CCR2216-1G-12XS-2XQ was announced

i hope it can meet your expectations

Not really, it's almost 3 times more expensive. Hard to invest such money to homelab.

It looks like bridge filter is not working or all rules are totally ignored, ether5 is my Raspberry Pi where I tried to generate traffic after adding those rules: > /interface/bridge/filter/export /interface bridge filter add action=accept chain=forward in-interface=ether5 add action=accept chain=fo...

None is matching (before setting edge=yes -> see below)... /interface bridge filter add action=drop chain=output dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF out-interface=ether23 add action=drop chain=output out-interface=ether23 src-mac-address=08:55:31:95:85:C3/FF:FF:FF:FF:FF:FF I managed ...

Due to ISP special setup, I need to block STP on one switch port, otherwise clients behind this switch will not get IP thru DHCP. I'm limited to 3 dynamic public IPs, but also STP proto is somehow blocking rest of clients and is counted as a client. This bridge filter was working fine untill I upgra...

Working fine for me: CHR <-> HexS, both on ROS 7.1.1

Seems there is no way, except putting your switch to colder area. In your case, it looks like tigger is sfp+ module. Can you try to cool down somehow this module? Also is strange my CPU is on 58C and fans are on 0 RPM, but I'm still on ROS6. > /system health print cpu-temperature: 58C power-consumpt...

Just define new type...

But if I understand correctly, you can enable l3 or firewall acceleration on CRS317, but I need l3 AND firewall.
It's pity that mikrotik is not showing in presented throughput also values without fasttrack.

Put a switch and do VLAN Trunking... Not an option, if you need to get inter VLAN routing with 10G line speed thru FW. Due to limitations I need to disable fasttrack and CCR2004 is not able handle 10G routing in this case. To get best speed from CCR you need to utilise as much interfaces as possibl...

@Znevna: ignore tailscale, try headscale https://github.com/juanfont/headscale. i think heads are scaling better than tails /s

I would like to see something like CCR2116-4G-12S+, even something without RJ45, just pure SFP+ with 1G management port, like old CCR2004. This is really nice piece of HW, but only 4 SFP+ isn't usable for me.

This docker implementation looks nice, but I don't think it's good idea, plus I think Mikrotik should invest their development time on more important RouterOS things - like they did with ZeroTier. It makes no sense to use docker container on some boards (maybe most of them) due to low memory or no H...

In what cases do I need to specify addresses for both ends of the IPIP-tunnel, and in what cases it is not necessary? I tried a IPIP-tunnel without addresses - everything works fine. Not required for single ISP or single WAN IP. If you have multi-ISP uplink or more IPs on WAN and you want to use sp...

@loloski is right, reverse proxy is your friend.
Often used proxies are haproxy, nginx, caddy... for containers for example traefik. If you want easy quick start with web UI and build-in ACME, you can use Nginx Proxy Manager

Interesting, your temps are lower, but fans are running. I've S+RJ10 in sfp2 and sfp4, sfp8-12 are DACs, rest is unused. Also psu2 is not connected for now. Edit: this is in my living room with temp ~22-23C. > /system health print temperature: 61C cpu-temperature: 48C board-temperature1: 26C board-t...

Look at the "IPsec test results" section of any prospective router at mikrotik.com/routerboard. hEX S gets pretty close to 200Mbps IPsec and is very competitively priced. Next step up would be RB4011 which can do >500Mbps IPsec. With hEX S I was able reach ~120Mbps using AES128 and SHA1. ...

I even put a CRS309 in between my ELAN and my CCR2004 and the tx drops moved to the interface going to the ELAN on the CRS309 and stoped on my cloud core. … It's odd that the problem moved down to the interface on my CRS309 instead of staying on my CCR2004. So you think the CCR2004 is causing tx dr...

-- deleted --

Until someone comes with a better solution, I recommend you to use bridge filter to drop packets with destination MAC address 01:80:C2:00:00:00 which come in through that physical interface. As the bridge filter permits filtering by specific STP fields, I deduce that the filter acts before the STP ...

This info is currently not available in SNMP...

works like a charm, thanks a lot sindy If you just set a non-empty ipsec-secret value in the /interface eoip row, and let RouterOS create the IPsec configuration for you dynamically, it uses the default profile for phase 1 and the default proposal for phase 2, full stop. To use another profile/propo...

@sindy: thanks a lot, i'll try this, had no idea it's possible

Hi, I'm not able to get working different proposal in IPsec then 'default' with IPIP or EoIP tunnel. I tried create IP matching template, putting it on first place, anyway still 'default' one is picked. I want to have CHR connected using AES-CTR and some MikroTik devices connected to CHR using AES-C...