MikroTik

savagedavid

See attached below

savagedavid

In my network we have a number of routers that are "shared" devices between different providers. In some cases different default gateways are required depending on source IP address. Routing Rules provide a very simple way to implement this without using Mangle / VRF or another much more c...

savagedavid

Have you tried managing it using Webfig? If you create a skin you can make something pretty close to what you are asking for. Hello MikroTik We would like to request to re-add the old feature "Admin Web Interface for the User Manager" in the new version of User Manager in RouterOS 7 (um5) ...

savagedavid

I received a response from support. Seems like firewall address list can only match an exact prefix and not a range. It might be added in a future release.

savagedavid

I'm not sure if this is a bug or a feature request! With v7 BGP you need to advertise networks by using a firewall address list. I have a script that automatically sets up all the filters for me, previously populating BGP Networks and using the same info to update scripts was quite easy. With the ne...

savagedavid

OR IP ROUTE RULES (source address list) !!!

This is a great idea!

savagedavid

Not sure if this has been requested before. It would be really great if you could reference a firewall address list in IP--Services for allowed addresses. Very often you would have an address list of "management" IP ranges allowed in the firewall and this is often the same as winbox/SSH al...

savagedavid

I have noticed when migrating from v6 filters to v7 filter the prefix length 0-32 does not seem to translate properly.

For example this

prefix-length=0-32

translates to

 dst-len > 32

where is my mind it should be

dst-len <= 32

savagedavid

Never mind, I just answered my own question. Turns out you just type the address list name instead of an IP and it works fine.

/ip/firewall/address-list/add address=10.2.1.16/29 list=isp-prefix
 /routing/filter/rule/add chain=ospf-in rule="if (dst in isp-prefix) {reject}"

savagedavid

Busy getting my head around route filters and V7 and trying to update my scripts. In V7 you no longer advertise in BGP--Networks (which does not exist) and you now do it via a firewall address list. My question is: can you use firewall address-list entries in BGP route filters? It would make a lot o...

savagedavid

Wondering if anyone has experienced anything like this. We have a CCR1072 core router that links to several other CCR routers (1016, 1036, 1072). The router runs both BGP and OSPF and links our AS to the internal network. We decided to embark on a routine upgrade since it had net been done for close...

savagedavid

Solved: I managed to work around the problem by creating a folder structure on my local PC e.g. /dude/files/[filename}
Then drag the entire file structure to Winbox. This added the package in the correct place and it appears in Dude monitor under Packages.

savagedavid

The RoMON system works well, but is is a concern that any valid user account including those with Read access can access the RoMON system. It would be great if RoMON could be added as a right in User Groups so that it can be restricted on a policy basis.

savagedavid

I think I have tracked the problem down. Seems like the CCR's are much more sensitive to heat. The CPU temp was exceeding 75 degrees in the location it was installed (the RB1100AH did not seem to have a problem in the same location). Back in the DC it does not freeze at all. I am going to look at ad...

savagedavid

Hello again savagedavid, just require a less buggy ROS release to take full advantage. this is more related to the new hardware platform type from Tilera, but if they get it false free running and other well known bugs and issues are also fixed, it must be a really cool device, i personally think. ...

savagedavid

I really think that we all should change the former thinking in my opinion, because today we have 36 cpu cores and not only one or two cores! Am I right with this? If the CPU load from the CCR is under 36% of total CPU load it will be shown as 0-1% of each core > 36% : 36 cores = 0%. And now backwa...

savagedavid

Seems I spoke too soon. The RC8 unit is still freezing. We have installed the old RB1100 at one location and continue to monitor.

savagedavid

Hello savagedavid, One side is now freezing up constantly. This morning one of the CCR's is frozen. And what is with the other CCR? Is it running fine or there are also problems? We eventually figured out the freezing side had not taken the RC8 upgrade (corrupt file upload) so we fixed that. The ot...

savagedavid

One side is now freezing up constantly. In addition pings across the fibre are 0ms but every 10th ping or so it either times out or jumps to 50+ms.

savagedavid

A few problems I have picked up: Last night we installed 2 x CCR1036 between our DC and a fibre connected highsite. This morning one of the CCR's is frozen. Shows up in IP neighbors but cannot be accessed otherwise. Waiting for a technician to get onsite so that we can reboot and upgrade to RC8. Asi...

savagedavid

I have not seen it yet. If what you are saying is accurate then I agree, queue tree should not be required.

savagedavid

one global (well, not about global queues, but about ideology :) ) question: do we still need queue tree at all? in the light of kernel-level optimizations of Simple Queues and remembering Occam's razor to make queues more homogeneous, maybe it worths to transform Queue Tree to another set of Simpl...

