MikroTik

eghtedari2000

hi all i have a quee tree qos, and i limit some ports on my quee tree for a subnet. can i have a limitation per ip with burst and burst threshold in this quee tree. i explain more, for example i limited the bandwidth of some ports in 20 mb in quee tree for 256 ip addresses( one subnet ). can i have ...

eghtedari2000

please think mikrotik can calculated every connection throuput, so easily can calculate totals of that. am i right? unfortunately, you're not. router's connection tracking facility gives firewall the information about the connection currently being processed, but it will be very CPU-expensive to ca...

eghtedari2000

please think mikrotik can calculated every connection throuput, so easily can calculate totals of that. am i right? unfortunately, you're not. router's connection tracking facility gives firewall the information about the connection currently being processed, but it will be very CPU-expensive to ca...

eghtedari2000

please think mikrotik can calculated every connection throuput, so easily can calculate totals of that. am i right? unfortunately, you're not. router's connection tracking facility gives firewall the information about the connection currently being processed, but it will be very CPU-expensive to ca...

eghtedari2000

it put much load on billing. "welcome to the real world, Neo" how can billing say to router to change the QOS, only way is disconnect user and give him another ip that is on that QOS, do you have any other idea? I know absolutely nothing about your billing system and its possibilities, so...

eghtedari2000

i didnt torrent, i download an .iso file by flashget from http://www.ubuntu.com
and if you will download your ubuntu via torrent, even grouping connection-bytes by src and dst addresses won't help you - that's what I'm saying

you didnt reply me another post, i sent you again

eghtedari2000

your billing system should count total traffic, this feature is just to detect 'long' connections and apply QoS rules to them it put much load on billing. but if i said ok, i count that by billing, how can billing say to router to change the QOS, only way is disconnect user and give him another ip ...

eghtedari2000

i think if mikrotik can take a total from all connections from a source ip to a destination IP and use in connection byte, it is a good way for limit download torrent protocol downloads from hundreds IPs - it won't limit anything :) i didnt torrent, i download an .iso file by flashget from www.ubun...

eghtedari2000

your billing system should count total traffic, this feature is just to detect 'long' connections and apply QoS rules to them it put much load on billing. but if i said ok, i count that by billing, how can billing say to router to change the QOS, only way is disconnect user and give him another ip ...

eghtedari2000

it's about single connection, so every of 7 connections will have 50 Mbytes (350 Mbytes in total) i think if mikrotik can take a total from all connections from a source ip to a destination IP and use in connection byte, it is a good way for limit download, but when it calculate from connection one...

eghtedari2000

it's about single connection, so every of 7 connections will have 50 Mbytes (350 Mbytes in total) i tested for example flashget. when you use this software every 1 minute start a new connection to server with new port. so mikrotik start counter for new connection from zero and my download speed did...

eghtedari2000

it's about single connection, so every of 7 connections will have 50 Mbytes (350 Mbytes in total) so, with some software user can take up number of its connection, when wants to download huge files take it to 30 connections. so this policy cant monitor download!!!! does it posiible that when mikrot...

eghtedari2000

The next RouterOS version will include a new exciting feature - matching connections by their speed. This will help you assign different rules for http downloads, in contrast to just surfing, find P2P downloads even if they mask themselves as HTTP, give priority to VOIP etc. See more here: http://w...

eghtedari2000

hi

i wanted to user these rules in this age to manage download.

but when i setup no counter work on mangle.

http://wiki.mikrotik.com/wiki/Manual:Connection_Rate

can anybody help me?

thanks

eghtedari2000

hi

i found in a web site that packet size upper than 1023 bytes are more download packet.

i wanted to filter in router but i think it isnt good idea

i went for PSD, how can i configure that?

does PSD help me about that?

or is there any way to help me about that?

eghtedari2000

hi

i want to block ultra surf in my network.

how can i do that? does it possible in layer7 ?

i do some works that said in mikrotik sites to do but doesnt work

please help me.

