I'm running a 5009 with an almost exclusively linux based network and have no issues. Have you tried disabling the adguard stuff you're running on the 5009 and re-test? While adguard was not at fault, thanks to your suggestion I was able to determine the culprit! Apparently it was my other containe...

Well if you go by the title of the thread it does intimate what erlinden is suggesting, ( a wireguard server on the NETWORK, not on the router ).

Yes that is the way I took it.

I'm running a 5009 with an almost exclusively linux based network and have no issues. Have you tried disabling the adguard stuff you're running on the 5009 and re-test?

I *think* OP was trying to ask about limiting access to the whole network for the WG users. I think he *could* use a VLAN or simply configure the firewall on the WG server node like anav was describing.

Who said Win is from Windows? Win is from Winning We don't plan to change the name for every platform.

"Win" is usually a reference to Windows. Does this mean versions for other platforms are forthcoming?

If the name itself created any legal issues it would've been rebranded long time ago for Windows systems too. It apparently isn't

Not a legal issue, just a "we don't want to create a tool for Linux with 'win' in the name because it's weird" issue.

Why have the WAN going to the switch?

I think 802.3ad mode and layer-2-and-3 hash policy would work fine.

I run Winbox using wine and it works great. I just find it kind of ironic that ROS is built on Linux but MT does not have a native Linux version of their management tool available...

Perhaps it's the name that is the issue and they would want to rename the tool before releasing for Linux?

I'm no expert either but it would seem to me you need a router instead of a switch there, or reconfigure the network architecture.

Right. I wrongly assumed that it could use the time provided by the Mikrotik cloud sync to provide time via NTP for my network. I just thought I'd make a post to help others in case they also made the same assumption.

Just an FYI, I was having issues with LAN machines getting time from the mikrotik router even though the NTP server was enabled. I had the time update enabled under IP > cloud, but apparently that only updates the time for the router and does not translate to the router being able to send time to th...

Couldn't the OP simply run a WG server on his windows box behind the MT router and just port forward the WG port in the NAT of the router? Seems easier than trying to run WG on a router that is out of date and he doesn't have full admin rights on.

New owner of a Hex S: 1: I run a linux desktop, so a Windows application doesn't work for me. I like others find it of no use to my administration tasks. Winbox works just fine in Wine. It would be nice to have a native linux application but I would rather use it in Wine than not have it all!

You shouldn't need to set a bandwidth limit in the queue type.

I'm only praying for native Linux support (instead of having to use Wine). Maybe something based on Flutter/Dart so Mikrotik can pool their dev resources instead of having 3 different dev teams for the web-ui, winbox and android app. This. I love using Winbox but I would like to have a native Linux...

It is true that the app does not get updated often, but I've been using it for a few years now with no issue. The difference for me being that my WG server is a VM within my LAN, not on my router.

That is fine, as long as you understand that in today's world that does not do anything. (because of DoT, DoH and VPN) I'm preventing my kids from going around the block by trying to use another DNS server. As of now they don't even know how I'm blocking them. If they were to figure it out and try ...

If you're trying to use WG on your home wifi, you need to configure a hairpin NAT on your router. The 5G connection works because it's hitting your router from the WAN.

That's what I'm trying to understand. Not sure what port it uses by default. By default, it works as a caching recursive resolver, which means it will query the root servers, etc... and use port 53 (UDP & TCP). It can also work as forwarder and forwards requests to upstream DNS servers. In that...

I get that, but if unbound isn't using port 53, I can block it on my firewall and prevent users on my network from bypassing my piholes, right?

How is unbound getting its DNS data?

That's what I'm trying to understand. Not sure what port it uses by default.

Good info. I use pihole to block youtube on my network as well, but my pihole servers use unbound so they are not querying external DNS servers. Does that mean I can block all traffic on port 53 on my firewall and what does that look like? Thanks. Unbound is the name of the software your servers ru...

I know you're asking how to do this with a Mikrotik router, and I'm about to give you a combination Mikrotik/non-Mikrotik solution. So please forgive me. It is not possible to get all the IP addresses of "youtube.com" and just block them. The layer 7 stuff in the router that you're doing ...

Thanks. You're right about reducing the max-limit to achieve best latency results. Running this right now and seems to perform pretty well all around. /queue type add cake-diffserv=diffserv4 cake-nat=yes cake-rtt=20ms kind=cake name=cake-upload add cake-diffserv=diffserv4 cake-nat=yes cake-rtt=20ms ...

After playing around with various implementations of simple queues and queue trees with and without fasttrack enabled, I just can't get the same download throughput with cake as I can with fq-codel. Cake seems to give slightly better latency on a bufferbloat test, but I'm not giving up throughput fo...

Thanks. I've played around with fq-codel and cake and have decent results with both but think fq-codel wins. With cake it seems to limit my download speed some. /queue type add kind=fq-codel name=fq-codel /queue simple add max-limit=100M/10M name=fq-codel queue=fq-codel/fq-codel target=ether1 \ tota...

RB5009 here. I am having an issue where a single download saturates my connection and prevents other internet activity on my computer. I've been trying to implement some kind of QOS to fix this. I disabled the firewall fasttrack rule, and then implemented following: /ip firewall mangle add action=ma...