MikroTik

Ehman

Hi I've got a IKEv2 VPN running on a mikrotik router and want to make Socks5 proxy incoming connection re-direct and go via the IKEv2 VPN connection, and not via my LAN internet connection as its doing now, I've got no idea how to do this besides for using another router, and to connect that to the ...

Ehman

Hi Everyone, I would love it if someone that help me, I followed this guide over and over and it does not work, however it seems to work in guide. https://support.purevpn.com/en_US/router/how-to-setup-purevpn-on-mikrotik-router There is a certificate file even provided in that guide "How to set...

Ehman

And you followed the netinstall manual to the point? Disabling all network interfaces except teh one being used for connectin to router, setting manual IP address, allowing netinstall.exe in firewall (or disabling firewall altogether), etc.? netinstall is indeed very fragile process (we can argue i...

Ehman

The first screenshot might indicate that you did not start netinstall with administrative rights.

it makes no difference....with or without administrative rights, I still get those error message...

Ehman

Hi, I'm unable to use netinstall on my windows 7 pc, I get these 2 errors after another when I open netinstall, all the versions does this, After I clicked on the OK on the errors, then netinstall just closes.. and thats it?! Im forced to use my XP laptop for this missions, anyone out there with thi...

Ehman

Hi. Have the same problem. Windows 7, no java, arp shows no programs using port 69. Disabled firewall antivirus but the same gives me the error bind() without anything in the two brackets, you have bind(boots) Any hints? Regards OK, I finally decided to disable the things I need to disable (very la...

Ehman

Yes, those instructions will work also.

Make sure your Windows PC has Firewall and Antivirus turned off, and that you run Netinstall "As Administrator"

Ive got the same problem on my win7 machine, and Im not going to disable my antivirus... Mikrotik fix your software!!

Ehman

Ive got the same problem on my win7 machine, and Im not going to disable my antivirus... Mikrotik fix your software!!

Ehman

I suggest you to progress 6.44.6, 6.46.8, 6.47.10, 6.48.5

soooo inconvenient and messedup I'd say... its like saying, if you want win10, you need to install windows 95 first and then upgrade and upgrade and upgrade until you reach win10

Ehman

I've emailed support@mikrotik.com and explained them my story and told them to read this forum... after some emails I'm happy with this last email from them... Hello, Suggested stable versions for upgrade are > 6.44.4, 6.46.6, 6.48.4, 6.49. We will check and fix issues with upgrading in the next ver...

Ehman

Well, if it's going to take a week before long-term is fixed, just pull the release. At least for affected architectures. Just disable download and update within ROS. I dont see the problem. First 6.41.4 is very old, so some one has missed out many many version. Second, I do not auto upgrade, and a...

Ehman

I agree with some colleagues, if there is an error, it has been identified, then it is urgent: 1) revoke 6.48.5 (remove the firmware file itself from publicity) (it is impossible for devices to be updated) 2) urgently make a correction and release 6.48.5.1 , since the Long-Term market segment = the...

Ehman

where is the people from Mikrotik in this forum!?!
Here, for example: viewtopic.php?p=889344#p889344

thank you

Ehman

this is a user forum, mikrotik support is support@mikrotik.com

Very funny

Ehman

where is the people from Mikrotik in this forum!?!

Ehman

Long-term branch should NOT have these problems... one would expect long-term to be exactly the same as stable that's maybe 1-2 releases behind and proven to be stable without any reported issues. But that's not the case, long-term is older version where some fixes and features are backported and a...

Ehman

this version is a disaster.... If you see the thread for 6.49 (which has the same issues), MikroTik found that this issue only happens when you are upgrading from a device that has a very old RouterBOOT firmware (6.41.4 or older). If the RouterBOOT firmware is newer than 6.41.4 it *should* upgrade ...

Ehman

bugs inadvertently included in a fresh release version)

I've never had any issues with long-term released until today!! I would expect this from beta's but NOT from long-term releases... long-term is like legacy releases kinda to me

Ehman

this version is a disaster.... I've update my 750GL (bad blocks 0.0% FYI) ....so today with this firmware after it had v6.44.6 on and it completely bricked the thing...I always stick with the long-term releases and after I re-loaded v6.48.5 on with netinstall it worked briefly and went dead again......

Ehman

I'm using ntp1.neology.co.za everywhere.... Why don't you use something that actually works then, instead of whatever this thing is? Ive been using the servers found under http://www.time.org.za/ for ages now.. for NTP clients... only the neology have the wrong time!!!... omw they messedup!! and Iv...

Ehman

Very bad idea "hardcode" DNS or IP not under own control...

What do you mean by this?

Ehman

Because this: I'm using ntp1.neology.co.za everywhere Both neology servers behave as if they are down. These work: ntp.is.co.za (Johannesburg) ntp2.is.co.za (Cape Town) Very bad idea "hardcode" DNS or IP not under own control... http://www.time.org.za/ Yip, I used ntp.is.co.za now... 100%...

Ehman

I found the issue... that ntp1.neology.co.za server seems to be messedup!!

I used another server, however its 4sec ahead, but now everything is working perfect!!

Ehman

If status is started the NTP server do not provide sync.
Only when NTP Client is status: synchronized NTP Server provide the right time.

I've rebooted the router and then did the print out command.... my bad

Ehman

Where you read the clock? On the video?
Some seconds of differencies can be possible, because the image is processed before you can seee it on video...

because the image is processed before you can seee it on video...
nope, I'm running live, direct from the cameras

See attachment

Ehman

Weird ... I just checked: Synology NAS to NTP server, PC to NTP server, Mikrotik Hex to NTP server. All the exact same time, not a bit of difference (not that I can see right away). Can you do /system ntp client print and provide the result ? EDIT: rextended has got a point there ... enabled: yes m...

