MikroTik

lavv17

I'd like to have a setting to change ppp aaa order: radius first, then local. The default is now local first.

lavv17

Hello! I'm setting up check_mk monitoring for CCR health parameters (voltage, current, temperature, etc). But I'm not sure which warning/critical thresholds should I use. Can you help me?

And BTW, several CCRs of mine have had problems with PSU (bad capacitors).

lavv17

Cool. I've also seen a pair of MikroTik's in a https://en.wikipedia.org/wiki/Magnit grocery store today. They were labeled "master" and "backup"

lavv17

connection tracking is needed for NAT and connection-state checking in the firewall. If you don't need these features, it should be safe to disable connection tracking. But it will only help if CPU is already quite loaded.

lavv17

It works very well! Thanks, MikroTik!

lavv17

Any news on the issue? I've problems with 300kpps flood with connection tracking disabled.

lavv17

It would be nice if routing updates were more atomic. Currently converging BGP full view can lead to temporary routing loops. They last for a minute or two. My setup consists of 3 CCR1036 routers facing different providers; iBGP between each pair of them. When a router boots up, a temporary loop can...

lavv17

Hello!

RouterOS "ip route print where dst-address in x.x.x.x/z" is fast. But for a reason the same for ipv6 is slow (when the number of routes is large).

Please, make ipv6 route lookups fast as well.

lavv17

There is the option:
src-address-type (unicast | local | broadcast | multicast; Default: )
local - if address is assigned to one of router's interfaces

Cool, thanks! I'll use this feature.

lavv17

Filtering packets in chain=input can affect srcnat. So it would be nice to limit filtering to local routers's IP addresses. But it would be hard to maintain such a list of addresses, if the router's configuration is changed from time to time. So here goes a feature request: an automatic address-list...

lavv17

Yet another feature request:

add netwatch options to send TCP port probes (e.g. check if port 80 is open on a server for load balancing)

lavv17

Sometimes www proxy in routeros shows very low performance: low throughput, high delay before accepting new connections. The total number of active connection (as shown by "ip proxy monitor") is below 150, traffic to clients is about 1Mbit/s Are there any hints for proxy performance optimi...

lavv17

Thanks, it helped me too.

It can be made shorter by combining declaration and assignment like this:

:local remoteAddr $"remote-address"

lavv17

Here are corresponding memory usage graphs. Old routeros versions have had a memory leak, but newer ones are not so clear. http://lav.yar.ru/ccr0-mem-yearly.gif http://lav.yar.ru/ccr1-mem-yearly.gif http://lav.yar.ru/ccr2-mem-yearly.gif http://lav.yar.ru/ccr3-mem-yearly.gif http://lav.yar.ru/ccr4-me...

lavv17

Two other CCR1036 show similar pictures: http://lav.yar.ru/ccr1-ping.png http://lav.yar.ru/ccr2-ping.png But two another don't: http://lav.yar.ru/ccr3-ping.png http://lav.yar.ru/ccr4-ping.png The only difference I see now is that ccr0, ccr1 and ccr2 have a DHCP server enabled and ccr3-4 don't. So pr...

lavv17

Is this the ping time between the monitoring system and the bras?

Yes, exactly.

lavv17

Hello!

Here is an interesting statistics on a CCR1036 working as a BRAS (PPPoE server). See the picture:

As you see, ping RTT grows over time and resets on reboot. It may be some kind of a resource leak.

lavv17

Hello!

Nice features to have:
1. IP firewall address lists could include one another (or firewall rules could match multiple lists at once, e.g. "src-address-list=list1,list2").
2. NAT parameter to-addresses could refer to an IP pool.

lavv17

I'd like to have a new feature: "graceful reboot". Things to do before actual reboot: 1. disconnect ppp users (while not accepting new ones) 2. transition vrrp to backup state 3. disable external bgp peers 4. wait for routing convergence Without these, there is a time frame when traffic lo...

lavv17

Fasttracking that traffic you want to be excluded from queues is much more efficient.
But keep the exclusion queue for the cases when some connections couldn't be fasttracked.

I have turned off connection tracking for most connections (using raw table), so it won't be efficient in my case.

lavv17

create a queue for local traffic and put it on the top. it will catch all local traffic, and all the rest will be caught by 'personal' queues p.s. if you won't set any limits on that queue, don't forget to change at least something (like queue type) for this queue to actually work Cool! It seems to...

lavv17

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working. what do you use them for? I want to exclude some traffic from the rate limitation (so called local traffic). I used to mark non-local traffic and ad...

lavv17

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-marks" parameter stopped working. Is it possible to create a template for the dynamic simple queues which are created for PPPoE users, so that I can specify some parameters like "...

lavv17

Thanks! I'll try it when it will be released.

lavv17

+1
This addition could save some resources on the routers.

lavv17

Hello!

