MikroTik

leonset

That's what I was trying to say. I have huge lists of firewall filter rules and some 40.000 address list entries. I was wondering if conntrack on + fasttrack would be easier on the CPU than conntrack off and having each packet in the connection be processed by all the rules. You should've clarified...

leonset

I can confirm that the OID .1.3.6.1.4.1.14988.1.1.1.3.1.10 for CCQ only works if wireless protocol is plain 802.11. It returns 0 otherwise.
Many thanks for the detailed information!

leonset

I am querying OID .1.3.6.1.4.1.14988.1.1.1.3.1.10 on AP to get Overall Tx CCQ for a certain wlan interface.

I always get 0 on that OID. RouterOS versions range from 6.27 to latests betas using wireless-fp/wireless-cm2 packages and nv2. Which ones do work for you?

leonset

How many rules are in your firewall filter/mangle/nat? Queues? I remember an issue I had some time ago: on a 1036 acting just as FW and OSPF gateway, I created a fw rule to check for L7 content. I just restricted by dst-port 80 and enabled it. CPU load was around 25-30% (normal usage is around 7%) b...

leonset

Already had a long discussion with support email to MT team, and they were unable to find anything. Well, then you need bigger hardware. Get another 1036 and set them side by side, they will share the PPPoE load automatically (I would set 3 in total, to make sure the system will still give service...

leonset

Hello, I'm interested on the CCQ OID's you used. Would you be so kind to let me know which OID you use for the RX/TX CCQ? Do you look for them in the client or in the AP? When I snmpget the values supposed to have CCQ information I always get "0". In fact, Mikrotik support has told me th...

leonset

In that case I suggest you reenable ConnTrack, generated some supout.rif files when the problem is happening and contact support@mikrotik.com with as much information as possible. How many PPS and how much bandwidth are we talking about? How many rules do you have in you firewall filter/nat/mangle?

leonset

But, is it overloaded? Which is the CPU usage? Have you used "Tools, Profiler" to find out which proceses are the most time consuming ones? Why did you tought about disabling ConnTrack? Don't remove the seats of your car suposing it will run any faster! (and you will not be able to bring ...

leonset

Ouch.
But everything is working fine.
So, do you mean, Connection tracking should be on for PPPoE router ?

Yes, it should. Set it as "auto" and get bigger hardware if load is an issue.

leonset

Leave it as "auto" and Mikrotik will wisely choose to enable it or not. If hardware resources are an issue, set it as "auto" and if RouterOS enables it, try to find out why and then if you can move/disable the service which switches tracking on. Many features require ConnTrack to...

leonset

Some suggestions: - You can't have a port both as a slave and in a bridge. - Check to make sure you are not generating a loop with some other devices. - Try with Data Rates set as "configured". - When you are connected to the AP, generate traffic for a minute, what is shown on Registration...

leonset

Leonset's suggestion has much merit. If you have servers with a service name BACKUP and put them in the same locations as the primary servers, then any backup pppoe session can be configured to use the service name BACKUP and they will only connect with the BACKUP servers. Yes, this is best choice....

leonset

What about using "service-name" on your PPPoE Clients? You could setup a new PPPoE Server instance (or add another routerboard) with different service names and then reconfigure your clients with two service names for primary/backup PPPoE link, then change OSPF instance redistribute option...

leonset

Not sure if I understood your scenario properly, but my suggestion would be to use something like 10.0.0.1 as "Local Address". Your PPPoE clients will get a PtP route to your PPPoE Server which they will reach through the tunnel (which can be encripted, etc). That 10.0.0.1 address will be ...

leonset

You have to fill in the "service name" on the PPPoE client if you want it to connect only to your PPPoE server with a specific "service name". Also, on latests versions there's an option "pppoe-server - added pado-delay option;" which can be used to give less preference...

leonset

In gns3 you can connect to a router with winbox just by double clicking without loopback without putty-telnet? Not AFAIK, at least on Mac you have to setup a cloud device conected to a Tap interface in your MAC, then using Winbox neighbours (those 3 dots) virtual RouterOS will eventually show up. A...

leonset

Same thing here. Upgraded 3 units, two of them are ok, but the third one keeps downloading a file every time i try to get into the unit. Tried power cycle, different browsers, clear cache, reset the switch with the front panel button and the jumper... The reset did change the device IP to default 19...

leonset

Very needed update!! Thanks!!

leonset

Note: wireless-fp package is discontinued in this version. It needs to be uninstalled/disabled before upgrade. Use wireless-rep or wireless-cm2 instead. The upgrade process of the latests RC and the final version must upgrade automatically wireless-fp to the most reliable alternative wireless packa...

leonset

If you don't use multicast-helper=full, the DST-MAC of a multicast packet should be multicast type MAC (i.e. 01:00:5E:00:00:00 for OSPF) and wireless interface will only send ONE copy of the packet regardless of how many conected clients it has, albeit at the slowest basic rate set on the AP. To ove...

leonset

Make an export to file instead of a backup in the VM. Backups are intended to be restored on exactly the same unit/kind of hardware.

