MikroTik

bjohns

Updated a RB4011iGS+5HacQ2HnD from v7.11.2 to v7.12. Has a Dell 3m 10GbE DAC (L56SF018-SD-R) connecting a CSS326-24G-2S+.

I had to unplug/plug the SFP for traffic to begin to flow, looked okay otherwise.

bjohns

Tested the Proscend PS180-C-R VDSL2 SFP pair.

CRS317-1G-16S+ <-eth-> CSS106-1G-4P-1S <-vdsl2-> CRS317-1G-16S+

161mbit/sec UDP, 148mbit/sec TCP both directions between the CRS's over a 3m cat5 lead.

Later I'll find a long copper pair on campus to see what speed/distance can be obtained.

bjohns

Enterprise Next Generation Firewalls (NGFW) can't do a lot about encryption either - even 'man-in-the-middle' decryption is now problematic with modern browsers and clients. They're resorting to extra-firewall intelligence - cloud based threat analysis and mitigation, DNS monitoring, traffic pattern...

bjohns

Hi Guys, We have a vCloud environment being used as an IT infrastructure Lab. The networking aspect of it all is extremely basic - they use a 'vShield' vAppliance as a two port NAT device to divide up virtual networks within the cloud. I would like to try out using ROS but thought to ask if anyone e...

bjohns

Cheers, I think I know what you mean, but to confirm: The first table is bsnAPIpAddress (1.3.6.1.4.1.14179.2.2.1.1.19) and an example entry is: 1.3.6.1.4.1.14179.2.2.1.1.19.0.25.169.166.246.32 = 192.168.1.101 The second table is bsnAPIfLoadNumOfClients (1.3.6.1.4.1.14179.2.2.13.1.4): 1.3.6.1.4.1.141...

bjohns

Hi folks, Seeing if I can map out the number of clients attached to a LWAP that is controlled via a WiSM. The table containing the list of APs and the number of clients each is: 1.3.6.1.4.1.14179.2.2.13.1.4 This will display a list of the following types of entries: 0.34.85.242.67.80.0 = 9 Where 0.3...

bjohns

Yep. Brisbane would be nice.

bjohns

R52 and R52-350

bjohns

Yeah, tried a bunch of wifi cards, every time I enabled the wireless it'd kernel panic and lose the wifi interfaces. Fiddling around would get them back again and then it'd panic again etc.

So now I'm using a little RB133C instead.

bjohns

Should have read the boards before buying a RB433 with this same issue

bjohns

+1 for MMCX.

bjohns

I'll refine it a bit more and drop it onto the wiki with a summarised howto, hopefully along with a few other matches that I'll need.

The howto on the L7-Filter site is a bit obscure so hopefully I can make it easier to understand.

bjohns

Figured it out, it's quite simply:

get /get_video[\x09-\x0d -~]* http/[01]\.[019]

bjohns

Long time since I posted - this place is busy these days. I've put my bofh hat on and would like a way of surgically restricting content such as Flash videos and other bandwidth/productivity sinks. Since I'm coming from a pre-3.0 era I'm not up with the new L7 filtering and it's associated regexes a...

bjohns

Hi guys, There's probably a few of you that have done similar things, but I thought I'd post my code here anyway for comparison/reference purposes (and to give the better programmers here a laugh). The first script grabs the data produced by http://<routeros ip>/accounting/ip.cgi and dumps it into a...

bjohns

Has anyone set up RouterOS to play nice with Spectralink based wireless voice services? I have access to a Alcatel OmniPCX 4400 , Alcatel SVP (Spectralink clone) and Alcatel Mobile IP Touch 300 sets. Currently using a Symbol/Motorola WS5000 Wireless Switch with AP300 RF Ports for wireless coverage. ...

bjohns

As usual, I'm in.

bjohns

http://kernelnewbies.org/Linux_2_6_22#h ... e8d84847cc

Looks interesting - will this assist MT in any way?

bjohns

D-Link 580 adapters are crap, they have been mentioned a number of times on these forums. If you get one, enjoy your reboots. I've yet to come across a VLAN switch that didn't support VLANs correctly. All in all the standard has been around long enough and most manufacturers have it down. I've used ...

bjohns

'invalid' is probably a harsh term for them. 'redundant' is probably more appropriate. Treat OSPF as another router 'instance' on the hardware. Meaning that you have your standard router with its connected/static routes, and then another OSPF router sitting on top of it. Since there are already conn...

bjohns

I thought as much. I guess that's the main reason for Layer 3 switches; with the router's "interface" sitting on the backplane. Thanks.

bjohns

Hi guys, Silly question, when routing between VLANs, does ALL traffic go through the router, or does it simply swap tags and let the switch do the rest? So for example I have a bunch of VLANs on a switch, a MT on a stick routing between them. A host on vlan20 wants to establish a connection to a hos...

bjohns

I'm pretty sure the Winbox hotspot setup wizard does all these things, it's fairly much the same as the cli.

bjohns

AOL have some strict mail relaying rules. Make sure you have a reverse/PTR record set on your mail servers IP and setup a SPF record if you haven't already.

bjohns

Thanks for that.

