MikroTik

Amm0

Okay, I got the /ip/cloud/file-share feature almost working. However @normis's comments do not quite match my experience: it only opens up the file share and has a valid HTTPS certificate. Webfig is not opened to the world, when you enable file share. It is a different service. I had HTTPS enabled i...

Amm0

How this works? Has someone tried already? *) cloud - added file-share feature; I enabled it, or at least I thought, but doesn't work. It says running, and looked based on BTH's relay service to share files over internet. /ip/cloud/file-share/settings/print enabled: yes dns-name: <sn>.routingtheclo...

Amm0

And it returns in 7.18 reincarnated!

/ip/route/check dst-ip=8.8.8.8                                 
     status: ok            
  interface: wan2  
    nexthop: 1.2.3.4

Amm0

This one could use a bit more explanation... *) cloud - added file-share feature; Now it did work to create a /ip/cloud/file-share ... but the URL with "routingthecloud.net" does not seem to work in browser (it gets a 404). Is this for BTH use only? i.e. I noticed the /ip/cloud/back-to-hom...

Amm0

NICE WORK. I'm undecided on what to report the most beautiful, besides the FastTrak, I should copy half the list... Indeed. Upgraded a RB1100AHx4, KNOT, and CHR(s). The RB1100 has some auto-start containers with ROSE RAID/bfrs & all just came up – which includes MQTT and LoRa server, and 7.18be...

Amm0

Based on at tip in from Amm0 I changed HA from branch “stable” to “latest”, installed HA container and it worked! 😊 from https://forum.mikrotik.com/viewtopic.php?t=214037#p1120343 # ... add veth and networking config ... # SSD is at "raid1/" and layer-dir= and tmpdir= explicitly use the &...

Amm0

CHR will have drivers for the virtualized network drivers... Otherwise, AFAIK ARM64 native build does not have a lot of drivers.

Amm0

Understandable. I regularly complain about this. But it has not improved for North American LTE/5G users — and newer LTE devices are even worse the older ones. The original CAT6 modems at least worked with AT&T and T-Mobile... but newer "refreshed" LTE devices, generally with "(20...

Amm0

None work "great" and no 5G options for US. The LTE6 will work okay with AT&T, albeit 5G and limited to CAT6 speeds - but it does at least couple CA modes for AT&T. And LTE6 may work for Verizon, in some areas, but it's without Verizon's Band 13 – which VZW widely deployed/uses – t...

Amm0

Did you try using the fully qualified remote-image, i.e. including :latest. This worked to create HA on a RB1100AHx4, which 32-bit too. # SSD is at "raid1/" and layer-dir= and tmpdir= explicitly use the "real" disk /container/config set layer-dir=raid1/layers registry-url=https:/...

Amm0

The "!dns !package" log rule will mean "debug" (or anything NOT dns and NOT package - which is a log. In general, the "double negative" rules really make it difficult to predict what will happen since it's essentially "everything else"... So may be more OTHER ...

Amm0

If they followed them, by hypothesis, all of them, they would do yours in 20 years.

I guess someone wins the lottery...

And, their AMT implementation does look simplier than PIM-SM or IGMP proxy (x2). Hopefully AMT works with WG tunnels to add multicast.

Amm0

Did you try from the CLI to set the DHCP Option? I suppose it's possible winbox/webfig used ߵsmartquoteߴ or some unknown Windows locale/code-page/keyboard thing in winbox... This will explicitly update any existing entry, if any unicode was present the CLI will strip it. /ip dhcp-server option set [...

Amm0

"Only critical bugs will be fixed in Winbox 3" . Sounds crazy, right? Not really. WinBox3 has not had new features for a long time... so I think it's been in the "only critical bugs" even before winbox4 came out . I think when you start seeing some "new winbox protocol"...

Amm0

Unfortunately yes. For example if you merge different office locations within OSPF over p2p wire guard links. In that case you have different networks in most cases, and to get for SMB share, printers etc to live across offices you still have to rely on WINS. Or use Active Directory (either MS or S...

Amm0

WINS is a 31-year-old, obsolete Microsoft legacy service Agree. But still really curious on what drives any use case for WINS... But just to answer the question... you can install samba in an Alpine container, and enable WINS in it's config (and add LMHOSTS, have RouterOS DHCP set container as WINS...

Amm0

You need to open up the File window in winbox, and drag the file to the blank spot in the window - not the menu itself – so that .npk package appears at the root directory inside Files dialog box. Then do a System > Reboot. You check Logs to see if has any messages after reboot after copy'ing the UM...

Amm0

I maintain the fat-chr project, so it's possible to add a variant for a 1MB aligned VHD image in future – but I'm not sure that's whole problem here with Azure Gen2 +ARM64... Basically the ARM64 build is different animal...Mikrotik has suggested it's really for AMPERE-based systems... so it may not ...

Amm0

[...]measurement unit jumps left/right depending on the order of magnitude of the numbers. eg. comparing "1.0 Mbps" and "1000.0 Mbps" the position of the Mbps are different - it moves sideways depending on the value and I find this distracting to read Agreed on alignment & M...

Amm0

ARM64 CHR may need NVMe disk, I think, although not 100%. I recall some issue with QEMU where the fix is to use NVMe emulation.

Amm0

Are you running the latest stable version (7.17, or 7.16.2)? e.g. Some devices come with older versions, and I want to say there was some bug someplace in TZ auto-detect and/or NTP in older versions. FWIW, Mikrotik has a build in time sync in /ip/cloud, so there is not a specific need to use your ow...

Amm0

Good idea. It let you "queue" some action simply... Now you can always have the last action of schedule script to remove itself. But this is a bit trickier...as there is NO "this" variable to know what script you're in (/system/scheduler/remove [find name="$name"] will ...

Amm0

Yeah I really don't know for sure on this one. Only guesses... Presumably the generated config should be the generic peer configuration, and it's totally unclear what the 0.0.0.0/32 is for from docs... It would be nice hear from someone at MikroTik about this! Agreed. Mikrotik really should write up...

Amm0

Good question. IDK exactly. But agree I think it's superfluous when using the generated config in a normal WG client. It is NOT a /0 default route, rather a /32 — so not sure it's be useful if normal WG app, unless some client app used "0.0.0.0". But dunno My only WAG is it's used by their...

