MikroTik

meazz1

I have upgraded to 7.3.1.
Looking in the System menu, I did not find "device-Mode (/system/device-mode)
I would like to disable Wireless.

meazz1

Thank you.

meazz1

I have download routeros-7.3.1-mmips.npk and also downloaded all_packages-mmips-7.3.1. What I trying to do is remove unnecessary packages that I don't need, for example ppp, wireless etc. My understanding that extract the zip file and put the files I want to keep in the root of the file system and r...

meazz1

This is my port forwarding and it works too, lol.

add action=dst-nat chain=dstnat dst-port=51820 in-interface=ether1 protocol=\
    udp to-addresses=192.168.4.8 to-ports=51820

meazz1

Remuneration not required LOL.
Payback is you learning a bit more every time you play with the router.
Simply copying will lead to disasters so don't be afraid to ask WHY!!!

Thank you very much.

meazz1

Thank you @anav. Please message your paypal email to me, I would like to buy you some beer, if you're not into drinking pls buy some lunch. Here's the final config. /interface bridge add admin-mac=08:55:31:CD:0D:6A auto-mac=no comment=defconf name=bridge /interface vlan add comment="Untrusted I...

meazz1

My Vlan 20 is attached to either 4, port 2, 3 & 5 are Lan only. My smart switch is connect to port 4 on the hex, nothing else connected to lan ports on the router. Kewl, So set vlan 20 to the bridge interface and not to ether4 Create vlan11 with the same IP subnet structure as your bridge and s...

meazz1

My Vlan 20 is attached to either 4, port 2, 3 & 5 are Lan only. My smart switch is connect to port 4 on the hex router, nothing else connected to lan ports on the router. I followed your suggestions above and made the necessary changes. Here is the newest config waiting for your approval. # nov/...

meazz1

My goal is , LAN LAN can access VLAN20 resource. Port forwarding is secured. # nov/06/2021 17:24:50 by RouterOS 6.49 # software id = 5MZ7-RL5B # # model = RB760iGS # serial number = XXXXXXXXXX /interface bridge add admin-mac=XXXXXXXXXXXX auto-mac=no comment=defconf name=bridge /interface vlan add co...

meazz1

At this point I am ready to put a bounty of us $10.00 and fix my firewall and configurations.

meazz1

I am very novice when it comes to firewall, so I won't be able to enter all the suggested rules knowing I will mess up and bring down my home network. Port #4 is for a smart switch where I am connecting to a unify switch and unify access points. That part is working. On the hex router, I am not usin...

meazz1

I basicall used out of the box config, except changing network IP and DNS. When every looked all right, I added a VLN and a firewall rule to prevent VLAN from accessing LAN resources. I just want to make sure while adding the VLAN rule I did not screw up my firewall protection. Here is the config; #...

meazz1

I noticed there's a package called "iot". What is this mused for?

meazz1

I have a Hex S router which does not have wireless. If I want to uninstall the "wireless" and any another packages I don't use, what is the best way to permanently uninstall so they don't get re-installed when I run an update later? Also, what are the bare minimum packages I need? I think ...

meazz1

Here's my firewall output. # oct/17/2021 13:31:58 by RouterOS 6.49 # software id = 5MZ7-RL5B # # model = RB760iGS # serial number = E1XXXXXXXXX /interface bridge add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge /interface list add comment=defconf name=WAN add comment=defconf n...

meazz1

Back to Mikrotik after using Opnsense for while. Newbie when it comes to firewall rules. My understanding is, the fasttrack should be on top of the rules. This is my firewall rules out of the box and the fasttrack is at number 8. Is this ok or I need to move it up? What else should be I be moving wi...

meazz1

Is this what you mean?

meazz1

@anav
Thank you.
I took care of the first 3 as you suggested.
For #4, I checked the VLAN Filtering, for the Frame Types "admit all"? Which one from the drop down to pick?

