MikroTik

glucz

X86 still shows 1 CPU on a multicore system. The changelog says that this problem had been fixed. Can anyone else see this problem with 6.32.1 ?

glucz

Yes unplug the cable.

glucz

I have been experimenting with these Intel PRO/1000MT PCI cards and I found that if I unplug a card (link goes down) the router would reboot itself in 1-5 minutes. I thought it was some kind of watchdog, but even after turning that off, the same thing happens. I was able to reproduce it on 2 differe...

glucz

Don't use openVPN in version 6. It works for a while and then locks up - killing all other VPN interfaces, including the non-openVPN ones too. I seem to remember that it worked better in V5, but then there were other problems. So I think you are not getting help because nobody can really use that fe...

glucz

MT doesn't push the routes. You have to set them in the config file. I think you cannot set the default route because of permission problems, but you can create a set of rules that route everything through the vpn interface except the address to the VPN server itself. Usually you can make it with 10...

glucz

SMB is not working in 6.11 and 6.12 ... possibly it is broken since 6.8 . I know that it works in 6.7

glucz

Thanks for the tip. The board was working an hour ago... I followed the version recommendation on the download page. (3.30 mipsle). The problem is that a new dual wifi board with enclosure and shipping will cost about $150. I thought that the recovery would be cheaper. There are all those jumpers an...

glucz

I had 5.x on ROS 112 but performance had been horrible, so I decided to downgrade to 3.30 The downgrade went ok and when booting I hear the single and then double beep of normal booting. The blue light comes on as usual. However the router is non-responsive via ethernet and wifi. I cannot put it int...

glucz

Don't expect high performance. RB750 will be able to give you 8-10mbps total VPN bandwidth due to low CPU resources.

glucz

I hope someone can help me with this... I want to route public IP's that I have routed to a 1100AHX2 in a datacenter to servers in offices. The range is a /24. I used EOIP, but it was very slow and the different locations could send unwanted traffic to each other (DHCP for example), so I want to cha...

glucz

I have an 1100AHx2 with a 1GBps uplink on port 13. Ports 1-10 are in a bridge, serving a /24 subnet. Even though 1 have 4 servers connected to 4 ports, only 1 of those servers are generating any substantial traffic. It is about 110Mbps with 14000 pps . Even at this light load, I'm loosing 2-3% of pa...

glucz

... or if you know perl a little bit, you can download a fully functional syslog server from search.cpan.org (search for syslog server). Since the source is fully open, you can add any processing you like. Not all cpan modules work well on Windows, but most do work under Activestate Perl.

glucz

If you don't want to mess with routing or NAT, you can put an EOIP tunnel over the VPN. That will join the 2 network segments, however you have to be careful with DHCP because you probably have it on both netowks and now they will conflict with each other ... so you may want to switch to manual conf...

glucz

This is slightly off topic.... however I do agree that it is sometimes nearly impossible to put these devices into netinstall mode. I had an incomplete upgrade on a 751 and took me several hours to get it working. I tried with switch, direct connection, cross cable, straight cable, pushing button be...

glucz

I reported a similar bug to MT a couple of months ago. It was between Windows/MT and MT/MT The main point of the report was that when you get a connection error for any reason (network problem, password problem, etc ...) MT doesn't fully clear the SAs. They disappear from your list but MT still trie...

glucz

This is just a quick idea as opposed to a full though out answer: Some of these rules, especially #9 will have a lot of false hits ... at least false in the sense that they are not portscans. Simple FTP or P2P can trigger them and they could be initiated from inside your network. So you will end up ...

glucz

There may be some that you could detect by analysing the traffic, but most you cannot detect. You have to rely on third party security services that give you a list of IPs to ban. The one we use charges us $0.005 for each IP we request from their database (and we have to request specific IPs) and ev...

glucz

VPN performance is terrible on small MT devices. You can turn off encryption to double the speed. Even a 3Ghz P4 on each end will give only 9-15mbps. I was able to fill a full duplex 100mbps line with a quad core 3Ghz i3.

