MikroTik

jvanhambelgium

The correct setup is to ask your ISP for an appropriate ONT/ONR which would have a 10GBase-T interface or something.
Give 'm call.

jvanhambelgium

So what is your use case ? You state " Now I have a task to hide WG service packets " . Are you doing all of this effort in order to hide from an advanced UTM-firewall that would "detect" Wireguard application and block it for example ? Or is this some academic hack-a-thon thing ...

jvanhambelgium

Simple make the webserver perform the redirect

It can sent a HTTP 302 code to tell your Windows client that.

jvanhambelgium

Interesting, I always assumed that if you would physically have 2 different physical ports/interfaces (even under the same bridge) you could at least filter traffic between them by referring to the appropriate "ethernetX" port on your rule. but, now that I'm thinking about it ... these por...

jvanhambelgium

They may be in the same subnet IF you can connect each of the devices/servers onto a different physical port of your Mikrotik. (and these interfaces are members of the same bridge) Depends on the model you have then. Then simply adjust your (forward chain) firewall rule to include the "in-inter...

jvanhambelgium

Agree, your setup should be easy-peasy actually and this is very strange behaviour.
I would :

1) Save your complete config a file
2) Completely erase and start over and fix the basics! Then start building on top with the things like VLAN's, IPSEC-tunnels, fancy mangle-rules etc,etc

jvanhambelgium

From the terminal on the Mikrotik, can you ping 8.8.8.8 or something like www.mikrotik.com ??
I can ping your public IP 135.x.x.x (IF that your real one) but looking at your config I tried SSH/Web but no luck.
(you should probably not allow any public IP to connect to your router....)

jvanhambelgium

I think that is going to burn more cpu-cycles. I used these blacklists for both INBOUND & OUTBOUND blocking. For egress, you could easily blackhole each of these prefixes to "nowhere" But what about ingress traffic coming FROM these IP's ? Then we are talking about some policy-based-ro...

jvanhambelgium

Create a static dns entry that catch all fb/yt dns name and return 127.0.0.1 I do block dns from lans to wan. Only resolvers is mkt. the only way to bypass is for client use it's own hosts file with real ip. So i added forward deny rules with dst address list that contains identified dns names. I'v...

jvanhambelgium

I wonder if you not better look to handle this at CLIENT/ENDPOINT level. There are various endpoint-security clients available with things like webfilter-control policies etc. Is this 100% Windows 10/11 environment ? Things like Microsoft Defender for Endpoints etc. ...not everything can (or should)...

jvanhambelgium

Perhaps the best alternative is that you control the DNS. Then you can also do some serious blocking. If your Mikrotik is capable of running containers you can look for something like Adblock or Pihole and simply block on that. Off course you will have a tough time blocking "leaking dns" c...

jvanhambelgium

It CAN depending on all the whistles & bells you activate on the RB5009 and the type of ISP-connection. I really doubt it will deliver 2.5Gbps over a PPPoE connection. PPPoE encap/decap is not a multi-thread process and will be bound to a single CPU-core I think. If your ISP delivers Internet ac...

jvanhambelgium

Why is "your global traffic limited" ? Who limits this traffic ? This is not a concept we know here or in Belgium, but in some parts of the world an ISP limits the amount (or bandwidth) of traffic that is going outside the local area. So you could e.g. have "unlimited" traffic t...

jvanhambelgium

We have connected several windows web servers to mikrotik router. This router has WAN interface which obviously connects to local as well as to global networks. In our case the global traffic is limited, and because of this our global clients experience connectivity issues. So we need to investigat...

jvanhambelgium

No you cannot do this on Mikrotik itself. You need to look at something like a Netflow collector or Splunk setup. Depending on your level of expertise this might be pretty simple to setup or very hard... There is very nice Splunk-app developed by forum user complete with all install-instructions etc...

jvanhambelgium

"Load Balancing" is something different then "HA (High Availability)"
On the LAN-facing side, you could build some HA using VRRP indeed. Then further upstream towards "Internet" you can also build something with Mikrotik for both HA and load-balancing/distribution.

jvanhambelgium

Both "Yes" and "Not really", because you need to define first " without access to the entire internet " Sure you can allow LOCAL users to be allowed to 1 specific (your) SERVER on Internet and BLOCK everything else (=NO Internet) Within Mikrotik there is no concept of e...

jvanhambelgium

add action=dst-nat chain=dstnat comment=\ "Force any UDP DNS queries that aren't to pihole to go to pihole" \ dst-address=!172.17.0.2 dst-port=53 in-interface="Local Bridge" protocol=\ udp src-address=!172.17.0.2 to-addresses=172.17.0.2 add action=dst-nat chain=dstnat comment=\ &...

jvanhambelgium

Sure but RB5009 is not a CCR.
I guess the sensors are not there on the RB5009 board, they need to cut costs somewhere

The CCR1072 is slightly more "enterprise/datacenter" than a RB5009 which I consider "home user" or "small enterprise" grade equipment.

jvanhambelgium

You cannot check internally, only with external powerplug with measurement capabilities.
My RB5009 does about +- 9W (50% of all ports used, 1 SFP+ inserted (type S+RJ10)

jvanhambelgium

>Thanks, so if I connect my LAN port to his WAN port and configure independent DHCP / routing on his router for his use, can I just set up rules to prevent >routing between that LAN port (that his WAN connects to) and the rest of my LAN? Sure, you can craft some FW-rules based on different parameter...

jvanhambelgium

That will be hard to avoid (the double-NAT) unless you have extra public IP's and can ROUTE some traffic up to his WAN-port. OPTIONAL -> If you & the neighbor can agree a on IP-subnet he can disable NAT on his router and ROUTE all the traffic. You would be responsible for the NAT action then. eg...

jvanhambelgium

Take 1 interface out of the bridge and put a small subnet on it (eg /30) ? Then have the cable run to the neighbor and let him config the correct IP on his "WAN" interface. Secure what needs to be secured with some FW-rules (eg. make sure the "connection subnet" /30) cannot conne...

