MikroTik

Amm0

Since DDNS going down is an ongoing issue, I wish Mikrotik would provide a website that informs people about what's happening. The website could possibly include an ETA.

Perhaps they need to start with a pager for someone... They don't seem to do well with issues in middle of the [Riga] night...

Amm0

Not alone, this incident seems to be tracked here: viewtopic.php?t=213191

Amm0

Yup, seems down.

And also means BackToHome (BTH) is down too....Just tried enabling on a router and it gets stuck at "allocating endpoint"

Amm0

yeah the first thing I do in every config is blow up capsman and obliterate IPV6. They are like parasites that drain my energy ;-) LOL, I know your thoughts there & BTH does use IPv6 - why I highlight that detail ;). Although I suspect OP running into the WG+multipath "issue"...

Amm0

You might want to post your config. By default, port 25 is allowed outbound.

If your added rule to block outbound 25 is after an "accept", that could be the problem.

Amm0

Yeah config going to be needed here. One additional consideration, is if you have IPv6 enabled, BTH will use IPv6 if available. This may or may not be expected, so might want confirm in /ip/firewall/connections and/or /ipv6/firewall/connections to see... RouterOS comes with IPv6 enabled, but sometim...

Amm0

@ammo, Agree, in concept... But the problem is often "sync everything, except..." - with except part making it tricky. sounds like a developer having a tough project because the customer keeps changing his mind?? 😅 I spend 20+ years in software engineering, so I'm a bit sympathetic to Mik...

Amm0

- Does RouterOS allow you to fully disable multicasting? LLDP? STP? By disabling I mean killing the services and not have any processes listening on respective ports or just not having processes running at all. It would be even better to be able to completely remove related packages via CLI! You ca...

Amm0

DNS in a VRF still doesn't work... 7.17rc2 As explained already before, setting VRF parameter allows to listen for DNS queries in a VRF. Feature to connect to remote DNS servers via VRF does not exist yet. That detail should be in the docs, not just this beta thread, too: https://help.mikrotik.com/...

Amm0

I had to make a meme about it. But seriously. Thank you. I'm all set for what I needed. I hope someone else gets some value from this thread. LOL. A bug report to support@mikrotik.com on the user+1000w not working might have been more productive ;) - as I'm pretty sure the user+100w stuff is broken...

Amm0

I guess I don't understand, since it just bytes per "kid" AFAIK. So if you want to add the IP address of some kid to the address-list based on traffic volume, not site. I've never heard of kid control doing anything with content filtering, so really not sure what you're after. Do you have ...

Amm0

You may need to enable the RTSP firewall helper for the IPTV. But if your using Spainish Movistar IPTV... I believe there are some issues IGMP proxy that block that from working. Also EOIP with WG is going to reduce the MTU, so I'm not 100% sure the IPTV packet fit over the lower MTU....so that may ...

Amm0

Well, now you have me more confused. Kid control does not do blocking of sites, only controls access by time. RouterOS is poorly suited to do content filtering. So, even in terms of scripting, I'm not sure what your what your trying to gleam from /ip/kid-control/devices since it just what "kids...

Amm0

You'd normally use a script on the /ip/dhcp-server to do this, in which case "print" is not involved, only "/ip/firewall/address-list add ...", see "lease-script=" under https://help.mikrotik.com/docs/spaces/ROS/pages/24805500/DHCP#DHCP-DHCPServerProperties Is there som...

Amm0

You might try setting STP to "none", as you could something could be going into a blocking state during the configuration process. But otherwise it looks right to me... Also, in 7.16+, it's safe to set vlan-filtering=yes when you create the bridge, as the default bridge/ports all use a &qu...

Amm0

Would clients running WireGuard (such as Windows clients running official WireGuard NT) be able to pull 700-800Mbps on Chateau AX Pro? I don't expect such throughput when running WireGuard on router itself, but fast PC's with WireGuard NT should be able to achieve such throughput. Well, if WG is ru...

Amm0

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list. That would be for remote user access to the config of the router, I thought he was asking for access to the LAN subnets...... Now that I look, correct. But I read the OP as ...

Amm0

Mikrotik has a secure boot options (/system/routerboard), "locking out" features (and flagging) via /system/device-mode , and RouterOS packages are all signed. RouterOS does not use Linux standard GNU tools, so the split between kernel and user-mode is pretty abstracted by the CLI & th...

Amm0

they?

what video?

Probably one of @dru's videos on scripting on YouTube. Although he's pretty good about using the name in other places, https://youtu.be/2WsFhkLVaMY?t=254

Amm0

Hmm, not 100% without more inspection.... But I think 192.168.216.0/24 needs to be in the "allowed_to_router" list.

Amm0

Normally "AP" are strictly AP's.

Perhaps, but I've seen "router features" (e.g. NAT to internet) on most other vendor "APs" (outside perhaps UBNT).

And, in Mikrotik, all APs are routers running RouterOS (at some license level, which may limit things too).

Amm0

I am not aware of the address range used, so you are saying it starts the first one given to the admin on his smartphone as 192.168.216.2 and the next .3 and so forth.

Yup, admin/"1st user" is 192.168.216.2, and any added BTH users/"2nd+ users" start at .3, ...

Amm0

@Ammo: does this sound right. Challenge: Allow BTH users to go out internet and LAN. a. Establish BTH network with 5 users plus admin b. Do select NO for lan access initially --> I have a reason. :-) Go to /ip/firewall/address-list and copy down all the user Ip addresses. c. Unselect NO for lan acc...

Amm0

I'm more curious what underlying problem got someone to think concatenating an actual variable name is the solution...

Amm0

Just use a 2nd variable.
But this is not what OP ask: concatenate variable names

Well I'm not sure OP was very clear.

String interpolation get's tricky with variables and numbers... i.e. "$($var123)456" syntax isn't entirely obvious too.

Amm0

@Amm0, Yup, but a default route in main is sufficient to meet this requirement. Also, I'm pretty sure that statement in the documentation is a simplification the author has used to avoid the need to explain that this requirement (for some route to exist in main ) is only related to own outgoing tra...

