MikroTik

ajgnet

I can't figure out the sudden high fan speeds. Even when sfp-temperature is < 70 fan speed appears to randomly jump to 7000+ rpm. MikroTik friends, is it possible to add slightly better fan control options to keep these units quieter when possible? Columns: NAME, VALUE, TYPE # NAME VALUE TYPE 0 cpu-...

ajgnet

I am experiencing an issue with the fan speeds on my CCR2116 router. The fans seem to ramp up and down arbitrarily even when the temperatures are quite low, leading to unnecessary noise. Below are the current readings from the system health check: [a@gw01] > /system/health/print Columns: NAME, VALUE...

ajgnet

7.16beta3 (2024-Jun-27 08:33):
dns - added support for DoH with static FWD entries;

Thanks, guys! Amazing.

ajgnet

Is there any workaround to have FWD domains working with DoH? Thanks

ajgnet

I have a question regarding the IP --> Traffic Flow feature. I'm currently using Traffic Flow to export traffic data to ntop for analysis, and I'm considering enabling Fast Track for performance improvements. My question is: Will the IP --> Traffic Flow export still function correctly for flows that...

ajgnet

The config looks file. Please check if bridge1 has the H flag in "/interface/bridge print". The switch chip supports only one hardware bridge, let's double-check if the system picked the right one. [adam@gw01] /interface/bridge> /interface/bridge print Flags: X - disabled, R - running 0 R...

ajgnet

You can limit the egress rate of the port (or even a particular queue): /interface/ethernet/switch/port set sfp1 egress-rate=5G For some reason when I do this, max bandwidth gets capped around 800Mbps not 5G Also, I followed the Dante instructions but it does not seem like the below configuration h...

ajgnet

Thank you very helpful. But what if the uplink port has a 10G link but ISP bandwidth is only 5G? How can I make sure the buffer is not saturated at the ISP and thereby nullifying the priority queues? For example, should I set the sfp1 interface to 95% of 5Gbps so that the switch QoS takes effect? Ho...

ajgnet

I need to achieve two main goals with my QoS setup on a CCR2116 and would like to use L3HW if possible:

1. De-prioritize all traffic on TCP port 21 (FTP).
2. Prioritize all VoIP traffic by matching DSCP values.

Is this possible with QoS-HW? What would the configuration look like, as an example?

ajgnet

Thanks, has WRED offloading been enabled yet? Any simple examples you could point to?

ajgnet

I am currently using a CCR2116 and exploring options for implementing hardware offloaded QoS. Specifically, I am interested in enabling CoDeL or Cake using hardware queues if possible, if not, simple priorities. From my understanding, CoDeL and Cake are typically software-based solutions. Does anyon...

ajgnet

you missed an importaint part "psd", this option exists in the ipv4 firewall, but not implemented in the ipv6 firewall...

Thank you - I understand what you mean and this explains it. So it sounds like there is currently no way to do this in IPv6 until that feature is implemented.

ajgnet

I'm trying to block IPv6 portscans coming to my router. The below filter rules work for IPv4 but get ignored for IPv6 (no traffic matches). What am I doing wrong? add action=drop chain=input comment="BLOCK PORT SCAN - Drop Port scanners" src-address-list=port_scanners add action=drop chain...

ajgnet

Hello, is there an easy way to collect traffic totals by interface for day/week/month/year? Thanks

ajgnet

And as a follow up: what exactly is the SFP temperature measuring? If I pluck the module out of the switch and measure with a laser thermometer, it registers around 50C. So I'm not sure what is ~100C?

ajgnet

Hello - We have 3 Mikrotik 10G S+RJ10 modules on our CCR2116 and I noticed the temps in the range of 90-100C. Is this a safe operating temperature? The switch chip is a cool 40C as well as the CPU at a cool 45C. I'm just a little spooked by this high temperature, particularly since I believe the aut...

ajgnet

I did have luck with one brand, but I forget which one (I have about four). I believe the one that's in there now is QSFPTEK and the fans aren't ramping up. I think it's because some brands don't report SFP+ module temp. My 10GTek modules don't report and I get lower fan speeds. The Mikrotik SFP+ N...

ajgnet

I have the same issue with mine - very quiet until I put in a 10GbaseT SFP+ module, then fans ramp up to 8000 rpm.

ajgnet

Curious if anyone has replaced the stock fans on the CCR2116-12G-4S+, and what the results were? Any tips or suggestions? Thanks

ajgnet

Reporting the same issue

ajgnet

I am currently using a CCR2216-1G-12XS-2XQ with L3HW enabled in firewall compatible mode (enabled on the switch, disabled on the interfaces, fast-tracking established/related connections). On a saturated 10G line, my CPU is ~3% with around 4,000 tracked flows on the Marvell chip.

ajgnet

Thanks for that clarification - makes total sense to me now.

