MikroTik

ditonet

Hi, Thanks for your answers. I am familiar with 'wAP ac' devices, my main problem is the selection of the LTE modem. The main advantage of 'wAP R AC' is the integration of everything in one housing, dual-band radio and two Gigabit ethernet interfaces. Hence my search for a good LTE modem, operating ...

ditonet

Hi, I am involved in a project where Internet access will be needed in free-standing devices in public space, LTE is the only available option. I live in Europe and the obvious choice here is 'wAP ac LTE(6) kit', but I don't know the realities in the US and Canada. Is the kit mentioned in the subjec...

ditonet

Personally i use the Open in New window Feature... It makes things easier in many situations...

When you connect to RoMON, this feature is absolutely necessary.
MT should fix it ASAP.

Regards, Grzegorz.

ditonet

@ianngrh
Just tested this:

/queue simple add name="testing" target="10.0.0.254" max-limit="10M/10M" place-before=0;

on CCR1036-12G-4S, ROS 6.45.7 and it works as expected.

Regards,

ditonet

@Rudolfs I just tried to manually upgrade over LAN from version 1.1 (built at Fri Jun 14 2019) to 1.4 and I received only message 'Upgrading... (Please do not interrupt)'. After pressing 'Upgrade' button, green User LED (next to blue power LED) blinked 3 times and start to lit continously. Any advic...

ditonet

The time has come for a new certificate, "MikroTik Certified Surgeon"

ditonet

Please remove it, or at a minimum put it in a separate .NPK from the base OS. maybe a separate soho.npk that includes the torrent client, kid-control and SMB server..

+1000

ditonet

Why do you hold reset button pressed that long?
According to Wiki (https://wiki.mikrotik.com/wiki/Manual:R ... set_button), 5 sec. is enough to reset to factory default.

Regards,

ditonet

Hi,

My setup is: LHG LTE, RouterOS 6.44.3, RouterBOOT 6.44.3, modem firmware "MikroTik_CP_2.160.000_v011" and pass-through works properly.
Configuration of this LHG LTE is not changed for 8 months, only upgrades are applied.

Regards,

ditonet

Thanks, completely forgot about it, it was a few months ago.

Regards,

ditonet

Hello Emils,

Could You explain this?

!) user - removed insecure password storage;

Regards,

ditonet

Plenty of devices with IPSec configured upgraded to ver. 6.44.2, no problem at all. That might explain why @emils asks for a supout.rif from the unique case where it failed 😉 You are right. My post is mostly comment for this sentence: Be careful with this before name a version "stable", p...

ditonet

IPSec configuration completely lost after the update! All profiles 'unknown'. It was neccesary downgrade and restore backup previously done! Major bug! Be careful with this before name a version "stable", please!!! Plenty of devices with IPSec configured upgraded to ver. 6.44.2, no proble...

ditonet

No, there is 'password' parameter to encrypt backup file, eg:

/system backup save encryption=aes-sha256 name=test password=123

Regards,

ditonet

It would be convinient to CAPSAM and DHCP to log to log not only MAC address but also HOSTNAME if it is known. Process of transforming MAC 2 HOST is tedious and if log changes quickly you have no chance to check who is associating/dhcping DHCP server lease script can help you: :local leaseHostName;...

ditonet

@TomjNorthIdaho
RoMON
https://wiki.mikrotik.com/wiki/Manual:RoMON

Regards,

ditonet

I winbox to RB751U-2HnD and RB751G-2HnD via rb751gr2(romon), there is no wireless menu.

Same problem was also with previous version 3.13.

Regards,

ditonet

IMO it's simple shortcut for those who don't want to create 'all-wireless-interfaces' list, nothing more.

Regards,

ditonet

Hi,

Some additional info. There is a Janis' presentation from MUM in USA (https://mum.mikrotik.com/presentations/ ... 556394.pdf).
I made optimization according to advices from this presentation and now max. CPU usage is ~55%

It's definitely worth reading.

Regards,

ditonet

@Chupaka
'Any' means any wireless interface
'All' is name of address list, which can also contain other interfaces (ethernet, SFP, etc.)

HTH,

ditonet

Same question here: How to upgrade? I just bought WOOBM with firmware 1.0 but Wiki shows firmware ver. 1.1. I noticed same problem as nmglabs: "WoobmUSB terminal. Focus on the webpage and input commands. Additionaly neighbor list is empty, but clicking 'Terminal' make connection to my hAP AC. D...

ditonet

Use DHCP server 'lease-script'.
This script is triggered when host connect to network and obtain address from DHCP server.
https://wiki.mikrotik.com/wiki/Manual:I ... er#General

HTH,

ditonet

Yes, benchmarks provided by MikroTik looks very promising. but real-life results are completely different.
In my case WiFi is OK, no complaints about it.