Amm0

Agree, in concept... But the problem is often "sync everything, except... " - with except part making it tricky. For example, the src-nat or dst-nat might vary in a VRRP setup, while all other firewall be same. How to express that in config, IDK.... I guess IMO VRRP isn't special in the ne...

Amm0

Just use a 2nd variable.

:global hello 123
:global hello2 "$($hello)456"
:put $hello2

123456

Amm0

i just used as a bridge can you explain me step by step i can ping in mikrotik router ether1 to 8.8.8.8 but lan out not working Bridge works and likely want you'd want, essentially like a MACVLAN so RouterOS get's own MAC address. It's "host only" that is unlikely useful in any case. Alth...

Amm0

Ah, you want to register any DHCP lease in DNS... I believe you need an else={ ... } in the :if ( \$leaseBound = 1 ) { ... } statement for the "expired" case. Or, add another :if ($leaseBound = 0) do={} work too for expired dhcp leases. But your bigger problem is likely that /tool/dns-upda...

Amm0

I know we had a similar topic a while ago, but here there are some more specific questions. [...] As there are a lot of standards for managing network devices (https://xkcd.com/927/) my suggestion is to KISS and use whatever is there already - ansible for those who can code, API for those who can u...

Amm0

[...] If I use the brief option, as suggested in this thread, I still don't get the HOST-NAME column. If I use the detail option, I get the full hostname, but now the output is in this multi-line stanza format that I have to parse. What I really want is the IP address and the hostname and nothing e...

Amm0

Re macvlan, it might be useful in some cases... but adds more complexity if it's not actually needed was my point. you cannot just add a route to routing table unless same route exists in the main routing table Can you elaborate on why should doing so be a problem? The docs on Policy Routing have on...

Amm0

I'm not sure purpose behind using the intermediate macvlan in the first place...

Also, you cannot just add a route to routing table unless same route exists in the main routing table, which may be first order problem in OP's approach.

Amm0

I'm a bit confused. Normally, you use DDNS on a /ip/dhcp-client script (not "DHCP server" mention in top post)... First, /tool/dns-update uses the RFC scheme to update a DNS server, but few/none "cloud" DNS providers use that method. So /tool/dns-update pretty much work only with...

Amm0

I think it's Linux where the SVG is useful. On Mac/Windows, the icon file isn't needed since it bundled. But with Linux, there are different window managers. And using a SVG allow you use the "scalable" icon directory, while rastered PNG/etc require using the resolution specific directorie...

Amm0

HAP AC2 with 7.17rc2:[...] If from a phone connected to wifi I copy any file of average size 296MB, the transfer starts well but randomly in a percentage that is always different, the router goes into kernel panic and restarts completely. I formatted in ROS if it can be a detail.. Serious BUG !! Ev...

Amm0

The redcap mean "reduced capacity" so are speed limited than "full" 5G modem... so IMO routing performance is even less important since it not going to be GBs. Thus I'm not sure NAT-less IP routing from a "main" router to the LTE device is the end of the world, vs. &quo...

Amm0

+1 - you have a lot of good suggestions that I'd agree with. If you're configuring routers professionally, they do have the branding kit, so if you want to update the default configuration you can use that to do it. If you want to keep QuickSet working, you need to start with the existing default co...

Amm0

there is even a curl to Mikrotik fetch converter https://tikoci.github.io/postman-code-generators/ [...] curl -k -u user:password -X POST http://1.2.2.3:80/rest/system/identity/set --data "{\"name\":\"MikrotikTEST\"}" -H "content-type: application/json" This ...

Amm0

Maybe you just missed the options keep-result=no https://help.mikrotik.com/docs/spaces/ROS/pages/47579162/REST+API https://help.mikrotik.com/docs/spaces/ROS/pages/8978514/Fetch I think in V7, using output=none is generally preferable. Although imagine in that case there same. But output= allows you...

Amm0

I have a question about relaying. My Mikrotik router is behind a CGNAT connection, so the IPv4 address I receive from my provider is not directly accessible from outside. I have assigned a static IPv4 via an IPIP6 tunnel through a server and added a global route in a separate routing table. With th...

Amm0

(I was hoping @normis would chime in, since @anav asks good questions. But I'll try...) I want to know more about this line............ In case of going through relay, speed could be limited. Clearly we have limits on client end for ISP, and limits at Router end from its associated ISP connection a...

Amm0

Setup DDNS on the Unifi GW. [...] The Mikrotik is behind NAT so I am going to setup WG port forwarding to the RB2011 and try to get it to pass traffic. [...] I have tried a mangle rule to mark connection, it flooded the logs, so back to my copy of RouterOS by Example I go. Would I be correct in tha...

Amm0

So disk1 is getting created on the flash, with the path of "disk1"...
Do you have a USB or other disk connected?
Because... you may be out of disk space on the flash... Check /system/resource/print and look at free-hdd-space.

Amm0

The RB951 does not support containers, but running the Cloudflare container be best way to get traffic to the Mikrotik. You can create a dst-nat in /ip/firewall for the port to enable port forwarding. Since the FQDN point's the router IP, that's all that's technically needed. Your relaying on the se...

Amm0

The RB5009 / L009 format factor is a winner. Mikrotik promised a "series" using same form factor in an older YouTube video. It be nice to have a switch to be able to combine multiple RB5009 in same rack. The one SFP is pretty limiting. Now I personally wished they had an "accessory&qu...

Amm0

Nothing prevents you from going to a different vendor, or using a different VPN then wireguard. Just suggestions..........

Or, Mikrotik fixes their implementation to work like the rest of RouterOS.

Amm0

*) implement opened windows list

Thanks. One subtle thing is the "keyboard help" shown at bottom should use the platform-specific terms for "Alt", which on Mac be "Option" or the ⌥ symbol.

OptionNotAlt.png

Amm0

Sorry your trivial case nonsense is pure BS. Many folks that come here for assistance have normal multi-wan setups, not all can have specialized, niche vpn WAN only setups. It's not trivial. Mikrotik has plenty of users that use iBGP/OSPF/etc. One could also equally argue that Mikrotik focus on hom...

