Community discussions

Search found 2250 matches

by mkx
Tue Apr 03, 2018 9:25 pm
Forum: General
Topic: Port forwarding
Replies: 4
Views: 432

Re: Port forwarding

Just stating the obvious: you need to configure uTorrent to use speciffic port number, by default it chooses random port on start-up. And it needs to match whatever configured on RB.

I'm not sure if you need to set dst-address-type ... I rather use in-interface (my PPPoE interface).
by mkx
Tue Apr 03, 2018 8:55 pm
Forum: General
Topic: Port forwarding
Replies: 4
Views: 432

Re: Port forwarding

Specific to torrent port forwarding: you want to add rule to allow UDP as well. Most of torrent conections use UDP as transport protocol, my observed ratio is 20:1 in favour of UDP.
by mkx
Tue Apr 03, 2018 2:17 pm
Forum: General
Topic: hEX router overloaded and very slow
Replies: 5
Views: 673

Re: hEX router overloaded and very slow

I might be wrong, but I guess SPI process is firewall. Firewall rules are omitted in printouts shown in first post..

Can you do "/ip firewall export hide-sensitive" and post output? It might be that config is missing some rule which would offload SPI engine (without compromising security).
by mkx
Mon Apr 02, 2018 2:57 pm
Forum: Announcements
Topic: Future of LTE products, user feedback requested
Replies: 76
Views: 15896

Re: Future of LTE products, user feedback requested

TD-LTE
Don't forget that TDD LTE comes in bunch of frequency bands as well ... you can check the list on the intetnet, one is available on Wikipedia. It's not the most comprehensive either.
by mkx
Sat Mar 31, 2018 8:50 pm
Forum: Beginner Basics
Topic: Odds and Ends To Finish Setup
Replies: 15
Views: 1121

Re: Odds and Ends To Finish Setup

Whenever router gets address at some certain device it will, by default, forward traffic there. Changing this behaviour is not really productive, it's better to setup firewall filter rules to get desired behaviour. In my example: VLANs 40 and 41 are separate L2 networks and are perfectly separating ...
by mkx
Sat Mar 31, 2018 6:41 pm
Forum: General
Topic: cannot access forwarded services from my lan using the static ip
Replies: 2
Views: 228

Re: cannot access forwarded services from my lan using the static ip

Search this forum for Hairpin NAT.
by mkx
Sat Mar 31, 2018 6:29 pm
Forum: Beginner Basics
Topic: Odds and Ends To Finish Setup
Replies: 15
Views: 1121

Re: Odds and Ends To Finish Setup

An illustration to my previous post about adding "badboy" VLAN to the routing/firewalling mix: at my place I've got 3 VLANs: one for "good boys", one for guest WiFi and third one for ISP's IPTV (multicasts are delivered via VLAN tagged stream, but set top box needs internet for EPG etc.) that I don'...
by mkx
Sat Mar 31, 2018 6:06 pm
Forum: Beginner Basics
Topic: Odds and Ends To Finish Setup
Replies: 15
Views: 1121

Re: Odds and Ends To Finish Setup

Basically you've got it right. There is benefit in having VLAN used only inside RB (e.g. have single ether port configured as acces port for that VLAN and then build whole routing logic on top of VLAN) but I guess it's an over-complication. If there are other managed switches in the mix, then VLAN i...
by mkx
Sat Mar 31, 2018 4:10 pm
Forum: RouterBOARD hardware
Topic: Small, but powerfull RB with SFP
Replies: 3
Views: 515

Re: Small, but powerfull RB with SFP

Then your best hope is that Mikrotik might announce something next week in Berlin. Something like RB750Gr3 with SFP cage. Current 750Gr3 is only slightly slower than 850Gx2.
by mkx
Sat Mar 31, 2018 4:00 pm
Forum: RouterBOARD hardware
Topic: Tile CPU wiill be NOT in LINUX kernel, end CCR1036?
Replies: 8
Views: 1959

Re: Tile CPU wiill be NOT in LINUX kernel, end CCR1036?

