MikroTik

jvanhambelgium

What about 1 VLAN per room ? It is only 22 rooms/floor x 16 floors......
You can make a couple of nice interface-lists and group some stuff together at that level.

jvanhambelgium

Installation & Config is 1 aspect, actual operational performance another.
What type of installation-environment ? Industrial ? School ? Stadium/venue ?

jvanhambelgium

Thank you for your work, it works perfect. When I try to save the report to a shared drive (runs on SMB raspberrypi) using :local reportpath ("smb://user:password@192.168.3.19/home/pi/MyNASA/BWbyIP/report-" . $yearmonth . ".html") either with or without the user/password failure...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png the 5.6 script hits a system history print command which causes this error on my systems. You can reproduce this by entering the command "system history print" in a con...

jvanhambelgium

Hi, It seems a part of the script (v5.6) is giving me consistent error on 7.14.1 Screenshot from 2024-03-30 15-33-01.png It seems in the section where all the access-list are processed/counted, so the section below. Didn't change anything to the code, just copy-pasted into Winbox. The ACL "Azur...

jvanhambelgium

Hopefully 1 ether port off-bridge or a serial port but that means local access. No so long ago locked myself out of my RB5009. I had "some sort of recent backup" and needed to factory-default it + restore that config. That part went OK Since then I have indeed 1 dedicated physical port &q...

jvanhambelgium

Where is this 192.168.121.0/24 range actually used then ? On 1 of these remote sites ?
Just get a working-PC on that range, teamviewer/RDP into it and from there Winbox/WebFig to your RouterOS boxes ?

jvanhambelgium

Did you create the container in CLI of via WebFIG/Winbox ? Do you have the "logging" flag enabled too ?

jvanhambelgium

The S-RJ01 *itself* is OK I guess. I have one in my RB5009 and my ISP/Internet is coming in through there. Runs a little hot (66°C) but never any issues. But I have the impression it might be very dependent on which platform you plugin the module + RouterOS release. Vendor Revision : 2.16 Manufacter...

jvanhambelgium

While not a complete solution (rather a collection of tools to build your solution around it), you may want to check pmacct http://www.pmacct.net/ I've been using it for well over a decade now, and once I integrated it into my stack, I've never had to touch it again. It just works. What plugins are...

jvanhambelgium

Yes, something like that might be an option, but that would still not bring all logging from my different ros devices into the one log of my main router. But thanks for the pointer, I will think a bit further on how to configure it to my liking. Offcourse it would ? All you ROS devices then simply ...

jvanhambelgium

You have a RouterOS box that supports containers ? Then you could deploy such a container and collect logs. Offcourse you need to store them somewhere, so at least some external USB would be a good idea...unless these are really few logs. This is not a fancy (web)GUI where you can browser through, i...

jvanhambelgium

Sure, as long as your ISP does muck around with CGNAT and you have a public IP that you can "map" 1:1 to the inside.

jvanhambelgium

Most of the above vendors are really, really in another league compared to Mikrotik. You must see Mikrotik RB as a ROUTER with network packet filter (and a lot of Swiss-army knife capabilities for sure!) I use Fortinet & Palo Alto in my professional work, very,very capable but I comes with a pri...

jvanhambelgium

Take eth5 out of a bridge. Configure IP > DHCP-client and add "eth5" as DHCP-client. Be carefull and say "no" to "add default route" I think. I use the same approach and have a lab RB3001 connected as DHCP "client" on a RB5009 through some ethX port. Then offc...

jvanhambelgium

What about any NAT/Masquerading config ? Can you export that ?

jvanhambelgium

Pre-routing chain ?
Try the "forward" chain and it will work I guess.

I've several marking-rules and they work fine as the traffic flows-through the Mikrotik (= forward chain)

jvanhambelgium

Strange, its not like you have some secret recipe for vodka
Perhaps the vodka market is drying out and they want to get into chocolate or beer

I could throw in a couple of Belgian Waffles

jvanhambelgium

Not entirely from the same source IP, but close ... IP 95.214.55.244 inetnum: 95.214.52.0 - 95.214.55.255 netname: PL-MEV-20181221 country: PL org: ORG-MSZO78-RIPE Some Polish operated IP-space. For the last 30 days, it is trying consistently these 4 destination ports on my frontdoor :D 8) Screensho...

jvanhambelgium

>I would like to add succesfully connected rdp connections to whitelist. And I have no clue how to detect if the connection is succesfully established or it is >just another brute force attempt. If it was a brute-force you would also see multiple times a new SYN arriving I think? You cannot keep try...

jvanhambelgium

Perhaps solve this issue with a port-knock sequence? So "client" first needs to hit a certain sequence of UDP/TCP ports before "the gate opens up" Offcourse then there is still the mandatory authentication, jus make sure you run an up-to-date RouterOS and do NOT use default "...

jvanhambelgium

Other than my company, customers can use a dish satellite company or a cell phone company data plan - both are very expensive if you move lots of data. On a sidenote ; you feel any business impact/disruption from eg. Starlink services ? Rather cheap I believe & moving a lot of data is not reall...

jvanhambelgium

Current version on the 7.13-stable is 1.10.3

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that migh...

jvanhambelgium

That is going to be difficult , looking at your WAN-IP 100.67.x.x this is CGNAT-space (Carrier Grade NAT) so basically you do not have a public IP for yourself and therefore the world cannot "find" you if they want to initiate a connection to your server . YOU can offcourse initiate to th...

jvanhambelgium

Nope, SNMP will not provide you with that. User @Jotne has create a very nice solution using SPLUNK (Enterprise) and a script on the Mikrotik side forwarding information through SYSLOG. You can install it for free as long as you remain under 500MBytes/day logs This provides very nice information &am...

jvanhambelgium

There is no such thing as ns1.mynetname.net or ns1.mynetname.net
The 2 authoritative NS listed for that domain are ns2.kissthenet.net. (159.148.172.251) and ns1.kissthenet.net. (159.148.147.201)
They both resolve on IPv4 and IPv6

jvanhambelgium

In case you did not yet find these.

viewtopic.php?t=61007

So your product is NMEA-output support compliant ? Perhaps some fiddling with the baudrate ?

