Yes, it works with +ct, but the script must work with both 2.9 and 3.x. (and worked before 3.13).
Anyway, this is sort of a solution, thanks

Doesn't work in 3.14 either

sometimes entries in address list stop working and do not 'participate' in firewall matching. But if you select that (not disabled) entry in WinBox and press "Enable", visually nothing changes, but address list entry is working again...

Experienced the same problem in 2.9.51.

#!/usr/bin/perl use strict; use Net::Telnet; unless (@ARGV > 2) { exit 2; } my $nasip = shift(@ARGV); my $community = shift(@ARGV); my $login = shift(@ARGV); my ($user,$pass,$t); ($user,$pass)=split(/:/,$community,2); $t = new Net::Telnet (Timeout => 5, Errmode => "return", # Dump_Log => ...

Seems like nobody really reads my message
The script that works with 2.9 and 3.10 does NOT work with 3.13 due to some change in the console code.
It hangs after login (there is a "logged in via telnet" message in the /log).

There is nothing to "hit", the problem is with perl scripts (which worked fine with 2.9 and even with older 3.x versions). Yes, there should not be too much difference, but seems like there is :( Once again, the script does not receive command prompt, MT telnet server just hangs after logi...

After upgrading to 3.13 from 3.10 my Net::Telnet perl scripts don't work anymore. Seems like telnet server was changed, but I can't find anything about it in the changelog. 2.9 also works fine. The ploblem is apparently with terminal type handling, 2.9 says "terminal type is network", 3.13...

I've configured NSSA ospf area and ROS doesn't redistribute connected and static routes. If I configure the area as default it works (as type 5 LSA). The whole point of NSSA is to redistribute external routes (as type 7 LSA, which get translated by ABR). Tried both routing and routing-test. ABR is C...

Thanks, seems like the same problem (but I have no bridge). Still seems more like bug, if there is no way to match a fragment (ROS drops if tracking disabled, matches whole reassembled packet if tracking enabled) then why there are specific options for that in firewall?

So would I.
But no, fragments are silently dropped by routeros with tracking disabled, not seen in mangle nor in filter chains at all.

I have 2 vlan interfaces (tag 101 and 102) and "accept all" rule in the forward chain. Fragmented UDP packets are dropped and there is no way to match them (only the first fragment is matched with size=1500). If I enable connection tracking the packets get forwarded and i see their "f...

Actually it's even worse.
:put [find connect=no] doesn't show anything but i DO HAVE ospf and static routes (which are supposed to appear here). So it seems like TWO bugs
1) find returns an empty set
2) print outputs something on an empty set from find

Hi. When I execute /ip route print from [/ip route find connect=yes] I get the listing of directly connected routes. But when I try /ip route print from [/ip route find connect=no] I get all routes including connected. :shock: Is there any way to filter out "connect" routes? I've tried oth...

Hi. Does MT support transparent bridging of .1q tagged frames? i.e. MT1 eth1 connected to one end (site1) MT2 eth1 connected to other end (site2) There is an EoIP tunnel between MT1 and MT2, brigded with eth1 on each side. The point is to provide a "virtual wire" between two sites (which p...

Filter-Id=xxx.in creates dymanic rule jump to xxx (from dynamic interface) in the "ppp" chain. If the ppp chain doesn't exists Filter-Id does nothing.

To use Filter-Id you should create ppp and xxx firewall chains

No, just wanted to achieve perfect security

>Operating system may cache DNS records

That's what TTL is for

rate-limiting dns packets is a solution but not a perfect one.
Ideally non-authenticated clients should not be able to transmit a single byte to the outside

Is there any way to setup a dns server that responds with predefined A record to ANY request from non-authenticated hotspot users? I want them to be able to enter any url in their browsers and get to the login page. MT redirects all tcp traffic to HS webserver but client sends DNS query before openi...

No, viruses usually scan the whole Internet

Intel has windows drivers with vlan support for their cards, so you CAN connect a windows box to tagged port

Yes, it is possible. I have about 50 VLAN interfaces and many of them have PPPoE servers attached. Everything is ok

After some tracing I've found that MT incorrectly rejects LCP Code 12 packets. They are recognized as rejects of some random code. If this code is essential (9 for example) Windows drops the connection with 732 error. Here's how it happens: [1656] 12:54:12:315: <Protocol = LCP, Type = Identification...

About 1/10 of connect attempts to MT PPPoE service from Windows (using builtin XP client or RASPPPOE) fails with PPP 732 error. The problem never appeared with cisco. Is it MT bug? Any fixes/workarounds?