MikroTik

Amm0

The RB951 does not support containers, but running the Cloudflare container be best way to get traffic to the Mikrotik. You can create a dst-nat in /ip/firewall for the port to enable port forwarding. Since the FQDN point's the router IP, that's all that's technically needed. Your relaying on the se...

Amm0

The RB5009 / L009 format factor is a winner. Mikrotik promised a "series" using same form factor in an older YouTube video. It be nice to have a switch to be able to combine multiple RB5009 in same rack. The one SFP is pretty limiting. Now I personally wished they had an "accessory&qu...

Amm0

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions..........

Or, Mikrotik fixes their implementation to work like the rest of RouterOS.

Amm0

*) implement opened windows list

Thanks. One subtle thing is the "keyboard help" shown at bottom should use the platform-specific terms for "Alt", which on Mac be "Option" or the ⌥ symbol.

OptionNotAlt.png

Amm0

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups. It's not trivial. Mikrotik has plenty of users that use iBGP/OSPF/etc. One could also equally argue that Mikrotik focus on hom...

Amm0

Nope.

But they don't say version etc, so yeah compatibility might be tricky but dunno obviously... So worth a ticket.

Amm0

@mkx is correct, RouterOS basically uses the Linux kernel, but not the Linux tools. So AFAIK there is only the hardware encryption with OPAL that is support. You can file a feature request at https://help.mikrotik.com & see what Mikrotik says. They have been adding things to ROSE, and some softw...

Amm0

Wow lots of ways to do this. I was answering the scripting question, since I figure your trying to learn scripting. But I too was not sure what you're trying to do.... If you have a "backup WAN"... typically you'd put a script on the "primary WAN" DHCP to change the default rout...

Amm0

It can be inside {} but NOT between attributes, which else={} is actually a property of the :if.

Amm0

At least one problem is the comment in the :if - else= is an attribute and you cannot just insert a comment in-between (i.e. the "# Else at least one such route exists") If you paste in into CLI, it show you where the problem is too. Or, even syntax checking in /system/script/edit which sh...

Amm0

That is a script for /ip/dhcp-client. $bound does not exist in /system/script.

Amm0

That's an odd one. Since you're saying allocating more memory helps, I guess it's possible if there is a new driver that allocates some memory buffer. The docs suggest : The minimum required RAM depends on interface count and CPU count. You can get an approximate number by using the following formul...

Amm0

I do prefer winbox v3 but I am afraid that in the future I will not be able to use Winbox v3 anymore because newer RouterOS will not support it anymore, meaning I will be forced to not update my routers, which I realy don't want to do Mikrotik could comment on this.... But that may not necessarily ...

Amm0

Actually AMMO, you can use a single wireguard interface, and just use a different IP address schema for the road warriors, if you need some granularity over firewall rules..... Yeah that's true: different peers + subnet is enough for firewall. A different interface only adds using the different por...

Amm0

Have you consider just using a dedicated subnet for the WG between site A and site B, then using normal routing (/ip/route) instead of WG's allowed-address to handle routing? Also, I don't know if you control the IP numbering (i.e. if the sites are operational)... but using a 10.<site>.<vlan>.x for...

Amm0

I would have thought that would have worked...

You can also be explicit to disable SMB:

/ip/smb/set enabled=no

(the default is "auto" AFAIK ... but I'd thought the /disk auto-smb-sharing=no mean auto in /ip/smb be =no)

Amm0

It's closed source, so you cannot diff the modules. But you need ROSE installed for encryption support, and drives need be Opal complaint: https://help.mikrotik.com/docs/spaces/ROS/pages/259031065/ROSE-storage#ROSEstorage-Self-EncryptionDrives Does this encrypted disk mount on another plain Linux sy...

Amm0

It is the user space applications' duty to then fill out the source address (see https://blog.cloudflare.com/everything-you-ever-wanted-to-know-about-udp-sockets-but-were-afraid-to-ask-part-1/#sourcing-packets-from-a-wildcard-socket). That's a good article, which likely explains roughly what's goin...

Amm0

Have you consider just using a dedicated subnet for the WG between site A and site B, then using normal routing (/ip/route) instead of WG's allowed-address to handle routing? Also, I don't know if you control the IP numbering (i.e. if the sites are operational)... but using a 10.<site>.<vlan>.x form...

Amm0

Good to hear, it did seem like the firewall. I just thought there be a good chance you both had the default firewall & the loopback rule be in the right spot. Without config, guessing isn't always 100% accurate :). If you're only use FTP for the copy... you might consider restricting FTP to just...

Amm0

It's roughly the same as this issue: viewtopic.php?t=205278&hilit=wireguard

Wireguard, for some unknown reason, is not treated the same as "locally generated traffic". So pref-src= is I'm guessing a similar victim.

Amm0

So in summary, its transparent to the end user, and hence why both apps can be used.

Yup. Just WG peer, with special DNS name.

Amm0

Also, since the RB2011 lives behind the starlink connection and the unifi gateway, I think double nat is going to be an issue. I dont want to have the RB2011 as the main gateway. I think that having it hosted somewhere else might be a better option. Perhaps, but if the starlink is going to UBNT &am...

Amm0

Anyway, I still use the Automatic address acquisition which works fine without any issues. Just to be clear, you shouldn't need /ip/route or /ip/address if you using DHCP client. I was trying to explain how to set them IF you were NOT using DHCP client. But if a WAN has DHCP, in most cases that bet...

Amm0

Yeah the 40Mhz on 2.4Ghz always seemed silly to me. It the 5Ghz band where I just never/rarely seen anyone recommend/using 20Mhz (or even 20/40Mhz). And have wondered if either I'm missing something about AX thus the initial question... Seems I'm not alone. But do think using default 20/40/80Mhz cha...

Amm0

Well, BTH is actually useful for LTE for a router-to-router WG with a CGNAT. This is use case @normis does not quite get with the "always use app" approach, and why I persist in explaining it since regular WG will not use BTH's "relay" server hosted by Mikrotik to deal with hole ...

