956

Re: Plan to port BTH to CHR?

Still it a good request. Since beyond just the proxy feature of BTH... BTH also has the "friendly" apps to set it a VPN. That's another benefit to BTH over "plain" WG, which requires more manual cut-and-pasting of keys. That's exactly what is expected for beginners... Of course,...
by Amm0
Thu Mar 28, 2024 4:09 pm
Forum: General
Topic: Watchdog, or alternative?
Replies: 8
Views: 452

Re: Watchdog, or alternative?

I think watchdog with ping is a good idea if you have dynamic WANs like PPPoE or LTE. BUT you do NOT want to set it's timeout too aggressively (e.g. use 3-10 minutes) — otherwise if it take a while to reboot/connect/etc... it could reboot again before it finishes. And you have some time to access to...
by Amm0
Thu Mar 28, 2024 3:55 pm
Forum: RouterBOARD hardware
Topic: Outdoor 5G?
Replies: 13
Views: 1284

Re: Outdoor 5G?

Yeah, 15M is a LONG way for a passive antennas. And a wAPac would fit nice on a mast. Since Mikrotik offers nothing beyond very old 4G modems for US market, we've long installed third-party modems instead into various Mikrotik board. Past few years used the Telit LM960s using 4 x external pigtails o...
by Amm0
Thu Mar 28, 2024 12:21 am
Forum: RouterBOARD hardware
Topic: Pure ROS boot...
Replies: 31
Views: 1746

Re: Pure ROS boot...

Well said @Cha0s. Tend to agree the lack of a real force password change (e.g. you can Ctrl-C or "Cancel", when prompted) was likely the actual compliance issue. The "sticker" scheme is a pretty tedious affair, see @kevinds post above. But if it's your only router and a newbie, l...
by Amm0
Wed Mar 27, 2024 8:11 pm
Forum: Announcements
Topic: v7.14.2 [stable] is released!
Replies: 573
Views: 137050

Re: v7.14.2 [stable] is released!

But would then it be speed of light in vacuum or in some thick air with large refractive index? Well, in the case of distance= it already a proxy for time. 10km equates to some timing intervals at the end of the day. Now the constant "indoor" means I don't trust Mikrotik math, or perhaps ...
by Amm0
Wed Mar 27, 2024 6:16 pm
Forum: RouterBOARD hardware
Topic: Outdoor 5G?
Replies: 13
Views: 1284

Re: Outdoor 5G?

I might have been unclear - 5G as in cellular, not wifi. Not really. ATL is closest you get, but only in Europe. With an wAPacR or LtAP with pigtail/added modem modules, you can DIY to some degree. But even there most true 5G modems using M.2, so DIY for 5G/LTE get even more tricky (since you'd nee...
by Amm0
Wed Mar 27, 2024 4:58 pm
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

Adlists do not load automatically after restart.[...] If this is intentional behavior, there should be information in the documentation [...] You can use the scheduler to update automatically,[...] What ever the reload strategy is it should be documented. Like what happens during the reload process...
by Amm0
Wed Mar 27, 2024 2:22 am
Forum: Beginner Basics
Topic: Unable to find new replacement for existing router...
Replies: 7
Views: 624

Re: Unable to find new replacement for existing router...

I dunno for sure with AX whether it's a good idea... but I've always used 20Mhz or 40Mhz if I cared about distance from Wi-Fi. You'll lose max speed near router, but I suspect speeds at a distance would improve/more stable. Playing with channel selection certainly be a good idea... although at 80Mhz...
by Amm0
Wed Mar 27, 2024 2:09 am
Forum: Wireless Networking
Topic: Mikrotik LHGG LTE18 frequently unresponsive
Replies: 10
Views: 1116

Re: Mikrotik LHGG LTE18 frequently unresponsive

Hmm. The fact only winbox works is strange here. Since that shouldn't have anything to do with LTE not working right. Did you also upgrade the boot firmware in /system/routerboard/upgrade - so that matches the same version. Other thing to check is if your "Use Network APN" is checked the A...
by Amm0
Wed Mar 27, 2024 1:58 am
Forum: Beginner Basics
Topic: LTE6 and EE having issues? Anyone else, no LTE for 3 days now and no one can seem to solve it.
Replies: 7
Views: 723

Re: LTE6 and EE having issues? Anyone else, no LTE for 3 days now and no one can seem to solve it.

