Community discussions

MikroTik App

Search found 158 matches

by kujo
Tue Oct 09, 2018 8:53 am
Forum: General
Topic: SCEP
Replies: 1
Views: 753

Re: SCEP

For SCEP work you must enable WEB service(IP-service-www)
by kujo
Thu Jan 11, 2018 2:19 pm
Forum: General
Topic: IKE2 no policy found/generated
Replies: 1
Views: 2569

Re: IKE2 no policy found/generated

When we init connection, mikrotik select a proper Selector!
ipsec, init tunnel.JPG
by kujo
Thu Dec 28, 2017 11:11 am
Forum: General
Topic: IKE2 no policy found/generated
Replies: 1
Views: 2569

IKE2 no policy found/generated

Hi bro! I have VPN tunnel in IKE2 mode. Mikrotik CCR1009 v6.40.4 as a server and Windows 10 client! If no packets go through tunnel then Mikrotik drop ph2 dynamic policy from ipsec policy. Time to policy drop ~2h On widows builtin vpn client no error, tunnel still active, but no traffic pass from ro...
by kujo
Wed Dec 20, 2017 10:34 pm
Forum: General
Topic: CCR1009 maxes out at 2gbps?
Replies: 26
Views: 3586

Re: CCR1009 maxes out at 2gbps?

Attach output, please:
/tool profile cpu=all


Yours respectfully!
by kujo
Wed Dec 20, 2017 6:49 pm
Forum: General
Topic: Queue Tree and PCQ
Replies: 6
Views: 763

Re: Queue Tree and PCQ

You mean passthrough=no(not processed in mangle, after this rule)? Or you mean about fastpath(not processed in queue, etc..)?


Yours respectfully!
by kujo
Tue Dec 19, 2017 7:01 pm
Forum: General
Topic: multiple SSTP connections
Replies: 6
Views: 1139

Re: multiple SSTP connections

Easy! Attach your scheme!


Yours respectfully!
by kujo
Tue Dec 19, 2017 7:01 pm
Forum: General
Topic: multiple SSTP connections
Replies: 6
Views: 1139

Re: multiple SSTP connections

Easy! Attach your scheme!


Yours respectfully!
by kujo
Wed Dec 13, 2017 10:33 pm
Forum: General
Topic: Queue Tree and PCQ
Replies: 6
Views: 763

Re: Queue Tree and PCQ

You mark new connection only once when you mark connection , other work do a connection tracker. Packet mark rule do this on each packets! You can look at mangle rule packets count. Connection tracker at /ip firewall connections


Yours respectfully!
by kujo
Wed Dec 13, 2017 10:33 pm
Forum: General
Topic: Queue Tree and PCQ
Replies: 6
Views: 763

Re: Queue Tree and PCQ

You mark new connection only once when you mark connection , other work do a connection tracker. Packet mark rule do this on each packets! You can look at mangle rule packets count. Connection tracker at /ip firewall connections


Yours respectfully!
by kujo
Wed Dec 13, 2017 7:10 am
Forum: General
Topic: Queue Tree and PCQ
Replies: 6
Views: 763

Re: Queue Tree and PCQ

You need to mark connection only once, at forward chain. Then you mark all packets of this named connection in forward chain. This method mark all upload and download stream. Queue try parent must be: for download-lan(downstream to lan) for upload-wan(downstream to wan) don't use global Like this: 1...
by kujo
Tue Dec 12, 2017 4:23 pm
Forum: General
Topic: PPP L2TP Secrets (/ppp l2tp-secret) - what for?
Replies: 2
Views: 3755

Re: PPP L2TP Secrets (/ppp l2tp-secret) - what for?

It's like a password for l2tp protocol! Like a pre-shared key but not a ipsec!
Anybody know were this option set in Windows l2tp client?
by kujo
Sun Dec 10, 2017 9:53 am
Forum: General
Topic: USB relay
Replies: 6
Views: 1498

Re: USB relay

+1. If we can add some input/output board to mikrotik this would be fantastic!


Yours respectfully!
by kujo
Sun Dec 10, 2017 9:52 am
Forum: General
Topic: USB relay
Replies: 6
Views: 1498

Re: USB relay

+1. If we can add some input/output board to mikrotik this would be fantastic!


Yours respectfully!
by kujo
Sun Dec 10, 2017 9:52 am
Forum: General
Topic: USB relay
Replies: 6
Views: 1498

Re: USB relay

+1. If we can add some input/output board to mikrotik this would be fantastic!


Yours respectfully!
by kujo
Sun Dec 10, 2017 9:51 am
Forum: General
Topic: USB relay
Replies: 6
Views: 1498

Re: USB relay

+1. If we can add some input/output board to mikrotik this would be fantastic!


Yours respectfully!
by kujo
Sat Dec 09, 2017 1:35 pm
Forum: General
Topic: SSTP VPN with Win7 'verify client certificate'
Replies: 11
Views: 6131

Re: SSTP VPN with Win7 'verify client certificate'

Ok! Than only way to use IPsec and eap radius?


Yours respectfully!
by kujo
Sat Dec 09, 2017 8:33 am
Forum: Scripting
Topic: How configure two WANs with same IP
Replies: 2
Views: 1075

Re: How configure two WANs with same IP

Try use a bonding method, like LACP or other(need config change for ISP side). Failover from only one ISP its a mistake, maybe. You can add a 3G modem for example for true failover. If you cant do a bonding, you need write a script for interface up/down on some event of connection lost. Yours respec...
by kujo
Fri Dec 08, 2017 2:21 pm
Forum: General
Topic: SSTP VPN with Win7 'verify client certificate'
Replies: 11
Views: 6131

Re: SSTP VPN with Win7 'verify client certificate'

Wrong place to ask.. Contact Microsoft and ask them if such feature will be implemented.
Hi! Can you confirm, that verify-client-certificate is a mikrotik only feature And windows EAP is not a way for make SSTP VPN to mikrotik with cetrificate/tokens?
by kujo
Tue Dec 05, 2017 9:59 pm
Forum: General
Topic: Fasttrack & queue tree non-global queues
Replies: 4
Views: 2163

Fasttrack & queue tree non-global queues

Maybe packets no more mangling? Without packets marks queue don't work? WTF?


Yours respectfully!
by kujo
Sun Dec 03, 2017 5:00 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

I have one sip connection through pppoe and one through ethernet static. NO PROBLEM THERE!