jvanhambelgium

Your input is way overkill here and I disagree with it on top LOL. Interface usage is common and efficient, especially if users are going to go out the local WAN ( lan to wan and dns rules) and the use of firewall rules provides the requirement amount of security for individual user access. Let's a...

jvanhambelgium

I consider "Wireguard" or "ZeroTier" as different "zones". So these interfaces are not part of the LAN interface-list or something. So I have a set of firewall rules allowing WG-peer(s) to access what they need to action (eg. Plex, HomeAssistant, my home Splunk etc) So ...

jvanhambelgium

The requested config is relatively easy. I would expect this to be done between 1/2 day - 1 day by somebody who is juggling with RouterOS on a daily basis (and probably has his set of example config snippets etc for these types of basic things) Offcourse all info must be there (info on the 2 ISP cir...

jvanhambelgium

OK, thanks for explaining it to me. I have only one doubt. When I banned the IP on the router firewall, the banned log says: banIP_ prerouting: in:ether1 out:(unknown 0), connection-state:invalid src-mac XX:XX:XX:XX:XX:XX, proto TCP (SYN), 113.XXX.XXX.XXX:49987->[b][color=#FF0000]61.XXX.XXX.XXX:100...

jvanhambelgium

Why does this request reach the server 192.168.0.3, when the router firewall should drop all new connections in forward except those to the ports set in NAT (80,443,2203)? Maybe the internet host found open port 2203 and is now trying to brute-force in? I've seen that as well ... one has to keep in...

jvanhambelgium

Why do you think/state " ...upon analyzing the logs of the server 192.168.0.3, I've noticed continuous SSH brute force or scanning attempts (I'm not sure) on random ports (not the standard SSH port or my SSH port 2203) originating from an IP address in China: Apr 28 11:36:54 cloud sshd[28265]: ...

jvanhambelgium

What product are you using ? I'm pretty sure hardware-offloaded stuff/config will not always behave as simple as you might think . Which then can explain what you are seeing. I've think I remember reading somewhere that you can only perform MAC-filtering in the forward-chain when HW Offloading is DI...

jvanhambelgium

Limit the amount of broadcast you are sending out ? Where to ? Broadcasts will not pass the boundaries of the segment you are in anway. What problems are you encountering ? What product-type are you using? Without a detailed schematic (container interfaces/IP's etc) it is impossible to even comment ...

jvanhambelgium

what is "a bgp network" ?
Is 3.3.3.x/24 a pieces of your (public) PI-space ?
Is this "Internet" connected ?

Or is that 3.3.3.x prefix coming in via either ISP1 or ISP2

jvanhambelgium

My S+RJ10 in my RB5009 has always been running about 65°C - 70°C since day 1 Anything special you did regarding cooling or airflow ? Mine gets to 95C within 15 minutes. Same RB5009, same RJ-10 :? Nope, no attachments/heatsinks added. RB5009 is mounted in small 19" cabinet against the wall. Per...

jvanhambelgium

My S+RJ10 in my RB5009 has always been running about 65°C - 70°C since day 1

jvanhambelgium

If you want anyone to seriously take a look at it you'll probably need to provide the *full* config. This is very weird, if you cannot even ping from the CLI there is something fundamentally wrong... You could also try the "Quickset" and setup the box first with default settings ? At least...

jvanhambelgium

When on the CLI of the router, can you ping 1.1.1.1 for example ?
How does your routing-table look like ? (/ip/route/ print)

jvanhambelgium

Best thing is to provide a FULL config-export on your box , minus sensitive stuff like serial-numbers or some bits of the public-IP itself. I assume your Win11 PC can ping its default-gateway ? (= the RB5009) From the RB5009-console, can you ping something like 8.8.8.8 ? Or not even that ? I can be ...

jvanhambelgium

Again, it can be dozens of reasons. This could have been 1

It was worth trying.
You state traffic-counters are moving. Can you test if your issue is DNS-related or actual connectivity ?
Can you ping 8.8.8.8 from a connected PC ?
What DNS are you PC's on the LAN using ?

etc,etc ...

jvanhambelgium

Remove the to-address value ??

jvanhambelgium

# create bridge /interface bridge add protocol-mode=none ingress-filtering=yes name=bridge1 vlan-filtering=no Shouldn't that be vlan-filtering=yes ?? If you go now on your device in the CLI, type /interface/bridge and then "print" does that say "vlan-filtering=yes" on the config ?

jvanhambelgium

If they added Fortinet ABOVE the Mikrotik, they need to get stuff fixed on the Fortinet first. Without detailed picture it is difficult to guess, things might have changed. (eg. before Fortinet public IP was on RB2011, after "slide-in" of the Fortinet the public-IP moved to the Fortinet et...

jvanhambelgium

Ahh...you did not even have a DNS server configured then for you Wireguard connection ??!!
Yeah ... that explains a lot...

Anyway, glad it works now.
You can disabled some logging now

jvanhambelgium

The thing is, you need SOME rule that get hit with packets having source-IP = 192.168.87.3 (eg. you phone) and wanting to go out on the Internet (once it arrives from the wireguard decapsulation/decrypt) So perhaps DO enable some logging on FORWARD rules to, even the ALLOWED ones regarding Wireguard...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\ 192.168.88.0/24 in-interface=wireguard Well this rule is not going to help you get to the internet! You are allowing to pass ONLY for traffic towards 192.168.88.x If you punch www.facebook.com on your mobile device obviously...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\ 192.168.88.0/24 in-interface=wireguard But your WG-client has 192.168.87.x config ? hm, i thought i should interpret it as traffic coming from wireguard interface should be forwarded to destination addressed (192.168.88.0/2...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\
192.168.88.0/24 in-interface=wireguard

But your WG-client has 192.168.87.x config ?

jvanhambelgium

If customers purchase a so called "ip-pack" with us anyway, they get 5 adjacent/consecutive IP's.
depending on the config, that could 1 public fixed IP and the above 5-block routed to it for example.

jvanhambelgium

Something like this ?