Amm0

Or some cheap VPS in the cloud and install CHR on it, then use that one as pivot point for all Wireguard connections ? Shouldn't be too expensive ? Anav always claims it's about 7$ / month but I don't know what supplier provides it. I don't use it but I know some folks use https://www.vultr.com/pri...

Amm0

I am working on that bit ( improving docs ) and is why I am being nitpicky in my understanding. I forget, where do the firewall rules show up that allow a USER to access the WAN and possibly the LAN??? On firewall, there is an address-list named "back-to-home-lan-restricted-peers" in /ip/...

Amm0

You know its very annoying that your right ;-) Can we agree to blame Mikrotik's docs? :) BTH is actually pretty elegant since it really just uses DDNS to determine if proxy is needed, but always still plain WG. The docs are just bad (overly complex for simple case & not enough info for someone ...

Amm0

@holvoetn is right, Back to Home is what you'd want to used for Starlink. I went to check the docs, but The Dude interrupted me, but he says the RB2011 does not support Back to Home: Dude RB2011 BTH.jpg You can use plain wireguard, but one side requires a static IP. So another option be to enable a ...

Amm0

Yup. App is not mandatory, as EVERYTHING can technically be done using RouterOS winbox/CLI alone. As @normis suggests, the app may be easier. Although just enabling BTH under /ip/cloud is not very hard either (i.e. it's a radio button, which enables BTH & gets you 1st WG client, and then with &q...

Amm0

Not sure what you mean. If a user (not admin) uses the BTH app to setup a BTH tunnel after receiving the QR code, or URL link or export config file generated on the admins smartphone, then the user access is done through the BTH app, not the standard wireguard app. That why the app is more confusin...

Amm0

None of these give any reason why using 40MHz channels on 2.4GHz band would suddenly become a sane thing to do. That one I've never got either. I actually been using 20Mhz on both on most of the AX devices we use. I just NEVER see anyone recommend narrowing channel width for AX... which got me ques...

Amm0

The ROUTER initiated client peer, ( the one that should go on the admins smartphone ) can, via Managed Shares, create additional peer clients to the same router. The client peers (second created to infinity) CANNOT create additional peer clients. They are not equal..... Now I get the confusion. The...

Amm0

Could you check my port forwarding rules please? Although I follow the same way of opening ports for applications that I use, I still have problem with a few and I don't really understand why. Moreover, I have never been able to open any with UDP protocol. Does it need anything else? You shouldn't ...

Amm0

@jvanhambelgium: Hmm, I didn't think of it like this just to be fair. The ISP didn't instruct me to do anything, as I had always in my mind that static IP doesn't need any DHCP client to be enabled. It seems that I was wrong then. You're missing a default route in /ip/route for the gateway. To use ...

Amm0

It's WG, so all are peers. The app and /ip/cloud just always create ONE peer upon enabling it. If you need more, you need the "managed shared" (or /ip/cloud/back-to-home-users). On the "shared" ones, there is the additional option to allow-lan= so that the only difference AFAIK. ...

Amm0

For years of Wi-Fi, the general recommendation is avoid large channel widths unless the spectrum is relatively clean. But I've never seen that recommendation for AX devices. I know AX uses OFDMA to better handle this and large channel widths are needed to get "max speed". But most of my us...

Amm0

Why you do not download and save already the file on correct place instead of download on another place?

Fair point!

But given MT's recent focus on NAS things... some "copy" and "move" are still missing, which results in these kludgey solutions like FTP+fetch.

Amm0

Try using localhost as the IP, and make sure 127.0.0.1 is allowed in /ip/firewall/filter (and recent defaults generally allow it). While could a be a few things why this does not work... firewall blocking it be 1st to look at. Also note that in 7.17, if you're downloading RouterOS packages to instal...

Amm0

You may need Part 15 for other reasons. IANAL, but just using different antennas may fall under the FCC's "permissible change" stuff. But imagine Part 15 certification be cheaper than lawyers arguing about FCC rules. ;) They've just required that the radio be put in a mode where it transmi...

Amm0

I also understand that once folks have accepted the qr code on their smartphone app, or wireguard client app (laptops), etc. the results show up on the associated MT Routers IP Cloud tabs ( users ) and can be configured further if required ( add access to subnets, delete, and probably other options...

Amm0

anav:1 ammo:0 ( but whose counting) Except I'm not wrong. All BTH are just WG peers, and have QR codes. So just like any other peer, don't use the same peer twice. The advice to first one (/ip/cloud), applies to the shared ones too (/ip/cloud/back-to-home-user) - don't use them twice as they have a...

Amm0

You're not using an external disk. You might want to try setting root-dir=usb1-part1/pihole or whatever path you have (noting that paths do NOT start with / in root-dir=). Perhaps PiHole is small enough for flash, but IDK.

Amm0

Impressive you got something working here! Another poster was trying to use Hotspot+WG to do this (https://forum.mikrotik.com/viewtopic.php?t=205625&hilit=hotspot) and that approach didn't work out so well it seems... But +1 - MT should have some way to directly integrate User Manager into WireG...

Amm0

there is a "REST API" Better ? Sure, your commentary here is 100% spot on: If you find yourself needing a control plane for your routers’ containers, you will likely need to write it yourself. And it is kinda pedantic, but complex/hard is different than impossible ;). MT has mentioned &qu...

Amm0

That's a good question... I'm not the expert on the CRS326, and haven't tested Dante with it.... But same DSCP marks should work on a VLAN with Dante, if VLANs were setup AFAIK. And you want one bridge, see https://help.mikrotik.com/docs/spaces/ROS/pages/30474317/CRS3xx+CRS5xx+CCR2116+CCR2216+switch...

Amm0

I guess my first concern would be the topology of the links. Specifically if you're planning on bridging or routing the various links. The bandwidth and router are more easily swapped than not having a good architecture to start. For PTMP (APs<->CPEs) and PTP (APs<->Stations) I will use Ubiquiti. An...

Amm0

I've updated my Container Limitations article to cover these latter details. I chose not to address the topic's primary question since you can cause this same port number conflict under Docker and Podman, too, most easily by giving the --host flag. I can't justify calling this a "limitation&qu...

