MikroTik

uberwebguru

I am about to use the first qsfp+ 40G port on my CRS326 switch for my truenas server

i noticed in the winbox dashboard it is showing as 4 x sfp+ ports but i only want to configure this as a single 40G port wiht my 40G DAC cable so how do i set this up???

mikrotik-40g.JPG

uberwebguru

seems you not getting it man, mikrotik and fortinet are not in the same bracket to start off next i only paid like less than $300 for 1 year support and i can call them and have them help me with an issue will you accept $300 for 1 year support and i can call anytime 24/7? at the end i bought a used...

uberwebguru

What brand of switches are you using with your palo alto? just curious i personally dont like palo alto just because i think fortinet is better even if same price, then to put icing on top fortinet is cheaper so that is done deal really i do get palo alto have the PAN/APPID thing that is going for ...

uberwebguru

Let me know how much you want to sell your CCR2004 for. I might be interested in buying it assuming you are in the US. I’ll netinstall it and make it purr. How much you want to pay for it? between 1 of the power supplies is no longer working but otherwise the unit is near brand new, got it like cou...

uberwebguru

Indeed, fortigate is more appropriate for the uber web gurus. For example, similar to Fortinet we use Palo Alto modules on 1 of our environments (services > 100k users, full UTM/SSL-decrypt/webproxy/... enabled) that cost 6-digit numbers in euros only for a single line-card.... What brand of switch...

uberwebguru

man fortigate is super awesome man i even have ipv6 setup paid for support and man i get the engineers to help with any issues with misconfigurations had the support engineers help me with ipv6 setup now i have DNAT setup for ipv6 super awesome man, the support is key meaning no need to post in foru...

uberwebguru

Indeed, fortigate is more appropriate for the uber web gurus.

I am no guru, please ignore username

uberwebguru

I love mikrotik, and i will be sticking to the mikrotik switches BUT i finally made the migration from my CCR2004 to Fortigate router, i am more comfortable with fortigate and before did not make the move because of costs but now i finally did The switch was effortless because my network is pretty s...

uberwebguru

For other router brands like fortinet, cisco, juniper usually the routers have the following stats

Concurrent Sessions (TCP)???
New Sessions/Second (TCP)???

So can someone please post the stats for these metrics for the CCR2004-1G-12S+2XS

https://mikrotik.com/product/ccr2004_1g_12s_2xs

uberwebguru

Start with an anonymized config export (that was requested already), post it here in code blocks if you want to recieve any helpful answers. I dont think that will help anything, this is a weird issue not a misconfiguration you guys should stop opting first for configuration i get you want to help ...

uberwebguru

Then take your rants elsewhere or at least have the courage to post your config so we can attempt to find out if the config is an issue or more likely you have a flaky ISP.

flaky ISP so some NAT works and other stopped working?
IP in the same block, how is that possible?

uberwebguru

It is caused by the admin. The router is not alive and does not make decisions. :-) Look in a mirror. ;-) Please post your full config /export (minus serial number and any public WANIP type information ) did you hear what i said? some NAT still works and some not working And they were all working b...

uberwebguru

I am the only person managing the router..this is a home setup not a company
i am not talking about config for now, just ranting about why these types of weird things happen with mikrotik

uberwebguru

Is this a mikrotik thing, all my websites were working fine for several months and all of a sudden cloudflare can not reach them anymore and i am troubleshooting things i noticed some NAT work and others do not this is not first time i notice strange things in network since i switched from juniper t...

uberwebguru

Now POST your config when you fix up your firewall rules and interface lists and we will have a look /export hide-sensitive file=anynameyouwish How do i export my config by showing only active `/ip firewall filter` rules? when i exported i am seeing rules that are disabled but will be great to show...

uberwebguru

So essentially i need so many rules, then what is use of the interface list then? When using interface lists, it doesn't matter how many "forbidden" VLANs there are, you only add interface to interface list and the rest remains the same. Can even be dynamic (e.g. via scheduled script or w...

uberwebguru

You can use interface list ... which will reduce number of rules. I'm not sure I understand which traffic you want to block though ... if you want to block traffic originating from vlan101 targeting other VLANs and router itself, then you need 5 rules without using either interface list or address ...

uberwebguru

I am trying to create a firewall rule that will drop all traffic from one vlan101 to a list of multiple vlan100, vlan102, vlan103, vlan104 can i achieve this with a single firewall rule? right now i have to create 8 rules, one for forward and one for input for all 4 vlans i want to block traffic to ...

uberwebguru

Issue solved Apparently my static IP block on ISP gateway was on private subnet, i called them to explain this weird issue and they changed it to public subnet and everything is now working fine now one of the weirdest thing for me to troubleshoot. Wasn't aware a static ip can have private subnet se...

uberwebguru

Well, dstnat is fine, anything going to 101.x.x.1 will be redirected to 10.101.0.101. But I'm not sure about the rest. Based on the masquerade rule, your WAN interface is "bridge", but there's no address on that. Is perhaps sfp-sfpplus12 part of this bridge? But if it is, and you have 101...

uberwebguru

Here is what i have for NAT rules All firewall rules disabled private ip of webserver is 10.101.0.101 and public IP to do destination NAT is 101.x.x.1 here is a copy of some piece of config /ip address add address=101.x.x.29/27 comment="ccr2004 ip" \ interface=sfp-sfpplus12 network=101.x.x...

uberwebguru

Or is it the NAT rule used for the destination NAT the one doing this?

