MikroTik

jvanhambelgium

So this is my RB5009 example on PPPoE 2Gbit/s speedtest. If it's a single thread exaplain to me CPU loads : PPPoE encapsulation/decapsulation is only 1 part in the chain. If you are receiving 2Gbits/sec, that traffic, after PPPoE framing is removed is going through FW-rules etc so it might incur ad...

jvanhambelgium

What routerOS/platform are we talking about ? So in essence everything starts with how you are identifying such "insolvent client" then ? You are running PPPoE servers ? Using AAA (RADIUS) I assume ? 1) Go non-technical and simply block access. Customer will make a call to support "wh...

jvanhambelgium

Nah you probably have to make a graph, put different datasets in there and then have some "sum" operation to count totals.
But then again, it does not make any sense to have a "per device bandwith" parameters ? How could that be interesting ?

jvanhambelgium

Is the target host a Windows machine ?
No host-firewall issues ?

If a Linux, can you do a quick "tcpdump" to see what actually ARRIVES there ?
If a Windows, perhaps quickly install "Wireshark" or something for a test.

jvanhambelgium

Dear Team, I am facing some issue with CCR-1072 loading kernel... OK setting up elf image... OK jumping to kernel code (0,0) hv_panic: msh3: detected uncorrectable memory error on rank 0 (H) System halted. (6,1) hv_panic: got read error response on RDN interrupt: PC 0xffff_fffc_0003_8e88, ICS/PL 0x...

jvanhambelgium

Then why use RouterOS / CCR-box ? do this on native Linux ?
Get yourself some 25/40/100Gbps NIC's and perform some tuning.

https://fasterdata.es.net/host-tuning/l ... 0g-tuning/

jvanhambelgium

Along the different versions of RouterOS I also found some weirdness in some of the netflow-config, but that was more in the v9/IPFIX templating.
Made a quick test on my v5/Netflow on RB5009 v7.16 using Wireshark and it works fine. Wireshark detects as CFLOW v5 and I'm seeing flows in there.

jvanhambelgium

Did you analyze what is "not working" ??
RouterOS is not sending anything to the target collector ? Or is information plain wrong/missing ?
Are you limited to v5 for some reason and not able to try v9/IPFIX or something?

jvanhambelgium

No, "Kid Control" will only provide nummeric values but Yes on a "client" (IP) basis. It is up to you to extract the data from RouterOS and do something with it. Through scripting you can transmit SYSLOG messages containing this "accounting" info and load them into some...

jvanhambelgium

Exactly like you mentioned ; 1/ Configure 6 ports, put 192.168.x.254/24 on each of the interfaces.(eg 192.168.1.x , 192.168.2.x , 192.168.3.x and so on) 2/ Configure DHCP for each of theses ranges, make sure you hand out DNS (eg. 1.1.1.1 or 8.8.8.8) and gateway 3/ Configure Firewall-policies where y...

jvanhambelgium

>> For me this should prevent everyconnection, but I still can access the video so ... it's not working How do access the video-feed ? Are you using app on your smartphone on the local WIFI-network ? Are you testing externally with your phone on 4G/5G? Is the REOLINK cabled directly into the Mikroti...

jvanhambelgium

Works fine on my RB5009 (tested with my Internet radio) but your problem probably is the position of the rule in the forward chain!
Move it up!
You can always temporary enable logging and check the output.

jvanhambelgium

Still confused but the very first post states ; If I change to Automatic and use a DHCP Client, then it gets the static IP and works fine. So at this point, you've enabled "DHCP Client" on the Mikrotik, you get an IP (public) and Internet works ?? Through DHCP you normally (can) get DNS,De...

jvanhambelgium

Simply make different tunnels (eg. across different ISP) and have on top indeed a routing protocol take care of that. Some of the tunnels will be mostly "idle" (except for some routing-protocol traffic across it) so it will not really impact your device. IF your device is already strugglin...

jvanhambelgium

Perhaps your interpretation is just wrong ;-) Don't overthink it.... A ISP provider providing you a "static" non-changing public IP *does not* mean you mandatory have to configure an actual STATIC IP on your interfaces ! This non-changing public IP is/can-be delivered through DHCP-mechanis...

jvanhambelgium

Given the bandwidth constraints & managing an equal share for everyone you are going to have to perform some bandwidth management too. (queuing etc). Now in theory you still have a wireless part where you can slow down stuff on the radio-link(s) I guess. I tend to agree that a 4011 or 5009 would...

jvanhambelgium

Create a FW-rule in the FORWARD-chain and play with the "Connection NAT State" values ? This value can be "srcnat" "dstnat" "ein-snat" or "ein-dnat" So basically you could configure to only pass traffic that have a valid "src-nat" mark ?? J...

jvanhambelgium

Below the specs of a t3.micro instance. vCPUs 2 Memory (GiB) 1.0 Memory per vCPU (GiB) 0.5 Physical Processor Intel Skylake E5 2686 v5 Clock Speed (GHz) 3.1 CPU Architecture x86_64 The 5 Gbps is probably the BEST CASE ( up to 5Gbps of NETWORKING performance, 0 guarantees) => do not confuse "wir...

jvanhambelgium

You should first fix physical access. On the eth8 nobody should be able to pull the cable out. On the AP-side, depending on brand, it can be made very difficult to pull out the cable. The only option is : -> Have any wireless end-user drop in a separate vlan-id + subnet being different from the &quo...

jvanhambelgium

Do you have the same results when graphing using an external application & using SNMP or something? Perhaps because of the different RouterOS 6 <> 7 Things related to some fast-path stuff what that certain things are "less visible" to RouterOS 7 ? Mikrotik must provide insight on how &...

jvanhambelgium

If you configure each of these routers 10.1.1.254, 10.2.1.254 etc with some "helper" address (on the customer-facing side) to relay the broadcast-request they see coming in the client-side and deliver it in unicast to your DHCP you'll have no issue to map it to a correct pool I guess. So y...

jvanhambelgium

The problem is very often that "a website" these days has all sort of content fetched from different sources. So you would allow 1 domain or IP, but your client will fail fetching dozen of content items along the way.

