MikroTik

elico

OK, the VPN way seems like the right way.

elico

Hey, I have a scenario which I have a server with static IP that I want to use to access the RouterOS remote devices and to allow access to the devices from couple static ip addresses. To allow other users to access the remote devices I want to use a http proxy which winbox should use. Is it possibl...

elico

I made a simple chat with ChatGPT to create the relevant tools for it:
https://chat.openai.com/c/f8037c71-7fa5 ... 21328a7436

elico

I have a bunch of devices and I want to be able to connect to them using a href link. there are many uri schemes and I have a binary that can receive a uri and to extract the details and spin a winbox instance with the details. so I have two schemes in minde: winbox://username:password@ip-or-domain:...

elico

first the rest API script at: https://github.com/elico/routeros-create-vlans-range and a simple script: :local masterInerface "test"; :local defaultDisabled "yes"; :for LoopCount from=1000 to=1099 step=1 do={ /interface/vlan/add interface=$masterInerface name="$masterInerfac...

elico

It depends id the web service is built to take such a load. normal web services are ok with 300 requests per sec but in bursts of max 300. Above this you need threading of so sort of parallel processing. Also, it depends on other factors and if you take 10k per an hour it's about ~166 per minute whi...

elico

Depends on the Bruteforce mitigation technique you use. For WG you just need to limit the burst of new connections to a reasonable amount and use keepalives. For IPSEC, I don't know who bruteforce IPSEC but it should be pretty hard to brute force... And again just block a burst of new connections. A...

elico

So basically if you want all your FW connection tracking rules to be flushed you can't do it with a button click on winbox but with /ip/firewall/connection/print where (timeout>15) [remove $".id"] I can check it but my script worked fine, maybe this specific one liner is better or faster t...

elico

You can create a Jump rule into a specific set of dst-nat rules from the dstname ruleset.
You will need to find it first so a commend might be a good way to find the jump rule.

elico

Now I'm looking for the right way to remove a specific record with a single POST request :\

elico

The next script works great on RouterOS V7.x but I prefer a foreach one if possible. The issue is that I have a device with more then 60k Connections tracked and when I am trying one of the scripts above with foreach it does a "find" per connection and it takes forever to flush the connect...

elico

To my opinion it's better to use the rest api to update the address list.
You can use a simple curl command to fetch the current list and then using a diff to find out if and what you might need to add or remove from the address list.
Less overhead inside the RouterOS scripting area.

elico

As for winbox you need to clear the session cache and make sure that you use the latest winbox version.
Use safe mode on winbox to make sure you won't get locked outside of the Router.
Once you see the rules are OK for 30 secs you are probably OK to apply the config/rules by unclicking the safe mode.

elico

I too had an issue with CHR ethernet adapters disappearing after updating from 7.13.5 to 7.14 on a production server times two. 7.14 is supposed to be stable realease? I was prepared with a week old snapshot and suddenly my adapters reappeared. OK what hypervisor? Worked fine on Hyper-V. /system/re...

elico

Thank you...until now I did not need it but I have to see it now. It would be better to fix Netwatch/sending notification than add new interface for nothing... What notifications and I don't understand if it's sending or not. As far as I know to send a notification from netwatch you need to write a...

elico

The comment from w0lt was correct. In order to disable specific topic logs, go to System/Logging and open, for example, "info" topic. Add "!wireguard" to it. All info logs, except WireGuard, will be logged now. Yes, these are new logs, nothing changed in the WireGuard behavior. ...

elico

I tried to understand what you want to do but yet to understand.
Can you elaborate a little bit more then what's already?
Maybe, where do you want the AX to source the internet from?

elico

I need to test it.
It worked fine on my HAP AC3 and HAP AX3.
Let me check it later on.

elico

OK, So first of all for all the assistance in the Discord wifi channel. I respect each and everyone who made a response to help me first asses the options. The main difficulty was that it was a RouterOS to RouterOS single device connection and non an Iphone or laptop or android or any other client w...

elico

I have a setup of HAP AC(client) to HAP AC3(AP) which worked very well for a very long time. I replaced the HAP AC(Client) into HAP AX3 to achieve better performance (I could not get an AC3). Since I replaced the HAP AC to HAP AX3 I got a weird behavior of the wifi link drops every day couple times....

elico

Can you try to post the channel you use and the Status of the interface from Winbox?

