MikroTik

gargola

This solved my issue, thanks a lot pe1chl. The weird thing with this is that, CCR1009 v6.48 was perfectly working, then we had a power outage where our batteries drained out, after restoring the power we started having problems with MTU and PPPOE interfaces. In this scenario there was no upgrade, no...

gargola

Hi eset, djdrastic. I'm using policy based: Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active, * - default 0 T * group=default src-address=0.0.0.0/0 dst-address=0.0.0.0/0 protocol=all proposal=default template=yes 1 A peer=peer2 tunnel=yes src-address=169.254.0.5/32 src-port=an...

gargola

Hi @MasteRTriX Did you find any solution? I have an RB750UPr2 that Netinstall says it worked and reboot the router, but after rebooting it, it gets again in the rebooting loop, within netinstall it can stay on for hours, so no problem there. I have tried with 6.45.6 6.45.8 and 6.4 (i think that was ...

gargola

Good knews short story. At least for me it is fixed with the 6.45.6 in the RB3011UiAS. Long story I was having 3 RB3011UiAS with the port flapping issues, then I upgraded them to the 6.45.6 and it was fixed. That was several months ago, then I had to replace on of the 3 RB3011UiAS in one site and I ...

gargola

Thanks a lot Katem. It helped me out to do my script, the truth is that I don't know what I''m doing, but this is how I made it work. #Start Monitoring of All Ethernet Ports #Edit The X to the desired Ethernet port Name /interface ethernet monitor etherX once do={ :if ($"rate" != "1Gb...

gargola

RB3011UiAS v6.45.8 all ports in switch 2 flapping constantly, all connections are at 1Gb Mikrotik's response on this looks like a joke.

gargola

@edo89b I'm neither a BGP expert, but there are several ways to indicate to BGP which path to take, like costs in OSPF, in BGP some of them are: Weight Local Preference Network or Aggregate Shortest AS_PATH Lowest origin type Lowest multi-exit discriminator (MED) Take a look at them and which one is...

gargola

@eset yes, sometimes and randomly the ipsec tunnel is connected but no traffic passing through, so the bgp goes down. I have to reset everything manually and it comes back, I got almost fixed it setting the timers a google request them on their manual, but still having some random issues. The easies...

gargola

Try adding these exceptions to your NAT: /ip firewall nat add action=accept chain=srcnat comment="IPSEC NAT Exception" dst-address=169.254.0.6 src-address=169.254.0.5 add action=accept chain=srcnat comment="IPSEC NAT Exception" dst-address=10.0.X.X/29 @gargola i tried your config...

gargola

Hi Pete Here is the configuration on the router: /interface bridge add name="BGP GCP VPN" protocol-mode=none /ip address add address=169.254.0.1/30 comment="BGP GCP" interface="BGP GCP VPN" network=169.254.0.0 /ip ipsec profile add dh-group=modp1024 enc-algorithm=aes-12...

gargola

Hi all.

Just give me the opportunity to have some time from my job and i'll publish the configuration.

gargola

Hi Eset.

Sorry for the late response, I didn't received a notification email. I'm using the VPN service from GCP. What config do you need? router side or GCP platform?

gargola

Finally made it. To be able to route to the VPN I created a bridge to use it as the interface that has the ip for the BGP session and it turned in to my gateway to the cloud. If you're going to use static routes or policy based VPN is enough with the IPSEC Policies. Any doubt feel free to contact me.

gargola

Well, some sleep hours helped, I could figured it out after search a little, I had to add the NAT exception from the src/dst networks. Now I'm able to ping both ways. So the IPSEC tunnel is working. But at this time is configured with static segments (only 10.0.5.0/29 to 10.168.0.02/0) I have to mak...

gargola

Hi sri2007. Thank you for your response, here is the configuration: /ip ipsec proposal set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=aes-128-cbc,3des lifetime=30m name=default pfs-group=modp1024 /ip ipsec peer add address=XX.XX.17.122/32 auth-method=pre-shared-key dh-group...

gargola

Hi guys. I'm trying to establish a vpn to GCP network but I have a doubt still can't resolve. I can establish the ipsec tunnel, but I don't have any interface o idea to where to configure the ip to create the bgp sessión. Is the same if I configure the VPN on GCP for static routing, the ipsec works,...

gargola

Hi @eset.

I know there's a lot of time since this post, but meaybe you can read it or another member can help.

Were you able to find how to add routing? I'm with the same doubt than you, I can establish de ipsec tunnel, but I need an interface to add the ip and create the BGP.

Best regards.

gargola

I'm not familiar with the BGP process in Mikrotik, but you can degrade for example you transit B adding repeatedly your AS in the AS-PATH via prepend. Take a look at that.

Sent from my Nexus 6P using Tapatalk

gargola

Is your script testing to your gateway? Or to what ip are you sending the icmp?

