MikroTik

Caci99

Anyone experiencing flickering screen when winbox window is in background and you move the mouse around? It is very common to open winbox and then work on another window but the winbox window keeps flickering and is quite annoying. Not possible to attach screenshot, and strangely enough even the na...

Caci99

Anyone experiencing flickering screen when winbox window is in background and you move the mouse around? It is very common to open winbox and then work on another window but the winbox window keeps flickering and is quite annoying. Not possible to attach screenshot, and strangely enough even the nat...

Caci99

1) Are you interested in a central controller for MikroTik devices? Sure, mostly for wireless because that is commonly the case where one would find a lot of devices on the same network, but managing a bunch of SwOS would be good as well. If we are talking about managing devices across different si...

Caci99

In general I do not get that exited about new looks, but it is nice to see some effort put into it. Obviously, as mentioned in the opening post, there are functionalities that are not there yet. Two suggestion I have at the first glance 1. when entering the field of user and password at first window...

Caci99

I experienced some weird behavior when moving from 6.49.13 to 7.15 with IPSec site to site tunnel. Generally being cautious when moving from 6.49 to 7.x last week I did such upgrade for the purpose of moving capsman to wifi wave2. It all went smooth, with the exception of IPSec tunnel. This tunnel w...

Caci99

.. CRS is a switch, why do you need RAM at all in there ? How about buffering? When you connect two switches via SFP and the main traffic is at one port, a server for example, there are too many TX pauses because the switches between them see the connection at 10GB, but the ethernet where the major...

Caci99

About point 3
One thing that comes to mind, is to not save sessions which are <own>. That way if one wants to assign a self defined session is easier to pick it up from the drop down menu of sessions instead of scrolling.

Screenshot 2024-01-15 122334.jpg

Caci99

1. Yes 2. I use sessions a lot in saving windows and column widths on particular routers. For example in core routers I use it to have always queues and firewall in first view, on capsman routers I set it to view capsman window at first opening etc. 3. No opinion right now 4. I guess it does, ones y...

Caci99

Long long overdue, when was the last update? Two years ago?
But we need SWOS update as well, not only lite.

Caci99

What fix are you referring to? This release has several fixes on wifi wave2. Clients can not connect WiFi only reboot will help. Check forum there is plenty of reports. That is a very general statement you are stating. There are plenty of reports but not all can be attributed to ROS, many can be mi...

Caci99

Fix for WiFi will be in 7.11 so stay at 7.8

What fix are you referring to? This release has several fixes on wifi wave2.

Caci99

There is still a risk you can be locked out by some malicious employers who can have physical access. I If you take security seriously, all network equipment and servers etc should be in a locked space. Would you place a server outside in public, no. Just with an usb emulating mouse or keyboard you...

Caci99

*) routerboot - enabling "protected-routerboot" feature requires a press of a button; Finally!! I have been talking multiple times to Mikrotik about this since long. Glad they took some measures now. There is still a risk you can be locked out by some malicious employers who can have phys...

Caci99

Mikrotik has more options, yes...But only non functionality feature! That is stretching the reality by quite some lengths beyond imagination. I do run small and big networks based on Mikrotik and hardly can recall any bug impacting the network, performance wise there are things I wish they can do b...

Caci99

I think it has been already discussed a lot about the change log of long term releases. What they will put in the forum as change log is the change to the latest stable version from which the long term has derived. If one wants to see the whole change from the latest long term release you can find i...

Caci99

Unfortunately the bug that occurs when holding down mousebutton on a window which is frequently updated, e.g. to change column width or to move a line up or down, is still present! It has been reported so many times already and I think it also was reproduced at MikroTik, please fix it. (back to ver...

Caci99

do you use doh (dns over https) ? it will reduce the amount of your memory No I don't use it. The router has standard DNS servers and barely uses DNS at all. (it is not a resolver for other systems in the network) I have located the problem and will inform MikroTik in de support case I had opened f...

Caci99

!) dns - added client side support for DNS over HTTPS (DoH) (RFC8484);

Does this mean we will see the end of filtering via DNS anytime soon?

Caci99

I put my hands on netPower 15FR for first time and trying to figure out how it can be deployed. In my lab I am using Hex PoE, CRS112-8P, hAP AC2 and netPoer 15FR. My first test was powering from CRS112 in one of the receiving 15 interfaces and then connect hex poe and hap ac2. The hex poe was connec...

Caci99

Shift+Ins in Terminal works at least in Wine for MacOS.

One learns a new thing everyday. Thanks Chupaka for the tip

Caci99

https://wiki.mikrotik.com/wiki/Manual:I ... :1_mapping

Caci99

If you check from winbox the change log that appears at /system package you will see that it has all changes since 6.45. Is there a better way to alert a user about the change log? No indeed, but do you mind to consider cli-only setups? Mikrotik site is the default place for changelogs as for me an...

Caci99

What kind of test are you doing? Have you checked, filters, fast track, bridge, etc..?
That does not look good, looks like a case to write to support.

Caci99

17 answers and none about the release. It probably means that the release is stable indeed :D All this discussion should be put in another topic guys if you are unhappy about the release channels and how are those named. If you check from winbox the change log that appears at /system package you wil...

Caci99

Big issue!
After the upgrade hap ac2 (RouterBOARD D52G-5HacD2HnD-TC) - stopped working any wi-fi (2 and 5 GHz)!
After downgrade to 6.45.7 - wi-fi work fine.

No issues at all for me, upgraded two hAP AC2 fine, one has a lot of configurations as well (ipsec, qos, etc..).

