MikroTik

shivansps

oh, i see. I didnt need to set the endpoint ip when i set the server peers. Thanks, this is working fine. I really like the results compared to L2TP/IPSEC on the RB951/RB941/RB931 routers.

shivansps

ive been testing diferent VPNs protocols on Routerboards based on QCA9533, i have a few RB941and RB931 around. Im not expecting to break any bandwidth records with these cpus that do not support hardware crypto. They connect to a RB750Gr3, and that one do support hardware crypto for L2TP/IPsec. L2TP...

shivansps

In a few months will be moving out to a new place and im going to build the network from zero, incluiding configuration so im going to do it properly this time. Thanks for your recomendations. As for my problem, this is silly, but i figured out what the problem was, it was not the router or switch, ...

shivansps

Ill be away for the week, so ill be doing the sniff when i get back, thanks for your reply. It appears you have 12 things connected to the switch. (from the yellow and green dots) next to the ports in the GUI. When you post the startup-config, can you also let us know what port(s) are connected to t...

shivansps

Please ignore the advice to avoid VLAN 1. The rationale behind that advice is that rumor has it that some equipment uses it in a special way. I'd love to see an example of such an equipment, where this "special treatment of VLAN 1" would not be just a result of a misconfiguration/misunder...

shivansps

I didnt posted the complete config because it is quite complicated as i have hotspot and a l2tp server, wan failover lots of firewall rules for port forwarding as well... But here it is. The sfp1 is not used, i realised that on the RB760 the sfp port is half speed, so using a regular ethernet port i...

shivansps

This is likely a switch configuration issue, but i wanted to ask here as maybe i have a bad configuracion on the router. The setup i have a is actually a very simple one, VLAN 1 is untagged on the bridge, this is the router native vlan, and then i added a bunch of different vlans with different netw...

shivansps

Ok, after disabling the sfp port and move the trunk to a ethernet port now i get about 280Mbits/s on single conection and about 480Mbits/s with 4 parallel streams. I think this is the most i can get out of the little Hex S and this is fine because Windows actually does this if you have multiple nics...

shivansps

Ether3 is just another bridge port with ID=1 like all others but it has no tagged traffic on it, so you dont see it on the export because it just has the default dynamic vlan ID 1 untagged setting. From what I tried a year ago ( this post and this post ), hEX S is nice, but not exactly performance b...

shivansps

Im having a medium to large setup here, as this RB760 handles 7 vlans and is a l2tp server. This is the configuration im using. /interface bridge add admin-mac=C4:AD:34:F2:8C:C6 auto-mac=no name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] name=ether1-Modem set [ fi...

shivansps

Got it, thanks, you have been very helpfull.

shivansps

It looks like the traffic is getting dropped right were it should be going to the VLAN that goes out, but im not really sure why. Try to disable the chain=forward action=drop connection-state=invalid rule. I never tried whether a ping response for which no request was seen is considered connection-...

shivansps

It looks like the traffic is getting dropped right were it should be going to the VLAN that goes out, but im not really sure why.

shivansps

https://i.imgur.com/h01gbTr.png i tried both ways with the same results. In attaching the full configs. # model = RB760iGS /interface bridge add admin-mac=C4:AD:34:F2:8C:C6 auto-mac=no name=bridge vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] name=ether1-Modem set [ find d...

shivansps

Ok i removed a bit of stuff because it was way too long with L2TP and hotspots and some extras. This is at site 1, it has VLANs from 100 to 140, vlan 200 comes from site 2 Vlan 130 is 192.168.85.0/24 /interface bridge add admin-mac=C4:AD:34:F2:8C:C6 auto-mac=no name=bridge vlan-filtering=yes /interf...

shivansps

i got stuck in the configuration, the vlans are added to both routers, and assigned to lan list, if i set a dhcp client on any of them i get an ip. Both routers can ping any device IP on the other site, but i cant make pcs on for example 192.168.90.0/24 on site 1 ping pcs on 192.168.88.0/24 on site ...

shivansps

I was in the middle of chaging my EAP network and i accidentally saved

IP:192.168.89.3
Gateway: 192.168.88.1

The EAP is on a very high roof, there is some way to temporary allow this to work so i can log in and change it?

shivansps

The CPEs are TP-Link but they carry the VLAN-Tagged frames over the wireless link. So the best way is to have all vlans added to both routers with vlan filtering and send all over the cpe link, and use EOIP interface instead of a vlan for sensitive traffic. Yes i do have conflicting networks and vla...

