Feature Request:
With the use of interface-lists, set customized permissions to which interfaces a user (and preferably also snmp community) can see or make changes to.
Some of our clients like to have read access to our routers, but sometimes it’s a router supplying more than one client and giving even read access would mean they could see every other customer in it.
Currently we work around this using Traffic Flow, but it’s not real time and generates a lot of traffic and CPU overhead.
this might be two things however. while the interface statistics could be worked out with “/tool graphing” even with resource visibility separation - currently using src ip address as differentiator - the “editing” part is tough. so if you can separate your customers based on ip address, you can define which interface/queue/resource the user may be viewing on the router’s web gui.
but i don’t really think this is a good idea, as routers are to forward packets and to run web servers. if you want real granular read/write control for defined routeros resources (interface, addresses, queues) you will be better off with an external web server using API integration.
I’ve tried to search this topic, but I haven’t found it (hope there are not any duplicates):
NTP Client - Possibility to use server name, not just IP address
exFAT (FAT64) or NTFS support - yes, MT is not NAS (it’s slow), but it would be great to use file system capable of handling >4GB file complatible with Windows (you have HDD with big files and you want to share some files - you cannot connect it to MT, you have to reformat it to FAT32, copy everything except for big files back…)
Wireless - move Country and Distance setting to Simple Mode - you can set every other important “basic” setting in simple mode, but you have to switch to Advanced Mode for these two settings.
Quick Set - It’s working with WPA1 password. It doesn’t recognise, when you manually set WPA2-PSK AES only password. It requires also setting WPA1 password (even if WPA1 is not allowed), otherwise Quick Set shows WiFi password red and empty (WPA2 only is used)
Secured DNS
You will have to learn and understand that you should use QuickSet only ONCE and not look at it later!
It provides an overview of some basic config but it is not showing correct values after you made manual changes (not only this!) and should you later change some
things via QuickSet you will seriously mess up the configuration!
So please don’t worry about things like this and don’t use QuickSet.
In fact a more appropriate feature request would be: make QuickSet disappear once it has been used and manual changes have been made afterwards.
That would protect a lot of beginners from serious trouble.
RAM Disk for temporaty files ex. configuration to/from other devices, scripts
I’ve been waiting for along time MikroTik can provide alternative port for IP DNS Setting, other than 53 (default)
normally user input value ip address such as 8.8.8.8 and 8.8.4.4 for IP DNS Setting
alternative port, for example, can be set as easy as 8.8.8.8:553 and 8.8.4.4:533
The purpose is to get DNS service from non default port DNS Server.
Any response is greately appreciated,
Thank You
Do you know dst-nat ?
Is there any DNS server on port other than 53?..
There are some non port 53 DNS configurations/uses.
Example: DNS over TLS is often port 853 -and- I kinda remember something about 135 End-Point-Mapper being used also for DNS
Also - security through obscurity can help prevent some attacks - such as running ssh on non-standard ports , DNS could possibly be remapped to use a non-standard port other than 53 to achieve a security through obscurity.
However , the standard well-known DNS port is 53. I would think if there is a security concern , that a FW configuration would be easier and more compatible method to control DNS access and better prevent attacks against DNS servers.
North Idaho Tom Jones
The intended use case is probably where the ISP blocks or redirects access to port 53 outside (only allowing acces to their own resolvers)
but does not have advanced DPI in place. Then just using a different port may circumvent their efforts. E.g. OpenDNS listens on port 5353,
and one could sents the requests there. I don’t know if Google DNS and CloudFlare DNS have similar alternate ports.
Of course this works only until the ISP admins know it and block or redirect that port as well. Not worth it to make a change in the router
for that, just use dst-nat.
Current RouterOS stores IP address of resolver and uses hardcoded port 53. Changing it to store IP address and port doesn’t sound like anything big. But I guess dstnat would be enough. It’s just that as it is now, you can do it only for clients, not for router itself. If router requires resolver on alternative port for own use, or if you want alternative port and also router as resolver for clients (because of caching, or because you want to override some records), you can’t do it. It would require support for dstnat in output chain.
It may be possible to use a loopback interface and set the DNS server address to the address of this interface, then dstnat that traffic.
(I did not try, but I do use dstnat for traffic incoming to a router and that works)
Or you use an local DNS server on a RaspberryPI like DNSmasq, PiHole, etc.and you are able to control it all yourself.
As stupid as it might sound -almost a lol-
What happens if you add “:XY” to the IP address of the DNS server , where XY is the port #
Say you wanted you mikrotik to use port 5320
then use IP address format of the DNS server of:
a.b.c.d:5320
I remember this working on an old DSL router 15 years ago.
North Idaho Tom Jones
@pe1chl: No, dstnat happens in prerouting, so traffic coming to router (no matter if it will end up in forward or input) can be matched by dstnat rule. Traffic from router doesn’t come through prerouting in RouterOS.
@msatter: External device would work fine, but sometimes it may not be desired or even possible to add it.
@TomjNorthIdaho: Nope, to quote WinBox: “Error in - non zero ip address or non zero ipv6 address expected!”
But something can be done. I posted possible solution in the other thread, because it belongs there more. But I don’t like it.
Ok apparently it needs a real loop, I was thinking about adding a loopback interface (an empty bridge with an IP address) and sending the DNS queries there.
But maybe the address is considered local and it does not work then.
file get contents
Increase threshold 4096 byte, while reading the file or make the file reading by pieces. 4K is too little!
It is not a limitation of those routines, but of the maximal length of a variable content.
What is needed is an open/readline/close feature so files can be read line-by-line into a variable.
(for completeness also a read(n) to read a fixed number of bytes instead of a single line)
I have a solution to decrease costs with DNS filters like OpenDNS or SafeDNS, using a DNS resolver intermediate on UDP port 5353. All my 100 MK with different valid IPs points to this resolver.
This also helps in the security of this resolver.
I can give you more details if anyone has an interest.