MikroTik

JJCinAZ

Safe Mode is only applicable for up to 100 changes; after which it disengages without rollback. If the script make more than 100 changes, safe mode may not help.

JJCinAZ

The variable name of "name" is causing an ambiguity in the parsing. Try the following instead: :local x 11; :put [ /interface eoip find name="$x" ] To explain more, because you used "name" as the variable, your comparison is really, "where name=name". In other...

JJCinAZ

Here's a quick try at it: # mac-address is case sensitive -- use upper only :local x [/ip dhcp-server lease find where mac-address="20:3A:07:F2:B6:3F"] :if ([:len $x] = 0) do={ # not found /tool fetch http-method=put url="http://192.168.1.25:8080/rest/items/pres_ch/state" \ mode=...

JJCinAZ

Yeah, not surprising there's a race condition there and it would be difficult for the DHCP server to serialize since it would have to have a single pipeline or a pipeline per-mac address which would be a lot of complication. You could try writing the script so that it doesn't care if it's an assignm...

JJCinAZ

Have you looked at the rb850? Inexpensive, fast, hardware AES. It doesn't have the SFP but it sounds like that isn't a must.

JJCinAZ

I'm adding my vote to this as well.

Joe

JJCinAZ

You would need to disable IPv6 to get rid of OSPFv3

JJCinAZ

This is normally accomplished by adding a route filter in OSPF as follows: /routing filter add chain=ospf-in set-pref-src=[/routing ospf instance get default router-id] However, this "broke" or changed somewhere between 6.3 and 6.30.4 (I didn't test in which exact version it changed). Appa...

JJCinAZ

Right after your line:

:local date [ /ip hotspot user get $i comment ]

Add a log:

:local date [ /ip hotspot user get $i comment ]
:log info "DATE IS:$date"

You'll see something you don't expect to be in the comment.

JJCinAZ

No you can't. The backup/restore is not meant to be used to duplicate configurations like that. You should try an "export compact" and then import/paste it into a new blank router. The export compact doesn't normally export any MAC addresses for Ethernets. You can also reset the MAC addres...

JJCinAZ

Try logging the date variable each time through the loop.

JJCinAZ

Right, so $days is wrong and that comes from the variable $date which comes from a hotspot user comment:

:local date [ /ip hotspot user get $i comment ]

So clearly, one of your hotspot users doesn't have a comment in the expected format.

JJCinAZ

You should try inserting some ":log info ()" commands to debug your code. For example ... :foreach i in [ /ip hotspot user find where profile=PRIVATE ] do={ :if ([ :find [ /ip hotspot user get $i comment ] ] = 0 ) do={ :local date [ /ip hotspot user get $i comment ] :local montharray ( &qu...

JJCinAZ

I haven't use that selector in the mangle, but I think it only applied to traffic destined for a process on the router. Your intra-LAN traffic is not destined for a process on the router.

Instead of "dst-address-type=!local" you could try "dst-address=!192.168.0.0/16".

JJCinAZ

You're adding a route mark to all traffic, including that from 192.168.1.0/24 <->192.168.3.0/24. By adding the route mark, you are causing the traffic to only use routing table entries with those route marks and if you look at your routing table, you have no route to 192.168.1.0/24 or 192.168.3.0/24...

JJCinAZ

Well, some quick back-of-the-envelope calculations say that if you write once per hour, then you're writing 24MB per day. Now let's assume you have a 64MB flash with 32MB free, so let's assume that your overwriting the 32MB free only, and that means you're overwriting the 32MB every 1.3 days. If the...

JJCinAZ

Sorry, left out a line: :local traf :local dntraf :local uptraf :local s :local a /queue simple :for i from=250 to=253 do={ :set s ("192.168.0.".$i."/32") :set a [/queue simple find where target=$s] :if ([:len $a] > 0) do={ :set a [:pick $a 0 1] :set traf [get $a bytes] :log info...

JJCinAZ

You could try an enable/disable of the PPPoE interface in the VRRP Master/Backup scripts, but now it sounds like your starting to violate the KISS principle.

JJCinAZ

You just need one NAT rule: /ip firewall nat add chain=srcnat out-interface=Internet action=masquerade Disable all the rules in the Forward chain on firewall filters: /ip firewall filter :foreach i in=[find where chain=forward] do={disable $i} If you can't communicate between the subnets, then you h...

JJCinAZ

Patrick has the right idea (IMHO). You might also look at running two routers in the data center, each on its own IP then you have two GRE tunnels from the remote site and the two routers at the DC use VRRP on the LAN IP only with OSPF to handle tunnel failover. Trying to use VRRP to move both IP's ...

JJCinAZ

Adding the following rules, now i can access the ftp server!, i just posted here if in-case someone needs it /ip firewall nat add action=masquerade chain=srcnat out-interface=ether2 add action=masquerade chain=srcnat out-interface=ether1 @descartes Are these the proper way to nat 2 different subnet...

JJCinAZ

Look at the Wiki: RouterOS massive auto upgrade

JJCinAZ

Here are some comments: - The find commands return an array or list of items. It's best if you stick to processing that as an array, hence the use the of the :len operator to test if we found anything. - The target is an Interface or a subnet, so for a single IP, it's really a /32 subnet. - You can ...

