MikroTik

raktim

But my other end is Cisco

raktim

Please help me...

How can i change mine Mtu size to 1476.
It will work if i will disable / enable Gre-tunnel.
After reboot, same problem, too large Mtu, mine=1422, received=1476.
[img]

Mtu.jpg

[/img]
[img]

mtu_tunnel.jpg

[/img]

raktim

ospf_error.jpg

How can i solve this issue??
Please need help.

raktim

"cdiedrich" was right, it should be DES When i change ipsec enc-algorithm=3des to DES now log shows "failed to pre-process ph2 packet."

ipsec_ph2_error.JPG

Any one can help me please......

raktim

A. IMHO log shows problem with DH_GROUP: 1024 vs 768 bit
B. Could you make time be more accurate on Mikrotik. We are in 2015 not in 2002.

i have already tried with this (DH Group & PFS Group) parameter. but not working....

raktim

Problem has not solved yet. Cisco debug log shows:: entry number 47755 : CRYPTO-4-RECVD_PKT_NOT_IPSEC Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /10.30.1.4, src_addr= 10.30.2.71, prot= 47 timestamp: 777181959 Mikrotik Ipsec error Shows:: 03:38:41 ipsec,debug rejected enctype: DB(prop#1:tr...

raktim

:-( You might probably want to add topics=ipsec to /system logging and see what's going wrong in more detail. Also a deep look into the Cisco logs can help. From my experience the Cisco logs are easier to understand with IKE problems. Additionally, a debug crypto isakmp or debug crypto ipsec comman...

raktim

Hmmm... Are you sure your Cisco is using 3des for IKE encryption? Try setting enc-algorithms to aes-128-cbc instead of 3des. Leave PFS-group on modp1024. Good luck, -Chris Thanks, but Bad Luck it's not working, i have tried & selected all possible parameters, Ipsec error shows on Mikrotik "...

raktim

In your proposal, try to set pfs-group to none or mopd768, if the peer is a PIX firewall.

Thanks "cdiedrich", i have changed pfs-group but it's not working. It is Cisco ASR1002.

raktim

Please Need help to establish Ipsec connection between Cisco & Mikrotik. Cisco crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key ******** address 0.0.0.0 0.0.0.0 crypto isakmp invalid-spi-recovery crypto ipsec transform-set test esp-3des esp-md5-hmac crypto map try_bd 9...

raktim

How to convert below configurations in to Mikrotik . OSPF router ospf 1 router-id 192.168.16.179 log-adjacency-changes network 20.10.3.144 0.0.0.3 area 3000 network 20.10.3.148 0.0.0.3 area 3000 network 20.10.3.152 0.0.0.3 area 3000 network 20.40.2.80 0.0.0.3 area 3000 network 20.40.2.84 0.0.0.3 ar...

raktim

i have upgraded to v 6.22 also firmware in my Metal 2Shpn. After up gradation, last few days i have changes all possible parameters but problem has not solved. Smartphones, Wifi Usb Dongles & Ip cameras are connected and works within 20 Meters distance. Above 20 meters these devices are connecte...

raktim

**Metal 2Shpn is not working in 2GHz-B/G/N mode . it works only in B/G mode.
**Smart Phones , wifi usb Dongles & ip cameras are not connected with Metal 2Shpn @ short or long distance.

raktim

I upgraded to 6.22 also firmware, but problem of Metal 2Shpn has not solved yet. I can't connect from 30 meters distance.

raktim

How many MAC addresses or rules are allowed in wireless Access list of Mikrotik 951G 2HND or level 4 license.

raktim

I manage bandwidth in Access list (AP TX, Client TX Limit) for wireless clients. Is there any options to see the graphs for wireless clients.

raktim

Can we replace mikrotik with ddwrt in this device for test purpose???

raktim

I have upgraded the firmware patch to (ar7240_3_17_2_Metal_2SHPn.fwf), but problem has not solved yet.

raktim

i have upgraded to "routeros-mipsbe-6.21rc3.npk", but problem remain exist. Can anyone please give me the link of "firmware patch (ar7240_3_17_2_Metal_2SHPn.fwf)" ??????

raktim

Does RB951Ui-2HnD has input power in ether1 & output power in ether 5???

