MikroTik

tneumann

if Mikrotik developers will implement different WPA2 keys for various users over radius protocol.

What would be the advantage of your implementation compared to EAP with certificates, which is a standards-based technology that already works on RouterOS today?

--Tom

tneumann

Not with PSK, but if you use EAP the keys will be generated and supplied automatically...

So you should use WPA2/EAP to solve this.

--Tom

tneumann

Just define an ip pool per bandwidth you want to offer and map each user an ip from the corresponding pool. Than you just need a PCQ queue for each pool. Sure, that works, but it's not what I was asking for. When I asked about Radius Framed-Route attribute based routes above I was specifically talk...

tneumann

Sounds quite useful, thanks for that new feature! Is it also possible to get networks that are specified as Radius Framed-Route reply attributes dynamically inserted into that same address list in addition to the PPP peer host address? That would make the feature useful for clients that get Radius-a...

tneumann

h
... connection time... date, login...logout.....username....ip adress .. mac address...login name... maybe "connected to"..

If you use radius for authentication you'll get all that info without any additional work anyway.

--Tom

tneumann

Ask your ISP to blackhole/discard the traffic on their side of the link. If you're running BGP with your ISP then maybe you can trigger the blackholing yourself via BGP. There are documented "best-practices" for this, see http://www.nanog.org/mtg-0410/soricelli.html . Maybe your ISP suppor...

tneumann

http://wiki.mikrotik.com/wiki/Transpare ... o_Networks

--Tom

tneumann

Did you take into account that OSPF does send
some packets to a Multicast destination address
in some situations? You'd need to allow these
packets to reach your router as well...

--Tom

tneumann

what is your setup or scenario, what are your requirements? Regards Faton i want to use it but i dont know how trottolino1970, I realize that you might indeed be looking for guidelines on how to solve your configuration problems, but you really are asking for help in the most uneffective way I can ...

tneumann

Like one in Texas and one in Arizona? Sure, go for it!

Seriously, please be more specific in describing your problem.

--Tom

tneumann

Ok, then you do not need WDS. Roaming will be possible. Configure all access points to use the same SSID and the same security-profile (i.e. WPA or WPA2 or WEP or Open or whatever you need). But the roaming will probably not be completely seamless as it takes some time for a client to (re-) associat...

tneumann

What kind of relation do you have with those other ISPs that you'd allow the user to choose from? And what kind of network interconnection does your hotspot have with those ISPs? For 4) and 5) to be at all possible you'd at least need a routed subnet from every ISP connected to your hotspot network....

tneumann

Do you have multiple ISPs routing addresses from their respective allocations to your hotspot router? That would be a very unusual setup, but how else would it be possible to allow the hotspot users to "switch ISPs" when they login? Anyway, usually inter-ISP hotspot roaming is not implemen...

tneumann

That does not answer any of my above questions.

--Tom

tneumann

It sounds like each of your AP will have a seperate LAN connection (wired ethernet)? I'm asking because you mentioned 'bridged ethernet and wireless'. If this is the case then you will not need WDS at all. It would only be useful if you have some APs that do not have their own wired uplink but inste...

tneumann

You should not run hotspot and uplink on the same interface (ether1 in your case).

Furthermore, what are you trying to do with those 1.1.1.x and 10.5.50.x address ranges while at the same time you answered during the setup that you do not want to masquerade?

--Tom

tneumann

Did you try a security profile with WPA2-EAP and EAP passthrough on your MikroTik access point? In EAP passthrough mode all certificate verfication and PEAP handling are done between the client and the RADIUS server only, so this should work just fine provided that you have the needed Microsoft mojo...

tneumann

In a correctly configured EAP setup the radius server will automatically provide per-client keys.

--Tom

tneumann

As a first step you should decide if you want (or need) both networks to operate as one broadcast domain (that is: bridged to each other) or as separate broadcast domains (then it will be routing between the networks). Your goals and requirements are not clear to me from what you wrote so far, so co...

tneumann

Is this the only reason that conn-trac would be used? Besides being able to actualy see whats happening on the network?

No, connection tracking is also needed for some functionality of the firewall (/ ip firewall filter)

--Tom

tneumann

Your masquerading / srcnat does not work because the rule ip firewall nat add chain=srcnat action=masquerade out-interface=Public specifies the wrong out-interface. You're running a pppoe-client on your public interface towards your ISP, therefore the interface that will carry your outgoing traffic ...

tneumann

That's what a VPN tunnel is for.

See the documentation

http://www.mikrotik.com/testdocs/ros/2.9/ip/ipsec.php

http://www.mikrotik.com/testdocs/ros/2. ... e/pptp.php

--Tom

tneumann

tneumann

if I use EAP with certificates, do I need buy certificates service from somewhere? You can, but you don't need to. You can just as well run your own PKI. There are lots of tutorials on the net on how to setup a basic PKI (CA) with OpenSSL and a bunch of shell scripts, such as http://www.sourcequenc...

tneumann

Yes, logically there'd need to be two AP, one for unsecured connections (offering registration only) and one WPA protected for full network access, but you can use the virtual-AP feature of RouterOS so that you do not need to buy and install two AP devices - both AP can run on the same radios. Regar...

tneumann

You could set up an open, unencrypted hotspot that allows only access to your user-registration page where you describe the services that you're offering to registered customers and allow potential customers to sign up for your services. Require them to identify themselves upon registration and to p...

tneumann

There is no backup file. Backup means the accounting records will
also be sent to an additional, second radius server (this is the "backup server").