Caci99

there must be a problem with LtAP and 6.44.6 i have a raspberry connected to eth0 (the LtAP is powered over POE) .... everytime when i restart the raspi ... i see a eth up/down/up/down ... and no DHCP IP is assigned. When i disable the eth port for 1-2 minutes .... then enable the eth port ... then...

Caci99

to Caci99
All customers use L2TP/IPsec and OVPN, but there is a Keenetic-4GII which has only PPTP!

PPTP is dependable on GRE. They have changed how GRE handles first packets ( version 6.44.3 maybe ).
If you go to that topic you will see some workarounds how to handle the GRE connections.

Caci99

I had a problem after upgrade on LtAP with DHCP Server and the raspberry on the ETH Port. I took 2-3 LtAP reboots so that the Raspberry finally got a IP adresse from DHCP ( always ETH down/ETH up/ETH down/ETH up ....) Richard Those are symptoms of no synchronization between the two ethernet interfa...

Caci99

Hello ! After upgrading from 6.44.2 to 6.44.6, the PPTP stopped working. L2TP and OpenVPN work well. RouterBOARD 750G r3.

Glad that PPTP does not work. It is so outdated and unsecured that undoes the purpose of VPN. Stick to L2TP with IPSEC or OpenVPN.

Caci99

Hi, I am sorry, I have maybe dumb question, I am new here, I tried to find out why don't see in upgrades this "long-term" version. I have RB962UiGS-5HacT2HnT hAP running on 6.42.11 and in winbox I see that it is actual or latest version. Is it correct? I have some problems with IPSec/IKEv...

Caci99

hAP ac2 on 5g Tx rate picks up very slowly after a device is connected. If the freq. is set to auto, it thinks a lot about detecting radar, i gave up and put it on a non DFS channel. Ping seems fine, ill play with it more tomorrow and add to this reply if I find anything wrong. As far as I know, th...

Caci99

Great. How about the wifi configuration? It let configure SSID and PSK with AES only? The Ethernet interface I believe that is fast Ethernet, in any case Gigabit. Right? Thanks for share your first impressions with us. Regards. The OS is quite limited, still version 1.1. But wifi configuration is i...

Caci99

I got one MQS in hand and here are my first impressions: The MQS for some reason will not power up from CRS112-8P-4S which I have in my lab from poe-in using straight or cross over cable, but it will power up from rb260GSP Using a Power bank at my hand, one rated at output 5V x1A, MQS does power up ...

Caci99

I started with debian machine and then just overwrote system disk with ROS image. They issue coupons worth 10€ so you can try yourself before purchasing. Thank you guys I managed to do it with Aruba, but I would guess it can be done with any other VPS provider. I installed first Debian and then fla...

Caci99

As It's just for private use (holding several VPN tunnels with low traffic + dude) the smallest one for 2.79€/month is more than enough.

Are you using Linux as a template with virtualbox? Can virtualbox run at 64 bit?

Caci99

Which option have you picked up there? Which is the most economical one for CHR?

Caci99

I am thinking on running a CHR on VPS, mostly for vpn connections for customers who do not have public IP and want to access their resources. It maybe run as dude server as well. But it is not easy to find a reliable VPS service who can offer full virtualization in order to run CHR as I found out. A...

Caci99

Where is the procedure detailed on how firewall rules are automatically created?

-tp

I didn't say it exists, I said they can implement it.

Caci99

There is no bug. It just got fixes some Versions ago. "The accuracy of your information could be sucessfully questioned". You are right that the bug consisting in having the firewall too open for GRE was fixed, but bundled with this fix came another bug - the very first GRE packet of a ne...

Caci99

Normis: June news repost Ok, it's amazing that the CCR1072 is still the biggest Hard, I'm a fan of Mikrotik, but in the ISP where I work, we are with a troughput of almost 20Gb, reaching almost saturate some 10Gb interfaces and with a CPU that peeks already 50% (it's a BGP core) and I have nothing ...

Caci99

... Of course. But, I was refering to 2.4GHz QRT2 vs 2.4GHz LHG XL 52 ac. Is it possible that I could potentially see improvement in that area, if 5GHz option fails ? Not necessary. If I recall it correct, LHG shoud be a bigger antenna than QR2, that means a narrower beam distribution. It depends o...

Caci99

Can remote host 10.2.1.233 ping your MT?
Try masquerade without specifying out-interface.

Caci99

Would pair of LHG XL 52 ac be decent replacement for pair of QRT2, for PtP ? Using QRT2s because of tree foliage, haven't tried 5GHz yet in those conditions. 5GHz is more prone to obstacles than 2.4GHz, it is already lucky that your link works behind foliage, usually it is a big problem for wireles...

Caci99

My guess is the PD has the resistance installed on another pair from where the PSE sends the signal, thus not detecting PoE on the device and not powering it up. By doing a crossover cable, the signal gets response and powers it up.

Caci99

I had the same issue trying to power up a cAP Lite with a Longse LS-RT2412. Decided to use a Cross Over cable and lo and behold, the cAP Lite powers up. There got to be some issues on how these switches detect the device, otherwise I don't see why a cross over cable works and a straight one does not.

Caci99

It is the case to write to mikrotik support. Sounds like drivers are missing.

Caci99

Have you tried to change the auto negotiation option?

Caci99

I've noticed this behavior on a capsman I was configuring with wsap and cAP AC. I noticed some of the interfaces were labeled with "i" (inactive) on the winbox list. I disabled the DFS on the configuration and that solved the problem. If your APs are close to each other and DFS enabled the...

