MikroTik

volkirik

i also update srcnat rule.. thanks for posting gateway script :local EthInterfaceName "ether1" :local MyComment "terra" :local newgw [/ip dhcp-client get [/ip dhcp-client find interface="$EthInterfaceName"] gateway]; :local routegw [/ip route get [/ip route find comment...

volkirik

I currently use following setup /ip firewall mangle add action=mark-connection chain=forward comment="youtube tls host youtube.com" new-connection-mark=youtube passthrough=yes \ port=443 protocol=tcp tls-host=*.youtube.com add action=mark-connection chain=forward comment="youtube tls ...

volkirik

we use tls-host matcher for eba.gov.tr online education portal's bandwidth management you can do the same, just need to rename rules and hostname (domain) /ip firewall mangle add action=mark-connection chain=forward comment="eba tls host eba.gov.tr" new-connection-mark=eba passthrough=yes ...

volkirik

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn

/ipv6 firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn

volkirik

actually it is not solved... clamp TCP MSS still not working... MRRU is not supported by my ISP so I add 2 forward rules (one for incoming traffic and another one for outgoing traffic) and clamp-to-pmtu manually. dunno what mechanism Mikrotik use for clamping TCP MSS at interfaces but it is not work...

volkirik

disable autoneg.. may solve the problem

volkirik

i recommend 1 day for group key update

and 15 seconds for disconnect-timeout... then you will be ONLINE!

these two should be considered and applied as default values for HOME-AP by mikrotik team due to lots of problems and complaints.

volkirik

awesome. thanks.

saved my life. i can have a sleep now

/routing bgp peer {
   :foreach peer in [find state!="established" and disabled=no] do={
      :log warning "Restart stuck BGP Peer: $([get $peer name])"
      disable $peer
      :delay 100ms
      enable $peer
   }
}

volkirik

unfortunately Mikrotik xDSL modem is not going to be produced.. They focus on active fiber and GPON.. the response from mikrotik was:

xDSL and G.fast are old technologies. Big chip makers quited that market long time ago. Intel, Qualcomm, Marvell... they sold or closed their xDSL and G.fast groups.

volkirik

unfortunately Mikrotik xDSL modem is not going to be produced.. They focus on active fiber and GPON.. the response from mikrotik was:

xDSL and G.fast are old technologies. Big chip makers quited that market long time ago. Intel, Qualcomm, Marvell... they sold or closed their xDSL and G.fast groups.

volkirik

It is not abandoned.. "NG.fast" and "XG.fast" will be named as "G.mgfast".. But the "NG.fast" prototype was only 5 Gbps. Maybe Swisscom would only be interested in 10 Gbps now. G.mgfast (multi-gigabit fast) will be supporting both 5Gbps and 10Gbps profiles.

volkirik

If the "NG.fast" project was supposed to result in a slower product, maybe it is now abandoned. It is not abandoned.. "NG.fast" and "XG.fast" will be named as "G.mgfast".. I wish mikrotik make 35b/G.fast/G.mgfast SFP/+ modules. To decrease the price on the ma...

volkirik

It has elegant design!

volkirik

soon™ see also: https://m.facebook.com/story.php?story_fbid=1432205596904888&id=186874744771319 From Thrifty: My new response to people saying Mikrotik BGP being single threaded is causing them performance issues: A few points: 1) Control Plane ≠ Forwarding Plane While the processing of routing ...

volkirik

there may be another problem with clients running MS Windows:
https://superuser.com/questions/984502/ ... by-default

posting here for reference.

it may be solved by disabling WoLAN and WoWLAN (if you are not using) because there seems to be no other solution.

volkirik

So is antenna gain added back now?

yes

volkirik

Not every country has cheap labour, and it is quicker to replace a box than laying FTTH. Very few people need 10 Gbps at home. This "NG.fast" is made for up to 100 meters, so it would be mostly for FTTB (or right outside). modems will be ready from broadcom soon: https://www.broadcom.com/...

volkirik

You could try "https://1.1.1.1/dns-query" - Cloudflare managed to get the the ip address into the certificate.

thanks

volkirik

+1 for this

volkirik

Flow control just sh*ts in the Logs in my setup. I Didn't see any benefit.

volkirik

+1 for this

ipv6 fasttrack is also needed with route caches.

volkirik

I was receiving way too may errors.
Also the connections slowed way down when the router was reporting:
dns,error DoH max queue size reached, dropping query

I removed my DoH configurations, back to normal.

same here.. made me sick 2 days.. need more stable version..

volkirik

Since version 6.39, mangle rules it not needed anymore.