Take care when restoring the export if you have renamed the interfaces, as name is whats used to associate interfaces with values (ip, fw rules, etc).

leonset

Hello, The Wiki says that using multicast-helper=full will make the DST-MAC to be changed to the one of the receivers wlan interface, allowing it to be send at max modulation. I have an AP with 27 CPE conected to it, and say 5 of them use multicast OSPF packets. If the DST-MAC gets replaced from a m...

leonset

Hello, I'm using python API and I would like to remove a file. The name of the file will follow a pattern, so I will have to find it before deleting. The equivalent console command would be: /file remove [find name~"stats"]; I'm trying things like this, but don't really know how to make th...

leonset

If anyone has ethernet issues with 922/912/911 boards with firmware v6.32.4, check my post here to get access back:

http://forum.mikrotik.com/viewtopic.php?f=2&t=105324

leonset

Just tested with a RB-911-G-5HPacD and firmware 6.32.4 and it looses ethernet conectivity if switch is 10/100. To regain access from local network, force eth port to 100/FD and/or connect it using a Gigabit switch/PoE/computer and/or upgrade to v6.34.2 from wireless. I hate this kind of bugs which t...

leonset

Hello, I have upgraded two NetMetal5 devices to the latest bug fix version (6.32.4) and I lost ethernet link on both of them. Luckly they are in my desk and not in the tower and this happend during my normal version test routine. Checking the changelog for the "Current" version I can read:...

leonset

http://wiki.mikrotik.com/wiki/Manual:CRS_examples

leonset

Is there any chance of emulating wireless interfaces with this setup?
For example, if you want to test WDS with some other settings and check how the network will behave.

I have used GNS before but I worked with ethernet like interfaces and did not try wireless ones.

Thank you

leonset

Enable at IP, Traffic Flow. It does output netflow v9 like traffic streams.

http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

leonset

You can also use an external tool like nTop.

leonset

Try this:

http://forum.mikrotik.com/viewtopic.php?t=47366

leonset

C1 (pppoe client1) |------ R1 (pppoe server1) C2 (pppoe client2) | |--- [OSPF routes] ----- R3 (main router) ------- Internet C3 (pppoe client3) | |------ R2 (pppoe server2) C4 (pppoe client4) This is the simplified network, where each component is: - C1 to C4: PPPoE client which get a real IP from ...

leonset

In the pppoe client, in the Dial out tab, uncheck "add default route" for PPPoE-out2 to 5, and leave it ticked only for PPPoE-out1. Then add routes/nat manually to route things on your PPPoE2 to 5 connections, otherwise they wont be used for anything.

leonset

Hello, In the firewall of a main router, I would like to be able of match packets for the IP's which are conected to a given gateway/router. Routes are distributed to the main router by OSPF from diferent routers which act as PPPoE servers and IPs are assigned by Radius server from a common ip pool....

leonset

Hello,

I'm having this problem with v6.13. Do you know if this problem still happens with the latests versions of RouterOS?

It's a remote system and I can't update it just now to test it myself.

Thank you!

EDIT:
This workaround works for me!

http://159.148.147.201/viewtopic.php?t=46659#p236253

leonset

Hello!

Yes, I can use only one license too... I should have updated this thread before!

Thank you!

leonset

The short answer would be "never", all changes are applied inmediately. But for example, if you were dealing with NAT rules, those rules are only checked on the first packet: if a connection is already stablished those rules won't be checked until the connection times up (/ip firewall conn...

leonset

please, has at least one of you contacted support about this? we can't fix it, if we can't see the problem With due respect, Mikrotik must implement the appropiate test suites to see the problem before clients face it. Full stop. Specially if the bug breaks any current feature or makes the router u...

leonset

I have used VRRP + IPSec in the past. Unfortunately I don't have access to those devices anymore to test with OVPN and I have almost no experience with OVPN. Use IP filter log+accept rules to check if and how packets are reaching your routers. Also, take care with your switch ARP cache (if using any).

leonset

Care to elaborate on this?

Already did so!
Just take some time to read some or all of the firewall related pages in the Wiki (I gave you the link in my previous post). I'm sure you will find there most answers to your doubts.

Good luck

leonset

So I suppose you still have a lot to learn about how firewalls work... no offense intended

http://wiki.mikrotik.com/wiki/Firewall

leonset

That seems way too low... I remember getting more than 4Mbps using pure IPSEC/AES-192 and the old RB450 (not g). Sorry, I don't have values for SSTP not PPTP...

leonset

If VRRP ip is not ping-available, OVPN is completely unrelated and you should find out why that VRRP IP goes down. I mean, if the IP is not working OVPN won't work. While having the problem, check the status/logs of the VRRP interface and if you can ping VRRP IP from R1 and R2. Also try no NAT out u...

leonset

Ok, your statement applies for the IP filter No. 3 (the RDP connection). But for the IP filter No. 2 (the SSH one) this doesn't apply. In fact, being a connection to the router, it seems I don't need any NAT rule, as the router seems to listen on port 22 on all its IP addresses (be it internal or e...

leonset

If I understand what you are trying to do, your rules are wrong. Check the packet flow in the Wiki, specially the first and third drawings: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow Basically, dstnat rules are procesed before ip filter. That make your "input" rules useless, because ...

leonset

Have you managed to solve this?