Amm0

Nope.

But they don't say version etc, so yeah compatibility might be tricky but dunno obviously... So worth a ticket.

Amm0

@mkx is correct, RouterOS basically uses the Linux kernel, but not the Linux tools. So AFAIK there is only the hardware encryption with OPAL that is support. You can file a feature request at https://help.mikrotik.com & see what Mikrotik says. They have been adding things to ROSE, and some softw...

Amm0

Wow lots of ways to do this. I was answering the scripting question, since I figure your trying to learn scripting. But I too was not sure what you're trying to do.... If you have a "backup WAN"... typically you'd put a script on the "primary WAN" DHCP to change the default rout...

Amm0

It can be inside {} but NOT between attributes, which else={} is actually a property of the :if.

Amm0

At least one problem is the comment in the :if - else= is an attribute and you cannot just insert a comment in-between (i.e. the "# Else at least one such route exists") If you paste in into CLI, it show you where the problem is too. Or, even syntax checking in /system/script/edit which sh...

Amm0

That is a script for /ip/dhcp-client. $bound does not exist in /system/script.

Amm0

That's an odd one. Since you're saying allocating more memory helps, I guess it's possible if there is a new driver that allocates some memory buffer. The docs suggest : The minimum required RAM depends on interface count and CPU count. You can get an approximate number by using the following formul...

Amm0

I do prefer winbox v3 but I am afraid that in the future I will not be able to use Winbox v3 anymore because newer RouterOS will not support it anymore, meaning I will be forced to not update my routers, which I realy don't want to do Mikrotik could comment on this.... But that may not necessarily ...

Amm0

Actually AMMO, you can use a single wireguard interface, and just use a different IP address schema for the road warriors, if you need some granularity over firewall rules..... Yeah that's true: different peers + subnet is enough for firewall. A different interface only adds using the different por...

Amm0

Have you consider just using a dedicated subnet for the WG between site A and site B, then using normal routing (/ip/route) instead of WG's allowed-address to handle routing? Also, I don't know if you control the IP numbering (i.e. if the sites are operational)... but using a 10.<site>.<vlan>.x for...

Amm0

I would have thought that would have worked...

You can also be explicit to disable SMB:

/ip/smb/set enabled=no

(the default is "auto" AFAIK ... but I'd thought the /disk auto-smb-sharing=no mean auto in /ip/smb be =no)

Amm0

It's closed source, so you cannot diff the modules. But you need ROSE installed for encryption support, and drives need be Opal complaint: https://help.mikrotik.com/docs/spaces/ROS/pages/259031065/ROSE-storage#ROSEstorage-Self-EncryptionDrives Does this encrypted disk mount on another plain Linux sy...

Amm0

It is the user space applications' duty to then fill out the source address (see https://blog.cloudflare.com/everything-you-ever-wanted-to-know-about-udp-sockets-but-were-afraid-to-ask-part-1/#sourcing-packets-from-a-wildcard-socket). That's a good article, which likely explains roughly what's goin...

Amm0

Have you consider just using a dedicated subnet for the WG between site A and site B, then using normal routing (/ip/route) instead of WG's allowed-address to handle routing? Also, I don't know if you control the IP numbering (i.e. if the sites are operational)... but using a 10.<site>.<vlan>.x form...

Amm0

Good to hear, it did seem like the firewall. I just thought there be a good chance you both had the default firewall & the loopback rule be in the right spot. Without config, guessing isn't always 100% accurate :). If you're only use FTP for the copy... you might consider restricting FTP to just...

Amm0

It's roughly the same as this issue: viewtopic.php?t=205278&hilit=wireguard

Wireguard, for some unknown reason, is not treated the same as "locally generated traffic". So pref-src= is I'm guessing a similar victim.

Amm0

So in summary, its transparent to the end user, and hence why both apps can be used.

Yup. Just WG peer, with special DNS name.

Amm0

Also, since the RB2011 lives behind the starlink connection and the unifi gateway, I think double nat is going to be an issue. I dont want to have the RB2011 as the main gateway. I think that having it hosted somewhere else might be a better option. Perhaps, but if the starlink is going to UBNT &am...

Amm0

Anyway, I still use the Automatic address acquisition which works fine without any issues. Just to be clear, you shouldn't need /ip/route or /ip/address if you using DHCP client. I was trying to explain how to set them IF you were NOT using DHCP client. But if a WAN has DHCP, in most cases that bet...

Amm0

Yeah the 40Mhz on 2.4Ghz always seemed silly to me. It the 5Ghz band where I just never/rarely seen anyone recommend/using 20Mhz (or even 20/40Mhz). And have wondered if either I'm missing something about AX thus the initial question... Seems I'm not alone. But do think using default 20/40/80Mhz cha...

Amm0

Well, BTH is actually useful for LTE for a router-to-router WG with a CGNAT. This is use case @normis does not quite get with the "always use app" approach, and why I persist in explaining it since regular WG will not use BTH's "relay" server hosted by Mikrotik to deal with hole ...

Amm0

Or some cheap VPS in the cloud and install CHR on it, then use that one as pivot point for all Wireguard connections ? Shouldn't be too expensive ? Anav always claims it's about 7$ / month but I don't know what supplier provides it. I don't use it but I know some folks use https://www.vultr.com/pri...

Amm0

I am working on that bit ( improving docs ) and is why I am being nitpicky in my understanding. I forget, where do the firewall rules show up that allow a USER to access the WAN and possibly the LAN??? On firewall, there is an address-list named "back-to-home-lan-restricted-peers" in /ip/...

Amm0

You know its very annoying that your right ;-) Can we agree to blame Mikrotik's docs? :) BTH is actually pretty elegant since it really just uses DDNS to determine if proxy is needed, but always still plain WG. The docs are just bad (overly complex for simple case & not enough info for someone ...