But It doesnt work with fasttrack. Weird no mention of tcp-mss-clamping in the fasttrack wiki

volkirik

keep in mind that tunnelbroker.net does NOT support keepalives! You need to (have to) disable keepalive for 6to4 interface. I also suggest that you set your MTU on tunnelbroker.net. It will be MRU of your side and better be same as actual MTU of 6to4 interface. You should Also enable clamp-tcp-mss. ...

volkirik

you need following rule before fasttrack-connection otherwise SYN packets will be fasttracked and clamp-tcp-mss will break

/ip firewall filter
add action=accept chain=forward comment="tcp syn no-FP" connection-state=established,related \
protocol=tcp tcp-flags=syn

fyi.

volkirik

It is sign of mac address conflict. reset mac addresses of each interface and set auto-mac=yes for all bridges.

It is mostly caused by restoring backup of a router to another.

volkirik

this bug still exists..! I can not get proper keepalive responses from tunnelbroker.ch and tunnel goes down.

could you please share here your correspondances with the mikrotik support

volkirik

It may be sign of mac address conflict.

volkirik

How DoH works. Pssssst I like to go to the Pornhub can you give me the IP address. Here you go says Google, of you are. Google making a note the IP xxx.xxx.xxx.xxx went to the pornhub on that day and time and it is already the 6543 time. Lets ask pornhub what is the preference of IP xxx.xxx.xxx.xxx...

volkirik

Seems there are some errors with DoH, I've this sometime in the logs : DoH max queue size reached, dropping query

@Florian : same here. couldnt get it to work stable.

volkirik

Works fine for 5 minutes and then Makes router unstable by %40-50 CPU usage (ssl process). And also I get lots of errors with or without "Verify certificate";

doh.png

I imported cloudflare's root CA successfully, and started to get other type of errors as follows;

doh2.png

volkirik

Maybe in v7 ? With a ccr1036, I hit approx 2gb/sec per connection, while I can hit more than 9gb/s with ipv4 and fastrack. Of course, if you multiply the connections, you can be at full speed overall, but, it's not ideal. unfortunately it seems impossible for now. they said that they should add rou...

volkirik

the solution is to terminate PPPoE on firewall and drop all incoming packets from PPPoE if they dont participate in NAT by writing a rule. of course, if it allows you to do so. If it is not possible, simply replace the firewall as it should be piece of junk. Many of new ones can terminate 100 mbps P...

volkirik

Mikrotik RouterOS does not have PPPoE Relay (half bridge) feature, yet. So you cant run your mikrotik router in half bridge mode. But IF you have a modem/gateway that supports PPPoE Relay (aka Half Bridge or Passthrough), then you can use PPPoE client on routerOS to connect PPPoE server via modem/ga...

volkirik

Mikrotik RouterOS does not have PPPoE Relay (half bridge) feature, yet. So you cant run your mikrotik router in half bridge mode. But IF you have a modem/gateway that supports PPPoE Relay (aka Half Bridge or Passthrough), then you can use PPPoE client on routerOS to connect PPPoE server via modem/ga...

volkirik

Experienced same problems many times.

MTU should be set to 1500 for the network interface.
Unused network interfaces should be disabled in OS.

volkirik

Thanks for posting the information.

Linux defaults have been resulting better in my Home Network. Less disconnects and less invalid packets.

volkirik

I still get this behaviour on 6.43rc32 after power-outage.

PPPoE client statistics (graphs) got deleted after power-loss

Graphs of other interfaces , CPU , Memory , Disk usage remains.

volkirik

change the group key update time from 5 minutes to 1 hour.

volkirik

You don't need to update the HE.NET side of the tunnel (on their web site) any more. Only needed to update the local IP on the tunnel interface on your RB, and the tunnel will come up. HE somehow automatically detects the IP changed and updates their end without intervention. unfortunately this is...

volkirik

This script also does the job, without auto-detect local-address feature: http://forum.mikrotik.com/viewtopic.php ... 43#p336881

keepalive feature should be disabled for IPv6 tunnel, it takes the interface down...

volkirik

I use the new feature of RouterOS that detects local-address automatically. Here is modified script for auto-detect local-address setup # Update Hurricane Electric IPv6 Tunnel Client IPv4 address :local HEtunnelid "YOUR_tunnelid" :local HEuserid "YOUR_username" :local HEmd5pass &...

Search found 42 matches