Amm0

Following all the v7.17 topics, between various complaints, it's not clear what are the know issues.

Agree on known issues for beta, but by "rc", ideally there shouldn't be any.

Now device-mode does deserve "top billing" with the !) since it changes behavior...

Amm0

Yeah the mounts can be tricky. Especially since RouterOS only allows mapping directories, not files. In a full-featured container engine, you have to do both, but now that you mention it, yeah, container.npk ignores the EXPOSE directive, doesn’t it? Nope, EXPOSE does nothing. Now ideally it be good ...

Amm0

As I said, the docs are not very clear. But end of the docs does reference the commands. The wording at top of docs should be changed IMO. In other words, the router itself can only generate one setup via BTH, the rest have to be done from the Admins smartphone. Just waiting for NORMIS to confirm! B...

Amm0

In 7.17, the difference becomes even less since webfig looks nearly identical to winbox4. So main difference IMO is winbox can do Layer2 / MAC address, while webfig is Layer3/4 / IP only. With the native winbox adding a few extras like sessions/workspaces, and associated multiple windows. Did you wr...

Amm0

I think you need to change the NGINX config file to do this. I don't the EXPOSE has any effect. i.e. The DockerHub version of NGINX has a script that parses env variables to "passthrough", see https://hub.docker.com/_/nginx under "Using environment variables in nginx configuration (ne...

Amm0

Yeah I have same problem on at least one test router, and by "rc" this stuff should work... So I did open a formal ticket with supout.rif on this issue.

Amm0

The new webfig has a similar problem to winbox4 where that status/flags are very difficult to interpret. For example, LINK OK and NO LINK are radically different states - yet the only difference is the text inside. Screenshot 2024-11-22 at 7.31.57 PM.png Screenshot 2024-11-22 at 7.32.11 PM.png Being...

Amm0

Anybody give an OK for Hap ax2 running capsman, I wouldn't want my config to explode! You can try it without harm. Repartition the hapax2 with two partition, on part0, stay 7.16.1, copy that onto part1 and switch to part1, then upgrade it to 7.17. If it is messed up itself, you can switch back to p...

Amm0

No. The hAPax2 "dual use" PoE port is passive, but it does support 48V input.

Amm0

You get what you measure... First, I think Mikrotik should publish MORE stats in general. There is already a lot of conjecture on this WG vs IPSec performance, without any good baselines. On the WAG'ing, I'd be looking at how the bandwidth test is being running before getting into questions about I...

Amm0

Hi Ammo reading the docs there is only one qr/code one can generate from the router itself, the rest if I read this right, is that you can easily create and manage additional Qr codes and send them all from the admin smartphone. The docs aren't entirely clear, but the "share" ones should ...

Amm0

Trying to understand BTH some more. Is this correct?? Bizarre that I cannot do this FROM or AT the router ????? Did you look in /ip/cloud/print (first BTH user), or /ip/cloud/back-to-home-users/show-client-config XX (2nd or more BTH users)? But I just notice is under /interface/wireguard/peer in Wi...

Amm0

Is the traffic getting fragmented? i.e. Are you sure it's 1500 MTU both ways. The packets-per-second on the slow link in half that of fast one....

Amm0

impossible that webfig skin designer is broken in a RC release. There was another thread where someone else in beta4 had the same issue. I'll note that it does work fine on a KNOT running 7.17rc1, but I reset the default configuration with the first 7.17 beta on the KNOT. But on the RB1100AHx4, it ...

Amm0

In the new webfig, I'm not sure the skin designer is working. I cannot seem to figure out how to create a new skin. When I do a "Design Skin", it shows a blank list and I don't see anyway to select things. Either I'm missing something in how to use new webfig's skin support, or it just is ...

Amm0

I like the colorization, but that's it. Agree with @eworm, it should not be in an export. And not sure the "extra" comments are needed in winbox/webfig if it's already colorized (but the color is kinda handy).

Amm0

Utah and North Pole have spoken. Cloudflare or bust! @anav, I thought you'd like that pivot ;) And California be happy to take the tax revenue from Cloudflare. And, @wfburton isn't wrong RouterOS is pretty far from a "enterprise firewall". Installing Cloudflare's single exe tunnel in a NP...

Amm0

Probably best to ask Mikrotik, or perhaps Quectel. But for FCC Part 15, which you'd need to sell them, you shouldn't actually need any special commands. Now the LTE modem and various cell carriers are a different story.... that typically where you need the LTE modem into various test modes. So if th...

Amm0

This is turning into the IT version of Netflix doc "Don't F**k with Cats"... I'm not the expert but setting up DNS is just first step to setup Cloudflare proxy services, I think the purposal here is that HTTPS traffic go through a Cloudflare IP before getting to "real" phpBB. [.....

Amm0

There's no need to fake anything since there are no restrictions on anonymous access (tho creating a post is). Your suggestion might very well work, but it could end up being like robbing Peter to pay Paul. :D Perhaps. But if you're a guest... "user control panel" (aka /ucp.php) is an odd...

Amm0

Side note: one added benefit from this whole situation ... spammers have little interest the past days for this place. What I noticed during the weekend was most of the "extra guests" (perhaps faking being a bot) were visiting the "User Control Panel" page, under the "Who's...

Amm0

Some call it space-wasting, others call it easier readability because text ist not squished together. I'm not sure there are many folks who like the extra spacing... And @eworm is right, the comment has more space between the item it refers, than the next/previous item does. It's like the comment i...

Amm0

The first immediately useful thing I can think of would be running The Dude client in Wine on an ARM router (that's also running The Dude's polling package) instead of running it in a VM on separate hardware. But alas, no wine package exists for Alpine 3.2. LOL, see https://forum.mikrotik.com/viewt...

Amm0

macos big sur 11.7.10

Yeah that version seems to be a trend. But Intel-based with MacOS Sequoia does work without crash.

Amm0

Great work here! after starting you will get some permission errors (we will check whats going on) I've wanted to do same X11/RDP/VNC/etc approach for a while... but got similar permissions issues before. Now I've never tried the "s6-overlay" approach to "multi-service containers"...