Caci99

Support got back really fast. No wonder. Memory leak in "long-term" (previously "bug-fix") branch is ridiculous failure of their QA team. I find it sad if we can't rely even on the most stable branch. Maybe its time to offer money for better support? If the fee is reasonable, I ...

Caci99

Hello emils,
I did try your suggestion without waiting for Monday to contact the other part and it worked

Thank you
Now back to wiki to understand better what level=unique means

Caci99

The other end is a watchguard firebox.
I can not try this today unfortunately, only from Monday.
Will come back with results.

Caci99

Hello I am trying to build an IPSEC IKE1 between two peers. One of the peers has two networks: /ip ipsec policy src-address=192.168.1.0/24 src-port=any dst-address=192.168.0.0/24 dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=90.90.90.90 sa-dst-a...

Caci99

Is it ok that we have < 3 MB of free space on our 16 MB devices after update?

It depends on your files, for example on mine Hap ac lite there is nearly 4MB. On these boards the update package is saved on RAM instead of HDD.

Caci99

This is the end Mikrotik! Regulation got u by the balls. With antenna gain and TX limitation there is no way to use Mikrotik wireless devices anymore unless u stick to a version prior to these awful changes. Even if I would tend to see the root of these changes outside of Mikrotik the devices are c...

Caci99

why not just change the country to "no country" instead of switching to regulatory??? Let me guess... Because someone set 'country' value for some reason? :) Of course, because as long as the rules were respected, many ISPs like me respected them, now that the collapse is now total, we ha...

Caci99

You are right that there could have been two ways to adjust the inaccurate setting for some users. We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already. I've CPE scheduled to autoupgrade via scheduler script "/sy...

Caci99

The PWR AP is an interesting product, but I would love to see it in 5GHz instead of 2.4GHz. We are slowly starting to ditch 2.4 APs in every solution. How to you limit the area of coverage of this product? If it is transmitting through power lines, what stops it to go to the neighbor apartment? . P...

Caci99

The PWR AP is an interesting product, but I would love to see it in 5GHz instead of 2.4GHz. We are slowly starting to ditch 2.4 APs in every solution.
How to you limit the area of coverage of this product? If it is transmitting through power lines, what stops it to go to the neighbor apartment?

Caci99

I decided to update my hAP ac Lite to 6.43.7 today. It is running for more than 12 hours now and I haven't noticed any message in the log about this issue. I don't have a remote syslog to save all logs, but it looks like the issue is solved. Also, looking at versions change log Mikrotik has made som...

Caci99

Well, receiving a packet with same mac address is definitely a loop. The issue here is how to analyze the loop apart from the obvious checking mac addresses of the interfaces. In my opinion this is related whenever you have bridge interfaces created, be it STP, RSTP or none. The learning of the mac-...

Caci99

I encountered this weird issue today as well. I was trying to add to the Capsman running on RB2011UiAS-2HnD its own wireless interface. Bridge was created with interfaces from eth2 to eth10 in it. The reason why you see "removing stale connection..." in logs, is because the Cap disconnects...

Caci99

Just select parent option on the simple queue, it is on the second tab of simple queue configuration.

Caci99

Hello
Has anyone had trouble with netinstall after enabling dhcp snooping on the bridge?
In my lab, router can not find netinstall server every time I enable dhcp snooping on the bridge. This has happened on two types of routerboards acting as switches, one was RB1100 and on the CRS112-8P-4S.

Caci99

I think I got it guys. Started a new CAPsMAN from scratch for testing.
I think I had it wrong on defining slaves on provisioning configuration. Will test a bit more and let you know how things go.

Caci99

Config on CapsMan: /interface bridge add name=bridgeCAPS auto-mac=yes add name=bridgeGuest auto-mac=yes /interface bridge port add bridge=bridgeCAPS interface=ether2 add bridge=bridgeCAPS interface=ether3 add bridge=bridgeCAPS interface=ether4 add bridge=bridgeCAPS interface=ether5 /caps-man datapat...

Caci99

Did you guys managed to get this done?
When I set Virtual AP to CAP they will cause the real wireless interfaces to be excluded and deactivated. I am trying this on Ceiling AC with Hex as Caps manager.
Basically by adding any virtual AP none of the interfaces will join Caps Manager

Caci99

Either way is my request unreasonable? i.e. a route with check-ping should only become active if the gateway IP is ping-able? No, not unreasonable at all :). It should become active only if ping is successful. My suspicion though (since I haven't tested such a thing), is about the ethernet link. As...

Caci99

It is a seamless process, I have done many with desired result and no issues. That is why I recommend to start with a basic setup with only one host per link to check. Also, why should the interface of the modem go down? The modem might lose connection but the ethernet link should remain up. I suspe...

Caci99

This is how I see it: add comment=CABLE distance=1 dst-address=208.67.222.222/32 gateway=67.253.120.1 scope=10 add distance=20 dst-address=208.67.222.222/32 type=blackhole add comment=CABLE distance=1 dst-address=1.1.1.1/32 gateway=67.253.120.1 scope=10 add distance=20 dst-address=1.1.1.1/32 type=bl...

Caci99

On your first part of post, where you have the printed route table, there are 4 routes with destination 0.0.0.0/0 which are the routes to the internet. I don't see the rules for these on the second part where you have posted the export of the route table. From what I can see on the first part, you h...

Caci99

Post your routing configuration, it is not easy to understand without looking at it.
I suspect you have defined interface as gateway instead of IP address.

Caci99

For those who can not advance past version 2.4, I got word from support and they have introduced a dhcp client at version 2.5 so very probably the switch gets an ip address from dhcp server and no longer answers to the default ip. No I feel dumb :), I should have checked my dhcp server for new lease...

