MikroTik

SurferTim

As I recall (it has been a while), the dhcp server will hold that lease offer for 30 seconds. If the client does not respond, then the IP is released. You can check that here: /ip dhcp-server lease print detail It will show the status there also. I think it will say "offered" while waiting...

SurferTim

I need this on occasion. You must route the network IP/subnets back to each router on the downstream router. What are the IP/subnets assigned to each of these router interfaces? That would be the P1 and P2 on each router.
WAN <--> P1-R1-P2 <--> P1-R2-P2 <--> P1-R3-P2 <--> PC

SurferTim

First, you need to disable the hotspot NAT.

/ip hotspot
set 0 address-pool=none

Then when you use ip-binding, it will bypass everything. At least last time I checked.

SurferTim

Did you set your dhcp client to use peer dns?

/ip dhcp-client
set 0 use-peer-dns=yes

You might also try setting a static dns server in "/ip dhcp-server network".

SurferTim

Did you find a fix? Yes. I do this kind of routing all the time. You must explain your network configuration. Do you have an internet connection, or plan on having one someday? If so, specify which router it connects to. If you need a masquerade, you probably forgot the default route on the remote ...

SurferTim

Add an in-interface parameter to the dstnat rule.

/ip firewall nat
add action=dst-nat chain=dstnat comment="Video" in-interface=ether1 dst-port=5445 protocol=tcp to-addresses=192.168.0.31

If ether1 is not the WAN interface, change that.

SurferTim

As I recall, the lease expires-after will not change until the client renews the lease. That will be at half the lease time. That will be a long time if the current lease is several thousand days. The alternative is to force the clients to renew the lease if you can access the client computers. With...

SurferTim

Yes.

/ip hotspot ip-binding
add address=192.168.0.0/24 type=bypassed

For Winbox, it is under "IP - Hotspot - IP Bindings"

SurferTim

You can do that with ip-binding.

/ip hotspot ip-binding
add address=192.168.0.2 type=bypassed

If 192.168.0.2 isn't the IP you want bypassed, change that.

You can also bypass by mac address if you prefer.

SurferTim

Is there going to be an internet connection on this setup at some time? If so, which router will have the internet connection?

SurferTim

/ip hotspot user profile
set 0 session-timeout=0
or
set 0 session-timeout=1d

Setting session-timeout=0 disables the session timeout (no timeout).

SurferTim

I had problems with that, but I haven't seen it lately since upgrading the RouterOS. The problem was the dhcp server was not updating the lease "expires-after" value when a lease was renewed. You might want to check that. /ip dhcp-server lease print detail The sum of the last-seen and expi...

SurferTim

Is the wireless set up with a hotspot? Does the wireless client bypass the proxy?

SurferTim

You should add a dst-port to those rules, or it will redirect all port requests to the first rule. /ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.10.10.2 to-ports=28000 protocol=tcp dst-port=28000 in-interface=ether1 /ip firewall nat add chain=dstnat action=dst-nat to-addresses=10....

SurferTim

I have also small other problem. I have forwarded port 443 from WAN to LAN (192.168.22.88) and this connection works properly from outside ;-) One important inconvenience is when I will browse other https page file (port 443) from LAN I allways go to this forwarded addres 192.168.22. Then you need ...

SurferTim

Then you should either:
1) use the localnet private ip of the email server on your localnet computers rather than domain name.
or
2) use the router localnet gateway for your dns and set a static dns for the server in the router.
or
3) use a hairpin nat.

SurferTim

What does this mean? The problem is when I tried to send email being connected to my LAN. Send email with what program? To where? There are two ways email servers "send and receive" email. 1) Email client (Outlook and Thunderbird) to and from the email server (Sendmail or Postfix). 2) Emai...

SurferTim

Then adding the "in-interface=ether1" to the nat rule should allow your email server to send mail to another email server without being redirected back to your email server. Have you tried it?

SurferTim

If you are having trouble with outgoing mail from your email server, then it is probably due to the dstnat rule for port 25. It may be redirecting your outgoing packets back to your server. You must add an in-interface (or dst-address) to that rule to prevent that. /ip firewall nat add chain=dstnat ...

SurferTim

Please help to configure NAT Rule to run my outcomming messages. I don't have any problems with my incoming messages ;-) Outgoing and incoming messages from where? If you mean another email server is having trouble delivering email to your server, you must use port 25 for that. Port 465 is how emai...

SurferTim

I try to manually add the options without success. What did you try? Did you try to enter the settings in "/ip dhcp option" and it reported an entry or value error? Did it accept your entry and doesn't send it to the DHCP client? Have you enabled verbose logging for the dhcp service? /syt...

SurferTim

Just to be more specific, the device that goes trough without login is tablet that does not have 3G connection. Is that normal? Thank's Well, that depends. On your "/ip hotspot profile" settings, what do you have in "login-by"? If you have cookie, it may be logging in without an...

SurferTim

My iPhone works like it should with a hotspot, but my Blackberry seemed to bypass the hotspot login. After testing, I found it was not bypassing the hotspot security, but if it couldn't connect through the wifi immediately, it would resort to using the 3G data connection from my cellphone provider. ...

