MikroTik

scotthammersley

What RouterOS version and hardware?

scotthammersley

Are you creating a Tunnel or are you using Transport for the IPSEC policy's? There is a difference in behaviour depending on which option you went with and how you configured the IPSEC policies. A little to much to explain here, but you can read up on the differences and it may shed some light for y...

scotthammersley

Not with a PPTP tunnel no, it will not forward L2 packets as it is not a L2 tunneling protocol. Now, I am not suggesting you do this but you could create an EoIP over PPTP, which then will allow PPPoE to traverse. All you are doing though is creating tunnels for the sake of tunnels. What is the purp...

scotthammersley

Why would you want to do that? Are you trying to route between the Vlans or specifically 'bridge' the two vlans together?

scotthammersley

Auto-Isolate is specifically for Spanning Tree, so this would not do you anything at all. You could write a mangle rule specifically targeting a dst address from a src address and route it in another routing table. Even including the specific port if needed, so that only traffic sourced from 192.168...

scotthammersley

If you only want to route VoIP packets a certain way you would need to use a separate routing table. Create mangle rules to identify and mark the VoIP packets, which in turn are then marked for another routing table. Then in the /ip routes table, create a new route for the VoIP packets and select th...

scotthammersley

- Sometimes the RB3011 reboots but I don't know why -> Any idea how to analyse this? Create a supout.rif on reboot, then forward to MikroTik for analysis - I've installed the DUDE on the same RB but it's not connecting to the ROS. Maybe the Firewall rules are blockin but to which interface do I need...

scotthammersley

As long as the ISP is routing a subnet to your device, you should be able to configure ether3 with that subnet. For example... Your Device (MikroTik) PPPoE WAN address is 1.1.1.2/32 and gateway configured for the ISP, the ISP is routing a subnet to you of 2.2.2.0/27 to 1.1.1.2. Ether 3 of your Mikro...

scotthammersley

PCQ looks at classifiers and the overall bucket size configured (in your case 100M). It will then share this bucket bandwidth between all the classifiers that it sees equally per stream. So, technically as long as you classify the identifiers correctly, your users should get an equal piece of the pi...

scotthammersley

Mangle rules and queues, using L7 Regex. But be careful, L7 rules will tax the CPU and could cause you resource issues down the line.

scotthammersley

If you know the MAC's of the devices tied to the user, you would have to write specific queue rules to limit each MAC/Device. There is no specific way to aggregate the users devices into one rule when you are using the hotspot configuration to apply a dynamic rule, that I know of. Maybe a script cou...

scotthammersley

You could mark the connections based on src and dst, then mark packets based on those connections. You would also need a general bucket rule set to catch all other traffic (or use the no-mark in the queue config). At that point, once they are marked, depending on how you want to handle those packets...

scotthammersley

Would need to see the full configuration of the mangle tree and queue configuration. I would suggest marking the connections first based on the applicable source and destination IP's/ports. Once you have the connections marked correctly in the list, you then mark the packets based on those connectio...

scotthammersley

Please post your current configuration of the RB450 and if possible the switch.

scotthammersley

This could possibly be solved by just routing over the PPTP connection to the far end resources. Say your PPTP subnet is 10.10.10.0/24, you would add this: /ip route add dst-address=10.10.10.0/24 gateway=10.0.2.32 (or could possibly use interface name if you create a binding for it). Depending on wh...

scotthammersley

Scripting would be your answer, so yes, in MikroTik it is possible.

scotthammersley

While you cant completely hide an SSID from someone that really wants to find it, you can write a wireless ACL to either only allow certain wireless clients to connect based on their MAC. Something like this: /interface wireless access-list add interface=wlan1 mac-address=00:00:00:00:00:01 vlan-mode...

scotthammersley

You could possibly use Wireless ACL's to control the attempted devices.

scotthammersley

chain=dstnat action=dst-nat to-addresses=213.128.9.224 to-ports=80 protocol=tcp dst-port=443 log=no log-prefix="" -----> this says anything recieved on any interface destined for TCP 443 will be forwarded to itself on port 80. Absolutely will not work. What is the IP of the device you are ...

scotthammersley

Yes, you need to alter/create your own login.html that basically takes the login parameters with a meta refresh to the hotspot. Basically something like this would need to be placed inside login.html (this is part of the hotspot file system withing routeros); <html> <head> <meta http-equiv="ref...