--Tom

tneumann

Set the routing marks not only depending on the source-address but also on the destination-address, that is only set the subnet1 routing mark if the destination-address is not in subnet2 and set the subnet2 routing mark only if the destination-address is not in subnet1. Something like add chain=prer...

tneumann

nordex, we've been discussing this a few months ago, see http://forum.mikrotik.com/viewtopic.php?f=2&t=14686&hilit= Did you follow all the suggestion I made in that previous discussion? Especially the add chain=forward in-bridge=bridge1 out-bridge=bridge1 action=drop comment="" dis...

tneumann

Why do you specify 10.200.0.10 as the next hop? You're assigning 10.200.200.2 to the client (with the Framed-IP-Address attribute), so you have to use that client IP address as the next hop if you want to add a route towards that client. Try this: "22110";"Framed-Route";":=&...

tneumann

Yes, of course it's supported.

See the RouterOS manual at http://www.mikrotik.com/testdocs/ros/2. ... radius.php

For the correct format of the Framed-Route attribute see http://www.ietf.org/rfc/rfc2865.txt (Chapter 5.22)

--Tom

tneumann

The Framed-Route should use the Framed-IP-Address that is assigned to the client as the next hop.

--Tom

tneumann

The networks ares direct connected and others are with static routes.

A stub area can not announce routes from external (i.e. static, connected) networks
towards the OSPF backbone. You'd need either a normal, full-featured area or at
least a NSSA for that.

--Tom

tneumann

How does router B know the route to "Network"? Is it directly connected? Or a static route?

--Tom

tneumann

You can not achieve much of an effect with priorities for downstream traffic on your end of the link. Priority queueing of your downloads should be performed on the ISP's router at the other end of the link.

--Tom

tneumann

users internally can no longer get to the website by using the DNS name which points to the external IP. What would I need to change to resolve that?

Set up split dns on your nameservers.

--Tom

tneumann

Adam,

the MikroTik Wiki has some examples at

http://wiki.mikrotik.com/wiki/Wireless_Setups

some of these use WDS and you might be able to learn from them for your project.

--Tom

tneumann

Can I put the wlan1 (backhaul link) of the repeater into station-WDS, and expect it to connect to another RB532 back at the tower that is operating in bridge-ap mode for clients? Yes, but make sure that the RB532 ap-bridge back at the tower has also enabled WDS. Enabling WDS in addition to ap-bridg...

tneumann

Adam, do not put a wireless interface that is in station mode into a bridge. Wireless interfaces that operate in station mode can not support transparent bridging (if you need to know why this is the case, please read the IEEE 802.11 standard chapters 7.1.3.1.5 and 7.2.2-Table 4). Every interface th...

tneumann

Yes. They are at completely different protocol layers. EoIP does not exists on a wireless interface as such. It is a tunnel protocol that operates between two IP endpoints, and as such is not bound to a wireless interface but can of course operate on top of IP packets that are transmitted over wirel...

tneumann

No, it will not. And why should it? Skynoc, did you try it for yourself? Try it and you'll see.

--Tom

tneumann

jurisv,

you do not login via PPP from some IP address (except for PPTP). Are you talking about PPTP or are you talking about PPPoE? For PPPoE your question does not make sense.

--Tom

tneumann

this is normal Mukah

No, this is not normal. A destination NAT rule does not change the source address of the IP packets, only the destination address. If everything is configured correctly then you should still see the external source address of outside clients on you internal servers.

--Tom

tneumann

sergejs already told you the most probable cause for your problem, but you did not comment on his suggestion. So did you take into account what he wrote? Did you check whether this does indeed affect you or not? Did you make sure that you have a transparent layer 2 connection between the PPPoE clien...

tneumann

A PPTP interface will not work as a member of a bridge. Only ethernet-like interfaces should be put in a bridge. You can establish a PPTP tunnel for authentication and encryption between two MikroTik devices just like you already did, but then you also need to configure an EoIP tunnel on top of the ...

tneumann

There are some hints on radius installation on the MikroTik Wiki site at http://wiki.mikrotik.com/wiki/Assorted_examples.

--Tom

tneumann

As you are using PPP already I think your best solution would be to install a radius server and let it do the accounting (maybe with Acct-Interim-Interval if you have long-running sessions and need up-to-date accounting values even during the lifetime of a users session).

--Tom

tneumann

Smops,

there's a problem with your mangle rules. All your mangle rules with action=mark-connection should have passthrough=yes

--Tom

tneumann

ravin,

the remaining time is calculated in the function time_left_for_user() that you can find in the file func.sql on the URL I posted previously. In the file radius.conf you can see how time_left_for_user() is used to map its result to a Radius Session-Timeout reply item.

--Tom

tneumann

Any problems with using the same ip address on a VLAN interface and on an ethernet interface at the same time?

This will not work. You should not configure the same IP address (or any overlapping networks, for that matter) on more than one interface.

