MikroTik

gazingbazooka

This might be a little crazy. I have an RB3011, it has two internal switches. I have a need for a second router that's disconnected from my main one at home, and I don't really use the second switch in the RB3011. Can I just create a second bridge with a DHCP server/client and use it as a 2 in 1? Br...

gazingbazooka

Thank for your help!

gazingbazooka

Right you are. Caught my copy and paste sloppiness.

Can you help me understand how the list is better than using the src-address approach? It seems to me like the end result is the same, however it forces me to keep a list in parallel.

gazingbazooka

So it sounds like the same firewall rule except using a list: add action=reject chain=forward out-interface=ether1 reject-with=icmp-network-unreachable src-address=!staticIPList time=\ 2h-6h,sun,mon,tue,wed,thu,fri,sat vs just blanket address: add action=reject chain=forward out-interface=ether1 rej...

gazingbazooka

I'm still looking to just turn off the internet for everyone that's not in the static list. This includes my laptop, kids devices, my neighbour being on my wifi. Just peace and quiet. The only devices I care about being on are in this list: /ip dhcp-server lease add address=10.1.8.2 mac-address=XX:X...

gazingbazooka

RB3011, I'm trying to turn off the internet at night for all devices with dynamic IP. I tried kid control but you have to list every device which is very painful. I'm thinking of just turning off the internet at night for everything that's in the DHCP server IP range with a firewall rule. Everything...

gazingbazooka

Do you have more information? What model? Where is your export of your config? Is it always 100% even on bootup?

gazingbazooka

Have you checked the gold standard: viewtopic.php?t=143620

gazingbazooka

1. I saw the guide suggested in here , that suggests creating vlan interface in a new bridge, so this means having 3 bridges. I think that's the old way. You only need one bridge. As others have mentioned multicast will break with VLANs so just keep stuff like Chromecast on the same VLAN as your de...

gazingbazooka

Here is what I was able to piece together for Dynamic WAN + PPPoE failover: /interface bridge add auto-mac=no name=bridge /interface pppoe-client add disabled=no interface=ether1 name=pppoe-out1 /interface list add name=WAN add name=LAN /ip pool add name=dhcp ranges=192.168.88.10-192.168.88.100 /ip ...

gazingbazooka

question 1:
jan/02/1970 00:04:14 This tell me that you have not setup NTP at your router. You should do thos

Likely never been connected to the internet to pull the time

gazingbazooka

If you're trying to do Dual WAN then I wouldn't touch QuickSet. That's way outside the scope what that page can handle. You'll need to dig into WebFig/Winbox.

gazingbazooka

That's not how anav works

gazingbazooka

@anav you're a firewall machine. You should create a sticky post for reference.

gazingbazooka

CAT5 cable though!? I dont think that's the issue but I dont even know where to get a CAT5 cable these days.

gazingbazooka

Start here: viewtopic.php?t=143620

gazingbazooka

So the ask is:

PC1 and PC2 online -> Total bandwidth between the 2 is 5Mbps
PC1 or PC2 online -> Total bandwidth for 1 is 10Mbps

So the PCs get double the speed when the other is not online. I'm really curious why?

gazingbazooka

Good call anav. I usually try to make the WAP central to the house but I know that's not always a possibility.

gazingbazooka

That's a great combo. Is that all your requirements? No VLANs? How fast is your internet? If budget is tight and you aren't going to customize then you could get away with a HEX (RB750gr3) and UAP AC. I don't see how it wouldn't work in your case based on the requirements you stated.

gazingbazooka

I'm no expert but I play one online. Circular loops in networks sound like a bad idea to me. I'm curious about the answers to the questions though. If you want to keep the traffic on the switches what if you just plugged one switch into the other? Router > Switch1 > Switch2. Or is this a purely hypo...

gazingbazooka

Isn't this just a simple queue with a limit of 10m for both the devices? Or am I not understanding correctly. So if both are online they will share the 10m equally. But if only one is online they take the full 10m.

gazingbazooka

Not sure if I'm missing something obvious but on a Mac I cannot paste into Webfig Terminal. This is pushing me to SSH more and more but it's just convenient sometimes. What gives?

gazingbazooka

You have a double firewall though don't you? Why isn't the ISP router in Bridge mode? If I understand correctly you have a router plugged into a router. It seems that way from the IPs you're indicating. This will cause you headaches like this.

gazingbazooka

That’s it! Thanks so much. I was trying to use net watch to check for the new IP. This is what I needed. I didn’t realize you can have a script on DHCP Client changes.