thanks

eghtedari2000

hi

can i cross voip packets from socks or upnp when my isp blocked?

if it is possible how can i do that?

thanks

eghtedari2000

hi in usermanager i wanted to know more in website i found subscriber, customer and user. can i know difference of subscriber and customer. also i want to start accounting which my system has one admin and after that i can show all of thing of my reseller, i want to charge their deposit and have mon...

eghtedari2000

That is not possible.

this is possible in windows server 2008, but in mikrotik not!!!!

eghtedari2000

hi

i wanted to know how can i setup socks server in mikrotik and let user connect to socks server by radius.

if it is possible what is the software for client?

thanks

eghtedari2000

hi all

how can i block DDOS attack in mikrotik routers?

thanks

eghtedari2000

Well NTTAC is to old to expect do anything for you... You should use a radius that can support update packets to/from BRAS. I think you better hook up with IBSng.

free IBSng doesnt support reseller service, i heasr about RSC, do you know that and commands in mikrotik?

eghtedari2000

yeah, use L2TP - it's UDP-based =)

i cant use L2TP, because of in special time all of such these protocols blocked, so i need to change protocol directly

eghtedari2000

huh, where do you need that? O_o

do you have any way for me?

i need to change tcp to udp for cross some filters.

thanks

eghtedari2000

hi

i have 3 mikrotik in 3 places and my accounting is in one place,

when a problem occured for band width of 2 other places my users be onlined on my accounting ( NTTAC Plus )

is there any way to check real user on mikrotik and NTTAC and if there is please help me about commands

thanks

eghtedari2000

hi

i want to change a protocol to another, UDP to TCP and also change the PORT, in one time

i found to change port in ip , firewall, NAT but for protocol i didnt found.

please help me

eghtedari2000

I solved it with metarouter, openwrt works perfectly on rb450g, then you can install openvpn and luci to mnage it. Isn't the best option but for now there is no other with mikrotik... I saw a fortinet seller after a pilot test vs openvpn going out with his expensive hardware, and I think the real d...

eghtedari2000

here there is nothing for mikrotik exactly, openwrt is not RouterOS, it is not maintained by Mikrotik. It is completely different open source operating system that you can run virtually on RouterOs. And how to configure it you can find in their manual. so can you give me more guide to find how can ...

eghtedari2000

refer to openwrt documentation.
http://wiki.openwrt.org/doc/start

here there is nothing for mikrotik, or may be i didnt find, i want to setup this router that my users can connect to this router through udp by openvpn.

please help me i really need that

thanks

eghtedari2000

when i type interface bridge in metarouter command doesnt work!!
OpenWRT is not RouterOS, so there is no interface bridge command.

so how can i configure my openwrt, i want to have UDP openvpn connection.

can you help me about that?

eghtedari2000

If you want to keep RouterOS then openwrt should be set on metarouter. If you don't need RouterOS at all you can try to install OpenWRT on routerboard. Which part exactly you didn't understand? Easiest way is to download precompiled image and import it and Thats it - virtual OpenWRT is up and runni...

eghtedari2000

If you want to keep RouterOS then openwrt should be set on metarouter. If you don't need RouterOS at all you can try to install OpenWRT on routerboard. Which part exactly you didn't understand? Easiest way is to download precompiled image and import it and Thats it - virtual OpenWRT is up and runni...

eghtedari2000

Search the forum for PCC or look at the wiki for PCC. It meats all of your conditions. There are a couple of more reliable ways to discover if a route is down or not than what is provided by default. You can write a script that will perform the functions for you, or there a method that does not use...

eghtedari2000

If you want to keep RouterOS then openwrt should be set on metarouter. If you don't need RouterOS at all you can try to install OpenWRT on routerboard. Which part exactly you didn't understand? Easiest way is to download precompiled image and import it and Thats it - virtual OpenWRT is up and runni...