--Tom

tneumann

Make sure you have a working WINS/NBNS server in place, then do something like this (adapt IP addresses to your network, of course) / ip dhcp-server option add name="nb-node-type-P" code=46 value="2" / ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 wins-s...

tneumann

See http://www.mikrotik.com/testdocs/ros/2.9/root/queue.php

Simple queues have a time parameter that will help you with what you want to do.

--Tom

tneumann

yes routing would sent 10.0.0.0/16 traffic to the default route over pppoe but why doesn't the firewall filter rule then pick them up and redirect them to wlan1? Because redirecting something is not the srcnat's job at all. The out-interface parameter in the srcnat rule is not an action parameter; ...

tneumann

Well, with this routing table it's clear that packets with destination 10.0.0.33 choose the default route and get sent out on the pppoe interface. It appears that you need to change your routing, and only after that works the way you need it to you then can take care of srcnat...

--Tom

tneumann

... the rules above should surely have the effect of giving every packet with a 10.0.0.0/16 destination address a source address of 10.0.3.2 (wlan1) True, if and only if the packet were to go out on interface wlan1 in the first place! ... and routing it via wlan1 That, on the other hand, need not b...

tneumann

srcnat does not influence the route/next-hop/outgoing-interface that is used to forward a packet. It's the other way around, i.e. if the routing code decides that a packet will be send out on interface ppoe-out1 then a particular srcnat rule might be selected for this (because it has a matching out-...

tneumann

RouterOS 2.9 supports one CPU only, regardless how many CPU cores your hardware has installed.

--Tom

tneumann

Yes, I mean packet duplication based on the nature of a bridge.

Do you have that much broadcast traffic on your network? After all, non-broadcast traffic should not be 'duplicated' but just send out on the (bridge member) interface on which the destination MAC can be reached...

--Tom

tneumann

Sounds like plain policy routing - it does not matter if the route to the destination is learned via BGP or not... so just configure policy routing and force it to use a certain next-hop. If that next hop is a BGP peer or would be irrelevant from what I understand.

--Tom

tneumann

NBMA and ptmp are more preferred in wireless networks.

Why?

--Tom

tneumann

BGP does not by itself have anything to do with mangeling. From my understanding I thought that you are already using mangeling for traffic shaping and now you want to additionaly implement BGP and use the traffic control features that BGP offers - which, as I already wrote - do not have any relatio...

tneumann

I have 5 BGP peers and use mangle to take a control to upstream traffic (balancing 3 international providers), how can I do that with BGP ? Traffic management with BGP is not an exact science. Because of the dynamic nature of the worldwide BGP routing table it's more of a moving target and an ongoi...

tneumann

Hi, can I put more than one dst-address into a single mangle rule ?

Yes, but not directly. Use an address-list. Define the list under /ip firewall address-list and then use that list in the mangle rule (use dst-address-list in the mangle rule instead of dst-address).

--Tom

tneumann

Do I need 2 wlan cards in each router to do this or can I bridge them using one per. Two WLAN cards (one for backbone (AP-to-AP) and the other for clients) is the cleanest solution and offers the best performance, but it is also possible to run inter-AP-WDS and clients on the same radio; but keep i...

tneumann

What is the difference between Static and Dynamic WDS? Dynamic WDS is mostly useful when you have a changing (dynamic) number of WDS peers, such as in a growing/changing mesh network. In your situation I'd suggest static WDS. Do the bridge interface names need to be the same on both units? No, does...

tneumann

Configure both units to communicate with each other via WDS, create bridges on both units and add the WDS interfaces to the bridges. Run the hotspot on the bridge interface of the first unit.

--Tom

tneumann

Well, initially you said that the MT is configured as a bridge, now you say it is configured as a router... As already written in the other thread discussing the same thing: A router is not transparent to MAC addresses. If you absolutely must see the clients MAC addresses at the billing server then ...

tneumann

Aren't you discussing the same setup in http://forum.mikrotik.com//viewtopic.php?t=15026 ? Anyway, as long as your MT device is routing and not bridging the billing server will always only see the MAC address of the MT device, never of any clients on the other side of the MT device. This is a fundam...

tneumann

Now you're confusing me. At the start of this discussion (your first posting) you stated that the station's MAC address is seen, now you're telling us it's the MAC address of the MT router... so which one is it?

--Tom

tneumann

I tried dstnat with action netmap and it seems to work.

Yep, thought so. Good job! Maybe you can document your solution in the Wiki once you're completely sure that it works as intended.

--Tom

tneumann

Does the switch to which you've plugged all three ethernet ports at least support VLANs and did you create separate VLANs / port groups for the three network segments, or is the switch one 'flat' layer 2 device and all three network segments end up being connected to each other? If the latter is the...

tneumann

RouterOS 3.0-beta is the first version to have that feature, 2.9 and earlier don't.

--Tom

tneumann

Is your 'transparent proxy' setup working at all with this configuration and just the blocking of '*.zip' and '*.exe' does not work or does the transparent proxy not work at all?

--Tom

tneumann

I don't think it can be done on the router itself, but a possible solution would be to setup an Apache webserver from where you'd reverse-proxy relevant parts of the URL-space to graph display pages on the router. For this it is especially convenient that the queue name is part of the URL, which is ...

tneumann

Well, it worked fine for me (I did test it before I posted my reply). Can you post an export of the relevant parts of your configuration?