In general, you should be able to upgrade the firmware using LTE interface. There was some pre-release firmware for one of the modems, but I'd imagine it's been integrated into the stable build by now. While depending on modem... you'll likely better of making sure both RouterOS (/system/package) an...
by Amm0
Wed Mar 27, 2024 1:50 am
Forum: General
Topic: Precision Time Protocol (ieee 1588) CRS326-24G-2S+
Replies: 6
Views: 1826

Re: Precision Time Protocol (ieee 1588) CRS326-24G-2S+

Nice. FWIW, Mikrotik document Dante's QoS for the CRS326's HW QoS recently, suggesting there is full support coming in 7.15:
https://help.mikrotik.com/docs/pages/vi ... QoS)-Dante
by Amm0
Tue Mar 26, 2024 5:11 pm
Forum: RouterOS beta
Topic: Speedify Mulit WAN Bonding
Replies: 41
Views: 14289

Re: Speedify Mulit WAN Bonding

Between VoIP, Wifi calling, video conference, and the real driving force... Streaming Services. Oh there are use cases for bonding for sure. I didn't look too closely at the timestamps here. Been at this problem for a long while myself too, mainly on the LTE side of multiwan. I settled on Peplinks ...
by Amm0
Tue Mar 26, 2024 2:29 pm
Forum: General
Topic: Multiple APN profiles on LTE interface
Replies: 2
Views: 340

Re: Multiple APN profiles on LTE interface

Interesting idea. So you have two APNs assigned, but a working SIM for only one of them? I'm just not sure it's a good idea. In general, modems expects all APNs provided work. If one fails, the modem is going keep trying forever until it works... so it keep searching and that very well might interfe...
by Amm0
Tue Mar 26, 2024 5:43 am
Forum: RouterOS beta
Topic: Speedify Mulit WAN Bonding
Replies: 41
Views: 14289

Re: Speedify Mulit WAN Bonding

Not sure where MPTCP is coming in here. Although agree that MPTCP is more for applications needing control, than as network bonding protocol. Speedify uses UDP-based DLTS* to setup tunnels to some cloud server, so it's not TCP. I'd imagine their Linux version could be put in a /container similar to ...
by Amm0
Mon Mar 25, 2024 10:20 pm
Forum: Beginner Basics
Topic: Same IP on different Ether interfaces
Replies: 10
Views: 671

Re: Same IP on different Ether interfaces

That's why you're getting a command error. Now is routing "mark" in the firewall, it a "table" routes.
Sorry, I don't know what you mean
/ip route
add distance=1 dst-address=10.0.0.1/32 gateway=ether2 routing-table=port2
by Amm0
Mon Mar 25, 2024 8:08 pm
Forum: General
Topic: How does RouterOS prioritize domain name servers?
Replies: 3
Views: 461

Re: How does RouterOS prioritize domain name servers?

@mkx is correct. If you give a client two DNS servers via DHCP it can use either. Now... if you client use FQDN (e.g. hostname.example.com) for stuff, and you have a custom domain with it's own DNS. You can use the Mikrotik "FWD" record in /ip/dns/static to match on a domain name & tha...
by Amm0
Mon Mar 25, 2024 7:25 pm
Forum: Scripting
Topic: execute & parse
Replies: 15
Views: 851

Re: execute & parse

It just be nice if you could have some "stored functions" since they could just be saved in config like a script. e.g. "/system/scripts/function add addVLAN source={}" so NO :global be need. Without resorting the @Larsa's nifty but ugly approach. As a "config language",...
by Amm0
Mon Mar 25, 2024 7:07 pm
Forum: General
Topic: DNS and mDNS name conflict
Replies: 5
Views: 481