Amm0

@holvoetn is right, Back to Home is what you'd want to used for Starlink. I went to check the docs, but The Dude interrupted me, but he says the RB2011 does not support Back to Home: Dude RB2011 BTH.jpg You can use plain wireguard, but one side requires a static IP. So another option be to enable a ...

Amm0

Yup. App is not mandatory, as EVERYTHING can technically be done using RouterOS winbox/CLI alone. As @normis suggests, the app may be easier. Although just enabling BTH under /ip/cloud is not very hard either (i.e. it's a radio button, which enables BTH & gets you 1st WG client, and then with &q...

Amm0

Not sure what you mean. If a user (not admin) uses the BTH app to setup a BTH tunnel after receiving the QR code, or URL link or export config file generated on the admins smartphone, then the user access is done through the BTH app, not the standard wireguard app. That why the app is more confusin...

Amm0

None of these give any reason why using 40MHz channels on 2.4GHz band would suddenly become a sane thing to do. That one I've never got either. I actually been using 20Mhz on both on most of the AX devices we use. I just NEVER see anyone recommend narrowing channel width for AX... which got me ques...

Amm0

The ROUTER initiated client peer, ( the one that should go on the admins smartphone ) can, via Managed Shares, create additional peer clients to the same router. The client peers (second created to infinity) CANNOT create additional peer clients. They are not equal..... Now I get the confusion. The...

Amm0

Could you check my port forwarding rules please? Although I follow the same way of opening ports for applications that I use, I still have problem with a few and I don't really understand why. Moreover, I have never been able to open any with UDP protocol. Does it need anything else? You shouldn't ...

Amm0

@jvanhambelgium: Hmm, I didn't think of it like this just to be fair. The ISP didn't instruct me to do anything, as I had always in my mind that static IP doesn't need any DHCP client to be enabled. It seems that I was wrong then. You're missing a default route in /ip/route for the gateway. To use ...

Amm0

It's WG, so all are peers. The app and /ip/cloud just always create ONE peer upon enabling it. If you need more, you need the "managed shared" (or /ip/cloud/back-to-home-users). On the "shared" ones, there is the additional option to allow-lan= so that the only difference AFAIK. ...

Amm0

For years of Wi-Fi, the general recommendation is avoid large channel widths unless the spectrum is relatively clean. But I've never seen that recommendation for AX devices. I know AX uses OFDMA to better handle this and large channel widths are needed to get "max speed". But most of my us...

Amm0

Why you do not download and save already the file on correct place instead of download on another place?

Fair point!

But given MT's recent focus on NAS things... some "copy" and "move" are still missing, which results in these kludgey solutions like FTP+fetch.

Amm0

Try using localhost as the IP, and make sure 127.0.0.1 is allowed in /ip/firewall/filter (and recent defaults generally allow it). While could a be a few things why this does not work... firewall blocking it be 1st to look at. Also note that in 7.17, if you're downloading RouterOS packages to instal...

Amm0

You may need Part 15 for other reasons. IANAL, but just using different antennas may fall under the FCC's "permissible change" stuff. But imagine Part 15 certification be cheaper than lawyers arguing about FCC rules. ;) They've just required that the radio be put in a mode where it transmi...

Amm0

I also understand that once folks have accepted the qr code on their smartphone app, or wireguard client app (laptops), etc. the results show up on the associated MT Routers IP Cloud tabs ( users ) and can be configured further if required ( add access to subnets, delete, and probably other options...

Amm0

anav:1 ammo:0 ( but whose counting) Except I'm not wrong. All BTH are just WG peers, and have QR codes. So just like any other peer, don't use the same peer twice. The advice to first one (/ip/cloud), applies to the shared ones too (/ip/cloud/back-to-home-user) - don't use them twice as they have a...

Amm0

You're not using an external disk. You might want to try setting root-dir=usb1-part1/pihole or whatever path you have (noting that paths do NOT start with / in root-dir=). Perhaps PiHole is small enough for flash, but IDK.

Amm0

Impressive you got something working here! Another poster was trying to use Hotspot+WG to do this (https://forum.mikrotik.com/viewtopic.php?t=205625&hilit=hotspot) and that approach didn't work out so well it seems... But +1 - MT should have some way to directly integrate User Manager into WireG...

Amm0

there is a "REST API" Better ? Sure, your commentary here is 100% spot on: If you find yourself needing a control plane for your routers’ containers, you will likely need to write it yourself. And it is kinda pedantic, but complex/hard is different than impossible ;). MT has mentioned &qu...

Amm0

That's a good question... I'm not the expert on the CRS326, and haven't tested Dante with it.... But same DSCP marks should work on a VLAN with Dante, if VLANs were setup AFAIK. And you want one bridge, see https://help.mikrotik.com/docs/spaces/ROS/pages/30474317/CRS3xx+CRS5xx+CCR2116+CCR2216+switch...

Amm0

I guess my first concern would be the topology of the links. Specifically if you're planning on bridging or routing the various links. The bandwidth and router are more easily swapped than not having a good architecture to start. For PTMP (APs<->CPEs) and PTP (APs<->Stations) I will use Ubiquiti. An...

Amm0

I've updated my Container Limitations article to cover these latter details. I chose not to address the topic's primary question since you can cause this same port number conflict under Docker and Podman, too, most easily by giving the --host flag. I can't justify calling this a "limitation&qu...

Amm0

Following all the v7.17 topics, between various complaints, it's not clear what are the know issues.

Agree on known issues for beta, but by "rc", ideally there shouldn't be any.

Now device-mode does deserve "top billing" with the !) since it changes behavior...

Amm0

Yeah the mounts can be tricky. Especially since RouterOS only allows mapping directories, not files. In a full-featured container engine, you have to do both, but now that you mention it, yeah, container.npk ignores the EXPOSE directive, doesn’t it? Nope, EXPOSE does nothing. Now ideally it be good ...

Amm0

As I said, the docs are not very clear. But end of the docs does reference the commands. The wording at top of docs should be changed IMO. In other words, the router itself can only generate one setup via BTH, the rest have to be done from the Admins smartphone. Just waiting for NORMIS to confirm! B...