scotthammersley

If you have more than one RADIUS server defined in the configuration, LAC's will always try to authenticate to the first in the list. Only if the RADIUS request timesout will it attempt the next server. So, you need to make sure that the server you are querying is the one you need to test against. D...

scotthammersley

Do you mean userman instead of CAPSMAN? If you do indeed mean userman, you would be able to define the client LAC identifier responding to the authentication requests (that forwards it to your AAA Server). This would allow you to know which client was authenticating to which system. If not, you are ...

scotthammersley

I assume what your asking for is the PPTP configuration on your MT client? Have you got the VPN concentrator already configured and ready to accept the PPTP connection from the MT?

scotthammersley

Can you post the pertinent configuration for review? There are a number of possibilities that could be causing your issue.

Thanks,

scotthammersley

Do you have a need to take full BGP tables from your ISP's? If all you are looking to do is advertise your networks for upstream reliability, then you could take all three into one CCR 1009 without injected routes (only default) from them. Or you could write some inbound filters to split the tables ...

scotthammersley

EoIP MTU really should be set around 1530, generally because they frag and de-frag packets on each side. PPPoE would decrement the available packet size and normally we find that setting the PPPoE MTU to around 1460 is good.

scotthammersley

Use RSTP within a bridge interface.

scotthammersley

VPLS is normally used as an MPLS VPN. Unless you use the BGP VPLS function. It is possible to use and configure both ends that use dynamic IP's, just requires more in depth configuration and extra tunneling.

scotthammersley

You could possibly create your own captive portal and redirect all users to it rather than letting the MT do the portal. This would give you more flexibility and control of how users are redirected and authenticated.

scotthammersley

A lot depends on the input voltage being supplied to the 260. Are you using a PoE injector? Or is it powered by a PoE switch etc?

scotthammersley

Have you set these up with a Bridge interface?

scotthammersley

Can you post your settings?

scotthammersley

Do you have a bridge configured for the PPP interfaces?

scotthammersley

In the dst-address of the firewall rule.

scotthammersley

Understood, would be nice to post to the MikroTik Wiki also though and help to contribute. Just a thought.

scotthammersley

I know MikroTik is continually adding more multithread processes with each release. PPPoE may just be one of those that have not made it yet. But I could be wrong.

scotthammersley

Quickset is fine if you are looking to get a basic config onto the box without extra fluff.

To the issue of loosing connectivity once you apply, have you tried connecting via MAC?

scotthammersley

That Wiki is relevant to stopping DDOS at the router itself. However he is looking to dynamically update his BGP black hole list.

Again though, both examples show how to identify traffic and place into an address list. You just need to script a way of adding them into your BGP lists.

scotthammersley

No problem, glad we could try to help.

scotthammersley

Jarda, Doesnt matter whether its a "Public IP" or not. That just defines whether the traffic can be possibly routed over the net. I can use a "public IP" and still keep it internal if we wish. So that statement is really null and void. What he is trying to do is basic NAT. To tha...

scotthammersley

Change the proxy rule to include both port 80 and 443. This will catch most https traffic.

scotthammersley

Use the packet capture tool, this will be like using Wireshark. You can save the capture and open with Wireshark too.

scotthammersley

Disable the firewall rules, then test again.

scotthammersley

Yes you can. Add the vlan interface to the phyiscal. If you have the same vlan id on two different ports, you can create a bridge to tie them together if needed.

scotthammersley

Someone may correct me, but, if your SNR is relative to around -65 to -70, you should have a clean signal. There are other factors to this, but generally speaking you dont want the link to hot either.

scotthammersley

Are you directly connected to the device when you use the QuickSet feature?

scotthammersley

Why not post this on the Wiki? People search the MikroTik Wiki also.

scotthammersley

No problem.

scotthammersley

Gotcha.

What RouterOS version are you using?

scotthammersley

Probably would need to use an 3rd party monitoring program like Solarwinds, WhatsUP etc, even maybe the dude.

scotthammersley

Good to hear you figured it out.

scotthammersley

Yes, I understand that, but you need a way of identifying the traffic first, which is the mangle rule I gave you. Once you identify the offender, then you can script to add to the BGP advertise filter list.