--Tom

tneumann

My post was not asking for a solution, just asking if there is something similar possible, maybe with some other router, or, at least, in theory. Conceptually this can be solved with address translation of both networks in both directions. To recite your example with networks A and B both using 10....

tneumann

/ ip proxy access add path="*.zip" action=deny
/ ip proxy access add path="*.exe" action=deny

--Tom

tneumann

The only thing that comes close to what you describe would be bridging. Whether this would fit your needs and would even be possible with your ISP connection depends on a lot of details that you unfortunately did not provide...

--Tom

tneumann

Both sides of the connection (AP and station) must support WDS and must be configured to use it. If your Senao station does not support WDS then you will not be able to achieve transparent bridging and would need to replace that station with other, more capable hardware.

--Tom

tneumann

fpascual,

you defined the 'knocking' to port 2031 with UDP, but telnet uses TCP, hence you can not use a telnet to port 2031 to do the knocking...

You'd need a special tool that sends a UDP packet to port 2031, or change the knocking rule to use TCP, then you can use telnet just like you did.

--Tom

tneumann

Make sure you're using WDS on the link 'STATION ---> Access Point (MT RB)'

--Tom

tneumann

if he knows he wouldnt be here asking for a solution or an idea .. Well, yeah, for sure, but your comment did not help either. Ok, so the original question did not get any answers for several days by now. Can you think of reasons why this might be the case while at the same time several other discu...

tneumann

Well, I think there's no official name for that feature. Vendors call it whatever they want, I guess. For example, Allied-Telesyn calls it Protected Ports VLAN in the following document (chapter 27) http://www.alliedtelesyn.com/media/datasheets/s62-mi_ug_b_v140.pdf I've seen other names for the same...

tneumann

The VLAN solution that savage outlined will work just fine, although nowadays there are more elegant solutions available. You might want to get a switch that does support the private VLAN feature. Private VLANs are VLANs that block direct communication between all connected devices but allow all of ...

tneumann

1) Will i need any other server or router for PPPoE Server. 2) Will MikroTik will authenticate the users of i will need FreeRadius and MySql 3) Can i Limit Users for 64KUP 128K Down 4) Can i use Windows PPPoE Client or i will need some other Client 5) Can MikroTik work as a Web Proxy 1) No other de...

tneumann

I am NOT going to use any authentication method

I understand that you do not want your users to authenticate, but nevertheless you could still use a hotspot or not. So what will it be?

--Tom

tneumann

edspoon what do you mean by "make it see the marks on virtual AP's farther out" ? A routing-mark by itself is local to the router where it is defined and assigned. Unlike IP TOS bits or ethernet 802.1p priority information it is never written to a packet and thus can not travel from one ro...

tneumann

Do you plan to use the MikroTik router as a hotspot or not? (Hotspot will give you more options to implement your requirements, IMHO).

--Tom

tneumann

http://wiki.mikrotik.com/wiki/Transpare ... o_Networks

tneumann

Disable default-forwarding on the wireless interface. See the manual at

http://www.mikrotik.com/testdocs/ros/2. ... reless.php

on how to do this.

--Tom

tneumann

If you do not want to use any authentification, how do you plan to identify users and (after having identified them) determine to what group they belong?

--Tom

tneumann

netinstall (erasing current configuration), then import backup of current configuration and set admin password right after that and before logging out.

--Tom

tneumann

You might try to run tagged vlans over the WDS links and then add the vlan interfaces as bridge ports where appropriate...

--Tom

tneumann

Usually this is done with Radius-Peering and using a Radius server that can proxy/relay requests to the cooperating ISP's Radius depending on the chosen realm of the connecting user.

--Tom

tneumann

-Then through php I'll retrieve their mac address -through telnet I'll create mikrotik account This would be a lot cleaner and more reliable using radius (like I already suggested) with an underlying SQL database, then you'd need none of that ugly telnet and MAC-address-retrieval voodo. With radius...

tneumann

You need to use WDS between the AP and the stations and bridge the ethernet with the WDS interfaces.

--Tom

tneumann

Even if you find and install a switch that can set an individual MAC address for each VLAN, how would the MAC address of that switch port ever be communicated to the MikroTik router? All you will ever see on the MikroTik router is the MAC address of a client that is connected to that switch ports, b...

tneumann

192.168.2.0 is the network base address of 192.168.2.0/24 and therefore should not be the configured address of an interface.

--Tom

tneumann

Use radius and check for Calling-Station-Id attribute in access request.

--Tom

tneumann

The Mikrotik Discovery Protocol operates on layer 2 and is indenpendant from IP addresses. It appears that there are other Mikrotik devices (owned and operated by another ISP) in the same broadcast domain as your devices. If you're using a shared network that you and the other operators agreed on us...

tneumann

You are probably seeing MTU/MSS problems with your PPPoE users. Search for Path MTU Discovery (PMTUD) and MSS clamping.

