MikroTik

tomislav91

Any advice how to do it

tomislav91

I didnt say that vpn works. I only said that i have 1000 routers on VPN and f something broke and need to fix maybe with routes, etc, and try to find a way to solve it.

tomislav91

So, is there some possibility if I have a 1000 routers in my vpn network to somehow access it to troubleshoot if there is no internet connection.
I never used rommon, but dont sure if thats some possibility through vpn

tomislav91

Hello,

I know that mikrotik is not such nextgen FW but is there some efficient way to block internet traffic and allow only thats real need (i have a list).

tomislav91

i somehow stuck here

/file get test.html contents

/file set test.html contents=[/file get test.html contents; :find "http://"; :pick replace with "https://"]

but there is no replace....of course..

tomislav91

yes i did, but i thought its possible to change it. So, any ideas?

tomislav91

so its not possible something like this thread:
viewtopic.php?t=62024

tomislav91

problem is that i have more than 1000 routers, and dont wanna do it manualy, so i will use automation to do it, and thats why i need a single command.

tomislav91

No, i have a file name test.txt and in that file I need to change some url, so instead of http to use https, thats the only change.
But i cannot fetch it again, cause every file is different

tomislav91

So,

is it possible to modify a files which are uploaded into Files in mikrotik routers via cli? I need to change some link inside it.
I can access it via

file edit value-name=contents test.txt

but how to change it there through terminal

tomislav91

Hi, i have issue from some of different OS send tls 1.0. Is it possible to check it with mikrotik terminal? I tried like this /tool fetch http-method=post url="https://test.com/testapi" i need similar command which windows does: curl -v --tlsv1.2 -X POST "https:/test.com/testapi"

tomislav91

This is what I tried but no luck /ip firewall mangle add action=mark-routing chain=prerouting src-address=10.10.194.40 dst-address=192.168.2.3 new-routing-mark=to_vpn passthrough=yes /ip route add distance=1 routing-mark=to_vpn dst-address=192.168.2.3 gateway=ovpn-out1 /ip firewall mangle add action...

tomislav91

Call me stupid, but I just want to ask maybe a simple question. If I have openvpn connection to my router, and that server push some routes (remote subnets) to my mikrotik for my whole lan subnet. So if I have 2 ISP, and I am connected now through ISP_1, and my openvpn is connected ofcourse. For som...

tomislav91

anyone

tomislav91

The right question is why did you mangle??? Think about it..... a. you created a table and a route using the table. b. you created a routing rule for that IP to use the table. DONE! no mangling required. Also why did you bother with distance=4? While we are at it lets fix the routing rule. from: /i...

tomislav91

I wanted to put one IP to another isp using pbr /ip firewall mangle add action=mark-routing chain=prerouting new-routing-mark=isp_2 passthrough=no \ src-address=10.10.194.40 /ip route add distance=4 gateway=192.168.0.1 routing-mark=isp_2 /ip route rule add dst-address=0.0.0.0/0 src-address=10.10.194...

tomislav91

guys, there is nothing fancy in config. All we did is just a simple failover and connect router to open vpn, and within routes we can see Screenshot 2023-11-06 at 10.22.10.png Firewall doesn't matter here, only routing. So, when I put that .5 address to another ISP via command I provided to you, tra...

tomislav91

So i have connect my router to pfsense OpenVPN and have some routing things there and that's work like its should. So problem is next, when I use this command to forward only 1 IP to another isp: /ip firewall mangle add action=mark-connection chain=prerouting \ connection-mark=no-mark dst-address=!1...

tomislav91

thanks, so we have 2 possible situation, first is that my cpe is not reachable, then we need blackhole? And if my cpe is not reachable then we need blackhole ? I'm not sure what you actually wanted to express, so please reword that. So how can i improve my firewall settings further on, can we preve...

tomislav91

If ISP_1 "goes down" in terms that internet is not reachable via ISP_1 but the physical interface connected to the CPE provided by ISP_1 stays up (which is your main concern as per post #4 , you don't need the blackhole route because in such a situation, the route to 9.9.9.9 via 192.168.0...

tomislav91

Which address should I use for this? I am not sure what is reachable only through that wan? When routing a packet using a routing table, among all active routes whose dst-address matches the destination address of the packet, the one with the longest dst-address prefix is chosen. So although a rout...

tomislav91

helpp for that

tomislav91

Probably you write worng IPs on post??? If the RouterBOARD has an IP for both networks AND ALL devices on the network gateway the IP on the RouterBOARD, the ROUTER automatically connects both networks, unless firewall rules or other configuratin block this thing. If the RouterBOARD does not act as ...

tomislav91

I have Wi-Fi on MikroTik. The range is 192.168.6.0/24, and the local LAN is 192.168.6.0/24 How can I make these ranges visible to each other? I tried /ip route add dst-address=192.168.6.0/24gateway=10.50.50.0/24 /ip firewall nat add chain=srcnat src-address=10.50.50.0/24 dst-address=192.168.6.0/24 a...

tomislav91

i bought new one 2116 for replacement of old one hw, but i encounter many errors even when i update old one to v7 and export it to new.
So, waste of money.

tomislav91

we didn't figure it out. How knows why.

tomislav91

i now buy a new route r2116 and cant put it new version, its just a hard work to do it. I will try to manually upgrade it to v7 like you propose.

why on earth when try to restore from 1036 (v7.

to 2116 same version, on 2116 number of interfaces went from 13-25 omg

tomislav91

i now buy a new route r2116 and cant put it new version, its just a hard work to do it. I will try to manually upgrade it to v7 like you propose.

tomislav91

Do not use old 7.2, on new version have fixed some bad impor from previous version and almost correctly convert bgp and filters. Use 7.7. But do not expect trouble-less experience on migration. My CCR2116-12G-4S+ (with 2 BGP 2G + 2G) where I'm forrced to use v7.7 still up and do not crash for month...