Amm0

The "Who's Online?" from the main forum page has been removed too. I suspect they blocked the "public profiles", to reduce the URLs that could be scraped/DDoS/whatever...

Amm0

Since 7.17 is forcing me to use new Winbox instead old one, that i'm used to it, How does it forcing you to use new WinBox? WinBox 3.41 works fine on 7.17. Yeah...you might want to explain what you mean... i would like to ask if there is a way to fix comment section under connections, that i would ...

Amm0

Why and what traffic is coming in from the dynamic BTH interface that is added? [...] the counter increments steadily without a BTH client out there. So what traffic is this, mddns? Seeing as you have persistent keep alive set to the relay server, the router keeps in contact with the relay server??...

Amm0

I can see that an autosupout was created at the time the process halted..should I send it to MT for investigation? Perhaps a case at support@mikrotik.com. The path and layer-dir= is about the only knobs I know to try here... Make sure to generate a new supout.rif with the current state and include ...

Amm0

in macOS, on Winbox Terminals, it is no more possible to input ^ or ~ characters without having to make copy-paste. That's odd. I can use both the caret and tilde fine in Terminal, on MacOS, using latest beta. Are you using an external keyboard, or perhaps foreign keyboards might cause a difference...

Amm0

Hmm. Can you also change tmpdir=usb1/pull in /container/config (settings), to remove that slash too?

If that does not work, you could try to the the "layer-dir" in container settings this specifies where the layers are stored:
/container config set layer-dir=usb1/layers

Amm0

Try using root-dir=usb1/ha (without the leading /).

RouterOS file paths do not start with a /, and while some item (like /container/mount) will ignore a leading slash /... root-dir= is very picky.

Amm0

migrate to other forum software that supports load balancing, high availibility etc
Im 100% sure one can do this with PHPBB and HAProxy
https://www.haproxy.org/

+1 to haproxy

It has been flaky today too...

Amm0

While it's nifty trick to use [:parse] to create new globals or use one without a declaration... In most cases, your better off using an array-of-maps or array-of-lists & using TWO :foreach loops. And bad examples of using [:parse] to have "dynamic variable names" are even less helpful.

Amm0

"Most" clients will be automatically set the TCP MSS correctly (assuming ICMP/"ping" is not blocked in the path), but it's not 100%. And why "it worked for a while, then some device broke it..." So using an adjust-mss action makes sense for WG - keep in mind it only app...

Amm0

Please be patient, we will have some new features in ROSv7. :) Well folks have been patient... But even the new REST API, which borrows the API query syntax, does not support regex either. So it's useful beyond just the older API, since I'd imagine REST just proxies the native API. If API supported...

Amm0

If you create a pcap with your ping from the router using sniffer, and they use that same pcap in traffic generator does it work? IDK why the Juniper might not see it. But again if something generated is malformed, perhaps it drops it. Or, if IP/arp was wrong, then generated traffic might not be goi...

Amm0

The CHR solution looks cool, but CHR + server looks a bit to much for me right now. [...] Maybe flashing the RB951 with openWRT + Zerotier (I hope this is not a sin to be told here) Most commercial VPN services (Nord, SurfShark, etc.) don't allow port forwarding, so that not a viable options. I'll ...

Amm0

Yeah ZeroTier works pretty well for these cases. While WireGuard and EoIP+IPSec be alternatives if you have a public IP someplace where you can do port forwarding... But without a public IP, you need another router someplace with a public IP that the MIPS RB951 will initiate a connection, and the re...

Amm0

Yeah maybe @normis has a clue here. I am trying to follow the MT documents. While I get it... that would include doing a /system/reset-configuration no-defaults=no keep-users=yes IMO. And I bet everything would work. I doubt the docs assume anyone has custom firewall rules or VLANs in their docs... ...

Amm0

If you're running 7.17rc, you need to enable the traffic generator in /system/device-mode (see 7.17 thread here, or docs).

Otherwise, it's possible you're not generating a valid packet that be dropped before your router sees it. Do you see it on the Mikrotik touch or sniffer locally?

Amm0

IDK what's going. I've always seen the rules, but only have a couple test devices, both are running 7.17rc. Although this was all working in 7.16 too. I'd try again, and NOT use the smartphone app - IMO that makes this MORE configuring unless you really do have "factory defaults". So disab...

Amm0

To cut to chase, you're right that if you have customization in /ip/firewall/filter things get more complex. I think the underlying assuming is that you do NOT have any modifications to the default firewall.... Now why some are missing, it's possible that unless you have an BTH peers that have "...

Amm0

1. Do I need to keep the IPV6 addresses, even though I am strictly using IPV4, in other words does MT relay server require that for all devices?? IPv6 address are not required on the peers or router, although it will be generated in the sample/exported/shared config. But on IPv6... keep in mind if ...

Amm0

You might want to post your config. I believe the default configuration is empty, so routing might not work out of the box.

Amm0

Is there a way to just simply remove the login username by default? Nope, or at least no documented way I could find. And, agree, it's annoying. Considering Mikrotik encourages everyone to NOT use "admin" as username (i.e. to add another element to a password attack), it a poor default th...

Amm0

I don't know if there any other users of my $ROKU script, but in the latest RokuOS update some permissions have changed that will break the script . Specifically "ECP" which is the web service used to control the TV via HTTP over the LAN. So to keep using the script, you must enable on the...

Amm0

Not "simple" at all.

And here I thought you like making things more complex.

Amm0

One only needs the APP to create the first user ( the smartphone itself ). It automatically turns on BTH VPN, and creates the first two entries! I had thought one needed to manually turn on BTH VPN in ip cloud first. It's likely best to do it phone BTH app - so you can test it first. But doing it v...

Amm0

FWIW, both modern Windows and MacOS desktop OSes support using DHCP options to detect the captive portal, which /ip/hotspot support (returning the JSON needed by Option 114). Now hotspot also does all the older DNS/redirects schemes too - which @mkx is correct, they don't as well these days since ne...

Amm0

A certain Amm0 :wink: explained how hotspot can only take care of the wifi part in a post in one of the two threads I mentioned: https://forum.mikrotik.com/viewtopic.php?t=208023#p1077781 Your memory is better than mine. But despite my poor summary there... I'm pretty /ip/hotspot applies to any LAN...

