MikroTik

kai

@anav

Many thanks for the explanation. I have managed to sort out the issue and your post is well written.

kai

Hi there, You state you have a second wireguard interface on the main router for remote users. To me its not clear why you decided to create a second interface? Make it clear what you wish these mobile user to be able to do. a. reach and config router A main b. reach and config other Routers B,C,D ...

kai

Hi, I have the basics of Wireguard down quite well I think. Currently I have a main site which has multiple sites (mikrotik to mikrotik) conencting to it via wireguard via wireguard interface 1. Anyone connected to Main Site A directly on the LAN (e.g. 192.168.5.0/24) can connect through to the othe...

kai

SSH client seems a bit broken.
I use the mikrotik as a client to connect to something like a UniFi - it attempts a connection but it immediately quits. It doesn't get as far as asking for a login or password.

It works in 7.7

Edit: also works ok in 7.10rc1

kai

The more I delved into this, the more that I'm not entirely sure that it can actually be done. There just seemed too many strange ways (even in Mikrotik's world) of configuring things that I'd most likely forget even with documentation of it all. I ended up using CPU-software interconnects and gener...

kai

Thank you for the example. I'm anticipating this kind of setup: Ether 1: trunk link to managed switch Ether 2: trunk link to managed switch Ether 3: trunk link to managed switch Ether 4: trunk link to managed switch Ether 5 connected via patch to Ether 6 Ether 7: untagged VLAN 80 Ether 8: untagged V...

kai

Thank you very much for your reply. I just want to try out the way using short jumper cables... in the interest of learning actually. It's been said (by MT personnel) that it should be fine to have one bridge per switch chip and those bridges would then be HW offloaded. I don't have any device havin...

kai

Hi, Looking at the block diagram for the RB1100AHx4: https://i.mt.lv/cdn/product_files/RB1100AHx4v5_180118.png I can see that Ether 1-5 and Ether6-10 and Ether 11-13 are on their own switch chips respectively. After noting that: Bridge HW vlan-filtering was added in the RouterOS 7.1rc1 (for RTL8367)...

kai

Hi, Something has changed from ROS6 to ROS7, when importing a private key, there is no longer an option to specify a passphrase along with the private key file to be imported. If I try omit it, it will fail and state "Script Error: this command required user input" Is there any workaround ...

kai

Hi, I'm on 6.48.1 on a 1100AHx4, I've also tested on a rb750gr3 and it seems the same. I've noticed that if I set a queue to manage bandwidth, it adversely affects the Bandwidth Test tool. I have a 150 Down / 30 Up link and Bandwidth test seems to be able to measure the upload ok but download is rep...

kai

I'm on BT full fibre and also on the 152Mbps service. However, I'm not using a HAP AC2, I'm using a RB1100AHx4. My ONT is made by Nokia (G-010G-Q). I've had the service for a few months now and I've not noticed any random drops regularly. I think maybe it might've dropped out once in that time? Even...

kai

Try following this instead: https://forum.mikrotik.com/viewtopic.php?f=23&t=169273 Thank you for your reply. It was actually this guide that I based the whole start-from-scratch approach on. However, after a lot of reading today, I noticed a few things and it seems to be working well now. 1) Th...

kai

Hi, I'm trying to connect through to Windscribe VPN via Mikrotik using IKEv2 client. I've followed the guide from here: https://www.reddit.com/user/gromo3eka/comments/f5u2ny/mikrotik_ikev2_client_configuration_for_windscribe/ For whatever reason I believe that this works fine in 6.46.X but after goi...

kai

Just as a reply to myself and for anyone else who might find this useful:

It turns out that while it's not displayed in the raw value section, the variable $(CLIENT_MAC) does populate. You can see this if dhcp logging is turned on.

kai

Hi, I just need some clarification on something regarding the clientid option for DHCP client. I notice that by default it uses the value: '0x01$(CLIENT_MAC)' and I understand the the variable $(CLIENT_MAC) is supposed to correspond to the MAC address but the raw value only shows as '01'? It doesn't...

