MikroTik

ShayanFiroozi

Hi guys Is there any way to ping an IP by Netwatch with a specific routing table or routing mark ?? if there isn't i think it would be very useful in many solutions for example : i configured 2 internet gateway in 1 router, but my fail-over technique just working when the interface is physically una...

ShayanFiroozi

Inorder to use ROS' DNS cache feature， All my devices are using ROS as their DNS server . And I am living in China, our DNS service has been poisoned. Inorder to visit some website such as facebook, I need to force ROS to request DNS service through a VPN gateway. I've tried several ways,but it doe...

ShayanFiroozi

Maybe it's about your Internet , are you sure your internet speed is good enough and stable ??

ShayanFiroozi

Dear shayan,
I want to do the same config but i need more details from you.
Note that I had used web-proxy but it was not work!
Thanks for your help.

Search the internet for yahoo and facebook IP's then we can easily drop other packets !

ShayanFiroozi

Hello, I have problem becouse I don't know how to configure two mikrotik routers. I attachment JPG with my problem. I have configured VPN and I think it is working but I don't know how to configure routers. User doesn't see CCTV. Could anybody help me? Hi, send you both router configuration did you...

ShayanFiroozi

Hello, i want to block all url and traffic internet in mikrotik but leave yahoo and facebook you can enable web-proxy feature or use IP firewall. With IP firewall you should find all facebook and yahoo IP's and allow them on your router and then deny all traffic from the internet , using url (Layer...

ShayanFiroozi

thank you for your replay my setup firewall for block Facebook and YouTube from PC and laptop - from L7 create Regexp ^.+(facebook.com).*$ - create Filter Rule chain: forward Src.Address=192.168.1.2/24 layer 7 protocol= facebbok Action=Drop i need some one did block Facebook app from mobile If App ...

ShayanFiroozi

ok i will do it but if i need set new configuration u can tell me correct option ? or link can i learn from here ?

need to know what you gonna do ?
draw your network diagram visually with some software like visio and post it here

ShayanFiroozi

run export hide-sensitive in terminal

ShayanFiroozi

Newby here, Tried to update my hEX. Now unit will not give router address connected via Ethernet. Tried to use reset pin, held for 7sec. Will no longer beep during power up. Ip on computer shows 169.254.214.215 / 255.255.0.0 May have deleted boot backup in router folder. Is there hard reboot, or di...

ShayanFiroozi

Same problem. Once it goes one way... The whole thing could half-work if you had provider independent addresses with two uplinks and it wouldn't matter which one is used. Then you could send outgoing traffic any way you'd want. But only outgoing, you still wouldn't be able to influence incoming tra...

ShayanFiroozi

I guess routing extension will not work. Ok I found 'connection-byte' marking method. but how it will going to work in following? I want to route files above then 100MB to second wan link , will this work? how it will work, it will route to second wan link after initial 100mb transfer or will it se...

ShayanFiroozi

and this proxy enabled: yes src-address: 192.168.1.1 Your ADSL ip is 192.168.1.1 and then you've set your web proxy src-address to 192.168.1.1 !! disable your entire web proxy and check if your ADSL modem is reachable also let web-proxy src-address to be blank , router will use the best in its rout...

ShayanFiroozi

Hi,
so tell us how did you do that on your PC and laptop ?

ShayanFiroozi

Is there any way I can route few extension like exe or mp3 files to second WAN link ?
will this routing work?

Hi,
the only way is to catch extension with L7 firewalling , Mark connections , Mark routing and then route them via specific interface

ShayanFiroozi

and this proxy enabled: yes src-address: 192.168.1.1 Your ADSL ip is 192.168.1.1 and then you've set your web proxy src-address to 192.168.1.1 !! disable your entire web proxy and check if your ADSL modem is reachable also let web-proxy src-address to be blank , router will use the best in its rout...

ShayanFiroozi

it's better to send your router configuration here , specially firewall and proxy settings

ShayanFiroozi

I would try to help.... but I just don't understand the question. You want someone from the INTERNET or WAN to be able to reach the server when they use the FQDN (Like http://something.somethingelse.com. But not if they use the IP address of 65.54.254.3 which is the FQDNs actual IP? Yes , that's hi...

ShayanFiroozi

As Sob said 2 devices in bridged mode should be in same IP range , in your situation your Macbook should have 192.168.1.x/24 (255.255.255.0) and your mikrotik connected to ether2 , because IP has been set on your ether2

ShayanFiroozi

Hi,

when you remove router default configuration its default IP address will be removed
so you have to add your own IP address(based on your network configuration) in IP/Addresses

for example : 192.168.1.1/24 or etc..

ShayanFiroozi

My server already has a username and password but it's not my question My question is how to restrict access to my server via my public IP but only through my domain name that's i don't know , Since it's about DNS and public IP and they are the same now ! i don't think Mikrotik could help you , but...

ShayanFiroozi

Hi community , I have no idea why it's so laggy when I'm using PPTP at home. I need to work at home using PPTP connect to the network of my company. While I'm operating ERP system or using Xshell SSH connect to ERP server , I'm feeling so laggy and painful . I'm seeking help here , please give me a...