Regards,

ditonet

Hi, Same problem here. I have FTTH 100/100 and similar setup (bridged ethernet and wireless, one simple queue, NAT) with FastTrack enabled. During download/upload CPU is ~95%. Disabling queues reduces CPU usage to ~70%. I've tried almost everything in configuration but without success. Funniest part...

ditonet

print oid

Use this command in terminal, it shows all SNMP OIDs supported, e.g.:

/interface wireless print oid

HTH,

ditonet

@hci
Maybe You should examine 'last-update-before' value?
If is grater than 900s (poll-interval) it indicates that was no synchronization.

HTH,

ditonet

@FIPTech

:local leaseHostName;
:set leaseHostName $"lease-hostname";

Then use 'leaseHostName' variable instead of 'lease-hostname'.

HTH,

ditonet

OK, thanks.

Regards,

ditonet

Address list entry creation time bug ( described here: viewtopic.php?f=21&t=116951&p=579862#p579862) still exists.
It is also not fixed in 6.39rc72.

Regards,

ditonet

This font was downloaded from Google website:
https://fonts.google.com/specimen/Source+Code+Pro
Do you have problem with this font and Polish characters in other apps, e.g. text editor?
Do you see Polish characters when using 'Charater Map' (Tablica znaków) tool?

Regards,

ditonet

Hi,

Upload font which supports Polish characters to 'dude\files' folder, then use it in 'Settings' instead of default Vera fonts.
I use Source Code Pro font:

PL_Chars.png

HTH,

ditonet

My bad, email settings from 'General' tab are currently in 'Notifications'

Regards,

ditonet

Hello,

Today I've noticed that "General' tab disapeared from 'Server configuration' window.

Lost_Tab.png

Dude server 6.38.3 running on CHR, client 6.38.3 running on Win 10.
Does anyone noticed similar problem?

Regards,

ditonet

saved my day

I'm glad that I helped.

Regards,

ditonet

Use firewall/mangle 'connection-limit' matcher to add host to address list.

HTH,

ditonet

Hello,
On mentioned site (https://www.digitalocean.com/community/ ... k-routeros) is third script which extends disk space (according to author description, not tested by me).
Did you try this one?

Regards,

ditonet

@janisk I made AWS test 2 month ago and don't remember details. There were other small problems/inconveniences due to AWS infrastructure, not with CHR which worked fine. I also tested other cloud services and finally I decided to not run CHR on AWS. Currently I run two CHR using other cloud services...

ditonet

@strods
Any info about VLAN belonging to bridge problem described here:
http://forum.mikrotik.com/viewtopic.php ... 37#p578886
Is this bug confirmed by MT staff?

Regards,

ditonet

I have problem with 6.38.1 wireless connection between 2 RB. 1 ap bridge, 2 station bridge. Both connected but no traffic. I saw similar problem, There is a traffic, but can't connect via winbox to RB with station-bridge mode set and no response to ping. Unfortunately I haven't free time to deeply ...

ditonet

Hi. I succesfully spun up an AWS CHR instance (6.38.1), BUT if I attach a second network interface to the instance, it will show as Running in Interfaces with correctly assigned IP address, but otherwise be completely dead (not reachable neither with www nor Winbox). Eventually the whole instance g...

ditonet

Maybe status change 'up -> unstable' is what are you looking for?

HTH,

ditonet

ditonet - Yes, that is correct. We will try to fix this in next RouterOS release.

Thanks.

Regards,

ditonet

hAP ac, ROS 6.38.1, RouterBOOT 3.34:
Firewall/Address-List/Creation-Time shows GMT time, not time according to time-zone settings.
Can someone confirm this?

Regards,

ditonet

Properly configured IPSec tunnel automatically brings up when traffic defined in IPSec policies is detected.
I've got IPSec tunnels between MikroTik and ZyXEL USG 300 and works fine.
Check your config on both sides.

Regards,

ditonet

Default user is 'admin'.
Here is Wiki article about CHR installation on AWS:
http://wiki.mikrotik.com/wiki/Manual:CH ... stallation

HTH,

ditonet

@strods

Any chance to fix VLAN and bridge problem described here:
http://forum.mikrotik.com/viewtopic.php ... 37#p578951

Regards,

ditonet

VLAN interfaces that have a bridge declared as a belonging interface don't work anymore. You need to declare a physical interface instead for it to work properly. It worked ok in previous versions. At least in RB951G-2Hnd Same problem with CCR1009-8G-1S-1S+, VLAN port belongs to bridge and doesn't ...

ditonet

@Micropower
On source map select device (or devices) you want to move, then press Ctrl+C.
Click on destination map, then press Ctrl+V.
Delete unnecessary devices from source map.

HTH,

ditonet

@Yasir
Use WebFig with skins.

HTH,

ditonet

*) firewall - improved "time" option (ranges like 22h-10h now are acceptable); Something is broken with this improvement :( I have firewall rule which worked for months: /ip firewall filter add action=drop chain=forward comment="Block" disabled=no src-address-list=Some_List time...

ditonet

@killersoft
Did you managed to run CHR with second network interface added?

