MikroTik

Tdaddysimi

Also, no forward firewall that could be blocking it.

Tdaddysimi

ip arp print Flags: X - disabled, I - invalid, H - DHCP, D - dynamic, P - published, C - complete # ADDRESS MAC-ADDRESS INTERFACE 0 DC 11.12.0.137 28:C0:DA:2C:E0:01 ether2 1 P 11.12.0.140 00:00:00:00:00:00 ether2

Tdaddysimi

I am still missing something. It is a subnet that I also use as the gateway from my isp. Lets say my router ip is 11.12.0.138/29. The ISP is 11.12.0.137 which my default route is going to. My ppp secret > Remote IP is using 11.12.0.140 and I set proxy arp with that IP to publish that ip. I must not ...

Tdaddysimi

I was missing the proxy arp then. I will try this asap!

Tdaddysimi

I have a /29 of public ip addresses on a mikrotik I remote into in a data center. I would like to be able to assign a public ip an incoming pptp connection. I have tried assigning the static ip i wanted to use on both fields of the ppp secret tab and varrying configurations off that, And have tried ...

Tdaddysimi

The server is plugged into that port but I don't think its interface is vlan aware.

Tdaddysimi

I have a CSS326-24G-2S+ running in production right now with the latest version 2.13 Installed. SFP1 is going to my headend router, port 23 and 24 are going to servers. Port 24 needs to allow multiple vlans to hit it, and port 23 needs only vlan 20 to hit it. I can make 1 vlan talk to 1 port but I c...

Tdaddysimi

I am having an issue. I have a client with a mikrotik router that has a /26 assigned to it to get it on the internet. The client then has a GRE tunnel that has a /25 routed over it. His servers aren't accessible over the gre tunnel. When I vpn to his tik, I can easily access everything on his public...

Tdaddysimi

I am going to try downgrading to version 6 and just running an instance on our internal asn and see if the servers recognize it.

Tdaddysimi

I have a client with internal servers. These servers open up containers that are assigning themselves ip's. The client wants their Cloudcore to be able to run internal BGP for servers to be able to talk to eachother and the router. How easy is it to impliment? I am using version 7 beta 6. I am profi...

Tdaddysimi

The CHR has the VLAN/PPPoE Server. I already have it doing a bunch of vlan stuff with other ports and its doing great. But specifically, i have ether4 unbridged on its own interface with vlan1234 on it. And I want anything that plugs into ether4 to be under vlan1234. I read some of that guide and pu...

Tdaddysimi

I know you could put a switch in and Tag/Untag the vlan on a port to make them only see a vlan that way, but I am wondering if you could do something similar just on a Mikrotik itself. AGain thanks in advance.

Tdaddysimi

Hello Everyone I have a CCR1036. I have a router plugged into it on one of its interfaces. When it dials out a PPPoE Session to the CCR, I want it to authenticate it on the VLAN. I know I could set a VLAN on the router and have it dial out to the CCR and have it work that way, But I want this setup ...

Tdaddysimi

It is running 6.47

Tdaddysimi

Trying to troubleshoot why one particular mikrotik of mine will not establish a vpn or be able to recieve a request from one, just shows the TCP connection in the log hitting the router. When I checked the logs I noticed "secret string is empty? Its an older rb450g

Tdaddysimi

I have found a couple posts but am struggling making a mangle rule that catches the traffic. If anyone has a simple way to achieve my goal, I'd appreciate it.

Tdaddysimi

I have numerous internal ip ranges on my network. I have one 10.2.2.0/24 that is just for l2tp/pptp clients that connect to me. My cell phone connects via 10.2.2.254. I have a VPN server in the cloud at 10.1.1.1. My main lan is 192.168.88.0/24. I do have an IP on my lan of 10.2.2.1 as well for my VP...

Tdaddysimi

Ran a btest this morning with my new ccr1036-12g-4s and reached 438 mbps of the 500 i'm paying for. Not bad!!! Thanks!!!
You provide a beautiful service to the Mikrotik community and I appreciate having a resource like this to test against from time to time.

Tdaddysimi

I have a feeling my public got accidentally put on a ban list. I can ping it from a different connection.
Can you please see if 173.27.22.214 got put on a block list?