eghtedari2000

UDP! UDP! UDP! if routeros can not do it, can someone comment an alternative to run on routerboard? and if routerboard is not good enough, can someone comment good hardware to run openvpn? we are using cisco 1841 routers for all our offices now, and we want to replace them with openvpn hardware. th...

eghtedari2000

From that link:
There is one limitation to using OpenVPN on the RouterOS platform: currently only tcp is supported. udp will not work.

i found at forum that i can have openvpn connection on mikrotik trough UDP by openwrt.

can you guide me more about that?

eghtedari2000

MikroTik RouterOS OpenVNP capabilities,
http://wiki.mikrotik.com/wiki/OpenVPN

hi

if i want to have openvpn connection on UDP port, does it possible?

eghtedari2000

hi

i want to setup secure OpenVpn on mikrotik, does it possible or not?

now i do that on windows XP in client and windows server on server and have key and can bypass filter of government.

so i want to setup on mikrotik

thanks

eghtedari2000

hi i have 2 bandwidth from 2 provider. i want to use from both ( load balance ) by packet or other ways that you offer. also i want that if one of the bandwidth found problem for example disconnect or have packet loss or latency the router automatically found that and send packets trough another gat...

eghtedari2000

For OpenVPN you specify port, which is used for tunnel 443 is by default, /interface ovpn-server server print enabled: no port: 443 thanks alot can you please guide me more for pptp to write mangle configure on that and also for protocol for l2tp? thanks

eghtedari2000

/ip firewall address-list add list=whatever address=172.17.5.0/24 add list=whatever address=192.17.6.0/28 /ip firewall mangle add chain=prerouting action=accept src-address-list=whatever Paste that into the terminal window of the GUI and then inspect the things the commands created in the GUI to fi...

eghtedari2000

hi i wanted to have manage bandwidth on all type of vpn and i dont need to see content of vpn for pptp, i found to have manage on 1723 tcp port. for l2tp, on mangle , i found protocol, that have some kind of ipsec and GRE. another problem for this way is in every mangle you can put only 1 protocol, ...

eghtedari2000

You can use only range there, ip firewall mangle add src-address= SrcAddress ::= [!]Range Range ::= A.B.C.D[-A.B.C.D |0..32 |/A.B.C.D ] (IP address range) To use one mangle rule for both networks, use address-list. can you type the sample for me with my ip addresses that i said in top, and the way ...

eghtedari2000

1) Use address-list, if you need one mangle rule for both subnets. Add both networks to /ip firewall address-list, set one mangle rule with src-address-list. 2) Create two mangle rules with the same mark-connection/mark-packet. i know but i wanted to know in source address i separate them with comm...

eghtedari2000

hi

i have 2 range of ip

172.17.5.0/24 and 192.17.6.0/28

i want to mangle these, can you please say me in source address with which character , i can separate them form together?

thanks

eghtedari2000

add comment="" name="Extension \" .exe \"" regexp="\\.(exe)" add comment="" name="Extension \" .exe \"" regexp="\\.(zip)" question can we make it in one line to add tow extension toghether try add name="ExtensionZ&...

eghtedari2000

I don't understand the question. explain you more. for example in my router i have 100 mb of bandwidth, but i dont want that users use the all of that for download, i want they can use only 70 mb for download so if i use this script , web browsing will be limit in 70 mb or only download is in 70 mb...

eghtedari2000

The two are the same. Downloading an HTML page and downloading - for example - an MP3 file uses the same protocol.

so i have a question

if i use this script and limit the bandwidth, both download and web browsing limit or only download limit?

thanks alot for your reply

eghtedari2000

From your link: :if ([:len [find name=http]] > 0) do={ :put "already have http" } else={ add name=http regexp="http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\09-\0D -~]*(connection:|content-type:|content-length:|date:)|post [\09-\0D -~]* http/[01]\\.[019]" } That expression detects ...

eghtedari2000

What is a "download application"? Do you mean download managers for HTTP(S), FTP, etc.? Those just talk HTTP, FTP or whatever other protocol they support. "Application" refers to layer 7 of the OSI model, not the executable run on a computer. i want that in layer7 i can detect, ...