uberwebguru

I am noticing some very weird thing with the firewall of mikrotik CCR2004 I setup a destination so i can access private ip via a public when am on the wifi connected to ISP, i can reach this public ip and access the private ip behind it fine; it is a webserver and i can see default web page fine but...

uberwebguru

cool thanks..will have a look a this shortly

uberwebguru

A simple way to do manual failover would be to create two routes to 0.0.0.0/0, one via your preferred ISP with distance=1 and one via your backup ISP with distance=2. To manually failover, disable the first route using Winbox or whatever you prefer. I have a dual Internet failover with LTE as the m...

uberwebguru

So guys i plan on getting 2 routers Connect each to the 2 different ISPs So CCR 1 will connect to ISP router 1 AND CCR 2 will connect to ISP router 2 Now is there a way i can route traffic between the routers using local network? So i dont have to go via internet when using VPN tunnel for example? L...

uberwebguru

I think i have a good idea about this I think it is better to have 2x routers CCR2004 and then have the second ISP WAN on the 2nd router and prepare the config so it is ready for things to switch over. So when there is issue with ISP #1, i just unplug switch and plug switch to CCR router #2 and when...

uberwebguru

I am considering having 2 ISP so i can failover if one ISP is out Where can i find documentation on this It is fine if failover will be manual i dont mind I actually prefer manual and second ISP will be like a secondary and will only be used if and only if first ISP is down Keep in mind since i have...

uberwebguru

Yeah will have to focus on firewall for next 1 week before going PROD I kind of have similar setup on my current Juniper SRX240 router also, and had it wide open too for like 8 years But want a more security focused setup now Will read up and work more on the firewall side now Will post questions i ...

uberwebguru

Input chain is only for traffic to router itself, to server running on router, e.g. when you're connecting to router with WinBox or use WebFig. Traffic passing through router and going somewhere else uses forward chain. And if I understood correctly that your whole firewall consists of only three r...

uberwebguru

These are not very high ones and the SPF could beover 80 celcius. Those with ether out can even go over 100 celcius...boiling water. The temperature inside the rack reads 80/81 F I have some rack fans that help also read temperature inside the racks => https://www.acinfinity.com/rack-fans/ just wan...

uberwebguru

/ip firewall filter add chain=forward src-address=!172.x.x.x dst-address=192.168.10.111 connection-state=dstnat action=drop Ok now it blocks everyone including the public i need it not block seems i missed the private ip in dst address, i thought that was the public ip I really want to separate the...

uberwebguru

Other rules. If this one doesn't block it, some other rule before this one already allowed it. I have this rule at the very top of firewall rules, i only have 3 rules in there, so not much and the 2 other rules just allow traffic from one public ip to/fro another public ip via input and output chai...

uberwebguru

/bridge port ports add bridge=bridge interface=ether5 pvid=10 {hybrid} add bridge=bridge interface=ether6 pvid=10 {access} add bridge=bridge interface=ether7 pvid=11 {access} /interface bridge vlan add bridge=bridge tagged=bridge,ether5 untagged=ether7 vlan-ids=11 add bridge=bridge tagged=bridge un...

uberwebguru

Main part is to use correct chain (forward instead of input), correct addresses (forward no longer sees original destination, but 192.168.10.111), then if you want to do it properly, you need to do it only for dstnatted connections, otherwise it may block (depends on your other rules) also connecti...

uberwebguru

I see, yeah hope mikrotik fixes this as should be a very easy add
are those healthy temperature values?. what are you getting for yours?

uberwebguru

Because chain=input has nothing to do with it, connections to forwarded ports go in chain=forward. And if you want it for only one address, you can do it directly in dstnat rule, e.g.: /ip firewall nat add chain=dstnat dst-address=98.x.x.x src-address=172.x.x.x <conditions for protocol and port if ...

uberwebguru

I only hope the IP addresses are not real IP adresses that you use/have. Never ever put real IP on the internet unless you like to receive many 'visitors'! The one that going to snitch on you... Users browsing this forum: Ahrefs [Bot], Baidu [Spider],etc. mentioned at the bottom of the page. lol, o...

uberwebguru

So i have setup a destination nat to route traffic from public ip 98.137.11.164 directly to a private ip 192.168.10.111 and works fine Now i want to restrict traffic so that only my internet public ip 172.217.14.174 can access this destination nat public ip but it is not working, am not sure what el...

uberwebguru

Only issue i see is no way to control what VLANs should be allowed per interface port Lets say i want port5 to have vlan10 untagged and vlan11 tagged so it can allow both vlans on same port port6 to have vlan10 untagged, same as access port but for vlan10 port7 to have vlan11 untagged, same as acces...

uberwebguru

Here are what my System => Health readings are showing for my devices The gears are in a room that i believe is room temperature so not sure why my readings are so high Are these values you get also? How do i change from C to F for the temperature reading? CCR2004 https://i.imgur.com/tb6sexF.png CRS...

uberwebguru

Great thanks
this is what am after https://wiki.mikrotik.com/wiki/Manual:I ... d_Ports.29
just as i assumed it will be, just needed to add the ports as tagged also
very simple

thanks

uberwebguru

switch is crs312_4c_8xg_rm

uberwebguru

So everything is fine currently with just vlan10 with regular access port setup so now i want to allow vlan11 for iLO remote management so just want to know what to change to achieve this Good to know proper way to do this on mikrotik this is a very common setup using iLO network on same network as ...

