MikroTik

hwsinn

Sorry for the late reply.

Oh yes! Didnt notice that.

I am also putting in action=jump firewall rules using so that it finds a match faster.

hwsinn

How do i enable safe mode from winbox?

I know you can do a ctrl-x in winbox terminal.
But i am not that well versed and comfortable with the commands yet

hwsinn

honestly, i am not sure where was the problem. For winbox access via IP -> i did a one time allow rule for the specific port (8291) and it allowed me to enter. I then removed the rule, restarted the laptop, manually released the IP from MT DHCP lease and i tried multiple times and it still worked. S...

hwsinn

hi 404, thanks for vetting my config on security. I am no expert when it comes to mikrotik configuration (hence i am here). i am still learning but i am trying work on a backup plan to connect back in to the router when given physical access. i have a small amount of years as a network engineer (mai...

hwsinn

i have updated the code with full config

hwsinn

My guess
Firewall services.
You may have disabled winbox but kept http active.

Could be under ip service as well.

IP services config has been shown above.
Firewall is allowed too as shown in the config

hwsinn

Hi everyone! I recently made a misconfiguration and i had to revert my settings on my hex POE. I have previously left a emergency physical port (ether 5) so that i can physically log in to the device to undo the change. Ether 5 is assigned DHCP server, firewall input rule (allow Ether5 to 192.168.88...

hwsinn

Hi sindy, as VPN internal traffic, i tried to do the firewall rule via IP matching. i was monitoring the packet movement and the count was always 0. i previously did forward source <xxx> to destinated vlan interface <xxx> i tried to use VPN client IP (coupled with another forward rule for VPN gatewa...

hwsinn

ok i have managed to solve the problem.

since i have done most of my config as an INTERFACE, i created a OVPN server binding INTERFACE.
allowed it in my firewall rule and all works now.

Not sure if it is the best way or not but please point it out if it is not correct or not secure.

hwsinn

hi lis, i am not sure if i got you correctly. I assume you are saying i have created Interface > vlan when i should have done bridge > vlan. If my understanding is right, what i have to do now is just to go to Bridge > Vlan and create all the vlans? I dont think i am going to redo my network just fo...

hwsinn

My understanding is that input is for incoming to an interface (physical or logical) while forward is to pass on the packet to the next interface (assuming mikrotik is a member of that interface/network and it knows where to pass on to) Upon reading the links you gave, i couldnt pick up where in my ...

hwsinn

Hi Sindy, I have added one more rule below the VPN input rule as such add action=accept chain=input comment="VPN incoming" dst-address=HIDE \ dst-port=8443 in-interface-list=WAN protocol=tcp add action=accept chain=forward comment="VPN to SNET" disabled=yes \ in-interface-list=WA...

hwsinn

sorry, i have reexported and vet through again. Hope the info below is enough. # jul/21/2021 22:15:59 by RouterOS 6.47.1 # software id = 9WAC-9NWN # # model = 960PGS /interface bridge add admin-mac=HIDE auto-mac=no comment=defconf name=bridge /interface ethernet set [ find default-name=ether2 ] poe-...

hwsinn

Bumping for assistance

hwsinn

below is my firewall rules /ip firewall filter add action=accept chain=input comment=\ "defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=accept chain=input dst-address=192.168.88.1 in-interface=ether5 add action=accept chain=input c...

hwsinn

I have successfully established a OVPN connection from my mobile to mikrotik gateway. Got an VPN internet IP from the defined pool. My internal network is segregated into vlans, which is added to the bridge interface OVPN server range is defined without vlan tagging and i dont see anyway to add to t...

hwsinn

somehow there is static DNS set on this device that i am using. I have removed it and problem is solved

hwsinn

ipconfig -> https://imgur.com/a/1IinSk0

dhcp client is use for WAN interface only.
use-peer-dns is checked.

hwsinn

any help?

hwsinn

Hi erlinden /ip dhcp-server network add address=192.168.11.0/24 dns-none=yes add address=192.168.12.0/24 dns-server=1.1.1.1,165.21.100.88 gateway=\ 192.168.12.xx add address=192.168.13.0/24 dns-server=1.1.1.1,165.21.83.88 gateway=\ 192.168.13.xx add address=192.168.14.0/24 dns-server=1.1.1.1,165.21....

hwsinn

In my DHCP options, i have set 2 DNS servers for all interfaces. Router has received dynamic DNS from ISP. I have also been trying to toggle between Allow remote requests in IP>DNS during troubleshooting. I also have tried to use other DNS servers that totally do not coincide with my ISP's DNS eg go...