Amm0

We have many similarly configure LTE routers, so it's easier for me to test that a version works before dealing with anything remote... But if you got just one and it's remote, that makes it harder... Especially if it's stable for hours and then dies, that's sounds really annoying... Their support i...

Amm0

If you can't disable the interface without a crash, that seems like bug somewhere. I'd file a ticket at support@mikrotik.com, and make sure to include a supout.rif when you have the problem. If it keeps happening, you can also try running 7.17rc (+upgrading the boot and LTE firmware too for 7.17), w...

Amm0

This thread has a few approach to a similar problem: https://forum.mikrotik.com/viewtopic.php?t=195386&hilit=captive+portal Basically the options from that are: 1. Create a [largely unused] captive portal on new VLAN, with update HTML with your "Out of order" sign. For maintenance, you...

Amm0

I wasn't sure if it internally used in matcher if the = was "ip-prefix" type. Apparently not, according to MT's @mrz in this thread ( https://forum.mikrotik.com/viewtopic.php?t=103590 ) from ~8 years ago: I recently became aware that you can use a "in" operator in a command line ...

Amm0

The part of the story missing is the LTE metrics. If you're doing monitoring, adding RSRP, RSRQ, and SINR likely be useful since it could be on the LTE carrier side (i.e. time-of-day, changing bands, etc.) which some data either confirm or rule-out. Now the dramatic drop in traffic might indicate so...

Amm0

Never bridge VETH interfaces with physical ports, it will disable hardware forwarding. "Never" is overly strong, but because it's a consideration worth taking into account, I've added it to the list of consequences The loss of HW forwarding is a good point, and a valid consideration. With...

Amm0

but FASTTRACK works with a "change MSS" in the ppp profile?

MSS adjustment happens on first/"new" TCP SYN packet & "new" connections not covered by fasttrack established/related rule...

Amm0

With my ISP you normally have to pay a subscription for IPTV and get a TV-Box. But if you don't subscribe and pay nothing, the IPTV multicast streams with all the channels are still available on the ethernet connection that PPPoE uses, not in a separate VLAN, free of charge, you just don't get the ...

Amm0

Couple questions... 1. Is the LAN bridge using auto-mac=no? – if it's =yes, then it's possible VETH become the "first interface" in the bridge, in which case it changes the bridge MAC address to be VETH, which may have some side-effects & using a admin-mac= is generally a best practice...

Amm0

Did you try using query (.query in REST POST)?

/ip/route/print
?active
?dst-address=10.10.10.1
?#&

Now if you got multiple responses, your code have to deal with getting the first from the array, since there is no "pick" in API.

Amm0

Well, at least we have a test of AI's AGI abilities - if an LLM can figure out RouterOS config, we're got AGI and domed. But seems were long way from that... Change the "/interface mdns" to: /ip/dns/set mdns-repeat-ifaces=LAN-34,IOT-200 And, the firewall rules are likely not optional, but ...

Amm0

Yeah point being there are three possible places to update: 1. /system/package 2. /system/routerboard/update 3. /interface/lte/firmware-upgrade & with LTE likely best ALL align (and/or at latest stable), since over many releases I have see weird things with LTE (no showing up, not running, disap...

Amm0

The automatic search feature in the Brother Full driver did not found the printer (I expected that cause they were not in the same broadcast domain). After putting the IP statically - printer was found immediately but installation failed. Even adding a FORWARD rule of allowing ALL from VLAN34->Prin...

Amm0

Yeah that one says TWO modems, and TWO SIM. But none going to run RouterOS™.

Amm0

On routerA it's needed because routerB is trying to connect to the routerA thought the internet and without that rule firewall would drop the traffic. Perhaps there is some outbound traffic from that port that opens up a hole in routerB allowing response traffic? Anyway, I think it does not hurt to...

Amm0

This is using /zerotier/controller. By the way, in this case are there any flow rules I can edit? I am asking because now RoMON goes through the ZeroTier interface, but OSPF does not discover peers in any broadcast mode, it only works if they are defined statically. But for 80 peers, I obviously pr...

Amm0

Good write up! Few points: - BTH does add all the firewall stuff automatically - that's why it "easy"... while doing it "by hand" on RouterB you do have to allow the WG port otherwise it be blocked by the default firewall's drop WAN in rule. - AFAIK, the BTH "server" ru...

Amm0

To be fair on the posted image, also Huawei claims the same. It seems more likely that it is something lost in translation (or whatever) connected with amazon than originating from the manufacturers. RouterOS do sounds generic, it is a router and has an OS ;). I believe you can report them to Amazo...

Amm0

I found this about WinBox encryption https://margin.re/2022/02/mikrotik-authentication-revealed/. No idea if the author was correct or whether it's still relevant to the current version. It's actually documented as ECSRP for key exchange and authentication [...] AES128-CBC-SHA as an encryption algo...

Amm0

Sorry, /system/routerboard is where you upgrade the firmware (but the "firmware"/BIOS is called RouterBOOT).

Amm0

Yes, I too am going that very path :-) I just have ordered 2 LTE sticks, and will first test a solution on the PC (Linux), and later move it to a dedicated small router device... On Linux, if mbimcli works (assuming ModemManager is installed) then it should work on "real" RouterOS.

Amm0

I heard they were discussing Latvia buying Cloudflare...
Or is it the other way around?

LOL. Perhaps,

Latvia's GDP = $43.63 billion
Cloudflare, Inc. (NET) market cap = $39.71 billion

Amm0

Help!
How can I post an image here at all?
Is only an external link possible?

When you do a reply, below the text box/button there a tab that says "Attachments", you can add a graphic as a file, then use "Place inline".

Amm0

@anav is right, but it is unfortunately ironic that the "easy-to-use" QuickSet method is fraught with bugs and caveats. On the specific issue, QuickSet messing up /ip/dhcp-server/network with 0.0.0.0 is known issue in some combo of older versions AND older default configuration built-in (/...

Amm0

Yeah the whole idea of $SECRET is that it uses /ppp/profile password= variable, which in RouterOS policy is "sensitive" - you indeed you do need policy permission for it. Now the main benefit of using a "sensitive" attribute to store the "secret" is that stuff like API ...

