IP Cloud

janisk · Fri Jan 25, 2019 1:30 pm

We have improved old IP Cloud backend, that will continue to serve older RouterOS versions.

1) Upgrading/downgrading between RouterOS versions with old or new IP Cloud does not need any extra attention. No more disabling/enabling the service.
2) New IP Cloud address for cloud.mikrotik.com - 159.148.147.229
3) The old IP address (81.198.87.240) will continue to work for hosts, but routers with working /ip dns configuration will work with the new IP address.

anav · Fri Jan 25, 2019 8:51 pm

Hi Janisk, thanks!
If my default setup does not allow external access to winbox, (or entire input chain) there is no security risk in using IP cloud correct?
It simply is an effective way to point to our external public WANIP (especially for those that need to connect to devices behind the router)?

jebz · Sun Jan 27, 2019 2:05 pm

We have improved old IP Cloud backend, that will continue to serve older RouterOS versions.

.
Thankyou this is good news.

janisk · Tue Jan 29, 2019 11:36 am

Hi Janisk, thanks!
If my default setup does not allow external access to winbox, (or entire input chain) there is no security risk in using IP cloud correct?
It simply is an effective way to point to our external public WANIP (especially for those that need to connect to devices behind the router)?

IP Cloud is made so that it does not pose a security threat. It will assign FQDN to IP address of your router. In RouterOS 6.43 or newer - it will have both A and Quad A entry maintained by the router (if both v4 and v6 connections can reach our backend).

mkx · Tue Jan 29, 2019 2:08 pm

It will assign FQDN to IP address of your router. In RouterOS 6.43 or newer - it will have both A and Quad A entry maintained by the router (if both v4 and v6 connections can reach our backend).

It works for me on 6.44beta54 nicely, thank you!

The only problem with IPv6 (not MT's fault) is that IPv6 AAAA has very limited usability. In IPv4 usually there will be some DST-NAT rules and will work directly off the IP address pointed to by A record. In IPv6 usually there will be some routing allowed, but referring to LAN host IP addresses directly. Hence AAAA record can only be used as a pointer where the whole /64 (or /60 or whatever prefix length) network wandered and one will have to deduct LAN hosts' IPv6 addresses by hand.

Meins · Fri Feb 15, 2019 8:31 pm

Hello Janisk,

Is it possible to contact me via pm? I have a important Question to the Cloud function of the mirkotik that i don't wont to discuss in public.

Peter

We have improved old IP Cloud backend, that will continue to serve older RouterOS versions.

1) Upgrading/downgrading between RouterOS versions with old or new IP Cloud does not need any extra attention. No more disabling/enabling the service.
2) New IP Cloud address for cloud.mikrotik.com - 159.148.147.229
3) The old IP address (81.198.87.240) will continue to work for hosts, but routers with working /ip dns configuration will work with the new IP address.

Chupaka · Fri Feb 15, 2019 9:52 pm

Hello Janisk,

Is it possible to contact me via pm? I have a important Question to the Cloud function of the mirkotik that i don't wont to discuss in public.

support@mikrotik.com

Meins · Fri Feb 15, 2019 10:07 pm

.. responding time: 10 Weeks if you write on this address….

Hello Janisk,

Is it possible to contact me via pm? I have a important Question to the Cloud function of the mirkotik that i don't wont to discuss in public.
support@mikrotik.com

Chupaka · Fri Feb 15, 2019 10:14 pm

.. responding time: 10 Weeks if you write on this address….

PM response time: never, as they are disabled on this forum

10 weeks are less than +infinity, if I remember correctly

nostromog · Sat Feb 16, 2019 1:53 am

IP Cloud is made so that it does not pose a security threat. It will assign FQDN to IP address of your router. In RouterOS 6.43 or newer - it will have both A and Quad A entry maintained by the router (if both v4 and v6 connections can reach our backend).