Regards,

ditonet

Hi,
Download link for Dude server 6.38rc24 for CHR is broken

Regards,

ditonet

Maybe you should change firewall logic from 'interface list' to 'address list'?
It's pretty simple to add dynamic PPTP interface's address to address list.

HTH,

ditonet

It seems that Winbox 3.7 solved my problem

Regards,

ditonet

Hello, I've CHR (demo) hosted on VirtualBox as my testing enviroment for Dude. CHR version is 6.38rc10, Winbox is ver. 3.6 When I try to connect to CHR, Winbox crashes during 'Downloading plugins...' and Winbox process terminates. Does anybody noticed similar problem? For other devices (more than 50...

ditonet

CCR1036-12G-4S after update to v6.34.3 lost all IPSec settings. Configuration is empty, even default values. Also is not possible to create new IPSec config using Winbox, SSH or terminal :shock: Terminal gives output: action timed out - try again, if error continues contact MikroTik support and send...

ditonet

Hi,

Thanks a lot, it helped me.

Regards,

ditonet

@mrz
Thanks, I thought that it was separate functionality.

Regards,

ditonet

@mrz Now you can choose multiple DH groups in phase1 and all the chosen protcols are sorted from strongest to weakest protocol before sending proposals to remote peer. Thanks a lot, it looks that currently this option is supported only from command-line, not from Winbox. And what about *) ipsec - pr...

ditonet

@strods

*) ipsec - prioritize proposals;
*) ipsec - support multiple DH groups for phase 1;

Can you explain it? How it works?

Regards,

ditonet

Hi, Some time ago I did it this way: # scan for modem :foreach i in=[/system resource usb find] do={ :local venid [/system resource usb get $i vendor-id]; :local devid [/system resource usb get $i device-id]; # log info ("USB Device -> Vendor-ID: $venid, Device-ID: $devid"); :if (($venid=&...

ditonet

As for AVG issue - I have tested it myself with rc16 and rc17 version but have not managed to reproduce it. It sound like something specific is configured on your AVG when Winbox is recognized as virus. Please test if issue persist when you use rc17. I don't know what AVG version do you use, in my ...

ditonet

@LearningCurve
Use 'Tools/Packet Sniffer' to prove that packets from 'yougetsignal.com' arrive on your WAN interface.

HTH,

ditonet

@LearningCurve
Does DST-NAT rule's counters increase when you check it with 'yougetsignal.com'?
Maybe your ISP block access to this port?

HTH,

ditonet

since it won't work without an accepted forward Unfortunately, you are wrong. the packet gets new dest address and then is considered a forward packet during the route decision phase, and follows the forward path, including the forward filter chain No, packet is directly send to host specified in D...

ditonet

Accept port 8096 in forward chain. Yes, create a new rule with action accept on those ports. This advice is useless, because DST-NAT occurs before 'forward' chain firewall rules. Look at packet flow diagram: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow Remove this part of your DST-NAT rule: dst...

ditonet

Configure NAT rule for FTP data (check FTP server 'passive ports' settings), not only for FTP command (port 21).

HTH,

ditonet

src-address=1.1.1.1

Regards,

ditonet

What's wrong with 'noise-floor'=-116dBm?

Regards,

ditonet

Problem with global variables is not fixed for almost 4 years:
http://forum.mikrotik.com/viewtopic.php ... 3&p=293379

Regards,

ditonet

I runned to another case of increasing sector writes at System/Resources. Steps to reproduce: - open winbox. - check sector writes first to check it is not changing. - go to ip --> firewall --> connections. - stay there browse the list. - sector writes start to increase by 1 - 2 every second untill...

ditonet

@timd93
What wireless package do you use? AFAIK 'wireless-fp' package is necessary to use 'Mikrotik_Wireless_VLANID' and 'Mikrotik_Wireless_VLANIDtype' attributes.

HTH,

ditonet

I've got a small, simple suggestion. Please make an option to disable/enable drag and drop of RouterOS configuration entries in Winbox. I'm a cautious user, but from time to time I move some firewall rules and I already locked myself out a few times, or disturbed traffic for multi-thousand-user net...

ditonet

AFAIK from technical point of view Winbox's look and functionality depends on DLLs downloaded from router (located in folder AppData/Mikrotik/Winbox). These DLLs are part of ROS, hence my opinion that you don't expect they do something with it. IMHO for MikroTik ROS 5.x is already a past :( . Regards,

ditonet

Should it behave this way and why not to unify it ? According to changelog, latest version 5.26 is 17 months old and is pretty stable. IMHO, MikroTik is not interested in changing anything in ROS 5.x and don't expect they do something with it, even if you are asking about adding icons :) . They are...

ditonet

3. For RB133C3 WinBox looks different.

It's typical, Winbox internal look (buttons, etc.) depends on ROS version on device connected to.
The same is with ver. 2 of Winbox, e.g. for ROS 6.x buttons have icons, for 5.x don't.

