MikroTik

llamajaja

The easy way to load balance on MT routers ( PCC ) is to take traffic coming from the LAN and send some to WAN1 and some to WAN2. If the throughput is somewhat equal then its a one to one type of setup. If WAN1 has closer to 2/3 than 2/4s of traffic then one could send traffic in one cycle to WAN1, ...

llamajaja

Sorry, none of MTs routers have the capacity to deal with the number of IPV6 numbers that one would get.
At least thats what a birdy told me, but I probably misinterpreted what I was being told.

llamajaja

Three things generally speaking. a. use the same format as Static IP, but dst-address-list=MyWAN (vice dst-address=) where as noted above one can use a dyndns URL as an address, could even be your IP cloud net.name. b. ensure your hairpin nat rule is in the proper format add chain=srcnat action=masq...

llamajaja

Concur with previous posters. If your android is connecting its using BTH not regular wireguard setting Which is only required if you dont have a public IP. For client devices allowed IPs, you need either, BOTH the subnet of wireguard and the subnet(s) you need to access { 192.168.100.0/24,192.168.1...

llamajaja

Thank you, yes the wording was misleading ( at least to my simple brain ) , you have clarified it.

llamajaja

Ketchup is for losers.................. If anything red goes on my food its hot sauce.
Sorry rextended, I assumed you were weened with vino, my bad.
Not maple syrup, but heck bacon goes with just about anything.

PS actually prefer estrella with my calamari.
MUM in Valencia please!!!

llamajaja

The "recursive routing" is just an incorrect shortcut for "recursive next-hop search"; the search processs has nothing to do with the actual packet flow. Okay then please explain how traffic from the user on the LAN when selecting www address, gets routed?? I am curious. :-) The...

llamajaja

If your router has a public IP ( or can port forward from ISP router to your router ) do not use BTH or any automated tricks. It seems to cause issues and you dont learn a damn thing about how to setup wireguard properly especially since its not that hard. post your router config please /export file...

llamajaja

hahahah, I thought the same thing when rowing yesterday 32 felt like 38 with humidity. Hard to grip the oar handles.
Drinking chilled vino over there or is that blasphemy? Sangria with ICE and some calamari .....

llamajaja

Best bet is to use net reinstall with a clean version of 7.1X of your choice. Following the bouncing bugs not sure what is the best version to use currently 7.13?

llamajaja

Fixed it for ya........

...not everything can (or should) be "solved" at network-level via mikrotik products... RoS from 750 to ccr2216 is still RoS.

llamajaja

Suffering from lack of knowledge anxiety, rextended, or simply puzzled beyond belief ;-P
Not very carbon friendly...

If work, why upgrade??????????????????
And, why upgrade without read changelogs??????????????????

llamajaja

Question>
(1) Why wAP 60 and wAP 60G AP?
Vice getting a wireless wire kit ??? ( assuming kit is a pre-configged wireless link with two wAP 60G AP devices ?? )

(2) Finally what ruled out the better WW Cube Pro
(longer ranges, more versatile and with 5ghz backup)

llamajaja

Sweet! Good proof of concept for any one here thinking of something similar. LIke the fact that the one at the 'house' is somewhat protected from the elements as well. Reminder to me that the beam is fairly focused near each device and thus clearance is not a big issue as opposed to halfway between ...

llamajaja

Yes, and if one thinks about a trunk port coming in with vlan20, it can be then untagged to a port and no definition required for the transfer of such traffic through the bridge.
What is being done is the reverse and thus your setup would seem to the correct one, not required to define.

llamajaja

Yup, no reason normally to have UPNP enabled............

llamajaja

Understood, however since the vlan didnt exist yet (from source), I thought it was necessary??
Perhaps I am wrong, as your logic is also valid, will ask a friend.......

llamajaja

The WWW is being constantly scanned by bots, so consider life is normal. Open ports attract more flies, one thing you can do is - ensure you have source address list for all those externally accessing your server a. users should either have fixed static WANIPs OR b. they should be able to use DYNDSN...

llamajaja

What you need to do is copy and paste information within the same VLAN, and do this behind a SWITCH with greater than 1gig ports. Other wise a. your limited to 1 gig ports to begin with and then the ROUTING capacity of the router ( whether its between internet and vlans or between vlans Why not load...

llamajaja

Cat is on the right track for sure ( except he mixes up the 175 with 170 on several lines of the config ) and agree stick to private IPs within the router, there are ways to ensure external access to your LAN etc, without such drastic ideas. That requirement is secondary and can be dealt with after ...

llamajaja

(1) One thing not showing on the APP config is persistent keep alive = 30s etc.. if you have such a setting. Router (3) Add the Wireguard to the LAN interface list. (4) DO NOT UNDERSTAND the purpose of this config line??? /ip dhcp-server network add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24 (5) ...

llamajaja

You are right, First I would burn the fritz box! Then i would need a real router.

llamajaja

Good day, As usual, I disagree, otherwise, the world would have frozen over, The discussion above I provided, expressed the viewpoint that we were talking about local LAN users entering the wireguard tunnel and heading outbound to a distant site for internet. In this case your comment does not apply...