GL

glucz

Hello, I don't pretend to have thought through everything that you wrote, but have a suggestion that I use sometimes. Set up a redirect rule in your RouterOS to redirect any port 53 traffic (tcp+udp) to localhost 53. Then enable the DNS server with 8.8.8.8/8.8.4.4 (you may have to allow remote queri...

glucz

Well .. first of all decide what you want to log. I think the data retention directive talks about a lot of garbage like logging all emails (?) - which as a hotspot provider you will not be able to do for example. The only thing you can directly log are login, logout times and originating IP. Since ...

glucz

The true solution would be to allow us to delete dynamic ipsec policies (if the corresponding SA's are missing for example)

Does enyone know if this is a kernel limitation or a Mikrotik enforced limitation that they could be able to change?

GL

glucz

It is possible, but you can only tie it to the originating IP of the connection. So set up 2 PEER's under ipsec. Both should have a non-overlapping address range. One can have one secret and the other another. Whichever peer is triggered based on the originating ip of the connection, that secret wil...

glucz

You can do it without problems. KVM, Virtualbox, VmWare, Xen all work well. If you configure a virtio network driver, that can give you a 10% performance boost compared to other network setups ... but everything else should be the same as the physical installation.

glucz

I have a problem with Ipsec. The generated policies are assigned a "required" level. This is problematic because if a client connects to me with Ipsec, a policy is generated to require all further traffic to be encrypted... but after the SA's time out and the client decides to connect with...

glucz

Just a quick note here: On ROS V5.20 the Atheros 9271 (TPLINK) seems to work 99% . I had the same problem described here on earlier versions. The only thing I could not get to work is to access RouterOS with Winbox through the USB wifi interface. At the same time I could use it as an AP.

GL

glucz

Hello, It was I whose post you linked here about the r210 . There are 2 issues. 1, Probably there are SATA controller issues. Mine has 00:1f.2 SATA controller: Intel Corporation 5 Series/3400 Series Chipset 6 port SATA AHCI Controller (rev 05) and it is not recognised by ROS, so I'm running it from ...

glucz

Hello,

Instead of SSTP try L2TP with and/or without IPSec.

Geza

glucz

Hello,

I confirm the load problem on 5.18
It is because of ppp

Here are the profiles side by side of 5.17 and 5.18. It is the same server handling the same types of jobs.

GL

glucz

... I know that this thread is almost a year old, but I came across another broken routerboard. This is the same problem that I saw in a few 750's (that this thread is about) ... this is a 450. I looked into one of the newer 751's and there seems to be only solid-state capacitors inside. So hopefull...

glucz

Could you boot 5.14 from the USB like you did with 5.11 . I know that it may not help your problem, but it could help me verify my problem with the dell server.

GL

glucz

Another thing you can do is to install KVM / Xen / Virtualbox on your server and emulate a more standard hardware and install ROS inside that. There is a little performace hit (3-5%) ... but your HW seems to be strong enough.

GL

glucz

It seems like that ROS has no driver for your SAS controller. Maybe you can put in an additional SATA controller. Just out of curiosity ... can you upgrade the 5.11 to 5.14 on your USB stick? 5.12-5.14 doesn't run at all on my Dell that is similar to yours. I have not been able to determine if that ...

glucz

Hello,

Which version did you try to install? 5.14? I had a similar problem on PowerEdge R210, but possibly from a different reason .. try to install version 5.11. That had been the highest version I could go.

Please let us know your results as it might confirm a suspected bug in ROS.

Thanks

glucz

Hello, I had posted some tickets previously that the SSTP service doesn's start on Intel pre-core CPU's (possibly pre-core2). Today I noticed something else. One of our x86 i3-540's running 5.11 locked up. So since I was already on location, I upgraded to 5.14. The server locked up after displaying ...

glucz

Yes, that works for a single pair. I have a 1000 pairs that change from time to time. I don't want to have 1000 rules.

The problem with the internal email server is that when clients use the hotspot, they would have to switch their config to it, and switch away when they leave.