It will be very much "trial & error"

jvanhambelgium

> We not using an SFP port. just using ether1 for WAN and ether2 for LAN so i could be an issue with the grouping? Sure it could be that, try moving "ether2" for example to port 6/7/8/9/10 and see what happens. I'm pretty sure throughput will for sure increase as you have a 1Gbps "lin...

jvanhambelgium

Not a very clear story. So you have ISP1 , which delivers 1 public IP using L2TP terminated onto a CCR You have ISP2, that delivers also 1 public IP using L2TP terminated onto a CCR So is ISP1 providing you with the primary FTTH link and ISP2 with similar FTTH-link ? If the above assumptions are cor...

jvanhambelgium

Next-Generation Firewalls like a Palo Alto can easily do this based on App-ID signatures. They recognize A LOT of applications and you can do something with that (allow, deny, traffic shape etc) Below a list of applications in their library. https://applipedia.paloaltonetworks.com/ Very expensive b...

jvanhambelgium

How is the cabling done ? Do you use the SFP slot ? Remember the RB3011 has an architecture where both groups of ports are interconnected to CPU-cores using a 1Gbits/sec channels. (1 for each CPU-core) When you do queuing I'm pretty sure the CPU is involved so if you use 2 adjacent ports your probab...

jvanhambelgium

Next-Generation Firewalls like a Palo Alto can easily do this based on App-ID signatures. They recognize A LOT of applications and you can do something with that (allow, deny, traffic shape etc) Below a list of applications in their library. https://applipedia.paloaltonetworks.com/ Very expensive bo...

jvanhambelgium

> How can I "secure" my router? What are the must-have/suggested firewall rules? Focus on adding rules to the INPUT-chain. These are packets targetting the RouterOS itself. Securing the router would mean ; -> you want to filter out crap hitting the INPUT-chain, eg coming on from your WAN a...

jvanhambelgium

Packets routed by the UDM-Pro will hit the 192.168.0.x directly on the WAN-interface. What is the gateway on these servers ?? Do you have a static route on each server for the 192.168.128.0/22 pointing back to the UDMP-PRO (*.241) or do you default to the RouterOS box and have a static route on that...

jvanhambelgium

Where is your default-drop (eg. on your forwarding-chain) ? As you move sequentially through the rules top-bottom finally the packet will be allowed unless explicitly blocked. I don't see that in your rules. Mine looks like this. So no references to any interfaces, just across the whole forwarding-c...

jvanhambelgium

Isn't that the same display which can cause performance problems ?? Yeah I remember some threads about that ;-) Back on the days of 6.x releases I think. This machine was my lab-router. I've moved to RB5009 some years ago as my main home-router now. I think the time has come to lay the RB3011 perma...

jvanhambelgium

True, the RB3011 really looks bad ass with its LCD-display

jvanhambelgium

Hi, For many years I have a RB3011 in my lab, but some weeks ago suddenly it would not boot anymore. I've tried netinstall-cli on my Linux but it does not really complete. RouterBOOT booter 7.16beta7 RouterBOARD 3011UiAS CPU frequency: 1400 MHz Memory size: 1 GiB NAND size: 128 MiB Press Ctrl+E to e...

jvanhambelgium

Bottleneck is probably because PPPoE is a single-threaded process stuck on 1 CPU-core (out of 16) when it comes to encapsulation/decapsulation and therefore you are probably hitting its limit.

jvanhambelgium

Starlink for sure is a quite disruptive player and I admire the technological concepts & roll-out. I"ve only seen a few cases where customers deploy Starlink in favor or (our own owned & operated) 4G/5G/MPLS solutions. Offcourse we do not merely act as an ISP, because the connectivity-a...

jvanhambelgium

I understood earlier in your posts that your "ether1" is your ISP "uplink" AND if you pull out the cable out of your Mikrotik router and put it on a PC it receives via DHCP a 192.168.88.x IP and Internet works. ---------------------- PC connected to Mikrotik via ether2 and ether1...

jvanhambelgium

Perhaps time to actually DEBUG the situation. So go into winbox and go to "System" > "Logging" en then add 1 "rule" Select topic "pppoe" and set "Action" to "memory" Now watch your logging-screen in Winbox ... perhaps there is something int...

jvanhambelgium

The hint on the MAC-address is also something to check?
In my case, I have explicitly on my PPP-profile

Screenshot from 2024-10-06 18-07-21.png

Screenshot from 2024-10-06 18-07-31.png

jvanhambelgium

Credentials are correct, I use them every day, and I can open a connection with them creating a windows pppoe connection as described above On the PPPoE-client settings, what do have selected for authentication protocols ? pap / chap ? did you select mschap1/2 ? You have a PPP-profile associated wi...

jvanhambelgium

What about that DNS .
Is see 192.168.1.75 assigned as DNS-server ?? Where is it ?
Try to assign 1.1.1.1 (or 8.8.8.

in the DHCP-settings for clients to start with.
Can you perform a basic lookup ?
So open CMD-prompt, and try "ping www.youtube.com" ?? What does it do / say ???

jvanhambelgium

>Does it matter if Gateway in DHCP is 192.168.4.1 or 192.168.4.2? It shouldn't be the same as Address on the Adress list or not.: >https://hizliresim.com/qa7p63a Offcourse this matter. This is KEY. The value of gateway must be the same as the IP of the interface ! So in your case 192.168.4.1 Otherwi...

jvanhambelgium

192.168.88.1 is OK as next-hop.
The Mikrotik will find it.
So correcting the mentioned 192.168.4.x on the INTERFACE itself combined with a correct static-route should get it working I guess.

jvanhambelgium

IP route print: Code: Select all DST-ADDRESS GATEWAY DISTANCE DAc 192.168.4.0/24 ether4 0 DAc 192.168.88.0/24 ether1 0 You do not have a static default-route and that is the reason why it does not work. Add a static route 0.0.0.0/0 pointing to the next hop "192.168.88.1" across interface e...

jvanhambelgium

There are A LOT of posting about the 2.5G implementation on RB5009, and most of them not in a positive way. It is quite possible some bugs exist in RouterOS on this, or the "interoperability" with other vendors is not rock solid. Some users seems to have a stable working 2.5G setup with a ...

jvanhambelgium

1 I have a switch CRS317-1G -16S + 2 Three servers 3 Everywhere installed network card Intel X 520AD 4 cable SFP/SFP+ MikroTik XS+DA0001 When I run the utility iperf3 in single-threaded mode. I have a speed of only 3.5 Gbps. But the problem is that veeam works in single-threaded mode and the speed ...

jvanhambelgium

Are you sure the NAS supports 2.5 ?
Perhaps it is strictly a 1/10G port ?