For PPPoE it just needs to sit there till it gets lit up as a backup when primary goes down. Nothing fancy needed there.

gazingbazooka

I know this must have been posted many times and I have seen all those posts. Most talk about static IP/Gateway which I do not have. My setup is RB2011 or RB3011 with a Dynamic Internet connection + PPPoE DSL for failover. My current failover strategy is: move the physical cable over (much to be des...

gazingbazooka

Thanks for sharing your feedback! Good to know that MS Teams works elsewhere - could you confirm if RouterOS version is the same like mine? I haven't customized the firewall, I just did some minor WiFi adjustmenets. The issue is reproducible on several devices so I guess it's not something specific...

gazingbazooka

You said you started using it recently? Are all settings out of the box or did you customize anything. There should be 0 issues with Teams running out of the box.

gazingbazooka

@anav (or others) is there a way to run profiling on firewall rules to see how much of a burden it is on the HW? For example, the. original question from the OP it looks like a lot of rules to continuously process. But how do you quality if you have gone over the board?

gazingbazooka

Maybe is for another topic, but i have some FW rules to add to a list called "blocked" to the IP from try to snif some ports. I was collecting like 20-30 IP addresses by day, but now I have more than 1000 in 5 hours. I must be worried? I copied a script to convert that dynamic IP to stati...

gazingbazooka

Thanks. This is running Rogers Ignite. I'll try to spot check that once the internet usage dies down later tonight by pulling the cable.

Shouldn't this happen automagically?

gazingbazooka

I got a weird issue that's more of an annoyance but I thought it was localized to my crappy modem but that's not the case. Setup is RB2011, RB3011 and RB750GR3 connected to a modem in bridge mode, this is in separate locations. In the past I had some Internet speed issues and I tested it by unpluggi...

gazingbazooka

I'm sure someone will reply with the golden standard post on VLANs: https://forum.mikrotik.com/viewtopic.php?t=143620 From a quick glance the config is missing some stuff. Where are the ports? The bridge? You need to assign the VLANs to ports. How are you setting this up? Something like: /interface ...

gazingbazooka

I have the RB750Gr3 for testing out changes. I took a quick glance, and from my noob standpoint I can tell you this thing does not go full speed with any extra configs. I have seen 600Mb/s at home with default settings and fasttrack to the max. Any queues and packet marking will only slow it down.

gazingbazooka

Apparently yes the Mobile app uses Winbox, it was right in the logs. I would prefer Winbox off but such is life:

user admin logged in from 10.1.8.107 via winbox

gazingbazooka

I would go with PPPoE on router. Why? One could be marginally better than other however the MikroTik is fully secure and in your control. The same cannot he said for the modem. So as quickly as you can offload the work from the modem to the Mikrotik.

gazingbazooka

Did you look at the tutorial?

One thing I will point out since I started with this problem as well. Stay away from VLAN 1. There are 4000 numbers to choose from. Do not use 1. It’s not a fun ride.

gazingbazooka

Was playing around with the MikroTik app for iOS and while it saw the router it wouldn't connect. It had me second guessing my password till I tried toggling the services and it would appear that it won't work without the Winbox service running. That's kind of odd to me. Wouldn't this be using the w...

gazingbazooka

viewtopic.php?t=143620

gazingbazooka

I could get it to work using the proper vlan switch method and not the bastardized chip based vlan method LOL (only saying that cause I dont know how to configure it based on hardware chip approach).