llamajaja

You do not provide enough context. If you have wireguard traffic leaving the router it has nothing to with going out your WAN on ether1. In fact, in general, one has no need to specify the WAN interface because we use interface lists /interface list add name=LAN add name=WAN /interface list memberes...

llamajaja

The only reason to use port knocking is if there isnt any other viable alternatives, including spending $7US a month to setup a cloud CHR. The extreme case is living in the wrong country, where democratic values don't exist, and all forms of VPN are blocked by the STATE, why still living there for s...

llamajaja

Nothing better than the red army having a clear digital path to all the homes in Europe

The slow drip drip drip of digital intrusion and take over...........
https://www.nbcnews.com/news/world/aust ... rcna160813

llamajaja

Sure, just add the MT device to the FRITZ and have the fritz LAN be the WAN for the new MT device.

Then we can wireugard from mt to mt, I know that works LOL.
The only requirement on fritz is to be able to port forward WG listenting port to the new MT.

llamajaja

There is no security risk to expose ICMP as far as I am aware but it does impeded troubleshooting and some router functionality if needed.

llamajaja

A change of 3dbs is 1/2 the power. So 2 dbs is not trivial!!

llamajaja

A first poster process would have alleviated the need for that comment of yours stated how many 100s if not 1000s of times, and would prevent same in the future but status quo & lethargy must live on!! ....................

llamajaja

Maybe he has a large extended family

llamajaja

--> rextended è buono come il pane.
--> rextended non ha peli sulla lingua, dice quello che pensa.

I hope its not to hot where you are.
Take care.

.

llamajaja

One would think, but then again you are using logic and educational principles.

llamajaja

Originating Inbound traffic is normally blocked by firewall rules.
Originating Outbound traffic other than blocking standard RDP port, dont know. One could change the RDP port number on you and then not much you can do.

llamajaja

What is the throughput of the ISP(s)?
Is most of the traffic in the same vlan or is it mostly across vlans.
Is the majority of traffic from vlan to internet?

llamajaja

yup, if it works, and the rest of the users are happy, then its an exercise in config, that is not necessary at this point.
To be frank, until recently I would never assign subnets to ports or wifi ports, and would only use vlans.......so everyone learns at their own pace.

llamajaja

Good idea, you can use the dstnat rule work around, it works!

llamajaja

Every question so poorly worded constructed and presented, should be handled by Mikrotik as they do not want to support better forum handling of new posters. :-P For the OP. Please provide a diagram and export your config /export file=anynameyouwish ( minus router serial number, any public WANIP inf...

llamajaja

Thanks rodney, but its not your rule and its been stated on many threads. If you want plugNplay use TPLINK or DLINK or NETGEAR etc.
If one wants to learn RoS, the rule is a good starting place but one should learn what is going on with traffic flow to make sense of why the rule works.

llamajaja

Does your router have a public IP address??

llamajaja

Hmm I see you are allowing ISP DNS usage! /interface pppoe-client add add-default-route=yes allow=pap,chap,mschap2 disabled=no interface=\ ether1_WAN name=pppoe-1und1 use-peer-dns= yes user=\ Hxxxxxx/xxxxxxxx@online.de So try disabling all your current IP DNS settings and see if the performance impr...

llamajaja

Observations: (1) Dont see sfpplus1 identified on /interface bridge vlans...... (2) Simplify your interface list member, the bridge is not needed for starters. why do you have both LAN and VLAN. Then you duplicate everything on firewall address lists...........redundant and usually not required. Kee...

llamajaja

The point about fastrack is very important as you want to keep fastrack for the rest of your traffic. Since we have clearly identified a source address structure for this traffic we can really nail it down. Using rplants excellent work for maintaining fastrackk (for dynamic gateway changes as well) ...

llamajaja

I am not sure why rplant is suggesting routing rules because that assumes you are working with IP addresses only. This is only true for SOURCE but not for DESTINATION. The only requirement as you have stated is basically any IP address with dst port ABC needs to go through WAN2. Routing RULES do NOT...

llamajaja

So the single and only special requirement for your configuration is that ANY user (not single user, group of users or one subnet of users if have multiple subnets) with destination of port ABC, must use WAN2? I'm assuming WAN1 is primary and WAN2 is secondary (failover). What you haven stated is WH...

llamajaja

/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc.)

llamajaja

Okay, thats fine, just to be clear then that there is one single flat network coming from the watchguard. What is this subnet and what is its significant to the rest of the network? I am assuming none, and its simply acting as the WAN connection for all intensive purposes for the MT device. Also I a...

llamajaja

Observations: (1) I cannot make any headway into your setup of ports vlans and subnets. Thus cannot even fathom attempting Wireguard advice. Try to simplify if possible. One bridge! The only port NOT on bridge should be a.. WAN ports b. Management port (ether13) if the intention is to be able to loc...

llamajaja

Hah hah fair enough. I will keep trying. Especially because the interloper couldnt be further from the truth. I prefer to SIMPLIFY configs, not make them more complex and furthermore I do go off on non direct parts of the issue when the config is so badly botched it needs attention. It is also myopi...

llamajaja

Who uses SSH??? I mean SSH1 as that is what Open SSH was based on??

