MikroTik

RonJohn63

do not use ether1, that is the WAN port by default, it does not have DHCP server and is blocked by the firewall for incoming connections)

That was the key. I'm in now.

RonJohn63

you have to make an initial configuration either with ssh, wine (winbox) or the app for ios / android (you should see a wifi on the iphone - connect to it without a pass and make the configuration via the app, for example) But I can't access it. $ telnet 192.168.88.1 20 Trying 192.168.88.1... telne...

RonJohn63

I've been contentedly using an RB750Gr2 for a couple of years, and so decided to buy an hAP ac2 when my Netgear WNDR3700 (in AP mode) died. All of the devices on my network are on 192.168.1/24, so, because the hAP ac2 is on 192.168.88.1, I set the RB750's routing destination to 192.168.0.0/16. $ sud...

RonJohn63

Hi, v6.24.7 I've installed the ntp package, and (hopefully correctly) configured the ntp server properly: [admin@MikroTik] /system ntp server> print enabled: yes broadcast: yes multicast: no manycast: yes broadcast-addresses: 192.168.1.0 . Now I need to configure the firewall to allow systems on the...

RonJohn63

Looking at the specs of both routers, your question answers itself: https://mikrotik.com/product/RB750r2 https://mikrotik.com/product/RB750Gr3 The r2 only has 100Mbit Ports, while the Gr3 has 1G Ports. Even if the r2 CPU could pull off that Gigabit, you'd still have to go for the Gr3 for the Gigabi...

RonJohn63

Hi,

Does the RB750Gr2 support it (maybe just barely), or should I upgrade to an RB750Gr3?

Thanks

RonJohn63

The current rule set works. You are correct it works - but I would still recommend removing that section of the rule as it is not required <snip> It is common when rules have been checked in Winbox and options opened but not actually filled in for entries like that to get left behind as orphans. In...

RonJohn63

Hi, is servers still runing ? I did try few times last couple of days but never able to connect ! It would be so cool if Mikrotik has someting like that for at least 100Mbit test:)! I had the same problem, then enabled logging on the FW rule chain=input action=drop tcp-flags="" in-interfa...

RonJohn63

Your default input drop rule has a setting of tcp-flags=""

This is probably the problem. Remove any reference to tcp-flags and it should then catch anything not specifically allowed before that.

The current rule set works.

RonJohn63

Understood. Thanks. (I'll enable logging, and give it a prefix to see how often it occurs.) It is somewhat unlikely you will see anything in the log (especially in comparison to attempts on the input chain itself), but that doesn't mean that you shouldn't protect yourself from that attack vector. A...

RonJohn63

@nescafe: did you use 6.37.1?

@rohnjohn63: try downgrading to bugfix channel, 6.36.4. Do the linux host uPNP properly creates the dynamic dst-nat on IP > Firewall > Filter in this case?

No.

RonJohn63

That makes me sad... :( Sorry for playing the "have you tried turning it off and on again" - card.. But really before starting the process elimination you should've checked the obvious. Please take the time to follow my steps. I have installed transmission on Ubuntu and tested UPnP. It se...

RonJohn63

Here's my current filter set: /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related add action=accept chain=input comment=&quo...

RonJohn63

Demonstrating how much I don't know what I don't know: how does someone outside of my router's WAN know what to target behind my router? To some extent, it is a guess. However, 192.168.1.0/24 is the most commonly used private subnet for home users, so the odds of this guess being accurate are fairl...

RonJohn63

From what? (This is a small, trusted LAN.) From malicious traffic :) Anyone in your provider's subnet could send malicious traffic to your internal network. Even if your house is small, you shouldn't leave the doors wide open.. I thought that was what the rule " chain=input action=drop tcp-fla...

RonJohn63

From what? (This is a small, trusted LAN.) From malicious traffic :) Anyone in your provider's subnet could send malicious traffic to your internal network. Even if your house is small, you shouldn't leave the doors wide open..[/quote] I thought that was what the rule " chain=input action=drop...