Caci99

It is a strange problem indeed. I can upgrade up to 2.4, after that it is impossible to upgrade.
I will write to support a bit later and see what they have to say.

Caci99

Try pinging to internet, that's where you'll have a worse jitter. Also, moving pppoe to mikrotik will help with that, modems CPU are not ideal, while the routerboard will definitely handle it better.

Caci99

If you are not noticing any drop in pppoe connection while it is configured on the mikrotik (after the wireless link) than your wireless link is pretty good. About the voice drops, those are very sensitive to latency and more to jitter. You need to monitor them and configure some QOS to optimize for...

Caci99

Every time in such cases I recommend to put modem in bridge mode and let mikrotik handle the pppoe. There are two advantages at place, first you have only one NAT node, and secondly the processing power of routerboard is far better than that of a modem. PPPoE is senstive to the wireless, meaning any...

Caci99

RouterOS version 6.42.2 has been released in public "current" channel! Before an upgrade: ... 3) Device has enough free storage space for all RouterOS packages to be downloaded. ... You might remove that warning about storage available, it is confusing for people I believe. There are rout...

Caci99

How it works: The vulnerability allowed a special tool to connect to the Winbox port, and request the system user database file. They gain access on a file within the router, right? What kind of information is stored in there? You don't know what is stored in the system user database file ???? :lol...

Caci99

How it works: The vulnerability allowed a special tool to connect to the Winbox port, and request the system user database file.

They gain access on a file within the router, right? What kind of information is stored in there?

Caci99

I use firewall rules which will kick an IP address if login fails after three attempts. Will this method be sufficient to be protected from this vulnerability?

By the way, thank you for letting us know about it.

Caci99

Moving the focus on the password field while you're browsing the managed list does not make sense to me. The purpose of having the managed list is to save the credentials of your own routers along with their addresses, so moving to the password to insert the password does not make sense, I already h...

Caci99

Caci99 - User Manager is a separate package which can be installed on your device running RouterOS. Support for MMIPS and ARM platforms was added in 6.42rc versions. You can now test it if you are willing to try out rc version and, of course, you will be able to use it also when 6.42 and later full...

Caci99

UserManager can be run on ARM now. What ROS is needed to run it, or is it a separate package?

Caci99

Confirming. When you select an item in 'Managed' list, WinBox copies credentials to the text boxes in the top of window and moves focus to 'Password' field for some reason. That's not what I'm expecting :) Yep, I see it now after chupaka post what you guys meant. Winbox moves focus to password fiel...

Caci99

i cant show it with video. please open winbox with many saved adresses. i have 48 items in my address book. mark one and try to scroll up-down with the mouse wheel. it does not. with 3.11 was possible.

Using Win7x86, it works for me

Caci99

You clicked on the Note header to cause it to be sorted by Note. Click on the column header you want to use for sorting, you can sort on 2 different colums this way. This is indicated by the arrow in the column header. It is not that. The sorting on the Note column somehow is not behaving as it sho...

Caci99

Having trouble since a couple of days ago sorting saved routers by "Note" column. Using winbox 3.11 on Win7, but being using it like this for a long time and did not have this issue. Now that I'm trying to add a new router and a note for it, will put it always last, unless I add a 0 before...

Caci99

Is there any other service running on PC which may block the port of Netinstall (I can't recall on which port Netinstall runs)? I have had this issue with Acronis Snap Deploy before. I have seen scenarios, not with netinstall but other cases, when auto-negotiation does not work as expected, so tryin...

Caci99

Strangely enough, today the winbox 3.11 was reported as virus form Avira, containing traces of TR/AD.Swrort.absza. This has to be a false positive, I have being using winbox 3.11 since when it came out with the same antivirus protection. An update of Avira might have caused the problem.

Caci99

Hey. Better make dhcp pool with IP's which in address-list range.

That won't cut it. Devices connecting to dhcp server are from different people with different rules to be applied. I can't put them all on the same pool, unless I can differentiate them by dhcp option

Caci99

Hello Is there a way to add a particular dhcp client at an address list? There is a script option at dhcp server to be run when client gets ip address, but how to make it run for a particular set of clients instead for all. Maybe using dhcp option? But I am not that familiar with those and how to ru...

Caci99

It's important to note that this is a client vulnerability - patching your router / AP does not prevent the attack from working on connected devices. You need to update almost every device that has WPA2 support. Which means every device :) ( I guess every one secures wireless connection on WPA2) If...

Caci99

okay the graphing tool does monitor data and kinda everything but only inside the router what goes in and what goes out. but it doesn't tell what and how much data went to let's say to nano station #1 or how much nano station #2 has uploaded . that what i want to monitor . To acquire data from Nano...

Caci99

So what does this mean exactly in general? Can the password be stolen? How has Mikrotik fixed it, if it is the protocol itself who is vulnerable?

Caci99

Try to configure it as any router and just do net mapping for IP = 10.2.3.55
https://wiki.mikrotik.com/wiki/Manual:I ... :1_mapping
You will assign two IP on the WAN interface, 10.2.3.253 and 10.2.3.55 and than do net mapping.

Caci99

I don't know much about ubiquity devices but on mikrotik side you can activate the graphing tool built in the Router OS. Though with every reboot you will lose the graphing. If you don't want to lose the graphing data you can use dude to monitor it or NTOP. NTOP would need to activate traffic flow o...

Caci99

Will the Woobm work as client device on desktops or laptops to connect them to an AP?

Caci99

I do usually add these rules on firewall filter, got them from wiki: add action=drop chain=forward comment="Drop invalid packets" \ connection-state=invalid disabled=no add action=drop chain=input comment="" connection-state=invalid disabled=no add action=drop chain=output commen...