GL

glucz

Hello, I hope someone can help me with this. In my hotspot I want to set up firewall rules that allow specific users to access specific SMTP servers, but otherwise SMTP access would be blocked. Here is an example: If source IP is 192.168.1.1 then access to target IP 88.88.88.1:25 is OK If source IP ...

glucz

All I can tell you is that OpenVPN started working around version 5.3 or 5.4 . There is no working OpenVPN in any of the previous versions. You could connect for a while and then had to restart either the OpenVPN service or the router to get it to work again. However since about 5.4 I have had no pr...

glucz

Upgrade to 5.14 and it will work ... assuming that you are not running x86 version on older Intel Pentiums where SSTP on 5.13/5.14 fails alltogether.

GL

glucz

it is just an idea, but you could try 1, enable DNS 2, set up an IP list (ex: youtubeOK) of local IP addresses that you want to allow access to youtube 3, redirect UDP and TCP port 53 traffic to your router where source IP is not on youtubeOK list 4, set up a static IP DNS entry for *.youtube.com 1....

glucz

Hello, I have reported similar problems. 5.13 and 5.14 seem to have problems with older (pre core 2) Intel CPU-s. I see that you also use an older intel platform. For me all dual xeon's and P4's failed while AMDs worked well from Geode to Athlon64. I suggest you try the same and report what you find...

glucz

Hello I did a whole separate post about this, but I copy the info here as it relates to 5.14 (and 5.13) and in case others want to test it. The X86 SSTP implementation doesn't seem to support the Intel P4 CPU (and possibly others below that). It seems to work well on newer Intels like core 2 and all...

glucz

Can someone tell me the logic behind interface queue assignment to VPN interfaces? I know that Simple Queues are assigned every time there is a speed limit on the interface. However I sometimes see Interface Queues and I cannot figure out when they appear and what type they would be. For example (th...

glucz

I only use bridged mode. I don't always have performance issues. Some installations work fine and I can use 60 out of 100mbps, sometimes only 5 or 10. I thought it was a bandwidth problem to the server, but the servers can talk to each other 100/100 when I do a bandwidth test. It's not an openvpn is...

glucz

Hello again, You guys should start to pay me for the number of hidden bugs I have been finding lately :-> -if not in cash, but in licenses. Anyhow. I tested SSTP on a number of X86 architectures ... and here are the results AMD Geode on a 10 year old WRAP board --> SSTP OK AMD Athlon 64 [several ins...

glucz

Thanks.

I tested 5.14 in Virtualbox and got the same error in the logs.

I noticed however that it is not enough to run
/certificate reset-certificate-cache

after the downgrade, but it is required to decrypt the keys again. It was not obvious for me, but might be for others.

GL

glucz

Are you sure that it was not because of the asymmetric nature of the subscriber line that the clients used? All in all I have good experience with MT VPN solutions including openVPN since version 5.x when it became stable for the first time. However under some circumstances vpn seems to become unrea...

glucz

Hello, This is probably not RouterOS related, but I thought I would mention it. SSTP in 5.13 doesn't work in Virtualbox. 5.12 works however. 5.13 logs a bad peer version when I try to connect and displays a 619 error on the client screen. I tested the same thing on Xen and it works well there.... bu...

glucz

The static route might be a valid way to do this, but it is not the most resource efficient especially if your partner is on a slow Internet line. All traffic between you and the third company goes into their network and comes out causing a double traffic load. If this is just going to be 3 nodes, y...

glucz

Hello, Seing that this still comes up sometimes even on 5.11 and 5.12 - I'm wondering if this is somehow related to an installation error. I remember that the first time I boot routeros, it generates the server keys. This is not generated when I upgrade or downgrade. So if the initial key generation...

glucz

I moved some guests from vmware to virtualbox and the same thing happened. I think you will need to invest in a new license.

GL

glucz

I think that they are the same as far as resources go, especially if you don't use IPSEC with L2TP. I always suggest people to go with L2TP if possible. It uses UDP transport. If urge you do to a google search regarding the disadvantages of running tcp traffic inside a tcp tunnel.