Perhaps Kev, you want this.........

https://www.ietf.org/archive/id/draft-m ... h3-00.html

llamajaja

The requirements need to be stated a bit more clearly............ Break it down, as you have, CRS326 PORTA needs to carry vlans XYZ trunked to Smart Device Y (model?) CRS326 PORTB needs to carry vlan W untagged to PC/printer (dumb device) For each smart device then break down its movement of traffic...

llamajaja

Well, the issue is you do not have direct contact with any of the end devices. The firewall router ( which I am assuming provides all the vlans ) sends the vlans to the CRS326 on the CRS326 trunk port sfp-sfplus1. Note I said trunk port because there is no reason on this earth for there to be untagg...

llamajaja

Okay after some more research. 1. The function of DNS (udp type traffic) to acquire www addressing, is SEPARATE and INDPENDENT from the TCP https traffic going to specific sites. The latter is dependent upon the routes available on the router and the former the DNS services setup on the router. 2. T...

llamajaja

The mangle rule indicated above needs only to be on the client side. If that rule doesnt work an alternative is
add action=change-mss chain=forward new-mss=1380 out-interface=wireguard1 protocol=tcp tcp-flags=syn tcp-mss=1381-65535

This rule has no effect on the rest of the routers performance

llamajaja

Hard to say, very odd config you have there.

Try this
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether1 vlan-ids=10
add bridge=BR1 tagged=ether1 vlan-ids=20
add bridge=BR1 tagged=ether1 vlan-ids=30
add bridge=BR1 tagged=ether1 vlan-ids=40
add bridge=BR1 tagged=ether1 vlan-ids=50

llamajaja

Can amnezia vpn be run on a server/pc behind the router ??

llamajaja

By not assuming your config is correct.
Please post /export file=anynameyouwish ( minus router serial number, any public WANIP info, keys etc.O)

llamajaja

The answer provided was incomplete and missed the mark. Note: Teh to-port entry, IS required, if the incoming port will be different from the port hitting the server (port translation by the router). There are two main categories to consider in DST NAT RULES a. Static IP ( your IP address is static/...

llamajaja

I dont comment unless I see the full config as items are related.

llamajaja

Sounds good............ let us know either way.

llamajaja

Disagree the results show that with firewall rules the device should easily reach 300Mpbs and possibly up to 400Mbps. However, I really like MKXs observation that upgrading from SIX is not optimal for throughput and that a clean netinstall for version 7 yields best results. Its almost a bug in a sen...

llamajaja

Without seeing MT NTP config and input chain firewall rules config, hard to make any assessment.

llamajaja

The quick and dirty method would be subnets out specific VPNs but failover is not in the cards. Also you failed to note if the VPNs were all from the same provider ??????, if so, talk about failover is moot. /ip routing tables add fib name=use-VPN-A add fib name=use-VPN-B add fib name=use-VPN-C add ...

llamajaja

Your requirements are poorly stated. You want all 2.5 gig ports but remember the 5009 is limited to routing realistically at around 3gigs. So if you had 8 ports all capable of 2.5 gigs, you wouldnt achieve WAN throughput greater than 3 gigs at any one time. If that is not a concern to you and simply...

llamajaja

I will have a look. Goal is to ensure road warriors or any user for that matter coming in via Wireguard and going out LOCAL 5009 internet gets stuffed through the pi hole DNS. (1) Add wireguard to LAN interface /interface list member add interface="Local Bridge" list=listBridge add interfa...

llamajaja

Sorry your requirements are not clear.
If you have 9 vlans that can reach each other in both directions and one vlan that cannot
YOU ONLY NEED TWO VLANS.

llamajaja

Dont see anything OBVIOUS yet........ some small items. (1) Modify From: /interface detect-internet set detect-interface-list=all internet-interface-list=WAN lan-interface-list=\ all wan-interface-list=WAN TO: /interface detect-internet set detect-interface-list= NONE can cause issues....... (2) Not...

llamajaja

Okay as I understand it you wish to force ALL USERS through vpn for internet Preferably PCC load balancing access so the load is shared equitably between users. OR Subnets X,Y to vpn1, AB, to vpn2, CD to vpn3 (assuming all from same vpn provider and thus failover means nothing. a. confirm all subnet...

llamajaja

Not sure what you are doing with PLEX and DNS, but suggest you disable the two IP DNS static rules you have made while making the changes recommended. They should NOT be required. /ip dns static add address=192.168.10.1 comment=defconf name=router.lan add address=192.168.10.3 regexp=".*plex\\.d...

llamajaja

(1) Which interface was identified here???? --> that now has the YOU HAVE AN ERROR indication LOL add bridge=bridge interface=ether1 add interface= *9 (2) Since spf+1 is the WAN port it needs to be removed from the bridge. I see that its disabled but dont keep garbage lying around get rid of it. (3)...

llamajaja

I dont know whether to be humbled or amused LOL.