SurferTim

Hi guys,

Is realy necessary to have a RADIUS server to the external hotspot work?

If you mean an external hotspot login page, no. It will check the local router database first (/ip hotspot user), then a RADIUS server if you have one set up.

SurferTim

...or you can select "IP - Hotspot" and click on the "Hotspot Setup" button. With the CLI

/ip hotspot
setup

SurferTim

Last I checked, this is caused by the hotspot interface doing a 1:1 NAT on all localnet devices. Whatever IP you try to connect with on the localnet, the hotspot intercepts that attempt. Try disabling that 1:1 NAT. Everything else should still work ok, but any device connected to the hotspot interfa...

SurferTim

Is everything assigned to bridge1? IP address/subnet? DHCP server? Hotspot? The hotspot will assign an IP from its dhcp pool if the IP address the client is using is out of the localnet subnet or is already assigned to another device. edit: My apology. I was interrupted by a phone call.The IP shown ...

SurferTim

That will cause no noticeable effect. Ping is one packet from src to dst, and one packet back. Hardly a network killer, even if done 30 times every 5 minutes.

SurferTim

Thanks tim. On the same note, if I am running a script to ping all static ip addresses every 5 minutes, will this also tax the network, or is ping so minimal it doesn't matter? It shouldn't tax the network too much, but again, it depends on the number of static IP clients you have on the localnet. ...

SurferTim

got it. But by shortening the lease time to 10 minutes, doesn't this tax the router and add network traffic? I wonder how it affects performance? Yes, it affects the performance of the network, but that would be relational to the number of clients on the network. If there are only a few clients, th...

SurferTim

The change in lease time should not be a problem. As long as the client device thinks it has a lease, even tho it is longer than the lease time on the dhcp server, it should not lose the connection. The dhcp server (last I checked) will check to see if an IP is being used before issuing that IP from...

SurferTim

Take a look at this thread.
http://forum.mikrotik.com/viewtopic.php?f=2&t=89620

If you wait a while, then try the ping again, does the IP change? It may be the site is using dns to load balance. PayPal uses this type of load balancing.

SurferTim

Normally that is caused by the hotspot's 1:1 NAT. It uses ARP poisoning to intercept requests to localnet IPs from any device on the localnet.

Try disabling the 1:1 NAT. You do that by setting the hotspot address pool to none.

/ip hotspot
set 0 address-pool=none

SurferTim

I have not tried it, but FreeRADIUS is supposed to be able to do that. It is a setting in the clients.conf file. Maybe DMA Softlab can do it. It is based on FreeRADIUS v2. Check with them. Here is the entry that allows all IPs to be a client: client 0.0.0.0/0 { secret = 12345 shortname = name } Mayb...

SurferTim

I think you have to wrong IP for the SSH NAT. Port 80 is NAT'ed to 192.168.0.100 and port 22 is NAT'ed to 192.168.0.233. Is that really what you wanted?

SurferTim

what is the difference between the dhcp option 42 and the ntp server option in dhcp networks.

Probably nothing different. Just a different way of sending option 42. I have not tested it, but I don't see another way using dhcp to send the NTP server IP.

SurferTim

I don't know if this is your challenge, but some busy domains (like PayPal for example) use DNS to load balance between several servers. The TTL on each domain resolution is very short, and a subsequent domain resolution request will return a different IP. PayPal uses 4 servers in the rotation last ...

SurferTim

Are these the options you wanted? /ip dhcp-server option add name="Time Zone Offset" code=2 value="'-28800'" add name="NTP Server" code=42 value="'1.2.3.4'" The value is a bit odd. It requires a double and single quote on each end of the value if not a hex val...

SurferTim

You can set those in /ip dhcp-server option. I don't use it but I know where to set it.
http://wiki.mikrotik.com/wiki/Manual:IP ... CP_Options

SurferTim

If you used "/ip hotspot setup", the default user and password are the last prompts. I don't see how you missed it. The rest I guess depends on your WAN interface. That shouldn't be on the hotspot. How strong is your firewall on it? Does the device have a serial port? If so, get a null mod...

SurferTim

When you set up the first hotspot on that router, it asks for a user and password for a "default" user. What did you enter there? Same as the login for the router?

SurferTim

If you want the interfaces on a bridge for a reason, that is fine, but the ip address/subnet must be assigned to the bridge, not an interface on that bridge. I recommend removing all interfaces from the bridge, removing all but the ip/subnet you connect to the router with, and start over by adding t...

SurferTim

Still using your "PayPal script" on my hotspots. 2 years later Tim. Saved me a LOT of Grief!

Thanks! It is good to hear my script is still useful!

Actually, I was hoping the Mikrotik crew would have come up with a fix to eliminate the need for that script by now.

SurferTim

Remove the interfaces from the bridge. Is there a reason they are on a bridge?

edit: Your listings of /ip address and /ip route above don't match. Have you done some editing of the settings in /ip address? The interface in /ip address and the gateway for that subnet in /ip route should match.

SurferTim

What tells the RB2011 to allow traffic from 192.168.1.x on ether1 bound for 192.168.3.x on ether3 to go out ether3? and to allow return traffic from 192.168.3.x bound for 192.168.1.x to go out ether1? Dave The settings in /ip route. Those settings are added automatically when you enter the address ...