savagedavid

It's not unusual for clients running torrent applications to have many hundreds of connections. Can you post an export of your exact configuration? It sounds as if you might be limiting on an entire range rather than a single IP.

savagedavid

so now what do you do with such bad devices which are working hence not qualified for replacement or any other warranty issues??..... becomes a capital liability.... does it? The problem only happens when going into a switched network. On highsites connecting to other routers it has no problems. Fo...

savagedavid

Please note from 5.13 changelog *) dhcp client - revert DNS settings on dhcp client disable; What this means is if you get IP details from DHCP it wont write it into your fixed DNS settings. Instead it creates a "dynamic-servers" entry with the DNS servers listed there. It will not show up...

savagedavid

It will require a lot of back-end modification and customization to get what you want. It's not going to be easy or cheap to really do. I realize that and indicated to the client. He still wants some kind of ballpark figure though. 2.) For the survey requirement, that will require a custom remote l...

savagedavid

Does Rb1200 gad latest version and latest bios version?

yes and yes, first step I took was upgrading every device in the path

savagedavid

We have a client with a Mikrotik Hotspot onsite and a remote Mikrotik User Manager that authenticates users. What they want is a 30 minute voucher, that if expired, brings a pop up/ or redirects their browser - this takes them to a survey. If the user completes the survey they have their time extend...

savagedavid

David, Are the RB1200's by any chance using bonding? We have seen very similar issues but only with bonding. Nope, no bonding. It's a very standard routed network running OSPF. The issue is very weird indeed. When pinging from the 1200 router to a directly connected device (another router or a lapt...

savagedavid

Update II: I replaced the 3 x RB1200 with 1 RB100AHx2 and 2 x RB493AH (It's all I had in stock). Performance increased massively and immediately. I can now do file copy across the network between 2 Windows 7 machines (using windows file transfer) at 96mbps, which is the limit on the 10/100 ether por...

savagedavid

Update: Seems the problem is with the RB1200 routers on ether side of the link! Replaced one of the routers with an RB1100AHx2 and response immediately improved hugely. I am running more tests now and will post back results.

savagedavid

is this UDP or TCP test? copy files in windows is not the best way to test speed. Try btest (mikrotik) or iperf. Still bad, try change frequency. Still bad, adjust adjust adjust antenna. Sorry, I don't think you understand the problem. Wireless connection and bandwidth test is absolutely perfect. U...

savagedavid

In actual testing we have found that station-wds with NV2 delivers higher bandwidth test speeds, but performs quite poorly when copying multiple small files. The best results overall seem to be using MPLS/VPLS pseudowire.

savagedavid

I am having a particularly frustrating time with a client network. We upgraded some links from an old x86 routerboard platform running 5Ghz turbo and nstreme to an 802.11n system running NV2. Previous system (turbo+nstreme): Bandwidth Test: 65-70mbps Windows File copy: 20mbps application performance...

savagedavid

You are probably referring to the RB800 with wireless daughterboard option. It has 4096 vlans per port, so just using the 3 ether ports you can have 12000+ vlans!

---
I am here: http://maps.google.com/maps?ll=-33.809637,18.475089

savagedavid

We eventually receive our GBPOE stock and installed. Getting around 180mbps btest to the ether port and wireless performance of 125-130mbps TCP bandwidth running btest between 2 x RB1200 connected to a transparent bridge using RB711G. Full Duplex testing delivers around 150mbps aggregate.

savagedavid

i am using ADSL routers in router mode as my gateways. the adsl routers create the pppoe connection to my isp. is this what you mean? Not really, this normally happens with multiple tunnels within. It's always possible that your ISP may be doing something further up the line. In any event the probl...

savagedavid

You are probably accessing the internet through a tunneled connection (e.g. PPtP tunneled over PPPoE to deliver public IP's) and that creates problems with MTU/MSS when using another PPPoE connection inside your network

savagedavid

Good to hear. I wonder if MikroTik can give us the pin layout so we can build it into our power systems?

savagedavid

Please keep us posted, I am having the same issue.

savagedavid

Curse you MT for teasing us with such mouthwatering new products! I can wait to get my hands on some of it. The RB750UP is exactly the product I have been waiting for, since currently we have to manufacture our own multi-poe injectors to use with the common rail battery backup PSU's that are working...

savagedavid

Sorry out of ideas then. I have never had any issues with XP myself.

savagedavid

I admit I am also taking a few shots in the dark here. What happens if you uncheck "Always Broadcast"? This essentially stops the DHCP server from sending a broadcast check to see if an address is currently in use. Long shot, but worth a try.

savagedavid

it looks like the XP machine is trying to renew an IP given to itself via Automatic Private IP address. Can you disable that setting and see if anything happens?

savagedavid

Have you enabled logging for DHCP server? e.g.