Ehman

Are you getting NTP time on your Mikrotik routers through DHCP or really from NTP server (like pool.ntp.org) ? I also noticed the former method sometimes gives a difference. The second method is always spot on. It's one of the things I standard configure when getting a new device. If the second met...

Ehman

Hi, I've just noticed something I want to share.. I use 5 Dahua IP cameras for my CCTV, my IP cams and windows PC's get its time from the same server, and so does the mikrotik routers... I've noticed on mikrotik there is a 4~5sec difference on the clock... Mikrotik is a couple of seconds ahead of al...

Ehman

So we all have established now, Here is the problem... Mikrotik OVPN Client is lacking features clearly!!!, perfectly explained by tdw "As others have said the Mikrotik OpenVPN implementation is limited - no UDP, no LZO compression, no TLS authentication, no authentication without username/pass...

Ehman

Stubborn. If i were PureVPN I'd just give you the money back. And you can go choose another VPN provider that deprecates SSTP soon, let them deal with you. I've been using PureVPN for many many many years.... and like I said, I'm sitting with a fresh 5yr account that I bought like last year or some...

Ehman

Not even PureVPN themself can connect to a PureVPN vpn account with a mikrotik router using OpenVPN protocol.. PureVPN support told me, they've tried it themself, It doesnt work on mikrotik....I tried it... it doesnt work... As others have said the Mikrotik OpenVPN implementation is limited - no UD...

Ehman

Not even PureVPN themself can connect to a PureVPN vpn account with a mikrotik router using OpenVPN protocol.. PureVPN support told me, they've tried it themself, It doesnt work on mikrotik....I tried it... it doesnt work... As others have said the Mikrotik OpenVPN implementation is limited - no UD...

Ehman

Time to learn IKEv2 / IPsec then, crying doesn't help. How does MikroTik need to wake up if PureVPN supports protocols also supported by RouterOS ? Not even PureVPN themself can connect to a PureVPN vpn account with a mikrotik router using OpenVPN protocol.. PureVPN support told me, they've tried i...

Ehman

Time to learn IKEv2 / IPsec then, crying doesn't help.

Just out of curiosity? Is the word "crying" the new trend word lately on this forums, I have to admit, I haven't been in this forums in ages until today...

Ehman

You are owning one of the shittiest VPNs now and crying that Mikrotik doesn't support specific VPN protocol? How about NordVPN/Surfshark? They do support lots of them, including OpenVPN TCP and IPSEC/IKE2 which works incredibly well and there is a guide too. https://forum.mikrotik.com/viewtopic.php...

Ehman

What's wrong with IKEv2 and IPsec? Use that.

...I've got no idea how to implement it on the router and I'm not familiar with IKEv2 and IPse at all!!

Ehman

Hi, I cant connect to my preferred servers anymore with a mikrotik router because purevpn went into "Discontinuing PPTP, L2TP, and SSTP Protocols" mode ...anyone else having this issue? https://support.purevpn.com/protocol-discontinuation What protocols are we supporting? PureVPN will supp...

Ehman

I used SSTP on my router with purevpn, but now we all have a big messedup problem
https://support.purevpn.com/protocol-discontinuation

Ehman

Create a Script called "SCRIPT-PING-TRACE" or call it what you want and make it match above put this in the script. (the trace and ping logs will get overwritten each time this occurs , so you will need to get to them quick) :log info "\rNW-8.8.8.8 down\r"; :execute {/ping 8.8.8...

Ehman

[41:11] Testing Started. Proxy Server Address: 192.168.0.195:1080 Protocol: SOCKS 4 Authentication: NO [41:11] Starting: Test 1: Connection to the Proxy Server [41:11] IP Address: 192.168.0.195 [41:11] Connection established [41:11] Test passed. [41:11] Starting: Test 2: Connection through the Prox...

Ehman

doesnt work # sep/25/2016 19:27:02 by RouterOS 6.34.6 # software id = 83KU-RR95 # /ip dhcp-client add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \ interface=ether1 /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 /ip socks set enabled=yes The IP on et...

Ehman

I just tried it with same RouterOS version and no problem here, it works. Too bad it's stuck in stone age with socks4 only. Not even socks4a... There's no magic configuration needed. Select port, enable socks, make sure you allow tcp connections to selected port and that's pretty much it. Setting a...

Ehman

Hi folks, I'm using ros 6.34.6, and I'm trying to make the ip/socks work for local socks proxy server, but no luck at all!! http://wiki.mikrotik.com/wiki/Manual:IP/SOCKS I went through it, all cool. nothing works, kinda useless Ive enabled the socks, and trying to connect to it using socks4 client(s...

Ehman

Easy

[:pick $ipaddress ([:find $ipaddress "/"]+1) [:len $ipaddress] ]

Thx for helping out @ mrz

+1 ..

Ehman

Hey guys, I've trying to figure this out for the whole day and think its time I ask the pro's!! I need this script to log info ONLY the subset mask, in this case 24 Help would be super appreciated! :global ipaddress 10.1.101.1/24 :for i from=( [:len $ipaddress] - 1) to=0 do={ :if ( [:pick $ipaddress...

Ehman

3g dongle K3772-Z been added yet?

Ehman

I've got the exact same issue with 3 of my RB750UP's, did anyone managed to fix this issue?

I've tested it on all versions of ros, no luck... the stuff is unstable

and I'm using K3772-Z dongles

Ehman

Yeah, I chose not to help based on your comments in the thread, and then on your private Karma email... I don't owe you a resolution to your problem -I chose to investigate and solve my own problems, and its comments like yours that cause those with experience in this industry to keep our knowledge...