Caci99

So, router was accessed using it's private IP, right? That means he knows port forwarding of core router. I bet he knows password too, how he does it's another story. In ten years I have worked with mikrotik, since ROS 2.9.x , I have never encountered a case where routerboard was compromised with ju...

Caci99

Are you reading logs from router memory? it can not save more than 100 lines, so maybe there are previous attacks which you can not see.
Also, look at this:
viewtopic.php?f=21&t=119308

Caci99

As long as all of the traffic is passing through the router, PCQ will work.
It depends on how you have configured it.

Caci99

When you set exchange-mode=ike2

got it

Caci99

Guys, a dumb question, but ... how can I understand if I'm using IKEv2 or not?

Caci99

https://mum.mikrotik.com/2017/LA/agenda/EN

Caci99

Netmap
https://wiki.mikrotik.com/wiki/Manual:I ... :1_mapping

Caci99

Your mikrotik router is behind another router, so you are basically double nat-ing. The first router must have a nat config which sends the request to mikrotik IP 192.168.1.2 on port 33000. Is it so? Also, from your posted rules looks like the ones for this port are disabled. Have you enabled them w...

Caci99

Take a look at this topic
viewtopic.php?f=13&t=87565&hilit=month+data+limit
It might be a good start what you are looking for.

Caci99

This is less and less of an issue these days, as most devices connecting to a hotspot are smart enough to automatically issue a regular http request and if it's redirected, present the user with the login page. Not at the moment though, there are still a lot of devices which don't do that, which gi...

Caci99

Hi Guys, Finally after long forum reading and googling, I am able to work with SSL and HTTPS sites. I will post all the details after few other test and post a video also if its a 100% success. Finger crossed. https://youtu.be/gth9SG_O8j0 That video didn't show that much how were you doing it. Can ...

Caci99

To start the SSL connection, doesn't the browser need first to connect to the server? By sending a request for connection, isn't it visible to the router on port 443 and as result redirected to hotspot login page? What am I missing here? When the client wants to connect to https://google.com, the c...

Caci99

I am a bit in the dark here.

To start the SSL connection, doesn't the browser need first to connect to the server? By sending a request for connection, isn't it visible to the router on port 443 and as result redirected to hotspot login page? What am I missing here?

Caci99

That is a lot of simple queues you would need to create for each customer. Mikrotik says that they have improved a lot the performance of simple queues, but I haven't tried it in real world since I am a lot more comfortable with queue tree. The good thing about queue tree is that all queues are tre...

Caci99

The good thing about queue tree is that all queues are treated at the same time, while with a simple queue the packet must check them all in their order until it matches the one which deals with it. To my knowledge, this is totally wrong. The current implementation if Simple Queues uses hash-table ...

Caci99

That is a lot of simple queues you would need to create for each customer. Mikrotik says that they have improved a lot the performance of simple queues, but I haven't tried it in real world since I am a lot more comfortable with queue tree. The good thing about queue tree is that all queues are trea...

Caci99

They each get a simple queue created dynamically when their PPPoE Connection is authenticated through RADIUS. Because they are dynamic, I can't do more than pick what Queue Type will be used. You mentioned that customers are dynamic and thus you can't apply the queue to your needs, so I offered an ...

Caci99

Well, you know that to have priority work it needs a reference, meaning queue1 has higher priority to queue2. That's why the queues need to be related as in queue tree. When they re not related, it is not possible to apply priority. In case of pppoe users, do not set limits on the profile of users, ...

Caci99

Keep it as I posted it. By using 8.8.8.8 or any other live host (all the time accessible computer on the internet) as your gateway you are actually checking by ping this host and not the gateway of your ISP. This will solve the problem when connection to your ISP is working but connection to interne...

Caci99

If the configuration is as you have posted, then it is wrong. The right one should be as follows /ip route add dst-address=8.8.8.8 gateway=1.1.1.1 scope=10 target-scope=10 add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=1 check-gateway=ping add dst-address=0.0.0.0/0 gateway=2.2.2.1 distance=5 Thi...

Caci99

It depends on how much bandwidth you want to pass through the router, and what level of QOS will it have if any. Also how do you connect to it from the remote locations, are you using any IPSEC? You see, almost any router of MikroTik can do that with PCC configuration, but the power of the router sh...

Caci99

as i know windows support l2tp

Windows does support l2tp, but only with ipsec. You have to change something in windows register to be able to connect to a l2tp server without ipsec. Maybe the same goes for android.

Caci99

Are you trying to connect via l2tp a windows device? If I recall it correctly, windows does not support l2tp without ipsec.

Caci99

Thing is, both pppoe and dhcp clients will find the server by broadcast packets. The way you have created the network, if the two routerboards have arp=proxy-arp in their bridge interface, means that every device is in the same broadcast domain. So every device will find either server 1 or server 2 ...

Caci99

Well, put the IPs you want to bypass the rule in an address list and then create rule with action=accept and source the address list and put this rule above the one you created for block. But in future, you better post the rule you have created to see how you are approaching it, so the answer can be...

Caci99

AP in every test is TP-Link? If moving your AP 20m away gives you a hooping -40 in signal and better performance, it means there is either an alignment issue (i doubt it given your capabilities) or interference. Someone must have put something which greatly disturbs your signal path. I would recomme...

Caci99

1km distance with a 24dbi antenna and -69 signal? That is low, would have expected something below -60. The behavior is typical of interference scenario. How is the line of sight, any kind of obstruction? Even leafs of trees can cause problems. Have you tried changing the frequency, change to superc...