JJCinAZ

That is possible with Policy Routing. There are a plethora of examples in forums and wiki.

JJCinAZ

Use NetInstall to reinstall OS from scratch.

JJCinAZ

You should never receive that packet on an Internet connection, so by definition, no you can't "forward" it. You can get the router to send WOL packets using the /tool wol command. The question implies some sort of WAN connectivity between locations via some sort of tunnels and there are w...

JJCinAZ

Yes, yes, and yes. The caveat here is the latency . You need to know your apps, their usage patterns, and the effects on user interactions. For example, a user may be used to a 200ms response to an action in their accounting application, but if the connectivity carrying the EoIP link makes everythin...

JJCinAZ

You could allow them to send an SNMP command to your router which can run a script, but they can run any script on the router. The proper way to do this is to setup some sort of REST API server which they call to and that API server connects to the router to accomplish the command(s). This way, you ...

JJCinAZ

That works fine on my CCR1009 with 6.33rc11.

JJCinAZ

Yes. That's just a DST-NAT with a Protocol=icmp to get started. You can later restrict the icmp type to just 8 if you want.

JJCinAZ

Everywhere you have:

:for nodays from=0 to=$months do={

Try using:

:for nodays from=0 to=[:tonum $months] do={

JJCinAZ

Make sure you are not accidentally NAT'ing the connections across/through the EoIP tunnel. If this is happening, the SMB server will see multiple SMB sessions/users from the same IP. Each time it does, it will terminate the previous session/user and create a new one. Smaller/faster operations seem t...

JJCinAZ

You seem to imply that this is a new fiber setup to a new site. You might try a NBMA neighbor setup so that multicast is removed from the equation. If your fiber is some sort of metro-LAN service, you might be seeing the multicast reflected.

Joe

JJCinAZ

Sorry, no. There are no ways to configure the graphing for that. You would need to install something like Cacti or another SNMP graphing system and poll your devices, generating your own graphs.

JJCinAZ

If I understand what you're trying to do, maybe you could add a blackhole route for the same destination with a higher distance. When the lower distance one becomes unreachable, the blackhole route will become active. For example: /ip route add disabled=no distance=1 dst-address=4.2.2.1/32 gateway=p...

JJCinAZ

You could switch to using static interfaces by creating OVPN-Client interfaces for each of your VPN clients. That way, interfaces will not disappear on you. Alternately, you'll need to run a script periodically which looks for the "parent=unknown" and fixes it. For example, if you added a ...

JJCinAZ

While it can probably handle that given the generic parameters specified (the devil is in the details), I would suggest you build a design which allows you to easily scale horizontally. In other words, create a design where you can simply add another CCR if you start to hit limits on the first CCR.

JJCinAZ

Turning off the higher MCS values on the AP-side can help as the system doesn't try to move up to higher modulations. You can also turn off the A/G rates to keep control packets in higher modulations. Running with narrower bandwidth can also help as the smaller your channel, the lower the probabilit...

JJCinAZ

Being able to put some arbitrary text on the LCD via scripting would be great!

JJCinAZ

You can clear all the UDP connections in a script with the following:

/ip firewall connection
:foreach i in=[find protocol="udp"] do={remove $i}

JJCinAZ

Yes, that's correct. It means you will normally not see quick bursts on the graph. For example, a user executing a speed test, which normally lasts less than 10 seconds, will not affect the 5-minute average very much. AFAIK, it's just RRD underneath. This tutorial has details (see the Consolidation ...

JJCinAZ

You might try starting with the most simple config, starting from scratch (not starting from some wizard config): /system reset no-defaults=yes /interface vlan add name=e10-v10-WAN interface=ether10 vlan-id=10 disabled=no /interface bridge add name=br-lan /interface ethernet set ether2,ether3,ether4...

JJCinAZ

I can confirm that OSPF on v6.x with RB433AH and RB493AH works just fine with all sorts of other Routerboards. Have you captured the OSPF traffic between the two and looked at it with Wireshark? Maybe compare that with a capture from something else in your network where it is working?

JJCinAZ

Just use the command:

/ip hotspot reset-html 0

You might need to replace the 0 with the number of your hotspot server instance, but if you only have one, it should be 0.

JJCinAZ

I'm assuming you wanted the target-address to change, not the net mask on it. Also, you can't use the 'M' and 'k'. Finally, you cannot have a burst-limit less than the max-limit. Burst-limit should be larger than max-limit and you would also need a burst-time and burst-threshold. For example: :for i...

JJCinAZ

I can confirm this changed in 6.30.x. Probably best to open a support ticket on the issue.

JJCinAZ

It is possible to have more than one radius server, but they both have to be operating from the same database. Usually this is accomplished by tying the radius servers into a database backend, but for simple authentication-only it could also be done by keeping static files synchronized via something...

JJCinAZ

Kris, I have to echo marrold -- use Radius. It's not that hard to setup (FreeRadius on a VM) and changes to users are instantaneous. With code to walk through 1200 routers and change users, it will take a lot of time and you have to deal with errors along the way. Also, you need a database of router...

