MikroTik

BRMateus2

For the input traffic, that is totally normal and no need for any fixes.

Please stop blocking ICMP if you don't know what you are doing; http://shouldiblockicmp.com

BRMateus2

Upgraded mipsbe RB951G from v6 to v7 and worked fine at the first moment, but when I upgraded the firmware it broke the router, now its DHCP doesn't work and the router can't handle any Layer 3 IP IPv6 anymore - will try to netinstall with a switch in between, because directly connecting to PC for n...

BRMateus2

@rextended, you should shut up already, we don't need salty guys like you.

BRMateus2

Wouldn't it be easier and way more effective to power a USB fan on the case? Nice job by the way, interesting that some passive holes works.

BRMateus2

Did the Ruckus work? I've never seem something like this, are you sure there is no jammer nearby? Jammers don't show in any of the WiFi protocol scans.

BRMateus2

A bit of troubleshooting and I realize that the ICMP-TIMEOUT in conntracking is the issue. If I reduce that value to 2 secondes and add a "ping 127.0.0.1 -n 5" in my batch file, then everything works as expected.

Isn't because you are using connection-state=new?

BRMateus2

What is on your advanced WiFi configuration data rates? The lower rates are to reduce power usage and minimal control (beacon, etc).
If you want always high transfer rates, you need to disable the lower data rates manually, at the cost of stability considering the signal quality and noise.

BRMateus2

@xbar7networks
You might want to send supout to MikroTik support, as this kind of debugging might be out of the scope.

You sure the voltage is ok?

BRMateus2

This is your fault, as no device should be placed into Internet before configuration.
It's the same as I uploading a example sketch to a Arduino and putting it to run 24hs in the WAN natted, it's bad.

BRMateus2

Don't think you can without by serial console or some soldering, as you said the firmware does not support flashing MikroTik firmware.

BRMateus2

Such a "simple software" of drawing and translating into scripts is very time consuming to produce, and will be very limited in settings available considering how time consuming it is - even more, only a few people will use it, as Quick set itself is enough for many new-to-networking users...

BRMateus2

Memory fragmentation undefined behaviour bugs happens even in Windows (do a 500MB free test without swap, Windows craps out).
It is very hard to handle such malloc issues, because it is part of malloc itself - any kind of new route or such, will bug out the dynamic buffers, etc.

BRMateus2

Linux 5 is there, an stable kernel with tons of fixes from very dangerous bugs of 4.14-4.16 (BFQ with SCSI kernel locks (can corrupt the disk), Ryzen bugs ie suspend locks). This is an DDoS kind, not something an dedicated blackhole subnet or country couldn't handle. Good for Mikrotik and Normis tel...

BRMateus2

Hello guys ! I'm looking at those packet flow diagrams and the exemple scenario and I was wondering : where does the traffic originating from the router itself appears ? For example let's say I bind a dhcp-client to a vlan interface, what would be the path of a DHCP Request packet on those diagram ...

BRMateus2

You can protect from that by not enabling RDP from the Internet. Basic security.

Those attempts are botnets, and Windows RDP is full of vulnerabilities, it will never be secure.

BRMateus2

Your domain might filtered out Mikrotik - this seems common.

BRMateus2

EoIP seems to be single-thread then, where the Kernel possibly mistakenly assimilated Btest and EoIP to the same thread - anyway, (4 - 1) threads which can go to any other feature.

BRMateus2

Tell you, I have an old RB951G-2HnD MIPSBE which is not the top line of today's MikroTik hardware. Bridging between switches might turn into CPU bound, so it depends on how much bandwidth you need. I don't know what exactly "HW accel" means in the router block diagram, so I can't tell you ...

BRMateus2

Well, the processing power goes mostly by packets per second - mixing packet sizes is simply misleading towards a certain target PPS or countering a certain RAM bandwidth limit. RB4011 has two 2.5gbps switches so you can expect 5gbps upper total, anyway, what you do with the router can reduce that b...

BRMateus2

You might get better roadmap directly from MikroTik, where this feature goes completely out of a routing scope and enters an pay to play or such things - remember Windows and its force privacy contracts when you give too much power. It's not like IANA and ISO things are respected when their scope go...

BRMateus2

I don't think here in Brazil - or in any standard poor country in the world - this technology would prevail from start.
USA providers have tons of money, some experts and has time to implement those crazy all-in-one vulnerable protocols.

BRMateus2

Well, HTTP speed tests are all by an specific protocol - Speedtest.net for example, is very different from Btest, which is very different from any open source Python server and client. There does not exist any HTTP Speed Test as you want, it does not work magically in computer science and protocols,...