/system logging add action=memory disabled=no prefix="" topics=dhcp

This will give you much more detailed logs and could provide us with better clues as to the problem.

savagedavid

AFAIK there is currently no 100% effective way to detect all Skype packets for effective QOS. There are some limited success L7 filters, but it seems every new Skype version changes the way it uses the network so it will probably only be 40-50% effective. The filter below definitely captures packets...

savagedavid

@Normis, I'm in Perth Australia and although I would love to attend the Brisbane MUM I doubt I will be able to make it(opposite side of the Country). Are there any online courses I can do for the MTCNA? we don't offer online courses, sorry. but just so you know, there will be people from USA and Eu...

savagedavid

Hi Justin, MT should change the pre-requisite to "MTCNA or relevant experience".... There are a lot of people who MTCNA would be a waste of time for, but would find MTCRE useful. I don't necessarily agree here. I think people mistakenly think the MTCNA is a "basic" course. It is...

savagedavid

We have committed to OZ-MUM. April 15th is our US tax day so this will be a good escape. I am looking forward to the show. I'll be the guy in the roc-noc T-Shirt. Stop by and say hello. We have some free MUM vouchers available for the asking. Free L4 license and free food. You must attend to receiv...

savagedavid

Damn, was hoping for MTCRE at a minimum

If there is enough interest...
I am sure a plan can be made

savagedavid

I have written a Wiki entry for this. Check under http://wiki.mikrotik.com/wiki/Display_v ... be_devices

savagedavid

Loopback address has no practical application here is why. Like you said, there has to be at least one link working (connection wire/wireless) to the device. So, you have interface with ip to connect. You don't need any loopback interface etc. since there has to be at least one virtual or physical ...

savagedavid

Travel will be a challenge but I would certainly consider coming

savagedavid

The other advantage of loopback (especially in MPLS setup) is that the loopback address will not go down if one of the interfaces is disconnected (as might happen with an IP on a WLAN). It also helps with keeping Source IP consistent when using it in RADIUS or anywhere else that you specify source IP.

savagedavid

> Did you try this configuration? ...(MPLS) No, I haven't tried it, but I did notice this statement on that page: "802.11n speed is limited over WDS bridges, this method doesn't have such limitations" I don't understand why bridging with WDS would limit the speed. Does anyone have more in...

savagedavid

Simple queues really just transparently generate items in global-in, global-out and global-total. I know the manual says: If you have simple queues and queue tree in the same HTB - simple queues will get traffic first. But that isn't how it actually works. You are totally correct. I tested it out u...

savagedavid

Fair enough - I will test it out myself (I don't mix queue trees and simple queues so I am only referencing the manual). If it is the case we need to lobby to have it changed.

savagedavid

Queue trees attached to global-in and global-out always override simple queues. Use those instead. This is not the case. A Simple queue will get traffic before the queue tree. See: http://wiki.mikrotik.com/wiki/Manual:Queue for more details Whatsoever, only thing I managed to make is limit in downl...

savagedavid

in most countries it is illegal

savagedavid

I have put up a wiki article detailing how to display voltage along with cpu and mem. Please give me feedback if it is helpfull.
http://wiki.mikrotik.com/wiki/Display_v ... be_devices

savagedavid

With OSPF on routing-test I have had several cases where the default instance fails only to start up again after a few reboots. Also routes seem to be persistent and don't get removed even when they are no longer valid (e.g. when removing an IP address from an interface often the route will remain b...

savagedavid

Up until 3.23 it was distributed as a regular package able to run with the standard routing package and also as a beta (test) package. This is no longer the case it would seem. Now you would have to run the routing-test package to run MPLS. Since I have had stability problems in OSPF with the routin...

savagedavid

That is the beta package - are you saying there is no stable release for MPLS?

savagedavid

You cannot bridge a wireless interface running in Station mode. You need to use station-pseudobridge or station-pseudobridge-clone. Alternatively you can use station-wds mode with wds enabled on the AP.

savagedavid

so is there any answer to the mystery of the missing package?

savagedavid

to be sure I downloaded the all-packages file and checked in there too...

savagedavid

It is not there - only the beta package is available

savagedavid

I hope I am not missing something obvious here, but from version 3.24 onwards the MPLS package is no longer available. What has happened to it?

savagedavid

My boss's main objection initially to the Mikrotiks didn't come from any deficiencies in the hardware, the problem was the casing and the DIY approach. Agreed, I sometimes feel embarrassed going to a client with an indoor RB450G unit. No box, manual, etc. Whatever happened to the RB532's that Mikro...

savagedavid

Agreed on almost every point. I would have 2 applications: A "standard" client who would be very happy with a plastic case RB750 style unit, and a "professional" client who would demand the 1U/2U style device in their rack. Both unit styles have their place. For outdoor applicati...

savagedavid

That limits you to a single (very expensive) unit for every application. What if you want 9 ports on your router (e.g. 493AH) or even 450G as in previous discussion?

savagedavid

I didn't say it's unrelieable. they are both very good, and similarly powerful. one of them is in a plastic case, and lacks a serial port. also RB450 now come with Level5 license (!) whereas RB750 comes with Level4 I hear all of that and agree in most cases. However the problem I have is even with ...

savagedavid

In Winbox click Make supout.rif ...