Yours respectfully!
by kujo
Sun Dec 03, 2017 10:46 am
Forum: General
Topic: NAT - Load Balance traffic to be NATed to several destinations
Replies: 3
Views: 519

Re: NAT - Load Balance traffic to be NATed to several destinations

I would do like this: /ip firewall mangle add chain=prerouting action=mark-connection connection-state=new dst-port=80 in-interface-list=WAN\ new-connection-mark=1st_conn_web per-connection-classifier=src-address:3/0 /ip firewall mangle add chain=prerouting action=mark-connection connection-state=ne...
by kujo
Sun Dec 03, 2017 12:27 am
Forum: General
Topic: NAT - Load Balance traffic to be NATed to several destinations
Replies: 3
Views: 519

Re: NAT - Load Balance traffic to be NATed to several destinations

Yes. You can mangle incoming connections in prerouting chain like a PCC style. Than use connection mark in NAT rules for dst-nating to different web servers. Use queue type pcq for limit and balance



Yours respectfully!
by kujo
Thu Nov 30, 2017 10:04 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Turn off connection tracker and check again)


Yours respectfully!
by kujo
Sun Nov 26, 2017 12:56 pm
Forum: Beginner Basics
Topic: Link 2 Mikrotik Routers [SOLVED]
Replies: 8
Views: 1014

Re: Link 2 Mikrotik Routers [SOLVED]

Please, add to your schema ip addresses of used nets. Looks like you make a mistake with networks assign!


Yours respectfully!
by kujo
Sun Nov 26, 2017 12:48 pm
Forum: General
Topic: Need to pass VLAN from WAN to LAN [SOLVED]
Replies: 4
Views: 3364

Re: Need to pass VLAN from WAN to LAN [SOLVED]

You can add second ip address to vlan5 on mikrotik and dstnat to lan switch through this ip


Yours respectfully!
by kujo
Sat Nov 25, 2017 7:14 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Yep, if you need hide your public IP use something like this 1.1.1.1, not private pools! Maybe its asterisk sip.config problem? Do you use provider recommend config? And try install bugfix only image on mikrotik


Yours respectfully!
by kujo
Sat Nov 25, 2017 1:35 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

NAT table not cleared correctly [SOLVED]

I hope that adsl mobem in bridge mobe(Disable dhcp client on ether1-wan interface ) Print sip connection at now, please


Yours respectfully!
by kujo
Fri Nov 24, 2017 4:27 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Why in routes no pref.source in pppoe default route?
There must be your ext address.
This route is Dynamic. Remove from profile "add default route". Disable pppoe. Add this route manually with pref.source! Enable pppoe
by kujo
Fri Nov 24, 2017 3:20 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

/ppp profile add dns-server=192.168.111.1 local-address=dhcp_ovpn1 name=ovpn remote-address=dhcp_ovpn1 use-encryption=required add change-tcp-mss=yes name=wan /interface pppoe-client add add-default-route=yes disabled=no interface=ether1_wan name=pppoe-telekom profile=wan use-peer-dns=yes user=user...
by kujo
Fri Nov 24, 2017 12:53 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

Re: mikrotik ccr and fortigate firewall policy

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?


Yours respectfully!
by kujo
Fri Nov 24, 2017 12:52 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

Re: mikrotik ccr and fortigate firewall policy

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?


Yours respectfully!
by kujo
Fri Nov 24, 2017 12:44 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

NAT table not cleared correctly [SOLVED]

You can also export compact, without sensitive info, your config and put here...


Yours respectfully!
by kujo
Fri Nov 24, 2017 12:39 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Packet sniffer on mikrotik can view all packets to the wan interface(before nat and after nat! No packets no SIP service))) Try change mikrotik to the ... dlink, still problem occur?


Yours respectfully!
by kujo
Fri Nov 24, 2017 9:29 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

NAT table not cleared correctly [SOLVED]

My friend, i'am work with two SIP provider simultaneously without any problem(one asterisk server with different external IP address nated through mikrotik). If your router don't receive any packets from provider of SIP, where you mean problem occur?


Yours respectfully!
by kujo
Thu Nov 23, 2017 9:45 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Try open a ticket in support system of tour SIP provider. If provider don't send to you SIP responses it means, that problem not at router point view!


Yours respectfully!
by kujo
Thu Nov 23, 2017 9:36 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

mikrotik ccr and fortigate firewall policy

Maybe you need create a bridge on ccr, then add a wan port of provider and wan port of fortigate uplink, then you only assign needed external addr to fortigate? But, if you create a bridge, then all ip config need be at bridge interface, not at physical port.


Yours respectfully!
by kujo
Thu Nov 23, 2017 3:32 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

Re: mikrotik ccr and fortigate firewall policy

You can mangle new gateway IP


Yours respectfully!
by kujo
Thu Nov 23, 2017 1:35 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

Re: mikrotik ccr and fortigate firewall policy

You can move traffic by mangle in any needed gateway. Can you?


Yours respectfully!
by kujo
Thu Nov 23, 2017 12:05 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Response packet from SIP provider arrive to Wan interface?
by kujo
Thu Nov 23, 2017 12:01 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Response packet arrive to Wan interface?


Yours respectfully!
by kujo
Wed Nov 22, 2017 11:57 pm
Forum: General
Topic: mikrotik ccr and fortigate firewall policy
Replies: 11
Views: 1444

Re: mikrotik ccr and fortigate firewall policy

Hi! Can you attach a scheme of your net and your plan?


Yours respectfully!
by kujo
Wed Nov 22, 2017 5:23 pm
Forum: Forwarding Protocols
Topic: How to redistribute bandwidth to my secondary mikrotik with static route and two bgp dyanamic route route
Replies: 1
Views: 475

Re: How to redistribute bandwidth to my secondary mikrotik with static route and two bgp dyanamic route route

Create vlan4 on main, set address from pool 148.66.66.0/29. Create vlan4 at satellite, assign another addr from pool(66.3). On main mark all connection to this vlan(by mac or ip), then mark packets. Create on main queue for downstream to satellite, set to max 5m. In mangle route this packets to 148....
by kujo
Wed Nov 22, 2017 3:56 pm
Forum: General
Topic: CCR health monitoring
Replies: 1
Views: 486

Re: CCR health monitoring

We have a big trouble when disk space is over! Monitor this parameter!


Yours respectfully!
by kujo
Wed Nov 22, 2017 11:36 am
Forum: Beginner Basics
Topic: Cisco ASA change to CCR1072
Replies: 6
Views: 1108

Re: Cisco ASA change to CCR1072

Yep... HA its also bgp, few isp... etc. Any device spend cpu to firewall rule processing! But mikrotik is not a security appliance with antivirus, thread detectors, etc...


