MikroTik

Seccour

Certainly some advice to take to heart on that. The most recent request for the elevation of privvies wasn't PCI but an internal risk assessment they had built up using bits and pieces here and there. Now that you mention it, I think it has only been internal risk assessments that have had that ques...

Seccour

This topic doesn't seam to come up at all. I started out in the ISP biz and moved over to Information security for a company who was small enough that tik's still seamed to fit the bill. However we are starting to get hit with PCI-DSS evaluations, Risk Assessments and Gap Analysis with an array of r...

Seccour

I 100% whole heartedly agree that proper firewall setup and maintenance is necessary to protecting our routers and network. I will never argue you that on that point. Even the best firewalls can be compromised though, and having a brute force attack simply render the most basic of unauthorized acces...

Seccour

ROS 3.16 RB230 Current Routerboard Firmware 1.3.8 The Only configuration is nat, Public IP and a gateway and Queues. The router is a test machine for a inhouse bandwidth management system using the ROS API. Problem: The router goes under a SSH attack and we experience a symptom where we cannot get i...

Seccour

3.14 on a 532A using routing-test package w/ ospf also pegs CPU at 100%

So it appears that its not just on a X86

Seccour

I had built such a setup a while ago but abandoned it due to some problems that hotspot had with retarded consumer routers. This was all done pre 2.9.40 So I don't know what changes have been made to possibly help me with the problems I had. Do a search on the forum for my username and i'll get the ...

Seccour

1.Hotspot Is possible without MT DHCP server? My client will get ip from Linux DHCP server. Hotspot doesn't care how a client gets an IP. So you may use your Linux box for DHCP. You can actually use the MT as a DHCP relay which I've done as part of my network design. Allows me to have a single DHCP...

Seccour

Knowing a little bit more about your current configuration for your network and for squid. Off the top of my head it sounds like Squid isn't listening on the correct port. You're going to need to make sure you have squid listening on the same port you have the MT redirecting your port 80 traffic to....

Seccour

Nope, I'm not missing that. #1) Users authenticate just fine, if you read my first message again you will see that they authenticate the first time fine, but if they Idle out then some of them aren't able to reauthenticate without removing them from the host list in the hotspot on the MT. #2) We are...

Seccour

Seccour 1) Please, provide complete log errors, when users are unable to authenticate in HotSpot+RADIUS. I've since disabled the hotspot (clients were getting way to mad at me.) I'll dig up the info and paste it here. I also have a supout i should be able to send. I've not tried the hotspot since 2...

Seccour

Mac Authentication has some weird quirks, so unless you need some radius specific return attributes like rate limiting, I would use IP bindings, you can actually just put in a mac address and any IP that is bound to it will pass traffic.

Seccour

I have a few hotspot problems and unfortunately its forcing me to not use Hotspot until I can get it fixed. Here are the two problems. one of them I've sent into Mikrotik but they unfortunately ignored my support request. I'll be more than happy to send it in again if they happen to see this thread....

Seccour

I'm getting a similar problem only I'm using MAC authentication, and it seams to be random. Clearing them out of the hotspot host list will get them to automatically and immediately authenticate properly. I think the problem may be the radius server that I'm using, but I'll let you know. I recently ...

Seccour

You can also try a firewall rule to drop the incoming traffic from a IP or range (likely the better of the two idea's )

Seccour

Use a Queue to rate-limit the ip. queue simple> print Flags: X - disabled, I - invalid, D - dynamic 0 name="attacker" target-addresses=10.10.10.10/32 dst-address=0.0.0.0/0 interface=all parent=none direction=both priority=8 queue=default-small/default-small limit-at=0/0 max-limit=1000/1000...

Seccour

I have a unique scenario in which using NAT (to free up IP's) cases browsing and general internet to stop working. Let me explain... I have a Mikrotik RB532 with 5 total interfaces, 3 Ethernet and two wireless. The internet comes into this MT via ether1. All of the interfaces are bridged. The other ...

Seccour

email me your config's and i'll see what I figure out.

seccour [at] nebonet [dot] com

Seccour

in my rad reply table i have a attribute called Framed-Ip-Address and the address they are assigned. I assign then the network parameters in the DHCP server so that they get their Netmask, gateway, and DNS correctly without interaction from Radius. Radius only needs to know then the IP address and i...

Seccour

use NTP to keep the date and time on the boxes. Then you don't need to manually go in and reset the date and time if the box gets rebooted.

Seccour

I use sql for my setup so it may differ from your config, but my radius uses the mac address to see whether or not to give out a DCHP lease, and then for my replies i ahve framed-ip-address and the ip, plus other nifty stuff like my rate limiting. The user that you are using, can you paste that conf...

Seccour

Make sure that the Mikrotik is listed in the radius configuration as an accepted NAS (client). If its not, then the mikrotik logs will give you error (assuming your logging radius messages) but freeradius will not log it by default, at least mine didn't. I use DCHP and Hotspot with Radius in combina...

Seccour

We were going to use session time out to get proper accounting logs every so often. I am now using Interim update, so this shouldn't be an issue. I will move over to using an Idle-timeout instead.

Thank you Normis! I appreciate the reply.