It's useful having a tunnel for dynamic routing purposes, plus it makes QoS etc easier.

bjohns

Currently I have a pair of Cisco 857's running with a IPSec 'tunnel' between. I would like to replace one of the Cisco's with a MT router. What would the RouterOS config to match the following Cisco config be? crypto isakmp policy 10 authentication pre-share crypto isakmp key ######### address 1.1.1...

bjohns

http://www.opendns.com has adult content blocking on its agenda. No exact ETA at this stage however they mentioned mid this year.

I use them for URL spelling correction, searching and phishing site filtering.

bjohns

Maybe using a coinchecker with a serial interface - RouterOS can do some things directly with the serial port.

bjohns

Maybe a publicly accessible bug tracker might be the go. Could be 'read-only' or maybe it can allow someone to submit a bug along with a supout file etc.

At least it'll provide a list of currently known bugs.

bjohns

"because account is made and activated at the time of payment"

I take that to mean that they pay, account is enabled, they are logged in automatically. Thus they will now have access to their e-mail to obtain a username/password for subsequent sessions...

bjohns

What's the experience been like with Wireless Orbit to date? I'm wondering what the radius reply times are like - ie if they're fairly average in the US then use from Europe/Australia and other parts might be limited due to timeouts. It's a good concept and I would like to have them as an option for...

bjohns

Fidelio has an API, the reference for it costs a fair bit. It would have to be the more popular PMS around, however as mentioned, there's a lot of them and each with it's own way of doing things. You're probably better off developing a 'black box' of sorts that sits between the MT and various PMS sy...

bjohns

Simply search for Intra-VLAN Bridging

http://www.cisco.com/en/US/tech/tk389/t ... 7af6.shtml

It's not 'impossible' its just you should carefully think about it before doing so , consider all of your options.

bjohns

Look at the 'Traffic Flow' feature - it supports NetFlow export etc.

bjohns

iPass/bongo usually do it based upon a prefix/realm. No reason you can't do the same thing - when they select their ISP append a realm or something onto their username and base pricing etc upon it. The other way is to run multiple Virtual APs, and map them through to each ISP that wishes to particip...

bjohns

Are there any miniPCI based GPS devices?

Commell make one although there aren't any specifications detailing accuracy/speed.

bjohns

It will work as I have done similar things. Although the general consensus around here is that bridging vlans should be avoided if at all possible.

bjohns

I found out something important - limits in user profile apply only at the time of the user login. First login will create dynamic queue and it will stay there until the user will expire. Any user profile limit change during that time will not affect this dynamic queue. Correct. If using RADIUS you...

bjohns

I believe that version of FreeRADIUS has a MikroTik dictionary built in as such, no need to add an external one. :) It's had a very basic mikrotik dictionary since 1.0 I think. I had to still load the Mikrotik supplied one into 1.1.4 because many attribs didn't exist or had changed (many now have t...

bjohns

I don't know what you're getting at. But if I was a network provider (meaning that I have a bunch of routing/switching/wireless gear interconnected together) and I wanted to share that with other entities, I would much rather just use MPLS and not worry about all the IP etc - they use whatever they ...

bjohns

http://wiki.mikrotik.com/wiki/How_to_ma ... ot_gateway

I'm guessing you have read the above howto in the wiki?

One hotspot per interface, so just use two to do what you want.

bjohns

There's a lot MPLS offers, the first thing that springs to mind is enabling multiple ISPs to share the same infrastructure, such as Hotspots. As for size, I think quite a few people here have sizable networks. I feel small with 50 hotspots and 25 APs/clients located throughout the east coast of Aust...

bjohns

Update to 1.1.4: * VALUEs can only be defined for 'integer', to catch mistakes with setting VALUEs for type 'string'. Because of this I had to remark out all the Cisco Values such as: VALUE H323-Disconnect-Cause Local-Clear 0 For freeradius to accept the dictionary. Don't ask me why, it just error'd...

bjohns

With freeradius you can set this using radgroupreply - I don't know about user-manager, but it should be possible or easily implemented.

bjohns

From the outset it looks kind of odd - why not just bridge ether1 and ether2 and let the vlan traffic just travel through like any other?

bjohns

Edit the 'Rate-Limit' attribute within the Hotspot User Profile. Or if using radius set the Mikrotik-Rate-Limit attribute.

bjohns

LDAP is a protocol used by many different systems/products, the same goes for RADIUS.

How do you propose for us to predict which particular implementation of LDAP/RADIUS you intend on using?

Tell us about the intended environment and exactly what you would like to achieve.

bjohns

From the site linked by tneumann:

You can enable NetBT broadcast forwarding (UDP ports 137 and 138) on some routers. However, the practice of enabling NetBT broadcast forwarding to simplify NetBIOS name resolution is highly discouraged.

So I would lean towards WINS.

bjohns

Usually UDP broadcast forwarding, think DHCP relay with a different destination port (137 instead of 67).

Sounds like something you can mimic using RouterOS, if not then maybe MT would like to include something like this?

bjohns

Setting up a WINS server isn't that difficult - if there's a windows server then its just turning it on. Otherwise Samba is excellent. This would be my suggestion for a client/server style VPN.