uberwebguru

I currently setup access port with vlan10 that i connect directly to lets say HP server and looks good there Now i want to be able to manage the HP server using iLO and want to use same network connection from switch for iLO networking also iLO network is vlan11 I am assuming i need to change from a...

uberwebguru

Which means that practical limit is indeed around 6 WLANs per radio (physical one plus 5 virtual) but that's true for both single chain devices (such as hAP ac lite on 5GHz) and quad chain devices (e.g. audience on the upper 5GHz radio or the wireless version of RB4011). Can you please share how to...

uberwebguru

@holvoetn got it to work now
thanks to you

i added firewall rule to accept all from the zabbix address to CCR address
and another one rule to accept all from the CCR address to zabbix address

and boom i can now see network graphs already
using SNMPv3!!!

uberwebguru

No I meant that RoS is very flexible, you could run 50 vlans into the audience and then through one of the ethernet ports run those 50 to another device (like a smart switch). Yes, if using vlans you can has as many WLANS as you can create but most devices its not recommended to create more than 6 ...

uberwebguru

Check your firewall settings. Most likely udp/161 is not being allowed (it isn't by default). I see, yeah i didn't realize i have to allow it So i have to add a firewall rule to allow it? or i have to open port somewhere? mind helping with command to allow it? or where in documentation they have this

uberwebguru

Super glad you got it running!! Yes, for example I have a hex used as a switch and can run many vlans over it (from my main switch) and then go into the config at any time to select what is going over the hex ports. What do you mean you used hex as switch and can run many VLANs over it? So you have...

uberwebguru

From what am seeing seems, there can only be very limited number of VLANs on wireless Seems the number of VLANs possible is equal to the number of WLAN interfaces on the AP From picture below each VLAN is on a different WLAN interface https://wiki.mikrotik.com/images/thumb/d/d1/Vlan-wlan1.jpg/1480px...

uberwebguru

Please repost your config with your changes so i can see where you are at. As noted you DONT need to identify vlans11 and 10 as belonging to the bridge only vlan20. Not sure if its greyed out, or just not simply active at the moment, no traffic flowing through Ok i removed the VLAN10, VLAN11 from t...

uberwebguru

(2) Why do you have have same SSID names for all WLANS?/ because i thought that is how you enable the wireless bands to the wifi network how should i do this then? the VLAN20 works like i mentioned, i can access audience on the VLAN20 all fine no issues there because i see you creating Trusted inte...

uberwebguru

(1) Okay so there is no wifi for vlan20! Good to know. (2) Why do you have have same SSID names for all WLANS?/ (3) Only need to identify management vlan and only need address for management vlan (4) I didnt include all of your config, just the important parts that need to be followed. Not includin...

uberwebguru

Right now testing out zabbix and nagios and if i dont like those, will checkout elastic stack and possibly prometheus/grafana/loki also i honestly want one app that will so all of monitoring for everything, from network, to server to application to logs i want one dashboard for everything, similar t...

uberwebguru

I am having similar issues wireguard1 is showing as running, but wireguard2 is not showing as running why is this? Because you used the exact same listen port as the other entry. Change that port and it will start. Wow you are right So the add feature does not auto increment the port Yup changed th...

uberwebguru

common folks, just a joke
yeah couple of exaggerations there
but point am trying to make is making big progress
i am as humble as they come

uberwebguru

I am having similar issues
wireguard1 is showing as running, but wireguard2 is not showing as running
why is this?

uberwebguru

I am trying to setup SNMP so i can monitor my mikrotik networking devices with zabbix I believe i did everything right but getting "No SNMP data collection" error Can someone please tell me what i am missing? Here is my setup on mikrotik [admin@MikroTik] > snmp community print Flags: * - D...

uberwebguru

The Dude, on a RB1100AHx4 Dude Edition with internal SSD disks and about what @loloski wrote, I use it (on a dedicated separated hEX with a microSD) also for customers I dont think i like The Dude it looks too ugly and specific to mikrotiks I want something that i can extend to do more like monitor...

uberwebguru

I am about to test out zabbix and nagios for network monitoring
What are you guys using? What has been your experience with zabbix or nagios?
Or do you use paid software like solarwinds or prtg?
Please share

Thanks

uberwebguru

Have no clue what you are trying to accomplish with the Audience, Which vlan is the trusted or management vlan?? There should only be one route........to the gateway IP of the trusted vlan. VLAN20 is management VLAN I want to setup different wifi for VLAN10 and VLAN11 Users connected to wifi wifi_s...

uberwebguru

Spend some time reading the MikroTik docs. Start here: Getting started Almost done with my config!!! I even got wireguard from laptop to CCR2004 router working like a charm!!! Can access the private IP of CCR, tested webfig and so on All these in like 2 weeks? With no consultant, except for the for...

uberwebguru

Here they are guys @rextended @anav @AllexRo CCR2004 # RouterOS 7.2rc3 # model = CCR2004 /interface bridge add name=bridge /interface ethernet set [ find default-name=sfp-sfpplus1 ] comment=AUDIENCE set [ find default-name=sfp-sfpplus2 ] comment=CRS326 set [ find default-name=sfp-sfpplus12 ] comment...

