MikroTik

CZFan

sounds like you might have "tkip" ciphers enabled in security profile

CZFan

...
however, I still have no communication with the other party.

Reason above did not work is you added:

add bridge=bridge1 interface=sfp-sfpplus16 pvid=2500 tag-stacking=yes

CZFan

My config: add ether-type=0x88a8 name=bridge1 protocol-mode=none vlan-filtering=yes /interface bridge port add bridge=bridge1 interface=sfp-sfpplus16 pvid=2500 add bridge=bridge1 interface=sfp-sfpplus1 /interface bridge vlan add bridge=bridge1 tagged=sfp-sfpplus1,sfp-sfpplus16 vlan-ids=2500 from th...

CZFan

not talking about "Test Results"

is announced in a video, which tells me it should be available, the video did not say "we will "try" and add IPSec HW Offload in future releases..." See below for the ac³ device

CZFan

https://www.youtube.com/watch?v=A_5NdEEjEgE

Time 1:55 /4:01

1. Not all have time like you available to sit and watch videos all day.
2. It was a "Tongue in cheek / devils advocate" type post so that Mikrotik can sort out their documentation, although I doubt it achieved that

CZFan

You can add vlan 258 and a second pppoe service on that vlan, alternatively, vlan translation

CZFan

Bit disappointed, seems no IPSec hardware offload on the hAP ax² and ax³ devices.....

CZFan

... I am not sure what else is needed at this point. The documentation is lacking for v7 and 90% of the info out there is for v6 BGP. For a router that touts BGP performance, the lacking documentation and bugs is concerning. This is not a Mikrotik issue, but the way iBGP/eBGP protocol works. Mikrot...

CZFan

VRFs come more into play when you have a big network, something like an ISP/WISP, etc that provides branch to branch connectivity for clients as example, many times there can be overlapping of these clients internal IPs, and to isolate them to route them accordingly, you use VRFs

CZFan

Hi, Hope someone can help me here, I am trying to do a print in firewall connection for a specific port number, but not getting results I expected. I tried all the below commands, the first one returns all with 500 in it, i.e. 500, 50018, etc, the last 2 seems to be not "supported" by Mikr...

CZFan

Post full configuration export, screen shots shows only part of config But there 2 things you really need to look at after separating the subnets. One being that the vpn subnet is allowed in relevant chains in firewall on mikrotik, and second is you will need to add the vpn subnet on the windows fir...

CZFan

They way your config is at the moment, i.e. vpn and LAN on same subnet, you will need proxy arp, which I do not suggest.

Rather give your vpn a separate subnet to the LAN, and then route / firewall between these

CZFan

Which model do you have, RB450G or RB450Gx4?

Two different chips and needs to be configured differently

CZFan

You should review the conn/pkt mark and queue tree config, you typically use the "leaving" interface for this, i.e. outgoing traffic on the internet facing interface for upload traffic limits, and outgoing traffic leaving the "bridge" interface towards LAN devices for download tr...

CZFan

without seeing full config / connection diagram, it is difficult to suggest any fixes. As mentioned already, data transfers in local network should not go via the router and should not affect the transfer. There is possible 3 reasons why local traffic will cause limitations via the router: 1, Separa...

CZFan

Devices such as Android tries to access "special servers" to see if it has internet connection or not and if it is behind a captive portal setup, i.e. http://connectivitycheck.gstatic.com/generate_204 http://www.google.com/gen_204 https://www.google.com/generate_204 So you could possibly a...

CZFan

in routing filters, in in filter, set prepend on backup link, although this does not always work so well anymore, then "set bgp weight" for the primary / backup links, i.e. set it to 10 for backup and 15 for primary You could also just set bgp weight for primary to 10 as example, default i...

CZFan

also like the antenna gain

Wireless antenna max gain 2.4 GHz (4.5 dBi), 5 GHz (4 dBi)

Looking to be a good performer in a "standard" house

CZFan

Never tested it, but I suspect it will not disable the ethernet interfaces in that bridge/switch group, but will disable any bridging/switching so you will lose connection to other devices, and also disables this CPU access via the ports in that bridge, hence reason you will not be able to access de...

CZFan

Eish!!!! And I just upgraded from AC2 to AC3 a couple of months ago, now I have to buy a new one

But glad it is eventually here though

CZFan

try something like if NTP server is mikrotik itself:

/ip firewall nat
add action=redirect chain=dstnat dst-port=123 in-interface-list=LAN protocol=udp

CZFan

For a Dahua NVR at one of my clients, I had to forward the following only:

TCP 443,554,37777
UDP 37778

Maybe check your NVR requirements again?

