MikroTik

givemesam

Any update on this? I logged into our datacenter ccr1036 and we see fcs errors every minute on our sfp+ uplink It's set to 10G full Haven't seen this before but noticed it in the logs being full I was gonna to head there and change the optic bit I have no real reason to blame it. Anyone find a reaso...

givemesam

So ive been watching it, and trying a few things, like enabling firewall, turning off service ports, making sure discovery is off on gateway. nothing worked. so i just kept watching it, then BAM, it all disappeared infront of my eyes. no longer showing the traffic on the lan via torch. makes no sens...

givemesam

I have a rb750 at every one of my sites. I use it for ping tests, and speedtests for network performance. We do not have anything connected to its lan ports, only the gateway. it sits on the same lan as other devices at this location. somehow the gateway is showing about 20mbps constant traffic on t...

givemesam

Our new ip uplink is using QiNQ to get our vlans sent to our head router. This brings our C-vlans mtu down to 1572 (upstream s-vlan interface is 1576, 1580 on bridge/eth) are we fragmenting with this current l2 MTU setup? - should i make an mtu change on the l2 MTU? - should i also tell the upstream...

givemesam

so, on our ccr1036 we have a mikrotik sfp in the sfpplus1 6.34.6 when it is on autoneg, it gets ddm information, but wont pass data when negotiated at 1000F. it will show low light unless sfp is re-inserted with fibers installed. when its set to no auto 1000F, (as that is what upstream requires), ...

givemesam

They are pretty slow on complex things and will ask us to test it and supout

No way we can do that on our production gear

It could have been a bad revision that got sorted. I think it was 6.30.x

givemesam

Do you know a thread dedicated to 1036 stability? Is it possible Mk just keeps breaking their flagship router on every release? The last one we tried turned all ports into hub ports and all data flooded to all ports. The router is not new but is still in beta The old firmware gave us negotiation tro...

givemesam

So your saying I should downngrsde from 6.29.1 to 6.19?

Do you have any info on the 6.35 reliability?

I can't find anywhere discussion on stable newer firmware from the 2016 bugfix releases.

givemesam

hi all we have a 1036 running 6.29.1 and we are not sure what the stable software/firmware for it is. We tried a few releases a few months ago (6.3x) and it crashed our network instantly. We are not sure if it was the software or the FW that crashed them, but we downgraded back to 6.29.1 There are m...

givemesam

Thanks for the reply Has anyone implemented any special tricks for PPTP on mikrotik? It is still a widely used protocol. Although i dont really like PPTP through NAT, it is something i need to try to support. Any guides on making it work would be great. My guess is it involved mangling..... But that...

givemesam

"Acting as a VPN server" and "forwarding VPN traffic" are two completely different things. It is not useful to apply solutions you find for acting as a VPN server to the forwarding of VPN traffic problem. I'm not even sure that the MikroTik is capable of forwarding PPTP (that is...

givemesam

PS its a ccr1036 with r6.29

givemesam

I've been playing with this for a while with no luck I have a good firewall following a drop all logic with some tweaks to drop known baddies. Firewall is basically: Accept established and Related for both input and forwarding chains. Then drop all. Works great for all users except for PPTP through ...

givemesam

How are you adding the VLANs? I copy an existing VLAN from within winbox and vlan tab, and change all the fields, then press OK on the new one, and cancel on the source. I have also simply pressed + to add a new vlan, to re-create one that is giving me issue. Both methods didnt solve the issue in r...

givemesam

I am not sure what section to put this, but in both 6.28, 6.29, and 6.29.1 when adding new vlans, under a bridge, some will work, some will not. I have found the issue to be somewhere with NAT. Simple explanation: Added Vlan 30-40. Each has its own DHCP, Pool, Network, Addresses, scr-nat to address ...

givemesam

I'm no pro but possibly you need to swap tx and rx on one side of the optical link.