It's interesting to understand what the situation for this issue.

Thanks!

elico

Sharing the config of both the AP and the STATION: AP: /interface wifi channel add band=2ghz-ax disabled=no frequency=2412 name=2GHZ skip-dfs-channels=10min-cac width=20/40mhz add band=5ghz-ax disabled=no frequency=5745 name=5GHZ skip-dfs-channels=10min-cac width=20/40/80mhz /interface wifi security...

elico

I have this exact same issue between two ax3 devices and it was the same between a hap ac3(AP) and hap ax3(station). I am trying to understand how to prevent this issue. Both devices use wpa3 couple other basic configurations. In my PC and mobile I just connect to the wifi and it stays on for hours ...

elico

Has anyone tried Caddy reverse proxy with automatic lets encrypt to run ontop of RouterOS container? It can be pretty nice. The only issue is the configuration and process management. A simple port 443 and port 80 port forwarding into the container is a must. Then the configuration should be auto ge...

elico

Probably a security feature.
You can try to contact support to understand better.

elico

@user442 using what tools?
curl would be good?

elico

What version of RouterOS and also what container?

elico

@normis, I have just installed the BTH app on andorid and tried to connect to my device but it shows:
VPN Connection failed.

Do I open a ticket for that? I am using latest 7.12.1.

elico

@Amm0 scripting something like docker-compose would be pretty simple to some degree.
An upgrade can be done with a "spec" of the container making sure that the data is saved.
There is even probably an option to take an existing container, delete it and recreate it with a set of commands.

elico

@jasonwxybj do what?

elico

@PappaB did you managed to make it work?

elico

@noctis.
YES, this is great!!!

elico

Hey Tangent, The point of having an option to use a distribution is to not handle the sources yourself. There is a price for building and verifying yourself the binaries and handing it over to another entity or person. I prefer to invest my time on what it's worth. I am not handling embedded systems...

elico

Hey Tangent, First I appreciate your time and effort. In a forum there is some definition of tread hijacking but for now you are writing much more then me and also placing very good points. I would say this is a very very successful discussion regarding the general topic of containers. I don't know ...

elico

I have seen that lets encrypt can be used on RouterOS devices. The drawback is to open port 80 to the world and there are workarounds using /ip/firewall/xyz rules to block port 80 and allow to only specific sources. There is another option and it's to use some kind of reverse proxy such as nginx or ...

elico

If you are using some kind of torrent software you should look at qbittorent rather than transmission.
However for hap ac2 I would try to use only transmission if at all and with a limited amount of ram.

elico

Hey Tangent, I don't want to say what you are saying is wrong. It will be different per use case. Your container is designed to be as small as possible and for specific edge use cases. The container I have created is a general off the shelf ready to use software packaged in a container. I am not try...

elico

Give the latest alpine 3.18 iperf3 a test: https://hub.docker.com/r/elicro/iperf3-server The next is a test from a windows machine over a connection between HAP ax2 to an HAP ac2 which hosts the iperf3-server. Seems pretty decent to me. PS C:\Users\Administrator\Software\iperf-3.1.3-win64> .\iperf3....

elico

The issue was the version of the container which for some reason doesn't work. The alpine version is a static binary version and works as expected. Installation instructions: /interface/bridge/add name=dockers /ip/address/add address=172.21.0.254/24 interface=dockers /interface/veth/add name=veth22 ...

elico

The container doesn't work because of couple things but I am testing the options. If you have some experience with containers debugging please put some hand to find out what is causing the container to not start. /interface/bridge/add name=dockers /ip/address/add address=172.21.0.254/24 interface=do...

elico

Has anyone tried to use:
https://github.com/drakkan/sftpgo

on RouterOS?

elico

I had the devices ping each other over wireguard on 7.9 but now on 7.10 I can't do that. Is there any know issue with that? ## EDIT OK SO I found out what was the problem in my config on RouterOS. I tried to understand what's wrong and eventually looked at: https://markeclaudio.github.io/mikrotik-wi...

elico

Seems to work fine on RouterOS v7.10. https://gist.github.com/elico/176d1c0a83a5e4f6c53fe11a20bd7b62 /interface/veth/add address=172.21.0.201/24 gateway=172.21.0.254 name=veth201 /interface/bridge/port/add bridge=dockers interface=veth201 /container/envs/add name=adguard_envs key=TZ value="Asia...