Third menu from the bottom

savagedavid

All of a sudden Usermanager is causing my router to sit at 100% usage and will not authenticate clients. System is an RB433AH with an 8gig Compact Flash. Userman database is stored on CF. Running 3.17 with latest bios version. If I disable the usermanager package CPU drops to 1% and the board works ...

savagedavid

Yes it is client traffic

savagedavid

If you use Mikrotik User Manager it includes a self-signup option built in - virtually no setup is required. Check the Wiki entry for UserManager - it is quite well documented.

savagedavid

if your PC router is a User Manager radius server and the Hotspot make sure you specify an outgoing interface on your masquerade rule, otherwise the loopback address wont be presented to the User Manager and it will cause errors.

savagedavid

It is DHCP requests.

savagedavid

Hi Headstrong

We are currently working on a local payment gateway that can intergrate into virtually any RADIUS system (we are currently testing it with User Manager in an active hotspot)

Contact me offline for more details.

savagedavid

Another tip - if you are looking for speed and dont need firewall / nat features, disable the Connection Tracking system (IP -- Firewall -- Connections -- Tracking). This will give a good 10-15% speed increase.

savagedavid

Update: Note your User Manager AND your highsite must be running 3.10 for this to work!

savagedavid

ISA cannot do ANY type of load balancing at all. It is very primitive in that respect. It can routing without any problem via Windows Routing and Remote Access - dont expext miracles beyond basic static routing though. Look at ISA as more of a "client and application management server" rat...

savagedavid

The Hotspot Address List feature is a great one for me - it has solved a problem I have been working on trying to have different "classes" of hotspot user routed down different bandwidth lines. This makes it super easy to do! One more request though - can you make it possible to specify th...

savagedavid

Need more detail. Chances are if you are behind a DSL router that you need to add a mangle to change the MSS value - this has been fairly well documented elsewhere.

savagedavid

Using firewall passthrough / mangle will essentially do the same thing as a queue and with the same limitations (except it will use less resources). The queue is a lot easier to monitor in real time though.

savagedavid

A real simple way would be to add a queue on the satellite interface - not perfect because it will lose the count if the board reboots, also it is (apparently) not 100% accurate. But for your purpose it should work fine.

savagedavid

Today I did a system reset, upgraded the unit to 3.9 and installed from scratch. I still have the same problem - no walled garden entries work - eventually it gives a proxy timeout. I have disabled the transparent proxy setting under the default user profile. Since all authentication comes from Radi...

savagedavid

Hi Omega00 I tried all options for disabling the proxy. New information I have suggests that the custom website we use for the hotspot is based on version2.9 files, and there are now altered / additional files in version 3. We are updating the custom pages with a ver3 template to see if that solves ...

savagedavid

Not sure what you mean by "legal". You can use Verisign or Thawt for a paid option, or you can try cacert.org for a free option.

savagedavid

Use HTTPS authentication instead of HTTP

savagedavid

Default Authenticate is not a flip flop! You can set the default behaviour under the wireless menu and then override the default behaviour using access/connect lists. default-forwarding (on AP) – gives ability to disable the communication between the wireless clients default-authentication – enables...

savagedavid

A simple way would be to masquerade the network if you dont mind having a natted output. This will effectively hide your network behind the router but still allow all outgoing traffic. Currently the last rule in your list will drop ALL traffic in the forward chain, in and out, so the result you are ...

savagedavid

Do you have a backup of the router? If so you can do a netinstall onto the CF using a cF adapter and any windows machine running Netinstall. This should repair the problem as it initiates a fresh install when the CF is first booted on the target machine. It wont affect the license either. Afterwards...

savagedavid

Quite a process to fix it seems. I tested the walled garden on a stock router running a new install and it works fine - it seems the problem might be an upgrade issue from 2.9 to 3. I cant restore the production hotspot as easily, but I will let you know what happens when I get to it.

savagedavid

I am currently experiencing similar problems after moving from 2.9.50 to 3.6 - walled garden entries gives a proxy timeout even after disabling all web proxy / transparent proxy features.