There is a clear problem not being able to address different names for IPv4 and IPv6 addresses. My router in London, for instance, is under a provider that has CGNAT for IPv4 but gives a /56 of IPv6 addresses. As it is currently, for the other Mikrotik routers the name is useless, as the IPv4 address is non functional, while the IPv6 is perfectly reachable. Not even in the tunneled machines can I say

/ping <mysn>.sn.mynetname.net interface=sit1

, as the router pings using IPv4 even on interfaces that have no IPv4 addresses...

Computers are more clever and usually prefer IPv6 correctly.

I wonder if you could make the cloud server ping back to ensure that the the addresses are reachable before confirming the records. In any case I think you should provide <mysn>.4sn.mynetname.net and <mysn>.6sn.mynetname.net records.

nichky · Sat Feb 16, 2019 8:00 am

This features from which version will start up?

florid · Mon Feb 18, 2019 7:54 am

I tested IPv6 once but that IPv6 address keeps in my IP Cloud record. How can I remove/clean that IPv6 entry only since I no longer use IPv6?

Update: Mikrotik support told me to disable / re-enable IP Cloud will remove no longer used IPv6 record.

PatricF · Tue Mar 05, 2019 2:17 pm

Do I get a new domain name with the new Cloud service or if it still the xxxxxxxxx.sn.mynetname.net domains that are being used?

Chupaka · Tue Mar 05, 2019 2:53 pm

Domain names did not change, it's still *.sn.mynetname.net

janisk · Thu Mar 07, 2019 2:43 pm

.. responding time: 10 Weeks if you write on this address….

mikrotik.com

Contact via support@mikrotik.com
The e-mail has to contain proper question.

Domain names are *.sn.mynetname.net For IMv4 A record is added, for IPv6 AAAA record is added. If you enable DDNS feature router will attempt to connect via IPv4 and another connection via IPv6.
If you want to force the router to use only IPv6 to communicate with IP Cloud backend in the /ip dns cache set up a static entry cloud2.mikrotik.com with the proper IPv6 address. We are trying our best to not change the IP addresses without a good reason. In this case, the IPv4 connection will always fail.

The update works as fowllows - if no options are set - your DDNS address will be assigned to the source address of the packet received. That is not our concern if the address is not reachable as users may opt to register their local addresses, like 192.168.88.1 that is not globally routable.

Also, it is possible to check /ip cloud public-address (or public-ipv6-address) to see what source address packets coming from your router had.

One more important thing - if you have 2 or more connections, make sure you have proper configuration on your router for balancing or failover.

PatricF · Thu Mar 07, 2019 5:01 pm

@janisk can you please check if you can open port 53 over TCP for the nameserver of *.sn.mynetname.net? (ns1.kissthenet.net and ns2.kissthenet.net)
These nameservers also doesn't seem to support EDNS.

janisk · Fri Mar 15, 2019 12:23 pm

IP Cloud DNS server is not responding to TCP requests and in general, is outright denying access to TCP#53. All the EDNS features that rely on UDP will work. EDNS changes are there since February,

nichky · Sun Mar 17, 2019 8:43 pm

Cen i get some info regarding Ip Cloud. Since new version 6.44.1 Ip Cloud has features “use-local-address” if i tick that domain names is not going to change, it's still *.sn.mynetname.net

Chupaka · Sun Mar 17, 2019 11:57 pm

It just uses local IP address (for example, in case of CGNAT), like you get local internal IP 100.72.56.9 from your ISP, and then it's NAT'ed to public IP 93.125.75.34.

nichky · Mon Mar 18, 2019 1:34 am

i thought that if i tick “use-local-address” is going to be local_address.sn.mynetname.net

Chupaka · Mon Mar 18, 2019 8:25 am

You mean, local_address being "washington-street-bld-123-office-57a"?

nichky · Mon Mar 18, 2019 10:27 am

You mean, local_address being "washington-street-bld-123-office-57a"?

like 192.168.88.1.sn.mynetname.net. And i was thinking that i ca use like public address