Amm0

I'd make sure you also upgraded the firmware in /system/routerboot to match. If that matches, then... it may be worth it do a backup, and upgrade to the "testing" channel with 7.17rc. I recall others some issues with LHG specifically in 7.16 or 715, so doing another search through forum ma...

Amm0

While I mainly use Mikrotik router as LTE devices, I do have one site with an inherited Cudy LT something. Amazon is wrong, it's not RouterOS. It has decent web UI, but all the features are pretty fixed in how they work and there aren't a lot of customizations. Small example, Cudy's do support ZeroT...

Amm0

the way, I solved the RoMON issue with ZeroTier: I had to enable bridging mode for each peer. This is when using /zerotier/controller for your peers? ...or using my.zerotier.com service? I ask since the default flow rules for ZeroTier's cloud service will block RoMON. In which case, you need to add...

Amm0

In general, a USB stick with LTE should work via USB, and multiple via a hub should too. But not all modems are compatible, and some may require issuing AT commands to switch modes. Mikrotik has a list of modem here: https://help.mikrotik.com/docs/spaces/ROS/pages/13500447/Peripherals#Peripherals-Ce...

Amm0

Attempt4: Why did I volunteer to attend this event for Viktors......

I think the PM's drug-sniff dogs excluded him from the event.

Amm0

Maybe @normis is taking you seriously...

Gc_FYR5XkAAenOb-2.jpeg

I heard they were discussing Latvia buying Cloudflare...

Amm0

Jinx! But with way better details than I was able to provide. :-D I like the OP's presentation, since these choices are kinda of matrix. I'd already wrote my post when I got a conflict, otherwise I'd agree with your assessment ;). Perhaps I'm more agnostic on IPSec IKE2 vs WireGuard — neither have ...

Amm0

Well the text is confusing. But so is the RouterOS bridge interface... see @sindy's "RouerOS bridging mysteries explained", which pre-dates MVRP and dynamic /interface/bridge/vlan assignments: https://forum.mikrotik.com/viewtopic.php?t=173692 In 7.16 and above, /interface/vlan (i.e. dynami...

Amm0

For completeness, RouterOS also support OpenVPN in layer-2 - although whether multicast/OSPF//RoMON work on it IDK since I've not used it. On ZeroTier, you can run RouterOS as a controller without a license AFAIK. But your list does not capture that ZeroTier only works on ARM devices. Since that mea...

Amm0

I just need the config spat out in the terminal to be seamlessly integrated with our config change software It's this I'm confused by: sending to terminal is different from automation. If your config software can use SSH to issue the "export" command, that will spit out to "terminal&...

Amm0

On word of caution... while a missing interface may be the problem-du-jour, it hard to predict the future. And this is what makes scripting around LTE failure tricky. For example, your+AI script looks for "lte1" as the name of the interface...but over the course of many, many RouterOS vers...

Amm0

Yeah :convert transform= only does SHA512 only, even in 7.17rc6. I filed a ticked (SUP-126958) a year ago about SHA256 (and HMAC's) - in my case, it limits being about to sign AWS HTTP requests, which need SHA256. I got the "Thank you for the feature request. We will see what we can do." f...

Amm0

Be careful, it might be easy to get trapped in a boot-loop this way ... Not really a concern.. if it goes into a loop it will be because the LTE card isn't working and if that's the case the unit is no good to us and its a swap out anyway That where the ping watchdog isn't a bad option... as that w...

Amm0

FWIW, you can run Splunk locally, so no cloud required. @Jonte uses syslog data to capture monitoring data - instead of SNMP (or REST/API) which is why it's pretty complete set of monitored things. Unfortunately, the log parsing is done via Splunk in @Jonte's approach... so not so easy to use Graphi...

Amm0

I'd add that if it's only some units... I'd make sure the RouterBOOT and LTE firmware matches, if you haven't already. RouterOS used to support a "/system routerboard settings set init-delay=5s" to delay LTE. I know the option is not on ARM, and docs support only RB9xx but might be worth c...

Amm0

Those do not support LTE or 5G in US.

And there are NO 5G products in the line-up that have support for US bands. Closest you can do is the US variant of the LTE6 Chateau, and that one does not do AX Wi-Fi.

Amm0

AFAIK, it's an LTE antenna, and there is no Wi-Fi*. So if you want to make a PtP link OVER an LTE network, you can do that. But you cannot just use two SXT-LTE6 without some LTE network. In the US, you can use LTE Band 48 to create your on LTE network, but you need a eNB/etc hardware for that & ...

Amm0

Okay AMMO how does your router send you an email when your WAN goes down ;-PP

Well, if you have multiple WANs.

Amm0

But as I understand it, this mode is not compatible with wpa3-psk? Is there any example of how it is used? To use PPSK... you set "multi-passphrase-group" on a security profile, which will then use any password+vlan-id combo add'ed under /interface/wifi/security/multi-passphrase with the ...

Amm0

I too wish there was a long-term channel, since I too like more time after "stable" before upgrading production things... since sometime "stable" isn't quite stable. But I suspect your #3 problem isn't going away, since they have changed some of the permissions scheme (i.e. some ...

Amm0

For the uninformed, does this mean it's possible to get the modem to function? I did have it working and then I shelved my wAP-R however when booting it back up it stopped working, the interface showing up as "inactive". Not sure if I've broken something or if something has changed on ROS...

Amm0

My apologies for the late reply. I don't know why I don't get notifications. Some times the turtle wins the race. I believe 7.17rc (which is likely going to stable soon) has some new SNMP attributes – although I have NOT tested it. I maintain a webpage, https://tikoci.github.io/restraml/ , where yo...

Amm0

What I don't get is that they added the serial port to the L009.... but not the 5009. Odd decision. (Just saw this today on a L009 I was installing in a rack.) The RB5009 came out before the L009, so I'd like to think MT learned a serial port is still useful ;). Also the L009 is a replacement for t...

Amm0

You can if you want... it's on the "zt1" instances, so it applies to all connect ZT networks that use the instance. Theoretically, changing the default likely make ZT hole punching scheme go through an extra step internally, but cannot imagine it be significant.

