Okay there is a pattern here. Its been up perfectly after it kernel failed and I left it running, now 4 hours. Log shows that upon rebooting the CCR on the front display panel right upon reboot these are the first two logs:
Router was rebooted without proper shutdown, probably kernel failure
Kernel failure in previous boot
But thi won’t work on https sites. I am talking about tls-host functionality. How can you block more than 1 site using this feature?
With tls-host you have to have new rule for each host.
I do not understand what do you man. Why do you assume that you can not block HTTPS traffic with address list?
/ip firewall address-list
add list=block address=www.example1.com
add list=block address=www.example2.com
/ip firewall filter
add chain=forward action=drop dst-address-list=block
I think this is about something like this:
/ip firewall address-list
add list=block tls-host=*.example1.com
add list=block tls-host=*.example2.com
/ip firewall filter
add chain=forward action=drop dst-address-list=block
He wants to reuse lists with tls-host matcher.
Issue of flooding all bridge ports with IGMP Snooping on stream change (ie channel surfing, flood lasts about 1-2 sec) or interface removal (ie dynamic interface leaves bridge, flood lasts 60+ sec) still exists on this version.
How to easily replicate:
Method a) Put multiple interfaces on the IGMP-Snooped bridge, start streaming with one (ie an IPTV channel), leave one stream and join another (ie change channels) all interfaces on the bridge start to get flooded with the stream for a few seconds. Rapidly change streams (ie channel surf), you can easily flood all interfaces with 80-100mbit of traffic for a ~8mbit per stream scenario.
Method b) Put multiple interfaces on the IGMP-Snooped bridge, start streaming with one, remove it from the bridge, all interfaces on the bridge start to get flooded with the stream for 60+ seconds.
Makes IGMP Snooping kinda useless, when a group’s doesn’t have any members but is still getting to the router, it needs to get blackhole’d, not broadcasted.
Minor issue that maybe not a lot of people will see:
My bridge interface MAC address changed after upgrade from 6.40 to 6.40.1, or possibly due to the reboot.
This is a wAP-ac. I set it up as a regular access point by adding the ethernet interface to the bridge, then setting dhcp-client to listen on the bridge interface.
I use a static DHCP setup using the ISC dhcp server on another machine.
Layer 2 services were working (Wifi allowed clients to connect to the internet and get a DHCP address), but the wAP-ac itself was not able to get an IP address after the reboot after upgrade.
I was able to log into the wAP-ac with mac-telnet and understand the problem, then I put the new MAC address into my dhcp server and everything was fine.
So the bridge MAC definitely changed at some point.
After upgrade to 6.41.1 from 6.41 I have the problem, with /tool fetch, gives timeout for larger downloads.
Original fetch from www.squidblacklist.org, filesize around 3.7 mb fails.
Also fetch from internal:
/tool fetch address=10.1.0.30 host=10.1.0.30 mode=http src-path=/resources/drop.malicious.rsc dst-path=disk1/drop.malicious.rsc
timed out and failed.
Normal download via curl from the origin site works without any issue.
Runs on a CCR1009-8G-1S-1S+..
Other does see this also?
acruhl, was the mac address of the bridge originally set as administrative mac address? Or it was just dynamic before the upgrade?
I have at the moment only RB750Gr3 for test purposes, 6.39.3 was creating default configuration without problem.
Command shows default configuration script. I can post it on Monday.
All my RBmAP2n devices that were running a hotspot with a customised set of files have been reset to the default hotspot setup. The customisations were all stored in a directory under /flash but since the upgrade, the subdirectory has disappeared (though /flash is still there) and I now have a new root entry called disk that has the default hotspot files under it.
Is that to be expected???
Sorry, I meant 6.41 to 6.41.1…
I didn’t statically set the MAC address. I just added the wired interface to the bridge is all.
Looking at my notes on DHCP server config, the bridge MAC changed from being the same as one of the WLAN MACs to the same as the wired ethernet interface.
Again. I’m not 100% sure if it was just a reboot that caused this or the upgrade, but I suspect it was the upgrade.
Possibly the same issue that dropped the system note for me? I guess it is not expected.
I’d say it is a known bug of 6.41.1. From change list of 6.42rc20:
*) filesystem - fixed situations when “/flash” directory lost files after upgrade;
Hap AC upgraded from 6.41 - same thing happened to disk… and besides that it cleared my bridge ports config with all VLANs
For example, I want to block facebook ad youtube sites which are https. I can do it with address list, but need to find all domains (i.e.xxx.facebook.com, yyy.facebook.com, etc.) and put them on the list. With tls-host functionality, I can put *facebook.com and it’s done. I need to create the similar rule for youtube and all other sites I want to block. My qustion is, if there is (will be) any possibility to create a list containing all hosts I want to block? Or maybe there is any other way to block whole domains, like it is mentioned few posts below
/ip firewall address-list
add list=block address=*.example1.com
add list=block address=*.example2.com
/ip firewall filter
add chain=forward action=drop dst-address-list=block
Can you please give more details about this:
*) sfp - improved SFP module compatibility;
thank you
What about 6.40.6? Could we expect it?
hello,
noticed after upgrading to 6.41 and 6.41.1 dhcp server lease script is not executed any longer.
last-started timestamps / run-count properties below were set / incremented from manual executions only…
My lease_debug script is not executed when client (dis)connects.
Can anybody confirm?
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-script="/system script lease_debug" lease-time=5m name=dhcp
/system script> print
1 name="debug_lease" owner="quirin" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon last-started=feb/03/2018 21:03:18 run-count=16
source=:log info "leaseBound: $leaseBound - leaseServerName: $leaseServerName - leaseActMAC: $leaseActMAC - leaseActIP: $leaseActIP"
Hi, as I can see there are some issues with dhcp server on all ethernet/wlan interfaces. After creating a new dhcp server, disabling it makes it permanent ‘red’ after re-enabling again.
Supot sended to support.
at hotspot with user manager (profile with 2 shared users) when i reboot the router after devices can not automatic login with mac-cookie. at log it says “login failed simultaneous session limit reached” and hotspot login page appears.
ps why i cannot attach a picture? where is the option?