Re: DNS and mDNS name conflict

I guess I'm suggesting there may not be easy solution using Mikrotik DNS. Mikrotik has NO support for "discovery proxy" (https://www.rfc-editor.org/rfc/rfc8766.html) which resolve normal/unicast DNS queries into mDNS ones, which is kinda what you'd like in this case. No static DNS entries ...
by Amm0
Mon Mar 25, 2024 6:45 pm
Forum: General
Topic: DNS and mDNS name conflict
Replies: 5
Views: 481

Re: DNS and mDNS name conflict

Add'l detail, if you using a custom domain & want it resolved by mDNS. You'll need to add specific records to the DNS server used by clients to say that "regular" domain is enabled for mDNS lookups. This older document explains more how to add the Mikrotik to another DNS server (since ...
by Amm0
Mon Mar 25, 2024 6:25 pm
Forum: General
Topic: DNS and mDNS name conflict
Replies: 5
Views: 481

Re: DNS and mDNS name conflict

Just adding a .local to a static DNS is not enough to enable it for mDNS (or specifically DNS-SD). Bonjour uses multicast (or SRV and PTR DNS record) to actually resolve ".local" names. On Mac (or Linux distro/Windows with Bonjour/mDNS resolver enabled), it wouldn't check the DNS servers f...
by Amm0
Mon Mar 25, 2024 5:01 pm
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

Well, Mikrotik has said they're working on a "solution". And at least it failed gracefully. Using Netinstall let you test 7.15beta. Whether it's fragmentation, "leftover" files from past, leases, graphing... The "math" using the UI is not always predictive of failure &a...
by Amm0
Mon Mar 25, 2024 4:15 pm
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

Be curious, do you have any other things in Files?

e.g. since photo shows 46 million sector writes, there could be none.
by Amm0
Mon Mar 25, 2024 4:02 pm
Forum: Scripting
Topic: execute & parse
Replies: 15
Views: 851

Re: execute & parse

Like eval in another script languages ? Yes. And same generally approach: string interpolation to dynamically create a command. Here the use more complex. @rextended and @Sertik are trying to get around the restriction that a function must declare any global variables to be able to use them. So the...
by Amm0
Mon Mar 25, 2024 2:19 pm
Forum: Beginner Basics
Topic: Same IP on different Ether interfaces
Replies: 10
Views: 671

Re: Same IP on different Ether interfaces

While subnet is /32 based /ip/address, the issue isn't the /24. But more likely
routing-mark=port2
vs.
routing-table=port2

That's why you're getting a command error. Now is routing "mark" in the firewall, it a "table" routes.
by Amm0
Mon Mar 25, 2024 2:12 pm
Forum: Wireless Networking
Topic: Mikrotik LHGG LTE18 frequently unresponsive
Replies: 10
Views: 1116

Re: Mikrotik LHGG LTE18 frequently unresponsive

The default IP is 192.168.88.1. You changed it to 192.168.188.1? Likely not. I believe 192.168. 188 .1 is the default IP on the LHGG (and some other LTE things I think). You may want to check the LTE firmware is update-to-date. It's an option on the LTE interface to check for upgrades. There should...
by Amm0
Mon Mar 25, 2024 5:53 am
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

As far as I know, this gives a result of -1. Depends. JS allows it and is -1. But in Python, it's an error. In C, it's left to an implementation detail. But of all things to complain about in RouterOS scripts... And even if "wrong", you never know what might break changing stuff, someone ...
by Amm0
Mon Mar 25, 2024 2:43 am
Forum: Beginner Basics
Topic: Dual WAN Setup - how to get both public IPs reachable
Replies: 6
Views: 1793

Re: Dual WAN Setup - how to get both public IPs reachable

I have exactly the same problem as Chaosphere64. [...] IPSec Lan2Lan connection [...] How can I solve this problem?
To @anav's point, your problem is not the same. IPSec isn't mentions at all here & that add more complexity.
Likely better to create a topic with your config/diagram/details.
by Amm0
Sun Mar 24, 2024 11:58 pm
Forum: Containers
Topic: Can't ping veth1, trying to add pihole to a container.
Replies: 1
Views: 393

Re: Can't ping veth1, trying to add pihole to a container.