The port#5 in the router is carrying both Vlan20 and lan traffic to Unifi switch, which seems to be working already.

meazz1

My only goal is to have a LAN and and IoT Vlan, it just seems so difficult. Here's my config, I just need to see if the firewall is still somewhat in default state to give me out of the box protection. Secondly, the Vlan20 does not have access to Lan devices. # jun/12/2021 15:15:29 by RouterOS 6.48....

meazz1

I just bought a HexS and trying to accomplished this. What I'm trying to do is setup a VLAN and have one dedicated trunk port to go to my unifi switch. Also, i'm trying to get a port for VLAN only, vlan devices should not have access to lan resource but lan can should have access to vlan. Here's wha...

meazz1

Everything works except one thing. Right now, I've DNS servers are setup under DHCP Networks and my LAN and VLAN works fine. The DNS settings under IP is blank. The issue I see, System --> Package can't connect to internet for update. I resolved this by adding DNS entry in DNS settings menu. The que...

meazz1

What you mean by: How to handle port 53?

I read in the forums that a firewall filter to block external DNS queries to port 53 and force pi-hole to resolve the queries.

Your suggestion to setup in the dhcp network is what I want to do.
Thanks

meazz1

I have 2 Pi-hole I want to implement on my home network. here's my network layout. What would be the best way to setup everything? LAN- 192.168.4.0 - home network DNS 1 - 192.168.4.200 -Pi-hole#1 DNS 2 - 192.168.4.201 -Pi-hole#2 ========================= VLAN IOT - 10.0.20.0/24 DNS 1 - 8.8.8.8 DNS 2...

meazz1

as long as my firewall is setup right I will be ok with it for now.
I used Opnsense on a device with only 2 gig ports so setup was pretty straight forward.
Now, I want to give Mikrotik a try hence all this dilemma.

meazz1

@anav I took your advice and made few changes. I'm hoping this will be it. Lan 192.168.88.0/24 bridge ether2, ether3, ether4, I will only use this to access WinBox, no devices are using this. VLAN1 192.168.4.0/24 bridge1 ether5, my main home subnet VLAN20 10.0.20.0/24 bridge1 ether5, IOT devices. Ne...

meazz1

Thanks @anav You always help right away. Really appreciate your willingness. Here's the chnages you suggested. I will try it out when the family is asleep and let you knoe. # jan/01/2002 00:22:03 by RouterOS 6.47 # software id = S1MG-NEED # # model = RouterBOARD 750G r3 # serial number = 6F39079A5CA...

meazz1

I have created this config and hope this will pass the leak test. I would appreciate if someone can take a look. My setup is in mikrotik LAN -192.168.4.0/24 VLAN ID20 - 10.0.20.0/24 Port forwarding for VPN to IP192.168.4.8 Managed switch for tagged and untagged traffic. Only thing I added a rule for...

meazz1

Ok, I made some changes to my scripts and I think it's what I really want. Only sticking points are, not sure if the firewall rules are correct, secondly, should I be able to enable on "1-default" vlan-filtering? I could not get the ether5 to communicate if I enabled filtering. /interface ...

meazz1

Here's a diagram.
All I need is VLAN20 not see any LAN resource.
Please ask if any confusion.
Eth5 is MGMT port.

meazz1

@anav @sindy Thanks here are some answers. This is for my home use for 4 of us. I have an Unifi AP-AC lite with 3 ssid for each VLANs. My current router is an EdgerouterX. I want to replace this router with Mikrotik Hex. My main lan is VLAN4. Most of my day to day stuff like PC, laptop, unifi ac-lit...

meazz1

@anav Thank you. I played around with your configuration and got it up and running. Before I dive deep into this I have a question. Using a managed switch I 'm able to access all the VLAN. How do I supposed to access IP on the ether5 MGMT port on the router? I really appreciate all the help you folk...

meazz1

Here is the latest and greatest config. I have redone everything, all collected from different google search and my own understanding. Again, my goal is to block VLAN 20 from talking to any other LAN device but only access to internet. All firewall rules are default except this block rule. #5.3 Bloc...

meazz1

I usually dont comment on snippets as the whole config tells the story /export hide-sensitive file=anynameyouwish So far so good (but without the rest a meaningless statement). The order within a chain is critical and thus to make it read far easier most admins put all the input rules first and the...

