MikroTik

Zebble

ZeroTier was just updated yesterday to version 1.10.3 in ROSv7.9beta4

Good timing and great news!

Zebble

Same question... ZT is now at 1.10.6 and incorporates new functionality since 1.6.6 and some significant path improvements/fixes. If ZT is not going to be regularly updated with new MT releases, then probably best just to remove it entirely from ROS. We can always run it in an container on some ROS ...

Zebble

It appears this functionality is definitely broken (Mikrotik support indicated it was "unstable") in 7.x. I'm not sure saw I saw that indicated anywhere wrt 7.x release documentation...

Support also indicated there isn't a release date as to a fix.

Well, at least I wasn't crazy!

Zebble

Port-extender/controller seems to be completely broken in 7.5. The interfaces won't appear in the bridge on the controller. They all appear as red/invalid and take forever to come in (if they ever do). Controller performance also drops down significantly, at least from a GUI standpoint. This was usi...

Zebble

+1 for this feature. Would love to be able to have Mikrotik devices subscribe to a central MQTT server over TLS/SSL to trigger scripts on topic updates. Perfect for doing lightweight automation and control and not need to poke any inbound holes through firewalls! We currently do this through some sc...

Zebble

You can always buy an AP that supports it! You will never find all features in all possible devices at all price levels. The problem isn't the AP (we're talking about Mikrotik - they all support EAP), it's the client devices. Not all support EAP, especially consumer devices. The example above of an...

Zebble

You can do this standards-based when using WPA2-EAP. Almost every client supports it.

This isn't the same as dynamic PSK. Not all devices support EAP, and DPSK is far simpler from a user perspective.

Zebble

Nice Work!

I added FireHOL Level2 to the script as well, in case you're interested. Just added this line:

$update url=https://raw.githubusercontent.com/ktsao ... el2.netset description="FireHOL Level2" delimiter=("\n")

-zeb

Zebble

This appears to now work, at least with the CRS328 I was testing with. With the change to using bridges for most stuff with regards to switches, this is now available in the BRIDGE-MIB (1.3.6.1.2.1.17).

http://www.oidview.com/mibs/0/BRIDGE-MIB.html

FDB is 1.3.6.1.2.1.17.4.3.

Zebble

CRS328 is definitely an awesome addition! Thanks MT!

Zebble

Did you ever figure this out? We're running into the same challenge. We've also tried a RADIUS server (userman), but it can't handle username pattern matches...

Zebble

You could also just turn off connection tracking to clear the connections, and then turn it back on.

/ip firewall connection tracking set enabled=no
/ip firewall connection tracking set enabled=yes (or auto)

-wade

Zebble

Based on experience, you may want to use blackhole routes instead of an Address List. For larger lists, blackhole routes take up less CPU and RAM so they tend to perform much better and on lesser hardware. The only thing you lose is the ability to count the number of "hits" to the blacklis...

Zebble

6.2 update fixed both problems.

Thanks for checking jirif. Confirmed on this end too.

Zebble

This seemed to work in a system script, pre-6.x: /import script.rsc Now, any script with an import command works just fine from the CLI (ie. manually entering "/import script.rsc") but does not run within a system script. No error, execution just stops at the import command. Is there a new...

Zebble

We saw exactly the same thing on an RB532 running ROS 6.1. I thought it was a rules issue, but couldn't find the culprit. Refreshed the rules with a new set, rebooted and the problem was gone... I'm now not sure if a simple reboot would have sufficed.

Zebble

At the risk of starting a flame war, this is fairly common with Cisco equipment and auto-negotiation.

Try locking the ports on both ends (the MikroTik and Cisco) to a specific speed and duplex. That usually works.

-zeb

Zebble

Unless I'm missing something, this isn't really bonding, but load balancing, right?

Not that it matters, just doing a sanity check for my own benefit.

Zebble

Yup, definitely works as suggested. We have a PPPoE connection with a static ip, as well as a /28 and /29. We've assigned the first address of each subnet to a physical port on an RB1200, and made the ports standalone (ie. master ports with no slaves) and works great! Definitely nice to have complet...

Zebble

The RB44Ge looks like its full height. I've never seen a half-height card that can fit 4 full RJ45 ports on its faceplate...

Zebble

Got it... I wonder if you could mangle using the "Content" field? If you can identify something specific within the packet of each PPTP connection, then you could do what you need to do... Alternatively, if you could change the PPTP server to accept PPTP connections on another port in addi...

Zebble

That's correct, but the last sentence in the first post indicated you were trying to use PPTP and SSTP and alter routing tables but couldn't figure it out. That's exactly what skillful's response addressed.

Zebble

Hi syadnom, skillful's response is what you want. Marking the outbound packets through mangling, based on the characteristics of PPTP and SSTP, and then applying policy routing based on those marks will force PPTP out the "DSL_Uplink" interface, and SSTP out the "cable_Uplink" in...

Zebble

Certificates are optional if you're connecting between Mikrotik's using SSTP.

Zebble

ulikroessin, that will depend on how you setup your firewall rules that use the layer7 protocol filter. You can specific specific addresses, or not and have everything filtered...

Zebble

Zebble

SSTP doesn't do any routing, it's simply a VPN pipe. We've been using SSTP from site-to-site, as you've described, without any issues. Your issue is either a rule problem, or a routes problem. Your routes look ok, so I suspect it's a rule problem and the logs should indicate what's being dropped and...