.To be honest

ahmetaybar · Tue Mar 26, 2019 5:28 pm

Hello,

I am using Mikrotik on the vessels behind satellite modem with very limited data usage such as 50Mbyte per month. So each MBbye cost the customers extra US$s. We just allow e-mail IPs on the firewall
I have seen on satellite POP, we have a lot of request from our satellite modem to 81.198.87.240 and 159.148.147.229. I saw that these are Mikrotik Cloud IPs. I have disabled Cloud and DNS service on the unit. But it still send reqauest to those IPs. I have added rules to IP firewall rules but it is still happening.
How can I stop these requests or block these IPs on the Routerboard?

gotsprings · Wed Mar 27, 2019 6:21 pm

Hello,

I am using Mikrotik on the vessels behind satellite modem with very limited data usage such as 50Mbyte per month. So each MBbye cost the customers extra US$s. We just allow e-mail IPs on the firewall
I have seen on satellite POP, we have a lot of request from our satellite modem to 81.198.87.240 and 159.148.147.229. I saw that these are Mikrotik Cloud IPs. I have disabled Cloud and DNS service on the unit. But it still send reqauest to those IPs. I have added rules to IP firewall rules but it is still happening.
How can I stop these requests or block these IPs on the Routerboard?


/ip firewall address-list
add address=81.198.87.240 list=ipCLOUD
add address=159.148.147.229 list=ipCLOUD
/ip firewall filter
add action=drop chain=output dst-address-list=ipCLOUD place-before=1
add action=drop chain=forward dst-address-list=ipCLOUD place-before=1
/ip dns cache flush

That should block devices inside the network for reaching IPCloud
It will also force the router to dump connection attempts to IPCloud

leoservices · Sat Mar 30, 2019 5:20 am

I tested with an option Use IP Local Address but being with CGNAT but only returns the Public IP.

nichky · Sat Mar 30, 2019 10:34 am

I tested with an option Use IP Local Address but being with CGNAT but only returns the Public IP.

Can you give more info what for “ Use IP Local Address” . i haven't an idea how can i use.

nescafe2002 · Sat Mar 30, 2019 10:41 am

[admin@MikroTik] /ip cloud> print 
          ddns-enabled: yes
  ddns-update-interval: none
           update-time: yes
        public-address: 82.x.x.x
              dns-name: 757bxxxxxxxx.sn.mynetname.net
                status: updated

It displays public address, but will return local address in actual lookup.

C:\>nslookup 757bxxxxxxxx.sn.mynetname.net
Non-authoritative answer:
Name:    757bxxxxxxxx.sn.mynetname.net
Address:  192.168.88.x

(6.45beta20)

nichky · Sat Mar 30, 2019 11:46 am

[admin@MikroTik] /ip cloud> print 
          ddns-enabled: yes
  ddns-update-interval: none
           update-time: yes
        public-address: 82.x.x.x
              dns-name: 757bxxxxxxxx.sn.mynetname.net
                status: updated

It displays public address, but will return local address in actual lookup.

C:\>nslookup 757bxxxxxxxx.sn.mynetname.net
Non-authoritative answer:
Name:    757bxxxxxxxx.sn.mynetname.net
Address:  192.168.88.x

(6.45beta20)

It doesn't come on my side

janisk · Thu Apr 18, 2019 2:41 pm

Code: Select all
/ip firewall address-list
add address=81.198.87.240 list=ipCLOUD
add address=159.148.147.229 list=ipCLOUD
/ip firewall filter
add action=drop chain=output dst-address-list=ipCLOUD place-before=1
add action=drop chain=forward dst-address-list=ipCLOUD place-before=1
/ip dns cache flush
That should block devices inside the network for reaching IPCloud
It will also force the router to dump connection attempts to IPCloud

While outright cutting at the firewall works beautifully. Sometimes knowing what uses what is better.

IP Cloud services include:
Time-zone detection, that is enabled by default.
approximate time setup, if NTP/sNTP is not used (user enabled)
DDNS (user enabled)
Backup (user initiated)

Out of scope of the IP Cloud services the detect-internet feature uses the same IP addresses for communication.

nichky · Thu Apr 18, 2019 11:04 pm

janisk, what about in my case? did i do correct, did you see the picture above?

nostromog · Fri Apr 19, 2019 1:03 am

IP Cloud services include:
Time-zone detection, that is enabled by default.