Ehman

Thx for your input

http://forum.mikrotik.com/viewtopic.php?f=2&t=86163

Ehman

There are payment gateways that deal with the 3DS for you ( they host the 3DS validation stage). We use one ourselves for this very reason and can confirm it works fine. You clearly don't know what you talking about, or you have never seen 3DSecure in action, don't mistaken 3DSecure with Nintendo 3...

Ehman

great idea you've had dohmniq, but hotspot enabled, change the entire system to something else. forward only applies to logged in users, and unauthenticated users change to pre-hs-input. the layer7 is a good trigger, but this one is a difficult one, I've just tested your method on my dev unit, it di...

Ehman

Use paypal, I have checked, there do not use 3dsecure on my credit card with verified by visa....

Paypal doesn't support my currency..

Ehman

Use a payment processor that deals with the 3DS side of the transaction - they do exist and they host all the pages including the 3DS secure site of things on a single domain name. I've never seen that and I can't imagine how that could be true as each customer-bank has their own 3DS form. If a pay...

Ehman

not have dns or url like "www.mybank.it/verifiedbyvisa" or like "visa.mybank.it"? I don't know for sure, I think its just better to allow everything 443 and 80 port related for 10min with queue 128k/192k for the user so that he can buy a voucher, I'm sure that will help, but I'v...

Ehman

How is possible the DNS namee of bank site never have one distingushible word inside?

all the 3d secure hostnames I've seen is : example: secure.bankname.com
they never start with www so far to my knowledge... but I might be wrong.

...or I don't understand your question

Ehman

Hi all I've got a problem here, when a client do a credit card payment to buy a wifi voucher, 3DSecure ends it all on the final step (OTP process), because he needs to have access to 1 of the 1000000000 banks or what ever bank he is from.. 3dsecure server in the world, so that he can complete the tr...

Ehman

Did I post in the wrong section... anyone? I seriously need help! walled garden aint sufficient anymore, the client needs internet access to be able to buy internet access, that's the moral of the story. Give 10 min free internet access to buy... How can I implement such a feature? I need some trig...

Ehman

Did I post in the wrong section... anyone?

I seriously need help!

walled garden aint sufficient anymore, the client needs internet access to be able to buy internet access, that's the moral of the story.

Ehman

Hi, I've got a issue with my hotspots, the payment gateway uses 3D Secure to be able to purchase a voucher, but to make that work, you need to add all the 3D Secure servers/banks in the world in the walled garden, each bank got their own 3d secure hostname, its very annoying, is there any method to ...

Ehman

Ehman

thx

Ehman

Hi Can someone help me with this one I need a script that removes all the address-list entry's that starts with "T-" I've tried everything, I cant figure it out Here is my script that removes everything in my address-list :foreach counter in=[/ip firewall address-list find ] do={/ip firewa...

Ehman

after "from" you can put only one complete username, not one letter.... you get "1" when you have only one "b" user, because auto-completion of "b" are "b" full username. you get error when "b" are misunderstandable from two or more users....

Ehman

Hi, I want to print count users that starts with B.

/ip hotspot user print count-only from=B
so far I've been able to get to this, but if there's 2 users starting with B, I get this error "no such item"

however if there's 1 users that starts with B, then it counts 1

plz help

Ehman

I'm sitting with the same issue here, and if I add the path, nothing works!!!

can someone please help me?

Ehman

log info [/ip dhcp-server lease print count-only]

perfect

thx

Ehman

Hi

Can anyone one help me with this:

/ip dhcp-server/lease

I want it to print the number of items to log, I don't know how to do it..

Ehman

I have the exact same problem as Ehman. Using a K4201-z Dongle when I plug it into the USB port no PPP-client is automatically generated and when I manually generate one and attempt to connect to USB1 and then view the info on the dongle I am presented with the error "Couldn't start, unable to...

Ehman

Hi, has anyone managed to get this working with a script?

I want to dump [/interface wireless scan 0 duration=5] to a text file and email that to me

Ehman

Hi, I'm looking for the same script, its all junk out there, I want all my trail users with a T- in front to be attached with the 100mb total data cap and after that 100mb is over, kick out... no luck for me, I cant believe mikotik haven't yet added that under the 30min free trail setting, its sad

Ehman

See this:
http://www.wirelessinfo.be/index.php/mikrotik/pages/3g

I hope this help you

damm, I've returned the product already, but thx for posting this guide, I'm sure it might have helped a lot!!

Ehman

Hi, today I've bought a Vodafone K4201-Z dongle. the interface sits under /interface lte but it doesn't add any route, or does it really work, and I cant use it, but its connected, and have 10packets tx and 60 packets rx, so I guess, its doing something somewhere. but it sux so hard, can ping anythi...

Ehman

what do you guys use now?

Ehman

Hi guys

Does anyone of you also have the issue where the client(s) don't receive the username and password screen after the purchase but they got charged for the voucher from netcash?

This happens 10% of the time to me, and its irritating as ****

Please help

Ehman

Add 'incoming' and 'outgoing' interfaces as conditions to rule.

HTH,

I'm such a idiot sometimes

... .thx mate

Ehman

Hi Ive been struggling to make a forward rule to stop a internal IP to dos attack a external IP add action=add-src-to-address-list address-list=Syn_Flooder \ address-list-timeout=30m chain=forward connection-limit=100,32 protocol=\ tcp tcp-flags=syn this rule suck, it keeps on adding the src and dst...

Ehman

rb750UP is not supported for USB power reset - http://wiki.mikrotik.com/wiki/Manual:USB_Features#USB_feature_table LOL, I'm aware of that, its lame as hell! tho, because I'm only using RB750UP's for POE and 3G modems only, now I cant reboot my modems if it crash, so all the popular devices with a d...