Amm0

In 7.17, the difference becomes even less since webfig looks nearly identical to winbox4. So main difference IMO is winbox can do Layer2 / MAC address, while webfig is Layer3/4 / IP only. With the native winbox adding a few extras like sessions/workspaces, and associated multiple windows. Did you wr...

Amm0

I think you need to change the NGINX config file to do this. I don't the EXPOSE has any effect. i.e. The DockerHub version of NGINX has a script that parses env variables to "passthrough", see https://hub.docker.com/_/nginx under "Using environment variables in nginx configuration (ne...

Amm0

Yeah I have same problem on at least one test router, and by "rc" this stuff should work... So I did open a formal ticket with supout.rif on this issue.

Amm0

The new webfig has a similar problem to winbox4 where that status/flags are very difficult to interpret. For example, LINK OK and NO LINK are radically different states - yet the only difference is the text inside. Screenshot 2024-11-22 at 7.31.57 PM.png Screenshot 2024-11-22 at 7.32.11 PM.png Being...

Amm0

Anybody give an OK for Hap ax2 running capsman, I wouldn't want my config to explode! You can try it without harm. Repartition the hapax2 with two partition, on part0, stay 7.16.1, copy that onto part1 and switch to part1, then upgrade it to 7.17. If it is messed up itself, you can switch back to p...

Amm0

No. The hAPax2 "dual use" PoE port is passive, but it does support 48V input.

Amm0

You get what you measure... First, I think Mikrotik should publish MORE stats in general. There is already a lot of conjecture on this WG vs IPSec performance, without any good baselines. On the WAG'ing, I'd be looking at how the bandwidth test is being running before getting into questions about I...

Amm0

Hi Ammo reading the docs there is only one qr/code one can generate from the router itself, the rest if I read this right, is that you can easily create and manage additional Qr codes and send them all from the admin smartphone. The docs aren't entirely clear, but the "share" ones should ...

Amm0

Trying to understand BTH some more. Is this correct?? Bizarre that I cannot do this FROM or AT the router ????? Did you look in /ip/cloud/print (first BTH user), or /ip/cloud/back-to-home-users/show-client-config XX (2nd or more BTH users)? But I just notice is under /interface/wireguard/peer in Wi...

Amm0

Is the traffic getting fragmented? i.e. Are you sure it's 1500 MTU both ways. The packets-per-second on the slow link in half that of fast one....

Amm0

impossible that webfig skin designer is broken in a RC release. There was another thread where someone else in beta4 had the same issue. I'll note that it does work fine on a KNOT running 7.17rc1, but I reset the default configuration with the first 7.17 beta on the KNOT. But on the RB1100AHx4, it ...

Amm0

In the new webfig, I'm not sure the skin designer is working. I cannot seem to figure out how to create a new skin. When I do a "Design Skin", it shows a blank list and I don't see anyway to select things. Either I'm missing something in how to use new webfig's skin support, or it just is ...

Amm0

I like the colorization, but that's it. Agree with @eworm, it should not be in an export. And not sure the "extra" comments are needed in winbox/webfig if it's already colorized (but the color is kinda handy).

Amm0

Utah and North Pole have spoken. Cloudflare or bust! @anav, I thought you'd like that pivot ;) And California be happy to take the tax revenue from Cloudflare. And, @wfburton isn't wrong RouterOS is pretty far from a "enterprise firewall". Installing Cloudflare's single exe tunnel in a NP...

Amm0

Probably best to ask Mikrotik, or perhaps Quectel. But for FCC Part 15, which you'd need to sell them, you shouldn't actually need any special commands. Now the LTE modem and various cell carriers are a different story.... that typically where you need the LTE modem into various test modes. So if th...

Amm0

This is turning into the IT version of Netflix doc "Don't F**k with Cats"... I'm not the expert but setting up DNS is just first step to setup Cloudflare proxy services, I think the purposal here is that HTTPS traffic go through a Cloudflare IP before getting to "real" phpBB. [.....

Amm0

There's no need to fake anything since there are no restrictions on anonymous access (tho creating a post is). Your suggestion might very well work, but it could end up being like robbing Peter to pay Paul. :D Perhaps. But if you're a guest... "user control panel" (aka /ucp.php) is an odd...

Amm0

Side note: one added benefit from this whole situation ... spammers have little interest the past days for this place. What I noticed during the weekend was most of the "extra guests" (perhaps faking being a bot) were visiting the "User Control Panel" page, under the "Who's...

Amm0

Some call it space-wasting, others call it easier readability because text ist not squished together. I'm not sure there are many folks who like the extra spacing... And @eworm is right, the comment has more space between the item it refers, than the next/previous item does. It's like the comment i...

Amm0

The first immediately useful thing I can think of would be running The Dude client in Wine on an ARM router (that's also running The Dude's polling package) instead of running it in a VM on separate hardware. But alas, no wine package exists for Alpine 3.2. LOL, see https://forum.mikrotik.com/viewt...

Amm0

macos big sur 11.7.10

Yeah that version seems to be a trend. But Intel-based with MacOS Sequoia does work without crash.

Amm0

Great work here! after starting you will get some permission errors (we will check whats going on) I've wanted to do same X11/RDP/VNC/etc approach for a while... but got similar permissions issues before. Now I've never tried the "s6-overlay" approach to "multi-service containers"...

Amm0

the thing is, putting the useful and inoffensive stuff (such as cpu-frequency, without overclock) behind the same security-group as some other "more dangerous" settings (boot to ethernet-only, disable reset) will incentivize people to "unblock" this, defeating the purpose of the...

Amm0

It took longer, as the biggest change was hard to implement - tree views. Now we will continue with the rest of the requests and ideas in this thread. The "tree [+list] views" did sound tough...but great work! It's actually quite an improvement over winbox3 in the Files view! And 100% sup...

Amm0

I think it's pretty obviously broken, and worth waiting to see in the next beta release.

But for next time you can add attachments to forum post using the "Attachments" tab in the "full editor", and then say "place inline" after uploading.

Amm0

Anyway, I'd be curious on the hearing the root cause from Mikrotik...
Won´t be all?

