MikroTik

kujo

Tested on 6.49.8 Create new user with 'write' permission Generate random password for newly created account. Must be run from linux console. ssh admin@192.168.88.1 "/file print file=mykey; /file set mykey.txt contents=\"`cat ~/.ssh/id_rsa.pub`\"; /user add name=ansible group=write pas...

kujo

Hi) Script add comment to caps-man access-list from dhcp lease list info. :local wifiItem; :local wifiItemMac; :local dhcpItem; :local dhcpIPaddr; :local dhcpServer; :local dhcpName; :local dhcpStatus; :local dhcpLastSeen; :local newComment; :local currentComment; :foreach wifiItem in=[/caps-man reg...

kujo

:local wifiItem; :local wifiItemMac; :local dhcpItem; :local dhcpIPaddr; :local dhcpServer; :local dhcpName; :local dhcpStatus; :local dhcpLastSeen; :local wifiComment; :foreach wifiItem in=[/caps-man registration-table find] do={ :set wifiItemMac [/caps-man registration-table get $wifiItem value-n...

kujo

It's can be done by script that runs periodically with simple logic:
-check all registered clients in the capsman
-find for all wifi clients a dhcp leased address
-edit a wifi client comment

/caps-man registration-table edit 0 comment

But this feature don't work (6.48.6)

kujo

Hi! I tested certificate gen. and seen that ca-crl-host don't copy to new signed certificates (like in v6) version: 7.1rc5 (testing) build-time: Oct/25/2021 17:15:25 board-name: CHR platform: MikroTik /certificate add common-name=CA digest-algorithm=sha512 key-usage=key-cert-sign,crl-sign,key-cert-s...

kujo

In your first schema red square should become a router! Transfer routing/l2tp/filtering to him. Your switch is L2 device(access level). And your bridge config incorrect.
https://wiki.mikrotik.com/wiki/Manual:I ... s_Ports.29

kujo

https://wiki.mikrotik.com/wiki/Manual:I ... _Bridge.29
Look at examples

kujo

Add log=yes log-prefix=“big ping” to firewall rule
Then in script try to find this log, like /log find where message~”big ping”. If exist -send this message to bot. You can also check address list for new entry, and mark old entry(or delete)

kujo

Hi!

Star connection always best for bandwidth reason, but you can mix daisy with star and create additional fault tolerance with STP.

kujo

Try to play with interface queue.
What the difference in test CHR and production on load /tool profiler?

kujo

You must create CA first, by hand, not through scep. Scep only for child certificate requesting!

kujo

For SCEP work you must enable WEB service(IP-service-www)

kujo

When we init connection, mikrotik select a proper Selector!

ipsec, init tunnel.JPG

kujo

Hi bro! I have VPN tunnel in IKE2 mode. Mikrotik CCR1009 v6.40.4 as a server and Windows 10 client! If no packets go through tunnel then Mikrotik drop ph2 dynamic policy from ipsec policy. Time to policy drop ~2h On widows builtin vpn client no error, tunnel still active, but no traffic pass from ro...

kujo

Attach output, please:
/tool profile cpu=all

Yours respectfully!

kujo

You mean passthrough=no(not processed in mangle, after this rule)? Or you mean about fastpath(not processed in queue, etc..)?

Yours respectfully!

kujo

Easy! Attach your scheme!

Yours respectfully!

kujo

Easy! Attach your scheme!

Yours respectfully!

kujo

You mark new connection only once when you mark connection , other work do a connection tracker. Packet mark rule do this on each packets! You can look at mangle rule packets count. Connection tracker at /ip firewall connections

Yours respectfully!

kujo

You mark new connection only once when you mark connection , other work do a connection tracker. Packet mark rule do this on each packets! You can look at mangle rule packets count. Connection tracker at /ip firewall connections

Yours respectfully!

kujo

You need to mark connection only once, at forward chain. Then you mark all packets of this named connection in forward chain. This method mark all upload and download stream. Queue try parent must be: for download-lan(downstream to lan) for upload-wan(downstream to wan) don't use global Like this: 1...

kujo

It's like a password for l2tp protocol! Like a pre-shared key but not a ipsec!
Anybody know were this option set in Windows l2tp client?

kujo

+1. If we can add some input/output board to mikrotik this would be fantastic!