SurferTim

To access any device on the hotspot interface, that device must be logged in or bypassed. Otherwise, the connection will fail. If the device IP is 192.168.0.2, then this will bypass the device. You can also use the mac address if the IP will vary. /ip hotspot ip-binding add address=192.168.0.2 type=...

SurferTim

i have webproxy enabled do u think that can be the problem ?

No. The web proxy works on port 80. The radius servers work on ports 1812 and 1813.

SurferTim

I can't help you there. All my routers are v6.x. I have no router to test that. The only suggestion I can offer is upgrade to the latest version. If you still have that problem, maybe the Mikrotik crew can help you. They have been really helpful with my problems. I presume you have the radius debug ...

SurferTim

What version of RouterOS are you using?

SurferTim

Then you need to do a bit of troubleshooting. Use this as the login.html page in your router. Check all entries to insure it is passing the values to the new page, especially the error value. My apology in advance if I introduced any errors into this page during the edit. <html> <head><title>...</ti...

SurferTim

Here is the wiki I wrote on external login pages. http://wiki.mikrotik.com/wiki/HotSpot_external_login_page Insure when the new login.html page in the router forwards the data to the external server, it sends this value <input type="hidden" name="error" value="$(error)"...

SurferTim

If you are not logged in, I presume it calls login first. If you try to load login.html, then do a "view page source", all the variables are inserted correctly.

SurferTim

I don't believe the Mikrotik has the internal capability to do that. I use what you use. FreeRADIUS.

SurferTim

Why are some lease times 2 hours and others 5 minutes? Both were issued by the same dhcp server. 374 R address=nat mac-address=20:CF:30:D6:BD:0C client-id="1:20:cf:30:d6:bd:c" server=DHCP lease-time=2h dhcp-option="" status=bound expires-after=1h14m6s last-seen=45m54s active-addr...

SurferTim

Check the entries in "/ip dhcp-server lease". /ip dhcp-server lease print detail Check the "expires-after" and "last-seen" entries. They should total the lease time. I had problems with this several versions ago when the "expires-after" time was not being upda...

SurferTim

but no advertisement redirect or popups happens during hotspot session. Most web browsers have popups blocked by default. My web browsers (IE and Chrome) don't even popup the "you are logged in" page unless I allow popups for the router's hotspot IP. Try setting your web browser to allow ...

SurferTim

Enable debug logging for RADIUS. The full response will be in the router's log.

/system logging
add topics=radius,debug action=memory

SurferTim

Enable email debug logging and try it again, then check the router's log. It give much more detailed info on the attempted transaction.

/system logging
add topics=e-mail,debug action=memory

SurferTim

You know the device using 192.168.88.10 must be logged in to ping it, right?

edit: Or you need to bypass that ip through the hotspot if it can't login.

/ip hotspot ip-binding
add address=192.168.88.10 type=bypassed

SurferTim

If I need to ping the clients on the hotspot interface, I found I must use a out-interface icmp masquerade on the hotspot interface.

/ip firewall nat
add chain=src-nat action=masquerade protocol=icmp out-interface=ether2

If ether2 is not the hotspot interface, change that.

SurferTim

The issue I'm having is that the radius server appears to be sending a "MT-Group" instead of a "Mikrotik-Group" when responding with the access-accept. Is this how it should be? No. It should send Mikrotik-Group. I use this with the hotspot logins. http://wiki.mikrotik.com/wiki/...

SurferTim

The hotspot client must be logged in in order to ping from outside the hotspot network. Also, insure you are pinging the correct IP from outside the hotspot subnet. Look in "/ip hotspot host" and insure the to-address for that client is the same as the address. The to-address is the ip you...

SurferTim

I just tested my iPhone5 on a RouterOS V6.9, and it did good. Popped up the login page, logged in, and an hour later it logged out. I was testing the session-timeout feature.

SurferTim

I get the same thing when I try to login. I think MikroTik is implementing an anti-spam feature on the login.

SurferTim

I have my idle timeout set high (1 day) so I can run tests like these without having to download something every few minutes. I'm now running this test on my iPhone 5. I have 58 minutes to go. edit: This is more difficult on my iPhone. When it goes into standby, it disconnects from my wifi and that ...

SurferTim

I'm using v6.9. It logged me out after 1 hour. I had to log in again. Maybe it is your script. You should post it so I can try it. It is not a problem here. This is your problem. I was testing with a YouTube video running during the last few minutes to insure it cut off the video when the time ran o...

SurferTim

Are you sure those users are using the default profile? The 'R' indicates you are using a RADIUS server for auth. Note the lack of a 'R' on the second active list.

What version RouterOS are you using?

I've got 25 minutes to go on my one hour session timeout.

SurferTim

I just checked my Winbox, and it is showing the correct times there also. Why is your display showing an 'R' before the line number in "ip hotspot active"? That is supposed to indicate you are using a radius server for authentication. I'm using a user from my router database in "/ip h...