elico

You will need to elaborate more about the process you are using to create the containers and then import them so we would be able to try to help you.

elico

I have tried couple scripts that will create a BLOCK or ALLOW ipv4 firewall address lists. The main issue was that some scripts are too long for RouterOS import. I want to use the next github repo: https://github.com/herrbischoff/country-ip-blocks to take a specific set of countries lists and add th...

elico

OK, SO I have verified this issue. The way to handle this issue is to define two things: 1. is to always use the relay server in the environment variables. 2. both clients should use the same host domain name, for the local/internal the domain should point to the internal IP For the external the dom...

elico

I will try to test it on a regular container and server first.
If it's the same for both a container and a server then it's something with the rustdesk software and should be discussed in their github issues.

elico

What about a proxy? The main issue that you might try to be as transparent as possible. With a good proxy software you will be able to do whatever you want. Also, with containers you can have any proxy of your choice. You will still need to block quic and port 80,443 and maybe other parts of the net...

elico

How much memory is needed to start and run this container?
Is it possible to run it on hap ax3? (with 1 GB RAM, 650 MB free)

It is possible to run it on hap ax3 but I recommend to use an external USB storage and not the internal one.

elico

Have you tried any containers until now? You can try this one: https://hub.docker.com/r/satishweb/doh-server I do not know the project and it should be inspected before usage but it seems legit on the surface You can see the variables that can be used for the container in this docker-compose.yml exa...

elico

With what OS have you tried to build the Websockify container? It seems that both Debian and Alpine has a package so you'd better stick to it. I can try to create a container for that and resolve the issue and I wish there was funding for the time on such a project. To clarify my project: I want to ...

elico

we would need step by step how this can be repeated. For me files always stay with correct uid,gid when upgrading from 7.6 to 7.7 I will try to test it later on. I have tested this on HAP AC3, every file I am uploading via lftp or winbox has a the above 65534 UID and GID. I will verify if it's my d...

elico

I have used both minicom and picocom and picocom seems much nicer to me to some degree. To connect the RB2011 console I have used a Prolific 2303TA cable which is not compatible with Windows 11 so I have installed Ubuntu 22.04 on a VM in Virtualbox and then connected the USB to the VM. The VM got th...

elico

What are you quotting whole preceding post for? Do this help undertending the conversation? No. Use "Post Reply" button. Will test. ... OK so I have tested and it seems that there is an issue with the container running as unprivileged user on 7.7. From what I understood the Support team i...

elico

@TheNetworkBerg Did you tried to make a backup using lftp before erasing the mount point? I will try to test it later on when possible. ... I have now verified that after the upgrade from 7.6 to 7.7 the old files get the uid and gid of: 65534 and there for cannot be touched even when I am the root u...

elico

fix for .type will be available in next releases. Thanks! Looking forward for this. For now I have provided a better entrypoint.sh version which uses find instead of chown -R and excludes the .type file. Can be seen at: https://github.com/louislam/uptime-kuma/pull/2587/commits/f7da83ed55ca2d0ee28d0...

elico

@elico .type file inside mounts is for RouterOS to mark folder contents as not to be listed inside RouterOS. Correct fix would be not changing permissions for this file from uptime-kuma side, or allowing permission change or change the way of listing/not listing folders from RouterOS side. Deleting...

elico

In the latest post of uptime-kuma there was a resolution for an issue by erasing a .type file in a container directory. Based on this I have tried to see the options of sftp and lftp (lftp has great auto-completion and couple nice tools like cat) and it seems that you can actually manage the FS of b...

elico

exabgp would be great.
I have somewhere an exabgp setup which defines the next-hop for a bgp advertisment and it's good for anycast dns advertisment in ISP networks.

elico

The real solution is to fix this "bug" inside the container since it's doing something wrong in the entrypoint.sh script. I have a fix for that and will submit a PR to the uptime-kuma git repo which if will be accepted will reduce this unnecessary step. ... at: https://github.com/louislam/...

elico

Did you got your answer?

elico

This is a security restriction to prevent from the container to do a mount back into the RouterOS FS.
There was a CVE as far as I remember that showed how the telnet binary can be mounted from the container back into the RouterOS FS and well it ended pretty bad...

elico

Downgraded from 7.7 to 7.6? Nice. Downgraded my router to 7.6, then got the container working. Snapshot versions don't have a GUI, so this is what I ended up preparing for the router. docker import https://downloads.openwrt.org/releases/22.03.2/targets/armvirt/64/openwrt-22.03.2-armvirt-64-default-r...

