MikroTik

blake

Is your Equinix peer in the same BGP instance?

Do you mind posting the config of both neighbor sessions, and associated filters?

blake

Could you post the configuration for the neighbors you are redistributing this to?

blake

Nothing needs to be done. Configure your router with your 4-byte ASN. Your peer will configure the session toward you with remote-as=23456. You will use their regular AS in remote-as=. BGP will bring up the session, and your upstream will see your AS as the 4-byte transitional ASN. The rest of the w...

blake

My problem is that, how do I tell the RB's to only route the radius authentication traffic over the PPTP tunnel(ports 1812/1813)? Just create a static route for your RADIUS server's IP (ie 192.168.1.5), and point it to the VPN gateway. /ip route add dst-address=<radius IP>/32 gateway=<PPTP tunnel's...

blake

Why don't you guys try this?

/ip route print where bgp and 177.66.x00.1 in dst-address

You're welcome.

blake

Got one more slight problem. DHCp is authing and assigning correct pool fine. But when the hotspot authenticates however because it sees Framed-Pool it assigns another IP on hotspot to-address so two IPs are used!! Do you know if there is a rule like above that can omit the radreply Framed-Pool whe...

blake

So can I just clarify that your saying Freeradius can be setup to send access-accept when getting a dhcp request even if NAS is not sending password? Can I just be clear what your saying can be setup only to authorize a DHCP request as it's important the hotspot continues to have same auth method a...

blake

Yes, MikroTik's DHCP server does not send the User-Password attribute. If your configurations requires a password then you can easily set it in the RADIUS server. Here's how to do it if you're using FreeRADIUS:

authorize {
  update request {
    User-Password = "%{User-Name}"
  }
}

blake

You can use RADIUS to instruct the NAS to disconnect a user after either of these values. Look the following link for more info.

http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client

blake

FreeRADIUS.

I am using this with EAP-PEAP. Works perfectly.

blake

How are you setting up the RADIUS server?

/radius
add service=wireless address=<some ip> secret=mySecret

?

blake

Two ways. Both require you to have an autonomous system number (ASN). 1. Setup a BGP session with the customer and let them advertise their IP prefixes into your AS. Contact your upstream provider(s) and request they add this ASN & prefix to their filters for your connection. Explain to them tha...

blake

Adjust the l2mtu parameter on the Ethernet port to something higher than 1500. The RB1100AHx2 supports a maximum l2mtu of 9498.

/interface ethernet set ether1 l2mtu=9498

blake

Look into Route reflector option. it will pass the learned routes to the next router. No, this is not needed. Route reflectors are only used to 'reflect' routes to other routers in the same AS. You would never enable route reflector functionality with an upstream peer. swapwnet, could you please po...

blake

CloudCore is brand new, unproven hardware. Who knows how long it'll take to get the bugs worked out. 100G? Buy the ASR9K if it'll handle your workload. I would imagine if you're buying that bandwidth capacity that you have a large amount of revenue, and will be able to pay it off in a reasonable amo...

blake

He's asking if MikroTik will pass MPLS packets that encapsulate a non-IP packet.

Cisco - Any Transport over MPLS (AToM).

I'm curious about this as well. I have Cisco & MikroTik equipment to test this. I just need to find time to build the lab.

blake

Apply an inbound route filter to your BGP multi-hop session which changes the next-hop of received routes to that of their router on the /30. Something like this. /routing filter add chain=cogent-in set-nexthop=a.a.a.a / routing bgp peer add name=cogent-a remote-address=a.a.a.a remote-as=174 multiho...

blake

/ip route print where static

blake

# Route Reflector

/routing bgp instance
set default client-to-client-reflection=yes

/routing bgp peer
set peer1 route-reflect=yes

# Clients

/routing bgp instance
set default client-to-client-reflection=no

/routing bgp peer
set route-reflector route-reflect=no

blake

Are you advertising the prefix with 'synchronize=no' under /routing bgp network?

blake

:put [/ip firewall address-list get value-name=list [find address=192.168.x.x]]

blake

There are graphing programs available outside of MikroTik which can graph at 1 minute intervals, although its resource intensive with a large number of hosts & thus usually avoided. The graphs are not 100% accurate because they're averages of data over a 5 min polling period, but they give a fai...

blake

/ip firewall filter
add chain=forward action=drop in-interface=vlan_network out-interface=!internet

blake

Escribir en Inglés, por favor. Este sitio es un foro sólo Inglés.

blake

Yes.. if i issue the following command... ping 192.168.88.1 -t -l 5000, does it mean i am pinging with 5000 size of packet? It means you are pinging with 5000 bytes of just ICMP payload. Add 8 bytes for the ICMP header, and 20 bytes for the IP header and that'll put you at 5028 bytes. This value of...