JJCinAZ

Yes, I don't normally use the routing rules to accomplish that. Normally, I use the "main" routing table for WAN1 and the "WAN2" routing table for WAN2, I would check for new connections only, I'd mark routes for traffic passing through to and from the LAN, and I wouldn't have th...

JJCinAZ

I didn't spend too much time looking through that config, but you're likely spending way too much time trying to classify traffic with layer-7 filters -- they are expensive in CPU time. Have you tried disabling all your filters and mangles so that you're merely routing between subnets in the most si...

JJCinAZ

Did you mean to be using Distance and not Scope? See: http://wiki.mikrotik.com/wiki/Manual:IP ... _selection

JJCinAZ

You could also look at transporting DHCP events to a central place using syslog. If you want to stick with the email-the-file method, look at rotating the log to a new file first, then email the old log.

JJCinAZ

You're having performance issues because you're configuration is sending every packet through the CPU on the CRS. You should not be using Bridging to accomplish this; rather, you should be using the switch-chip to accomplish this, else you'll never get wire speeds. Take a look at the CRS switch info...

JJCinAZ

You don't really want it to do that automatically -- that would reduce your flexibility in the future. Really all you're going to do is mark the new connections coming in on WAN1 and WAN2 and then you're going to look for that Connection Mark and, based on that, you'll be adding Routing Marks to out...

JJCinAZ

When one of the WAN links is not available however, it seems to work about half the time. That means it is doing exactly what you told it to do. You have effectively setup ECMP routing. Half the time, the reply packets to you are going through WAN1 and the other half, WAN2. Once that decision is ma...

JJCinAZ

Do you have a Src-NAT catching that RDP traffic when it shouldn't be?

JJCinAZ

I might suggest that you create a dummy loopback adapter which can be monitored for up/down state via SNMP: /interface bridge add name=monitor1 /interface print oid The "print oid" command will give you the interface ID number for your SNMP monitoring. Next, use the Netwatch tool, some cus...

JJCinAZ

/interface monitor-traffic LAN once do={:put ($"rx-bits-per-second"/8) }

JJCinAZ

Add your new IP. Adjust route or add specific route for your source. Connect to router in second instance using new ip. Delete old up. Change default route.

JJCinAZ

You could look at HeyWhatsThat

JJCinAZ

Is this what you're looking for? { :local routelist [/ip route find where (!disabled && comment~"^IP")] :if ([:len $routelist] > 0) do={ :foreach i in $routelist do={/ip route disable $i} :delay 15s :foreach i in $routelist do={/ip route enable $i} } } The if-statement is somewhat ...

JJCinAZ

You probably want to get rid of the Masq rule (rule #0) else it will catch all the traffic instead of rules 2 & 3.

JJCinAZ

Do I need both the Filter and the NAT statements? or should the Filter be the only rules I need? Assuming you have a rule "further down" in the Forward filter chain which would drop such traffic, then you do need the accept rules. I think CelticComms was onto something when he suggested t...

JJCinAZ

Try:

:global test
:set test [:resolve www.google.nl]
:put $test

JJCinAZ

This also occurs with Rb751 but only when ether1 is cycled. If ether1 is disabled and then renewables all the other ports (ether2 through ether5) reinitialize. It's normally not noticed but if you have a dynamic routing protocol like ospf running on e2, for example, the ospf session is reset as a re...

JJCinAZ

There are no ALG's for WebRTC in RouterOS, there are only ALG's for SIP, FTP, TFTP, H323, and IRC. Only IP address and TCP/UDP port translations, due to standard source-NAT'ting, would be occurring with WebRTC. The WebRTC protocol RFC does require ICE, TURN, & STUN implementations in the WebRTC ...

JJCinAZ

You could try using GRE tunnels with IPSec transport mode protecting the GRE traffic. Then you could use routing as you expect. You can even use ospf to automatically manage your routes.

JJCinAZ

Try:

ip dhcp-server lease print where status="bound"

JJCinAZ

Don't use IPSec tunnels; rather use GRE tunnels with IPSec transport mode. That will make it far easier to create redundancy in your setup.

JJCinAZ

I can't see it in your screen shot, but there could be a couple of things. First, it looks like you still have the sip nat helper enabled and if so, I recommend disabling it. Second, could your public IP address be changing such that the sip server is seeing you come from different addresses. With h...

JJCinAZ

You should enable the display of the reply-dst and reply-src addresses in the Connections list. That might show you something interesting.

JJCinAZ

Ah, I see the confusion. There are two places you can use the 'no-mark' parameter. One is in the 'if' portion of a rule, e.g.: /ip firewall mangle add action=mark-connection chain=prerouting protocol=ospf connection-mark=no-mark \ new-connection-mark=Alpha passthrough=yes In this example, we are tes...

JJCinAZ

It's just a way to test whether a mark has been previously assigned to the item. For example you may have a series of mark rules ordered from more to less specific and each checks for no-mark so as to not overwrite a more specific mark.

JJCinAZ

On v6 setup, have you tried disabling Fast Path under /ip settings?

JJCinAZ

You buy another sxt for client 1 location and you separate the two units there by enough space to avoid interference.