Ehman

Is there even money in hotspots anymore these days, because everyone uses 3G/LTE , but I would like to know from you guys that work with it a lot? thx

Ehman

Hi folks I've bought a couple of RB750UP's for 3G, now sometimes my 3G dongle freeze and then I have to do a power cycle on it, a reboot on the router doesn't work at all!!! and I've recently discovered that the USB Power Reset is not supported, are you kidding me mikrotik!!!!!!!!! So now I have to ...

Ehman

I don't get the joke?

Ehman

Please report this bug to MikroTik support

Is there a scheduler bug in v6.4 ?? ..My router (RB750UP) is plain eng and my scheduler stopped working on this one dev router that's been on for days doing nothing then charging my blackberry via usb, nice charger tho

Ehman

I've never heard of such a problem ever! ..I would however love! to know the fix for your problem when you fix it

Ehman

while we are working on this winbox problem use CLI to rename certs. Ok, Ive figured out how to rename the thing, my main problem is, WHY!!! does this upgrade change the way things work, now I have to add a line to my config setup file so that my cert_1 can rename to cert1 for all my future routers??

Ehman

while we are working on this winbox problem use CLI to rename certs.

no problem importing the certificates, via winbox terminal or ssh

I just don't want it to be called cert_1 when importing, in all the other versions it used to be cert1 after importing, how can I import it as cert1?

Ehman

can't rename imported certificate? I use this command to import: /certificate import file-name=ca.crt /certificate import file-name=ca.key in v6.3 it used to name it cert1 after importing, now in v6.7, it names it cert_1 and all my scripts and SSTP connections is used to cert1 can anyone please help...

Ehman

it is not possible to execute interactive commands from other scripts via script. If you open terminal it is OK if that is done via script = nothing happens. /system ssh 1.2.3.4 user=admin "/log print "hello"; It asked me for a password, I want to put my password into my scripts, and...

Ehman

This is lame... I want to make a script that change somethings on 20 AP's via ssh, but hmmmm nooo ...I cant! ...because Mikrotik doesn't want me to be lazy, and Mikrotik wants me to login into each router and change stuff. I don't get the point of not allowing it, I like my stuff to be automated, I ...

Ehman

Upgraded a router to 6.6 and hit a problem with bridging Ethernet (BCP) over SSTP: 10:39:19 sstp,info <sstp-0>: waiting for call... 10:39:19 sstp,info sstp-in1: authenticated 10:39:19 sstp,info sstp-in1: connected 10:39:19 sstp,info,account door logged in, 0.0.0.0 10:39:19 sstp,error could not add ...

Ehman

software bugs reintroduced

I'm still searching for the answer to that..

Ehman

To not f**k device through the window

LOL!!

..thats like me and my RB1100AHx2 with ANY new version on, I'm running a netinstalled v6.0rc13 ...and I'm a very happy man now

..no more upgrades for me, thank you

Ehman

YES!!!
And I ask you - stop releasing features (i do not need management Curiosity ), bug fix errors first, make a very stable product.
+1

+ 100000

Ehman

Please anyone, contact support! We still have nobody writing to support with any information about this issue. We would appreciate some detailed information, like: 1. Version of RouterOS and RouterBOOT before upgrade 2. Link to packages that were used for upgrade 3. Procedure how upgrade was done 4...

Ehman

I've netinstalled v6.0rc13 on my 1100AHx2, the latest version of v5 worked ok, but my sstp vpn stuff didn't work so great with my config and I didnt had time to figure out the problem, so I had to pop on v6.0rc13, the device worked fine with v6.0rc13 for a long time now before I dropped the v6.5 upg...

Ehman

this lame absolutely non production platform drives me crazy (and not only me) CCR-* on tile + RoS v6.5 is hell ... i have 3 CCRs 1016-12g 2 of them are heavily configured, especially one which has: routing, mpls, mangle, queues, 1500+ virtual interfaces (vlans vpls', bridges), and not so big traff...

Ehman

For stability use 5.26 and upgrade to v6 once its mature. We run 5.25 and 5.26 on all of our 1100's with no issue. v6 is getting there but not something I would put into production for anything other then basic router and AP functions. but thats just my 2 cents. I would have to be very confident fr...

Ehman

v6.6rc1 is NOT ok anymore everything with [find comment=????] in, doesn't work in v6.6rc1 fix something old, broke something else thats old... :? I don't understand how you guys do it ...I'm going to try to go back to routeros-powerpc-6.0rc13.npk ..I can live with the random reboots, but can't live ...

Ehman

everything with [find comment=????] in, doesn't work in v6.6rc1

AWESOME!!!!

Ehman

/ip firewall address-list set [find comment="test"] address=1.4.5.6 that command does not do jack!! ...another bug maybe? [ I'm using v6.6rc1 on my 1100] and therefor my script does not work! ..the one I've been using for years :local ip [:resolve "www.mikrotik.com"]; /ip firewa...

Ehman

Something has seriously got to be done about how these are released. I killed a brand new 2011 upgrading it before a new installation this week. Please, please stop releasing features until what exists now works 100%. It's killing my faith in the stuff, and I'm starting to have fond memories of Cis...

Ehman

v6.6rc1 seems to be ok working, but I get the feeling its not stable enough, anyone else with a 1100 issue ? I've noticed that now and then, winbox stops displaying content like..... for example: all the firewall rules / no nat rules/ no nothing its shows that I don't have anything set up on the rou...

Ehman

Ehman, this could be caused by specific configuration, it export fine on our "demo routers". Do you have a supout.rif file from this device? If yes, you can also get the config from there, check your mikrotik.com account, it has a "supout.rif reader" I dont have a mikrotik accou...

Ehman

Ehman: as you may read on the forum, importing backup sometimes not working (or producing problems) while configuration after clean install works well. (and this is equivalent of importing export-file from the same ROS version) I've upgraded a RB750 to I think v6.5. and thought ok awesome.. lets &q...