Offcourse all of this is RouterOS 6.x (old wiki)

jvanhambelgium

Installed it to test it .... extremely slow on my RB5009
Slow like in transferring 150Kbytes/sec across the LAN !!
The RB5009 was not really high in CPU

jvanhambelgium

Upgraded without issues :

RB5009UG+S+
RB3011UiAS

jvanhambelgium

Why might this happen? I just recently started trying to set up a firewall and I don’t understand everything. For example, 172.29.45.251 is the address of your PI Hole? -> There are (Android) clients that I've seen that always contact 8.8.8.8 etc. And in case there is a client with hardcoded DNS se...

jvanhambelgium

And you should "intercept" anyway classic DNS packets in case some client does not want to use the Adguard. See my example below (I use Pihole) Make sure you excluded the Adguard/Pi-hole itself using the appropriate src-address-list. /ip firewall nat add action=dst-nat chain=dstnat comment...

jvanhambelgium

Remove the container and re-create and provide the logging=yes from the beginning. You should see a bit more output when it downloads the various layers. I agree the logging is pretty ... basic .... and will probably not reveil WHY you have this issue. You specify as root-dir=adguard => This will wr...

jvanhambelgium

Add the logging=yes directive on the container-creation command and look in the logs. Might explain more about the error.

jvanhambelgium

AND the Wireguard AND the PPPoE overhead probably explains why your "only" get 300-350Mbits/sec CPU-profiler will give you insight. If you have a "spare" RB5009 you could perform a back2back test with a piece of ethernet-wire in between to see what the max is you can reach. You'l...

jvanhambelgium

Since this is a general setting, I would assume the total of all containers.

jvanhambelgium

As for using ACI instead of a single CRS326-46G-2S+ : It´s like suggesting a homeless person to move in to the royal castle. It would certainly solve his problems... :? Yep, it sure is. Totally different worlds. Good to know Mikrotik does support something like a PVLAN on certain models/chipsets so...

jvanhambelgium

What you are looking for is called "PVLAN" constructuon in general (Private VLAN) and you would be using some form of "Isolated Ports" in a "Isolated VLAN" construction. So 2 devices in such PVLAN cannot directly talk to each other but must pass through a device connect...

jvanhambelgium

Going into IP--> Services --> www and disabling port 80 unfortunately disables all web traffic to the router, including internal. So it stops router management. No need to disable it completely, but add the "Available From" values ? Eg. 192.168.x.y or multiple ranges that you want it to be...

jvanhambelgium

Howmany users ? 10 ? 500 ? 20000 ?

jvanhambelgium

It depends on how the devices are wired on your local LAN. These Tuyas are *wireless* right, so their traffic is hitting your router through the port on which some AP is connected ? And your DNS is the Mikrotik itself at 192.168.99.1 looking at your config. If so, change the "chain" to INP...

jvanhambelgium

The DNS-blocking is going to be a bit harder if everything remains in the same "LAN". If you would be using an IoT-VLAN that would be easy to also restric "internal" traffic flowing between VLAN's anyway. Alternative could be you provide SPECIFIC DNS-servers through DHCP-options ...

jvanhambelgium

Do you have a a "Tuya" bridge or somethings ? (like a HUE-box)
Can't you "pair" the Tuya devices nativly with Zigbee to Home Assistant ? Offcourse you need a Zigbee "radio" for that in your HA.

jvanhambelgium

You don't need a separate vlan for that.
Just make sure your IoT devices get fixed IP's based on their MAC
Then block these IP on their way out.

jvanhambelgium

Could you guys as container specialists enlighten me why a container would not start if you installed it onto a SMB-share (on a RouterOS through ROSE-package) Such package is downloaded correct, container is created OK, "iperf" binary can be found on the NAS providing the SMB-share under t...

jvanhambelgium

apart from that ... why on earth are you rebooting daily anyway....

jvanhambelgium

Something like this ? I think the RB1100 AHx4 (ARM32) supports Wireguard. https://www.wiresock.net/ Note : The Cisco ASA Anyconnect Client is so much more then only "a vpn client" offering basic vpn-client,advanced vpn-client, endpoint-compliance,inspection service,enterprise acccess, thre...

jvanhambelgium

and QoS ... what contract/agreeement/service do you promise/sell ? You don't want 1 appartement to blast away all the bandwidth all the time. Some policing & shaping for sure needs to be done.

jvanhambelgium

Ahhhh..good spotting @anav about the UDP/53 missing in the DNAT-rules. That might explain a lot.

jvanhambelgium

Hi, place these before the masq entries, so re-order them. add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ LAN protocol=tcp src-address-list=!excluded to-addresses=192.168.0.8 \ to-ports=53 add action=dst-nat chain=dstnat comment=PiHole dst-port=53 in-interface-list=\ ...

jvanhambelgium

east-west security simply means "horizontally". Can be within a datacenter, but also between different vlan's eg on a smaller scale. It is a generic wording. depending on the environment, often the security hazards are not coming "from the outside world" alone anymore but often i...

jvanhambelgium

Your IPv4 standard for sure should include "east-west" security these days.
By default each of the 3 LAN's can just chit-chat with each other and that is not really a good plan...

Next-generation networks (SDx) would be intent-driven with micro-isolation already at the switchport/host.

jvanhambelgium

Sure this is possible. Nothing out of the ordinary, but somewhat strange. I f the WAN router is some decent gear , it can do NAT for whatever is coming in from the LAN, be it through different physical interfaces, VLAN's, ranges whatever. The typical "consumer" Internet-router provided by ...

jvanhambelgium

Put the Starlink in a separate VRF and work from there?
You could issue some health-check to eg. 8.8.8.8 across the Starlink-vrf and make some decisions from there?

jvanhambelgium

Did you poweroff/poweron the ISP modem ? Might also be something "MAC" related in the sense that the cable-modem expects the MAC of the hEX S. Apart from that, yes you need to configure "DHCP Client" on the RB5009 in order to obtain an ISP-address. Specify the correct "WAN&q...

jvanhambelgium

Why bother with the Mikrotik ? Fortinet can do the PPPoE to your ISP just fine and is a much more advanced solution then any Mikrotik when it comes to security.