JJCinAZ

Mikrotik, or RouterOS more specifically, is a router and firewall device not an IDS, Spam filter, or other application-level policy/filter device. While it can be a part of these type solutions it doesn't have a magic button to do it. Maybe if you were much more specific in your question someone mig...

JJCinAZ

Yes, it could be more efficient depending on traffic patterns. You could also use one of the 10/100 ports as the Internet or upstream port instead of ether1 which is 10/100/1000, thus keeping your Lan ports all on the gigabit ports.

JJCinAZ

Try using only ports 1 through 5 instead of 6 through 10.

JJCinAZ

Because the graphs are averaging X samples over Y time. The larger Y the more samples are smaller since IP traffic is generally bursty. If you were to run a constant-bit-rate application at R for 45 minutes then you would see a 30 minute average at the rate since all of the samples would be at R.

JJCinAZ

There is no place to put the priority value unless there is a tag. This is why tag ID 0 is allowed -- for layer-2 priority communications of packets belonging to no Vlan. In my experience there are many types of networking devices which get this wrong and will not allow a tag with a vlan ID of zero....

JJCinAZ

You should probably not be executing a srcnat on the traffic between sites. In your post it sounded like you specifically doing so.

JJCinAZ

Like the new diagrams. One suggestion is to add detail on the "Use MPLS?" and "Use Route?". If you compare these decisions in the flow chart to the first decision after physical input, "In-Interface Bridge Port?", it seems to me that the first decision is much more self...

JJCinAZ

If you put the interface into a bridge then you need to move the vlan to the bridge.

/interface vlan set ether1-v30 interface=br-v11

JJCinAZ

Could you be accidentally NAT'ing the traffic between sites and that's causing the BCM trunking to fail? Just a guess

JJCinAZ

What's the other side?

JJCinAZ

With respect to tomaskir, my experience is that none of those routers (the 260GS is a switch not a router) will do 15-20Mbps of aes-128 IPSec. Here's the table of processors in use by each along with OpenSSL aes-128 benchmark speeds: MODEL: CPU: OpenSSL aes-128 Speed Benchmark RB/951G-2HnD: Atheros ...

JJCinAZ

We see the same thing. There is clearly a problem after 5.6 (v6 also has the issue). You can install 5.6 to clear up the packet loss in my testing. I submitted a bug report with exacting reproduction steps back on dec 18th. Got initial run-around but maybe they are starting to look more closely. You...

JJCinAZ

That's actually correct behavior. The SNMP server is bound to all IP addresses on the router. The broadcast is one of those. Sending an snmp request to a broadcast address is perfectly valid and all hosts on the subnet should reply, all other things being correct. It's similar to doing a ping to a b...

JJCinAZ

On the RB1100AHx2 v5.20, we are seeing packet loss with any HTB queues enabled on an interface. Disabling the queues clears it up. There is no CPU overload and this only seems to affect the 1100AHx2 as far as we've seen. You only have to be pushing a few Mbps of traffic to start seeing the loss even...

JJCinAZ

Yes, 2Mbps IPSEC max is about right for that router. You will start to get some additional latency and jitter even with queuing due to the high CPU usage. Try the RB1100AHx2 for more performance with encryption in IPSEC.

JJCinAZ

You're question is kind of broken in that it's not nearly verbose enough. Try studying this diagram and then post again.

JJCinAZ

CelticComms is correct and that behavior will occur with any interface which is not in the "running" state. For wireless and some ethernet ports you can force the interface to always running with the command: /interface wireless set wlan disable-running-check=yes The option is particularly...

JJCinAZ

You could also just use two RB750's to achieve this and you get a more simple solution leading to more redundancy and security -- all for the low price of $39 (USD).

JJCinAZ

If you're looking for some "magic" box which you plug in to solve all your VoIP problems, you'll be disappointed with everything. You need a deep and wide understanding of VoIP and Networking to be able to properly setup high quality and reliable VoIP. That being said, your RB750 is not li...

JJCinAZ

It should work just fine. Why not post your config and maybe someone can see what's wrong.

JJCinAZ

He means you need to do this: /interface vlan add arp=enabled disabled=no interface="lan bridge" l2mtu=1594 mtu=1500 name=vlan1 use-service-tag=no vlan-id=60 /interface bridge port add bridge="lan bridge" disabled=no edge=auto external-fdb=auto horizon=none interface=ether2 path-...

JJCinAZ

I haven't asked lately, but I'm sure it's Cisco and Juniper.

JJCinAZ

I highly recommend HotLava products: http://www.hotlavasystems.com

JJCinAZ

I'd recommend an x86 based system, dual-core with a simple SATA flash for boot, 2GB of RAM, and Intel-based NIC chipsets like the 82546 and 82573. Stay away from fancy array subsystems and try and stick with hardware from the Supported Hardware list. The KISS principal works well here. Attached are ...

JJCinAZ

Thanks for posting the solution.

JJCinAZ

That usually indicates that the connection was marked by some mangle but then all rules naming or using that mark were deleted and so the textual label for mark #13 was removed, thus the connection list has no way to translate the value 13 to text.