Regards,

ditonet

Wiki page mentioned by you also states: alogin.html - page shown after client has logged in. It pops-up status page and redirects browser to originally requested page (before he/she was redirected to the HotSpot login page) flogin.html - shown instead of login.html, if some error has happened (inval...

ditonet

MikroTik's Dude demonstration system is running ROS 6, it works, and system packages don't include a Dude package. So how is it working? Hopefully I could do mine the same way they are doing theirs now. To be exact ROS 6.16rc3. Maybe this version works fine with Dude package. Here is Normis' answer...

ditonet

@macsrwe
http://wiki.mikrotik.com/wiki/Manual:The_Dude/Agents
Unforunately MikroTik removed Dude packages (.npk) from web page, due to incompatiblity with ROS 6.x

HTH,

ditonet

There is a list of supported Ethernet chipsets:
http://wiki.mikrotik.com/wiki/Supported ... t_chipsets
Usually Intel is best choice.

HTH,

ditonet

Restrict access to router using 'IP/Services' as described here:
http://wiki.mikrotik.com/wiki/Manual:IP/Services

HTH,

ditonet

ROS 6.21.1 / RouterBOOT 3.19 on RB951Ui-2HnD.
Profiler permanently shows 'DNS' CPU usage over 80% and DNS resolver stops resolving after few hours.
After downgrade to 6.20 problem disappeared.

Regards,

ditonet

Also, you can use verbose=yes when importing script to see the actual output where might be the problem.

I don't like to complain, but why the heck such useful option for script import is not documented in Wiki???

Regards,

ditonet

bajodel is right, something is wrong with '.local' domain and Apple devices.

Regards,

ditonet

@gcs
For succesful netinstall connect your RB via Ether1, on other ports netinstall doesn't work.
I've netinstalled RB433AH in my office two weeks ago, without problems.

HTH,

ditonet

So please remove these entries and see if it works

I don't need to remove them, because they don't exist in my hotspots.
But I agree, user eduardi should remove them.

Regards,

ditonet

do this only if you know what you are doing and why

This is general life advice

But seriously, eduardi's post shows that he probably follows mentioned above Wiki article.

Regards,

ditonet

why do you put those things in walled garden? this will make hotspot not work. apple checks those sites, and if it detects hotspot, login page is opened. if you put them in walled garden, iphone thinks that you have internet, and doesn't open login. Maybe he did this, because MT Wiki suggest this: ...

ditonet

[grzegorz@Some_Gateway] /ip firewall service-port> export # oct/09/2014 13:38:06 by RouterOS 5.26 # /ip firewall service-port set ftp disabled=no ports=21 set tftp disabled=no ports=69 set irc disabled=no ports=6667 set h323 disabled=no set sip disabled=no ports=5060,5061 sip-direct-media=no set pp...

ditonet

This 'new' option exists even in ROS 5.x and is described here:
http://wiki.mikrotik.com/wiki/Manual:IP ... vice_Ports

Regards,

ditonet

MTU has value "0" and is marked red colour as error!

Yes, you are right, but it's probably Winbox error only.

ros code

/interface pppoe-server print detail

shows proper MTU value.

Regards,

ditonet

pitr wrote: My 6to4 tunnel to tunnelbroker.net broke with 6.20. Can't even get them working again if I redo the configuration completely. Thanks for the heads up. I was too busy the past few days to upgrade mine to 6.20 (they're currently on 6.19). Guess I'll leave them at 6.19 till the problem is ...

ditonet

ros code

/interface pppoe-server server> set max-mtu=auto

HTH,

ditonet

@bigcw Probably problem occurs because you invoke command: /system reset-configuration skip-backup=yes no-defaults=yes run-after-reset=second.rsc with option no-defaults=yes . In this case router is not set to factory default configuration, but everything is cleared. http://wiki.mikrotik.com/wiki/Ma...

ditonet

@rkau045
I made test and you are right.
Now I'm considering what to do to protect 'forward' chain in case of dynamic UPnP NAT rules.

Regards,

ditonet

No DST-NAT = INPUT DST-NAT = FORWARD This is obvious for me and always was, read my posts. Few posts earlier I asked you with example: E. g. my WAN interface address is 1.2.3.4 and this interface receives packet with dst-address 5.6.7.8. According to your post this packet will be forwarded by route...

ditonet

@rkau045 Your logs clearly shows what I wrote in my previous post. According to packet-flow diagram if SYN packet hits WAN interface, first is checked against DST-NAT rules and router's service ports (Winbox, SSH, etc.). Next this packet flows to 'input' chain, where is dropped (in my case) by filte...

ditonet

@rkau045 There is no matcher for SYN packets in these rules. therefore they follow the default policy of ACCEPT. This is how a new connection is established. Are you sure that these SYN packets from WAN side hit 'forward' chain, not 'input'? For what reason? According to packet-flow diagram if SYN p...

ditonet

you are ACCEPTING ALL TRAFFIC transiting your router via the default ACCEPT policy of the router, i.e. you have no firewall for forwarded traffic. No, I accept established and related connections only and drop invalid. Any packet sent to your router with any destination address that is not the rout...