CZFan

By making use of vlans.
For cabled, you will have to do the vlan tagging from client devices, on wireless, you can create 2 separate SSIDs and tag these accordingly

CZFan

Change add check-gateway=ping distance=1 gateway=192.168.1.1 to

add check-gateway=ping distance=2 gateway=192.168.1.1

CZFan

I really am struggling to understand why Mikrotik does not list all changes made in updates, I.e. as I just found out changes were made in Bridge filtering....
@Normis, can you please respond on this?

CZFan

Oh, thank you so much!, its possibe to disable or remove? thanks
Why?

Proof again you can't please all, everytime

CZFan

...that last part about copy-pasting from txt editor was just rude.

Seriously?????

CZFan

....
I am still able to connect successfully to Mikrotiks running 6.47.9 and 6.47.10 from Windows 10 with KB5009543 installed...

I was unable to connect with L2TP/IPSec VPN to any of my clients, ROS ranging from 6.45.9 LT to 6.47.10 LT

CZFan

Anyone seen an issue with the CCR2004 on ROS V6.49.1 where there is packet loss each time BGP needs to converge its routes? If the routes from the remote peer are stable, then there is no packet loss across any interfaces. As soon as the CCR2004 needs to converge received or withdrawn routes, CPU g...

CZFan

connection oriented or connectionless protocols have nothing to do with this, this only comes in between the two end devices.

This is only relevant to firewalls, connection tracking uses both src and dst addresses with the src and dst ports to decide of it is a new connection, established, etc

CZFan

My understanding is that there is no "Route Caching" in ROS7, hence the jump in CPU utilization from V6 to V7.

CZFan

i use RouterOS v6.49.2 and some days ago...

But V6.49.2 was only released today????

I think you have sort of isolated where problem is yourself, i.e. look at your firewall rules

CZFan

The Ubiquiti WIFI U6 Pro is cheaper than the TPLINK eap660HD by about $80 and thus may be excellent value IF, IF it can be configured in a stand alone mode.

Last I checked, this is a Mikrotik forum?

CZFan

I think your best option is going to send copies of config / supout file to MT support

CZFan

assuming ether2 is the downlink, you seem to be missing uplink in bridge port/vlan config

CZFan

I read about a month ago that ROS does not support Cert only authentication, not sure if this applies to your situation .
If this has changed since, I can't say either

CZFan

This comment tells me you don't understand how MikroTik works as a company. Without specifics nothing will change. If all you want to do is share your frustration and anecdotal results with the WiFi performance, no big deal, but it doesn't really benefit anyone. +1 Where is the "Like" but...

CZFan

You give no description re symptoms why it is not working!!!
It seems you are making ssinf some attributes in your port forwarding rule, name destination address and or in interface / list

CZFan

Communicated with you re this topic on FB, want to test in lab environment before I can give further comments, just have not had time to test in lab...

CZFan

You can play around with logging rules, i.e.

/system logging
add topics=route action=memory prefix="Route Changes"

CZFan

B) Dst. Address → your WAN (Public) IP

You can use "in-interface/list" instead

CZFan

To add to what @sindy said, the other IPs in that prefix might not be available to you, i.e. might belong to devices on the link to you, etc...

CZFan

1. The firewall rules on the Mikrotik seems to be as per default, so firewall probably dropping the packet coming in on WAN interface . 2. Have not tested your scenario, but suspect if you resolve point 1 above, the Mikrotik is going to send an icmp redirect packet back to the laptop telling it to u...

CZFan

...If i remember previous version was 6.37

That is a "massive" jump between versions, I suspect there might be config problems on your side

CZFan

1st point will be for you to define "backup"

Backup is there only to restore to the existing / same hardware device, for others you need to do export of config, reset new device and import config

CZFan

IP Address should be attached to Vlan interface, not ether interface

CZFan

... I would like to use this script, would you mind changing it to monitor 2 devices on innerweb, i.e. ping both 8.8.8.8 and 1.1.1.1 and if both fails, then take action? Nevermind, think I have it working... :global ltestatus :if ([:typeof $ltestatus] = "nothing") do={:set ltestatus "...

CZFan

Too much strict, someting can fill the connection and reboot the device without reason...

Agree, but it is what he asked.

I would like to use this script, would you mind changing it to monitor 2 devices on innerweb, i.e. ping both 8.8.8.8 and 1.1.1.1 and if both fails, then take action?

