MikroTik

Cameron Earnshaw

Do you know if this script will work with O/S V4.x or 5.x?

Cam

Cameron Earnshaw

I like this idea! I'm just curious how this has been working for you now that you have had a couple months to test it?

Cam

Cameron Earnshaw

I installed a new RB the other day that came with 3.14 installed. It replaced one running 2.9. We have several firewall rules in place that block ports 67 and 68 to keep clients on some bridged interfaces from getting an IP from the wrong subnet. It seems the old firewall forward rules aren't workin...

Cameron Earnshaw

Hi, It seems the documentation of the brouter feature is very limited and the V3 manual on the MT web site has nothing about bridges. Does anyone have an application example of how to set this up? I have two LAN and one WAN interface. I just want to be able to bridge some of the /24 subnets (for man...

Cameron Earnshaw

I'm not sure I understand. This is RB230 running OS V2.9.39, which is supposed to support this card. Wouldn't the driver be part of the package-- or are you saying that possibly I need to install a driver on the RB?

Cameron

Cameron Earnshaw

Thank you for your response Normis. The card doesn't appear on my list of serial ports. What package do I need?

Cameron

Cameron Earnshaw

This thread is a bit old now but I wonder if someone could tell me about installing the Novatel S720 card in the RB230. I have Level 4 O/S V2.9.39 and the card seems to power up OK (LED looks normal) but it does not appear in the list of interfaces. Is there some documentation on initializing this c...

Cameron Earnshaw

Does 2.9 support MLPPP protocol on Cycades T1/E1 interface?

Cameron

Cameron Earnshaw

OK, thanks. I guess it's time to start visiting clients.

Cameron

Cameron Earnshaw

Could it be accomplised with OSPF?

Cameron

Cameron Earnshaw

My network has grown and I feel I should start segmenting my /22 LAN subnet. I bought a 4-port nic for my Mikrotik and plan to assign each nic its own subnet and DHCP pool. Problem is I have some clients with static addresses all on one /24 subnet that will now be spread among five nics. Is there a ...

Cameron Earnshaw

Anybody having problems logging in to retreive aol mail from this page? We just helped a customer install a Mikrotik. No problem with his old soho router but they can't log in with the Mikrotik in place. I tried turning off the web proxy and no change. Other pages load fine. Any ideas would be great...

Cameron Earnshaw

I forgot to mention that I am also doing pcq. Maybe I should create a separate pcq rule for high-priority clients?

Cameron Earnshaw

If I want to give some users priority over others (according to their IP address) is it enough to do make a simple queue for each prioritized client, or do I also have to make separate rules for the other clients. Is it required to first mark the packets with a mangle rule?

Thanks,

Cameron

Cameron Earnshaw

I agree 100%... and then they have the nerve to tell you to rtfm when it's written the way it is! It is slowly getting better though. I'd rather have the present situation than something that has great documentation but is not affordable, so let's count our blessings that MT exists at all.

Cameron Earnshaw

Many of the phones and ATAs have two ports, so you can put the phone on the WAN side of the client's router. Even if you get it to work, QoS will be better if the VoIP doesn't have to pass through the client's router.

Cameron Earnshaw

Are you doing any pcq or p2p queues (using mangle)?

Cameron

Cameron Earnshaw

Tulley, what is your preferred NIC? Ours seem to be Accton/SMC. Also, what about the integrated NIC on the PC motherboard? Should we avoid using it? I would be a happy man if this problem could be resolved by changing NICs.

Cameron Earnshaw

Thanks Eugene. The explanations and examples here are much better than previous documentation. This is very similar to rules I was using already but I seemed to remember that in previous tests we found that each active connection was treated separately and that a user with many active connections co...

Cameron Earnshaw

I've been having this problem for weeks now with V 2.8.25 and find the problem goes away when I turn off pcq. I too have tried changing machines. I am now looking for another way to do traffic shaping. I am beginning to think Mikrotik O/S has become unstable but this is not a popular opinion to have...

Cameron Earnshaw

Is there a way to do queuing for individual IP or MAC addresses without making a separate simple queue rule for each address? PCQ does not seem to be a good solution as someone with several open connections easily circumvents the limits. Besides, this I find my MT frequently crashes with PCQ enabled...