Thank you

leonset

I already knew that HD/lincense relation, but thanks for the clarification regarding QEMU. I haven't actually tried doing that though (as I don't have a spare license to potentially sacrifice). Thats why it would be very nice if OP could update us with his experience :) The problem is that I need to...

leonset

Hello! I'm planning on using GNS3 too but I'm not sure if I understood this statement: Every time I create a new topology I have to enter the license... Does that means that every time you power up a qemu VM you have to put the license? Or every time you add a qemu VM to a proyect and start it for t...

leonset

Those values are valid only for 802.11 links, they are not used neither in Nstream nor NV2.

http://wiki.mikrotik.com/wiki/Wireless_Matrix

leonset

Probably the input capacitors have leaked. You may try to replace them if you know how to use solder tools.

leonset

Be careful when doing masquerade/NAT: connections will be cached until they timeout. That is, if they are shown in "IP, firewall, connections" any packet related to them whon't be checked again against the masquerade/NAT rule... not even if you modify the rules. In my experience, it's easi...

leonset

If interface is setup to get an IP by dhcp, Windows won't pass any traffic until it gets the lease from a DHCP server... which is fast if there's a server available, but takes more than a minute if no DHCP server replies to the ip request. Set a fixed ip and problem gone. Personally, I haven't had a...

leonset

Thanks for the info, but this is an ancient post!

At that moment, I wasn't aware of those tricks... nowadays I use them and sometimes also use some scripts and the scheduler (i.e. when the VPN has to be up for some hours a day).

leonset

uldis, I have upgraded to 6.17 and re-activated wireless-fp. So far I've had a couple very minor drop-outs but I think I can chalk them up to multi-path interference due to the locations at the times. I'll keep an eye out for it and send in a supout if I can catch it happening again. Glad to know, ...

leonset

The trick to catch it is sending pings fast enough to somewhat emulate the flow of other kind of packets. I started investigating this when our users complain about strange behavior of some apps (games, voip, sometimes DNS queries) which mostly use UDP (TCP usually will recover from those losses), s...

leonset

Hello, After being using the new wireless-fp package I can confirm that it does generate a small packetloss in PtP links which do not have any losses using the "classic" wireless package. The problem does not happend in all links, it is just more prone to be seen on links which are in area...

leonset

I just don't agree with you, unless OP is using an ancient OS. Since Windows 2000 windows shares use SMB protocol over TCP and are completely IP routable. Older Windows used SMB over NetBIOS/NetBEUI, which is non-routable protocol. You can read all the details here: http://en.wikipedia.org/wiki/Serv...

leonset

Maybe your UDP/53 port is open and you're getting queries from outside your network. Put some firewall rules or disable the service completely if you're using an external DNS server for that network.

leonset

I have no experience with that IPTV provider, but also IGMP Proxy should work ok and would be more dynamic than static switch rules, i.e. if you move your STB to different ports. Oh, well, you might never move it!

leonset

Sorry but, what you mean with "try to browse to a computer on the other side"?

\\localip.in.remotevpn.network\c$ ??

leonset

And where's the gateway to Internet? Is one of the mikrotik devices or a different router?

leonset

I would need a drawing of your network to try to help you and also the config of the routers.

leonset

Write all in the same line...

/ip firewall mangle add chain=forward action=change-mss new-mss=1360 passthrough=yes tcp-flags=syn protocol=tcp src-address=10.1.1.0/24 dst-address=!10.1.1.0/24 tcp-mss=!0-1360

leonset

Try putting this in both ends to limit the data size of every packet, so it won't exceed MTU afther adding all IPSec headers, checksums, etc. /ip firewall mangle add chain=forward \ action=change-mss new-mss=1360 passthrough=yes tcp-flags=syn protocol=tcp src-address=10.1.1.0/24 dst-address=!10.1.1....

leonset

Still makes me wonder, why it is so hard to implement? Even sub 30$ Home "soapbox" routers have it now in conjunction with IGMP Proxy. http://en.wikipedia.org/wiki/IGMP_snooping#Standard_status Despite it's broad usage and usefulness, IGMP snooping is not an industry standard. That alone ...

leonset

Now I am left wandering, typically why would someone want to use bridging on a CRS? Well, you may need to do some filtering that can't be done directly within the switch chip, i.e. filter pppoe discovery packets or apply some MAC based Nat rules... very specific scenarios that few "ordinary&qu...

leonset

The documentation seems to say that bridge mode or router mode applies to how data flows between switch groups, am I correct? As I see it, you need to start thinking that CRS is a switch plus a single port (switch1-cpu) routerboard all in a single box. The way to set this up is different from any o...

leonset

Is it possible to add MFC static entries from Winbox? I haven't found it yet...

leonset

I would suggest you to try an updated ROS version... sometimes they solve issues and do not mention it in the changelog.

leonset

This probably won't help you, but I've worked for years with more than one hundred 450G and never had such problem...

leonset

In CRS125 just make SFP1 slave of whichever master-port you had defined and all switching will be done in the switch-chip without using the CPU. Don't use bridge. We all need to learn that CRS must be setup in a different way than the previous routerboards: it has a powerfull switch chip which can d...