raktim

Can i do it in RB951Ui-2HnD???

raktim

My Problem has solved. it's working,

1. i have connected Mikrotik lan to Netgear Lan port (not wan)
2. disabled dhcp on netgear.
3. enable dhcp on mikrotik.

thanks,

raktim

raktim

I have bought a TPLink TL-WN 350 GD, but my Mikrotik x86 machine does not recognize this wlan card. so i want to use this netgear as AP with my Mikrotik, so clients can access Ap. i am newbie in wireless network. i want to convert my cable network to wireless network for clients. please need your he...

raktim

Can i use "Netgear WGR614V7" as Access point with Mikrotik? if possible please write details..

thank you.

raktim

Hi i want to implement wireless network in my area, i don't have any idea about wireless network. Can i use "Netgear WG311T 108" Wireless interface As Access point in x86 mikrotik.

raktim

i want to flush/delete all logs from Mikrotik router without reboot.

any idea?

thnxs,
raktim

raktim

thank you very much. But need help in nat rule. Please help me in src nat rule. i have tried with below rule, but not working

chain=srcnat action=src-nat to-addresses=xxx.xxx.58.0-xxx.xxx.58.127 (ISP1, here i put xxxx.58.1/25 in lan ip from isp1)
out-interface=ether2 (ISP2)

raktim

But what abt DVB technology??

thnxs,
raktim

raktim

i wanted to all of my Rx packet will come from ISP1. and Tx packet will go through ISP2.
Isp1 is use for download and isp2 is for only upload.
How can i will mark Rx and TX separately??

isp1---------- |------------|
lan -----------| RB1000 |
isp2-----------|------------|

thnxs,
raktim

raktim

sorry, this is not what i wanted.

In my pppoe secret list i have many disable users. i want to print only enable or disable users from the secret list. Which will help me to find out how many users has disabled in this month.(Billing purpose).

thnxs,
raktim

raktim

i have more than 3000 pppoe user's per router. To find out the User list i just use the command /ppp secret print
I want to see only enable or only disable users from pppoe secret list in terminal mode.

thnxs,
raktim

raktim

i have started a packet sniffer and file saved as a sniff. But how can i read this sniff file from Files Menu ???

thnxs,
raktim

raktim

We need powerful router than RB1000 also need SFP ports.

thnxs,
raktim

raktim

i have configured Hotspot. Now i want to make quota limit for my user. How can i??? do i need to extra radius server machine?? is it possible without extra radius server machine???

thnxs,
raktim

raktim

All of my clients are pppoe . how can i make a quota per user. like "user1" can download 5Gb. after 5Gb used, then user cant browse or download. users: 2 sun pppoe 123456 Gold 10.0.0.16 3 nasuha pppoe faisal Silver 10.0.0.24 profile: name="Gold" local-address=10.0.0.1 use-compres...

raktim

same problem

bgp-cease.JPG

raktim

thnxs kirshteins & SurferTim, it's working

raktim

i have tried with v3.28, 3.24, 3.20, 3.13 . script can run but changes not occurs in filter rules.

thnxs,
raktim

raktim

thnxs for reply, but it's not working..

raktim

i want to open p2p for specific time but below script is not working. i dont want to disable/enable the filter rule.

/ip firewall filter set [find P2P=all-p2p] action=accept
/ip firewall filter set [find P2P=all-p2p] action=drop

raktim

I m using V3.15 RB1000 for BGP.Total Bw uses 60Mbps. My Upstream is International Internet Gateway (IIG1), Some days ago they(Upstream) have changed Cisco to Huawei.
Now my BGP hangs 4/5 times in this week. To established BGP i have to disable/enable peer so many times.

BGP.JPG

raktim

THNXS, CHUPAKA

i used below rule but not working, anything else or did i miss anything????

chain=srcnat action=src-nat to-addresses=202.X.X.0-202.X.X.7
src-address=192.168.96.0/28 out-interface=wan

raktim

i have 192.168.1.0/24 private ip masquered to 1 real ip. But i want 192.168.1.0/24 will masquered to xxxxxx/29 public ip. So, client's can uses rapidshare.

Any idea??

thnxs,
raktim

raktim

mac-block.JPG

Not working, still logged in from this MAC.