blake

Cisco Catalyst 3750.

blake

I'm using SXT clients with WDS interfaces in a bridge & I was having this problem. I had to MAC telnet to the SXT's ether1 MAC instead of its wlan1 MAC.

blake

Ports may be configured as edge ports if they are attached to a LAN that has no other bridges attached. These edge ports transition directly to the forwarding state. RSTP still continues to monitor the port for BPDUs in case a bridge is connected. Source: Wikipedia: Spanning Tree Protocol #RSTP Ope...

blake

Utilize static WDS interfaces and add those interfaces into a bridge with the VLAN interface. Here's what I do. AP: /interface vlan add interface=ether1 disabled=no name=vlan10 vlan-id=10 add interface=ether1 disabled=no name=vlan11 vlan-id=11 /interface bridge add name=bridge10 comment="VLAN 1...

blake

I'm looking to get some input regarding the best method for separating CPE management & subscriber traffic in a bridged environment. What I'm trying to achieve: RFC1918 address on CPE for management, segmented from customer traffic. Customer traffic bridged onto VLAN at AP. Low complexity provis...

blake

It goes to the input chain because the dst-address is an IP that is local to the router.

You haven't described your topology in great detail. But, I would assume you're looking for this. http://wiki.mikrotik.com/wiki/Hairpin_NAT

blake

My only concern is that this came from Amazon Cloud (Frankfurt) and not from Latvia even if I select Latvia. They likely just chose the Latvian download location as a way to test Amazon distribution. I assume if it works well they will remove all of the country-specific download locations and just ...

blake

Possibly, this had nothing to do with it and just the change restarted the OSPF process on the cisco and that restart fixed the issue. I think it had nothing to do with it. I have multiple Cisco's, all using 'passive-interface default' in the OSPF configs, and the MikroTik's will still lose the def...

blake

Firewall filters are the only solution right now. I believe your customers should only be able to ping interfaces local to their PE router which are in other VRF's. I haven't tested it lately, but that's the behavior I recall when I tested VRF's on MikroTik.

blake

Are the clients on the 192.0.0.0/24 subnet receiving 192.0.0.1 as a default gateway? If so, this should work.

Also, best practice is to use RFC1918 addresses for internal use instead of picking random IP's.

blake

When the issue occurs, this particular redistributed static route is the only route that doesn't come up. The native OSPF networks and the other redistributed connected/static (about a half dozen from this router) do come up properly. The only difference between this route and the others is that it...

blake

Does anyone have any update on this? I have routers running 4.11, 5.4, 5.7, and 5.8 which all experience this.

blake

Post your current BGP configs on each router. That would assist us in finding your error.

blake

OSPF router ID should not be changed after the OSPF process has been started. OSPF router ID change resets all OSPF adjacencies, resulting in temporary router outage. The router also has to originate new copies of all its LSAs with the new router ID. Stale copies of the LSAs originated by the “old”...

blake

Just create a bridge interface with zero member ports. The interface will always be active and thus will function as a regular loopback interface. This is the only way to emulate a loopback using RouterOS.

/interface bridge add name=loopback0

blake

I do not put the actual wlan interfaces into the bridge. I only add the client WDS interfaces, and the VLAN interface I want to bridge the clients onto.

blake

Yup, did that. I guess you never received it.

blake

I emailed you. Have you replied? I haven't seen it.

blake

PHP for front end. Any particular web development framework? and some sneaky back end scripting, linux based. I'm curious to know the reason for this. I may be interested in assisting, depending on current time constraints. PM me on the UBNT forums. I'm registered there under the same username.

blake

What language is it begin written in, and for what platforms (Windows or Unix)?

blake

http://www.roxwel.com/news/its-not-a-bu ... nters.html

Graph the MT using SNMPv2 and 64-bit counters.

blake

what is SM?

Subscriber module.

Customers on our legacy gear receive a single IP from a shared /24 on a 'static IP VLAN'. All of our fixed WiMAX customers receive a /29 or greater on their own dedicated VLAN.

blake

Rack 2 needs some wiring attention.

blake

You're right, its only needed on AS2.

Can you post your BGP peer and filter configs?

blake

AS 1
/routing bgp instance
set 0 confederation-peers=2,3

AS 2
/routing bgp instance
set 0 confederation-peers=1,3

etc…

blake

You need Spanning Tree Protocol. http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge Assuming your Ethernet ports are all members of a bridge on the MT's, then you could do something like this: ## MikroNOC ## /interface bridge set 0 protocol-mode=rstp priority=0 ## Router A ## /interface bridge se...

blake

Correct.

blake

On the router which connects to the internet:

/routing ospf instance
set default distribute-default=if-installed-as-type-1

It will broadcast a default route to the other OSPF routers as long as it also has a default route in its own routing table.

blake

My issue is that I have limited WAN experience. If I get issued a block of IP's from my service provider, how do I setup the Mikrotiks to pass those public IP's out to each location just as a normal ISP would do? MCT is correct in that this is really no different than private IP management. Operati...

blake

MikroTik was not designed for this. First and foremost it is a router operating system. Everything else is just interesting additions.