And fails spectacularly when I'm in London, systematically thinking that I'm in Europe/Tallin:

[user@router] > /system clock print 
                  time: 00:50:19
                  date: apr/19/2019
  time-zone-autodetect: yes
        time-zone-name: Europe/Tallinn
            gmt-offset: +03:00
            dst-active: yes

When I left the place it was in Europe/London, and it has not moved... This is the travel router, which would benefit from being detected; the main one here
I already disabled the time-zone-autodetect because it was changing to Tallin in every reboot.

janisk · Tue Apr 23, 2019 9:27 am

we do update the database regularly, so in most cases, this should be correct. Maybe sometime later it will clear the issue. Also, for the detection the IP address you are communicating with the server is used. As a result, if you use tunnels it might guess incorrectly.

nichky: do your outgoing interface have a local IP address? If not, even if you set - use-local-address it will bind to the outgoing IP address as used by the kernel to create a connection.

nichky · Wed Apr 24, 2019 3:51 pm

we do update the database regularly, so in most cases, this should be correct. Maybe sometime later it will clear the issue. Also, for the detection the IP address you are communicating with the server is used. As a result, if you use tunnels it might guess incorrectly.

nichky: do your outgoing interface have a local IP address? If not, even if you set - use-local-address it will bind to the outgoing IP address as used by the kernel to create a connection.

of course it does, so my ether1 has public interface and my outgoing interface has local ip. You can see from my picture above. When i do nslookup im getting my public ip. Maybe im doing something wrong, or..
correct me i want to be sure that this feature it works.

Thanks a lot

Chupaka · Thu Apr 25, 2019 9:28 am

of course it does, so my ether1 has public interface and my outgoing interface has local ip. You can see from my picture above.

There is no interfaces and local IPs on your picture. Probably you're talking about some other picture?

nichky · Fri Apr 26, 2019 3:00 pm

of course it does, so my ether1 has public interface and my outgoing interface has local ip. You can see from my picture above.
There is no interfaces and local IPs on your picture. Probably you're talking about some other picture?

okay, so on ether1 is terminated pppoe connection.
Outgoing interface bridge. In there is ether2 and wlan1.

ip cloud is already eabled, plus use-local-address.

how i'm testing does use-local-address work?
like the picture above

Chupaka · Fri Apr 26, 2019 6:44 pm

If ISP1 is your PPPoE (and I believe it's your outgoing interface - check your default route), then if you have some private IP in ISP1 (like 10.2.3.45 or 100.89.123.21; when your ISP uses NAT instead of giving public IPs via PPPoE), then use-local-address will add that private IP to Cloud DNS instead of NAT one.

I can't see exact IP on ISP1 interface because of some black dirt on my screen

algisr · Fri Jan 03, 2020 3:09 pm

Hey,
Any way we can get 2 DDNS for dual WANs?

Also, does MikroTik plans to add DDNS functionality for CHR free edition?

deanMKD1 · Sun Mar 08, 2020 8:01 pm

Cloud not working again...

mcskiller · Thu Apr 02, 2020 4:48 pm

Same here.. ip cloud not working, rb750 latest routeros and firmware.

ricardovianna · Wed Jun 03, 2020 5:37 am

Hi,

I'm having issues on IP Cloud with IPv6. The public IPv6 does not get updated.

/ip cloud print
  ddns-enabled: yes
  ddns-update-interval: 1m
  update-time: yes
  public-address: 201.27.181.165
  public-address-ipv6: 2804:431:b799:39ca::8
  dns-name: axxxxxxxxxxx.sn.mynetname.net
  status: updated

This is my IPv6:

/ipv6 address print  
  Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local 
   #    ADDRESS                                  FROM-POOL INTERFACE               ADVERTISE
   0  G 2804:431:c7f2:df3f::/64                  pool-ipv6 bridge                      yes

The IPv4 address is correct.