meazz1

Something like this? Be easy on the newbe, lol. add action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input ...

meazz1

I have basic networking for my soho with 3 VLANss. I'm using default firewall rules and need a filter/rules to prevent VLAN10 and VLAN20 from accessing other VLANs. I have googled and add some rules but it seems not block the access. So, I restore the router to default cong and setup all the VLANs a...

meazz1

Upgraded from v6.45.5 to v6.45.6 on my hex mmips and no problem but setup is very simple and straight forward.

meazz1

Upgraded my hex mmips from 64.45.3 to 6.45.5, no upgrade issue and everything seems good. My setup is just basic out of the box for my home use.

meazz1

I'm running WinBox v3.18 on my Linux Mint in Wine. How do I populate the login screen with MAC, Version, IP etc. I looked but not able to figure out. Google was not help for me either. https://lh3.googleusercontent.com/2U3WRZQXZ3VmBwx02fcEwFawbMg8Y6N0xPTbailXeUTbYninmSVBpQ66zOP-vjJGGOmvRkg1c0hn6qsOm...

meazz1

So I will delete everything from IP---> Firewall and open a terminal and paste your scripts? No way! The "script" contains your existing rules with no effective change, just re-grouped by their membership in chains but keeping your original order within each chain, and numbered so that I ...

meazz1

@sindy
Really appreciate your time and help.
So I will delete everything from IP---> Firewall
and open a terminal and paste your scripts?

Thanks

meazz1

If you not use telnet and SSH, disable it from IP -> Services

Regards.

Thanks.
What I did is made both available from my local subnet only 192.168.4.0/24.
Is that good?

meazz1

I just saw this when I logged in to my winbox today while I'm sitting at home. Any idea? 22:15:06 echo: system,error,critical login failure for user service from 92.115.171.102 via telnet [amgg@Tulip] > 22:15:07 echo: system,error,critical login failure for user admin from 92.115.171.102 via telnet ...

meazz1

Here's my /export hide-sensitive file # may/30/2019 21:24:29 by RouterOS 6.45beta50 # software id = S1MG-NEED # # model = RouterBOARD 750G r3 # serial number = xxxxxxxxxxx /interface bridge add name=bridge1 /interface list add name=WAN add name=LAN /ip pool add name=dhcp ranges=192.168.4.10-192.168....

meazz1

Here is my ip firewall filter export # may/30/2019 21:27:33 by RouterOS 6.45beta50 # software id = S1MG-NEED # # model = RouterBOARD 750G r3 # serial number = XXXXXXXXXXX /ip firewall filter add action=accept chain=forward connection-state=established,related add action=fasttrack-connection chain=f...

meazz1

I basically copied the rules for mikrotik wiki and added the fasttrack action. Can you tell me if this looks ok for my basic protection for the home use? https://lh3.googleusercontent.com/TFj3cuO9a04zxpwI_Lj6vIjTLIVPS3aHMlivv2Z95nWfYsZyxHv-lxL5Cn7yTQnidrbWLWwX8fDyjj48LexNRV5P7IQmBa7E0BEf1a6PKeqpDb7t...

meazz1

any suggestion?

meazz1

If you wanted your router to be completely invisible from outside its WAN subnet, you'd have to disable also the TFTP - port scanners scan using multiple ports and protocols. So if you need the TFTP service to be available for requests received via WAN, disabling ping will not add much invisibility...

meazz1

I have the default firewall rules running on my router. Only thing I added is the "fasttrack" feature. Not having good idea about how ping should work, here's my question. Is is ok form my router to return reply if I ping my IP from outside of my network? Here's my firewall rules. # may/24...

meazz1

@meazz1: by default, Routerboard devices have installed package bundle and it's not possible to completely uninstall individual packages ... it's only possible to disable them. If you want to completely uninstall some packages, you have to "unbundle" ROS first. The procedure is as follows...

meazz1

The "ppp" package is also for VPNs. So if you don't need them, then yes.

thanks for your suggestion.