You may have tx going to tx, tx needs to go to rx

givemesam

Hi all, lets say i used a real MT on one of my lans, OR i launched a VPS server with ROS running, could i do this: issue: Wifi network running 'isolation' with MAC based authentication. No devices can communicate over the lan. Devices are HVAC sensors and do not need internet access persay, but my c...

givemesam

Is this the x27 (introduced in .25) port flapping issue? Taken off upstream switch cisco me3600x, ethernet port, connected to mikrotik sfp+ port on ccr1036 16GB via mikrotik copper sfp Also note: their port is set to no autonegotiation / 1000M Full My port would not sync up on autonegotiation unchec...

givemesam

me too. i upgraded to 6.27 last night, and 2 hrs later had FCS errors on the uplink/wan port connecting to upstream isp. This resulted in an outage that was devastating. rebooting did not help, reseating did not help. nothing helped. it randomly came back an hour later.......... Very concerned it wa...

givemesam

There are no dates on the posts in this thread. When will .28 be released? Just updated to .27 from .23 and immediately adopted an Ethernet negotiating issue on my ccr1036..... After two hours it just went off line. Has some FCS errors on my Cooper sfp. No asking of reboots or unplugging recovered i...

givemesam

Any issues on CCR 1036 16GB bugs on current release 6.23? Using mikrotik copper sfp in sfp+ port for wan uplink I auto updated firmware and boot loader Replacing 1100ah Saw some stuff from a year ago mentioning beta 6.6 and some interface flopping issues, not sure if the firmware is way behind or no...

givemesam

I have been trying to learn everything i can to make my rb1100ah more resilient (if possible) and more stealthyish to DDOS. I just learned about syn_cookies and have enabled them :) they moved it to ip/settings vs ip/firewall/connections/settings Anyway, i had these rules at the top of my firewall: ...

givemesam

so i had to add an icmp rule so i could ping the gateway. in my tests, i think it was pinging without the rule becuase the connections were already established when i loaded the new rules. then my watchdogs started rebooting when those connecttions were dropped and not allowed. I used: chain=input s...

givemesam

OK! so i got hit with DDOS before i was able to put get things finalized. Network went down.... came back in about 10 min. i was desperate, so i started applying the rules, (in safe mode of course!) Things were going well with my new rules! Got hit with DDOS again, router could not handle it. its re...

givemesam

I was working on my firewall and thought, hey, make a drop rule for known bad ips. I know its not elegant because ips can change, but i found a site called http://greensnow.co who publish about 700 of them. I know here are others, and maybe better ones, darklist, arbor, etc, im interested to know pe...

givemesam

deleted

givemesam

Excellent! I studied your notes, and then ran a test on my RB450G at home. Had to play with it a bit, but i think i got it. I am still a bit unclear of my order or operations on the icmp rules i have here. But what i want is the router to be stealth, but users on the lan, and the router itself to be...

givemesam

what do you mean it could be a valuable debugging tool? how so? i have about 20 outside facing public ips, so i added dst-address to the rule so only 1 of them would ping back and since it was specified to allow, the other 19 would get caught by the drop everything rule right? ??? like this? add cha...

givemesam

Thanks SO MUCH! you are teaching me lots! here is my rough draft now. I have a few questions on there and hoping i have things in the right order. I have some pre-filters that i am thinking can help me until i learn about pppoe, but i want to get my semi-open router mostly secured. Im worried about ...

givemesam

Am i right to assume that the 1100AH (notx2) does not have the juice to filter 250mbps/20mbps on the forward chain for lets say about 30 virus ports and accept new/est/related and drop the rest? I applied the port block on the forward chain and saw what i thought was drops from about 200mbps to less...

givemesam

awesome. thanks! i am working on my 3rd draft, but i have a quick question. my v2 firewall that was posted above does not have a hard drop rule (yet :)) but i was wondering why the drop invalid connections count is so high? i feel like that should be before the allow established/related rules to wor...

givemesam

Hi Doc, I hope you are watching this tread. Your post really helped me to change my point of view of firewaling and while trying to build it, i think i understand all the login needed to make an effective edge router firewall. Here is the document i made for myself. I think it needs some editing and...

givemesam

Wow. yes, you are right. Im learning and new at this. I had that queue in there and that was taking my routers performance :( had that in case it would help me hold access during an attack. RB1100AH i guess cant handle a queue of that size As a way to understand, help me with this: If say 20 users w...