Tdaddysimi

Hey Tom,
I can't connect to 207.32.194.24
Is it up?

Tdaddysimi

Any update on this? I have a couple godaddy domains i'd like my tik to auto update to.

Tdaddysimi

After checking the forums, downloading using winbox 3.19 was the fix.

Tdaddysimi

our normal username and password or even using admin, blank, gives you incorrect password error.

Tdaddysimi

I upgraded a couple routers today, from 6.44 and 6.44.X to 6.45.2, and now I can't log back into them no matter what I try. I work for a WISP. One is behind a 5AC client and another behind an LTE client, all bridged out to the Tik's. Please help. Customer Tik is a hAP AC lite.

Tdaddysimi

Your question is very vag and hard to understand. Without knowing the topography or what you're trying to achieve its hard to help you, but typically assigning static routes with set costs for each interface under ip > routes would proibably be your best way to go.

Tdaddysimi

In reference to my forum post on here https://forum.mikrotik.com/viewtopic.php?f=13&t=129790 When an IP tries to hit my router's pptp server and doesn't authenticate or do anything, is there a script to automatically add it to a block list?? Not familiar with scripts or block lists, but I'm sick...

Tdaddysimi

Its easy. Here is how I used dst-nat to access winbox behind a public IP. /ip firewall> add action=dst-nat chain=dstnat comment="DST NAT for \"Tiny Tik\" Moms Wifi Router" \ port=31 protocol=tcp src-port="" to-addresses=192.168.1.31 to-ports=8291 add action=dst-nat chai...

Tdaddysimi

I would double check your routes.

Tdaddysimi

Just connect to your router through a VPN on your phone. I can do this easily on my android, and then view it that way.

Tdaddysimi

jan/17 23:44:25 pptp,info TCP connection established from 174.219.2.123 jan/17 23:44:26 pptp,ppp,info,account phone logged in, 192.168.1.251 jan/17 23:44:26 pptp,ppp,info <pptp-phone>: authenticated jan/17 23:44:26 pptp,ppp,info <pptp-phone>: connected jan/17 23:50:20 pptp,ppp,info <pptp-phone>: ter...

Tdaddysimi

I do a mixture of both. Most of my devices I do manage individually by IP, the rest, like at my moms house (also part of my LAN through a wireless bridge) is behind her own mikrotik, and then I just make a QOS rule to the IP of her tik, and then do QOS inside of that tik depending on whats going on....

Tdaddysimi

Or just install the free local controller software and run it on a pc. I did that and port forwarded it in my Mikrotik so now I can access the GUI from the web, similar to how a "cloud key" would operate

Tdaddysimi

I believe with the CHR you'll be limited to 1 mbps / 1 mbps with limited functionality, but for testing/playing it should be good.

Tdaddysimi

The easiest would be to assign different ranges of IP's per que, and make a different rule for each IP range, although that tends to get more CPU hungry.

Tdaddysimi

I just subscribe to a free dyndns service, like no-ip.com. I have a pc thats on already 24/7 on my network run their free client that updates the public every 5 minutes, and then I can connect my vpn clients (mainly my phone and travel router) to xxxxxxx.ddns.net and my vpn works flawlessly behind a...

Tdaddysimi

Always wondered about your method though, but never could get verification when I pursued it in the forums, so I found a better source of internet and created a wireless link instead of using a dedicated computer and phone.

Tdaddysimi

What i did was just USB tether my phone to a dedicated PC on ether1 of my tik, and set the 0.0.0.0/0 routing rule to a 192.168.1.XXX I addressed the pc, and then go to the adapter settings on the pc (I was running windows 7) and enable internet connection sharing, and viola! I was stuck behind veriz...

Tdaddysimi

Post an export of your routes.

Tdaddysimi

My mAP is amazing. I set the primary wireless card and Ether1 on a bridge, and set it up as a dhcp client to pull an address from whatever it connects to. I then created a second bridge for the virtual ap and Ether 2, and set them up with a dhcp server that nats out to the internet. Then, I was able...