tomislav91

I am having one issue, having one ccr1036 and version 6.49.7 and want to change it to 2116, but on 2116 minimum is 7.2 What is recommendation in this situation, because i can't do export-import because of syntax. Is it way to put 6.49.7 and then update it or should i just update to 7.2 and then expo...

tomislav91

The script uses a for-each loop to iterate over all Ethernet interfaces found by the find command. Inside the loop, the script retrieves the name of the current interface using the get command and stores it in a local variable named name. The script then sets two global variables using the global co...

tomislav91

Maybe to create some pbr? Something like this? /ip route add dst-address=100.64.0.0/10 gateway=100.0.0.1 routing-mark=10064 /ip firewall filter add chain=forward protocol=all dst-address=100.64.0.0/10 action=mark-routing new-routing-mark=10064 /ip firewall nat add chain=srcnat out-interface=<externa...

tomislav91

Firstly, it's important to note that an MTU of 1460 bytes is generally recommended for OpenVPN connections. However, the MTU should be set to the same value on both sides of the connection. Regarding measuring fragmentation, errors, and retransmissions, you can use a tool like Wireshark to capture a...

tomislav91

i am having on mikrotik input drop for address list shodan, and shodan.io for source ip, but how than shodan finds info about it?
Its snmp info.

tomislav91

Is it possible to hide snmp info from shodan on mikrotik routers?

tomislav91

#!/bin/bash user=admin read -sp 'Password ' pass log=StrictHostKeyChecking=no locdir=/home/user/backup/ rm -rf /root/.ssh/known_hosts d=$(date '+%d-%b-%Y') mkdir $locdir/user_$d cd $locdir/user_$d while read n h;do sshpass -p $pass ssh -o $log -n $user@$h -p 4777 '/ip dhcp-server lease;:foreach i i...

tomislav91

You answered to everything except why you write things at random without even trying them.

Writing code without first researching and testing it can lead to errors and unexpected results. I hope I helped

tomislav91

Just some minor observations. Every new client will create two permanent mangle rule, that stay there even after reboot. So if you have many clients that comes and goes, it will be lots of rules :) Reset script clear counters on all mangle rules, not hust the Bandwidth counter rules. May be fixed b...

tomislav91

is there anyone ? please help . It seems that the issue is that the $billmsg variable is being overwritten in each iteration of the loop, resulting in all PPP secrets having the same comment. To fix this, you can modify the $billmsg variable by including the value of $item to create a unique value ...

tomislav91

it requires manually entering the desired interface name into the code Since no one has provided "where" to read the interface name (or hostname), how do you think the script should be provided which interface (or host) information it wants to have? you can use the […] command to get an a...

tomislav91

While the code provided by @rextended may work for the task, it does not provide a scalable solution as it requires manually entering the desired interface name into the code. A better approach is to use a loop to iterate through each interface and store the interface name and hostname in an array. ...

tomislav91

:global newIP 1.1.1.1 :foreach i in=[/ip firewall nat find comment=TEST] do={ /ip firewall nat set $i to-addresses=$newIP } I am having setup that some mikrotik routers get IP of another router and use it with some firewall rules, but problem is where IP has changed and i must mannualy go to every ...

tomislav91

To optimize this script, you can use an array of DoH servers and a loop to check them one by one. Instead of hardcoding the URLs, you can store them in an array and then use a loop to iterate through the array, checking each one until you find an available server. This will make the script more modu...

tomislav91

Here are a few suggestions on what you can try to troubleshoot the issue: Double-check the BGP configurations on all devices involved in the session to ensure that they match and that all necessary settings are configured correctly. This includes the autonomous system number, local and remote addres...

tomislav91

One way to do this is to edit the /etc/network/interfaces file on the CHR image and set the MTU value to 1442 for each interface that needs to have the MTU set to 1442. This file is usually where the network configuration is defined for a Debian-based system. Alternatively, you can also set the MTU ...

tomislav91

It sounds like you are experiencing a bottleneck with your current setup. Adding more virtual CPUs (vCPUs) to your Mikrotik VM may not be the solution, as it appears to be causing network issues. One possible solution to reduce CPU load is to increase the amount of RAM allocated to the VM. This will...

tomislav91

Network Diagram https://drive.google.com/file/d/1cqJSt3t6tr3Uu2kjCTp97hAo68xMDvnX/view?usp=sharing I hope the image goes through. tinypic is no more, and it wouldn't load as an attachment to this post. Export # jan/12/2023 10:15:27 by RouterOS 7.5 # software id = HJND-FS5T # # model = CCR2004-1G-12...

tomislav91

You can configure Mikrotik RouterOS to log all login attempts by modifying the system logging settings. Here are the steps: Log in to the Mikrotik router using the Winbox interface. Go to the "System" menu and select "Logging" In the "Rules" section, click the "+&q...

tomislav91

It seems that the packets are being repeatedly sent without being acknowledged by the server, which is preventing the link from being established. Here are a few things you can try to troubleshoot this issue: Check the server settings to make sure that the server is configured to accept connections ...

tomislav91

Hi, I have heard from other source that RouterOS 7.6 OVPN Client supports UDP, TLS and Compression. But when I try to connect to my Synology NAS OpenVPN Server, it shows "TLS failed". Any idea? Thanks. Here is my setting Synology: see attached. RouterOS 7.6: /interface ovpn-client add aut...

tomislav91

maybe something like this :local running true :do { /interface ethernet monitor numbers=ether5 :local torchResult [/tool torch duration=0s icmp-query dst-address=10.1.1.1] :foreach line in=$torchResult do={ :local fields [:toarray $line] :if ($fields->1 = "ICMP") do={ :log info message=&qu...

tomislav91

Transparent proxy for HTTPS (port 443) is not possible - not in TLS v1.3 and higher (because SNI is already encrypted). Transparent proxy with port redirection in general is connection hijacking: client thinks it's talking to end server, in reality it talks to proxy server. Which is fine until clie...