I just added the firewall rule in as an extra precaution.

scotthammersley

Would be nice to be able to use DNS names no matter where in the configuration.

scotthammersley

Add a static Mgmt IP to the 911 in the same subnet, this will allow you to manage it through the other devices.

scotthammersley

Why would you not write a mangle and firewall rule that limits (and adds to an address list) the connection count to any once source on your WAN interface that exceeds a give value? Something like this maybe: /ip firewall mangle add action=add-src-to-address-list address-list=High_Connections chain=...

scotthammersley

Are you setting the rate limit in the profile of the PPP connection?

scotthammersley

Glad to be able to help.

scotthammersley

Afraid not, have not encountered that specific issue yet. Doesn't mean I wont though

scotthammersley

If you are using OSPF to redistribute your loopbacks, I would definetly use the /32 loop IP's for the tunnels. Need to see your config regarding the TE tunnels though.

scotthammersley

Are you using all seperate wireless cards?

scotthammersley

Or use the Quick Set feature.

scotthammersley

One thing to try is to do a full system reset-configuration without defaults, then try that. It may be that its seeing the default pool and throwing the error.

scotthammersley

Can you post your config?

scotthammersley

I verified that that ups package is there on 6.10. You will need the "all-packages" download not the upgrade npk. If you don't have it, you may want to upgrade your router so you can download it from the website. Alternatively, you may want to talk to you vendor and see if they can provide...

scotthammersley

Yes, there is another to troubleshoot it. Create a VPN to the router and re-test. That will take the ISP out of the equation.

scotthammersley

Can you post your settings? Please, include a network diagram.

scotthammersley

Yes, you can use an html file on the router, or anywhere else for that matter, to have some text. That text gets updated upon some event. You will need to script the router to read that file periodically and then execute the command. This is basically how the DynDNS script works if you would like to...

scotthammersley

You will have to use PBR with some way of triggering it such as traffic monitor. This is something that we can help you with, if your interested.

scotthammersley

Can you post a network diagram? Can you accomplish your goals if you are using 1:1 NAT? That might make the configuration a little simpler.

scotthammersley

Can you ping for the client and back to the server and visa versa? What does a trace route show? Do you have proxy-arp enabled?

scotthammersley

There have been alot of changes in between those versions, can you post the settings you are trying to use currently?

scotthammersley

If you are trying to make it a transparent proxy for the users, you are going to have to use Policy Based Routing or turn on the router's proxy on and re-direct it to the squid. If you would like some help with this, we would be more than happy to help you. Please, give us a call at 1-855-MikroTik.

scotthammersley

Thank you!

scotthammersley

You can use SNMP to monitor the uptime.

scotthammersley

All of your traffic will naturally flow out your default gateway, which I assume is the 8.8.8.8 route? To use the 2nd WAN, you will have to identify the traffic to go out the 2nd WAN and direct it through that gateway. There are many ways to do this such as ECMP, PCC, PBR, ect. Using Mangle to mark ...

scotthammersley

That's correct; at the present time you can not run the Dude on the CCR series. It may be advantageous to use another RouterBoard, bridged to your WAN, to monitor your network.

scotthammersley

To block website by FQDN you really need to use either L7 Firewall rules or as I see you trying to do, use a web proxy.

Try reading this:http://wiki.mikrotik.com/wiki/Manual:IP/Proxy
Or this: http://wiki.mikrotik.com/wiki/How_To_Block_Facebook

scotthammersley

If you dont need/want encryption, IPSEC is not the right tunnel mechanism. You should use something like pptp or EoIP instead.

scotthammersley

Thats a loaded question. How do you want to configure it, and have you searched the Wiki's first?

scotthammersley

It can be used in conjunction with the hotspot function. It is configured in the server profile of the hotspot to use the proxy. You can set individual user accounts to use different profiles that allow certain access.

scotthammersley

Yep, i wasn't sure, but I did some google fooing and figured it out. Your right though, it is a feature that is really missing. ISP and IPTV deployers will look over RouterOS as a CPE purely for that reason. Shame, hopefully we can get MikroTik to implement soon.

scotthammersley

RouterOS supports multicast and IGMP. Looking to refresh my memory now whether snooping is there.

scotthammersley

Mark the packets after the connection, then mark routing.

scotthammersley

What software version are you running?

scotthammersley

Do you have any type of USB LTE modems or something along those lines installed on the CPE?

scotthammersley

You are marking the connections, however I would mark the packets that belong to those connections. Then on your routing mark rules use the packet marks instead of connection mark.

scotthammersley

Possibly write a script that telnets to the RDP port of that PC. That might possibly wake them up. Trick is writing the kickoff.

scotthammersley

Absolutely:

Take a look here: http://wiki.mikrotik.com/wiki/Manual:IP/Proxy

scotthammersley

This should work for you. /ip firewall address-list add address=192.168.100.1-192.168.100.50 list=Defined /ip firewall mangle add action=mark-routing src-address-list=Defined chain=prerouting dst-port=443 new-routing-mark=https protocol=tcp /ip firewall nat add chain=srcnat dst-port=443 protocol=tcp...

scotthammersley

It sounds like you have a hardware problem, but just to be sure have you tried replacing the cable, using a different Ethernet port, or changing your port settings to 10M Half duplex? If so, that router may just be bad.

scotthammersley

There were alot of changes, bugs, and fixes between those versions. If you want to use 6.13, you are going to have to re-validate the entire scenario from scratch.

scotthammersley

You can use Netwatch with VRRP to identify the failed conditions you are looking for.

scotthammersley

Dont quite understand what you are asking. What version did you updgrade from again?

scotthammersley

rborz, you are correct in stating that it should be controlled as close to the edge as possible. Although, without the SXT acting as the AC for the clients, it becomes a little more of a manual process im afraid. One place to start is to come up with a common schema for QoS at the edge. Maybe someth...

scotthammersley

You need to create a certificate template first.

Its a little more intuitive if you use winbox instead of CLI.

Go to system, certificates. Create new (press red + sign) , fill in the info. Add it, then select from the window and press the 'create certicate request'.

scotthammersley

Just realized from your image that you dont have a second default static configured, in any case, it would need to be in its own routing mark so that packets that get mangled through the firewall follow that route.

scotthammersley

Doesnt look like you have set your other static route to be in the routing mark you are mangling. Wont work until then because currently both static defaults have the same AD.

scotthammersley

If you open your file browser in Winbox, do you see a file created with the .pem extension?

scotthammersley

I dont believe you missed anything. I can not say I have had reliable import/export in any instance without having to go through and scrub out errors. I normally save the template that works and just create from it, rather than exporting then changing. If you have made changes to the running config,...

scotthammersley

Correct me if I am wrong, but the google analytics scriptlet is Java based, I am not sure RouterOS can support. Even if you allowed it through the walled garden I think you would still run into problems.

Someone please correct me if different.

scotthammersley

How is the UPS configured? Static IP, DHCP etc?

scotthammersley

As Barkas and I have suggested, I think your only option is to use a dummy set unfortunately.

scotthammersley

Post your NAT rules and I will take a look. Though without access to the remote config, it will be hard to decipher.

scotthammersley

Thats a good question, will need to research that now you asked.

scotthammersley

Good deal. Glad you figured it out.

scotthammersley

WhatsUp
Solarwinds
The Dude
Google.

scotthammersley

Are you looking at adding this to the bridge firewall? Secondly, I dont think you can add as a wild card unfortunetly.

scotthammersley

Try disabling the default firewall rules, they normally block all access to the input chain of the router on ether-1. If that works for you, build a comprehensive firewall filter set to suit your needs.

scotthammersley

So you are pushing 40Mbps each direction, but what is the size of the pipe you are traversing?

scotthammersley

I would be looking at the return src nats, make sure the RDP client and server are being returned with the same src address.

scotthammersley

There is a nifty little function in RouterOS called 'Netwatch'. This allows you to script on instances.

scotthammersley

If i understand your question correctly, are you looking for some sort of active/backup Usermanager setup?

scotthammersley

Yes using UserManager. You can configure UserMan to control wireless user access as you are wanting.

scotthammersley

Yes, that will work.

Because you are decrementing the frame size by 4bytes for each vlan tag, plus the extra for PPPoE.

I would actually suggest lowering it a little more, we have always found 1440~ works best.

scotthammersley

try this:

/ip firewall nat
add action=dst-nat chain=dstnat comment="GRE Forwarding" disabled=no protocol=gre dst-address="YourGatewayAddress" to-addresses="YourInternalAddress"

scotthammersley

You really need to add a rule that specifically allows your API server to talk to the MT, not the whole world.

Place this before the default configuration of the firewall.

/ip firewall filter
add chain=input action=accept in-interface=ether1-gateway src-address="YOUR_API_SERVER_IP"

scotthammersley

What hardware are we talking about? Frequency, licensed/unlicensed, etc...

scotthammersley

We (IPArchiTechs) are working on an extensive set of Wiki articles that we plan to post in due time, both on the MT Wiki and our website.

scotthammersley

Unfortunetly RouterOS implementation of OVPN does not support the exclusion of username/password. Some get around this by using a dummy set across their clients.