Exactly what model of NAS is it ?

jvanhambelgium

> how do I see the "internet connection" for each user? Depending on what Mikrotik & version of RouterOS the "Kid Control" function provides some "insight" on this. In Winbox : "IP" > "Kid Control" where you can see the amount of data processed f...

jvanhambelgium

You can use CloudFlare resolvers ? (I use them "upstream" for the requests my Pihole makes to the outside world) IPv4 Malware Blocking OnlyPrimary DNS: 1.1.1.2 Secondary DNS: 1.0.0.2 Malware and Adult ContentPrimary DNS: 1.1.1.3 Secondary DNS: 1.0.0.3 IPv6 Malware Blocking OnlyPrimary DNS:...

jvanhambelgium

https://help.mikrotik.com/docs/display/ ... ter%2C+CHR

How could you miss the section on payed licenses ?!

jvanhambelgium

Updated my RB5009 & RB3011
No issues, all my basic services work fine.

jvanhambelgium

Another tip : do not use the "admin" username. (valid for any product)
It will increase security by not using the default administrative-login user.

jvanhambelgium

Howmany megabit/sec is each camera doing ? 2Mbps ? 4Mbps ? 6Mbps In *theory* you can "split" your CAT6 cable into 2 sets of connection, but limited to 100Mbps !! However this *might* not be a problem is you have 4-6Mbps per cam and 12 cams < 100Mbps. The other 100Mbps "channel" c...

jvanhambelgium

The correct setup is to ask your ISP for an appropriate ONT/ONR which would have a 10GBase-T interface or something.
Give 'm call.

jvanhambelgium

So what is your use case ? You state " Now I have a task to hide WG service packets " . Are you doing all of this effort in order to hide from an advanced UTM-firewall that would "detect" Wireguard application and block it for example ? Or is this some academic hack-a-thon thing ...

jvanhambelgium

Simple make the webserver perform the redirect

It can sent a HTTP 302 code to tell your Windows client that.

jvanhambelgium

Interesting, I always assumed that if you would physically have 2 different physical ports/interfaces (even under the same bridge) you could at least filter traffic between them by referring to the appropriate "ethernetX" port on your rule. but, now that I'm thinking about it ... these por...

jvanhambelgium

They may be in the same subnet IF you can connect each of the devices/servers onto a different physical port of your Mikrotik. (and these interfaces are members of the same bridge) Depends on the model you have then. Then simply adjust your (forward chain) firewall rule to include the "in-inter...

jvanhambelgium

Agree, your setup should be easy-peasy actually and this is very strange behaviour.
I would :

1) Save your complete config a file
2) Completely erase and start over and fix the basics! Then start building on top with the things like VLAN's, IPSEC-tunnels, fancy mangle-rules etc,etc

jvanhambelgium

From the terminal on the Mikrotik, can you ping 8.8.8.8 or something like www.mikrotik.com ??
I can ping your public IP 135.x.x.x (IF that your real one) but looking at your config I tried SSH/Web but no luck.
(you should probably not allow any public IP to connect to your router....)

jvanhambelgium

I think that is going to burn more cpu-cycles. I used these blacklists for both INBOUND & OUTBOUND blocking. For egress, you could easily blackhole each of these prefixes to "nowhere" But what about ingress traffic coming FROM these IP's ? Then we are talking about some policy-based-ro...

jvanhambelgium

Create a static dns entry that catch all fb/yt dns name and return 127.0.0.1 I do block dns from lans to wan. Only resolvers is mkt. the only way to bypass is for client use it's own hosts file with real ip. So i added forward deny rules with dst address list that contains identified dns names. I'v...

jvanhambelgium

I wonder if you not better look to handle this at CLIENT/ENDPOINT level. There are various endpoint-security clients available with things like webfilter-control policies etc. Is this 100% Windows 10/11 environment ? Things like Microsoft Defender for Endpoints etc. ...not everything can (or should)...

jvanhambelgium

Perhaps the best alternative is that you control the DNS. Then you can also do some serious blocking. If your Mikrotik is capable of running containers you can look for something like Adblock or Pihole and simply block on that. Off course you will have a tough time blocking "leaking dns" c...

jvanhambelgium

It CAN depending on all the whistles & bells you activate on the RB5009 and the type of ISP-connection. I really doubt it will deliver 2.5Gbps over a PPPoE connection. PPPoE encap/decap is not a multi-thread process and will be bound to a single CPU-core I think. If your ISP delivers Internet ac...

jvanhambelgium

Why is "your global traffic limited" ? Who limits this traffic ? This is not a concept we know here or in Belgium, but in some parts of the world an ISP limits the amount (or bandwidth) of traffic that is going outside the local area. So you could e.g. have "unlimited" traffic t...

jvanhambelgium

We have connected several windows web servers to mikrotik router. This router has WAN interface which obviously connects to local as well as to global networks. In our case the global traffic is limited, and because of this our global clients experience connectivity issues. So we need to investigat...

jvanhambelgium

No you cannot do this on Mikrotik itself. You need to look at something like a Netflow collector or Splunk setup. Depending on your level of expertise this might be pretty simple to setup or very hard... There is very nice Splunk-app developed by forum user complete with all install-instructions etc...

jvanhambelgium

"Load Balancing" is something different then "HA (High Availability)"
On the LAN-facing side, you could build some HA using VRRP indeed. Then further upstream towards "Internet" you can also build something with Mikrotik for both HA and load-balancing/distribution.

jvanhambelgium

Both "Yes" and "Not really", because you need to define first " without access to the entire internet " Sure you can allow LOCAL users to be allowed to 1 specific (your) SERVER on Internet and BLOCK everything else (=NO Internet) Within Mikrotik there is no concept of e...