Cameron Earnshaw

I still have web proxy running and no crashes since I disabled pcq. I have 1 GB RAM in this machine but I think maybe too many interrupts per second makes sense. My knowledge of this is limited but as I understand the problem actually gets worse as you add more memory. Maybe I would actually be bett...

Cameron Earnshaw

No reboots since I turned off pcq. Could there be something wrong with my configuration? Here are my mangle rules, mostly disabled now except for p2p. As you can see I have rules for p2p, pcq, voip and xbox. Am I just trying to do too much? 0 X in-interface=RoutedPublic p2p=!any action=accept mark-f...

Cameron Earnshaw

Why can't you just use dst-nat?

Cameron Earnshaw

Is it possible that you have a rogue DHCP server on the same subnet as your internal IPs? 192.168.0.x is the factory default on D-Link routers, I believe. Maybe one of your wireless clients mistakenly connected the radio to the LAN side of his router. We see this quite often.

Cameron Earnshaw

I get a kernel panic error. Like I said, the last router (that this one replaced) did this too. In fact, at this point it is my opinion that the legendary Linux reliability, at least as interpreted by Mikrotik, has become somewhat of a joke. I have eight Mikrotik routers running. Only one has run fo...

Cameron Earnshaw

I've got plenty of issues with Mikrotik reliability of late, but have never heard of the problem you describe. Are you sure you have your DHCP server set up properly? You haven't assigned IPs to the interfaces that are also being assigned by DHCP have you?

Cameron Earnshaw

That might be trued with some services such as Vonage. With my IP phones, which I run through my own Asterisk PBX, I see 80-90 Kbps on these ports whenever a call is in progress, so it must be more than just messaging.

Cameron

Cameron Earnshaw

Not sure if this is exactly right but it seems to work for me: ip firewall mangle> src-address=:5004-5065 protocol=udp p2p=!any action=accept mark-flow=VoIP-In mark-connection=VoIP-In set-tos=min-delay dst-address=:5004-5065 protocol=udp p2p=!any action=accept mark-flow=VoIP-Out mark-connection=VoIP...

Cameron Earnshaw

My Mikrotik server was shutting down about once every one or two weeks. I changed to a new PC, and still having the same problem. Anybody else seeing this? Version is 2.8.25. I am running pcq, web proxy and dns cache. Computer has AMD 1.4 GHz processor with 1024 MB of RAM. CPU load usually less than...

Cameron Earnshaw

I remember seeing an example of this in the manual or possibly the "How To" Guide. Unfortunately, you'll have to spend some time searching for it because the documentation is poorlyl organized and there is no index.

Cameron Earnshaw

Go to Torch, set interface to your LAN interface and check (tick) all boxes. Then press start. Once you isolate the offender you can type his address, i.e. 192.168.1.25/32 in the source address field and look at this traffic alone.

Cameron Earnshaw

This is one of the more frustrating features of MT/OS. I use the MT web proxy and DNS cache but never fully trust them because of problems of this type. I am putting in a separate box (not MT) for DNS cache and we'll see if that fixes it.

Cameron Earnshaw

Well, with all due respect, this is about the extent of details on connection limiting that I found in the manual. "connection-limit (integer; default: 0) - match the number of concurrent connections from each particular IP address" I think I could have guessed that. I agree that not a lot...

Cameron Earnshaw

the number of simultaneous connections may be limited in firewall. please see the manual for the example. Seems you have better luck locating these things in the manual than I do. Perhaps if the manual were better organized or had an index? In any event, would you mind advising which section of the...

Cameron Earnshaw

My apologies to the Mikrotik folks. Turns out it was not the PCQ that was causing the problem but our own stupidity. We had a memory chip mismatch (one 512 MB and a 256 MB DDR) in the computer. Changed them both to 512 MB DDR and now cpu loading is only 4-6%. Regarding the pcq-limit, I find this a b...

Cameron Earnshaw

So then is it that pcq-limit is for the entire queue and pcq-rate is per client (actually per connection?)

Any idea why I get 100% cpu usage as soon as I turn pcq on? It is 1.4 GHz with 768MB of RAM, so should be powerful enough, don't you think?

Cameron Earnshaw

Here they are. I'm not sure whether pcq-limit is set properly. Is this the number of simultaneous connections? 4 name="PCQ-Download" kind=pcq bfifo-limit=15000 pfifo-limit=50 red-limit=60 red-min-threshold=10 red-max-threshold=50 red-burst=20 sfq-perturb=5 sfq-allot=1514 pcq-rate=4000000 p...