Is it possible to do selective connection tracking? In my setup the routers forward lots of traffic, but connection tracking is only required for input/output chains, not forward. Is it possible to implement to save resources?

lavv17

BTW, is DHCPv6 server implemented in RouterOS so that such kind of PPPoE connection could be implemented on the server side by MikroTik?

lavv17

It would be fine even if you distribute ZIP via plain http. Torrent was useful to me just because it allowed to download all the files at once.

lavv17

Isn't easier to download it from official website than asking here for it? I would prefer mikrotik could do it, if anyone has to seed... MikroTik releases RouterOS also as a torrent (for all routerboard architectures). But for this release there were no seeders for some reason. I like the torrent r...

lavv17

Please, anybody, seed the torrent for v6.34.2.

lavv17

marting
Please consider applying the patch from my bug report:
https://rt.cpan.org/Public/Bug/Display.html?id=111476

lavv17

Hello! Is there anything like API for manipulating SwOs configuration? I've looked at the protocol, it seems quite easy to use (e.g. POST /links.b with some json data can tune ports). But before going to reverse engineer and implement those POSTs I'd like to check if there is any existing framework ...

lavv17

I had the same problem. Mikrotik support replied /31 networks are not supported. I made a workaround: I assigned overlapping /29 network and created a pair of static routes for the parts not belonging to the actual /31 network. E.g. if you have x.x.x.41/31 and x.x.x.40 as the gateway, then you can a...

lavv17

I encountered the problem when migrating from cisco to mikrotik. I had a route-map which set no-export community (outbound). When I directly translated the route-map to "ip routing filter" outbound chain, the routes disappeared. I think the no-export community should be used for route filt...

lavv17

I think it's only https (www-ssl) which is affected. But I don't know for sure. Use good firewall settings and you would be fine.

lavv17

Hello!

Is it possible to advertise routes to another AS tagged with no-export community?

It seems that append-bgp-communities=no-export in output routing filter prevents the route from being advertised, nevertheless is is listed in "routing bgp advertisements".

lavv17

MT please please. We need more queue options in PPP profile. For example we need different values in max-limit and limit-at. When using Radius for AAA, now dynamic simple queues create with same value at limit-at. It restricts us to do some QoS and it fights off RouterOS`s powerful, intelligent que...

lavv17

For some reason after upgrade from 6.7 to 6.9 bonding stopped working, interfaces don't join together. Flags: X - disabled, R - running 0 R name="bonding1" mtu=1500 mac-address=D4:CA:6D:77:6D:34 arp=enabled slaves=ether1,ether2 mode=802.3ad primary=none link-monitoring=mii arp-interval=100...

lavv17

Upgrade 6.5 to 6.6 on a CCR leaves bonding interface with MAC address 00:00:00:00:00:00. Fixed by interface recreation.

lavv17

CCRs work here flawlessly for weeks serving around 900 pppoe users each. Surely there are problems with the software, but they are not global and happen only in certain configurations (e.g. I discovered a problem with PCQ and had to use dynamic simple queues).

lavv17

Lol. You didn't see any real operator class router if you are willing to name this board like that.

"real operator class router" costs 10-20 times more. For me, CCR delivers good enough performance. Especially considering it's cost.

lavv17

pcq on ccr seems to work incorrectly for large number (>500) of concurrent clients. Are there any internal limitations?

lavv17

Yes, I have 3 CCRs with 6.0 and 6.1 now. They run quite well, but there is latency jitter issue under load, although CPU utilization is under 25%.

lavv17

CCR1036 is stable here, with 700 PPPoE users and 1 BGP session. My only concern is about latency jitter. I think there is a mutex in the kernel which is held for too much time.

lavv17

rc14 pre-release seems to fix the performance problem

lavv17

omega-00 Cool! Thank you! BTW, it looks like CCR-1036 cannot properly handle more than 300 pppoe users and 300 Mb/s of traffic in my configuration. I use pcq for user rate limit. Here are ether1 and cpu graphs from the last day, people complained about too low speed. http://lav.yar.ru/tmp/ether1-da...

lavv17

max-sessions setting does not allow sterling fallback, e.g. if CCR hangs.

lavv17

Hi! For load balancing it would be nice to have a "delay" parameter in settings of PPPoE servers. It would delay PADO packet for specified number of milliseconds or microseconds. In fact, without this setting I cannot really test CCR in PPPoE BRAS configuration, because it cannot compete w...

lavv17

Hello!

