MikroTik

please read my post again, because you completely missed my point. I said - why even bother encrypting it? it will just take a little more time to read. Better deal with your other security hole - why can somebody take your router and do what he pleases?

Suricata on CCR

• The frequency provisioning does not permit to set the "auto" frequency value
• The frequency provisioning does not permit to set the country value resulting in illegal frequency channel (in fact we cannot use the channels 2467 and 2472 that are permitted in italy)
• Generally speaking it will be usefull having a greater control on CAP's radio parameters setting (country, power, frequency mode, antenna gain, DFS mode, etc...)
• May result usefull let the CAP use its own radio parameters configuration, when implicit default provisioning rule is applied, or when configurations without radio parameters explicitly setted are used.

Some features have already been requested before, to better manage this, you can register on the Wiki and cast your vote there:

http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

Of course, in addition, it would be great if you also posted a message here, explaining why you need that particular feature. And as usual - search before you post, maybe a topic exists already.

Note: Whenever possible, the same ip address is given out to each client (OWNER/INFO pair).

Would be perfect in IP/ROUTES Check-Gateway to be able to specify an IP-Adress other the the default Gateway.

I seem to have seen an example somewhere in the wiki as well, but can't find it at the moment.

If I have opened a firewall rule, a Button to clone this rule.

Some features have already been requested before, to better manage this, you can register on the Wiki and cast your vote there:

http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

Of course, in addition, it would be great if you also posted a message here, explaining why you need that particular feature. And as usual - search before you post, maybe a topic exists already.

Please, create universal versatile graphing that allows user to set whatever value that is readable in ROS to be graphed. Combined graphing (e.g. CPU, memory and number of connected clients together in one graph) would be something extra!

And please, ensure that power loss, reboot or ROS upgrade will not erase old graphs. It is still unsolved bug that emmerges very often still in 6.18 (contemporary latest).

That isn't graceful restart. Graceful restart means "hold your routes until I come back, wait up to x seconds for me to finish my operation then update routes after we reestablish adjacency". The change you requested is best handled with bfd.

Please, create universal versatile graphing that allows user to set whatever value that is readable in ROS to be graphed. Combined graphing (e.g. CPU, memory and number of connected clients together in one graph) would be something extra!

And please, ensure that power loss, reboot or ROS upgrade will not erase old graphs. It is still unsolved bug that emmerges very often still in 6.18 (contemporary latest).

I would be nice that in /ip service I could set more ip address or one addres-list

I would be nice that in /ip service I could set more ip address or one addres-list

erm, you actually can do this (not with ACLs but with multiple IPs)

I would be nice that in /ip service I could set more ip address or one addres-list

erm, you actually can do this (not with ACLs but with multiple IPs)

Why not just block unwanted access by firewall?

Functionality such as DNETMAP

Functionality such as DNETMAP

+1

Please add ability to set comment for dynamically added entries in address list.
This feature let for e.g. make script which resolves blocked IP addresses to their FQDN and puts it into comment field.

[admin@TestPlace] > /ip firewall address-list 
[admin@TestPlace] /ip firewall address-list> add list=mylist address=1.1.1.1 dynamic=yes comment="FQDN.HERE"
[admin@TestPlace] /ip firewall address-list> print where list=mylist 
Flags: X - disabled, D - dynamic 
 #   LIST                                                 ADDRESS                         TIMEOUT             
 0 D ;;; FQDN.HERE
     mylist                                               1.1.1.1                        
[admin@TestPlace] /ip firewall address-list> 

MAC Address List . This is very useful especially in a topology where there are multiple subnets.

hi if it is possible to have the pppoe server listens to serveral interfaces instead of one interface ..
i have 7 vlans and i have to have 7 pppoe servers for each vlan interface it would be nice to have one pppoe server for 7 interfaces

Is OVPN Client side LZO Compression and UDP support somewhere out there in plan? the wiki link is missing.

Feature request:

Ability to specify boot-file-name on a per static lease basis. This would add much needed flexibility for rather than using the global setting at the 'ip dhcp-server networ' level where all clients receive the same file.

Provide a simple way to use switch chip to do wire-speed IP routing. Although the switch chips can only support limited routing rules, it can serve smaller setups well.

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server

I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP.
Problem is that on radius server i have configured rules to only received radius request from one IP.

/radius
add address=1.1.1.1 secret=123456 service=login src-address=10.0.0.100

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server

I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP.
Problem is that on radius server i have configured rules to only received radius request from one IP.

You can already do this...