Yours respectfully!

kujo

+1. If we can add some input/output board to mikrotik this would be fantastic!

Yours respectfully!

kujo

+1. If we can add some input/output board to mikrotik this would be fantastic!

Yours respectfully!

kujo

+1. If we can add some input/output board to mikrotik this would be fantastic!

Yours respectfully!

kujo

Ok! Than only way to use IPsec and eap radius?

Yours respectfully!

kujo

Try use a bonding method, like LACP or other(need config change for ISP side). Failover from only one ISP its a mistake, maybe. You can add a 3G modem for example for true failover. If you cant do a bonding, you need write a script for interface up/down on some event of connection lost. Yours respec...

kujo

Wrong place to ask.. Contact Microsoft and ask them if such feature will be implemented.

Hi! Can you confirm, that verify-client-certificate is a mikrotik only feature And windows EAP is not a way for make SSTP VPN to mikrotik with cetrificate/tokens?

kujo

Maybe packets no more mangling? Without packets marks queue don't work? WTF?

Yours respectfully!

kujo

I have one sip connection through pppoe and one through ethernet static. NO PROBLEM THERE!

Yours respectfully!

kujo

I would do like this: /ip firewall mangle add chain=prerouting action=mark-connection connection-state=new dst-port=80 in-interface-list=WAN\ new-connection-mark=1st_conn_web per-connection-classifier=src-address:3/0 /ip firewall mangle add chain=prerouting action=mark-connection connection-state=ne...

kujo

Yes. You can mangle incoming connections in prerouting chain like a PCC style. Than use connection mark in NAT rules for dst-nating to different web servers. Use queue type pcq for limit and balance

Yours respectfully!

kujo

Turn off connection tracker and check again)

Yours respectfully!

kujo

Please, add to your schema ip addresses of used nets. Looks like you make a mistake with networks assign!

Yours respectfully!

kujo

You can add second ip address to vlan5 on mikrotik and dstnat to lan switch through this ip

Yours respectfully!

kujo

Yep, if you need hide your public IP use something like this 1.1.1.1, not private pools! Maybe its asterisk sip.config problem? Do you use provider recommend config? And try install bugfix only image on mikrotik

Yours respectfully!

kujo

I hope that adsl mobem in bridge mobe(Disable dhcp client on ether1-wan interface ) Print sip connection at now, please

Yours respectfully!

kujo

Why in routes no pref.source in pppoe default route?
There must be your ext address.
This route is Dynamic. Remove from profile "add default route". Disable pppoe. Add this route manually with pref.source! Enable pppoe

kujo

/ppp profile add dns-server=192.168.111.1 local-address=dhcp_ovpn1 name=ovpn remote-address=dhcp_ovpn1 use-encryption=required add change-tcp-mss=yes name=wan /interface pppoe-client add add-default-route=yes disabled=no interface=ether1_wan name=pppoe-telekom profile=wan use-peer-dns=yes user=user...

kujo

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?

Yours respectfully!

kujo

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?

Yours respectfully!

kujo

You can also export compact, without sensitive info, your config and put here...

Yours respectfully!

kujo

Packet sniffer on mikrotik can view all packets to the wan interface(before nat and after nat! No packets no SIP service))) Try change mikrotik to the ... dlink, still problem occur?

Yours respectfully!

kujo

My friend, i'am work with two SIP provider simultaneously without any problem(one asterisk server with different external IP address nated through mikrotik). If your router don't receive any packets from provider of SIP, where you mean problem occur?