Look at Squid, nginx, or Varnish Cache. They're designed for that type of application.

blake

Great, thank you for that.

Yes, a 2800 series will not handle full BGP with three providers. If you stick with Cisco you may get away with a 7200 with a NPE-G1.

But, since you want to use MiroTik…go with the MikroNOC.

blake

we have 3 internet feeds from 3 different providers, with full BGP, and AS That quote led me to believe you were receiving full tables from three different providers. Please let us know which equipment you have. You given us the exact product you want to migrate to (MikroNOC 7500 1U), but not what ...

blake

use transparent bridge on all rb750 and rb433, and configure STP (rstp) on routers and switches (for backup), its much simply than use many vlans in your schema.

[sarcasm] Right! Because separating traffic at layer 2 is such a bad idea. [/sarcasm]

blake

Regarding load balancing, MikroTik's BGP implementation can't do anything outside of what the BGP protocol can do. You need to tune your inbound and outbound traffic with standard controls such as BGP local pref, weight, AS path prepending, communities, etc. Quite a few people use MikroTik as a bord...

blake

when the whole world is using 802.xx how come RAD has its own proprietory software for radio? The same reason MikroTik implements its proprietary Nv2 protocol, and Ubiquiti has Airmax. The IEEE 802 actually encompasses a large number of "…standards dealing with local area networks and metropol...

blake

If that statement is true, please explain why at http://wiki.mikrotik.com/wiki/BGP_based_VPLS R5 could act as the route reflector if R1 and R2 are not connected directly to it? Or am I missing something??? The routers do not have to be physically connected, or on the same Ethernet segment. R1 and R...

blake

Yes, one is made by RAD Data and the other is Radwin. ste is right, they are carrier class radios. We use Airmux-200 and Airmux-400 radios extensively in customer point-to-point applications for IP & TDM backhaul. Like any product they have an occasional bug, but not as many as other products I'...

blake

Setup VLANs on ether6…one for each service you want to offer. You will need a VLAN capable switch and/or network access equipment.

blake

VLANs

blake

http://forum.mikrotik.com/viewtopic.php?f=2&t=51969

blake

Could you describe in more detail what is not working? Perform some debugging and narrow it down to a certain issue.

blake

Are you adjusting the l2-mtu parameter, or just mtu?

blake

http://wiki.mikrotik.com/wiki/Improved_Netwatch

blake

You need to configure the MikroTik to acknowledge the relay as a valid relay source. If your DHCP server instance is zero and the ethernet-to-coax gateway's IP is 192.0.2.1, then you can do this: /ip dhcp-server set 0 relay=192.0.2.1 Refer to this for more information. http://wiki.mikrotik.com/wiki/...

blake

How do I downgrade it to a lower version (i.e. 4.17) ?

http://wiki.mikrotik.com/wiki/Manual:Ro ... owngrading

blake

Quite a number of people on these forums consider the stable to be rather unstable for certain features. If you poke around the forums you'll see there are various bugs present in the stable release which are to be resolved in subsequent versions. 4.17 on the other hand seems to be the most stable o...

blake

http://wiki.mikrotik.com/wiki/Manual:Ro ... ng_filters

And some hands-on work / testing.

blake

/routing filter add chain=bgp-static-out action=accept prefix=68.142.0.0/19 prefix-length=19-24 add chain=bgp-local-out protocol=static match-chain=bgp-static-out set-bgp-communities=11280:115 add chain=bgp-out locally-originated-bgp=yes invert-match=no action=jump jump-target=bgp-local-out add cha...

blake

In your code they are OR. In the following they are AND.

/routing filter add chain=tnn-out bgp-communities=11280:661,11280:662 invert-match=no action=accept set-bgp-prepend=1

As far as I know there is not a more efficient way to write those rules.

blake

this is a known problem on RB493G, you can rename the ports back to what you want, only the names have changed.