tomislav91

Yes, it is possible to use the SQUID proxy running on a VM as a proxy for all connections that pass through the Mikrotik router before reaching the internet. One way to do this is by configuring the Mikrotik router to forward all incoming traffic to the SQUID proxy server. This is typically done by...

tomislav91

It sounds like you want to redistribute the IP networks that are announced under Router-2's BGP into Router-1's BGP, and vice versa. One way to accomplish this is to configure a routing protocol, such as OSPF or BGP, between the two routers, and then redistribute the BGP routes into the OSPF or BGP ...

tomislav91

Hi there, Recently I need to change the tunnel IP on a remote linux that is connected to my local CHR Routers via IPIP tunnel, as unfortunately my local ip will change every week. I was hoping to use script to ssh login to the remote linux. I wrote the script and could run it from a terminal, but c...

tomislav91

i have more than 400 netwatch host and i want to edit interval to default i use this command // set 1 timeout=3s but still interval value not change to default If you are trying to change the interval of multiple netwatch hosts on a MikroTik RouterOS device, you can use the following command to set...

tomislav91

Hi there General question, I have a VM that is running SQUID as a proxy. This works perfect when I update any computer to use the Proxy server directly. This works for HTTP and HTTPS I have one Mikrotik router that connects to the internet on eth1. Question, is it possible to use the SQUID proxy as...

tomislav91

# dec/19/2022 11:31:07 by RouterOS 6.49.7 /interface bridge add admin-mac=CC:2D:E0:17:22:64 auto-mac=no comment=\ "created from master port" name=bridge1 protocol-mode=none /interface ethernet set [ find default-name=ether5 ] mac-address=CC:2D:E0:17:22:63 name=\ ether1 speed=100Mbps set [...

tomislav91

the only thing i do is this /ip firewall nat add action=dst-nat chain=dstnat src-address-list=allowlist comment=WEB dst-address=192.168.1.163 dst-port=\ 80 in-interface=ether5 protocol=tcp to-addresses=192.168.111.155 \ to-ports=80 and allowlist is IP ddns filled with public IP from where packet com...

tomislav91

I am having one dst nat and source address list in that rule and i notice that in some random time i dont have access thorugh some of IPs from allow list. Allow list is some ddns names and ip is dinamicly learned. And its in there. I tried without list and everything is ok, but when i activate list,...

tomislav91

how to forward traffic from lan to public ip of that server?

source 10.10.10.0/24
destination 10.11.110.200/32

but i want to DNAT when connection want to go via LAN to forward to destination WAN?

source 10.10.10.0/24
destination 1.1.1.1 - server side WAN IP (there i dnat already)

tomislav91

Hello, i am utting from my ansible some mikrotik command and I need to put this command into one line router v6 :global c3 "PC4SEARCH" :foreach i in=[/ip dhcp-server lease find where host-name~$c3] do={:put ([/ip dhcp-server lease get $i address])} i tried like this, but didn't work {{ :lo...

tomislav91

Is it possible to put result to file?

I tried with one single line

{{ :local c3 "PC4SEARCH"; :foreach i in=[/ip dhcp-server lease find where host-name~$c3] do={:put ([/ip dhcp-server lease get $i address])} }} file=test.txt

but command don't work.

tomislav91

Thanks a lot!!!!

tomislav91

RouterOS ver 7 or higher :global c3 "PC4SEARCH" :foreach i in=[/ip/dhcp-server/lease/find where comment~$c3] do={:put ([/ip/dhcp-server/lease/get $i address])} RouterOS ver 6 :global c3 "PC4SEARCH" :foreach i in=[/ip dhcp-server lease find where comment~$c3] do={:put ([/ip dhcp-...

tomislav91

so you all consider that this netwatch will do the job /ip fire conn :foreach idc in=[find where timeout>60] do={ remove [find where .id=$idc] } 2022-09-27 14_04_48-Window.png 2022-09-27 14_05_01-Window.png It's also duable to do with previous IP but not see for my setup more effective than this one...

tomislav91

which script is more usable of those two? It depends on the use case: if the second WAN is used solely as a backup and there is no further backup, there is no point in tracking availability of the second WAN because there's nothing you can do when it becomes unavailable. if you have some traffic th...

tomislav91

@tomislav91, @anav has turned my attention (via another channel) to this post by @rextended - in another words, I was wrong and :remove [find] is not reliable. But it is also not sufficient to use just :foreach x in=[find ...] do={:remove $x} - the remove must use another find because removing an e...

tomislav91

What would be the purpose of the other DNS inquiry 1.1.1.1 ? The script does not refer to it and I don't see it being used and can probably be removed. Also, if the idea was to be better than check-gateway (checks every 10 seconds), why not change netwatch to every 5 seconds vice 30 ????. /ip route...

tomislav91

I understand that, but which IP to use in netwatch? You said Since you have defined a route to 9.9.9.9 to test ISP1, netwatch must test 9.9.9.9. Thanks, whole setup is /ip route add dst-address=0.0.0.0/0 gateway=192.168.0.1 comment"ISP_1" add dst-address=9.9.9.9 gateway=192.168.0.1 add ds...

tomislav91

Which address should I use for this? I am not sure what is reachable only through that wan? When routing a packet using a routing table, among all active routes whose dst-address matches the destination address of the packet, the one with the longest dst-address prefix is chosen. So although a rout...

tomislav91

FortiGate != "anyother"

sorry i didnt mean for exclusive leaders firewall devices like tenda, zyxel, dlink and tplink

My mistake

tomislav91

Clone Reverse are not some thing you need to do to make the firewall work. It would be interesting and see you fortigate firewall if you have done that for all your rules??? Its just like anav writes, an option for you to save some click if you need a revers rule to be created. Reading the manual d...

tomislav91

No your logic is flawed. A rule is one way on purpose! If I allow the admin on one vlan, access to a shared printer on another vlan, that means I am allowing traffic ORIGINATING from the admin to access the printer, as desired. I DO NOT WANT the printer being able to originate and reach the admin a...