And what does enabling L3 Hw Offloading on the switch1 cpu do?

ajgnet

Out of curiosity, are you using Unifi APs?

ajgnet

Hello, just curious if there is a way to get statistics off the 98DX3255 or 98DX8525 chips? Thank you

ajgnet

Hello, I am configuring a CCR2116 with firewall compatible layer 3 hardware offloading (via fast track rules). I have L3 hardware offloading disabled on the WAN port, but enabled on the switch, on the CPU, and enabled on all other ports including the LAN ports. I am using a bridge, and the LAN port ...

ajgnet

Would love the ability to specify a DoH server but also FWD entries to specific DNS servers. Currently, enabling DoH disables all FWD entries.

ajgnet

Hello, looking into the CCR2216-1G-12XS-2XQ for a project but the server closet is near desks and we'd like to keep noise to a minimum. We are looking into the CCR2216 and CCR2116 but would strongly prefer the CCR2216 due to the QSFP28 ports. What's the noise like? Thank you

ajgnet

/ip firewall filter add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=no protocol=udp add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes add action=accept chain=forward connection-state=established,related ^ ...

ajgnet

Hello - Just switched from Unifi to Mikrotik and one thing I miss are the pretty graphs that provide device-level detail on traffic flow. I know Mikrotik can export traffic flows but I am not familiar with software to collect and process such flows to make pretty graphs. I've used ntopng in the past...

ajgnet

I have a CCR2116-12G-4S+ w/ L3HW offload enabled at the switch level and disabled on ports. Fasttrack offloading works great. However, I'd like to mirror the LAN switch port to sniff traffic. The LAN interface is currently a member of a bridge w/ several VLANs. When I enable port mirroring in switch...

ajgnet

I just enabled L3HW offload on my ccr2116-12g-4s+ and it is magical to see NAT'd IPv4 internet traffic routed at 10G line speed w/ <5% CPU usage. Is there any trade-off for offloading to the switch chip instead of CPU routing, particularly with respect to latency? One of the Mikrotik examples mentio...

ajgnet

Hello, I didn't see an option for PTR records in the built-in DNS server. Is there another way to forward all reverse lookups for an IP range to another server? For example:
any reverse lookup for 172.20.0.0/14 should query 192.168.2.1 for resolution
Thank you

ajgnet

Hello, I am using a CCR2116-12G-4S+ w/ hardware offload via fasttrack enabled. I'd like to set up QoS (fq_codel or cake) for upload and download traffic on the interface. Is this possible without turning l3hw offload off? Thank you

ajgnet

You'd need policy routing, i.e. two routing tables (one with ISP1 as gateway and another with ISP2 as gateway) and tell router that packets from prefix1 should use one (be routed to ISP1) and packets from prefix2 should use the other (go to ISP2). It can be done using either firewall mangle rules (...

ajgnet

I have two ISPs at home, each provides a ::/56 prefix delegation via dhcpv6. My ISPs don't support BGP or anything. I know I can assign ULAs internally and use NPTv6 or NAT66 to map them but it's a hassle since hosts with ULAs revert to IPv4 first by default and frankly, I'd rather not use NAT. Addi...

ajgnet

hah, oh wow that saves me a lot of time. thanks so much. but stupid question - it looks like when I do it this way the valid lifetime is 30 days and there isn't a way to change that. My ISP changes my prefix regularly and if there's a reboot or refresh/renew of the IPv6 address on my router the pref...

ajgnet

You know that IPv6 address has from-pool parameter that can do it automatically, right? Not sure I know what that is. I saw a "from pool" option in the dhcpv6 server but I'm not using dhcpv6 on my LAN only neighbor discovery. Is there a better way to do this?? If that's not good enough fo...

ajgnet

I solved this by adding the below to my DHCPv6 Client Advanced Configuration: :if ($"pd-valid" = 1) do={ :local lanVZ ([:pick $"pd-prefix" 0 [:find $"pd-prefix" "/"]]."/64"); :log info "VZ value is $lanVZ"; /ipv6 nd prefix set interface=sfp...

ajgnet

I'm trying to create a script in my dhcpv6 client that adds an nd prefix for my LAN (a ::/64) from my ISP provided /56. How can I do this? I was thinking of something like: :if ($"pd-valid" = 1) do={ :local lan_vz ([:pick $"pd-prefix" 0 19] . "::/64"); /ipv6 nd prefix a...

ajgnet

Working for me as well now. Thanks for the fast fix

ajgnet

Reporting the same issue. Thanks for the update

ajgnet

This solution no longer works on 7.5rc2

ajgnet

Anyone know which linux kernel version 7.5b is based off of? Looking forward to full NETMAP support in kernels 5.8+.

ajgnet

I have 3 ISPs VZ, NW, and SP. By default, all traffic goes out VZ with NW and SP acting as failover. However, some traffic is marked to exit NW and SP depending on the destination IP, source IP, or destination port using mangle rules. When I fasttrack all established, related traffic on the forward ...

ajgnet

Having the same error here on 7.2.1. Looks like a connection tracking error. Workaround was to allow input from specified dns servers

ajgnet

Does anyone have a working example of nptv6 netmap? or even nat66? I am trying to translate a ::/56 ULA to ::/56 public prefix.

ipv6 netmap through prefix translation isn’t implemented until kernel 5.8 so curious how Mikrotik has it working; I believe ROS is still 5.6

ajgnet

New to MikroTik and found the below script, added to each dhcp client, very helpful to get my 3 ISPs working: :if ($bound=1) do={/ip route set [find where dst-address=0.0.0.0/0 routing-mark=ISP1] gateway=$"gateway-address" } Just had two questions... first, is this still the best way to up...

Search found 47 matches