Amm0

the thing is, putting the useful and inoffensive stuff (such as cpu-frequency, without overclock) behind the same security-group as some other "more dangerous" settings (boot to ethernet-only, disable reset) will incentivize people to "unblock" this, defeating the purpose of the...

Amm0

It took longer, as the biggest change was hard to implement - tree views. Now we will continue with the rest of the requests and ideas in this thread. The "tree [+list] views" did sound tough...but great work! It's actually quite an improvement over winbox3 in the Files view! And 100% sup...

Amm0

I think it's pretty obviously broken, and worth waiting to see in the next beta release.

But for next time you can add attachments to forum post using the "Attachments" tab in the "full editor", and then say "place inline" after uploading.

Amm0

Anyway, I'd be curious on the hearing the root cause from Mikrotik...
Won´t be all?

We don't know it wasn't some software update pushed by @normis late on Friday, that had some leak/etc that caused these issues....

Amm0

Like I said, I think it's broken. I had some issues you're describing, and under 7.17beta5

Maybe there is some interface trick I'm missing, but it ain't obvious.

Amm0

Most probably user error. I don't think so. 7.17 is radically changed. I have not been able to create a new skin, since it seems to depend on what in the skin's .json file. Now my test router had none. So I'm not sure you can add items to the skin in the beta, only modify - or at least that has bee...

Amm0

IDK, maybe it should be. It COULD be. I wasn't trying to argue – not wrong from a pure business perspective hosting might make more sense, especially if uptime and low-latency were a concern.... But for Mikrotik it would be a sign of capitulation. And implication that any small/medium sized busines...

Amm0

I have an example of using a function in a probe here: https://forum.mikrotik.com/viewtopic.php?t=192103&hilit=probe It does not use not function parameters, however. I just created multiple functions rather than take an argument. Reason being is I'm not 100% on how to correctly use arguments. $...

Amm0

I guess I'm saying Mikrotik runs VPN proxy (BTH) and /ip/cloud DDNS already. So some PHP should actually be easier than BTH to secure.....and why I present the question. As a data point, I ran a ping over the weekend, it was ~250ms from the west coast to Mikrotik/Lativia, with 1.5% packet loss – whi...

Amm0

Not be the contritaian. Why should some cloud solution be needed? Because this is not their core business. Their routers aren't the best bet to fend off heavy DDOSs - and they shouldn't: it isn't their market target. IDK, maybe it should be. I just don't buy that every publicly visible site needs t...

Amm0

Well this important advice, gets lost among the unnecessary invectives...

never use $ on :global, :local and :set

Amm0

Ah. This we agree upon: it's past time they shove it behind some Cloudfare or whatnot. +1 Not be the contritaian. Why should some cloud solution be needed? I'm pretty sure Mikrotik can fix this without 3rd parties. Maybe not. But Mikrotik's basic product pitch is nothing depends on the cloud. And I...

Amm0

This is nothing but a disguised attempt to decrease the use of this forum........

Or, Mikrotik is just hungover from their holiday.

Amm0

While cable cuts add some international intrigue and drama here... It does seem more related to application load, not network bandwidth.

Amm0

Yeah it's still flaky today. I see 1300+ users online.

Amm0

Are DoS attacks a holiday tradition in Latvia?

Still flaky.

Even worse.

Amm0

Still flaky.

The only question is: did Mikrotik pissed off someone, or is it just a bad programmed harvester?

LOL. That's my question here... I was kinda curious if newer/bad harvester, and not some attack. I guess it could be some attack targeting phpBB too.

Amm0

*) iot - added additional debug for LoRa logging; [...] *) iot - added new LoRa traffic FCnt packet counter parameter; On a positive note :). I have a KNOT with LoRa (+ 3rd party temp sensor) running 7.17beta5, connected to mosquitto and an old erlang lorawan-server container on RB1100 to run entir...

Amm0

*) webfig - status page is deprecated, old status page config will work , but can't be updated or created; A previously created webfig status page does NOT work , despite the release note.... I upgraded a wAPacR with status page showing LTE stuff, running 7.16.1 to 7.17beta5 — no status page is sho...

Amm0

A spike in session counts is usually a good indicator of a DDoS attack. Yup. I'd like to think it's still possible to self-host a 25 year old "web app" (phpBB here). i.e. without needing cloud services (AWS, cloudflare, Azure, etc.) or expensive enterprise security products. Perhaps not —...

Amm0

And it's still not working well...
There are not normally 1000+ real viewers on Saturday.

Screenshot 2024-11-16 at 7.07.53 AM.png

Amm0

[...] Edit: i just compared, the chain.pem from LE is the same exact file as the r11.pem. Looks like there's a bug in the certificate handling/import process on Mikrotik. [...] I recall that without the delays I had problems with this process... Maybe there's some race condition there? A race condi...

Amm0

It's using the R11 certificate, not same as other thread.

Consult the LE web page: https://letsencrypt.org/certificates/

Amm0

In those markets you don't assume your customers are idiots, which is what device-mode assumes. Device mode is direct consequence of exactly this assumption. LOL. Perhaps. But device-mode needs more "sophistication" than just physical presence test. I got similar problem as @sirbryan, why...

Amm0

To be clear — IDK why the forum was getting 500 errors / hanging — I more was trying to make a joke. Now, I did see the active users being 1500 or so - but that does not mean there was an "attack" per se. But it be nice if Mikrotik posted the post-mortem on the failure, since it might a le...

Amm0

I think Mikrotik is trying to prove the point about device-mode that DoS attacks are real.

Amm0

I'm not sure the VRRP address has to be a /32 when it's NOT in same IP subnet? At least in RouterOS 6, Yeah... I had a good handle on how this all worked. And on LAN side, all the same. But with V7, the effects of the new routing engine on VRRP is just not well described and subtlety different. Now ...

Amm0

Mikrotik seems to want to focus home users. So this trend is concerning, since disabling features is not root cause and shows a haphazard approach to security. Its my opinion the the Tik market is focused on small ISP, entrepreneurs, SMB's and the Home users who are enthusiast's ... In those market...