CZFan

@pigsfoot, I think what you looking for is:

[:ping 8.8.8.8 count=3] = 0

This will send 3 ping requests, if all 3 fails, then do what is required...

If not, you will have to elaborate on your requirement

CZFan

I would rather reboot the "modem" instead of the router, that way you still keep the logs, etc below amended script from @rextended: :global ltestatus :if ([:typeof $ltestatus] = "nothing") do={:set ltestatus "offline"} /interface lte :if ([:len [find]] > 0) do={ :if ([...

CZFan

Yes, it does actually. ...

Not sure if above refers to my post saying hEX S switch chip does not support Vlan tables...

CZFan

/interface ethernet reset-mac-address ether1,ether2,...

CZFan

Not sure exactly what you want to achieve, and will probably just cause a lots of retransmits of packets in your network, but maybe below is a starting point which you can expand / amend to your liking with additions like connection marking, etc. /ip firewall filter add action=drop chain=input nth=5...

CZFan

The VLans are assigned to the the bridge in PORTS How a trunk port is made in mikrotik then... The interface directly connected to CISCO ( which is ether1) will create a trunk Clearly you have not read the link from @sindy!!! Your config is based on the "old Mikrotik Vlan" method and not ...

CZFan

With lack of complete view, I am failing to understand why you think the >25Mb/s multicast will kill the hEX S?

If you need to change this, this is where the trusty old RB2011 will shine

CZFan

hEX S switch chip does not support Vlan tables

CZFan

..
ppp, mpls, and routing are the usual candidates for disabling.

Personally, I would leave ppp, as this might be needed for VPN / PPPoE. I typically remove/uninstall the following on small client CPEs:

hotspot

ipv6

mpls

routing

I also remove wireless if not required

CZFan

this has been discussed "ad nausea", try the search facility some times...

Options are:
1. Netinstall, or
2. Only install "services" that is required

CZFan

link, not icon???

That will depend on you age I suppose

CZFan

Icon???

Link!!! ???

???

CZFan

Silly question, but you did update any existing icon properties to reflect new folder?

CZFan

...
Since the setup is created as only 1 NIC --> Could I create the VLAN1 og VLAN2 - and create the same VLAN on the NIC in VMware - and split it that way instead
...

Yes, segregating the connections using Vlans is good to go

CZFan

Actually repeating the same process with the same netinstall version made no difference.. so that was not the case... In the case i described the router was showing fine in the list... pressing the install button made no progress... I 've come to this situation just 2-3 times with the same laptop t...

CZFan

/int bri por is expanded to /interface bridge port-controller for some reason.. just don't abbreviate cli commands, they are suspected to change anyway.
...

Yes, that will explain it, thx, tested and that is the case

CZFan

On 2011, trying to print bridge ports, I get the following:

bridge-port.JPG

When I export, get below:

bri-exp.JPG

CZFan

Not Mikrotik related, but uptime related :-) Went to a client in approx 1997/98, it was a bakery baking high volumes of breads for shops. The callout was for to setup / connect a new user to their network. The Novell 3.x server used as a F&P server, dust, backing powder, etc all over the server,...

CZFan

Looking at your config, it seems you have not reviewed the wiki article, see ink below:

https://wiki.mikrotik.com/wiki/Manual:B ... g_Stacking

Welcome to come back if still experiencing problems after following article above

CZFan

IIRC, in Google Chrome you can set your geolocation to something you specify manually, this is not the case?

CZFan

...
The above l2tp-out go to the CCR1009.
...

How is your VPN connections to 1009 working?

client-->L2TP/IPSec-->CCR1009
or
client-->hEX-->L2TP/IPSec-->CCR1009

CZFan

I dont see how this is possible, your local public IP should not be routed to remote country via the internet, so you must be breaking out locally and not using the VPN when you think you do.

Best will be to post config of both devices, also check routing on client devices

CZFan

Post results (between code brackets) of 2 commands below

/ip firewall mangle export
/ip route export

CZFan

CZfan should the OP look at the new 5009 its in the same ballpark $wise but seems to be more powerful ???

For me personally, the jury is not out yet on the 5009, so for a production box, with only ROS 7 which is not out yet either, don't think so

CZFan

/ip firewall nat add chain=srcnat src-address=10.10.10.10 dst-address=192.168.30.150 out-interface=<WhatEverInterfaceIsConnectedToTP-Link> action=masquerade

CZFan

I public department, we spend less than U$20 per 1Gbps link, but we don’t have money to buy lots of CCR, I live in Brazil, one CCR costs the same as an good car..