ShayanFiroozi

Is it possible to have Simple Queues limit/control the traffic generated by the router itself? I've recreated a simple config in CHR /queue simple add dst=ether3 name=queue1 target="" /ip settings set allow-fast-path=no /ip address add address=10.1.0.1/24 interface=ether1 network=10.1.0.0...

ShayanFiroozi

Hi, I am just wondering is it possible to use the ACL feature in swos to change the vlan-id by mac address? Example: Port1: vlan 10,20 Port2: default 20 for all, but certain mac address I would like it to be part of vlan 10. Is this configuration possible? And how can I configure it? Thanks! Hi, it...

ShayanFiroozi

So if you wanna make your Server public , it's public !
you have destination NAT to your Server.
it is reachable from internet because you want this.

if you limit your source IP addresses its publicity has no meaning
it's better to secure your Server with strong username and password

ShayanFiroozi

try winbox how ?
i need login to my router adsl not mikrotik

It seems you have enabled web cache server , so exclude your ADSL modem's IP address from cache in mikrotik

ShayanFiroozi

Send your NAT configuration here

ShayanFiroozi

Hi,
Drop packets which NOT coming from your LAN subnet and going to Synology device , use IP/Firewall/Filter Rules
Or it's better to set this rule when you are NATTING your packets to Synology

ShayanFiroozi

Try Winbox

ShayanFiroozi

I have a similar question, but in my case i need that both networks have independent gateways. Routers are not really my thing and this is the first time using a Mikrotik hardware. Something like: Network 1 - Gateway ETH1 (Has its own valid IP) - Port ETH2 (Connected to a switch) Network 2 - Gatewa...

ShayanFiroozi

I have a similar question, but in my case i need that both networks have independent gateways. Routers are not really my thing and this is the first time using a Mikrotik hardware. Something like: Network 1 - Gateway ETH1 (Has its own valid IP) - Port ETH2 (Connected to a switch) Network 2 - Gatewa...

ShayanFiroozi

If you can ping last router so you can use ip/ip tunnel,if not you should setup up router's routing tables in order to get ping

ShayanFiroozi

in what situation ?

ShayanFiroozi

Would you please export your conf ?? specially firewall , IP , Route settings

ShayanFiroozi

Assume your hotspot gateway is 192.168.88.1 you should allow your clients to communicate with their gateway with this 2 rules : add chain=forward dst-address=192.168.88.1 src-address=192.168.88.0/24 add chain=forward dst-address=192.168.88.0/24 src-address=192.168.88.1 then drop every packets in sa...

ShayanFiroozi

Good Luck

ShayanFiroozi

Hi, Sorry your question in not clear , but it seems what you need is Access-list you can easily add your clients MAC address in Access-list and also disable (uncheck) "Default Authenticate" feature on your AP after that AP just allow clients who their MAC addresses added by you in AP's Ac...

ShayanFiroozi

Hi, why don't you use IP's ?? in Bridge/Setting/enable Use IP Firewall then in IP/Firewall add a simple rule which drop packets from same subnet which client are in ! for example drop forwarding packet from 192.168.200.0/24 to 192.168.200.0/24 i thanks Shayan very much so i have to delete my filter...

ShayanFiroozi

@hi4ibb use settings recommended by kiaunel

ShayanFiroozi

Hi,
why don't you use IP's ??

in Bridge/Setting/enable Use IP Firewall

then in IP/Firewall add a simple rule which drop packets from same subnet which client are in !

for example drop forwarding packet from 192.168.200.0/24 to 192.168.200.0/24

ShayanFiroozi

Hi, Sorry your question in not clear , but it seems what you need is Access-list you can easily add your clients MAC address in Access-list and also disable (uncheck) "Default Authenticate" feature on your AP after that AP just allow clients who their MAC addresses added by you in AP's Acc...

ShayanFiroozi

You should add some firewall rules ,
Besides you should not allow client to communicate with each other

ShayanFiroozi

[find where name~"3-"]

it will give you queue ID which you can use it for any operation , Mikrotik scripting is ID based not name based

ShayanFiroozi

Hi,
would you explain more please , what exactly the theft of Mac address is ?

ShayanFiroozi

Sorry i didn't understand you , would you please give an example ?

ShayanFiroozi

Hi,
it depends on your server , for HTTP sites you could catch them with L7 and file extension in firewall(.flv .mp4 .3gp and etc..) , but for HTTPS sites (like YouTube) it's better to use IP addresses.

ShayanFiroozi

Hi,

: put [[get 3 value-name=name]]

output is : your queue name , but :put command will print it on Terminal Window , i just used it for a working command !

ShayanFiroozi

Working on media extension is possible only when you trying to download media's from Youtube with some download software like Download Manager , but playing media's in Youtube won't use extension , it's all about media streaming in a flash player plugin it seems you have to find all IP's !!! at leas...

ShayanFiroozi

Change your NAT rules priority , make sure all NATs about Synology come first in you Firewall Nat list , you can easily drag them to top on Winbox.
you are masquerading your Synology interface , of course router will change real addresses with itself IP.