I'll try the non-Switch way and see what I get.

gazingbazooka

I'm keeping the changes on the AP to a minimum. Really not much there as far as I remember. i set this up years ago and it's been solid, haven't changed anything till the VLANs this weekend. Nothing fancy, there are 3 SSIDs over 2.4/5GHz, all internal, and each one specifies a VLAN. It's running th...

gazingbazooka

Remove I believe. The desktop won’t ask for a new IP till the lease expires. So yes it will disappear from the list. Once the lease expires it will ask for a new address and you’ll see it back in the list. Just because you killed it from the DHCP Server list doesn’t mean that gets broadcasted to the...

gazingbazooka

You will need a managed switch. Only thing you could try doing is having everything as one VLAN when one is not specified then explicitly configuring other devices as a different VLAN on the switch. That just seems like a maintenance nightmare.

gazingbazooka

That's interesting. I get no MAC addresses in the list, but they show up right away if the router has an IP and MAC. So I cannot configure any router that doesn't have a default config.

gazingbazooka

I'm keeping the changes on the AP to a minimum. Really not much there as far as I remember. i set this up years ago and it's been solid, haven't changed anything till the VLANs this weekend. Nothing fancy, there are 3 SSIDs over 2.4/5GHz, all internal, and each one specifies a VLAN. It's running the...

gazingbazooka

@JazzMaster, is there an easy way to extract that kind of like /export? I did the settings backup but that looks like a binary file.

gazingbazooka

I added the Queue back in and turned off Fasttrack though I don't think this will solve my issue.

gazingbazooka

I was grasping and thought maybe this was getting caught up in the firewall rules somehow and QoS queue had me turn off Fasttrack. Internet connection is 500/20 but with everything going on I was getting like 60-100 down. Seems like they fixed the issue now.

gazingbazooka

Wine seems to work fine with Winbox on a Mac FWIW as long as the router is giving out an IP

gazingbazooka

I turned off my simple QoS queue so I could get fast track back on. I thought that would help. I was running the same setup less the VLANs on the RB2011. Switched to the RB3011 with the VLANs on Sunday night. I thought the beefier HW with the VLANs would be a wash but something is a miss. The big di...

gazingbazooka

Actually that's a good idea. I just use that switch to get the power to the WAP. I can test out your theory by just digging up a PoE Injector and cutting the switch out of the equation.

gazingbazooka

Really tried to get all my ducks in a row with as much info as I could. I was able to catch this in action this morning and what is interesting is that while I couldn't access the internet in Chrome, I was also not able to get into the router at http://10.1.1.1 but apps like Slack continued without ...

gazingbazooka

With the guidance and help of everyone here I swapped out my RB2011 (without VLANs) with my new RB3011 with 3 VLANs. I learned a lot to say the least and networking is not my strong suit. Having said that I am seeing some hiccups with the internet connection. I know there is a lot of pressure on the...

gazingbazooka

That makes sense. Thank you!

gazingbazooka

Color me embarrassed! To my defense, how this really went down is: - Check RB3011 GUI on Switch Port menu, no SFP - Check RB3011 interface ethernet switch port printout, not there Flags: I - invalid # NAME SWITCH VLAN-MODE VLAN-HEADER DEFAULT-VLAN-ID 0 ether1 switch1 disabled leave-as-is auto 1 ethe...

gazingbazooka

Trying this out on RB2011 and I just noticed that the SFP port is not in the Switch Port. How do you configure it for VLAN? Flags: I - invalid # NAME SWITCH VLAN-MODE VLAN-HEADER DEFAULT-VLAN-ID 0 sfp1 switch1 disabled leave-as-is auto 1 ether1 switch1 disabled leave-as-is auto 2 ether2 switch1 disa...

gazingbazooka

I have no proof but I would guess that the packet loss is with your ISP and not with MikroTik. Unless there is something really funky in your config. Easier to see that with /export hide-sensitive than a print in each section.

gazingbazooka

I see ether2-master in there. I havent seen that in a while. Are you keeping this thing up to date? Full explanation on the IP address: "The size of the prefix, in bits, is written after the oblique. This is called “slash notation”. There is a total of 32 bits in IPv4 address space. For example...

gazingbazooka

Ok, I got it. Atheros8327 port ether2,3,4,5 untagged VLAN100 and ether5 tagged VLAN200. I have no idea what was preventing the DHCP server from kicking in before on VLAN100. Not sure if I want independent-learning on or off . Sample config for others: /interface bridge add admin-mac=64:D1:54:9D:88:6...

gazingbazooka

You can upload the file and import but this is not a good idea as I learned in the past.