Yours respectfully!

kujo

Try open a ticket in support system of tour SIP provider. If provider don't send to you SIP responses it means, that problem not at router point view!

Yours respectfully!

kujo

Maybe you need create a bridge on ccr, then add a wan port of provider and wan port of fortigate uplink, then you only assign needed external addr to fortigate? But, if you create a bridge, then all ip config need be at bridge interface, not at physical port.

Yours respectfully!

kujo

You can mangle new gateway IP

Yours respectfully!

kujo

You can move traffic by mangle in any needed gateway. Can you?

Yours respectfully!

kujo

Response packet from SIP provider arrive to Wan interface?

kujo

Response packet arrive to Wan interface?

Yours respectfully!

kujo

Hi! Can you attach a scheme of your net and your plan?

Yours respectfully!

kujo

Create vlan4 on main, set address from pool 148.66.66.0/29. Create vlan4 at satellite, assign another addr from pool(66.3). On main mark all connection to this vlan(by mac or ip), then mark packets. Create on main queue for downstream to satellite, set to max 5m. In mangle route this packets to 148....

kujo

We have a big trouble when disk space is over! Monitor this parameter!

Yours respectfully!

kujo

Yep... HA its also bgp, few isp... etc. Any device spend cpu to firewall rule processing! But mikrotik is not a security appliance with antivirus, thread detectors, etc...

Yours respectfully!

kujo

Stefan, can you start packet sniffer at mikrotik router? /tool packet sniffer

Yours respectfully!

kujo

Cisco ASAP is a firewall and ccr is a router. Not the same type of product. ROS does have a firewall and can be used but is not built to be a firewall. I use ROS at home as both firewall and router but would not do so at work. I personally like Pfsense a lot. They also have some great appliances an...

kujo

Any feedback from support?

Yours respectfully!

kujo

Ok. There are all good in ip firewall. Try turn on packet sniffer on all interface and udp and port 5060. How the packers arrive? Look at connection tracker when you make outgoing call. Look at asterisk console, 'sip show peers', and calls log. You also can turn on debug on specific sip channel! You...

kujo

Ok. Can you past /ip firewall nat export compact?

Yours respectfully!

kujo

Ok. Can you past /ip firewall nat export compact?

Yours respectfully!

kujo

You may try In firewall services disable sip helper

Yours respectfully!

kujo

https://wiki.mikrotik.com/wiki/Manual:PCC

Yours respectfully!

kujo

Do you receive new IP on wan interface thought DHCP or there's static one? Sip providers often firewalling clients connection and make a static entry user-ip. Sip use udp, udp-timeout (time; Default: 10s)

Yours respectfully!

kujo

Maybe mikrotik need add a feature for display implicit rules for "guru-mode"? (Read-only)

Yours respectfully!

kujo

Yep. What problem occur in action filed#6? Why our friends from mikrotik don't give a comment to this error type, user friendly description?

Yours respectfully!

kujo

Yep. What problem occur in action filed#6? Why our friends from mikrotik don't give a comment to this error type, user friendly description?

Yours respectfully!

kujo

Many authors show examples (even coaches) that this mysterious rule is necessary. I want to understand whether this is a myth

/ip route rule add action=lookup routing-mark=ISP1 table=ISP1

kujo

We think that this is not a flash memory problem, but a mikrotik!
Does overflow of flash memory lead to loss of all data? Where did you see this ext3/linux? Why there is no reserve for system functions?
Dear mikrotik, maybe need some fix?

kujo

When we reboot this router - CCR print at LCD "Loading kernel" and don`t boot anymore! Netinstall repair flash error!

action failed (6)

- it's a flash file system error!

kujo

Hi! Mark routing in mangle: /ip firewall mangle add action=mark-routing chain=prerouting src-address=192.168.0.10 new-routing-mark=ISP1 Then create this type of route in different table ISP1 /ip route add distance=1 gateway=1.1.1.1 routing-mark=ISP1 We really need set up this type of rule: /ip route...

kujo

must be formated first

Yep, this don`t help. On other CCR flash attached and recognized without a peep!

