MikroTik

anjey

SO that's why proxy is not an option.

Still an open question WHY resolve could not return all IPs in list context and WHEN it will be implemented? =)

anjey

even with proxy you can simply do any load-balancing scheme (for example, PCC-based)

it's not a load balancing just fixed ISP for fixed IPs

Btw if I use proxy how router will see src|dst address? For NAT src address will be router's address or am I wrong?

anjey

so why proxy is not an option? we have 2 ISP here so 2 possible routes for real traffic. Now it determines routing table for packet based on client IP address. The problem is that I do not know how to split client traffic based on criteria mentioned above when using proxy. Now my configuration look...

anjey

yep with nslookup no problems

the question is how to do this on mikrotik inside a script using resolve or similar command

anjey

proxy is not an option =(

question still open how to get other ip's for the host name not only first one

anjey

Hi there. I've got MT 4.3 on RB450G up and running. I need to restrict access to some social network sites. With layer-7 feature i've managed to achieve what need, but I want to minimize overhead of L7 usage so I want to ban this sites by IP first. The problem is that some host names have more than ...

anjey

I can try it tomorrow morning

But about network topology -- i could not change it, i have only access to my local segment -- 192.168.122.0/24, everything else is not under my control.

anjey

Put all networks with free access before your hotspot interface and routing them.

u mean I should put "accept" rule for this networks before any hotspot rules?
P.S.: we have OSPF here so with routing everything is OK

anjey

So no suggestins? =(

anjey

its quite easy if you understand how your nat rule works. just modify your masquerade rule to say, src-nat action=masquerade where dst-address!=192.168.0.0/16 .. hence it will masquerade anything NOT going to the 192.168.0.0/16 range. i've tried to do so, but traffic simply stop going to 192.168.0....

anjey

My clients have 192.168.122/24 addresses, I need them to access 192.168.0.0/16 network without been NATted. And they need to be NATted as 192.168.105.12 only when accessing everything else. Walled Garden allows them to access 192.168.0.0/16 without authentication but they are still NATted as 192.168...

anjey

so this setup is impossible?
i really need to know

anjey

anyone???

anjey

Hi! Sorry for my bad English. I've installed my first hotspot server on mikrotik 3/ I had no experience in configuring hotspot before. I have router with two interfaces local: 192.168.122.1/24 out: 192.168.105.12/24 I've set up walled garden ip address list 192.168.0.0/16 and all unauthorized client...

anjey

192.168.105.13 DO NOT receive announcement for 192.168.3.0/24 but do receive for 192.168.3.254/32 (IP address on 702 interface of my router) This route is not listed in IP routes list on other OSPF servers, but when i do traceroute to 192.168.3.254 it goes (not dirrectly through my interface 105.34)...

anjey

i didn't add that interface to OSPF at all, that's "702" interface and it's not listed on OSPF

anjey

Put the interface you don't require in passive mode. That essentially will disable OSPF on that single interface
...
Based on your original post, I presume this is what you're looking for...

How could I accomplish that on MikroTik?

anjey

hm... ip firewall filter add chain=input dst-address=3.254 action=reject reject-with=icmp-network-unreachable ? yes, I've setup this currently. But this leads to 192.168.105.34 reports: destination host unreachable ... but this is not what i need. I need that this 3.x network should not be announce...

anjey

any suggestions?

anjey

Hello. I have a following problem. I have a router with 3 interfaces and OSPF routing enabled. I need to hide one of the interfaces from other routers. I've tried everything: * I do not add network of this interface to OSPF * I've set up routing filters for this network * I've added some firewall ru...

anjey

Thx for quick reply!

Will that be 100% safe? No caveats? Thx.

anjey

Hello again.

Currently my PPTP setup eats two IP addresses for each VPN connection. Is that possible to use only one for each tunnel? Thx.

P.S.: Mikrotik version 3.17

anjey

So as I can understand from this document

1. Mark packets by service type in Prerouting mangle table
2. Prioritize 'em in global-in queue
3. Mark packets by client type in forward/postrouting mangle table
4. Shape packets in global-out OR interface queues

Is that strategy correct?

Thanx

anjey

Appreciate for this links. I think i need a few days to get everything up and when i'll get things working i'll post my config here. (Or if i'l have some problems... hope there will be no problems)

Thx for your help!

anjey

So as I could understand from your quote i can so shaping on outgoing interface with queue tree on outgoing interface and priorities on global-in global-out? But how should i distinguish traffic for shaping? If i do priorities I have 5-6 at least and 20-25 at most packets marks for EACH client. Shou...

anjey

Updated to latest 3.17 ... still could not solve my problem.