jvanhambelgium

add action=dst-nat chain=dstnat comment=\ "Force any UDP DNS queries that aren't to pihole to go to pihole" \ dst-address=!172.17.0.2 dst-port=53 in-interface="Local Bridge" protocol=\ udp src-address=!172.17.0.2 to-addresses=172.17.0.2 add action=dst-nat chain=dstnat comment=\ &...

jvanhambelgium

Sure but RB5009 is not a CCR.
I guess the sensors are not there on the RB5009 board, they need to cut costs somewhere

The CCR1072 is slightly more "enterprise/datacenter" than a RB5009 which I consider "home user" or "small enterprise" grade equipment.

jvanhambelgium

You cannot check internally, only with external powerplug with measurement capabilities.
My RB5009 does about +- 9W (50% of all ports used, 1 SFP+ inserted (type S+RJ10)

jvanhambelgium

>Thanks, so if I connect my LAN port to his WAN port and configure independent DHCP / routing on his router for his use, can I just set up rules to prevent >routing between that LAN port (that his WAN connects to) and the rest of my LAN? Sure, you can craft some FW-rules based on different parameter...

jvanhambelgium

That will be hard to avoid (the double-NAT) unless you have extra public IP's and can ROUTE some traffic up to his WAN-port. OPTIONAL -> If you & the neighbor can agree a on IP-subnet he can disable NAT on his router and ROUTE all the traffic. You would be responsible for the NAT action then. eg...

jvanhambelgium

Take 1 interface out of the bridge and put a small subnet on it (eg /30) ? Then have the cable run to the neighbor and let him config the correct IP on his "WAN" interface. Secure what needs to be secured with some FW-rules (eg. make sure the "connection subnet" /30) cannot conne...

jvanhambelgium

Your input is way overkill here and I disagree with it on top LOL. Interface usage is common and efficient, especially if users are going to go out the local WAN ( lan to wan and dns rules) and the use of firewall rules provides the requirement amount of security for individual user access. Let's a...

jvanhambelgium

I consider "Wireguard" or "ZeroTier" as different "zones". So these interfaces are not part of the LAN interface-list or something. So I have a set of firewall rules allowing WG-peer(s) to access what they need to action (eg. Plex, HomeAssistant, my home Splunk etc) So ...

jvanhambelgium

The requested config is relatively easy. I would expect this to be done between 1/2 day - 1 day by somebody who is juggling with RouterOS on a daily basis (and probably has his set of example config snippets etc for these types of basic things) Offcourse all info must be there (info on the 2 ISP cir...

jvanhambelgium

OK, thanks for explaining it to me. I have only one doubt. When I banned the IP on the router firewall, the banned log says: banIP_ prerouting: in:ether1 out:(unknown 0), connection-state:invalid src-mac XX:XX:XX:XX:XX:XX, proto TCP (SYN), 113.XXX.XXX.XXX:49987->[b][color=#FF0000]61.XXX.XXX.XXX:100...

jvanhambelgium

Why does this request reach the server 192.168.0.3, when the router firewall should drop all new connections in forward except those to the ports set in NAT (80,443,2203)? Maybe the internet host found open port 2203 and is now trying to brute-force in? I've seen that as well ... one has to keep in...

jvanhambelgium

Why do you think/state " ...upon analyzing the logs of the server 192.168.0.3, I've noticed continuous SSH brute force or scanning attempts (I'm not sure) on random ports (not the standard SSH port or my SSH port 2203) originating from an IP address in China: Apr 28 11:36:54 cloud sshd[28265]: ...

jvanhambelgium

What product are you using ? I'm pretty sure hardware-offloaded stuff/config will not always behave as simple as you might think . Which then can explain what you are seeing. I've think I remember reading somewhere that you can only perform MAC-filtering in the forward-chain when HW Offloading is DI...

jvanhambelgium

Limit the amount of broadcast you are sending out ? Where to ? Broadcasts will not pass the boundaries of the segment you are in anway. What problems are you encountering ? What product-type are you using? Without a detailed schematic (container interfaces/IP's etc) it is impossible to even comment ...

jvanhambelgium

what is "a bgp network" ?
Is 3.3.3.x/24 a pieces of your (public) PI-space ?
Is this "Internet" connected ?

Or is that 3.3.3.x prefix coming in via either ISP1 or ISP2

jvanhambelgium

My S+RJ10 in my RB5009 has always been running about 65°C - 70°C since day 1 Anything special you did regarding cooling or airflow ? Mine gets to 95C within 15 minutes. Same RB5009, same RJ-10 :? Nope, no attachments/heatsinks added. RB5009 is mounted in small 19" cabinet against the wall. Per...

jvanhambelgium

My S+RJ10 in my RB5009 has always been running about 65°C - 70°C since day 1

jvanhambelgium

If you want anyone to seriously take a look at it you'll probably need to provide the *full* config. This is very weird, if you cannot even ping from the CLI there is something fundamentally wrong... You could also try the "Quickset" and setup the box first with default settings ? At least...

jvanhambelgium

When on the CLI of the router, can you ping 1.1.1.1 for example ?
How does your routing-table look like ? (/ip/route/ print)

jvanhambelgium

Best thing is to provide a FULL config-export on your box , minus sensitive stuff like serial-numbers or some bits of the public-IP itself. I assume your Win11 PC can ping its default-gateway ? (= the RB5009) From the RB5009-console, can you ping something like 8.8.8.8 ? Or not even that ? I can be ...

jvanhambelgium

Again, it can be dozens of reasons. This could have been 1

It was worth trying.
You state traffic-counters are moving. Can you test if your issue is DNS-related or actual connectivity ?
Can you ping 8.8.8.8 from a connected PC ?
What DNS are you PC's on the LAN using ?

etc,etc ...

jvanhambelgium

Remove the to-address value ??

jvanhambelgium

# create bridge /interface bridge add protocol-mode=none ingress-filtering=yes name=bridge1 vlan-filtering=no Shouldn't that be vlan-filtering=yes ?? If you go now on your device in the CLI, type /interface/bridge and then "print" does that say "vlan-filtering=yes" on the config ?

jvanhambelgium

If they added Fortinet ABOVE the Mikrotik, they need to get stuff fixed on the Fortinet first. Without detailed picture it is difficult to guess, things might have changed. (eg. before Fortinet public IP was on RB2011, after "slide-in" of the Fortinet the public-IP moved to the Fortinet et...

jvanhambelgium

Ahh...you did not even have a DNS server configured then for you Wireguard connection ??!!
Yeah ... that explains a lot...