GL

glucz

You don't have to use the same technology among each site ... in general I would say that you need to think about your topoloogy first. Are you setting up a central hub and all others connect to that or you set-up peer to peer connection among each pair of sites? Even in the hub situation you can ha...

glucz

I think you have the same question as I. How is the rate calculated? You assume that it is based on a per second basis and expiry doesn't affect statistics. I assume that it is calculated over the whole hash table (number_of_active_connections + number_of_not_expired_but_inactive_connections)/(time_...

glucz

There is a difference between 10/5 minutes and 2/1 minute (ie: 5 minute rolling average vs 1 minute rolling average) but I understand your thinking ... Set a true rate in the rate section like 2/minute and set expiration to 5 minutes will make it 10/5 minutes ... but it would be nice to get a confir...

glucz

We agree on the function of the expire parameter. What is the point of setting a 10/hour rate if I expire my entries after say 5 minutes? And conversely what is the point in setting the expire to be longer than the time rate unit parameter. The first scenario makes the true rate 10/5 minutes, while ...

glucz

Downgrading back to 5.8 from 5.10 will also loose the IP address, but the interface is kept.

glucz

Thanks. I have seen this example. The problem is that that is mostly a count and drop scenario. For a well written dst-limit you should not need the mark and drop part, just the dst-limit with a return or accept action and then a simple drop afterward. That way you have drops based on the actual rat...

glucz

well ... it seems like that nobody knows exacly how dst-limit works? ... I was able to figure out partly why it doesn't seem to work. The expire time units seem to be off. Counted packets expire quickly. Someone mentioned in the forums that the time units are actually 1/10th seconds. However I still...

glucz

Rename is still present in upgrading to 5.10 . Previous version was 5.8
X86

I also lost the static IP address.

GL

glucz

Hello, Could you please someone explain to me how the dst-limit works exactly in the firewall rules? I have looked at the wiki and the 1 example available that I found in the forums, as well as my own attempts and I still can't figure out. What I want is this: I want to limit the rate at which hotsp...

glucz

This error has stretches with the third version! With the loss of PPP (pptp, l2tp, openvpn) connections - does not delete the IP address automatically. If it is static, more impossible to establish a connection! https://lh6.googleusercontent.com/-jJ03jOO0V00/Trg08YyoPCI/AAAAAAAAAQE/JUh4oHy8wkU/s144...

glucz

To be honest, the question has merit ... I sometimes have to install ROS on remote PC's. I have used Xen, KVM, VMware or Virtualbox (whatever was available) and up to version 4.x this woked well. However 5.x runs very badly in Virtualized environments. VMware seems to be the most stable ... the rest...

glucz

I downgraded X86 ROS 5.7 with a L4 license to ROS 4.17 . Now I get a boot error .. something about "license expired", but it disappears quickly. I had a full L4 license and not a L0. Does anyone know why this is happening and how the installation can be restored?

Thanks
GL

glucz

Hello, VmWare is a stable solution. I don't fully understand the rest of your question, but if you have multiple adapters in your server, you can set up a network bridge on each in VmWare Server or Esxi. Then connect the virtualized eth interfaces to one of the bridges. You can have as many virtuali...

glucz

Hello, I saw that there have been earlier discussions regarding web proxy authentiction ... well this is not about that. It would be great if the web proxy could log into a parent proxy using the standard authentication. I think it would be easy to implement, since all you need is 2 new entries for ...

glucz

RouterOS will run fine under XEN in full virtualization mode. It will not work under paravirtualization.

GL

glucz

Is it working on 5.5 for you? What happens when you downgrade without changing anything else? I have been complaining about OpenVPN in ROS for years and I'm now running it more or less without problems on 5.5 As far as I can tell only 5.5 and 5.4 can run OpenVPN without internal crashes ... and I ha...

glucz

Because nameservers cannot be trusted. That's why windows for example will not accept the server certificate unless it's signed by a trusted signer. So now not only will they have to contaminate the DNS, they will have to generate a valid a signed certificate in your domain name. So now IE/FF/Chrom...

glucz

Yes, now you have to set server's IP address (not DNS name) when creating certificate. SSTP is not harder to use, it is just an additional security feature. OK. So let's assume for a moment that I'm running a VPN server and want to connect to it using SSTP. I generate my certificate signing request...

glucz

I'm trying to get the meaning of this: *) sstp - when server certificate verification is enabled for sstp client, it will additionally compare IP addresses found in certificate's subjectAltName and subject CN to the real address, DNS names are ignored; What does this mean in simple terms? Do I now h...

glucz

I use 5.5 on 112. You must be very careful to install only the packages that you need and to turn off all services that you don't use. I think the main limiting factor is the RAM. It seems to start swapping to the flash, causing 100% CPU and lockup in 1-5 minutes.