It's blocked by firewall. Specifically the default !LAN input drop rule: /ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN since bridge-pihole is not a member of the LAN /interface/list Several ways to allow. But this be ...
by Amm0
Sun Mar 24, 2024 11:41 pm
Forum: Beginner Basics
Topic: What happens to an interface that is not part of any bridge?
Replies: 7
Views: 632

Re: What happens to an interface that is not part of any bridge?

"Seen" is where the theory meets practice. They're all interfaces to the router. RouterOS is also a [Layer 3] [IP] router & routers do routing. So with empty firewall... IP/IPv6 between traffic be allowed between all the interfaces, bridged or not. But an off-bridge ethernet interface ...
by Amm0
Sun Mar 24, 2024 9:36 pm
Forum: Beginner Basics
Topic: how to find version of runing Winbox
Replies: 2
Views: 309

Re: how to find version of runing Winbox

It's in the title bar of the first/login window that appears after launch. Once connect, I'm not sure where you could find out winbox version, since the titlebar will show the connected router's version AFTER login.
by Amm0
Sun Mar 24, 2024 9:18 pm
Forum: Scripting
Topic: fetch - how receive response code
Replies: 8
Views: 5314

Re: fetch - how receive response code

That's a shame. This seems to be a very old user need. I guess the best option is to resort to files as @rextended suggested. I hope MT improves the Fetch tool one day. 🤞 They added "output=user-with-headers" option recently, but that doesn't help on DNS failure. Also, if there is a some ...
by Amm0
Sun Mar 24, 2024 5:51 pm
Forum: General
Topic: TIP: Do not use rp-filter=Strict with Dual WAN policy-based routing [SOLVED]
Replies: 6
Views: 1227

Re: Policy-based routing with dual WAN [SOLVED]

Might want to change your title. Something like "TIP: Do not use rp-filter=strict with Dual WAN".

It's been years, but I have run into this one myself.
by Amm0
Sun Mar 24, 2024 5:48 pm
Forum: General
Topic: TIP: Do not use rp-filter=Strict with Dual WAN policy-based routing [SOLVED]
Replies: 6
Views: 1227

Re: Policy-based routing with dual WAN [SOLVED]

I read your case. I figured it was something like... ;)

e.g. "strict" does seem like a good option, and no routing tables at that time.... And the dual WAN enough config, might think it was some firewall rule, etc. etc....
by Amm0
Sun Mar 24, 2024 5:43 pm
Forum: General
Topic: TIP: Do not use rp-filter=Strict with Dual WAN policy-based routing [SOLVED]
Replies: 6
Views: 1227

Re: Policy-based routing with dual WAN [SOLVED]

Yup rp-filter=strict would do that. I can see how that how an esoteric /ip/setting like rp-filter might NOT be the first thought. FWIW, "strict" shouldn't be the default... so someone changed rp-filter at some point. And docs the option: Warning: strict mode does not work with routing tabl...
by Amm0
Sun Mar 24, 2024 5:18 pm
Forum: Virtualization
Topic: Plan to port BTH to CHR?
Replies: 7
Views: 956

Re: Plan to port BTH to CHR?

Also, CHR+BTH is bit trickier since there is default config/firewall on CHR for BTH to know what to modify. With the default conf on ARM/etc., there is notion of LAN (bridge) and WAN (ether1)... same isn't true on CHR. Still it a good request. Since beyond just the proxy feature of BTH... BTH also h...
by Amm0
Sun Mar 24, 2024 4:47 pm
Forum: Virtualization
Topic: Plan to port BTH to CHR?
Replies: 7
Views: 956

Re: Plan to port BTH to CHR?

True. Unless OP needed the proxy features for restricted NAT from BTH... That's the main benefit of BTH... and as it's already emplemented on other platform, I was wondering if it is planed on CHR. That's all... :wink: You can file a feature request at help.mikrotik.com. I suspect part of the probl...
by Amm0
Sun Mar 24, 2024 2:58 pm
Forum: Scripting
Topic: fetch - how receive response code
Replies: 8
Views: 5314

Re: fetch - how receive response code

If the problem is a "wrong URL"... It's either the DNS could not be resolve OR TCP cannot connect to the IP resolved. AFAIK, nothing will tell you that specifically, just "failed" as status (although you can check DNS using ":resolve" before). But if HTTP is not success...
by Amm0
Sun Mar 24, 2024 2:45 pm
Forum: RouterBOARD hardware
Topic: Request for Python Script to Change L2TP Password in MikroTik Router
Replies: 6
Views: 672