You can't delete existing files due to they locked by running Dude.

My friend, we can`t delete any file from storage: old backup, supout, etc..

kujo

Insert flash card or USB drive.

Yes, I'am insert flash now, but CCR don`t see any new disk attached

Move the dude storage to the external drive and start the dude

We can`t move/delete/create files on main storage, because error occur!
Thank`s for reply!

kujo

Hi! We have a problem with CCR-1009. Dude database occupy all disk space! no space.JPG When we try to delete any files, error occur: remove failed.JPG When we try remove file from console - some error: /file> remove 10 action failed (6) We don't try a reboot the device, maybe somebody help us!

kujo

Can you targeting your problem?

Yours respectfully!

kujo

We use L3, no problem. Your network design dictates your level of communication. Try use cert in cap auth!

Yours respectfully!

kujo

You don't need make dstnat to router service ports. Dst-address-type="" - this's incorrect in first rule...

Yours respectfully!

kujo

Try turn on logging in all deny firewall rules log=yes

Yours respectfully!

kujo

Can you look at mail log files? This is not router problem, but mikrotik can make a spoofing preventing rule in firewall

 ip firewall filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=wan log=yes

Yours respectfully!

kujo

Queue tree parent need be a interfaces. In mangle try mark connection, then mark packets, you don't need mark upload/download stream, if queue parent=interface.

Yours respectfully!

kujo

Hm! Same strange issue I'am detect on CCR1009 v.6.39.2 on switch group ports! Maybe it's winbox bug?

Yours respectfully!

kujo

Maybe this helps viewtopic.php?t=66578

Yours respectfully!

kujo

Yes! Good idea! Work perfect!

add action=accept chain=input  connection-state=new dst-address-type=local src-address-type=local

kujo

If lo interface hidden, then maybe need hidden rule, like "allow from lo to lo"? Capsman connect to self by address 192.168.66.1. And we see that in interface also unknown! Any self connection from unknown interface! 09:25:00 firewall,info drop input: in:(unknown) out:(none), proto UDP, 19...

kujo

Work only this rules to block/allow this traffic

/ip firewall filter
add action=accept chain=input dst-address-type=local port=23 protocol=tcp comment=This rule work
add action=accept chain=input port=23 protocol=tcp comment=This rule work too, BUT both allow/block all telnet traffic

kujo

Hello! When connect to selt, for example to telnet (127.0.0.1:23) we can log this message: 09:28:35 firewall,info telnet input: in:(unknown) out:(none), proto TCP (ACK), 127.0.0.1:40539->127.0.0.1:23, len 52 09:28:38 firewall,info telnet input: in:(unknown) out:(none), proto TCP (ACK,PSH), 127.0.0.1...

kujo

Hi!
Do we need add in last position of chain=bad_tcp RETURN rule?

/ip firewall raw add action=return chain=bad_tcp

kujo

What model of switch?

Sent from my iPhone using Tapatalk

kujo

I use bonding for connecting to the Lan switch, like LACP, try it. If port in bridge, then all references need apply to bridge (address, rules, queues)

Sent from my iPhone using Tapatalk

kujo

Create bridge, add add this two ports to newly created bridge

Sent from my iPhone using Tapatalk

kujo

Hello RESOLUTION: Go to Queues-->Interface Queues. Check mode of all virtual interfaces. default: ""only-hardware-queue" changed this to "multi-queue-ethernet-default". WARNING: : After this change, u can lost connection to router near 5-10 seconds, i dunno why. You need up...

kujo

Hello RESOLUTION: Go to Queues-->Interface Queues. Check mode of all virtual interfaces. default: ""only-hardware-queue" changed this to "multi-queue-ethernet-default". WARNING: : After this change, u can lost connection to router near 5-10 seconds, i dunno why. You need up...

kujo

anybody with similar or (hopefully) different experience with CHR NAT throughput?