JJCinAZ

See this thread: http://forum.mikrotik.com/viewtopic.php?t=60255

JJCinAZ

Yes, your understanding is correct. First, here is a good, general article on the connection tracking (conntrack) in iptables: http://people.netfilter.org/pablo/docs/login.pdf Second, the SIP helper is a sort of ALG (Application Layer Gateway) which has to inspect the SIP commands going back and for...

JJCinAZ

Working fine here. I have six deployed so far.

JJCinAZ

If you're just routing traffic between network segments, then you shouldn't be using any NAT. It sounds like issues with NAT and misunderstanding of the VoIP protocols involved. Assuming you're using SIP, you cannot just "open ports" to get things to work. SIP is just call control. There a...

JJCinAZ

It can work just fine even with NAT. I find it's not a Mikrotik issue but rather an issue with understanding of SIP, RTP, STUN, UDPTL, etc.

JJCinAZ

We run thousands of SIP sessions through hundreds of Mikrotik routers with no problems. I do recommend that you disable the SIP NAT helper though.

JJCinAZ

Well same theory but the buffering may be occurring in the NV2 code where it does packet aggregation. Im not in front of a router now but you could try disabling that for a test.

JJCinAZ

Is your entire network bridged?

I think that was your answer.

Patient: Doctor, it hurts when I do this.
Doctor: Don't do that.

Byte the bullet now and setup a routed network.

JJCinAZ

Try the training portal? http://www.mikrotik.com/training/next

JJCinAZ

That behavior doesn't sound absurd. It sounds like the algorithm in the bonding code is waiting for X amount of data or a timeout before sending. A single ICMP is not enough data to trigger an immediate send. When there is a high volume of traffic on the link, the ICMP traffic is carried along more ...

JJCinAZ

The 20 second timeout sounds like one of the two SIP partners (device or server in this case) is not receiving all the SIP messages and a SIP timer fires, terminating the call; or a NAT connection is broken on the RTP stream after 20 seconds. Here are some things to try (not in any particular order)...

JJCinAZ

If you delete the "corrupt" rule and re-add a completely new masq NAT rule:

/ip firewall nat export:
add action=masquerade chain=srcnat disabled=no protocol=tcp src-address=2.2.2.2

the dst-ports are not changed on the outbound traffic?

JJCinAZ

I don't agree with your interpretation of masquerade action. Masq action, IMHO, is a src-nat which simply picks the to-address based on the pref-src in the route chosen for the traffic. Contrast that with the src-nat action which uses the address specified in the rule. With both actions, if you have...

JJCinAZ

I did it.

Mind posting how you did/fixed it for the benefit of all the forum users?

JJCinAZ

Almost sounds like an MTU problem.

JJCinAZ

Yes, it's the same.

JJCinAZ

No such thing in Router OS. For really old Windows networks, use WINS, else setup Active Directory servers.

JJCinAZ

Yes, the VoIP technician is referring to the SIP Helper. Disable it with the command:

/ip firewall service-port disable sip

JJCinAZ

Two ports in a simple bridge configuration will forward broadcasts. Something else is going on.

You could attempt to enable a DHCP client on the bridge interface as a test to see if the routerboard can get an address from your ISP.

JJCinAZ

I can see the DHCP relay service on RouterOS count up the request coming in and you can see the request coming into the DHCP relay via a packet sniff, but the DHCP relay never seems to send out the request to the upstream DHCP server. In the case the other day, the DHCP server was a Windows 2008 ser...

JJCinAZ

I saw this on a v5.x router the other day. I've used the DHCP relay a number of times previously on version 2.x, 3.x, & 4.x but it seems to be broken with v5.x. I haven't had a chance to test further, but in the limited testing I did get to run, I see the DHCP relay count the request, but it nev...

JJCinAZ

It also works for RS-232 serial adapters.

JJCinAZ

Here's another power oddity with the RB751U. Connect ethernet port 2, 3, 4, or 5 to an 802.3af POE switch. Then connect an 802.3af POE device like a VoIP phone to one of other ethernet ports 2, 3, 4 or 5 on the same RB751U. You'll notice that the POE device will start into a loop of power cycling. I...

JJCinAZ

I highly suggest using a VLAN per customer on the AP. The SM will tag the traffic and you can tell the SM to only accept untagged packets for security purposes. We use a router per tower or ring and when a customer purchases a static IP, we subnet out a /30, /29, /28, etc. and put the gateway on the...

JJCinAZ

When an Ethernet interface is "captured" by a bridge then a VLAN on the interface itself will be become ineffective and the VLAN's master interface must be changed to the bridge. The VLAN does not automatically "move" to the bridge.

JJCinAZ

Because the mac address of the bridge is changing on use. Watch it with serial console while you plug and unplug ethernets. After that, assign a fixed admin-mac to the bridge.

JJCinAZ

Does Xen require hardware virtualization in BIOS? My original system did not have hardware virtualization in BIOS.

Not that I know of. Did you get it working at all?

JJCinAZ

Is the script being "broken" in that the second fetch will not execute? The script engine seems to take the next like as input to the status display of the first fetch, so the second fetch doesn't get executed. In other words, have you figured out a way to get the script to "pause&quo...

JJCinAZ

However, if one side was bad wouldnt the signal tx / rx be way different if it was only 1 side with the problem ? Not really. What if the pigtail at the data center side is a 20db attenuator? Wouldn't that affect tx/rx at the same time? If you had highly asymmetric signal levels, then you would sta...