viewtopic.php?t=167814

jvanhambelgium

Yeah...I've seen some strange stuff on C9300 too and had to play a lot with parameters to power some fancy doorphones (2N IP Style) Sure you are hitting no PoE bugs ? What release are you on ? I've seen 1 case where a Raspberry Pi with PoE would not boot on a C9300 with olde 16.12.x code. Worked fin...

jvanhambelgium

This router is not capable of 2.5Gbit/s. Not in real life condition With fasttrack and all optimizations tested it with iperf, PPPoE speed max 1.6Gbit/s because CPU Mhz/software limits speed. Cable-modems do not use PPPoE in general. Plain DHCP across the ethernet and that's it. So that is already ...

jvanhambelgium

What would it take to be able to use the same $listname across different downloads ? I prefer working with 1 big list, and in the comments-section I provide info about the origin of that list. $update url=("https://" . "iplists.firehol.org/files/firehol_level3.netset") listname=D...

jvanhambelgium

The only true testing is disconnect the ISP and put some testing-PC and perform iPerf *trough* the RB5009 or some other test-tool. I would not rule-out your ISP...."cable modem" is a shared medium and you never know exactly what happened. You also probably do not have performance guarantee...

jvanhambelgium

Well them simple perform 2 tasks 1) Create "address-list" and put the IP(s) in there that are allowed to "hit" the dstnat-rule https://youtu.be/WVxj9v4J3xM?si=uKyKTgVLo1UhNqKc (look around minute 2:15 for the access-list creation part) 2) Edit the NAT-rule and select the correct ...

jvanhambelgium

It depends on how you perform the NAT. If you also perform some snat on the packet then the SAT-receiver would only see a packing coming in from 192.168.88.1 (the IP of the bridge on Mikrotik) Without this extra snat the original source-IP is retained. This could make a difference in some scenario's...

jvanhambelgium

There is no protection on this Linux Sat-server that is does not accept incoming requests from IP's other then the LAN-range 192.168.88.x ?? You never know. I think the dstnat actually works, but I don't see why it should not work end2end. I have several of such dstnat and they just work, the only d...

jvanhambelgium

But what IS running on that port 82 ? Some web-interface ?
What happens if you connect from another 192.168.88.x device on your network to the IP on port 82 ?

jvanhambelgium

Then I'm afraid the only option is to start capturing packets to effectively investigate if the packet is getting there. Looking at the counters it seems the DNAT does work and some packet is passing through the box on its way to 192.168.88.68 on port 82 If you go in Winbox to Tools -> Telnet -> and...

jvanhambelgium

Can you disable the embedded webserver in the Mikrotik ?
Under "IP" -> "Services" and look for the "www"

jvanhambelgium

Chain must be FORWARD in the "duplication rule"
It is about traffic GOING THROUGH THE BOX

jvanhambelgium

These screenshots don't always tell the full picture or show all attributes clearly. A textual config is straight to the point...
I see some jumps to custom chains etc,etc.

jvanhambelgium

Make a copy of Rule3 and place it just below Rule3 (you can never do harm like that) Then edit the rule and in "General" on the bottom make sure the "Connection NAT State" menu has selected "dstnat" flag. Clear all other flags that are on the "Connection State"...

jvanhambelgium

The DNAT seems to hit, looking at the traffic-counters.
What are the Filter Rules in the FORWARD chain ? How do they look like ?

jvanhambelgium

Execute something like this on the CLI /export file=myconfig (minus router serial number and any public WANIP info, keys etc.. ) It will create a file and then you can get it off your router with Winbox for example and upload into the forum If you don't understand any of the above, I suggest you sta...

jvanhambelgium

Before anyone will jump in to support you, you'll be asked to provide your full config anyway. You might have broken things because of "I have done many things" Do you have a rule in the FORWARD chain to allow (valid) DNAT-traffic "trough" ? This should be part of the default fir...

jvanhambelgium

Do you have a public IP on "pppoe-out1" ? If you are behind NAT from your ISP this will never work.
So what "WAN" IP did you receive ? 100.64.0.0 to 100.127.255.255 ??

jvanhambelgium

Same here, never could ROSE NFS work on my Synology NAS, while I only use NFS at home with all my Linux boxes etc.
Got various errors, including "unknown error"

SMB works immediately....

jvanhambelgium

OK, didn't know. But 50% CPU usage on DNS is clearly a bug. But I can imagine support answer: "dear user, while you can increase DNS cache size to a very high number, it is still limited by your device's physical capabilities. ROS gives you the freedom to set 512MB cache size but this does not...

jvanhambelgium

I assume that MT developed this feature for home users. Maximum 40k URL lists. Kind of grabbing low hanging fruits. The main thing is to be able to import adlists -> "we already have DNS". Where is this documented ? I can't find any such statement ? On the help-page it says ; Before confi...

jvanhambelgium

I'm testing the DNS "Adlist" feature in 7.15.RC3 on my RB3011 I've increased the DNS-cache setting to 512MBytes !! value It seems things are going down the drain when I load a rather larget set. (> 2 million entries) When I remove 1 URL https://raw.githubusercontent.com/mkb2091/blockconver...

jvanhambelgium

"everything is connected by fiber" => So you have actual fiber-pairs coming in for each of your customers ??
Or you have some wholesale-service that you take from a larger ISP that does the last-mile to customers or something ?

jvanhambelgium

Jotne, Would it be possible to start looking into an extra addition on the the "DNS" section of your Splunk app ? Since 7.15RC3 there is the concept of "adlist" where you can put URL's to download filter-lists like a Pihole. Currently testing on my RB3011 and it seems to at least...

jvanhambelgium

Hmm, did you see that yourself that it tried the gstatic.com domain ?
I've checked my Pihole that logs everything (and I block everything like DNS-over-TLS,DoH,Quic) and I cannot find any such lookup ?
Phone is a Samsung Galaxy S21

jvanhambelgium

I'm looking into options to bypass my ISP devices and work directly on my RB5009. However for the TV-service of my ISP, they have published detailed specs what you need to be capable of. Apparently DHCPv4 Option spoofing: The following options provided on WAN side need to be provided to the TV decod...

jvanhambelgium

There are no benefits in disabling STP for sure and I was only looking at the uplink "line" not the different endpoints. Without some form of STP somebody could cause some havoc when connecting an endpoint the wrong way, having other switches introduced that you are not aware of and formin...

jvanhambelgium

Rapid Spanning Tree protocol (RSTP) -> The maximum allowed network diameter for the RSTP protocol is 40 switches.