Clear the config and copy over the file line by line.

gazingbazooka

I'm in no position to be helping but I fully expect the gurus will ask for an export of the config rather than pictures

/export hide-sensitive

gazingbazooka

This seems like more of a TP-Link question, though out of curiosity what's the model number?

gazingbazooka

Something is off, making this change I'm still not getting an IP: /interface ethernet switch vlan add independent-learning=no ports=switch1-cpu,ether2,ether3 switch=switch1 vlan-id=100 add independent-learning=no ports=switch1-cpu,ether2,ether4 switch=switch1 vlan-id=200 I'm falling back to even sim...

gazingbazooka

Thanks. Let me try this out. I'm not really focused on implementing my specific setup. I'm just trying to get something going that I can build from. In this case yes, ether2 is a trunk port and ether3/4 are access ports.

gazingbazooka

Yeah. I'm not fully understanding the switch1-cpu. It's there is some examples but not others. Is it the same idea as the bridge being the trunk for the VLANs in the other mode? I added the DHCP servers but still no IPs on either port. Would the switch1-cpu have something to do with it? /interface b...

gazingbazooka

I'm following the doc here: https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Setup_Examples on the RB2011/3011. I have a rough start. What I am struggling with is how is the switch VLAN gets a DHCP server. Do I still add the VLAN to the bridge so I can attach the DHCP Server, like so: /int...

gazingbazooka

Hybrid ports will work on the 8327? I need hybrid ports in my setup.

gazingbazooka

Do you know any good forum examples of setting up switch level routing on the Atheros8327? I'm fine starting with just one switch.

gazingbazooka

Found a post talking about the dual switch issue now: https://forum.mikrotik.com/viewtopic.php?t=152048 "There is a way to configure the device to have all ports switch together and yet be able to use VLAN filtering on a hardware level, though this solution has some caveats. The idea is to sacr...

gazingbazooka

I am all too familiar with that post. I've spent a lot of quality time with that post and anav setting up CPU based VLANs on the GR3. I'm trying to attempt VLANs using the switch on the RB2011. Those examples seems to be all CPU based switching. Is there a good post about doing that at the Switch le...

gazingbazooka

As I understand it for Routers such as RB2011/3011 the VLAN setup cannot cross to the second switch. I was thinking of adding the second switch in by creating two bridges and just patching it in as part of the VLAN by running a cable between ether5 and 6. Is that too crazy? Is there anything else fo...

gazingbazooka

What are you trying to accomplish by hiding the SSID during particular times?

gazingbazooka

Thanks for your help. I'm going to try to figure this out now on the RB2011.

gazingbazooka

Success! Complete config for anyone looking in the future. Not sure if you have time to spot check the Firewall rules but I followed what you had less the printer access. # model = RB750Gr3 /interface bridge add admin-mac=B8:69:F4:AB:32:8A auto-mac=no comment=defconf name=bridge vlan-filtering=yes /...

gazingbazooka

I already tried thinking about that. The issue is the Switch and the devices connected to it are at the other end of the house. The MikroTik is supporting 3 devices at one end and there is a patch link across the house to the PoE switch which supports the other 3 devices on the other end. Total of 6...

gazingbazooka

The WAP is: https://www.ui.com/unifi/unifi-ap-ac-lr/

This is what I get for answering questions before waking up

gazingbazooka

(1) Is it going to a managed switch or unmanaged switch. (answered - good) It's unmanaged (2) Is the switch connected to any devices which recognize vlans or just PCs, printers etc...... (partial answer) The devices here are random but they are not smart enough to specify the VLAN in the configurati...