tomislav91

netwatch script, is it better to ping google dns or some dns used in ip-route (9.9.9.9 and 1.1.1.1)? The very essence of the method of detecting WAN availability (transparency through the ISP all the way to the internet) is that you let netwatch ping an address that is only reachable through the WA...

tomislav91

it need to automaticlly change when ISP is down. That's what your netwatch will take care about. So...Is this final thoughs: Set IP-DNS to for example 8.8.8.8 and 8.8.4.4 IP address for WAN1 is 192.168.0.1 IP address for WAN2 is 192.168.1.1 add dst-address=0.0.0.0/0 gateway=192.168.0.1 add dst-addr...

tomislav91

like anyother firewall has. I just check some toys from tenda, zyxel, dlink and tplink, no one have that option... " anyother " for me, at this point, not exist . I do not remember that option on Cisco... In all these years that I have been working, it has never helped me to copy "th...

tomislav91

add this to down script to remove connection tracking / ip firewall connection {:foreach r in=[find] do={remove $r}} You don't need the foreach, the remove can work with a list directly: /ip firewall connection remove [find] and use this kind of ip-route which anav propose If you are going to disab...

tomislav91

masquerade causes the auto-destruction of connections if their reply-dst-address disappears, but it has no relationship to the speed of detection. It can only speed up the removal of connections if combined with disabling and re-enabling the interface bearing the address. You can replace recursive ...

tomislav91

Should we add some connection tracking removing or something? Is there anykind of way to change routes manually faster than disabling in the routes? One thing is how fast you detect that a route needs to be disabled, another thing is how fast you actually disable it. With the recursive routing appr...

tomislav91

This is not the correct way to make requests. But what exactly are you talking about anyway? like anyother firewall has. If i make rules in both directions, ussualy i will copy rule and change source/destination IP, but it'll be better to have copy reversed to reverse source and destination IP. not...

tomislav91

so better idea is to use for example 1.0.0.1 and 9.9.9.9 for checking in IP-DNS and for IP-DNS 8.8.4.4 and 8.8.8.8? From your post /ip route add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12 add distance=2 dst-address=1.0.0.1/32 gateway=192.168.1.1 scop...

tomislav91

dont remember why though. Because if you use x.x.x.x as the "canary" address (to monitor the transparency of a articular WAN), it is only reachable through that WAN. So strictly speaking you can use the canary address also as DNS servers but not as the only one. so If i use DNS for IP-ROU...

tomislav91

I will change it, also I'll try solution for faster/better changing manually wan, if I have problems with that ISP (some pings goes around 200+) and i want to change it mannualy, i must disable rules in Ip-routes and thats only way. Can we maybe somehow make it more easily, for support team. Problem...

tomislav91

Okay, your failover is a bit confused, in the sense that there is no need to check the failover through a public DNS server site. The reason being, if the primary is down, then if the secondary has no access, regardless you have no internet. However, perhaps there is some logic to knowing ???? Plea...

tomislav91

there is no l2tp or any tunneling on those routers, pure LAN and WAN usage. That was just an example of long-term UDP connections that need to be treated specially to properly migrate to the backup WAN. A continuous ping is yet another example of the same - if you run a continuous ping from the LAN...

tomislav91

there is no l2tp or any tunneling on those routers, pure LAN and WAN usage. WAN_B is only for backup, its usually copper isp provider, and WAN A is fiber. So my direct problem is, first there is a about 60 packets, when i ping from dude to that site, before internet gets back, but it is a situation ...

tomislav91

buy FortiGate instead

tomislav91

what happend when you just plug out cable from isp modem? Then you will see gateway from MikroTik but there will be no internet access.
Check it, and let us with results. I have problems with my script for failover in that kind of cases.

tomislav91

when you finish please attach it

tomislav91

where to put your second script

This script deletes all static DHCP

?

tomislav91

It depends on what kind of WAN you have - unless you've got public addresses also in LAN and your own AS number, the only thing you can do is to speed up the failure detection using the method described by means of some scripts pinging the canary addresses more frequently than in those hardcoded 10...

tomislav91

Which scenarios are you using for dual wan failover? Through just routes, ibgp, or something else? Anykind of examples will be helpful :) I am trying to find replacment for this kind of failover /ip route add check-gateway=ping distance=1 gateway=8.8.8.8 add check-gateway=ping distance=2 gateway=8.8...

tomislav91

This is more request rather than a problem.
Please add copy reverse option when do some nats. That would be very helpful

tomislav91

You need to match on ICMP type and code. Search for " icmp-options ": https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter /ip firewall filter add action=accept chain=input disabled=yes dst-address=10.10.10.0/24 icmp-options=8 protocol=\ icmp src-address=!10.100.0.100 src-address-list...

tomislav91

Is there a working scopes for The Dude when ping is higher than 150ms to inform me?Not via email, just information in the screen.

tomislav91

i have this /ip firewall filter add action=drop chain=input disabled=yes dst-address=10.10.10.0/24 protocol=\ icmp src-address=!10.100.0.100 src-address-list=BlockLAN add action=drop chain=forward disabled=yes dst-address=!10.100.0.100 \ dst-address-list=BlockLAN protocol=icmp src-address=10.10.10.0...

tomislav91

i want to add some preroute drop rule for src address list which contains all public ip collected from my honeypot ssh server.
Is this a good idea or is there a better way to block it?
honeypot ssh is on public ip (where are also the most of servers, same subnet)

tomislav91

This will add one by one IP to the address list "Blocking" { :local c3 "PC4SHOPS" :local IP :foreach i in=[/ip dhcp-server lease find where host-name="$c3"] do={ :set $IP ([/ip dhcp-server lease get $i address]) /ip firewall address-list add list="Blocking" a...

tomislav91

Its how local variable work. Global variable are "permanent" and works everywhere Local variable works fine in script, but if you cut an past it to a terminal session, you need to put it in brakets like this: { :local c3 "PC4SHOPS" :local IP :foreach i in=[/ip dhcp-server lease ...