If you are saying I have uncanny powers to spot useless posts, then I am humbled.
If you are saying, I have a unique propensity to dish out vacuous posts, then I am amused.

llamajaja

/export file=anynameyouwish (minus router serial number, any public WANIp info, keys, etc. )

llamajaja

cggx stop using logic LOL

llamajaja

Its not a matter of seeing what happens, its KNOWING what will happen. Use the force! This is the way!

llamajaja

Thank you for the kind appreciation you wish to express, I will take it directly from you (vice through a third party ).

llamajaja

Traffic going out VPS should not have anything to do with fastrack. Not part of the traffic flow that goes by fastrack that I am aware of but will look into it.. If it was a concern then simply put two rules before fastrack add chain=forward action=accept connection-state=established,related src-add...

llamajaja

Hello and welcome to the Mikrotik forum :D For all new users that uses RouterOS for the first time and have some questions regarding their config here is short tutorial on how to access RouterOS configuration using "WinBox" and how to export their configuration and posting it properly in ...

llamajaja

To answer the title, by creating an IP address for wireguard, it becomes a local interface and thus the router creates a route for that traffic. So you should not have to do any routing.. One reason to create route is if you have to reach remote subnets via wireguard, but not the case here ( allowed...

llamajaja

(1) It would seem you have a problem on your WAN interface: /ip dhcp-client # DHCP client can not run on slave or passthrough interface! add comment=defconf interface=ether1 add interface=sfp-sfpplus1 (2) wg settings seem fine..... (3) To allow traffic to router for config purposes ........ from wir...

llamajaja

What type of VPN are you using. Do you have a publicly reachable WAN ( wan1, or wan2, or both)?? What type of interface is RED taller, a port?? Is the VPN port simply identifying which users will be going out VPn\? WHat type of VPN is it, remote users coming to your router or using a third party vpn...

llamajaja

Okay to confirm, You have a mikrotik device, that you would like to act also as a router in terms of providing DHCP services etc.. You are simply terminating the WANIP connections at the two upstream ISP routers. These routers are providing the Mikrotik router a private IP address on their respectiv...

llamajaja

The traffic that will appear slower to the user on the router will be the traffic going out Wireguard.
Other traffic going out the local WAN should not be affected.

llamajaja

Believe this is a known issue with the BTH functionality being addressed for imminent 7.15 release. Imminent used loosely.

llamajaja

Need to post config properly

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys )

I can help if you wish to change to PCC, which is better load balancing,

llamajaja

Use wireguard, its better.

llamajaja

You are mistaken, the only traffic that is really slowed down by wireguard is wireguard traffic as the the CPU handles this functionality. The tunnels are supposed to maintain 'touch' at both ends, hence the keep alive function. This activity will not harm the ax3 or have any effects on other normal...

llamajaja

Larsa being right all the time? Probably because I have a big llama brain and he has a tiny mouse/bat brain.

Maybe I should stick to flatulence and biting........

llamajaja

Router C......... Same issues as Router A, need to be fixed....... 1. Changes for backup wireguard /interface wireguard add listen-port=52810 mtu=1420 name=WireGuard add listen-port=52910 mtu=1420 name=WG-C /interface list member add interface=ether1 list=WAN add interface=ether2 list=LAN add interf...

llamajaja

Router B - remember this is the backup wireguard in case B is down so B and C can still reach each other and so that the admin can reach both routers remotely. Besides all the fixes noted for Router A, they are all applicable here as well, 1. Add the extra wireguard items: /interface wireguard add l...

llamajaja

Latest email update Quote: " We do not man-in-the-middle encrypted protocols. (e.g. adding certificate to endpoints and terminating ssl/tls in firewalla and re-encrypt them). this behavior is not safe for our customers, and usually should be managed by IT/InfoSec. Firewalla can see (and control...

llamajaja

RouterA (1) Remove pre-shared keys from wireguard. I have not ever seen it used, so for this testing remove. Once we get a good working config, feel free to play with it at your leisure. (2) Remove ether1 from Bridge, WAN is not part of LAN bridge. (3) Modify as follows: /interface list member add c...

llamajaja

Larsa, how do know that firewalla doesnt use SSL/TSL in its DPI functionality??

llamajaja

Using masquerade, at least my understanding, does a better job of flushing old connections ?

llamajaja

Okay the assumptions will be as follows. 1. Router A is the server for handshake purposes...... Routers B and C will connect to Router A. 2. For redundancy, in case Router A is not available for whatever reason, will create secondary WG between Router B and C, with Router B being server for handshake.

llamajaja

Why do you have an IP pool for the bridge and NOT for vlan80>> Dont need one for the bridge If you want another subnet create a vlan....... Same issue with dhcp-server. Okay its clear you communicated about two vlans, but you failed to mention another subnet........!! /interface vlan add interface=b...

llamajaja

Since gateways are MT interfaces, one can always ping the vLAN gateway but one should not be able to ping other users or worse access them ( I mean across vlans ).

llamajaja

Wrong question Bartoz! Why does MT not a have a first post process, to ensure posters understand what should be provided and so helpers can quickly deal with issues efficiently.