Flags: X - disabled, I - invalid, D - dynamic
0 ;;; test
chain=input action=drop src-mac-address=00:21:27:C6:3B:8C

raktim

1. how can i sure that firmware is upgraded??? & what is the way to upgrade the firmware in x86 machine???

2. There is no prerouting option in filter rules. Do i need mark the connection first in Mangle???

thnxs,
raktim

raktim

i want to block MAC address for pppoe clients. i m using V3.13.

// chain=forward action=drop src-mac-address=00:21:27:C6:3B:8C Not working...

Any idea???

thnxs,
raktim

raktim

Have u checked the switch? It can happen if generate broadcast storm in switch which connect with Router interface (Lan). U can check it by ping from client end to router local address.

thnxs,
raktim

raktim

i was using webproxy for my 1000 pppoe broadband clients. here i used sata 250 Gb hdd. router os v3.13. When cache fill up 70% of HDD, that time browsing speed is so slow but download speed is fine. What abt ssd?? Can i use it on cache drive instead of Hdd??? Now a days 250 Gb sata ssd or PCI-Expres...

raktim

Is it possible to make volume based internet connection for my pppoe clients. ie. specific profile based clients can't use more than 1GB BW.

thnxs,
raktim

raktim

But where i have to use this packet mark???
i have more than 1000 pppoe clients, and i put their BW in pppoe profile.

thnxs,
raktim

raktim

i m using mikrotik proxy more than 6 machines. version 3.13. the queue, where packet mark for unlimited cache. everything is fine but sometimes this queue freezes, that time clients (pppoe) get unlimited bandwidth. to solve this problem , i have to change queue type, default to default-small, again ...

raktim

i was used "rate limit" at cisco 2811 . May be it will help you.

thnxs,
raktim

raktim

i m newbie here (User Manager). I have mikrotik router RB1000 which have 1000 pppoe clients. I need a simple billing solution. How User manager help me??? or Do i need another radius manager server??? i read topic user manager in wiki. but i cant understand.

plzzzz need help..

thnxs,
raktim

raktim

i did it succefully, check below link

http://forum.mikrotik.com/viewtopic.php?f=2&t=26755

raktim

make another queue, in this queue the dst. address is ur yahoo address or any which u want un limited. and put it the top of the previous queue.
Or u can mark packet in mangle by messenger port and in queue advance use mark packets and make it unlimited.

thnxs,
raktim

raktim

is it possible to add mikrotik with satellite modem (Comtech 8psk tpc 10M, cdm 570) ???
i have a cable converter serial to ethernet, can i use it in rb1000 or X86??

need advice.
thnxs,

raktim

raktim

if ur simple queue type is default-small, make it default.

thnxs,
raktim

raktim

MMM MMM KKK TTTTTTTTTTT KKK MMMM MMMM KKK TTTTTTTTTTT KKK MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK MikroTik RouterOS 3.20 (c) 1999-20...

raktim

Can i make Mikrotik + cisco switch as a Inter vlan routing. Like "Router On a stick"
Any one have any idea??

thnxs,
raktim

raktim

At first u have to add masqurade rule. then redirect rule. or try disable in - interface.
In v3.17 it's automatically in transparent mode. And in transparent mode, dont need to configure browser's proxy.

thnxs,
raktim

raktim

i read the the mikrotik manual to understand the "Action=same". May be example will clear my confusion.
please help me.

raktim

/interface pppoe-server remove [find user=abcd]

thnxs,
raktim

raktim

//i want 30% bandwidth will use gateway A and 70% for gateway B. I m using V3.13 //i made mangle rules: add action=mark-connection chain=prerouting comment=A connection-state=new \ disabled=no in-interface=lan new-connection-mark=A_con nth=3,1 \ passthrough=yes add action=mark-routing chain=prerouti...

raktim

Can anyone plz tell me, which version is stable for dual core. i have tried with v3.13, but freezing.

thnxs,
raktim

Magically freezing problem has solved in v3.13. i think its stable v3.13

raktim

Can anyone plz tell me, which version is stable for dual core. i have tried with v3.13, but freezing.

thnxs,
raktim

raktim

check below link

http://forum.mikrotik.com/viewtopic.php?f=2&t=26755

raktim

how can i get unlimited cache from my external linux(squid) box??