eghtedari2000

hi

can everybody help me to have script for " download application " to use in layer 7?

i have this link: http://www.mikrotik.com/download/l7-protos.rsc

but i dont know which is exactly for download!!

thanks

eghtedari2000

Mikrotik Support Object Size ??? not getting ur point.

in linux with object size we an say to OS if the object of that come to router for example bigger than 5 KB have lower priority

eghtedari2000

Downloading with different Sites depend upon the Payload they cary. And it seems that different sites using different payload. So restricting traffic on MTU based is not a gud idea. L7 Filter works with known pattern.

thanks alot

i wany to know mikrotik support "object size"?

eghtedari2000

AFAIK !! The packet size means MTU size of packets. Here you can find the MTU size support on different mikrotik Hardware. http://wiki.mikrotik.com/wiki/Manual:Maximum_Transmission_Unit_on_RouterBoards. You can mark packet according to packet size even port based too via Mangle rule. Then use queue...

eghtedari2000

AFAIK !! The packet size means MTU size of packets. Here you can find the MTU size support on different mikrotik Hardware. http://wiki.mikrotik.com/wiki/Manual:Maximum_Transmission_Unit_on_RouterBoards. You can mark packet according to packet size even port based too via Mangle rule. Then use queue...

eghtedari2000

hi i want to have manage on bandwidth on port 80 for web and download. so i thinks it is better that i work on packet size on port 80 for web and download, because of i think web packets are smaller thatn download packets. at first i wanted to know does it possible on mikrotik that i have manage on ...

eghtedari2000

hi thanks alot for your attention now i use quee tree for my QOS. i wanted to have axact information about that. can you say me how can i limit bandwidth on port and also i dont want to do this limit for all of my users i want to do that for some of my ip address classes. please say me about all of ...

eghtedari2000

hi

i dont want to look to content of encrypted data in packet, i need that router from kind of encryptuion or other way know that it is vpn packet to manage bandwidth for that.

thanks

eghtedari2000

hi

so you said that i cant find packets for although it uses standard vpns that uses statndard protocol, such as ipsec and,...

how can i solve my problem, is there another way?

thanks

eghtedari2000

hi

i mean that my router is pppoe server and i want to control my users bandwidth that take from vpn servers on internet, does it encrypted or not.

and if it is encrypted you said that it is impossible, so how can i control that

thanks

eghtedari2000

hi

i wanted to know can mikrotik work on L7 filter on vpn ( PPTP, L2TP)

if it can, please send me its file

thanks

eghtedari2000

hi

can any body help me about that, i want to have L7 filter on vpn packets, L2TP and PPTP.

if any body can help, please give its file.

thanks

eghtedari2000

hi i configure the router and separate one of my IPs . this range have this policy that " download, p2p and FTP packets" have limited bandwidth and separate by layer7. and other protocols have exterem band. but when i ping i have big delay and browsing is slow. can you help me about that? ...

eghtedari2000

I think, you should read some neighbour topics about queues and priorities. for example, there's no such things like 'strict priority' (http://forum.mikrotik.com/viewtopic.php?f=1&t=40823) - you should (approximately) know your bandwidth, and create leaf queues with necessary limitations for ba...

eghtedari2000

you can match packet size in firewall mangle, and then send in to necessary queue (by packet-mark) really thanks alot for your response speed. i found the packet size, so i think the UNIt is at byte, am i right? also i want to have the first priority for VOIP packets, after that WEB and after that ...

eghtedari2000

if you use PCQ, it's impossible to use burst for each subqueue ok, thanks alot for your guide so i have questions: 1-does it possible to set priority for the size of packet and if it is possible how can i do that 2-does it possible to set priority for kind of packet VOIP, WEB, download and etc. ple...

eghtedari2000

hi all i setup a quee tree in mikrotik and setup priority for bandwidth usage in quee tree. one if my tree is with lowest priority is for download users. and i want to have burst service on the bandwidth of this group, but burst doesnt work when i test, also i cant use burst threshhold because of al...