Sorry that its not what you want to hear.

scotthammersley

How did this work out for you, were you able to try it out?

scotthammersley

Are the default firewall rules still configured on the router?

scotthammersley

Great, no problem.

scotthammersley

=1 Yes, that feature would be very useful!

scotthammersley

It is probably one of a few different things. It could be the settings... you can post your settings to get another set of eyes on it. It could be hardware failure. Have you tested each of the ports to verify they can handle the traffic? Also, test it with lower speed setting like 10M half duplex. H...

scotthammersley

Do you have check gateway by ping set in your routes? That will keep you from having to switch the routes over manually. As far as blocking the others users, you can use the web proxy feature in conjunction with the firewall. Check out the manual on web proxy. You are going to permit the traffic for...

scotthammersley

Take a look at how they are doing it on this thread:
http://forum.mikrotik.com/viewtopic.php?f=7&t=80925

scotthammersley

Functionally there is no difference in the way you Network a CCR from a RB411. Other than different interfaces and horsepower, Im not sure how to point you in the right direction.

scotthammersley

Your welcome to your opinion. However, working with a large array of vendor hardware including MikroTik, bugs are apart of life. Yes, 6.x has introduced quite a lot of bugs that Mikrotik has had to address, but nothing compares the Cisco Nexus platform. Upgrade early and often is the mantra with tha...

scotthammersley

You can use the Hotspot setup function and it will create the IP Pools for you. Then set up UserManager, RADIUS, and configure the hotspot to auth to RADIUS.

scotthammersley

Why don't you just use two different SSIDs. Create a VAP of WLAN1 and separate the traffic that way?

scotthammersley

What do you mean by that?

scotthammersley

Yes, that is possible. You will want to check out the wiki on queues http://wiki.mikrotik.com/wiki/Manual:Queue. Simple Queues is probably where you want to start. There are also several videos on tiktube and youtube that show how to setup the queues.

scotthammersley

To "Trunk" them and the VLAN and the Ethernet ports to a bridge. That will allow them to pass through to the next device.

scotthammersley

The real question is, what are you more comfortable with? If DD-WRT is something you are comfortable with and it will handle your needs, then that is the right choice for you. I use Mikrotik at work and at home because it what I am the most comfortable with and I think it has the best feature set fo...

scotthammersley

Can you post your config?

scotthammersley

Paypal and Authorize.net are the only payment gateways that you can use with Usermanager. However, if you use another RADIUS platform you can use whichever payment gateways that they support.

scotthammersley

I'm not really sure what they experienced in that thread, but the Dude does work. There are bugs here and there, but overall it works pretty well. For the money, it works great. However, you said you wanted to see what sites your users are accessing...try traffic flow. There are some free Traffic Fl...

scotthammersley

Were you able to solve this problem or do you still need help with it?

scotthammersley

Moving the cable is really not as intimidating as it may seem. You are only gong to have a handful of references to the actual interface.

scotthammersley

Its true that bugs can be frustrating, but you said something that I want to comment on. I owe almost all of my routing and network knowledge to messing with these routers Having used a large array of vendor's products, I can promise you that bugs are just as common everywhere else. The fact of the ...

scotthammersley

Is the public IP address that you are trying to NAT on the router itself? So when I client goto that address, the address should reside on the router and it gets NAT to the private IP.

scotthammersley

Normis, we have had a few inquiries into whether MikroTik will develop any QSFP+ 40G SFP modules. Whether or not the unit can sustain the transfer, a growing number of DataCenters are looking to deploy as Top Of Rack solutions. However, many are going with newer BladeCenter chassis that they wish to...

scotthammersley

What is the device on the other side of the link?

scotthammersley

Does it work at 100M?

scotthammersley

It looks like there is a security mis-match. Can you post the settings from both devices?

scotthammersley

Here is how we solve that problem. First, you have to make exceptions for the valid DNS requests (both ways). Then you have to identify the rest of the DNS traffic and block all of it. If you are still having trouble with it, call us at 1-855-MikroTik and we can help you with that.

scotthammersley

With all wireless products that tx/rx on multiple bands at the same time, there must be at least two wireless cards. Each wireless cards needs to be configured separately. Even when you do see it in product xyz, there are multiple wireless cards.