jvanhambelgium

Hello guys, i strugglin with one thing... My NAS using IP 192.168.88.200 i want to use xyz.xyz.com.pl in url but its not working, can you help me? Search the forum for "hairpin NAT" because that is what you are looking for. And post your config as requested below if you already attempted ...

jvanhambelgium

The resolving of FQDN will follow the TTL-value of the zone applicable. No need to "force" to resolve this periodically. Go to /ip/dns/cache and "print" .The FQDN's should be there and you will see the TTL value countdown timer.... This works fine as I have some units for which I...

jvanhambelgium

Hmm, if your IP falls in the range 172.16.0.0 to 172.31.255.255 you DO NOT have a true public IP !

jvanhambelgium

>> We only have /31 range from our ISP to use. Nope, don't think so :lol: :lol: This ISP-link always has a cable that always needs to be inserted into something...and that will be your SPOF. With a /31 that does not leave much flexibility to have a robust/dynamic setup... You still can have 2 x CCR ...

jvanhambelgium

Beginning with 172.x.x.x MIGHT be OK ;-) Is the IP address on the range below ? If so, then you do not have a public IP. 172.16.0.0 to 172.31.255.255 Under "Settings" , then "Network" I also filled in the field where you put a URL that points back to you. In my case for example t...

jvanhambelgium

Are you sure it's a public IP ? And not something like 100.64.x.x ? Your screenshot with the blurred out IP says "0" as port-number and that is not correct. I have there nicely 32400 Try the "manually specify public port" setting and put 32400 in there + Apply. See what that does...

jvanhambelgium

Well...try to refer to Interface address lists like the other (apparently working ones) ?? Why do you select "ether1" and not "WAN" ? You tried and it doesn't work ? You reference "ether1" for these Minecraft rules but that might be wrong. If you are using PPPoE for ex...

jvanhambelgium

Interesting use-case, but I think everybody has moved to from stand-alone approaches (on the CPE itself) to centralized, API-driven solutions? So all devices would report their usage to keep track of accounting centrally and through API/remote-control the cap would be enforced on the device. Perhaps...

jvanhambelgium

I am interested in the way you run splunk inside ubuntu, how did you get that working ? runnning syno virtual machine manager ? and than a plain ubuntu image ? and than a normal ubutu splunk install ? I am running latest DSM on a 920+ with enough resources Indeed, just like that. I'm running on 918...

jvanhambelgium

I'm running Splunk on a Synology too, but as a VM under Ubuntu Linux, not containerized. Works OK in general, had 1 or 2 occasions where the 4GB assigned memory fell short and things fell apart ;-) >> After a while the logging to splunk stops ... Splunk generates a ton of logging messages that might...

jvanhambelgium

Ok, but you write it as if you want some mechanism of "load balancing". That is not gonna work. You can have 1 destination-NAT (so at *network* level) pointing to some backend (internal) IP and have this changed based if the backend is "up" For this to work you could have several...

jvanhambelgium

There are 2 parts to this question ; frontend & backend In the backend, you could with "Netwatch" tool have a "test" (eg. ping or http-get to backend servers and do things if they reply or not) So these would be your health-checks to the backend servers and you could enable/d...

jvanhambelgium

Are you sure your USB-storage is still "usb1-part1" ? Don't know the release you are running, but I had the same with RB5009 on some where where each reboot the USB-drive/partition was named differently! This whole container thing on eg. RB5009 still is a bit "hit & miss" fo...

jvanhambelgium

That is why I have such separate rules masq-rules for anything that needs to go out on Internet coming from eg. Wireguard or ZeroTier "zone"
So at least this gives me logging & counters in case certain things do not work and it might be easier to "pick up" along the way.

jvanhambelgium

I would start by looking at the map of the RV-park and where the RV's are going to be stationed/clustered and work from there. Remember Wifi is 2-way, so the client also needs to communicate back. Some endpoint have better antenna's than others etc. But outdoor there is a lot of things to consider t...

jvanhambelgium

Best is to make packet-capture and spot for issues....this smells indeed MTU or alike. If you get authentication-box already etc then I doubt "settings" of Wireguard are at play here. Firewall-rules also seems OK at this point then, but that can be checked in the logs (if you enable loggin...

jvanhambelgium

logging - logging - logging

Enable logging on any rule that has a "drop" in there, and filter for you endpoint 10.180.5.2/32
There has to be some trace of a rule that seems to stop your packets from going out.

jvanhambelgium

The "pull" works fine. I see the folder being created (the first time after I alter the path) and I see a growing *.gz file while it is being downloaded...then suddenly everything stop and it removed from the NAS and it throws an "error". Usually 1 or 2 "layers" are pro...

jvanhambelgium

Is there anyone that can explain me why the extraction of a container-image fails across a ROSE storage point ? Running the latest 7.11 on RB5009 So I've mapped an SMB on my NAS which is accessible fine (because I see files being created on it) Screenshot from 2023-08-20 20-17-12.png I've also adapt...

jvanhambelgium

It is a bug for sure. Same with "Winbox"
On CLI, when doing a "print" of the vETH you get so see the IP address
On Winbox, it is 0.0.0.0 for every vETH
It was on 7.10 and now on 7.11 also.

jvanhambelgium

I believe that the LCD screen is not supported on RouterOS 7. So, forget that the screen. LCD works just fine on my RB3011 on 7.11 But it is a gimmick for sure. Sometimes handy to see if some interface does traffic or so but in the end still a gimmick I have the RB3011 on a +- 100Mbps xDSL and it h...

jvanhambelgium

Updated LAB RB3011 to 7.11 and all seems fine (for my limited use-cases ; basic PPPoE Internet, IPSEC-tunnel to RB5009 etc)

jvanhambelgium

If you care about power-consumption a device like RB5009 uses much less power then "the average spare computer" When running 24x7 this might make some difference in yearly running cost. I think my RB5009 is about 9.5Watt if I look at my home-automation graphs. (because I use a SFP-module i...

jvanhambelgium

Rx counter remains at "0" on the "client" side ?
It should at least try from the hotel to reach the endpoint right ?