RouterOS has p2p matching capability. Does it match uTP protocol too? (it's udp based peer protocol)

lavv17

I am satisfied with the 32 bit version. Why would you need a different one ? Thanks.

I've heard that x86_64 code is a bit faster. More processor registers are available, for example.

lavv17

reason is amount of work and amount of testing, driver related work who knows what else that goes on underneath there Probably most of work and testing would be related to 32->64 migration of routeros kernel modules, and it would be done anyway for CCR. Linux drivers have already been tested in 64 ...

lavv17

CCR will - it's 64bit

Great

Will there be an x86_64 version?

lavv17

Thanks for multicast-helper setting!

lavv17

I think it is the same as before. I get a more stable result with OSPF if I set DR on AP and disable BDR at all. NBMA is even more stable, but does not work correctly on versions before 5.x

lavv17

Yes, on point-to-point links.

lavv17

well, now (v6, AFAIR) ROS can send mutlicast paskets as unicast frames, so udpxy is not actual just for wifi

If I understand correctly, multicast-helper works only for point-to-point radio links. Udpxy can help if there is a standard home WiFi network with multiple client devices.

lavv17

will there be a x86_64 version? Probably it would provide a better performance.

lavv17

I have a server with routeros 5.11 (same with 5.14), which eventually locks up hard if built-in ethernnet is used. 0 device="04:00.0" name="RTL8111/8168B PCI Express Gigabit Ethernet controller (rev: 6)" vendor="Realtek Semiconductor Co., Ltd." category="Ethernet c...

lavv17

integrate udpxy. Very useful for IPTV over WiFi for home users.

lavv17

I need dynamic "ipv6 firewall address-list", currently it's only static.
Also ospf-v3 is not quite stable, there are stuck redistributed routes.

lavv17

usually default mode works well, unless the radio link is not reliable.

lavv17

It can be a problem with multicast. I had a similar problem with unreliable radio link and also with a switch with incorrectly set multicast traffic control.

lavv17

 3  2001:5a0:2800::e (2001:5a0:2800::e)  77.652 ms  77.582 ms  77.526 ms
 4  ffm-b10-link.telia.net (2001:2000:3080:30c::1)  79.093 ms  79.060 ms  77.255 ms
 5  s-b3-v6.telia.net (2001:2000:3018:9::1)  100.877 ms  99.454 ms  106.812 ms
 6  * * *
 7  * * *

It does not work here too.

lavv17

Can you pass IPv6 network routes to attached PPPoE clients assigned through Radius?

Yes, with Framed-IPv6-Prefix. They stuck in ospf, though, Ticket#2011051866000501.

lavv17

I am impatient to see full IPv6 PPPoE-server support in ROS. I would allow me to throw away several ciscos.

It works here (ROS 5.4). I just miss dynamic ipv6 address-lists.

lavv17

dynamic ipv6 address lists are really needed to implement rate limitation with pcq.

lavv17

Currently ROS sets irq smp_affinity to a single core, thus the interrupts of a single ethernet card with one irq do not get distributed over the cores. It would be nice if the command "system resource irq set ... cpu=0,1,2,3" worked and set the affinity mask to multiple cores. It is report...

lavv17

For ppp interfaces in ppp profile set use-ipv6=no

I'd like to do just the reverse

Leave it on for ppp and disable it on a VLAN.

lavv17

Correct. So how do I disable it for selected interfaces? Either: a) change that to specify the interface you want it on for (add more for more interfaces) b) disable it. c) remove it. Yeah. Turn it on separately for each of that zillion of dynamic pppoe connections. I just want to disable IPv6 or a...

lavv17

It is enabled by default when the IPv6 package is turned on. You'll see an entry in there for "interface=all". Correct. So how do I disable it for selected interfaces? What do you mean by RPS? Receive Packet Steering (system resource irq rps) Is it really enabled in the kernel of ROS 5.1?

lavv17

Can I disable IPv6 ND on selected interfaces and enable it by default?

lavv17

It seems that RPS does not work until one core load = 100%. Am I right?