Sent from my Nexus 6P using Tapatalk

gargola

"Lesson lerned ...." There are three branches: bugfix, current and RC (read it as beta/alpha/test version) It should be obvious that production system should not go further than "current" despite the name of device manufacturer. I was having issues with the DHCP offered lease wi...

gargola

The trouble is, MikroTik's naming is not exactly what many people expect. Personally I'd call their "RC" beta if I'd like to be nice, or alpha if I want to be safe. Yeap, I'll prefer to name them like that. RB1100aHX2 BRICKED, man, this is a RC, not an alpha, can't even think how this hap...

gargola

RB1100aHX2 BRICKED, man, this is a RC, not an alpha, can't even think how this happend. Trying to downgrade to earlier version, unfortunately at this time i'm 250 miles away from the RB, so only can connect through layer2 (MAC) and i'm lossing the connection every X seconds and I can't upload de 11M...

gargola

I was having the same issue with the "offering lease without success" for some customers. It was happening with a RB1100AHx2, after several reboots and tshoot, they were remaining around 7 customers that couldn't get ip, all of them with routers TP-Link WR720N. I Tested versions 6.38.1 and...

gargola

No, CPU is perfect 0 to 3%, WAN is working like a charm. Is like if a have a filter rule blocking that network.
Can you help me via teamviewer?

I cleared DNS cache, rebooted all CPEs, tried everything.

gargola

Thank for your reply. Yes, ether1 is active, and torch show some activity. some clients can navigate, if a restart the router other clients navgite is something randome. This happened from one minute to another. Allready restarted the router, reset to default configuration and restore yesterday back...

gargola

Hi, From nothing something is blocking my lan network, we didn't move anything and can't connect to my customers routers. I added a firewall filter rule to free everything and didn't work. Can somebody helpme remotelly please. I can connect to everything without any problem, RB, CPEs, VPN, Switches,...

gargola

You were right. Days looking for the solution and the problem was in my cablemodem provider

Sometimes we just need another point of view.
I'm waiting my provider to give me another modem and do some tests.

Regards!

EDIT: After the change of the cablemodem , everything is working like a charm!

gargola

Hello colleagues. I searched for that, but they are only topics related to wireless. This is my network: RB750GL (Load Balance) --> RB1100AHx2 (Core router) ---> then, wireless to the clients. I'm connected directly to the RB1100, tested various cables, and nothing, still have "ping timeout&quo...

gargola

So, with my HTTPS web server, I'll be able to redirect the HTTPS requests to the proxy and show the alert? I'm already working on a laboratory, lets see what happens. I can't get it work :( /ip firewall nat add action=redirect chain=dstnat comment=\ "Payment" dst-port=80 protocol=tcp \ src...

gargola

So if I'm not wrong.
HTTP -> One NAT rule, One webproxy, One web server.
HTTPS -> One NAT rule, One webproxy, One web server with HTTPS certificate?

gargola

Thank You, works perfect :D Could You know why my rule isn't working with https? I add to the rule the port 443, but, if some IP in the address list tries to navigate still can see https pages. /ip firewall nat add action=redirect chain=dstnat comment="Payment" dst-port=80,443 in-interface...

gargola

Hello colleagues: This is my situation, I'm redirecting users to the webproxy to show alerts about payment. /ip firewall nat add action=redirect chain=dstnat comment="Payment" dst-port=80 in-interface=ether5-LAN1 protocol=tcp src-address-list=alert to-ports=999 /ip proxy set enabled=yes po...

gargola

Your questions are all answered in the wiki. Give it a try, it doesn't bite

anyway, if you are trying to access from outside (WAN) then, IP is your public IP. User and password are the router board login info.

Enviado desde mi LG-D805 mediante Tapatalk

gargola

Only in the data storage is where 1M = 1024K

Enviado desde mi LG-D805 mediante Tapatalk

gargola

The problem here is that every network is a totally different world. The mikrotik performance depends on how many rules do you have. Every rule you add to firewall, mangle, queue, nat, etc. Will be reflected on you router CPU. If you search in the mikrotik page, on each router can tell you the perfo...

gargola

Normally the mobile companies share their public IP addresses with other users, so you are behind a NAT. You can't connect because you need to do a port forwarding. But you don't have access to the routers company..

Sent from my GT-I9300 using Tapatalk 4

gargola

Yea thanks I already made it. I had to put a Webhope on dyndns with the port

Sent from my GT-I9300 using Tapatalk 4

gargola

You need to set master port to none on each interface for they can act as independent interface! Then if you don't want that the ports could communicate you need to delete the routes!

This is what I understood that you want to do.

Sent from my GT-I9300 using Tapatalk 2

gargola

Your scenario is possible just like you describe it!

Sent from my GT-I9300 using Tapatalk 2

gargola

This script works perfect on 6.2 version, no problem updating dyndns host

gargola

Thank you aldoir your script works perfect on 6.2

gargola

Hi guys. I'm trying to configure an RB750GL to get remote access to the webfig, but with a different port than 80 (for security reasons). If I put http://publicip:port I can access with out any problem, but if I try to access through http://domain.com:port it can't resolve it. I think is a NAT rule ...

Search found 42 matches