Amm0

So your have a Mikrotik router, it has one port going to some switch with 2+ devices with same IP and subnet? If each device with the same IP was connected to a different port on Mikrotik router, the duplicate IP/subnet is solved by adding an interface to route, in which case only a src-nat be neede...

Amm0

I believe you might be able to but not an easily. First, using wg-export is wrong - that's going to replicate the entire wireguard config... While what I think you want to do is make the router2 as peer to router1's BTH. So you need to create an additional BTH user ("shared user") via app ...

Amm0

Cheapest is a CHR in a virtual machine. They have a free trial. And you can also use bigger tools like GNS3 to emulate multiple routers. If you want hardware, all the routes have same features including BGP/OSPF and certainly VLANs, so even a hAPaxLite or new "refresh" hEX both let you tes...

Amm0

If you open a feature request ticket, sometimes MT will say something to effect that it will be in the next release...

Amm0

Peplink does not use MPTCP to do WAN bonding. While possible to do same WAN bonding using subflows and proxy, the standards around MPTCP aggregation are all about client-server communication, not networking bonding. And, I'm not sure there is too much value in /tool/fetch being MPTCP aware which is ...

Amm0

Up.

Also, is there a more official forum for feature requests? I don't want to submit a service ticket just for a wishlist item.

If you go to help.mikrotik.com, there is a category for feature requests. Stuff like adding a setting like MTU on VETH seems like a fair request.

Amm0

And seems unstable today, with a lot of HTTP 500 errors & 1200+ active users shown now....

Amm0

Perhaps the issue is the ICMP check uses more data to decide up and down, like latency and %loss. If you're not using those... use "simple" as the netwatch, which also uses ICMP but only fails if a ping fails above timeout. The ICMP check will fail on a lot of things, which can create unex...

Amm0

change the 9.9.9.9 route's distance to 1, the dhcp one is not used since 0.0.0.0 routes to 9.9.9.9, which then routes to 192.168.168.1 - why it's called recursive routing: it goes through the route table twice. the one with distance 10 is in fact correctly not used/unavailable since a route with a h...

Amm0

For detection of failure of starlink... Three+ choices: 1. "check-gateway=ping", see https://help.mikrotik.com/docs/spaces/ROS/pages/4390920/Load+Balancing#LoadBalancing-SimpleFailoverExample & post my above To do this, you can add a script to the /ip/dhcp-client for starlink on hEX :i...

Amm0

Not @Amm0 but if I may, these are the issues I've mentioned a few posts ago. @BartKindtNZ - sorry just reading this. But @sindy offers better advice here. I put him in the "meticulous" category too :). I was trying to get you up-and-running in few steps to be able to test/tweak... but I f...

Amm0

Are we getting yet another offtopic monologue in the Newsletter topic? Yes. But highlights the need for better communication about their roadmap. i.e. If they giving up on the US market, that be good to know – none of new LTE products have US variants. The new cAPax+LTE is actually a nice offering ...

Amm0

I used Chatgtp for the following code however I cannot see anything wrong myself. VS Code with RouterOS (routeros) plugin cannot seem to find any faults during debugging too. Well, ":urlEncode" is not a thing, among other problems - like all the :execute may not be needed. But there a lot...

Amm0

Your APN settings from config don't look right. 0. Although it look like APN is wrong. Wth LTE, you should make sure the /system/routerboard firmware is updated too. In winbox, you can check this in System > RouterBoard and hit "Update". Also, that the LTE modem firmware is updated, which ...

Amm0

Agreed. But I'd point out that it will use any failover routes in main, but it take at least the DDNS update interval time for it to failover to 2nd WAN. BTH and WG both get complex when you want to use a routing table or PCC, instead of main. So using a more frequent update in /ip/cloud will quickl...

Amm0

Also, if same config works in 7.16, but does not work in 7.17... that be worth a ticket to support@mikrotik.com - ideally with a supout.rif for BOTH 7.16 and 7.17 since the supout.rif will have logs etc and your config for them.

Amm0

It's the "failed" on the ZT instance that is pretty odd. It could be a bug since I believe they updated the ZeroTier version in 7.17... But I have 7.17rc3 running on several wAPacR and RB1100AHx4 and ZT seems fine, so dunno exactly. You can also try to limit ZeroTier to just the upstream i...

Amm0

You'd have to post your configuration as the defaults should work to allow ZL1 tunnels. But you might try downgrading to 7.16.2 to see if is in fact an issue in the 7.17rc.... When you wipe the router... are you upgrading the firewire in /system/routerboard? Did you use something like "/system/...

Amm0

Another newsletter... still nothing for LTE/5G that works outside EU, no Audience AX, no mixed voltage PoE switches, no devices with LCD & nothing more in the RB5009/L009 form factor. Disappointing year in hardware offerings IMO.

Amm0

There are a lot of places script can live (PPP, netwatch, dhcp-client, dhcp-server, mqtt, etc. etc.). The message does mean some script is broken. So million dollar question is there any script that's enabled, someplace – that why everyone want to look at config. But at some level, I think opening a...

Amm0

All true @sindy. I do normally use VRRP on the LANs, so forgot the ICMP would further delay "fail-back". My generalized worry is always over-engineering failover so that itself produces outages, like here starlink should be pretty reliable, so failover should be pretty rare... So if perhap...

Amm0

It might help if you got the port number correct - it's 8123 not 8321. That's probably why you "can't access it" (whatever that really means). LOL, yeah I didn't check that part... But Mikrotik's instructions for setting up HomeAssistant put it on a seperate bridge, so .local like also ma...

Amm0

There are few ways to design this.... But, if you want something basic without VLANs or "passthrough".... I don't see harm in leaving the hEX as is, and then put the SXT on the hEX LAN. i.e. assuming all have default configuration, the most basic failover be to: - set the ip address of SXT...

Amm0

4- Your base problem here might be that you are not aware a bridge has multiple personalities as explained in this thread. IMHO: heavy stuff, may take several readings before you really get it and I will admit I still don't get it completely myself. RouterOS bridge mysteries explained While that's ...

Amm0

HomeAssistant has to be on the same LAN network as the browser for the .local name to resolve. This is because it use mDNS to "discover" the IP address, but mDNS require being on the same IP subnet to work. Mikrotik has a feature in 7.16, to enable broadcasting mDNS lookups, like homeassis...