jvanhambelgium

If you can ping it already that means that VLAN's are OK. Printers these days are quite flexibel, offer dozens of (printing) protocols to choose from. They can be configured with ACL to only allow printing from certain IP-ranges etc,etc. What does you logging say ? If you define a printer on a PC on...

jvanhambelgium

Where do you want to forward port ? From Internet ? Internally between 192.168I.1.x and 192.168.2.x you do not need to forward ports, (under the NAT-tab in Firewall) you simply need to make firewall-rule to ALLOW it through. (and offcourse *above* the rules where you block all further communication...

jvanhambelgium

Hmm, a lot of various rules, not perse "bad" but it doesn't make thing easy to follow. Some forum-member will tell you this is a very messy config ;-) Anyway your question was about flows between 192.168.2.x (home-network) and 192.168.1.x (homelab-server) that should be blocked right ? (in...

jvanhambelgium

Perhaps begin with posting you config here so things are more clear

/export file=anynameyouwish (minus router serial number and any public WANIP information)

jvanhambelgium

hmm...firewall rules ?

jvanhambelgium

I have similar issues on a RB5009. The USB-storage for sure is not super "stable" and after a few weeks often a container is completely trashed because the underlying USB-storage is gone. I need to unplug-replug etc. In the past I had to reformat completely. I tried USB3.0 stick directly i...

jvanhambelgium

I'm still puzzled why "Adguard" is not showing any statistics *but* it seems to be working. My test-PC has hardcoded 1 single DNS pointing to the Adguard, dns-resolving works (I see exchange in a tcp-dump) but nothing in the logs or statistics-dashboard. Strange .. don't think its a permi...

jvanhambelgium

Hi, Yep, seems to be a Winbox bug. On a RB3011 lab box, running the latest beta 7.11 BETA6 this "issue" is present. Winbox entries all give 0.0.0.0/0 but on console all is OK. Feel free to log a ticket on this with MT. /interface/veth> print Flags: X - disabled; R - running 0 R name="...

jvanhambelgium

Strange, Works fine here. The difference is during boot it clearly prints the veth-IP:3000 reference to login, and in your case it does not... Screenshot from 2023-07-27 18-21-54.png And I confirm the GUI works fine on my test-segment 192.168.3.4:3000 ...and after first install the GUI is available ...

jvanhambelgium

You use the interface-list "WAN". Are you sure the ingress interface is member of that ?
When you try and it does not work, what counter increases ? The "drop all not coming from LAN"

jvanhambelgium

This requirement ; - have guests being able to join the network on the Guest SSID and on the TP-Link without accessing the Normal network. - On the TP-link I just want to connect the Guest without thinking about what port. This cannot be done without 802.1x implementation on the switch-side. Your TP...

jvanhambelgium

The only option you have is start a packet-capture on a RouterOS device and "stream" this towards any IP endpoint further down the network. On the remote end you either have some Wireshark running or probably some tool will exist to then write a pcap-file locally. (eg. rpcapd.exe) Screensh...

jvanhambelgium

What if, for example, "Untrusted" VLAN is 10.1.1.0/24,"Semi-Trusted" VLAN is 10.1.2.0/24, "Fully-Trusted" VLAN is 10.1.3.0/24, and the file server is 10.1.4.1/24. Untrusted and Semi-Trusted can access the File Server, but Untrusted, can't. How would I do that without n...

jvanhambelgium

Lil off topic - but still related to file-servers ... Take a look at TrueNAS I run a dozens of TrueNAS file servers. When configured correctly , they can be pretty fast. For example , I have a TrueNAS file-server with 1-TB RAM and about 256-TB of solid-stade SSD drives with 100-GIg network interfac...

jvanhambelgium

...and with a fileserver you also need to look at aspects like NFS ACL's or SMB User-accounts etc. Being able to "reach" your fileserver does not mean you can access it / use it. Depending on the file-server model/OS , you can also apply a IP-ACL to exclude the "Untrusted" IP-ran...

jvanhambelgium

>WBut, the firewall is basic, and I want to give my servers additional protection ( I get various probing attempts / hacks / brute force log in attempts every >day). So the way I envisage it, I just need some sort of packet filter between my servers and the existing LAN. It would do things like: dro...

jvanhambelgium

Please explain what *service* is behind the Windows machines ? What are you trying to accomplish ? Perhaps NLB between the 2 Windows servers might be a good approach. The MikroTik then can have a DNAT pointing to the NLB-VIP and NLB will sort it out. https://learn.microsoft.com/en-us/windows-server/...

jvanhambelgium

I think there is an issue with ZeroTier on the 7.9-stable release. After 1-2 days the ZeroTier looses its LEAF & PLANET connections for some reason. Stopping & Starting resolved it and then you are good to go another 1-2 days. This on RB5009 system. Don't think a SUPOUT will do any good here...

jvanhambelgium

Try with NFS v3, that works for me...

Hmm, I can't really force that on the NAS. I can enable/disable NFSv4.1 , but other than that its "enable or disable" NFS as a whole.
Is there some command-flag on the ROSE package to force NFSv3 ? (doesn't like like it....)

jvanhambelgium

Anyone using a Synology NAS and was able to mount a NFS-export onto a Mikrotik ? (I'm using RB3011-ARM here to test) It just won't work, getting "Protocol Not Supported" error ? (while I use the Synology with a bunch of mounts to other systems here, media-players etc. In-house I only do NF...

jvanhambelgium

Personally allowing access to a device on Internet through a "whitelisted" source-IP(s) is acceptable to me and we do that for customers across our projects. VPN is not always an option or sometimes overkill. Just make sure you have additional layers like (encrypted) authentication using c...

jvanhambelgium

It could be 10 things, without any config impossible to say. (could be nat, routing, ...) Did you "torch" on FW2 to see if the DNAT'ted packet arrives at that point ??? The "device" is exposed to Internet with a DNAT ? Or does this "public computer" also has Wireguard C...

jvanhambelgium

So this is obsolete and not correct? In the link below "https" is not mentioned.

https://wiki.mikrotik.com/wiki/Manual:IP/Proxy

Not sure if it would insert X-Forwarded-For in the headers neither.