llamajaja

1. Would recommend upgrade firmware to at least 7.12.2 later. 2. Modify this rule. From add action=accept chain=input comment="accept LAN traffic only" in-interface=bridge1 TO: add action=accept chain=input comment="accept LAN traffic only" in-interface -list=LAN 3. REMOVE this r...

llamajaja

Okay they are telling me they use their own software coupled with Zeek monitoring software, say they do not use any existing platform???
Their new 10gig box supposedly comes with 8gigs of memory and quad core cpu ???

llamajaja

Similar crapola then to NETGATE PFSense Plus ~ Cheaper device but they charge for cloud access.

llamajaja

How did you figure it out Mozerd?
So pfsense has layer 7 capabilities? If so how do they compare to MTs efforts with regex?
Im assuming that they are probably not all that different and if so, then pfsense DPI is also not viable???

llamajaja

If you elect to do queuing, then disable fastrack. That accept thing got by all of us, good catch!!!

llamajaja

-Train employees to think and ask questions if unsure before clicking on anything. ( on web or in emails #1 issue ) -Make sure device firmware is always up to date. -Use reasonable passwords for devices. ( add wo factor authentication for better protection ) -Always use antivirus. ++++++++++++++++++...

llamajaja

easy peasy...... just one long config line LOL vlan-ids=2,10,20,30,40,50,60..........................all of them You could break it up if you so desired........... add bridge=bridge tagged=ether1,wireless-link vlan-ids= (15 vlans ) add bridge=bridge tagged=ether1,wireless-link vlan-ids= ( next 15 vl...

llamajaja

True that, the website is updated regularly......Okay, given you have opted to create PDF in a cumbersome way

, seems like its what we will get so, better than not having it. Thanks.

llamajaja

# model = RBD52G-5HacD2HnD /interface bridge add admin-mac=********** auto-mac=no comment=defconf name=bridge vlan-filtering=no { change to yes as last config step } /interface list add comment=defconf name=WAN add comment=defconf name=LAN "**************" /interface vlan add interface=vl...

llamajaja

Post your current config please.

/export file=anynameyouwish ( minus router serial #, any public WANIP information, keys etc.. )

llamajaja

Updated Rarely is not acceptable.......... Updated version stored upon each firmware release is reasonable as part of your release process. Cant be too demanding, its a pdf.

llamajaja

Please provide the config, you have so far......

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.. )

llamajaja

Ah its a backup to the fibre link between building, Got it!! In this case, its simply acting as a wifi switch. Thus Take a look at this example............. Assume the management vlan is 99, and the other vlans are 2,10,20,30,40,50,60 VLAN 99 subnet is 192.168.99.0/24 NOTE the only difference I can ...

llamajaja

Post again after applying the new knowledge MKX referenced, and we will have another look!

llamajaja

(1) recommend change this rule: from: add action=drop chain=forward comment=\ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ connection-state=new in-interface-list=WAN TO: add action=accept chain=forward comment="internet traffic" in-interface-list=LAN o...

llamajaja

It depends, Are you replacing the CISCO router, or simply providing a second WAN into the CISCO router. If its the latter, the MT devices are nothing more than probably moving the public IP along or simply terminating the WAN connection, and simply providing a private WANIP to the Cisco. In other wo...

llamajaja

It should updated after every firmware release. This assumes that the changes incorporated have at that point been properly updated/documented in the official docs.

llamajaja

Winbox, IMHO is the secret sauce, allowing non CLI trained folks to access and modify their configs and view all kinds of information. I had no RoS or CLI or networking training but do use Terminal from time to time as required and basic scripting as well. So CLI is just a fingertip away in winbox. ...

llamajaja

Without diagram all is a bit weird.
Is this acting as a router as well and if so where is the WAN information
( which port, static IP or dynamic IP, from ISP or private IP from ISP router/modem

llamajaja

Just saying,sweet to be able to have multiple winbox windows open, viewing rules being tripped, logs filling, sniffing ongoing, connections tracking shown etc.........

llamajaja

No one has proven to me its not a BTH bug. Why else would the router attempt to initiate traffic (not properly respond to incoming traffic, thus bypassing mangles ) from the Peer (Server for handshake )? The only two things I can think of are. A. BTH traffic in the background. b. Normal conversation...

llamajaja

Correct, The subnets cannot be duplicated for two different peers.
If unable to change one of them then use a second wireguard interface.

llamajaja

nm duplicate....................

llamajaja

Not enough info.

llamajaja

My questions have to do with the bloat created by BTH. Clearly it works also if one has at least one publicly accessible WANIP. People are using it and ending up with Peer (Server for handshake) allowed IPs that contain 'extra' information such as endpoint address and endpoint port etc....... Create...

llamajaja

Why not have all three WANs share PCC as well?
What are the down/up throughputs of each WAN??

llamajaja

Probably we are not handling the pppoe properly in some way not sure if the issue is ppp profile or pppoe server........

llamajaja

Nope the handshake is initiated on Router B and lands at the WAN on Router A, and thus why A needs the input chain rule only.

llamajaja

you are missing a manual route for WAN1 as you opted to use default route on WAN2 only??? ( but not visible ip dhcp client for wan1 ) /interface list member add interface=ether2 list=WAN add interface=ether1 list=WAN add interface=ether3 list=LAN add interface=<pppoe-1111> list=ppp add interface=ser...

llamajaja

Of course it should, you programmed the router to do so. Geez, there is no accountability in todays youth ;-) ( for marking connections more accurate to use input chain for rules to router and forward chain through router ) 1. Set this to NONE is the general recommendation from users and MT...... /i...

llamajaja

Post both configs............... I will set you up so it works without capsman......