Cameron Earnshaw

Finally got a pcq rulle working properly. I have two problems: 1. System resources show 100% cpu usage whenever pcq is running. M router is an Athalon 1.8 GHz with 768 MB RAM, and I have about 200 clients. Everything seems to be running fine though, with no noticeable lag when I log-in with Winbox. ...

Cameron Earnshaw

I had two separate networks feeding into the same T1. Because we have now installed a wireless link that allows us to connect them on the LAN side I decided to put them all onto the same subnet. When we switched the wireless link on I turned the DHCP server off on the second network, and had planned...

Cameron Earnshaw

It's been reported that the IDE flash modules are only good for 300,000-500,000 rewrites or thereabouts. I have a MT that's been in service for only five months and the flash drive already has close to 400k writes on it. I just installed a new flash module last night and it already has 196k writes o...

Cameron Earnshaw

That's fine if you're just passing the IP traffic, but for connecting the calls to the PSTN with telephone cards the RouterOS needs to support SIP. In the V2.8 manual only H.323 compatibility is mentioned, but SIP is rapidly becoming the dominant format.

Cameron Earnshaw

I don't see that MT supports SIP protocol for VoIP yet. Anybody know whether this will change with 2.9?

Cameron

Cameron Earnshaw

Anyone know a good firewall rule to block rogue DHCP servers? I have made the MT authoriative but still have problems when one of my clients connects my cable to the LAN rather than the WAN side of their router. I've been trying various rules so far with no luck.

Cameron Earnshaw

In fact the numbers do match those under the statistics tab. I was just looking in the wrong place.

Cameron Earnshaw

Looking at my simple queues with Winbox there are two numbers in the Bps column, such as 66.7kbps/445.6kbps for my download queue, and another set of two numbers for my upload queue. None of these numbers seems to relate to the number shown under the queue "statistics" tab. If in fact thes...

Cameron Earnshaw

There is an example of how to do this near the bottom of this page:

http://www.mikrotik.com/docs/ros/2.8/root/queue.content

Cameron Earnshaw

Yes, I can now see that it is definitely the queue doing this as the latency improves the instant I disable it. I guess it's just doing what its supposed to do.

Cameron Earnshaw

My network is getting much busier these days and I am seeing sometimes 200-300 ms difference in latency when pinging the local side of the router vs the public side. In other words, if I ping the side of the router I am on, the ping times are 200 ms or so less than when I ping through the router. I ...

Cameron Earnshaw

Yes, the new MT must be properly licensed but you can move the backup from one box to another. I think the problem with everything being attached to the wrong interface is when you go between major revision levels only, but I could be wrong.

Cameron Earnshaw

The web proxy is not stable in my opinion. I have started turning it off in most of my machines because I just can't trust it.

Cameron Earnshaw

With Winbox you go into the files tab on the first MT and click backup . Then FTP into the file directory of the first MT, retrieve the backup file and load it via FTP into the same directory on the other MT. Reboot the second MT. Make sure both MT have the same major revision level, i.e. 2.8.x to 2...

Cameron Earnshaw

I have a dst-nat rule to redirect non-paying customers to a web page that informs that their account has been temporarily suspended. It's very effective and I almost always get payment within 24 hours or enabling the rule. I'm redirecting to a particular IP address, but is it possible to also do thi...

Cameron Earnshaw

No, we have a static block assigned to us. I have reverse DNS entry in place for the mail server address but the problem was with masquerade it was the gateway address that was forwarded instead.

Cameron Earnshaw

I think the problem was actually a rogue DHCP server on my network. I shut it down and the problems went away. It gave some weird results, like DNS address would be that of the rogue server's IP but the client IP would come from the Mikrotik.

Cameron Earnshaw

I upgraded a couple weeks ago to 2.8.22 for the hotmail web proxy fix. Now Yahoo mail pages won't load properly. If you try to reply to a message or the page won't load unless you switch the MT web proxy off. I'm beginning to think the web proxy is more trouble than it's worth.

Cameron Earnshaw

Nobody responded, perhaps because this had partly already been covered in an earlier post, but I found the exact solution I needed by using in part what ASM had written in an earlier post: /ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1 (xxx.yyy.1.1 being th...