tomislav91

Instead if put, use set to put it inn to a variable. :global c3 "PC4SEARCH" :local IP :foreach i in=[/ip dhcp-server lease find where comment="$c3"] do={:set $IPAddress ([/ip dhcp-server lease get $i address])} when i env print nothing showed, only c3 variable edit: this is how ...

tomislav91

RouterOS v7 understand v6 script so this works for both: :global c3 "PC4SEARCH" :foreach i in=[/ip dhcp-server lease find where comment="$c3"] do={:put ([/ip dhcp-server lease get $i address])} And recommend to change from ~$c3 that means contain (example it will hits on "P...

tomislav91

Thanks!

tomislav91

i want to get some IP from my commented lease IP. When i did like this, i get all those INFO, but how to get from this only IP [admin@site1] > :global c3 "PC4SEARCH" [admin@site1] >/ip dhcp-server lease print where comment=$c3; Flags: X - disabled, R - radius, D - dynamic, B - blocked # AD...

tomislav91

Yes those ports have to be open for the initial VPN connection of the tunnel as per the config. There is nothing wrong with this behaviour. The only thing you could do is limit access by source address if that was possible which may make them appear closed or invisible (which is the case for ports ...

tomislav91

You would be far better off going back to the default firewall rules and then adding what is only necessary from there............ Such as any legitimate VPN rules on the input chain to allow initial connection of the tunnel add action=accept chain=input "allow vpn connection" dst-ports=X...

tomislav91

Reading as I go along You have bridge and one vlan = 2 dhcp type interfaces But you have 3 pools?? Your interface list only contains WAN ??? Now I see you have 2 WANS, ether1 ether5 - which is what VLAN1 runs on. Okay so you have another subnet not identified for the hotspot 10.5.50.0/24, No dhpc n...

tomislav91

Please post config if you want assistance....... /export hide-sensitive file=anynameyouwish # dec/02/2021 20:25:24 by RouterOS 6.49.1 # software id = YTJ3-10KN # # model = 951Ui-2HnD # serial number = 80F1088227E6 /interface bridge add admin-mac=CC:2D:E0:07:87:93 auto-mac=no comment=\ "created...

tomislav91

Is your WAN interface in your WAN Interface list?

yeah, ofcourse, also didnt work with single interface

r325.png

tomislav91

this rule is on top, but ports are opened. (action is DROP)
Why?

qq.png

235.png

tomislav91

MicrosoftTeams-image.png

after upgrading.
anyone has this problem?

tomislav91

the rules are on top, there is no need for exporting, you see all in this post, your code that you wrote to me, doens fill out address list when i try to ping from PC (which is on mikrotik network)

tomislav91

when i ping some server from pc where those rules are implemented nothing happend.
Something is wrong about this adding to new address list

test.png

tomislav91

yeah but that is whats pinged in general, but i want what is pinged from my BlockLAN address lists, not all in general

tomislav91

I have this little script to push into locations :global MySubnet [:put [/ip firewall nat get [find where dst-address="192.168.0.0/16"] src-address]]' ip firewall address-list add address=192.168.0.0/16 list=BlockLAN' ip firewall address-list add address=10.100.0.0/16 list=BlockLAN' ip fir...

tomislav91

maybe something like this /ip cloud set ddns-enabled=yes /interface list add name=WAN /interface list member add interface=ISP-eth1 list=WAN add interface=ISP2-eth2 list=WAN /ip firewall address-list add address=TRUSTED_REMOTE_NETWORK list=Trusted /ip firewall nat add action=dst-nat chain=dstnat ds...

tomislav91

Check the UTP cable ...

i am aware of that, just posting cause is it possible to have this type of problem and be something else

tomislav91

Hello, i have a FreePBX (asterisk) system as my pbx. It is connected to my Mikrotik. PBX: 10.0.0.210 Mikrotik: 10.0.0.1/24 I have two Mikrotik i have setup server l2tp VPN and client VPN. Server Mikrotik VPN Adr local: 10.100.0.1 Client mikrotik VPN Remote Address: 10.100.0.2 Inside my internal lan...

tomislav91

maybe something like this /ip cloud set ddns-enabled=yes /interface list add name=WAN /interface list member add interface=ISP-eth1 list=WAN add interface=ISP2-eth2 list=WAN /ip firewall address-list add address=TRUSTED_REMOTE_NETWORK list=Trusted /ip firewall nat add action=dst-nat chain=dstnat dst...

tomislav91

qwer.png

qw.png

kr.png

can be something else with ether goes up and down ?
I assume its connected to switch which is powered on constantly.

tomislav91

if you work with bridge interfaces, that you must enable ip firewall on the bridge itself

testt.png

so, command like this

/interface bridge filter add chain=forward mac-protocol=ip ip-protocol=tcp dst-address=yourIP/32 dst-port=3389 action=drop

tomislav91

we have set on asr router cisco xr bgp: bfd fast-detect bfd multiplier 5 bfd minimum-interval 300 bfd: interface gi1/1 echo disable rx-interval 2000000 and on mikrotik test.png and of course bfd is checked on peer. When i enable bfd on peer, bgp goes to open sent state and wont go up.

tomislav91

what happend with ddns? Does anyone have information. MikroTik????

tomislav91

Can not be defined on device property, add more tools / WinBox Function for each port required call it WinBox, WinBox 48291, etc. Original: winbox.exe [Device.FirstAddress] [Device.UserName] [Device.Password] Modified for use port 48291: winbox.exe [Device.FirstAddress]:48291 [Device.UserName] [Dev...

tomislav91

On post # 4 I have already provided the instruction for do that, read and understand: https://forum.mikrotik.com/viewtopic.php?f=8&t=177166#p869620 yes yes understand for changing user and pass, tny what about port? If I change to some different instead of default? How can i change it in dude w...

tomislav91

Your reply is vague... Again: You want change inside The Dude the saved username and/or password on displayed Devices OR you want change username and/or password on the remote devices displayed on The Dude? 2021-07-29 00_03_19-Window.png when i click tools-winbox to open me with new credentials... ...

tomislav91

i disabled admin user on my routers and wanted to somehow change it automation on dude, instead of change all 500+ devices manualy, but it seems dude dont have that kind of option

tomislav91

What devices do you mean? MikroTik routers?