--Tom

tneumann

http://www.mikrotik.com/testdocs/ros/2.9/ip/hotspot.php

tneumann

It appears that your hotspot's default gateway is on address 10.1.0.1, which is part of the hotspot network itself and thus connected to the interface that the hotspot is active on (bridge1). That is not a good design. You should have a separate client-facing interface on which you run the hotspot a...

tneumann · /ip route add dst-address=2.2.2.8/29 gateway=2.2.2.5

/ip route add dst-address=2.2.2.8/29 gateway=2.2.2.5

tneumann

Install a syslog server on your Linux machine and configure your routers to send remote logging to that server.

See the manual at http://www.mikrotik.com/testdocs/ros/2. ... ogging.php for details.

--Tom

tneumann

/routing ospf status lsa print external no such command or directory (status) I believe that command is for v3beta and not supported on RouterOS 2.9 I do want to filter external routes... in-between areas. Yeah, the routing information initially came from an external source, but the place where you...

tneumann

Why do you need dst-nat at all when you're already using a VPN tunnel (L2TP)? Can't you just access the SMTP server directly over the tunnel, without any NAT?

--Tom

tneumann

I've uploaded parts of the setup that I'm using with the Radiator radius server and a PostgreSQL database. See the following URL http://www.gosingen.net/mt/radius/ It's probably very specific to my local setup and mostly useless for everybody else given its lack of documentation, but anyway, maybe y...

tneumann

Richard, OK, I kind of missed that you were specifically talking about inter-area filtering (though you clearly said so, I should have read your post more carfully). What I wrote about routers not being allowed to suppress LSAs is true within one area, inter-area is a different thing and of course r...

tneumann

When I put in the filters, they seem to apply to what routes that particular router generates only. Correct, and that's exactly how it should be. Example, I have a MT as a ABR between to areas, I only want to propagate some routes between the borders. This can not be done with OSPF filters. An OSPF...

tneumann

Interesting the Linksys ones do this - I might investigate them further and see what kind of magic it is. Usually UDP broadcast forwarding, think DHCP relay with a different destination port (137 instead of 67). Anyway, I agree that a WINS server is a much cleaner solution. And while we are at it, ...

tneumann

But how should my topologie look like when using MT base CPE´s?
Set them up as ´bridge´ (bridge all interfaces) and have a hub/switch behind them to connect to different users of the HotSpot?

Yes, and you need to use station-wds on the CPE to get transparent bridging.

--Tom

tneumann

The client CPE´s are all SmartBridges, I can´t actually change their behaviour I think. Well, then you'll have no way to fix this. Get another brand of CPE, one that does support fully transparent bridging (which - in the context of 802.11 - means WDS) or ask SmartBridges if they can tell you how t...

tneumann

Synchronize your router to a NTP server.

--Tom

tneumann

I know this, read this and tried this. From the config export you posted in an earlier message I'd say that you did not, at least the config you posted does not include a non-backbone area. If you did in fact try a multi-area setup then could you please post that configuration export as well? --Tom

tneumann

magic, area ranges defined under /routing ospf area range are only relevant with inter-area routing; the range is used for summarization when routing information passes from one area into another, usually from non-backbone to backbone. OSPF also supports summarization of external routing information...

tneumann

magic,

from your configuration I see that you did not define an OSPF area for the PPPoE range - all you have is the backbone area.

You need to define an additional (non-backbone) area to be summarized and put your PPPoE addresses into that area.

--Tom

tneumann

larmaid, Your IP setup looks OK with the IP address on the bridge interface and no IP addresses on the ether interfaces, but please recall what I already wrote: ARP has no meaning on interfaces that do not have IP configured. That alone practically answers your question: As there are no IP addresses...

tneumann

can any intruder get in by making his parameter like this :

192.168.1.101 mac 11:11:11:11:11:11

On a hotspot? Or on a plain IP interface?

--Tom

tneumann

If you have ether1,ether2,ether3 joined into a bridge then you should assign the IP address to the bridge interface and not assign any IP addresses to any of the physical ports ether1,ether2,ether3. Because all ARP related settings are only relevant for interfaces that have an IP address assigned (w...

tneumann

http://forum.mikrotik.com/viewtopic.php?p=52849#52849

--Tom

tneumann

Art, Hotspot requires transparent layer 2 connectivity between the router and the client. You can terminate VPN tunnels into a hotspot, but for this to be useful you'd need to configure EoIP on top of the VPN, run the hotspot on a bridge interface and make the EoIP interfaces member ports of the bri...

tneumann

janisk, you're right. As I wrote in my first reply I find believewireless' question rather strange and fail to see the point behind what he's trying to do. Maybe he'll enlighten us.

--Tom

tneumann

MT1 still will be able to connect to MT3 because MT2 will anounce MT3 network to MT1 if you set redistribute connected In the sense they they will be able to pass traffic between each other, yes, sure (if that would be the issue then thats what firewall filters are for). But they will not form an O...

tneumann

if mt supports it you can set ospf cost or priority i don`t remember which one it is to 0

That does only prohibit an OSPF router from becoming DR for a broadcast domain.

--Tom

tneumann

You could install firewall filters in the input chain of router-1 and router-3 where the filters on router-1 would block traffic with a source IP of router-3 and protocol=ospf (Protocol 89) and the filters on router-3 would block packets with a source IP of router-1 and protocol=ospf. Whether it is ...

tneumann

Some config export would be helpful, so that we can see more about your OSPF areas and how interfaces are assigned to areas etc...

