MikroTik

paintballer4lfe

I would recommend folks make input rules to block incoming to all outside connections or to specific sources but a lot of folks rather go this route oddly enough. Not only incoming, also attention should be given to outbound traffic. Block also egress traffic trying to connect to such IP's. I block...

paintballer4lfe

Why again do I need this......... Currently have no issues with regular firewall rules. I don't run your network so you tell me if you need it or not. It's an ongoing list of IP's actively attempting logins to systems open to the internet. Do as you please with it. I would recommend folks make inpu...

paintballer4lfe

Well I figured I might as well make this a public thread so it's not just in my sig only for the few that view that. I recently have made a system to ingest and process logs for honeypots I have in the wild. Essentially it's just open services for now that IP's will try and wordlist or brute force l...

paintballer4lfe

+1 this can be useful

My friends who rent out VPS space on my servers are always opening up ports to stream their plex porno collection. This can be helpful to only allow home devices to open up instead of my annoying friends on my servers paying me big bucks for shitty VPS's.

paintballer4lfe

RouterOS 6.47. This is not a change between RouterOS versions - these damn SXTsq antennas have always done this. Drove us nuts with our automated provisioning system which we made a specific exception for. But field changes don't use the automated system which is only used for initial deployment. Y...

paintballer4lfe

Show us on the doll where Mikrotik touched you. It's a bit of a dumb change but this is really on you. I'm assuming you're a provider of some sort, you did no testing prior to deployment? you don't have any systems in place to save running configs remotely like Oxidized? I get it, I would be a littl...

paintballer4lfe

quick update:
So it wiped all of the files and folder in the FIles menu, including the tar with adguard in it lol.

Uploaded the tar again and I have a feeling the same thing is going to happen, absolutely no log entries still.

paintballer4lfe

Not sure if anyone has tried yet but my 4011 is now not in my production and can be fiddled with so I wanted to test with an ADGuard container on it so the folks in the Mikrotik networking discord could have some feedback and help on basic implementation but I have a feeling there's an issue with th...

paintballer4lfe

export not work

routing-mark=*4000 instead of mytable
Code: Select all
/routing table
add disabled=no name=mytable

/ip firewall nat
add action=log chain=srcnat routing-mark=*4000

What's the routing mark it uses? I genuinely can't read that small of font size.

paintballer4lfe

why would this take so long for mikrotik to resolve? (i show atleaste 6hours its been down now) the fix should be: make payment on the expiration, and then the service is restored (ie dns NS servers pointed back to mikrotiks cloud infra). and ~ 10min for TTL to reset. It could be something beyond a...

paintballer4lfe

Reply to @mitzone:
but I'd really like to have an official statement on this
Probably [MikroTik team] has a hard time answering this...
Imagine if you were the person who forgot [to renew the domain]...

No one has to imagine, they should be looking for new job if true. Pretty simple.

paintballer4lfe

Probably is hard to reply to that... Imagine if you are the person that forget that... That's pretty broken English. no clue what you mean "imagine if you are the person that forget that". Forget what? Deploying a simple system to monitor YOUR domains you subdomain to the public for any r...

paintballer4lfe

Is really hard check the service for 100.000 and more DDNS provided...

Not really, there's tools for this. You can also code your own solutions, nothing new. Especially if you just tie into the public DB's like Virustotal and scrape for subdomains. Very easy actually.

paintballer4lfe

You deserve to be fired if you ever fuck up like this lol. What I can say is just: you are right... but first must be check what happen really... If for some reason some xxx.sn.mynetname.net is used for something illegal, the authority can ask the block of the DNS... I'm assuming it's from no payme...

paintballer4lfe

@paintballer4lfe, as you write, the biggest stupidity, laziness and "bad staff" are on user side who relies on only one service, which can goes down like all the other services in the world ... I do not use this service and have plenty of failsafe options HOWEVER the home users aren't goi...

paintballer4lfe

Question is how could this ever happen? When a domain is about to expire u receive TONS of freaking warning emails . I simply dont get it how lazy handling that was... Laziness, stupidity, bad staff. Tons of reasons, none of them are excusable lol. It's oddly common for some people to have this hap...

paintballer4lfe

We are happy to announce ZeroTier support for ARM architectures with enough space*. RC2 package available here: https://box.mikrotik.com/f/c9a303113884413bbdca/?dl=1 But from the next v7.1 release, it will be included in the release system (all packages ZIP archive). To join a Zerotier network, it ...

paintballer4lfe

Please use your brains and publish a fix that's easily obtainable instead of emailing generic support for the new release that you apparently already have compiled. Here's a copy of rc2, but only the ARM32 version: https://streetlights.info/nc/s/t7zctZXirrnk2xj Woah, someone with a brain! Thank you...

paintballer4lfe

We have fixed "cake" reboots, in case you want to try prerelease rc2 version on your setup. Please contact us directly (support@mikrotik.com). We will provide you with packages to test. umm great except for alot of people who are literally never going to see they have to email for a fix. ...

paintballer4lfe

So some 4011 info for anyone wondering. Memory leak is still a thing - just slower but still unusable. Upgrade breaks static route config - at least for mine it did. (removed default route) Updated my 4011 memory leak ticket but of course it's been completely ignored for 3 months now so there's that.

paintballer4lfe

Why didn't you stay with those equipments then? If it works, don't fix it.

lol because those devices have a different purpose in my architecture. They were tested for this specific issue to ensure it is a Mikrotik issue ;)

paintballer4lfe

MikroTik can't fix your shitty provider.