BTW, 5.1 looks very good

compared to 3.17 it is 1.5 times faster, subjectively.

lavv17

How can I disable IPv6 on selected interfaces? How can I view IPv6 status on incoming ppp connections? Is this CPU load normal? Shouldn't the kernel distribute interrupts over the cores? CPU LOAD IRQ DISK 0 14% 13% 0% 1 0% 0% 0%

lavv17

Please add timeout info to output of
ip firewall address-list print detail
for dynamic entries.

lavv17

Thank you! It will be possible to limit PPS, scans, spam, DDoS, etc on per-user basis.

lavv17

dst-limit is nice, but I need to limit by src-address.

lavv17

please make possibility to use hashlimit in ip firewall.

lavv17

This may be related.
http://forum.mikrotik.com/viewtopic.php?p=211442

lavv17

It would be great to get more detailed information, so we can test the same configuration on our lab. 1) What is the configuration of RouterBOARD 600? 2) How it is connected to the another device? 3) Is there any on the middle device between the router and the another device? 4) What kind of the de...

lavv17

5.0beta2 also has this problem. The last version without the problem is 3.28.

Currently I workaround this problem by creating a bridge with a single port. The bridge does not reset when its port goes down-up.

lavv17

RB1000 can pass through 3.2Gbps I guess it is with a single ip route without connection tracking. Here, with connection tracking, ip traffic-flow, 100 routes, bgp, ospf, no queues, single firewall line in input chain - it can barely cope with 60kpps and 300Mbps (in+out). After that cpu usage=100% a...

lavv17

I can explain the significant raise of cpu usage when I added a new chain and a jump only by linear search in mangle/forward table.
Anyway change-tcp-mss=no now, pcq queues are in place, and cpu usage is below 50%

(200 pppoe users, 120 Mbit/s on RB1000)

lavv17

Let me answer myself. It appears the cause for slowness of "jump" was change-tcp-mss=yes in ppp profile.
It creates many hidden entries in firewall mangle table and jump apparently uses linear search to find the named chain.

lavv17

eliminating of "action=jump" in "ip firewall mangle" reduced cpu load even more. I wonder why "action=jump" is so slow. http://lav.yar.ru/rb1000-daily.gif At 11:45 I have "optimized" mangle table with a jump to avoid duplicate checking an address list in 16 ru...

lavv17

Ok, thank you for pcq! I have implemented it and cpu load dropped somewhat (by 10-20%).

Has anybody profiled where the cpu is mostly spent?

lavv17

I use plain "routing ospf interface print without-paging" and it produces infinite output.

lavv17

Unfortunately, I also use Framed-Route attribute to create a dynamic static routes for some clients. That way PCQ will not work, as it is per-IP address limitation, not per-interface which I need.

lavv17

there are appox 300 pppoe interfaces. They are passive (in ospf sense). I cannot announce an aggregate route because there are several pppoe servers in the cluster. I don't use redistribute-connected because I want to filter the routes between areas. 1 P interface=all cost=10 priority=1 authenticati...

lavv17

Is there any alternative for rate limitation with radius?

lavv17

no encryption, no compression.
Interesting that cpu load with pppoe significantly depends on the number of pppoe clients, more than on the traffic.

lavv17

I'd like to ask why pppoe in routeros has such a low performance. EoIP is several times faster (approx 5x in my setup based on cpu load and used bandwidth). I use dynamic simple queues if that matters.

lavv17

I've noticed that some RB (e.g. RB1000, 600A) with RouterOS 3.30 reset ethernet from time to time. It shows as dropping all pppoe sessions and ospf neighbours.

The problem is fixed by installing ROS 3.28 (not tried 3.29).

lavv17

Wow! I've just found the command to discover underlying interface:

interface pppoe-server monitor ...

lavv17

routing ospf interface print ... 223012 DP <pppoe-eia> 10 1 broadcast none 223013 DP <pppoe-avv> 10 1 broadcast none 223014 DP <pppoe-shadrich> 10 1 broadcast none 223015 DP <pppoe-agamov> 10 1 broadcast none 223016 DP <pppoe-i1279> 10 1 broadcast none 223017 DP <pppoe-i1662> 10 1 broadcast none ......

lavv17

The same problem happens with 4.1, once a day average (400 pppoe users)

It only happens with multi-cpu=yes, so I have to run it with multi-cpu=no.

lavv17

typical user is only willing to wait 'several seconds'

30 seconds would be fine for me. This timeout is only needed for peak loads when 1000 users reconnect simultaneously after router reboot.