Yours respectfully!
by kujo
Wed Nov 22, 2017 11:25 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

NAT table not cleared correctly [SOLVED]

Stefan, can you start packet sniffer at mikrotik router? /tool packet sniffer


Yours respectfully!
by kujo
Wed Nov 22, 2017 7:48 am
Forum: Beginner Basics
Topic: Cisco ASA change to CCR1072
Replies: 6
Views: 1108

Re: Cisco ASA change to CCR1072

Cisco ASAP is a firewall and ccr is a router. Not the same type of product. ROS does have a firewall and can be used but is not built to be a firewall. I use ROS at home as both firewall and router but would not do so at work. I personally like Pfsense a lot. They also have some great appliances an...
by kujo
Wed Nov 22, 2017 7:28 am
Forum: General
Topic: A summary about performance queue tree in CCR for medium-large cases
Replies: 4
Views: 1084

Re: A summary about performance queue tree in CCR for medium-large cases

Any feedback from support?


Yours respectfully!
by kujo
Wed Nov 22, 2017 7:24 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

NAT table not cleared correctly [SOLVED]

Ok. There are all good in ip firewall. Try turn on packet sniffer on all interface and udp and port 5060. How the packers arrive? Look at connection tracker when you make outgoing call. Look at asterisk console, 'sip show peers', and calls log. You also can turn on debug on specific sip channel! You...
by kujo
Tue Nov 21, 2017 3:44 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Ok. Can you past /ip firewall nat export compact?


Yours respectfully!
by kujo
Tue Nov 21, 2017 3:44 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Ok. Can you past /ip firewall nat export compact?


Yours respectfully!
by kujo
Tue Nov 21, 2017 8:24 am
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

You may try In firewall services disable sip helper


Yours respectfully!
by kujo
Mon Nov 20, 2017 11:20 pm
Forum: General
Topic: NAT table not cleared correctly [SOLVED]
Replies: 77
Views: 9026

Re: NAT table not cleared correctly [SOLVED]

Do you receive new IP on wan interface thought DHCP or there's static one? Sip providers often firewalling clients connection and make a static entry user-ip. Sip use udp, udp-timeout (time; Default: 10s)


Yours respectfully!
by kujo
Wed Nov 01, 2017 9:22 pm
Forum: Beginner Basics
Topic: Implicit route rule?
Replies: 5
Views: 664

Re: Implicit route rule?

Maybe mikrotik need add a feature for display implicit rules for "guru-mode"? (Read-only)


Yours respectfully!
by kujo
Wed Nov 01, 2017 9:17 pm
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

Yep. What problem occur in action filed#6? Why our friends from mikrotik don't give a comment to this error type, user friendly description?


Yours respectfully!
by kujo
Wed Nov 01, 2017 9:17 pm
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

Yep. What problem occur in action filed#6? Why our friends from mikrotik don't give a comment to this error type, user friendly description?


Yours respectfully!
by kujo
Wed Nov 01, 2017 4:56 pm
Forum: Beginner Basics
Topic: Implicit route rule?
Replies: 5
Views: 664

Re: Implicit route rule?

Many authors show examples (even coaches) that this mysterious rule is necessary. I want to understand whether this is a myth
/ip route rule add action=lookup routing-mark=ISP1 table=ISP1
by kujo
Wed Nov 01, 2017 4:45 pm
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

We think that this is not a flash memory problem, but a mikrotik!
Does overflow of flash memory lead to loss of all data? Where did you see this ext3/linux? Why there is no reserve for system functions?
Dear mikrotik, maybe need some fix?
by kujo
Tue Oct 31, 2017 3:04 pm
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

When we reboot this router - CCR print at LCD "Loading kernel" and don`t boot anymore! Netinstall repair flash error!
action failed (6)
- it's a flash file system error!
by kujo
Tue Oct 31, 2017 11:48 am
Forum: Beginner Basics
Topic: Implicit route rule?
Replies: 5
Views: 664

Implicit route rule?

Hi! Mark routing in mangle: /ip firewall mangle add action=mark-routing chain=prerouting src-address=192.168.0.10 new-routing-mark=ISP1 Then create this type of route in different table ISP1 /ip route add distance=1 gateway=1.1.1.1 routing-mark=ISP1 We really need set up this type of rule: /ip route...
by kujo
Mon Oct 30, 2017 11:14 am
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

must be formated first

Yep, this don`t help. On other CCR flash attached and recognized without a peep!
You can't delete existing files due to they locked by running Dude.
My friend, we can`t delete any file from storage: old backup, supout, etc.. :(
by kujo
Mon Oct 30, 2017 10:56 am
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Re: Disk full

Insert flash card or USB drive.
Yes, I'am insert flash now, but CCR don`t see any new disk attached
Move the dude storage to the external drive and start the dude
We can`t move/delete/create files on main storage, because error occur!
Thank`s for reply!
by kujo
Mon Oct 30, 2017 9:29 am
Forum: General
Topic: Disk full
Replies: 12
Views: 4459

Disk full

Hi! We have a problem with CCR-1009. Dude database occupy all disk space! no space.JPG When we try to delete any files, error occur: remove failed.JPG When we try remove file from console - some error: /file> remove 10 action failed (6) We don't try a reboot the device, maybe somebody help us!
by kujo
Wed Oct 18, 2017 10:54 pm
Forum: Beginner Basics
Topic: NAT Problem
Replies: 3
Views: 545

Re: NAT Problem

Can you targeting your problem?


Yours respectfully!
by kujo
Wed Oct 18, 2017 10:33 pm
Forum: Wireless Networking
Topic: CAPsMAN over L2 or L3 ?
Replies: 2
Views: 892

Re: CAPsMAN over L2 or L3 ?

We use L3, no problem. Your network design dictates your level of communication. Try use cert in cap auth!


Yours respectfully!
by kujo
Sun Oct 15, 2017 9:31 am
Forum: Beginner Basics
Topic: NAT Problem
Replies: 3
Views: 545

Re: NAT Problem

You don't need make dstnat to router service ports. Dst-address-type="" - this's incorrect in first rule...


Yours respectfully!
by kujo
Tue Oct 03, 2017 8:28 pm
Forum: General
Topic: Traceroute problem
Replies: 6
Views: 1206

Re: Traceroute problem

Try turn on logging in all deny firewall rules log=yes


Yours respectfully!
by kujo
Tue Oct 03, 2017 7:04 am
Forum: Beginner Basics
Topic: Spoofing Internal Network from WAN Connection Through Port 25 or Malware?
Replies: 2
Views: 525

Re: Spoofing Internal Network from WAN Connection Through Port 25 or Malware?