uberwebguru

Please post your config - if you want assistance /export hide-sensitive file=anynameyouwish In terms of the basics some ideas here...... https://forum.mikrotik.com/viewtopic.php?t=182276 Didn't realize you posted this command /export hide-sensitive file=anynameyouwish ok will try that and upload

uberwebguru

Please post your config - if you want assistance

How do i post the config?
Guys i am new to mikrotik
Very new, I just found about about it few months back
Not expert like you guys, and no support except in forums

uberwebguru

I Dont have time or patience to read some non-standard format. Why cannot you simply post your config ??? This guru is getting uber annoyed and I just might leave this web. ;-) I asked how to post config and no one answered Does RouterOS have option to have config file and be able to edit the file ...

uberwebguru

@rextended @anav @AllexRo Winbox, RouterOS 7.1.5 Here is what i have done to Audience Pre-requiste settings on CCR2004 1. Created bridge "bridge" Added the port connected to Audience to the "bridge" 2. Under Interfaces, created VLAN3 and VLAN4 And used "bridge" as inter...

uberwebguru

You do know we are both talking about the same thing, right ?

OP did indeed use Winbox (but he needs to confirm that).
And from CLI some characters need to be escaped, I am aware, but that was not his question.

Yes i use winbox, and ROS v7.1.5

uberwebguru

@uberwebguru Without wasting time, publish the command line with the password that gives you the error instead of writing novels. Don't use as an excuse that you don't want to show (rightly) the password, create another one that gives you an error and show that. I use winbox not CLI I am using Rout...

uberwebguru

Ok my next post in a few will detail settings i have for the Audience AP
Does RouterOS have option to have config file and be able to edit the file as another option to CLI or winbox or webfig?
So maybe i can just post that config file here, after changing real names and redacting stuffs ofcourse

uberwebguru

i you are gonna connect this machine to a rj45 uplink consider ccr2116, cost a fraction and performance will be very similar in most scenarios, and more adequate for the job, and more power efficient Yeah will stick with my CCR2004, i hate the CCR2116 with passion because of the useless several 1G ...

uberwebguru

At first I though you were serious, then due to your uber name, I believe when you posted it was 1-APR-2022 where you are, so I assume this is an "april fools joke". Nopes not april fools I have tried many times and it keep not accepting but when i reduce characters it allows So there are...

uberwebguru

I have noticed whenever i have a complex password up to like 28 characters or so, RouterOS does not accept the password
I need to modify to allow even up to 256 characters or more!!!
How do i do this?

uberwebguru

I know on my cap ac, using it as a pure Access Point was a bit frustrating at first, since the device tries to operate in a "router" mode, and the quick webfigs didn't make things any better. The default settings (or whatever I clicked around with in webfig/quickWebfig) almost always made...

uberwebguru

Are you able to connect to Winbox via devices that are directly connected to Audience via WiFi or downlink ports (meaning, by not traversing the uplink to the CCR/CRS/etc)? That is another issue i have, the wifi SSID is on and i can see it but when i try to connect, i get "no internet connecti...

uberwebguru

Can someone please help How is it that i can see wifi SSID but winbox can not see Audience AP What do i check to fix this? Audience is connected to CCR router same way CRS switches are connected but winbox cant see Audience AP It can everything else All devices can all ping each other and all device...

uberwebguru

S+RJ10 should work in the SFP28 cages.

Sorry guys, I mispoke too soon, I thought those ports were QSFP+(40G) but they are SFP28(25G)
So the same SFP+(10G) port will fit into SFP28925G) ports as well? and if that is Yes
Then i will assume QSFP+(40G) will also fit into QSFP28(100G) also?

uberwebguru

I am thinking of this beat of a CCR2216-1G-12XS-2XQ router https://mikrotik.com/product/ccr2216_1g_12xs_2xq #1 Hhow do i connect my RJ-45 WAN uplink from ISP to this router? https://i.mt.lv/cdn/rb_images/2123_hi_res.png #2 For devices with 1G and 10G BASE-T RJ-45, what connectors can i use to connec...

uberwebguru

Too little information. Since you seem to struggle configuring the whole lot (CCR, Audience, VLANs, ...), it's really hard to pin the exact point of failure in your case. I have 2 other CRS switches i am able to connect fine So why is audience differemt Again i can ping audience IP from CCR, CRS an...

uberwebguru

You need to understand some networking fundamentals , then learn about how RouterOS is configured. Those are two different things, and in my opinion, you should understand networking before you start playing with the router connected directly to the internet. Spend some time reading the MikroTik do...

uberwebguru

What am asking is about essential services that MUST be on for things to work None of them are needed for things to work. System-Packages, if you mess with those, then stuff will break. Cool then, then disabling all those services and only leaving winbox on is huge security settings now i no longer...

uberwebguru

I have my audience device connected to CCR2004 router I can ping the ip of the audience device on management VLAN1 with ip 192.168.11.253 from the CCR2004 router with VLAN1 ip of 192.168.11.254 when i connect to the audience device via wired ethernet cable, i can ping the CCR2004 router also and can...

uberwebguru

Please let me know what services i need on and if this is a good idea You need the services on that you plan to use. We can't answer that for you. What am asking is about essential services that MUST be on for things to work Maybe api is needed for basic routing, am not sure Again what MUST be on, ...

uberwebguru

I am trying to only keep necessary services on only
Since the rack will be couple of feet away from me
I can turn them on when i need them, as part of security

Please let me know what services i need on and if this is a good idea
Thanks

uberwebguru

Ok i have setup the destination NAT in ip => firewall => NAT Followed these steps https://i.imgur.com/UhbPJ3m.png Issue now is i am able to route to internet using the gateway public IP for the router but what will be the gateway ip to route to internet for the switches? this is where am not getting...

uberwebguru

Conneted and making requests is two different things
They are?