ditonet

But am I correct that everything is allowed on the forward chain then? My basic config for 'forward' chain is: Allow if connection-state is 'established' and 'related' Drop if connection-state is 'invalid' /ip firewall filter add chain=forward comment="default configuration - established"...

ditonet

@rkau045 The problem is that I have devices that should accept New connections on the ports set up by UPnP, but standard firewall rules will drop that traffic without the accept rule added for the local subnet. IMHO 'standard firewall rules' definition is different for every network administrator :)...

ditonet

@aya & rkau045 I don't know how your configuration looks like, but my UPnP settings works perfectly without filter allow rule to DST-NAT'ed ports. usually all the last rule in the firewall forward prohibits the passage of incoming connections. Why 'forward' chain, not 'input'? Properly configure...

ditonet

DST-NAT is done before any firewall filter.
Check packet flow diagram first:
http://wiki.mikrotik.com/wiki/Packet_Flow#Diagram
UPnP works properly on MikroTik routers.

Regards,

ditonet

Ok, so even this doesn't work... Code: export verbose file=second.rsc /system reset-configuration skip-backup=yes no-defaults=yes run-after-reset=second.rsc Again, no IP addresses after reboot. Only option is to factory reset. My advice is to divide this into two steps: 1. Reset RB configuration (w...

ditonet

Maybe this article will help you solve problem:
http://wiki.mikrotik.com/wiki/Flashfig

HTH,

ditonet

@econet
Use Ethernet over VDSL2 Converter (http://www.planet.com.tw/en/product/pro ... p?id=21749).
Only one cable pair is necessery for data transmission, so second cable pair is available for power.

HTH,

ditonet

I have tried to edit the 'backup' file, but it's mainly binary. You are right, these files are binary and non-editable. Only script files (.rsc) generated by 'export' command are editable. Export your configuration, but use this command: /export verbose file=test Without 'verbose' switch only diffe...

ditonet

One of my customers has this modem working with RB751 (but this is currently EOL product).
IMHO every RouterBoard with USB port should work, e.g. RB951Ui-2HnD.
Do not expect 4G connection, only 3G (PPP client, not LTE).
You must also search Google how to set this modem to work with RouterOS.

HTH,

ditonet

Read Wiki article
http://wiki.mikrotik.com/wiki/Winbox
and access your router using MAC address.

HTH,

ditonet

I tried exporting the configuration, but that is the same - MAC addresses hard coded in. Removing 'mac-address' and 'orig-mac-address' from exported .rsc file is not enough? You have to do this only once. Below is link to utility which simplify editing of .rsc files: http://wiki.mikrotik.com/wiki/M...

ditonet

My all Point to Point devices currently working with -111, but still I feel latency instability.

Please advise is it good value, if not then what to do to reduce the Noise Floor.

You can't change Noise-Floor value, because it's measured value of enviroment noise.
-111 dBm is good value.

HTH,

ditonet

Did you define MikroTik dictionary (custom VSAs) on your RADIUS server?
http://technet.microsoft.com/en-us/libr ... 10%29.aspx
What are currently defined Access-Accept atributes?

Regards,

ditonet

According to the RFC 2865: 5.30. Called-Station-Id Description This Attribute allows the NAS to send in the Access-Request packet the phone number that the user called, using Dialed Number Identification (DNIS) or similar technology. Note that this may be different from the phone number the call com...

ditonet

I notice the CAPsMAN will cause all the connected APs not working when the CAPsMAN is down, is there anyway the CAPs will copy the CAPsMAN configuration and store on it self ? Thank you for the suggestion - we will think about those features. Implement this ASAP, please. CAP must be able to work, e...

ditonet

If the dynamic IP is a problem, I will tell the customer to get a static IP without router as he has in the other offices. Yes, MT should be connect directly to WAN, with static IP address. I found few mistakes in your config: /ip ipsec peer 'local-address' must be your public (WAN) IP address, not...

ditonet

phase1 negotiation failed due to time up In RouterOS, phase 1 settings are in 'IPSec/Peer'. According to your previous post on Firebox side PH1 settings are: PH1 transform SHA1-3DES, DH2, SA life 8h On RouterOS side: /ip ipsec peer add address=89.xxx.yyy.196/32 enc-algorithm=aes-256 exchange-mode=a...

ditonet

I am far from being a pro, but I think the setting should work. You are wrong, config on MikroTik side is completly messed up. Do not use 'aggressive' mode, use 'main' instead. NAT-Traversal should be 'no'. Why do you have same addresses for 'dst-address' and 'sa-dst-address' ? Same with 'src-addre...

ditonet

I never noticed any problem with my Xbox.
Firewall is enabled and everything works fine.
Remember to enable and configure UPnP.

Regards,

ditonet

http://www.mikrotik.com/download
Can be downloaded as separate package.