GL

glucz

Currently all of them are working, so I won't break one open now. But you have to take it apart anyhow, so just look inside to see if it is really the capacitors that blew. Search for blown capacitor in google to see how they look like. Look on the side of the capacitor for a capacitance and a volta...

glucz

We had a few 750's die too (3 out of 10). If you take them apart, you will see 2 large capacitors in the middle. Most likely they are deformed and the top is blown or split. Replace them with solid state capacitors. They are in the $1 range each, so your total fixing cost is $2. This is a common pro...

glucz

Hello, This is just a guess, not knowing what kinds of routes actually get set up when you check the PPTP interface to be your default route... check if there is a route remaining to your VPN server through your regular gateway. You are expected to get these kinds of timeouts if the router will try ...

glucz

I suggested this to MT earlier to make this a FAQ item or something prominent so that ROS users are aware of this problem: If you use tarpit firewall actions in 5.x, it will fill up your route cache. The more connections run into tarpit, the sooner your cache fill fill up. The error message when tal...

glucz

My experience is that OpenVPN doesn't work properly on ROS releases up to and including 5.2 . If you read the posts you will see a lot discussions ending with a suggestion to turn off openvpn. Not only is it buggy but causes problems to other services and winbox in certain versions. It may appear to...

glucz

Yes ... I'm interested in this too. Everyone is talking about transitioning to IPV6. How is a gradual transitioning possible? When my server has only IPV6 address, how can IPV4 clients reach it ... and suppose my ISP switched my residential addressing to IPV6, how will I be able to reach IPV4?

GL

glucz

In case the original thread was removed and others experience the route-cache problems, lost pings etc ... change your tarpit actions to drops The problem is possibly due to a diffeerent route cache / tarpit implementation in the new linux kernel used by ROS 5, so this may be present in 5.3 or other...

glucz

Yes ... it has been like that for several years, possibly forever. The interesting thing is that if you set up several IP's in the same /24 range and don't pick a primary, but set up all of them with the same /24 mask, the IP for the L2TP server will be random after each reboot. Usually however it s...

glucz

I installed 5.2 on a pppoe (bras) mk router. Till now I see a bug. in PPP, active connection you can see new connecting pppoe client uptime starts from 39seconds and starts decreasing till reaching 0, then starts increasing! So funny :) So it's user "yyy" connect. you can see it's alive f...

glucz

or .... are you talking about how you can install routeros on a remote PC? Like a server in a datacenter - without involving the datacenter personnel ... or simply because they don't support custom OS's as it is most often the case? Actually I would be interested to hear if someone can do that too. ...

glucz

If it is enough to monitor the IP addresses visited, you can set info logging to a remote syslog server. Then set up a mange rule ip firewal mangle add chain=prerouting action=log connection-state=new protocol=tcp dst-port=80,443 log-prefix="WEBACCESS" This way you can also monitor SMTP,IR...

glucz

This doesn't look like a website that an ISP would block. You can try accessing the site through a free proxy or a VPN service (ex: http://usaip.eu) to verify if it is a local problem. If you can access it, then probably your ISP is blocking it and you will be in a better position to ask for an expl...

glucz

Yes. I can too confirm after 16 hours that route cache is now stable. So tarpit seems to leak into route cache.

GL

glucz

This is total RAM-shared video ram, so the RAM available might be slighly different for each configuration.

GL

glucz

No. They are all different. Whatever was available at the time.

Whoever else is also having route cache problems: Are you using tarpit actions in firewall rules?
I picked 2 MT750's off the shelf and am tring to build the minimum required rules and services to replicate the problem.