JJCinAZ

BTW: GREAT posting. Lots of clear data, good descriptions, graphs -- I wish everyone posted like that. Very professional.

JJCinAZ

I believe the Frequency Use tool is only showing you 802.11a frames received. It does not measure raw energy received at the antenna like a spectrum analzer would. You could have an interference source and not know it from that tool. You could hook up a real spectrum analyzer to see what noise you m...

JJCinAZ

Not in any single rule/queue. Here are some quick ideas (i.e. I didn't think to terribly hard here so be careful): 1. Mark the traffic using a bridge rule to match VLAN tag and add a packet mark. Then add queues on the master interface. 2. Setup a heirarchy of queues in the queue tree such that you ...

JJCinAZ

Seems broken in 3.26 also. It will not obey the main memory parameter, thus leaving no memory for VM's.

JJCinAZ

Ethernet duplex mismatch?

JJCinAZ

I can't since the Mikrotik guys frown on posting of other products here. Google is your friend. Search for web filtering appliances. I thought of another method. Setup an account on OpenDNS and force all your users to go through it. I do that with a firewall rule disallowing DNS from the LAN to the ...

JJCinAZ

That's hard to do with RouterOS. Audio streaming and Internet radio is done with HTTP on port 80 and other ports as well as with RTSP on various ports. A layer-7 filter can catch the RTSP but the HTTP streaming looks like any other web traffic. You really need a dynamic list of IP's, plus a bunch of...

JJCinAZ

Setup a layer-3 routed network.

JJCinAZ

EoIP doesn't "decrease the MTU" on any interface. The EoIP interface itself will transport a 1500 byte MTU just fine. Since the EoIP interface is encapsulating Ethernet frames in IP packets and sending those IP packets on networks supporting 1500 byte MTU's (usually) then the IP layer will...

JJCinAZ

It's virtually impossible to do. Skype, for example, encrypts it traffic and does not have a static port. You could block everything for the student and only allow access to approved IP addresses -- in other words a whiltelist scheme. However, that's a huge headache. You can sniff the traffic he's u...

JJCinAZ

It's a bug. You should be setting the main memory down to leave some open for Xen to give to other VM's, but that setting does not get obeyed in versions 3.23 or 3.24. Wait till 3.25 to see if it's fixed.

JJCinAZ

I don't know what you are doing with port 1460, but since you mentioned port 1723 I assume you are using PPTP. If so, then you need to also forward GRE protocol through from your DSL modem. Try disabling all drops (or the final drop) on the input chain and get to a working case first, then lock down.

JJCinAZ

Was it stable using the routing or routing-test package on the 3.24?

JJCinAZ

Assuming you are converting to VoIP of some type, yes it can be done. By this I mean that there is no built-in E1 TDM transport like that available on some PTP radios. Unless you are using NStream2, you will have a half-duplex link. This means you need to have good enough throughput to be able to tr...

JJCinAZ

A script with the command above works on my 3.23 router. Try creating a new script from scratch?

JJCinAZ

The best way is to use AP on one side and station-wds on the other. You can easily control the AP such that only your station can connect or run the AP side in mode=bridge which is identical to mode=ap-bridge except only one station can connect. As for WDS mode, which is different from the AP/bridge...

JJCinAZ

Though I don't think it's your problem, you should have the equal sign: /queue simple print stats file=stats You said you tried putting that in a script and then executing the script from the scheduler and it didn't work. Did you try running the script manually and did it work? I haven't had problem...

JJCinAZ

You didn't express your IP addresses in CIDR notation, so that limits what people could help you with. If you have the proper IP addresses and subnets, no firewall rules blocking, NAT rules changing addresses, and proper default gateways on all hosts then the AP/routers should route the traffic norm...

JJCinAZ

I would do that by bridging the public interface on the router with a VLAN on the LAN interface of the router. Then you can put the workstation in question on the VLAN and it use any of your public IP's (or at least those not used by the router itself). If you don't have a VLAN capable switch, then ...

JJCinAZ

When I sniff packets on the remote file server, it seems that all remote addresses are the IP of the router local to it I think that's the problem. You should be seeing source addresses of the workstations talking to the file server. It seems like you have something on the "router local to it&...

JJCinAZ

You need to sniff traffic coming into the file server and see what source address is getting used for the multiple sessions. You will see the session reset from the file server going back to an IP address. That should give you the next piece of evidence to track down which device is in the way.

JJCinAZ

For non-standard frequencies, you need to add the frequencies to the scan-list on the client.

JJCinAZ

Well 2.4g bands are OFDM modulations at 12 to 54 Mbps. Certainly they are faster and OFDM can run in near-line-of-sight whereas the FSK modulations of the 2.4b "band" are really just line-of-sight. So to go faster than 11Mbps, you need to use 2.4g or 2.4b/g. If you don't need to talk with ...

JJCinAZ

That sounds like you are inadvertantly NAT'ing the connection across the EoIP tunnel. I assume you are using an SMB file system, e.g. Windows file sharing. What happens is that the file server sees multiple SMB sessions from the same IP because a SRCNAT is catching the traffic across the tunnel. Whe...

