Bokad, I would highly suggest just posting what you have so far under GNU or something, then everyone can contribute to the project. You could probably even get it set up under a SourceForge project. I understand everything else but the hangup I have is a lack of understanding quite how to work with...

So has anyone got it to work correctly yet and care to share the wisdom?

I would be interested in hearing more about this. Please e-mail me at mikrotik@rikerconsulting.com. Thank you.

~ Jason M. Weber

I was thinking use the MAC address for the Hotspot login. Just my initial thinking.

~ Jason

One of the first sets of rules I add to any forwarding fire table is a block of the Netbios ports 135-139. It's a defense against customers who can't keep their local networks from leaking that junk out into ours. Of course the whole point in this instance is to allow that traffic. He wants the net...

The router probably only does PAP but the Win XP box doesn't like anything less than CHAP. Also start looking at the encryption settings.

~ Jason

Yes, it should work fine but there is going to be a lot of broadcast traffic (assuming you're running Windows) and this may cause bandwidth issues. Just something to keep in mind.

~ Jason

Might want to look here too:

http://www.mikrotik.com/docs/ros/2.9/ip/mangle

Look for "src-port" or "dst-port".

~ Jason

umm if I remember the basic routing class I took way back when I seem to recall that you can not route from a public network to a private (reserved address space) network. You have to do NAT/PAT or Proxy-ARP. A router doesn't care about a public IP being routed across private space, do it all the t...

Just as a side note, you generally don't want to be doing too much caching on flash drives.

~ Jason

Mikrotik Router 2.8.28 I use the mikrotik box for PPPoE connections. I want to block all ip addresses except those I have setup for users. What kind of firewall rule or rules can I use to do this? I have a forward rule now that basically says: drop all 192.168/16 on all interfaces. How can I do thi...

Are you opposed to using RADIUS?

~ Jason

You can specify a prefered source in the route table though I'm not sure this entirely answers your question.

How about using a src-nat to another IP for most of the traffic and leaving the router source IP as the proxy?

~ Jason

So what about a queue tree? ~ Jason No [yogi@Home] queue simple> add name=override dst-address=1.1.1.2/32 max-limit=512000/512000 limit-at=512000/512000 [yogi@Home] queue simple> pri Flags: X - disabled, I - invalid, D - dynamic 0 name="override" dst-address=1.1.1.2/32 interface=all parent...

What about a simple queue with the dest address of the mail server. Or was mail just the example, and you specifically need ports?

Would the PPP profile queue not take precedence?

~ Jason

I believe the question was about PPTP not PPPoE. Anyway, when you added the user did you change the default profile? /ppp profile 0 * name="default" local-address=0.0.0.0 remote-address=0.0.0.0 session-timeout=0s idle-timeout=0s use-compression=no use-vj-compression=no use-encryption=no re...

Depending on how you have it set up, you can also rework the firewall rules that are set up by the Hotspot to specifically allow addresses, etc and the user never knows they're actually connected to a hotspot system. It wasn't hard. Let me know if you would like a hand.

~ Jason

Is it possible you need to open the ports up for the src-port as well? The server may be sending reponses from those ports and getting blocked.

~ Jason

Should be easy enough to do via scripting. Let me know if you would like my assistance, mikrotik@rikerconsulting.com.

~ Jason

You may need to stop using the PPP profiles to set the rate limits and configure queue trees. If I can take a look at your configuration I might have a different (much easier) solution but I don't want to promise that unless I'm sure. Just let me know, mikrotik@rikerconsulting.com.

~ Jason M. Weber

I may be able to help you out. It would probably be quicker if I look over an export of you configuration. Just let me know, mikrotik@rikerconsulting.com.