Ehman

Importing certificates is a known problem in 6.5. It is fixed in 6.6 (released soon, look around for links to the beta) I don't understand why there's always!! issue's with new versions of ros with the existing/old features, it tends to get broken, and I've been moaning about this almost forever.. ...

Ehman

have both device with same ROS version and firmware version - in this case, the problems minimalised. However, we are backing up "/export compact" instead of configuration backup. that is human readable and if some problem accours, you will be warned immediately and you can fix it. No wor...

Ehman

use netinstall to upgrade/install newest firmware (in the package, downgrade firmware to the one included in your package) and ros. I have no problems (after 6.5 or 5.25) with 1100, and have about 50 in production. However, upgrade from 5.x to 6.x on a unit having config, might "broke" th...

Ehman

I use the NO-IP mikrotik scrip, and every now and then, I run this command "/system script environment remove [find user="admin"]" to remove everything, so that I can do a forced IP update but of course now after a upgrade , the old scripts doesn't work!!! There is no "user...

Ehman

Thanks for the replies the '/system script enviroment' method works great. I was really getting tired of unneeded global variables. Cheers Still impossible ? I use the NO-IP mikrotik scrip, and every now and then, I run this command "/system script environment remove [find user="admin&quo...

Ehman

Upgrade slowly... Go to 5.26, then upgrade firmware. Then try to go to like an earlier version of 6, upgrade firmware again. Then try 6.5, and upgrade firmware. Then restart... That might make it a smoother transition.... That does not sound normal to me, so you say, when you buy a unit with v6.1, ...

Ehman

Hi Folks I've decided to upgrade my live core router of my business RB1100ahx2 with ROS v6.5 and let me say, it was the worst decision Ive ever made! some issue's I've experienced: the fan stopped working, the device started to behave very strange, and I'm unable to import any certificates for my ss...

Ehman

not to keen to kill 20 live AP's 400km away from me, will rather wait it out till someone else makes the mistake and in mean time, I'll order the same unit for demo and testing purpose with the new ros version

Ehman

I don't trust the new versions of ros [past experience] ...always tends to be full of bugs

Ehman

awesome script, I use it on almost all my routers, but after a upgrade on my grooves, the script go's mental and kinda crash my router, leaving me a nice supout.rif file and no email!

Model: Groove A-52HPn
ROS: v6.3
firmware: 3.07

Ehman

How do you configure your rstp and "connect list". This should work if setup correctly. http://wiki.mikrotik.com/wiki/Wireless_WDS_Mesh Model 2 : Wireless WDS Mesh With Bridge Interface exactly the same bridge config, the only difference is, I use [WDS MODE:static mesh] and I've entered a...

Ehman

Hi I've got some issue's with my wds mesh rstp wireless network I've noticed that the "path cost" is way more accurate then the "root path cost" with all my wds ap's, but the system responds to the "root path cost" when it switches over from root to alternate port. I wa...

Ehman

LOL ..I still need someone to help me with this major issue?

Why does the AP drop when it connects to new WDS AP ???

but there's no drop when it connects to the alternate port, its lame

Ehman

Ive got the same problem and changing from: both-addresses-and-ports to both-addresses will cause a severe performance decrease, I have a 3WAN PCC balancing config, and both-addresses-and-ports worked like a charm, what now??! I need the performance of both-addresses-and-ports but need the stability...

Ehman

well. It could be complicated. but to try in a simple way, try to make the perfered route. start at 1000 at your root (gateway), and set 2000 to fisrt device, 3000 to second, 4000 to third etc. If multipath. try to see as a circle with more rings.. put devices in the same "ring" at same p...

Ehman

something to consider: Uptime + highest tx/rx signal + highest tx/rx rate + ...maybe the little packet flood thing that determines the max bandwidth I think if you guys can add that, it will improve the system by far! or give the user options to select that will influence the "root path cost&qu...

Ehman

for rstp ports you also can set manual path-cost and also by lowering the main routers priority to a lower one to make it as a root-bridge. OK, just found out, the bridge path cost and stuff needs to be dynamic, but I need a better method then now, I want the thing to connect to highest Tx/Rx rate,...

Ehman

well. It could be complicated. but to try in a simple way, try to make the perfered route. start at 1000 at your root (gateway), and set 2000 to fisrt device, 3000 to second, 4000 to third etc. If multipath. try to see as a circle with more rings.. put devices in the same "ring" at same p...

Ehman

prioritize in your rstp setup.

wish I knew how

Ehman

Hi, I've got a WDS Mesh With Bridge with rstp on bridges with 7 antennas on static wds mesh mode [dynamic is worst] and the performance suuuck, sometimes the "nodes" just drop off the air and return when they feel like it and the system seems to make the worst! signal the root, example: be...

Ehman

ahhhhh. my false I was thinking on that you are owning an internal mini PCIe card!!!

hahaha, its ok, I returned the device today and got my money back, I bought a slower device that is compatible

Ehman

Hello Ehman, I was seeing this solution a while before I was telling you that here and it was working very well for other so I was thinking it should also work at your RouterBoard and also solve your problem! Here is the original thread I was gaining this solution! mini-PCIe slot not working??? I d...

Ehman

Hello, if this modem is in mini PCIe form factor you can try this: Please go into the System Routerboard USB section and choose the type Mini-pcie and then the modem should be recognized. If this is a modem as a USB stick please make a supoutfile.rif and mail it with your question to support@mikrot...

Ehman

read my post http://forum.mikrotik.com/viewtopic.php?p=72336#p72336 Hi, yea.. I've been checking your post out, but its not working 1. only numbers can be specified. For example if you want to move rule 3 to first position: /ip firewall nat move 3 0 2. use find command /ip fire filter move [/ip fir...