Amm0

Anyone knows/heard of container roadmap ? Being able to display memory/cpu consumed would be great.

+1, to both a roadmap & per-container mem/CPU. I'd also add showing the disk usage of a container be nice too.

Ideally via /container item, than having to start the profile tool to see it.

Amm0

@slimprize - You can mark your top post as "solved". I don't think anyone cares too much about who solves... there are new puzzles in forum everyday. @anav - luck played a role too... since easiest case of failover is static IP as primary and DHCP as secondary, with the primary WAN gateway...

Amm0

Also, I think it is enough of hijacking this topic, better open new one for Xray in ROS container in "3rd party tools" section, since this conversation is gone OT. Or Mikrotik just add AmneziaWG and/or XRay containers to docs as examples and to test/fix /container support for them better....

Amm0

Usually when this ISP has been done, I have been unable to ping even the modem because it is in bridge mode and does not have an IP address. Yup, and then it should failover from the check-gateway=ping. All more advanced approaches do get real complex, so if your ISP is bridge (and most are), the c...

Amm0

I think, it's better to have separated roles.... RB must only be wired router. Personally, I'm not concerned by the nomenclature. So get RB5009 specifically having Wi-Fi may not be right in their name scheme, but some "hAPax4" in the RB5009/L009 frame be nice. As noted, IMO it's a common ...

Amm0

P.S. Propose them in ticket with optional :return for both blocks :) Yeah I already put that in the ticket: While I get idea of :onerror could be used in an :if statement (which docs highlight)…. But in reality it likely be better if :onerror always returned :nothing unless an explicit :return was ...

Amm0

Also, on the failover. As configured now, it will only use the 2nd WAN if the cable to 1st WAN is unplugged/gateway is turned off. Since it's a static route, it will use that regardless if packets arrive anywhere. One easy improvement is to change your: /ip route add disabled=no dst-address=0.0.0.0/...

Amm0

The distance is 0 for LAN/subnet specific routes, not the internet. So if 192.168.88.200 wants to talk to 192.168.100.100 etc etc, that what would use the distance=0 ones. These route are automatically created (thus the "D" in first column of print) by adding /ip/address (or IP address add...

Amm0

Well, the L009 does not have 5Ghz, so that's not quite an AP either... More devices in the same form factor be good. So +1 here... In ideal world, I think there should be some "stackable" solutions using the RB5009/L009 as "blades" to be able to use all the various RouterOS featu...

Amm0

Yes, that's was my thought. No need to have mandatory return value when is not needed while handling error or when processing in={} . I filed a ticket on this (SUP-174412), since something isn't right here IMO. With a simplified example: # corrent per docs, but still weird: :put [:onerror e in={:re...

Amm0

I agree for consistent behavior for block returns. Also if block has no :return command, then :onerror is should return :nothing so that :return command is optional in blocks. 100%. I just thought the do={} part was consistent, was my error here. Personally, :nothing be best from both do={} and in=...

Amm0

Actually :onerror returns value from do={} block if executed when error occurs or false if no error. This is not correctly stated for :onerror command in doc : ... :onerror can return false (if there is no error) and true (if there is an error) values, so it can be used in :if condition statement s...

Amm0

The whole VLAN stuff still s*cks! Any reasonable WiFi network has the capability to assign a different VLAN to each client either via RADIUS or via access list rules. While perhaps the older ac chipset cannot directly handle VLAN in hardware... the whole idea of RouterOS is these hardware differenc...

Amm0

One man's bug is another man's feature... so IDK. My view is the operators are also functions, so they return values. In the case of [:onerror], it returns a boolean if there was an error (false = no error/do={} run / true = error inside in={}). Since :onerror returns bool if error.... that means th...

Amm0

Now, how do I add another gateway? Let us assume that it will be on ether4. I suspect the first thing I will have to do is to remove ether4 from the lan list so that the dhcp server does not give any IP addresses on that port. I will need to add a default route with a greater distance but I am not ...

Amm0

Agree with the sentiment here – Mikrotik PoE support is all over the place & poorly documented. While the RB5009/L009 form factor is great, there really is no "PoE switch" in this form...

But the L009 is a replacement for the RB2011, not the [old] HexS, per se...

Amm0

This kind of log entries are vague, as seen here: https://forum.mikrotik.com/viewtopic.php?t=209998#p1093607 but the Mikrotik support should know what "net" is (or is supposed to be) I think my grip is forum is beating up OP, when Mikrotik's log message is shitty — these "executing s...

Amm0

Log files do show something is running, no ? And that part is defined ... in your config. Exactly, the error message tells the story. There is not a "net" service that runs scripts AFAIK, why this one is odd.... Now perhaps the config has something strange, but if MT ask for a case, that'...

Amm0

Although I agree I'm not sure what "net" means – that's not one in docs, google or forum.

But I do think folks would like review your config to double-check — as that the most definitive on what should happen. See:
viewtopic.php?t=203686#p1051720

Amm0

Which is why we need at least some info on what script is running and how.

Otherwise we are all simply guessing.

It looks like a bug IMO, since there is no RouterOS service that run scripts that's called "net".... I just hope OP did attach the supout.rif for Mikroik.

Amm0

In fairness to OP, the question was about the log message, not a script error... In the error message: "executing script from XXX failed. please check it manually." the XXX is normally something like "scheduler", "netwatch", etc.... So I too like to know what "from...

Amm0

When you connect to the routers Wi-Fi on iPhone, and using the router's IP address is that what is not does not working? Or... is it the neighbors view that's not working? Also, you do NOT have /ip/dhcp-server/network... So check if you're getting a valid IP address on the iPhone in the same subnet....

Amm0

From the router, you have /tool/fetch mode=sftp (or =ftp):
https://help.mikrotik.com/docs/spaces/R ... 8514/Fetch

Otherwise from Linux/etc, scp will work like ssh. But AFAIK there is no scp from router to another device.

Amm0

I think a diagram would help. And describing what problem you're trying to solve too. I have no clue from your description.