gazingbazooka

It’s an unmanaged switch. “TL-SG1005P is a 5 10/100/ 1000Mbps ports unmanaged switch.“ The devices connected currently are printer, camera, Xbox and the WAP.

gazingbazooka

The snippet is the only difference between the config you posted. Here is the full thing: The way I made this work is having the guest (VLAN 200) show up as tagged traffic on ether3 and assuming everything else, even the home WiFi is untagged as VLAN 100. I looked here: https://wiki.mikrotik.com/wik...

gazingbazooka

I tried out the config and most of the things are working, except there is some weirdness around ether3 which has the switch connected to it with the WAP. It looks like this: mikrotik ether3 -> unmanaged poe switch -> (wap [home vlan100 | guest vlan200], device1, device2, device3) ether2, ether4 and...

gazingbazooka

That worked surprisingly well. I installed the 32 bit version.

One issue I have a device that is reset to factory without an IP and it doesn't seem to do so well finding devices by MAC address. When the router is giving out a full on IP it works fine. Is this a known issue?

gazingbazooka

It looks like my immediate problem when trying out this config is in the allowed interfaces in the tooling: [admin@MikroTik] > /tool mac-server [admin@MikroTik] /tool mac-server> set allowed-interface-list=vlan100 input does not match any value of allowed-interface-list Not sure if I messed anything...

gazingbazooka

I'll let others chime in on the HW but everyday 2.4GHz is moving towards legacy. If you're starting on new hardware you should definitely get 5GHz to futureproof.

gazingbazooka

I just have access to Macs around me. By definition it seems WinBox is available for Windows. I'm curious if there is something simple I can do to work around this on a MacBook? My current plan is to install VirtualBox, get Windows and hookup a dedicated interface. This leaves me with a problem of f...

gazingbazooka

I think I found it, it's likely at the end here:

/tool mac-server
set allowed-interface-list=vlan100
/tool mac-server mac-winbox
set allowed-interface-list=vlan100

gazingbazooka

Thanks so much. Let me digest this and combine the two threads to see what I get. Also appreciate you going heavy on the firewall as that's not my strong suit.

In your config what is the IP of the router?

gazingbazooka

I truly appreciate the time you put into this. To clarify, I'm still learning. The 192.168.X.X network was just something I thought the two VLANs would route through, I didn't realize it would be dead in the water and not needed. Further clarification on ether3. It's a PoE Switch that's actually plu...

gazingbazooka

This is a follow up to my previous post here: https://forum.mikrotik.com/viewtopic.php?f=13&t=159532 I'm attempting to setup a CPU VLAN for Ubiquiti WAP. This is my lab setup that I'm trying out before applying to my RB2011 but I just realized that these two will take different approaches to VLA...

gazingbazooka

Thanks. I’ll try to compare this against the golden reference in the other thread. Much appreciated.

gazingbazooka

Thanks for the link. That's literally where I started but I was trying to run those rsc files and it didn't really leave the router in a happy state. I have a previous post about that. I'll try to diff those files against what I have. Oddly enough these steps seemed to suffice when I linked it to et...

gazingbazooka

Good catch. I knew a second set of eyes would help. Also moved the IP to the bridge as you suggested. Now I'm not getting an IP when hitting VLAN 200. Anything obvious? /interface bridge add admin-mac=B8:69:F4:AB:32:8A auto-mac=no comment=defconf name=bridge /interface vlan add interface=bridge name...

gazingbazooka

I'm totally green on the VLAN but taking my first stab at creating a VLAN from scratch for my Ubiquiti AP. I had the VLAN working semi-correctly when added to a specific interface but when I add the VLAN on the Bridge and follow the same steps the DHCP Server comes out as Invalid. I prefer for the V...

gazingbazooka

The file loads successfully though and there was no base config of any kind

gazingbazooka

I've been on Mikrotik a while but trying to venture into some of the intermediate topics. Right now I am trying to offload all questionable devices on the network to its own VLAN. My home router is RB2011 but I'm trying this out on a spare hEX RB750Gr3. I'm following the post here: https://forum.mik...

Search found 93 matches