scotthammersley

The reality is, that would help some, but make things more difficult for others. If you want a persistent interface, use the Bridge to create a "loopback." Point all of your settings to the Bridge Interface. Then all you will have to do is change the ports in the bridge.

scotthammersley

You can try a couple of things. First make sure that nothing is interrupting the connectivity of the hosts to the hotspot. Then try bypassing then hosts and see if they get online. If there are still not online at that point, you know its not the hotspot and that its some other type of networking is...

scotthammersley

You have to use a username and password with MikroTik OVPN solutions. You can use this Wiki page as a guide:

http://wiki.mikrotik.com/wiki/OpenVPN_C ... ep_by_Step

scotthammersley

Have you created a bridge with both the WLAN and Ethernet interfaces in the bridge? Can you post your settings?

scotthammersley

Several of the vendors have pre-built 5GHz solutions which are similar although a little more expensive.

scotthammersley

Are you using PhyDiskWrite.exe?

scotthammersley

How are you writing the file to the CF card?

scotthammersley

The binding for the subnet should look like this:

/ip hotspot ip-binding
add address=10.10.10.0/24 type=bypassed

Can you post what your's look like?

scotthammersley

In MikroTik, that setting is referred to as HT Guard Interval and its on the HT tab. If you are still having problems, post your wireless settings.

scotthammersley

Check your cookie settings in your broswer.

scotthammersley

Are you looking for a controlled environment that works with a Layer 2 network, MAC Auth and bandwidth control?

Then you are looking at a hotspot function coupled with UserManager. This will give you the DHCP control and RADIUS authentication that controls users as you are looking for.

scotthammersley

Probably need to do some BGP local preference on the outgoing advertisements. Also, ensure you are NAT'ing to the correct subnet to the correct peer so that return traffic is always destined back through that peer. Would need to see the mangle rules that are marking your traffic for the policy routi...

scotthammersley

Thats a good question. Obviously TCP proxies and load balancers do that to preserve source, but I am not sure whether that is possible in RouterOS. More I think about it, the answer is probably no.

scotthammersley

You need to mark the connection and packets before you mark routing. Something like this: add action=mark-packet chain=prerouting comment=inProxyRoute dst-address=192.168.0.0/24 in-interface=pppoe-out new-packet-mark=inProxyRoute add action=mark-routing chain=prerouting comment=inProxyRoute packet-m...

scotthammersley

Maybe, yes, depending on your configuration. You probably dont need to be NAT'ing on the LAN side of the Hotspot. The Hotspot will do that anyway.

scotthammersley

Are you wanting to do a many to many NAT using the Public space you were provided?

scotthammersley

Depends on which chain you use. I would also set the incoming interface and outgoing interface.

scotthammersley

Firstly, looks like a routing problem from first glance.

Secondly, PPTP is not a recommended encryption engine. The hash algorithms are easily hacked. I would suggest using something like IPSEC if you need "secure" communication.

scotthammersley

Good question, no idea. Not sure your question really suited for this forum.

scotthammersley

Are you asking for The Dude help? Or general network question?

scotthammersley

I would be looking at either the Cloud Core Router or Cloud Core Switch.

However though, L7 application firewalling is very CPU intensive. You might want to consider something like a Barracuda firewall etc, which is specifically designed for such control. Just a suggestion.

scotthammersley

Use the quickset option to connect to the wireless device and make sure you bridge the wireless network to LAN.

scotthammersley

What version of RouterOS are you using?

scotthammersley

Dst based routing can force all traffic destined to the p2p peer across the needed link. Make sure you are NAT'ing out that particular interface to ensure the traffic returns correctly.

scotthammersley

Without not knowing much more than you have described, possibly using OSPF and ECMP to the gateway.

scotthammersley

What version of RouterOS are you running? Was the unit configured with the QuickSet function?

scotthammersley

That's a very vague question with an even broader answer set.

There are a multitude of ways to load balance in RouterOS, one persons view isn't always the other persons poison either.

scotthammersley

You can WinBox to the MAC address if you loose connection. Also, good point to start using the "SAFE MODE" option, will save you having to factory reset because of an oopsie.

scotthammersley

Technically, because RouterOS does not validate the chipset of the SFP's, any SFP should work albeit some better than others.