Successful SSH login and SSH command to login are the same?

uberwebguru

That is remove though, I dont want to remove I want to find ways to detect what the IP is doing, it has been there for a while Also what is the connections tab meant for? All connections to router or requests to router? What do you think closing means then? "Connections" is all traffic. I...

uberwebguru

Click on the connection and then the red - button in the top left. Also be aware that there is a LOT of "harmless" traffic.. There are many groups that scan the entire internet hourly. That is remove though, I dont want to remove I want to find ways to detect what the IP is doing, it has ...

uberwebguru

I am seeing the following IP 186.148.224.203 in my CCR router under ip => firewall => connections tab and not sure if am hacked or something

Anyone know steps to close all connections and see this IP continue to show up?

uberwebguru

Here is back of the fan, seems it might be sucking air out

uberwebguru

Ok cool will leave in
I think most mikrotik rack devices have those side vents at the same spot even
I just checked my it now with CCR2004 and CRS312, they all have that same side vent on same side

uberwebguru

Conversely, if the fans are sucking air out, the air pressure in the cabinet will drop resulting in air entering via the side vents.

I dont think the fans are sucking air out, you can see the pics

uberwebguru

Which part of the NAT configuration are you having issues with? I think first i want to understand what i need to do Like i said router can be reached via public IP address and can route to internet using the public IP gateway of third to the last IP in the CIDR block i purchased from ISP Now i wan...

uberwebguru

Do not remove cover, use air conditioner on the room.

Air conditioner or not, hot air has to get out
If fans blow towards ports and ports are closed
how will hot air get out? side holes not enough, and fans do not blow in that direction

uberwebguru

More pictures here https://www.servethehome.com/mikrotik-c ... ne-switch/

uberwebguru

I'm trying to politely saying this, you are not the right person for this job [/b]. I strongly suggest hiring someone for a couple/few hours to set this up for you. Otherwise start here, https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT#Source_NAT Networking is not rocket science; you guys make...

uberwebguru

I have the CRS326-24S+2Q+RM that comes with the SFP+ port covers
Since am using only a few of the available ports
I am thinking it is best to remove all the port covers for cooling
Can someone please advice what recommended practice is with these SFP+ port covers?

uberwebguru

I added the route to 0.0.0.0/0 via 192.168.11.254 gateway but i cant reach internet this way I can only ping the gateway IP but cant reach internet how do i reach internet from the CRS switches? Oh boy... Where to begin.. I do have a couple questions.. Why did you pick the CCR2004? The RB____ serie...

uberwebguru

how do i setup the private IP from the management VLAN1 (192.168.11.254)? /ip address add address=192.168.11.254/24 interface=???? Replace the questionmarks with the name of an interface where you want this address to be placed. As you mention management VLAN 1, the proper interface would be the in...

uberwebguru

An ISPs router can both act as a Router and at the same time having passthrough enabled... Since you can reach the internet connected to your ISPs wifi obviously it acts as a router too... Are you sure the IP address space assigned to you by your ISP belongs to the Public IP address space ? I can r...

uberwebguru

Anyone else willing to help with this setup
I have couple of stuffs setup already
Just need guidance on how to proceed from where am at

Thanks in advance

uberwebguru

https://forum.mikrotik.com/viewtopic.php?t=182276 Look at the example. You can use ether2 on the audience for off bridge access during configuration and after. I do not understand that thread/post Any way to provide help for my specific question? For you that know what to do, things may look obvious

uberwebguru

I have been able to setup route to internet using the static public IP CCR2004 can route to internet with the public IP but the CRS switches are not able to route to internet I created route to internet using the private IP of management as gateway but still can not route to internet from the CRS sw...

uberwebguru

I am trying to setup my audience device with my CCR router. CCR2004 is connected to ISP gateway router with static public IP via IP passthrough setup ==> (https://forum.mikrotik.com/viewtopic.php?t=184341) So i am able to set static public address for the CCR router, but how do i set private ip addr...

uberwebguru

Extra details on topology

CCR2004 ---> CRS326(need for SFP+ 10G ports) ----> CRS312(need for RJ45 10G ports)

CCR2004 => https://mikrotik.com/product/ccr2004_1g_12s_2xs
CRS326 => https://mikrotik.com/product/crs326_24s_2q_rm
CRS312 => https://mikrotik.com/product/crs312_4c_8xg_rm

uberwebguru

Without knowing more details, i'm going to lean towards this topology CCR ---> CRS ----> CRS at this point i will be daisy-chaining the CRS326 and CRS312 switches together and have many un-used ports on CCR2004 router, thanks to you guys but yeah like many wierd things in the world, not sure what r...

uberwebguru

why do routers have many ports? Routers may be used in more complex scenarios than just a single WAN and multiple (V)LANs. Also the bandwidth of a single port may not be sufficient to host all the traffic volume. And it would probably be too complicated to manufacture multiple routers with the same...

uberwebguru

@Zacharias @sindy I have assigned static public IP from what i purchased from ISP and i can reach my mikrotik router via the static public ip fine that is already done, i can pinfg the internet from CCR router fine also I am already setting up my VLANs and connecting the 2 x CRS switches also Only t...

uberwebguru

Ok i see the point you making Now i have a question, if it is not recommended to connect switches directly to router and be doing switching on it then why do routers have many ports? What scenarios does it make sense to connect a device to the available ports on the router? Because if this is the ca...