--Tom

tneumann

What do you mean by 'is for another interface'? Can you describe it in more detail and maybe post the relevant parts of your config?

--Tom

tneumann

As long as it is NetBIOS over IP (and not NetBEUI, which can't be routed) then it is just IP traffic like any other IP packets, so you do not need to do anything special with your VPN to make this work. If you're talking about what can be 'seen' in Windows Network Neighborhood then that's a differen...

tneumann

Your problem is that both the AP and the station are using 192.168.1.0/24 on their LAN interfaces. You need to use different, non-overlapping networks on the AP and the station(s) otherwise routing will not be possible.

--Tom

tneumann

If the wlan and the ethernet interfaces are correctly bridged they will transparently pass any traffic between each other, including NetBIOS. There are no special settings needed.

--Tom

tneumann

Groundhog Day, again?

http://forum.mikrotik.com/viewtopic.php?t=13646

--Tom

tneumann

The CPE automatically adapts to the frame size of the AP, you don't need to set it on the CPE.

--Tom

tneumann

Going back to your initial question where you talked about access-list and registation-table, it appears that you're trying to run PPPoE on wireless interfaces, right? Because the features you mention (access list, registration table) are only relevant for wireless. Well, the access-list is meant to...

tneumann

set ip arp to reply-only and register mac adresses you want to authenticate with your PPPoE service Setting ARP to 'reply-only' will probably not help in this case. The functionality of ARP is only relevant for the IP protocol (as is provides a mapping of MAC addresses to IP addresses) but the MAC ...

tneumann

When a user connects with PPPoE he can not use the hotspot and vice versa.

--Tom

tneumann

Mikrotik-Group is indeed the correct Radius reply item to send back to the router with the Access-Accept message. The value of Mikrotik-Group should be the name of the profile and a profile with that name needs to already exist under /ip hotspot user profile on the router. Check your user profiles ...

tneumann

ether 1 - with ip = 10.10.1.1/255.255.0.0 (local) (reply only) ether 2 - with ip = 10.10.2.1/255.255.0.0 (local) ether 3 - with ip = 10.10.3.1/255.255.0.0 (local) Address overlap... they're all 10.10/16 what i want to is all ether can connect each other without to creat a bridge.....!!!!! Well, if ...

tneumann

It wasn't clear from your first description that you're using WDS. Now what you said about the WDS setup of the 15 MikroTik routers that make up your campus wide network basically sounds OK (if they do WDS then indeed they need to 'see' each other, use the same channel etc.) But what about the Links...

tneumann

Are the indoor access-points connected to the outdoor MikroTik? If so, how are they connected and what's the network topology like? As for interference, it's a bad idea to run several access-points on the same frequency/channel if their RF signal coverage might overlap. You should specifically avoid...

tneumann

Does Mikrotik support PHP (hotspot).

On the router itself? No.

--Tom

tneumann

Here's what you could try to do 1) Set up two different hotspot user profiles (groups), see http://www.mikrotik.com/testdocs/ros/2.9/guide/aaa_hotspot.php?permalink=0.13474025974025974 and set the incoming-packet-mark differently for each profile, let's say you assign incoming-packet-mark hs_group_a...

tneumann

If you're seeing 46ms latency on a wired ethernet link (crossover cable) then either the CPU of your routers is maxed out or you are having serious problems on that ethernet link (bad cable, failed auto-negotiation, duplex mismatch etc.)

Latency should be much lower under normal conditions.

--Tom

tneumann

We use the same address range on different VLANs, because it is the most correct variant.

Yeah, right... Nevermind, I give up

--Tom

tneumann

Standard nstream is half-duplex. The main point of nstream2 compared to nstream is to make it possible to build full-duplex links...

--Tom

tneumann

Your network design is broken, as JJCinAZ already said. For example, in your network diagram addresses from the 192.168.3.0/24 network appear to be used on all three VLANs (Vlan1, Vlan2 and Vlan3). How is that supposed to work and what is the intention behind this? The same is true for 192.168.1.0/2...

tneumann

It's not about the VLAN Id. The problem is that you have a VLAN defined on physical interface ether1 and then you are throwing ether1 and that VLAN together into one bridge. It's not a good idea to bridge a VLAN with the physical interface that this VLAN itself is defined upon. Why would that ever b...

tneumann

It doesn't make sense to have vlan1 and the native interface bridged because vlan1 is the native/default vlan anyway.

Yeah, that's what I've been telling him about five posts ago...

--Tom

tneumann

It should work, but let's just hope that vlan1 is not defined on physical port ether1 itself, or is it?

--Tom

tneumann

If you can ping and traceroute but TCP sessions appear to hang, it could be MTU problems in combination with broken Path MTU Discovery.

--Tom

tneumann

any one know if a cisco 2900 which supports vlans, woudl be compatable with vlan tagging on MT 2.9.39? Depends on the model and the installed IOS version. Any version that supports dot1q will do, versions that only support ISL will not work. All currently not EOL'd Catalyst 2900 versions (such as 2...

tneumann

sisw, it is perfectly normal for a router to provide layer 3 connectivity between it's interfaces. That's what a router is for, after all, and that is what is happening between your VLAN interfaces. If you want to restrict the communication between certain interfaces you need to add firewall filter ...

tneumann

Is there anywhere I can learn more about mikrotik? I've looked over the manual many times but find it difficult to follow at times. The Wiki at http://wiki.mikrotik.com/wiki/Main_Page offers more information on some topics and is more tutorial-like than the manual, which is more of a reference than...

tneumann

Create a bridge and add the wlan and the ether ports to the bridge but do not configure any IP address on neither the wlan nor the ether interface. Configure the IP address on the bridge interface instead.