ShayanFiroozi

add action=dst-nat chain=dstnat dst-address=1.2.3.4 dst-port=80 protocol=tcp src-address-list=US to-addresses=192.168.168.24 to-ports=80

it should work unless you have other firewall rules or NAT rules , also make sure your web server is HTTP not HTTPS

ShayanFiroozi

Hi,
is 192.168.168.24 your web server ??

ShayanFiroozi

Hi,
Problem is your ports.
what is port 800 ? and why did you forward it to 443 ??
use port 80

ShayanFiroozi

Hi,
IP Tunnel for general purposes
IPSec for a secure tunnel
EOIP Tunnel for bridging your network and carrying Layer 2 traffic

ShayanFiroozi

Hi , it's not a strange thing ! you are disconnecting yourself from router and it's completely normal. when configuring a router you should always make sure that you have a stable connection to it , also when you wanna connect via Winbox click on your router MAC address in list not IP , this help yo...

ShayanFiroozi

Hello
The problem is the same
How do I export my configuration?

on Winbox go to NewTerminal and type this command : export hide-sensitive

and don't forget to secure(hide) your router sensitive information such as public IP's

ShayanFiroozi

It seems you have a bridge in your router ,so what is that ? in your routing table you have 192.168.1.0 reachable from bridge ! i still recommend you to post you router configuration with hide-sensitive , may be it's not about NAT at all because you are bridging some devices , also disabling your na...

ShayanFiroozi

Hi, Google and Youtube use https , it means end to end encryption , how did you catch them with L7? i suggest you to use IP's , besides if you are separating your in/out traffic from/to Google or Youtube with different IP it may be an security issue for those servers , can't say exactly , just a tho...

ShayanFiroozi

@jarda : i think it's MTU too but each site has its own internet(provider,gateway,NAT)
how it's possible some site would be unreachable just when bridging eoip with LAN ??

it seems sites reaching internet over EOIP due to the wrong configuration on default gateway or NAT , what do you think ?

ShayanFiroozi

below script find 1024 in all simple queues and change max-limit up/down speed as written below /queue simple set [find name~"1024 -*"] max-limit=256k/1M but i want to change only upload speed and download speed remain unchange /queue simple set [find name~"1024 -*"] max-limit=2...

ShayanFiroozi

i suggest you to printout you entire firewall settings

ShayanFiroozi

as i suggested : http://wiki.mikrotik.com/wiki/Hairpin_NAT

but he's using internet too , so a NAT should be added for internet access

ShayanFiroozi

disable this add action=masquerade chain=srcnat out-interface=all-ethernet
and check your Synology log , see what happens ?

ShayanFiroozi

use a small fan !!

i have a RB750GL working 8 month of year in over 40C temperature without any problem or packet dropping,

if you wanna use automatic fan which on/off with different temperature it could be costly

ShayanFiroozi

https://www.whatsapp.com/cidr.txt

ShayanFiroozi

Hi,
print out your NAT rules please ( on both sites)

ShayanFiroozi

At first I was given this line: add action = masquerade chain = srcnat out-interface = vlan832 orange-to-addresses = 0.0.0.0 But to-addresses = 0.0.0.0 does not pass what is orange-to-addresses = 0.0.0.0 ? we don't know how your Synology connected to your network , and which interface , but excludi...

ShayanFiroozi

it seems you need this : http://wiki.mikrotik.com/wiki/Hairpin_NAT

ShayanFiroozi

Hi,
it's about NAT , send your router configuration please

ShayanFiroozi

Hi, can't say exactly ! it completely depends on your network configuration. http://wiki.mikrotik.com/wiki/Manual:Packet_Flow input : packets coming to the router itself output : packets going out from the router itself forward : packets going through the router. prerouting : before the router route...

ShayanFiroozi

http://wiki.mikrotik.com/wiki/Manual:PCC

ShayanFiroozi

Remove this rule from second router, that's the unnecessary second NAT: /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway @drupol : your first router working as NAT router for you , packets route from router #2 to #1 because y...

ShayanFiroozi

*** pay attention here : your gateway of second router's users should be 192.168.1.1(actually your first router , then first router will route it to your modem ;) ) Sorry if I misunderstood you, but users in second 192.168.3.0/24 subnet can't have 192.168.1.1 as gateway (unless you play with proxy ...

ShayanFiroozi

NP ,it seams drupol is working hard and no result yet

ShayanFiroozi

Hi , 1-Unplug your second router !! 2-first you have to setup you first router , if your first router has internet ( you can test it by ping 8.8.8.8 from Tools/Ping) then setup DHCP on first router and be sure it's working,since your modem , first router and first router's hosts are in a same subne...

ShayanFiroozi

no , use another subnet it's not important but 2 IP's should be on same subnet , set 192.168.250.1 to first router port 2 and 192.168.250.2 to second router wan(or any port which connected to the first router)

ShayanFiroozi

Hi , 1-Unplug your second router !! 2-first you have to setup you first router , if your first router has internet ( you can test it by ping 8.8.8.8 from Tools/Ping) then setup DHCP on first router and be sure it's working,since your modem , first router and first router's hosts are in a same subnet...