SurferTim

I just tested mine. Here is the result from "/ip hotspot active". UPTIME + SESSION-TIME-LEFT = 1 hour. [admin@test] /ip hotspot active> pri Flags: R - radius, B - blocked # USER ADDRESS UPTIME SESSION-TIME-LEFT IDLE-TIMEOUT 0 tim 192.168.1.254 4m53s 55m7s 1d [admin@test] /ip hotspot active...

SurferTim

If you do not see a value here, it isn't working.

Does it show a session-time-left in "/ip hotspot active"?

SurferTim

The user is logged out unconditionally . That does NOT mean the user cannot log back in immediately ! I use FreeRADIUS and send a WISPr-Session-Terminate-Time with the Access-Accept message instead of session-timeout. That will prevent a client from logging back in. http://wiki.mikrotik.com/wiki/Man...

SurferTim

The entry won't take fractions, so use K instead of M.

/ip hotspot user profile
set 0 rate-limit="1M/1500K"

SurferTim

It did last time I checked. Look in "/ip hotspot active" and see what that client shows under "session time left". Once the client is logged out, there is nothing to prevent the client from logging in again unless you use some other way of preventing the login. If you have "...

SurferTim

This sets the user upload/download speed limit to 512k upload and 1M download.

/ip hotspot user profile
set 0 rate-limit="512k/1M"

SurferTim

I don't see the profile for the hotspot. I see only the default.

I use the rate-limit entry in "/ip hotspot user profile" to limit user upload/download rates.

SurferTim

You can use "login-by=cookie,http-chap", and a cookie will log you in without a login page, but you must have NTP set or the cookie will timeout each time you close your web browser.

edit: That change must be made on the router that has the hotspot, so your ISP would need to implement that.

SurferTim

Have you tried disabling the hotspot universal NAT?

/ip hotspot
set 0 address-pool=none

If 0 is not the line number of your hotspot, change that.

SurferTim

Simultaneous-Use is working if I use PAP. radtest works. #radtest user password 127.0.0.1 100 secret FreeRADIUS will never be 127.0.0.1 on the router. Enable radius logging on your router. /system logging add topics=radius,debug action=memory Try the login again and check your log. edit: If the use...

SurferTim

You should be blocking requests from the WAN interface from at least unknown/untrusted ip addresses, otherwise you are asking to get hacked. This will help you add the other rules you need to secure your router.
http://wiki.mikrotik.com/wiki/Securing_your_router

SurferTim

Are you blocking proxy requests from the internet? If not, then that is normal. Anyone would be able to use your proxy.

SurferTim

How would one verify that the router is not blocking/dropping packets to port 445 for SMB share access (or any other protocols)?

Look in "/ip firewall filter".

SurferTim

Are you using Winbox? If so, start Winbox and next to the "Connect to" box there is a button with "...". Click on that and wait a couple seconds. Your router should appear there, even if no ip is assigned to the port. It may show only the mac address.

SurferTim

If you can ping the AD server, then the Active Directory problems are normally a Windows firewall issue. Insure you are allowing the correct ports through the AD server firewall. Do a Google search for Active Directory firewall ports.

SurferTim

Are you planning on using different radius servers to manage each domain?

SurferTim

Also check "/system logging" to insure you do not have a "topics=firewall" enabled.

SurferTim

Why not keep them separate hotspots and use a single RADIUS server for the authentication?

SurferTim

Hi, you need to change the hotspot user profile to none not only in servers sheet. It works fine im tested it on more hotspots, in hosts now only one IP. Where do you see an entry for this in "/ip hotspot user profile"? I don't know what this is supposed to mean. edit: I see where you can...

SurferTim

If they have static IPs, what is the point of having an IP pool? I do not use hotspot, so maybe there is some point I do not know about. What is the IP address which is configured on the hotspot facing interface? If the hotspot is still using the universal 1:1 NAT, the hotspot interface on the clie...

SurferTim

I haven't verified it, but that is normally unauthorized clients attempting to access pages outside the hotspot. It could be websites in the walled garden, or the login page.

SurferTim

SurferTim,

Same issue.

Are you sure? If you set the hotspot address-pool to none, it does not perform the NAT.

edit: Insure you are setting the address-pool on the right hotspot (AFGS-HS-S...).

SurferTim

I need my hotspot to get the same ip address from my dhcp, which is working before on my previous hotspot setup, now I dont know what is wrong.

Disable the hotspot NAT. If disabled, no translation will be done.

/ip hotspot
set 0 address-pool=none

SurferTim

Look in "/ip hotspot host". That shows the hotspot NAT results. The address is what the PC is assigned. The to-address is the dhcp issued ip to that device. The router sees only the to-address. The hotspot uses arp poisoning to intercept the devices requests on the hotspot localnet. To dis...

SurferTim

If you mean the entries in "/ip hotspot host", that is the universal hotspot NAT. It allows clients to use the hotspot if they have a static ip outside the hotspot localnet ip range.

If you want to disable the hotspot NAT, then

/ip hotspot
set 0 address-pool=none

SurferTim

My apology for not experimenting with this in a while. I've been busy with another project. I am now at a point where this function would be useful. I will try to make time soon to see if I can login to the Mikrotik router through the USB port. That would probably be the simplest solution involving ...

SurferTim

ROS6.9 on a RB433AH.