Thanks
GL

glucz

It seems like that the max cache size depends on the RAM in the router. The minimum size seems to be 16384 If you have over 128M RAM, the size is 32768 If you have over 256M RAM, the size is 65535 etc ... The point is that it will fill up regardless of the cache size. The added bonus is that 5.2 is ...

glucz

Hm. It seems like that my previous post got deleted. I hope it was because of the size and not the content ... so I will just phrase it simply:

Please send me the question you refer to, because I received no questions from support.

Thank you
GL

glucz

Normis ... and when you said that you were looking into my ticket which is about this same issue a few days ago, and forgot about it ... ? Even when others asked about the status - we received no answer. I don't see what the added value is in disregarding a serious problem in ROS 5.X . Not talking a...

glucz

MT. Please acknowledge these problems so we can move on with our lives and stop generating supouts, screenshots, statistics and posts. A rough timeline for a fix would be nice too, so we can decide if we want to downgrade to 4.X for a few months (years) or we should convince our clients to stay on 5...

glucz

[Ticket#2011041766000095] Possible bug report + supout.rif

Thanks
GL

glucz

I myself reported the ping problem maybe 3-5 weeks ago first. It is present in all 5.X versions, including the RC-s that I tested. It is really the filling up of the route cache that materializes as a ping problem first and blackout later. The problem seems to be present not only in x86, but routerb...

glucz

You can use startssl.com to create both the private key and certificate for openVPN ... or you can set up a CA on your computer and generate the certificates yourself (http://openvpn.net/index.php/open-source/documentation/howto.html) Import both key and certificate under system certificates You wil...

glucz

If you don't want to play with NAT, you can just set the remote address in PPTP/L2TP secret to the real static IP. You will also need to enable proxy-arp on the main eth interface of the router.

GL

glucz

Others reported 100% CPU spikes with ROS 5.x . What I see is similar. It starts with CPU spikes and goes into 100% CPU utilization and locks up. I was able to catch the spikes once in winbox and since then I just see that it locks up. So I repeated the experiement with ROS in Virtualbox ... and plea...

glucz

The problem is still present in 5.2 I have been sending supouts to support to help their work .. maybe things will improve in 5.3? I unfortunately need SSTP, so I must keep 5.2 on a few servers. This also gave me the opportunity to test a few scenarios and found the following: I have a demo PPTP/L2T...

glucz

I have a somewhat similar situation on 5.2. Can you check
ip route cache print
Maybe your route cache is full? That's what is happening to me.

GL

glucz

What is the 3 digit error code you/your client gets when trying to connect? (619, 809 etc ...)

Usually L2TP gets through firewalls better as it is UDP. PPTP uses GRE packets. Older routers might not support GRE NAT at all, and some ISP's block GRE alltogether.

GL

glucz

Rapidssl will require you to also add rapidssl intermediate certificate to the server https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&actp=CROSSLINK&id=SO6252 I never tried this with Mikrotik, but in apache I have to use different configuration directives fo...

glucz

This may not be your solution ... but I try to avoid TCP tunnels (PPTP) whenever possible. TCP traffic (like SMTP) inside a TCP tunnel goes through double congestion control and one can affect the other. http://www.docstoc.com/docs/37194256/Understanding-TCP-over-TCP-Effects-of-TCP-Tunneling-on So y...

glucz

Hello.

Which version of routeros do you use?

glucz

I had 3 high CPU usage related crashes on 5.2 within the past 2 days on 2 different x86 routers. I couldn't do a supout in the first 2 cases and forgot in the 3rd case, but I did make a profile screenshot. A reboot was required in all cases. There were about 30 users logged in with 3mbps traffic. No...

glucz

I reported a problem previously that interfaces disappear in winbox, but can be seen through the terminal http://forum.mikrotik.com/viewtopic.php?f=1&t=50994 Now I noticed a few spurious interfaces that cannot be removed through the terminal and since the interfaces are missing in winbox, they a...

glucz

[admin@MikroTik] > ip route cache print
cache-size: 15239
max-cache-size: 65536

glucz

There is a route fix in 5.2 . I hope that it was in response to this bug report. I upgraded 4 routers yesterday

So far I'm up to here:

[admin@MikroTik] > ip route cache print
cache-size: 2596
max-cache-size: 65536

I'll just wait and see what happens.

glucz

I reported a problem to mikrotik earlier in which routeros 5.x looses network connectivity every day or so - depending on load. Support told me that the reason for this was that my routing cache filled up. They suggested that my users were running p2p or the router is DDOS-ed. However my suspicion i...

glucz

Hello,

I was able to send the supouts to support today. I also found an actual error that could be related to this problem. Please see screenshot below ... there could be many other factors involved, but my money is on memory leak now.

glucz

Hello, There are no problems with the counters. The actual problem is that unless the load is light, routeros will start loosing packets at an increasing rate. It will eventually loose all network connectivity. This happened to me on all 5.x based x86 servers, both RC and final, but never on 4.X or ...

glucz

Hello,

I already rebooted, so I don't have an actual answer, but if my memory serves right, it goes to 0%. So it doesn't look like a deadlock.

GL

glucz

Hello, I have been seing this problem for a very long time, so I don't know if this is winbox or routeros related. I mostly saw this on virtualised systems, but that doesn't mean that it can't happen anywhere else . The problem is that Winbox forgets about the network interfaces, both ethernet and t...

glucz

Hello, I imagine that it is related to a specific service or task, so the most common features won't bring out this problem. I noticed this very early with the RC 5.x versions - but there were so many other problems that got fixed quickly that I didn't pay much attention to this. I however started t...

glucz

Hello, Actually I have this problem since the 5.xRC versions: I have a few x86 installations running as VPN servers serving PPTP and L2TP. The 5.x versions will start loosing packets after a while. It all seems to depend on load / traffic. The heavier the load is, the sooner the packet loss will sta...

glucz

I upgraded half of our servers to 5.0 for the SSTP functionality. I noticed that on multicore x86 systems SSTP always restarts when there is a connection attempt. It would also log an SSTP :- internal error message, but no further details. The client computer would see an 809, 631 or 619 error and a...

glucz

I can confirm that rc5 is eating up 100% of the CPU ... it doesn't always happen, but when it does, it stays like that for hours. This is a new rc5 installation on dual core x86 (2x1.8Ghz) with no traffic at all. The idle process shows 50% utilization, but that's only because of the dual core ... on...

glucz

I have a hotspot that has recently been used to DOS others. Thus I want to limit the maximum number of connections to the same destination IP's. I have seen incoming DOS protection in this forum where someone set up a filter with connection limiting like 10,32 where 10 is the number of connections a...

glucz

This problem came up for me too. OpenVPN is just unusable. It just stops. It is not possible to restart. Only reboot will fix it, but of course that is not an option on a live system. We can't keep rebooting the server every day.

glucz

SSTP VPN besides the existing PPTP, L2TP, openVPN .

GL

glucz

What does the limit mask (connection-limit=71,32) of 32 mean in this case? You allow 71 connections per individual source IP to a /32 range (individual IP)? So you allow 71 connections from any source to any destination? Shouldn't this be connection-limit=71,0 ? So you limit the global total connect...

glucz

What I have here is PPTP and L2TP users from different locations. Some are single computers, some are complete networks. A specific group of these connections get their routing marked as EV2 I was masquerading the connections to 193.239.149.97 via 87.229.53.253. Note that the base IP of the router i...

glucz

has anyone found a solution? This is still a problem in routeros 3?

Thanks

glucz

I used to have a system where I had different groups of users masqerading on different public IP addresses. I was routing them to the proper IP using simple routing with routing marks and rules with preferred sources. In 3.x now everyone sees the outside world on the same IP, which is the base route...

glucz

I also read maybe 1 more post like yours that it's working, but there are no details regarding the setup or the server hardware type - not to mention the client type. This is why I tried to give a clear description of what I'm doing, so there would be a thread that can help set up a working system f...

glucz

I have been trying to find a solution to connect to a MT router from Windows using the built in l2tp client. From XP it was possible via turning off ipsec. This is not posible in VISTA however. I have tried every possible scenario with routeros 2.9 but I think that it's not possible to connect the n...

Search found 123 matches