Interesting the Linksys ones do this - I might investigate them further and see what kind of magic it is.

bjohns

Sorry to bump and old thread for self gratification - but given the hits on my blog originating from this thread I think there must be some interest in what I'm doing. http://naturalnetworks.blogspot.com/2007/03/revised-hotspot-interface.html Nearly finished the remote hotspot interface. Now have Pa...

bjohns

http://wiki.freeradius.org/Radclient

echo "Framed-IP-Address=<client ip>,Rate-Limit=<limit values>" | /usr/local/bin/radclient <routeros ip>:1700 coa s3cr3t

bjohns

I would contact microsoft. If something as simple as a browser redirect is causing a BSOD it needs to be fixed by them, not mikrotik.

No, Mikrotik should support chickens :P

bjohns

Jimojo are in direct competition, and I've attempted contact with Goldentek some time ago and received no response. Thus why I have been a happy wrap customer because of a very good local supplier of that equipment.

bjohns

For a MIPS based solution I'm sure the Infineon chip is great. Still waiting on a local supplier of RouterBoards tho ;)

It looks like the new AMD Geode LX800's will be used in the wrap boards:

http://www.amd.com/us-en/ConnectivitySo ... 22,00.html

bjohns

The RFC indicates that TCP Window Scaling occurs at the transport layer. Makes sense to me since it's a transport layer protcol... The window scale extension expands the definition of the TCP window to 32 bits and then uses a scale factor to carry this 32-bit value in the 16-bit Window field of the ...

bjohns

...the AMD Geode SC1100 processor has been discontinued, and the 266MHz processor is no longer available. Supplies of the 233MHz processor are also limited. This means that the WRAP and net4801 boards have to be redesigned to accommodate a new processor. News from the manufacturers is that this pro...

bjohns

Rate-Limit += 128k/512k 256k/512K 64K/128K 60/60 5

That will do what you ask, bursting for 60 seconds on each, and will assign a priority of 5 to each queue.

bjohns

I wasn't referring to Wireless Orbit, just the operating over water part.

bjohns

Same for me, I would like to use the Commell LE565 platform (1GHz Via, 4 x Realtek RTL 8110S-32 Gigabit Ethernet controller) instead of the LE564 one (533MHz Via, 4 x Realtek 8137C+ 10/100 Mbps).

bjohns

-- More time and money to eat pizza, drink beer, sleep. I didn't see that on the spec sheet, how do you know of this feature? :P I'll try one or two out when the local supplier gets them in. The only time we use higher power is when using a very low gain antenna - ie to get the maximum vertical cov...

bjohns

So the time should be in 24hr format then?

Thanks.

bjohns

That sounds similar to using a Cisco router as a terminal server - telnet to port 200x for each async port to test/configure the analog modems. I'll definitely have a look at this since it could also be used for remote environment monitoring. Just tested it with a Linksys SRW224G4 switch and it work...

bjohns

I had considered that but the manual says:

T - either "A" for AM, or "P" for PM;

So I thought "T" was merely a gap filler to be replaced with A or P?

bjohns

Receiving an error when passing this attribute to the Hotspot: Required format: YYYY-MM-DDThh:mm:ssTZD hotspot,error,info,debug testuser10 (172.16.101.250): ignoring invalid session terminate time <2009-05-07P11:59:59+10:00> from RADIUS Manual says that TZD can be in the form of: +hh:mm", "...

bjohns

On the login page you will need to 'capture' the link-orig var and save it somewhere, like in the users session/cookie. Then you can recall it from the status screen.

The MT lets go as soon as it submits the form data, so it wouldn't know anything about your status screen.

bjohns

Also don't forget there's LOTS of connector styles out there and the chances are that you can find one that suits your particular application - ie a right angle entry.

bjohns

If appropriate, you could also look at setting up a VirtualAP for hotspot clients.

bjohns

I agree that the webbox should not include the 'full' feature set as winbox does - however I think it should be brought up to a feature level equal to that of say a Linksys or Netgear firewall/router.

bjohns

In addition to waiting to hear from the users on what they would like implemented - I would hope MT are looking to the competition on what they are offering. For example Vyatta may be a young project but it's got a nice wish list that would be worth a look. I have mentioned various features of Colub...

bjohns

I touched upon methods of passing the MD5 encrypted password from the backend to the MT for authen. I couldn't work it out when I tried but I might revisit it again now that I have a few more ideas on how to do it.

I'm currently using https login.

bjohns

I wonder if the ESD/EMP protection will fix up the woes people have been having with the Pacific Wireless collinear antennas?

They look good on paper and if the SR series is anything to go by they should be good performers.

bjohns

I noticed there are a few bug fixes re IE6+Proxy regarding Hotmail access but just now I had a user who kept receiving a '400' error from the routeros proxy after submitting to the 'live sign-in'. I disabled transparent proxy in the default hotspot user profile and this fixed the issue. RouterOS ver...

bjohns

With FreeRADIUS you tweak the sql.conf file.

bjohns

I would say its the small packets that cause the most problems. Nstream assists because of its packet packing and polling mechanisms.