But anyway, with only 1 fiber line I would disable any STP anyway since it is not relevant and of no value

jvanhambelgium

No real pitfalls to my knowledge.
Sure, such topology is a big single point of failure but apart from that it will work just fine, especially for such low flow of data.
There is no option to form some sort of "ring" ? Are these 21 buildings/switches really "in a line"

jvanhambelgium

I can't speak out of experience, but I see no reason why simple-queues for the sake or shaping would work differently on 35Gbps vs 1Gbps. What you need to try to find out is the impact on cpu & memory I guess. Shaping on IP-level like this using (simple) queues on 35Gbps is something you want to...

jvanhambelgium

You don't have an aggregation-layer where you terminate such (very high-speed) customers ? Straight onto your core switch doesn't sound like a very good plan to me. I don't know what CPU-power you have in your coreswitch-device, but perhaps you can iterate from 1Gbps shaping profiles to see howmuch ...

jvanhambelgium

Perhaps interesting for those collecting various sources to feed the scripts.

https://docs.paloaltonetworks.com/resou ... ng-service

Palo Alto also provides for free various curated lists like for M365,Azure,GCP,Zoom etc,etc

Imports work just fine with the current script.

jvanhambelgium

https://www.3cx.com/docs/manual/firewall-router-configuration/ Apparently for this SIP-provider there seems to be quite some stuff you need to open and they don't mention any of their public IP's / FQDN's of their SBC's.... I guess it depends on the SIP-provider. I have seen installations that only ...

jvanhambelgium

What overkill ? VLAN is just label.
Only 350 VLAN's out of 4K standard available.
It DOES keep things very separated (if you want) and identifiable across the whole setup.

Depending on how the wireless is organized (authentication-wise) their devices can be mapped easily in the VLAN of the room.

jvanhambelgium

What about 1 VLAN per room ? It is only 22 rooms/floor x 16 floors......
You can make a couple of nice interface-lists and group some stuff together at that level.

jvanhambelgium

Installation & Config is 1 aspect, actual operational performance another.
What type of installation-environment ? Industrial ? School ? Stadium/venue ?

jvanhambelgium

Thank you for your work, it works perfect. When I try to save the report to a shared drive (runs on SMB raspberrypi) using :local reportpath ("smb://user:password@192.168.3.19/home/pi/MyNASA/BWbyIP/report-" . $yearmonth . ".html") either with or without the user/password failure...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png the 5.6 script hits a system history print command which causes this error on my systems. You can reproduce this by entering the command "system history print" in a con...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png It seems in the section where all the access-list are processed/counted, so the section below. Didn't change anything to the code, just copy-pasted into Winbox. The ACL "Azur...

jvanhambelgium

Hopefully 1 ether port off-bridge or a serial port but that means local access. No so long ago locked myself out of my RB5009. I had "some sort of recent backup" and needed to factory-default it + restore that config. That part went OK Since then I have indeed 1 dedicated physical port &q...

jvanhambelgium

Where is this 192.168.121.0/24 range actually used then ? On 1 of these remote sites ?
Just get a working-PC on that range, teamviewer/RDP into it and from there Winbox/WebFig to your RouterOS boxes ?

jvanhambelgium

Did you create the container in CLI of via WebFIG/Winbox ? Do you have the "logging" flag enabled too ?

jvanhambelgium

The S-RJ01 *itself* is OK I guess. I have one in my RB5009 and my ISP/Internet is coming in through there. Runs a little hot (66°C) but never any issues. But I have the impression it might be very dependent on which platform you plugin the module + RouterOS release. Vendor Revision : 2.16 Manufacter...

jvanhambelgium

While not a complete solution (rather a collection of tools to build your solution around it), you may want to check pmacct http://www.pmacct.net/ I've been using it for well over a decade now, and once I integrated it into my stack, I've never had to touch it again. It just works. What plugins are...

jvanhambelgium

Yes, something like that might be an option, but that would still not bring all logging from my different ros devices into the one log of my main router. But thanks for the pointer, I will think a bit further on how to configure it to my liking. Offcourse it would ? All you ROS devices then simply ...

jvanhambelgium

You have a RouterOS box that supports containers ? Then you could deploy such a container and collect logs. Offcourse you need to store them somewhere, so at least some external USB would be a good idea...unless these are really few logs. This is not a fancy (web)GUI where you can browser through, i...

jvanhambelgium

Sure, as long as your ISP does muck around with CGNAT and you have a public IP that you can "map" 1:1 to the inside.

jvanhambelgium

Most of the above vendors are really, really in another league compared to Mikrotik. You must see Mikrotik RB as a ROUTER with network packet filter (and a lot of Swiss-army knife capabilities for sure!) I use Fortinet & Palo Alto in my professional work, very,very capable but I comes with a pri...

jvanhambelgium

Take eth5 out of a bridge. Configure IP > DHCP-client and add "eth5" as DHCP-client. Be carefull and say "no" to "add default route" I think. I use the same approach and have a lab RB3001 connected as DHCP "client" on a RB5009 through some ethX port. Then offc...

jvanhambelgium

What about any NAT/Masquerading config ? Can you export that ?

jvanhambelgium

Pre-routing chain ?
Try the "forward" chain and it will work I guess.