Code: Select all

/radius
add address=1.1.1.1 secret=123456 service=login src-address=10.0.0.100

add address=1.1.1.1 secret=passwd service=ppp,login src-address=212.121.121.121

Hi All,

could you add a "skip" option to netwatch system, please?
So when netwatch pings a host and sometimes it has a timeout the host goes down immediately... and goes up on the next ping. It occurs because of a transmission timeout or something else but the host doesn't inaccessible.
If we had a "skip" option to be set to "3" for example then the system could skip 3 timeouts and the host doesn't get down on a simple ping timeout until it has 3 timeouts. When "skip" is "0" all goes the same than before.

thank you much!

Gabor

Being able to set the RADIUS source IP to an interface instead of an explicit IP address would be useful... for me, at least!

We have ROS boxen that speak RADIUS over a VPN to our freeradius servers; if I could set the RADIUS request source IP to the VPN interface, it would make for simpler "cookie cutter" config when rolling such things out or making changes.

also would personally welcome more updated/actual Active queues in RouterOS to handle/combat/prevent Network congestion. rather than static/notorious RED algo/type present already, which unsuable for production for number of reasons.
for example, RRED would be nice. aswell as other adaptive, attack/flooding-proof variants of AQM.
also bout moving RouterOS from vanilla Linux kernels to Zero Overhead Linux gossips - is actually such plans, yet ?
(this thing http://www.tilera.com/sites/default/fil ... aper_0.pdf meant, to be exact/specific)
also finishing/completing BFG routing implementation (auth and echo ?) also may be handy.

Route availability base on an remote IP.
...
It would help very much in regards to failover.

Route availability base on an remote IP.

I would like to have route availability based on some other IP. Let's say you add a new option below Check Gateway that would be something like check another gateway (my gateway's gateway for example) or just any other IP like 8.8.8.8. And if that IP becomes unavailable over that specific route it can make it unreachable/inactive so other route with higher Distance can became in charge. Check Gateway option does not work when your provider puts router on your premises. And if provider's router loses connection to it's remote router, you still have your gateway (because you have a router on your premises) and so for you, gateway is reachable, but you actually don't have internet access and that route looks good.

It would help very much in regards to failover.

I know that currently this can be achieved by using Netwatch and some scripting but it would be much easier if it were available directly on the route's properties.

Thanks, I wasn't aware of that!

Still, it would be easier to just be able to define what IP to probe for a specific route, rather than having to create extra static routes and play with scope to achieve this (if I understand the wiki page correctly)

Well, even with the option to ping some specific address (other than the GW) you would still need to create a /32 route that forces the test target via a particular interface, or else the route will flap as the GW points to failed link, ping fails, route changes to backup path, ping starts working (via backup), primary route re-activated, pings fail, etc etc etc.

I don't know if anyone requested adding  DPI  or User activity monitor but anyway can we have this feature Please.

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.

I don't know if anyone requested adding  DPI  or User activity monitor but anyway can we have this feature Please.

RouterOS is for routing, DPI is part of a UTM or NGFW solution.

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.

what do you use them for?

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.

what do you use them for?

I want to exclude some traffic from the rate limitation (so called local traffic). I used to mark non-local traffic and add the packet mark to all dynamic queues. Now it is not working. Please advise.

create a queue for local traffic and put it on the top. it will catch all local traffic, and all the rest will be caught by 'personal' queues
p.s. if you won't set any limits on that queue, don't forget to change at least something (like queue type) for this queue to actually work

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.

Fasttracking that traffic you want to be excluded from queues is much more efficient.
But keep the exclusion queue for the cases when some connections couldn't be fasttracked.

Hi There,

We are using a Supermicro 5018 MLNT4 (https://www.supermicro.com/products/sys ... -MLTN4.cfm) with onboard C2000 SoC I354 Quad Nic.
This nic is not supportes... PLEASE ADD THE DRIVERS !

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.

just add one more Radius Server entry with the same settings

• More details in Action, the "filter rule changed" is to short, enter the details of the rule
• Action Tab should write about "Delete/Insert/Add/Move 5 rules" with description like chain/comment/etc.
• If I work on SafeMode then the history entry should be have a flag SafeMode - I know what will be safe or drop

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.

just add one more Radius Server entry with the same settings

I'd like to see a dummy network interface like one available in generic Linux kernel (http://www.tldp.org/LDP/nag/node72.html).

If all physical interfaces are DHCP it might simplify things to be able to assign a static addresses to an internal interface to make routing and firewall rules simpler.

how about adding an icon "L" next to each firewall-mangle-nat rules that this rule is "logged" so you can see easy what is logged and not.

Add a button to easily toggle logging for rule. I often need logging rules that I only quickly turn on and off again, to catch just a few packets.

• Firewall rules "grouping" (example: https://sc1.checkpoint.com/documents/R7 ... 103603.png)
• Configuration sync to other devices (eg. firewall-rules/lists, dhcp/dns-objects)

Right Click -> Show Columns -> Log. Voila!