Can you update to latest RC? There are some trouble with interface queues!

kujo

Type your ip filter. Maybe icmp outgoing block?

Sent from my iPhone using Tapatalk

kujo

Add before first /ip firewall mangle chain=forward in-interface=vlan1000 new-connection-mark=TUN_conn
And make changes in route mark.

Sent from my iPhone using Tapatalk

kujo

Version 6.39rc33 has been released.

*) chr - fixed problem when transmit speed was reduced by interface queues;

Thank you!

kujo

Kalpar - Yes, that is exactly what was done! MRRU works in same way as it did before, but it is now adjusted/updated to multi core age

Can we use L2TP + MRRU over one WAN link of PPPoE provider 1492 MTU/MRU?

Sent from my iPhone using Tapatalk

kujo

Who then tested the limit of connections? it seems that the filter rule is not working with him! CHR 6.38 /ip firewall filter add connection-state=new chain=forward connection-nat-state=dst-nat dst-port=443 connection-limit=100,32 Sorry! Work well!! Need add not! To connection-limit Sent from my iPh...

kujo

Pppoe Provider switch-100mb/s<-->cooper<-->converter-1gb/s<-->fiber<-->converter-1gb/s<-->cooper<-->ccr1009-1gb/s. When provider reconnect my to 1gb/s port on his switch, then full bandwidth on channel appears!!!

Sent from my iPhone using Tapatalk

kujo

Can you attach screenshots of queue tree and mangle from winbox?

Sent from my iPhone using Tapatalk

kujo

Maybe incorrect mangle? Need more info about traffic type, source and dst... You can learn a traffic flow diagram...

Sent from my iPhone using Tapatalk

kujo

Good question! Some problem. Wan interface for upload streams, lan interface for download stream. Global for input/output chain. But what interface we install in download stream if have multiple wan with different bandwidth ?? We need create correct mangle for each interface! Mangle for wan1, wan2.....

kujo

Cool!!!

Sent from my iPhone using Tapatalk

kujo

If you can't past config, add some screenshots, where trouble exist.

Sent from my iPhone using Tapatalk

kujo

Sent from my iPhone using Tapatalk

kujo

Drop client to client talk in bridge, also drop fake dhcp (if dhcp on bridge interface). For guest wifi network

/interface bridge filter
add action=drop chain=forward comment="Drop all to !bridge self host" in-bridge=bridge-guest  out-bridge=bridge-guest packet-type=!host

kujo

If working then don't touch!!

Sent from my iPhone using Tapatalk

kujo

Lucky )))

Sent from my iPhone using Tapatalk

kujo

Try add

/ip route rule add dst-address 19.1.16.152/29 table=main

Sent from my iPhone using Tapatalk

kujo

Can you turn on packet sniffer on this vlan, and look at icmp traffic, its arrived to you?

Sent from my iPhone using Tapatalk

kujo

If you create vlan interface, than set address to this interface.

Sent from my iPhone using Tapatalk

kujo

Make a mangle of facebook connection and then mark packets. Create queue to catch this packets.

Sent from my iPhone using Tapatalk

kujo

Hi! We use remote logging to syslog server! This code work well /system logging add action=remote topics=critical and this code don't send any packets to syslog and I'am check this on /tools packet sniffer /system logging add action=remote topics=warning,info,error,critical,caps It's a feature of co...

kujo

Limit to 10Gb/s )))

Sent from my iPhone using Tapatalk

kujo

License P1 only 1gb/s interface speed! Maybe you need p10!
http://wiki.mikrotik.com/wiki/Manual:CHR#CHR_Licensing

Sent from my iPhone using Tapatalk

kujo

Hi, maybe you can try this: On dlink move uplink port in tagged vlan1,vlan2,default. On roteros create vlan1 and move address 192.168.1.1 to vlan1 interface .