Thanks for confirming this as a known bug. I tried swapping out a RB493AH with a 493G and ran into this. I'm glad it wasn't just me.

blake

Even better…just enable OSPF on interfaces you DO want to run it on.

router ospf 1
 passive-interface default
 no passive-interface FastEthernet2/3
 no passive-interface FastEthernet4/5

blake

Look at the Framed-Route attribute.

http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client

blake

If you never heard a network like /22 netmask although you have extensive Cisco experience, look the following. I know what a /22 is. I'm saying I've never seen network 0.0.0.0 mask 255.255.252.0 in a config, but I have seen actual blocks listed like network 209.145.204.0 mask 255.255.252.0 . If yo...

blake

http://wiki.mikrotik.com/wiki/OSPF_to_s ... redundancy
or
http://blog.butchevans.com/2008/10/usin ... ess-links/

blake

No, it cannot. It can only handle simple HTML. You'll have to use an external web server if you want to support dynamic programming languages.

blake

I guess what I'm after is a set of devices to 'plug' into the 'Internet' to provide 'tunnelling'

This statement is what made me suggest EoIP. It doesn't sound like he owns all of the backhaul. If not, he can't run MPLS across another provider's network. EoIP will have to do.

blake

Where in southern CA? I'm in Yuma, Arizona. We have service throughout California's Imperial Valley…right in southern CA.

blake

Hi,

I don't want to be a bother, but do you think you would have time to contact me this evening or next week? Should only be a few minutes. I'm just curious what you were seeing, and what you did to fix it.

Thanks.

blake

You may want to look at MikroTik's Ethernet-over-IP.

blake

I believe I'm speaking for fewi as well as myself, but we have extensive Cisco experience and have not seen a network statement such as that. From the syntax it would appear to match any network you want to advertise as long as its a /22. Interesting, but again I've never seen it in operation. I'll ...

blake

I'm also in the desert, and I have a few MikroTik access points up on towers which are operating without issue. Things get pretty hot around here, but so far not hot enough to damage equipment. I'll let you know if that changes.

blake

Looks like you can just add them to the 'test' group. http://wiki.mikrotik.com/wiki/Manual:Router_AAA#User_Groups /user add name=customer1 group=test password=changeme Since you're not permitting local, telnet, or SSH logins it should just limit them to performing bandwidth test none of the other to...

blake

Could you do a 'print detail' on some of those routes so we can see the BGP weight and metrics between the two links? Also please put the output into a [ code ] block. http://forum.mikrotik.com/viewtopic.php?f=13&t=45259

blake

Are you receiving the same routes from both external peers? Are they sending you a default route, partial table, full table, or full w/ default route?

Also, you may want to read this. http://wiki.mikrotik.com/wiki/Manual:IP ... .29_routes

blake

We use Trango units for our bigger wireless links. For some reason through cli the trango showed to have the correct default gateway but through the gui it had the wrong one. I was originally doing the troubleshooting from the office so I could only get to the trango unit through telnet on the rout...

blake

Unless you don't mind cloning your MAC addresses over other hardware…then simply running that command is fine.

Most of us enjoy unique MAC's in our network though.

blake

http://wiki.mikrotik.com/wiki/Manual:License

blake

sorry for the offtop, any example?.. thanks

Several posts above yours have already covered this…

blake

What are you looking for that makes existing products unreasonable? I operate WiMAX products from several different vendors, and can likely offer comments on products you're looking at.

blake

I thoroughly enjoyed reading the above post, and I wholeheartedly agree.

blake

It allows you to take layer 3 interfaces in RouterOS and bridge them at layer 2 so that they emulate a layer 2 environment. If you're still confused, read this: TCP/IP Guide: Understanding The OSI Reference Model.

Hope this helps.

blake

I'm not sure why you need to use the bridge interfaces. The configuration below should work. /ip address add interface=ether1 address=192.168.1.1/24 add interface=ether2 address=192.168.2.1/24 /ip pool add name=pool1 ranges=192.168.1.10-192.168.1.254 add name=pool2 ranges=192.168.2.10-192.168.2.254 ...

blake

You could use MetaROUTER for your simulations. I've used it for the exact thing, and it works fairly well.

blake

the procedure that fewi describes indicates that this is to be done externally, so if one of you can write a solution and post on the wiki, you will receive a license and everyone will have the solution they wanted.

Level 6 license?

blake

what's thundercache?

http://www.thundercache.org/

Hi, I want know if in future, thundercache will be used inside mikrotik. Tank you.

Probably not.

blake

If your password has special characters then try removing any back or forward slashes or exclamation points. I have a password containing the following symbols and it works fine between ROS 4.11 and IOS 12.0S.

#}(>&:,; (special characters from my password)

blake

I would continue to look at '/log'. That's the only way I know to view devices attempting to connect, but which are denied.

blake

It sounds like you want access-list, not connect-list.