Can you look at mail log files? This is not router problem, but mikrotik can make a spoofing preventing rule in firewall
 ip firewall filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=wan log=yes


Yours respectfully!
by kujo
Tue Oct 03, 2017 7:00 am
Forum: General
Topic: A summary about performance queue tree in CCR for medium-large cases
Replies: 4
Views: 1084

Re: A summary about performance queue tree in CCR for medium-large cases

Queue tree parent need be a interfaces. In mangle try mark connection, then mark packets, you don't need mark upload/download stream, if queue parent=interface.


Yours respectfully!
by kujo
Wed Sep 27, 2017 6:39 pm
Forum: General
Topic: Strange Issue with CRS125-24G-1S
Replies: 4
Views: 845

Strange Issue with CRS125-24G-1S

Hm! Same strange issue I'am detect on CCR1009 v.6.39.2 on switch group ports! Maybe it's winbox bug?


Yours respectfully!
by kujo
Thu Sep 21, 2017 7:06 am
Forum: Beginner Basics
Topic: Setting up RB750r2 hEX lite with radius server
Replies: 8
Views: 1564

Re: Setting up RB750r2 hEX lite with radius server

Maybe this helps viewtopic.php?t=66578


Yours respectfully!
by kujo
Fri Sep 08, 2017 5:41 pm
Forum: Beginner Basics
Topic: input: in:(unknown) out:(none) [SOLVED]
Replies: 6
Views: 5715

Re: input: in:(unknown) out:(none) [SOLVED]

Yes! Good idea! Work perfect!
add action=accept chain=input  connection-state=new dst-address-type=local src-address-type=local
by kujo
Fri Sep 08, 2017 9:29 am
Forum: Beginner Basics
Topic: input: in:(unknown) out:(none) [SOLVED]
Replies: 6
Views: 5715

Re: input: in:(unknown) out:(none) [SOLVED]

If lo interface hidden, then maybe need hidden rule, like "allow from lo to lo"? Capsman connect to self by address 192.168.66.1. And we see that in interface also unknown! Any self connection from unknown interface! 09:25:00 firewall,info drop input: in:(unknown) out:(none), proto UDP, 192.168.66.1...
by kujo
Thu Sep 07, 2017 11:04 pm
Forum: Beginner Basics
Topic: input: in:(unknown) out:(none) [SOLVED]
Replies: 6
Views: 5715

Re: input: in:(unknown) out:(none) [SOLVED]

Work only this rules to block/allow this traffic
/ip firewall filter
add action=accept chain=input dst-address-type=local port=23 protocol=tcp comment=This rule work
add action=accept chain=input port=23 protocol=tcp comment=This rule work too, BUT both allow/block all telnet traffic
by kujo
Thu Sep 07, 2017 9:08 pm
Forum: Beginner Basics
Topic: input: in:(unknown) out:(none) [SOLVED]
Replies: 6
Views: 5715

input: in:(unknown) out:(none) [SOLVED]

Hello! When connect to selt, for example to telnet (127.0.0.1:23) we can log this message: 09:28:35 firewall,info telnet input: in:(unknown) out:(none), proto TCP (ACK), 127.0.0.1:40539->127.0.0.1:23, len 52 09:28:38 firewall,info telnet input: in:(unknown) out:(none), proto TCP (ACK,PSH), 127.0.0.1...
by kujo
Thu Jun 01, 2017 10:00 am
Forum: Announcements
Topic: v6.40rc [release candidate] is released!
Replies: 231
Views: 51352

Re: v6.40rc [release candidate] is released!

Hi!
Do we need add in last position of chain=bad_tcp RETURN rule?
/ip firewall raw add action=return chain=bad_tcp
by kujo
Mon Mar 27, 2017 1:16 pm
Forum: General
Topic: Just got my new CCR1009-7G-1C-PC
Replies: 24
Views: 4642

Re: Just got my new CCR1009-7G-1C-PC

What model of switch?


Sent from my iPhone using Tapatalk
by kujo
Sun Mar 26, 2017 8:22 am
Forum: General
Topic: Just got my new CCR1009-7G-1C-PC
Replies: 24
Views: 4642

Just got my new CCR1009-7G-1C-PC

I use bonding for connecting to the Lan switch, like LACP, try it. If port in bridge, then all references need apply to bridge (address, rules, queues)


Sent from my iPhone using Tapatalk
by kujo
Sat Mar 25, 2017 10:46 pm
Forum: General
Topic: Just got my new CCR1009-7G-1C-PC
Replies: 24
Views: 4642

Re: Just got my new CCR1009-7G-1C-PC

Create bridge, add add this two ports to newly created bridge


Sent from my iPhone using Tapatalk
by kujo
Sat Mar 25, 2017 9:23 am
Forum: Virtualization
Topic: CHR on KVM - auto-negotiation fails
Replies: 11
Views: 5255

Re: CHR on KVM - auto-negotiation fails

Hello RESOLUTION: Go to Queues-->Interface Queues. Check mode of all virtual interfaces. default: ""only-hardware-queue" changed this to "multi-queue-ethernet-default". WARNING: : After this change, u can lost connection to router near 5-10 seconds, i dunno why. You need update CHR to latest stable...
by kujo
Sat Mar 25, 2017 9:23 am
Forum: Virtualization
Topic: CHR on KVM - auto-negotiation fails
Replies: 11
Views: 5255

Re: CHR on KVM - auto-negotiation fails

Hello RESOLUTION: Go to Queues-->Interface Queues. Check mode of all virtual interfaces. default: ""only-hardware-queue" changed this to "multi-queue-ethernet-default". WARNING: : After this change, u can lost connection to router near 5-10 seconds, i dunno why. You need update CHR to latest stable...
by kujo
Fri Mar 17, 2017 2:33 pm
Forum: Virtualization
Topic: CHR NAT performance on desktop HW?
Replies: 5
Views: 2478

Re: CHR NAT performance on desktop HW?

anybody with similar or (hopefully) different experience with CHR NAT throughput?
Can you update to latest RC? There are some trouble with interface queues!
by kujo
Tue Mar 14, 2017 10:33 pm
Forum: Beginner Basics
Topic: First jump with stars, in tracert
Replies: 2
Views: 543

Re: First jump with stars, in tracert

Type your ip filter. Maybe icmp outgoing block?