Sent from my iPhone using Tapatalk

kujo

Install CHR in cloud, create on them ppp server, configure ospf.Ppp clients(cenral, site a, b) connect to the central router CHR through isp1 or/and isp2

kujo

Maybe some log export can help ? Trace route from l2tp client? Routing table from router and from warrior!?

kujo

Do you change l2tp server address to 192.168.1.1?

Sent from my iPhone using Tapatalk

kujo

You don't need second masquerade rule. Do you accept on client option for create a default route to l2tp server? Remove l2tp interface from bridge(option in ppp profile), change network for l2tp server and client like 192.168.1.0/24(l2tp-pool). Add accept forward filter rule where incoming interface...

kujo

You need correct routing table, correct firewall filter(not address list). Export this two things. And Your scheme is not displayed, repeat please))

Sent from my iPhone using Tapatalk

kujo

Create vlans for this pc. Create vlan interface on routers, make a routing.

Have a good day!

kujo

Hi! Try set interface queue to multiqueue on CCR device.

Have a good day!

kujo

1. You need central peer(ppp client, maybe cloud router). This router connect to the your site routers( mikrotik, with configured ppp server!) Client(cloud) make a connect to the sites(office). If no router(physical) in cloud - try use a CHR. 2. Use L2tp servers on office sites and l2tp clients on m...

kujo

Try mangle connection first, then mark route. If no success, try change route in isp2 table to interface route

Have a good day!

kujo

Ok, move vpn masquerade rule to the first position

Have a good day!

kujo

And print macos ipsec settings, please

Have a good day!

kujo

Try modify masquerade rules, set src address in vpn rule and in pppoe rule, remove duplicate pppoe rule

Have a good day!

kujo

CCR1009-8G-1S-1S+ v 6.35.4 L2TP server is Enabled Two l2tp client is enabled and work One pppoe client is enabled and work DO: Disable L2TP server, and see this problem. All l2tp and pppoe client closed. Ip address of two l2tp client are mark red in address list and clients can't connect because ip ...

kujo

Good config!! Very well!!

Have a good day!

kujo

Wah!! Good load, maybe ccr-1036 or 1072 help for your setup??

Have a good day!

kujo

Hm.. Write to support@ I'am can test also this two-pppoe-conn-trable

Have a good day!

kujo

Can you analyze access level? 150-200mb/s not problem for ccr. Analyze connections tracker! Any log items present before reboot? 3 ccr??? Can you attach net scheme ?

Have a good day!

kujo

Queue on 1500 users? Memory usage? Cpu usage, health of board?

Have a good day!

kujo

Good shema, create a bridge between networks, create dhcp server and configure dynamic ip assign on all pc.

Have a good day!

kujo

Try downgrading

Have a good day!

kujo

Hi, do you try configure ospf over l2tp in ptp interface mode? Thera are some err on ccr 6.35. Incorrect routes are coming. Choose ptmp mode resolve this!

Have a good day!

kujo

Cool. Make port-list, list in list also good ))
P.S. in prerouting mangle mark dscp (63-groups/portlist) and manipulate packets in filter on dscp based rules. Portlist by routeros(We are not looking for easy ways)

Have a good day!

kujo

Try use aes128

Have a good day!

kujo

Attach scheme of your site. Why you want control AP traffic directly? Maybe use shaping of clients or services? If you want separate AP traffic to queue you need QinQ vlans.

Have a good day!

kujo

Routing rules in routeros, please!

Have a good day!

kujo

Any firewall rules in your config? /ip address print?

Have a good day!

kujo

Pptp, pppoe, vlan, check your mtu config? How many broadcast traffic?

Have a good day!

kujo

Pppoe speed over 100? Try to reduce interface speed to 100mb/s, share interface load, pls

Have a good day!

kujo

Why you think it's a NAT trable? 60% good load! You are network monster! Maybe connect second device in active-active mode? Also try update to current!