shivansps

Hi, im wanted to ask because im in this situacion were i have two places connected with a point to point CPE. What i want to do is to allow for internet sharing so if the internet goes out in one site, it uses the internet of the other one, and to be able to access the the servers on site 1 from sit...

shivansps

Ill need to check if the managed switch has no issues with not having a ID 1 first, it is very old. Now that ive been reading that and the mikrotik page about potential issues of bridging vlans like im doing i wonder if this is the reason of why im having so many issues with the ip cams, some of the...

shivansps

i see, i think i understand, one bridge with all vlans attached to it, have the address, interface list, dhcp server, etc running directly on the vlan. Vlan Interfaces: vlan1-Sales (ID 100) vlan2-Employees (ID 200) vlan3-Clients (ID 300) vlan4-Cameras (ID 400) All attached to "Bridge1-Admin&quo...

shivansps

Hi, im wanted to ask this because im now reading about port vlans and bridge vlans and i still not fully understand how bridge vlans work or how to properly configure it. What i have right now i belive is called port vlans. Im using a RB750GR3 for a office/store with 5 networks, dual wans and L2TP V...

shivansps

This is a question to the people testing RouterOS v7, there are conditional DHCP options allowing network boot of UEFI and legacy systems whiout having to go and change the filename or next server ip manually? Like the one requested here https://forum.mikrotik.com/viewtopic.php?t=95674 ? Is user-man...

shivansps

Yup, just tried is not possible to use userman to as a radius server for wireless clients. No EAP-TLS, EAP-SIM, EAP-AKA, PEAP, LEAP or EAP-TTLS support.

shivansps

So i have to have a script runing very minute to check if the gateway has changed to remove ALL UDP connections? And this is not considered a bug? wha...? Ok i got the script up and running, it works, but why?... im using masquerade why on earth i need to do this with a script? It should be auto cle...

shivansps

Im using advanced 2 wan failover as showed in this example https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting But im having a severe issue, if the WAN1 goes down, it switchs to WAN2, thats OK, but after doing that all UDP connections that were trought WAN1 fail to close, this...

shivansps

I ended up fixing it by adding another set of rules whiout the routing mark /ip route add distance=1 gateway=Host1 check-gateway=ping add distance=2 gateway=Host2 check-gateway=ping For the record, the wiki is not very clear what this /ip route add distance=1 gateway=Host1 routing-mark=ISP1 check-ga...

shivansps

Hi, in trying to setup a better WAN failover using this guide: https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting Just the basic setup, so far so good, i have that set up, using 1.1.1.1 and 8.8.4.4 as hosts i also have a DHCP lease script running to update the gateways on the...

shivansps

It's simple, dstnat changes destination address, so when they connect to you, their packets are redirected to target server. And since you also have srcnat/masquerade on WAN interface, and it's clearly not limited only to connection from your LAN, you created a variant of hairpin NAT config. So fro...

shivansps

This is something i did not realised that can be done. My friends and i were playing in a Arma 3 server a few days ago, and 3 of them had problems conecting to the server due to very high packet loss, so out of the "im out of ideas lets try this" i did a firewall rule to dstnat all the por...

shivansps

Thanks, ill look into that. But im going to be away for the next week now. The issue is now getting worse, i fixed remote extensions problems by switching to TCP for sip register, the SIP Trunk registration now it SEEMS to work on my main wan, ive added a mangle rule to "passtrought" all c...

shivansps

This is something that i cant figureout what is going on and its really driving me crazy. I have a very simple setup, 2 gateways with diferent distance so it works as a failover, 2 networks and 2 switchs, one for each. Recently we started using a sip trunk on our 3CX server, i just cant use my main ...

shivansps

I get it, thanks. The other option what i dont think is better, i would rather do load balancing, the PPC method should work, But the other thing i was thinking is disable fastrack only for port 5, connect 20 pcs on it and then use mangle rules to force those 20 ips to go trought the other 2 gateways.

shivansps

The games are going to be Fortnite, LOL and CS:GO, 10 pcs for each. Fortnite is by far the harder one. CS.GO dont uses much, and im not sure about LOL.

shivansps

Hi guys, we are planing a one time gaming event and i need to decide on the router... i need to set up a router with load balancing of 3 ISPs, one with 300MB/15MB, other with 100MB/8MB and finally 100MB/5MB. Do you think the RB750GR3 is up to the task? The most important thing for this is balance th...