Tdaddysimi

Why wouldn't you bridge both those out and let the tik dial out the pppoe or the connection? Maybe not with the lte but atleast with your primary. Double nat is no fun.

Tdaddysimi

Works seamless!! Thanks!!

Tdaddysimi

Anyone?

Tdaddysimi

I have a rather large network all on 192.168.1.XXX with two default gateways. My main gateway is at 192.168.1.14, which is a RB450G that goes to my primary cellular connection. Because its cellular, it doesn't have a routable/pingable public IP, but i get decent bandwidth. I have another gateway at ...

Tdaddysimi

please type /ip route export and show us what routing you have in place. I believe your IP ranges don't know how to talk to each other.

Tdaddysimi

I just found it interesting and worth sharing.

I use a robust firewall, only limit certain IP Services to certain IP's, and all my passwords are complex.
But anything mentioning MikroTik is worth mentioning here.

Tdaddysimi

I figured it out.. I wanted the customer to only be able to see their DHCP and Wireless and withhold everything else. Using webfigs "Skins" I was able to achieve this.

Tdaddysimi

If you have a tik at the headend, you can just "torch" the traffic onsite to see a live picture of whats doing what to what IP

Tdaddysimi

Otherwise I guess I don't really understand the question, you didn't make it very clear. If you get 8 mbps of download per wan and each is running at 7.5, the problem might be from the ISP and not the Tik.

Tdaddysimi

It looks like each interface is running at 7+ mbps. Are you confusing the MB of your file transfer with your interface speed of Mbps???

Tdaddysimi

Absolutely. You can create a bridge and add them all to it. Or else hardware switch the switching groups and then create a software bridge between the master interfaces.

Tdaddysimi

@sizeofbool if you're just using the internal btest function to test your mini, you wont be able to reach the maximum available throughput that way regardless due to the intensity of btest on the cpu.

Tdaddysimi

I can't find ANY documentation on this. Would like to provide a couple basic functions to a customer and retain the rest. Customer would of course be restricted to access to only certain things on LAN. We would have full management through WAN. Can anyone help me with this??

Tdaddysimi

According to https://research.checkpoint.com/new-iot-botnet-storm-coming/ There is a new botnet more powerful than Murai, and it does state it can grab Tik devices, It lists possible vulerabilities as: MikroTik RouterOS SNMP Security Bypass – MikroTik RouterOS Admin Password Change – Mikrotik Router...

Tdaddysimi

It sounds like they may be too far away from the AP.

Tdaddysimi

If you reset the Mikrotik to the default config, the firewall supplied is pretty good.

Tdaddysimi

Its dynamic and it changes every 12-24 hours, but right now its 174.219.139.207.
Its a verizon wireless IP. my network is bridged off from my lte connection via cellular

Tdaddysimi

It sounds like you may be bottlenecking your internet connection.

Tdaddysimi

And I wouldnt have this router connected to the internet until you're done securing it.

Tdaddysimi

Could not connect to Planetcoops but could connect to Toms. From one Tom to another, thank you! great way to test out my small pipe when needed.

Tdaddysimi

Still isn't working, so I have found other means for now. Thanks @djfrancis. Glad to see the rest of the community is just as helpful... *cough cough*

Tdaddysimi

I have created that static route everywhere. I can ping from the terminal of any mikrotik and ping 10.10.10.20, but unable to pull up the devices webpage or anything like that. I have disabled all firewalls during debugging.

Tdaddysimi

Anyone?

Tdaddysimi

Correction: I can ping from any terminal in any mikrotik on my network of 192.168.1.XXX to my test radio of 10.10.10.20, but any normal PC cannot.
What am I doing wrong? I have disabled my entire firewall on my headend router just incase it was blocking it to no avail.

Tdaddysimi

There are no firewall rules. Just the NAT rule.
Arp is enabled.

Tdaddysimi

I had this issue with port 1 of my MikroTik Powerbox. Try lowering the MTU. That was the only resolution I found.

Tdaddysimi

After applying that nat rule and deleting the incorrect one, I still cannot ping across. [admin@Hex POE] > ip route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit # DST-ADDRESS PREF-SRC GA...