Ehman

Hi I bought a nice huawei e3131 with hilink enabled (the nightmare), this device is fast! but... I can't use it in mikrotik because it doesnt want to work as a modem, I can't make it work, I've tried every guide on the web and none works, can anyone help me with it. The issue: the device is in hilin...

Ehman

I've got 10 of them example: /ip firewall filter move [find comment='rule0"] 0 /ip firewall filter move [find comment='rule1"] 0 /ip firewall filter move [find comment='rule2"] 0 /ip firewall filter move [find comment='rule3"] 0 /ip firewall filter move [find comment='rule4"...

Ehman

Now I'm sitting with the same problem!, all the methods in here are dodgy...I need to move 10 rules on the top, I had a power failure and all my top rules on my hotspot moved down causing me to have critical access blocked from clients

how can I fix this with a script every time my unit boots

Ehman

Ok, I've been busy for the entire day to disable hilink on my linux pc, no luck! http://192.168.1.1/html/switchProjectMode.html makes it a modem ....temporally, and there is no windows drivers for the modem so I cant communicate with the dam thing. AT^U2DIAG=0 that code makes it a permanent modem, a...

Ehman

is it possible for you to use RSTP ? i think its completely solve your problem , i had this problem earlier and when i use RSTP instead MESH its solved !

thx

Ehman

Hi I've got a couple of WDS/mesh units and some indoors, well, the indoor units wants WDS from units waay to far, I want to use connect list and set the signal strength range -70..70 ...well guess what, devices with 85 still connects and mess up my path cost while its doing its thing causing huge pa...

Ehman

Hi, Can you share your configuration & explain details about problem? I've been told by mikrotik support that multiple gateways on a hotspot can cause issue's So I guess it cant be done, so I added a 2nd router for it, against my will! I don't have a config for it anymore, but I used route mark...

Ehman

It is not really wrong. Maybe we're both right 50% Maybe it is best to block both ways. Block initiated connection from both inside and outside. lol..you've got a point there :) , yea its probably better to block it both ways EDIT: naah I'm sticking with my one way rule, just tested it again.. I do...

Ehman

forward rule on blocking source: 184.173.0.0/16 from destination: Address-list IP

so my method is wrong you say?

Ehman

Thanks, but how do I run a test to speedtest.net? When I try put http://www.speedtest.net in the "test to" box in winbox, it says cant connect. I have also tried the sites ip. Hmmmmm....I'm also looking for this feature, the reason behind it is ...I want to build a intelligent loadbalance...

Ehman

are you blocking dns requests too? or just trying regexp in blocking http traffic? can't do that in my case, because I'm running a hotspot with free users and paid users on the same router with different subnets You drop this is your terminal and whatsapp will be blocked and so will all the servers...

Ehman

why do you assume that this text "thepiratebay" shows up in any of the packets? you must use packet sniffer and check how to block it. L7 is not a keyword blocking system the domain is *.thepiratebay.* So I assume if I block that in layer 7 on the appropriate way, then it will be bye bye ...

Ehman

6.4 development test version. I doubt if makes a difference. I am planning to experiment with transparent proxy over the weekend. I think it is a more reliable way to block websites than layer7. haha ok, I thought u were using a old stable version, I always have problems when I'm using hotspots wit...

Ehman

if the link you provided above is up to date, you could easily block packets sent to any dns server, which contain "sro.whatsapp.net", by creating a layer-7 regexp. I'm having big issue's with layer 7 on certain sites, the only site I can bock on layer 7 is facebook, everything else refus...

Ehman

the same: add name=facebook regexp="^.+(facebook).*\$" add name=piratebay regexp="^.+(thepiratebay).*\$" the filter rules are #0 and #1 on top of my list. I can see both Bytes and Packets counters increase whenever I click on the piratebay link or enter the url into the browser....

Ehman

You're right - I am still missing lots of theory. I left both src-address and dst-address empty and I am unable to open http://thepiratebay.se/ on the whole network. Do a similar test without the address-list and see what it does? I defined regex similar as you did. add action=drop chain=forward co...

Ehman

I think you need to declare freeusers as src-address-list. Also make sure that both rules are on top of the Filter Rule list. not going to work, dst-address-list is the end users, not servers, the block facebook works 100%, but me trying to use the exact method to block the other site, does not wor...

Ehman

Hi I'm trying do block thepiratebay with layer 7, but hell no, it refuses to block, but blocking facebook works like a charm!! :shock: /ip firewall layer7-protocol add name=block-facebook regexp="^.+(facebook).*\$" add name=block-thepiratebay regexp="^.+(thepiratebay).*\$" /ip fi...

Ehman

http://rickey-g.blogspot.com/2011/05/wh ... tails.html

there's some info on how to do something, but those IP's aint the same then those that I saw on my log

Ehman

I'm looking for the same thing, I've noticed that it uses a bunch of IP's and port 443 and maybe 5222

But I'm looking for a solution and haven't found one yet, so have anyone found something yet?

Ehman

In the profile hotspot for user set "transparent proxy" no

*mangle rule is set to hotspot: auth
*"under user hotspot profile" transparent proxy is unticked

result: doesn't work

Ehman

Hi Is there a way that I can make things like mark routing or even load balancing with hotspot enabled, because I cant make anything work that involves a hotspot in the setup, it just pops me a error or gives me a issue, I bought a 10port router for a reason, and now I need individual units to make ...

Ehman

please see the wiki.mikrotik.com on how this can be accomplished, of course you can implement 2 servers or even 2 separate networks. That is your choice. However, cost effective implementations are as described. I would go with this one: trial - without authorization, can only access pages you allo...