HTH,

ditonet

Some problem but no rule some RB working some not, 433AH working, 433GL no, one Groove is ok other not. Solution: Winbox 1. Open clock 2. Select time zone manual click apply 3. Select back your time zone click apply 4. Click OK (must click ok ) Log time is now ok. Log shows events with GMT time, no...

ditonet

Log shows events with GMT time, not according to timezone.
Tested on RB433AH and RB951-2n with latest RouterOS and RouterBOOT.

Regards,

ditonet

So do you scheduled this EXE to run on a regular basis and put the text files on a web accessible server to download into your routers on a regular basis?

Yes, you are right.

Regards,

ditonet

I wrote similar app almost year ago, it converts SpamHaus and OpenBL lists to RouterOS script file (.rsc).
My app is Windows executable, attached to this post.

List2Script_Conv.zip

Hope you find it useful,

ditonet

@marrold
Tested on v.6.10, your code returns IDs of all routes with comment, not only one with specific comment (e.g. 'lala').
You are right, it's probably ROS bug.

Regards,

ditonet

Simple, change the TTL of the packet to 1 in the mangle rules. /ip firewall mangle add action=change-ttl chain=forward in-interface=<WAN INTERFACE> new-ttl=set:1 passthrough=no That way when a packet flows over their router, it will decrement the TTL by 1. The router will then see that and drop the...

ditonet

Hi, virtual usb not needed, they can use IPP http://ru.wikipedia.org/wiki/Internet_Printing_Protocol OK, but in this case all necessary conversion 'IPP -> USB' must be done by router software, because we are talking about printers without network interface. This conversion is printer specific, thus...

ditonet

drivers for printer on the end-user machine If we are talking about drivers, there is also need to provide driver for 'Virtual USB Port' for every operating system. This is another extra work for developers :) . Many manufacturers offer USB print servers and every comes with 'Printer compatibility ...

ditonet

Bad idea.
Every USB Print Server has 'printer compatiblity list'.
Not every printer is supported, only mentioned on that list.
It's a endless work for developers adding support for new printers.
Just my two cents.

Regards,

ditonet

Not so fast. Some new hope did appear during the MUM.

Normis, more information, please.

Regards,

ditonet

Why only 400Mhz? Old CRS have 600Mhz

Probably MT decided that it's mainly switch and router functionality is 'additional feature'

Regards,

ditonet

SSH from outside local network works properly.
Probably your firewall config lacks 'accept' rule for SSH in 'input' chain on WAN/PPPoE interface.

HTH,

ditonet

Nice tool, thanks. I have a feature request: 1. add ability to define port used by SSH service, currently is fixed to 22. I always use non-standard port for SSH to prevent automated port scanning. 2. some kind of credentials encryption in 'data.xml' and 'settings.xml' files. Maybe I'm slightly paran...

ditonet

http://wiki.mikrotik.com/wiki/Manual:CAPs_Manager
So now we probably know what will be announced during MUM

.
Looks very promising.

Regards,

ditonet

I noticed that the newer ROS version refer to a "firmware" folder (system -> ports -> Firmware). How is this used?

This question is answered here:
http://forum.mikrotik.com/viewtopic.php?f=13&t=70779

Regards,

ditonet

Noticed on v6.9 and this is still present is v6.10 as well - Times in log are always in +0 gmt offset even though I have set up another time zone. When going in system->clock it shows correct time, in my case 19:57 at the moment (gmt offset +02:00), but in log it shows 17:57 Very interested, for me...

ditonet

I'm using a 3G stick for WAN that does not have a fixed IP address. That's why I used 0.0.0.0 for source.

It's possible to read WAN IP address and set it in 'IPSec/Policy' using script.

Regards,

ditonet

sa-src-address=0.0.0.0

SA-Src-Address should be set to your public (WAN) IP, and this NAT rule is not necessary:

add chain=srcnat dst-address=192.168.10.0/24 src-address=10.32.0.0/16

BTW, you didn't post your 'IPSec/Proposal' settings.

HTH,

ditonet

@macsrwe
Run Notepad, next run Dude.
On device list or network map select interesting device, then click 'Copy' button on Dude toolbar.
Switch to Notepad and paste (Ctrl+V).
You should see whole device configuration including password as XML file. That's all

.

HTH,

ditonet

Currently CCR1036 and CCR1016, both ROS v.6.9, so far so good.

Regards,

ditonet

Probably it's impossible to use these 'character constans' from script.
Maybe you should make feature request for this.

Regards,

ditonet

As Wiki says (http://wiki.mikrotik.com/wiki/User_Mana ... _constants),
these 'character constans' are available only for voucher template.
Is not mentioned in any place that they are also available from scripts.

Regards,

ditonet

AFAIK last number in these OIDs is physical interface number,
so 'ether-1' is .1.3.6.1.2.1.2.2.1.10.1 and so on.
Maybe your WAN interface on other RouterBoards is not configured on 'ether-1' hence differences.

HTH,

ditonet

Are you kidding? Wait some days until user reports say it's save and then do it.

It looks that only I was brave enough, to upgrade router located 210 km away from me

.
But everything went fine, so far so good.