Tdaddysimi

Sadly im a GUI guy.
I have no idea what i'm doing in CLI yet.

Tdaddysimi

I understand the masquarade rule is probably wrong and I should be NAT'ing differently somehow. (almost bricked it, defaulted router and tried to revert back to my config as close as I could.) I just wanna know how to resolve both CLI and using Winbox GUI. I have a good grasp on most of it besides t...

Tdaddysimi

[admin@Hex POE] > export # sep/26/2017 21:34:22 by RouterOS 6.30.4 # software id = GDDY-RMN2 # /interface ethernet set [ find default-name=ether1 ] comment=WAN set [ find default-name=ether2 ] comment=master set [ find default-name=ether3 ] master-port=ether2 set [ find default-name=ether4 ] master-...

Tdaddysimi

So port 1 is set up to recieve DHCP from my 192.168.1.XXX/24 network. The router is assigned 192.168.1.12 from DHCP on that network. Ports 2 - 5 are hardware slaved, with port 2 set as the master. Port 2 has an address of 10.10.10.1/24, and there is a DHCP server going from 10.10.10.10-10.10.10.20. ...

Tdaddysimi

Are you unintentionally blocking it in your firewall?

Tdaddysimi

For only letting certain things on and limiting all else, simple queues will be the go to answer, configured easily inside the mikrotik. its mainly used for QoS and limiting user's speed. On my network, I have my file servers and what not with unlimited access, but of course when my younger cousins ...

Tdaddysimi

Some select UBNT devices can run some cambium software but it is not recommended. Mikrotik devices are extremely cheap, along with UBNT. Mikrotik for the more advanced routing options with its RouterBoard OS and UBNT with its more simplistic easy to use GUI. I prefer to use a mixture of both, as Mik...

Tdaddysimi

Honorable mention: PRTG

Tdaddysimi

Its a samsung phone on verizons netowork. Thanks for your help!

Tdaddysimi

Do all network equipment (but radios on 10.10.10.0/24) use 192.168.1.116 as default gateway? Yes. This is just a PC on port 1 of the RB750G with a cellphone tethered to it via USB. All traffic is routed to the .116 as the gateway. Thats the only way I can get internet out in the sticks here in MN. Q...

Tdaddysimi

I'll get you a diagram after work. :) Basically Tethered phone ---> PC dedicated for internet @ 192.168.1.116 <--- Internet Backbone RB750G @ 192.168.1.14 ---> <----Lan Backbone (also 750G) @ 192.168.1.28 -----> <--- Switch @ 192.168.1.13 ---> <------ Powerbox @ 192.168.1.17 -----> WLAN Radio Networ...

Tdaddysimi

[admin@PowerBox - Mast Router] > ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 10.10.10.1/24 10.10.10.0 ether2 1 D 192.168.1.17/24 192.168.1.0 ether1 [admin@PowerBox - Mast Router] > ip route print Flags: X - disabled, A - active, D - dynamic, C - conne...

Tdaddysimi

After Changes. undid the 192.168.1.0 address because it over-rode my dhcp client and lost my address of 192.168.1.17 to it. Applied NAT [admin@PowerBox - Mast Router] > export # aug/15/2017 12:57:03 by RouterOS 6.39 # software id = 0XYE-X9HZ # /interface ethernet set [ find default-name=ether1 ] com...

Tdaddysimi

I've tried natting and still can't get it to ping. just adding a srcnat and dstnat. am i missing anything?

Tdaddysimi

Ive added routes on my tiks on the 192.168 side to route all 10.10 traffic towards the powerbox also

Tdaddysimi

I added that, and still can't ping over from my pc on the 192.168 side. Is it NAT or something like that?

Tdaddysimi

I have a 192.168.1.0/24 network and i'm trying to seperate my wireless links some on their own 10.10.10.0/24 network but I can't ping across it. Played around with NAT, etc. Can't ping from the 192.168.1.0 network over :/ Trying to learn but stuck. # /interface ethernet set [ find default-name=ether...

Tdaddysimi

I'm just looking for a simple yes it will work or no it wont....

The UBNT forums are more responsive than this..