You dont really need a CCR, a RB4011 will run circles around the CRS125 without breaking a sweat

CZFan

You will have to ask ISP to configure port forwarding for PPTP on their router pointing to your router address.

CZFan

That should not happen, create a support ticket by sending details to support@mikrotik.com

CZFan

Can be, will have to wait for OP to clarify, but to quote OP:

the WiFi connection is broken and the changes made are reset before the apply button is pressed!

CZFan

This is true for all configuration methods. Changes to access list will restart the wifi interface. Do this only from a wired connection, or simply be aware of this limitation

Understand that wifi interface will restart, but why is changes not applied?

CZFan

@BlackRat, the setting you highlited is IMO invalid. It's not logical to have address with network address set to same value....

It is a /32 address, and usually used for loopback interfaces

CZFan

Alright. I see we have a few "gaming" home PC builders here. Firstly, the "rules of thumb" of gaming PC building do not apply to switches. Even if they did, a lot of people spread dumb "rules" out of ignorance in the PC gaming communities. ... I removed their special r...

CZFan

It can differ a bit depending your exact config, but if the IP of the VPN client is static, it can look something like below: /ip firewall nat add chain=dstnat dst-address=10.8.0.2 port=8081 action=dst-nat to-addresses=192.168.123.1 to-ports=80 Instead of dst-address, you can also use in-interface/l...

CZFan

"Getting fibre" means nothing to me, i.e. here we have soooooo many people on fibre with packages 5Mb/s - 50Mb/s

Something in between the hEX and 4011 series, is also the hAP AC², very nice little router

CZFan

Applied it successfully on a CRS326 a couple of years ago

CZFan

I suspect your problem is you don't have a route via the backup ISP, add a default route to this with distance of 3 and test

CZFan

Had an incident with a client of mine recently where they peer with a Internet Exchange at data centre routing +- 200Mb/s on a 2004. The Internet Exchange route server sends constant route updates in BGP which causes the 2004 CPU to spike to 30% utilization every +- 45 seconds, when this happen, any...

CZFan

Is this the "full" config, i.e. there is no Firewall Filter rules?

If not full config and there are firewall filter rules, then make sure you have a rule that allows Destination NAT

CZFan

You can manually calculate costs using formula below to get similar costs like Cisco

Cost = 100000000/bw in bps.

CZFan

Post current config after changes made

CZFan

...But i ve seen other posts too with problems configuring a /31 subnet between two Mirkotiks

official word from MT Support is that ROS does not support /31, have to use /30 or alternatively ptp addressing /32

CZFan

Yep but default Firewall Rules are not useable when i'll try to reach a network via VPN and everything is block by an deafult firewall rule which blocks everything not coming from lan... Next Time i use safe mode till then reset and reconfigure is what i have to do :) What you can do is add interfa...

CZFan

First, thanks for have spent your time to do the graph. ... To add to this extensive list of incorrect configs on your device, you also have ether 2 as a slave port of the bridge, but have IP config 192.168.1.0/24 directly on the slave port which can possibly be the issue. If ether 2 should be part...

CZFan

Hello friends, what I will ask here is that it is duplicated in many forums but I cannot find something that can help me and I have configured it in the possible ways. I have a mikrotik 4011 in production with 200 clients, I manage them by pppoe with plans of 5 and 15mb, configure queue tree + pcq ...

CZFan

Look at PC firewall settings, Windows firewall by default drops packets for "new" connections not from local subnet

CZFan

... I just tried ... and IPsec works just fine without setting local address. Seems it automatically takes local IP address of interface used when routing towards peer. For most users that'll be interface used by default route. Hmmm, Yup, just tested and seems you are correct. I guarantee this was ...

CZFan

In what cases do I need to specify addresses for both ends of the IPIP-tunnel, and in what cases it is not necessary?
I tried a IPIP-tunnel without addresses - everything works fine.

When you enable IPsec encryption you will need to specify a local address

CZFan

If both devices are on the desk, then maybe get some more space between them, as the radios are probably screaming at each other and causes noise

CZFan

I think the best in a case for above is to contact a certified Mikrotik Consultant in your area.

These guys pay big money to ensure they have knowledge and skills and are there for things like this to assist

https://mikrotik.com/consultants

CZFan

No, we dont use wds right now, but wanted. We need to avoid the "disconnection" and "reconnection" everytime a device changes from AP to AP in our wireless enviroment, avoiding the need to get a new IP address. We have 2 SSIDs in Virtual APs, ("Corp" and "Guest&qu...