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc. )

llamajaja

Sorry, I changed all your wireguard1 entries, on Router B, to wireguardB. Call me anal, but when looking at a config I want to know intuitively which of two or three or more configs I am looking at. Using the same name on both RouterA and RouterB is not clear to me and thus prefer to distinguish. Pe...

llamajaja

Yes if you can explain your requirements more clearly......... dont mix up config speak with requirements. a. identify all user(s)/device(s) and groups of users/devices, including admin b. identify the traffic they need to accomplish Provide a network diagram showing the ISP connections, subnets, po...

llamajaja

One option is to procure a cloud server, can get them cheap in the USE like $6 A MONTh. Then route all users at work with need to access library through a wireguard tunnel to the CHR and out the internet that way ( KNOWN FIXED PUBLIC ip ) You will need to mangle LAN traffic destined for medical serv...

llamajaja

Just for your edification. General rules of thumb. 1. To firewall a single address use: src-address or dst-address 2. To firewall a single subnet use: src-address=subnet or dst-address=subnet ( where subnet example looks like 192.168.88.0/24 ) 3. For two or more subnets use: INTERFACE LISTS. Excepti...

llamajaja

Concur tangent, I could post a working config for either option in minutes, except he is using capsman which I dont touch with a 10 foot pole. One of these years will have to bite the bullet.

llamajaja

Router B. Missing two things: /interface wireguard peers add allowed-address= 192.168.202.0/24 ,192.168.201.0/24 endpoint-address=123.456.789.1 endpoint-port=23231 interface=wireguard1 public-key="***********************************************=" persistent-keep-alive=35 have to move on, b...

llamajaja

Router A: Modify Allowed IPs so looks like: /interface wireguard peers add allowed-address= 192.168.202.2/32 ,192.168.88.0/24 interface=wireguard1 public-key="**********************=" [/b] / /ip dns set allow-remote-requests=yes servers=1.1.1.2,1.1.1.1,1.0.0.2,8.8.8.8 /ip firewall filter a...

llamajaja

Not really only to say the problem is likely on the remote device. Either the public Key is wrong from the MT device, or some other setting...... Of course the public key of the remote device may be incorrectly input to the allowed IP peer setttings on the mT as well. The fact that device 1 works gr...

llamajaja

Sorry not familiar with capsman, and not sure why needed with single device??
otherwise its too easy to setup a vlan ( transparent ) for the current LAN and a new one for guests, attached to the WLAN.......

llamajaja

Vlans are cheap use them.

llamajaja

/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc)

llamajaja

#1 Issue on these sorts of problems......... Ensure you have the right public key on the android from the MT. Ensure on the MT you have the right public key from the android #2 issue - Rest of Allowed Ips configured right at both ends. +++++++++++++++++++++++++++++++++++++++++++ Disable other peers ...

llamajaja

I dont care about wanting to use an alias address because that is not clarifying or providing any logic or reasoning. Its some unknown functionality without a purpose. Please state what associated users you have and what traffic flows they require..... then we will be able to make sense of what you ...

llamajaja

He forget the endy bit....... I have completed this work: over 2OO internal and external AP-ACs all wired in fiber optics 9/125. 3x vlan: wifi guest(VLAN100), wifi management(VLAN200), wired voip(VLAN50). CCR1016, CRS318, RBD22UGS-5HPacD2HnD, RBwsAP-5Hac2nD, RBcAPGi-5acD2nD, SFP+ and my hair turned ...

llamajaja

Can you draw a network diagram detailing from where internet starts ( isp and device(s) ) to the WAPs etc......... ports and vlans included........

llamajaja

Now with that knowledge can you frame your question so that it makes sense.....................

llamajaja

For port forwarding, you need a generic allow port forwarding rule in the forward chain. add chain=forward action=accept comment="port forwarding" connection-nat-state=dstnat Then you need a specific DST NAT rule, detailing the port, the server etc...... For a dynamic public IP the standar...

llamajaja

/export file=anynameyouwish ( minus router serial number, any public WANIP information,keys )

llamajaja

would need to see the complete config
/export file=anynameyouwish ( minus router serial#, any public WANIP information, keys etx.)

llamajaja

/export file=anynameyouwish ( minus router serial number, any public WANIP information,keys etc.)

llamajaja

Just to be clear is HW offloading possible on some routers regarding its chip, completetely different from L3HW offloading discussed for switches? I am trying to make sense of test results. For routers, I look at the table with or without filter rules and assume the speeds reflect the best possible ...