Ehman

How about creating 2 separate hotspot servers ....and then bound it to specific IP ranges by using fancy rules that I don't know how, forward, jump something like that?
they can register a free account on my radius server, and my radius server will give them a IP in the free range
everything on 1 SSID

Ehman

it is, and you have to use it. Either use separate SSID, where trial/unauthorized users can connect with limited access to internet resources, or use hotspot with walled garden, where limited/unauthorized users can access only certain pages. Either this or "creative" users might get free ...

Ehman

Set the routing mark with hotspot=auth and try... Nope, does not work at all, I've tried that before I post this thread ERROR: Not found While trying to retrieve the URL http://www.google.com Network is unreachable You cache administrator is webmaster Generated blablabla (Mikrotik HttpProxy) I'm ru...

Ehman

easiest way is to separate them out, just add (I presume you are using wireless) virtual AP with different SSID and different address space where your trialists are connecting and manage their traffic completely separately from main AP. I'm using wifi Yea that's the problem, I'm trying to do it via...

Ehman

Hi

How can I block certain websites and services from trial users only?

the problem is, I've got 1 router serving trials users and paid users. and only want to block stuff from trial users

Ehman

Hi This guide I've been trying to follow refuses to work with a hotspot enabled on the router, I'm trying to mark routing so that a certain IP range get a certain gateway, but no luck at all, if I disable the hotspot, it works! . :shock: Guide http://wiki.mikrotik.com/wiki/Load_Balancing_over_Multip...

Ehman

http://forum.mikrotik.com/viewtopic.php?f=2&t=73483

I've asked the same question a long time ago, but haven't had time yet to understand it, but check it out, if you haven't made a plan yet .....if you sorted it out, please post your solution

Ehman

wooow this suck..

I'm receiving my RB-2011URM today, it better be working right

Ehman

So this cant be done?

Ehman

Hi This is a feature the world might kill for I need a script that can help me out to give all my trial users x amount of mb until their time expires ONLY the trial users must get the x amount of cap not my other logged in users or if mikrotik can add the feature it will be EPIC, I'm sure the world ...

Ehman

at these distances it will not work. and if you can lay quality cable for a wireless signal, why cannot you lay any other cable, that would allow greater speeds. i am not going to lay cables rather i was thinking to use the cable of a PSTN provider local authority don't give permission to lay own c...

Ehman

Hi it's 12:!2 am now and i was thinking can we user a 2-3km length single copper wire 24awg (not pair) to directly connect twi 7115hn antenna port and both the device will work at a distance of 2 km?? can admins/wifi engg confirm this?? Thanks weirdest question I've ever seen in my life, but oddly ...

Ehman

I didn't think about this one long enough. The above scripts are very flawed and will not generate very many unique passwords. I will make another attempt soon.

any luck yet? ..I'm looking for the same kinda thing

Ehman

You Need a Radius Server with Multi contract Support I'am Using radius Manager from DMA Softlab mistry7 I'm also using radius manager, but lol!, you cant expect a noob to turn into a linux genius and doing the works that involves using Radius manager, because its hard as hell and takes forever to u...

Ehman

Hi I've been using old version of routerOS because new versions is always screwedup example: http://wiki.mikrotik.com/wiki/Use_host_names_in_firewall_rules that does not work on v6.2, but works on v6.0rc13... the reason why I'm not on v6.0rc13 is that my logdump email script makes certain units cras...

Ehman

damm

Ehman

it wont be ten times faster but you can look at '/ip packing' hmm I've been looking at that feature now for a long time, but not sure if it will work inside a sstp VPN tunnel with EoIP on both ends, to pipe thru a 10meg internet connection using a 1meg VPN link, and hopefully get more then 1meg ban...

Ehman

I bought myself a 1100AHx2 a while ago, and it does sound like a turbo prop, louder then my 2 servers, and office pc, I tried to turn it off by selecting manual but it only made the aux fan turn on, so I just left it and lived with it, but now I need another 1100AHx2 on another site, and this puppy ...

Ehman

Hi, I've been thinking is there a method to speed up your link using routerboards, heavy packet compressing or heavy something limitations... a leased line and a fixed budget goal: something 10 times faster Inspiration link: Increasing wireless network speed by 1000%, by replacing packets with algeb...

Ehman

sweet, its working now, I changed the rate to 3min and burst to 1

thx guys

Ehman

Ok, I tested the rule, I changed the rules from forward to input, and after pinging the device 10 times or 100times, it doesn't add anything to address-list.. Am I missing something? Make sure your hitting the time threshold. ... it has to be more than 10 per second averaged over 2 seconds. Ohh, I'...

Ehman

Ok, I tested the rule, I changed the rules from forward to input, and after pinging the device 10 times or 100times, it doesn't add anything to address-list.. Am I missing something?

Ehman

Try this:

add chain=forward comment="allow 10 ICMP-requests per second per source IP" dst-limit=10,2,src-address protocol=icmp
add action=add-src-to-address-list address-list=icmpflooders address-list-timeout=60m chain=forward protocol=icmp

thx

Ehman

Hi

Can someone help me with this, I need a firewall rule that can add a source to address-list after it got pinged a x amount of time, say for example 3 pings put address on address-list.

Ehman

Also enable syn cookies:
/ip firewall connection tracking set tcp-syncookie=yes

That command give me:
expected end of command (line 1 column 38)

Ehman

/ip firewall filter add chain=forward protocol=tcp tcp-flags=syn connection-state=new action=jump jump-target=SYN-Protect comment="SYN Flood protect" disabled=yes /ip firewall filter add chain=SYN-Protect protocol=tcp tcp-flags=syn limit=400,5 connection-state=new action=accept comment=&q...

Ehman

I've had a issue with my 4 ubnt rockets rebooting every second, but I changed my PoE setting on my RB750UP from auto to ON, and problem was fixed :) So just by interest sake, is this problem solved now? ..I've checking out all the pages on this thread and it looks like some guys really have a hard t...