savagedavid

Support for TE in 3.7 mpls package is rather limited - although it supports TE tunnels, there are limited abilities to direct traffic over them (e.g. no way to direct VPLS or MPBGP IP VPN traffic over TE tunnels). As of version 3.8 new mpls-test package will be introduced that together with routing...

savagedavid

Does anyone know if there is any information on the Traffic Engineering support included in the 3.7 version of ROS? A command line reference maybe or any kind of documentation.

savagedavid

I am busy setting up a lab to test various MPLS configurations. You can check my results so far on the WIKI: http://wiki.mikrotik.com/wiki/MPLS_Lab_Setup I am hoping to start up a conversation around this to test the capabilities of MPLS and see how it operates with regard to RouterOS Please give me...

savagedavid

well the webpage doesn't list this file because we removed it due to the mentioned problem. notice that webpage only lists RC11. Please wait until a fix for X86 is released. It seems like that uses the new format CPU naming convention but the files are on the server under the old names. I managed t...

savagedavid

Are there any plans to implement CARP or a form of it in upcoming releases of ROS3? Currently I have found the best proxy proxy method (for myself) is using MT as the transparent proxy and then using a Squid Acceleration proxy as the parent. It would be great to be able to use multiple squid proxies...

savagedavid

After upgrading to to 3.0RC9 my routerboard 532, which is running a hotspot on the wireless and also running the User Manager system, now refuses to authenticate hotspot users via radius. I keep getting a RADIUS server timeout message. It was working perfectly before the upgrade. I tried removing th...

savagedavid

That would require a MT PPPoE Concentrator at all tower locations correct? If that was the best solution that i know that works well, then i wouldn't have a problem doing that... Matt Matt Having a PPPOE concentrator at each highsite is pretty much the WISP standard in my part of the world. Most wi...

savagedavid

It sounds pretty straighforward - assuming not too much interference from outside you should be able to reach 30-35mbps each way on your link. I have achieved up to 70mbps total throughput using 532R5's - you dont need the A version by the way - the extra memory wont be needed. The advantage of the ...

savagedavid

Why are you using WDS for a backhaul link? While WDS is very effective in certain situations its not designed to be used in long range links.

Have you tried a PTP setup instead and measured the results?

savagedavid

Would a system with 2 quad core xeon processors be supported?

It's pretty much kernel dependent so figure anything that a Linux 2.6 kernel would support would be supported.

savagedavid

I have just upgraded one of my backbone links from RB532 to a PC based router. It is a link over 7.4KM using R52's either side. If I run 5.8 Turbo with Nstreme, Polling and Dynamic size I get incredible results - up to 75mbps on a tcp bandwidth test. The problem is the link is very unstable - it run...

savagedavid

Thank you for the positive feedback - I will continue to work on it.

savagedavid

The dst-limit is an "accept" rule - so this rule will match if limit is at or below the specified amount. You would need a drop rule of some sort after the dst-limit rule to limit the sessions

savagedavid

I have been thinking about providing some online training on Mikrotik. I have a small beta training session available here: http://www.mikrotiksa.com/mtbasic/BasicSetup.htm . Please check it out and tell me if it is something you can see being useful. All comments whether good are bad are welcome. T...

savagedavid · Re: 2.9.44 Changelog Thank you I missed that completely!

Thank you I missed that completely!

savagedavid

The Changelog link for 2.9.44 seems to be broken. If anyone has the changelog can you post it please.

savagedavid

I will upgrade my RB230 to beta3 and see if I can achieve similar. Unfortunately tech support from our local cell provider is non-existent, so I am on my own here...

savagedavid

I never did get this to work. It was just out of interest and not a requirement of mine. When I get a chance I will try to get it operational again.

savagedavid

SATA is only supported in ver 3 unless the motherboard can run compatibility mode

savagedavid

I have to say though - I have a Gigabyte mobo with VIA chipset running on one of my highsites with a 3ghz celeron and 256mb ram. It runs 8 wireless interfaces, can handle almost any amount of bandwidth and is fantastically reliable. So you just never know...

savagedavid

Having worked on a number of HMS systems I can tell you that all of them have custom requirements for writing information into the system database. You will almost have to take it up with the creators.

savagedavid

I am waiting for some of those juicy new high speed routerboards promised at MUM. Q2 2007 is almost here...

savagedavid

If you redirect port 443 it will not actually proxy the request - the proxy will merely pass on the request and not cache it. There is probably no benefit in caching HTTPS. Also how would your users feel knowing that there might be a chance of their secure transactions being cached (even if you know...

savagedavid

After speaking to the Mikrotik guys at MUM it would seem that adding MPLS capabilities is an extremely complicated procedure. It is under consideration, but I think that most effort is being put into getting a stable ROS3 version suitable for release. Once that is in place additional features like M...