kai

I have a problem with a hAP ac^2 on 6.47. It won't update to 6.47.1 from either the check update option (which sees 6.47.1) nor by manually adding the firmware file from the website into files and trying to reboot. In both cases, the router comes back up as normal but for some reason wipes all DHCP ...

kai

It's instructions for setting up an IKEv2 client to a VPN service. It generates a dynamic NAT rule to route traffic for addresses in an address list. In 6.47+, it basically kills all routing for some reason. Link to post in the 6.47 release thread about the same problem: https://forum.mikrotik.com/v...

kai

I think this is broken in 6.47 (and also here still in 6.47.1). It works fine on 6.46.6. https://www.reddit.com/user/gromo3eka/comments/f5u2ny/mikrotik_ikev2_client_configuration_for_windscribe/ I did send some support files for 6.47 regarding this issue but I think it's still not fixed here. Can an...

kai

Simple way, on router #2, forward port to router #1 (assuming that 192.168.89.2 is address of router #1 reachable from router #2 via VPN): /ip firewall nat add action=dst-nat chain=dstnat dst-address=<public address of router #2> dst-port=1234 protocol=tcp to-addresses=192.168.89.2 to-ports=8291 Th...

kai

Ok I think that i more of what you are trying to do... You are in vpn using l2tp/ipsec to public MT. from your pc (connected to public ip MT) you are trying to winbox into lan ip of CGNAT lan ip. is this correct? I would like to have the complete exports (without passwords or public ip or any sensi...

kai

Ok, I am a little confused.. You are trying to open a winbox session from the lan side of your internet MT to your CGNAT lan ip and not able to? You may need to add /ip firewall nat add action=accept chain=srcnat dst-address=(Lan Network Internet MT) src-address=(Lan network CGNAT) Should be the fi...

kai

On your public mikrotik dont add a default route.. add a specific route like: /ip route add distance=10 dst-address=(lan network of cgnat network) gateway=(l2tp interface) Sorry, I meant the other way around, if I set 'add default route' to the L2TP client interface connection which is being sent o...

kai

can you ping from the lan ip on the public ip Mikrotik to the CGnat lan ip? post configs to see better Hi, I can ping the lan IP if I select to add a default route to the L2TP client interface (but this seems to break connection to the internet via the LTE interface). Here's the relevant config of ...

kai

Hi, Apologies if this seems quite trivial, I can't seem to implement this even if I seem to understand the concept behind it. I have a Mikrotik that is connected to and LTE network but it's behind CGNAT. I will need to get back access to the Mikrotik for future configuration, etc. I have another Mik...

kai

Supposing you already use a common bridge with vlan-filtering=yes for VLANs 10 and 100, just treat the EoIP tunnel the same way as if it was a regular Ethernet port you wanted to make an access one to VLAN 80. /interface bridge port remove [find interface=eoip1] remove [find interface=ether3] add b...

kai

https://i.imgur.com/2BXD7Dr.png Hi, I'm struggling a lot with something that I'm unsure if it's even possible to do.. I've managed to create an EoIP connection to a remote network and that is working fine (the Laptop in the diagram is connected as if it's part of the remote network, getting it's DH...

kai

So I followed the instructions from: https://wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS I found that while the tunnel gets created successfully, no traffic gets routed down the tunnel or through the designated WAN port either. In fact, you cannot use the internet at all until you ...

kai

I ve seen cases where more than 1 versions would never finish the installation process... Thats why i mostly choose previous versions until i find one that does the job... So closing and opening netinstall would not help... I've seen the problem where when you select to install and it flashes quick...

kai

Assuming that NetInstall is set up correctly - if the router show up on the list, you're 99% of the way there really. I've seen the problem where when you select to install and it flashes quickly that it's installing but doesn't actually do anything. The solution for me is that I just close NetInsta...

kai

OK :) In header field replace http-content-type:application/json with content-type:application/json Hahahah, nice catch! I've been trying this on yesterday's late night and I probably wasn't even looking anymore. Thanks a lot, it worked perfectly. Sorry to bring up a post from the dead.. but I can'...