thnxs,
raktim

raktim

change mss to 1400

raktim

How can i discard everything at end..
i have add
/routing filter add chain=btcl-out prefix=xxxxx/22 prefix-length=22-32 action=passthrough
/routing filter add chain=btcl-out prefix=0.0.0.0/0 prefix-length=0-32 action=discard

but it's disacard everything, also prefix xxxxx/22

thnxs,
raktim

raktim

Can any one explain "BGP local pref" and "BGP prepend"??

thnxs,
raktim

raktim

problem has solved. i just have to add lan ip or pppoe local ip(172.16.101.1/32), in /tools graphing queue and interface rules.

thnxs,
raktim

raktim

It's not working. May be i missed something in my routing filter rules,

bgp2.JPG

mang1.JPG

plz need urgent help,

thnxs,
raktim

raktim

write ur all configuration here

raktim

have u set ur interface arp-reply only

thnxs,
raktim

raktim

THNXS mrz
In BGP Route Filter i have add Prefix= xxxxx/22, But what is prefix length, what should i have to write here.

thnxs,
raktim

raktim

it's a dynamic ip in address-list. May be u have put a rule for "ssh attack" or something else in firewall there u mentioned that Action= add src to address-list

thnxs,
raktim

raktim

so, i think out-filter should be advertised routes of my BGP.
And In-filter should be my Upstream's BGP routes.

Am i right???

thnxs,
raktim

raktim

i can understand the Prefix-list-out= which i have advertised (xxxxxx/21) in my BGP. But I cant understand the Prefix-list-in. In documentation it is written that "receiving routes". it is not clear to me. In V3 i dont get any doc abt BGP filter. Can any one help me to remove my confusion ...

raktim

raktim

i add xxxxx/22 in Queue & interface rules.But it's not working. It's working when i make it 0.0.0.0 . i m using more than 16 Mikrotik routers. i dont find this type of problems in others. i have made new proxy on it & upgrade in to v3.13. I thought may be it occurs by proxy or version. thnxs...

raktim

go PPPOE server then set keep alive time to lower value

thnxs,
raktim

raktim

i cant see the graphs but if i make 0.0.0.0 to interface and queue rules then i can. i m using public ip to acces the graphs. my ip is belong to /24 subnet (red mark of the pic) . here i m using Mikrotik proxy. //chain=srcnat action=masquerade src-address=172.16.104.0/22 out-interface=wan //chain=ds...

raktim

r u using mikrotik proxy or external proxy???
i think below link will help u to solve the problem

http://forum.mikrotik.com/viewtopic.php?f=2&t=25549

raktim

make a queue with dst-address is ur squid server address and put the queue at the top

thnxs,

raktim

raktim

i did n't face this type of problem before, But when i upgrade v2.9.51 to v3.13 i m really confusing abt "Peer is not responding"

is it cable problem or router????

raktim

thnxs,
Done

raktim

proxy-debug.JPG

why web-proxy debug??

raktim

ok i will try to solve my problem from old archieve, if i need help, then i will write again.

thnxs,
raktim

raktim

can anyone tell me what type of warning message it is??
and what i have to do for it???

warning.JPG

thnxs,
raktim

raktim

Thnxs Chupaka,
But i need documentation or any articles, how can i do this??

plz need ur help

thnxs,
raktim

raktim

how can i view the web proxy log file??? i mean access.log(which ip browses which website) file. I am using v3.13.

thnxs,
raktim

raktim

thnxs Chupaka, It's my core BGP router. not possible to reboot or update for single moment. if i will get chance, i 'll do it later.