llamajaja

1. I am not big fan of the documentation myself. I rely on other sources which I referenced and common sense. 2. You have to clearly decide if the PFSENSE is going to the router with DHCP firewall rules, etc or Just termination point for WAN, no rules and forward WAN vlan to Switch GR and have Switc...

llamajaja

Yup its up a level from my knowledge hoping MKX will find this thread and comment!!

llamajaja

Not a problem and makes sense. I would also setup an IP-IP backup tunnel based on Ipsec secret as a backup to wiregurd. This has nothing to with your attempt to assign wireguard to ports vice users/devices etc... What you are talking now is simply to access remote routers for config purposes. If you...

llamajaja

As noted vlans block at layer2, firewall rules block at layer3.
To block WiTHIN layer2, the same guestnetwork, has been accomplished by access list (mac) address within the wifi settings.

https://help.mikrotik.com/docs/display/ ... AccessList

llamajaja

Since you have one bridge and subnet assigned to bridge on all devices, each device has a flat subnet associated. In other words, all users are on the same LAN and same subnet and yes all ports are part of bridge. You need to decide WHICH users require access to wireguard. a. by firewall address lis...

llamajaja

What I will say is, that you do not state requirements in terms of ports etc... Describe requirements in terms of a. identify users/devices, groups of users/devices and b. identify what traffic they need to accomplish. So ports are NOT users or devices!! Should explain the need for wireguard to user...

llamajaja

I dont see an issue with the rule myself? I think the extras showing are simply the defaults and not stuff he is added,,,,,,,, but not sure. However, you have a mixed bag of crap, Unsafe winbox access, two different access to openvpn?? and SSH which is not the most secure access. Simply and get bett...

llamajaja

Your explanation is not complete or maybe just lacks some clarity. Are you saying that a. Users at Device B, via wireguard, successfully access the Iris Server on the LAN at Device A? Note: Assuming the users simply put in their APP or browser 192.168.0.1 : 81 and the connection works great. b. You ...

llamajaja

Wrong approach.
One should not open up winbox to the www.
Instead VPN to he router and then access the config via winbox. Wireguard is a decent option.

llamajaja

Normis, on a side note, does RoS use the input chain default rule dst-address=127.0.0.1 for anything other than internal capsman use?????

llamajaja

Routing expectations from a routing device are reasonable.
Switching expectations from a switching device are reasonable
Expecting a coffee bean grinder to make a smoothie not so much.

To echo the point, its 2024 and we still have wars and famine............

llamajaja

hapac3 ( and technically the CRS3 switch is pretty much identical in approach setup minus wifi. ) 1. Remove frame types.........here /interface bridge add frame-types=admit-only-vlan-tagged name=BRIDGE vlan-filtering=yes 2. Need only to define one VLAN, and this is where the HAP gets its own IP addr...

llamajaja

keep your 5,6 as is, I had forg0tten about two chips, so two bridges should work.

llamajaja

Use code quotes to shorten up the view on the config. ( black square with white brackets inside ) 1) ONE BRIDGE -- ah okay using fact it has two chips.......... 2) USE THIS REF: https://forum.mikrotik.com/viewtopic.php?t=143620 3) Dont see any wireguard settings?? 4. All one needs to on bridge itsel...

llamajaja

Attention to detail my friend! SPINE 1. You need to add ether 2,3,4 to the bridge ports! ( assuming they are part of your LAN as you have no other ports or addressess delineated ) 2. If the Spine is behind another router fine, if not, pull the ethernet cable from the modem , as you have no firewall ...

llamajaja

You did NOT find that device under MT--> products --> Routers. Hence, its a switch and should be used as a switch. What you want is an RB5009 as the router and then a switch. Not sure what you are looking for in a switch though, here are two potential options. 24gig ports, 2xsfp+ ports - ->CRS326-24...

llamajaja

The 310 is a switch and yet your requirement is clearly routing..................... Why the purchase of the 310?? With any kind of firewall rules applied your throughput is going to max out at 200Mbps or less! Assuming by the way, this device is getting a public IP from a fiber modem/ont ( and not ...

llamajaja

Reputable brand? Nothing wrong with Mikrotik Routers, the RB5009 is an excellent router for your situation.
If you meant a router, vice a switch, that is not brand, that is form following function, procure and use a product for what it was intended to do!

llamajaja

Why each MT devices doesn't come with a magnifying glass is beyond me.

llamajaja

Suggest you approach this in a logical manner instead of playing footsie with switch settings or bridge talk all without any real focus.. a. identify all the devices/users including the admin b. identify all the traffic flows they actually require 9 (no mention of config etc.) c. provide a network d...

llamajaja

Sure thing. Please use this virtual eraser to remove your mangles, this virtual pen to rewrite proper mangles, and these virtual scales, to help load balance your PCC.

llamajaja

Correct, since maybe 7.12??? not sure when but there is no longer a need to do this on the client (for handshake) peer to re-establish connectivity with the Server ( for handshake ) peer.

llamajaja

Mozerd, how easy is it to integrate PRO WG MGMT with MT devices?? Does it run on windows PC?

llamajaja

You all be missing the point..................... Zerotier, besides the limitation to ARM devices, is forcing the OP to be dependent upon THIRD PARTY. Wireguard is direct and thus more secure and independent --> and ZT may conflict with Company Policy..... I mean its unlikely that cloudflare is goin...

llamajaja

Suggest that the Mikrotik document be clearer in this regard, it is actually could be construed as somewhat misleading.............
....

current.jpg

....