elico

Reporting the same issue

Has anyone tested this with 7.7rc?

elico

No, Just adjust the ip addresses to your containers network subnet. Just a recursive caching DNS server? A simple unbound container can be found at: https://github.com/elico/unbound-container Example on how to deploy it: /interface/bridge/add name=dockers /ip/address/add address=172.20.0.254/24 inte...

elico

Contact support ...

elico

What about rest api? It's very simple to find the first hostname with curl and jq from the API using: curl -s "https://api.nordvpn.com/v1/servers/recommendations?limit=3"| jq -r ".[0] | .hostname" Then using a simple rest api query you can verify if there is a change needed and i...

elico

OK so I have PTP SSTP connections with a centralized router. The SSTP clients network is 192.168.120.0/24 and the remote address of the centralized router over the SSTP connection is 192.168.9.250. I have multiple locations that are connected to the centralized Router each on a different geographic ...

elico

OK so I took the time to write some code and give a programmatically example of an address-list update at:
https://github.com/elico/mikrotik-web-f ... ss-domains

It requires some environment variables like MT_HOST and MT_USER and MT_PASSWORD
I hope it helps someone.

elico

Hey, I am using an external script to dump the DNS cache from the device and then populate an address list with specific domains. I am able to dump and find the addresses but not sure how to add a batch of domains and/or addresses to the RouterOS device via REST API. What: https://router/rest/path s...

elico

NMAP container ? It's something missing on routerOS to easily scan client LAN (check if a port is open on a device or not). Or if someone have a easy way for this (ssh tunnel ?) A very simple ssh container can do that. I have created one based on alpine linux 3.17 but not sure if I have published i...

elico

Then change the network to .17 compared to .20 and it should work. I am using the 172.20 since I have local machines with docker which the default network of choice is 172.17 so... I am using another network on the MT device so these containers can reach the DNS or another service. You should instal...

elico

OK I have seen some horrible code but the above from me was a total mistake. The next one works for now: /log info ("Starting whatsapp script"); :foreach i in=[/ip dns cache all find where (name~"whatsapp")] do={ :local tmpAddress [/ip dns cache get $i name]; :if ( [/ip firewall ...

elico

I took only a single piece of code and it doesn't even run on V7. It looks to me like something in the code is wrong. :log info ("Start of script"); :foreach i in=[/ip dns cache all find where (name~"whatsapp") && (type="A") && (data!="240.0.0.1&quo...

elico

Hi experts, I have 2 Raspberry PIs running Kubernetes (k3s actually) and they will be hosting various web applications. Network setup is so that ISP is directly connected to my MikroTik Hex router, and everything at home has IP from the Hex's default range of 192.168.88.0/24. Because I'm overly amb...

elico

Thanks for the details. ~20% for 10Gbps is not really a lot. I just wanted to add that not all clients are equal and not all of them can handle even 1Gbps to begin with. Most recent hardware and browsers can handle this but I have been running speed tests against clients Desktops and Servers for the...

elico

I have followed the instructions as per the wiki on setting up Pi and it works great! Now I would like to setup Unbound as a container for a DNS solution but can't find any information on how to do this on the Mikrotik. Any help would be appreciated! Just a recursive caching DNS server? A simple un...

elico

An example of usage in video of installation and operation at:
https://www.youtube.com/watch?v=DGC_Wt6HX7w

elico

Rustdesk is an opensource alternative for Anydesk and Teamviewer (cannot 100% replace Teamviewer but is good enough for the price). Rustdesk is composed of couple components: A server (api and registration) A relay server A client An installer I have added a "secure" (password protected) h...

elico

Any idea what is going wrong here? Maybe the user is not root? Thanks, dksoft Nov 17 21:02:55 router container,info,debug INFO: /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration Nov 17 21:02:55 router container,info,debug INFO: /docker-entrypoint.sh: L...

elico

There are minio containers out there but non of them are for armv7 so I took the time to build a compressed minio container. The binaries are compessed with upx and are more or less 30% compressed. ie 30MB compared to 90MB. The container includes both minio and mc (client). If you don't know what mi...

