MikroTik

raphaps

I don’t have access to my ISP’s router; this configuration was sent to me by an ISP technician at the time of installation. I have spoken with the ISP multiple times to resolve this situation, but without success. Unfortunately, I have come to the same conclusion: they want me to enable proxy-ARP (w...

raphaps

But this configuration should be done by the ISP on the Cisco, right?

raphaps

So, as I mentioned at the beginning of the post, I have not configured address distribution for LAN devices through the ether4 and ether6 interfaces, which is why the advertise option is unchecked. The test I’m conducting involves assigning addresses to the ether4 and ether6 interfaces and trying to...

raphaps

Below are the configurations for interfaces, firewall, and IPv6.

raphaps

Hello, sorry for the delayed response. As far as the ISP informed me, they are routing the prefix to my router, but I captured packets and noticed that the RS and RA advertisements only occur between the ISP's Cisco router and the Mikrotik's ether1 interface, where the Cisco router is connected. I t...

raphaps

The ISP serving one of my business clients has an entire network in bridge mode. As a result, if I enable the ISP's interface discovery in the neighbors' settings, I can see several of their clients who have Mikrotik routers, many of them with versions older than 6.45, and some even without password...

raphaps

Yes, I understand that you weren't arguing, thank you for the help. A technical conversation is always welcome, especially in the early hours (in my case).

raphaps

But the issue is that I need to use addresses in different networks (there are actually 4), which is why a larger prefix is needed, since we can't divide a /64 as it doesn't allow subnetting (at least, it's not recommended). In fact, there is RFC 6177, which provides some guidelines for ISPs to deli...

raphaps

Understood, I’ll explore the options here. Either way, with a bridge, I can access the addresses of other prefixes, but I’ll test other configurations to achieve what I want. Maybe I misunderstood the concept of IPv6 on Mikrotik, but for me, the IPv6 forward option enabled would allow packets arrivi...

raphaps

My ISP provides me with a /56 pool statically, using manual configuration, without SLAAC or DHCP. Once I start distributing IP addresses on the LAN, I will then configure SLAAC on my Mikrotik. The starting point here is that I need to make these interfaces accessible from outside the network. The on...

raphaps

So your suggestion is for me to create a bridge between the interfaces ether1 (ISP), ether4 (LAN), and ether6 (LAN)? After that, add the addresses to the interfaces as in the first post?

raphaps

In this case, would I have to create a rule in the RouterOS firewall? Could you help me with this solution?

raphaps

I am unable to ping the addresses on ether4 and ether6 from outside. On ether4, there is an RB450 connected, and on ether6, there is a switch. Based on the tests, it seems there is no routing for the network addresses on ether4 (2001:db8:20a0:a1::5/64) and ether6 (2001:db8:20a0:b1::5/64) to the ISP ...

raphaps

@tdw, as I mentioned in my initial post, my primary intention is to configure it statically. I’m simply assigning addresses to the ether4 and ether6 interfaces. Once I manage to achieve external access through the global address I defined for them, I’ll move on to configuring the devices behind thos...

raphaps

I had already tested it this way, but without success as well.

raphaps

Hello friends, I am having trouble configuring an IPv6 pool provided by my ISP. They assigned me a /56 pool, and I want to break it into /64 networks. However, I am facing an issue: when I add the addresses to interfaces, I do not have external access. I have done similar configurations with another...

raphaps

/ip/firewall/service-port/disable sip

Explanation: https://wiki.mikrotik.com/wiki/Manual:IP/Services

Study a bit about SIP Helper and SIP ALG to better understand this configuration.

raphaps

Hello everyone. Regarding this freezing issue with the RB1100ahx2, I can say that I'm not experiencing the same. I own 9 routers of this model, all with uptime exceeding 17 days (except 2 that restarted due to electrical problems on-site), which was when I updated them from version 7.11.2 to 7.14.2....

raphaps

I have the same issue. After this problem occurred last year, I ended up hiring a redundant DDNS service, which I keep running via script. My routers are only online because of this redundant DDNS service.

raphaps

what tool you use to do that? (showed on screenshot) I have a perl script that exports from devices every night and then shows me a diff when something has changed. The output is that of Text::Diff::FormattedHTML from CPAN. The grey blob in the middle was just a quick way to cover some parts of the...

raphaps

*) ovpn - improved memory allocation during key-renegotiation; After over an hour of extensive testing, forcing key renegotiation every 60 seconds, I can state that the memory leak issue related to OpenVPN key renegotiation has been fixed. Thanks to the Mikrotik team and to Oskars who responded to ...

raphaps

I experience exactly same issue (OVPN server, CHR, 7.11.2, 2x3GHz CPU, 1 GB RAM). Each hour (default key renegotiation) I lose cca 50% of OVPN clients. Anyone tried 7.12rc1? They mention "*) ovpn - improved system stability;". These issues with openvpn are chronic in version 7. I have an ...

raphaps

You aren't running the test with one of the routers as the client or serving endpoint are you? Routers are not meant for that type of activity and will always perform less than amazing. You have to use non-router client/server at both ends to test this. I know it's not the best way to do the test, ...

raphaps

Thats fine, but the way we tested was the opposite end did an ookla speed test through my router and I did the reverse through the other router. Show results doing such real world tests and then I will beleive you. Trying to keep it real and not give false expectations. My equipment far site was is...