Amm0

How on earth disabling stuff like btest protects just anyone? Are there any documented cases of a feature missuse? no need to get agressive. yes, of course there is documented cases of misuse, even in this forum there are people who are asking why they have unrecognized accounts and unrecognized sc...

Amm0

Still bashing my head on a wall trying to figure out how to use a single WAN IP address for the two routers I have created. The easiest is to use private addresses in the "WAN VRRP", and then NAT out the real public IP. Basically, the VRRP IP address does not have to be in the same subnet...

Amm0

Who guarantees that yourself on the github do not insert commands that create users and open backdoors in the router? The issue is you suggest that anyone who builds an open source script/framework and publish them transparently on GitHub is an 💀⚠️CRITICAL" ..."security issue". So yo...

Amm0

I'm not sure the "💀⚠️CRITICAL" is necessary. Everything here can be relegated to security "best practices". And applies equality to "cut-and-paste" scripts and containers. Or even the dude, which downloads the matching version. And winbox4 new's "Update Winbox"...

Amm0

Inline editing in "list/table view" would be nifty, i.e. no dialog needed would be nice feature.

Amm0

Those, when we click the "ok" button and immediately think "oh, no". The firewall rules aren't special, copy works throughout the UI... and I'm not sure changing how it works is a good idea. Among them is a disabled item would still be committed to "disk", so it anothe...

Amm0

There is one rule with routing rules — the route MUST still exist in main, to be able to be used in another routing table. So you may want the use-default-route enabled on both APNs (or VLAN passthrough'ed), as that would deal with a changing public IP. Just set the default-route-distance higher on ...

Amm0

AFAIK, it like MIBs... you put it into the top-level "files" under the dude directory and it will be moved automatically.
And you can pick the new graphic on the device type to use it.

Amm0

Honestly, maybe it's just my opinion but i have a feeling that cAP ac works better than all of this ax stuff... Maybe your memory is bad, but the old wireless drivers got a lot complaints for years ;). Something like a cAPac also take exacting configuration to work well too... The issue is both ax ...

Amm0

I'll take svg any day.

and SVG rendering support is one step closer to showing Dude maps in WinBox4 (something webfig has long be able to do, since browser has built-in support for SVG while winbox3 does not)

Amm0

suggestion — WinBox4 should use an image for QR codes There are various complaints about the QR code for Wireguard client in 7.17beta thread... I'm not a regular user of the QR codes, but everytime I've tried to use one, I have to adjust the phone and/or fonts/sizing/"something"... While ...

Amm0

If the 2nd APN is working, you get a 2nd LTE interface. With that... At a high level, you need to add new /routing/table that has the 2nd APN's LTE interface as a /ip/route & use /routing/rules to steer the particular IP/subnet traffic to the new routing table for the 2nd LTE interface. But it a...

Amm0

Default configuration does not allow accessing webfig from WAN. Up to a point. The botnet on that article was composed by high end routers (CCR1036, CCR1072, CCR2004, CCR2116). Those have no firewall or protections whatsoever - since they are professional models. Yeah, that's makes the focus on dev...

Amm0

I do not understand what a "mirrored datacenter" means. Yeah that's kinda the central question here. Based on my now dated VMWare knowledge, but the general idea is that an "application" (i.e. CHR) didn't NOT have to be aware of redudency — since VMWare managed syncing all machi...

Amm0

I guess my initial question is if you have an investment in VMWare... wouldn't vMotion/etc work better? In that case you'd two identical CHRs, with VMWare controlling which one was active. VRRP certainly be possible on LAN side pretty easily. And VRRP supports connection tracking sync which keep it ...

Amm0

I guess I'd rather see some "real" switch with more flexible PoE power options... before a modular PoE injector rack.

Right now, there is no switch in the lineup that actually support the entire range of power options (passive, 802.3a[ft][+][+]) on a per-port basis.

Amm0

I thought that for distances up to ca 2km the setting could be omitted. Or should I always round up to next higher km and specify it? I have NOT used wifi-qcom for long PtMP links..... But I can only imagine still you'd want to "round up". While an oversimplification, "distance"...

Amm0

I don't see how having the firmware set to automatic is "better", you have anyway to remember to reboot twice, so you can as well remember to upgrade the firmware. It's eventually get upgraded if one forgot...since at some point you'll reboot. My list was more "unless you know better...

Amm0

Considering they allow+support the "branding kit" to add your own logo to software and remove Mikrotik from SNMP MIB... I'm cannot think of how adding a sticker be any issue. But if you're a distributor or retailer, you'd have to look at any contracts with Mikrotik on such things. Now... w...

Amm0

Can someone duplicate this error? Does it do the same on Android? Not wrong. I get same 0.0.0.0 and also that it still won't save the peer on iOS to RouterOS 7.17beta4. It seems the field does not know it's a ip-prefix type, since it should default should be 0.0.0.0/0, not just plain "0.0.0.0&...

Amm0

My commentary originally was "not much", then turned in a rather long list... To answer some "suggestions on the suggestions"... On "firmware" and/or RouterBOOT and/or BIOS – i.e. auto-update in /system/routerboard... - OP mentioned LTE... and my experience is that late...

Amm0

I find it hard to understand why MT doesn’t enable the interface for all standard ZeroTier options that are available on every other platform except ROS. Agreed. It's still in beta, one can hope. I'm less concern about the specific version that RouterOS uses unless there are security issues... it's...

Amm0

We're on 7.16 and will be on 7.17 soon, yet the zerotier version is once again stuck on 1.10.3 Or, perhaps read the release notes for 7.17: *) zerotier - upgraded to version 1.14.0 Now since the config interface has not changed, RouterOS still supports only a sub-set of features. But certainly any ...

Amm0

Good question. IMO, the defaults in recent RouterOS are pretty good. And, it acts like any common home router by default. So you don't necessarily need to do very much. Here are some general pointers & most are just considerations, rather than "you MUST do this": 0. The most important ...

Amm0

Port should not matter. But you'd have install the routeros LE certificate directly on HA (by exporting the certificate and key from /certificate). A dst-nat rule alone does not add LE encryption, it just forward any TLS traffic.