leonset

Tested this too and this workaround worked for me with 433AH and 7115Hd: set wireless to enable and wireless-fp to disable, then reboot. In fact, this sounds logical to me, because it's a user choice to enable/disable wireless package, whichever flavour it is. Mikrotik has no way to know if you want...

leonset

The nv2-tdma-period-size is recalculated at some time interval or by any kind of trigger? Where can I check which period is currently being calculated by the "auto" function? I noticed that with wireless-fp package enabled for NV2 the field TDMA Period size can be empty. But if it is empty...

leonset

Forget bridge and read this carefully:

http://wiki.mikrotik.com/wiki/Manual:CR ... _Switching

Also, I've read in some other post that 802.3ad is still not implemented in CRS, so you can't use it and benefit of wirespeed switching... yet

leonset

That sentence essentially means that the port for which a master-port has been defined will show no traffic from a RouterOS perspective, as all packets will remain within the switch chip. Indeed, the port that will show all traffic is the master-port (with Winbox, torch, etc). I.E. if you set ether3...

leonset

Give IGMP proxy a try...

leonset

Don't have access to my CSR right now, but try to put something like 224.0.0.0/8 in Multicast FBD and assign to a port you control (say, main router, a server...). That would filter out, but I don't know if its possible to put ranges in FBD. Anyway, IGMP snooping would solve your problem a lot more ...

leonset

1.- Choose a master port and enslave the ports you need to be in the same switch group. Switch groups are completely isolated among them, as if they where 2 separate switches. No port can be in more than one switch group. /interface ethernet set ether2 master-port=ether1 set ether3 master-port=ether...

leonset

Multicast FBD is working correctly for me, it does filter which ports are allowed to receive multicast. Not dynamic and not as useful as IGMP Snooping, but could be enough for some usage scenarios: /interface ethernet switch multicast-fdb add address=239.0.1.1 ports=ether5 vlan-id=1 add address=239....

leonset

Thats the easy way: ruling out VLAN's and use just port isolation... But even I don't need a tunk port ATM, I may need to use different VLAN tags in the same ether port and tag packets in the servers. And of course I want them to be isolated among them, even if they come to the same ether port. I'm ...

leonset

Now that I need it...

+1 for IGMP snooping!

leonset

Hello, I need to setup a CRS 125 switch with half the ports in VLAN1 and the other half in VLAN2. Ports in the same vlan must be able to communicate among them with untagged packets but must be isolated from ports in the other VLAN. VLAN2 will have a lot of multicast traffic that could easely satura...

leonset

Following your post there I just found yet another bug, settings in: drop-if-no-vlan-assignment-on-ports drop-if-invalid-or-src-port-not-member-of-vlan-on-ports made from command line do not show in Winbox. Also, if you change those settings in Winbox they overwrite the ones set from the command lin...

leonset

I don't think that you can get jitter figures within routeros. Try using a server with smokeping or use a script like tho one mentioned here:

http://blog.metricfire.com/2012/04/repl ... ll-script/

leonset

Hi!

Did you get this issue solved? I'm trying to address it, but I've had no luck yet...

Thanks!

leonset

Good to know, thanks! @xcracker If using Freeradius, check the file ippool.conf in /etc/freeradius/sql/mysql (or equivalent for your distro). You'll find an "on-clear" query which states something like this: ## This series of queries frees the IP numbers allocated to a ## NAS when an accou...

leonset

Try to use the internal IP address in the NAT'ed router ipsec policy. You will also need to put accept rules for ipsec traffic before your masquerade rule (if there's any in the ipsec router).

Something similar is explained here:
http://wiki.mikrotik.com/wiki/Manual:IP ... behind_NAT

leonset

How does the router which is the "main" and which one is the "backup" radius server?

leonset

Change the admin credentials to something only you know and wait if it happends again.

leonset

Hello, I've had to use an RB493 as a switch to replace a dead switch. I used eth2 as master-port and set eth3 to eth9 as slaves. It works as switch correctly with v6.12. BUT, i need to know which MAC is connected to which eth port of the RB493. The ARP table shows all MAC's in the eth2 interface (as...

leonset

Question I need to put on windows 8.1 ROS. Unfortunately can not see network interfaces with Hyper-V. Is ROS in general 6.x adapters work with Hyper-V? AFAIK, ROS is not and will not be supported under Hyper-V. You may have better luck with Virtualbox or VMWare, but I have no personal experience wi...

leonset

If I understand correctly, you mean that traffic generated in the router doesn't match your prerouting rule?
That is expected, check packet flow: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

You must put a rule in postrouting to match in-router generated traffic...

leonset

Triple check shared secret in both mikrotik and the radius server. Packets are signed with that secret so they must be the same. Also, increase radius timeout in Mikrotik... maybe that radius takes more than the default 300ms to reply, Mikrotik resends the packet and then receives the reply from the...

leonset

I've tried this in my spare time but I couldn't make it work correctly.

One option would be to split your IPSec policies so half clients go through first wan and the other half use the second wan.

Edit: with version v5.x

leonset

Which was the problem?

leonset

Whats the time in the router?