JJCinAZ

Keep your posts together on the same topic please. Look, try the following on the Crossroads: /system reset Confirm the reset then reconnect via serial, mac-telnet, or mac-winbox. /interface bridge add name=br-lan port add interface=ether1 bridge=br-lan port add interface=wlan1 bridge=br-lan /interf...

JJCinAZ

Have you tried searching the forums or reading the Wiki? This question is asked usually once a day and sometimes more than once a day. Study existing discussions and articles before asking for someone to write your config for you.

JJCinAZ

It will only allow a connection to be initiated to 222.222.222.222 not initiated from. Once the connection is initiated, packets FROM 222.222.222.222 will be allowed back to the originator. That's why I originally said, "return packets will not pass".

JJCinAZ

/ip firewall filter
add chain=forward action=accept connection-state=related place-before=0
add chain=forward action=accept connection-state=established place-before=0

JJCinAZ

Your default gateway is not totally correct. It should normally be 0.0.0.0/0. That doesn't affect your AP functionally. You also should not need a DHCP relay. That would only be needed if you were on a seperate subnet. An AP is just a bridge -- no seperate subnet there.

JJCinAZ

Right, well then you can use what I said before. Add a wildcard DNS to allow the users' browsers to resolve and then use the hotspot to return a page with instructions. The router does not need access to the internet to be able to do that because of the wildcard DNS capability. Try it with Internet ...

JJCinAZ

Try adding rules at the top of the list allowing Established and Related connections, else the return traffic will not pass.

JJCinAZ

The system will show them your Hotspot login page, if they are not logged in. Assuming you then authenticate them but still have no Internet connectivity, then the Internet doesn't work. While your original question is poorly worded, if you are asking how to get everyone to the Hotspot login page wh...

JJCinAZ

You need a wildcard DNS entry in the DNS server on the router else the client browsers will never do an HTTP get of anything. The DNS requests by the clients must resolve to something. It doesn't matter if the address returned is not reachable because the hotspot will intercede before the GET is all...

JJCinAZ

The bridge should pick up the mac address of the lowest running interface in the bridge. As long as its not zero, not all ones and not duplicated elsewhere it should be okay (there are minor exceptions to that). He really needs to switch to something like an EoIP tunnel instead of the OpenVPN tunnel...

JJCinAZ

G729 with a payload size of 20ms will consume 40 Kbps upload AND 40 Kbps download with 50 pps up and 50 pps down. G711 with a payload size of 20ms will consume 80 Kbps upload AND 80 Kbps download with 50 pps up and down as well. You have to take packets-per-second (pps) and bandwidth into account.

JJCinAZ

Why is the address 192.168.2.240/32 showing up on both the vpn-bridge interface and on the open-vpn interface? I know the dynamic one from the open-vpn interface was assigned via the profile, but it would seem to me that you don't want the duplicate addresses. I don't think that should affect the la...

JJCinAZ

Well not really a just a patchcord. You need an SFP/Mini-GBIC adapter. You can get those for copper and fiber.

JJCinAZ

Ah, OpenVPN interface in the bridge -- totally different story. I've never used an OpenVPN tunnel into a bridge for layer-2 connectivity so I can't help. Maybe someone else has done that. You could use an EoIP tunnel encrypted with IPSEC or OpenVPN.

JJCinAZ

I wouldn't use 802.11 technology for a link of that distance and I don't post competing products in these forums, so I cannot recommend something.

JJCinAZ

These work: http://www.hotlavasystems.com/

JJCinAZ

You didn't post enough details of your config for anyone to be able to help.

JJCinAZ

Ay 60km with a grid dish? Good luck with that... You would need something like this: http://www.radiowavesinc.com/pdf/5.725-5.850_GHz_Parabolic_Subscriber_Antennas.pdf . Your freznel zone is going to be big -- you will need to take that into account. Finally, don't count on turbo-mode working at tha...

JJCinAZ

Here's a stab at it not knowing your specifics. /ip address add address=x.x.x.2/m interface=e1-isp1 add address=y.y.y.2/m interface=e2-isp2 add address=192.168.1.0/24 interface=e3-local1 add address=192.168.2.0/24 interface=e4-local2 /ip firewall mangle add action=mark-routing chain=prerouting new-r...

JJCinAZ

What's the bridge-mode on the station side set to? Look at the status of the bridge ports when you are in the failed state -- see if that gives you a clue. Also, are your IP addresses assigned to the bridge, the wlan interface, or the ether1 interface? If something is happening to the bridge and the...

JJCinAZ

Well the order of the mangle matters within a chain. The mangle rules are executed multiple times in the packet flow with different chain selectors. For example, in the preroute stage, the mangle rules where chain=prerouting are executed in their order. Then later in the forward stage, the mangle ru...

JJCinAZ

I would use the following mangles: 0 chain=forward action=mark-packet new-packet-mark=NONVOIPpack passthrough=no connection-mark=NONVOIP 1 chain=forward action=mark-packet new-packet-mark=VOIPpack passthrough=no connection-mark=VOIP 2 chain=prerouting action=mark-connection new-connection-mark=VOIP ...