Connect lists for controlling which AP's a subscriber unit attempts to register with, not which subscribers an AP will allow to register.

blake

The MikroNoc 2200 is not a MirkoTik product. It is a Axiomtek NA-820 x86 machine which is re-sold under different brand names (MikroNoc, PowerRouter, etc) by various companies with RouterOS pre-installed. Refer to this post for more info. The correct packages you want to download are the x86 packages.

blake

If I'm not planning on doing an VLAN sorts of things for now and have a fairly simplistic network topology, then perhaps that's OK?.. With that in mind can I assume I'll not be tickling any of the oddities here and still get fast wire-line switching/routing? You will be able to achieve gigabit, wir...

blake

/ip dhcp-server network there you can add same next-server option, and do not need to do that through /ip dhcp-server option menu.

Good to know. Thanks!

blake

hi blake, thanks for the reply.. for this "add chain=pptp-filter-in action=accept dst-address=1.1.1.1 protocol=tcp dst-port=21", how do i add chain=pptp-filter-in? because i only can find "forward, input, output" When you run that command it will create the chain 'pptp-filter-in...

blake

http://wiki.mikrotik.com/wiki/Manual:IP/Proxy

blake

Where do I route this /24 to, and where do the individual /32's originate from? You don't specifically have to route the /24 anywhere. Your edge router will obviously receive the block from the ISP, and internally you would just fill your IGP (OSPF, or BGP) with the /32's. As you grow your network ...

blake

Assuming dhcp2 is for the 192.168.2.0/24 subnet /ip dhcp-server set dhcp2 bootp-support=dynamic /ip dhcp-server option add name=pxe-server code=66 value=192.168.0.2 /ip dhcp-server network set [find address="192.168.2.0/24"] dhcp-option=pxe-server Haven't tested this. But option 66 should ...

blake

Syntactically there is no equivalent in MikroTik. If you at least want to create peers with a standard config you could probably do something like this. /routing bgp peer # Templates add disabled=yes remote-address=127.0.0.1 remote-as=11111 update-source=loopback0 name=ibgp-template out-filter=inter...

blake

You could use dynamic PPP filters to achieve this. /ip firewall filter add chain=pptp-filter-in action=accept dst-address=1.1.1.1 protocol=tcp dst-port=21 add chain=pptp-filter-in action=drop add chain=pptp-filter-out action=drop add chain=forward action=jump jump-target=ppp /ppp profile add name=fi...

blake

Unfortunately I haven't found a way to keep broadcast off of a VPLS tunnel. I guess it wouldn't be broadcast if it couldn't go everywhere on a single layer 2 domain.

If you don't want broadcasts on a backhaul, route.

blake

You want email to use a web proxy? Doesn't work. What exactly are you trying to achieve? Who is your email provider? Most providers allow you to use the SMTP Alternate Submission port of 587. You can take packets originally destined to your ISP's email servers on port 25, and rewrite them to port 58...

blake

Some things I'd like to improve upon if a switch to another platform is done :D : Increase routing speeds from FastEthernet (10/100) to Gigabit MikroTik will only offer gigabit, wireline forwarding if you use the Switch Chip feature. Using this feature limits the things you can do with each host. F...

blake

I used the above config with ROS 4.x. Haven't tried it with 5.x. Is that what you are using?

do i need to have anything in radusergroup table ?

You don't need anything. It's optional based on your return params.

blake

The 'radusergroup' table is only used inside FreeRADIUS for assigning RADIUS users to 'RADIUS groups', and then returning a set of replies to said group. ie: radcheck id | username | attribute | op | value ----+-------------------+---------------+----+------------------- 67 | 00:15:6D:33:0B:48 | Use...

blake

Do you have a DHCP server running on that interface? It should grab an address from that DHCP server pool.

blake

It doesn't look like they're routing you that block. Here's some truncated traceroutes from my point of view. Traceroute to 24.153.244.26 19 gig3-0-0.austtxrdc-p-rtr01.texas.rr.com (24.93.60.152) 101.857 ms 87.066 ms 99.997 ms 20 gig2-0-0.snantx6000-pe-rtr01.texas.rr.com (24.93.60.150) 98.381 ms 89....

blake

http://wiki.mikrotik.com/wiki/Manual:Ho ... an_Address

One-to-one NAT can be disabled by un-setting the address-pool parameter under /ip hotspot. ie:

/ip hotspot set 0 address-pool=none

blake

I really need to have complete, normal, straight routing of L3 traffic while maintaining the ability to bridge VLAN traffic. Can anyone help with this?

A tunnel is probably your best bet. VPLS, or otherwise.

blake

/interface ethernet set ether3,ether4,ether5 master-port=ether2

blake

Is there any way you could post your entire configs? Its difficult to see what may be the problem with the information we've seen so far.