I'd like to see a dummy network interface like one available in generic Linux kernel (http://www.tldp.org/LDP/nag/node72.html).

If all physical interfaces are DHCP it might simplify things to be able to assign a static addresses to an internal interface to make routing and firewall rules simpler.

just create a bridge (call it Loopback1 ) and assign address to it

Is it possible to add /ip cloud ddns to x86 ROS?

Is it possible to add /ip cloud ddns to x86 ROS?

This has been asked here many times before. Mikrotik usually answers that /ip cloud depends on RouterBOARD serial number, so it can not be just added to x86 as it is. And there are no plans to work on any alternative solution.

I also have a mikrotik serial number for my ROS installed on my x86 hardware. Their logic is not correct

Please implement this command:

Code: Select all

/ip service set dns address=192.168.0.0/24 disabled=no

Would like every service MT runs (SMB, Socks, Proxy, DNS, etc.) to all have ACLs in /ip services AFAIK, and would be good to have it 'locked down' by default to say 1921.68.1.0/24 seeing that the default IP on hardware devices is 192.168.1.1/24.

On the other hand, DNS on MK is totally obsolete service. Running DNS service on internet gateway is fundamentally a security risc.

Another good one, IMHO...

Route-Filters - have the ability to synchronize prefixes received/withdrew to dynamic access-lists.

This gives us the ability to very easily match entire ASNs in firewall rules

Another good one, IMHO...

Route-Filters - have the ability to synchronize prefixes received/withdrew to dynamic access-lists.

This gives us the ability to very easily match entire ASNs in firewall rules

This has been requested, and confirmed by Mikrotik for routing filters in v7.

Filtering packets in chain=input can affect srcnat. So it would be nice to limit filtering to local routers's IP addresses. But it would be hard to maintain such a list of addresses, if the router's configuration is changed from time to time.

So here goes a feature request: an automatic address-list "local-router" (or similar name) which is generated automatically from the local IP addresses of the router.

src-address-type (unicast | local | broadcast | multicast; Default: )

Matches source address type:

unicast - IP address used for point to point transmission
local - if address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

It will be good if RouterOS will have integrated brute force protection and filter.

It does

http://wiki.mikrotik.com/wiki/Bruteforc ... prevention

Another good one, IMHO...

Route-Filters - have the ability to synchronize prefixes received/withdrew to dynamic access-lists.

This gives us the ability to very easily match entire ASNs in firewall rules

This has been requested, and confirmed by Mikrotik for routing filters in v7.

Is Route-Filter equivalent (or similar) to the Cisco Route-Maps?

It will be good if RouterOS will have integrated brute force protection and filter.

Is Route-Filter equivalent (or similar) to the Cisco Route-Maps?

yes

Is Route-Filter equivalent (or similar) to the Cisco Route-Maps?

yes

Great, any chance we'll see acl's (filter groups) as well?

There is the option:

src-address-type (unicast | local | broadcast | multicast; Default: )
local - if address is assigned to one of router's interfaces

Is Route-Filter equivalent (or similar) to the Cisco Route-Maps?

yes

Great, any chance we'll see acl's (filter groups) as well?

what is that? ACLs are IP Firewall (Filter, Mangle, NAT). what else do you need?

Ethernet eth1 = router.hardware.ether1;

eth1.ip.address = “192.168.0.1”;
eth1.status = enabled;

log (“Eth1 - current speed: “ + eth1.speed);

• hotspot management
  accounting and billing
  two factor authentication
  OpenVPN AS
  performance tools
  enhanced management services
  storage providers
  move User-Manager and Netwatch here

• JSON/REST
  CORBA RPC
  ONC RPC
  DCE RPC

• Two factor authentication for management access and VPN tunnels.
  Password (or possible ACL) protected files and settings
  LDAP integration for management access.
  Real brute force protection

• - Pluggable module for Network Management (NMS) with support for:
  OpenFlow/NetFlow (SDN)
  RMAN2
  CIM/WBEM (SBLIM)
  SNMPv3 with enhanced security
  Enhanced MIB-II trees
  SNAP traps for all manageable objects (both hw and sw)

Nice list, but you have to ask yourself - do you want to see RouterOS v7 before or after 2020?

The trouble with working prototypes is that while you can create one in couple of days, you then need couple of months to turn them into something you can share with others, and much more if you want to reliably tackle all corner cases. I imagine there are quite a few in something with RouterOS size. So while I hope to see some of your suggestions make it into v7, I think a lot of others can be just distant dream for v8 or so.

RFC 3021

IPSec Policy with ADDRESSLIST

Please add some kind of "find router" feature. I often take over projects from other people and have to search for bunch of devices sometimes in many rooms even buildings. A simple "beep constantly" feature could save me a lot of time. You wouldn't believe where people put their routers and wifi access points. This way devices can be located without disrupting their operation. Beep constantly + maybe some kind of LED visual feedback would be nice to have.