uberwebguru

Without you telling us exactly in what way ISP device us still acting as router I'm guessing you set up CCR in parallel to the rest of devices. If that's not the case, then provide us with current network layout and text export of your CCR. And write details about how's your ISP router configured. ...

uberwebguru

What if i connect one of the CRS switches to both the CCR router and the other CRS switch? So any connection between devices on same VLAN uses the connection between the switches, which will be trunk port and also have connection to router for VLANs that need to go directly to CCR router Is that a v...

uberwebguru

I guess @chechito tried to emphasize that traffic passing between clients in sane (V)LAN connected to different switches should pass LAN infrastructure with least impact on performance of all infrastructure devices. Switches are very efficient at passing frames belonging to same (V)LAN between thei...

uberwebguru

I guess @chechito tried to emphasize that traffic passing between clients in sane (V)LAN connected to different switches should pass LAN infrastructure with least impact on performance of all infrastructure devices. Switches are very efficient at passing frames belonging to same (V)LAN between thei...

uberwebguru

Most networked devices nowdays (wired, wireless, ...) use DHCP protocol to discover network settings (own IP address, gateway, DNS servers) ... and most routers, given out by ISPs, have DHCP server configured (because most users don't know much about networking). Users who know a bit of networking ...

uberwebguru

will be nice to know the exact models or CRS switches en CCR 2004 you are using i think its also important toknow if in that scenario will be valuable to offload some traffic accross directly conected accross switches without passing accross the router, that will be optimum for efficiency and perfo...

uberwebguru

So i have now added static ip to the mikrotik all looks good, i added gateway ip and DNS server and route to internet and i can route to internet can ping google.com and so on BUT the ISP router is still working as router. What is going on? Am i doing something wrong? I thought the ISP gateway route...

uberwebguru

I have CCR2004 and 2 x CRS switches So my question is, should i connect each CRS switch directly to the CCR router OR do i connect one CRS to CCR router and then connect second CRS to the first CRS switch? What i want is have similar VLANs really on both switches, there may be a few VLANs on one and...

uberwebguru

When you say static IP block what do you mean? THe ISP is giving you 5 public Static WANIPs ??

yup i have /27 static ipv4 from ISP

uberwebguru

I believe what you're asking for is how to make the RouterOS box get a public IP. Assuming you don't have a static IP from AT&T, you have to enable the DHCP client on the WAN-facing interface. RouterOS doesn't blindly solicit IPs and DNS servers and routes and everything else you can get over D...

uberwebguru

Trying to do similar thing to this https://forums.att.com/conversations/at ... 546096212e

I need to use router at home and need to connect to ISP gateway router via ip passthrough

uberwebguru

I am finally ready to seup mikrotik CCR router with home ISP gateway router
trying to seup ip passthrough, but i am not sure where to find the mikrotik public WAN ip address

anyone willing to point to how to navigate to where this ip address will be?

uberwebguru

@Amm0 With the method above, I will be unable to specify the exact winbox version i want to use Nevermind. Just a suggestion, since I actually like that "brew upgrade" get me the latest winbox and the wine stuff is automatic/included. Clearly you have unique problems. Gatekeeper is needed...

uberwebguru

@Amm0 With the method above, I will be unable to specify the exact winbox version i want to use

uberwebguru

In your case, essentially, you'd want ether1, ether2, wlan1, wlan2, wlan3 all as a bridge ports, using "vlan-filtering=yes" on the bridge interface, assigning the PVID/tagging on ports, and finally associating the bridge port with your existing VLAN IDs. You'd want a DHCP client the untag...

uberwebguru

The rest of your question is easy by /interface bridge ports and /interface bridge vlans I know how to setup VLANs on switches already and all that, issue here is audience device does not have ports i can use as access ports, devices will connect via wireless, that is the issue am having. Also no w...

uberwebguru

Side issue 1: Downscale screenshots taken on Retina systems by 2x before posting to the web to avoid this scaling problem. The macOS way of doing that is via Preview: Tools → Adjust Size, then say either 50% or change the resolution to something more like 72 ppi. one your screenshot you posted is b...

uberwebguru

Anyone know how i can permanently trust opening this file without the popup? Once again, you've asked something that has nothing to do with this forum's topic . You've simply broadened it to "how do I use macOS" now. We're happy to help you with MikroTik hardware, RouterOS, and so forth, ...

uberwebguru

Ok solved second part of winbox not working on mac again
followed this video

https://www.youtube.com/watch?v=UZcOKYVNup4

Anyone know how i can permanently trust opening this file without the popup?

uberwebguru

https://i.imgur.com/gj067Fm.png I get this when i run the command /usr/local/bin/wine64 "/Applications/winbox64.exe" Issue now is, first time i installed winbox on my mac, everything worked great, i was able to connect tot he router and switches on my GNS3 project but now when i try to lo...

uberwebguru

In general, if using vlans, its cleaner to use ALL vlans and just have the bridge be a bridge (not doing any dhcp etc.). So in short - one bridge -define all subnets via vlans with interface bridge -all vlans get ip pool, ip address, dhcp-server, dhcp-server-network -config /interface bridge ports ...

uberwebguru

I will like to setup Audience AP device, but wanted to know if we manage this with CAPsMAN also or not. I know CAPsMAN is for managing multiple CAP AP devices, but is audience AP considered a CAP? So i have setup a VLAN to put the audience AP device on from CCR router, i created a bridge to setup ma...