Going surfing now, Be back in an hour or so.

SurferTim

I did. I set the http-cookie-lifetime=10d, and it set the http-cookie-lifetime=1w3d. Here is the output from the router: [admin@test] /ip hotspot cookie> pri Flags: M - mac-cookie # USER DOMAIN MAC-ADDRESS EXPIRES-IN 0 admin 00:16:76:04:CC:1E 1w2d23h58m6s Here is the output from Chrome's cookies: Na...

SurferTim

The maximum value is 3d!!!

Was this a test or in the documentation?

SurferTim

I don't use cookie logins, but I know where to change the value.

/ip hotspot profile
set X http-cookie-lifetime=10d

Change X to the line number or name of the hotspot profile.

If they don't work, insure you use NTP client to set the correct time in the router.

SurferTim

Not enough info here. How are these routers connected to each other?

If the routers all share the 10.0.0.x network, and all have a 192.168.1.x localnet, it will be very difficult to route all those. Maybe one 192.168.1.x network will work.

SurferTim

That is the same ip I get here. That website is using virtual hosting. If you try that ip, you get a webpage from the virtual host. Then try nslookup from a command line on the computer if it has that capability. Maybe the computer is not getting the resolution on that domain. Is the request to that...

SurferTim

Check if the router is resolving that domain. From a command line in the router

:put [:resolve e107.org]

SurferTim

How long are you looking to keep the user logged in after the disconnect? If you allow only one user logged in simultaneously, then that user will not be able to login from another device during that time.

SurferTim

If I can, I will help.

SurferTim

Today I login and I see that it's changed back to pornotube redirect, but no body else except me logged in to the RB. :-S

How do you know that? Maybe the hacker rebooted your router.

SurferTim

How does the router which is the "main" and which one is the "backup" radius server? It is the order that the servers are entered in the "/radius" section. First entry is the primary. The second entry is the backup. Only if the primary does not respond will the router ...

SurferTim

ya you are ri8. But currently i don't have mikrotik router. So i did my testing on D-link router. it works well. But i want to check make sure for mikrotik it will work as well. So if you can provide me that kind of stuff then it will be better for me. That doesn't make sense. How can you test a Mi...

SurferTim

That code was produced by the standard login.html page from my router. I removed the stuff that applied to the login-by=http-chap and the formatting part. Look in your router under /file. It should be in a directory called hotspot/login.html. The code I posted above was taken from a "view sourc...

SurferTim

ok. let me check that it works for me or not. Do you think that by providing simply username and password using a form we can authenticate our self to mikrotik? It appears so. That is what that form does if using login-by=http-pap. If you use login-by=http-chap, all bets are off. The chap challenge...

SurferTim

I enabled my hotspot and tried to login. Then I did a "view source" of the login page (login.html). Here is mine shortened to just the stuff you need. If you are using login-by=http-pap, then this is the form you must submit to the router: <form name=login action="http://192.168.1.1/l...

SurferTim

I'm not sure. I haven't tried it. If you are not using the login-by=http-chap setting, it shouldn't be too bad. Open a port 80 connection to the router, then send a form with the user/password to the correct "page" and wait for a response.

SurferTim

Your app need not respond to the "look and feel" stuff. Just the forms. All those web browsers are not returning the "look and feel" stuff to the router, just to you so the display will be pretty. I recommend using http-pap as a login-by setting to start. That way your app doesn'...

SurferTim

@SurferTim : so you mean its possible to authenticate using desktop based application to mikrotik??

Of course! Internet Explorer is a desktop app. Chrome is a desktop app. Firefox is a desktop app. Your Java app must emulate those apps to login.

SurferTim

You must authenticate through the Mikrotik router. The router must connect to the radius server, get the authentication and return that result to your Java app through a port 80 connection.

SurferTim

If the Java app works like a web client, it should be possible. I'm not saying it would be easy.

SurferTim

Did you remove the interfaces from the switch? ether1 is normally the WAN interface, and ether2-ether5 are normally on a switch on the RB750. If you haven't removed them, I believe ether2 is the master port of the switch, not ether3. If I get time, I'll try some tests on my network today, just to in...

SurferTim

So your localnet PCs can access each other and the internet with the hotspot disabled? If so, the hotspot universal nat is the only thing that has blocked localnet access for me. Setting the address-pool to none disables that nat. Maybe you should post "/ip address" and "/ip hotspot p...

SurferTim

I want to authenticate each connected user using wired connection. So i use Freeradius server along with mikrotik. I want to make a simple change. I don't want to use default authentication page provided by mikrotik, apart from it i want to use my own mechanism that request to authenticate to mikro...

SurferTim

Look here under "User status information".
http://wiki.mikrotik.com/wiki/Manual:Cu ... ng_Hotspot

$(session-time-left)
$(limit-bytes-in)
$(limit-bytes-out)

SurferTim

If you want the PCs on the hotspot interface to communicate with each other, disable the hotspot universal nat.

/ip hotspot
set 0 address-pool=none

It is the hotspot using arp poisoning to perform the universal 1:1 nat that prevents localnet communication.

SurferTim

...and move it above the 'drop all' rule...