lavv17

Now radius timeout has a limit of 10s maximum, and it's 3s by default. Please increase this upper limit, and possibly the default, as 3s is not enough IMO.

lavv17

"/system script job remove" did the trick! Thank you!
BTW, is it possible to output a detailed info of which command is being executed in the job?

lavv17

"export file=123" hangs after /routing ospf interface (all interfeces are output). ^C does not work. Closing telnet connection does not stop export too. Is there a way to kill an active user? Like "user active remove"? CPU usage is 100% because of that export and I'd like not reb...

lavv17

funny thing, after _several_ reboots it has found it. But now there are two ether1 interfaces. Fortunately I can rename one. 0 R ether1 1500 00:17:9A:38:0B:21 enabled 1 R ether1 1500 00:1D:7D:9F:5D:9A enabled

lavv17

3.23 version does not detect this adapter, while 3.22 does.

lavv17

The problem happens once in a week, sometimes more often.

lavv17

On a pc running RouterOS 3.20 (and 3.19 too), acting as pppoe server for ~150 users sometimes the command 'ppp active print' stops working. It just hangs until ^C, then prints the header and that's all. The command 'interface pppoe-server print' works as expected. New users cannot connect. Please he...

lavv17

I mean the interface which is used for pppoe protocol, the ethernet interface.

The problem is that on the mikrotik there is several pppoe servers with the same service name but on different ethernet interfaces. And I'd like to know which ethernet interface pppoe sessions belong to.

lavv17

Thank you!
I used the second approach.

Another question: is it possible to run a script once a new pppoe user connects? Preferrably with an argument of interface name.

lavv17

Hello!

Is it possible to add interface name to output of:
interface pppoe-server print detail

lavv17

Hello! I had a problem with a script that is run by scheduler each minute. The script sometimes cannot finish its work in that minute because of high cpu load and thus the scheduler runs the script again in parallel, the load increases even more and the script again cannot finish in a minute, the lo...

lavv17

Hi! I have a problem with OSPF on point-to-point wireless links. I have determined that the reason is losing multicast packets when they are sent from AP to the client. The AP is in bridge mode (single client). So the question is: is it possible to change multicast sending mode when AP is a bridge, ...

lavv17

What's new in 3.8: *) fixed removing external routes from OSPF; It seems the problem is still there in 3.14: "routing ospf route print" shows: 227 x.x.x.x/32 imported 20 0.0.0.0 BUT ip route print where dst-address=x.x.x.x/32 shows nothing. Traffic loops. The user is not connected (it use...

lavv17

are there any alternatives?

I cannot use static firewall rules, because users connect with pppoe authenticated by radius, and besides some of them get a dynamic route by Framed-Route radius attribute.

lavv17

Has the feature been implemented?
http://forum.mikrotik.com/viewtopic.php?f=4&t=64

lavv17

Same here. The PC has Core2Duo CPU and a SATA disk.

lavv17

Oops. It seems I was mistaken about 3.4 version. The built in PCI-Express ethernet only works when I insert another PCI ethernet card. When it is the only ethernet it still does not work. But the good news is that new linux kernel from fedora updates (2.6.24.3) does work with the builtin ethernet ju...

lavv17

3.4 version works fine! Thank you!

lavv17

The ethernet adapter is a builtin PCI Express Gigabit one. I have tried to install fedora linux 8 on the computer and had the same ethernet problem, which could only be solved by installing r8168 driver from realtek web site.

Is there a way to use the driver with mikrotik routeros?

lavv17

Hello! Does Mikrotik support Realtek 8168 gigabit ethernet chipset? I have tried 3.3 version - it discovers an ethernet interface, but it does not seem to work. For example it always shows link-ok, even when the cable is not plugged in. The older version 2.9.50 does not see the ethernet controller a...

lavv17

I have found a solution. These commands will do the trick:

system script add name=set_queues source={/queue simple set [find dynamic yes] packet-marks=...}
system scheduler add name=set_queues on-event=set_queues interval=60s

lavv17

Is it possible to set a default packet-marks on dynamic simple queues?

lavv17

An additional info: users have various rate limitations, so I cannot just set a static queueing.

lavv17

Hello! I have pppoe users with traffic shaping which gets set up with the radius Ascend-Data-Rate attribute. Everything works fine, except that I want to have an IP network from/to which the traffic rate would not be limited or limited with a different rate. Is it possible to do? The network is stat...

Search found 120 matches