OTOH, if Mikrotik sees future in Tilera, they might start to maintain platform specific things. They could even only maintain only needed parts of Tilera-specific kernel source tree. That would be useless for any third party Tilera victims, but could do it for Mikrotik business. Maintaining stable c...
by mkx
Sat Mar 31, 2018 3:01 pm
Forum: Beginner Basics
Topic: Odds and Ends To Finish Setup
Replies: 15
Views: 1121

Re: Odds and Ends To Finish Setup

If LAN device wants to connect another LAN device, it does it directly on L2 (ethernet) and L3 (IP) gateway (your router) is completely bypassed. The only way of controlling what LAN devices do to each other is on L2 and if you insist on using RB that probably means using SW bridge of LAN ethernet p...
by mkx
Sat Mar 31, 2018 1:34 pm
Forum: RouterBOARD hardware
Topic: Small, but powerfull RB with SFP
Replies: 3
Views: 515

Re: Small, but powerfull RB with SFP

How powerful does it have to be? There are a few devices available, such as hAP ac or hEX PoE ... both are around half the speed of 850Gx2 when doing routing with many rules...
by mkx
Sat Mar 31, 2018 12:24 pm
Forum: Beginner Basics
Topic: Odds and Ends To Finish Setup
Replies: 15
Views: 1121

Re: Odds and Ends To Finish Setup

If you want to block some devices from connecting other devices on lan, then you need to create separate LAN for those devices and deploy appropriate firewall rules. Separate LAN can be either VLAN or physical LAN. However, if badboys can physically access "normal" LAN ports/AP, they can connect the...
by mkx
Sat Mar 31, 2018 12:16 pm
Forum: Beginner Basics
Topic: WAN IP leak
Replies: 12
Views: 899

Re: WAN IP leak

Are you sure it's Mikrotik who leaks? Any client host which has possibility of discovering public IP address (perhaps through client-server communication on Layer 7) could potentially do it. You'll have to trace it down using wireshark or similar tools to discover plaintiff. After you find the sourc...
by mkx
Sat Mar 31, 2018 12:11 pm
Forum: Beginner Basics
Topic: Web site that won't resolve
Replies: 5
Views: 373

Re: Web site that won't resolve

Maybe the owner is fan of IPv6 who was annoyed by slow adoption and decided to give it a little push by cutting off IPv4? :) I've heard rumours that in some parts of universe IPv4 is actually not available anymore. In such case it's only logical to have some host name only resolvable to IPv6 addres...
by mkx
Fri Mar 30, 2018 9:36 pm
Forum: Beginner Basics
Topic: "Check for update" Error [SOLVED]
Replies: 7
Views: 4000

Re: "Check for update" Error [SOLVED]

Your rule to drop anything on chain=input is fine ... but before that you need some other that accept connections you want to allow. For example connections with connection state established or related. You need to allow those to maintain connections initiated from router itself. If you're extra par...
by mkx
Thu Mar 29, 2018 11:24 pm
Forum: Beginner Basics
Topic: Bridge WAN to ALL etherports
Replies: 17
Views: 3317

Re: Bridge WAN to ALL etherports

I don't have slightest idea about what OP is trying to do. I just know that mixing WAN and LAN addresses on same bridge doesn't sound right to me. At all.
by mkx
Thu Mar 29, 2018 8:39 pm
Forum: Beginner Basics
Topic: Bridge WAN to ALL etherports
Replies: 17
Views: 3317

Re: Bridge WAN to ALL etherports

PPPoE client uses whatever device (I've got mine running on VLAN device) and creates it's own interface. Then you can make that interface part of bridge (not clever) or roure between it and bridge. Bridge itself can have imternal address, DHCP server and whatnot. The only reason I wouldn't make phys...
by mkx
Thu Mar 29, 2018 5:20 pm
Forum: General
Topic: Simple firewall config to block ssh to router or any device in the network not working
Replies: 3
Views: 732

Re: Simple firewall config to block ssh to router or any device in the network not working

It's hard to tell (you don't tell where you ran nmap, from WAN or from LAN), but it seems to me that your filters are slightly FU. The first says drop any connection to ssh port of router itself if connection request comes from WAN. The second says drop any connection to ssh port if forwarded and re...
by mkx
Thu Mar 29, 2018 4:46 pm
Forum: Announcements
Topic: Future of LTE products, user feedback requested
Replies: 76
Views: 15896

Re: Future of LTE products, user feedback requested

What @Tw0kings writes about is Embedded SIM (or eSIM). That's SIM card functionality, but implemented inside SOC (or whatever powers mobile radio terminal). Which is something that phone producers try to push (less space needed inside phones, one less hole to make dust&water tight, ...) but is a nui...
by mkx
Thu Mar 29, 2018 2:22 pm
Forum: Announcements
Topic: v6.42rc [release candidate] is released!
Replies: 538
Views: 90222

Re: v6.42rc [release candidate] is released!