...and that too. I missed that part.

SurferTim

I don't know if this is the problem, but I don't see where you have started a services chain. 7 ;;; Allow NTP chain=services action=accept protocol=udp dst-port=123 I would set that chain to input, and allow the src-port=123. 7 ;;; Allow NTP chain=input action=accept protocol=udp src-port=123

SurferTim

You should be able to do it with a script and the scheduler. Replace the 'X' below with the line number or name of the hotspot.

Schedule this to run and enable it at 1PM daily.

/ip hotspot
enable X

Schedule this to run disable it at 6PM daily.

/ip hotspot
disable X

SurferTim

How are you determining what ips to put in the blacklist? Are you planning on doing that manually? If so, use an address list. Put the ips in an address list, then use that list to block access to those ips. This should do what you want: /ip firewall address-list add address=1.2.3.4 list=myblacklist...

SurferTim

If you want me to help you, be more specific about "blacklisted" and "hosts". Are you not understanding what I am asking? Just a few questions: 1) How are you determining what goes in the blacklist? 2) What format are the hosts in? IP or domain name? 3) How did you get that much ...

SurferTim

how to make blacklisted hosts in firewall?

Use "/ip firewall filter".

SurferTim

nobody understand my question!

I don't know what you want. I thought you wanted a login page and your forum page on the same page. If that isn't it, be more specific about what you want.

Did you not understand about the iframe and the walled garden?
http://www.w3schools.com/tags/tag_iframe.asp

SurferTim

No. Remove it by highlighting the dhcp server entry, then click the red '-'. Click "DHCP Setup" and answer the prompts.

SurferTim

Can I do this by WinBox's GUI?

Yes.

SurferTim

Remove the old dhcp server.

/ip dhcp-server
remove X

Relace X with the line number of the server for that network.

Set up the new one.

/ip dhcp-server
setup

SurferTim

Did you change the dhcp server and repair the network connection?

SurferTim

I recommend removing the assignment in "/ip address" and enter a new assignment. Don't edit the address. It won't change the stuff needed to route the new ip address. Do the same with the dhcp server. Remove it and set up a new one after the "/ip address" change. Be careful tho. ...

SurferTim

The solution in your case is easy. If you do not understand what I am asking, don't change it.

SurferTim

I should have been more specific. You should post the following
/ip address print
/ip route print
/ip dhcp-server print
/ip dhcp-server network print
/ip pool print
/ip firewall nat print

SurferTim

Then you should post the following
/ip address
/ip route
/ip dhcp-server
/ip dhcp-server network
/ip pool
/ip firewall nat

SurferTim

Insure you remove wlan1 from the switch/bridge. Here are the default configurations for MikroTik devices.
http://wiki.mikrotik.com/wiki/Manual:De ... igurations

SurferTim

Insure you change the gateway on the PC. The dhcp server settings on the router may need to be changed. That may require "Repair the connection" on your PCs.

/ip dhcp-server network
print

SurferTim

If you want to allow communication on the hotspot localnet, you can disable the hotspot universal nat by setting the hotspot address pool to "none".

/ip hotspot
set 0 address-pool=none

SurferTim

The cookie login doesn't work if NTP client is not set up on the router. The router needs the correct time for that function to work. Just a thought...

SurferTim

If you set "allow-remote-requests=no", then your router will be the only device using the dns on the router. Your clients will not be able to use the router for dns. The "/ip dns static" entries are local only. Only clients using the router for dns will use the entries there. Be ...

SurferTim

You should be able to add an iFrame to the login.html doc just like any html page, and allow the forum through the hotspot like this:

/ip hotspot walled-garden
add dst-host=forum.mydomain.com action=allow

SurferTim

I think this is what you want. Set up the router in "/ip dns". Set "allow-remote-requests=yes" so the clients can use it for a dns server. If the clients get their network settings from the router's dhcp, then set the dhcp server to issue the router's ip as the dns server. /ip dh...

SurferTim

Not possible unless your ISP port forwards the public ip to your private ip.

SurferTim

You don't need a wildcard for the pages, just the server/domain. This should do the same thing.

/ip hotspot walled-garden
add dst-host=download.mcafee.com action=allow

SurferTim

Sounds like a gateway problem in the APs. Maybe you should explain what make/model they are, and how they are set up.

SurferTim

Why don't you just allow access to all mcafee.com? Would that be out of the question?

/ip hotspot walled-garden
add dst-host=*.mcafee.com action=allow

SurferTim

Then remove the code from alogin.html as I suggested above.

SurferTim

Post your "/ip firewall nat" and "/ip firewall filter" rules.

I use the CLI.

/ip firewall nat print
/ip firewall filter print

SurferTim

Check "/ip firewall filter". The RB2011 blocks WAN access by default. Add a rule that allows your remote ips through the firewall.

SurferTim

You stated that the router was refusing ip addresses from the dhcp server. What ip addresses is it refusing? If the dhcp server is attempting to issue a 192.168.0.x/24 ip, and you have a 192.168.0.x/24 localnet on the router, that could cause a problem. The usual thing I recommend is enable verbose ...

SurferTim

Post "/ip address" and the ip offers that the router is refusing from the dhcp server.