Looks as it isn't set correctly (revoked in Jan/01/1970) and maybe that confuses Winbox to show the wrong valid period.

leonset

One thing that comes to my mind is to create an VRRP interface, put there the second IP, and route mark traffic depending on the incoming interface... I'm not sure that it would work, but you may give it a try and let us know. Other option (if your hardware supports it) could be to create a Metarout...

leonset

Manually using "export" or "export compact", my IPSec peer passwords do get exported correctly. What VPU are you using?

If you are using a script or a schedule make sure the "sensitive" policy is checked or you'll get just "*" as the password.

leonset

Check if you have some kind of logging to disk. I just don't know what else could be producing that...

leonset

Test through the routers and you'll get much more, but probably not a full Gbps.

BTest server/client does use Routerboard's CPU and if you check, it would be all the way up during the tests.

leonset

I've read it again and it has to refer to the fact that no traffic is shown in / passes by *slave* interfaces, all goes by the *master* one. Say you have master port eth2 (internet gateway) and slave port eth5 (computer): if you put a firewall rule or use torch to match traffic going through eth5 yo...

leonset

As I see it, you'll need to setup IPSec policies in each site to reach the other's sites IP ranges through an IPSec tunnel that goes by your HQ. Setting routes is not enough, as IPSec won't encript/tunnel traffic if it doesn't match it's policies. Do you really need to access any site from any other...

leonset

Sort of related question... can you connect anything to the Master switch port? The Mikrotik wiki says "Interfaces for which the 'master' port is specified become inactive - no traffic is received on them and no traffic can be sent out." So, is the port not usable if it's set as a master ...

leonset

You have the same priority on both routers. It has to be higher on master router and lower in backup one... If you check the status of the VRRP interface you should see that one has an "M" (master) and the other is "B" (backup). If both have the same status then something else is...

leonset

Maybe its a license level limit?

leonset

Why are you using such an old version? (v2.9.26)

leonset

Thats a completely different question and should be posted in the main forum, not in this thread.

By the way, I can't tell you if it would work as I haven't used PCC myself yet.

leonset

SPI doesn't make me think about disk I/O, specially in a firewall router like a CCR... but besides the counter-intuitive of the name is nice to know what it was

leonset

I believe this one will be better asked directly to support@mikrotik.com
And please post back the reply here

leonset

Of course, with the proper settings. For example:

http://wiki.mikrotik.com/wiki/Manual:PCC

leonset

In Mikrotik world nearly everything has a meaning. Glad to help.

leonset

I believe that you are making the wrong question. You should be asking yourself what performance do you really need, based on the intended usage of your router. If you really need to deal with sustained traffic of 3Gbps maybe no mikrotik router would fit in... OTOH, basically yes, performance is lim...

leonset

As I see it, I should be much faster to have the list in memory than in a file. File would need to be loaded to memory for the router to process it and that would be as if it was in memory in the first place.

leonset

The only thing I can tell you is that in the v6.4 change log it says:

"graphing - make sure that interface graphs gets preserved across reboots;"

You may try...

leonset

Be careful! CRS125-24G-1S-RM is a "Cloud Router Switch", which is a "Perfect SOHO gateway router, switch, all in one box" as Mikrotik describes it and has nothing to be with the CCR "Cloud Core Router" series that I sugested before. In CCR all ports are connected direct...

leonset

Add a rules in NAT, like this: add chain=srcnat dst-address=199.10.0.0/16 src-address=192.168.63.0/24 action=accept add action=masquerade chain=srcnat comment=OUT It's very important the order of the rules, so packets for your IPSec neighbour(s) are accepted and passed over to the IPSec process befo...

leonset

And if you want to do anything with the traffic in any switched port, packets will need to be passed to the CPU for processing and performance will be lower. That doesn't mean that it should be "slow". Do you really need 13GBit simultaneous performance with firewall, nat, queues? Then mayb...

leonset

That table belongs to the performance of some routerboard model?

leonset

As explained here: http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Internet_Key_Exchange_Protocol Phase 1 is equivalent to peer config in Mikrotik and Phase 2 is Proposal settings. Policy tells router which traffic to encrypt. Set source address 172.27.63.0/24, remote 199.10.10.0/24 and use the rest v...

leonset

1.- Check Windows firewall config to open the new C ranges of the other offices. If you enable ping from the firewall UI it will allow only from the C class that the computer belongs to. Try disabling firewall and test. 2.- Could be similar: maybe the NAS only allows access to the /24 it belongs to....

leonset

Hi,

I don't really know, but if you check the block diagram you'll be able to get some conclusions:

http://i.mt.lv/routerboard/files/Block-RB1100AHx2.pdf

Also this should give you more info on how they benched that router http://www.ietf.org/rfc/rfc2544.txt

leonset

Hi,

Check CPU load, it could be an issue if MK board is weak. I don't think its an MTU issue, those values are typical.
Also try different speedtest servers and compare results.

leonset

Hi, You'll only get that level of performance with routerboards with hardware encryption engine, like the old RB1000 or the new 1100AHx2. I don't know if other models are equiped with it too. As a reference with RB450G I get no more than 23Mbps (with a few firewall/nat rules and routing enabled). Re...

leonset

I have sent an email tu support about this issue, I'll post the answer here... I can't use 6.1 because it has bugs with IPSec, can't use v6.0 cause has bug with VRRP, can't use v5.x because it has problems with Mangle rules and performance with RB1000... I hope that I get a "good" version ...

leonset

Yes, I use this to en/disable IPSec Policies since almost ever:

/ip ipsec policy enable [find sa-src-address=1.2.3.4]

Your script block doesn't work, exactly the same behavior: only the first peer got enabled and then the prompt halts until I press Ctlr+C

Thanks!

leonset

Hello I'm trying to find a way to disable all or a set of IPSec peers within a script in v6.2. In theory something like this should do the trick: /ip ipsec peer enable [/ip ipsec peer find port=500] But it doesn't... it just enables the first peer (number 0) and then the terminal prompt just hangs. ...

leonset

Check the always useful packet flow!

http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

leonset

EDITED!!

