MikroTik

MangleRule

my own biological family with 70+ 80+ year old family members have at least one time said something to me clear as day that they do not accept that I am a human, but I could be a human if I did what they tell me to do, but I didn't, and they blocked me, so I am not human according to them, lol, but...

MangleRule

The VLAN tagged and untagged fields are comma separated values. So if you want to build up a comma separated list you can do something like this. { /interface ethernet { :local SFPInterfaces [ find default-name~"sfp*" ]; :local InterfaceList; :foreach i,Interface in=$SFPInterfaces do={ :lo...

MangleRule

If you are trying to login using an IP address, there is a firewall rule or something blocking your access if it doesn't respond. RoMON is independent of layer 2 and layer 3 configuration which is why you can login with RoMON.

MangleRule

I should have linked this video: Tomas Kirnak - Load Balancing / Mangle Deep Dive

MangleRule

I have tried to follow the official documentation and configure my rb2011 il-rm but it does‘nt work. Would someone help me and assist me to make load balancing into this appliance to have this result .. WAN1 (200Mbps) + WAN2 (200Mbps) = OUT (400Mbps) Nb: The configuration of rb2011 series that i fo...

MangleRule

That is odd that your camera is phoning out like that. You should just adjust the rule so instead of dst-address=!192.168.88.0/24 just use out-interface=<wan.interface> (Change <wan.interface> to whatever the port going to the internet is).

MangleRule

Does anyone know if the hAP ac² can do WiFi Access Point and WiFi bridge mode in the same time? Well the hAP ac² has two wireless cards, 2.4GHz and 5GHz. Are you talking about using one of the cards (2.4GHz for example) to connect to another SSID as an uplink as well as broadcast it's own network o...

MangleRule

Great news SOB, i implemented a variation of your rules with some others and despite having my IP Routes reachable on both internet and email, I dont have internet or email connectivity LOL. I am trying to figure out why but dont see anything obvious. If I get desperate I will ask for help............

MangleRule

And i do know how snat and dnat work, thank for the explanation though. I was just stating that your suggestions about Masquerade was coming from left field here and was the opposite of the requirement. Mikrotik firewall is very basic when used to working with iptables. I mean.... iptables are very...

MangleRule

That doesn't really help much, that is just a plain torch. You just need to set the Dst. Address to the openHAB server, if you know the port that it uses for the app to communicate to the server add that under the Protocol and Port as well so you can see if the traffic is even reaching the openHAB s...

MangleRule

if each vlan has its own gateway which is the router why not use the router as your DNS server and allow incoming traffic on each vlan to destination port 53/udp (the router) otherwise just allow incoming on each vlan with destination any udp/53 and in nat create from source desired vlan for all tr...

MangleRule

So in conclusion thanks to Sob:

/ip firewall nat 
  add chain=dstnat protocol=udp dst-port=53 action=redirect
  add chain=dstnat protocol=tcp dst-port=53 action=redirect

MangleRule

Okay last time I will list the list on this thread........... One question though remains, when looking at the TO address for the NAT DSTNAT rule for DNS, How would I best handle the fact that I would have multiple router LANIP gateway addresses. Consider each LAN or VLAN will have its own gateway?...

MangleRule

Are the device across the fiber the ones that can not communicate by chance?

MangleRule

So are you saying dont bother with such rules?? Regardless I am interested in how one would identify such trafffic using the mikrotik,,,,,,,, what combination of time and connections in the extra page would do the trick........... If you don't have multiple Gbps of bandwidth available, you can not ...

MangleRule

Interesting mangle. What do you recommend for dos type scenario. Option 1: tarpit input chain traffic - something about changing data package size being sent - not sure how it does this and to what traffic incoming or returning? Net effect I am told is slowing down the incoming? Option 2: Drop inpu...

MangleRule

The first thing I would try is connecting to the router with Winbox and running the torch tool and see what happens if you try to use the app on your phone while it connects to the PPTP tunnel.

MangleRule

Finally: Brain fart is there a reason why there is no DROP invalid rule on the INPUT Chain?? You should have a drop invalid for the input chain. Basically any packets coming in that do not have a connection tracking entry for it's source and destination and are not new connections, they are invalid...

MangleRule

They will have to use the DNS options I have setup in the router? With both rules, any traffic on TCP/UDP 53 will get the destination address in the packet replaced with the router's IP address so it doesn't matter what they set their machine to. If its the default for lan clients to go out their r...

MangleRule

First part is optional, you can skip to-ports and port will stay the same. But second part is the main point of action=redirect, it always changes destination to router's own address without a need to give a specific one. Oh cool! That is very useful, I probably should have checked the documentatio...

MangleRule

Run the following command so we can see what you have setup.

/export hide-sensitive

MangleRule

I just did a quick test. I ran a DNS query to google.com with the NAT rules in place and there were no hits on the rules. So the rules I listed above will have no effect on the router's self resolution for DNS.