Yes

tomislav91

is it possible to change all password or username of all devices somehow or must be manual?

tomislav91

Such cases are quite common when an internet provider sends emails stating that your IP is open to a dns resolver. Without seeing you firewall configuration, let's say you use the default config. Close access to dns 53 port from the outside. It is best to use Raw chain so as not to overload the cpu...

tomislav91

We got an email that: "You appear to be running an open recursive resolver at IP address x.x.x.157 that participated in an attack against a customer of ours, generating large UDP responses to spoofed queries, with those responses becoming fragmented because of their size." How to prevent t...

tomislav91

problem is when GW is alive from another ISP but there is no access to internet (provider problem), and when my 1 uplink disconnect, second also not working, but in my routing table it is shows me like reachable (it is , but only gateway). And in the dude i wonder why its red :D I'm not sure I get ...

tomislav91

So i am having two ISPs and having this as a failover /ip route add check-gateway=ping distance=1 gateway=8.8.8.8 add check-gateway=ping distance=2 gateway=8.8.4.4 add distance=2 dst-address=8.8.4.4/32 gateway=192.168.2.1 scope=10 add distance=1 dst-address=8.8.8.8/32 gateway=192.168.1.1 scope=10 An...

tomislav91

:local NAT4Remove [/ip firewall nat get number=[find where dst-address-list=MyList]] ??? why that ??? simply: /ip firewall nat remove [find where dst-address-list="MyList"] i was driving in another directions. Thanks, thats it

tomislav91

I am having a strugle with removing some rules from NAT, where i have rules with some named address list inside rule, like add action=dst-nat chain=dstnat dst-address-list=MyList protocol=tcp \ to-addresses=1.2.3.4 to-ports=4444 I want to use script to remove all rules which have dst-addresss MyList...

tomislav91

isnt tls 1.3 adopted in quic as part of crypto part? handling flow control,crypto, http part as well?

tomislav91

I am using this

/ip firewall filter
add chain=forward dst-port=443 protocol=tcp tls-host=*youtube* action=reject src-address=10.10.10.0/24 place-before 0l

but users can open youtube. Where is mistake?

tomislav91

You are missing quotes. Try
Code: Select all
:put [/ip firewall nat find where dst-address="192.168.0.0/16"]
So this should give what you looking for:
Code: Select all
:put [/ip firewall nat get [find where dst-address="192.168.0.0/16"] src-address] 

thats it, thanks!

tomislav91

Do you get any output from running this form command prompt
Code: Select all
:put [/ip firewall nat find where dst-address=192.168.0.0/16]

nope

tomislav91

:local LocalSubnet [:pick [/ip firewall nat find where dst-add ress=192.168.0.0/16] src-address]]; idea is to use local subnet for further scripting and i have one rule in nat and i want to exclude from that, so src subnets are different but that dst subnet are the same allways, so i want to get th...

tomislav91

Sites blocking is never going to work. At some point user will start using VPN provider and there is no way to block it (e.g. NordVPN can use 443 over TCP as well as obfuscated traffic). we are speaking about users inside company, for sure they will not use vpns. i just wanted to use outlook web, n...

tomislav91

i have two rules add action=accept chain=forward dst-address-list=\ AllowedSites dst-port=80,443 protocol=tcp \ src-address=192.168.50.181 add action=drop chain=forward dst-address=0.0.0.0/0 \ src-address=192.168.50.181 and in AllowedSites list is a list of IPs for outlook from their website https:/...

tomislav91

Should i put parent queue if i enable only one client or i can only put it in lower ID?
So if i have 192.168.5.0/24 and client 192.168.5.22, my q is is it neccesary to put in advanced tab Parent queue?

tomislav91

I am having several end devices and i want to get some range of pool of somesubnet, i will create seperate pool, but how to force that those mac adresses use that pool? I am aware that only first 3 octet in MAC define device, but i will script it somehow, but cant figure out how to force dhcp pool w...

tomislav91

Does this affect some Stellaris microcontrollers, because i am having some issue with communication? Maybe some have information?

tomislav91

Trusted checkbox appears twice in Bridge -> Ports -> <interface> -> General

What that use for?

tomislav91

I'm afraid it's the in-state-sequence-errors value - it doesn't sound related, but apparently there is no separate counter for packets encrypted using a wrong key. So whenever this counter increases, there is at least one "miskeyed" SA. Go to command line of the pfsense and try ip xfrm st...

tomislav91

This is what i use /system script add dont-require-permissions=no name=firmware-updater owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\ \r\ \n\r\ \n\r\ \n# Script name: firmware-updater\r\ \n\r\ \n########## Set variables\r\ \n\r\ \n\r\ \n## Backu...

tomislav91

msatter understood your question and pointed you in the right direction. The linked post contains all you need to know to create a failover solution. Next time, don't quite entire posts especially if it's the most recent post you are replying to.. thanks :) I understand what you say friend, but the...

tomislav91

Very limited info you provide, but if my understanding is correct, then there is a problem with your logic. i.e. you ping 8.8.8.8 from ether 2, if no response, you disable interface, with this interface disabled, you will not be able to ping from it. If reasons for doing this is dual WAN purposes, ...

tomislav91

Greetings friends: I have the following script that disables an interface of my RB when it pings google DNS and they do not respond, I need that same interface to be enabled when google DNS respond to ping, someone can help me. I leave the script that I have. :if ( [/ping 8.8.8.8 interface= "E...

tomislav91

What are those scripts that really help in some various problems you had? We have a topic useful scripts but that topic goes off road.
So just post scripts and tell what did or do use for.