Caci99

chain=output is for traffic outgoing from the router itself. Try to mark in mangle and see if it helps.

Caci99

Connection to router shouldn't, and doesn't look, be influenced by your policy routing in mangle. What is probably happening, is that you are sending request to WAN2 but router chooses WAN1 as gateway. In the routing table, put the gateway of the connection you need as default, with smaller distance...

Caci99

If you can't log in there is no way to access the router. The only way would be, as you mention, reset or netinstall.
But anyway, how come you left it with default credentials, changing username and password should be the first thing to do on a routerboard.

Caci99

Post how you are creating those address lists, they look dynamic so it maybe the changes are normal because it depends on how the lists are created.
Also, post your configuration of policy routing to see how traffic chooses one gateway over another.

Caci99

You have misunderstood that article completely. What is achieved through that method is using an external, not on your network, as gateway through recursive routing. By doing this, you can rely on check gateway by ping to see if gateway is up or not. Basically, if your gateway is 192.168.1.1, using ...

Caci99

Look at the the registration table and the data rate of connected clients, you can deduct by that.
But I believe B is very old and very very slim chance there is still any device around.

Edit: andriys beat to me it

Caci99

The product is very nice, but I don't know why Mikrotik is putting that kind of default configuration where you can't connect from ethernet, same as with mAP-lite. It is frustrating trying to connect with it. A 5 sec job turns into 5 min. Not every one has in their labs laptops. So the only way for ...

Caci99

Guys, this topic has got away from its main subject. The whole point of this topic is to have the ability to download all files of all architectures (mipsbe, tile, ppc, etc.). This is what is asked about a year ago. Whether it is a torrent or a file from http makes little difference. Some of us have...

Caci99

13 ;;; WAN1 3/0 chain=prerouting action=mark-connection new-connection-mark=WAN1_conn passthrough=yes dst-address-type=!local src-address-list=!vpnusers dst-address-list=!vpnusers in-interface=bridge-local connection-mark=no-mark per-connection-classifier=both-addresses-and-ports:3/0 log=no log-pre...

Caci99

It's all about how you configure the PCC. You can't possibly load balance providers which have different factor. If one is giving you 160/20 the other 80/40 it just can't be load balanced at full use. One has a ratio of 8/1 the other 2/1.
Post your PCC rules and see how packets are divided.

Caci99

Does it have full routerOS functions? Yes it does, but keep in mind it is a small device so no fancy configurations (vpn, vlan, bgp :) ) I'm wondering if after initial setup I can place it in station mode. Is it possible to use map-lite's ether port to connect the device to wifi ap? Of course you c...

Caci99

Hi, Caci99 just one question, anyway to test PCC works or not? I mean i need to know traffic are both going through WAN1 and WAN2 equally, or most are. Thanks In a day average it would almost equalize, but the most important is the packets average because different connections would have different ...

Caci99

Hi, @Caci99 The router runs well today, i may do more configuration test tomorrow. 1. add both port forwarding and uPnP to this router, then VPNs (OpenVPN, PPTP, IKEV2...) on both WANs. 2. Stick clients (or certain inside lan IP, ports, mac) to use dedicated output WAN route. 3. Automatic block IP ...

Caci99

It works! I re-worked the mangle rules as you typed. Then, rechecked the masquerade rule, modified it from /ip firewall mangle add chain=prerouting out-interface=ether7-wan1 action=masquerade add chain=prerouting out-interface=ether8-wan2 action=masquerade to /ip firewall mangle add chain=srcnat ou...

Caci99

ok, i removed the pcc part fo first 2 mangle rules as you mentioned. But I still can't ping 8.8.4.4 from my laptop, while passed from router, there must be something wrong on ether the route rule, or the mangle rules. Thanks. Ok, let's try with rules order and disabling the first two rules: /ip fir...

Caci99

The first two mangle rules, remove the part about per connection classifier: /ip firewall mangle add chain=prerouting dst-address=112.65.129.176/30 in-interface=bridge1 per-connection-classifier=both-addresses:2/0 add chain=prerouting dst-address=140.206.103.132/30 in-interface=bridge1 per-connectio...

Caci99

My 2 WANs come from same ISP with exact same bandwidth and latency. That's very good for PCC For the masquerade, i do intend to use src-nat method cuz i have static wan ip, hope it should be better than masquerade. Choose which one you prefer, it is basically the same. if i set dhcp server running ...

Caci99

First, how are the two connections provided to you in term of bandwidth and latency? If they are not symmetrical you will have problems. With symmetrical I mean they should have more or less same latency and equal down/up or one has to be the factor of the other down/up. Second, dns servers should b...

Caci99

By default, you are only able to access the router through wireless interface as it is stated in the quick guide. The logic behind that is the ethernet goes to wall (ISP) and users are connected to wireless. Fair enough, but you have to consider that a lot of people still use ethernet for configura...

Caci99

I just put my hands on this device and it is very nice. Still figuring out the range of use of it, it is to be considered as "mobile" wireless device rather than a fixed one, although it will serve as a fix AP very well. Anyway, my problem is with its default configuration. In a device whi...

Caci99

If you see counters running in mangle than that config is working.
As for the queues, don't forget to specify limit-at and max-limit of the queues. If you leave them 0 they will not work.

Caci99

Good, that's the way to start getting help :), try it first and post your config. Now to the point, first it is important that wireless interface named qbtcm is not part of any bridge interface. I will assume it is not. Second, your mangle seem correct to some extent, but I would mark connections fi...