Again thnxs for ur advice.

thnxs,
raktim

raktim

i cant see any tx rx rate. i have to check it by interface.would u plz see the below pic

queue.JPG

thnxs,
raktim

raktim

see the below link, i think it will help u.

http://forum.mikrotik.com/viewtopic.php?f=2&t=25549

thnxs,
raktim

raktim

Thnxs Chupaka... it's working.

thank u very much.

thnxs,
raktim

raktim

just simple queue..

can u plz tell me da difference between default-small & default

thnxs,
raktim

raktim

i have tried but failed...

mangle.JPG

is it right way???

raktim

i have 400 pppoe users. But i need help to make mangle rule which will mark the cached packet. then i will make a simple queue & put it at the first with unlimited bandwidth. May be it will help pppoe users to get access cached without queue limit. can anyone plz help me abt the mangle rule??? t...

raktim

it's very simple. U have to install raspppoe protocol in ethernet. then u can run raspppoe from run menu, just write "raspppoe" and enter. now u can press query available service to get service and press create dialer for that service.

it's so easy,

thnxs,
raktim

raktim

Now it has solved(Cisco 2950T), when i changed ""channel-group mode On(Enables Ether-channel Unconditionally)"" instead of Auto. It's not working, when mode is in Port Aggregation Protocol.

thnxs,

raktim

raktim

Thnxs mrz, What i have to do to make both link same speed? In my Cisco2950T etherchannel ports are Gi0/1 and Gi0/2. And other ports are 10/100 where branch mikrotiks are connected.
Below is my core mikrotik interface pic where mode is round-robin.

bond1.JPG

raktim

i want to add some info here that my core mikrotik is RB 1000 v3.3 i think this scanario will make us higher throughtput, loadbalance, failover . but i am facing some problem, i am testing in different mode like balance -rr, balance-tlb. In balance-rr i got packet loss 10% may be created loop In bro...

raktim

i bond My Core Mikrotik with Cisco 2950T, //Core Mikrotik: name="mbd-bond" mtu=1500 mac-address=00:0C:42:20:9B:8F arp=enabled slaves=ether4,LAN DIST mode=broadcast primary=none link-monitoring=none arp-interval=100ms mii-interval=100ms down-delay=0s up-delay=0s lacp-rate=30secs //Cisco2950...

raktim

is it possible with Cisco catalyst 2950 ???

How can i make 1 uplink only,??? would u plz write the technique or command

thnxs,
raktim

raktim

does n't matter 200 clients or 5000 clients, If u have more clients then u should have more switches. First u have to start from Core switches then others.

switch.JPG

thnxs,
raktim

raktim

u have to connect your pc to your lan switch (client's switch). Now check query , if unwanted service is available,then disconnect the one cable and check query,again disconnect other cable and check query. Now u can find out which cable is responsible for unwanted service. and this way u can get th...

raktim

By using "Raspppoe" at client's end, problem can be solved. if u press query, then it will shows the all services in this lan, then u have to select the service name (pppoe server name) and create a dial up. If u want u can catch that client's who made another ppppoe server or other server...

raktim

Sergejs, I have made bridge in one of my router as a test basis. Here My pppoe server interface is "bridge1", and lan1 & lan2 is bridge ports. bridge.JPG //if i keep two uplink (like bonding) from lan1 & lan2 to client's switch, pppoe server is not working, //if i keep one uplink(l...

raktim

Thnxs, Sergejs. i need better performance coz i have 700 pppoe clients and in pick hour bandwidth uses more than 35Mb. I thought it will balance the bandwidth between two interfaces & will deliver higher throughput. Can u plz try to help me, how will i make bridge between 2 interfaces??? Thnxs, ...

raktim

i have made a pppoe server by bonding interface, where ether2 and ether 3 is slaves and mode is round robin algorithm.

My problem is when i use Raspppoe to get service, Now i get 4 services. Before bonding i always got 2 services.

bonding.JPG

raktim

Average Cpu load is not greater than 30% and i think if i will upgrade to V3.13 than Cpu load will decrease.

thnxs,
raktim

raktim

Can u plz tell us, which version r u using????

And details info. about public ip subnet which is used in ip pool.

thnxs..

raktim

i have been running RB 1000 last 4 months. It's a great. I used for core router, E-BGP & I-BGP is running smoothly and my bandwith is 70 Mb.

bgp.JPG

Thnxs,
Raktim

raktim

There is a option in read only user "Hide Password" . But i dont want to give permission to see password for "Read only access" user's in secrets mode.

pppoe.JPG

raktim

I need a solution to Mikrotik Team. I have 400 pppoe users. i dont want that, read only access users can't see the password in secrets mode. is it possible for read mode access????

thnxs,

Raktim

raktim

i have upgraded one of my router to v3.13. But still no change. i think Mikrotik Team should think about this "PPPOE Active connection"

raktim

i get back my router life. By view below topic ....