CZFan

You are missing the bridge interface under bridge vlan table for vlan 999, need to add bridge as tagged interface

CZFan

I would start by looking at MTU configs

CZFan

... Now, the client must send a REQUEST for that address and the DHCP server answers with a REPLY and at that point the address is bound to the client. ... Just for correctness sake, the server does not answer with a REPLY message, but with an ACK, aka Acknowledge. Process is is called DORA, i.e. D...

CZFan

2 things:

1. If you installed the "ntp" package, it changes the look/feel of the ntp client, and you will have to use scripts to make use of the FQDNs

2. If not, then see screenshort below for using FQDNs with ntp client

mtntpclient.JPG

CZFan

Tell Google that; it's time1.google.com. Yes, .0 is a perfectly legal address, depending on the netmask.

Snap!!! :-)

CZFan

216.239.35.0...
I know for sure that is not an NTP server.

Not sure I understand your reasoning, but an IP ending with .0 is a perfectly legal IP Address. Seems also it is Google Time server

googlentp.JPG

CZFan

Please read at start wiki about LTE
...

@SiB,

Would you mind posting an URL for what you refer to above, I am also currently struggling with LTE connection and looking for same info as per OP but cant find any info, been googling for last 2 hours

CZFan

Does anyone know where I can get LTE status / error code descriptions.

Trying to connect a Mikrotik LTE router with a private APN SIM Card, but get message "not registered, state 3" message but cant find any info on this

CZFan

Solved, seems it does not like the "-" in the function name

CZFan

I am trying to create a function / probe but just not getting any results. The function is suppose to report the interface utilization. Below is the Function "In-Utilization" code: if(oid("1.3.6.1.2.1.31.1.1.1.6.13"),round(rate(diff64(oid("1.3.6.1.2.1.31.1.1.1.6.13"))*8...

CZFan

If I may interject here, Will be good to understand what exactly the OP wants to achieve, but SSTP is a "service" on the router, and will accept from any IP Address configured on the router depending firewall rules. You dont bind SSTP to a specific IP per se. With SSTP and Road Warrior con...

CZFan

Thank you @mkx, appreciate your response/feedback

...
Just to be sure modem doesn't emit smoke...

I did run the "no-smoke.bat" file, so all should be ok :-) (Giving my age away here again)

CZFan

STP is the symptom, and is behaving as per design, i.e. block/disable ports where there are network loops.

This is more to do with physical connections than config...

CZFan

Analogy, to build a wall you can stack the bricks on top op each other, or "Optionally" use cement mix between the bricks Wonder which is the correct way??? another thing, these thermal pads seems to be fairly difficult to get hold of, i.e. I have to do a round trip of 100km from where I a...

CZFan

Yes, problem was with stp! Somebody can elaborate why stp was problem and is only solution to disable it?

I don't think the problem is STP, I rather think you have a loop in your network

CZFan

hmmm, and everyone will go and read that?

CZFan

@normis et al A customer of mine bought 2 x LtAP LTE6 kits and 2 x R11e-LTE6 modems and dropped off by me to install for him. Following the instructions as per Mikrotik, thermal pads needs to be used on the 2nd modem installed in the router. My question is why is the thermal pads not supplied with t...

CZFan

Have the following, "LtAP LTE 6 kit + R11e-LTE6 + External Antenna" but have a couple of questions if someone does not mind to assist. 1. As per attached pic, the "tabs" that can be broken off to provide place for cables/connectors/etc, the ones on inside (white plastic) does not...

CZFan

You will need to enable proxy arp on the internal facing interface

CZFan

Yes, relevant routes needs to be in place, depending on the public IPs / setup, you do not have to have multiple routes, i.e. lets say the ISP issues (Not routed to you) a /29 range, 1 address will be used for the next hop gateway with 1 default route, you can then assign the other 5 on your WAN int...

CZFan

Why don't you do it the right way, i.e. Log a call with whoever does the IT and explain the problem so it be dealt with

CZFan

.. Is DNS attack by bots , I guess You are not "really" being attacked, but are being used to attack some other internet user If this packets are not dropped, it will have an impact on your upstream link as well as use additional resources on your router though. Will be better to drop the...

CZFan

...SIP packets falling foul of MNDP.