Sent from my iPhone using Tapatalk
by kujo
Mon Feb 20, 2017 10:16 pm
Forum: General
Topic: Route marking, static route and nat
Replies: 1
Views: 1197

Re: Route marking, static route and nat

Add before first /ip firewall mangle chain=forward in-interface=vlan1000 new-connection-mark=TUN_conn
And make changes in route mark.


Sent from my iPhone using Tapatalk
by kujo
Mon Feb 20, 2017 5:10 pm
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93435

Re: v6.39rc [release candidate] is released

Version 6.39rc33 has been released.

*) chr - fixed problem when transmit speed was reduced by interface queues;
Thank you!
by kujo
Sat Jan 07, 2017 11:51 pm
Forum: Announcements
Topic: v6.39rc [release candidate] is released
Replies: 391
Views: 93435

Re: v6.39rc [release candidate] is released

Kalpar - Yes, that is exactly what was done! MRRU works in same way as it did before, but it is now adjusted/updated to multi core age
Can we use L2TP + MRRU over one WAN link of PPPoE provider 1492 MTU/MRU?


Sent from my iPhone using Tapatalk
by kujo
Fri Jan 06, 2017 6:32 pm
Forum: RouterOS v7 BETA
Topic: v6.38 [current] is released!
Replies: 168
Views: 42490

v6.38 [current] is released!

Who then tested the limit of connections? it seems that the filter rule is not working with him! CHR 6.38 /ip firewall filter add connection-state=new chain=forward connection-nat-state=dst-nat dst-port=443 connection-limit=100,32 Sorry! Work well!! Need add not! To connection-limit Sent from my iPh...
by kujo
Tue Dec 20, 2016 12:42 pm
Forum: General
Topic: PPPoe fast download, slow upload
Replies: 8
Views: 2975

Re: PPPoe fast download, slow upload

Pppoe Provider switch-100mb/s<-->cooper<-->converter-1gb/s<-->fiber<-->converter-1gb/s<-->cooper<-->ccr1009-1gb/s. When provider reconnect my to 1gb/s port on his switch, then full bandwidth on channel appears!!!


Sent from my iPhone using Tapatalk
by kujo
Tue Dec 20, 2016 12:35 pm
Forum: General
Topic: queue tree - mutiple wan interfaces - what should be the parent ?
Replies: 32
Views: 4601

queue tree - mutiple wan interfaces - what should be the parent ?

Can you attach screenshots of queue tree and mangle from winbox?


Sent from my iPhone using Tapatalk
by kujo
Thu Dec 15, 2016 9:26 pm
Forum: General
Topic: queue tree - mutiple wan interfaces - what should be the parent ?
Replies: 32
Views: 4601

Re: queue tree - mutiple wan interfaces - what should be the parent ?

Maybe incorrect mangle? Need more info about traffic type, source and dst... You can learn a traffic flow diagram...


Sent from my iPhone using Tapatalk
by kujo
Thu Dec 15, 2016 2:43 pm
Forum: General
Topic: queue tree - mutiple wan interfaces - what should be the parent ?
Replies: 32
Views: 4601

Re: queue tree - mutiple wan interfaces - what should be the parent ?

Good question! Some problem. Wan interface for upload streams, lan interface for download stream. Global for input/output chain. But what interface we install in download stream if have multiple wan with different bandwidth ?? We need create correct mangle for each interface! Mangle for wan1, wan2.....
by kujo
Tue Dec 13, 2016 9:32 pm
Forum: RouterBOARD hardware
Topic: CCR1076
Replies: 8
Views: 1747

Re: CCR1076

Cool!!!


Sent from my iPhone using Tapatalk
by kujo
Sat Dec 10, 2016 11:01 am
Forum: General
Topic: CCR1009 switch2 type:unknown
Replies: 2
Views: 682

Re: CCR1009 switch2 type:unknown

If you can't past config, add some screenshots, where trouble exist.


Sent from my iPhone using Tapatalk
by kujo
Fri Dec 09, 2016 7:16 pm
Forum: General
Topic: IP mangle drives me crazy!!
Replies: 21
Views: 5901

Re: IP mangle drives me crazy!!

:D


Sent from my iPhone using Tapatalk
by kujo
Fri Dec 09, 2016 10:53 am
Forum: General
Topic: Best configured Bridge Filter Rules
Replies: 6
Views: 18190

Re: Best configured Bridge Filter Rules

Drop client to client talk in bridge, also drop fake dhcp (if dhcp on bridge interface). For guest wifi network
/interface bridge filter
add action=drop chain=forward comment="Drop all to !bridge self host" in-bridge=bridge-guest  out-bridge=bridge-guest packet-type=!host
by kujo
Wed Dec 07, 2016 7:08 pm
Forum: General
Topic: Should I update from 6.33.1 (stable) to current?
Replies: 2
Views: 571

Re: Should I update from 6.33.1 (stable) to current?

If working then don't touch!! :D


Sent from my iPhone using Tapatalk
by kujo
Wed Nov 30, 2016 10:37 pm
Forum: Announcements
Topic: v6.37.3 [current] is released!
Replies: 58
Views: 23159

Re: v6.37.3 [current] is released!

Lucky )))


Sent from my iPhone using Tapatalk
by kujo
Mon Nov 28, 2016 4:10 pm
Forum: General
Topic: Multi IP on WAN & Masq help needed
Replies: 15
Views: 1919

Re: Multi IP on WAN & Masq help needed

Try add
/ip route rule add dst-address 19.1.16.152/29 table=main


Sent from my iPhone using Tapatalk
by kujo
Mon Nov 28, 2016 3:01 pm
Forum: General
Topic: Multi IP on WAN & Masq help needed
Replies: 15
Views: 1919

Re: Multi IP on WAN & Masq help needed

Can you turn on packet sniffer on this vlan, and look at icmp traffic, its arrived to you?


Sent from my iPhone using Tapatalk
by kujo
Mon Nov 28, 2016 11:39 am
Forum: General
Topic: Multi IP on WAN & Masq help needed
Replies: 15
Views: 1919

Re: Multi IP on WAN not working

If you create vlan interface, than set address to this interface.


Sent from my iPhone using Tapatalk
by kujo
Sat Nov 26, 2016 6:34 pm
Forum: General
Topic: Facebook Full Speed script
Replies: 8
Views: 6046

Re: Facebook Full Speed script

Make a mangle of facebook connection and then mark packets. Create queue to catch this packets.