uberwebguru

You are right i installed wine via homebrew and downloaded winbox64.exe in Applications folder and boom started winbox like so wine64 "/Applications/winbox64.exe" only issue is i have to keep the command session open while am using the winbox if i terminate from that command, winbox closes...

uberwebguru

Can we install winbox on mac but using bash (instead of zsh)?
This video mentioned we must use zsh shell

https://www.youtube.com/watch?v=FXhT2QGxgp0

uberwebguru

The rest of us are willing to help those that make honest efforts and that read available literature and dont forget to read I am not starting from zero with mikrotik I have been able to follow couple of guides already I just have certain questions, like i asked above and maybe a few follow up ques...

uberwebguru

is it ok to create 3 VLANS to put the CRS1, CRS-2 and AUDIENCE-1 You don't put your network gear into VLANs. I know what VLANs are, did you read my question? If you don't put your network gear into VLANs when what do you put into VLANs? we got trunk ports and access ports, so depends how you interp...

uberwebguru

Hi, I am very interested in routerboards and the CCR2004-1G-2XS-PCIe and would like to know whether it is possible to install an OS other than RouterOS. My question is specific: is it "possible" in the first place, or is it "explicitly forbidden" by nature (e.g. BIOS in ROM or s...

uberwebguru

There is a nice tutorial on the forum:
NEW USER PATHWAY TO CONFIG SUCCESS
viewtopic.php?t=182373

So no route to requesting support from mikrotik? just forum support?

uberwebguru

There is a nice tutorial on the forum: NEW USER PATHWAY TO CONFIG SUCCESS https://forum.mikrotik.com/viewtopic.php?t=182373 A question i have CCR-1, CRS-1, CRS-2 and AUDIENCE-1 is it ok to create 3 VLANS to put the CRS1, CRS-2 and AUDIENCE-1 OR create just 1 VLAN and connect CRS-1 and then connect ...

uberwebguru

The mikrotik gears are here!!!
Got CCR, CRS and AUDIENCE

Now i need some help in configuring these things.
One question i have is, is community support all we got?
Even for a brand new purchase?

P.S No way to attach images? Only option is web images???

uberwebguru

550mbps audience speed wave2... as an AP only.
No bridge mode yet. Doesn't help me.

If audience is rated to cover 20k sq ft, then why do you need more than 1 in your space?
How big is your space?

uberwebguru

I am still waiting to have my audience delivered But for $169 what is the issue with mikrotik to go wifi 6? Is wifi 6 so much more difficult for mikrotik than other brands? Am not getting what the issue is really to be honest Claim is audience can cover 20k sq ft, i only need it to cover 3k sq ft, i...

uberwebguru

For any better graphing/logging, use some 3rd party tools. Such as cacti with SNMP data collection. Mind pointing to what cacti templates you using or you have custom templates? Between by know i would have thought there will be a newer and more modern monitoring software than cacti and the others ...

uberwebguru

Do mikrotik routers/switches have enough storage to store long time graph data for interfaces? I see there is endpoint to view graphs but am wondering for how long data can one store since mikrotik devices lack enough storage How long can one store for and what other options or solutions do you gusy...

uberwebguru

I am working on setting up 40G infiniband networking for TrueNAS storage server My reason for this setup is to help reduce latency when reading/writing to the TrueNAS storage server Computer nodes will be connected via 10G SFP+ ports to mikrotik switch So lets say i have a switch like mikrotik CRS32...

uberwebguru

anyone can help? thank you

possible that any other brand 100G module should work is what it seems

uberwebguru

42x42 meters is not that big, depends on what walls you have. Audience has amazing antennas. In an open space, it will cover even bigger areas.

42x42 meters is HUGE!
how many houses in the world are that big? very few
this is home office router/AP

uberwebguru

Difficult to select for someone else. I'm not able to include the "amazing" factor in these calculations, but doubling the range requires 6 dB extra. (it's logaritmic). And any high gain antenna does only work because it reduces the directions. (from sphere to donut shape, even sectored f...

uberwebguru

20.000 sq ft .... 141 ft side in square. 42mx42m is quite big! Is that really true? Well maybe. I don't know how accurate this test is: https://forum.mikrotik.com/viewtopic.php?t=176564 , and on what freq is used to measure (the 2x2 or 4x4 5GHz). The test does not match (my) expectations and estima...

uberwebguru

20.000 sq ft .... 141 ft side in square. 42mx42m is quite big! Is that really true? Well maybe. I don't know how accurate this test is: https://forum.mikrotik.com/viewtopic.php?t=176564 , and on what freq is used to measure (the 2x2 or 4x4 5GHz). The test does not match (my) expectations and estima...

uberwebguru

I am seeing the audience US model with model number of RBD25G-5HPacQD2HPnDUS different from the regular model of RBD25G5HPacQD2HPnD?