I had a search of the forums but couldn't find the post you mentioned

viewtopic.php?f=21&t=171035&p=840920&hi ... dp#p840552

CZFan

@networquk, pleasure, glad I could be of some assistance

@sindy, you are a blessing to the Mikrotik community, thank you and also thanks for the explanation, makes more sense to me now

CZFan

In 2016, when I had 1Gb/s fibre at my place, I used a 2011 and could get speeds of +- 850Mb/s to speedtest.net. +- 15 devices on the LAN/WLAN and approximately 15 FW rules + NAT, fasttrack enabled. Was not on a PPPoE connection but DHCP with the ISP. Only other difference was the WLAN was not part o...

CZFan

As a minimum, you should have the following: /ip firewall nat add chain=srcnat src-address=LANIP1 action=src-nat to-addresses=WANIP1 out-interface-list=WAN add chain=dstnat dst-address=WANIP1 action=dst-nat to-addresses=LANIP1 in-interface-list=WAN nat add chain=srcnat src-address=LANIP2 action=src-...

CZFan

My understanding is as follow:

Netmap - Maps IPs 1:1, so must be 1000 IPs to 1000IPs, i.e. a /22 to a /22
Same - You might have 1000 IPs mapping to 255 IPs, so the NAT will try and use the same NAT IP map per src/dst address pair, if src and or dst is different, it might use another IP to map/NAT to

CZFan

Did you restart the router after disabling fast track? if not, the fasttracked connections in connection tracking table will stay active till timeout, and if active traffic on these connections can stay active indefinitely. Your firewall accepts established related packets, so should the phone initi...

CZFan

The setup script adds a NAT rule automatically

CZFan

Without seeing your config, it is just a guessing game. Torch disables a couple of things while running, i.e. Fasttrack, so if you have perhaps mangle rules for the phones and have fasttrack enabled, disable it, restart router and test If it does not solve the problem, post your config between code ...

CZFan

Have you tried reading the Mikrotik wiki to understand how Same and Netmap works and what the difference is?

CZFan

... This is default config! Better option is to set IP to bridge? Thanks. If that is "default", then you have very old ROS version, then better you upgrade, then reset config to default and start again Yes, IP should not be attached to slave interface, should be on master, i.e. bridge int...

CZFan

couple other things incorrect, you have IPs assigned to slave interfaces on both sides, i.e on ether 2 which should be on the bridge interface

CZFan

See below re raw vs tagged

https://tools.ietf.org/html/rfc4448#section-4.4.1

CZFan

IIRC, you use tagged type when you make use of service tags inside VPLS cloud

more info below

https://tools.ietf.org/html/rfc4762#page-11

CZFan

Off the bat, have not tested it, etc. possible solutions might be:

1. Assign Vlans to a VRF and use the VRF, or maybe
2. In bridge port, you can select interface called "dynamic" and assign pvid there

CZFan

OP:

Just a word of warning, your public IP is visible on those screenshots, let me know if I am close :-)

EDIT: IP Removed

CZFan

without recursive routing, will be something like this (trying tp keep with your method of explanation): Route Rules: LAN1: SrcAdd(LAN1) Table(LAN1) LAN2: SrcAdd(LAN2) Table(LAN2) Routes: route 1 isp1 wan, route-mark LAN1 distance=1 route 2 isp2 wan, route-mark LAN1 distance=2 route 3 isp2 wan, rout...

CZFan

https://www.cdw.com/product/hpe-aruba-a ... nt/5520246

WoW, for that price, I will rather by 6 x RB4011s and place them all over where needed :-)

CZFan

Can this be done without mangling is the challenge?

Yes, by using route rules with routing mark/route table for each LAN/WAN combination.

Then create 2 rules for each routing table, one with distance of "1" and another "2", recursive routing will serve better here

CZFan

Without seeing the configs, your guess is as good as mine

CZFan

No, they probably have a ttl of 64 or 128, etc and decrement from there as they cross hops Let me rephrase, There is option in filter rules that you can check the TTL under advanced tab and then add src address to address list, but what I meant with the "No" is that they will most probabl...

CZFan

No, they probably have a ttl of 64 or 128, etc and decrement from there as they cross hops

CZFan

Have config at a WISP client of mine where I am using /31 between them and their upstream provider.

My client side is a MT and upstream prover side is Cisco, using the Cisco as GW

CZFan

@CZFan and what Clamp mss in EoIP does? Not sure if I understand the question correctly, but: OP did not mention EoIP tunnel MTU size in OP, so with that, if the tunnel MTU was set at 1500, then the "Clamp TCP MSS" in EoIP config will clamp the MSS at 1460, which might not be low enough. ...