Regards,

ditonet

happens that the second rule is always red

Even between 00:00:00 - 06:00:00 ?
Or you never checked this during mentioned above period of time?
Time rules become red/invalid when they are out of specified time.

HTH,

ditonet

http://wiki.mikrotik.com/wiki/Netinstall

HTH,

ditonet

Ability to display custom bitmap and message will be very useful.
+1

Regards,

ditonet

Just upgraded CCR1036-12G-4S, everything looks good.

Regards,

ditonet

The TCP state said "Established"

It only means that SSH client is connected to router, but not authenticated using user name/password.
Maybe someone tried to brute-force SSH service.

HTH,

ditonet

Increase RADIUS timeout setting. Default value of 300ms sometimes is too low.

HTH,

ditonet

It'll be nice if you deploy one CRS as a demo system (similar to demo.mt.lv and demo2.mt.lv) so that the community can see what's the switch management looks like in the UI on a live system.

+1

Regards,

ditonet

AFAIK 'WLC' will be a separated package.
I've compared separated package files,
only 'system-mipsbe.npk' is bigger than usually.

Regards,

ditonet

Did anyone noticed that latest mipsbe .npk file is bigger?
11.6MB instead of usual 9.8MB.
I'm very curious what made such difference.

Regards,

ditonet

Just create local hotspot 'admin' account. http://wiki.mikrotik.com/wiki/User_Manager/Hotspot_Example Note, first local HotSpot Users database is consulted, then User Manager database. It means that if you have configuration in '/ ip hotspot user print', users will be able to authenticate in HotSpot...

ditonet

http://wiki.mikrotik.com/wiki/Manual:IP/Settings
Probably 'ARP-timeout' property is what you are looking for.

HTH,

ditonet

You don't have IPSec policies defined.
For site-to-site IPSec VPN don't use

ros code

generate-policy=yes

but define policy manually.

Also you must change to:

ros code

exchange-mode=main

HTH,

ditonet

I have a problem FORWARDING port 80 to my PS4. What if I wish to run a webserver?

Check router's 'IP/Services', probably WWW is enabled.
Disable WWW service (Webfig) or change port used by it.

HTH,

ditonet

How do you try to change password? Using Winbox, then 'System/Password' I'm able to change it. If You are trying with 'System/Users', double-click on user name, then 'Password' button, it ends with with message 'Couldn`t change Change Password - not permitted (9)'. In first case user is changing it'...

ditonet

Why this user cannot change own password.

Enable 'password' policy for this user group.

HTH,

ditonet

@rado3105
Try this:

ros code

/system routerboard settings set force-backup-booter=no
/system routerboard upgrade
/system reboot

HTH,

ditonet

In case you use Windows 7 and are to buy an USB adapter, make sure to NOT buy a Prolific chip based adapter.
See my post about Serial Connection With Windows 7.

Just FYI, for 3 years I've never noticed problems described by you using Prolific PL-2303 XA/HXA converter on Windows 7.

Regards,

ditonet

N - negative

HTH,

ditonet

http://wiki.mikrotik.com/wiki/Netinstall

HTH,

ditonet

Decrease 'tcp-established-timeout' to 5 minutes.

Regards,

P.S. I'm going on New Year's party

ditonet

Unreplied is no........................... not yes as would be expected!

This bug was fixed year ago, in ROS v.6.0rc6 if I remember correctly.

Post your conntrack settings:

ros code

/ip firewall connection tracking export

Regards,

ditonet

v5.25 does not have a time out setting for "unreplied" !

I've asked about shown values:

unreplied_timeout.PNG

Regards,

ditonet

Post your conntrack settings, please.
What is higher 'timeout' value for unreplied connections shown by Winbox?

Regards,

ditonet

Did you try to decrease TCP SYN-timeouts in conntrack settings?

Regards,

ditonet

need help here with a script to run every 5 minutes to delete from tracking table all connections that meet the following criteria.
1: tcp+(!SA)+(!local network ip's)+established

Just out of curiosity: Why do you want to remove established connections?

Regards,

ditonet

Add 'incoming' and 'outgoing' interfaces as conditions to rule.

HTH,

ditonet

You have to lower transmitting power on your devices.
Signal strenght should be -60 to -50 dBm for best results.

HTH,

ditonet

Strona o podanym adresie nie istnieje

http://www.cdr.pl/p2009,mikrotik-router ... os-l4.html

HTH,

ditonet

@plankanater
Disable 'policy' permission for this user.

HTH,

ditonet

Try interface name without quotation marks:

ros code

/ip dhcp-client set [find interface=ether1] disabled=yes
/ip dhcp-client set [find interface=ether1] disabled=no

HTH,

ditonet

On Up:

ros code

/ip dhcp-client set [find name="ether1"] disabled=yes;

On Down:

ros code

/ip dhcp-client set [find name="ether1"] disabled=no;

HTH,

ditonet

Thanks for info.