I tried forcing update, having a 1 min as DDNS update interval and nothing made the IPv6 address show correctly.
How should I get this resolved?
Thank you

kaitwo · Thu Jun 11, 2020 10:11 pm

Hi:

I have a RB951Ui-2HnD that refuses assign a dns-name in /ip cloud:

[admin@RuthMikroTik] /ip cloud> print
          ddns-enabled: yes
  ddns-update-interval: none
           update-time: yes
[admin@RuthMikroTik] /ip cloud>

I've setted up tons of other routers using same internet access without issues.

Any idea?

Regards.

GioBar · Mon Jun 15, 2020 1:56 am

same problem, cloud does not work on LTE modem on latest stable version

jtf6xb · Tue Jun 16, 2020 8:06 pm

I am unable to get IP Cloud to function on my Hex S. I had it working on my other device, but that one has a bad port. I can ping cloud2.mikrotik.com and see traffic to and from the respective IPs, but IP Cloud never updates or assigns a DNS name. There are no ip or bridge filters to block traffic.

eggbean · Wed Jun 17, 2020 5:06 am

Does this feature work? I've recently got a RB4011GS+RM. On my previous router I could update DDNS to a few different services and it was very reliable, so I hope that I am doing something wrong rather than that this service be too unreliable to use. I am using to open aws and gcloud firewalls to my home connection.

[admin@MikroTik] > /ip cloud print 
          ddns-enabled: yes
  ddns-update-interval: 3m
           update-time: yes
              dns-name: d12XXXXXXda71.sn.mynetname.net
                status: updating...
[admin@MikroTik] > /ip cloud advanced print 
  use-local-address: yes

It seems to be stuck on updating and the A record is not the same as the output of..

$ curl icanhazip.com

jvanhambelgium · Wed Jun 17, 2020 7:24 am

Sure it works.
Do NOT enable the "use-local-address" as the result will be that not your public IP is pushed to the cloud-DNS service but your private/internal one. Not very useful.

[user@gateway] > /ip cloud print
ddns-enabled: yes
ddns-update-interval: none
update-time: yes
public-address: my.public.ip4.number
public-address-ipv6: my.public.ip6.number
dns-name: myserialnumber.sn.mynetname.net
status: updated
[user@gateway] > /ip cloud advanced print
use-local-address: no

AlexRodac · Wed Jul 15, 2020 11:57 pm

Hello, I have a problem, my case it is that I cannot configure the IP cloud because my device has a private IP that is given to me by a mobile phone server, so when I try to activate it to be able to connect in a way remote, in the cloud sale it tells me to post nat and well, it is obvious that nat is from the internet distributor that this case is a mobile phone provider, is to say a sim card, what can I do to enter remotely in this case?
My device is a LtAP LTE, with three slots for sim cards.
I await response, thanks, regards.

vecernik87 · Thu Jul 16, 2020 10:21 am

@AlexRodac: You can't do much. "IP Cloud" is just fancy name for Dynamic DNS. It helps if you have public dynamic IP - that means real world routable IP which can randomly change anytime. Everytime IP changes, mikrotik will update the DNS entry and point the same unique domain name to the new IP.
Without public IP you have no way to connect to your device from rest of the world. There are only two options which may not be suitable for you:
1) use port forwarding to poke a hole through the nat (pretty sure impossible in your case, because you do not manage ISP's routers which are doing the NAT)
2) have a VM in cloud or somewhere else, with a public IP. Then you can set it as a VPN server. Your router will connect to it as a client (which will make a tunnel through the NAT) and then you can forward the data from public IP to your router. (or even better - you connect through the VPN as well and that way you have secure access to your router or even whole LAN from all around the world)