ShayanFiroozi

your welcome , you can test it easily , in this scenario 8MB will be applied to your packets which means all users

ShayanFiroozi

This is how it's exported, it's all as you said except for the speed limit at 8M. /ip firewall mangle add action=mark-connection chain=forward dst-address=170.10.0.5 new-connection-mark=local-storage-conn add action=mark-connection chain=forward new-connection-mark=local-storage-conn src-address=17...

ShayanFiroozi

send your network diagram ? with router full configuration

ShayanFiroozi

Hi , try this format :

/interface wireless set wlan1 ssid=Mvk_networks frequency=2442 band=2.4ghz-b/g mode=ap-bridge disabled=no wireless-protocol=802.11

do not use new line between commands

ShayanFiroozi

After changing any NAT/Filter/Mangle/it's better to restart the router , actually set connection tracking off/on will work too

ShayanFiroozi

Hi,
please print out your configuration , maybe before your rule there is a rule which accepting packets

ShayanFiroozi

Hi,
your question is so general !! describe more please , but if you wanna limit your entire internet and give WhatsApp more bandwidth and higher priority it's easy on mikrotik but first you should find WhatsApp all IP addresses , google it and post them here please

ShayanFiroozi

Try this and let me know the result : add action=mark-connection chain=postrouting dst-address=170.10.0.5 new-connection-mark=local-storage-conn add action=mark-connection chain=prerouting new-connection-mark=local-storage-conn src-address=170.10.0.5 add action=mark-packet chain=forward connection-m...

ShayanFiroozi

OK , what's you gonna do ? what is your scenario ?

ShayanFiroozi

I was on Holliday ,sorry
Send your last configuration please

ShayanFiroozi

You can't use ip range on actions,just use single ip addres:192.168.79.1(i assuming 1) that's it,
You could use ip ranges in general or advanved tab when you are selecting your nat rule.
Use dst,src address to port forward just your pppoe subnet not every packets going through your router

ShayanFiroozi

I'm not familiar with L7 filtering and I don't recommend it , also https sites won't work with L7 , try use IP's instead of sites link

ShayanFiroozi

http://stackoverflow.com/questions/1044 ... amatically

ShayanFiroozi

Man C# va SQL kar kardam , az java etelaat nadaram , Hotspot vasat behtarin gozinast , ye kare dige ham mishe kard : MAC address har gooshio to IP/Firewall ya Bridge/Firewall doone doone add kon , baraye allow kardane packetashoon time moshakhas kon , too saathaye gheyre mojaz connect mishan traffic...

ShayanFiroozi

Hi, we use a RB2011UiAS-2HnD-IN. The first Eth-Port is the gateway. I´ve tried to setup two different networks (work and guests). Example: 1. Network: Ethernet Ports 2-7 IP Range: 192.168.5.0/24 2. Network: Ethernet Port 8-10 IP Range: 10.5.50.0/24 Both Networks should use Port 1 as Gateway. And th...

ShayanFiroozi

Hi,
Hotspot is a good option for you , but if you don't wanna login via a page , try VPN

ShayanFiroozi

Hi , Of course your destination web server has many IP's but it's not so difficult to find them , 99% they are in a single subnet , if not at least you client application using one or two of them with , so you can find IP's L7 is not reliable feature and it's completely dependent on HTTP headers and...

ShayanFiroozi

Hi ,
put this rule the last one on list , first allow your related connections then drop invalids , see what happens

ShayanFiroozi

both src and dst interfaces are on RB411 ? if not what device they are ??

ShayanFiroozi

Hi
http://www.speedguide.net/port.php?port=5200
http://www.speedguide.net/port.php?port=37083

there is not an explicit info, you can drop it with firewall and see what happens or what application or protocol stops working

ShayanFiroozi

Hi,

May be using Web proxy or some firewall rules , send more config please

ShayanFiroozi

I have tried all that i can try, but no success. The script that i used to create a user, inside the user manager is: /tool user-manager user add username=USERNAME password=PASSWORD last-name="SURNAME" first-name="NAME" customer=admin copy-from=test Now the user is able to login...

ShayanFiroozi

Hi ,
what about your IP's ?? you set them on bridge ? also test another bonding mode and set a link-monitoring then see what happens ?

ShayanFiroozi

Hi ,
for merge two line we usually use Load Balancing or Bonding , i think bonding is better for you , has simple setup , just search it in forum
and about "setup hotspot as bridge" what that means ? more details please

ShayanFiroozi

Hi , what is your network configuration ?
if you connected via VPN so just enter your router IP address(private IP) in winbox and connect to it , if not your router should have public ip address ,so type your public ip address in winbox and connect to it

ShayanFiroozi

Hi
Question is so general with not enough description but if I got it correctly you can use Load balancing and it won't be so easy,search about load balancing in mikrotik

ShayanFiroozi

Also if you can not separate your subnets , you can use Bridge firewall and force hosts to use a specific IP address , so if they change their IP address your router will drop their traffic , disadvantage of this method is that you have to set one-by-one MAC address with an IP address for each host ...

ShayanFiroozi

Hi ,
i don't recommend QuickSet , configure your router manually , go to IP/Addresses , IP/DNS and IP/Routes see what happens ! add some DNS server manually

ShayanFiroozi

Thank you, and I just forgot to mention about your first answer of this post,he's gonna control over hosts on a same subnet which are connected to the same interface,I think interface based rule doesn't work here , he should use IPs , am I right??