MangleRule

when you state to addresses <routers address>did you mean the LANIP of the subnet? Exactly, so <routers.address> is just what I put in the code example to be replaced for whatever address is reachable on your router. By default, dhcp clients will use the gateway for any routes the host doesn't know...

MangleRule

Special note to anav, this thing is entirely optional and I'd say only needed for special circumstances. Feel free to ignore it. And this note is not meant as anything against MangleRule.

Even though redirect makes more semantic sense, unfortunately redirect can only redirect port numbers

MangleRule

You can setup a MikroTik Cloud Hosted Router on Amazon AWS and use that as a VPN concentrator. Then you can connect your device (laptop, phone, etc) to the VPN and also connect your MikroTik at home to the VPN to get remote access without a public IP.

MangleRule

DNS queries work over 53/udp, tcp is only used for zone transfers, first rule is correct second is wrong if you only accept established connections all new will be dropped, you can do output same as input just make sure to create an outgoing accept rule in output chain for connections related, esta...

MangleRule

I dare not to cheer too loud, but this seems to do the trick... Feel free to cheer safely, there is not really room for error with that setup. what do you feel/think when you all read this kind of questions? I just see an opportunity to help someone enjoy MikroTik and prevent some discouragement. E...

MangleRule

@anav : 1. What is the difference (which is better) between these two INPUT chain rules..? a. add action=accept chain=input in-interface=LAN protocol=tcp dst-port=53 b. add action=accept chain=input connection-state=established port=53 protocol=tcp Option A is correct. Option B: connection-state=es...

MangleRule

So to confirm you are saying we don't really need to state untracked (a very rare case only under our control - would require additional rules) The untracked state is usually set in RAW or in...... MangleRules :lol: Once a connection has been marked as untracked, all packets related and established...

MangleRule

What hardware do you have to use? I usually use a hAP AC Lite . Using the hAP AC Lite, I usually will setup my 2.4GHz interface as a wireless station. Then you just have to setup a dhcp-client on that interface to get an address from the hotel. In the MikroTik NAT firewall rules you can Masquerade t...

MangleRule

It sounds like you need to setup a bridge on your wAP AC. From the product page it looks like the wAP AC has a single ethernet interface and two wireless interfaces. # Setup a bridge for your interfaces /interface bridge add name=local-bridge # Add the interfaces to the bridge /interface bridge port...

MangleRule

dear r4z0r84 plz make video this setting and share plz i really need it What is the purpose of blocking the VPNs? What is suggested above is a terrible idea! Even if you force every client to use your VPN to get primary access, someone can just run a VPN tunnel inside of that tunnel and you are bac...

MangleRule

Please about this problem can you confirm the substitute command for this? # Setup a bridge for your LAN ports /interface bridge add name=local-bridge # Add your LAN ports to the bridge, by using hw=yes, it will leverage hardware offloading to the switch chip giving the same performance as master >...

MangleRule

You can use the TAB keyboard key to show all of options when you are in the terminal under "/interface wireless". MikroTik also has excellent documentation on their wiki which can be accessed here: Manual: Interface/Wireless . If you have any specific questions that are not available from ...

MangleRule

I tried "arp -a" in terminal, it found the only IP in local network: "(224.0.0.251) at 1:0:5e:0:0:fb on en0 ifscope permanent [ethernet]". Well, i cannot reach 224.0.0.251 from browser also. 224.0.0.251 is a multicast address so that will not have anything to do with the setup, ...

MangleRule

If you insert the power to the device while holding the factory reset button, you should get a blink on one of the LED indicators. This will factory reset the device. Plug into the device locally and open Winbox. Using Winbox, you should be able to connect to the device using the MAC address that sh...

MangleRule

/ip firewall nat add chain=dstnat action=dst-nat in-interface=ether-WAN protocol=tcp dst-address=192.168.0.1 to-addresses=192.168.1.15 dst-port=8080 to-ports=8080 With the above rule, it is stating that if any traffic comes in from the interface ether-WAN destined to the host 192.168.0.1 on port 80...

MangleRule

I'm glad to hear everything is working for you!

MangleRule

It would help to know your configuration as well as the current hardware you have. What speeds can you get through the router currently and what does your CPU look like while you push traffic.

MangleRule

Nice.
But you can't switch on/off or count particular protocols hitting your router.

Well you can just disable and enable the items on the address-list to turn them off and on. I guess counters would be the only downside.

MangleRule

I'm sure this will be useful to a lot of people! To keep the firewall tables from getting unruly it might be nice to get these into address-lists like "multicast.addresses" and have a single rule. It would make importing, extending, managing, and deleting these rules very simple. /ip firew...

MangleRule

So lets say for the example the following are true: Public IP: 122.x.x.x Camera IP: 192.168.1.15 Modem/Router LAN: 192.168.1.0/24 Your RB750Gr3 LAN: 192.168.0.0/24 The Modem/Router and your RB750Gr3 both have their own DHCP servers handling their LAN subnets Your RB750Gr3 is getting a DHCP address f...