--Tom

tneumann

Yes, I have untagged frames on ether2. I would like to know why they're being picked up on vlan101 - shouldn't the vlan interfaces ignore all untagged?

Yes, they should not appear on the VLAN interface. Maybe you should have MT support look into this, could be a bug...

--Tom

tneumann

Cisco Catalyst 1900 ? Really? That's ancient! Where did you get that one from? Anyway, the Catalyst 1900 does not support 802.1q VLAN tagging/trunking, it only supports the older, Cisco proprietary ISL protocol, which is not compatible with other vendors, including MikroTik RouterOS. You will probab...

tneumann

So on each of these three bridges (one per campus?) you are bridging together one "VLAN for PPPoE" and one "VLAN for hotspot"? If so, I would recommend against this design because then you'll end up running a PPPoE server and a hotspot on a common interface (the bridge interface)...

tneumann

Create virtual access points (see the RouterOS manual) and run hotspot and PPPoE on different virtual access points (and thus on different interfaces).

--Tom

tneumann

EoIP tunnel is bridged with Eth1. When we try to give Eth1 an IP address in same segment we cannot ping it

When Eth1 is a member port of a bridge then do not assign an IP address to Eth1 directly. Assign the IP address to the bridge interface instead.

--Tom

tneumann

You need to send a Session-Timeout radius reply item from the radius server to the MikroTik router when the user connects. The Session-Timeout reply item holds the number of seconds that the session will be allowed to last in total; after that number of seconds the session will be disconnected by th...

tneumann

isn't adding 10 vlans into a bridge the same thing as not using vlans? Basically yes, but it gives you the ability to put layer 2 filters between the vlans. This is useful in situations where layer 2 connectivity is called for (such as for hotspot) but you would like to gain more control over the c...

tneumann

From the Mikrotik I can ping 224.0.0.5 and get a reply from the Cisco Router from the Cisco's interface IP. The Mikrotik does not reply. Pinging the multicast address is meaningless. Please post the output of /routing ospf export from the MikroTik router here, and -if possible- the complete running...

tneumann

IIf you have input rules in the firewall will this block the multicast traffic and Hello packets coming to the Mikrotik Yes, if the filter rules are not configured to allow for OSPF then it will be dropped. Routing protocol traffic does not automatically bypass firewall filters. Are you running rou...

tneumann

RouterOS itself does not support IPX routing. The only option you have is to create an EoIP tunnel on top of the VPN and then bridge the IPX packets over the EoIP tunnel.

--Tom

tneumann

For roaming without having to re-login it would be better if you implement multiple access points (as much as needed for good RF coverage of your area) but only one hotspot gateway (that all the AP connect to). Why do you feel the need to implement multiple hotspot gateways?

--Tom

tneumann

gpienaar, can you describe your network topology in more detail? You can not have a chain of non-backbone areas in OSPF. Every non-backbone area must be connected to the backbone. You can not have a non-backbone area behind another non-backbone area. You should not try to use virtual links to try to...

tneumann

You should define your VLAN interfaces on top of a physical ethernet port and not on top of the bridge interface, and then you need to add the VLAN interfaces as member ports to the bridge. Then run the hotspot on the bridge interface.

--Tom

tneumann

What IP address did you set as default gateway on the Windows PC when you did your ping tests?

--Tom

tneumann

No. Antenna diversity is currently not supported by RouterOS.

--Tom

tneumann

gpienaar, are you running routing-test or the legacy routing package? I do not want to create a OSPF on or inside a PPPOE link! Ok, so what do you want, then? Is your problem that a route to each PPPoE client is propagated through your entire network as soon as the new client connects? What do you e...

tneumann

i knew that if i received a low signal in mi 15 dbi omni and the AMP is connected to the omni , then this low signal will be amplified too with the amplifier , then it will make the signal clearer for the radio which is connected with the AMP , is that true ? Not, not clearer, just louder . Assume ...

tneumann

you could bridge the 10 vlans and setup the dhcp-server on the bridge interface. you'd need to add a drop all rule in bridge firewall forward chain. Yep, exactly. I'm running such a setup with a hotspot on the bridge interface and it works beautifully to prohibit direct client-to-client communicati...

tneumann

pavlik386, your test setup itself is based on an invalid network configuration. With these parameters ether1 192.168.101.12/24 ether2 192.168.102.12/24 ether3 192.168.103.12/24 ether4 192.168.104.12/24 ether5 192.168.105.12/24 Windows adapter list: Description . . . . . . . . . . . : NVIDIA nForce N...

tneumann

I think you are going the wrong way about this. The obvious idea of combining an amplifier with an omni antenna usually does not work very well. The reason is that tx-power and rx-resitivity are one thing (the amp does help with those, at least if all you do is look at the numbers) but the other, at...

tneumann

when we are connected from DSL Router, the connection is not stable.