AlexRodac · Thu Jul 16, 2020 6:10 pm

@AlexRodac: You can't do much. "IP Cloud" is just fancy name for Dynamic DNS. It helps if you have public dynamic IP - that means real world routable IP which can randomly change anytime. Everytime IP changes, mikrotik will update the DNS entry and point the same unique domain name to the new IP.
Without public IP you have no way to connect to your device from rest of the world. There are only two options which may not be suitable for you:
1) use port forwarding to poke a hole through the nat (pretty sure impossible in your case, because you do not manage ISP's routers which are doing the NAT)
2) have a VM in cloud or somewhere else, with a public IP. Then you can set it as a VPN server. Your router will connect to it as a client (which will make a tunnel through the NAT) and then you can forward the data from public IP to your router. (or even better - you connect through the VPN as well and that way you have secure access to your router or even whole LAN from all around the world)

Thanks for your answer
In this case, the idea is a transport line, how can I do to enter the device remotely? because all this about creating a vm in IP Cluod is as if the device was always connected to an ethernet cable. And the device is to be independent, that is, it will be installed on a bus, in this case, and will receive the Internet through a SIM card from a local telephone dealer. So how can I do there? Or what exactly do you mean by creating a virtual machine in the cloud? Don't I already need to have enabled the option from the device? which is not allowed for the small problem of the private ip.

mkx · Thu Jul 16, 2020 7:33 pm

The idea is to have a virtual machine running CHR in {google,amazon,azure,etc.} cloud where it has public IP address (can even be dynamic, but public so that IPcloud does work). Then your mobile box using mobile network as internet access establishes VPN tunnel towards the CHR and via CHR you have access to the mobile device.

Sob · Thu Jul 16, 2020 7:54 pm

Or a more detailed explanation, if you want to connect to device, you need public address, it's not possible without it, it's just the matter where exactly it is.

Best case is when device has is, i.e. gets it from ISP. Which nowadays often doesn't happen, because there are not enough public addresses for everyone (actually there are, it's called IPv6, but whole world has been ignoring it for more than twenty years; oh well...).

Slightly worst case is when device doesn't have public address directly (it's behind NAT), but ISP forwards all or at least some selected ports to it from public address which is somewhere else.

Worst is NAT and no forwarded ports, which is most likely what you have. In that case the only way is to find another device which has public address, connect your device to it using some kind of VPN and forward ports from device with public address to yours.

The last option (sort of) is used by all those remotely controlled devices that you just plug in local network, and you can access them from anywhere without configuring anything. They simply connect to some manufacturer's server (popular term is cloud), you're connecting there too, and server communicates with connected device. Even though MikroTik also called their thing "cloud", it doesn't do this, you'd have to create such thing yourself (see previous paragraph).

AlexRodac · Thu Jul 16, 2020 11:04 pm

Oh right, thank you very much i am going to do and let you know what happens

gotsprings · Mon Sep 21, 2020 3:52 pm

Since my other post is getting read but not answered...

Is the older IP Cloud service still working?
cloud.mikrotik.com

I have a few older routers out there that I think still use the old service.

Was it shut down or is something else going on?
############
UPDATE:
Got an email from support (several days later) asking me to update to latest routerOS, which is the typical canned response.

It also told me make sure that cloud.mikrotik.com resolved and pinged... which it did.

Then to check my firewall rules...

Its been working for a couple of years. Mikrotik... can you just tell me if something has changed.

Znevna · Mon Sep 21, 2020 6:23 pm

they can deprecate anytime support for version older than 6.43, why would anyone care about those with so many security issues in them anyway?

gotsprings · Mon Sep 21, 2020 9:29 pm

they can deprecate anytime support for version older than 6.43, why would anyone care about those with so many security issues in them anyway?

Because when you try to take a look at an old system that was installed in 2014 and last touched in 2018... knowing that IP cloud(1) has been deprecated would be helpful.

atuxnull · Fri Sep 25, 2020 3:23 pm

Hi. running Mikrotik in a x86 machine (Alix from PC engines) and i cannot see the IP>cloud setting.
is it hidden and needs to be enabled by some commands?

nescafe2002 · Fri Sep 25, 2020 3:33 pm

viewtopic.php?t=136036#p670044

Found the answer. The option "ip cloud" is not supported on x86 due to the inability to verify hardware reliably.

viewtopic.php?p=430762#p430762

The DNS is assigned to valid serial numbers, for X86, we have no way of reliably identify the hardware.

gotsprings · Fri Sep 25, 2020 9:39 pm

Got an email from support
..... "The server has not received any info prom this device."