We don't know it wasn't some software update pushed by @normis late on Friday, that had some leak/etc that caused these issues....

Amm0

Like I said, I think it's broken. I had some issues you're describing, and under 7.17beta5

Maybe there is some interface trick I'm missing, but it ain't obvious.

Amm0

Most probably user error. I don't think so. 7.17 is radically changed. I have not been able to create a new skin, since it seems to depend on what in the skin's .json file. Now my test router had none. So I'm not sure you can add items to the skin in the beta, only modify - or at least that has bee...

Amm0

IDK, maybe it should be. It COULD be. I wasn't trying to argue – not wrong from a pure business perspective hosting might make more sense, especially if uptime and low-latency were a concern.... But for Mikrotik it would be a sign of capitulation. And implication that any small/medium sized busines...

Amm0

I have an example of using a function in a probe here: https://forum.mikrotik.com/viewtopic.php?t=192103&hilit=probe It does not use not function parameters, however. I just created multiple functions rather than take an argument. Reason being is I'm not 100% on how to correctly use arguments. $...

Amm0

I guess I'm saying Mikrotik runs VPN proxy (BTH) and /ip/cloud DDNS already. So some PHP should actually be easier than BTH to secure.....and why I present the question. As a data point, I ran a ping over the weekend, it was ~250ms from the west coast to Mikrotik/Lativia, with 1.5% packet loss – whi...

Amm0

Not be the contritaian. Why should some cloud solution be needed? Because this is not their core business. Their routers aren't the best bet to fend off heavy DDOSs - and they shouldn't: it isn't their market target. IDK, maybe it should be. I just don't buy that every publicly visible site needs t...

Amm0

Well this important advice, gets lost among the unnecessary invectives...

never use $ on :global, :local and :set

Amm0

Ah. This we agree upon: it's past time they shove it behind some Cloudfare or whatnot. +1 Not be the contritaian. Why should some cloud solution be needed? I'm pretty sure Mikrotik can fix this without 3rd parties. Maybe not. But Mikrotik's basic product pitch is nothing depends on the cloud. And I...

Amm0

This is nothing but a disguised attempt to decrease the use of this forum........

Or, Mikrotik is just hungover from their holiday.

Amm0

While cable cuts add some international intrigue and drama here... It does seem more related to application load, not network bandwidth.

Amm0

Yeah it's still flaky today. I see 1300+ users online.

Amm0

Are DoS attacks a holiday tradition in Latvia?

Still flaky.

Even worse.

Amm0

Still flaky.

The only question is: did Mikrotik pissed off someone, or is it just a bad programmed harvester?

LOL. That's my question here... I was kinda curious if newer/bad harvester, and not some attack. I guess it could be some attack targeting phpBB too.

Amm0

*) iot - added additional debug for LoRa logging; [...] *) iot - added new LoRa traffic FCnt packet counter parameter; On a positive note :). I have a KNOT with LoRa (+ 3rd party temp sensor) running 7.17beta5, connected to mosquitto and an old erlang lorawan-server container on RB1100 to run entir...

Amm0

*) webfig - status page is deprecated, old status page config will work , but can't be updated or created; A previously created webfig status page does NOT work , despite the release note.... I upgraded a wAPacR with status page showing LTE stuff, running 7.16.1 to 7.17beta5 — no status page is sho...

Amm0

A spike in session counts is usually a good indicator of a DDoS attack. Yup. I'd like to think it's still possible to self-host a 25 year old "web app" (phpBB here). i.e. without needing cloud services (AWS, cloudflare, Azure, etc.) or expensive enterprise security products. Perhaps not —...

Amm0

And it's still not working well...
There are not normally 1000+ real viewers on Saturday.

Screenshot 2024-11-16 at 7.07.53 AM.png

Amm0

[...] Edit: i just compared, the chain.pem from LE is the same exact file as the r11.pem. Looks like there's a bug in the certificate handling/import process on Mikrotik. [...] I recall that without the delays I had problems with this process... Maybe there's some race condition there? A race condi...

Amm0

It's using the R11 certificate, not same as other thread.

Consult the LE web page: https://letsencrypt.org/certificates/

Amm0

In those markets you don't assume your customers are idiots, which is what device-mode assumes. Device mode is direct consequence of exactly this assumption. LOL. Perhaps. But device-mode needs more "sophistication" than just physical presence test. I got similar problem as @sirbryan, why...

Amm0

To be clear — IDK why the forum was getting 500 errors / hanging — I more was trying to make a joke. Now, I did see the active users being 1500 or so - but that does not mean there was an "attack" per se. But it be nice if Mikrotik posted the post-mortem on the failure, since it might a le...

Amm0

I think Mikrotik is trying to prove the point about device-mode that DoS attacks are real.

Amm0

I'm not sure the VRRP address has to be a /32 when it's NOT in same IP subnet? At least in RouterOS 6, Yeah... I had a good handle on how this all worked. And on LAN side, all the same. But with V7, the effects of the new routing engine on VRRP is just not well described and subtlety different. Now ...

Amm0

Mikrotik seems to want to focus home users. So this trend is concerning, since disabling features is not root cause and shows a haphazard approach to security. Its my opinion the the Tik market is focused on small ISP, entrepreneurs, SMB's and the Home users who are enthusiast's ... In those market...

Amm0

How on earth disabling stuff like btest protects just anyone? Are there any documented cases of a feature missuse? no need to get agressive. yes, of course there is documented cases of misuse, even in this forum there are people who are asking why they have unrecognized accounts and unrecognized sc...

Amm0

Still bashing my head on a wall trying to figure out how to use a single WAN IP address for the two routers I have created. The easiest is to use private addresses in the "WAN VRRP", and then NAT out the real public IP. Basically, the VRRP IP address does not have to be in the same subnet...

Amm0

Who guarantees that yourself on the github do not insert commands that create users and open backdoors in the router? The issue is you suggest that anyone who builds an open source script/framework and publish them transparently on GitHub is an 💀⚠️CRITICAL" ..."security issue". So yo...