ShayanFiroozi

partial internet is going to require transparent proxy to get the desired effectiveness: enable the web proxy feature and configure the sites you want to allow and block the rest in that section (note that HTTPS sites cannot work with a transparent proxy - at least not the Mikrotik proxy feature) t...

ShayanFiroozi

Hi
Cant say exactly , but try high power POE , i had same problem and after searching 2 months i found out that enough amperage is not reaching properly to my device due to the long cable !!

ShayanFiroozi

Hi ,
i think installing ROS on a x86 with VMWare Workstation is a good idea , you can easily add routers , PCs
there are many videos on youtube about that

ShayanFiroozi

Hi,
i think it's better and more efficient to use load balancing between your WANs .
testing the bandwidth itself could leads to packet loss due to its fully usage of your bandwidth !! so you never get a real result

ShayanFiroozi

Hi,
send your network diagram or ROS configuration , it completely depends on how your network configured , routed ? bridged ? your firewall rules and .......

ShayanFiroozi

Hi ,
in winbox there are two way to connect to your device , with IP address and with MAC address , if you click on your device MAC address in winbox discovery list you can easily connect to it without setting your IP on the same range

ShayanFiroozi

Hi , try hardware reset

ShayanFiroozi

Hi , yes it's possible in Mikrotik , you can separate your traffic per application , per service , per host , per client , but you should know how they communicate with network , for example : their IP address and ports , or protocol they're using. Traffic marking in Mikrotik could be done by Firewa...

ShayanFiroozi

Don't use one by one single IP , firewall supports subnets and IP ranges : one Mangle with 192.168.20.0/24 matches all IP's from 192.168.20.1 to 192.168.20.254 Also you can use IP pool which is supported with both DHCP and Firewall , very useful and you'll never get confused about your addresses (na...

ShayanFiroozi

Hi ,
don't use one by one IP , IP/Firewall supports subnet and IP ranges.
instead of 192.168.10.1,192.168.10.2,192.168.10.3..............192.168.10.254 !!!
you can use 192.168.10.0/24

ShayanFiroozi

If you use Mangle GUI instead of command line you will find many options , you can customize your Mangle , In/Out interface , port , ip addresses could be useful for you , any network has its own architecture and situation , so i can not give you an explicit Mangle because i don't know how is your n...

ShayanFiroozi

Hi ,
i don't think so it could be done without Managed switch or router , your network is full bridged and not managed.
maybe DHCP client on windows has a feature could help you on this situation(just an idea)

ShayanFiroozi

Just go to / IP Firewall Mangle and put add keyword before your commands ( i forgot to write them

)

Also it's better to not use New Terminal ,go to IP/Firewall/Mangle and use the GUI , there are many option you can use and get familiar with them

ShayanFiroozi

HI,
more details or diagram about your network , it's routed or bridged ?

ShayanFiroozi

Hi
i think L7 in not a always working feature , a simple encryption cause nothing to match wit your query.
i suggest you to block IP addresses, but they could be hundreds !!

ShayanFiroozi

Hi , Yes it's possible , we call it QOS(quality of service) aka Queue in Mikrotik. usually done by 2 step : 1-Mark our connections and packets. (It will be done by IP/Firewall/Mangle) 2-set their priority higher than others(It will be done by Queue) Marking connection and packets : **** here we mark...

ShayanFiroozi

Hi, EoIP is a Mikrotik protocol , but it still uses GRE protocol for its communication , also EoIP changes the frames , adds some bytes ..... http://wiki.mikrotik.com/wiki/Manual:Interface/EoIP so it's possible your ISP firewall limiting GRE protocol(port 47) , big frames or anything else . it's bet...

ShayanFiroozi

Hi,

http://download2.mikrotik.com/2016-Q1.pdf

you can easily check hardware and compare them , but with 1 Gb/s NAT ! definitely CCRs

ShayanFiroozi

Hi, first you have to mark your traffic , for example you will mark every packets coming from 1.1.1.1 ,or coming from specific interface and many other options are available. you can mark your traffic(connections and packets) by IP/Firewall/Mangle. it's better to use IPs and ports , Viber , Whatsapp...

ShayanFiroozi

It's not so complicated , but i'm a wireless professional , it's something about routing , firewalling and NAT which i'm not expert on these subjects. but every firewall has its own behavior over packets and you don't know how it has been configured ,may be somewhere its dropping your packets , i'm ...

ShayanFiroozi

Are you sure that the Ap is mikrotik device? If not, you cannot use station bridge mode. Check your values correspond to what you have got from isp. Enable wireless debug logging and check what is recorded during connection process. Better to do the same logging on Ap side too. Reset the wireless s...

ShayanFiroozi

Hi, a network map please , how your clients connected to you , you have Mikrotik router ? more details but i think you can run a private L2TP server on your router , whenever your customer wanna play game , they can connect to your router via L2TP and even Layer 2 traffic will be passed ! like bridg...

ShayanFiroozi

Hi , yes you can assign more than one IP to an interface i didn't exactly understand you , but i think you wanna redirect your packets which targeting your public ip address to a private ip address behind your router , if i'm right we call it NAT here is an example of NAT port forwarding for remote ...