IIRC, you have to set IPSec Policy, Action, Level to "unique" to make it work

Anything in the logs?
Go to System, logging and add a rule for "ipsec, !packet" to get some info and add "debug" it you need extremely verbose logs

leonset

Hi,

VRRP AH auth seems to be broken in v6.2 as it was in v6.0. It worked ok with v6.1, but I can't use that release due to IPSec problems solved in v6.2. I've had to switch to "simple" authentication and/or vrrp v3 protocol.

Please, check vrrp again for next release.
Thanks!

leonset

Don't use such rule, you are blocking all traffic to port 53 and thus blocking DNS. Just limit queries to your local LAN address range:

chain=input action=drop protocol=udp dst-port=53 src-address=!10.10.10.0/24

Replace "10.10.10.0/24" with your local LAN range

leonset

Nice, I was expecting lower performance from RB2011 as it has 600Mhz CPU versus RB450G's 680Ghz.

You may try to fine tune the tunnel playing with MTU/Clear DF so it won't generate unneeded fragmentation and thus less packets to enc/decrypt. Anyway, you probably won't see much more than that.

leonset

It's RB1100AH or RB1100AHx2? The later supports HW encryption and manual says you should get ~700Mbps. Anyway, the other end doesn't have HW engine, and based in my experience with RB450G you may expect something around 20Mbps from RB2011

leonset

Update: - It works ok with RouterOS 6.0 in RB1000. - Downgraded to v5.25 with the same config and I got a performance drop of ~50% - Under v5.25, changed encryption algorithm from AES-128 to Camellia-128. There was NO performance drop at all (but CPU usage rised to ~20% as only AES is hardware accel...

leonset

Hi,

No, I have no logging rules, just te bare minumum for this test. As this is a test environment I can up or downgrade freely so I'm going to do it now and test it again.

thanks

leonset

RB1000 v5.25
RB450g v6.0

I'll upgrade RB1000 to v6 in a while and test again.

leonset

Just to clarify some points: - Traffic is uploaded from RB1000 to RB450G: RB1000 encrypts IPSec and RB450G decrypts it. - The Magle rules decreases performance even if the traffic is not matched by the rule. Just having the rule there drops performance. - This probles ONLY affects IPSec flows. Using...

leonset

It could be a setting with the webserver you are downloading from. It may allow for an initial high burst and then reduce the speed... Does it happens with more than one web server?

leonset

IPSec if you are using any hardware accelerated routerboard (RB1000, RB1100AHx2). Anyway, how much bandwidth do you need? A simple RB450G should give you 15Mbits of AES-128 bandwith

leonset

Hello, I've been doing some testing with a new IPSec deploypment using RB1000 with 20MBits WAN in one end and RB450G with 100/10 FTTH in the other. Enabling "Clear DF" in RB1000 cuts performance in halve, in my case from nearly 15MBits/s to somewhere around 8MBits/s. CPU at RB1000 sits bel...

leonset

Glad to hear that, slech :) I've manager to get it done by: - Defining two IPSec policy, each one for the needed tunnel: Tunnel1: 10.0.0.0/24 -> 10.20.0.0/24 Tunnel2: 10.0.0.0/24 -> 10.20.0.32/28 - Setting them as "unique" instead of "required". - Setting the priority for Tunnel2...

leonset

Hello!

I've tried using higher priority (for example 100, 1000, 9999...) for 10.20.0.32/28 bu it still doesn't work.

Thanks for the tip!

leonset

Forgot to mention, I'm using Mikrotik on both ends, RB1000 and 450G.
For Cisco I've read that the policy has to be set as "unique" instead of "require".

leonset

Hello,

I'm trying to configure this tunnels:

Tunnel1: 10.0.0.0/24 -> 10.20.0.0/24
Tunnel2: 10.0.0.0/24 -> 10.20.0.32/28

Tunnel1 always work, but I get no traffic through Tunnel2. The SA for Tunnel2 does get stablished, but count bytes stay at 0.

Whow should I set this up on Mikrotik?
Thanks!

leonset

Try this:

http://wiki.mikrotik.com/wiki/Manual:Password_reset

leonset

In the past I have moved .backup full configs between different models. It has usually worked correctly, but the eth and wireless interfaces do get messed up: I had to check one by one and rename them, check IP address assignments, check DCHP server settings, etc. I have to check that /export compac...

leonset

I still have this problem, but I have narrowed it down to my DSL routers on the branch offices stopping to send ESP packets to the Mikrotik router behind them. The test I did was to disable DPD on that tunnel and reboot the DSL router when the tunnel stopped sending packets. After the reboot, the tu...

leonset

Hi, I'm having a similar problem and I have narrowed down the problem to my DSL router's stopping to pass ESP packets to the mikrotik router behind it. As I have no control over them, I use this script to check connectivity and flush SA's if neccesary: :if ([/ping REMOTE_IP_REACHABLE_BY_THE_VPN_TUNN...

leonset

I think that using PCC would be do a better use of both links:

http://wiki.mikrotik.com/wiki/Manual:PC ... _Balancing

leonset

Hello!