Anyway, glad it works now.
You can disabled some logging now

jvanhambelgium

The thing is, you need SOME rule that get hit with packets having source-IP = 192.168.87.3 (eg. you phone) and wanting to go out on the Internet (once it arrives from the wireguard decapsulation/decrypt) So perhaps DO enable some logging on FORWARD rules to, even the ALLOWED ones regarding Wireguard...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\ 192.168.88.0/24 in-interface=wireguard Well this rule is not going to help you get to the internet! You are allowing to pass ONLY for traffic towards 192.168.88.x If you punch www.facebook.com on your mobile device obviously...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\ 192.168.88.0/24 in-interface=wireguard But your WG-client has 192.168.87.x config ? hm, i thought i should interpret it as traffic coming from wireguard interface should be forwarded to destination addressed (192.168.88.0/2...

jvanhambelgium

add action=accept chain=forward comment="WG to LAN" dst-address=\
192.168.88.0/24 in-interface=wireguard

But your WG-client has 192.168.87.x config ?

jvanhambelgium

If customers purchase a so called "ip-pack" with us anyway, they get 5 adjacent/consecutive IP's.
depending on the config, that could 1 public fixed IP and the above 5-block routed to it for example.

jvanhambelgium

Something like this ?

viewtopic.php?t=167814

jvanhambelgium

Yeah...I've seen some strange stuff on C9300 too and had to play a lot with parameters to power some fancy doorphones (2N IP Style) Sure you are hitting no PoE bugs ? What release are you on ? I've seen 1 case where a Raspberry Pi with PoE would not boot on a C9300 with olde 16.12.x code. Worked fin...

jvanhambelgium

This router is not capable of 2.5Gbit/s. Not in real life condition With fasttrack and all optimizations tested it with iperf, PPPoE speed max 1.6Gbit/s because CPU Mhz/software limits speed. Cable-modems do not use PPPoE in general. Plain DHCP across the ethernet and that's it. So that is already ...

jvanhambelgium

What would it take to be able to use the same $listname across different downloads ? I prefer working with 1 big list, and in the comments-section I provide info about the origin of that list. $update url=("https://" . "iplists.firehol.org/files/firehol_level3.netset") listname=D...

jvanhambelgium

The only true testing is disconnect the ISP and put some testing-PC and perform iPerf *trough* the RB5009 or some other test-tool. I would not rule-out your ISP...."cable modem" is a shared medium and you never know exactly what happened. You also probably do not have performance guarantee...

jvanhambelgium

Well them simple perform 2 tasks 1) Create "address-list" and put the IP(s) in there that are allowed to "hit" the dstnat-rule https://youtu.be/WVxj9v4J3xM?si=uKyKTgVLo1UhNqKc (look around minute 2:15 for the access-list creation part) 2) Edit the NAT-rule and select the correct ...

jvanhambelgium

It depends on how you perform the NAT. If you also perform some snat on the packet then the SAT-receiver would only see a packing coming in from 192.168.88.1 (the IP of the bridge on Mikrotik) Without this extra snat the original source-IP is retained. This could make a difference in some scenario's...

jvanhambelgium

There is no protection on this Linux Sat-server that is does not accept incoming requests from IP's other then the LAN-range 192.168.88.x ?? You never know. I think the dstnat actually works, but I don't see why it should not work end2end. I have several of such dstnat and they just work, the only d...

jvanhambelgium

But what IS running on that port 82 ? Some web-interface ?
What happens if you connect from another 192.168.88.x device on your network to the IP on port 82 ?

jvanhambelgium

Then I'm afraid the only option is to start capturing packets to effectively investigate if the packet is getting there. Looking at the counters it seems the DNAT does work and some packet is passing through the box on its way to 192.168.88.68 on port 82 If you go in Winbox to Tools -> Telnet -> and...

jvanhambelgium

Can you disable the embedded webserver in the Mikrotik ?
Under "IP" -> "Services" and look for the "www"

jvanhambelgium

Chain must be FORWARD in the "duplication rule"
It is about traffic GOING THROUGH THE BOX

jvanhambelgium

These screenshots don't always tell the full picture or show all attributes clearly. A textual config is straight to the point...
I see some jumps to custom chains etc,etc.

jvanhambelgium

Make a copy of Rule3 and place it just below Rule3 (you can never do harm like that) Then edit the rule and in "General" on the bottom make sure the "Connection NAT State" menu has selected "dstnat" flag. Clear all other flags that are on the "Connection State"...

jvanhambelgium

The DNAT seems to hit, looking at the traffic-counters.
What are the Filter Rules in the FORWARD chain ? How do they look like ?

jvanhambelgium

Execute something like this on the CLI /export file=myconfig (minus router serial number and any public WANIP info, keys etc.. ) It will create a file and then you can get it off your router with Winbox for example and upload into the forum If you don't understand any of the above, I suggest you sta...

jvanhambelgium

Before anyone will jump in to support you, you'll be asked to provide your full config anyway. You might have broken things because of "I have done many things" Do you have a rule in the FORWARD chain to allow (valid) DNAT-traffic "trough" ? This should be part of the default fir...

jvanhambelgium

Do you have a public IP on "pppoe-out1" ? If you are behind NAT from your ISP this will never work.
So what "WAN" IP did you receive ? 100.64.0.0 to 100.127.255.255 ??

jvanhambelgium

Same here, never could ROSE NFS work on my Synology NAS, while I only use NFS at home with all my Linux boxes etc.
Got various errors, including "unknown error"

SMB works immediately....

jvanhambelgium

OK, didn't know. But 50% CPU usage on DNS is clearly a bug. But I can imagine support answer: "dear user, while you can increase DNS cache size to a very high number, it is still limited by your device's physical capabilities. ROS gives you the freedom to set 512MB cache size but this does not...