elico

I looked at my ESXi server and the VM's it's running, and I'm considering moving what I can over to my CCR2116. pi-hole - Already moved Asterisk/FreePBX Beta Unifi/UISP servers And with 2-4TB NVMe SSD, I could do OwnTone (DAAPd) to replace macOS 12 running iTunes 24/7 ownCloud/NextCloud NAS (NFS, S...

elico

Hi, Thank you, Any instructions or walkthroughs on establishing an HTTPS connection? Regards, Hey, It depends on how this would be setup. You either have a pre-existing certificate and chain and everything or you will use some lets encrypt. For lets encrypt It would be much smarter to put a simple ...

elico

Prometheus is known for it's metric scrapping graphing and alerting capabilities. When combined with grafana it can be a very powerful tool to visualize IT systems and routers statistics and to know about trends in a system over time. I have created a container for Mikrotik RouterOS devices metric s...

elico

How does this test (server side in container) perform on a mid-range Routerboard? Is it light enough on CPU to saturate 1Gbps LAN without hitting CPU limit? (First it got max to 70% CPU utilization) And well.. it's based on Javascript/html5 and nginx. It's really a very simple speed test but well w...

elico

Based on old work of mine I have created a simple IP Subnet Calculator html5 web container: The source of the calculator is from: https://github.com/jmpep/IPsubnet The container details are at: https://github.com/elico/ipcalc-container To install the container you can use the next commands and then ...

elico

After seeing couple issues with containers I took the liberty to compose a speedtest container based on: openspeedtest https://openspeedtest.com/ https://github.com/openspeedtest/Speed-Test 1Gbps-local-speedtest.png The sources for the container and the Makefile to build it for amd64/arm64/armv7: ht...

elico

After a while trying to cross compile couple Golang based server I managed to find the right way to make it work inside a container. The current build repo is at: https://github.com/elico/ifconfig.io The binary and the actual container is separated into two separated processes. In golang you can sim...

elico

Hey, I wanted to run a PHP based service inside a container on my RB4011. The image I found that is compatible and slim is: https://github.com/erseco/alpine-php-webserver There are couple issues that are preventing the container from operation. The first is that it's tries to write into /dev/stderr ...

elico

I have couple hap ac2 and it doesn't have /system/health output at all. I have a power supply that stopped working and I wanted to read the voltage so I would know before something fishy is going with the power supply. However compared to other devices it seems like it doesn't have the input voltage...

elico

Hey,

Did you managed to find a solution for your use case?

elico

Can you share the relevant YouTube links?

elico

Hello, I have a mikrotik router with LTE interface. I want to send SMS via REST API, but I'm not able to be success. This command runs OK: curl -k -u admin: 'https://192.168.8.95/rest/tool/sms' With this result: {"allowed-number":"","auto-erase":"false","...

elico

API is the same as CLI, you can add only one entry by one "add" command. What about the PUT command? Can I add multiple values in a single command? ie how would I add multiple values with the next curl command? what json content will add more then one entry per request? Currently I am run...

elico

I wrote a powershell script that runs a script on the RouterOS device remotely via REST API. https://gist.github.com/elico/9110bc2a7eab12b9e65a1c1b3e4f8c69 add-type @" using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy { ...

elico

I have been working with V7 rest API for quite some time and it's wonderful. In bash I am running the next request: curl -s -k -u "${USERNAME}:${PASSWORD}" -X POST "https://${HOST}/rest/ip/firewall/address-list/add" \ --data "{\"address\":\"${ADDRESS}\",\...

elico

I wonder how they managed to not reproduce it, it's clearly there: Well it's pretty easy to reproduce with webfig when creating a new script on 7.1.1. I have tried creating a simple script with 5 lines and while on webfig when writing and editing it looks fine, in winbox and on export it has line e...

elico

Hey, The device is Rated for 1Gbps like many other only with FastTrack enabled. With FastTrack enabled you can't load balance traffic between WAN connections, ie the only way that I know to use these devices with proper speed is with proper Routing and FastTrack Enabled. You will first need to make ...

elico

It's supposed to use TTL. What RouterOS version do you have? I am using both 6.49.2 and 7.1.1. However now I have captured the dns requests and responses on the DNS server to make sure what happens and... It seems that indeed the TTL is being considered but, some domains have very weird ttl's. For ...

elico

I have used for quite some time domain names in the firewall address lists. Lately I have started monitoring my devices with syslog and I am seeing that every second the RouterOS device is sending a DNS query for all the domains in the address lists. I assumed that the device will do that a bit smar...