Tdaddysimi

Tdaddysimi

so with that usb port for a 3g/4g modem, could I plug a usb cable into there and into my phone, enable usb tethering, and then share my connection through that usb port?? Currently doing it through a dedicated computer going into port 1 on a RB750G with a static ip on my lan and then send all intern...

Tdaddysimi

My only internet access is currently Verizon, and my phone is tethered to a laptop being shared at the head end of my network routed through a RB750G at my headend (I have 5 other tiks inside my lan). I was told I need to use SoftEther to create a VPN behind verizons double NAT. How do I tie in my R...

Tdaddysimi

I ended up lowering the MTU levels and it resolved.

Tdaddysimi

SO I've created a backup of a haplite to use as a template for a few haplites I purchased.

When I install the backup onto the next haplite, it copy's the mac to each new one, and it seems like my wireless settings don't carry over.

Thoughts??

Tdaddysimi

You have to route them. If they dont have a route to know where eachother are, they wont communicate. Create 2 routes. one for the range of existing to the range of the new ones, and vice versa.

Tdaddysimi

Know where to find it in the GUI?

Tdaddysimi

Anybody know of some simple queues that will work on my Powerbox? Just looking to throttle people's internet traffic by ip address, my mangle export from my RB750G didnt work. (I'm a supernoob)
Any advice would be appreciated!

Tdaddysimi

I thought so too, but I called verizon up and got it clarified, and the 70 GB of unthrottled data is proof that it works! I have 3 roomates, and lots of pc's and they all run flawless with only the aid of a couple simple queues. Thanks for the advice man!

Tdaddysimi

I need it tethered through the phone. With verizon's unlimited plan, tablets, hotspots, etc are throttled after 10 GB of usage. With phones though, that rule doesn't apply. So being so rural, I activated another phone onto my plan, and now i've done 70 GB off the 35/15 connection of my phones 4g wit...

Tdaddysimi

I have everything tethered through a phone dedicated to internet.. lol but the rest of that makes sense.

Tdaddysimi

If you can't set those limits from the radius server then you're probably using a crappy one.

Tdaddysimi

Its an issue with verizon. I dropped all my firewall rules for the time being. Nobody on the outside cant ping my IP. I just need someone with some experience whos tethered their whole network to the internet off cellular data to figure out how I can have access to ports on my lan out to the interne...

Tdaddysimi

So right now until the WISP I work for extends coverage to my area, my only rural option is my astounding Verizon phone (35/15 w/ 50ms latency) tethered to a computer onto my network. At home I have the powerbox, 2 RB 450G's (one as my backbone) a mAP, and some ubnt radio's. Anyway, I want my buddy ...

Tdaddysimi

I'm using the injector that came in the original packaging, and thats plugged into a backup battery/surge protector. I'll verify the versions and monitor the power anyway. Any other suggestions?

Tdaddysimi

Anyone?

Tdaddysimi

I purchased it brand new from ISP supplies. Should I just try to return it??

Tdaddysimi

I seem to have the infamous powerbox problem, where spuratically my powerbox will glitch out for roughly 5 seconds and then come back. Most of my network activity goes through my Powerbox and the constant drops suck. I have already enabled the long cable setting, to no prevail. Any help would be app...

Tdaddysimi

I tried /interface ethernet poe settings set ether1-poe-in-long-cable=yes and it still cuts out spuratically

Tdaddysimi

I seem to be having the same issue. I have it fed with power via POE, powering my Ubiquiti AP's (just a 900 loco and a 2.4 loco). On my AirControl server, im seeing them powercycle. The Powerbox is fed from my backbone, and im seeing that port go up and down. (backbone is 2 RB450G's). If the long ca...

Tdaddysimi

or just give them read priviledges instead of full when creating the user.

Tdaddysimi

http://forum.mikrotik.com/viewtopic.php?f=2&t=117984

Tdaddysimi

Just bumping your post, wanna see the solution as well.

Tdaddysimi

This is one of the smartest networking guys I know.
He also has a crazy amount of helpful MikroTik Youtube Videos that are actually very in-depth and easy to follow.
Once I am online, I will only go to him for any consulting needs!
http://gregsowell.com

Search found 108 matches