Anyone? Pls help!

anjey

lol search this forum it was discussed one week ago

anjey

when issue with xen and queues will be fixed?

thx

anjey

Are you following these rules: When marking packets and creating Queues for them, you must not forget other packets that you may have not marked that would travel the same direction. Because they will have unlimited speed. all packets are marked! pls read my first post closely, i've wrote that queu...

anjey

anyone?

anjey

How can I update my router and preserve license?

Thx.

anjey

8 X chain=forward action=mark-packet new-packet-mark=256k out passthrough=yes src-address-list=256k/256k dst-address-list=!Not NAT Networks 9 X chain=forward action=mark-packet new-packet-mark=256k in passthrough=yes protocol=tcp src-address-list=!Not NAT Networks dst-address-list=256k/256k src-por...

anjey

Up.
Still needs help! URGENTLY =(

anjey

First possible solution: DISABLE "path through" on Packet Marking rules and MOVE packet marking rules RIGHT AFTER appropriate connection marking rule. SO when your packets get's marked they stop following mangle chains. Second possible solution: Don't mark connection but do JUMP into anoth...

anjey

any suggestions?

anjey

I am using the 3.14 MT, and LAST mangle rule's random can't be 100. so you means I should change the four rules , random should be 20 if I have 5 ADSL .the fifth rule should no random. is that right? thanks a lot yes 5-th rule should be mandatory 'cause what will u do with connections which bypass ...

anjey

Hello. I'm trying to use queue trees to prioritize AND shape traffic. I want to make few clients with 256k/256k dl/ul traffic limit and prioritize ICMP, HTTP, POP3, DNS for them. I've started by simply adding two child queues with priorities (all packets in mangle are marked properly and all queues ...

anjey

up-up =)

anjey

LAST mangle rule should have random=100 or no random at all, 'cause there will be a chance for some connection to become not marked

anjey

i guess you should add Mark Connection rule (in fact five of them) first four with 20% probability (more or less -- you should play with the numbers) last one with 100% After that mark packets for each marked connection and NAT every packed on appropriate DSL interface -- depending on packet mark An...

anjey

did you use the latest version empty strings file? I used one, supplied with Dude 3 RC 2. I took russian and translated IT. does it work correctly when you put it in the latest Dude v3 language folder, and select it as a language? Yes i've tested everything that i could, the only problem (same with...

anjey

as i see in your configuration examples, then you are using addresses from private address list, then you can use other subnets like 10.0.0.0/8 or 172.16.0.0/16 networks for your pptp.Of course, you can set up limitation directly in /ppp profile and that way ensure, that all that connect to ppp usi...

anjey

Ok, i've got it translated, what should I do next?

anjey

How to add single quote to strings? should i escape it with \ or double like in pascal??

anjey

I can translate to ukrainian and polish as well, is that actual yet?

anjey

anyone?

anjey

I resolved similar problem this way: :foreach i in=[/ip firewall address-list find list="Blocked"] do={/ip firewall address-list remove $i} /ip firewall address-list add address=[:resolve "somehost.com"] list="Blocked" Schedule it once in 5-15 minute and create rule for...

anjey

Ok, thank you people, now everything works as it should. But the story continues: now I need to distinguish traffic from VPN and mark it in mangle section. The problem is that DHCP server and PPTP uses same address pool (that's how it supposed to be, 'cause IP addresses amount are limited here). Any...

anjey

That's 2.9 mikrotik (as i've mention in my first post).

I've just enabled routing-test package, need to reboot router but can't do that until 19 PM EET

anjey

routing> filter
no such command or directory (filter)

anjey

can u please describe
1) add routing filter ( chain=ospf-out ) that will allow only 192.168.108.0/24 and drop the rest.
more briefly?

I've managed to work around problem with OSPF network areas tweak, now i want to know how to do that with routing filter.

Thanx

anjey

Ok, That part of my problem is resolved. Big thanx to you =) Now the second part. I've got OSPF setup on that mikrotik and i do not want client addresses assigned to them by pptp to expose on routes list (i've got router entry for 192.168.108.0/24 already, i do not want it to add all that 192.168.10...

anjey

Yes, client is Windows PC
i've tried to setup custom route, but VPN setups default route: 0.0.0.0 0.0.0.0 192.168.108.72 1
and
route delete 0.0.0.0

does not seemed work
any suggestions?

anjey

Hello I've got Mikrotik 2.9 router. I've configured PPTP and added user account. Everything seemed to be OK -- user can login to VPN from Internet and have access to Mikrotik's local network. But he get's he's IP as a default route on he's local PC. How to disable default route for him and make him ...

Search found 54 matches