http://forum.mikrotik.com/viewtopic.php ... ic#p122492

thnxs,

raktim

raktim

i have 400 pppoe clients in this router(x86 platform). Today morning, i just upgrade my router from v2.9.51 to v3.13. But It says "Kernal Panic" Everything has gone

raktim

My BGP router is Mikrotik, i had a e-BGP with "IIG1", Now i need to make another e-BGP with "IIG2". i had advertised "xxxxxx/22" in "IIG1" and now "yyyyy/24" in to new "IIG2". Do i need to add another instance & AS number for "IIG2...

raktim

Thnxs Normis,

Can u help me again?
if i upgrade in to v3.11 Do i have to face problem in this below topic??
http://forum.mikrotik.com/viewtopic.php?f=2&t=22294

raktim

but did you see the other posts? you can't shutdown, even if it offers you to.

i have checked 3 of my mikrotik v2.9.51. if i press shutdown as a read only user, it's really works.

,I have checked in my other v3.10, here it offers but not working.

thnxs,
raktim

raktim

i think i should have to send my supout.rif to support

thnxs,
raktim

raktim

Looking at your Pictures again you do have it disabled. I tested on Version 3.11 the option is there and the box comes up but it does not allow it reboot or shutdown. Timatics, i want to say u that, i have also tested in v3.10,3.3 & 3.4 before post this topic. But problem occurs only in v2.9.51 .

raktim

the default allowed actions for the user group "read" allow reboot. change your read group Policies or create a new User group. I agree the Default should not allow reboot. But it can be fixed easy enough. Did u see my first pic? In my read group , there were only 3 policies ... read, win...

raktim

My read only access user's of winbox can shutdown the system. Any idea to disable this option for read only user???

pic1.JPG

pic2.JPG

raktim

when i log in to winbox, sometimes it's show 2 times. i dont understand why this happening? plz check the red mark area from below pic.

log_info.JPG

raktim

u have to do policy routing, //mangle, /chain=pre-routing src-address "ur lan address block" Action=mark routing, New routing mark "test" pass through=yes //routing, /ip route rules then add src-address "ur lan address block" routing mark= "test" action=lookup...

raktim

make a queue, dst-address is ur client's address block. and place this at the top.

thnxs,
raktim

raktim

What's ur FTP IP address. Is it Public or Private?

Can u plz set a real ip in FTP server, then try from outside.

& check (FTP Server) /etc/hosts.allow
/etc/hosts.deny

raktim

i m also facing this....

raktim

Just boost up ur bandwidth,
i think it 'll solve ur problem.

thnxs,

raktim

i have already send my supout.rif to support@mikrotik.com May be they will help me to find out the problem.. 10 days ago i've bought 3 RB1000. under this core router i have also installed two of them. WE have also running 12 more routers in x86 machines. But i think RB1000 is not better for huge ban...

raktim

check interface MRU & MTU

raktim

some times it goes through 100%.

core_router1.JPG

raktim

i m using RB 1000 in my isp as a core router . Here i m using BGP routing and bandwidth is 44 MB. Within 4 days it hangs 5 times. last two days it's works fine.

core_router.JPG

raktim

i did it, But i m curious about layer7 filter. i upgraded my router to v3.10 just for layer7.

Any idea, how to block this in layer7 filter.

thnxs,

raktim

Below is my torch result..........................

rp_torch.JPG

how can i block this by using layer 7 ??????

thnxs,
raktim

raktim

i have a client, who took 2 Mb from my isp. He has made a VPN by using 80 port. How can i block his outgoing VPN??? ANY Idea???

raktim

Any one here to solve my problem.....
"Normis" can u plzzz help me ????

raktim

plzzz help me "sergejs"....

if u need any info's or details of my router, then i will send u.

raktim

plz check the "test" queue, (red mark) there is no download bytes has sent.

bandwidth.JPG

mangle.JPG

raktim

thnxs "omega-00" i dont need that script. plz check my first pic. there i have put a queue named "test" at the top.

it's not working.... any other idea.........

raktim

Below pic is assigned ip for clients...

as_ip.JPG

raktim

i have unset coneection-state in mangle rule.

But it's not working Sir...............