BRMateus2

Your router might have been used in DNS amplification attacks.
The ISP should provide you an drop hole for the possible spoofed IP.

BRMateus2

Send supout to support@mikrotik.com, this is a bug they might don't have any to support output.

BRMateus2

To be honest, this shouldn't escalate to an last resort like netinstall - the small size is not good because does not allow to use all compatible features simultaneously, it's like installing Linux and only be able to execute X11 or Console(tty) but not both - it is damaging the brand, and SPI Flas...

BRMateus2

To be honest, this shouldn't escalate to an last resort like netinstall - the small size is not good because does not allow to use all compatible features simultaneously, it's like installing Linux and only be able to execute X11 or Console(tty) but not both - it is damaging the brand, and SPI Flash...

BRMateus2

1. This might be port flapping, that means not related to any attacks or vulnerabilities - you might want to disable hardware offloading and enable cpu offloading as I had this same issue with my RB951G. Seems related to a bad cable/layer1 with mixed ethernet negotiation speeds, where any renegotiat...

BRMateus2

Please

/export hide-sensitive

in terminal.

BRMateus2

What version of RouterOS and firmware you are using?

BRMateus2

Deantwo
From the reddit response (netsec), the limit of 3 packets is a per connection basis - this means you can scan the whole network for all ports and IPs.

BRMateus2

You might want to start by this link then: viewtopic.php?t=143620
I don't know about VLANs tho, I only bridge for now (home).

BRMateus2

If someone has access to the RouterOS console, he at least already has access to any service exploit, it is just a question of activating a service and sending overflowing data or such. What you need is to disable "sensitive" in System/User List/Groups for untrusted users, but this is only...

BRMateus2

Hackers on your outdated versions.
Or maybe outdated firmware scraped the settings.

BRMateus2

Hello, I just want to confirm why my PPPoE Client has a blank Encoding even with a Required Encryption profile, and if its possible to solve: # dec/21/2018 22:50:22 by RouterOS 6.43.7 # model = RouterBOARD 952Ui-5ac2nD /ppp profile add name=force-encryption change-tcp-mss=yes use-encryption=required...

BRMateus2

You can try disable hardware-offload (/interface bridge port), fixed the issue for me, but it will make processing fully CPU bound..
This seems related as the OP already saw: viewtopic.php?f=3&t=128762
Running different speed negotiations.

BRMateus2

Lol the whole forum topic for nothing.
That's the function of an anti virus.

BRMateus2

Many thanks for the information, I will not mishap next time as I didn't understand fully what was going on in an unconditional masquerade - I only use with configured out-interface-list, so thinking without that generated that big error of mine.

Good day @Sob!

BRMateus2

I think your unconditional masquerade is doing it's job, it is masquerading the server output and changing the header to router IP, meaning the browser error is very clear as it did not get data from (..).20.

BRMateus2

Perfect update and upgrade from 6.42.3 to this in RB951G-2HnD

BRMateus2

Agreed - this goes more for an privacy concern them, and Duckduckgo is an very good alternative - I use it primally.

BRMateus2

Many thanks @vecernik87 for such information, I've updated the original post tasking the reader to create layer 7 rules which is not my knowledge for all case scenario.

BRMateus2

Actually the second stage is, if this reference is correct (https://blog.securityevaluators.com/vpnfilter-threat-how-to-prevent-detect-and-mitigate-9cdf74fee92a), just detecting specific hardcoded destination IPs (supposing all VPNFilter code has the same IPs) # Address list /ip firewall address-lis...

BRMateus2

Agreed.

BRMateus2

You should never put an server IP you don't own and explicitly disallows such an shame ping flood..

BRMateus2

Even all programming languages that I know do use tricks to make Unicode work, because the Unicode specification is very hard to understand and implement literally how it is specified without many performance constraints. Command prompt as I know, only supports ASCII specifications with ISO-8859 (&q...

BRMateus2

Well this deserves a page in the wiki or even forum pin

BRMateus2

So how do you expect to secure 3000 routers without even reading MikroTik Documentation which is way smaller than the C++17 release specification??

BRMateus2

This isn't ethical, you will break everyone in your network for MitM attacks and too, break Google hard work at cryptography.

BRMateus2

I can't recommend the MikroTik WiFi for low latency 802.11; but they have good signal and very good bandwidth management so everyone can get some. My testings show an average jitter of 30 in some very high interference places, that's why ISP only use MikroTik with its proprietary wireless protocols....

BRMateus2

BRMateus2

What is at tools profiler when this happens? Percentage by process.