jvanhambelgium

btw,
don't think any HTTPS will work.
the "proxy" module on Mikrotik supports HTTP only, and in 2023 only very few websites use HTTP.

jvanhambelgium

eh...just duplicate the rule just below and change accordingly ? Just for my own edification, if I did that it would still block my WG traffic would it not? That rule only allows traffic from one subnet and it wouldn't match that so it wouldn't matter if the next rule did. Am I misunderstanding? Ye...

jvanhambelgium

I found the issue. Rule 9 in the Raw table: add action=drop chain=prerouting comment="defconf: drop local if not from default IP range" in-interface-list=LAN src-address=!192.168.100.0/24 My WG connections(s) are 10.10.100.0/24 so not in the allowed IP range. Question: It seems I cant add...

jvanhambelgium

since I've inserted a USB 2.0 "hub" into the RB5009 and then my SDCARD in it the disk-id remains consistent across reboots. The problem was that sometimes the card is seen as USB 3.0 and sometimes USB 2.0 which results in differend "disk" ID's. At the moment I have 4 containers r...

jvanhambelgium

I've had the same on 7.8 on my RB5009
Not often, but sometimes it was in a state "REQUEST CONFIG" or something. Stopping en starting ZeroTier services made it work again.
Now I've update to 7.9(rc2), which bumps the ZeroTier version also to a much newer release 1.10.3

jvanhambelgium

I couldn't get the Traefik container to work too. Therefore I decided to use nginx-proxy . How did you install it ? I tried to launch it via line below but it gives an error. add remote-image=jc21/nginx-proxy-manager:latest interface=veth4 root-dir=/usb3-part1/npm mounts=npm_data,npm_encrypt start-...

jvanhambelgium

I couldn't get the Traefik container to work too. Therefore I decided to use nginx-proxy.

Yes but this requires a DB in the backend. I have NPM also running on a Synology NAS combined with MariaDB where the config is stored for NPM ?

jvanhambelgium

Anyone here has practical working container like "Traefik" operational ? (can serve as reverse-proxy) I've imported it and I can start it, but dash-board for example does not work. Also what about its config file "traefik.yml" ? I've shelled into the container but cannot find any...

jvanhambelgium

Your wireless scenario is not possible unless you have an advanced ISP-router that you fully control.
Some "static routes" are not enough, this sound more like some policy-routing based on certain criteria.

The "wired" scenario is basic and will work.

jvanhambelgium

Depends... What is the PPPoE link ? 100Mbit ? 1000MBits ?? If only a 100Mbits Internet link I would risk ik. Don't expect 500Mbps Internet performance or something... Your product is a SWITCH with a pretty weak CPU, so if you start using as a breakout-router to Internet don't expect a lot of perform...

jvanhambelgium

TP-Link "management" (webgui) are always untagged packets, its not like a enterprise-grade switch where you can "dictate" which VLAN the Management should be. So, untagged frames will end up on the port "ether4" on the HEX Why would you think you'll get an IP from 192.1...

jvanhambelgium

Anyone else having this thingy with USB storage that keeps changing with each reboot from usb1-part1 to usb2-part1 etc ? Basically breaking containers etc between reboots. Was it possible to refer to a "label" in the container-settings ? yes, add "slot=DATA" parameter to your di...

jvanhambelgium

i5 - 7400 , 16g ram? if you already have it available go with it, it will perform better than a rb4011/rb5009 Thank you Chechito. Is the i5-7400 better than CCR2004? Better? you only have 150 clients and 1Gbits at most. i5 is even overkill. RB4011 or RB5009 will serve your Internet Cafe without eve...

jvanhambelgium

Is there another way to log visited sites? You could always go down the DNS path (analyse resolved entries), but that will not give you granularity *what* has been exactly visited. And off course not all DNS-lookups lead to visited "websites" so no real 100% match for your requirements. I...

jvanhambelgium

Mikrotik should remove this "web proxy" module all together from RouterOS. It is only for HTTP and does not support HTTPS Most Internet traffic these days is HTTPS. To put in some numbers (from Netflow). The last 24h my router processed about 89.000 flows on port 443 , while "port 80&...

jvanhambelgium

Last week I disabled my Pi-hole container on RB5009 and returned to the container on my Synology NAS where it used to work flawlessly for years. "Once it runs" it is quite stable, but I experienced things like ; cannot start container anymore after an update-only reboot helps, USB-storage ...

jvanhambelgium

Anyone else having this thingy with USB storage that keeps changing with each reboot from usb1-part1 to usb2-part1 etc ? Basically breaking containers etc between reboots. Was it possible to refer to a "label" in the container-settings ? /container mounts add dst=/etc/pihole name=etc_pihol...

jvanhambelgium

What 6500-E chassis do you have ? 6503 / 6504 / 6506 / 6509 / 6513 ? What SUP's have you installed ? It all depends on the features & services that you use today on these chassis. Without knowing that its impossible to say of a Mikrotik switch would be capable to act as a replacement. The Cisco ...

jvanhambelgium

Or an EOIP layer over wireguard. Even ROMON works then. Yes, but EoIP tunneling is bridging right ? So this means the user must "extend" his office LAN down to the home. What about the different VLAN's in the office. Let's say IPCAM VLAN in the office and IOT/MEDIA VLAN in the office, bot...

jvanhambelgium

Please help me understand, is the reason that none of the devices at either end of the wireguard tunnel show up via network discovery because network discovery only works for devices on the same subnet? I'm going to base the next paragraph on this assumption. Depending in its implementation of this ...

jvanhambelgium

Ahhh..that is not going to work ;-) You cannot gain failover with regards to that aspect. If you have 1 "flat" network why not look at VRRP ? If you network is flat and you don't have Internet ... WHAT IS the gateway ? You need one ? Is any of these 3 routers a gateway to somewhere ?? Hi ...

jvanhambelgium

Hi. yes, its plain flat. the reason i am using 3x dhcp is frequent power cuts that can affect one or two routers...so at least one can serve the clients remaining. Question: the clients will not need a gateway? if an assign one, and its the one going down what happens? Thank you again for your time...