savagedavid

you need to dst-nat the GRE protocol too

savagedavid

Once the RB112's become part of a bridged hotspot all authorization happens through the hotspot, often meaning you cant telnet or mac telnet or access the routers behind the hotspot. Create IP Binding passthrough entries using the MAC addresses of the routers and that should solve the problem.

savagedavid

I think you know me well enough to ask a question like that! It was definitely something in the way the hotspot works through a bridge. DHCP was being assigned normally and if you added a hotspot bypass ip you could surf on that IP even on the non-operational AP's

savagedavid

I managed to solve the problem by bridging the ethernet side ports instead of routing. I was still not entirely satisfied though as this solved the problem but did not explain why it was happening.

savagedavid

Apparently you need a very specific init string - which provider are you with?

savagedavid

Hellbound wrote: can we have multiple userman synchronization? and backup server if it is down and etcetera? I need two or more userman server in my network. thanks in future we will have it, but first we need to finish the main features of the usermanager and after that we could start to work feat...

savagedavid

Correct: you cant sum the 2 lines together and get 3M if thats your aim. If you want to load balance between the lines then that is possible - there are a number of different methods for doing this.

savagedavid

Yes I agree - to handle that many clients (750+) requires a lot more than the standard squid conf. Also what hardware are you running? It should be around a 2.8Ghz with 512mb RAM minimum.

savagedavid

I very much doubt an address list will cause slow browsing - unless you have created a loop in your filter rules - but then you will notice very high CPU activity.

savagedavid

Why dont you add the "add to address list" rule in your mangle rather than in the firewall since the mangle happens before the firewall filter.

savagedavid

Using nstreme dual and / or bonding you can achieve the same results. Turbo mode automatically uses double the bandwidth.

savagedavid

Haha yes - many cups of strong coffee and late nights!

I have gotten this to work - I am busy putting it on the Wiki. I'll ost a link when it is done

savagedavid

Also note this rule needs to be above your proxy dstnat rule

savagedavid

This is fairly well documented elsewhere. If you want to transparent proxy to squid you need an accept rule for the return traffic from the squid proxy, otherwise the return traffic will be re-natted and never reach the client. ip firewall add chain=dstnat in-interface=ether-internal src-address=x.x...

savagedavid

I have come across an interesting issue with the hotspot i am running. The old configuration looked like this: ADSL | (RB532 - hotpsot + userman) | ethernet bridge | rb532 | WLAN -- RB532 / \ RB532 RB532 -- RB532 \ RB532 (multiple WDS bridged RB532's) This configuration worked perfectly but i only h...

savagedavid

Nice one - thanks. I see it is for upcoming ROS3. This is fine however, as the interface probably wont be ready before the release candidate anyway.

savagedavid

The prerouting mark happens BEFORE the forward mark, so your rules would not work. You dont need the forward mark rule to policy route HTTP. You can use something like this: /ip firewall mangle add chain=prerouting protocol=tcp dst-port=80 action=mark-routing new-routing-mark=http-route comment=&quo...

savagedavid

Hi

Does anyone know if the API for Web box is available? We are trying to develop a custom web interface for Mikrotik to allow limited configuration for end users without having to teach them how to use Winbox!

savagedavid

The best way to do this is to use Point to Point addressing on your network. This means using /32 addresses on your client side. Then you dont need any tunnels of any sort and you dont waste addresses. Your routing will be more complicated though.

savagedavid

It was quite an effort, we used User Manager to generate several hundred random vouchers of various types (1 day, 1 week, 1 month etc.) Then we loaded this data into a database and assigned them out via the website Credit Card authorisation system. This system in completely independant of the Mikrot...

savagedavid

For interest here is the logfile output: 03:13:06 system,info device changed by admin 03:20:14 async,ppp,debug ppp-: ppp-out1: PPP restart 03:20:14 async,ppp,info ppp-out1: initializing... 03:20:14 async,ppp,info ppp-: ppp-out1: initializing... 03:20:14 async,ppp,debug ppp-: ppp-out1: PPP started 03...

savagedavid

No problem - I have done that

savagedavid

I have just installed a Huawei Mobile Connect Model E620 onto my RB230. It detects fine and I can add a PPP connection. On bootup when I enable the interface it gets as far as link established, but no IP address or route is assigned, and everytime I connect after that it just cycles between initiali...

savagedavid

That is true. The bridging solution will allow seamless roaming across wireless interfaces

savagedavid

You can have 3 hotspots all sharing the same user secrets database. Alternatively you can bridge the wireless interfaces to the ether. Just make sure you running the latest MT version.