JF.

This is already possible, there is a :beep console command and also leds can be turned on/off. Simple script will do the trick.

Please add some kind of "find router" feature. I often take over projects from other people and have to search for bunch of devices sometimes in many rooms even buildings. A simple "beep constantly" feature could save me a lot of time. You wouldn't believe where people put their routers and wifi access points. This way devices can be located without disrupting their operation. Beep constantly + maybe some kind of LED visual feedback would be nice to have.

JF.

This is already possible, there is a :beep console command and also leds can be turned on/off. Simple script will do the trick.

Hello!

RouterOS "ip route print where dst-address in x.x.x.x/z" is fast. But for a reason the same for ipv6 is slow (when the number of routes is large).

Please, make ipv6 route lookups fast as well.

caps,error removing stale connection [E4:XX:8C:D4:11:99/18/b823,Run,[E4:XX:8C:D4:11:99]] because of ident conflict with [E4:XX:8C:D4:11:99/18/e84d,Join,[E4:XX:8C:D4:11:99]]

caps,error removing stale connection [E4:XX:8C:D4:11:99/18/b823,Run,[E4:XX:8C:D4:11:99]] because of ident conflict with [E4:XX:8C:D4:11:99/18/e84d,Join,[E4:XX:8C:D4:11:99]]

You might be using the same certificate on multiple CAPs. Take this as an educated guess, not a definitive answer.

No certificates at all!! Maybe thats the problem??

No certificates at all!! Maybe thats the problem??

Another guess- CAPs with duplicated MAC addresses. Do you happen to use backup/restore to clone configuration of CAP devices?

Hi,

Please add feature that will allow me to add DNS name instead of exact IP address. I need this to connect 2 or more MKT routers (PPTP connection) if they are connected to internet thru ADSL and theirs IP addresses are dynamic. I hope that you understand what I am saying and that we can expect this feature in new ROS.

bye,

i think that this should be global. anywhere you specify a dns name it should be resolved.

Please make it possible to change the comment associated with a connection without it restarting said connection.

Please add some kind of "find router" feature. I often take over projects from other people and have to search for bunch of devices sometimes in many rooms even buildings. A simple "beep constantly" feature could save me a lot of time. You wouldn't believe where people put their routers and wifi access points. This way devices can be located without disrupting their operation. Beep constantly + maybe some kind of LED visual feedback would be nice to have.

JF.

This is already possible, there is a :beep console command and also leds can be turned on/off. Simple script will do the trick.

Hmm... can't make any of the 20 wAP devices beep.... is it just me or the damn thing does not have a beeper??? The 850Gx2 beeps OK...

JF.

I believe this request can be implemented very fast but it helps the ROS management with Multiple WAN a lot!
The "/ping" and "/system ssh" allow user to specify the "src-address" parameter so that the command can initiate the network connection on specific WAN easily.
BUT "/tool fetch" doesn't include "src-address" parameter.

The problem is one ISP blocks all incoming ping request, thus I cannot use ping as a remote monitoring facility, I need to find alternatives to archive this goal.
I write script to carry out the monitoring job, but as I know, "/system ssh" cannot be executed under script environment, which means I cannot use "/system ssh" to do this job.
The only way to choose is to use "/tool fetch" facility to monitor the remote ROS, BUT it lacks "src-address" parameter, to supplement this deficiency, before using the "/tool fetch", I need to specify a temporary custom route to fix the outgoing path for remote target.

The whole situation can be simplified tremendously by only adds the "src-address" parameter to "/tool fetch"

The problem is one ISP blocks all incoming ping request, thus I cannot use ping as a remote monitoring facility, I need to find alternatives to archive this goal.
I write script to carry out the monitoring job, but as I know, "/system ssh" cannot be executed under script environment, which means I cannot use "/system ssh" to do this job.
The only way to choose is to use "/tool fetch" facility to monitor the remote ROS, BUT it lacks "src-address" parameter, to supplement this deficiency, before using the "/tool fetch", I need to specify a temporary custom route to fix the outgoing path for remote target.

The whole situation can be simplified tremendously by only adds the "src-address" parameter to "/tool fetch"

Please add the ability to do a where query in [] with any valid-variable.

fail example:
:local identity "testRouter"
:local interface [/ip neighbor find where identity=$identity]

fail reason:
result differs from :local interface [/ip neighbor find where identity="testRouter"]
contains several interface which don't have the specified identity.

:local id "testRouter"
:local interface [/ip neighbor find where identity=$id]

:local interface [/ip neighbor find where $identity=$id]
:local interface [/ip neighbor find $identity=$id]