Amm0

I'm not 100% I understand. MACVLAN give the routers a 2nd MAC address on one RouterOS interface, but alone directly link a printer across VLANs. So I think you may be looking for this approach: https://forum.mikrotik.com/viewtopic.php?t=204025 And also you can use the new mDNS repeater feature if ne...

Amm0

Presumably this is part of what is driving the ideological position of device-mode: https://blog.ovhcloud.com/the-rise-of-packet-rate-attacks-when-core-routers-turn-evil/ And that part of the problem, we don't know what's driving the device-mode changes (i.e. the threat profile). Beyond platitudes ...

Amm0

I'd make sure they know it crashed under 7.17beta - so not just missing RSSI, they should want to take a look at that. It's a bug if something causes a boot loop. I'm pretty the modem is providing RSSI via MBIM since it's requirement and it taking a minute to get to running... kinda does indicate so...

Amm0

So attention, for anyone who hasn't noticed, antennas don't scatter the signal 360 degrees, they scatter it 180 degrees! Chaos is the documentation for this device!!!!!! Clearly a poor cut-and-paste job on the specs page. And IDK why it's hard to for the web specs to match the PDF - the PDF often h...

Amm0

Fortunately there appears to be "json.no-string-conversion" in the documentations for RouterOS for "serialize" - however my system is missing it. It would be helpful for communicating with JSON api where a string is expected regardless of if it happens to be a number. I'm runnin...

Amm0

Please add support for the AmneziaWG protocol using standard tools without using Docker. Bypassing Internet censorship is very important and using it directly inside the router is a big advantage. The problem with adding features like AmneziaWG is its effectiveness is subject to change over time, a...

Amm0

For content filtering like something really granular like"YouTube shorts", you need to re-write the HTML to remove the section. That's more similar to an ad-blocker. So I'd think some browser extension might be easier (perhaps deployed via MDM solution to forced it on clients). Now this is...

Amm0

To do math, you can use ros_command function, and provide RouterOS script since that can deal with bit operations. To display some kinda enum, that's tricker... theoretically one approach be use a probe, with a Function type, and use "units" for your text formatting. I wrote up using the D...

Amm0

It make sence to be 2-dimensional array (fields per lines)

Yeah I kinda abused it here for the more simple case (one field)... but it's more designed to import a CSV file.

Amm0

@optio has a good point. delimiter= is the "field separator", not the "record separator" (if I borrow awk's terms). The default "record separator" is a "newline" it seems.. So the delimiter does not matter if there only one "field" per row, so the de...

Amm0

You are bridging VETH to your LAN. So the VETH IP address need to match the LAN. So the VETH need to be something like: /interface veth add address=10.10.20.201/24 gateway=10.10.20.254 gateway6="" name=veth1 Otherwise, if you want the container to be a separate IP subnet, then you do not w...

Amm0

Not wrong... See https://help.mikrotik.com/docs/spaces/ROS/pages/130220135/Address-lists If the timeout parameter is not specified, then the address will be saved to the list permanently on the disk. If a timeout is specified, the address will be stored on the RAM and will be removed after a system'...

Amm0

Sorry about that, normally the beta do work... And I have 7.17 running on a couple wAPac, but no LtAPs....

You can use the serial port to see what's going on. And perhaps the backup boot loader help, dunno.

But doing a reset to defaults may be quicker.

Amm0

At a high level, potentially yes. But you'd have use src-nat to the public IP and/or potentially other firewall nat/mangle things ... but really depends on what you're trying to do. Normally VRRP is the default gateway for a network on the LAN side, not WAN side.

Amm0

What I'm not sure of is the effect of "use-ip-firewall-for-vlan=yes" as that could add another dimension to ZT bridging. IDK but I've never tested that option with ZT.

Amm0

Ah, you might have needed a delimiter="\r\n" if the file was created on RouterOS since it uses windows line-endings.

Amm0

've already got the logging enabled, so I'll get a fresh boot on T-Mobile and a couple minutes of logs and then submit, thanks. I'm also willing to try the next beta if you think it's worth it. It be worth a ticket. They may just need some ID specific for the EC-25AF, but only MT would know. There ...

Amm0

IDK, but does it work when you only have one IP and/or on interface? Sometimes having multiple interfaces with wine+winbox3 would cause MAC winbox not to work.

Amm0

I guess one long-shot option MIGHT be use /tool/traffic-gen to generate the broadcast packets. Since you have the traces, that might not be so difficult to try. Where it work/help IDK.

Amm0

Could latency be an issue, like their protocol requires very low delays so it works over physical LAN but not when tunneled over the Internet Yes, I am beginning to fear that they are explicitly checking for latency. The tunnel is over a site-to-site OpenVPN from two locations more than 1500km apar...

Amm0

Actually, it looks like I might already be on the latest rev (EC25AFFAR07A14M4G) according to some posts from July. So maybe it's too new :) It should show "RSSI". If you can try T-Mobile again, that be worth a shot to know if it's a Verizon carrier firmware issue. You might want to open ...

Amm0

Your suggestion worked. However, the ip 0.0.0.0, which did not exist in the file, was added. There were no empty lines. The :deserialize is very new, so it may a bug in that actually. i.e. inserting an extra array element, that would unconverted to an IP type, which defaults to 0.0.0.0. Do you have...

Amm0

Additionally make sure RouterOS is at stable, and the /system/routerboard has been updated to latest firmware too. I had no idea that there was separate board firmware from ROS. I upgraded this and it seems to now work in MBIM mode without issue. Seems hard to believe, but ... does that seem legit?...

Amm0

RouterOS like to abstract Linux-things, so I'm not sure they want to bind "files" to some particular linux file system details like owner/group. And FTP follows the same policy system as rest of RouterOS. Also, I think you're presume a higher level of sophistication in policy / AAA elsewhe...

Amm0

In V7, Mikrotik use MBIM with their Quectel models, so I suspect that be best. But if T-Mobile is working...I'm not thinking it's MBIM vs ECM. So yeah switch the LTE modem back to mode=auto may be best plan. Also try lowercase "vzwinternet" and disable "Use Network APN". You may ...