jvanhambelgium

Since it is only "Intranet" you can deal with the failover/redudancy by using a larger scope and divide it across the 3 Eg. 172.16.0.0/16 , so this is a large IP-space, especially for only 300 devices. On all 3 , the "network" would be 172.16.0.0/16 , but the differences will be...

jvanhambelgium

Since it is only "Intranet" you can deal with the failover/redudancy by using a larger scope and divide it across the 3 Eg. 172.16.0.0/16 , so this is a large IP-space, especially for only 300 devices. On all 3 , the "network" would be 172.16.0.0/16 , but the differences will be ...

jvanhambelgium

Did you try to actually put something in the "Source Address" in the target config ? So in stead of 0.0.0.0 put 192.168.7.254 or whatever the IP on the MT side. thank you ! Yes, I did I'm using Netflow to (towards Splunk) and this just works. is there free edition of Splunk to use? Sure, ...

jvanhambelgium

Did you try to actually put something in the "Source Address" in the target config ?
So in stead of 0.0.0.0 put 192.168.7.254 or whatever the IP on the MT side.

I'm using Netflow to (towards Splunk) and this just works.

jvanhambelgium

I've tried them on my RB5009 on the latest 7.8 and I do get *a lot* of errors where the list fails to update. Some even " script error: error - contact MikroTik support and send a supout file (10) " Screenshot from 2023-03-05 19-39-19.png On what platform did you test these scripts ? After...

jvanhambelgium

This is unnecessary, all input on the WAN side should be blocked by default. Sure, but you could also block OUTGOING traffic towards any of these IP's. This might indicate some internal compromise of some system. And IF you run any services (eg. webserver, VPN-server) you cannot just "all inpu...

jvanhambelgium

palantiacuteri-lotr.jpg

jvanhambelgium

I agree with you, Now give me the solution or recommend me another hardware or equipment which full fill my need Thanks in advance That is going to cost you vastly more ... Palo Alto FW, Checkpoint, Fortinet, etc (and dozens others) have the required power to identify applications and thus allow yo...

jvanhambelgium

Updated my RB5009. No issues so far. The "flashing" SFP interface window in Winbox seems fixed and remains stable. My SFP S+RJ10 works just fine. Screenshot from 2023-02-28 19-43-00.png The only thing is this usb-drive mapping/naming. Now it became usb2-part1 (it was usb1-part1 on 7.7) so ...

jvanhambelgium

This thing has serial ports ? Alternatively you can just use the "ethernet" ports no ? 1 cable to RB4011 en 1 ethernet to CRS328-24G-4S+ and make the appropriate IP-config.

jvanhambelgium

Small ARM/ARM6464-based MT-device and then a ZeroTier "OOB" network ?
No hassle with launching VPN's etc. Its always "connected" via the cloud-switch. (zerotier)

jvanhambelgium

Install TeamViewer on a PC if that PC belongs to your or is from your company?
When you take over the PC, you can Winbox straight to the Mikrotik.

jvanhambelgium

Not possible with Mikrotik.
If your MT supports "containers" you can consider trying to get something like NGINX/Traeffix etc active and "redirect" from there.
You need a reverse-proxy of some sort for these functions and MT does not have it embedded.

jvanhambelgium

Pi-hole works just fine here on my RB5009. Sure, it consumes quite some RAM, but performance is fine in my HOME scenario. Don't know if the container could be optimized to use even less. If you in Pi-hole GUI and check the utilization there ; Total CPU utilization: 0.2% Memory utilization: 1.9% Used...

jvanhambelgium

ZFS - probably more complicated Yeah, both BTRFS and ZFS are great choices but as the latter is a third party add-on (originated from Sun Microsystems) it would likely be harder to maintain. likely ? Look at for example the ZeroTier package ; MT released it at version 1.6.6 and it was never updated...

jvanhambelgium

The only test that I can think of is to disconnect the ONT/dumb-switch and effectively place a PC on your "WAN" port and "simulate" your Internet. If you also cannot push 1Gbit/sec through the RB5009 then the unit really is faulty, really. I can't imaging a "netinstall"...

jvanhambelgium

Are you using the Mikrotik as a DNS-server ?
Then it is normal that FORWARD chain will not deal with any traffic GENERATED by the Mikrotik (example ; upstream DNS queries) or RESPONSES back to the Mikrotik.

jvanhambelgium

So for my understanding, the "WAN" interface is configured just to obtain via DHCP a IP-address from the ISP, no PPPoE anymore right ? Really, really weird phenomena you have with RB5009. Did you reboot after setting the MTU back to default value ? Could you perform a complete factory-rese...

jvanhambelgium

Reset the L2MTU value on the RB5009 again to default value and try again ?
What effect does this have ?

jvanhambelgium

https://wiki.mikrotik.com/wiki/Manual:C ... stallation

jvanhambelgium

Who said your ISP allows you to use anything else then 192.168.1.1 ?
It does not mean that if you see some /24 mask somewhere that you can use that whole block. Check with your ISP for confirmation.

jvanhambelgium

As ISP I have mitigation center. If for some reason my network is under attack, the traffic instead of the usual 3ms latency go to 35/45ms because all is routed trough the cloudflare center than have power to filter any DDoS attack... I can't reveal other detail for N.D.A. but ask your ISP to use s...

jvanhambelgium

This will be my last post on this as it's getting off-topic, but ZeroTier is a pretty basic SD-WAN and is in no way equivalent to the capabilities, flexibility, and scalability of SD-WAN from vendors like Cisco-Viptela, Palo Alto-CloudGenix,VMware-VeloCloud, Fortinet SD-WAN, etc. mpvpn, meshvpn, sd...

jvanhambelgium

Perhaps you could torch/packet-capture on the RB5009 to see if packets destined for 10.128.64.0/24 are *effectively* arriving here ? I fired up my (lab) installation to check on the rules. Could you on the rb5009, create in the FORWARD chain a accept-rule that allows "in-interface" = BRIDG...

jvanhambelgium

As a test, could you add the "zerotier1" interface to the LAN interface LIST ?
Very weird that with all firewall-rules disabled (which should mean "allow any any") things don't seem to work in your setup.