Funny because Fortinet, Cisco and Extreme networks can lmfao.

paintballer4lfe

How about some more useful debug logs? from when it's working and from when it's not? hm? can you do that instead of screaming for nothing in the forums? You specified some "junk modem" are you behind a modem? is that in bridge or router mode? details? hm? no? ok. If you use your eyes you...

paintballer4lfe

Yup I've tried with and without a prefix hint. Believe it or not on other devices I can use prefix hint or not use prefix hint and still get an IPv6 no issue and obviously end user devices get an IPv6 no issue. If you do want to get this fixed and not just whine, please stop it with the "MIKRO...

paintballer4lfe

lol I wish that could have helped. Literally every end device and other switch and router I connect to this junk modem gets dhcpv6 prefix and address (for end user devices) totally fine. It's ONLY this 4011 that will not obtain an IPv6. I actually know someone in Denmark with the same issue that we...

paintballer4lfe

I have prefix delegation working perfect, devices directly connected use SLAAC perfectly fine and I can even get IPv6 addresses AND delegation to work with my shitty Nighhawk router AND my semi not great Fortigate 101E BUT Mikrotik decides they don't want to follow RFC I guess? I have IPv6 DHCPv6 p...

paintballer4lfe

Just like the title says. Why is IPv6 basically unusable????? I have prefix delegation working perfect, devices directly connected use SLAAC perfectly fine and I can even get IPv6 addresses AND delegation to work with my shitty Nighhawk router AND my semi not great Fortigate 101E BUT Mikrotik decide...

paintballer4lfe

Tested with windows wireguard client since ya know, logging isn't needed for Tik's. Handshake fails on the client, the Tik see's the packets coming in but has an unknown(0) for out interface. Seems the Tik doesn't know what to do with the wireguard packets. I have an SSTP tunnel up on the CHR and i...

paintballer4lfe

Tested with windows wireguard client since ya know, logging isn't needed for Tik's. Handshake fails on the client, the Tik see's the packets coming in but has an unknown(0) for out interface. Seems the Tik doesn't know what to do with the wireguard packets. I have an SSTP tunnel up on the CHR and it...

paintballer4lfe

/routing table add name=ether1 /ip mangle add action=mark-routing chain=prerouting in-interface=ether1 passthrough=no /ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=70.39.67.49 routing-table=ether1 scope=30 target-scope=10 This is the mangle config on my CHR which yeah does noth...

paintballer4lfe

I have a CHR running beta 3 and a 3011 running beta 4 and really I'm just trying to get a wireguard tunnel up. Wireguard config on CHR IP set to 172.2.2.1 for wireguard interface /interface wireguard add listen-port=13259 mtu=1420 name=wireguardSRV private-key="<key>" /interface wireguard ...

paintballer4lfe

I'd double check the NIC driver the VM is using. Make sure it's VMXNET3 It is, pretty sure there's just a general issue with this CHR showing 1Gb speed because I can process alot more than 10Mbps lol. Consistent 500-720Mbps no problem, link speed just shows 10Mb for some reason so I guess not reall...

paintballer4lfe

What hypervisor are you running and what version of CHR? RouterOS 7.x while called a Beta is really alpha quality and no where near production ready. Luckily this is a production machine but it doesn't really matter if I use the shit ROS7 or non shit ROS6 version. But yeah it's 7.1 running on ESX 6...

paintballer4lfe

So I bought a license for this CHR I'm running and I'm not sure if this is normal or not but the ports are showing 10Mbps not 1Gb. Setting to 1Gb makes the interfaces drop. Can I ignore the link speed and assume CHR runs at 1Gb links without showing them as 1Gb links?

paintballer4lfe

It ended up being an issue with the ubuntu server routing, fixed the issue on the server side but unfortunately the VPS could not offer what I am in need of so on to the next hoster.

paintballer4lfe

So as the title states I can see and receive the packets being sent through the tunnel to my tik to send to an internal host and I can see the packets coming back from the internal host trying to get back to 192.168.6.1 (wireguard server at end of tunnel). However when I check the tunnel I can ONLY ...

paintballer4lfe

So the issue which was a weird one is the fortigate was sending the incorrect router ID. reboted the firewall and it started sending the correct ID and it's working great now.

paintballer4lfe

So I configured OSPF on both sides and ran a debug to see the OSPF packets and they are coming back and forth with the Tik and Fortigate however the Tik and Forigate are not negotiating properly or something. Router ID's and correct as well as areas and instances. I've never configured OSPF on a Tik...

paintballer4lfe

I setup sstp some time ago and I love it but I'm setting up my old ac2 for some road warrior stuff but apparently I'm doing something wrong with the client key. SSTP client gives a "no key for certificate found (6)" but I've tried all kinds of key usage options and it still gives that erro...

paintballer4lfe

I think you have to disable auto negotiation and set the speed to 1000 full duplex on both ends in this case.