Amm0

Verizon is strict on everything. The modules must be whitelisted by a device manufactured and go through Verizon-specific certification. Modules are certified too, but BOTH module and devices require certification. So this means, unless the module came from a previous Verizon device, you will not be...

Amm0

[lost by accident - I meant reply not edit - but was just example script two post below now]

Amm0

That same thread shows a photo of it. And more importantly the spec sheet on www.mikrotik.com shows "M.2 slot: 1".

But your modem likely has different connectors, so may need some jumper adapt a 5G modems's MHF4 connector the U.FL used by the ATL.

Amm0

Also you might read this thread https://confusedbird.com/thread-310.html From the above... One issue I see in the ATL LTE18 brochure is that the antenna gain graphs all stop at 2.7GHz, so I am not sure how well it will perform in the 3.6GHz band. The LHG LTE18 dish antenna covers all the way to 3.8...

Amm0

It still be good to know the @Monty995 actual WAN situation. It could just be a terminology, like one side may have a dynamic public IP & in which case... adding DDNS would work for Wireguard. e.g. Folk are reading a lot of from the title, which may not be 100% what's going on. Now perhaps it 10...

Amm0

* Just to be esoteric, the needed MQTT broker and midimonster linux exe actually both live a "multi-process" RouterOS /container, that use `make` as it's init to start BOTH nanomq and midimonster. And, Alpine Linux had no problem compiling midimonster inside the RouterOS container (since ...

Amm0

:local scanTime "30"

should be

:local scanTime 30s

near the top of the script

Amm0

192.168.0.37 F6:F5:AC:C6:61:E6 169ms 192.168.0.30 E8:F4:08:E8:52:51 I don't know what the issue is with 192.168.0.30 no time ms It could just be a timing issue (no pun), but the duration= is a hard cutoff, so it could be in the middle of getting the ARP from 192.168.0.30 when the duration= hits.

Amm0

Hmm, in a quick test it works on my test router using 7.17. It might be the /tool/fetch that does the MAC address lookup that's failing... since that requires policy and test permissions, so if /system/script didn't allow those that be one reason it fail. The on-error={} prevents errors from being s...

Amm0

since 172.15.0.0/24 isn't private range

I didn't catch that, but yeah that ain't private. So ZeroTier's "allow-global=yes" would have been required ... to enable a bad config ... but why it didn't initially work.

Amm0

3) From the GUI, if you go into a wifi interface that is set up as PSK, and simply click "Apply", the passphrase will be corrupted and you'll have to go back and retype it. Under the hood it sets the passphrase to \E2\80\A2\E2\80\A2\E2\80\A2\E2\80\A2\E2\80\A2\E2\80\A2\E2\80\A2\E2\80\A2 no...

Amm0

IDK about the internals of the hAP-ax-lite, but if you're going to DIY there is also the newer L23 board (https://mikrotik.com/product/l23ugsr_5haxd2haxd boards be another option. You can then add a better LTE module than the hAPaxLite. Also, there are external antennas (especially 4x4 ones) that ar...

Amm0

It may TiVo is looking for bridged/routed connections. One way be the packet's TTL, although I'm not sure TTL be changed since bridged... but if it's not use TTL = 65, you can "reset" the TTL on the far end using /ip/firewall/mangle. The Mikrotik LTE docs show the commands for T-Mobile, bu...

Amm0

Edit: What is interesting is, that 172.15.0.5:3000 works from all clients, but it's impossible to ping this adress from Mikrotik that is zerotier client if i disable route i manualy added in /ip route. It could be the default-route-distance= of ZeroTier instance (zt1) is 1, so depending on the dist...

Amm0

Just not sure about the auto-join using just the network id part of it.

FWIW, if you delete a /zerotier/controller, it does leave inactive /zerotier/controller/member's... so that why my Mac just joined/authorized, I think (still it was a different/new controller).

Amm0

This topic is open for 12 years, other similar topics maybe even longer.
Holy crap, 12 years just in this forum post.

And still no way to avoid using a dual-stack.

Amm0

Yeah the LtAP, wAPac, and LtAP mini have some "drill-able" holes to install SMA bulkhead connectors. e.g. the wAPac can mount 4 SMAs on the bottom of the unit. So you can run a "pigtail" cable from the modem module inside to some drilled holes. And, Mikrotik does sell u.FL to SMA...

Amm0

To replicate the same ZeroTier "pushed" routes as my.zerotier.com controller... there is routes= on the /zerotier/controller. The controller is CLI only, and MT's docs provide the format: routes Push routes in the following format: Routes ::= Route[,Routes] Route ::= Dst[@Gw] So you should...

Amm0

Here is quick hack to adapt the script for newer date format using in V7. I cannot vouch for the restore part, but this should work to keep same format as previous version. Basically the "Get date and time" part is replaced from above: { ### Backup Dude locally ### # Set root path for back...

Amm0

You got a few things going on there, but topology should work. I don't have an instant answer on what's wrong, but couple things to check: 1. On the ZeroTier Controller (my.zerotier.com), did you set "allow bridging" on the Mikrotik members? 2. zerotier1 is not a member of either LAN or WA...

Amm0

Please don't only use username and password as credentials, please also use PKI. I wish that were possible. The problem is Winbox, Webfig, native API, and REST API all only support username/password. So unless you know how to make winbox use a cert, you're kinda screwed on RouterOS for PKI auth.

Amm0

There is no UI to import certificates. Does this mean I do not need to copy those files manually? We're going OT on UDM... And never been a fan of UniFi. But I'm sure there is a better answer in their forums how to add an existing cert in the right location. I was suggesting what might be using the...

Amm0

The main attack vectors been admin and no password & creating DoS. And using "admin" as username opens up common dictionary attack. But so would using same username/password combo that been compromised in some other attack be equally, or likely even worse. I just worry about the attack...

Amm0

If I wrote it here it would be public knowledge... Yeah I'm confused too. Totally get not using "admin", and deleting the account once a new "full" user had been added seems like a better plan. What am I missing? @rextended, if you think there some security issue here (i.e. wher...