jvanhambelgium

Did you effectively add a route in the ZeroTier admin-panel ? So something like 10.128.64.0/24 via 192.168.42.3 I have such a setup with both an RB5009 and RB3011 hooked into ZeroTier and I can access (from a PC on the RB5009-LAN) a server sitting behind the RB3011-LAN and you have to do the same i...

jvanhambelgium

Did you effectively add a route in the ZeroTier admin-panel ?
So something like

10.128.64.0/24 via 192.168.42.3

I have such a setup with both an RB5009 and RB3011 hooked into ZeroTier and I can access (from a PC on the RB5009-LAN) a server sitting behind the RB3011-LAN

jvanhambelgium

Then I guess it will be a 100 mile trip for you...not much other options it seems. Perhaps in the future try to use Winbox SAFE-MODE while making such modifications from a remote location... After that test the changes by initiating a new/fresh session Only when 100% sure perform the commit. https:/...

jvanhambelgium

So no other local-device / server onsite that you might use as a jumphost (ssh is enough) ? Unless off course that change you made to a firewall-rule was significant enough to really block everything on the input-chain... If so, schedule a nice 100mile trip because there are no other remote "ba...

jvanhambelgium

Yes that will work, but you might see other messages too which are "info" level messages.
As far as I know, you cannot make a specific FILTER based on the message-content itself ; that would be even more flexibel.

jvanhambelgium

If you could obtain a config-extract from your customer you'll probably get some support here. However the question is ; does your customer even know how to login this Mikrotik and perform some basic things ?? If not, advise him to get in touch with some Mikrotik consultant who can perform this thin...

jvanhambelgium

Hello, I work for a security company installing CCTV and Audio. I'm having issues with SIP registration from the speaker to our PBX server. From what I gathered from the speaker manufacturer a Pcap determined the firewall is blocking the data. Unfortunately I'm not an network expert and the custome...

jvanhambelgium

Are there any people with a broken ZeroTier setup in this release ?? ZT on my RB5009 is broken. Stuck in the state "Requesting_Configuration" it seems. Worked just fine on 7.6 My LAB-3011 was also upgraded (first) and ZT is working fine here, that's the strange thing. The "LEAF" ...

jvanhambelgium

Updated RB5009 with SFP module "S+RJ10" but see in Winbox some "flipping" behaviour, switching between 1G & 10G but the connection (on top of this interface my PPPoE runs) is just fine, 0 errors, maximum performance. So at this point I'm not sure if this a "Winbox" ...

jvanhambelgium

I've just performed the update to ROS 7.7 STABLE on the RB5009 and this container does not want to start anymore : Screenshot from 2023-01-12 22-39-51.png Any clue why this suddenly happens ? On 7.6 I never saw this. What is the fix for this ? It does not look like I can pass an ENV-variable forcing...

jvanhambelgium

Change the in-interface to "pppoe-out1" ?

jvanhambelgium

The Tx/Rx "drops" you refer to (at interface level) are NOT related to FIREWALL DROPS etc. These are drops at the eg. ethernet level due to mismatches,cable-problems (crc errors etc) and other transmission issues. So this "counter" should ideally be "0" You cannot moni...

jvanhambelgium

The stack will also report this by itself through SNMP (trap) and/or SYSLOG.

jvanhambelgium

I'm even surprised this would work in China. Wireguard is rather easy for an advanced firewall to detect & filter....that might be the reason why you only see "Tx" traffic

jvanhambelgium

Updated my Pi-hole yesterday on the RB5009 and 30seconds later it was already back up & running with all config (because stored outside the container-image)
Can't be more simpel then this...

jvanhambelgium

Guys,Hi! I want to share WiFi access for 20 floors hotel with 143 rooms. The building is high, not wide. I have rj45 cable with 1000mbps link on first floor. I want to be cable less scenario. (im not a pro) I want to have captive portal with login (codes or username+password) I want to make my own ...

jvanhambelgium

But why would a professional installation ever use a dual power supply? Because we feed the device from 2 seperate UPS's or Incoming Circuit + ATS/Battery Backup to maximize uptime. Trust me you don't want to relive the CCR1036 days where it came with 1x psu and that psu came with a design flaw ......

jvanhambelgium

If you made folder-mappings / mounts on the Pihole container pointing to some USB-storage for eg. /etc/pihole I would thing there is no need to export/restore the config as it is not deleted when you delete the Pihole-container ? 1) Stop the container 2) Delete the container 3) Pull newest instance ...

jvanhambelgium

Splunk is also an option, and then you can benefit from the contribution @Jotne made // see this topic https://forum.mikrotik.com/viewtopic.php?p=969505&hilit=Splunk#p888798 In addition, you can install the Netflow module on Splunk to also process Netflow data. But again, this requires quite som...

jvanhambelgium

We'll, it seems that your VLAN setup works OK, as clients on these VLAN's can effectively go out to Internet etc It sounds also promising that from your wireguard-peers/clients you can already ping L3-VLAN IP's on the Mikrotik. Can you on the top of the "forward chain" , above the "dr...

jvanhambelgium

Are these clients all Windows PC's / servers ?
Sure there is no host-based firewall at play here ?

Remember, a Windows machine will drop pings if not sources from the local network-range. For sure 10.66.67.x is outside any 192.168..x.x range here.

jvanhambelgium

For another, you will notice that the current implementation requires NAT, not allowing direct access to the host's bridge. That's a sensible default, though I hope MikroTik eventually lifts it, as there are services you can only provide when bound to real hardware. My AdGuardHome runs fine with an...

jvanhambelgium

I do not use any DoT/DoH functionality.
Reading the forums I think fore sure there are bugs depending on the release you run.

But anyway, If I go to dns.nextdns.io with my Chrome on Ubuntu all seems fine. No warnings. Certificate is valid.