Amm0

I'm not sure the "💀⚠️CRITICAL" is necessary. Everything here can be relegated to security "best practices". And applies equality to "cut-and-paste" scripts and containers. Or even the dude, which downloads the matching version. And winbox4 new's "Update Winbox"...

Amm0

Inline editing in "list/table view" would be nifty, i.e. no dialog needed would be nice feature.

Amm0

Those, when we click the "ok" button and immediately think "oh, no". The firewall rules aren't special, copy works throughout the UI... and I'm not sure changing how it works is a good idea. Among them is a disabled item would still be committed to "disk", so it anothe...

Amm0

There is one rule with routing rules — the route MUST still exist in main, to be able to be used in another routing table. So you may want the use-default-route enabled on both APNs (or VLAN passthrough'ed), as that would deal with a changing public IP. Just set the default-route-distance higher on ...

Amm0

AFAIK, it like MIBs... you put it into the top-level "files" under the dude directory and it will be moved automatically.
And you can pick the new graphic on the device type to use it.

Amm0

Honestly, maybe it's just my opinion but i have a feeling that cAP ac works better than all of this ax stuff... Maybe your memory is bad, but the old wireless drivers got a lot complaints for years ;). Something like a cAPac also take exacting configuration to work well too... The issue is both ax ...

Amm0

I'll take svg any day.

and SVG rendering support is one step closer to showing Dude maps in WinBox4 (something webfig has long be able to do, since browser has built-in support for SVG while winbox3 does not)

Amm0

suggestion — WinBox4 should use an image for QR codes There are various complaints about the QR code for Wireguard client in 7.17beta thread... I'm not a regular user of the QR codes, but everytime I've tried to use one, I have to adjust the phone and/or fonts/sizing/"something"... While ...

Amm0

If the 2nd APN is working, you get a 2nd LTE interface. With that... At a high level, you need to add new /routing/table that has the 2nd APN's LTE interface as a /ip/route & use /routing/rules to steer the particular IP/subnet traffic to the new routing table for the 2nd LTE interface. But it a...

Amm0

Default configuration does not allow accessing webfig from WAN. Up to a point. The botnet on that article was composed by high end routers (CCR1036, CCR1072, CCR2004, CCR2116). Those have no firewall or protections whatsoever - since they are professional models. Yeah, that's makes the focus on dev...

Amm0

I do not understand what a "mirrored datacenter" means. Yeah that's kinda the central question here. Based on my now dated VMWare knowledge, but the general idea is that an "application" (i.e. CHR) didn't NOT have to be aware of redudency — since VMWare managed syncing all machi...

Amm0

I guess my initial question is if you have an investment in VMWare... wouldn't vMotion/etc work better? In that case you'd two identical CHRs, with VMWare controlling which one was active. VRRP certainly be possible on LAN side pretty easily. And VRRP supports connection tracking sync which keep it ...

Amm0

I guess I'd rather see some "real" switch with more flexible PoE power options... before a modular PoE injector rack.

Right now, there is no switch in the lineup that actually support the entire range of power options (passive, 802.3a[ft][+][+]) on a per-port basis.

Amm0

I thought that for distances up to ca 2km the setting could be omitted. Or should I always round up to next higher km and specify it? I have NOT used wifi-qcom for long PtMP links..... But I can only imagine still you'd want to "round up". While an oversimplification, "distance"...

Amm0

I don't see how having the firmware set to automatic is "better", you have anyway to remember to reboot twice, so you can as well remember to upgrade the firmware. It's eventually get upgraded if one forgot...since at some point you'll reboot. My list was more "unless you know better...

Amm0

Considering they allow+support the "branding kit" to add your own logo to software and remove Mikrotik from SNMP MIB... I'm cannot think of how adding a sticker be any issue. But if you're a distributor or retailer, you'd have to look at any contracts with Mikrotik on such things. Now... w...

Amm0

Can someone duplicate this error? Does it do the same on Android? Not wrong. I get same 0.0.0.0 and also that it still won't save the peer on iOS to RouterOS 7.17beta4. It seems the field does not know it's a ip-prefix type, since it should default should be 0.0.0.0/0, not just plain "0.0.0.0&...

Amm0

My commentary originally was "not much", then turned in a rather long list... To answer some "suggestions on the suggestions"... On "firmware" and/or RouterBOOT and/or BIOS – i.e. auto-update in /system/routerboard... - OP mentioned LTE... and my experience is that late...

Amm0

I find it hard to understand why MT doesn’t enable the interface for all standard ZeroTier options that are available on every other platform except ROS. Agreed. It's still in beta, one can hope. I'm less concern about the specific version that RouterOS uses unless there are security issues... it's...

Amm0

We're on 7.16 and will be on 7.17 soon, yet the zerotier version is once again stuck on 1.10.3 Or, perhaps read the release notes for 7.17: *) zerotier - upgraded to version 1.14.0 Now since the config interface has not changed, RouterOS still supports only a sub-set of features. But certainly any ...

Amm0

Good question. IMO, the defaults in recent RouterOS are pretty good. And, it acts like any common home router by default. So you don't necessarily need to do very much. Here are some general pointers & most are just considerations, rather than "you MUST do this": 0. The most important ...

Amm0

Port should not matter. But you'd have install the routeros LE certificate directly on HA (by exporting the certificate and key from /certificate). A dst-nat rule alone does not add LE encryption, it just forward any TLS traffic.

Amm0

I'm not 100% I understand. MACVLAN give the routers a 2nd MAC address on one RouterOS interface, but alone directly link a printer across VLANs. So I think you may be looking for this approach: https://forum.mikrotik.com/viewtopic.php?t=204025 And also you can use the new mDNS repeater feature if ne...

Amm0

Presumably this is part of what is driving the ideological position of device-mode: https://blog.ovhcloud.com/the-rise-of-packet-rate-attacks-when-core-routers-turn-evil/ And that part of the problem, we don't know what's driving the device-mode changes (i.e. the threat profile). Beyond platitudes ...