elico

I am using CHR on-top of hyper-v both V6 and V7 for the last couple years. The basics are that you need: * Gen 1 VM (will not boot at all on Gen 2) * Meet minimum RAM requirements, 128MB+ for V6 and 256MB+ for V7, I am using 384MB for 2 CPUS and 8 interfaces for V7 * Basic understanding of how Hyper...

elico

Testing the CHR vhdx on-top of Windows 10 hype-v with 8 nics (gen1 vm). * Can only see the first network interface * ACPI reboot+shutdown doesn't work (reboot is stuck with the "Rebooting..." text" [admin@MikroTik] > /system/resource/print uptime: 3m37s version: 7.1 (testing) build-ti...

elico

Do you still need help with this?

elico

You should try to use recursive routes.
It will automatically ping a specific destination but you will need to have a static ping address per route.
for one route you can use 8.8.8.8
and the other 1.1.1.1

https://help.mikrotik.com/docs/display/ROS/Failover

elico

This script works well for me for internal interfaces at the moment and for system/cpu temperature and if you go to my other thread, trying to do so for UPS log entry! https://forum.mikrotik.com/viewtopic.php?f=9&t=173565&p=849993#p849993 The one thing I would like to add from the first exa...

elico

Try this this one: ^[a-z0-9]{6,}\\.example\\.com\$ :put ("xyz.example.com" ~ "^[a-z0-9]{6,}\\.example\\.com\$") = false :put ("xyzxyz.example.com" ~ "^[a-z0-9]{6,}\\.example\\.com\$") = true You need extra "\" when you are inside a string/text in Ro...

elico

An example for sending a group or a single private message using a telegram bot. :do { :local telegramBotToken "xxxxxxxxx:secondpartOfTheToken"; :local destination "Number"; :local requestUrl "https://api.telegram.org/bot$telegramBotToken/sendMessage"; :local httpData &...

elico

You should try to see if there is some kind of error using a do and on-error like: :local cronUrl "https://xxxxxxxxxxxxx.php"; /log info "start"; :do { /tool fetch url=$cronUrl; } on-error={ /log info "finished with error"; } /log info "finished"; The log and ...

elico

You can use netwatch for ping tests and do the failover using a script call.
Jitter is a whole another story.

elico

Thanks! It turns out that /log get does exist. It does not auto-complete with tab, strange. But it works. And the /print as-value trick also works. I remembered that I had seen examples but could not find them using the search.... To find the ids you can use: :put [find .id ] or loop the [find .id ...

elico

You would need something like: $fileUrl = "http://".$localIP."/".$remoteSysModel."/".$fileName; $remoteAPI->write('/tool/fetch', false); $remoteAPI->write('=url='.$fileUrl); In api lines it should be something like: /tool/fetch =url=http://192.168.1.1/fileName =dst-path...

elico

I want to set up static dns in ros for matching any long (over 5 characters) subdomains eg. I want to match any domain like xyzxyz.example.com or abcabcabc.example.com, but don't want to match xyz.example.com or abcab.example.com. I was using ^.*\{6,\}\.example.com, but what I got in static record ...

elico

I am writing a keep-alive script from a proxy server to RB. I have an array of proxies which I am managing from a master node. The master keeps track on the proxies and updates the MT if one or more proxies are down and changes the mangle rules accordingly. Instead of re-creating the whole rules or ...

elico

@alexcherry what is your configuration looking like? Please send me your configuration i will give a try on that. Agent-Circuit-Id should be configurable with placeholders like %m = MAC-Address of Interface %n = Name of Interface (custom name) %i = ID of Interface XX (eg 01, 02, 03....) The informa...

elico

What about squid/nginx/varnish?

Squid-Cache is the general solution for http/1.x .
If you have a specific service you want to cache there might be a solution for this specific issue.
What do you need it for? windows updates?

elico

based on: https://forum.mikrotik.com/viewtopic.php?f=9&t=171750&p=840220#p840220 I have just tested that it's possible to do the same as on-up with lease-script. You don't need to set a global variable and just need to use the dont-require-permissions and use a script for the lease-script. /...

elico

Thanks, Eventually I managed to make it work with the next is my script: :do { :local Url ("http://ngtech.co.il/index.html"); /tool fetch url=$Url keep-result=no; :log info "*****$user Connected"; } on-error={ :log info "Error"; } :log info "#####$user Connected&qu...

elico

@mrz, I am trying to figure out how to do that but can't. I have the next in the ppp on-up script: :log info "****** $user Connected"; /system script run test; and in the test script: :log info "#####$user Connected"; The logs shows: ****** eliezer Connected ##### Connected So it...

elico

My main concern is the user variable.
I need it for the fetch script.