Any other idea .....

thnxs,
raktim

raktim

i have 1000 of pppoe customers. below is my routers info details..... //my wan=xxxxxxa //(default gateway) ip route, destination 00000 gateway = xxxxxxxb (proxy machine) //(Nat) chain=dstnat, src-address=10.0.0.0/22, protocol=tcp, dst-port=80, Action=dst-nat to-address=xxxxxxxb to-ports 3128 //mangl...

raktim

make unknown interface to known........

thnxs,

raktim

make 2 parent queue
1 for dedicated bandwidth 512kbps.
2 another for 1536kbps, and make childs from here as many as u need.

i think it will solved ur problem

thnxs,

raktim

raktim

how u want to access??? By winbox or ssh??? if u want to access by winbox then //ip firewall filter rules add input= (ur remote side ip address) action=accept if u want to access by ssh/telnet/ftp then // ip service available from = (ur remote adress) try it... i think it will work now thnxs, raktim

raktim

Make Mangle rule, //ip firewall mangle prerouting src-address=(ur client's ip ) action= mark routing new-routing mark= (any_name) passthrough=yes Then add routing policy rules, //ip routes rules add src-address=(ur clients ip) routing-mark=(any name) table=(any_name) action=lookup Add route, //ip ro...

raktim

U can use //ftp ur address
use binary //hash bin
then use //mput filename

i am sure it will work now

raktim

:( i failed to setup VPN.. Can u plz help me in this below scanario. Mikrotik: / interface ipip add name="Tunnel1" mtu=1480 local-address=xxxxx remote-address= yyyyy / ip address add address=xxxxxxx/24 interterface=WAN add address=192.168.1.1/28 interface=LAN add address=10.0.0.1/30 interf...

raktim

Thnxs for link.
do i need to configure any NAT rules????

MY
wan ip xxxxxx
remote ip: yyyyyy
tunel ip: 10.0.0.1/30
lan ip:192.168.11.1/28

i m trying to go outside from lan, But i failed.

raktim

i need to make a VPN between mikrotik & cisco router(other end). which one will be easy & better for me, ipip,pptp, l2tp or pppoe????

raktim

thnxs for ur help...

so, it should be,

first queue for loop,
target-address=192.168.0.3 Max-limit=5M/5M Dst-address=192.168.0/16 Limit-at=5M/5M

Second Queue for Internet,
target-address=192.168.0.3 Max-limit=128k/128k Dst-address= 0.0.0.0/0 Limit-at=128k/128k

Is it right now???

raktim

Have u tried with another OS in this machine??? try with linux.....

thnxs,

raktim

simple queue-->general-->target address = 192.168.0.5 max-limit = 128k/128k
advance---> dst-address--> 192.168.0.0/16 limit-at= 5M/5M

is this rule will work for above scanario?????

thnxs

raktim

i think DOM will be better. We have been using since 2005. For HDD it's chance for crash. We have lots of experience about that. At last i think CF is da best.

thnxs

raktim

ip firewall dst nat protocol=tcp In-interface=lan dst-port=80 Action dst-nat to address= xxxx (ur fedora/linux) to ports=xxx (ports u have to use, for proxy may be 3128)

raktim

queue.JPG

thnxs for the topic & solution. Can u plz help me in this scanario. i want to give internet access speed 128k/128k. loop speed 5mb.

How can i??

plz give me a solution???

raktim

route.JPG

Here the system history. When the route changes automatically the history shows nothing "BY" (red mark). then the script(which i have made to change gateway to xxxx.9) change the route of gateway "BY uzair" (green mark).

Question is how it changes(red mark) ??????

raktim

i am sure there is no script. But My previous proxy was xxxxxx6. i have changed this ip address from xxxx6 to xxxxx9 .

raktim

But it has happend when power failed and machine reboot. To overcome this problem i have wriitten a script "/ip route set [find dst-address=0.0.0.0/0] gateway=xxxxx.9" and time interval is 2 mins.

