MikroTik

libove

For what is worth, a (rigorously half-@§§ed and not fully tested) WOL generator in a spreadsheet.
Should be enough to play a little bit with various values.

libove

Whatever we may think of it, it's a thing. Lookup man ethtool, https://man7.org/linux/man-pages/man8/ethtool.8.html See the section on WOL option: wol p|u|m|b|a|g|s|f|d... Sets Wake-on-LAN options. Not all devices support this. The argument to this option is a string of characters specifying which o...

libove

It's what I said when I first started this thread -- some WOL-capable adapters, inexplicably?, REQUIRE the unicast - my MSI Cubi2 for example. It ignores broadcast WOL packets. -Jay ... at a minimum just please implement the (already submitted) feature request to do unicast instead of only broadcast...

libove

All of this is great discussion. In the end, in case anyone from MikroTik is reading, at a minimum just please implement the (already submitted) feature request to do unicast instead of only broadcast. Anything else would be gravy.
thanks

libove

I tested this. As expected, yes, it does work. Not sure whether it's specifically better to use the simpler (non-routable) packet vs. a (routable, slightly more complex) UDP packet, but anyway yes it does work. -Jay In theory, all this stuff Is not needed (the encapsulation of the 0x0800 ethertype a...

libove

I can't answer for why the source port seems to be wrong - could even be just an editing error on my part when I posted earlier. But I don't think it matters, since as @mkx points out, the target station doesn't look at the IP/UDP parts of the packet, and doesn't check checksums, anyway. The source/...

libove

NirSoft WakeMeOnLAN also needs to manually keep the IP-to-MAC mapping, and while it might be nice for RouterOS to implement this database of once-known ARP mappings, really the /tool WOL doesn't *require* such a database to be created - just to have the necessary options e.g.: /tool wol interface={w...

libove

@jaclaz asked about this part of the WOL packet: d89ef342deb4080045000082b9e70000801100e2c0a8ff25c0a8ff2ae6c69c40006ee5c9 Apologies, I might have shown the Wireshark interpretation from one WOL packet sent, but WOL packet data from a second occurrence: d8:9e:f3:42:-de:b4 is the MAC address of the ma...

libove

I truly brute forced this, so there's not much "script"; anyway, I'd already made the feature request last week. Here's what little I have: ## ## Send unicast WOL packet to host AVClientXB1's Ethernet interface MAC address 4C-CC-6A-D6-39-C7 ## ########## Set variables ## Notification e-mai...

libove

Thanks - I now have a couple of rather brute force but functional scripts, one way to send a host-appropriate magic packet, to two different of my local LAN hosts. It works. It would still be nice to see a user-friendly addition to the existing RouterOS WOL tool to specify that the magic packet must...

libove

So. Packet captures. On the sending host (running NirSoft WakeMeOnLAN): 0000 4c cc 6a d6 39 c7 d8 9e f3 42 de b4 08 00 45 00 L.j.9....B....E. 0010 00 82 b9 e7 00 00 80 11 00 e2 c0 a8 ff 25 c0 a8 .............%.. 0020 ff 2a e6 c6 9c 40 00 6e e5 c9 ff ff ff ff ff ff .*...@.n........ 0030 4c cc 6a d6 3...

libove

I agree that the NirSoft WOL tool sending the ARP request for an IP address which shouldn't be on and answering is a bit odd, but, also, the NirSoft WOL tool does keep a cache of MAC addresses, so it isn't necessary for the ARP request to get an answer in order for the NirSoft WOL tool to know to wh...

libove

Hm, yeah, I suppose it might be possible to mangle the packet; it would be nice if MikroTik would implement a full WOL capability. (I'll submit that as a support/feedback request to MikroTik).

libove

It is necessary, for this and some other WOL targets, that the destination IP address embedded in the WOL packet be a specific IP address e.g. 192.168.255.42, not a broadcast IP address e.g. 192.168.255.255 or 255.255.255.255. Selecting an interace on which to send the packet does not provide Router...

libove

With NirSoft's WakeMeOnLAN tool, I can successfully wake-on-lan an MSI Cubi2 system on my LAN. It requires setting the option to send the WOL packet directly to the device's IP address, not to the IP broadcast. In RouterOS, I don't see a way to do that in the /tool wol Is it possible, in RouterOS (v...

libove

One more bit of information - I did a packet capture on the roaming Windows 10 notebook computer. It confirms the above - the DNS replies (and PING replies, and any other kind) from the Mikrotik, that we see leaving the Mikrotik correctly (right source and dest IP and MAC addresses, right port, etc)...