I've several marking-rules and they work fine as the traffic flows-through the Mikrotik (= forward chain)

jvanhambelgium

Strange, its not like you have some secret recipe for vodka
Perhaps the vodka market is drying out and they want to get into chocolate or beer

I could throw in a couple of Belgian Waffles

jvanhambelgium

Not entirely from the same source IP, but close ... IP 95.214.55.244 inetnum: 95.214.52.0 - 95.214.55.255 netname: PL-MEV-20181221 country: PL org: ORG-MSZO78-RIPE Some Polish operated IP-space. For the last 30 days, it is trying consistently these 4 destination ports on my frontdoor :D 8) Screensho...

jvanhambelgium

>I would like to add succesfully connected rdp connections to whitelist. And I have no clue how to detect if the connection is succesfully established or it is >just another brute force attempt. If it was a brute-force you would also see multiple times a new SYN arriving I think? You cannot keep try...

jvanhambelgium

Perhaps solve this issue with a port-knock sequence? So "client" first needs to hit a certain sequence of UDP/TCP ports before "the gate opens up" Offcourse then there is still the mandatory authentication, jus make sure you run an up-to-date RouterOS and do NOT use default "...

jvanhambelgium

Other than my company, customers can use a dish satellite company or a cell phone company data plan - both are very expensive if you move lots of data. On a sidenote ; you feel any business impact/disruption from eg. Starlink services ? Rather cheap I believe & moving a lot of data is not reall...

jvanhambelgium

Current version on the 7.13-stable is 1.10.3

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that migh...

jvanhambelgium

That is going to be difficult , looking at your WAN-IP 100.67.x.x this is CGNAT-space (Carrier Grade NAT) so basically you do not have a public IP for yourself and therefore the world cannot "find" you if they want to initiate a connection to your server . YOU can offcourse initiate to th...

jvanhambelgium

Nope, SNMP will not provide you with that. User @Jotne has create a very nice solution using SPLUNK (Enterprise) and a script on the Mikrotik side forwarding information through SYSLOG. You can install it for free as long as you remain under 500MBytes/day logs This provides very nice information &am...

jvanhambelgium

There is no such thing as ns1.mynetname.net or ns1.mynetname.net
The 2 authoritative NS listed for that domain are ns2.kissthenet.net. (159.148.172.251) and ns1.kissthenet.net. (159.148.147.201)
They both resolve on IPv4 and IPv6

jvanhambelgium

In case you did not yet find these.

viewtopic.php?t=61007

So your product is NMEA-output support compliant ? Perhaps some fiddling with the baudrate ?

Offcourse all of this is RouterOS 6.x (old wiki)

jvanhambelgium

Installed it to test it .... extremely slow on my RB5009
Slow like in transferring 150Kbytes/sec across the LAN !!
The RB5009 was not really high in CPU

jvanhambelgium

Upgraded without issues :

RB5009UG+S+
RB3011UiAS

jvanhambelgium

Why might this happen? I just recently started trying to set up a firewall and I don’t understand everything. For example, 172.29.45.251 is the address of your PI Hole? -> There are (Android) clients that I've seen that always contact 8.8.8.8 etc. And in case there is a client with hardcoded DNS se...

jvanhambelgium

And you should "intercept" anyway classic DNS packets in case some client does not want to use the Adguard. See my example below (I use Pihole) Make sure you excluded the Adguard/Pi-hole itself using the appropriate src-address-list. /ip firewall nat add action=dst-nat chain=dstnat comment...

jvanhambelgium

Remove the container and re-create and provide the logging=yes from the beginning. You should see a bit more output when it downloads the various layers. I agree the logging is pretty ... basic .... and will probably not reveil WHY you have this issue. You specify as root-dir=adguard => This will wr...

jvanhambelgium

Add the logging=yes directive on the container-creation command and look in the logs. Might explain more about the error.

jvanhambelgium

AND the Wireguard AND the PPPoE overhead probably explains why your "only" get 300-350Mbits/sec CPU-profiler will give you insight. If you have a "spare" RB5009 you could perform a back2back test with a piece of ethernet-wire in between to see what the max is you can reach. You'l...

jvanhambelgium

Since this is a general setting, I would assume the total of all containers.

jvanhambelgium

As for using ACI instead of a single CRS326-46G-2S+ : It´s like suggesting a homeless person to move in to the royal castle. It would certainly solve his problems... :? Yep, it sure is. Totally different worlds. Good to know Mikrotik does support something like a PVLAN on certain models/chipsets so...

jvanhambelgium

What you are looking for is called "PVLAN" constructuon in general (Private VLAN) and you would be using some form of "Isolated Ports" in a "Isolated VLAN" construction. So 2 devices in such PVLAN cannot directly talk to each other but must pass through a device connect...

jvanhambelgium

Going into IP--> Services --> www and disabling port 80 unfortunately disables all web traffic to the router, including internal. So it stops router management. No need to disable it completely, but add the "Available From" values ? Eg. 192.168.x.y or multiple ranges that you want it to be...

jvanhambelgium

Howmany users ? 10 ? 500 ? 20000 ?

jvanhambelgium

It depends on how the devices are wired on your local LAN. These Tuyas are *wireless* right, so their traffic is hitting your router through the port on which some AP is connected ? And your DNS is the Mikrotik itself at 192.168.99.1 looking at your config. If so, change the "chain" to INP...

jvanhambelgium

The DNS-blocking is going to be a bit harder if everything remains in the same "LAN". If you would be using an IoT-VLAN that would be easy to also restric "internal" traffic flowing between VLAN's anyway. Alternative could be you provide SPECIFIC DNS-servers through DHCP-options ...

jvanhambelgium

Do you have a a "Tuya" bridge or somethings ? (like a HUE-box)
Can't you "pair" the Tuya devices nativly with Zigbee to Home Assistant ? Offcourse you need a Zigbee "radio" for that in your HA.

jvanhambelgium

You don't need a separate vlan for that.
Just make sure your IoT devices get fixed IP's based on their MAC
Then block these IP on their way out.

jvanhambelgium

Could you guys as container specialists enlighten me why a container would not start if you installed it onto a SMB-share (on a RouterOS through ROSE-package) Such package is downloaded correct, container is created OK, "iperf" binary can be found on the NAS providing the SMB-share under t...

jvanhambelgium

apart from that ... why on earth are you rebooting daily anyway....

jvanhambelgium

Something like this ? I think the RB1100 AHx4 (ARM32) supports Wireguard. https://www.wiresock.net/ Note : The Cisco ASA Anyconnect Client is so much more then only "a vpn client" offering basic vpn-client,advanced vpn-client, endpoint-compliance,inspection service,enterprise acccess, thre...

jvanhambelgium

and QoS ... what contract/agreeement/service do you promise/sell ? You don't want 1 appartement to blast away all the bandwidth all the time. Some policing & shaping for sure needs to be done.

jvanhambelgium

Ahhhh..good spotting @anav about the UDP/53 missing in the DNAT-rules. That might explain a lot.

jvanhambelgium

Hi, place these before the masq entries, so re-order them. add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ LAN protocol=tcp src-address-list=!excluded to-addresses=192.168.0.8 \ to-ports=53 add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ ...

jvanhambelgium

east-west security simply means "horizontally". Can be within a datacenter, but also between different vlan's eg on a smaller scale. It is a generic wording. depending on the environment, often the security hazards are not coming "from the outside world" alone anymore but often i...

jvanhambelgium

Your IPv4 standard for sure should include "east-west" security these days.
By default each of the 3 LAN's can just chit-chat with each other and that is not really a good plan...