JJCinAZ

Not directly. You can duplicate the rule in question (or rules in question), change the action to LOG and make sure the LOG version of the rule comes before the non-log version. That will log the match for that particular rule.

JJCinAZ

Do you have more than one Ethernet port from the ISP? If not, just add the 217.x.x.16 ... 217.x.x.22 (next time show the CIDR prefix please) to the ether1 interface connected to the ISP. If the ISP is providing you two Ethernet interfaces, add the public's to the ether3 and connect that -- but I dou...

JJCinAZ

I want to know step by step how to configure this options and also the scripting options for all this Maybe someone else would be willing to assist with such details. There are a number of paid consultants which can help you as well. You should take a look at: http://www.mikrotik.com/testdocs/ros/3...

JJCinAZ

Since you are remote to the site, remember that SAFE-MODE is your friend.

JJCinAZ

When you are in the failed state, look at the ARP table on the AP side to see if it has an entry for the IP on the other side. If so, see what interface that matches. If you have a bridge on the client side (you should) ensure the bridge is using an admin-assigned MAC and don't let it inherit a MAC ...

JJCinAZ

Multicast on PTMP wireless is treated as Broadcast. Think about it, there is really just one path to all clients -- unlike a switch with multiple paths to clients. This also means that the multicast/broadcast goes out at the slowest Basic rate of the 802.11 device not the fastest because the AP must...

JJCinAZ

You can have N number of hotspots so it's asking which one to reset. If you had first done a /ip hotspot print command you would have seen numbers listed next to each (just the one in your case) hotspot defined. Try the command /interface print to see the interfaces listed with indices listed next t...

JJCinAZ

Just add the second public IP to the WAN interface on the router and then setup a new dst-nat rule to match on the new public IP, TCP, and port 80 with a to-address of your local IP you want that sent to. I would also add a srcnat rule to catch the return traffic from that host and src-nat that to t...

JJCinAZ

So you can MAC ping the station from the AP but you can't IP ping the station from the AP, correct? What changed? Yes, I know, "nothing changed" is the standard answer, but something probably did. If you have MAC connectivity and no IP connectivity, then look for an ARP issue. Did you enab...

JJCinAZ

It is not possible to have queue totals saved to disk. You would need to write a polling system (using API or SSH scraping) or a push system (script collecting data and FTP that off the router disk). Search in forums and the Wiki to see what other people may have written. You could also use a system...

JJCinAZ

I've never had those issues with NTOP (http://www.ntop.org/overview.html) or commercial tools from IPSwitch and others. I can't vouch for flowd, pmacct, flow-tools, etc.

JJCinAZ

The Hotspot advertising facility works by temporarily suspending the hotspot authentication of a user on a timer basis and forcing them to go to a URL you specify. If popup's are enabled, this occurs automatically on the users's next browser request. If popups are not enabled, the user must click to...

JJCinAZ

Try this link to find the Wiki info:

http://lmgtfy.com/?q=password+reset+sit ... krotik.com

JJCinAZ

Have you looked at Cacti?

http://www.cacti.net/

If you had an x86 router, you could even try running the Xen package and then you could run Cacti aside the router.

JJCinAZ

Explain the use of the "PPPTP" [sic] in your first post. Did you mean PPP or PPTP? If you're acting as an ISP and you are trying to route through the public's to your customers AND you have a layer-2 connection to the customer, you can use VLAN's to assign to customers. Then you can either...

JJCinAZ

It could not be that RouterOS doesn't work well with d-link switches. Try upgrading to 3.23. Downgrading is not pretty.

JJCinAZ

The VOIP guy who set up the phone system isn't that bright You can't throw a dead cat without hitting someone who's clueless about VoIP. Make sure you are not accidently NAT'ing the traffic moving across the AP. This can occur when you have enabled "IP Firewall" on bridging and you are no...

JJCinAZ

EoIP tunnels are just GRE tunnels and are stateless. They don't have an "up" or "down". They just encapsulate a packet and send it. If they receive a packup, they unencapsulate it. Look for ARP problem and see if the GRE packets are still arriving at your NAS. We have EOIP tunnel...

JJCinAZ

For PPTP tunnel users, you do not need VLAN's. You need to setup one-to-one natting for the users after you setup static/reserved IP addresses for them.

JJCinAZ

You'll have to reinstall OS using NetInstall

JJCinAZ

Try capturing the SIP packets from the customer and open the capture file with Wireshark. Notice the SDP message in the SIP Invite and see what IP the device is telling the SIP partner to send audio back to.

JJCinAZ

tell me why is it ping stabile on wlan1 after I disable wlan2?

Because of self interference? ROS cannot synchronize the transmit on multiple radios, thus you get self-interference. Maybe break the RB433 into two units with some physical separation?

JJCinAZ

I agree with jwcn, those ping times with NStream are normal. As I said before in the thread, however, you need to test ping times with a load on the link not just idle. Without NStream, your pretty, non-nstream ping times will go to hell when you load the link. With NStream, a loaded link will be mo...

JJCinAZ

You can "slow" packets by queuing them using one of the available queuing deciplines available. If and when that queue overflows, it will start to drop packets. Study the queuing deciplines in the documentation.

Search found 475 matches