tomislav91

do you add allow ip in /ip services?

tomislav91

Do you have some propose of which book to buy. Not for completely beginers. I found this https://www.amazon.com/Theory-laboratories-exercises-Mikrotik-RouterOS/dp/1686046960 https://www.amazon.com/Networking-MikroTik-MTCNA-Study-Guide/dp/1973206358/ref=pd_sbs_14_2/139-7552241-6977159?_encoding=UTF8&...

tomislav91

None of those firewall rules blocks IPsec as such, nor do they block traffic to/from the subnets reachable via IPsec (unless you've added them to the shodan or pingers or @Services_Phase3 address lists). In fact, the firewall rules block almost nothing. In the printout of the security associations,...

tomislav91

That's magic. First, the IPsec control packets and transport packets are handled by chains input and output. Payload packets from/to external devices, which get extracted from IPsec transport packets, and which are going to be encapsulated into IPsec transport packets, are handled by chain forward....

tomislav91

I migrate ether1 to ether5 and ether2 to ether6 and now seems ok. I will be waiting to Monday to check all, but it seems ok for now. Thanks sindy. Can we somehow improve firewall rules? # nov/02/2020 13:32:24 by RouterOS 6.47.4 add action=fasttrack-connection chain=forward connection-mark=!ipsec \ c...

tomislav91

just for info, how you get 410 or 160mbit/s if total traffic is inclued? What you summarize here? ( in first case of 410Mbit i cant get that if i summarize ether1+ether2 tx and rx bits /s) Assuming that the own traffic of the router (sent by the router itself or received by the router itself) is ne...

tomislav91

I don't get why you are so fond of images where text is much more useful for post-processing. So roughly, when the DVR/monitor wall receiving the streams from the cameras is reachable (when the external switch is connected to ether3), the machine routes about 410 Mbit/s of traffic (and decrypts a g...

tomislav91

That's magic. First, the IPsec control packets and transport packets are handled by chains input and output. Payload packets from/to external devices, which get extracted from IPsec transport packets, and which are going to be encapsulated into IPsec transport packets, are handled by chain forward....

tomislav91

That's magic. First, the IPsec control packets and transport packets are handled by chains input and output. Payload packets from/to external devices, which get extracted from IPsec transport packets, and which are going to be encapsulated into IPsec transport packets, are handled by chain forward....

tomislav91

So the additional CPU spent on IPsec encryption and decryption per packet does not explain the non-linear growth of the CPU load as the video traffic is added to the mix. At this moment I've got no further ideas. The product page provides no information regarding IPsec throughput of your CCR1009-8G...

tomislav91

Is the other (non-video) traffic coming IPsec-encrypted as well? they are just in terms of ipsec watching cameras. Any other job is standard job as in any office. Sorry, I understand every single word but not the answer as a whole. So again - does any other traffic except the one from cameras need ...

tomislav91

I don't get why you are so fond of images where text is much more useful for post-processing. So roughly, when the DVR/monitor wall receiving the streams from the cameras is reachable (when the external switch is connected to ether3), the machine routes about 410 Mbit/s of traffic (and decrypts a g...

tomislav91

Looking at the file, those about 250 Mbit/s sent out via ether3 are sent as 21000 packets/s in 1500-byte packets, hence I assume the cameras send the video using TCP. The ACK traffic in the opposite direction takes some 9000 packets/s in 64-byte frames (which is fine, TCP doesn't necessarily acknow...

tomislav91

no, that bridge is for video surveillance center. So there is no much l2 traffic in the bridge there. Funny thing is that when i disable that bridge or just pull out cables, cpu level is OK, about 10-20%. As you've mentioned video surveillance, two things come to my mind - the cameras may be sendin...

tomislav91

You may misunderstand that tx and rx. In the list of interfaces, the bridge is an interface through which the router (L3) part of the software sends data to external devices connected to the physical ports included into the bridge, which is the download direction for those devices. Or in generic ca...

tomislav91

can you explain, in the bridge i can see that Tx (transmit=upload) is 246Mb and in queue for that subnet Download is 233Mbps. Like is vice versa? Or I missunderstand that tx and rx? Also when try to speedtest from that 192.168.90.0 subnet upload is 0 (all switches changed) 2020-11-15 15_46_43-Window...

tomislav91

i changed switches, but no signifcally changes

2020-11-13 22_34_55-Window.png

tomislav91

Officially, the 192.168.90.1/24 should be attached to bridgeVN rather than ether3_HQCAM . Practically I have never seen this wrong setup to cause any issues, and even the ROS upgrade script migrating configurations from old "master port" to current "bridge with hardware acceleration&...

tomislav91

Then why doesn't the picture match the configuration? 192.168.90.0/24 is attached to ether3_HQCAM in that configuration; the bridge exists there but has no member ports and no IP configuration is attached to it. Are you constantly updating the configuration? Yeah, i am seeing that now in the my pos...

tomislav91

Not knowing what linux distribution pfSense is based on, nor which IPsec implementation it uses (openswan, strongswan, something else), I cannot give you a more targeted suggestion. Did you issue that command as a linux user with root privileges, or is there some restricted command line of the pfSe...

tomislav91

Are we still talking about the machine where the IPsec tunnels are running? I'm asking because in its configuration export, I've found just an empty bridge with no ports at all. It is theoretically possible that there is so much traffic towards the devices connected to the switches with only 100 Mb...

tomislav91

Što si htio da rekneš ovom rječenicom: "I notice that one bridge when disable cpu goes regular about 10%."? i have one bridge with ports and 200Mb+ bandwidth within. when i disable it, cpu % is ok, there is no loop in network, log also dont write anything. can be problem within 100mb swit...

tomislav91

I am getting cpu about 70%.
I notice that one bridge when disable cpu goes regular about 10%.