I supply a few student accommodation sites via a wireless backhaul and NStream deals with the torrent traffic nicely.

bjohns

Yeah, just a little bit of experience :P I get best results using horizontal, most of my installations have either a PacWireless 4 (10dBi) or 12slot (15dBi) waveguide. Some omni-directional (double sided) for repeaters. They seem to perform a lot better than verticals over water. Plus they have a bi...

bjohns

To add yet another use for serial port interaction. Many modern charge controllers also have serial interfaces. Having the ability to read this data via the MT would save monitoring equipment at the very least.

bjohns

Yes, rate-limit lets you set pretty much everything queue wise.

However I'd like a upload/download MB limit. Ie trial user profile permitting 50MByte download quota.

bjohns

does anyone know if the MT Vlan Tags are compatable with a Cisco 1900 or 2900XL? tks

29xx running 802.1q, yes. 19xx no. You can run ISL into a 29xx and map them to dot1q before sending to MT.

bjohns

Private VLAN Edge (PVLAN):
http://www.cisco.com/en/US/tech/tk389/t ... _home.html

Dunno about the 1900 series, probably individual VLANs. I use PVLANs on SMC TigerAccess 7724 VDSL switches with success.

bjohns

A good trick is to set up your 1900's all over the place and consolidate them into a 2900 and then use vlan mapping to map the ISL trunks to 802.1q ones.

bjohns

Running the 'Packet Sniffer' tool and streaming it to the PC not appropriate?

bjohns

When using a SSL certificate to secure a hotspot - why not grab the dns name from the certificate and automatically assign it to the hotspot?

I'm not sure how this would work for a wildcard cert tho.

bjohns

As much as I would like to play around with such a network, BGP isn't my main area.

How on earth did you score a /22 in Australia?!?!? Did you ram-raid a university data facility or something?

How much did the AS set you back, if you don't mind me asking?

bjohns

Pacwireless makes a few. But I haven't used any myself. I only use 2.4Ghz Vert. antennas for small hotspot repeaters, never on towers. I usualy start with 90* and work down from there. Yes, their horizontal sector/omni's are same as what we use (but resold as 'Hills Antennas' over here) as linked a...

bjohns

Have you tried running MT on the WRAPs? I haven't had any problems with a MT/WRAP combination.

bjohns

Variables
$(location-id)
$(location-name)
are available in all hotspot html pages. It was added in version 2.9.36.

Excellent! Thanks.

bjohns

Any other advice on how to send back the location-id of the hotspot to the remote login site?

bjohns

I think Janisk was trying to be funny. I hope!

I was wondering if he was, but with all the weird antennas kicking around these days who knows.

bjohns

64 MB Biwin cards are incredible when they are fixed.

When fixed?

bjohns

a /23 will give you 510 usable addresses.

I'm guessing that you'll make that the address pool to assign to each connection? If so then each link will be a /32 anyway and broadcast traffic etc should be minimal I think. I might be wrong tho.

bjohns

What does a horizontally polarized Omni directional antenna look like ? Regards Piri http://photos1.blogger.com/blogger/4418/1475/1600/MagneticIs_05.jpg That's a 16.5dBi 12 Slot WaveGuide 95° Sector. You can get 13dBi (double sided) that covers 360° (omni) and smaller ones that are 12dBi and 9dBi r...

bjohns

We do this often. Vertical polarised directional with a Horizontal polarised onmi/sector. Keep the antennas as far apart as possible and use Ch 1 and 11 etc.

bjohns

our tested sandisk worked.

Apparently there are quite a few 'fake' sandisk cards going around too - something to be wary of.

I use Sandisk and 'Biwin' (cheap, but they work).

bjohns

Yes, they should not appear on the VLAN interface. Maybe you should have MT support look into this, could be a bug...

--Tom

Okay, I'll test a bit further (using bridge/no bridge etc) and send off the supout.

Current Topology

bjohns

The User Manager is a fairly new addition to RouterOS. Also many people use commercial/custom ISP billing systems that use radius.

bjohns

I will go with 3 MT systems, each with one vlan per campus. Then run pppoe and hotspot on this shared vlan with shared ip pool. I was considering something like this. I might actually do so now. About the issue - may be untaged frames are going into router via ether2 interface, not via valn subinte...

bjohns

I was hoping to run both the PPPoE and Hotspot on the one interface with the appropriate security in place. Pairing up VLANs into bridges would allow me to run three sets of services instead of six, one service type per each location. What I will do is include a dedicated PPPoE concentrator that wil...

bjohns

Been testing things and I've come across something odd. All 6 VLANs are on ether2 (on the test box, single interface). I have these combined into pairs using three bridges. When I connect straight to ether2 to run some test on a default setup I have on that interface, the router assumes all traffic ...

bjohns

With the pcq-clasifier option, can you have both src & dst in the same one? Just use th eone for upload and download? Thanks One in each. If you did both in one then it would be per each and every connection (or sets with same src/dst) - good if you want to set a maximum 'per connection' limit ...

bjohns

Thanks :-)

So for a normal download src-adreess would be a webserver and dst-addtress would be customer?

Thanks

That depends on what chain etc. Eg:

Input chain - dst-address = router
Output chain - dst-address = web
Forward chain - dst-addres = hosts/web

bjohns

which is good enough and since I wont be caching anything I should be in great shape.