Sent from my iPhone using Tapatalk
by kujo
Fri Nov 25, 2016 10:07 am
Forum: General
Topic: System logging, multiple topics
Replies: 0
Views: 400

System logging, multiple topics

Hi! We use remote logging to syslog server! This code work well /system logging add action=remote topics=critical and this code don't send any packets to syslog and I'am check this on /tools packet sniffer /system logging add action=remote topics=warning,info,error,critical,caps It's a feature of co...
by kujo
Thu Nov 24, 2016 6:58 am
Forum: General
Topic: Simple queue treating not working when using unlimited
Replies: 2
Views: 537

Re: Simple queue treating not working when using unlimited

Limit to 10Gb/s )))


Sent from my iPhone using Tapatalk
by kujo
Sun Nov 13, 2016 11:00 am
Forum: Virtualization
Topic: CHR on KVM - auto-negotiation fails
Replies: 11
Views: 5255

Re: CHR on KVM - auto-negotiation fails

License P1 only 1gb/s interface speed! Maybe you need p10!
http://wiki.mikrotik.com/wiki/Manual:CHR#CHR_Licensing


Sent from my iPhone using Tapatalk
by kujo
Wed Oct 19, 2016 10:34 pm
Forum: Beginner Basics
Topic: No SNAT rules applied for packets from VLAN interface
Replies: 8
Views: 1298

Re: No SNAT rules applied for packets from VLAN interface

Hi, maybe you can try this: On dlink move uplink port in tagged vlan1,vlan2,default. On roteros create vlan1 and move address 192.168.1.1 to vlan1 interface .


Sent from my iPhone using Tapatalk
by kujo
Sun Oct 16, 2016 8:52 am
Forum: General
Topic: IPIP tunnels with 2 ISPs ??
Replies: 2
Views: 505

IPIP tunnels with 2 ISPs ??

Install CHR in cloud, create on them ppp server, configure ospf.Ppp clients(cenral, site a, b) connect to the central router CHR through isp1 or/and isp2
by kujo
Sat Oct 15, 2016 12:23 pm
Forum: General
Topic: L2TP+IPSec with LAN Access
Replies: 10
Views: 4960

L2TP+IPSec with LAN Access

Maybe some log export can help ? Trace route from l2tp client? Routing table from router and from warrior!?
by kujo
Sat Oct 15, 2016 11:04 am
Forum: General
Topic: L2TP+IPSec with LAN Access
Replies: 10
Views: 4960

Re: L2TP+IPSec with LAN Access

Do you change l2tp server address to 192.168.1.1?


Sent from my iPhone using Tapatalk
by kujo
Sat Oct 15, 2016 12:41 am
Forum: General
Topic: L2TP+IPSec with LAN Access
Replies: 10
Views: 4960

Re: L2TP+IPSec with LAN Access

You don't need second masquerade rule. Do you accept on client option for create a default route to l2tp server? Remove l2tp interface from bridge(option in ppp profile), change network for l2tp server and client like 192.168.1.0/24(l2tp-pool). Add accept forward filter rule where incoming interface...
by kujo
Fri Oct 14, 2016 5:31 pm
Forum: General
Topic: L2TP+IPSec with LAN Access
Replies: 10
Views: 4960

Re: L2TP+IPSec with LAN Access

You need correct routing table, correct firewall filter(not address list). Export this two things. And Your scheme is not displayed, repeat please))


Sent from my iPhone using Tapatalk
by kujo
Tue Sep 13, 2016 9:09 pm
Forum: Forwarding Protocols
Topic: Same Subnet on both sides of L2TP Tunnel NAT
Replies: 8
Views: 2137

Re: Same Subnet on both sides of L2TP Tunnel NAT

Create vlans for this pc. Create vlan interface on routers, make a routing.


Have a good day!
by kujo
Mon Sep 05, 2016 11:15 pm
Forum: General
Topic: PPPoe fast download, slow upload
Replies: 8
Views: 2975

Re: PPPoe fast download, slow upload

Hi! Try set interface queue to multiqueue on CCR device.


Have a good day!
by kujo
Fri Aug 19, 2016 10:55 pm
Forum: General
Topic: Cloud VPN Network
Replies: 3
Views: 1583

Cloud VPN Network

1. You need central peer(ppp client, maybe cloud router). This router connect to the your site routers( mikrotik, with configured ppp server!) Client(cloud) make a connect to the sites(office). If no router(physical) in cloud - try use a CHR. 2. Use L2tp servers on office sites and l2tp clients on m...
by kujo
Fri Aug 19, 2016 10:47 pm
Forum: General
Topic: ppp out routing mark
Replies: 5
Views: 1302

Re: ppp out routing mark

Try mangle connection first, then mark route. If no success, try change route in isp2 table to interface route


Have a good day!
by kujo
Wed Aug 17, 2016 10:02 pm
Forum: General
Topic: [Solved] Route wlan3 through vpn (pptp) - Help!
Replies: 8
Views: 1230

Re: Route wlan3 through vpn (pptp) - Help!

Ok, move vpn masquerade rule to the first position


Have a good day!
by kujo
Wed Aug 17, 2016 9:16 pm
Forum: Beginner Basics
Topic: L2tp ipsec problem
Replies: 3
Views: 2198

Re: L2tp ipsec problem

And print macos ipsec settings, please


Have a good day!
by kujo
Wed Aug 17, 2016 7:14 am
Forum: General
Topic: [Solved] Route wlan3 through vpn (pptp) - Help!
Replies: 8
Views: 1230

Re: Route wlan3 through vpn (pptp) - Help!

Try modify masquerade rules, set src address in vpn rule and in pppoe rule, remove duplicate pppoe rule


Have a good day!
by kujo
Mon Aug 15, 2016 4:27 pm
Forum: General
Topic: could not add address. Already have such address.
Replies: 8
Views: 8623

Re: could not add address. Already have such address.

CCR1009-8G-1S-1S+ v 6.35.4 L2TP server is Enabled Two l2tp client is enabled and work One pppoe client is enabled and work DO: Disable L2TP server, and see this problem. All l2tp and pppoe client closed. Ip address of two l2tp client are mark red in address list and clients can't connect because ip ...
by kujo
Wed Aug 10, 2016 10:11 pm
Forum: Beginner Basics
Topic: help me
Replies: 6
Views: 948

Re: help me

Good config!! Very well!!


Have a good day!
by kujo
Thu Aug 04, 2016 10:07 am
Forum: General
Topic: CCR reboots automatically
Replies: 27
Views: 3487

Re: CCR reboots automatically

Wah!! Good load, maybe ccr-1036 or 1072 help for your setup??