2020-11-06 14_28_09-Window.png

is it possibly because link is more than 100mb and pc are only 100mb and thats what suffocate a router cpu?

tomislav91

but fasttrack connection for that is disabled, should i enable that also? No, don't enable the fasttrack connection. The steps need to be taken one by one to see where is the issue. So first you enable only the additional mangle rules and the additional rules in input in filter. If that works, we c...

tomislav91

With. They are in forward, aren't they? yes, they are add action=mark-connection chain=prerouting connection-mark=no-mark dst-port=53 \ layer7-protocol=*4 new-connection-mark=block_connection passthrough=yes \ protocol=udp add action=mark-packet chain=prerouting connection-mark=block_connection \ n...

tomislav91

That's magic. First, the IPsec control packets and transport packets are handled by chains input and output. Payload packets from/to external devices, which get extracted from IPsec transport packets, and which are going to be encapsulated into IPsec transport packets, are handled by chain forward....

tomislav91

OK, and with these three mangle rules enabled, everything works fine? What about the difference in CPU load when the "accept connection-state=!new" is enabled and when it is disabled, is there any? no no, it wasnt fine. I added this with /ip firewall filter add action=fasttrack-connection...

tomislav91

I'm afraid it's the in-state-sequence-errors value - it doesn't sound related, but apparently there is no separate counter for packets encrypted using a wrong key. So whenever this counter increases, there is at least one "miskeyed" SA. Go to command line of the pfsense and try ip xfrm st...

tomislav91

Without the actual encryption and authentication keys in use, it is not sufficient, as you can only confirm that it is a rekey issue by comparing the keys at both ends for same SPIs. Can you show me you /ip ipsec statistics print ? There is a counter which grows with each packet coming through the ...

tomislav91

i cant enable JUST those three in mangle, because here i mangle some subnet and force it to another ISP in routes and also using for VOIP, so i cant disable it. I had in mind "out of the rules added by my recommendation, enable only the three added to mangle, not the drop ones in filter"....

tomislav91

Let's keep the threads (firewall and IPsec) separate. Here, try to enable only the three mangle rules you've added, but keep those drop ones, which you've eventually added since the point in time when it was working, disabled, and tell me how it works. i cant enable JUST those three in mangle, beca...

tomislav91

In the past, there was an issue in IKEv2 rekey between two Mikrotiks, where in a few percent of rekeys the peers ended up with different keys for the same SA, hence the receiver was rejecting the packets. This particular issue has been fixed somewhere in late 6.43 version. You have one policy per e...

tomislav91

i added that firewall mangle rule before those ipsec. I got aproblem that tunnels goes down, msg1 sent error and i must disable all that i newly created and restart peer and than tunnels go up. I can't get how a rule in forward chain of mangle should break IPsec transport and control traffic which ...

tomislav91

i tried to make like this :set time [/system clock get time] :local file [/ip ipsec installed-sa print] <--- this fills a (string) variable called file with the output of the print command :local contents [/file get $file contents] <--- this tries to extract the contents of a file whose name is the...

tomislav91

is this better? i missread the ipsec in and out in forward. first i add mangle to capture ipsec, router is now at 25,30% Yes, this is yet another way how to do that. With this setup, a packet transported using IPsec is inspected by 1.5 mangle rule on average (those matching on ipsec-policy=out,ipse...

tomislav91

I prefer to let my router perform routing functionality. Assuming you only use Ubiquiti as accesspoint(s), I would use queues. As you mention subnets...are you using VLAN's (already)? yeah, i am using vlan for guest wifi and private. So i just remove user groups and put unlimited to all networks an...

tomislav91

but then i got problem then with dude just "getting stuff" but nothing happend than, and when disable fasttrackk it came and everything is ok. I have explained this in the previous post, which you've quoted as a whole (no idea why you do that) but apparently haven't read or understood it....

tomislav91

So you think this is the best rules to put it on top There is no such thing as "the top of filter". There is the top of chain input in filter, and there is the top of chain forward in filter. Packets always only go through one of these rule chains, not both. So the default firewall of the...

tomislav91

my q was, does it something thats a MUST HAVE this input chain rules to have most of the benefits of the firewall. Is there some updated firewall rules for preventing intrusions?Maybe someone to share their firewall without sensitive data ofc Short answer: yes, it is a must have. Long answer: Fastt...

tomislav91

i have limit on wireless networks on my unify controler. Is it better to put it unlimited and then queue that subnet on mikrotik?

tomislav91

First two rules are for input chain, the 3rd, fasttrack is for forward chain and has nothing to do with first 2 rules. Also not sure I understand your question? my q was, does it something thats a MUST HAVE this input chain rules to have most of the benefits of the firewall. Is there some updated f...

tomislav91

/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=fasttrack-connection chain=for...

tomislav91

how is your cpu handle with this rules at the top /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=...

tomislav91

Hi All, OK not really a script, but I thought it may be in the same flavour. I created this Dynamic Blacklist firewall rule set that counts excessive connection attempts from the same IP within a given time frame and eventually blocks them for X number of days. I was initially going to put in a geo...

tomislav91

hi guys, i am just wondering how to stress out one isp from another (some kind of load balancing). If router has 3 LAN interfaces, just maybe to test if second ISP is avaliable catch all IPs from one ether and than i will mangle that address list to another ISP. Any idea from where to start, i thoug...

tomislav91

ping over200 dude.jpg

I wanted to get an info message when there is a ping more than 250ms on isp to know and change to another ISP mannualy.
Why this dont work? I didnt get any notification....

tomislav91

Hello tomislav91 What do you mean by "created your own Traffic Monitor items for inbound / outbound, high / normal)"? What did you label/name the traffic monitor items in your example? Can you at least provide an example with screenshots? Thanks a lot. Regards, M Thats it? 2020-10-21 13_4...

tomislav91

Most likely you are trying to get more than 4096 bytes into a variable: :local contents [/file get $file contents] https://forum.mikrotik.com/viewtopic.php?t=127093 It is limit not to file - it is limit for variable size... If you write text variable to file - you can write maximum 4096 bytes. But,...

Search found 316 matches