jvanhambelgium

I assume that MT developed this feature for home users. Maximum 40k URL lists. Kind of grabbing low hanging fruits. The main thing is to be able to import adlists -> "we already have DNS". Where is this documented ? I can't find any such statement ? On the help-page it says ; Before confi...

jvanhambelgium

I'm testing the DNS "Adlist" feature in 7.15.RC3 on my RB3011 I've increased the DNS-cache setting to 512MBytes !! value It seems things are going down the drain when I load a rather larget set. (> 2 million entries) When I remove 1 URL https://raw.githubusercontent.com/mkb2091/blockconver...

jvanhambelgium

"everything is connected by fiber" => So you have actual fiber-pairs coming in for each of your customers ??
Or you have some wholesale-service that you take from a larger ISP that does the last-mile to customers or something ?

jvanhambelgium

Jotne, Would it be possible to start looking into an extra addition on the the "DNS" section of your Splunk app ? Since 7.15RC3 there is the concept of "adlist" where you can put URL's to download filter-lists like a Pihole. Currently testing on my RB3011 and it seems to at least...

jvanhambelgium

Hmm, did you see that yourself that it tried the gstatic.com domain ?
I've checked my Pihole that logs everything (and I block everything like DNS-over-TLS,DoH,Quic) and I cannot find any such lookup ?
Phone is a Samsung Galaxy S21

jvanhambelgium

I'm looking into options to bypass my ISP devices and work directly on my RB5009. However for the TV-service of my ISP, they have published detailed specs what you need to be capable of. Apparently DHCPv4 Option spoofing: The following options provided on WAN side need to be provided to the TV decod...

jvanhambelgium

There are no benefits in disabling STP for sure and I was only looking at the uplink "line" not the different endpoints. Without some form of STP somebody could cause some havoc when connecting an endpoint the wrong way, having other switches introduced that you are not aware of and formin...

jvanhambelgium

Rapid Spanning Tree protocol (RSTP) -> The maximum allowed network diameter for the RSTP protocol is 40 switches.

But anyway, with only 1 fiber line I would disable any STP anyway since it is not relevant and of no value

jvanhambelgium

No real pitfalls to my knowledge.
Sure, such topology is a big single point of failure but apart from that it will work just fine, especially for such low flow of data.
There is no option to form some sort of "ring" ? Are these 21 buildings/switches really "in a line"

jvanhambelgium

I can't speak out of experience, but I see no reason why simple-queues for the sake or shaping would work differently on 35Gbps vs 1Gbps. What you need to try to find out is the impact on cpu & memory I guess. Shaping on IP-level like this using (simple) queues on 35Gbps is something you want to...

jvanhambelgium

You don't have an aggregation-layer where you terminate such (very high-speed) customers ? Straight onto your core switch doesn't sound like a very good plan to me. I don't know what CPU-power you have in your coreswitch-device, but perhaps you can iterate from 1Gbps shaping profiles to see howmuch ...

jvanhambelgium

Perhaps interesting for those collecting various sources to feed the scripts.

https://docs.paloaltonetworks.com/resou ... ng-service

Palo Alto also provides for free various curated lists like for M365,Azure,GCP,Zoom etc,etc

Imports work just fine with the current script.

jvanhambelgium

https://www.3cx.com/docs/manual/firewall-router-configuration/ Apparently for this SIP-provider there seems to be quite some stuff you need to open and they don't mention any of their public IP's / FQDN's of their SBC's.... I guess it depends on the SIP-provider. I have seen installations that only ...

jvanhambelgium

What overkill ? VLAN is just label.
Only 350 VLAN's out of 4K standard available.
It DOES keep things very separated (if you want) and identifiable across the whole setup.

Depending on how the wireless is organized (authentication-wise) their devices can be mapped easily in the VLAN of the room.

jvanhambelgium

What about 1 VLAN per room ? It is only 22 rooms/floor x 16 floors......
You can make a couple of nice interface-lists and group some stuff together at that level.

jvanhambelgium

Installation & Config is 1 aspect, actual operational performance another.
What type of installation-environment ? Industrial ? School ? Stadium/venue ?

jvanhambelgium

Thank you for your work, it works perfect. When I try to save the report to a shared drive (runs on SMB raspberrypi) using :local reportpath ("smb://user:password@192.168.3.19/home/pi/MyNASA/BWbyIP/report-" . $yearmonth . ".html") either with or without the user/password failure...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png the 5.6 script hits a system history print command which causes this error on my systems. You can reproduce this by entering the command "system history print" in a con...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png It seems in the section where all the access-list are processed/counted, so the section below. Didn't change anything to the code, just copy-pasted into Winbox. The ACL "Azur...

jvanhambelgium

Hopefully 1 ether port off-bridge or a serial port but that means local access. No so long ago locked myself out of my RB5009. I had "some sort of recent backup" and needed to factory-default it + restore that config. That part went OK Since then I have indeed 1 dedicated physical port &q...

jvanhambelgium

Where is this 192.168.121.0/24 range actually used then ? On 1 of these remote sites ?
Just get a working-PC on that range, teamviewer/RDP into it and from there Winbox/WebFig to your RouterOS boxes ?

jvanhambelgium

Did you create the container in CLI of via WebFIG/Winbox ? Do you have the "logging" flag enabled too ?

jvanhambelgium

The S-RJ01 *itself* is OK I guess. I have one in my RB5009 and my ISP/Internet is coming in through there. Runs a little hot (66°C) but never any issues. But I have the impression it might be very dependent on which platform you plugin the module + RouterOS release. Vendor Revision : 2.16 Manufacter...

jvanhambelgium

While not a complete solution (rather a collection of tools to build your solution around it), you may want to check pmacct http://www.pmacct.net/ I've been using it for well over a decade now, and once I integrated it into my stack, I've never had to touch it again. It just works. What plugins are...

jvanhambelgium

Yes, something like that might be an option, but that would still not bring all logging from my different ros devices into the one log of my main router. But thanks for the pointer, I will think a bit further on how to configure it to my liking. Offcourse it would ? All you ROS devices then simply ...