Are you using a 4 pair Ethernet cable or 2 pair? Just thought Id ask, its always possible. 2 pair definetly wont work with a copper SFP.

scotthammersley

Well, if you need this done relatively soon, your best option is to contact a reseller or vendor that can do as you need. I do not know the pricing of what it would cost, but I dont think you are looking at thousands.

scotthammersley

You can try this: place this rule towards the top of the rule set: /ip firewall filter add chain=forward comment="accept and bypass established connections" protocol=tcp \ connection-state=established src-address-list=Processing action=jump jump-target=trust-established place this rule at ...

scotthammersley

Not sure you will find anything less expensive other than used of eBay maybe.

scotthammersley

Glad to hear you got it working.

scotthammersley

I would suggest using IPSEC to encrypt the tunnel endpoints. You could build that as a hard tunnel, but I would suggest then using the EoIP tunnel for physical route points.

scotthammersley

Two ways:

Log in through Winbox and open the interface. You can change the name pretty easily there.

2nd Way:

show interfaces to see the line number of the interface you wish to change, then...

/interface set "LINENUMBER" name="WHATEVER"

scotthammersley

Assume your server is 10.0.0.1, and your ISP Public IP is 64.64.64.100. The following rule would NAT the public to the private. /ip firewall nat add action=dst-nat chain=dstnat comment="Gaming Server In" disabled=no dst-address=64.64.64.100 to-addresses=10.0.0.1 add action=src-nat chain=sr...

scotthammersley

Did you try hard coding speed and duplex on the 750 interface?

scotthammersley

Short answer is yes.

A couple of route statements in your home router and the correct route statements in the two subnet endpoints.

scotthammersley

From first glance, it appears you are bridging both ether1 and Vlan100 together. I would say remove the bridge, and let the MT route the traffic as you probably intended it to. Whats probably happening is, if you have bridged them together, the Layer 3 boundary for the two subnets has no routing poi...

scotthammersley

Release will let the IP go without requesting a new address until the DHCP timers expire.

Renew will, well, renew the IP in one fail swoop.

I dont believe there is a specific timeout for DHCP client config in RouterOS. You are probably stuck with a script using scheduler.

scotthammersley

One way would be to add the route in the route table itself. Pointing to the PPTP interface, maybe something like:

/ip route add dst-address=192.168.30.0/24 gateway="PPTP INTERFACE or IP"

scotthammersley

Why use the PPtP endpoints at all? You will not benefit from building the EoIP ontop, and as you already mentioned, MTU is degraded also.

Are you looking for encryption with the EoIP tunnels?

scotthammersley

You could use mangle rules to identify the specific traffic to place into routing marks. Then use the routing table to forward out specific gateways.

scotthammersley

I would set the master to whichever interface you apply the Layer3 config too.

Or you could bridge the interfaces together to create one logical segment and remove the master-slave relationship.

scotthammersley

Are you trying to disable the port or enable it?

You say disable, which implies turn off? Is this correct?

If so, you need to set the following ("disabled"=>"no") to ("disabled"=>"yes").

scotthammersley

Are you implying all customers are connected to the same physical AP and that some get their allotted bandwidth and some dont?

If so, there may be other physical issues at the AP level. I would not assume the issue is with the CCR/config.

scotthammersley

Are the ports you are trying the LAG apart of a bridge span?

Why use arp-ip-target?

One general observation would be that LACP would break if apart of seperate Layer2 domain, so check for slave interfaces, bridges etc.

scotthammersley

Simplest way because you know the AP's need to talk to the controller only, is to block access from anything other than the AP's destined to that LAN. Such as: /ip firewall address add name=AP address=192.168.10.251 add name=AP address=192.168.10.252 add name=AP address=192.168.10.253 /ip firewall f...

scotthammersley

Im assuming this is for an x86 platform. If so, have you checked out Hot Lava? They had pretty decent priced expansion cards for x86 systems using RouterOS.

http://www.hotlavasystems.com/

scotthammersley

To allow only SSH and SSL on your WAN interface (must change the interface to your WAN): Also a good practice to use SAFE MODE when adding firewall rules. In winbox click the button at the top left side. For CLI, CTRL+X. **This will block everything except tcp/22 and tcp/443 destined for the router ...

scotthammersley

CRS has two 10G SFP+ ports, I dont think they are 1G compatible though. CRS226-24G-2S+IN. Other than that I am not aware of another product. At least that has been released.

scotthammersley

If memory serves, you can only Netinstall when connected physically to port 8, I believe. It may be port 10. Either way, did you try using one of the two mentioned ports when Netinstalling?

scotthammersley

Can you post your existing rule set please.

Search found 230 matches