Just curious, why would you need to do that?

Thanks!

leonset

Hello! I'm quite new to The Dude but not to Mikrotik. I've been searching for a while and I haven't found how and if it's possible to generate graphs of the bandwitdh usage of some simple queues or from a queue tree. Now I'm using mikrotik native graphs, marking packets and assigning them to simple ...

leonset

Hello! Is there any way to force RouterOS to send ARP broadcast packets to the net when an VRRP interface becomes master? Manual says that it sends one unsonlicited packet announcing the change when the VRRP becomes master, but some switches ignore it quite often and I have to wait some minutes for ...

leonset

Maybe it's because it needs to "write" a value into the smtp variable.

The only policies that I really use are "reboot" and "sensitive", the later to hide it from exports if the contain any kind of sensitive data like passwords, local IP's or whatever.

leonset

Glad to help! Thanks for Karma upgrade!

leonset

Sooo gooood!!! Thanks a lot for that tip!

leonset

Here:

http://forum.mikrotik.com/viewtopic.php?f=2&t=60380

A member suggests "Try to disable change-tcp-mss (encryption, compression) in ppp profile."

leonset

Try using a Mangle rule on the forward chain to reset the don't fragment flag for each packet and check if you are getting the same error from the client.

leonset

I'm using that setup, but the VPNHub is Mikrotik too, not Cisco, so I can't help you with that side. You should map both UDP500 and IPSec-ESP (IP protocol 50) from the external IP to the internal one. If using 1to1 nat, make sure that ESP is forwarded too, not just TCP/UDP. In the Policy, use the Mi...

leonset

I have the same problem: enabling IPSec or Debug logging shows a lot of detail, too much for a quick review. There should be an intermediate level of logging for IPSec.

leonset

Hello, I've been using Mikrotik's IPSec for VPN's for a long time with almost no problems. VPNHub is a RB1000 and peers use 450G. For sometime now my tunnels stop passing traffic, with no data flowing in one of the SA's of the tunnel. As you may know, each tunnel creates two SA's: one from VPNHub to...

leonset

Hello, I use scripts to keep configs in sync among two routers which share VRRP IP's for IPSec tunnels. I make changes only on primary router and use something like: /ip firewall address-list export file="EXPORT.$[/system identity get name].FW_Lists" to export some settings to a file. Then...

leonset

Nice! Try to use that for jitter sensitive traffic like VoIP or Citrix/Remote Desktop. Also, try to emulate problems with the DSL lines. My main concerns about that setup are packet reordering and retransmisions and resiliency to DSL problems. In my tests taking down one of the DSL's didn't took it ...

leonset

Oopss!!

It was disabled for the connected interface

Now it's working perfectly, thanks!

leonset

Hello!

In one of my sites, when I click the "three dot button" on Winbox to get a list of the available RouterOS devices on the net, I'm getting an empty list. But there's two devices and I can connect to them using their IP or MAC address.

Why I get nothing on the winbox list?

Thanks!

leonset

I've never done that kind of wifi deployments before, that your solution could be usefull to address that "interclient" traffic

Thanks!!

leonset

Hi,

Which are the expected results you want to accomplish with that setup?

leonset

That would make sense in a Remote Desktop/Citrix environment: you have the Citrix farm at the datacenter and connect to it from the DSL's lines. If you download someting in the remote session it will use the datacenter's bandwidth and traffic flowing by the dsl's would be only Citrix/Remote Desktop....

leonset

No one may enlight me on this issue? Please!

leonset

Hello,

You should try this way of doing such failover:

http://wiki.mikrotik.com/wiki/Advanced_ ... _Scripting

I've used it sometimes and does a nice job

leonset

Hi, I have a IPSec/VPN among a central site and a bunch of branch offices. Now I'm taiking some Windows PC's to Windows domain and some features of it (User GPO) aren't working. Some Microsoft forums suggests that I should enable 2K ping packet size among the PC's and the domain controllers. It shou...

leonset

Right! I had two gateways with different IP addreses

Thanks!

leonset

Fewi, are you sure you can't balance with PCC with just one interface? I tried some setup's and I ended up with a working configuration using just one eth iface on the Mikrotik to the switch where the DSL routers where connected. Maybe I'm wrong, it's been some time since i tested it. And I can't fi...

leonset

Hi, You won't get more bandwidth using Location B's WAN, because you will be limited by your current DSL's bandwidth. The only reason I can think of doing this is if you need some latency sensitive traffic and "DSL to Location B latency" + "Location B to destination server latency&quo...

leonset

Ok!

This drove me nuts for a while. I hadn't used bridges over Internet before.