Suggestion:
....

recommend.jpg

llamajaja

Are ISP1 and ISP2, fixed static public IPs, or dynamic WANIPs............

llamajaja

Which router, and what is the current firmware version being used? Better to assign the port to the address you want and forget vlan2. The bridge will remain serving all ports BUT NOT ether2. Remove this route it serves no purpose as one is automatically created via the bridge associated IP address&...

llamajaja

Why would you even consider posting a peer config the UDM thought the peer should have MAKES ZERO LOGIC.

Need to see actual UDM config (server)
and actual peers (clients) of interest CONFIGS.

llamajaja

(1) Not sure why you are getting a weird outcome for ethernet7 add interface=*7 list=LAN ?? /ip firewall mangle add action=passthrough chain=forward comment="Forward wg traffic" disabled=\ yes dst-address=0.0.0.0 in-int erface=*7 (2) Dont get your rules the chains are mixed up and thus not...

llamajaja

(1) Dont understand your Server UDM settings. a. You should show all the peers on the UDM. b. Each peer client gets a separate line entry. c. Each peer client in allowed IPs should be show as the actual IP/32 of that client peer. d. The UDM does not require an endpoint in allowed IPs, IT IS the endp...

llamajaja

viewtopic.php?t=143620

llamajaja

https://www.wireguard.com/
https://www.wireguard.com/#cryptokey-routing
https://www.wireguard.com/papers/wireguard.pdf

llamajaja

Why bother, I have never had to prioritize traffic. Assuming your pipe is extremely small????

llamajaja

hapax3 is your best budget approach, RB5009 is overkill but allows much room for growth.

llamajaja

Yes I think so!

llamajaja

As to discriminating the NAT based on external port number, that would work, but my read of the OP's question is that he would not want to give out nonstandard port numbers to achieve this. Hogwash. Why would the OP not want to give out a port that works for a simple way to complete the requirement...

llamajaja

provide a link to the correct tenda manual (user guide) and I will look.

llamajaja

New install 7.8??? 7.11.2 would be a new install.......

llamajaja

viewtopic.php?t=182276

llamajaja

What I would do is slightly differen, proxy or reverse anything sounds to complex for me and I am a rower LOL. I would not let tangent lead you astray to some tangent solution jajajaja..., and would direct all your domain name centric users 9 sistema1 ) to port 11080. Thus no conflict on entering th...

llamajaja

USe recursive routing see para I1...... viewtopic.php?t=182373

llamajaja

After more thought, you may be able to accomplish the goal if you use two wireguard interfaces on the CHR, one for each Router. THat is because on one wireguard interface there can only be one peer with 0.0.0.0/0 and it has to be last in the order otherwise all traffic will go to this peer. SO, the ...

llamajaja

yup any dns rule in input chain should be dst-port and should stipulate in-interface--list=LAN

llamajaja

Caveat valid for only wireguard as this I know. Well, you need a reachable endpoint. It certainly can be a friends house with a public IP or chr in a cloud server situation etc. So yes two routers can be linked as clients to the same Server Router and both router can reach the internet at the cloud ...

llamajaja

Wow, I want that router maybe lays golden eggs too.

llamajaja

Holve your wasting valuable posting time here when you could be waxing eloquently in my thread about IGMP and ax3!

llamajaja

Assume pppoe is coming on vlan20 add vlan20-ISP as an interface, with parent interface=ether1 ( assuming ether1 is assigned to ISP cable connection ). In pppp settings ADD + pppoe client Here add pppoe to the interface vlan20-ISP and simply keep the defaut name think its pppoe-out1. Done. In the ppo...

llamajaja

Do you want the fortigate to get a public IP or double nat behind MT router?? Assuming you dont want the server to get a public IP either. It sounds like if this is the case then you need to decide how you want to divy up all the lan traffic towards three public IPS. a. subnets dedicated to specific...

llamajaja

Sorry for the late response, been busy with lot of stuffs. Now everything is working perfectly fine. I had to change the allowed address on VPN client from 0.0.0.0/0 to 192.168.88.254 to make internet traffic pass through the client's own network. Thanks a lot for your time and effort :) No worries...

llamajaja

No need for bridge related subnet it should do no dhcp servicing. vlan10 managment 10.0.20.0 vlan20 NAS 10.0.20.0 vlan30 untrusted ( guest wifi?) 10.0.30.0 vlan 5 home 192.168.0.0 How to setup up vlans ---> https://forum.mikrotik.com/viewtopic.php?t=143620 Since unifi by default expects management v...

llamajaja

Hi Moba, travelling in Europe so was easier to just start new name.

Search found 278 matches