Could always use the 4Gb hdd as a cache drive - it's not like its good for much else anyway.

bjohns

Hello, I'm in the process of creating a config (MT RouterOS 2.9.38) for a Hotspot+PPPoE network to suit a 3 campus, 950 Room on-campus student accommodation network. I would like to hear other peoples opinions on what I have so far, to make sure no issues spring up during install and production. Par...

bjohns

Hello, Referring to the Location ID and Location Name RADIUS values in the Hotspot Server Profiles. Are these values available as a var in the hotspot login page? I want the location passed back to the backend server, and it would be better if I could avoid statically setting this in the login redir...

bjohns

We just devised a php script that grabs the list of gateways from the radius NAS/client table in mysql and gets the output from the cgi and records the values into another table. Main reason was to gather 'free' traffic and credit it back to the user accounts. I'll see about posting it here once we'...

bjohns

I can source them locally for $1150AUD, that's with 768MB memory. So your prices are comparable (1AUD ~= 0.75USD).

bjohns

bjohns, so what about your expirience with VIA-based device?

The project has reached the 'red tape' stages of legal agreements etc. I expect to have something on the bench in the next few weeks.

bjohns

'torrent traffic does tend to lead to network issues, especially in regards to congestion and general router loads. The sheer number of connections generated by a single user can be considerable. First I would limit the number of connections a single user can have. There's not really any point tryin...

bjohns

I'm just about to roll out a wifi network using nstream+wpa2... Tip: stick to fixed key for static links. It's replacing a Proxim network btw - no one, not even Proxim themselves, can find a fix for the MP.11a's constant packet loss :/ Somehow i've heard that one before. How does it appear? Yep, us...

bjohns

Only during the night? What's the environment like? Does it occur during summer/winter etc?

bjohns

*) fixed encrypted link establishment when using nstreme; What are the specifics of this particular fix? I'm just about to roll out a wifi network using nstream+wpa2... It's replacing a Proxim network btw - no one, not even Proxim themselves, can find a fix for the MP.11a's constant packet loss :/

bjohns

in linux and routeros the address belongs to the router, not to the interface. the router will answer regarding all it's addresses. the interface entity is only used to create the default route, and that is it's only use

I believe this to be the case with most, if not all real routers.

bjohns

Looking through the news section and found this too: ACMA seeks comments on proposals for broadband wireless access services in regional areas in the band 1785-1795 MHz and remote areas in the band 1785-1805 MHz Should I bug MT regarding the support of the random radio devices that will pop out to s...

bjohns

ACMA approved power limits : 915 MHz - 928 MHz Not exceeding 1W EIRP 2400 MHz - 2483.5 MHz Not exceeding 4W EIRP 5150 MHz - 5350 MHz Not exceeding 200mW EIRP 5725 MHz - 5850 MHz Not exceeding 4W EIRP So what's been suggested to you is half correct. The 5GHz ISM band is split into two parts in Austr...

bjohns

I would like to know what other people are doing to control abuse of the trial-user facility. I find some people like to abuse it by changing their MAC address after the session time is consumed and simply continue on. I would like a method of obtaining a 'signature' of such users and deny them acce...

bjohns

If it is the Cat5, stick a ferrite choke around it, close where it meets the unit outside.

bjohns

I've seen the same behavior but only with the NMP-8602 PLUS. It would appear to be that the WRAP1 does not like that particular adapter. The same adapter works fine in a WRAP2. I've tried many different boards and adapters however that combination always has the problem described by the OP. This is ...

bjohns

WiFi is half duplex, therefore to repeat you loose half your bandwidth. Otherwise use two radios.

Doesn't have anything to do with WDS specifically, they're just saying that repeating using WDS will demonstrate that behavior.

bjohns

Not sure about that one, I manually apply the certificates.

Best ask in 'scripting' - I would hazard a guess that an expect script of some kind would be used.

bjohns

I found the same thing. Certificates have to be in / to work.

bjohns

Looks like maybe a builtin firewall is blocking part of the DHCP handshake.

Maybe, but this is usually represented by a 'Offered' with no 'Assigned' in the dhcp logs.

What's the DHCP Server config on the hotspot?

I'd be interested to see what the ARP table is doing as well.

bjohns

And what would be the use for that?

Probably to discount free traffic or something like that.

bjohns

I am faced with the same issue. It would be nice to have the ability to remove accounting for certain source/destination addresses before it gets sent to the radius server. Currently my option is to use Netflow/cgi to pull all the accounting data off the router, add up all the free traffic per user ...

bjohns

The 978 Mbit was in EACH dirrection. I am going to see if I cant feneggle some 10Mbit cards out of Intel to try out... Now,,, Who can I scrounge a 10Gigabit switch from ??? Hmmm..... Craig You mean 10Gbit cards right? You've said 10Mbit twice now and I think you'll find them harder to find new than...

bjohns

I guess you could use a ping script/netwatch to shutdown the wireless upon failure?

bjohns

I solve this problem because I configure all my mt with the same domain in the hotspot interface. So I bought the SSL cert for this domain and I installed in all my hotspots. Yes, iPass want that valid SSL in place - can't use a dummy cert. It would be nice if they issued them under their own CA an...

bjohns

Sounds like a client issue. Each PPPoE service on the line will respond to the PADI packet with a PADO packet. The client will isolate which one it wants to use based upon the Service Name. So if the client is ignoring all the other offers and only looking for the set one... PADI Payload: PPPoE Tags...

bjohns

Also, I while ago their was a big flame war about routerOS and small packets, will there be any change with this?