SurferTim

Just out of curiosity, is your client router being issued an ip/subnet by the dhcp server that already exists on the dhcp client router?

SurferTim

Sorry about that. It is port 587 now, not 465.

SurferTim

Use the SMTP server ip for Gmail. That is smtp.gmail.com. I use nslookup (or :resolve in Mikrotik script) to get the ip. Currently it resolves to these here in Florida: 173.194.64.108 173.194.64.109 To insure the email is accepted, use your Gmail address as the sender. You can also use it as the to ...

SurferTim

Most email servers check the sender's domain. If it doesn't resolve, it won't take the email.

To check why it is being rejected, enable debug logging for email and try a send, then check the log.

/system logging
add topics=e-mail,debug action=memory

SurferTim

Set the relay and src. address settings to 0.0.0.0.

SurferTim

So 192.168.10.1 is the dhcp server for your network?
http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Relay

SurferTim

Is that an 'I' (invalid) preceeding the dhcp server name? If so, you should find out why. [admin@MikroTik] >> ip dhcp-server print Flags: X - disabled, I - invalid # NAME INTERFACE RELAY ADDRESS-POOL LEASE-TIME ADD-ARP 0 I dhcp1 ether1 192.168.10.1 dhcp_pool1 3d Why is there a relay entry of 192.168...

SurferTim

simply put "//" at the start of the line where "open('$(link-status)'......" is

The OP said above he tried that and it didn't work. I would suspect at that point the Android is not recognizing the comment slashes or the $if statement.

BTW, nice fix.

SurferTim

Then try removing all of this from the alogin.html page: $(if popup == 'true') open('$(link-status)', 'hotspot_status', 'toolbar=0,location=0,directories=0,status=0,menubars=0,resizable=1,width=290,height=200'); $(endif) If there is no command to open the status page, it shouldn't open.

SurferTim

I tried it again with IE and Chrome. Both respond correctly. If popup is true, you get a status.html popup. If popup is false, you don't. RB433AH ROS V6.9 I have "login-by=http-chap". Insure you are modifying the correct file. hotspot/login.html Did you do the "view source" as I ...

SurferTim

Is a mobile phone the only device you have? It doesn't matter if a cellphone or a laptop. Try it with a laptop and view the source. If the page has popup set to false, then it should be false for every device that loads the login.html page.

SurferTim

It appears to be the login.html page you need to modify. There are two places that must be changed to insure no popup status page. You must change <input type="hidden" name="popup" value="true" /> to false. Here if you use "login-by=http-chap": $(if chap-id) <...

SurferTim

Are you using a Mikrotik router as the client? If so, do you have a route to the PPTP server localnet networks in the client "/ip route"?

SurferTim

Last I checked:
Black means good.
Blue means the interface is not running (nothing connected)
Red means the interface doesn't exist or is disabled.

SurferTim

Add "dst-address-type=!local" to the dstnat redirect rule.

SurferTim

Yes, I am wrong. I just tested it with V6.9 and it does not change the mac format. It leaves the colons in the mac address. Sound like a new bug to me. I think the last time I tried this was with V4.X, so it has been a while. It did change the format then. I remember this because my radius didn't li...

SurferTim

I did a bit of experimenting and maybe found a way. Print the dynamic rules and set the redirect for tcp and udp dst-port=53 to "hotspot=!auth". Mine were rules 2 and 3. /ip firewall nat print dynamic set 2 hotspot=!auth set 3 hotspot=!auth Note it added "hotspot=!auth" to rules ...

SurferTim

I haven't checked in a while, but you can use RADIUS for the system users. It worked a few versions ago. Just a thought...

As I recall, you can return Mikrotik-Group to set the group.

SurferTim

Last time I checked, the hotspot walled garden depends on the dns cache to allow access to domains in the walled garden. If you managed to bypass the dns service of the router, the hotspot walled garden would not function. Just a FYI.

SurferTim

Usually this can be caused by a network configuration problem. Is your network routed or are you using masquerades?
Post "/ip route" from Mikrotik01.
Post "/ip firewall nat" from Mikrotik-02 and Mikrotik-03.

SurferTim

This change RADIUS MAC-format.. (Calling-Station-Id in radius packet), not login name...

It does change the login (user) name. I tested it, and it works.

Enable radius debug logging, and you will see the change in your router log.

/system logging
add topics=radius,debug action=memory

SurferTim

Yes. It works for RADIUS, but I haven't checked it with the local router database.

/ip hotspot profile
set X radius-mac-format=XXXXXXXXXXXX

SurferTim

What type security do you have set on the AP? Looks like your security mode or passphrase in the apm6828 may be incorrect.

SurferTim

How does the Groove get its network settings? Is it static or dhcp? Check the gateway setting on the Groove. Insure it is 192.168.40.254.

SurferTim

OK. Then post "/ip address" and "/ip route" from your routerboard server, whatever device that is. Never heard of that model routerboard.

SurferTim

My computer is connected on simple home router that is further connected to a main routerbord that is also a server/gateway...

Do you have that 192.168.40.x network routed to the routerboard in the "simple home router"?