So yeah it looks like Mikrotik broke something on IPCloud 1 relating to 6.40.

gotsprings · Tue Sep 29, 2020 6:50 pm

Updated a router from using Cloud to Cloud2.

Now IP cloud doesn't even show updating.

gotsprings · Wed Sep 30, 2020 9:09 pm

Took a wAP AC from 640.1 to 6.47.4.
IP cloud had never been enabled.
After reboot and update of firmware... IPCloud doesn't work.

Come ON Mikrotik... SOMETHING IS UP.

gotsprings · Fri Oct 02, 2020 9:15 pm

Noticed yesterday that routers that would be using IP cloud1 started popping back up.

Edit/update

Received email this morning 10/05/20
"Hello,

We had some issues with the cloud servers in the past weeks, but if the same issue happens again, please let us know.

Best regards,
######"

aleksandrko · Sun Nov 01, 2020 3:18 pm

Hello!
Please make it possible to get an ipv4 address and an ipv6 address separately. For example v4.cbXXXXXXXXXX.sn.mynetname.net or v6.cbXXXXXXXXXX.sn.mynetname.net
Now we have to use a crutch so that the cloud ip is ipv4 only

crutch.png

Znevna · Tue Nov 10, 2020 11:47 pm

Easier and safer to add cloud2.mikrotik.com to IPv6/Firewall/Address Lists.
And block that list in the IPv6 firewall.

inbsp · Wed Dec 30, 2020 3:29 pm

Good day Lady's, Sir's, and LadySir's.
Can anyone tell me, where can I find any information on "how to transfer assigned dns A record from one mikrotik to another"
I have one dying mikrotik (with too many bad blocks, on next reboot netinstall would not help). On that mikrotik I have a pptp server, wich is reachable by ddns record *.sn.mynetname.com.
I have several clients, who is connected to it by this DDNS A record. There is no option for re configuring those clients.
I can transfer all (server, ip, etc) configuration, but how I can transfer this particular DNS name?

Znevna · Tue Jan 05, 2021 12:12 pm

You can't.

eworm · Tue Jan 05, 2021 12:14 pm

You can not. The device's serial number is used in dynamic DNS name.

If you want a name that does not change on new hardware use a CNAME:
my-static-name.example.com -> serial.sn.mynetname.com.

If you can not reconfigure the clients it is too late, though...

masa · Wed Jan 20, 2021 6:56 am

Hello,
I'm using rb2011uias-in at router os latest ver.

I have a question about IP cloud.

I set ddns enabled yes,
then ddns-update-interval set to none,
Does this mean the router will check IP address
by every minutes automatically?

Could anyone help to answer?

Chupaka · Wed Jan 20, 2021 3:43 pm

From the docs:

ddns-update-interval (time, minimum 60 seconds; Default: none) - If set DDNS will attempt to connect IP Cloud servers at the set interval. If set to none it will continue to internally check IP address update and connect to IP Cloud servers as needed. Useful if IP address used is not on the router itself and thus, cannot be checked as a value internal to the router.

Does that answer your question?

masa · Thu Jan 21, 2021 12:41 am

　Thanks,
“If set to none it will continue to internally check IP address update and connect to IP Cloud servers as needed."
none means no specific interval set and is it updated only when needed?

Chupaka · Thu Jan 21, 2021 3:05 pm

Exactly

takefour · Sat Apr 17, 2021 9:42 am

I have seen on satellite POP, we have a lot of request from our satellite modem to 81.198.87.240 and 159.148.147.229.

anav · Tue May 18, 2021 2:37 pm

Some practical questions:
(1) What is the difference between the 60 second update and a FORCED update??