When you compare tests made with different tools (e.g. iperf VS. CIFS) you have to be aware of behaviour of test "tools". Tests done using iperf are not affected by latency much (apart from usual TCP slow-start) while some more "chatty" protocol (such as CIFS file transfer) can be affected by larger...
by mkx
Wed Mar 28, 2018 2:07 pm
Forum: General
Topic: View clients' http requests and traffic
Replies: 45
Views: 7142

Re: View clients' http requests and traffic

With certificate you probably can decrypt server's data. For decrypting client's data you'd probably need server's private key. If the https server is yours, then you surely have access to private key. For other servers it should be impossible to get hold on private key, privacy of private key is th...
by mkx
Wed Mar 28, 2018 12:37 pm
Forum: General
Topic: Strange logs
Replies: 6
Views: 389

Re: Strange logs

Your FW regarding the Winbox access port is just fine and if the log entries bother you you could just omit the log=yes part of rule ... I don't have any definitive advice regarding log ... other than that it seems you can't get log written to persistent storage on the RB device itself ... but you c...
by mkx
Wed Mar 28, 2018 10:56 am
Forum: General
Topic: Strange logs
Replies: 6
Views: 389

Re: Strange logs

My guess is that your FW is actually dropping the connections as per rule number 6 in your filter list. However, you do see these in your log because your filter rule has "log=yes" ... hence log entries.
by mkx
Wed Mar 28, 2018 10:48 am
Forum: General
Topic: View clients' http requests and traffic
Replies: 45
Views: 7142

Re: View clients' http requests and traffic

Sorry,but can you explain how can i capture https??Thanks in advance . While you can capture any kind of traffic, including encrypted one (https or VPN or ...), it is extremely hard do decrypt it to see the contents of communication. And that's by design, encryption is there exactly for this reason.
by mkx
Tue Mar 27, 2018 3:52 pm
Forum: General
Topic: Monitor national traffic and overseas traffic? [SOLVED]
Replies: 5
Views: 564

Re: Monitor national traffic and overseas traffic? [SOLVED]

Or, without marking, you could create a few FW filter rules, similar to these the ones below. Before implementing those you need to create address list named "national_address_list" with all IP subnets used within your country. If you decide to name address list differently, change the name in FW ru...
by mkx
Tue Mar 27, 2018 3:12 pm
Forum: General
Topic: QoS for IPTV
Replies: 34
Views: 4569

Re: QoS for IPTV

A thought, but I might be kicking dead horse here: how did ISP's router handle the connection towards TV (Ether3 in your diagram)? As per configuration attached to the diagram, TV (set-top box?) receives un-tagged packets. If that multicast is delivered wrapped in VLAN-ID=3 and if ISP's router did n...
by mkx
Tue Mar 27, 2018 12:37 pm
Forum: Beginner Basics
Topic: [RB750Gr3] DHCP failure on default/native VLAN (VLAN ID 1) of bridge [SOLVED]
Replies: 2
Views: 1048

Re: [RB750Gr3] DHCP failure on default/native VLAN (VLAN ID 1) of bridge [SOLVED]

In some oder post I mentioned that I've had my share of problems when trying to utilize VLAN ID=1. So if you're starting proper VLAN-based set-up it's best to stay away from VLAN ID=1 (if my memory serves me right it used to be possible to use also VLAN ID=0 but I've read somewhere that recent ROS d...
by mkx
Tue Mar 27, 2018 12:21 pm
Forum: Beginner Basics
Topic: Bridge setup - two subnets/interfaces/dhcp servers
Replies: 8
Views: 1794

Re: Bridge setup - two subnets/interfaces/dhcp servers

Which ROS version do you have on your hAP AC^2? Can you post output of command /interface export ? I believe there's something wrong with the way you set up ether5 (and possibly IP on top of it). My take is that if you'll only use single ethernet interface towards "old" wired network, then you shoul...
by mkx
Mon Mar 26, 2018 11:06 pm
Forum: RouterBOARD hardware
Topic: RB260GSP with cAP ac - POE compatibility
Replies: 5
Views: 897

Re: RB260GSP with cAP ac - POE compatibility

Bummer. Until recently I followed fine engineers' rule which says: "when everything else fails, read the fine manual" (I believe original phrasing has some other f-word in place). Then I started to believe in reading manuals beforehand and that principle obviously doesn't work out that well. Guess I...
by mkx
Mon Mar 26, 2018 10:49 pm
Forum: RouterBOARD hardware
Topic: RB260GSP with cAP ac - POE compatibility
Replies: 5
Views: 897