jvanhambelgium

You have a RouterOS box that supports containers ? Then you could deploy such a container and collect logs. Offcourse you need to store them somewhere, so at least some external USB would be a good idea...unless these are really few logs. This is not a fancy (web)GUI where you can browser through, i...

jvanhambelgium

Sure, as long as your ISP does muck around with CGNAT and you have a public IP that you can "map" 1:1 to the inside.

jvanhambelgium

Most of the above vendors are really, really in another league compared to Mikrotik. You must see Mikrotik RB as a ROUTER with network packet filter (and a lot of Swiss-army knife capabilities for sure!) I use Fortinet & Palo Alto in my professional work, very,very capable but I comes with a pri...

jvanhambelgium

Take eth5 out of a bridge. Configure IP > DHCP-client and add "eth5" as DHCP-client. Be carefull and say "no" to "add default route" I think. I use the same approach and have a lab RB3001 connected as DHCP "client" on a RB5009 through some ethX port. Then offc...

jvanhambelgium

What about any NAT/Masquerading config ? Can you export that ?

jvanhambelgium

Pre-routing chain ?
Try the "forward" chain and it will work I guess.

I've several marking-rules and they work fine as the traffic flows-through the Mikrotik (= forward chain)

jvanhambelgium

Strange, its not like you have some secret recipe for vodka
Perhaps the vodka market is drying out and they want to get into chocolate or beer

I could throw in a couple of Belgian Waffles

jvanhambelgium

Not entirely from the same source IP, but close ... IP 95.214.55.244 inetnum: 95.214.52.0 - 95.214.55.255 netname: PL-MEV-20181221 country: PL org: ORG-MSZO78-RIPE Some Polish operated IP-space. For the last 30 days, it is trying consistently these 4 destination ports on my frontdoor :D 8) Screensho...

jvanhambelgium

>I would like to add succesfully connected rdp connections to whitelist. And I have no clue how to detect if the connection is succesfully established or it is >just another brute force attempt. If it was a brute-force you would also see multiple times a new SYN arriving I think? You cannot keep try...

jvanhambelgium

Perhaps solve this issue with a port-knock sequence? So "client" first needs to hit a certain sequence of UDP/TCP ports before "the gate opens up" Offcourse then there is still the mandatory authentication, jus make sure you run an up-to-date RouterOS and do NOT use default "...

jvanhambelgium

Other than my company, customers can use a dish satellite company or a cell phone company data plan - both are very expensive if you move lots of data. On a sidenote ; you feel any business impact/disruption from eg. Starlink services ? Rather cheap I believe & moving a lot of data is not reall...

jvanhambelgium

Current version on the 7.13-stable is 1.10.3

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that migh...

jvanhambelgium

That is going to be difficult , looking at your WAN-IP 100.67.x.x this is CGNAT-space (Carrier Grade NAT) so basically you do not have a public IP for yourself and therefore the world cannot "find" you if they want to initiate a connection to your server . YOU can offcourse initiate to th...

jvanhambelgium

Nope, SNMP will not provide you with that. User @Jotne has create a very nice solution using SPLUNK (Enterprise) and a script on the Mikrotik side forwarding information through SYSLOG. You can install it for free as long as you remain under 500MBytes/day logs This provides very nice information &am...

jvanhambelgium

There is no such thing as ns1.mynetname.net or ns1.mynetname.net
The 2 authoritative NS listed for that domain are ns2.kissthenet.net. (159.148.172.251) and ns1.kissthenet.net. (159.148.147.201)
They both resolve on IPv4 and IPv6

jvanhambelgium

In case you did not yet find these.

viewtopic.php?t=61007

So your product is NMEA-output support compliant ? Perhaps some fiddling with the baudrate ?

Offcourse all of this is RouterOS 6.x (old wiki)

jvanhambelgium

Installed it to test it .... extremely slow on my RB5009
Slow like in transferring 150Kbytes/sec across the LAN !!
The RB5009 was not really high in CPU

jvanhambelgium

Upgraded without issues :

RB5009UG+S+
RB3011UiAS

jvanhambelgium

Why might this happen? I just recently started trying to set up a firewall and I don’t understand everything. For example, 172.29.45.251 is the address of your PI Hole? -> There are (Android) clients that I've seen that always contact 8.8.8.8 etc. And in case there is a client with hardcoded DNS se...

jvanhambelgium

And you should "intercept" anyway classic DNS packets in case some client does not want to use the Adguard. See my example below (I use Pihole) Make sure you excluded the Adguard/Pi-hole itself using the appropriate src-address-list. /ip firewall nat add action=dst-nat chain=dstnat comment...

jvanhambelgium

Remove the container and re-create and provide the logging=yes from the beginning. You should see a bit more output when it downloads the various layers. I agree the logging is pretty ... basic .... and will probably not reveil WHY you have this issue. You specify as root-dir=adguard => This will wr...

jvanhambelgium

Add the logging=yes directive on the container-creation command and look in the logs. Might explain more about the error.

jvanhambelgium

AND the Wireguard AND the PPPoE overhead probably explains why your "only" get 300-350Mbits/sec CPU-profiler will give you insight. If you have a "spare" RB5009 you could perform a back2back test with a piece of ethernet-wire in between to see what the max is you can reach. You'l...

jvanhambelgium

Since this is a general setting, I would assume the total of all containers.

jvanhambelgium

As for using ACI instead of a single CRS326-46G-2S+ : It´s like suggesting a homeless person to move in to the royal castle. It would certainly solve his problems... :? Yep, it sure is. Totally different worlds. Good to know Mikrotik does support something like a PVLAN on certain models/chipsets so...

jvanhambelgium

What you are looking for is called "PVLAN" constructuon in general (Private VLAN) and you would be using some form of "Isolated Ports" in a "Isolated VLAN" construction. So 2 devices in such PVLAN cannot directly talk to each other but must pass through a device connect...

jvanhambelgium

Going into IP--> Services --> www and disabling port 80 unfortunately disables all web traffic to the router, including internal. So it stops router management. No need to disable it completely, but add the "Available From" values ? Eg. 192.168.x.y or multiple ranges that you want it to be...

jvanhambelgium

Howmany users ? 10 ? 500 ? 20000 ?