CZFan

Clamp mss in EoIP will only clamp it based on tunnel mtu size, it doesn't know what the mss size is end to end

CZFan

Assign an admin MAC to the bridge interface, will probably drop you but then connect again, that should prevent dropping you changing bridge ports as the bridge wont change MAC address
Have not tested it

CZFan

I'm wondering if perhaps they do not intend to release a 6.49 (moving to v7 instead as the next stable release after 6.48) ...

I suspect there is a big push to get V7 out, hence the huge change released in Dec 2020, but suspect we will still get a couple V6 updates

CZFan

.... If i do keep it as is but put the WAP on NAT, yes, it works...but tripple NAT. I find it crazy the WAP cant do what a cheap $20 ethernet extender can do. The UBNT picostation does it fine, but lacks the connect list...but i guess will work if i setup some hacking way to do a connect list on it...

CZFan

From the export you provided, I cant see any reason why disabling that rule will drop VPN connections, unless the export is not all info

CZFan

All routing is done via CPU, firewall will see this traffic

CZFan

That looks like a fairly standard default Mikrotik firewall config, difficult to see details from screenshots, export much better If my assumption is correct above, it will mean that you typically allow DST NAT in the "Forward" chain, not "Input" chain, and as per example, you ar...

CZFan

With devices in the same subnet being on both sides of the router, I dont think ARP Proxy is going to help you here. Off the bat, the only other way I think this will work is, but sounds more of a mission than you already do: Assuming you are on the LAN side, add 192.168.1.254 on WAN side interface,...

CZFan

The only reason will be if a firewall is blocking connections from the outside, else those rules will redirect (NAT) anything with a destination port of 53 to 192.168.88.1 Also, you will still need to enable "Allow remote..." in DNS service on router, else the router will not respond to DN...

CZFan

"...they suspiciously look like the rules for port-forwarding..."

Reason is that is exactly what those rules are, they will just redirect (NAT) packets to which ever DNS server you point them to in the NAT rule, may it be your router or Google DNS servers, etc

CZFan

Not sure I follow.

Layer 2 is logically segregated right, that is one of the reasons for Vlan's?

To block comms between these on Layer 3, use firewall

CZFan

Ether1 does not apply to all routers for Netinstall,

For the CCR1009, I think it is ether7, check on the router, it will be marked "boot"

CZFan

Search Mikrotik wiki for EoIP or BCP (Bridge Control Protocol)

CZFan

Try 6.46.8 long term version

CZFan

I think you need to explane how you monitoring this, if it is watching the interfaces in Winbox, then it might possibly just be refresh rates, etc in Winbox

CZFan

You don't mention how you split the load a cross the 4 x WANs, so I can only assume: 1. Router sends the traffic across its DG with lowest distance. 2. You have configured DNS cache / proxy, so router does lookups on behalf of client devices, and follows point 1 above BTW, both your mangle rules are...

CZFan

Had same issue when I factory reset a customer of mines router, what resolved it was to add static IP address on my laptop (usually on DHCP)

CZFan

Why will you need full tables with only one peer?

CZFan

For Torch to see the traffic, you will need to disable "Hardware Offload" of the interfaces bridged in Menu-->Bridge-->Ports

Note: This will have a negative performance impact for traffic between interfaces in the bridge

CZFan

I would just use below, that burst settings you have will bring no value

/queue simple
add disabled=no max-limit=16M/16M name="PC-LIMIT" target=ether1

Then make sure you have no fasttrack enabled in firewall or bypass fastrack for this device / target

CZFan

If I am reading this correctly, the Mikrotik is sending, so you will have to get access to the logs / packet capture on the other side to see what the problem is, maybe the packet never reaches it, etc

CZFan

You dont give much information to go on, i.e. sample of your config, but I am convinced the reason will be that your config is not complete, i.e. need to add switch-cpu interface in the switch vlan table for that vlan

CZFan

The solution url you quoted is to enable bi directional communication, and I am not sure if this is the same as "bridge" as per your requirement.
I don't have a device to test with, but suspect it might work for you, but like I said, can't test or verify it

CZFan

1. Does Zyxel belong to Sonicwall? Those screenshots looks extremely familiar last when I worked on Sonicwall in 2014. 2. I believe you are still showing the WAN address on the Zyxel side 3. Not sure if is your problem, but you have key group set on DH5 at Zyxel side, I believe this translates to 15...