Have a good day!
by kujo
Wed Aug 03, 2016 11:04 pm
Forum: General
Topic: CCR1009-8G-1S kernel failure
Replies: 5
Views: 871

Re: CCR1009-8G-1S kernel failure

Hm.. Write to support@ I'am can test also this two-pppoe-conn-trable


Have a good day!
by kujo
Wed Aug 03, 2016 11:01 pm
Forum: General
Topic: CCR reboots automatically
Replies: 27
Views: 3487

Re: CCR reboots automatically

Can you analyze access level? 150-200mb/s not problem for ccr. Analyze connections tracker! Any log items present before reboot? 3 ccr??? Can you attach net scheme ?


Have a good day!
by kujo
Wed Aug 03, 2016 9:52 pm
Forum: General
Topic: CCR reboots automatically
Replies: 27
Views: 3487

Re: CCR reboots automatically

Queue on 1500 users? Memory usage? Cpu usage, health of board?


Have a good day!
by kujo
Wed Aug 03, 2016 9:44 pm
Forum: General
Topic: 1:1 NAT
Replies: 9
Views: 2060

Re: 1:1 NAT

Good shema, create a bridge between networks, create dhcp server and configure dynamic ip assign on all pc.


Have a good day!
by kujo
Wed Aug 03, 2016 11:47 am
Forum: General
Topic: CCR1009-8G-1S kernel failure
Replies: 5
Views: 871

Re: CCR1009-8G-1S kernel failure

Try downgrading


Have a good day!
by kujo
Tue Aug 02, 2016 12:42 am
Forum: Forwarding Protocols
Topic: OSPF
Replies: 3
Views: 988

Re: OSPF

Hi, do you try configure ospf over l2tp in ptp interface mode? Thera are some err on ccr 6.35. Incorrect routes are coming. Choose ptmp mode resolve this!


Have a good day!
by kujo
Tue Aug 02, 2016 12:37 am
Forum: General
Topic: feature request: add Port List to firewall
Replies: 35
Views: 9063

Re: feature request: add Port List to firewall

Cool. Make port-list, list in list also good ))
P.S. in prerouting mangle mark dscp (63-groups/portlist) and manipulate packets in filter on dscp based rules. Portlist by routeros(We are not looking for easy ways)


Have a good day!
by kujo
Sun Jul 31, 2016 9:56 am
Forum: General
Topic: Decreasing inbound speed on L2TP/IPsec
Replies: 11
Views: 2679

Re: Decreasing inbound speed on L2TP/IPsec

Try use aes128


Have a good day!
by kujo
Tue Jul 26, 2016 11:55 pm
Forum: General
Topic: Queue tree bandwidth management by VLAN
Replies: 11
Views: 4233

Re: Queue tree bandwidth management by VLAN

Attach scheme of your site. Why you want control AP traffic directly? Maybe use shaping of clients or services? If you want separate AP traffic to queue you need QinQ vlans.
Image



Have a good day!
by kujo
Sat Jul 23, 2016 4:51 pm
Forum: General
Topic: Possible YouTube video ideas
Replies: 29
Views: 4220

Re: Possible YouTube video ideas

Routing rules in routeros, please!


Have a good day!
by kujo
Sat Jul 23, 2016 4:34 pm
Forum: Wireless Networking
Topic: CAPsMAN Guest WiFi can't acces to internet
Replies: 4
Views: 977

Re: CAPsMAN Guest WiFi can't acces to internet

Any firewall rules in your config? /ip address print?


Have a good day!
by kujo
Mon Jul 18, 2016 12:23 am
Forum: Forwarding Protocols
Topic: NAT performance CCR1009-8G-1S-1S+
Replies: 13
Views: 2056

NAT performance CCR1009-8G-1S-1S+

Pptp, pppoe, vlan, check your mtu config? How many broadcast traffic?

Have a good day!
by kujo
Mon Jul 18, 2016 12:09 am
Forum: Forwarding Protocols
Topic: NAT performance CCR1009-8G-1S-1S+
Replies: 13
Views: 2056

NAT performance CCR1009-8G-1S-1S+

Pppoe speed over 100? Try to reduce interface speed to 100mb/s, share interface load, pls


Have a good day!
by kujo
Sun Jul 17, 2016 11:58 pm
Forum: Forwarding Protocols
Topic: NAT performance CCR1009-8G-1S-1S+
Replies: 13
Views: 2056

NAT performance CCR1009-8G-1S-1S+

Why you think it's a NAT trable? 60% good load! You are network monster! Maybe connect second device in active-active mode? Also try update to current!


Have a good day!
by kujo
Sun Jul 17, 2016 11:49 pm
Forum: Forwarding Protocols
Topic: NAT performance CCR1009-8G-1S-1S+
Replies: 13
Views: 2056

Re: NAT performance CCR1009-8G-1S-1S+

Maybe you can print some stats of your RB?
http://wiki.mikrotik.com/wiki/Manual:System/Resource
Config without ipsec tunnels?


Have a good day!
by kujo
Sun Jul 17, 2016 11:38 pm
Forum: Forwarding Protocols
Topic: NAT performance CCR1009-8G-1S-1S+
Replies: 13
Views: 2056

Re: NAT performance CCR1009-8G-1S-1S+

Have you any queue and routing rules ?


Have a good day!
by kujo
Sun Jul 17, 2016 11:32 pm
Forum: RouterBOARD hardware
Topic: CCR, "enterprise ready", seriously???
Replies: 35
Views: 6587

Re: CCR, "enterprise ready", seriously???

Cisco? The DLink switch have a two image on board! Its a big problem install second flash chip of RB(redudance power not problem at all)? And create alert if user configure log all package to the disk in 300 Mb/s networking?


Have a good day!
by kujo
Wed Jul 13, 2016 11:35 pm
Forum: General
Topic: Need to foward mail to another server
Replies: 3
Views: 571

Re: Need to foward mail to another server

Another ISP(receive/send email, correct dns record). Create a tunnel between new isp and main isp.
From new isp->routeros->ip tunnel->old isp(if not block ipsec/gre)->routeros->mail server


Have a good day!
by kujo
Wed Jul 13, 2016 8:33 pm
Forum: General
Topic: Multiple VLANs at remote site
Replies: 7
Views: 1131

Re: Multiple VLANs at remote site

Pppoe passthrough to ccr?