kai

I'm having some issues with a particular router - the problem is that I cannot remotely connect to it via Winbox or SSH. out bound, within the network seems to be fine, but externally not. I've looked through the config over and over and I cannot seem to find the issue. Can someone else please take ...

kai

Hey I think doing it on MT directly will be very inefficient, performance & accuracy wise. Why don't you try: * opendns allows to block ads * proxy (other than MT) with ad blocking enabled * on client, ex Opera does it out of the box Thank you for your suggestions. Are you sure about openDNS? I...

kai

Hi all, I'm trying to implement some form of adblocking at router level for the whole network but I'm running into some issues. I have a Hex Lite (rb750gr3) Firstly, i tried setting up a big list of static DNS entries and blocking that way but that quickly went out of the window as you can't really ...

kai

You can use Netinstall, Branding or Flashfig to change the config that loads upon reset, yes. Is that really the case? I have used NetInstall to install a customised script and it successfully sets the device. However, if I initiate a user reset (hold the reset button until the USR LED flashes and ...

kai

If you have a managed switch, wouldn't it be possible to put the VMWare server on it's own VLAN and isolate it that way?

kai

Hi, Thanks for the replies. I understand that it's possible to reconfigure port 1 (which is WAN out of the box) to a different port. However, port 1 is the only port that accepts PoE. What I would like to know is without reconfiguration is it possible to use PoE and WAN at the same time? What equipm...

kai

Hi, I've just taken delivery of a Hex S. I was just thinking about powering it over PoE which also happens to be the WAN port. Now I don't know if this is a silly question early in the morning or what, but under what circumstances would it be possible to both power the device using PoE and using it ...

kai

Yes, is it possible to change default configuration. You need to use netinstall Configure Script feature. Hi, Thanks for this. I've now managed to actually do this and can install a pre-made configuration via netinstall. However, I have a different problem - I can actually reset the device (Hex Lit...

kai

Hi, New to the world of Mikrotik - I have a RB750gr3 with me and I wanted to know how (or if it's possible) to do a few things: Is it possible to replace the default configuration script - if so, how? Is it possible to configure the reset button to reset the device so that if pressed, it will restor...

Search found 39 matches

Re: Wireguard help required

Re: Wireguard help required

Wireguard help required

Re: v7.10 [stable] is released!

Re: RB1100AHx4 VLAN with HW offload with multiple switch chips

Re: RB1100AHx4 VLAN with HW offload with multiple switch chips

Re: RB1100AHx4 VLAN with HW offload with multiple switch chips

RB1100AHx4 VLAN with HW offload with multiple switch chips

Importing Private key via scripting (ROS6 vs ROS7)

Bandwidth Test adversely affected by queue

Re: PPPoE client drops with BT Full Fibre 100 [SOLVED]

Re: VPN IKEv2 Client Problem

VPN IKEv2 Client Problem

Re: DHCP Client client ID raw value?

DHCP Client client ID raw value?

Re: v6.47.1 [stable] is released!

Re: v6.47.1 [stable] is released!

Re: v6.47.1 [stable] is released!

Re: Getting around CGNAT with another Mikrotik Router

Re: Getting around CGNAT with another Mikrotik Router

Re: Getting around CGNAT with another Mikrotik Router

Re: Getting around CGNAT with another Mikrotik Router

Re: Getting around CGNAT with another Mikrotik Router

Getting around CGNAT with another Mikrotik Router

Re: VLAN over EoIP to non VLAN network?

VLAN over EoIP to non VLAN network?

Re: v6.47 [stable] is released!

Re: WinBox can't see RB750Gr3

Re: WinBox can't see RB750Gr3

Re: POST Request with fetch

Cannot open ports / access router externally

Re: Adblocking with address lists

Adblocking with address lists

Re: /system default-configuration

Re: Block specific IP to access LAN

Re: PoE WAN in?

PoE WAN in?

Re: Default configuration [SOLVED]

Default configuration [SOLVED]