MangleRule

Based on the above information you used the wireless mode "station". In station mode, you do not have layer 2 bridging so you need to setup a dhcp client on the virtual client for the router to get an IP address and access to the internet. Then you would need to setup a DHCP server for the...

MangleRule

To make sure I understand what you are trying to do, is the following accurate? You have two buildlings Both buildings have MikroTik routers with wireless cards You want to second building to be able to act as an access point as well as a client connecting to the other building using the virtual cli...

MangleRule

Can you diagram what your goal is with the configuration? It is much easier to help if you have a diagram with your subnets, vlan ids, and maybe a basic traffic flow example. Without a diagram to reference, we have to sift through your configuration to try to guess what you are doing.

MangleRule

You should not have two devices with the same IP address in the same network domain. You should just get a second RB750gr3 (let's call them R1 and R2). Setup LAN1 on R1 and connect that router to WAN1 Setup LAN2 on R2 and connect that router to WAN2 If you ever wanted redundancy, you can connect R1 ...

MangleRule

Can you run the following command and post it to the thread? It will make it easier for someone to get an idea of what you have setup.

/export hide-sensitive

MangleRule

All MAC layer processes are Layer 2 so your firewall is not going to help you with anything. If you want to "secure" the router you can use the following: # Disable MAC Telnet server on all interfaces /tool mac-server set allowed-interface-list=none # Disable MAC Winbox on all interfaces /...

MangleRule

When you say you want to extend the network and not lay a cable that sounds like a perfect use case for a Wireless Wire

They are already paired out of the box as a bridge. They beam-form so you just need to mount them on the side of the buildings.

MangleRule

Routers will not have much of an issue handling large amounts of leases. If you are handling 2,046 users though, you are going to run into problems over wireless (I'm assuming since you are doing an outdoor event this is about wireless). You have to remember that the access points, depending on the ...

MangleRule

Check out this presentation from one of The Brothers Wisp members Tomas Kirnak: Bandwidth-based load-balancing with failover. The easy way.

Tomas shows a few different approaches to doing this. Hopefully this will give you some ideas for your implementation

MangleRule

You definitely need to give more information here: What are your LAN subnets? Is the 192.168.1.100 address your WAN address? You need to be careful with Masquerade. Masquerade is basically a fancy source NAT used in topologies where your gateway IP address might change. So if you have a dynamic DHCP...

MangleRule

# Permit any forward traffic that has a destination NAT state. /ip firewall filter add chain=forward connection-nat-state=dstnat action=accept # Destination NAT any traffic on port tcp 23 to the host 192.168.1.30 /ip firewall nat add chain=dstnat protocol=tcp port=23 action=dst-nat to-addresses=192...

MangleRule

Assuming DHCP leases are coming from your LAN ether2, just bridge all of the ports as shown below. /interface bridge add name="local-bridge" /interface bridge port add bridge="local-bridge" interface=ether1 add bridge="local-bridge" interface=ether2 add bridge="loc...

MangleRule

You didn't really mention in the post but is your goal to provide wireless? If that is the case, the issue isn't going to be the DHCP leases, it's going to be shared airtime with that many clients. You would have to split those user up across multiple access points.

MangleRule

Realistically the only thing you can really do is setup the MikroTik as a cache DNS server and see what sites are getting queried. Anything further than that, most sites today are HTTPS enabled so the session is encrypted.

MangleRule

I would highly recommend not using Telnet over the internet without using some sort of encrypted tunnel like IPsec. Anyone could read your credentials in plain text and compromise the system you expose to the internet. I would suggest either setting up a VPN server on the MikroTik you are trying to ...

MangleRule

That is definitely possible. Once you have the SSTP tunnel up and running, you just need to setup some static routes. The SSTP server needs to know that 192.168.50.0/24 is available over the tunnel and the SSTP client needs to know that 192.168.1.0/24 is available on the other side of the tunnel. On...

MangleRule

RouterOS (MikroTik) isn't a RADIUS server, you have a local user database under the users tab to use locally on the MikroTik. The RADIUS server settings are for if you have something like FreeRadius setup to centrally manage users with a RADIUS server.

MangleRule

With an HTTP request, the client makes a request to the server, the server then sends a response that is plain text. There are systems that can catch that server response and inject javascript or HTML before it gets back to the client. With HTTPS this is extremely difficult because the client and se...

MangleRule

You wouldn't be able to do this with MikroTik. This type of injection only works on http enabled websites. More and more sites are now using https so it wouldn't work anyways.

MangleRule

MAC addresses are layer 2 so your firewall will not help you there. If you want to hide visibility, you can use the following commands: /tool mac-server set [find] disabled=yes /tool mac-server mac-winbox set [find] disabled=yes /tool mac-server ping set enabled=no You can also go into IP > Neighbor...

Search found 62 matches