libove

Thanks again. So, I booted up and cleaned up and updated an older notebook computer, and tested it doing the same roam-between-WiFi-APs. It suffers the same symptom. So it's not the mobile phone, but rather (gee, what a surprise!) the ISP router. There are quite active forums for this ISP and its (i...

libove

Thanks for the pointed to disabling hardware offload for the purpose of sniffing. It actually does make some sense to me, as with hardware offload enabled the sniffer may be functioning at a higher level in the kernel - or, period, may have no choice but to be functioning in the kernel - at a place ...

libove

@sindy, You're right, once upon a time I had this stuff clear - "of all the things I've lost, I miss my mind the most"... @jvanhambelgium, thank you - see below for AP information. So, I modified the connectivity of the network to: ISP fibre -> ISP router ISP router -> MikroTik [Ether3] Mi...

libove

Hi MikroTik users, This three-year-old thread: https://forum.mikrotik.com/viewtopic.php?t=121618 .. talked of problems where ARP entries would hang around for too long. There was also a lot in there about placeholder 00:00:00:00:00:00 incomplete/ no-answer ARPs, but I'm focused on the person or a fe...

libove

Too weird. I trialled-and-errored it a bit. It turns out that it was NOT necessary to add the local-address to the ppp secret; having the local-address in the default-encryption profile, and that profile linked to the SSTP-server was fine. What turns out to have been missing - and I'm damned if I ca...

libove

I don't see a place to set the local address in the SSTP server configuration; in the ppp secret it references the default-encryption profile which specifies the local address; shouldn't that pick it up? Anyway, I tried it - I explicitly added the local address to this user's ppp secret, and the pro...

libove

I have a RouterBoard 951Ui-2HnD (RouterOS 6.45.9) which has been set up - and had been working - with an SSTP VPN. I don't think that I changed anything (other than routine RouterOS updates; I'm on the long-term channel). The SSTP VPN stopped working. (Well, the other thing, of course, that "I&...

libove

Thanks k6ccc and Jotne, also very good points.
First blocking scans, before even checking for knocks (with maybe a too-talky limit on allowed services) does seem more complete and simpler to implement than my more complex knock idea.
cheers,
Jay

libove

You raise a really good point. It depends on who/ what kind of attacks we're protecting against. My initial request would be for something that would stop a common port scan from detecting that there is e.g. an SSH or HTTPS port open on the MikroTik. And it would indeed do that. It would make the po...

libove

There are several discussions in these and other forums about how to implement port knocking in RouterOS. And, at a basic level, they all can work. In short, they tend to be "detect proto on port, add src to address-list KNOCKPHASE1", "detect proto on port2 when src already on address...

libove

Hi joegoldman, Interesting idea! I'm play devil's advocate and trying to think whether this could have unintended consequences (accidentally block legitimate traffic). Since the only incoming connections should be either VPN or knocked, any legitimate occurrence of all-ports-except-a-very-small-numb...

libove

Thanks very much for this Sob, I'm guessing that the third knock port (5000) is added just for purposes of demonstration, not that it's required in order to make the two-step knock order 7000,6000 function; right? I see what you mean about it being a bit ugly, since a rule meant to detect "port...

libove

Port knocking is well established. There are lots of examples in the forums and Wikis. "IF this, THEN IF ALSO that, THEN ALLOW ...". But. If we want the knocks to be able to be simple (TCP SYN, so it could be triggered by a web browser), then we run a modest risk of a bad guy's high-intens...

libove

Right, so this is weird. On one Windows 10 VPN client it works. The client gets an IP address from the VPNpool1 statically configured VPN IP address range on the Mikrotik. On another Windows 10 VPN client, it still fails as before. The client is getting that 192.168.255.32 address which mysteriously...

libove

Following-up my own post. I'm working with Microsoft support. They say that 1. Windows Server NPS is supposed to be able to return the Framed-Pool attribute, but 2. They can reproduce this problem and it looks like it's been this way for a long, long time (that in fact the Framed-Pool attribute neve...

libove

I have an SSL installed on my Mikrotik RB750, to provide httpS:// access to webfig, as well as to serve SSTP VPN connections. When I ran a Qualys SSL Labs SSL test against my Mikrotik, it reports that insecure hash algorithms are enabled (RC4). I don't see where to configure which cipher suites (enc...