Caci99

It is not about copy paste, is about understanding the example and then implement it on your network. First, you should start with marking packets coming and going from your wireless interface in the mangle. Then those packet marks are used in the queue tree using the pcq type you have defined. If y...

Caci99

PCQ is the way to go. You can check on the wiki page some examples on how to implement it to your needs, like:
http://wiki.mikrotik.com/index.php?titl ... edirect=no

Try it out, and then post your config in here if anything does not goes to plan.

Caci99

What is your masquerade rule?
Try to set the masquerade rule with out-interface=WAN only, if it isn't already like that.

Caci99

I have wrote it before, but I will repeat it. The situation is as @kgninfos describes it. You give CPE for free to new customer (or whatever deal you are offering), than competition arrives and offers him a better deal using the CPE. Customer is unaware of what is behind, he is just looking for the ...

Caci99

Try netinstall as @pukkita already suggested. Otherwise contact mikrotik support (although might take a while to get an answer since it is holiday season)

Caci99

Well, your max limit is 1M/10M. 10M should be the download, but it depends on which interface the queue is attached. I suspect that the queue is attached to the WAN so by definition the download is the Tx of the interface, and Tx on the WAN interface is actually the upload from your point of view. S...

Caci99

What is the firmware version of the routerboard? Have you tried to update it?

Caci99

There is always a slim chance that something can go wrong (unfortunately) but not much to be worried. I would recommend these steps: 1. Backup your config using export command from terminal. 2. reset the router with no defaults. 3. update to legacy ROS, 5.x I believe. 4. update license and then firm...

Caci99

If the routerboard is in remote, I would not recommend the update because it is a huge jump in OS version and it can go wrong. If it is on your desk, you probably would need first to update to ROS 4.x or 5.x (check the legacy on download page) because the 3.10 has still the old license system with 7...

Caci99

This will involve queue tree, address list and mangle. In the pppoe profile do not create limits, instead add the users to address lists which would represent the packets you are offering to the customers. Address list for 256kbps users, for 512kbps and so on. Then, use mangle to mark traffic from t...

Caci99

What could be the use of this TR-069 in MikroTik? Never heard of it before.

Caci99

What are you exactly experiencing? From those rules I can see that network 10.0.0.0/8 will always connect, you are accepting connections from that network. That means IPs form 10.0.0.1 to 10.254.254.254 can connect. The timeout of the blacklist is only 3 minutes, so after three minutes every IP on t...

Caci99

With policy routing. Mark packets in mangle: /ip firewall mangle add chain=prerouting in-interface=LAN src-address=192.168.1.0/24 action=mark-connection new-connection-mark=network1 add chain=prerouting in-interface=LAN src-address=172.16.16.0/24 action=mark-connection new-connection-mark=network2 a...

Caci99

I have written to support a couple of weeks ago about this issue, and they answered that they will look at it and fix it later. When, they didn't specify :) I wrote to support again a couple of weeks ago, and yet no fix has been introduced to this problem. I believe the fix is not coming soon. It m...

Caci99

If you change the distance manually it is obvious that you have to do it manually again.
But you better post here your IP configuration and your route configuration. Also, what kind of connection are you using to connect to the internet (pppoe, dhcp, IP)?

Caci99

Try this rule: /ip firewall filter add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.vimeo.com" /ip firewall filter add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.netflix.com" And move this rules to the t...

Caci99

3. Turn off some or all of the lower data rates. They'll hog airtime if clients end up using any of them. Turn off the lower data rates? That's the first time I hear it. Or do you mean the "802.11b" data rates? be careful with kicking clients when they fall behind some signal level, some ...

Caci99

You can limit max number of stations which can connect to an AP, together with limiting the minimum signal should be enough to provide reasonable WiFi service. Keep in mind that you want to limit signal from client to AP, as per your post I would understand that you want to limit the signal strengt...

Caci99

In my area there is an increasing demand of using multiple Access Points in one place with same SSID capable of serving 100 or more customers. The area to be covered are usually conference rooms, halls, big entertainment buildings, etc, meaning customers come and go, so no need to use any radius or ...

Caci99

So you instaled all this in the same room/hall or more than two in the same room? Allow me to :lol: With all due respect, I don't think there is anything to laugh at it. Everyone learns a lot of things the hard way. As a bad experience as it is, it is nice it was shared so other will know what not ...

Caci99

Try this: /ip firewall mangle add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=wan1 add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=wan2 add chain=postrouting connection-mark=wan1 action=mark-routing new-routing-mark=wan1 passthrough=no add ch...

Caci99

V6.2 on CCR1036-12G-4S .
customers are connecting statically. all the ARP table are dynamic.

It depends on the timeout of a dynamic arp entry then. I don't know the timeout of arp in mikrotik (but I guess it shouldn't be long). Do you see them after a long time they have been disconnected?

Caci99

What routerboard are you using? Are the customers connected to the router in any particular way (dhcp, pppoe, etc..)?
The entries in the arp table are dynamic?

Caci99

I don't know if it is already reported.
When you lose connection to a routerboard the window of the winbox3.xrc moves to the top left corner of the screen, instead of preserving the same position. Using Windows 7.

Caci99

There is still a problem with connection bytes and connection rate when used together. I am using this feature from long time to divide the "heavy traffic" from "normal traffic". But since version 6.30, I think, it is not working anymore. The rule is something like: chain=forward...

Caci99

What is the CPU value at the moment when this happens?
When you say latency is high, you do ping from LAN to the router or from the router to LAN?
I suspect there might be another device with the same IP of the router on the network which is responding to the ping, causing conflict.