Amm0

Set:
Code: Select all
/disk/settings/set auto-smb-sharing=no auto-media-sharing=no 
[...]
ip/smb/print
enabled: yes
status: enabled
domain: MSHOME
comment: MikrotikSMB
interfaces: brg-lan

Did you try /ip/smb/set enabled=no or /ip/smb/set enabled=auto ?

Amm0

Well... If your using Google or Cisco OpenDNS as your DoH provider... Those will go out the canary routes in your recursive routes.

Amm0

I luv it, I think MT should send you some swag and use it on their christmas show!! Holvoe is just not in the Xmas spirit yet!!! I thought the goal with wAP was it that it's more subtle than a cAP – but adding stickers only draw more attention.... But I am supportive of some groove boxers for the e...

Amm0

Yeah I'm not sure the "best way" here... I think parsing the /ip/route and the intermediate gateway value, and then looking up /ip/address based on what was found+parsed from /ip/route is kinda the only indirect way to do this. Could be wrong, maybe someone else is smart here... Another ap...

Amm0

Uh ?? cAPaxLTE12 PDF shows PoE passthrough. But no 2nd 5Ghz radio, doesn't sit on a desk/shelf/etc, and another 4G EU-only modem... Also, there was another thread after mine showing a new KNOT, ATL, and some "LMP 5G": https://forum.mikrotik.com/viewtopic.php?t=213245 It's actually quite f...

Amm0

I think the users view is from TWO CLI commands: /user-manager/user/print /user-manager/user/monitor So it's a PITA/complex... But you store the "print as-value", then :foreach over it and run monitor on each users to get the total-download, etc stats to add to the array from print. So som...

Amm0

Another approach is for Mikrotik to make miniPCIe (or M.2) with Zigbee/802.15.4/BT/etc support. They do this with LoRaWAN models, so then any existing model with expansion slots can be enabled for LoRa, either at the factory (like wAP-LR8) or by user.

Amm0

~ is for a regular expression, not an array...

So you can use a string with a valid regex like:
:global abc "youtube|google|amazon"

Amm0

How long did it take for wap AX to come out ? Well, the wAPac also had LTE variants – which have not come out... I just don't want the same thing on some Audience AX, since our use case generally involve having LTE/5G. And they've done nothing for the US market. Basically everything lately has take...

Amm0

FWIW, The topic of YouTube blocking comes up often. But I don't think I've ever seen anyone use kid-control for it. It be curious if you report back on success/failure, since it's always a hot topic. While docs are unclear how kid-control is getting activity, I have to presume it requires forcing us...

Amm0

Everyone likes the Audience, at least since first wifiwave2 driver. I just ordered more, which had me checking the FCC, and thus this post. It's actually the vlan assignment in AX drivers that bigger issue for me than AX specifically & some better antenna design for LTE/5G (since it doesn't even...

Amm0

First, a sanitized config may help to know where you're starting. While you can add a VLAN in a few steps to separate out devices, you may want to consider what you exactly mean by "trusted" and "untrusted" & if "untrusted" devices need to use some kinda broadcast/d...

Amm0

One of the better Mikrotik devices is the Audience – especially with newer wifi-qcom-ac drivers. Yet, all the other models have been "refresh" & no sign of newer Audience on the horizon (i.e. based the FCC filing). My main grips in current model (specifically Audience+LTE6 model) are: ...

Amm0

Couple of things: 1. the "find" gets returns the ".id" attributes for any matched results to activity~"youtube" - so $ipaddrs should be a list of *xx values - so that right 2. but... using "get <id> <attribute>" is valid form, but it's just a shortened version...

Amm0

Good to hear. It's a bit confusing at first... FWIW rules run from top to bottom, first match wins. So when you create a broad rule (i.e. all traffic on an interface), it does mean send ALL traffic, including local ones, to the specific routing table=. Why adding your local routes as rule to "m...

Amm0

I think your missing a /routing/rule that says traffic NOT to internet should use "main" routing table (i.e. the 0.0.0.0/0 route, which is represented as min-prefix=0). This rule should be list FIRST - before the WAN-per-interface route rules - otherwise local traffic is ALSO route to WAN'...

Amm0

I guess it should be something like this, but I don't use kid-control so cannot test

:foreach ipaddr in=[/ip/kid-control/device/find activity~"YouTube"] do={
     /ip/firewall/address-list name=ytkids timeout=1h address=[/ip/kid-control/device/get $ipaddr ip-address]
}

Amm0

I'm with @anav here. @normis you have to realize you come off as insulting to your users sometimes, including me. the name literally includes the word "home" There was an incident, and it's "blame the user"? And that "home" in name means unreliability? Most vendors ofte...

Amm0

We depend on this service for critical operations, so having a reliable alternative or knowing when it will be restored would be greatly appreciated. Universal solution would be for Mikrotik to implement DNS RFC2136 support allowing dynamic record updates to *any* standards compliant DNS server/ser...

Amm0

Since DDNS going down is an ongoing issue, I wish Mikrotik would provide a website that informs people about what's happening. The website could possibly include an ETA.

Perhaps they need to start with a pager for someone... They don't seem to do well with issues in middle of the [Riga] night...

Amm0

Not alone, this incident seems to be tracked here: viewtopic.php?t=213191

Amm0

Yup, seems down.

And also means BackToHome (BTH) is down too....Just tried enabling on a router and it gets stuck at "allocating endpoint"

Amm0

yeah the first thing I do in every config is blow up capsman and obliterate IPV6. They are like parasites that drain my energy ;-) LOL, I know your thoughts there & BTH does use IPv6 - why I highlight that detail ;). Although I suspect OP running into the WG+multipath "issue"...

Amm0

You might want to post your config. By default, port 25 is allowed outbound.

If your added rule to block outbound 25 is after an "accept", that could be the problem.

Amm0

Yeah config going to be needed here. One additional consideration, is if you have IPv6 enabled, BTH will use IPv6 if available. This may or may not be expected, so might want confirm in /ip/firewall/connections and/or /ipv6/firewall/connections to see... RouterOS comes with IPv6 enabled, but sometim...

Amm0

@ammo, Agree, in concept... But the problem is often "sync everything, except..." - with except part making it tricky. sounds like a developer having a tough project because the customer keeps changing his mind?? 😅 I spend 20+ years in software engineering, so I'm a bit sympathetic to Mik...