I'd be interested in anything that can address the small packet issue too.

bjohns

why do you want to configure all your routers to do something, that can be done on one PC that does the `push` thing. A combination of the two is used by other hotspot access controllers. Set up a radius user for the access controller that contains a bunch of AVPair attibs with values like login-ur...

bjohns

We cover a few buildings in a similar fashion and we just use a single ssid - the clients are pretty good at picking the best source and not hopping between APs. Haven't had any issues relating specifically to that anyway.

bjohns

http://wiki.mikrotik.com/wiki/RouterOs_MySql_Freeradius

bjohns

I was going to work out something similar to that, but I'm lazy :D

Thanks, I'll stick that into the configs.

bjohns

could be encrypted uTorrent or Azureus these can't be dropped? Not easily - deep packet inspection isn't possible due to the encryption. Other means of tagging the packets will need to be devised and I think that's easier said than done. I haven't specifically looked at such traffic although if the...

bjohns

I use this as the login.html page on the MT: <html> <title>...</title> <body> <form name="redirect" action="https://remote.web.serv/login.cgi" method="post"> <input type="hidden" name="mac" value="$(mac)"> <input type="hidden" nam...

bjohns

It's not too difficult to write your own interface. Like I wouldn't call myself a programmer but I managed to get most if not all the features I want out of a hotspot 'self manage' interface. I wrote mine using Perl. I will eventually bundle it up for release. However I don't think I can make it ope...

bjohns

Regarding WRAPs, the x86 package includes routerboard.npk. We have found a newly flashed WRAP will hang -once- when first setup requiring a manual power cycle then no problem with reboots. Same here, got plenty kicking around that have no problems with field resets as long as the routerboard packag...

bjohns

The larger units have a GPS receiver as a time source. Yes, I heard they had GPS, I thought it was used as a clock-source for the TDM, not for co-ordination among radios. NStream polling is good, but having the router co-ordinate among multiple radios could be beneficial. Like polling on steroids. ...

bjohns

I'm pretty sure there's a thread kicking around here that explains it. If I remember correctly it was a method where the radio can 'recalibrate' itself to adjust for extreme temperature changes and other environmental effects. http://www.freepatentsonline.com/6272322.html turned up in a google searc...

bjohns

telephony is supported in 2.9.x ... but you read the release notes for 3.x and it specifically says its being removed.

Yes, I saw that it was getting dropped in 3.x in the change logs too.

I was hoping it was making way for SIP support :D

bjohns

AFAIK The Motorola Canopy system uses Time Division Multiplexing - which is what I think this thread is hinting upon when saying things like 'TX Synchronization'. They have taken it a step further allowed multiple APs to co-ordinate. MT might be able to achieve something similar by using their NStre...

bjohns

added GIS/WISPr xml pages for hotspot smart client support;

IPass support?! Fantastic. Just in time too.

FYI http://www.pcca.org/standards/architect ... _pwlan.pdf

bjohns

I got around 'most' pop-up blockers by sneaking a 'onclick' into a submit button. Tied it to some js that forms a new window and populates it with a refresh/redirect meta tag that brings up the status window. So it appears to the browser that it's a user requested pop-up. Some zealous blockers preve...

bjohns

I only have 5 sites running 2.9.32, the rest are running 2.8.28, the two best are as follows: PPPoE Concentrator [admin@Unicentral_GW] system resource> print uptime: 227d18h49m36s free-memory: 52724 kB total-memory: 257228 kB cpu: Intel(R) cpu-frequency: 2800 MHz cpu-load: 2 free-hdd-space: 24335 kB...

bjohns

I will also create a script on *nix that runs and ssh's this lists to whatever boxes you have.

Or use the fancy API :)

bjohns

As per http://forum.mikrotik.com/viewtopic.php?t=11532 It would be nice to include something like $sigstr, $sigccq and $sigspd or something in the values available in the hotspot interface. While I understand that this information is moot given that the user would have to be connected to see it - it...

bjohns

PPTP is probably your best bet, quite common and there isn't a whole lot to think about. L2TP is a little more involved when adding IPSec. I run an older MT 2.8.26 as a VPN concentrator - takes PPTP/L2TP/IPSec and I've hooked up all sorts of consumer routers to it. IPSec takes a bit of fiddling but ...

bjohns

From a Cisco perspective, IPIP is as basic as tunnels can get - absolutely no encryption or identity protection at all. It simply lets you sneek a subnet over others.

bjohns

Hmm, I didn't notice that before - I would have ordered lvl5 licenses.