What are my options?

elico

I have a nice setup with pppoe/l2tp/pptp server it works great of course. I wanted to trigger a remote api call using "/tool fetch" however it doesn't work. I am trying to run the next: /tool fetch address=192.168.200.80 host=192.168.200.80 mode=http src-path=login output=none; :log info &...

elico

I tried the script from the wiki at: https://wiki.mikrotik.com/wiki/Manual:Scripting-examples#Block_access_to_specific_websites But it just didn't ran.. So I came up with: :foreach i in=[/ip dns cache find name~"(youtube-ui.l.google.com|youtube.com|googlevideo.com)\$" && $type ~ &q...

elico

OK Now I got it.
I will try it later and see how it goes.

elico

There's no "/ip firewall remove". This works for me: /ip firewall address-list remove [/ip firewall address-list find list="test" address="1.2.3.4"] but only when I write list name and address like this, I can't find a way how to make it work with variables. I assume i...

elico

I have a set of lists I want to cleanup a specific IP from another address list. It's not working.. What am I doing wrong? :local lists {"test1"; "test2"; "test3";}; :foreach ip in=[/ip firewall address-list find where list="CLEANUP"] do={ :local ipAddresss [/...

elico

I am curious how this went for you. I have been bombarded with zoom problems and they always seem to be mikrotik customers. I have tried disabling sip alg and udplite but it still seems like I get a lot of complaints from my customers at sites where I am running mikrotik routers and waps. Today I f...

elico

Hey,

You can send me or anyone else a supfie or export the router config so we can see if there is something specific.
The issues are limited to:
* Routing
* DNS
* Firewall

Since you are receiving a 403 it's probably not basic Firewall rules.

elico

Hi again As I wrote, it's a hub and spoke topology. Ipsec, OSPF, tunnels, - everything runs fine. Connected clients on the spokes gets a iperf3 throughput ~180Mb. That's fine. If I implement "VRF Lite" on a spoke router,- thoughput becomes very unstable, 180Mb - then 1Kb - then 0 - then 1...

elico

Hey @elico, you obviously use sub-optimal config for your hardware. Furthermore, the link you provided suggest 1Gbps routing performance for gr3... Wrt testing, have a look at https://mum.mikrotik.com/presentations/MX19/presentation_6766_1555080654.pdf & https://youtu.be/rQX0inNcPuM Just poping...

elico

So....disabling route cache got you the speeds you were looking for? I'm having the same problem as you. I don't want to downgrade if I don't have to. Disabling route cache means disabling also FastTrack which technically is a "flow" offload into either hardware or software. For normal an...

elico

Hey, The basic config of a GRE tunnel between PA and MT would be a bit different from MT to MT. With MT to MT the IPSec tunnel would be negotiated with the PSK defined in the GRE configuration. With PA and MT I assume that you would be required to to create another tunnel ontop of the IKE and the ip...

elico

You might be able to use IP routes with different metrics per gateway to force the VPN via a specific ISP.
ISP 1 metric 10
ISP 2 metric 20
Route of specific subnet or /32 host via ISP X Gateway/Interface with metric 5.

elico

Have you tried to look at:

/tool mac-server export verbose

Output?

For the winbox to be open to eveywhere you should first set these:

/tool mac-server
set allowed-interface-list=all
/tool mac-server mac-winbox
set allowed-interface-list=all
/tool mac-server ping
set enabled=yes

elico

Hey, What have you tried until now? There are some missing pieces to understand the technical issue. Who is behind the Mikrotik device? What are the routes on the Mikrotik device? /ip route print Might help to understand. What you technically need to do is add a dnat rule on the l2tp\sstp interface ...

elico

The network structure is not well understood to me. What is the IP of each device in each end of the setup? From what I remember both RB2011 and Powerbox Pro has the same CPU and they cannot perform better then 200Mbps ~ without RouteCache +FastTrack and FastPath. In any case a PtP it is preferable ...

elico

Can you please share more about this setup details?
I wan to try and run it locally with couple devices.