Amm0

- Does RouterOS allow you to fully disable multicasting? LLDP? STP? By disabling I mean killing the services and not have any processes listening on respective ports or just not having processes running at all. It would be even better to be able to completely remove related packages via CLI! You ca...

Amm0

DNS in a VRF still doesn't work... 7.17rc2 As explained already before, setting VRF parameter allows to listen for DNS queries in a VRF. Feature to connect to remote DNS servers via VRF does not exist yet. That detail should be in the docs, not just this beta thread, too: https://help.mikrotik.com/...

Amm0

I had to make a meme about it. But seriously. Thank you. I'm all set for what I needed. I hope someone else gets some value from this thread. LOL. A bug report to support@mikrotik.com on the user+1000w not working might have been more productive ;) - as I'm pretty sure the user+100w stuff is broken...

Amm0

I guess I don't understand, since it just bytes per "kid" AFAIK. So if you want to add the IP address of some kid to the address-list based on traffic volume, not site. I've never heard of kid control doing anything with content filtering, so really not sure what you're after. Do you have ...

Amm0

You may need to enable the RTSP firewall helper for the IPTV. But if your using Spainish Movistar IPTV... I believe there are some issues IGMP proxy that block that from working. Also EOIP with WG is going to reduce the MTU, so I'm not 100% sure the IPTV packet fit over the lower MTU....so that may ...

Amm0

Well, now you have me more confused. Kid control does not do blocking of sites, only controls access by time. RouterOS is poorly suited to do content filtering. So, even in terms of scripting, I'm not sure what your what your trying to gleam from /ip/kid-control/devices since it just what "kids...

Amm0

You'd normally use a script on the /ip/dhcp-server to do this, in which case "print" is not involved, only "/ip/firewall/address-list add ...", see "lease-script=" under https://help.mikrotik.com/docs/spaces/ROS/pages/24805500/DHCP#DHCP-DHCPServerProperties Is there som...

Amm0

You might try setting STP to "none", as you could something could be going into a blocking state during the configuration process. But otherwise it looks right to me... Also, in 7.16+, it's safe to set vlan-filtering=yes when you create the bridge, as the default bridge/ports all use a &qu...

Amm0

Would clients running WireGuard (such as Windows clients running official WireGuard NT) be able to pull 700-800Mbps on Chateau AX Pro? I don't expect such throughput when running WireGuard on router itself, but fast PC's with WireGuard NT should be able to achieve such throughput. Well, if WG is ru...

Amm0

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list. That would be for remote user access to the config of the router, I thought he was asking for access to the LAN subnets...... Now that I look, correct. But I read the OP as ...

Amm0

Mikrotik has a secure boot options (/system/routerboard), "locking out" features (and flagging) via /system/device-mode , and RouterOS packages are all signed. RouterOS does not use Linux standard GNU tools, so the split between kernel and user-mode is pretty abstracted by the CLI & th...

Amm0

they?

what video?

Probably one of @dru's videos on scripting on YouTube. Although he's pretty good about using the name in other places, https://youtu.be/2WsFhkLVaMY?t=254

Amm0

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list.

Amm0

Normally "AP" are strictly AP's.

Perhaps, but I've seen "router features" (e.g. NAT to internet) on most other vendor "APs" (outside perhaps UBNT).

And, in Mikrotik, all APs are routers running RouterOS (at some license level, which may limit things too).

Amm0

I am not aware of the address range used, so you are saying it starts the first one given to the admin on his smartphone as 192.168.216.2 and the next .3 and so forth.

Yup, admin/"1st user" is 192.168.216.2, and any added BTH users/"2nd+ users" start at .3, ...

Amm0

@Ammo: does this sound right. Challenge: Allow BTH users to go out internet and LAN. a. Establish BTH network with 5 users plus admin b. Do select NO for lan access initially --> I have a reason. :-) Go to /ip/firewall/address-list and copy down all the user Ip addresses. c. Unselect NO for lan acc...

Amm0

I'm more curious what underlying problem got someone to think concatenating an actual variable name is the solution...

Amm0

Just use a 2nd variable.
But this is not what OP ask: concatenate variable names

Well I'm not sure OP was very clear.

String interpolation get's tricky with variables and numbers... i.e. "$($var123)456" syntax isn't entirely obvious too.

Amm0

@Amm0, Yup, but a default route in main is sufficient to meet this requirement. Also, I'm pretty sure that statement in the documentation is a simplification the author has used to avoid the need to explain that this requirement (for some route to exist in main ) is only related to own outgoing tra...

Amm0

Agree, in concept... But the problem is often "sync everything, except... " - with except part making it tricky. For example, the src-nat or dst-nat might vary in a VRRP setup, while all other firewall be same. How to express that in config, IDK.... I guess IMO VRRP isn't special in the ne...

Amm0

Just use a 2nd variable.

:global hello 123
:global hello2 "$($hello)456"
:put $hello2

123456

Amm0

i just used as a bridge can you explain me step by step i can ping in mikrotik router ether1 to 8.8.8.8 but lan out not working Bridge works and likely want you'd want, essentially like a MACVLAN so RouterOS get's own MAC address. It's "host only" that is unlikely useful in any case. Alth...

Amm0

Ah, you want to register any DHCP lease in DNS... I believe you need an else={ ... } in the :if ( \$leaseBound = 1 ) { ... } statement for the "expired" case. Or, add another :if ($leaseBound = 0) do={} work too for expired dhcp leases. But your bigger problem is likely that /tool/dns-upda...

Amm0

I know we had a similar topic a while ago, but here there are some more specific questions. [...] As there are a lot of standards for managing network devices (https://xkcd.com/927/) my suggestion is to KISS and use whatever is there already - ansible for those who can code, API for those who can u...

Amm0

[...] If I use the brief option, as suggested in this thread, I still don't get the HOST-NAME column. If I use the detail option, I get the full hostname, but now the output is in this multi-line stanza format that I have to parse. What I really want is the IP address and the hostname and nothing e...

Amm0

Re macvlan, it might be useful in some cases... but adds more complexity if it's not actually needed was my point. you cannot just add a route to routing table unless same route exists in the main routing table Can you elaborate on why should doing so be a problem? The docs on Policy Routing have on...

Search found 4958 matches