libove

Hi MikroTik community, I've got a RouterBOARD 951Ui 2HnD (RouterOS v6.38) set up as a VPN server (SSTP). Everything works fine when the VPN clients (Windows 10 workstations) use local authentication from the RouterBOARD (that is, they login using ID+password from /ppp secret). However, I've recently...

libove

Hi MikroTik community, I think this is probably more a how-to about Windows Server 2012R2 Network Policy Server configuration than about MikroTik, but I also figure that the community here is likely smarter and better at answering questions like this than the Microsoft support communities are... :-)...

libove

Oh, and: RouterOS v6.34.4 (stable) RouterBOARD firmware 3.30 /system license print: software-id: 68EG-0A8X nlevel: 4 features: /system package print Flags: X - disabled # NAME VERSION SCHEDULED 0 routeros-mipsbe 6.34.4 1 system 6.34.4 2 X wireless-cm2 6.34.4 3 X ipv6 6.34.4 4 wireless-fp 6.34.4 5 ho...

libove

Hi again Lui, I've re-tested the PINGing, and now it works as expected between the MikroTik (on both it's 192.168.255.3 and 192.168.255.125 addresses) and the VG-8050 - I can't begin to explain why it didn't work before. (Internal hosts e.g. the Windows server on 192.168.255.8 could always PING the ...

libove

Thanks again Lui. Yes, I've always been able to connect across the two subnets; effectively, I'd already done the test that you suggest. And, yes, the configuration script that you provided matches the configuration of the two devices, with one minor difference: The MikroTik's IP addressing is attac...

libove

Hi Lui, I apologise, I was sure that I'd mentioned - there already is a static route on the VG-8050 pointing 192.168.255.64/26 -> 192.168.255.3 (the MikroTik). You mention needing a forwarding rule and a masquerade rule. Why would a forwarding (firewall, right?) rule be necessary? The MikroTik is a ...

libove

I'm probably doing something stupid. Or, Movistar has done something stupid (again) with their (weird, custom) router firmware. I'm hoping someone can tell me which, and what :-) I have Movistar (Spain)'s fibre based Internet service "Fusión", with a VG-8050 Internet router. Behind that I ...

libove

In my configuration, I have a VLAN set up: /int vlan add vlan-id=254 name=VLAN254 interface=ether8 ... and an IP on the VLAN: /ip addr add address=192.168.16.2/24 interface=VLAN254 ... This one MikroTik itself can ping its own IP address there, but another MikroTik across a trunked connection canno...

libove

It seems... in my case... the issue is that if I assign an IP address to the Ethernet interface (e.g. eth1) it does not properly propagate out on the PVID of the network. Where-as if I assign the IP to the VLAN ID of the network then it works. In my configuration, I have a VLAN set up: /int vlan ad...

libove

I've posted more details in a similar thread here: http://forum.mikrotik.com/viewtopic.php ... 14#p351000
.. if anyone wants to look it over...

Thanks,
-Jay

libove

What does the routing table look like on the RB1200? Have you only tried pinging from the command line? Any difference if you use the tool in Winbox and explicitly state the interface? The network in question here is 192.168.16.0/24, which should be on VLAN254, which is physically connected on ethe...

libove

Hi. I have tested this scenario and it works. PC-------switch (HP)---------Mikrotik (RB435G) PC is connected to a switch through an untagged port. Switch is connected to Mikrotik via a trunk port. Mikrotik is connected to swith through a tagged port. PC is in vlan 2. Switch trunk port is tagged on ...

libove

On an RB1200 (RouterOS 5.21): /int vlan add name=VLAN101 vlan-id=101 arp=enabled disabled=no interface=ether8 use-service-tag=no /ip address add address=192.168.17.1/24 interface=VLAN101 disabled=no There is an Ethernet cable plugged into ether8 which goes to a trunk port on a Dell PowerConnect 2848...

libove

For example: Following these instructions: add name=VLAN2 vlan-id=2 interface=ether1 disabled=no add address=10.10.10.3/24 interface=VLAN2 The device will pass traffic through the VLAN and to the appropriate ports... however, it will not respond to pings to that IP address from another device on th...

libove

No usb wireless modules do not work well. Honestly if you are wanting to do QoS on a 100mb link the 751G is not going to be enough. I would recommend a 1200 or 1100AH. You could also use a RB800 with multiple wireless cards.