Regards,

ditonet

@Normis
Is it possible to recognize newest design devices without unit disassembly?

Regards,

ditonet

Your 3G modem is not supported by RouterOS, hence that results.
http://wiki.mikrotik.com/wiki/Supported ... e#3G_cards

Regards,

ditonet

@flexus #count config :local start ("100"); :local stop ("250"); :local poolcount; :global count ($start); :for count from=$start to=$stop step=1 do={ :set poolcount ($count + 700); /ip pool add name="pool$poolcount" ranges="10.0.$count.20-10.0.$count.250"} HTH,

ditonet

ros code

[find default=no]

doesn't work for you?

Regards,

ditonet

I've never noticed problem described by you.
Add logging for NTP

ros code

/system logging add action=memory disabled=no prefix="" topics=ntp,!packet

restart router, wait 20 minutes, then log-in and check NTP logs.

HTH,

ditonet

I assume flash become damaged somehow.

Sad mikrotik doesn't have stronger software restore procedure for such situations.

You are denying yourself. How to restore software in case of hardware failure?
If you can't Netinstall this RB751G, just RMA it.

Regards,

ditonet

:foreach s in=[/interface sstp-server find where disabled=no and running=yes] do={ :local sstpsrvr $s :local clip [/interface sstp-server get $s client-address] :if ([/ip firewall address-list find (list=VPNLINKS && address=$clip)] = "") do={ /ip firewall address-list add list=VPN...

ditonet

As Wiki says:

RouterOS licensing scheme is based on SoftwareID number that is bound to storage media

If you want to install RouterOS on another disk probably you must buy new licence.

Regards,

ditonet

Connect patchcable to RB's Ether1 port. Unplug power, press reset button and hold it. Power up device and release reset button when green LED stops blinking, or your RB will be visible on Netinstall's routers list. This procedure is described in Quick Setup Guide: http://routerboard.com/pdf/423/rb20...

ditonet

http://wiki.mikrotik.com/wiki/Netinstall

HTH,

ditonet

@jkrepinsky
I have no more ideas what's wrong

.

Regards,

ditonet

@jkrepinsky Does your CDMA modem work properly when is connected directly to PC? I have AnyDATA ADU-895L (notice L , not H) and works fine with ROS 6.0rc12. IMHO, one thing is missed in our considerations, even the same modem type can have different firmware version. Maybe this is reason why for one...

ditonet

When you are trying to connect to Metal using MAC-Telnet,
is Metal 'wlan1' interface visible on Neighbor list on RouterBoard you connect from?
(Winbox/IP/Neighbor)

Regards,

ditonet

@Ivoshiee
IMHO, MT permanently make some improvements, never mentioned in changelog.
As I wrote earlier I had problem (disconnections) with AnyDATA ADU-520L and RC10.
These disconnections never occured with RC12.

@w0lt
http://www.mikrotik.com/download/share/ ... .0rc12.npk

Regards,

ditonet

Is 'wlan1' MAC-Address not visible when you click Winbox's [...] button?
Maybe neighbor discovery is disabled on 'wlan1' inteface?
http://wiki.mikrotik.com/wiki/Manual:IP ... _discovery
Or you are not able to connect even if MAC-Address is typed directly into Winbox?

HTH,

ditonet

I've asked support about this two months ago.
According to Sergejs' answer 'distance for default route for PPP clients' is on TODO list, but no exact time frame.

Regards,

ditonet

Try latest ROS 6.0rc12

Regards,

ditonet

Probably MAC-Server is disabled on 'wlan1' by default.

HTH,

ditonet

What CDMA modem do you use?
I had similar problem with AnyDATA ADU-520L.
Upgrade RouterOS and RuoterBOOT to latest version and observe what happend.

HTH,

ditonet

Do you think that this home-made powering might be problem?

I've asked because USB port is limited to 500mA and two modems connected to hub without external PSU overload USB port.
As I wrote earlier, not every USB hub works properly with RouterBoard.
Try another one with different chipset.

HTH,

ditonet

@jkrepinsky
Is your USB hub powered by external PSU?
Two month ago I made similar config (hub + 2 modems) and everything was OK.
I've tested two different hubs and finally worked one built using NEC chip.
Unfortunately, I don't remember what exactly chip it was.

HTH,

ditonet

Run Winbox, then 'IP/Routes/Rules tab'. Add new rule, Table='new table name', action=lookup. http://wiki.mikrotik.com/manual//ip/route/rule#table But new table is still useless without routing mark, because 'routing mark name' is 'routing table name'. Packets without routing mark are checked against...

ditonet

Complete solution made by Cyberbajt http://www.cyberbajt.pl/produkt/5003/

HTH,

ditonet

Use 'routing-mark' when adding new route as described here:
http://wiki.mikrotik.com/wiki/Manual:IP ... properties

HTH,

ditonet

Here is manual how to create self-signed certificates:
http://wiki.mikrotik.com/wiki/Manual:Cr ... rtificates

HTH,

Search found 836 matches

ros code

ros code