Re: RB260GSP with cAP ac - POE compatibility

Some reading of supplied manuals reveal: RB260GSP can output max 1A of current per PoE port. When using supplied power supply (24V) that means approximately 24W. On the other hand cAP ac has rated power consumption of 13W and allowed input voltage is 17-57V which is on par with RB260GSP supplied pow...
by mkx
Sun Mar 25, 2018 8:54 pm
Forum: Wireless Networking
Topic: Tutorial: Using wAP AC with a Tomato Router
Replies: 2
Views: 1033

Re: Tutorial: Using wAP AC with a Tomato Router

A remark regarding DHCP functionality on wAP ac: if your main router has DHCP server running (for wired clients), and you put both wireless interfaces on bridge with wired interface on wAP, then you don't have to run DHCP server on wAP. Wifi clients should be able to receive DHCP leases from main ro...
by mkx
Sat Mar 24, 2018 6:39 pm
Forum: Beginner Basics
Topic: (2WAN) +2LANS Basic but Elusive [SOLVED]
Replies: 12
Views: 1025

Re: (2WAN) +2LANS Basic but Elusive [SOLVED]

I guess it's possible to write some specific routes which wouldn't work well if the interface IP address changes (e.g. if WAN interface gets address via provider's DHCP server or if WAN interface is PPPoE or something). Changing addresses are PITA when writing FW rules such as src-nat ... for the la...
by mkx
Fri Mar 23, 2018 4:57 pm
Forum: General
Topic: VLAN trunk with Cisco switch and Juniper SRX300
Replies: 4
Views: 411

Re: VLAN trunk with Cisco switch and Juniper SRX300

After you set-up VLANs, you can proceed configuring WiFi AP in the following manner: /interface wireless set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-Ce \ country="your country here" frequency=auto frequency-mode=regulatory-domain mode=\ ap-bridge name="master wifi name here"...
by mkx
Fri Mar 23, 2018 12:00 pm
Forum: General
Topic: firewall advice to pppoe_client customers [SOLVED]
Replies: 26
Views: 1423

Re: firewall advice to pppoe_client customers [SOLVED]

Assuming your pppoe runs on top of some ethernet interface (presumably ether1), is it safe to add all ether interfaces to LAN list? I'd leave that particular one out. If pppoe runs on top of sfp1 interface then your config is OK.
by mkx
Thu Mar 22, 2018 7:06 pm
Forum: RouterBOARD hardware
Topic: SFP module is extremely hot
Replies: 35
Views: 9115

Re: SFP module is extremely hot

All of them are extremely HOT after 30 secs of work.
Out of curiosity: how does "extremely HOT" translate into degrees Celsius?
by mkx
Thu Mar 22, 2018 6:54 pm
Forum: Beginner Basics
Topic: Isolating physical LAN interfaces
Replies: 10
Views: 1669

Re: Isolating physical LAN interfaces

In proper router (MT basically are) there is no WAN and LAN ports. It's just ports and routing engine between them. Only when you apply certain configuration (IP address, routing rules and tables, FW rules, ...) it may appear that certain port might be WAN and another LAN. However, if you disable IP...
by mkx
Thu Mar 22, 2018 4:27 pm
Forum: Wireless Networking
Topic: TX-RX
Replies: 1
Views: 378

Re: TX-RX

From measurements made on static equipment you don't know which antenna needs to be tilted ... antenna pattern is identical for both TX and RX (at same antenna port) and if antenna is miss-aligned for TX, then it's miss-aligned for RX as well. By the same amount of dB, so from numbers alone you can'...
by mkx
Thu Mar 22, 2018 3:58 pm
Forum: RouterBOARD hardware
Topic: SFP module is extremely hot
Replies: 35
Views: 9115

Re: SFP module is extremely hot

My experience with SFP and SFP+ modules (different vendors) in non-Mikrotik equipment is that some SFP types run hot and some run cool. In very same router/switch so most likely "SFP environment temperature" (read: SFP cage in router) is almost the same for all SFP modules ... routers are well venti...
by mkx
Thu Mar 22, 2018 3:20 pm
Forum: Beginner Basics
Topic: Port forwarding for multiple web interfaces
Replies: 18
Views: 1259