It would be better to have the RIP versions in all levels, and include OSPF etc in >=lvl5. Since most off the shelf firewalls/routers these days come with some kind of RIP support.

bjohns

Yes, it's not supported yet, but it's available in the 3beta if you're that desperate:

*) added initial support for SMP on x86 (use it on your own risk);

Apparently a 233MHz WRAP can push 40Mbit/sec raw - so on your box I would expect much better as suggested by jo2jo.

bjohns

Excellent. Need someone to roll it all up in a Perl module :D

bjohns

Thanks! I'm not going crazy after all.

bjohns

Using v3.0Beta1. Checking to see if anyone else can reproduce this: I paste the following into a SSH terminal: / ip hotspot add name="Maroochy" interface=hotspot_wds address-pool=Hotspot profile=hsprof1 \ idle-timeout=5m keepalive-timeout=none addresses-per-mac=2 disabled=no And it ends up...

bjohns

Tested okay on the bench with my various hotspot configs. Going to roll it out next week.

bjohns

I'm using HTTPS login with the hotspot - no where near as many users but I have seen no unusual memory behaviour.

There could very well be an issue running that many clients with https logins. Thus why you should send the supout to MT.

bjohns

Framed-Route should be an IP Address.

bjohns

I got the pricing back - costs seem very reasonable.

bjohns

I did a solar powered wireless repeater setup some time ago using a Cisco BR352 Wireless Bridge. http://www.naturalnetworks.net/index.php?option=content&task=view&id=14&Itemid=27 Bloody old now but hopefully some info is still useful. Solar power is pretty much the norm in most parts of ...

bjohns

Make sure the hotspots dynamic rules are in the NAT tables - should be a few redirects etc.

bjohns

Just use the trial user feature - this is exactly what I've done just recently for a cafe wanting to provide a free hours access every day.

In your case just make it a free 30min every 30min.

bjohns

When window is hidden behind other windows in WinBox it is unreachable unsil user moves (or closes) all windows to find it. Some option to access any open window is a must.

Yes, something similar to a task bar just for winbox would be handy.

bjohns

Best think of it from the routers perspective - RX is what the router is receiving, TX is what it's sending. Same applies to accounting.

Thinking things from the client's perspective is a quick way to get very confused.

bjohns

I tried all kinds of formats etc - all the same result until I specified some random text file in the configuration field.

I guess I am the exception :(

bjohns

Since they're a European brand I thought it best to ask here. I'm interested in their cable, connectors and antennas for use in 2.4/5.8 networks. Has anyone go any feedback about cost/performance? I'm waiting for pricing from the local sales rep. (I hope this isn't stepping on MT's toes - its the no...

bjohns

Easy - this is similar to how the hotspot function does things. In dst-nat set a rule to NAT (not redirect) connections on port 53 (tcp and udp) to the correct DNS server. Turn off the local DNS server. /ip firewall nat add chain=dstnat protocol=udp dst-port=53 action=dst-nat to-addresses=<dns ip> t...

bjohns

http://forum.mikrotik.com//viewtopic.php?t=10096

They'll be addressing that soon I believe.

bjohns

I've noticed when using the netinstaller that if you don't specify a configuration script when installing directly to flash (usb card reader etc) the installation fails when installing upon the actual device (a wrap in my case). So is the configure script simply the exported configuration from a MT ...

bjohns

Probably best use an external MTA that has the appropriate spam filters etc installed. Force mail out via it (nat port 25 out -> mta).

Just make sure you're checking for spam both in and out.

bjohns

Make sure you have Internet access from the hotspot router (ping from terminal). I find if the Internet is not available, you will not be forwarded to the login page... logical, really Yep, the router won't be able to do a DNS lookup and thus the client won't get a DNS response and will be presente...

bjohns

http://members.iinet.net.au/~nbk/antennas/BBG_WG_01.png Spray painting an otherwise white 8 slot waveguide black to blend in with a security camera post http://members.iinet.net.au/~nbk/antennas/Rivergate_WG_RPT_01.png Good example of using a parapit to futher isolate a directional link Some other ...

bjohns

Fixed or mobile?

For mobile I set to 802.11b for maximum compatibility. For fixed where you have greater control over the remote end then 802.11g will be an option.

bjohns

I've just changed a few of these radios from +26 to +20 and most got a +3 - +5dB improvement in strength.

I can remember doing this on the bench but thought it was related to something else...

bjohns

I've been fidding around with a alternative access controller device (I won't mention it here because it wouldn't be nice) and it has a neat way of getting its configuration via RADIUS. Instead of setting all sorts of things on the controller you simply create a user account for it (in radius) and p...

bjohns

I can't see it being that common, however some default rules prevent any client like that from working imo. Ie DNS redirect - this is enabled pretty much by default and redirects all DNS queries to the MT's DNS server. This effectively distroys any chance they have of using their own dodgy DNS serve...

bjohns

Just set each port to their own vlan and then configure port 1 as a trunk port. As for automatically binding mac addresses to the port - your looking at implementing something like 802.1x. Which means installing some sort of suplicant on the customers equipment or updating the radius somehow. If you...

bjohns

disable-running-check=yes

does that fix the OSPF Problem?