What does that mean exactly? Can you describe your problems in more detail please?

--Tom

tneumann

The radius server is sitting on mikrotik1

Ok, so you're using the RouterOS integrated userman package as a radius server?

--Tom

tneumann

I'm missing the radius server in your network picture...

Where/how is it connected?

tneumann

So I guess I will need a new AP that supports the necessary, and works. What you need is a combination of client radio and access point that seamlessly works together to provide a transparent bridge between each of your end users and the PPPoE server. In the 802.11 world this requirement translates...

tneumann

I'm not asking about NAT on your MikroTik routers but if there are any other routers between your MikroTik routers (which are the radius clients) and the radius server, and if there is NAT on any of these other routers that may be between your routers and the radius server...

--Tom

tneumann

Will PPPoE work by assigning clients a public IP even though they are coming from the basestation which has a private IP. Sure, because PPPoE itself is a protocol that runs on layer 2 of the network. Most people (myself included) prefer to avoid any IP configuration at all on client-facing interfac...

tneumann

The clients are going through a hub, with then links up to a Saneo AP configured in bridge mode connecting to my AP. Really a Senao AP connecting to your AP (AP to AP - WDS?) or is this rather a Senao client radio? If the Senao radio is acting as a client to your AP (which I assume is the case) and...

tneumann

Is there NAT between your routers and the radius server?

tneumann

No, chain=output is for outgoing traffic originating from the MikroTik router itself, no coming from other devices behind the router that are sending outbound traffic through the router. You must use chain=forward for this.

Other than that your filter rule looks OK.

--Tom

tneumann

http://www.pcengines.ch/wbios111.zip

tneumann

Yeah, well, it's more like adding static entries to the cache. RouterOS does not implement enough of DNS to allow it to be an authorative server for a zone. It can only act as a (caching) resolver. But that's enough in my book, a router is a router and a DNS server is something else.

--Tom

tneumann

maybe the option is not working and it only left there for decoration to make sure that MT ROS is a rich feature RouterOS What option do you mean? The account-local-traffic option that plam40 was taking about? That pertains only to traffic that is originating from/destined to the router itself, see...

tneumann

Do you know any vendor of routers or routing-switches who do support such a config? No, not with VLAN (or Ethernet) interfaces for customer access. The problem is that VLAN and Ethernet interfaces are not Point-to-Point by nature, therefore they can not have "unnumbered" IP addressing, an...

tneumann

If you need to do accounting based on source and/or destination addresses your only choice is probably NetFlow. Radius accounting has no knowledge of where the traffic comes from or where it goes to.

--Tom

tneumann

What i would need is to have many VLAN Interfaces (one per subscriber), each of them having assigned the same IP on the Mikrotik side Not possible. Map IP Segment 192.168.1.0/24 in VLAN Interface cust0001 to official IP 89.111.123.4 Map IP Segment 192.168.1.0/24 in VLAN Interface cust0002 to offici...

tneumann

As you have given 32 for the netmask the limit will apply per each individual IP address. This is in the manual, by the way...

And you should use tcp-flags=syn with that rule, so that it only applies to TCP session setup.

--Tom

tneumann

/ip arp
print from=[find address=A.B.C.D]

tneumann

That is not the way BGP is supposed to work. You should always advertise your network to both peers (and learn routes from both), and if you want to prefer one peer over do other when both are online then you can play tricks with AS PATH length, local preference and MED. There is no active/standy co...

tneumann

When you have it switched off then clients can not use the router as a resolver at all; you need to configure your clients to use some other nameservers that are external to the router in this case. If you set it to on then clients may use the router as a resolver and it will forward the requests to...

tneumann

Link state protocols such as OSPF can only filter which routes are actually installed into a routers local routing table, but they are by definition not allowed to exclude selected LSAs from their advertisements, as this would break the link state calculation on other routers. Therefore filtering ro...

tneumann

Did you define the required static ARP entries after you've disabled dynamic ARP functionality?

--Tom

tneumann

What kind of VPN tunnel did you install between the end-router and the hotspot? You need to be aware that there needs to be transparent layer 2 connectivity between the client and the hotspot. In your situation that would only leave EoIP as the only possible VPN tunnel type, which would need RouterO...

tneumann

- Create vlan interfaces on ether1
- Create virtual access point interfaces
- Create a bridge for each pair of virtual-AP and VLAN interface that should go together
- Do NOT included the native ether1 interface in any bridge

--Tom

tneumann

so on the area border routers, i need to redistribute default route? You have to decide how much routing information needs to be visible inside the non-backbone areas for them to achieve optimal routing decisions. If they have only one gateway towards the backbone anyway, then yes, only injecting a...

tneumann

The only noteworthy thing I can see in that configuration is the fixed speed- and duplex setting of on of the ethernet interfaces, where auto-negotiation is turned off and it is nailed to 100-fdx. Maybe the Huawei modem also has auto-negotiation disabled with a fixed setting off 100-fdx. In that cas...

tneumann

We have a CISCO router connected its fastethernet to a SDH How is that supposed to work? SDH and ethernet are different interface types, you should not plug one into the other... Or maybe you did not give us the whole picture and there is "something" between the Cisco's fastethernet port ...

Search found 394 matches