Have a good day!
by kujo
Tue Jul 12, 2016 6:55 pm
Forum: General
Topic: VLAN tagging question
Replies: 7
Views: 947

VLAN tagging question

Hi, set IP conf on vlan interface!
/interface vlan
add name=vlan-wan12 vlan-id=12 interface=sfp1
/ip address 1.1.1.12 interface=vlan-wan12


Have a good day!
by kujo
Thu Jun 30, 2016 7:52 am
Forum: General
Topic: (Higher) Bandwidth Speeds
Replies: 1
Views: 541

Re: (Higher) Bandwidth Speeds

/queue simple add name=speed-test target=eth1-wan max-limit=50M/50M


Have a good day!
by kujo
Thu Jun 30, 2016 12:13 am
Forum: General
Topic: QoS for VoIP question
Replies: 1
Views: 469

Re: QoS for VoIP question

Need your config export! Mangle, queue, connection map)) You need after connection-mark, mark the packets for use in queue. Simple queue can work without packet mark.


Have a good day!
by kujo
Tue Jun 28, 2016 4:44 pm
Forum: General
Topic: IPSec Issue
Replies: 10
Views: 1095

Re: IPSec Issue

I removed the source address to verify nothing changed. Any other suggestions? Check the are action accept or masquerade? Insert before /ip firewall filter add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes...
by kujo
Tue Jun 28, 2016 4:29 pm
Forum: General
Topic: Routing rules and queue tree
Replies: 0
Views: 686

Routing rules and queue tree

Hello! On CCR1009-8G-1S-1S+, v6.34.6, have a config: /ip address add address=1.1.1.209/29 interface="eth1-ISP1" network=1.1.1.208 comment="ISP1 29 block, first IP" add address=1.1.1.210/29 interface="eth1-ISP1" network=1.1.1.208 comment="ISP1 29 block, second IP" add address=2.2.2.209/32 interface="...
by kujo
Mon Jun 27, 2016 10:36 pm
Forum: General
Topic: IPSec Issue
Replies: 10
Views: 1095

Re: IPSec Issue

Try to bypass nat for remote net
/ip firewall nat chain=srcnat dst-address=192.168.3.0/24 action=accept place-before=0

Have a good day!
by kujo
Sat Jun 25, 2016 4:04 pm
Forum: General
Topic: Poor (ridiculously) performance on two CCR1072
Replies: 54
Views: 8212

Re: Poor (ridiculously) performance on two CCR1072

Hi, any news??


Have a good day!
by kujo
Thu Jun 23, 2016 11:28 pm
Forum: General
Topic: Forward trafic to pc ccproxy
Replies: 2
Views: 715

Re: Forward trafic to pc ccproxy

Buy additional router. Add ipsec tunnel on miktotik in net 10.10.10.1<-->mikrotic in net 192.168.0.0. Add ipsec rule, peer, proposal. Web site routing must know where net 10.10.10.0


Have a good day!
by kujo
Thu Jun 23, 2016 11:05 pm
Forum: General
Topic: OpenVPN client problems
Replies: 4
Views: 1262

Re: OpenVPN client problems

Change location of cert and keys


Have a good day!
by kujo
Thu Jun 23, 2016 10:57 pm
Forum: General
Topic: CCR1036 PPPoE server bad performances
Replies: 10
Views: 2629

Re: CCR1036 PPPoE server bad performances

Sorry men, not success! Storm star again, 1-2 times per hour...


Have a good day!
by kujo
Wed Jun 22, 2016 9:43 pm
Forum: General
Topic: CCR1036 PPPoE server bad performances
Replies: 10
Views: 2629

Re: CCR1036 PPPoE server bad performances

Hi all,
I think is a cpu issue, though it isn't at 100%. I don't understand why.
Is it a software limit or a hardware limit? 
Hi! Set auto negotiation of interface with pppoe to 100Mb/s only mode.
Remove all jump rules from mangle.
I'am have success !


Have a good day!
by kujo
Mon Jun 20, 2016 12:34 am
Forum: Beginner Basics
Topic: Jump seems not to capture all packets it should
Replies: 2
Views: 749

Re: Jump seems not to capture all packets it should

Hm! How you route traffic across WAN's ? Also use jump rule on WAN pppoe client, and have a very poor performance on upload speed. I check tomorrow is that all packets catch.


Have a good day!
by kujo
Sun Jun 19, 2016 11:50 pm
Forum: Beginner Basics
Topic: CCR1009 PPPoE hardware offloading ?
Replies: 3
Views: 2375

Re: CCR1009 PPPoE hardware offloading ?

Hi! You have some performance in upload speed of pppoe connection?


Have a good day!
by kujo
Sun Jun 19, 2016 11:21 pm
Forum: General
Topic: CCR1036 PPPoE server bad performances
Replies: 10
Views: 2629

Re: CCR1036 PPPoE server bad performances

Some problem on one 100mbit/s pppoe connection! Like a storm. Random time to start jitter, few minutes and stop. In "storm" pppoe upload down to 2mbit/s. Have two WAN and one bonding LAN(of two ports). three ipsec connections (aes128, 3des,des) . Slow performance on aes128 chiper and only when uploa...
by kujo
Sun Jun 19, 2016 2:52 pm
Forum: General
Topic: PPPoe fast download, slow upload
Replies: 8
Views: 2975

Re: PPPoe fast download, slow upload

Some problem with CCR1009, slow upload speed. how you resolv this trabl? Have a progress, put gigabit interface(wan1 through optic converter) in 100MB/full mode, and upload speed up to near 87Mb/s. I'am connect to router through second wan, and after pppoe client start connect, ccr-1009 slow down a...
by kujo
Sun Jun 19, 2016 12:49 pm
Forum: General
Topic: IPsec Dead Peer Detection Best Practice
Replies: 3
Views: 5371

Re: IPsec Dead Peer Detection Best Practice

How about your performance on Ipsec channel? What model of central router you use?


Sent from my iPhone using Tapatalk
by kujo
Sun Jun 19, 2016 10:30 am
Forum: General
Topic: IPSec between two CCR1036 poor performance
Replies: 17
Views: 3781

Re: IPSec between two CCR1036 poor performance

Any progress in this problem? Have few ipsec tunnels on ccr1009 up to date, some poor performance:(


Sent from my iPhone using Tapatalk
by kujo
Sat Jun 18, 2016 11:24 am
Forum: General
Topic: PPPoe fast download, slow upload
Replies: 8
Views: 2975

Re: PPPoe fast download, slow upload

Some problem with CCR1009, slow upload speed.
how you resolv this trabl?