ShayanFiroozi

Hi , First of all i strongly suggest you to use routing network not bridging because : 1- More control over IPs and use a stateful firewall. 2- Limiting your broadcast domain and reduce useless traffics and many other reasons you can search about ! if you have to use bridging there is a firewall for...

ShayanFiroozi

Hi ,
you are changing ports ! so it's a one way communication , packets reach Router B , but unable to come back , i think we should have 2 NAT here , one in router A , one in B

ShayanFiroozi

Are you ready to pay for it ?;) take it easy man , check my signature :) anyway : in ROS when you are creating any user it belongs to a user group : full,read,write do you setting your group to full when you are creating user with php ?? maybe that's why you are unable to change its password later i...

ShayanFiroozi

i really don't understand what is going on with your provider , your device is ok and able to scan and list free frequencies , so the wireless card is ok , it's all about authentication failed , you can check your log and see the error , if your device or wireless card are dead how can you connect t...

ShayanFiroozi

Sometime AP is configured with an encryption like AES and other encrypting methods which you have to got a valid password which your AP owner will give you , otherwise authentication failed will occurred as this happening to you and sometimes AP doesn't use any encryption method , it's like an open ...

ShayanFiroozi

As i checked your router via teamviewer , there are 2 possibilities : 1- you have not a valid password. 2-your AP rejecting you because of access-list - your wlan1 MAC address should be exists on your AP access-list , and this task should be done by your provider , what a provider ....!!! anyway you...

ShayanFiroozi

** This information are just my personal experience , if it's wrong any correction appreciated As frequency goes higher your need more Line of Sight and antennas should be tune perfectly, in 24 Ghz you have very narrow frequency like a laser !! so tuning antenna could be more difficult , because the...

ShayanFiroozi

I think many questions like this has been answered several times in this forum and others , with a simple search you can find them and of course many documentations in PDF format are available for WISP. with all respects sir , you are going to do a complex scenario without any plan or map !! just th...

ShayanFiroozi

Send your wlan configuration and your device log , be cool and take it easy , all IT fields are complex and don't put yourself under pressure to solve them immediately !! get rest and sleep ,

As John Lennon said : Life is what happens to you when you are busy making other plans

ShayanFiroozi

it could be be a bug or incompatibility with your OS , contact support

ShayanFiroozi

Sorry, but I can't agree with ShayanFiroozi Any one chain model will be bad idea. Similiary with high power devices, so my advise is to forget about Netmetal. The same with WDS mesh, because of bandwith efficiency. 20km^2 it is not big area for ISP (~4,5 x 4,5km), but you have to explain what is ex...

ShayanFiroozi

Oh my god !! you need 300 or 500 MBps not Mbps ?!! your current link is perfect man , i don't think so there is a radio which carry 500 MBps !! it's too much,what you are gonna do wit such a crazy speed ? even a link could support that speed , what device are you using to use that amount of Data ?? ...

ShayanFiroozi

Hi,

try to uninstall/install MS VC++ runtime 2010 or 2013 , see what happens

ShayanFiroozi

Hi , a configuration like this should be done by a expert at the place , not remotely ! but if you wanna share internet over 20 km area is not very easy , of course not possible with a single or 2 devices. i recommend you to have several distribution sites , use sector antenna like mANT , and a powe...

ShayanFiroozi

try to check reflections How do you check reflections? :| Hi, I have not checked reflections... not idea who is it and how check it :? I´m a newbie... medium user Reflection occurs when your station receiving its AP signal from more than 1 line !!! when your Fresnel zone is not really clear you AP ...

ShayanFiroozi

mANT30 PA is perfectly match with Netmetal , so strange !! try lowering the power,a 30 dbi antenna is too much for a 2 km link specially when used with a high power radio like Netalmetal , here is what you done : -28 is so strong man ;) lower your power until you get -50 ... - 55 I just wonder if l...

ShayanFiroozi

Hi ,
Such an unstable ping could be a sign of network loop , send more details or network diagram

ShayanFiroozi

Hi, are you able to connect with Winbox ? if yes of course your device is not dead , what is you ap ?? send your SXT configuration here , it's better to giving a remote access to your pc ;) you should know that Mikrotik has its own wireless protocol like nv2 and nstreme which may be not supported by...

ShayanFiroozi

Hi, try to reorder your port forwarding rules before masquerade action with dragging them up or down in winbox list /ip firewall nat add action=dst-nat chain=dstnat in-interface=WAN1 protocol=tcp src-port=8000 to-addresses=10.20.0.5 to-ports=443 add action=dst-nat chain=dstnat in-interface=WAN1 prot...