shivansps

You can use DHCP option 67 to change the boot file name, in fact ive been using that to easily change PXE and UEFI boot mode from winbox, and yes you can set a dhcp option to one filename and having a dhcp option set pointing to the other one(what i think he was missing on the last command) active a...

shivansps

Yes... this did the trick, thank you. 11 chain=output action=mark-routing new-routing-mark=speedywifi passthrough=no protocol=tcp dst-port=80 log=no log-prefix="" 12 chain=output action=mark-routing new-routing-mark=speedywifi passthrough=no protocol=tcp dst-port=443 log=no log-prefix=&quo...

shivansps

Sure. Routes [admin@MikroTik] > ip route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 A S 0.0.0.0/0 PPPoE-Speedy 10 1 ADS 0.0.0.0/0 190.17.136.1...

shivansps

Righty now a have a setup with 2 wans and failover and i can force any ip i want on my network to use the 2nd wan gateway using mark routing.

But ill like to run the proxy server and hotspot but only using wan 2, not the primary wan.

shivansps

I know this is old, but i would like to see it done. I have both UEFI and legacy boot on my network and so far the only possible workaround is to change the file manually at the tftpd server.

shivansps

Ive contacted support, the problem was the default fastrack rule that was still active.

shivansps

shivansps

Im at a dead end, petty much everything ive searched about policy routing and routing Ips to 2 wan tells me that i only need a static gateway, a nat using that interface and a mangle rule to mark routing.

I really need to get this working.

shivansps

Now for example, i added a mangle route to pass my pc to the ISP 2 on PPPoE... chain=prerouting action=mark-routing new-routing-mark=speedywifi passthrough=no src-address=192.168.0.40 log=no log-prefix="" i open speedtest in a browser, it does detect the correct ISP 2 public IP, ping is go...

shivansps

This is my setup /ip firewall nat ;;; fibertel chain=srcnat action=masquerade out-interface=ether1-Fibertel log=no log-prefix="" ;;; speedy wifi chain=srcnat action=masquerade routing-mark=speedywifi src-address=10.5.50.0/24 out-interface=PPPoE-Speedy log=no log-prefix="" ;;;spee...

shivansps

It is possible to change it so instead of using the main enabled gateway for internet, to use a secondary gateway for internet? Like the one i use for failover? I know it can be done using a external proxy for example, but then i have no idea of how website control whould work. i whould preffer to u...

shivansps

For ISP 1: A DHCP client running on ether1 port, enable "add default route" and set a distance of 2. For ISP 2: A PPPoE Client running on ether5 port (by default is set as slave port, so remember to set Master port to "none" in its interface first), enable "add default route...

shivansps

nevermind, ive already figured it out, ive added a static route that uses "PPPoE-ISP2" as the gateway, and that is one using mark routing.

shivansps

Ok right now i have a: ISP 1: DHCP client running on ether1, with distance 1, and ive added a routing filter to enable check gateway. ISP 2: PPPoE client running on ether5 with distance 3. So far so good, the failover is working, but i want a certain ip to run ONLY on ISP 2. I could add a mark routi...

shivansps

In WAN i have a dynamic DHCP Client, ive enabled a filter rule to add "check gateway" on it. The 2nd gateway is inside the LAN, this is because there is an option on the pcs to manually switch gateways in order to use the other ISP if they wish. So, Gateway 1 = dhcp client with check gatew...

shivansps

This can be done? maybe using scritps? right now wlan 2 is a virtualAP whiout password in order to allow clients to get free internet, and is using my auxiliary gateway... my main gateway is only used for my internal network, BUT if gateway 1 is down, gateway 2 is used, at this point i dont want any...

shivansps

Hi, this is what i want to do. https://i.imgur.com/gLtyhPL.png So in preparation to that, i set up a VirtualAP with the secondary SSID, a IP pool, a secondary DHCP server to run on that interface (10.5.50.0 network, 10.5.50.2-10.5.50.254 pool, gateway and dns = 10.5.50.1, the image is wrong). I adde...

shivansps

Ok that is what i want to do, ive trying but have no success so far.

shivansps

Hi, Ill start explain my setup. ether-1: Fiber modem on bridge mode, it gets ip from a dhcp client. ether2-4 : Lan (192.168.0.0), 192.168.0.1 is the router IP. ether5: ADSL modem, in router mode, it has DHCP server disabled and a static ip of 192.168.0.2. wlan1: bridged with ether ports. there is a ...

Search found 54 matches