SurferTim

Outlook uses that short TTL for load balancing. The resolved ip should be good for much longer than 5 minutes. I show it rotates through the same set of ips over and over. If you keep entering this, you will see. :put [:resolve smtp.outlook.com] It has been the same set of about a dozen ips for the ...

SurferTim

There is no problem with resolving smtp.outlook.com. Using the CLI

:put [:resolve smtp.outlook.com]

Don't resolve it every 5 minutes. Run it once a day.

If you have the ability and resources, then the best way is to use an email server to relay your email.

SurferTim

What type of device is a nano time logger? The only time logger I know of would be an Arduino, but it doesn't have wireless capability.

edit: Or is this a computer like a Raspberry Pi or Beaglebone with a nano wifi device?

SurferTim

From the OP:

The hotpsot works fine but when I log in I am unable to access the internet even though the internet works when accessed directly without hotspot.

Then later:

I get the results

failure: dns server failure

If the router cannot resolve dns requests, then there will be problems.

SurferTim

Just a FYI: If you decide to add another network to your router, insure you add a masquerade that covers the new subnet. I use this, and it covers any subnets in the router.

/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1

SurferTim

Did you fix your dns resolution problem?

@rextended: The hotspot redirects any dns request to the router.

SurferTim

What does it do when it doesn't work? What does the web browser display? Do you get a login page? What is in the address bar of the web browser? I found the redirect to the login page won't work if the dns-name entry doesn't resolve to the ip of the hotspot interface, at least on my system. That wou...

SurferTim

You could use a scheduled script to resolve the domain to an IP, then replace an IP in a dstnat rule. Are you ok with that?

SurferTim

If speedtest.net uses a reverse dns lookup, you can contact your ISP, and if they are ok with it, they can change the reverse dns lookup to show your domain. I did this with my ISP and my email server IP so I wouldn't get rejections because the reverse dns did not show the correct server. If speedte...

SurferTim

Then you have my apology.

However. I am not sure why this is important. My customers use speedtest.net, and it shows the appropriate ISP for each of my connections. It still appears to me this is slightly deceptive.

SurferTim

Do you have valid operating dns server IPs entered in "/ip dns"? Have "allow-remote-requests=yes"?
I don't see a masquerade entry for the WAN interface. Does it require one?

SurferTim

Please tell me I am incorrect. The OP only has to tell me I am incorrect. The difference between a little tiny bit unethical and a lot unethical isn't much to me. My past experiences has shown me that one leads to the other. @rextended: This isn't aimed at you. I don't regret giving you the karma y...

SurferTim

@rextended: I have given you karma for your other answers to my questions, but I would be careful about judging my ethics. It is not impolite to ask a user about his/her intentions. I am a member of other forums where my responses could affect more than just the OP and myself. If you think that a cr...

SurferTim

this the scenario i have in mind. i have 2 ISP WAN 1 = 8 Mbps DSL WAN 2 = 30 Mbps PPOE i'm trying to use both on 1 mikrotik device, but i don't want customers to find out what's WAN 2 isp when they go to http://www.speedtest.net any ideas or suggestions ? So let me see if I have this correct. You w...

SurferTim

Try this from a command line in the router.

:put [:resolve www.google.com]

Does it resolve to an ip?

Insure the dns servers entered in "/ip dns" are operational dns servers.

SurferTim

Get ping working first.

/ping xx.xx.xx.xx arp-ping=yes interface=out1 count=1

If that works, add it to the script above.

SurferTim

Have you tried accessing the internet by ip rather than domain? May be a dns issue. Check your "/ip dns" settings and insure you have "allow-remote-requests=yes".

SurferTim

Do you have a dhcp client set up on the WAN interface?

I suggest enabling verbose logging for dhcp.

/system logging
add topics=dhcp,debug action=memory

After a dhcp attempt, check the log to see what is happening.

SurferTim

It appears to have a micro usb connector. Is that correct? If so, that is a client usb, not a host. If you can't connect to it, why have it?

Try 115200-8-N-1.

edit: It can also be used as a host according to the docs.
http://wiki.mikrotik.com/wiki/Manual:USB_Features

SurferTim

Yes. Replace xx.xx.xx.xx with the ip you want to test ping.

:if( [/ping "xx.xx.xx.xx" count = 1] == 0) do={
  :beep;
}

SurferTim

No. If you have two RADIUS servers set for the same service, the second server is used only if the first server does not respond. If the first server responds with ACCESS-REJECT, the second server is not used. You can kinda trick the router if you use FreeRADIUS by using an ACESS-REJECT delay longer...

SurferTim

Did you check "/ip dhcp-server lease" to see what is happening with the "last-seen" and "expires-after" values? Those two values should add up to total the lease time. If you see any leases that the sum of those two values equals about half the lease time, then that may...

SurferTim

It does not resolve it because its a local test DNS server that only resolved whats in the DNS list. Can this cause a problem with redirecting to resolvable hotspot URL? Should I create Google entry in DNS to resolve to a local address for testing purposes? Yes. If the dns server does not resolve d...

SurferTim

Then your dns is malfunctioning. See if your router is resolving domain names. From a command prompt in the router:

:put [:resolve www.google.com]

Does it resolve that domain?

Search found 4636 matches