Thanks

uberwebguru

Hello. I want to setup a network for my home which have 3 floor-house , one guest house and a gym. I am MikroTik user for more than 5 years and I want to setup a network with a MikroTik router and some APs which could operate in a mesh network to cover all the areas in my home. So far I decided to ...

uberwebguru

Capsman is another option but then no wifi6. Mikrotik AP are pretty cheap though... Unfortunately... Mikrotik wireless is nothing like the cost vs performance their routers are. Audience claims 20,000 sq ft coverage; try find a router/AP that can cover that much for $169. Will wait Yeah they are la...

uberwebguru

This is not Mikrotik specific, it is how wifi works.
thanks for the info, i think i will go with this https://mikrotik.com/product/audience
one thing am not if that is a typo or not is
it mentions that it can cover up to 20,000 square feet house

Is that really true?

uberwebguru

All repeaters lose some speed while doing this re-broadcast. Just not many will admit it. This is a limitation of current technology. Most mesh devices have a separate radio inside, that does the connection to the next unit. Then speed does not drop. We have such extra radio in our Audience devices...

uberwebguru

All repeaters lose some speed while doing this re-broadcast. Just not many will admit it. This is a limitation of current technology. Most mesh devices have a separate radio inside, that does the connection to the next unit. Then speed does not drop. We have such extra radio in our Audience devices...

uberwebguru

All repeaters lose some speed while doing this re-broadcast. Just not many will admit it. This is a limitation of current technology. So if AC #1 is connected via wired and AC #2 is connected to AC #1 via wireless(because do not want to run wire) as repeater, will both AC #1 and #2 loose speed or o...

uberwebguru

1. You can mount it any way you like, the wifi radiation pattern is roughly spherical for indoor devices 2. Yes, there are several ways to do this, with repeater mode (speed will be 50%) or using 2GHz only for link between devices (your clients only can use 5GHz then) cool thanks why is it that way...

uberwebguru

i see got it now...other brands/products are not like this
an access point usually can not be a router
makes mikrotik special in its own class i guess

thanks you all for all the info

uberwebguru

...yep, just use it in "bridge mode" only and do not add/enable any firewall rules. So is cAP XL ac also a router then? cAP XL ac looks more mainly as access point but hAP ac is like a wireless router? You get my question right? I can use hAP ac as wireless router but cAP XL ac needs a ro...

uberwebguru

As we all know, no one wants to be wiring the house every time there needs to be a need for a new device The cAP XL AC is said be a ceiling access point, meaning will require carrying wires in the ceiling and installing there #1 can i use this as regular access point and place on a desk or floor? #2...

uberwebguru

I am wondering if the hAP AC is a wireless router or an access point
https://mikrotik.com/product/RB962UiGS-5HacT2HnT

I want to use as access point only
already will be using CCR as router

uberwebguru

MikroTik’s firewall is not next gen and I do not believe that MikroTik want to be in that arena. Next gen firewalls work very comfortably in layer 7 very close to wire speed … they are in a class of their own. NGFWs are able to block malware from entering a network, something that traditional firew...

uberwebguru

What about this option then? Another option i am considering here is build a 1U router Dell R230 E3-1225 v5 [https://ark.intel.com/content/www/us/en/ark/products/88168/intel-xeon-processor-e31225-v5-8m-cache-3-30-ghz.html] 2 x 1G RJ45 onboard 2 x 4 x 10G SFP+ [Dell Chelsio T540-CR] => 8 x 10G SFP+ p...

uberwebguru

I am seriously considering this https://mikrotik.com/product/crs326_24s_2q_rm but only if the routing performance will be good enough for me Will use routeOS v7 on it question now is will the routing performance be great enough for my 12U setup? Anyone know where i can get the performance results fo...

uberwebguru

MikroTik’s firewall is not next gen and I do not believe that MikroTik want to be in that arena. Next gen firewalls work very comfortably in layer 7 very close to wire speed … they are in a class of their own. NGFWs are able to block malware from entering a network, something that traditional firew...

uberwebguru

https://mikrotik.com/product/ccr2216_1g_12xs_2xq And then in each of the SFP-slots you insert a 10G copper SFP. Not much room for expansion, just 1 port "free" , perhaps for a 2e ISP uplink. However if your ISP can deliver 100G Ethernet you can also do this. However the RJ45 part might be...

uberwebguru

So how do i like see statictics of wwhere traffic is comming from? what countries? locations? what IPs are making most requests etc? Those are features am looking for not virus scanning or the other NGFW features Just want modern traffic reporting A MikroTik Router can log your traffic and send tho...

uberwebguru

I have a 12U colocation I get 10G RJ45 uplink from provider for WAN/internet I have 8 servers with 10G RJ45 ports I need a single device to do routing and switching for my small 12U networking needs 8 servers will be doing web serving with hundreds of apps, with several millions of users using the a...

uberwebguru

MikroTik’s firewall is not next gen and I do not believe that MikroTik want to be in that arena. Next gen firewalls work very comfortably in layer 7 very close to wire speed … they are in a class of their own. NGFWs are able to block malware from entering a network, something that traditional firew...

uberwebguru

I plan on using the Mikrotik CRS312-4C+8XG-RM [https://mikrotik.com/product/crs312_4c_8xg_rm] as router and switch, meaning i will be connecting servers directly to this. Can someone let me know what kind of routing performance i can get from this? I have seen the test results here https://mikrotik....

uberwebguru

Is the new router CCR2116-12G-4S+ https://mikrotik.com/product/ccr2116_12g_4splus is a next generation firewall? https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-next-generation-firewall.html#~choose-an-ngfw-firewall A next-generation firewall (NGFW) is a network security device t...

uberwebguru

I am trying to get rid of having to get a server for pfsense and also get a 10G switch, making it 2 things to worry about So why not get one giant mikrotik core router and connect my servers to it directly? I only have like 8 servers to connect to with dual 10 SFP+ ports each Here is the mikrotik ro...

Search found 173 matches