jvanhambelgium

It depends on how the devices are wired on your local LAN. These Tuyas are *wireless* right, so their traffic is hitting your router through the port on which some AP is connected ? And your DNS is the Mikrotik itself at 192.168.99.1 looking at your config. If so, change the "chain" to INP...

jvanhambelgium

The DNS-blocking is going to be a bit harder if everything remains in the same "LAN". If you would be using an IoT-VLAN that would be easy to also restric "internal" traffic flowing between VLAN's anyway. Alternative could be you provide SPECIFIC DNS-servers through DHCP-options ...

jvanhambelgium

Do you have a a "Tuya" bridge or somethings ? (like a HUE-box)
Can't you "pair" the Tuya devices nativly with Zigbee to Home Assistant ? Offcourse you need a Zigbee "radio" for that in your HA.

jvanhambelgium

You don't need a separate vlan for that.
Just make sure your IoT devices get fixed IP's based on their MAC
Then block these IP on their way out.

jvanhambelgium

Could you guys as container specialists enlighten me why a container would not start if you installed it onto a SMB-share (on a RouterOS through ROSE-package) Such package is downloaded correct, container is created OK, "iperf" binary can be found on the NAS providing the SMB-share under t...

jvanhambelgium

apart from that ... why on earth are you rebooting daily anyway....

jvanhambelgium

Something like this ? I think the RB1100 AHx4 (ARM32) supports Wireguard. https://www.wiresock.net/ Note : The Cisco ASA Anyconnect Client is so much more then only "a vpn client" offering basic vpn-client,advanced vpn-client, endpoint-compliance,inspection service,enterprise acccess, thre...

jvanhambelgium

and QoS ... what contract/agreeement/service do you promise/sell ? You don't want 1 appartement to blast away all the bandwidth all the time. Some policing & shaping for sure needs to be done.

jvanhambelgium

Ahhhh..good spotting @anav about the UDP/53 missing in the DNAT-rules. That might explain a lot.

jvanhambelgium

Hi, place these before the masq entries, so re-order them. add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ LAN protocol=tcp src-address-list=!excluded to-addresses=192.168.0.8 \ to-ports=53 add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ ...

jvanhambelgium

east-west security simply means "horizontally". Can be within a datacenter, but also between different vlan's eg on a smaller scale. It is a generic wording. depending on the environment, often the security hazards are not coming "from the outside world" alone anymore but often i...

jvanhambelgium

Your IPv4 standard for sure should include "east-west" security these days.
By default each of the 3 LAN's can just chit-chat with each other and that is not really a good plan...

Next-generation networks (SDx) would be intent-driven with micro-isolation already at the switchport/host.

jvanhambelgium

Sure this is possible. Nothing out of the ordinary, but somewhat strange. I f the WAN router is some decent gear , it can do NAT for whatever is coming in from the LAN, be it through different physical interfaces, VLAN's, ranges whatever. The typical "consumer" Internet-router provided by ...

jvanhambelgium

Put the Starlink in a separate VRF and work from there?
You could issue some health-check to eg. 8.8.8.8 across the Starlink-vrf and make some decisions from there?

jvanhambelgium

Did you poweroff/poweron the ISP modem ? Might also be something "MAC" related in the sense that the cable-modem expects the MAC of the hEX S. Apart from that, yes you need to configure "DHCP Client" on the RB5009 in order to obtain an ISP-address. Specify the correct "WAN&q...

jvanhambelgium

Why bother with the Mikrotik ? Fortinet can do the PPPoE to your ISP just fine and is a much more advanced solution then any Mikrotik when it comes to security.

jvanhambelgium

Hello guys, i strugglin with one thing... My NAS using IP 192.168.88.200 i want to use xyz.xyz.com.pl in url but its not working, can you help me? Search the forum for "hairpin NAT" because that is what you are looking for. And post your config as requested below if you already attempted ...

jvanhambelgium

The resolving of FQDN will follow the TTL-value of the zone applicable. No need to "force" to resolve this periodically. Go to /ip/dns/cache and "print" .The FQDN's should be there and you will see the TTL value countdown timer.... This works fine as I have some units for which I...

jvanhambelgium

Hmm, if your IP falls in the range 172.16.0.0 to 172.31.255.255 you DO NOT have a true public IP !

jvanhambelgium

>> We only have /31 range from our ISP to use. Nope, don't think so :lol: :lol: This ISP-link always has a cable that always needs to be inserted into something...and that will be your SPOF. With a /31 that does not leave much flexibility to have a robust/dynamic setup... You still can have 2 x CCR ...

jvanhambelgium

Beginning with 172.x.x.x MIGHT be OK ;-) Is the IP address on the range below ? If so, then you do not have a public IP. 172.16.0.0 to 172.31.255.255 Under "Settings" , then "Network" I also filled in the field where you put a URL that points back to you. In my case for example t...

jvanhambelgium

Are you sure it's a public IP ? And not something like 100.64.x.x ? Your screenshot with the blurred out IP says "0" as port-number and that is not correct. I have there nicely 32400 Try the "manually specify public port" setting and put 32400 in there + Apply. See what that does...

jvanhambelgium

Well...try to refer to Interface address lists like the other (apparently working ones) ?? Why do you select "ether1" and not "WAN" ? You tried and it doesn't work ? You reference "ether1" for these Minecraft rules but that might be wrong. If you are using PPPoE for ex...

jvanhambelgium

Interesting use-case, but I think everybody has moved to from stand-alone approaches (on the CPE itself) to centralized, API-driven solutions? So all devices would report their usage to keep track of accounting centrally and through API/remote-control the cap would be enforced on the device. Perhaps...

jvanhambelgium

I am interested in the way you run splunk inside ubuntu, how did you get that working ? runnning syno virtual machine manager ? and than a plain ubuntu image ? and than a normal ubutu splunk install ? I am running latest DSM on a 920+ with enough resources Indeed, just like that. I'm running on 918...

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that might...

jvanhambelgium

Ok, but you write it as if you want some mechanism of "load balancing". That is not gonna work. You can have 1 destination-NAT (so at *network* level) pointing to some backend (internal) IP and have this changed based if the backend is "up" For this to work you could have several...

Search found 1150 matches