hwsinn

I have the router and switch untouched over the night with just the WAN link on and no devices connected. Somehow it got warm again. I guess i cant run away form the heat any more. I will just familiarise myself with a few more examples like port forwarding and VPN and i will start using it official...

hwsinn

anyone has more thoughts on my summary above? I have been monitoring the device and its heat output while the device is on my desk (the final location is my network closet which is enclosed with no ventilation). i find that it runs alot warmer when i run my set up in this manner: Mikrotik -> vlan aw...

hwsinn

Ok now to summarise my learning points, correct me if i am still wrong please. ==Understanding 1=== so can i summarise that HW-offloading is off when using bridged vlan. HW off-loading is of no importance when i am using the RB as a router (sub-interface routing or intervlan routing) so in the case ...

hwsinn

Hi mkx, I have tried you config but i am not getting an IP from DHCP and blow is my config. /interface bridge add name=bridge1 vlan-filtering=yes /interface vlan add interface=bridge1 name=vlan11 vlan-id=11 add interface=bridge1 name=vlan12 vlan-id=12 /interface list add name=LAN /interface wireless...

hwsinn

The setup you posted above does not facilitate any switch-chip offload whatsoever. Same-subnet traffic won't pass router because only single interface is member of single subnet. So I'll echo suggestion by @tdw: go with vlan-aware bridge setup, the performance will be just the same as it would be w...

hwsinn

Hi guys, i have ran through more examples and got it to work. I would like to check if this will achieve best performance for same subnet file transfer, intervlan routing and LAN->WAN (WAN->LAN) routing. /interface bridge add name=bridge1 /interface vlan add interface=bridge1 name=vlan11 vlan-id=11 ...

hwsinn

in my scenario, should i be focusing on the switch settings or the bridge as both has vlan options in them. It depends on your requirements: If wire-speed switching within the same VLAN is not of particular importance then a VLAN-aware bridge ( /interface bridge add name=... vlan-filtering=yes ) is...

hwsinn

thanks for the response, tdw. I think i am starting to get confused with when to use bridge and switch in the config. Initially i bought this device because it has the switch chip as the switch chip provides the hardware offloading to get close to wire speed across vlans. I will be using this mainl...

hwsinn

Looking at the hex poe https://i.mt.lv/cdn/product_files/RB960PGS_161241.png vice the plain hex or hex S https://i.mt.lv/cdn/product_files/RB750Gr3-dsw_161117.png https://i.mt.lv/cdn/product_files/RB750Gr3-esw3_190642.png I'd say you got the wrong device? The MT7621 in the hex does not have the vla...

hwsinn

thanks for the response, tdw. I think i am starting to get confused with when to use bridge and switch in the config. Initially i bought this device because it has the switch chip as the switch chip provides the hardware offloading to get close to wire speed across vlans. I will be using this mainly...

hwsinn

The configuration is completely different to any other vendor, it is a pity Mikrotik have not integrated hardware acceleration (i.e. switching) into the VLAN-aware bridge handling as they have with the CRS3xx devices. https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#VLAN_Example_2_.28Trun...

hwsinn

Which option locks you out? The device is configured so, that only LAN ports (2-5) are for management. The first port is protected. Unless you configured some more things. I have followed wiki guides like: https://wiki.mikrotik.com/wiki/Manual:Switch_Router https://wiki.mikrotik.com/wiki/Manual:Bas...

hwsinn

I have followed many of the wiki examples and i am always hitting a dead end when i flip the clan mode in switch-cpu to secure.

can someone enlighten me please.

hwsinn

i have just received my Hex POE device I have been trying to play around to be able to play around with various combinations and be well versed with configurations before i put it into my production home network. i am trying to get afew configurations to work but always got myself locked out, having...

Search found 35 matches

Re: problems logging in with winbox but web portal works [SOLVED]

Re: problems logging in with winbox but web portal works [SOLVED]

Re: problems logging in with winbox but web portal works [SOLVED]

Re: problems logging in with winbox but web portal works [SOLVED]

Re: problems logging in with winbox but web portal works [SOLVED]

Re: problems logging in with winbox but web portal works [SOLVED]

problems logging in with winbox but web portal works [SOLVED]

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

Re: OVPN client unable to reach internal network

OVPN client unable to reach internal network

Re: Receiving only 1 DNS server from DHCP [SOLVED]

Re: Receiving only 1 DNS server from DHCP [SOLVED]

Re: Receiving only 1 DNS server from DHCP [SOLVED]

Re: Receiving only 1 DNS server from DHCP [SOLVED]

Receiving only 1 DNS server from DHCP [SOLVED]

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

Re: having a little difficulty transitioning to the mikrotik router

having a little difficulty transitioning to the mikrotik router