Ehman

Is there a way to disable the "checking of the throughput" process?, this will make my life easier

Ehman

I have a network setup and running 3 AP bridge units with WDS. This is all working and has been up and running for 3 days then it drops, after a reboot the units start working again. I've checked for frequency conflicts, and also setup rstp but no difference after running for between 1-3 days the s...

Ehman

Hi, I have build a mesh Network with 6 RouterBoards RB912UAG-5HPnD with additonal wieless cards from ubiquiti (SR71) to work in 2.4Ghz for clients. The inbuild cards are configured in dynamic mesh (wds). The inbuild card, the separate ubiquiti Card and the ethernet are bridged. All of the the wirel...

Ehman

does not work at all! I can ping a mac using the gui's tool ping, but the command ping does not want to ping a mac-address and neither does the script work for me

Ehman

isnt there a way to make it ping all the other nodes and select the best ping instead of flooding the mesh for 2 minutes long constantly,,, its going to flood 80% of the time rendering the network useless ..? uldis, I can't implement your methods mate, its to much nodes and I run a risk to mess it u...

Ehman

ok problem fixed, hehe, I'm a idiot

..I used common sense and the forward rule on bridge

Ehman

Use split horizon bridging. You will achieve the same result, no firewall, much faster, much less config. http://wiki.mikrotik.com/wiki/MPLSVPLS#Split_horizon_bridging Hi. This is not working, it can ping right through it 4 ports bridged to a bridge called Birdge1, I played around on the 4 ports an...

Ehman

every time a WDS link is made it is checking the throughput of the link so it could calculate the patch-cost of that link. You can minimize that by creating a connect-list rules to make WDS links only between the good stable links which will give you less WDS reconnects. Or you can disable the WDS ...

Ehman

so you want to use a routeroard with a usb modem plugged into it, and then plug pc's into it, so that you can share internet like that... Not imposible, if its a 3G modem, then it can be done, I've done it like it, its epic, but adsl modem into your router, i dunno mate.. I've never done that, and I...

Ehman

Hi. I've created this mesh network using that guide http://wiki.mikrotik.com/wiki/Wireless_WDS_Mesh Model 2 : Wireless WDS Mesh With Bridge Interface Ok, its working and then its doing it THING! all units flashes going crazy and generate max traffic every time a AP connects in and ask for WDS, this ...

Ehman

Hi I need some help with one baby, Say for example, you hook up a hotspot but you dont give it a internet connection, its NOT going to work, but if you allow is DNS access, it will show the login page, and when you log in, your stuffed, result in a page that says: "the connection has time out&q...

Ehman

I haven't had time to play around with it, but this might help you.

http://wiki.mikrotik.com/wiki/DoS_attack_protection

Ehman

Hi can someone help with a script that can isolate my 13 ethernet ports from each other in a mesh topology like? /ip firewall filter add action=drop chain=forward in-bridge-port=\ ether2 out-bridge-port=ether1 thats 1 rule, to make them for 13 ports it will probably be around 156 rules :shock: So is...

Ehman

can 10.5.8.1 access 10.5.7.1 an vica versa at l2?

When plugged in ARP does its talk and the other units reply so I assume so, but when I disable the hotspot on the 10.5.7.1 unit, the problem is gone!

so maybe the bug is in the hotspot function..

Ehman

Update: All routers updated with v6.1 ...imho

GRE packet flood got replaced with a ARP packet flood, still equally bad.

unplugge ethernet cable between two routers and toy get that!

Ehman

did you update to latest RouterOS? other router is x86 box (10.5.7.1)? can you add pcap file with one packet or several packets for inspection? Its all routerboard. RB750GL configured to be a hotspot (10.5.7.1/16) and RB751U-2Knd (10.5.8.1/16, latest version of ros does the same thing only worst, i...

Ehman

can someone please help me to stop the flooding of packets when the cable is unplugged between the two routers running EoIP?

Ehman

Look at this guide
http://wiki.mikrotik.com/wiki/Manual:MPLSVPLS

No success mate, vpls suck. I really think mikrotik should fix the EoIP issue that I moaned about, v6.2 doesnt make it any better tho

Ehman

You should run VPLS on loopback addresses. I dont see where the loopback addresses are? ....I dont have any other options, because EoIP have lost its mind, and I dont know how to fix that issue and with "IP Tunnel" i cant do jack with, because I can add it in a bridge http://forum.mikroti...

Ehman

Hi I've got 3 networks on 2 routerboards and want to make a link using VPLS, but it gets confussed with all the IP's on each device. on each device I've got the following IP ranges active #1 = 10.0.0.0/16 -vpn network #2 = 10.10.0.0/16 -main network #3 = 192.168.1.0/24 -managed port network but it o...

Ehman

Screenshot of eoip -gre packet flood when I unplug the cable between the two routers.

check the time on the packets, its crazy

Ehman

check http://www.mikrotik.com/download/share/all_files_6.2.zip Hi, thx for link ros6.2 is a mess!! I loaded my config on and half in the middle it made my router crash and now when I want to log in via mac address, it keeps telling me "router has been disconnected" boom ! ...going in via ...

Ehman

EoIP go mad sometimes. :D Try another way of making a l2. l2tp or vpls. :D I've tried everything, only EoIP seems to work for me, vpls doesnt seem to work, it refuses to link up, makes me feel like a idiot.. What RouterOS version is this? Have you tried latest 6.2 if it is not already? Do you use k...

Ehman

HI I've got a issue here, I'm not sure if its a bug or something.. the problem is: I use EoIP allot and now on my test rig, I've got 2 routerboards connected via EoIP + bridge on both devices and a Ethernet cable between them, 1 device is a hotspot, ok... ive noticed that if I unplug the cable betwe...

Search found 402 matches