Have a good day!

kujo

Maybe you can print some stats of your RB?
http://wiki.mikrotik.com/wiki/Manual:System/Resource
Config without ipsec tunnels?

Have a good day!

kujo

Have you any queue and routing rules ?

Have a good day!

kujo

Cisco? The DLink switch have a two image on board! Its a big problem install second flash chip of RB(redudance power not problem at all)? And create alert if user configure log all package to the disk in 300 Mb/s networking?

Have a good day!

kujo

Another ISP(receive/send email, correct dns record). Create a tunnel between new isp and main isp.
From new isp->routeros->ip tunnel->old isp(if not block ipsec/gre)->routeros->mail server

Have a good day!

kujo

Pppoe passthrough to ccr?

Have a good day!

kujo

Hi, set IP conf on vlan interface!

/interface vlan
add name=vlan-wan12 vlan-id=12 interface=sfp1
/ip address 1.1.1.12 interface=vlan-wan12

Have a good day!

kujo

/queue simple add name=speed-test target=eth1-wan max-limit=50M/50M

Have a good day!

kujo

Need your config export! Mangle, queue, connection map)) You need after connection-mark, mark the packets for use in queue. Simple queue can work without packet mark.

Have a good day!

kujo

I removed the source address to verify nothing changed. Any other suggestions? Check the are action accept or masquerade? Insert before /ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new di...

kujo

Hello! On CCR1009-8G-1S-1S+, v6.34.6, have a config: /ip address add address=1.1.1.209/29 interface="eth1-ISP1" network=1.1.1.208 comment="ISP1 29 block, first IP" add address=1.1.1.210/29 interface="eth1-ISP1" network=1.1.1.208 comment="ISP1 29 block, second IP&qu...

kujo

Try this!

http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

Have a good day!

kujo

Try to bypass nat for remote net

/ip firewall nat chain=srcnat dst-address=192.168.3.0/24 action=accept place-before=0

Have a good day!

kujo

Hi, any news??

Have a good day!

kujo

Buy additional router. Add ipsec tunnel on miktotik in net 10.10.10.1<-->mikrotic in net 192.168.0.0. Add ipsec rule, peer, proposal. Web site routing must know where net 10.10.10.0

Have a good day!

kujo

Change location of cert and keys

Have a good day!

kujo

Sorry men, not success! Storm star again, 1-2 times per hour...

Have a good day!

kujo

Hi all,
I think is a cpu issue, though it isn't at 100%. I don't understand why.
Is it a software limit or a hardware limit?

Hi! Set auto negotiation of interface with pppoe to 100Mb/s only mode.
Remove all jump rules from mangle.
I'am have success !

Have a good day!

kujo

Hm! How you route traffic across WAN's ? Also use jump rule on WAN pppoe client, and have a very poor performance on upload speed. I check tomorrow is that all packets catch.

Have a good day!

kujo

Hi! You have some performance in upload speed of pppoe connection?

Have a good day!

kujo

Some problem on one 100mbit/s pppoe connection! Like a storm. Random time to start jitter, few minutes and stop. In "storm" pppoe upload down to 2mbit/s. Have two WAN and one bonding LAN(of two ports). three ipsec connections (aes128, 3des,des) . Slow performance on aes128 chiper and only ...

kujo

Some problem with CCR1009, slow upload speed. how you resolv this trabl? Have a progress, put gigabit interface(wan1 through optic converter) in 100MB/full mode, and upload speed up to near 87Mb/s. I'am connect to router through second wan, and after pppoe client start connect, ccr-1009 slow down a...

kujo

How about your performance on Ipsec channel? What model of central router you use?

Sent from my iPhone using Tapatalk

kujo

Any progress in this problem? Have few ipsec tunnels on ccr1009 up to date, some poor performance:(

Sent from my iPhone using Tapatalk

kujo

Some problem with CCR1009, slow upload speed.
how you resolv this trabl?

Search found 169 matches