Cameron Earnshaw

We have a wireless network with a mixture of Motorola Canopy and Tranzeo gear. We had occasional DHCP problems in past which seem to have been cured when we upgraded to 2.8.19 a few weeks ago. In the last five days we upgraded to 2.8.22 for the Hotmail fix and I'm beginning to think that the DHCP pr...

Cameron Earnshaw

I'm getting ready to add a second T1 from the same provider as the 1st. I now have a Cisco 1700 series router acting as the gateway and the MT behind it doing DHCP, firewall and web proxy duties for the LAN. The Cisco has a 2nd T1 interface. Do I need to ask my provider to bond the T1s or is it just...

Cameron Earnshaw

I'm having trouble with my e-mail server being blacklisted by dsbl.org. My server has a public address via dst-nat, but because of masquerade it appears that everything leaving my Mikrotik, even the natted public addresses, look like they're coming from the gateway address. Thus, whenever one of my ...

Cameron Earnshaw

Here's how the Cyclades is set for our frame-relay: 0 R name="cyclades1" mtu=1500 line-protocol=frame-relay media-type=T1 clock-rate=64000 clock-source=external line-code=B8ZS framing-mode=ESF line-build-out=0dB rx-sensitivity=short-haul frame-relay-lmi-type=ansi frame-relay-dce=no chdlc-k...

Cameron Earnshaw

After bad experiences with the MT web proxy in the past I had stayed away from using it, but recently I upgraded two routers to 2.8.19. so decided to try it again. It has been working flawlessly on both routers for over one month, but now one of the routers has developed the old problem where the pa...

Cameron Earnshaw

Is anybody using the hotspot feature to do community-wide authentication on a large wireless network? I'm just wondering whether it is suitable for this. Can it handle a lot (hundreds) of clients or will it consume too many resources vs. using something like PPPoE? Thanks!

Cameron Earnshaw

So, are you saying that the lines must be already bonded by the upstream service provider? If that's the case I don't understand why you would need two Mikrotiks.

Cameron

Cameron Earnshaw

We'd like to do this for T1s. I wonder if it's possible to bond them if the T1s are in different locations (with one connected directly to the Mikrotik and the other connected via wireless). Anybody know about this?

Cameron Earnshaw

OK, I bit the bullet and upgraded to 2.8.19 last night. No problems so far and my DHCP problems seem to be fixed. Keep in mind that I have no wireless interfaces installed.

Cameron

Cameron Earnshaw

Hmmm... not encouraging. I am seeing some DHCP problems with 2.8.16 and since we're using Motorola Canopy for our wireless backhaul links I'd like to upgrade to get the Canopy DHCP fix made begininng 2.8.18. I don't want to trade one set of problems for another, however. Maybe better to go with the ...

Cameron Earnshaw

OK... change that to 2.8.19. Anybody having problems with this latest release?

Cameron

Cameron Earnshaw

Anybody successfully using V2.8.18? I would like to upgrade but have read on one of the wireless forums of others having problems. Not sure, but perhaps these were just wireless related issues. I'm interested to learn whether it's safe for those of us not running wireless interfaces to upgrade. Than...

Cameron Earnshaw

Based on problems I've heard others are having with 2.8.18 I've personally been reluctant to upgrade. I did find out the hard way today that if you have ARP enabled on your interface, and also select "add ARP for leases" to the DHCP server, it will work for several hours, and then the clie...

Cameron Earnshaw

We DHCP private addresses with the MT and do some bandwidth shaping, but not for all clients.

Cameron

Cameron Earnshaw

I am using Canopy and Mikrotik without major issues, although I understand that there is a DHCP problem that is fixed with the latest MT firmware release. I do occasionally have problems with clients (mostly using Microsoft cable/DSL routers) obtaining IP address via DHCP but not sure if this is rel...

Cameron Earnshaw

Thanks! I just saw that in the archives too.

Cameron

Cameron Earnshaw

I want to redirect customers whose accounts are not current to an on-line payment page. I am willing to make the filter entires manually when needed rather than with RADIUS. I tried making a simple dst-nat rule to re-direct specific IP or MAC addresses to my page, but no matter what address I redire...

Cameron Earnshaw

Looks like my problem was maybe a wireless link issue and not related to MT at all. Why it seemed to affect XP users only I don't know. Maybe it has something to do with the way XP constantly checks for network connectivity?