RonJohn63

Well you did mention your laptop's Windows Explorer Network "Network Infrastructure page" in your opening post ;) My bad for the confusion. I've got two computers: a Windows laptop (where enabling UPnP and adding the interfaces allowed the Explorer Network Infrastructure page to see the R...

RonJohn63

ether1 is definitely the WAN port and ether2-master definitely the LAN port: I mean on your Windows computer itself. When you first connect to a network, Windows asks you if it is a private network or a public network. If you choose "public", or do not choose anything, it will assume publ...

RonJohn63

Maybe the network type you have chosen for the network on your laptop is "Public" rather than "Private"? I think "Public" would not attempt to communicate with uPnP devices. ether1 is definitely the WAN port and ether2-master definitely the LAN port: Flags: X - disable...

RonJohn63

Which RouterOS version? Have you tried latest bugfix (6.36.4)? 6.37.1 Can you post /Ip address print? admin@MikroTik] /system routerboard settings> /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 ;;; defconf 192.168.1.1/24 192.168.1.0 ether2-master 1 D ...

RonJohn63

Hi, I'm trying to get UPnP to dynamically open incoming ports, with no luck, for the Transmission torrent client. I think it's a firewall issue, because in Windows, routers and gateways (even those not mine) show up in my laptop's Windows Explorer Network "Network Infrastructure" page. Her...

RonJohn63

Does RouterOS v6.37 allow RSA keys (I couldn't get them to work) or have any plans to use them in the future?

Also, the wiki pages which refer to ssh keys need to be updated regarding the need to put this in the ~/.ssh/config file:

PubkeyAcceptedKeyTypes +ssh-dss

RonJohn63

Does RouterOS v6.37 allow RSA keys (I couldn't get them to work) or have any plans to use them in the future?

Also, the wiki pages which refer to ssh keys need to be updated regarding the need to put this in the ~/.ssh/config file:

PubkeyAcceptedKeyTypes +ssh-dss

RonJohn63

OpenSSH deprecated DSA. I had to add this to my ~/.ssh/config file:

PubkeyAcceptedKeyTypes +ssh-dss

This addition to the config file also made things simpler:

Host my-router IdentityFile /home/ron/.ssh/id_dsa

RonJohn63

Why this is not possible to get domain names. Other routers like DD-WRT or Openwrt can do this.

And Tomato Shibby. A list of the last 50(?) web sites visited, with timestamp and LAN IP address. Stunningly useful.

RonJohn63

Hi, Following the directions in http://wiki.mikrotik.com/wiki/Use_SSH_to_execute_commands_(DSA_key_login) (which is for v2.9) I generated the key, ftped it to the router and imported it. However, it still asks for a password, and now says "Permission denied, please try again." Where did I ...

RonJohn63

It appears to work, since I statically added those devices to the router DNS tables: [admin@MikroTik] /ip dns static> print Flags: D - dynamic, X - disabled # NAME REGEXP ADDRESS TTL 0 router 192.168.1.1 1d 1 haggis 192.168.1.10 1d 2 MC0XMUDC 192.168.1.12 1d 3 LinksysPAP 192.168.1.129 1d 4 726729_Ex...

RonJohn63

Hi, I see a pair of these broadcast(?) packets every 25-35 seconds whenever I enable logging on this FW rule: 3 ;;; defconf: drop all from WAN chain=input action=drop tcp-flags="" in-interface=ether1 log=no log-prefix="WANDrop " 16:46:36 firewall,info WANDrop input: in:ether1 out...

RonJohn63

Check if the "resolv.conf" in your client pc is set to your mikrotik router. It does, along with my ISP's name servers (presumably because the router DNS has "allow-remote-requests: yes". $ nslookup router Server: 192.168.1.1 Address: 192.168.1.1#53 Non-authoritative answer: Nam...