Seccour

Take a look at your system resources when the ping time starts to increase, I see this problem when I have an abuser and my Routerboard CPU goes to 100%. But with only 15 users, it likely is something else as I'm running 500+ clients through my Routerboard 230 only get that problem with abusers. Hop...

Seccour

I have a hotspot setup for MAC Authentication against a Radius Server (Works great now, btw!). Now I'm encountering this weird issue : If I have a user who's authenticated for a while, some of them will fail to reauthenticate to the hotspot if they've timed out. So they get the hotspot page and can'...

Seccour

Anyone else have experience with using DHCP and Radius ? I'm using Freeradius if that matters any. Does mikrotik have any thoughts ? I've setup another MT for production, and its now doing the same thing but now regardless if I've got a pool in or not. Just no DHCP via Radius. I've been mulling over...

Seccour

I have been developing my new AAA and BW Management system using Mikrotiks and RouterOS and ran into something odd. When first on the DEV, I was running ROS 2.9.29, Using the MT's to do my DHCP requests via a Radius Connection which worked exactly like we want. [admin@MikroTik] ip dhcp-server> print...

Seccour

Use the radius attribute Mikrotik-Rate-Limit The manual has a section for the different options you can do (Bursting) and it also appears to have a option for Marking the MAC via radius attribut but says its for Hotspot only. http://www.mikrotik.com/docs/ros/2.9/guide/aaa_radius I've used the Mikrot...

Seccour

It would be nice to be able to have graphs from a router stored on / at a central location. Would make looking at all my graphs localized without loading up all my routers / routerboard systems seperate to overview my system health.

Seccour

I had set the power to lower because I had read reports of the routerboard 532 not being able to supply enough power or have enough power itself if you had too much. When I first put both cards In I had a hard time getting clients to connect ( the AP was put in to replace a AP which took a direct li...

Seccour

A long time ago I recall seeing a thread about a situation where a Mikrotik AP would lose its clients, changing channel, power output, or enabling disabling the wireless interface would temporarily fix the problem. This is also only when using a SR2. Could someone point me to that post or perhaps he...

Seccour

Hrm...

both seam to work okay and switching between the two dont' make a difference with telnet / winbox / icmp...

by your recommendation i'll stick with the accept

Seccour

Did my test using that reference...came up with this. [admin@MikroTik] ip firewall nat> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=srcnat dst-address=10.0.1.0/24 action=passthrough 1 chain=srcnat dst-address=192.168.0.0/24 action=masquerade setup with appropriate routes for NAT and ...

Seccour

Awesome ! Thank you very much> I will be setting up and testing a configuration shortly

Seccour

We are looking to cut down on our IP usage by switching our clients over to a NAT configuration and offering still public IP's to those who need it and businesses. Is it possible to have both NAT and a routed IP subnet co-existing on the same interface (bridge, ethernet or wireless, We have a very m...

Seccour

I had similar issue with old linux kernal and some new Intel nics in which a feature was trying to be supported by the driver but wasn't fully compatible with the older kernel. Upgrading the kernel fixed the issue...

Seccour

Ram is a cheep upgrade and an easy one at that which requires hardly any downtime. So 512MB ram. As you'll notice i question everything, why 3Com over intel ? I current have two RouterOS routers which use 3Com and haven't had issues, but once again -- benchmarks have lead me to look at Intel vs 3Com...

Seccour

Hello, we are looking at putting in a RouterOS box specifically for managing our P2P traffic. We currently have 5 Class C subnet's which it would need to handle. What hardware would you recommend for such a task ? Right now I'm looking at an AMD 3000+, 1GB of Ram, CF OS Storage, Intel Network Cards...

Seccour

messed up my reply, moderater please delete

Seccour

Hello, we are looking at putting in a RouterOS box specifically for managing our P2P traffic. We currently have 5 Class C subnet's which it would need to handle. What hardware would you recommend for such a task ? Right now I'm looking at an AMD 3000+, 1GB of Ram, CF OS Storage, Intel Network Cards ...

Seccour

Shameless bump.

No thoughts ?

Seccour

After looking through the FTP threads and taking their advice, I'm finally to the point of asking the community for feedback. I recently just placed a few Mikrotik routers at my NOC. Everyone loves RouterOS, so do we. Once we placed a RouterOS machine (both are non-routerboard, just PC's) we noticed...

Seccour

Switching out the board seamed to have fixed the problem. We even kept the same Radio's and memory card that held the OS and didn't experience the same issue with just the replacement board.

Anyone ?

Search found 42 matches

Re: PCI-DSS/Security Risk Assessment/Gap Analysis

PCI-DSS/Security Risk Assessment/Gap Analysis

Re: 3.16 - SSH attacks Opens Router

3.16 - SSH attacks Opens Router

Re: 3.14 upgrade bad on X86!!! causes CPU peg

Re: FreeRadius auth by MAC address

Re: Linux and Mikrotik Integration

Re: Squid Cache server with MikroTik

Hotspot Problems with Mac Authentication

NAT and Bridged Interfaces

Hotspot Authentication Issue

Shameless bump

DHCP Quirkyness

Feature Suggestion for Graphs

Wireless AP Clients lose association...

Test appears to work...

Question about NAT and Routing co-existing

Nic's

Re: P2P and Hardware

Xeon vs AMD -- Not a debate, looking for price / performance

P2P and Hardware

Yet another FTP Problem

Details....