Screenshot from 2022-12-03 12-42-23.png

jvanhambelgium

The goal of the video was to make your Mikrotik a (secure) DNS "client" , so you see the certificate actions are on Mikrotik itself. All your clients on the LAN continue to keep using traditional DNS and must use the Mikrotik as their DNS. Upon receiving the regular DNS-traffic from your c...

jvanhambelgium

Why make a script ? "Netwatch" will do that for you... > Tools > Netwatch Then define some "targets" and what test you want to run (eg. regular ICMP or TCP-con or something) Then define "action" what to do when "Up" and/or "Down" (you can past a scri...

jvanhambelgium

So, what is this rule suppose to do ? add action= accept chain= input comment="bruteforce ssh&winbox" disabled=yes \ dst-port=1026,8292 protocol=tcp src-address-list= !bruteforce_blacklist So you ARE allowing SSH + Winbox to your router if they are NOT the bruteforce_blacklist. Why not...

jvanhambelgium

Thanks Jotne! for this new release. Both updated 5.1 script & 3.8 Splunk-app are working fine over here!

jvanhambelgium

There is a rule to allow ICMP; Code: Select all add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp This rule allows ICMP to WAN from the Internet, I changed action to drop, and there is no option to PING WAN port from the Internet, but this blocked ping to the VLAN ...

jvanhambelgium

My Pihole is running for quite some time now on my RB5009
Are you using USB storage or the 5009's NAND?

USB-storage.

jvanhambelgium

Isn't pihole better suited for that ? From what I can see, Snort is more for network intrusion detection. OTOH if you need Snort for detecting network intrusion, your firewall may not be up to par :D True ;-) @anav, you did not specify the bigger context ; Offcourse "Snort" can run on/in ...

jvanhambelgium

User requirements?

jvanhambelgium

For example, similar to Fortinet we use Palo Alto modules on 1 of our environments (services > 100k users, full UTM/SSL-decrypt/webproxy/... enabled) that cost 6-digit numbers in euros only for a single line-card.... What brand of switches are you using with your palo alto? just curious i personall...

jvanhambelgium

I forgot to use my sarcasm font.

Yes, I thought so

jvanhambelgium

Indeed, fortigate is more appropriate for the uber web gurus. Well ... you cannot really compare a RouterOS box with a Fortinet in the Firewall/UTM area...its not a fair comparison in favor of Fortigate. (similar statement for example compared to Palo Alto) This is not about being more "approp...

jvanhambelgium

So, on my own personal RB3011 in winbox i see this in the SFP interface. MODLUE PRESENT (TICK) RX LOSE TX Fault Followed by all the SFP info. This is for a BIDI module i have installed Surely if that was a duplex transceiver, surely there iwould be some way to have those first 3 checkboxes alert so...

jvanhambelgium

HI, I have a RB4011 i was looking to setup vpn but i notice that unlike in all the guides i have been through I dont have a mynetname address, it shows the routers ip address... why is this? Thank you for any input. You have a value in the "STATUS" field ? What does it say ? status (read-...

jvanhambelgium

You mean like this ? /ip/cloud> print ddns-enabled: yes ddns-update-interval: 1m update-time: yes public-address: XX.XX.XX.XX dns-name: XXXXXXX.sn.mynetname.net status: updated So this field "dns-name" empty ?? That can't be right ? Perhaps check with MT-support if there is something wrong...

jvanhambelgium

In theory you could have stumbled upon a bug or something, especially with these larger subnets. Your story makes sense. This 172.16.1.10 device that you are trying to ping, can you tell me something about it (Windows? Linux? custom appliance)? What is it ? Does it have a gateway set ? To where ? Ca...

jvanhambelgium

Small note, your Win10 Wireguard-config is not fully correct ; [Interface] PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXX Address = 192.168.32.2/24 DNS = 192.168.0.100 You need to specify a /32 here ! Each WG-endpoint receives a /32 (well ... not really "receives" off course but you get the picture...

jvanhambelgium

I see in your config-extract : RouterOS 7.1rc4
Please upgrade to 7.6 , make an export of Pihole // delete & re-install the container // import config and try again.
In the last 7.x release some fixing was done on permissions etc.

My Pihole is running for quite some time now on my RB5009

jvanhambelgium

I don't think this is possible with Mikrotik, unless perhaps with a great deal of hacking. Its not a SDWAN-product, where you can direct streams/flows to other WAN-links eg. if interfaces are loaded for 80% or so. If the Wiki is correct, following choices are possible ; https://help.mikrotik.com/doc...

jvanhambelgium

Hmm, for sure your use-case is pretty ... "a-typical" and I don't think you can ever really monetize it properly . Because you would need to have on each location also Internet connectivity yourself for getting these alarms out. 4G/5G/LTE will be challenging in basements etc. I you want to...

jvanhambelgium

I can only tell you I can make Wifi-calls on a standard Mikrotik setup (both RB3011/RB5009) with just regular rules like 1 NAT-rule to go out etc. My wireless is Unifi, not Mikrotik , so I can't comment on a "Mikrotik Wireless" do's or don'ts for Wifi-calling. (if they exist) Never had to ...

jvanhambelgium

https://www.t-mobile.com/support/covera ... m-t-mobile

Make sure all pre-reqs are covered.
IF you have working Internet at home with 2Mbps, this should work unless you do not meet minimum requirements.

jvanhambelgium

SNMP will not do that for you. Sure it can report if actual interface are going down or up This required some "high intelligence" like a script to evaluate some aspects like Tx/Rx power. In theory, on Mikrotik, you could have a script running that evaluates the stats on an SFP-interface. (...

jvanhambelgium

Firewall active on Proxmox ?
Check that first. When you ping FROM Proxmox (initiated) the return packets are probably allowed in...
If you ping remotely TO the Proxmox, they might be blocked immediately...

jvanhambelgium

Even if you insert this close to the splitter, whenever your "light drops" that doesn't mean there is fibercable-cut anyway! There is also the equipment from the Telco in the GPON-chain that uses your deployed DARK FIBER and lights it up! Suppose the Telco (using your deployed cables) has ...

jvanhambelgium

Not really, except that my understanding of "raw" means it sits very close to the interface itself at the point where dropping various stuff is not consuming much resources (eg. no connection tracking etc) Firewall RAW table allows to selectively bypass or drop packets before connection tr...

jvanhambelgium

Did you try to add it as "raw" rule?

jvanhambelgium

Probably they won't tell you for whatever reason, commercially or perhaps they are bending regulatory rules.
I mean, its just a tariff-plan...no fancy technical solution of some sort.

Search found 1017 matches