Next-generation networks (SDx) would be intent-driven with micro-isolation already at the switchport/host.

jvanhambelgium

Sure this is possible. Nothing out of the ordinary, but somewhat strange. I f the WAN router is some decent gear , it can do NAT for whatever is coming in from the LAN, be it through different physical interfaces, VLAN's, ranges whatever. The typical "consumer" Internet-router provided by ...

jvanhambelgium

Put the Starlink in a separate VRF and work from there?
You could issue some health-check to eg. 8.8.8.8 across the Starlink-vrf and make some decisions from there?

jvanhambelgium

Did you poweroff/poweron the ISP modem ? Might also be something "MAC" related in the sense that the cable-modem expects the MAC of the hEX S. Apart from that, yes you need to configure "DHCP Client" on the RB5009 in order to obtain an ISP-address. Specify the correct "WAN&q...

jvanhambelgium

Why bother with the Mikrotik ? Fortinet can do the PPPoE to your ISP just fine and is a much more advanced solution then any Mikrotik when it comes to security.

jvanhambelgium

Hello guys, i strugglin with one thing... My NAS using IP 192.168.88.200 i want to use xyz.xyz.com.pl in url but its not working, can you help me? Search the forum for "hairpin NAT" because that is what you are looking for. And post your config as requested below if you already attempted ...

jvanhambelgium

The resolving of FQDN will follow the TTL-value of the zone applicable. No need to "force" to resolve this periodically. Go to /ip/dns/cache and "print" .The FQDN's should be there and you will see the TTL value countdown timer.... This works fine as I have some units for which I...

jvanhambelgium

Hmm, if your IP falls in the range 172.16.0.0 to 172.31.255.255 you DO NOT have a true public IP !

jvanhambelgium

>> We only have /31 range from our ISP to use. Nope, don't think so :lol: :lol: This ISP-link always has a cable that always needs to be inserted into something...and that will be your SPOF. With a /31 that does not leave much flexibility to have a robust/dynamic setup... You still can have 2 x CCR ...

jvanhambelgium

Beginning with 172.x.x.x MIGHT be OK ;-) Is the IP address on the range below ? If so, then you do not have a public IP. 172.16.0.0 to 172.31.255.255 Under "Settings" , then "Network" I also filled in the field where you put a URL that points back to you. In my case for example t...

jvanhambelgium

Are you sure it's a public IP ? And not something like 100.64.x.x ? Your screenshot with the blurred out IP says "0" as port-number and that is not correct. I have there nicely 32400 Try the "manually specify public port" setting and put 32400 in there + Apply. See what that does...

jvanhambelgium

Well...try to refer to Interface address lists like the other (apparently working ones) ?? Why do you select "ether1" and not "WAN" ? You tried and it doesn't work ? You reference "ether1" for these Minecraft rules but that might be wrong. If you are using PPPoE for ex...

jvanhambelgium

Interesting use-case, but I think everybody has moved to from stand-alone approaches (on the CPE itself) to centralized, API-driven solutions? So all devices would report their usage to keep track of accounting centrally and through API/remote-control the cap would be enforced on the device. Perhaps...

jvanhambelgium

I am interested in the way you run splunk inside ubuntu, how did you get that working ? runnning syno virtual machine manager ? and than a plain ubuntu image ? and than a normal ubutu splunk install ? I am running latest DSM on a 920+ with enough resources Indeed, just like that. I'm running on 918...

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that might...

jvanhambelgium

Ok, but you write it as if you want some mechanism of "load balancing". That is not gonna work. You can have 1 destination-NAT (so at *network* level) pointing to some backend (internal) IP and have this changed based if the backend is "up" For this to work you could have several...

jvanhambelgium

There are 2 parts to this question ; frontend & backend In the backend, you could with "Netwatch" tool have a "test" (eg. ping or http-get to backend servers and do things if they reply or not) So these would be your health-checks to the backend servers and you could enable/d...

jvanhambelgium

Are you sure your USB-storage is still "usb1-part1" ? Don't know the release you are running, but I had the same with RB5009 on some where where each reboot the USB-drive/partition was named differently! This whole container thing on eg. RB5009 still is a bit "hit & miss" fo...

jvanhambelgium

That is why I have such separate rules masq-rules for anything that needs to go out on Internet coming from eg. Wireguard or ZeroTier "zone"
So at least this gives me logging & counters in case certain things do not work and it might be easier to "pick up" along the way.

jvanhambelgium

I would start by looking at the map of the RV-park and where the RV's are going to be stationed/clustered and work from there. Remember Wifi is 2-way, so the client also needs to communicate back. Some endpoint have better antenna's than others etc. But outdoor there is a lot of things to consider t...

jvanhambelgium

Best is to make packet-capture and spot for issues....this smells indeed MTU or alike. If you get authentication-box already etc then I doubt "settings" of Wireguard are at play here. Firewall-rules also seems OK at this point then, but that can be checked in the logs (if you enable loggin...

jvanhambelgium

logging - logging - logging

Enable logging on any rule that has a "drop" in there, and filter for you endpoint 10.180.5.2/32
There has to be some trace of a rule that seems to stop your packets from going out.