Now i dont have to change it manually & dont need to monitor it frequently.

raktim

There is the same bursting available for PPPoE clients, like you had in queues, http://www.mikrotik.com/testdocs/ros/2.9/root/queue.php?permalink=0.3615235635894125 If you will use Rate-Limit, here is syntax for the configuration, 64k/64k 256k/256k 128k/128k 10/10 rx/tx-rate=64000, rx/tx-burst-rate...

raktim

My Gateway xxxxxxx.9 is proxy machine. some times gateway of routing is change automatically to xxxxxx.6.

Any idea to solve this problem????

gateway.JPG

raktim

Gateway of routing is changing automatically when machine reboot.

Any idea????

raktim

For too many client's it's not possible to write a script to remove client from active connection. ppp active remove [find ppp active find]?.. i know that script. Questions was changing profiles for pppoe clients . i just said, i have 200 clients it's not possible to write 200 scripts to remove cli...

raktim

to change profile ---system script, add /ppp profile set "tester" rate-limit=128k/128k i think there will be a problem. Coz... if 200 pppoe customer logged in as a profile name "silver" speed 64k/64k. when profile will be changed to "Gold" speed 128k/128k as a scheduled...

raktim

when i realised someone is using my ip:XXXXXXX . then i static the ip from ARP list & made the lan to reply only. But i really shocked :( he is still using this ip. he has changed his mac address to same as mine. maybe by using MAC scanner & changer software. Any one have any idea to save fr...

raktim

Me too. We are waiting for MUM@Dhaka, Bangladesh.
I think Our Dream will be come true.

raktim

i put it at the first position. Change has occured. but rate of queue is greater than interface,
Any idea plz???

queue1.1.JPG

raktim

change the MRU MTU rate of interface, now check msn messenger.
i think it will work. keep the rate from 1480 to 1500

raktim

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \ comment="drop ssh brute forcers" disabled=no add chain=input protocol=tcp dst-port=22 connection-state=new \ src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \ address...

raktim

We ar using mikrotik v 2.9.42 only for bandwidth manage. But the sum of queues, total bandwidth using rate is 6.3/4.3 Mbps. But in interface it shows 8.0/5.3 Mbps. Question is where it has gone (interface-sum of queues) 8.0-5.3 =1.7 Mbps ???? there is no extra services & routing (BGP, Rip,static...

raktim

i have upgrade my router from 2.9.42 to 3.4. I have 350 pppoe clients. But in 3.4v, we dont find Tx & Rx rate in pppoe-->> Active connection list. So it's a problem for me to find out which user against which ip uses how much bandwidth. But it has given in ppp-->interface list. But there is no M...

raktim

[admin@MikroTik] ip proxy> print enabled: yes src-address: 0.0.0.0 port: 3128 hostname: "proxy" transparent-proxy: no parent-proxy: 0.0.0.0:0 cache-administrator: "webmaster" max-object-size: 4096KiB cache-drive: system max-cache-size: none max-ram-cache-size: none status: runnin...

raktim

ip firewall Filter Rules then add chain=input src address=ur outside address(which address u want to login from outside) action=Accept

try this, it think it will be working now

raktim

it's very difficult to get visa out side of Asia. i think it will helpful for us, if u will make it near INDIA or Bangladesh.

raktim

i have 250 above pppoe users under 7 different profile. i want to give winbox read access to profile wise. i mean one can view his active users under specific profile. any one help me plz?????

raktim

i have 250 pppoe users under 10 different profiles. i want to give winbox read access for specific profile base. i mean, one can view his active users under specific profile by using winbox. Any one have any idea plz????

raktim

If u want to block voice, then block some ports in 17udp protocol also u have to block some ports in tcp protocol in ur MT filter rules... i think it's working now... if not, contact with me.. Zubair vhai... Thnxs

raktim

In ip routes u have to add destination & gateway should be ur proxy server address...
i think it's working good...

raktim

i think u have to check the firewall settings may be u have dropped some ports...

raktim

there is no firewall added in first mikrotik(122.102.32.154/30) & also /ip services name=www port=80 available from=0000/0

//problem is i cant remote access (winbox) from 202.148.56.0/24

but i can find telnet & ping from it....

raktim

Hi,
my wan address is 122.102.32.154/30. & my lan address is 202.148.60.249/30.i can looged in from my lan address.
BUT, i can't logged in 122.102.32.154 from my other's mikrotik address 202.148.56.1/24 while my computer address is 202.148.56.58.

Search found 184 matches