meazz1

I have a Router 750G r3 without wireless feature. I also use a gig fiber connection without the PPPoE option.
In that case, will it be ok to uninstall package "wireless"and "ppp"?

meazz1

I have a gig fiber at my house. I have an IPTV box connected to my Mikrotik hEX router running 6.41 firmware. I also have a raspberry pi running pi-hole for DNS and adblocking. Everyting on the LAN is forced to use the local DNS address. For some reason the IPTV box is buffering but my other streami...

meazz1

I have a very basic setup and I need guidance. I had been using consumer grade router and new to Mikrotik configurations. i'm still learning Currently, ether2 is master and ether3,ether4 and ether5 are salves. ether5 is connected to a gig switch. I want to make ether4 a seprate port with it's own IP...

meazz1

I looked but couldn't find the answer. I just bought a wired router hEX RB750Gr3 and was wondering if I need to purchase a license? It's been up for less than a week but I'm confused if it will shut down after 15 days. For another router AP I'm planing to buy for my 2nd house if that needs licensing...

meazz1

There's no need to have a rule to explicitly drop ICMP in your posted filter rules. add action=drop chain=input in-interface=!ether1 protocol=icmp icmp-options=8:0-255 add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=drop c...

meazz1

I added an entry to drop pings from the wan side with the help of google, does it look right? I added the entry in line #16. /ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" \ ipsec-policy=in,ipsec add action=accept chain=forward comment="d...

meazz1

Add a second IP to your router's WAN interface - if the modem is connected to ether1, for instance: /ip address add address=192.168.1.253/24 interface=ether1 next add a srcnat rule to access the modem: /ip firewall nat add chain=srcnat dst-address=192.168.1.254 action=src-nat to-address=192.168.1.2...

meazz1

My lan Ip is 192.168.4.0/24. My At&t gateway is 192.168.1.254 and in passthru mode. What route or firewall rules I need to implement so I can access it from any lan pc? I'm new in this Mikrotk world. https://s19.postimg.org/jxh7ildjn/Capture.png https://s19.postimg.org/y5dtxnzqr/Capture.png

meazz1

I have been reading about fasttrack and checked my firewall and moved up "fasttrack" in the rules list.
No idea on how rules work, can someone look here at the screenshot and tell me if it's ok?
I have a hex router RouterBOARD 750G.

meazz1

I'm using RouterOS 6.40.5 and the RouterBOARD 750G r3. I have the default setup with Ip 192.168.4.1 assigned to the router and the dhcp 192.168.4.10-100. I can connect from the windows box using IP 192.168.4.1 to winbox. If I try to use the same IP in a browser it doesn't connect. What or how do I ...

meazz1

I'm using RouterOS 6.40.5 and the RouterBOARD 750G r3. I have the default setup with Ip 192.168.4.1 assigned to the router and the dhcp 192.168.4.10-100. I can connect from the windows box using IP 192.168.4.1 to winbox. If I try to use the same IP in a browser it doesn't connect. What or how do I e...

meazz1

Thanks for helping the newbie here. As suggested, I reset configurations to default and ran most of the command in the link provided ( https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router ). 4 questions: 1. the default config has firewall rules already, should I still add the one in the link? ...

meazz1

Can someone point me to a preconfigured basic firewall script that works with default config on hEX RB750Gr3 router?

meazz1

It's working fine.
But if I want ethher1 to be WAN and other 4 to be just switch, how do I go about it?

meazz1

I configured my hex router after removing default configuration. I'm new to Mikrotik and learning my way here. I setup the router with At&t gateway and everything works. For some reason when I look at the interface screen, it looks something is not done correctly. In my case, ether1 is WAN port....

meazz1

See this first, and implement the basic security as described. https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router Thanks for your help. Here is a script I made, let me know if this is ok. Any suggestion is welcom. /ip firewall filter add action=accept chain=input comment="default confi...

meazz1

I recently purchased a Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router. I reset default configuration and have the basic setup, eth0=wan and eth1 to eth4 as switch. I need to get a basic firewall rule so my external IP is not visible from outside ping. I just need basic rules to protect me as a...

Search found 67 matches