RonJohn63

Your dns settings should point to your mikrotik. Depending on your OS, try a command like "nslookup" or "dig". [admin@MikroTik] /ip dns> print servers: <<<<<<<<<<<<<< dynamic-servers: 68.105.28.11,68.105.29.11,68.105.28.12 allow-remote-requests: yes max-udp-packet-size: 4096 que...

RonJohn63

(Had to temporarily disable the FW rule on dropping all WAN packets.) Otherwise, it matches well with my 150/10 cable tier. [admin@MikroTik] /tool> /tool bandwidth-test address=207.32.195.2 user=btest password=btest \ duration=00:01:00 direction=receive random-data=yes protocol=udp status: done test...

RonJohn63

But dnsmasq can also be a name server for devices in the LAN. that is also available at ip > dns > static Thanks. I clicked on that, and then tried to ping devices who's names are known to the router. But now my devices think that all host names have the IP address 92.242.140.2 instead of something...

RonJohn63

Hi,

If I run/tool ip-scan interface=ether1 (where ether1 is the WAN port connected to my cable modem), will it try to scan my ISP's whole address range?

RonJohn63

qubic you have dns cache service already built in into RouterOS. (IP > DNS, tick Allow remote requests)

Unless you have a very large network that needs to cope with more than 100 requests per second no need for a separate cache.

But dnsmasq can also be a name server for devices in the LAN.

RonJohn63

OK, I was in a hurry and did not read properly you post. Rule 3 should block all traffic incoming from wan, but it is disabled. So it does not block. When first installing, the router didn't pick up an address ISP, and I thought that rule 3 was the culprit. Apparently not. Thus, I've enabled Rule 3...

RonJohn63

Flags XI mean "Disabled" and "Invalid". Maybe you need to check the interface names... The WAN cable is definitely plugged into ether1, and the LAN cable is definitely in ether2-master. Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU MAX-L2M...

RonJohn63

Hi, I can still remotely ssh in, even though I've got this set of rules: 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; defconf: accept ICMP chain=input action=accept protocol=icmp log=no log-prefix="" 2 ;;; defconf: accept established,related ...

RonJohn63

After trying it again this evening, it worked.

RonJohn63

Hi, RouterOS v6.43.2 I connected the wire from the cable modem going in the "Internet" port, and the wire to the rest of my LAN going in port 2. Then powered up the CM and when it got a signal powered up the router. After the 2nd beep, I refreshed my client's IP address. It successfully ga...

Search found 39 matches

Re: Accessing an hAP ac2 [SOLVED]

Re: Accessing an hAP ac2 [SOLVED]

Accessing an hAP ac2 [SOLVED]

Configuring firewall for use as NTP server

Re: Gigabit fiber

Gigabit fiber

Re: FW rule to block port 22, but still can ssh in

Re: 3.6 GIG - Public-Mikrotik-Bandwidth-Test-Server

Re: FW rule to block port 22, but still can ssh in

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Re: FW rule to block port 22, but still can ssh in

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Re: Another UPnP question

Another UPnP question

OpenSSH has deprecated DSA keys

OpenSSH has deprecated DSA keys

[SOLVED] Re: ssh key import

Re: Domains in logs and Firewall connections

ssh key import

Re: Is it possible to install dnsmasq into routeros

Lots of dropped 10.132.88.1:67 packets from WAN port

Re: Is it possible to install dnsmasq into routeros

Re: Is it possible to install dnsmasq into routeros

Re: 3.6 GIG - Public-Mikrotik-Bandwidth-Test-Server

Re: Is it possible to install dnsmasq into routeros

/tool ip-scan

Re: Is it possible to install dnsmasq into routeros

Re: FW rule to block port 22, but still can ssh in

Re: FW rule to block port 22, but still can ssh in

FW rule to block port 22, but still can ssh in

Re: RB750Gr2 DHCP client doesn't get IP from WAN port

RB750Gr2 DHCP client doesn't get IP from WAN port