Thanks very much. Okay, back to the drawing board a bit...

libove

A wireless interface can only be an AP or client. So you can't have one interface acting as both but if you used a 493G you could put multiple interfaces on the board. You can also setup virtual APs for your different networks without having to attach multiple APs. Hi cbrown, Thanks for the clarifi...

libove

Hello libove,

and this should all running smooth and liquid with a cool throughput on a device
that is sold as a wireless access point and 100 MBit/s FTTH Internet on top? :shock:

Hi Dobby,
I don't understand. Are you saying that I am expecting too much from the RB751 series?

Thanks,

libove

I am thinking of buying a RB751G-2HnD (or similar) to use for the following: At my home, I have a 100Mb/10Mb fibre Internet connection. It's usually great. And sometimes it sucks (technical failures in the infrastructure outside the house). I have wireless access to a fallback connection (Wi-Fi, not...

libove

Bump. Can anyone confirm (now at RouterOS 5.22) that the setup proposed by jvr is "correct"? That is, that not only does it seem to work for jvr, but that it isn't conflicting in some way with the standards and likely to break, either if the "wrong" kind of other network gear is ...

libove

I am becoming quite disillusioned with MikroTik. I have the same problem which others have posted (and on NONE of which threads I see a real resolution) where VRRP on-master/ on-backup scripts don't work correctly, where preemption-mode=no doesn't work correctly, etc. I need a consultant who special...

libove

The same problem has just happened again. Once again, it was solved (temporarily) by flushing the cache. I've now also reduced the cache-max-ttl from the 1w which it had been set at (by default, I guess) to 2d, in hopes that it helps. I'm not confident of that. This really does look like a bug: When...

libove

We have a VRRP pair of RouterBOARD 1200, IP addresses 192.168.1.2 and 192.168.1.3, VRRP address 192.168.1.1. Both are running ROS 5.21. These are our gateway devices to the Internet, in a typical "We're an internal LAN, the MikroTiks let us out to the Internet" medium-sized office configur...

libove

I have performed the initial setup here. I chose to go with one VRRP failover (just the internal LAN), with on-master and on-backup scripts. BUT this is clearly insufficient: When a VRRP failover occurs, the MikroTik which knows it has become Master will enable its IP addresses for our Internet link...

libove

Thanks very much!

libove

Thank you tws101. Some follow-up questions- When a MikroTik DHCP server detects that an IP address is in use, how long will it remember that detection and not try to re-check the IP address? That is, how long will that MikroTik DHCP server keep that address out of possible use? When a DHCP client &q...

libove

I am going to add a second MikroTik RB1200 to my existing RB1200. Call them RB#1 (in production) and RB#2 (soon to be added). My configuration is fairly straightforward - an internal LAN, to which both RB1200s are connected on their respective Ether5 ports - an Internet connection, to which both RB1...

libove

This was discussed 8 years ago. Wow :-) http://forum.mikrotik.com/viewtopic.php?f=2&t=394 The content of that older thread I think remains fully valid. My question just goes a little further than the earlier discussion did: If I set up the same DHCP scope on two co-operating RB1200s in a VRRP co...

libove

Thanks everyone. Given the amount of time this was taking, and that we didn't have a strong reason to keep the two separate subnets on the one same physical medium, we solved the issue by dodging it entirely - We changed from 192.168.1.0/24 and 192.168.4.0/24 to 192.168.0.0/21 .... :-/ So I guess th...

libove

Hi jandafields, Thanks for testing and updating the thread. Could I ask you to go one step farther and run a packet capture on one of the machines to check whether they are receiving and honouring the ICMP Redirect which the MikroTik router is surely sending (honouring meaning that thereafter they c...

libove

Thank you Feklar. I tested with the Windows firewall completely turned off. It makes no difference. I confirm that, as stated before, the MikroTik is the default route. I also confirm that there are no more specific routes pointing a different way. And even if there were, my packet capture (on all i...

libove

This has been discussed before. I've read everything I can find, here in the MikroTik forums and elsewhere on the Internet. I'm still not getting it to work.... RouterBOARD 1200, firmware 2.33, RouterOS 5.5 (yes, I know, it's old; I will update it, but this is in production and I'm quite conservativ...

libove

Please upgrade to latest version. If still pool addresses are not released then contact support.

So, you're saying that this is a known issue, which has been fixed (in what specific version update release)?
Thanks,
-Jay

libove

RouterOS 5.5 (yes, I know, it's out of date). I've set up an OpenVPN server: >/ppp profile print detail ... 1 name="OpenVPN profile1 Jaytest" local-address=ovpn_pool_win01 remote-address=ovpn_pool_win01 use-mpls=default use-compression=default use-vj-compression=default use-encryption=requ...

Search found 65 matches