CZFan

Duplicate post, but there is no dhcp client configured

CZFan

Apologies, @mkx correct, I quickly scanned over the config.

But I don't see a dhcp client line item in config and that is probably reason AP can't get IP from DHCP

CZFan

Add bridge as a tagged member/interface of management vlan in bridge vlan table

CZFan

Yes, you can route it further into your network

CZFan

The bridge has two sides to it, on is bridging interfaces, other is a interface itself which provides access to the CPU for accessing resources on device itself like DHCP, management of the device itself, etc. So like I mentioned earlier, to achieve above, you need to provide access to this in vlan ...

CZFan

You can use any method, but you have to give access to the Bridge / Switch CPU interface on that device in order to access resources, i.e. DHCP, Management, etc on it

CZFan

You have configured both methods, i.e. bridge vlan as well as switch vlan.

Should just be one or the other, and in neither did you configure access to the Bridge / Switch CPU interface

HINT: From URL you quoted:

add ports=ether1,switch1-cpu switch=switch1 vlan-id=99

CZFan

The steps you can take:
1. Drop L2TP that is not encrypted, explanation / sample config in wiki
2 use strong passwords
3 use RSA authentication

CZFan

Why is ether 1 mtu set at 1508?

CZFan

You don't want to test to/ from router anyway, as you will run into limitations of CPU, etc, so will not gain much. Best is to test "through" the router, and in that case, iperf is a good tool

CZFan

Only one sim slot can be active at a time

CZFan

If these were a "site to site" VPN, you can then make use of firewall rules to only allow from certain IPs, but as this is typically used for people to work remotely, i.e. today from home, tomorrow from coffee shop, etc. it is difficult to limit who can connect from where, etc. So best sol...

CZFan

Best will be to do packet capturing to see what is happening

CZFan

Can only have one mark.

What do you want to achieve, maybe another way of doing it?

CZFan

Hmmm, downgrade ROS version?

CZFan

Have you tried reading the wiki? See link below.

https://wiki.mikrotik.com/wiki/Manual:I ... Properties
Netmap is usually used with 2 x sets of ip addresses and will then create a static 1:1 between these 2 sets

CZFan

MSS is negotiated / agreed between end devices during the TCP handshake, so you cant change "incoming" from outside MSS values Possible reason your mangle rule is not working, is you probably have Fasttrack enabled which bypasses Mangle rules, if Fasttrack is required, you can exclude the ...

CZFan

Remove the below rules and add lte interface to WAN interface list

add action=accept chain=forward out-interface=lte1
add action=accept chain=forward in-interface=lte1

CZFan

You need to ask upstream provider to only annoince default route to you, then in routing filters, only accept default prefix and discard all others

CZFan

Seems they are labeled JB00 & 01, thinking 00 should be A and 01 B, but no guarantees :-)

CZFan

HAP AC2 does not use the flash for updates, only memory, so place the update .npk in the root, restart router and it will update just fine

CZFan

I would suggest resetting the first device as there are couple of settings that can cause slow performance, i.e. Ether1 (WAN) is set to half duplex, fast path s disabled and fasttrack needs this, etc

CZFan

Best will be to contact one closest to you, see below link

https://mikrotik.com/consultants

CZFan

What does log on Mikrotik device say when bulb trying to connect?

CZFan

CZFan

Above is posted in wrong topic header and should be under wireless .

Then as per your question, IIRC, CQI will only show when signal strength and quality is at acceptable levels

CZFan

I would think where the provider hands off the connection to you, the s tag is removed and you should only receive the 2 c tags from hand off

CZFan

Your description of your requirement is also not clear to me, all I can think of what you maybe want when saying "running through vlan 10" is possibly what is called qinq vlans, i.e. Tunneling a vlan inside another vlan

CZFan

If you are looking at sub 50ms, I doubt very much you will achieve this using scripts

CZFan

Great, now I know they reworked my article without even mentioning me... That's a bit depressing :)

Plagiarism much...

CZFan

There are various configuration items that can be optimized to improve performance on your CHR at the moment.

There are multiple posts here as well as Wiki articles, alternatively contact a certified consultant closest to you https://mikrotik.com/consultants

CZFan

Very limited info you provide, but if my understanding is correct, then there is a problem with your logic. i.e. you ping 8.8.8.8 from ether 2, if no response, you disable interface, with this interface disabled, you will not be able to ping from it. If reasons for doing this is dual WAN purposes, t...

CZFan

Also see

viewtopic.php?f=2&t=170769&p=835183#p835183

Search found 2104 matches