jvanhambelgium

The "pull" works fine. I see the folder being created (the first time after I alter the path) and I see a growing *.gz file while it is being downloaded...then suddenly everything stop and it removed from the NAS and it throws an "error". Usually 1 or 2 "layers" are pro...

jvanhambelgium

Is there anyone that can explain me why the extraction of a container-image fails across a ROSE storage point ? Running the latest 7.11 on RB5009 So I've mapped an SMB on my NAS which is accessible fine (because I see files being created on it) Screenshot from 2023-08-20 20-17-12.png I've also adapt...

jvanhambelgium

It is a bug for sure. Same with "Winbox"
On CLI, when doing a "print" of the vETH you get so see the IP address
On Winbox, it is 0.0.0.0 for every vETH
It was on 7.10 and now on 7.11 also.

jvanhambelgium

I believe that the LCD screen is not supported on RouterOS 7. So, forget that the screen. LCD works just fine on my RB3011 on 7.11 But it is a gimmick for sure. Sometimes handy to see if some interface does traffic or so but in the end still a gimmick I have the RB3011 on a +- 100Mbps xDSL and it h...

jvanhambelgium

Updated LAB RB3011 to 7.11 and all seems fine (for my limited use-cases ; basic PPPoE Internet, IPSEC-tunnel to RB5009 etc)

jvanhambelgium

If you care about power-consumption a device like RB5009 uses much less power then "the average spare computer" When running 24x7 this might make some difference in yearly running cost. I think my RB5009 is about 9.5Watt if I look at my home-automation graphs. (because I use a SFP-module i...

jvanhambelgium

Rx counter remains at "0" on the "client" side ?
It should at least try from the hotel to reach the endpoint right ?

jvanhambelgium

If you can ping it already that means that VLAN's are OK. Printers these days are quite flexibel, offer dozens of (printing) protocols to choose from. They can be configured with ACL to only allow printing from certain IP-ranges etc,etc. What does you logging say ? If you define a printer on a PC on...

jvanhambelgium

Where do you want to forward port ? From Internet ? Internally between 192.168I.1.x and 192.168.2.x you do not need to forward ports, (under the NAT-tab in Firewall) you simply need to make firewall-rule to ALLOW it through. (and offcourse *above* the rules where you block all further communication...

jvanhambelgium

Hmm, a lot of various rules, not perse "bad" but it doesn't make thing easy to follow. Some forum-member will tell you this is a very messy config ;-) Anyway your question was about flows between 192.168.2.x (home-network) and 192.168.1.x (homelab-server) that should be blocked right ? (in...

jvanhambelgium

Perhaps begin with posting you config here so things are more clear

/export file=anynameyouwish (minus router serial number and any public WANIP information)

jvanhambelgium

hmm...firewall rules ?

jvanhambelgium

I have similar issues on a RB5009. The USB-storage for sure is not super "stable" and after a few weeks often a container is completely trashed because the underlying USB-storage is gone. I need to unplug-replug etc. In the past I had to reformat completely. I tried USB3.0 stick directly i...

jvanhambelgium

I'm still puzzled why "Adguard" is not showing any statistics *but* it seems to be working. My test-PC has hardcoded 1 single DNS pointing to the Adguard, dns-resolving works (I see exchange in a tcp-dump) but nothing in the logs or statistics-dashboard. Strange .. don't think its a permi...

jvanhambelgium

Hi, Yep, seems to be a Winbox bug. On a RB3011 lab box, running the latest beta 7.11 BETA6 this "issue" is present. Winbox entries all give 0.0.0.0/0 but on console all is OK. Feel free to log a ticket on this with MT. /interface/veth> print Flags: X - disabled; R - running 0 R name="...

jvanhambelgium

Strange, Works fine here. The difference is during boot it clearly prints the veth-IP:3000 reference to login, and in your case it does not... Screenshot from 2023-07-27 18-21-54.png And I confirm the GUI works fine on my test-segment 192.168.3.4:3000 ...and after first install the GUI is available ...

jvanhambelgium

You use the interface-list "WAN". Are you sure the ingress interface is member of that ?
When you try and it does not work, what counter increases ? The "drop all not coming from LAN"

jvanhambelgium

This requirement ; - have guests being able to join the network on the Guest SSID and on the TP-Link without accessing the Normal network. - On the TP-link I just want to connect the Guest without thinking about what port. This cannot be done without 802.1x implementation on the switch-side. Your TP...

jvanhambelgium

The only option you have is start a packet-capture on a RouterOS device and "stream" this towards any IP endpoint further down the network. On the remote end you either have some Wireshark running or probably some tool will exist to then write a pcap-file locally. (eg. rpcapd.exe) Screensh...

jvanhambelgium

What if, for example, "Untrusted" VLAN is 10.1.1.0/24,"Semi-Trusted" VLAN is 10.1.2.0/24, "Fully-Trusted" VLAN is 10.1.3.0/24, and the file server is 10.1.4.1/24. Untrusted and Semi-Trusted can access the File Server, but Untrusted, can't. How would I do that without n...

jvanhambelgium

Lil off topic - but still related to file-servers ... Take a look at TrueNAS I run a dozens of TrueNAS file servers. When configured correctly , they can be pretty fast. For example , I have a TrueNAS file-server with 1-TB RAM and about 256-TB of solid-stade SSD drives with 100-GIg network interfac...

jvanhambelgium

...and with a fileserver you also need to look at aspects like NFS ACL's or SMB User-accounts etc. Being able to "reach" your fileserver does not mean you can access it / use it. Depending on the file-server model/OS , you can also apply a IP-ACL to exclude the "Untrusted" IP-ran...

jvanhambelgium

>WBut, the firewall is basic, and I want to give my servers additional protection ( I get various probing attempts / hacks / brute force log in attempts every >day). So the way I envisage it, I just need some sort of packet filter between my servers and the existing LAN. It would do things like: dro...

jvanhambelgium

Please explain what *service* is behind the Windows machines ? What are you trying to accomplish ? Perhaps NLB between the 2 Windows servers might be a good approach. The MikroTik then can have a DNAT pointing to the NLB-VIP and NLB will sort it out. https://learn.microsoft.com/en-us/windows-server/...

jvanhambelgium

I think there is an issue with ZeroTier on the 7.9-stable release. After 1-2 days the ZeroTier looses its LEAF & PLANET connections for some reason. Stopping & Starting resolved it and then you are good to go another 1-2 days. This on RB5009 system. Don't think a SUPOUT will do any good here...

jvanhambelgium

Try with NFS v3, that works for me...