Thanks!

leonset

Hello, I am having a problem bridging a net over the Internet using 2 ADSL connections. Here's my setup: - Mikrotik RB450g, RouterOS 5.6 - Static IP on both ends. DSL router does the NAT to the Internet. UDP500 is Dnated to each Mikrotik LAN IP for IPSec. No NAT or firewall on the mk routers. - IPSe...

leonset

Hi,

Make sure the IP's assigned to the VRRP interface have /32 mask and that the IP's assigned to the physical iface (eth1 and the bridge) have the correct mask (say /24).

Regards

leonset

Hi,

I believe you could check if it's and MTU issue lowering the MSS at /ip firewall mangle:

add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1400

leonset

Hi!

Does anyone else have any suggestion? Would be greatly appreciated!

Thanks in advance.

leonset

Sorry, just a question: why should "reject" those packets?

leonset

I use what I call a "selector" for the firewall set up, with a classifier at the top which sends the packet to the correct chain given it's source/destination IP. That way packets will have to be checked only against the rules that may be applicable to them and not against all 300 rules. I...

leonset

Yeah, but you can't have the same policy for both WAN's... You have to split the traffic among 2 tunnels somehow: source/dest TCP ports, source/dest IP addresses... So you don't get "real" load balancing in realtime, but a "manual" load balancing at configuration time.

Thanks!

leonset

Hello, I'm trying to figure out a way to load balance and failover an IPSec VPN among my remote office (2 ISP) and my central office (one ISP). I'm thinking on setting up two EoIP tunnel at the remote office, each one using one ISP, and then create a bonding with both. Then, I would add an IP to the...

leonset

Hello!

Will that allow to load balance an IPSec VPN among 2 or more internet conections?

leonset

Nice to know!! I whis I had tested my setup before using "selectors" in my forward chain to be able to compare.

Which tools do you use to do those performance meterings?

leonset

You're welcome!

Just take care, it isn't as simple to implement as it may seem... specially on a live system. At least for me!

leonset

Hi, Try to optimize the mangle chain. Each packet shouldn't be checked against each rule. Segment your network in order to be able to place a "selector" and then jump to a given subchain where those will be mangled acordingly. For example, if you have 2 internal networks with different man...

leonset

Hi, If WinBox "remembers" something that is NOT in a given RouterOS instance it isn't a "feature" but a bug, because you can't get consistency among what you see and what's currently running in RouterOS. On the other hand, if Winbox has "memory" to "remember" ...

leonset

Hello, I have sey up an IPSec VPN using a DSL line at the branch office to my central CPD. Now I'm going to have two DSL's at each branch office and I would like to load balance the VPN traffic among both lines, but I don't know if it's possible to do it straight away. Also, I need it to be able to ...

leonset

If you really want to reach gigabit performance you should opt for x86 hardware. I'm using RB1000 and I can't get more than 700Mbits at full duplex (700Mbps in at eth0 and 700Mbps out at eth1), just with static (but complex) routing, a heavy (but optimized) 250 rules firewall and some Nat/mangle rul...

leonset

What really stresses a router like RB1000 are packets per second and not bandwidth, because every packet has to be analized and checked against firewall, mangle, routing, etc, etc. Having the right order in your firewall rules does help to withstand Dos Attacks/Traffic Peaks.

leonset

Great! Thanks for the update.

I hope it gets solved soon!

leonset

Hello!

Have you send a bug report to Mikrotik? Do you have any answer?

I do heavy use of VRRP and I was planning on upgrading to 4.11 this week...

Thanks,

leonset

I don't think you can serve much more than just static files and it won't support too many concurrent users, probably RouterOS isn't optimized to be used in that way. Also, I don't know if RouterOS license will allow you to do that.

Regards,

leonset

Nice!!

Seems useful, even if I'm not using port knocking right now...

Thanks!

leonset

Enabling DPD and rebooting the remote router is the only way I know to flush an specify SA in RouterOS... Is any other way to do it?

Thanks!

leonset

Enabling Dead Peer Detection (DPD) really helped me when testing IPSec with Mikrotik. Restarting the remote router will flush just the SA of that peer.

Regards,

leonset

Ok, so if I want to use it as a firewall the limit is somewhere at 750Mbps. If I just need a router I could disable conntrack and get nearly 1Gbps performance (tested). Not too bad for this little board

Thanks!

leonset

If I understand correctly, the problem is that the export file is on the AP and can't get the file to a computer to read it... I don't know if you can "cat [filename]" from within RouterOS telnet... Probably the best solution would be to just import the old export if haven't done many chan...

leonset

Hello!

Yes, it seems logical that I get those values. I'll try to know the average size of packets.

I know that disabling conntrack will increase performance but, which firewall features I wont be able to use?

Thanks again!

leonset

Hello, I have added a new VLAN to a couple of RB1000 to act as intranet routers/firewalls. I have done many tests and the best I could get is 600Mbps full duplex (600Mbps in at eth3, 600Mbps out at eth1). At those rates, CPU usage rises to 85%-95% and I can perceive increased latency, but nothing to...

leonset

If an export-import solves the problem, RouterOS or Winbox is storing those address list values somewhere else than just the usual places available for user edit.

I don't like the idea, but I will do an export/import in my main firewall and check the results.

Thanks,

Search found 256 matches