Yer, it leaves the interface 'up' when there's nothing associated.

bjohns

7. default TX power works best :-) 8. Frenal zone os overrated, I have a 40km link on a 1 meter pole. Oh sure, physics in general is completely overrated :shock: I think he's saying that the negative effects of not having >%60 freznal zone are exagerated. Probably a greater issue for radio systems ...

bjohns

Yeah, I'll be there.

bjohns

How do you put this in place? the radius updates from MT dont seem to use it looking at the packets

2.9.28 now includes support for those particular attribs:

added support for Recv-Limit-Gigawords and Xmit-Limit-Gigawords Radius attributes for hotspot

bjohns

<div class="notice" style="color: #c1c1c1; font-size: 9px">Please log on to use the mikrotik hotspot service<br />$(if trial == 'yes')Free trial available, <a style="color: #FF8080"href="$(link-login-only)?dst=$(link-orig-esc)&username=T-$(mac-esc)">click...

bjohns

The ACMA (Australian Communications and Media Authority) has recently expanded the Low Interference Potential Devices class licence to allow the use of the spectrum between 5470 and 5725 MHz for outdoor use in Australia. There are 5 limitations to be aware of: 1. Maximum EIRP is 1 watt averaged over...

bjohns

Are you using the default login page or a custom one? There's a dynamic variable on the default one that detects whether the trial user feature is enabled or not and provides a link if it is enabled. What I like to know is what is the best way to enable the trial user feature using a remote server -...

bjohns

We normally use horizontal for most things - unless we're looking for maximum seperation etc.

For a Point-to-Point link we would consider radial too - get the best of both worlds.

bjohns

Yeah, I had to sneek it under a button via a 'onclick' function - so it appears to the browser as a user initiated thing, although this can still be blocked by particularly zealous popup blockers.

bjohns

That's why I use Radius interim accounting and the Acct-Input-Gigawords/Acct-Input-Octets/Acct-Output-Gigawords/... attributes with radius accounting. The Gigawords counters exist just to solve that exact problem of the 4 Gig wraparound of 32 bit counters. --Tom I was wondering what they were for a...

bjohns

You can do it either way, but if you're already using radius, use radius. radreply: Xmit-Limit (transmit TO client - Downloads) Recv-Limit (receive FROM client - Uploads) Also be aware that sometimes the database column 'AcctOutputOctets' needs to be set to a type that can take a large integer - if ...

bjohns

Umm, it would completely defeat the point of https/ssl if you could do that.

Yes, I know that - but even the first request packet is binary (unencrypted) so you can't even mark a SSL session.

bjohns

Just had the issue with one site - it worked okay for about three weeks. Restarting the hotspot instance didn't work, had to reboot the router.

supout sent.

bjohns

I've briefly looked into matching HTTPS packets - everything appears to be binary only during a https/ssl transfer, so I am not sure if you can use a text match.

Has anyone done this?

bjohns

Actually, I think I may be facing the same issue. I'm also using HTTPS and redirecting to an external server. I thought it was just a wireless signal issue and it came good after rebooting the router. However now that you mention it - it could be what you describe. How long does it take after reboot...

bjohns

Here's a image I threw together that illustrates the process: http://photos1.blogger.com/blogger/4418/1475/320/AccessPlus%20-%20Mikrotik%20Remote%20Login%20Flow.png The remote server code I posted above isn't the whole thing - there is more involved - essentially grabbing the values passed from the ...

bjohns

To log a client in, you need to get them to submit their credentials to the 'login' script on the NAS. If it makes it easier to understand, you can refer to it as login.cgi too. Ie: <form name="login" action="https://hotspot_address/login.cgi" method="post"> <input type...

bjohns

Not sure what's happening, you need to make sure it all happens between the client and the NAS. Here's what I use, which is very similar to what's in the manual: Server IP: 2.2.2.2 NAS IP (client facing/hotspot): 1.1.1.1 On the MTRouter: <html> <title>...</title> <body> <form name="redirect&quo...

bjohns

I have router OS running on a few different types of Via Epia platforms. No problems on any so far and it's been at least a year or more. Supports all the bits that need supporting for a router.

bjohns

I agree - while we were using MT Routers at the access layer we didn't think of using it for the distribution. Instead we've used Redline, WiLAN and Proxim. I can say that MT will beat Proxim gear hands down, however WiLAN and Redline gear is stable and hasn't caused us any greif. I'd say that MT wa...

bjohns

Look at the export/import commands.

bjohns

Change:
<input type="hidden" name="popup-present" value="true">

To:
<input type="hidden" name="popup" value="true">

bjohns

"Poor man's MPLS" explains it quite well imo. Just read the abundant info about MPLS and you'll see where the switched/routed network concept comes in handy. Ie. http://www.mplsrc.com/faq1.shtml#MPLS%20History What problems does MPLS solve? The initial goal of label based switching was to ...

bjohns

*) added WISPr Radius attribute support to hotspot;

Any details available about this feature? I'd like to get some testing underway asap.

bjohns

From what I gathered a wildcard is for a single server with multiple subdomains. Not for multiple servers with a single domain - it would be great if I'm wrong.

bjohns

We're in the process of establishing HTTPS authen amoung our hotspots and were wondering how others are managing their certificates. I guess we're after 'best practices'. For example, when it comes time to renew, how do you go about renewing many hotspots? What are the best kinds of certificates to ...

Search found 272 matches