savagedavid

You can have 3 hotspots all sharing the same user secrets database. Alternatively you can bridge the wireless interfaces to the ether. Just make sure you running the latest MT version.

savagedavid

Having gone through this myself I can tell you that the licensing guys are quite reasonable about things. Mail them and try!

savagedavid

It's quite a challenge to get QOS cross platform - are you running SIP or IAX?

savagedavid

What system are you using to log them in?

savagedavid

That is how OSPF works. If you specify the "Distribute Connected Routes" setting it will do that. It is designed to work like that. Are your backbone routes built dynamically? You could try specifying Redistribute Static Routes if not.

savagedavid

I have thought about that - in fact if I could get a way to intergrate the trial system into the credit card verification it would solve the problem quite nicely.

savagedavid

Hi I am running a hotspot that uses 2checkout.com for credit card authorization. It has been working quite well with 2checkout.com in the walled garden, but recently many banks have added an extra layer of security where the subscriber has to authorize on his banks' site as well. This creates a prob...

savagedavid

I believe this has been brought up before - we might see something in version 3...

savagedavid

I have a post describing the issues here: http://forum.mikrotik.com//viewtopic.php?t=12177&highlight= As mentioned I still dont know if it is a problem with the WDS mode or if it is interference due to very high wireless usage in the complex. I have used WDS before on 4-5 nodes with great succes...

savagedavid

Nice - sounds exciting. Currently I am having latency issues when using more than about 6 nodes in a close range WDS bridged hotspot type situation. I am hooping this new mode will improve things.

savagedavid

I had a similar problem to this on a WRAP 1E1 where the wireless settings would revert back to default. It turned out to be a corrupt Compact Flash.

savagedavid

That looks like the router logs, not Usermanager. It seems that it is not contacting RADIUS at all, do you not perhaps also have a local secret entry that its comparing against?

savagedavid

Looking at my problem closer, I've noted the RX counts are always zero (0) and the signal is always -95 in the reg table when in WDS mode. That is usually an indication that the WDS connection is only "one way" i.e. the 112 has linked to the AP but the AP has not linked back again. No tra...

savagedavid

Take away his PC? That would kill most of my users

savagedavid

While checking out ver 3 beta I noticed an exciting new feature. Under WDS there is a mode called WDS (dynamic) Mesh. Is there any information on what enhancements this offers over standard WDS?

savagedavid

The simple answer is: no. You cannot "join" two lines together to get a single higher speed line.

savagedavid

Have you checked the User Manager logs for a reason? Without this info we can't help you too much I am afraid.

savagedavid

Can the usermanager handle multiple timed billing profiles, i.e. by the minute, hourly, daily, etc. so a person could buy any item x at any qty. So you could set up a 10 min. free account, a $5 daily account, and a $20 weekly account or whatever you wanted to charge? Yes it can How about the abilit...

savagedavid

beta 3 has this feature in the access list

savagedavid

You can do this with scripting at the moment. Try something like: :local i 0; {:do {:set i ($i + 1); :put $i; :delay 2} while (($i < 5) && ([/ping 196.22.185.221 count=1 interval=5]=0)}; :if ($i=5) do={ :log info "Gateway is down!" This will ping an address 5 times at 5 second inte...

savagedavid

I am aware of the noise problems associated with too many AP's close to each other. This could well be a problem, but there is no other choice as the apartment layout is extremely complex and difficult to project signal everywhere - in fact we will probably need another 2-4 highsites to completely c...

savagedavid

Sorry - I thought my details were easy to find - it's on the Mikrotik site under trainers for South Africa. My email is d [at] etuan co za

savagedavid

Currently I am running static WDS only with a single link per AP - no redundant links. Signal strengths between units are -60 to -70 at worst. I still get issues once too many units (more than about 10) are online. Bandwidth starts dropping to below 1.5mbps

savagedavid

Are you trying to torch on the bridge interface itself?

Can you see any traffic flowing through the interfaces?

savagedavid

Assuming you want to change all 8 priority to 5 priority from command line you could issue:

/queue simple
set [find priority=8] priority=5

This will all all 8 priority to 5 priority

savagedavid

Hey GWISA - yes I remember the PTA course well. However if I remember your problem seemed to be reaching the hotspot across several WDS interfaces - If it transited a WDS node then the hotspot was not reached. I am not experiencing that particular issue - the hotspot always works. My problem is gett...

savagedavid

Hey GWISA - yes I remember the PTA course well. However if I remember your problem seemed to be reaching the hotspot across several WDS interfaces - If it transited a WDS node then the hotspot was not reached. I am not experiencing that particular issue - the hotspot always works. My problem is gett...