ShayanFiroozi

mANT30 PA is perfectly match with Netmetal , so strange !!

try lowering the power,a 30 dbi antenna is too much for a 2 km link specially when used with a high power radio like Netalmetal , here is what you done : -28 is so strong man

lower your power until you get -50 ... - 55

ShayanFiroozi

Hi ,
i don't know it's possible or not , but i'm sure you can write a very simple software with C# then your user can use for changing password

if you are not familiar with programming i can help you

ShayanFiroozi

Hi,
I think it's about CPU and memory of your device , if Base-box is not satisfying your needs , just download Router board catalog
from www.routerboard.com and compare them together , RB800 is still a powerful platform for wireless(if you use a good mini pci)

ShayanFiroozi

What is your antenna ?

looks like your are using an antenna with wide beam-width , there are many interferences on your link

ShayanFiroozi

Hi , i have never used L7 because is not a strong and always working feature ! it works on packet data , and data could be anything , most applications and sites encrypt their traffic before send it to network so you can do nothing about that , L7 just works for simple situation , best solution for ...

ShayanFiroozi

It depends on many variables ! first of all -45 is too much , may be your AP interfering with itself , decrease your AP power to achieve -50 or -55 second if you need real tcp 300 Mbps , i don't think it would be possible with a single Netmetal , may you have to use 2 independent links and bonding e...

ShayanFiroozi

Hi,
500 Mbps is not so easy !!

But 50 Mbps is nothing for Netmetal , are you sure a firewall or queue is not limiting your traffic ?? if you are sure , check your LOS , reflection , humidity , tower height , ......

it's better to export your wlan configuration here

ShayanFiroozi

Hi,
it's no possible to find out your problem except you post your wlan1 configuration and also tell us what is your AP device ?

ShayanFiroozi

Hi,

please send your Metal configuration , what protocol are you using ??

and what are your clients radio ?? are they Mikrotik too ?

use 802.11 protocol , may your clients radio not supporting NV2 or nstreme

ShayanFiroozi

Hi , /interface bridge filter add action=drop chain=forward log=yes log-prefix=\ "***** User using gateway ip address" mac-protocol=ip src-address=\ 192.168.1.1/32 src-mac-address=!xx:xx:xx:xx:xx:xx/FF:FF:FF:FF:FF:FF xx:xx:xx:xx:xx:xx : is your gateway device MAC address this rule deny any...

ShayanFiroozi

you can allow your hotspot users to communicate with hotspot gateway in firewall , then deny any packet is going to communicates in your hotspot subnet , so users can not communicate with each other ** i'm not familiar with hotspot , of course there is a better way to do that , waiting for experts....

ShayanFiroozi

Just forgot to say you may be able to remove ROS from RB and install a light weight linux distro on your miktorik device and set it up to running as https server,
Just an idea but not sure

ShayanFiroozi

Hi ,
I personally didn't test that , so it's just an idea

/interface bridge filter
add action=drop chain=input comment="Disable DHCP Requests" disabled=no ip-protocol=udp mac-protocol=ip src-port=67-68

i don't know it would work with IPs , but should work well with MAC addresses

ShayanFiroozi

you can allow your hotspot users to communicate with hotspot gateway in firewall , then deny any packet is going to communicates in your hotspot subnet , so users can not communicate with each other ** i'm not familiar with hotspot , of course there is a better way to do that , waiting for experts....

ShayanFiroozi

Hi,in firewall you can deny what you want then allow everything else or allow what you want then deny everything else,it's all about rules order which can be done with dragging them up or down in winbox

ShayanFiroozi

Hi , Isolate from what?? If you wanna deny or restrict its communication yes firewall is a good choice or maybe u can block dhcp request from specific ip or mac address with bridge firewall

ShayanFiroozi

Hi,
I didn't exactly got what you gonna do,but I think you can use Eoip or L2tp tunnel,they carry L2 traffic

ShayanFiroozi

That was one of my idea to use IP Firewall, but i hoped there would be some other way to block it. In my case there is about 80 subnets, so it will be many rules in firewall. First idea was to block one by one: /ip firewall filter add chain=forward action=drop src-address=192.168.2.0/24 dst-address...

ShayanFiroozi

Hi They are seeing each other because this is ROUTER ! your device routing your traffic between your subnets , because your have assigned ip address for each interface and of course there are dynamic routes on your routing table, use IP firewall and you can easily deny any traffic you want , use for...

ShayanFiroozi

I think it's better to run an independent proxy sever then redirect your traffic to it

ShayanFiroozi

Hi,

HTTPS uses port 443

ShayanFiroozi

Hi http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge (R)STP algorithm assigned role of the port: Disabled port - not strictly part of STP, a network administrator can manually disable a port Root port – a forwarding port that is the best port from Nonroot-bridge to Rootbridge Alternative port – ...

ShayanFiroozi

Hi,

Has your SXT access to the internet ? did you set ip address and default route ?

ShayanFiroozi

Hi , there is many features in firewall , you can play with that features to find it and exclude your page

ShayanFiroozi

Hi,
it's better to set your configuration manually , quick set is not a good option

ShayanFiroozi

Hi ,
Since you are using OMNI antenna , this bandwidth rate is perfect , remember OMNI is 360 degrees , so never should compare with a 3 or 5 solid dish anetnna

ShayanFiroozi

I've just found my first bonding result. Sadly the tutorial no longer exist. I've used 4xSXT and 2xRB750GL. http://community.ubnt.com/t5/Business-T ... d-p/194143 Found it : http://wiki.specialistoff.net/index.php ... ti:Bonding It was a better choice for me than full duplex. the last link is in Ru...