You could contact me outside of this site via telephone if you wish. I'm also currently in the #mikrotik chat on irc.freenode.net if you want to PM me there.

blake

You're right. It is needed for NAT. I quickly skimmed your post and suggested that since you seemed to express an interest in disabling that. Here is the dump on those commands: /ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=38.119.60.69 scope=30 target-scope=10 add comment="...

blake

/ip firewall connection tracking set enabled=no

Have you done that on the router?

blake

/interface pppoe-server server set 0 service-name=<Unique name> http://wiki.mikrotik.com/wiki/Manual:Interface/PPPoE#PPPoE_Server_Setup_.28Access_Concentrator.29 I believe that will prevent the other ISP's clients from attempting to use your server. You'll have to set the service-name parameter on ...

blake

/interface ethernet set ether1 arp=enabled auto-negotiation=yes set ether2 arp=enabled auto-negotiation=yes /ip address add interface=ether1 address=yyy.yyy.yyy.yyy/CIDR add interface=ether2 address=xxx.xxx.xxx.xxx/CIDR /ip firewall filter add action=accept chain=inside-inbound protocol=icmp add ac...

blake

I'm in there now. Should be around for another hour or so.

blake

What about on B2…could you show me the output of

/ip route print where 38.119.61.0 in dst-address
/ip route export

Also, you said if you start a ping from a host connected off of B3 then the traceroutes into the 38.119.61.0/25 subnet magically start working?

blake

What is the source IP address of your Juniper when performing traceroutes? Is that IP being advertised via BGP? Could you post the following info?

/ip address export
/ip route print
/routing bgp export

Thanks.

blake

Could you post the following information?

/ip address export
/ip route export
/ip firewall filter export

blake

There's probably something missing in the information you've provided. I can't see why this wouldn't work, but maybe with a bit more interactive debugging we could solve this.

Do you ever visit the #mikrotik IRC channel on irc.freenode.net?

blake

Upload the packages. Then…

/system package downgrade

blake

A software bridge will not have the same port-to-port forwarding performance as using the switch chip. You do not want to use a software bridge with our simple network setup.

Just do this on ports 3-5.

/interface ethernet set master-port=ether2

Put the DHCP server on ether2.

blake

Can you describe your topology in a bit more detail? Is the MT trunking those VLANs into a switch, or connecting directly to VLAN-aware devices on lan1?

blake

Could you please provide more information? Post the output of:

/interface bridge export
/interface vlan print
/interface dhcp-server print
/ip address print

Thanks.

blake

Where do I enter the main DNS settings? In IP > DNS, or DHCP Server? other? You enter it under the OpenDNS servers under '/ip dns'. All DNS requests from hotspot users (even to outside IPs) are captured and redirected to RouterOS's local DNS daemon. Insert OpenDNS servers under '/ip dns' to ensure ...

blake

Hello, we have 4 ISP links and we would like to route all traffic going to Vonage down one link? /ip firewall mangle add chain=prerouting passthrough=yes action=mark-connection new-connection-mark=voip dst-port=5060-5061 protocol=tcp add chain=prerouting passthrough=yes action=mark-connection new-c...

blake

Are the packets hitting a drop filter somewhere? Could you show us your logs?

blake

I'm not a MikroTik certified consultant, but I am a consultant. Maybe your questions weren't answered because they're not very clear. How often do you apply for paid help? Are you asking how often consultants solicit the help of other consultants in order to complete a job? For me, never. Then again...

blake

Yes, this is normal. The same thing happens with Cisco equipment. There's no need to be concerned since each interface is on its own broadcast domain, and thus there's no conflict.

blake

What RouterOS version are you running? I saw this on ROS 4.6. ROS 4.7 resolved that issue.

fixed mac address handling on RB750, some specific arp requests did not work

http://www.mikrotik.com/download/CHANGELOG_4

blake

Do you have physical access to the router? Could you show us the output of '/ip address print', '/ip route print', and '/ip firewall nat print' ?

Also '/ip firewall mangle print'.

blake

http://wiki.mikrotik.com/wiki/Manual:Console#Safe_Mode

RouterOS 5.0rc6 added Safe Mode to Winbox.

blake

That's quite a distance. Where are you located?

blake

I had issues with MetaROUTER on my RB1100. Disabled it entirely and things work well. I would definitely recommend trying that.

blake

So, If I understand correctly. The L2MTU setting is how you tell mikrotik the mtu of the underlying link? L2MTU is how you configure the largest layer 2 packet size an interface will accept, minus the Ethernet header. The first picture in that link explains fairly well. You could possibly look at i...

blake

What did we miss about MPLS that made this go haywire? MTU . Assuming each packet only has a single MPLS label (4 bytes) then all of your intermediary devices need to be able to support at a minimum 1504 byte packet sizes at layer 2. On MikroTik you need to adjust the l2mtu parameter, and Cisco its...

blake

My 2nd choice would be Las Vegas but then late Fall or early Winter.