elico

Hey, Pings can be dropped from time to time on the Internet so it's not a solid measurement for RDP. I would start with basic RDP debug. What Windows versions are you using? What connection are you using? TCP+UDP or just TCP? What do you see in the windows event log? You can try to disable Route-Cac...

elico

Hey, I am working here on an IPSEC s2s setup with Palo Alto and Mikrotik CHR. It would help to understand both sides setup. In the PA side you can use the default PH1 and PH2 IKEv2 and IPSEC profiles. ** EDIT ** For most use cases you will need to set on the PA side the IKE Gateway side "Peer I...

elico

Also, IPv6 has redirect message that end user hosts has to obey if received - that is, if network infrastructure knows a better route to the host via another router in the same network, it can send the redirect to the end user host. After that, the end user host has to send all the traffic using ga...

elico

Hey please! After 6 years, still not WoL in Winbox. It is just a button (for example in the DHCP Server/Leases menu, It would be great to wake computers by clicking on the MAC, mouse right button, WAKE!). +1 here I actually tested a nice script that runs every specified interval and checks for a li...

elico

EDIT: It appears that the browser on client cannot reach higher speed then 500 ~ Mbps on the HTTP SpeedTest. So I tried again with iperf and found out the next: via RB2011 using iperf with or without NAT I am able to reach 750 ~ Mbps. However when I am disabling route cache I am reaching a limit of:...

elico

I have a local RB2011 (FW 6.44.3)with 2 LAN segments: LAN - 10.0.0.138/24 SERVERS - 192.168.89.1/24 Client: 10.0.0.65 LAN SpeedTest Server: 10.0.0.79/10.0.0.13 SERVERS SpeedTest Server: 192.168.89.42 It works for a very long time now but always with the same max routing speed of 250-280 Mbps from on...

elico

I have couple RB750Gr3 but none of them were able to reach more then 300 Mbps for file transfer in routing only mode (No NAT). To test this issue try to use the "Bandwidth Test" tool of mikrotik. Take a look at this post: https://forum.mikrotik.com/viewtopic.php?t=104266 It has ip addresse...

elico

Hi normis, can this "issue" or "feature" can be published in the product wireless chip spec so I and others can see it while evaluating the product?
(this post is good enough for me but if it was on the specs I wouldn't be required to search the forum)
Sounds fair?

elico

<r>Depends on the OS forced limit and also the CPU arch. Iptables mark can be up to very very high ie from: https://www.frozentux.net/iptables-tutorial/chunkyhtml/x2702.html section "10.3.10. Mark match" it seems that the mark themselves can be much higher then 250. The next link give some...

elico

What about memory?

elico

I have a bunch(20+) HAP and RB750G devices which has a USB port. I have a USB Disk On Key with static html files that I want to be accessible via the network. The way I did that until now is using SMB and a public read-only share. I was wondering if it's possible to serve static files on a specific ...

elico

Was this answered?
I can write a tutorial on how to make a Linux squid work with mikrotik.
I have been working on som daemon that will throw rules to the edge router about what IP's to intercept and to what proxy forward the traffic.

elico

Anyone tried to configure RouterOS devices with ansible? Basically it's based on ssh so it should be doable and maybe in some way Anisble can be used as the "controller" for a RouterOS cluster. It would be similar to a "Control Plane" which is a cli\scripting\webui that sends com...

elico

You can use FastNetMon for DDoS Sync attack. It has support for rOS.

https://github.com/pavel-odintsov/fastnetmon

M.

When taking a peek at the FastNetMon github issues I have seen that there is an open issue about a specific issue and it's yet clear to me if it was fixed or not.

elico

I am connected to work over a PPPOE connection but to some systems I am required to have a L2TP tunnel. I tried to follow the next tutorials: http://wiki.mikrotik.com/wiki/Policy_Base_Routing http://wiki.mikrotik.com/wiki/PBR_PTP_IPIP In order to implement PBR for specific hosts on my network. The f...

elico

Will it only work for routers or also for SWOS?

elico

I tried to upgrade a 260GSP using firefox and it required me to rely on a the wiki article: http://wiki.mikrotik.com/wiki/SwOS#Reinstall_SwOS_firmware But on a rb750gr2 the defaults are to have 192.168.88.0/24 I had to use the combination of the article and use the existing address-pool instead of c...

Search found 152 matches