(2) If I have used the MT dyndns name in firewall rules (address lists), for other routers public IP, how do I know THOSE will be updated appropriately
(I cannot force udpate on someone elses router )
In other words, my own router checks my own dydns name and keeps the registered public IP up to date, but HOW do I know if my router keeps checking the other DYDNS names in my firewall rules to ensure those addresses are up to date.

(3) Finally, lets say I have a MT dyndns name used in a WIREGUARD endpoint setting. How will I know if
a. MT checks to ensure that dyndns address hasnt changed
b. updates it.

Clearly when it changes I will lose connectivity but there is a keep alive function every 30 seconds on the tunnel setup lets say.
Will the router be able to recover?????

vecernik87 · Wed May 19, 2021 1:38 am

@anav

1) No idea what the "forced" means. If you are talking about

force-update

command, well, that does what it says - it is an command (not a parameter), which forces the update to happen straight away. Meanwhile the "60 second" probably refers to

ddns-update-interval

which is parameter/setting which says how often to update the address.

2) if you use any FQDN in the

/ip firewall address-list

, it should follow standard DNS rules - it is resolved to the IP (and dynamic entry is added, with FQDN in

comment

and IP in

address

). You can also notice that

/ip dns cache

entry exists with correct TTL. Once TTL in DNS cache expires, router tries to resolve it again. If the new IP is different than the old one, the address-list is updated.

3) You can't be sure that MT updates it, but you can surely know that MT is checking, by looking at your

/ip dns cache

. If the TTL refreshes, you know that it has been checked. The MT ddns has fairly short TTL on purpose - only 60 seconds. That way, every device using this IP should re-check for update every minute. If your IP changes, the outage (caused by wrong IP) will be between 0-60 secs.

3firs · Mon Jun 07, 2021 6:55 pm

Hi,

For some reason IP Cloud is not updating for us on new installs of CHR. It's licensed with P1. Is this some bug? It's happening in the latest Long-Term and Stable ROS versions.

elmemis · Wed Dec 28, 2022 7:46 pm

The service not working, please check servers.

diamuxin · Mon Jan 09, 2023 6:15 pm

Still not working

BR.

pasan · Thu Mar 16, 2023 11:27 am

As of 2 weeks ago I noted that neither DDNS or the time is updating. I have a firewall rule to allow UDP port 15252 traffic through on the input chain on the pppoe interface. Is the service down or did something change on the mynetname.net server end?

Thu Mar 16, 2023 11:40 am

Not sure how you make that conclusion ?

I have a mAP on a site of one of my customers. Time is updating just nicely using IP Cloud after reboot (I can see it being logged).
Also just enabled DDNS on that device, within 30 seconds it responded from cmd-line ping.
So as far as I can tell, the service is working.

It should be an outgoing connection AFAIK, there's nothing input to it.
It's the device itself which will be using outbound connection to the service to get the time or to announce new IP address.

If you use terminal, what output do you get from this command: /ip cloud print

eworm · Fri Mar 17, 2023 12:39 am

I've had some issues with cloud backup lately. Did Mikrotik add some kind of rate limiting, for example to mitigate brute force or denial of service attacks? In general the idea is not bad, but it becomes a problem if several devices behind one public address fail.

pasan · Wed Apr 05, 2023 11:17 am

It should be an outgoing connection AFAIK, there's nothing input to it.

So I did a little bit more digging. It turned out to be this firewall rule that was causing my issue

add action=drop chain=input comment="Block WAN connections to router" 
    in-interface=pppoe-out1 log=yes src-address-list=!allow

When I disabled this rule the DDNS and time updated.
I added the cloud.mikrotik.com and cloud1.mikrotik.com to the allow list. Let's see how that goes because not sure adding a DNS entry into the address list dynamically updates the IP addresses or it is only resolved at the time when added. i.e. when the cloud.mikrotik.com IP address change will that also update in the address list?

Wed Apr 05, 2023 11:23 am

Could be you blocked the response from that service. Hard to tell without seeing the rest of your rules.

Who is online