Las Vegas would work well for me.

blake

Right. I was talking about about lowering tx queue length as being the solution the specific problem you're seeing with packets being queued below ROS when the interface is saturated.

I agree other algorithms are still needed at layer 3 to signal early network congestion (RED w/ ECN, SFB, etc).

blake

http://wiki.mikrotik.com/wiki/Dynamic_D ... for_dynDNS

blake

I understand you are experiencing delays due to hardware queues. This is still bufferbloat. Lowering the size of the hardware TX queues is a solution for Ethernet interfaces. The bufferbloat devs are hard at work on various 802.11 drivers to help reduce the effect of bufferbloat on those types of in...

blake

The solution is Update method through the program (FileZilla 3.2.3 win32.zip) type of the types of programs (FTP). On a technical level, the issue was probably related to you incorrectly uploading the files in ASCII instead of BINARY format. An intelligent program like FileZilla will detect the typ...

blake

Allright, I've looked into this book: Cisco - routing and switching (http://www.ciscopress.com/bookstore/product.asp?isbn=1587201968) and I found a page where they say that devices use also a hardware queue, and the description fits exactly. What your experiencing is Bufferbloat ( What is bufferblo...

blake

http://wiki.mikrotik.com/wiki/Dynamic_D ... angeIP.com

I modified that script to work with my local BIND server. Works well.

blake

Is there another way, return the update version v4.17

http://wiki.mikrotik.com/wiki/Manual:Netinstall

blake

How can we terminate the session when we delete the user from our database?

http://wiki.freeradius.org/Disconnect_Messages

I use this method and it works fine. The disconnect message must be originated from the RADIUS server though. It cannot come from an outside server.

blake

MikroTik: How to Start a Wireless ISP
http://www.dslreports.com/faq/wisp/2_How_to_start

You should also consider hiring a consultant if you are unable to understand some of the fundamentals provided in above links.

blake

[Connection-state] interprets the connection tracking analysis data for a particular packet: established - a packet which belongs to an existing connection invalid - a packet which could not be identified for some reason new - a packet which begins a new connection related - a packet which is relat...

blake

Please explain me what means [0-9]? Is it possible to print (see) it using WinBox? First off, the tilde ( ~ ) signifies that you want to match the value dst-address against a regular expression . http://wiki.mikrotik.com/wiki/Manual:Scripting#Other_Operators The [0-9] says that you want the regex t...

blake

/ip firewall connection
print where protocol="tcp" dst-address~"172.0.0.[0-9]+:110"

blake

Send this API command and store the results in a variable.

/ip/firewall/filter/print =stats =.proplist=bytes

http://wiki.mikrotik.com/wiki/API_PHP_class

blake

They're for different processor types.

blake

How about this? /ip firewall nat add chain=dstnat src-address=192.168.1.83 protocol=tcp dst-port=80 action=redirect to-ports=8080 /ip proxy set enabled=yes port=8080 /ip proxy access add dst-port=80 action=allow dst-host="188.132.227.1" add dst-port=80 action=deny redirect-to="188.132...

blake

How, I could make R4 to advertise R5 and R6 networks to R3 with AS path "4" instead of "4 5 1"? If all of the routers in 'network 2' are under a common administration then it seems what you're describing is BGP Confederations . If you are, I can show you how to do it in MikroTik...

blake

our experience has been that it doesn't do all that well. If you turn off basically everything else (conntrack, queues, firewall) it will get by with 2 peers probably. It takes a long time to converge. we ended up moving to a powerouter 732

So, basically just an x86 box.

blake

Well I have objects being saved to the hard drive the cache file grows in size but I do not get any hits when I return to the same site over and over it is all misses. Nothing gets taken from the cache it keeps going back to the source (ie:the internet) It is like it is caching all the objects etc....

blake

What problems are you having? I have some experience working with your desired setup.

blake

http://wiki.mikrotik.com/wiki/Manual:In ... LAN#Q-in-Q

blake

There's an API which is accessible on all routers via TCP/IP. There's an example Python client on the wiki.

blake

http://www.techrepublic.com/article/ip- ... sy/6089187

192.0.2.0/30
192.0.2.4/30
192.0.2.8/30
192.0.2.12/30

That's all you'll get subnetting into multiple /30s.

blake

http://wiki.mikrotik.com/wiki/Manual:IP/Packing

blake

You can't connect them directly together, but you can do it through a bridge on the host. /interface bridge add name=vm-bridge /metarouter add name=mr0 add name=mr1 /metarouter interface add virtual-machine=mr0 type=static static-interface=ether1 add virtual-machine=mr0 type=dynamic dynamic-bridge=v...

blake

VLAN s are one way to do it . It'll allow you to separate your clients traffic at layer 2, and then handle all layer 3 routing independent of each other. If you have a large bridged network you'll just have to build the VLANs out in your switches from your core to your access layer. If you're using...

blake

You could do something like this to handle inbound BGP redundancy. http://www.vyatta.org/forum/viewtopic.php?p=4213&sid=0b9f48079b1388c4fb722704ac6221ae And here's a sample config to implement that config in MikroTik. ### Router 1 ### /interface vrrp add interface=ether1 name=vrrp1 vrid=1 priori...

blake

Could you post your filter rules?