^^ yeah you'll have to set speeds on both sides and I'd be checking the other device if yout Tik says the link is OK but is clearly not OK.

paintballer4lfe

This may sound dumb but you might have to swap fiber pair ends. Change the A to B and B to A.

paintballer4lfe

It is quite similar to previously repaired "*) dns - do not use DoH for local queries when a server is specified;" in 6.47.1 - in both cases DOH took priority from specified server or local static entry. Unfortunately this is known issue (for any forum user), reported several times since ...

paintballer4lfe

It's definitely known. In my opinion it either bug or weird feature. I don't remember any official comment from MikroTik, how do they see it.

LOL I'm sure they are going to ignore it and roll out RouterOS7 maybe in the next 5 years with the issue ongoing.

paintballer4lfe

Is it a feature or a bug that RouterOS's DoH functionality turns off local DNS static entries completely until you disable DoH completely? I was bored and decided to enable DoH since Tik doesn't do DNSSEC and what not but noticed my local DNS entries were ignored and sent to cloud flare to resolve u...

paintballer4lfe

So yeah even tried placing a static route to 8.8.8.8 via the client tunnel to the gateway of the tunnel and it still times out.

paintballer4lfe

So I was able to bring up the OVPN client with help from Mikrotik direct. However nothing is being routed/handled correctly through the tunnel and I have no clue why. I can't even ping 8.8.8.8 from the tunnel interface on the Tik. Anyone have any ideas on what to try to get traffic to process like n...

paintballer4lfe

We've talked on discord and think there is an issue with the ros system and OVPN functionality. My OVPN client is having essentially the same issue. I've been forced to "report a bug" and hope for the best.

paintballer4lfe

I have never been able to actually get an OpenVPN config to actually transfer to Mikrotik's OpenVPN client. I've imported and trusted the config's certificate. I have the port, auth and login details all correct but when the handshake goes through it goes through 3 steps and then disconnects and I'm...

paintballer4lfe

Obviously you dont reset it as you should... While the device is powered off press the reset button, without releasing it power on the device, when the usr led starts to flash release the reset button immediately... Let it boot and it should be like before... Actually yes as i mentioned on the thre...

paintballer4lfe

I have a hAP ac lite i've been doing alot of testing and fiddling with but i made a change that completely made this device in accessible locally or externally lol. I've followed many guides on how to reset using the reset button and also using netinstall HOWEVER the hap usr lights blinks then goes ...

paintballer4lfe

Update: I disabled that setting and it actually works perfect thank you!!

I've only used ASA's for VPN's using the Anyconnect clients so this was a learning experience indeed lol.

paintballer4lfe

Routes in PPP Secret are not for clients ( https://wiki.mikrotik.com/wiki/Manual:PPP_AAA#Properties_2 ), it makes no sense to put local IP there. Currently RouterOS can push routes only to IKEv2 VPN clients. But you still can have default and class based routes added by Windows VPN client itself (p...

paintballer4lfe

So i'm very new to VPN's with Mikrotik so i'm sorry if something doesn't seem obvious to me about this config. Here is my profile https://i.gyazo.com/989f3d8924a622973f6596dca9a20467.png (vpn-pool is 10.11.10.1/24) Here is secret (only 1 user) https://i.gyazo.com/71cbf14d6fd4e084356549150ae3bb5c.png...

paintballer4lfe

I just setup a HAP ac lite as a very obvious backup WWAN gateway for my home lab. The configuration aspect is perfect and everything works great when my failover uses the device and it's WWAN. So here is my issue. I use LibreNMS to monitor my home lab and the wired stuff works fine of course HOWEVER...

paintballer4lfe

So i have a few wireless AP's that i want to do some testing with. I'm very new to mikrotik systems but the 10GB wired router i have is pretty awesome so far. I have 2 AP's which are 2 separate SSID's that i want to have 2 devices connect to as a client/bridge where i can then use the router to do l...

paintballer4lfe

Hmm well then i guess this router is partially useless for me without 10GB fiber and only 10GB ethernet. Thats fine for now though. This should still default to 1GB and work fine with the cisco X2 SR 10GB right? the cisco module can function at 1GB to my knowledge.

paintballer4lfe

I'm not entirely sure who could help with this as i am new to Mikrotik and a big Cisco fanboy but i like the router i bought and it seems pretty awesome except for this current issue. I have an RB3011 with a 10GB SFP/SFP+ module that is listed in the Webcfg UI and seems to be functioning from the ou...

paintballer4lfe

Bummer, no worries. Thanks for the compatibility link!

I'm not sure if anyone can verify or has tried but do the Cisco 1GB SFP's work with MikroTik routers? I've got a couple laying around at my parents i was thinking of having them ship me.

paintballer4lfe

I couldn't find anything specific or obvious but i'm curious if anyone can provide some info about this. I just bought the RB3011UiAS-RM router and i have a C4948 with twin 10GB uplink modules. The issue i'm trying to find and verify is if the S+31DLC10D SFP module would work at 10GB speeds with the...

Search found 59 matches