Cameron Earnshaw

The worst problems seems to be with customers behind the oldest MT in our network, running some version of 2.5. We're going to upgrade it in the next couple days. I think we can rule out customer computer problems, at least on some of them. I took the computer of one of my customers having the worst...

Cameron Earnshaw

Good suggestions. I've run into this before but had forgotten to check this. Turns out I'm not blocking any ports but did find that the destination ports in the NAT rules were set to zero instead of 0-65535. I've changed that now and we'll see if it makes any difference. It seems to me if this were ...

Cameron Earnshaw

The oldest is 2.5.14 but we're also seeing it with 2.8.10 and I think 2.8.11.

Cameron

Cameron Earnshaw

We've been seeing an increased problem where pages won't load yet we can ping normally. DNS appears to be resolving OK. Rebooting the client's computer temporarily fixes it. This is happening more and more in several of our systems in different communities using different T1s from different provider...

Cameron Earnshaw

We are not using PPOE but I had a severe problem with Tranzeo CPE on one occassion where they would work for a few minutes then stop passing traffic. I was installing 8 of them for a school campus. I was using Microsoft 4-port routers with the CPE but never sure if they were part of the problem. I w...

Cameron Earnshaw

I came to the forum because I could find nothing in the manual about it, despite what Normis says, but am glad to know that this can be done. Thanks!

Cameron Earnshaw

Here's how we're doing it. One rule per IP for uploads and one for downloads. Not sure if it's the best way but it works for us. As you will see we are limiting downloads to 1.2 Mbps max but they get at least 10% of that at all times. [admin@MikroTik] queue simple> print Flags: X - disabled, I - inv...

Cameron Earnshaw

Why not use just throttle bandwidth by IP address? I started routing public addresses recently using a bridged interface and limiting bandwidth in this way is working very well for us.

Cameron Earnshaw

I've been trying to use NetWatch to execute a telnet script. The scripting function works fine when used solely to change the MT internal settings, but it does not seem to work when I try to run telnet. The manual says that to run a script the users must have telnet policy enabled in the /user group...

Cameron Earnshaw

OK, I guess I misunderstood what you were doing. This is just the normal way of doing dst-nat in the Mikrotik. My problem is I find certain applications don't want to work behind nat (IP phones, for example) so I want to have actual public addresses on LAN side of my Mikrotik as well. Setting up a s...

Cameron Earnshaw

Great... this was very easy to do and got the problem solved quickly. Thanks!

Cameron Earnshaw

Is there a way for the Mikrotik to work without masquerade? I
think having it appear that all traffic is coming from one address may be
overloading the TCP/IP buffer on our satellite link.

Cameron

Cameron Earnshaw

Is there a way in the Mikrotik to limit the number of TCP/IP connections on a per-client basis?

Cameron

Cameron Earnshaw

I'd like to do this too, but have never been able to get it to work without dst-nat, which doesn't seem to work for certain aplications such as IP phones. Can you give an example of the route you added to get it to work? Did you have to add another NIC? Thanks.

Cameron

Cameron Earnshaw

I bought an IDE flash module with Level 3 and now realize I need Level 4 for a Cyclades card. Is there a way to upgrade the license key and just pay the differfence instead of waiting for a new flash module to arrive?

Cameron Earnshaw
Swift Wireless Internet

Search found 90 matches

Re: A working dynamic bandwidth script. Test it!

Re: A working dynamic bandwidth script. Test it!

Differences in firewall rules between 2.9 and 3.14?

Brouter setup

MLPPP

Adding interfaces without disrupting present LAN addresses

webmail.aol.com

Priority rule

Per address queuing

MT Shutting Down

PCQ

Routing issue has me stumped

Life of IDE Flash Module

SIP Supported?

Blocking rogue DHCP servers

Queue Statistics

Effect of Queues on Latency

Redirecting to URL

Web proxy issues - now it's Yahoo mail!

Is there a DHCP issue again with 2.8.22?

Any way around masquerade?

Web Proxy Woes (Again)

Using hotspot feature for general ISP authentication

Any V2.8.18 Issues?

Redirecting non-paying customers.

Web pages sometimes won't load

Using NetWatch to Execute Telnet Script

Masquerade

Limiting TCP/IP Connections

Upgrading IDE flash module to Level 4