Also, you may just need to refresh or re-send your routes after a filter update.

/routing bgp peer resend-all
/routing bgp peer refresh-all

You can also perform refresh and resend a single peer basis by using 'resend <peer name or number>'

blake

how can cache the youtube's video ?????

Check out VideoCache which is a piece of software that needs to be used in conjunction with Squid.

blake

/ip proxy
set parent-proxy=192.121.122.3 parent-proxy-port=3128

You should put the proxy and client computers on different IP subnets. What physical or virtual interface you configure for those segments is up to you.

blake

Do you have any bridge filter or IP firewall rules active on your WAN port? If so, could you please share those? The virtual-ethernet pseudo interfaces are designed to operate exclusively with Metarouter instances. They cannot function as standalone interfaces. Here's the documentation you requested...

blake

I found a way to do this but it limits you to only two DHCP clients / obtainable IPs (one for the bridge, one for the physical interface), and the requests cannot come from the same MAC address. Generate a fake MAC by creating an EoIP interface, copy the MAC address, then delete the interface. /inte...

blake

please confirm me that is this antenna work fine with R52hn ?

They work great. I have several 2G-16-90's on R52HN's and R52N's. No issues.

blake

Which router is going to speaking BGP? Will your provider let you create BGP peering sessions from all three routers?

Refer to this thread regarding redundant PPPoE. You'll have to route separate customer IP blocks to each PPPoE AC.

blake

From the CLI.

reset-counters <interface name>

blake

Also it is recommended to disable IGMP snooping on switches.

Why? IGMP Snooping ensures efficient delivery of multicast data at layer 2.

blake

How many routers are you planning to have speaking BGP with your upstream? Depending on your network design you could "load balance" or manually distribute PPPoE sessions between multiple routers. That would at least eliminate a single point of failure on the aggregation side. Could you po...

blake

TDMoIP, and the IPmux you mention would imply RAD products…something he said he does not want to use.

blake

Yes, I did not get any proper answer and I sent it again.
I want to do it on MikroTik, not any other brands.

So then I assume you want to transport it as native TDM. You can't do that using MikroTik, but I already told you that once.

blake

You already posted this. http://forum.mikrotik.com/viewtopic.php?f=7&t=48764

blake

/ip hotspot ip-binding
add server=<server name> address=<Asterisk.IP> typed=bypassed

blake

/interface wireless set wlan1 frequency-mode=superchannel

blake

Transport the data as Ethernet, or actual E1 framing transported via wireless? If the latter, my may want to look into a RAD Airmux-200.

blake

Correct. It will allow Internet from midnight to 6am, then disallow any further access outside of that timeframe.

blake

/ip firewall filter
add chain=forward action=accept time=0s-6h,sun,mon,tue,wed,thu,fri out-interface=internet
add chain=forward action=drop out-interface=internet

You probably want to enable NTP client on your router so your local time is accurate.

blake

/ip firewall nat add chain=pre-hotspot action=accept
dst-address-type=!local hotspot=auth

Maybe this? Credit should go to fewi.

blake

How could this be done on an unmanaged switch?

You can't. Buy a managed switch. Refurbished Cisco's are cheap. In fact, I have a number of 3500XL's and 2900XL's I'm looking to get rid of.…

blake

Are you doing '/tool traceroute src-address=10.10.10.2 10.10.10.1' ?

What's the routing table from the first box look like?

blake

Unfortunately, no.

The switch chips simply switch VLAN tags. They do not allow layer 3 / routed interfaces to be inserted into the switch by simply adding the VLAN atop the Master Port. MikroTik does not currently have the ability to function as a regular layer 3 switch.

blake

You should only need / require TProxy in when using public IPs to customers. Since you're not using public IPs I don't see any reason to use TProxy. Just redirect them with dst-nat and define 'http_port 3129 transparent' (or something similar) for the Squid listening port. NAT Squid across the ADSL ...

blake

/ip route add dst-address=3.3.3.0/24 type=unreachable distance=254

blake

Could you draw a quick diagram to explain in more detail? Are the routers all plugging into two separate switches on either interface?

Search found 426 matches