ShayanFiroozi

Hi , it could be done with scripting , but it would be much easier with IP firewall , just drop any packet from specific users in specific date and time ! also there are a lot of features you may interested to use ;) you should know if your user changes his or her ip address it won't work anymore an...

ShayanFiroozi

Of course you can, just imagine your SXT's are wlan cards and set them accordingly. You also need one mikrotik router at each end for the settings. Hi Inox, Don't you have any problem with bonding in this scenario ?? i've never used bonding on real world , but in lab it always is unstable and unrel...

ShayanFiroozi

Hi again !

NV2 is fast protocol , but not much reliable as nstreme , it's all about TCP/UDP transmitting packets,

just a personal experience : when an nv2 radio is on heavy load many packets will be lost !!

ShayanFiroozi

Results are different in various environment , just test it , but in most cases nv2 works better for video/voice packets

ShayanFiroozi

Hi ,
Use dst-nat , which means destination NAT , just asking the router to NAT packets from your public IP address to an internal one which is your web server

ShayanFiroozi

Hi,

it's easy , first of all accept any traffic you need , then deny all traffics !!!

*** BE CAREFUL : filtering rules order is very important here , you could deny any access to the router , then you should reset its configuration

ShayanFiroozi

Hi , why scripts ??
do it with queue , more reliable , google it , there are many videos on youtube and tiktube

ShayanFiroozi

it's gonna be a complex configuration !!! could you send a diagram ? of course there is a tricky way

ShayanFiroozi

Go to ip/firewall and define your filter rules http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter there are many options for filtering your users , but be careful , don't filter any packet from/to router itself , unless configuration reset will be required ! but if you filter some of your users...

ShayanFiroozi

send your configuration
How can i do that? My device is http://routerboard.com/rb941-2nd

if you are a beginner take a screenshot of your wlan1 settings , if not run export command on interface/wlan1 in terminal window and send settings as text here !!

ShayanFiroozi

Hi,
exclude from what ?!!

if you wanna block them or limit them , use IP firewall

ShayanFiroozi

Hi, it's better to use small UPS otherwise you have to design it yourself ! there are many automatic battery charger circuit , but you should know about your battery voltage , a 12 volts SLA battery will be died forever under deep discharge , 11.9 or 12.0 volts is the minimum threshold , 13.4 or 13....

ShayanFiroozi

Hi, many reasons may cause this problem , try different frequencies , antenna direction , check obstacles , and also try to find a free frequency because 2.4 Ghz is more common and has more busy channels than 5.8 Ghz I've tried everything but my HapLite doesnt wrok properly. I created AP on my Wind...

ShayanFiroozi

Hi ehsan , use packet marking , to my knowledge in mikrotik mangle is performed first ,
but what's the logic behind this ?! interface will be automatically selected by router depends on your interfaces IP address , guys correct me if i'm wrong ,
thanks

ShayanFiroozi

Hi,

POE output on boards has serious power and current limitation , you should use them when you really have to and in most cases it's not for running powerful devices , it's better to use independent POE for each device.

besides checking device datasheet would help you about POE output max current

ShayanFiroozi

Hi,

try downgrade and check it , i think just Mikrotik can help you !

ShayanFiroozi

Hi ,
I don't think the problem is your routeros , because you are fine with other browsers , try to clear cache and history of firefox , sometimes it would be happen on firefox specially with https sites

ShayanFiroozi

Hi
i personally think nv2 is so fast protocol but not so reliable , nstreme is better and much more reliable , just test it

it's all about TCP and UDP and sometimes CPU or memory weakness on heavy traffics cause packet loss, it's normal , tcp will re-transmit it

ShayanFiroozi

Hi ,

As ZeroByte said it's easy , but don't forget about bridging/routing and DHCP server on your own AP , it's more secure and you have more control over your own users , such as Qos or etc...

ShayanFiroozi

Hi,

guys you think interface bonding is better than OSPF full duplex ?? any real experience ?

thanks

ShayanFiroozi

Hi, if you are a beginner , let's think about your device : you have 2 interfaces on your device , a wlan1 which has wireless connectivity and ether1 which has cable connectivity. in normal cases we receive the internet from ether1 with cable and transmit it via wlan1 with wireless. first we have to...

ShayanFiroozi

Hi,
i use nv2 for video or voice because re-transmitting the packet may cause interfering and delay on your video or voice , packet loss is common on nv2

ShayanFiroozi

Hi,

many reasons may cause this problem , try different frequencies , antenna direction , check obstacles , and also try to find a free frequency because 2.4 Ghz is more common and has more busy channels than 5.8 Ghz

ShayanFiroozi

Hi , it's a 3 years posts but i'm going to answer it !! it's not so easy , but you can do it with OSPF routing protocol !! that's all if you are not friend;t with OSPF , use static routing , but in this case you will loose redundancy , with OSPF you could have full duplex and redundancy in case of r...

ShayanFiroozi

http://wiki.mikrotik.com/wiki/DDoS_Dete ... d_Blocking
http://wiki.mikrotik.com/wiki/DoS_attack_protection

these links are useful , but i think you should mix these solution with scripting to achieve what u want

ShayanFiroozi

It's better to send your network diagram

Search found 281 matches