eghtedari2000

they work together (queue tree and simple queues) but it is not simple configuration. You have to mark packets at certain places, otherwise queues will not limit traffic as you wish it was doing that. I would suggest to watch tiktube.com videos about QoS and read available presentation materials an...

eghtedari2000

you should check very carefully of possible configuration where you combine queue tree and simple queues together. when you figure out how these 2 work together, you can add simple queue for client and use time limit feature in the queue. so you mean that this combination maybe doesnt work or this ...

eghtedari2000

hi i have a quee trees and have priority of bandwidth and other QOS in router also i want to have a script that can let me to limit the bandwidth of some of IPs that are in quee tree from 9 A.M. till 17 . every day in 6 mb/s and between 17 till 9 A.M. in tomorow it can have 20 mb/s. i say again also...

eghtedari2000

i dont understand what do you mean?

eghtedari2000

hi

i had QOS in Quee trees and when i start loadbalance in 2 backbone or start IBGP that can use from service of 2 provider my QOS doesnt work.

can anybody help me?

thanks

eghtedari2000

hi

in the acces gruop of user we can only set user as read or write.

do you have any program in future in new OS to possible us to customize acces of user such az Cisco routers?

Thanks

eghtedari2000

hi

i wanted to say we need to GRE Tunneling in our network , but mikrotik doesnt support that.

is there any program in future OS to help us and solve this problem

Thanks

eghtedari2000

Remove the time constriction from the NAT line you marked red, and add the following to your firewall in a place that makes sense (if you aren't sure where that is post your "/ip firewall filter" ruleset): /ip firewall filter add chain=forward action=drop disabled=no src-address=192.168.1...

eghtedari2000

Remove the time constriction from the NAT line you marked red, and add the following to your firewall in a place that makes sense (if you aren't sure where that is post your "/ip firewall filter" ruleset): /ip firewall filter add chain=forward action=drop disabled=no src-address=192.168.1...

eghtedari2000

Remove the time constriction from the NAT line you marked red, and add the following to your firewall in a place that makes sense (if you aren't sure where that is post your "/ip firewall filter" ruleset): /ip firewall filter add chain=forward action=drop disabled=no src-address=192.168.1...

eghtedari2000

in Terminal, use 'export' command in any submenu (for example, '/ip firewall nat export') Dear Friend Thanks alot from you and excuse me because of latency and ask much of questions from you because of i am not too expert /ip firewall nat add action=src-nat chain=srcnat comment="" disable...

eghtedari2000

i configured a schedular NAT
this part of config, of course

hi

i configured that via winbox, can you send me configuration for schedular firewall

thanks

eghtedari2000

post your config

Dear Friend

thanks alot for your support

which part of router s config do you need?

and you need that in terminal mode?

thanks

eghtedari2000

post your config. in general, you should do the same scheduler as for NAT, but for Firewall Filter with chain=forward

hi

thanks alot

can you help me more about configuration that you said at top, aout schedular firewall and chain-forwars?

thanks

eghtedari2000

Can you start _new_ downloads after the schedule expires, or is it just that connections started before it expired keep going even afterwards? NAT is only applied at the beginning of the connection and then read from a state table, the rule is not consulted again. Instead of scheduling the NAT rule...

eghtedari2000

please explain in more details... i have a free service for night that thet user is a local user in router the username is "night@night" this service is 2-7 a.m. but when you connected from 2 A.M. till the admin kill the user manualy the user can use the service and doesnt stop automatica...

eghtedari2000

hi

i want to have a script that can disconnect all of users that the username is in router ( local ) in a special time, only 1 time in 24 hours.

does it possbile?

or if it is possible i want to have an script that can disable and enable a network interface of router one time in 24 hour .

thanks

eghtedari2000

hi

i configured a schedular NAT on my routers but until i dont disconnect the user manualy the service for the doesnt stop.

can any body help me?

Search found 85 matches