givemesam

router screenshot

wondering if we can share popular DDOS ports to block, and if it should be input and forward, and if output would help too.

not even sure any of this filtering will help.

givemesam

Hi all, DDOS. need i say more? crippled us over the last week. Had to have upstream isp blackhole the offending static route for 48 hours. Changing it didnt matter. Some LAN device is likely asking for it/report the IP. Didnt have any filter rules before. 2 years of no problems. I learned my lesson....

givemesam

Hi there is there a way to make a winbox session keep going even if i disconnect? what im trying to go is to use terminal to ping an IP, then if i get disconnected, for it to resume and show me what the pings were like when i was not connected. This is a way to monitor uptime, stats, etc i know i ca...

givemesam

I have an RB1100AH working as a core router. Will be doubling the traffic on it in the coming month. Its currently running around 150mbps of internet traffic for about 150 devices (all these are wireless APs, so total devices making TCP/UDP connections is more like 1,000) It is very simply setup. Th...

givemesam

cool
i didnt see an option to remove quickset in system/packages

givemesam

ok straight forward enough

Anyone know the 1100AH well enough to recommend which ones are not compatible?

givemesam

I updated 1100ah to v6 and installed all packages It grabbed quickset which clearly is not meant for it as it has put addresses in the fields that do not apply. It has occurred to me to take it out in case of accidental clicking or something. It also occurred to me there may be other modules in that...

givemesam

ALSO, Should i bridge my 2 switch groups? I dont have any reason for data to cross them, and each switch going to this router is vlaned to its own subnet, so broadcast traffic should not be trying to cross either (causing proccessor overhead?). If i do need to access something while managing the lan...

givemesam

OK! good to know! is there a way to turn it off? Also, i was watching throughput earlier, and noticed that every few seconds, it would show "0" for throughput on many of the interfaces for a moment, then show the rates again. Proc was about 30% with 120mbps throughput wondering if this is ...

givemesam

givemesam

Hi there I have an RB1100ah (not x2) and it used to be in this setup v5.xx Port 1 master port2-5 slaved Port 6 master port 6-10 slaved BRIDGE port 1+6 port 11 WAN port 12-13 unassigned Updated to most current 5.xx, then 6.xx, updated firmware newest: I changed it up to have NO Bridge, with 7 subnets...

givemesam

Hi there Even though this is old, i thought i would chime in. I was a MT noob, and probably still am, but my understanding is of the RB1100AH (not x2) is Port 1-5 has its own switch chip with wire speed performance Port 6-10 same thing BUT port 11 is directly connected to the CPU, so what you want t...

givemesam

Hi! this is what i am looking for but i am a noob for scripting. it would be great if someone could make this a bit clearer for me. I need a script that will renew the dhcp client on ether1-gateway (i assume 'wan' was a label) if it can not ping out to 8.8.8.8 x times in 15 seconds. Ideally you can ...

givemesam

Thank you for the reply! I thought i was missing some rules there. My understanding is quite primitive but i will catch on as i learn. So can this be explained as either /ip firewall nat add chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=53 protocol=tcp dst-port=53 add chain=dstnat...

givemesam

Hi Gurus, I am pretty new to Mikrotik, but have successfully put into production a 4WAN PCC load balanced 450G. Its performance is great, but sometimes things are not balancing all that well. I have narrowed it down to either our modems losing performance, or possible the ac adapter i used for it. I...

givemesam

I have a PCC 4 wan load balance setup on my 450g. We have wans drop out from time to time, and i need to do a speed test on the line to see if it is really down or if it is just how the load balancer is deciding to put traffic though it at the time. The alarming speeds usually look like this wan tx ...

givemesam

Hi, I am newbie in these parts. I need a 4 WAN Load Balancer that can handle 4 X 25 mbps WANS. I know that the 680 mhz boards can handle a lot of throughput but according to this explanation from pfsense it should need more power to do that well. take a look http://www.pfsense.org/index.php?option=c...

Search found 50 matches