Zebble

It's a firewall rule. Try adding a "log" action, identical to your drop rules, just before the drop rules, then try your tests again and check the logs. You should see where the packets are getting last and be able to add a rule to compensate. If you're still stuck, send the relevant porti...

Zebble

That possibly means your MikroTik is behind another NAT device.

Zebble

We had something similar happen with our monitoring tool. The tool would grab all SNMP values except the CPU first, which would load the CPU. We fixed this by changing the order of what SNMP values were polled, polling CPU first to avoid this issue. Not sure if this is related, as your issue seems t...

Zebble

I've used the same script on an RB750GL with no problems for at least a few months, non-stop. From your logs, it looks like the fetch command might have hung/lost communication with the dyndns ip fetch site at some point? If that's the case, you can modify the script to check the IP of the WAN inter...

Zebble

Might be easier if you can find a DSL provider that supports MLPPP and simply bond the two (or more) DSL connections? Works very well on the RouterBoards... The only other way would be load balancing the two DSL connections using Policy Routing: http://wiki.mikrotik.com/wiki/Load_Balancing_over_Mult...

Zebble

The Mikrotik appends the subnet to the result of [/ip address get [/ip address find where interface=WAN] address], so you may need to remove it first. This is what I've used: :local currentIP :local externalInterface "ether1-wan" # get the current IP address from the external interface :se...

Zebble

Hi Fredgr, You partially answered your own question. Bonjour is multicast, so you'd need to use something that facilitates a bridge (like EoIP) or does multicast routing. MikroTik appears to support Multicast routing, but I'm not sure if Bonjour will support it. http://wiki.mikrotik.com/wiki/Manual:...

Zebble

Glad it worked out, and I could help!

I'd appreciate forum Karma if you think I helped enough!

Zebble

Hi Mat, Restored your backup to our own RB750GL and everything works as expected. I can ping both ways, and connect to a file share to/from either system. The only things I can think of now is: - Check that MAC addresses are valid on your equipment and on the MikroTik's interfaces (ie. I've seen str...

Zebble

Interesting... Are you sure there aren't any NAT rules doing something strange?

If you want to send me a backup/export, I can test on some RB750GL's we have in stock.

Zebble

20-25kbytes/sec is about right since your lowest link speed is 256kbits/sec (2m/256k).

Zebble

Good point ditonet, which lead me to digging... I found that our script was only pulling in just over 1000 entries instead of the full ~23K due to a bug! It was only pulling in OpenBL entries that started with a 9 in the last octet! Whoops... I've loaded the full list on a reasonably loaded RB1200, ...

Zebble

Thanks again trm3, I think I'm getting it now. Your setup is a little different from ours. We're using MLPPP to our ISP, and then VPN to our centrally hosted MikroTik. I believe what you're describing is that you were using MLPPP to a centrally hosted MikroTik, and have now opted for EoIP. If I'm ri...

Zebble

Hi Trm3, To clarify, you were using L2TP/PPTP/OpenVPN -> MLPPP, and now you're using L2TP/PPTP/OpenVPN -> EoIP -> MLPPP, or did I miss something? How many connections were you bonding with MLPPP and what type (ie. DSL?). Was the MLPPP connection itself showing around 2 to 3% packet loss due to I ass...

Zebble

ChangeIp: That method is very interesting to me! I'm a bit of a BGP newb, so any advice/howto you can offer would be appreciated. In the meantime, here's the relevant portion of the linux-side script that produces the Mikrotik code to update a "blacklist" address-list, in case anyone wants...

Zebble

When we last had our x86 box crash, it was responding to pings but not forwarding any traffic. Console was completely black. Pressing any keys didn't change that, so can't help with a screenshot.

Been up just fine for over 2 weeks now.

Zebble

We have a central server that creates a MikroTik .rsc script every night that creates a blacklist address-list using lists from OpenBL, DShield and SpamHaus. A script on the MikroTik then does a "fetch" of this script on a nightly basis and runs it. Corresponding firewall rules then block ...

Zebble

I can personally confirm that the latest RB1200 firmware included with 5.11 (2.37) resolved the rebooting issue.

Zebble

Quick update that we've had our x86 5.11 VM running flawlessly except for an SSTP problem for almost 2 weeks now.
The ONLY change made was to have ALL logs go to disk instead if memory. Could memory-based logging or overall memory allocation be the source of the problem?

Zebble

The routes you have should be more than enough, and the gateway on each subnet appears to be fine.

Have you tried looking at the Torch for each interface on the MikroTik while pinging, to see where the packet(s) might be getting lost?

Zebble

Do you have any NAT rules enabled?
Can you ping to all subnets including the internet from the router itself?

Zebble

We have an x86 version if ROS 5.11 running in a vmware esxi VM with 2 cpu's and 1GB of vram. It is acting as an SSTP server for 3 RB750GL clients running 5.11. We are using user name/password (64 characters) instead of certs for SSTP. Periodically the SSTP connection will stop passing traffic. It st...

Zebble

Had 5.11 lock up on an esxi VM after about 2 days. A reset brought it back up, and its been up for just over 6 days. ONLY change made was for all logs to go to disk instead of memory or console, so I could catch what was in the logs before the next lock up. Config: 2 vCPU's (xeon e5420) 1GB vRAM 80G...

Search found 50 matches