Caci99

Nice you found a way out of it :) The 2011 has less RAM and CPU then 1100AHx2, so it could be hardware related. This can be easily verified by looking at system resources on the 2011 (although I hardly believe you have reached the ceiling of the resources of it). Otherwise it could be software relat...

Caci99

I think there got to be something on the log, it can not be all ok. Weather it is a problem when creating the tunnel or when trying to get the IP. If the IP are handled by radius, try once to assign the IP from the router itself.

Caci99

Activate the log for pppoe in /system log and check what the log says about it.

Caci99

What IP pool are you using? Are there any more IPs available in the pool?

Caci99

please fix connection-rate problem in next bug release!

http://forum.mikrotik.com/viewtopic.php ... 12#p495212

Second this, it is not working any more. I noticed this since version 6.30 (but might have happened before).

Caci99

Everything is crack-able. As @43north said, stay off the net if you want security. Just a couple of days ago I was reading how in Israel managed to compromise an "air gapped computer" by using cell phones for experimental purposes. So, if somebody is on to you, they will eventually get the...

Caci99

You can create a new queue by duplicating the "ethernet-default" and naming it as you wish. Increase the size from 50 to 100 for example and assign the created queue to the interface and see if this will help or not.

Caci99

Probably those packets are dropped by any queue you might have in. If you don't have any queue then they are dropped by the default queue of the interface. Increasing the size of the queue might help, though it will increase the latency.

Caci99

On the hairpinnat rule, try removing the destination port:

chain=srcnat action=masquerade protocol=tcp src-address=192.168.0.0/24
      dst-address=192.168.0.248 out-interface=bridge1 log=no
      log-prefix=""

Caci99

I don't know what is it, but... why doesn't these connections get marked properly? 90% connections get marked properly and behave as expected, w/o these "stalled" connections. Then, amongst the "stalled" ones, only a 5% of these Unreplied, TCP state established "orphan"...

Caci99

This is a topic about understanding very well ip tables, which I don't :). Anyway, an established connection is not the same with an established tcp. What could be happening is, if the client closes the http connection without sending an ack packet (or something like that), so the router considers t...

Caci99

In /ip service you can see the www-ssl service. But you would need a certificate to establish a connection I guess, otherwise there could not be encrypted connection without it.

Caci99

/ip firewall mangle add chain=prerouting src-address=192.168.10.0/24 action=mark-connection new-connection-mark=conn1 add chain=prerouting connection-mark=conn1 action=mark-routing new-routing-mark=conn1 passthrough=no Same for network 192.168.20.0/24 /ip route add dst-address=0.0.0.0/0 routing-mar...

Caci99

I tried (as mentioned before) such script: :foreach i in=[/ip firewall connection find tcp-state=established assured=no] do={ /ip firewall connection remove $i}; But it does nothing. How can I automatically remove such records? Try putting instead of assured=no seen-reply=no My guess is this are in...

Caci99

Post your firewall filter to have a look what is causing the block. Normally the firewall filter is blank, which means nothing is blocked through it, unless you have preserved the default configuration, or you have added some of your own. From where to where is the person trying to print? Are the tw...

Caci99

As you said, you need to configure the wireless router as bridge transparent.
Create a bridge interface with arp=proxy arp. Add to this bridge the wireless and ethernet interfaces. Remove NAT from it, and check on the second router if you can connect to the pppoe-server.

Caci99

It really depends on what level of security you want to achieve. When blocking all incoming connections, one should be really careful to specify the incoming interface, otherwise you would be left out of the router. Yoy may have a look at: http://wiki.mikrotik.com/wiki/Securing_your_router http://wi...

Caci99

Thanks..

but i still need a clear answer.

Regards

Well, the clear answer is contact support.

Caci99

I believe you would need to contact support for that. Mikrotik does not give Level 3 license if you do not order less than a 100 I think.
But why would you need a Level3 anyway, any routerboard would come with at least Level3 installed.

Caci99

I suspect that all pppoe connections are part of the same network from the point of view of your provider. Looking at the last route you have posted: 4 ADC dst-address=10.0.0.1/32 pref-src=86.122.51.229 gateway=rds_acc50_229,rds_acc50_228,rds_fb100 gateway-status=rds_acc50_229 reachable,rds_acc50_22...

Caci99

First of all, I would suggest to turn the modem into bridge and let the RB750 do the pppoe-client and routing since it is far better this way, although this is not related to your issue. For your problem, I would use connection rate. The problem with torrents is that it is almost impossible to ident...

Caci99

I guess you have tried the default credentials to login (admin and no password) in case the RBs have reset themselves. If that is not the case, I don't think it is possible to change the password without having access to the RB. Unfortunately there is no way to reset the RB without using netinstall ...

Caci99

You would need access to one router with Public IP. Then, from the router of your friend, create a VPN tunnel giving IP address on the first router with the Public IP. From there you can use dst-nat to access whatever device you want. For example, you have a router "A" with public IP 1.1.1...

Caci99

Most probably those are rules created by upnp. Disable it and you will not have any more dynamic nat rules. There are softs and devices who are designed to discover if there is upnp supported by the router and create rules at their need.
Menu for upnp is /ip upnp

Caci99

Use /export file=whatever and then copy the file to desktop.
For example
/ip arp export file=arp
/queue simple export file=queue_simple

Caci99

I have written to support a couple of weeks ago about this issue, and they answered that they will look at it and fix it later. When, they didn't specify

Caci99

I compared contents of the software and was disappointed.

What is there to be disappointed. It is a small device with little RAM. Do you miss NTP server on a home router? Than you can always chose RB951Ui-2HnD

Search found 1089 matches