Amm0

I'd make sure they know it crashed under 7.17beta - so not just missing RSSI, they should want to take a look at that. It's a bug if something causes a boot loop. I'm pretty the modem is providing RSSI via MBIM since it's requirement and it taking a minute to get to running... kinda does indicate so...

Amm0

So attention, for anyone who hasn't noticed, antennas don't scatter the signal 360 degrees, they scatter it 180 degrees! Chaos is the documentation for this device!!!!!! Clearly a poor cut-and-paste job on the specs page. And IDK why it's hard to for the web specs to match the PDF - the PDF often h...

Amm0

Fortunately there appears to be "json.no-string-conversion" in the documentations for RouterOS for "serialize" - however my system is missing it. It would be helpful for communicating with JSON api where a string is expected regardless of if it happens to be a number. I'm runnin...

Amm0

Please add support for the AmneziaWG protocol using standard tools without using Docker. Bypassing Internet censorship is very important and using it directly inside the router is a big advantage. The problem with adding features like AmneziaWG is its effectiveness is subject to change over time, a...

Amm0

For content filtering like something really granular like"YouTube shorts", you need to re-write the HTML to remove the section. That's more similar to an ad-blocker. So I'd think some browser extension might be easier (perhaps deployed via MDM solution to forced it on clients). Now this is...

Amm0

To do math, you can use ros_command function, and provide RouterOS script since that can deal with bit operations. To display some kinda enum, that's tricker... theoretically one approach be use a probe, with a Function type, and use "units" for your text formatting. I wrote up using the D...

Amm0

It make sence to be 2-dimensional array (fields per lines)

Yeah I kinda abused it here for the more simple case (one field)... but it's more designed to import a CSV file.

Amm0

@optio has a good point. delimiter= is the "field separator", not the "record separator" (if I borrow awk's terms). The default "record separator" is a "newline" it seems.. So the delimiter does not matter if there only one "field" per row, so the de...

Amm0

You are bridging VETH to your LAN. So the VETH IP address need to match the LAN. So the VETH need to be something like: /interface veth add address=10.10.20.201/24 gateway=10.10.20.254 gateway6="" name=veth1 Otherwise, if you want the container to be a separate IP subnet, then you do not w...

Amm0

Not wrong... See https://help.mikrotik.com/docs/spaces/ROS/pages/130220135/Address-lists If the timeout parameter is not specified, then the address will be saved to the list permanently on the disk. If a timeout is specified, the address will be stored on the RAM and will be removed after a system'...

Amm0

Sorry about that, normally the beta do work... And I have 7.17 running on a couple wAPac, but no LtAPs....

You can use the serial port to see what's going on. And perhaps the backup boot loader help, dunno.

But doing a reset to defaults may be quicker.

Amm0

At a high level, potentially yes. But you'd have use src-nat to the public IP and/or potentially other firewall nat/mangle things ... but really depends on what you're trying to do. Normally VRRP is the default gateway for a network on the LAN side, not WAN side.

Amm0

What I'm not sure of is the effect of "use-ip-firewall-for-vlan=yes" as that could add another dimension to ZT bridging. IDK but I've never tested that option with ZT.

Amm0

Ah, you might have needed a delimiter="\r\n" if the file was created on RouterOS since it uses windows line-endings.

Amm0

've already got the logging enabled, so I'll get a fresh boot on T-Mobile and a couple minutes of logs and then submit, thanks. I'm also willing to try the next beta if you think it's worth it. It be worth a ticket. They may just need some ID specific for the EC-25AF, but only MT would know. There ...

Amm0

IDK, but does it work when you only have one IP and/or on interface? Sometimes having multiple interfaces with wine+winbox3 would cause MAC winbox not to work.

Amm0

I guess one long-shot option MIGHT be use /tool/traffic-gen to generate the broadcast packets. Since you have the traces, that might not be so difficult to try. Where it work/help IDK.

Amm0

Could latency be an issue, like their protocol requires very low delays so it works over physical LAN but not when tunneled over the Internet Yes, I am beginning to fear that they are explicitly checking for latency. The tunnel is over a site-to-site OpenVPN from two locations more than 1500km apar...

Amm0

Actually, it looks like I might already be on the latest rev (EC25AFFAR07A14M4G) according to some posts from July. So maybe it's too new :) It should show "RSSI". If you can try T-Mobile again, that be worth a shot to know if it's a Verizon carrier firmware issue. You might want to open ...

Amm0

Your suggestion worked. However, the ip 0.0.0.0, which did not exist in the file, was added. There were no empty lines. The :deserialize is very new, so it may a bug in that actually. i.e. inserting an extra array element, that would unconverted to an IP type, which defaults to 0.0.0.0. Do you have...

Amm0

Additionally make sure RouterOS is at stable, and the /system/routerboard has been updated to latest firmware too. I had no idea that there was separate board firmware from ROS. I upgraded this and it seems to now work in MBIM mode without issue. Seems hard to believe, but ... does that seem legit?...

Amm0

RouterOS like to abstract Linux-things, so I'm not sure they want to bind "files" to some particular linux file system details like owner/group. And FTP follows the same policy system as rest of RouterOS. Also, I think you're presume a higher level of sophistication in policy / AAA elsewhe...

Amm0

In V7, Mikrotik use MBIM with their Quectel models, so I suspect that be best. But if T-Mobile is working...I'm not thinking it's MBIM vs ECM. So yeah switch the LTE modem back to mode=auto may be best plan. Also try lowercase "vzwinternet" and disable "Use Network APN". You may ...

Amm0

Verizon is strict on everything. The modules must be whitelisted by a device manufactured and go through Verizon-specific certification. Modules are certified too, but BOTH module and devices require certification. So this means, unless the module came from a previous Verizon device, you will not be...

Amm0

[lost by accident - I meant reply not edit - but was just example script two post below now]

Amm0

That same thread shows a photo of it. And more importantly the spec sheet on www.mikrotik.com shows "M.2 slot: 1".

But your modem likely has different connectors, so may need some jumper adapt a 5G modems's MHF4 connector the U.FL used by the ATL.

Search found 4791 matches