Re: Port forwarding for multiple web interfaces

My MAIN CONCERN however is not the port forwarding rule, its security for the port fowarding!! C. What I would ask the Gurus here is clarity on i. is a firewall rule needed for each port forwarding rule a nd if so what would it look like???? . Any port forwarding should be subject to same security ...
by mkx
Thu Mar 22, 2018 11:52 am
Forum: Beginner Basics
Topic: IPv6 from LMT.lv
Replies: 6
Views: 582

Re: IPv6 from LMT.lv

Your only alternative is to bridge between the interfaces instead of route. . Which kind-of breaks current IPv4 setup as bridging devices is done on layer2 connectivity which is shared by both IPv4 and IPv6. Even if one could somehow (I'm not saying that there's no way, I just don't know it) split ...
by mkx
Thu Mar 22, 2018 11:42 am
Forum: Beginner Basics
Topic: Port forwarding for multiple web interfaces
Replies: 18
Views: 1259

Re: Port forwarding for multiple web interfaces

You can set up different ports on WAN side being forwarded to different internal IP addresses (regardless of port) in the following manner: /ip firewall nat add action=dst-nat chain=dstnat comment="inbound port 80 goes to LAN host 1 port 80" dst-port=80 \ in-interface="your WAN interface name goes h...
by mkx
Thu Mar 22, 2018 11:25 am
Forum: RouterOS v6 RC and v7 BETA
Topic: Feature requests
Replies: 1095
Views: 187673

Re: Please increase Simple-Queue limits - they max at 4,294 Meg

The maximum possible value for " Max Limit " and " Burst Limit " and " Burst Threshold " is " 4294M " The Simple queue will not accept any higher numbers. . Seems like setting is set in 32-bit integer with unit of bits per second. This might pose an architectural problem and we can only hope it can...
by mkx
Mon Mar 19, 2018 9:44 pm
Forum: General
Topic: L2TP VPN for iPhones
Replies: 30
Views: 7448

Re: L2TP VPN for iPhones

These are not same peers. The first one is IPv4, the second one is IPv6.
by mkx
Mon Mar 19, 2018 5:27 pm
Forum: RouterBOARD hardware
Topic: hAP ac² - more RAM than in HW specification [SOLVED]
Replies: 55
Views: 12565

Re: hAP ac² - more RAM than in HW specification [SOLVED]

Please, insert in to Part Number a release code, p.e: - release 1 with 128MB - release 2 with 256MB Like a RB750r2 and RB750Gr3.... Because they are different hardware. . Add release 3 with 233MB ... And, please, charge for release 2 hardware extra money. We don't want to go through fine print in s...
by mkx
Mon Mar 19, 2018 3:58 pm
Forum: Beginner Basics
Topic: CRS112-8P-4S-IN - PoE Problem
Replies: 8
Views: 1338

Re: CRS112-8P-4S-IN - PoE Problem

IMHO it's unlikely you could construct a customized cable to overcome ModeA/ModeB mismatch. In modeA (obviously supported by your doorbell device) both data and power use same wires. Unless you use some smart power injector (which, according to your initial post, you don't want to use), you can't si...
by mkx
Mon Mar 19, 2018 12:35 pm
Forum: RouterBOARD hardware
Topic: hAP ac² - more RAM than in HW specification [SOLVED]
Replies: 55
Views: 12565

Re: hAP ac² - more RAM than in HW specification [SOLVED]

Labels on the circuit board says "2G CH0 + 5G CH1" ... the other is obscured by antenna itself, but I guess print would be similar (but with swapped chains). The frequency of two WiFi bands are (radio wise) far away from each other with plenty of other occupied bands in between so that filters (both...
by mkx
Mon Mar 19, 2018 12:06 pm
Forum: RouterBOARD hardware
Topic: Ethernet routers announcements?
Replies: 13
Views: 1357

Re: Ethernet routers announcements?

What Normis is saying in common words is: wait until April 5th.
by mkx
Mon Mar 19, 2018 7:56 am
Forum: RouterBOARD hardware
Topic: CRS125 reporting that a "6.41.3" *firmware* version exists [SOLVED]
Replies: 1
Views: 507

Re: CRS125 reporting that a "6.41.3" *firmware* version exists [SOLVED]

Since recently, firmware version numbers are same as ROS version numbers, so it's normal that after ROS upgrade there's firmware upgrade with same version number. Beware: there are reports that on certain hardware firmware 6.41.3 does not boot ROS and that in such case firmware has to be downgraded....