savagedavid

Also remember that if you can use different polarity sectors (say 2 horizontal and 2 vertical) you can get up to 20dB seperation between signals. This might not be practical in some applications, although its easy to switch client cpe's from vertical to horizontal and back.

savagedavid

If you have configured the router as a transparent shaper then all the management will take place on the bridge

savagedavid

I have recently deployed a MT hotspot running over quite a large area. It is several apartment blocks in a complex where there is lots of concrete, glass and steel, which has necessitated use of 10 repeater stations running WDS. The Hotspot itself works perfectly - no problems there (running a P3-73...

savagedavid

I have scripting experience and I am reasonably sure I could script it. However I was hoping that it could become part of a future release, since it seems to be a fairly minor modification of the trial function.

savagedavid

I am using User Manager with Hotspot and it is working great! One featre I would like to have though is the ability to lock a voucher to a MAC address the first time it is used, so that the voucher cannot be used from a different laptop once it is activated. I am hoping it would not be too difficult...

savagedavid

Next request 1:

Ability to daily mail users their usage stats based on the email field in User Manager. I could write a script to do this, but it would be nice to provide the option for users to set this up themselves.

Next request 2:
Ability to run script when a users download amount is exceeded

savagedavid

If it is posible then how ?

this can http://www.ipacct.com have 15 groups

First go do the research then ask how. You will more likely get help if you at least get a basis to ask questions from.

savagedavid

I am sure there must be an easier way, as most hotspot data is returned by direct function calls to the router (it would seem).

Any ideas on this Eugene?

savagedavid

From command line this will return the signal for a given MAC:

:put [/interface wireless registration-table get [find mac-address=00:85:49:8E:27:C7] signal-strength]

MAC can be entered without the colons too

Now to populate the hotspot status page with the data...

savagedavid

It's an interesting idea - I'll attempt to get it working and post result if I do

savagedavid

Maybe there will be grouping in a later version but perhaps for now you could use a prefix (e.g. group1- ; group2- ) etc then run a mangle based on the prefixes.

savagedavid

Initial tests seem to indicate it is now working correctly. I will post any further updates if required.

savagedavid

You will need to enable rstp on the bridges of all 3 units to avoid bridging loops and broadcast storms (which is probably what is causing the bad response times). You need to install / enable the rstp-bridge test package and then set it up in rstp settings under your bridge.[/img]

savagedavid

Thanks I will try it out today and post feedback

savagedavid

Possibility to have 2 or more addresses groups with diferent speed limits

Explain some more please?

savagedavid

OK so this is what I found. To get it working I had to delete all invalid routes and policy routes in the route table, then re-add the exact same routes but via command line. This seems to work as a temporary solution.

savagedavid

So will using CLI to add the routes instead fix the problem? Note that it was some of my existing routes that stopped working as well as new routes that I added.

savagedavid

use Linksys WRT54 as an AP ,it has an isolation option. You are kidding right? On your RB you can turn off default forwarding to stop clients on the same AP seeing each other. You can also use the firewall to block ports 135 and 443-445 to stop NETBIOS communication between PC's on different router...

savagedavid

Since upgrading my main router to 2.9.31 I am experience a serious issue. A ny new route I add through my outgoing (ether) interface appears with interface as unknown, even though the IP is valid and I can ping the gateway. As well as that, some of my current policy routing rules have also gone the ...

savagedavid

Thanks for the updated version - it is getting better all the time.

Next request please: Would there be any way to include a comment field in the User Manager user settings that would appear as a comment in Mikrotik when that user is authenticated (e.g. in pppoe interfaces or wireless registration)?

savagedavid

If that is the understanding then he will need a changeip.com account to dynamically track the changing IP address. Then he could use a script with a simple resolve statement to get the current IP of each side and use that to populatethe EOIP tunnel parameters.

savagedavid

I am not understanding your question - please rephrase

savagedavid

Then indeed it would not work!

savagedavid

I think it should be possible. Something like:

:local i 0; {:do {:set i ($i + 1)} while (($i < 5) && ([/ping 64.77.90.2 interval=3 count=1]=0)}; :if ($i=5) do={/system telnet... }

That would ping the IP address 5 times and if all 5 pings time out you could issue any arbitary commands.

savagedavid

When the packet leaves the proxy it will originate from the routers output chain from the routers outgoing IP address

savagedavid

An easy way would be to add the offending address to a dynamic address list and set a timeout value

savagedavid

I am confused by your question. The rate limit attribute is to limit download speed, not download amount.

savagedavid

Next feature request please: A way to group sets of users for easy sorting. E.g. I would have one set of users where MAC address is username that authenticates against access list, and another where i generate hotspot user vouchers. A way to place these different entry types in different groups (fol...

savagedavid

Excellent - I cant wait.Thanks uldis!

Search found 253 matches