raphaps

I did a bandwidth test here now, RB4011 testing for another RB4011 via the Wireguard tunnel. Each location has a 500mbps connection.

raphaps

I suggest the RB4011 or RB5009, I believe you will be able to achieve these transfer rates.

raphaps

This configuration is theoretically simple to do, not much has changed from version 6 to 7. I have a similar configuration in my environment that works normally using version 7.11.2, the difference is that there are 3 links balancing the load on two networks /25. I suggest disabling the firewall rul...

raphaps

Still not working? If it still doesn't work, define just a single address for each marking routing and test again. Disable the address list 192.168.1.0/24. /ip firewall address-list add address=192.168.1.10 list=Net add address=192.168.1.12 list=Vivo In ip/route change the pppoe-Vivo gateway to the ...

raphaps

Is this your complete ip/route export? I'm not seeing the main table in your configuration. Another point, change this setting, leave the passthrough option as: /ip firewall mangle add action=mark-routing chain=prerouting dst-address=!192.168.1.1 new-routing-mark=vivo-out passthrough=no src-address-...

raphaps

Export your complete route table. The latency of the pings will be different because the main is going out through Vivo and the net-out through the Net.

raphaps

Add the "not" in dst-address to both rules, leaving it like this: /ip firewall mangle add action=mark-routing chain=prerouting dst-address=!192.168.1.1 new-routing-mark=net-out passthrough=no src-address-list=Net /ip firewall mangle add action=mark-routing chain=prerouting dst-address=!192...

raphaps

I analyzed your post better and I think I understood your problem better. In the rule: /ip firewall mangle add action=mark-routing chain=prerouting new-routing-mark=net-out passthrough=no src-address-list=Net Change it to: /ip firewall mangle add action=mark-routing chain=prerouting dst-address=!192...

raphaps

Set dns 8.8.8.8 on the dhcp-server where you only defined the router gateway. /ip dhcp-server network add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 netmask=24 You are only able to browse the Vivo link because you configured pppoe-client with yes in user-peer-dns. The Net link...

raphaps

Export your complete configuration so we can review it. Delete the serial number and access passwords.

raphaps

When you say there is no connection, are you referring to ISP1 being down or you unplugging the cable? For me, the operation in both version 6 and version 7 of RouterOS is the same; I tested it here and it appears to be the same. If your ISP1 is down in the sense of unplugging the cable from the int...

raphaps

If you are using RouterOS7, the target scope must be greater than the resolved route, so it would look like this: /ip/route add comment="Check WAN01" dst-address=1.1.1.1/32 gateway=192.168.1.1 scope=10 target-scope=10 add comment="Check WAN02" dst-address=9.9.9.9/32 gateway=192.1...

raphaps

Have you tried clearing your browser's cache or trying to access it from another browser?

raphaps

The OpenVPN client on MikroTik has the "reneg-sec" parameter disabled by default, meaning it is set to 0. I have noticed this in several tests I have been conducting recently because if "reneg-sec" is disabled on the server, it does not renegotiate the keys when the client is a M...

raphaps

Openvpn with about 150 connections running on TCP crashes after 40 minutes. It was working fine until 7.11beta2, after that it was just a problem.

raphaps

Hi! Something changed from beta firmware(s) (at least 7.11beta2) to RC in relation to OpenVPN - RC version has problems with more than 170 OVPN connections ... I reverted to 7.11beta2 and everything works great. Luka I had the same problem. The connections hang, the interface drops and the addresse...

raphaps

Openvpn is working again on version 7.11alpha126 provided by support. Android clients are now able to connect. Test performed on an RB4011.

raphaps

I also have a problem with openvpn, on an RB4011. Since version 7.8, the system is unstable and restarts before completing 15 minutes of uptime. I have around 150 ovpn connections. I updated to v7.10 and the same problem occurred, the last version that worked fine was v7.7.

raphaps

Yes, 7.7 is stable but with a memory leak. The big problem in version 7.7 is the memory leak, which runs out of memory until I restart the router, this happens to me on average every 10 days, so I restart before it happens.

raphaps

i have disabled it(dude RouterOS Connection)
but no idea why is this happening again and again

It's the OVPN, it's having problems in version 7.8, there are already several reports from users about it. It even happens to me and in a few minutes the router restarts. I had to go back to 7.7.

raphaps

Wireguard has been rock solid so far for me on Mikrotik - Would suggest to give it a try! That is often a useless suggestion. When people have setup a specific VPN server and have configured several clients to use it, they usually cannot simply switch to another one. There appears to be an issue in...

raphaps

The OVPN service is unstable, and it will cause a Kernel crashes after 2,3 hours of uptime.
SUP-96432

I'm having the same problem here, on an RB4011. After updating to 7.8, the system has a kernel error and restarts before completing 5 minutes of uptime. I have about 150 ovpn connections.

raphaps

What you are calling jumps is NESTED recursive vice just flat recursive. Not something to lose sleep over. Stick with what you are comfortable understanding. Your rules look fine, the TS of the further hop is greater by one of the TS of the resolved route, and the scope of the resolving route is eq...

raphaps

I am still a little confused about RouterOS v7 and have some doubts. In this case, I couldn't understand why virtual jumps are used in this configuration. I have a similar situation, which is two links, with WAN 01 as the primary and WAN 02 only functioning as a backup, and everything works fine. Bu...

Search found 48 matches