Re: Request for Python Script to Change L2TP Password in MikroTik Router

Personally I would use the REST-API if possible. Then just use Python with requests module. For background, Mikrotik has several "APIs". The low-level one is what typically called "API", and there is a python module wrappers: https://help.mikrotik.com/docs/display/ROS/API#API-Ex...
by Amm0
Sun Mar 24, 2024 3:28 am
Forum: SwOS
Topic: Feature suggestion - FW Upgrade availability through SNMP
Replies: 2
Views: 418

Re: Feature suggestion - FW Upgrade availability through SNMP

I don't think there is anything in the MIB, other than current version. Often you can use HTTP to fetch the current version from a Mikrotik web service, and then have an alert/rule/etc in NMS that compares the result from HTTP with the SNMP version from device. While Mikrotik has URL to fetch the cu...
by Amm0
Sun Mar 24, 2024 3:12 am
Forum: Scripting
Topic: Startup settings (factory defaults)
Replies: 2
Views: 278

Re: Startup settings (factory defaults)

Just to be clear: If no one do a /system/reset-configuration or push-and-hold reset button, the config does stick around. All changes are automatically saved and used immediately. You only need netinstall or branding if your want to replace what's in "/system/default-configuration print" -...
by Amm0
Sun Mar 24, 2024 3:09 am
Forum: Scripting
Topic: Startup settings (factory defaults)
Replies: 2
Views: 278

Re: Startup settings (factory defaults)

The netinstall will do it via "-s myscript.rsc": https://help.mikrotik.com/docs/display/ROS/Netinstall#Netinstall-InstructionsforLinux You can also create a branding package, that includes the default script (as well as logos etc.). Branding creates a package, so you copy it and reboot, th...
by Amm0
Sat Mar 23, 2024 8:53 pm
Forum: Beginner Basics
Topic: How to configure LAN IP Pool
Replies: 15
Views: 4489

Re: How to configure LAN IP Pool

So do you also have two /30 and /29 [public?] subnets from your ISP? Likely better if you wrote up your problem in a new post. This "LAN IP Pool" is confusing term. When a customer does not have BGP, I've seen /30 used as route point at a customer site for any additional /29+ subnets assig...
by Amm0
Sat Mar 23, 2024 8:29 pm
Forum: The Dude
Topic: Read-only Dude access - how?
Replies: 8
Views: 1242

Re: Read-only Dude access - how?

Hi Amm0. To clarify, I meant that the Winbox tool specifically has been removed from Tools in the newer Dude client versions, not that the whole tool list has been removed. That makes more sense. To the original question is you'd have to make sure NOTHING uses "[Device.Password]". And a &...
by Amm0
Sat Mar 23, 2024 7:15 pm
Forum: Containers
Topic: Homeassistant as container and homekitbridge setup
Replies: 14
Views: 1280

Re: Homeassistant as container and homekitbridge setup

You can use multiple IP addresses, true.

But they are still in same VLAN/bridge as the VETH is using. So it's NOT a way to get into multiple Layer2 VLANs.
by Amm0
Sat Mar 23, 2024 6:59 pm
Forum: Virtualization
Topic: Plan to port BTH to CHR?
Replies: 7
Views: 956

Re: Plan to port BTH to CHR?

True. Unless OP needed the proxy features for restricted NAT from BTH...
by Amm0
Sat Mar 23, 2024 5:15 pm
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

While I have confidence Mikrotik will figure out something for 16MB in 7.15 to improve the situation.... The open question, and worry, is 7.16, 7.17, etc. If all new features/fix go to the main package, we'll be in the same boat again soon. And there does not seem to be a plan to deal with that.
by Amm0
Sat Mar 23, 2024 4:37 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

And I'm pretty sure that $ifadd is one address (with or without "/n") so no nil or str is returned, but one ip ... In your function, sure. My quick function example, no. My point was that on-error={} offers a false sense of security – since there are a lot of oddities in scripting. And a ...
by Amm0
Sat Mar 23, 2024 3:45 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