Hmm, I can't really force that on the NAS. I can enable/disable NFSv4.1 , but other than that its "enable or disable" NFS as a whole.
Is there some command-flag on the ROSE package to force NFSv3 ? (doesn't like like it....)

jvanhambelgium

Anyone using a Synology NAS and was able to mount a NFS-export onto a Mikrotik ? (I'm using RB3011-ARM here to test) It just won't work, getting "Protocol Not Supported" error ? (while I use the Synology with a bunch of mounts to other systems here, media-players etc. In-house I only do NF...

jvanhambelgium

Personally allowing access to a device on Internet through a "whitelisted" source-IP(s) is acceptable to me and we do that for customers across our projects. VPN is not always an option or sometimes overkill. Just make sure you have additional layers like (encrypted) authentication using c...

jvanhambelgium

It could be 10 things, without any config impossible to say. (could be nat, routing, ...) Did you "torch" on FW2 to see if the DNAT'ted packet arrives at that point ??? The "device" is exposed to Internet with a DNAT ? Or does this "public computer" also has Wireguard C...

jvanhambelgium

So this is obsolete and not correct? In the link below "https" is not mentioned.

https://wiki.mikrotik.com/wiki/Manual:IP/Proxy

Not sure if it would insert X-Forwarded-For in the headers neither.

jvanhambelgium

btw,
don't think any HTTPS will work.
the "proxy" module on Mikrotik supports HTTP only, and in 2023 only very few websites use HTTP.

jvanhambelgium

eh...just duplicate the rule just below and change accordingly ? Just for my own edification, if I did that it would still block my WG traffic would it not? That rule only allows traffic from one subnet and it wouldn't match that so it wouldn't matter if the next rule did. Am I misunderstanding? Ye...

jvanhambelgium

I found the issue. Rule 9 in the Raw table: add action=drop chain=prerouting comment="defconf: drop local if not from default IP range" in-interface-list=LAN src-address=!192.168.100.0/24 My WG connections(s) are 10.10.100.0/24 so not in the allowed IP range. Question: It seems I cant add...

jvanhambelgium

since I've inserted a USB 2.0 "hub" into the RB5009 and then my SDCARD in it the disk-id remains consistent across reboots. The problem was that sometimes the card is seen as USB 3.0 and sometimes USB 2.0 which results in differend "disk" ID's. At the moment I have 4 containers r...

jvanhambelgium

I've had the same on 7.8 on my RB5009
Not often, but sometimes it was in a state "REQUEST CONFIG" or something. Stopping en starting ZeroTier services made it work again.
Now I've update to 7.9(rc2), which bumps the ZeroTier version also to a much newer release 1.10.3

jvanhambelgium

I couldn't get the Traefik container to work too. Therefore I decided to use nginx-proxy . How did you install it ? I tried to launch it via line below but it gives an error. add remote-image=jc21/nginx-proxy-manager:latest interface=veth4 root-dir=/usb3-part1/npm mounts=npm_data,npm_encrypt start-...

jvanhambelgium

I couldn't get the Traefik container to work too. Therefore I decided to use nginx-proxy.

Yes but this requires a DB in the backend. I have NPM also running on a Synology NAS combined with MariaDB where the config is stored for NPM ?

jvanhambelgium

Anyone here has practical working container like "Traefik" operational ? (can serve as reverse-proxy) I've imported it and I can start it, but dash-board for example does not work. Also what about its config file "traefik.yml" ? I've shelled into the container but cannot find any...

jvanhambelgium

Your wireless scenario is not possible unless you have an advanced ISP-router that you fully control.
Some "static routes" are not enough, this sound more like some policy-routing based on certain criteria.

The "wired" scenario is basic and will work.

jvanhambelgium

Depends... What is the PPPoE link ? 100Mbit ? 1000MBits ?? If only a 100Mbits Internet link I would risk ik. Don't expect 500Mbps Internet performance or something... Your product is a SWITCH with a pretty weak CPU, so if you start using as a breakout-router to Internet don't expect a lot of perform...

jvanhambelgium

TP-Link "management" (webgui) are always untagged packets, its not like a enterprise-grade switch where you can "dictate" which VLAN the Management should be. So, untagged frames will end up on the port "ether4" on the HEX Why would you think you'll get an IP from 192.1...

jvanhambelgium

Anyone else having this thingy with USB storage that keeps changing with each reboot from usb1-part1 to usb2-part1 etc ? Basically breaking containers etc between reboots. Was it possible to refer to a "label" in the container-settings ? yes, add "slot=DATA" parameter to your di...

jvanhambelgium

i5 - 7400 , 16g ram? if you already have it available go with it, it will perform better than a rb4011/rb5009 Thank you Chechito. Is the i5-7400 better than CCR2004? Better? you only have 150 clients and 1Gbits at most. i5 is even overkill. RB4011 or RB5009 will serve your Internet Cafe without eve...

jvanhambelgium

Is there another way to log visited sites? You could always go down the DNS path (analyse resolved entries), but that will not give you granularity *what* has been exactly visited. And off course not all DNS-lookups lead to visited "websites" so no real 100% match for your requirements. I...

jvanhambelgium

Mikrotik should remove this "web proxy" module all together from RouterOS. It is only for HTTP and does not support HTTPS Most Internet traffic these days is HTTPS. To put in some numbers (from Netflow). The last 24h my router processed about 89.000 flows on port 443 , while "port 80&...

jvanhambelgium

Last week I disabled my Pi-hole container on RB5009 and returned to the container on my Synology NAS where it used to work flawlessly for years. "Once it runs" it is quite stable, but I experienced things like ; cannot start container anymore after an update-only reboot helps, USB-storage ...

Search found 1098 matches