Amm0

My reading is the script uses /data/eus_certificates/unifi-os.crt /data/eus_certificates/unifi-os.key And based on the using specific names, @sindy is likely right, the .crt would actually contain the root certificate, intermediate certificates, and server's certificate - all in same file (appended ...

Amm0

TDW's route will lead to graying or loss of hair. This is the sort of scenario 802.1X was designed for. Well, the built-in User Manager will support 802.1X, and UM is not that complex to setup. You can then set the VLAN on user using a RADIUS attribute. The 802.1X does work between RouterOS, and ev...

Amm0

It's random which one intermediate LE will use, per their specs. It possible to just install all the intermediate certificates for LE. Now I have no idea where on UDM. But if UDM supports SFTP... might be possible to use /tool/fetch mode=sftp upload=yes src-path=R1X.pem dst-path=/data/.../config/......

Amm0

Hi all, skins not working on winbox 4?

The lack of "skin" support is a "Known Issue" in @normis's original post.

Amm0

... or get a wider screen. Well, not wrong that you need a wide-screen. IMO is a kinda of a problem since not everyone uses Winbox from a desktop with multiple displays. My problem is I often I have two Winbox open, use a laptop, and don't have multiple screens available very often. Specific to Mac...

Amm0

Of great -- another new obstacle...errr...opportunity to learn. This is the URL of UDM. Screenshot 2024-11-01 130539.png The "Details" will show you the certificate it thinks is unsafe. And the message is due the certificates YOUR computer is lacking the "root" certificate autho...

Amm0

Well, I just looked at the webfig. Does look nice, & like the collapsing of the left-side. But this one affects us. *) webfig - status page is deprecated, old status page config will work, but can't be updated or created; The webfig "status page" was the only way to create some custome...

Amm0

The whole business of dealing LE renewals should have long been solved, without scripting porting 80.... Anyway... No, currently only port 80 is used to renew the certificate. This endeavor started because I couldn't access my UDM without SSL certificate errors. Am I close? What you do mean by "...

Amm0

It is really the "without public IP" that makes any VPN solution complex, which be true of any router. If one side does have a public IP, now Wireguard (or IPSec) option be possible. This part be good to clarify: does ONE side of the purposed VPN get a public IP? Otherwise, if BOTH side ar...

Amm0

The URL needs to use "urlencoding", which means things like space need to be escaped for HTTP. So your "....text=The Dude is happy again" part is likely the problem. In recent V7, you can use :convert to do the encoding. /tool fetch url="http://IP/cgi-bin/sms_send?username=u...

Amm0

IKEv2 is a bit more complex to setup… A bit? Hah! More like 3-10× more complicated, depending. Let's see: What'd I miss? LOL. I'll give 2× more complicated. You can use a PSK and avoid the certs. My comment was based an old hEX, that can offload IPSec encryption, but that is IPSec singular benefit....

Amm0

I'm guessing likely be better off with IPSec using IKEv2 on the older hEX, since IPSec will use hardware encryption. i.e. WireGuard will not be hardware offloaded, so might be slower. Although IKEv2 is a bit more complex to setup than ZeroTier or even WG. One side does need to be enabled with respon...

Amm0

I only have WireShark on one end, so I can't see what is going on at the other end of the EoIP tunnel. This is my first MikroTik project, so I haven't yet figured out how to use Torch ... Q: Can I use Torch to see what is going on in my remote NE location? Sure, you'd do it on the EoIP interface. I...

Amm0

The easiest thing to try is change MTU on the EoIP interface. If it's not 1500, that be worth a try. Now that will cause fragmentation over the VPN, but TiVo UDP packets may be too big to fit when a compressed MTU. You may also want to make sure "Don't Fragment" is unchecked (i.e. allow fr...

Amm0

And this why @anav is suggesting load balancing, since that is something you can do with one router and two ISP. This is theoretically possible, but with a lot of "ifs" and "provided thats". One of the "ifs" be is the 200Mb connections are via PPPoE, because "provi...

Amm0

A few years ago, I created an application to manage our mikrotik devices. It generates a configuration file for each router, based on how the router is modeled in the application, and uses TR069 to get the configuration on the routers themself. After the configuration is pushed to the routers, it a...

Amm0

Could you please elaborate? Why isn't it easy to use? You can click on "Usage" and it will sort by usage. In fairness, it is same as winbox3 which seems to be initial goal. But it ain't a great dialog box for quickly figuring out a channel to use. i.e. - usage should align on the ".&...

Amm0

Both VXLAN and EoIP approaches are covered here:
viewtopic.php?t=180369&hilit=wifiwave2

Amm0

I should have been clearer, in all likelihood using the "monitor once" in a scheduler is a better plan. I was more explaining how it works when NOT using "once"... generally speaking ;). Jokes aside, I don't have any UPS directly connected to a RouterBOARD otherwise I would have ...

Amm0

I don't know if this helps anyone, but I got Traefik to work on an RB1100 (which is actually ARM32) using this image: https://hub.docker.com/_/traefik I have to try this. Thanks Amm0 Yeah it works on RB1100AHx4 and RB5009 for sure. I use it for CORS and automatically renewing LE certs. I should cre...

Amm0

Did you look at Files in winbox, and see a dude.db someplace. If so, you're be in luck... And, one simple possibility is the "disk name", or RouterOS, slot= changed in the upgrade. For example, from disk1/ to sata1/. And the upgrade does not change the dude directory, so it's may be lookin...

Amm0

Load balancing is more effective using all available bandwidth and easier/less complex & straightforward on RouterOS — that's why I pitch it ;)... But your right failover is going to be noticeable since it's connection-based. And "hitless failure" and magic bonding is what Peplink pitc...

Amm0

Remove the "once" and it becomes a ":while (true)" loop, so it will run forever. There is an interval= that control how often the do={} code is run, i.e. 1s or 1m or 1h etc.... You can also make only run for a fixed period like duration=1m. This is useful like in a /system/schedu...

Amm0

The answer I'd like to give is use /zerotier multipath settings to do your desired bonding : https://docs.zerotier.com/multipath/ Sadly that is NOT an option . Since I occasionally use the peplink things... I kinda know how the peplink generally work... Also note there are additional recurring costs...

Search found 4746 matches