BRMateus2

What is at IP addresses and bridge ports?

BRMateus2

Version?
... details, formulate an relatory.

BRMateus2

Winbox officially doesn't support MAC at Linux, and the default settings from the MikroTik starts IP at 192.168.88.1.

BRMateus2

That version has tons of vulnerabilities; update all.

BRMateus2

I agree about including NTP to SMIPS for flexibility and, as many places has unstable jitter, or uses Windows which has horrible timing with bad internet, or user just wants to not use 4b/s bandwidth of the internet just to query NTP outside as its many home devices (NAT redirect), no hurts for that...

BRMateus2

You can make an firewall rule which catches those packets from your IP to ISP LAN and redirects to your own router. I didn't knew the traceroute stops after 5 failures.

Edit actually my mikrotik traceroute doesn't stop after 5 timeouts.

BRMateus2

That IP your router detects at DHCP Client is actually an private network address range as follows: https://db-ip.com/all/100.66.171 The IP the cloud informs is actually your public IP which everyone can connect, but if your ISP denies certain ports that you need or uses NAT for a big chunk at the s...

BRMateus2

If you set a big enough buffer which depends exclusively on the workload from/to WAN, no packets will be dropped ever in that situation, but will consume more RAM and a little more CPU, as it has to track every new big chunk of buffer. It's up to you that even QoS can almost offer guaranteed deliver...

BRMateus2

The architecture is different, even the software package sizes are different; can be related to kernel or even supout internal debug logging.

BRMateus2

From what I see, there is nothing wrong with your settings, place in the CLI/Terminal this command just to be safe: /tool graphing set store-every=24hours I do graph things every 24hs and the average writes per day is 3500. If I don't graph, the average is about the same as yours. This seems normal.

BRMateus2

Try to drop output; it seems to be skipping forward, and I think if the router originates the packets, it will place directly at output chain.

BRMateus2

Authentication is a must as it encrypts data; Mac spoofing is two clicks and "hacked" by a 6 year old.

BRMateus2

I needed help too and got an awesome experience with the support; awesome! Mikrotik is an golden enterprise.

BRMateus2

Unfortunately no 2-step feature. As MikroTik is not really meant to be housed but running into dedicated bandwidth and such. I would like to implement such scripts but would occupy some of my time, but here's references: Use version v1.5 from link redirect: https://wiki.mikrotik.com/wiki/Automated_U...

BRMateus2

You can't get end of month GB consumption but can estimate by tool->graphing.

The GB can only be made by scripts. Not obtained as it doesn't have.

Remember to save to disk at highest interval possible or else your flash will be gone. Put 24hs.

BRMateus2

I could not link your request directly to what you need, but there is the public DDNS offered by MikroTik itself, at IP->Cloud (supports only IPv4 as now).
There you can make Digital Ocean point to the link created by the MikroTik.

Disable Update Time if you already have a NTP Client setup.

BRMateus2

Netinstall works with equally RouterOS version, but might not with others.

BRMateus2

You can get the modem WAN MAC by connecting it at any port and going to IP->ARP, them set the WAN interface by: viewtopic.php?t=18305
"/interface ethernet set ether1 mac-address=xxx" provided ethernet WAN is port ether1.

BRMateus2

So I disabled all writes and even the 24hs DHCP leases; I might had bad luck and System was stored in bad blocks, because today I tested twice, reboot and it booted ok, shutdown and it booted too. Lessons learned: never write data in an interval less than 24hs to "any" NAND, or never write...

BRMateus2

Thank you for the suggestion! Yes I did use Graphing, today I disabled the disk-write and I'm graphing only to RAM; It happens to bug electricity every one to three months, its not that common; as its summer here and raining period, MikroTik suffered only one electricity cut and one low-voltage elec...

BRMateus2

Many thanks for your answer! I sent an email right now to support@mikrotik.com entitled "[Bug Ticket request] RB951G-2HND Reboot issues and system corruption". I love that router, would like to fix if its possible. Looked right now at bad blocks count, its 0.3% after the netinstall (before...

BRMateus2

Hello, an big thank you for the btest! Its great having that server for testing purposes, I did some tests for 2 or 3 minutes to verify the %CPU of the MikroTik rules and QoS and optimizations (wasn't necessary), I'm using my first MikroTik bought from a month, RB951G-2HND, an great product! Best of...

BRMateus2

This might be an duplicate, because my first topic doesn't show... Hello, so I bought the RB951G-2HND in september and it was my first one, before I had an TP-Link running DD-WRT which freezes after some days and the default firmware was even worse. Everything perfect, f* fast router and features th...

Search found 74 matches