It's that debugging later can be tricky. So you have to picky at the source. How anal you want to be is up to you. e.g. If your replacing the defconf, one error in a script, and the router won't work. For example on scripting pickyness, you'll note the need parse the prefix part using :find and :pic...
by Amm0
Sat Mar 23, 2024 3:17 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

Good example @rextended. Why I'm always pitching functions since you can hide all the checks inside so you don't need repeat elsewhere. I'm not as adverse to on-error={} as @rextended BUT it is tricky... & in most cases your better off just letting things fail, or specifically checking every ste...
by Amm0
Sat Mar 23, 2024 2:54 pm
Forum: Announcements
Topic: v7.15beta [testing] is released!
Replies: 501
Views: 123772

Re: v7.15beta [testing] is released!

It simply means that when these ARM devices were designed and released, such package did not exist yet. Fair enough. Y'all never marketed them as Wi-Fi 6. A lot of vendors would just tell folks to upgrade. But a lot of the great flexibility is lost when you cannot remove unneeded features & bro...
by Amm0
Sat Mar 23, 2024 2:38 am
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

Yup. :error will stop the script, and print message to the CLI/console. While the /log handles the case if same script run in background. So that combo covers both CLI and /system/script. But often it better to just add some more :if (error-condition) do={:error ...} checks along the way. And if som...
by Amm0
Sat Mar 23, 2024 1:19 am
Forum: The Dude
Topic: Read-only Dude access - how?
Replies: 8
Views: 1242

Re: Read-only Dude access - how?

Did not mean to be confusing. While no user can view the password on from the Device dialog box. And you're likely right that the "writable" RouterOS stuff for a Device, use the logged in user. I think OP's point is Dude uses variables in various points, including Tools, but elsewhere too....
by Amm0
Fri Mar 22, 2024 10:38 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

Sure, that kinda more what's the :do is used for. And, above code could fail, if an interface= had multiple IP address associated with it (e.g. "multihoming"). But.... it's often's better if a script fails immediately, than "catching" the on-error=. If something else further need...
by Amm0
Fri Mar 22, 2024 8:22 pm
Forum: The Dude
Topic: Read-only Dude access - how?
Replies: 8
Views: 1242

Re: Read-only Dude access - how?

Well removing the Tool is one approach, but doesn't really solve the undesired privilege escallation. It's still a variable in the system... About only thing you can do is ALSO use a read-only account on the devices being monitored. So Dude itself does not have write access, thus when password is &q...
by Amm0
Fri Mar 22, 2024 6:52 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

You can also make it a function, if you need to do for a multiple items: :global getInterfaceIP do={ :local currentIPv4 [/ip address get [find interface~$1] address] :return [:pick $currentIPv4 0 [:find $currentIPv4 "/" -1]] } :put [$getInterfaceIP ether1] Dorky side note: RouterOS has typ...
by Amm0
Fri Mar 22, 2024 6:40 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

where you get the useless do {} and the other frills?????????? In a script, do you think I could drop the "do"? Yes. Harmless, but unnecessary. Since :do { ... } is do'ing nothing. e.g. this is identical in function: {:set currentIPv4 ([/ip address/get [find interface=$wanInt] address]); ...
by Amm0
Fri Mar 22, 2024 6:25 pm
Forum: RouterBOARD hardware
Topic: Pure ROS boot...
Replies: 31
Views: 1746

Re: Pure ROS boot...

True, lots of way to have a broken router with unauthorized physical access (e.g. a hammer also disable it).... But the requirement is it has a unique password, and after a reset, it still does. It's also inconvenient that Wi-Fi antennas use RP-SMA, but that's also the law. e.g. US FCC did not want ...
by Amm0
Fri Mar 22, 2024 4:59 pm
Forum: Scripting
Topic: Isolate a value from a console output [SOLVED]
Replies: 25
Views: 2295

Re: Isolate a value from a console output [SOLVED]

[:find $wfaddress "/" -1]
vs
([:len $currentIPv4] - 3)
  • 1
  • 2
  • 3
  • 4
  • 5
  • 13