MikroTik

Ape

Hi,

yes you can.

Merge bridges, add appropriate VLAN interfaces, so CPU has access to VLANs and then move your DHCP servers and IP adresse to those VLAN interfaces.What you want to do is doable with one bridge an VLANs.

Regards,
Ape

Ape

Hi It depends entirely on your architectural solution. I would not drive client services through ospf. Use mpls + mp/bgp. I second this. Use MPLS/VPLS and centralize your PPPoE dialins to one server. MPLS should be the transport layer for your customer's traffic. It would be possible to just use the...

Ape

Hi,

if you only need to connect MT devices, you could use another VPN technology like IPSec/L2TP.
I like MT very much, but their OpenVPN implementation is known to be rudimentary.

Nonetheless, this should be fixed.

Regards,
Ape

Ape

Hi,

AFAIK this could be due to high packet loss or packet reordering.
Can you dismiss these possible issues?

Regards,
Ape

Ape

Hi,

it's totally possible with MikroTik and OSPF.

Have a look at this great talk:

Video: https://www.youtube.com/watch?v=dFZz2z6RdQY
Presentation: https://mum.mikrotik.com/presentations/ ... 062656.pdf

Regards,
Ape

Ape

Hi, normally, you look at this the other way round: Chose your media converter (copper / fibre) and then chose the SFP(+) transceiver accordingly. There is no need to use a SFP transceiver from the same manufacturer on both ends. It's only necessary to match SM/MM, distance and wavelength. In your c...

Ape

Hi,

you could use PPP profiles and execute scripts on Up and on Down to set/unset firewall rules or better adress list entries.
I didn't do it myself, but I think this should be possible.

Regards,
Ape

Ape

Hi, thank you for providing the additional information. Unfortunatelly, I don't understand what I see as the IP adresses in your config are other IP adresses than in your diagram. From the UTM's log you provided, I can see a peer ID of "192.168.178.84" is used. This looks like an IP from t...

Ape

Hi,

what about the remote side?
Any logs from there?

Regards,
Ape

Ape

Hi,

maybe this is related to the bridge functionality change starting with ROS 6.41.
Try netinstalling the devices instead of downgrading.

Regards,
Ape

Ape

Hi, I've no idea whats wrong - as you described the situation, everything is good IMO. Nevertheless, the error message clearly says that the server cannot verify the client certificate. Did you try to restart the OpenVPN server? (disabling and reenabling it) and/or restarting the CCR? Regards, Ape E...

Ape

Hi, I'm sorry, but you didn't provide any useful information about cour config to help you. Please post your config and exclude an sensitive data. What's in the logs of your MikroTik? Add a log rule in "System" -> "Loggin" with "debug" and "ipsec" to see what ...

Ape

Hi, thank you for reporting back. I drop just some thoughts: You can try "mtr -n --mpls" to determine the hop causing the packet loss Check if there are devices in the path with high CPU load, respectivly high single core load Is there an rate limit for ICMP packets? Is this limited to ICM...

Ape

Hi, just ping with "dont fragment" option set. Start with a payload if 1472 bytes (ICMP & IP Header is 28 bytes in total, so you have a size of 1500 bytes). Then, decrease payload size till ping goes through unfragmented. Take the value of your payload and add 28. Thats you actual MTU....

Ape

Hi, thank you for providing the diagram! chain=prerouting action=passthrough chain=prerouting action=accept src-address=192.168.5.0/24 dst-address=10.10.0.0/24 chain=prerouting action=notrack src-address=192.168.5.0/24 dst-address=10.10.3.0/24 chain=prerouting action=notrack src-address=10.0.0.0/8 d...

Ape

Hi, as you are using a very old release of RouterOS, you are probably affected by some of the security issues discovered in RouterOS. There are several official announcements from MikroTik about these issues: https://blog.mikrotik.com/security/new-exploit-for-mikrotik-router-winbox-vulnerability.htm...

Ape

Hi, I don't understand what you try to achieve. If you have correct firewall rules before your last deny rule, you should be fine. If you're using winbox, make sure, you display the rules in the order, they will be applied. To ensure this, you need to click on the "#" column in Winbox. Reg...

Ape

Hi, coming back to the intial issue, I would like to contribute some technical facts. You need to chose the VPN technology according to your limiting factors. These could be: - NAT/CNAT (https://en.wikipedia.org/wiki/Carrier-grade_NAT) - dual-stack lite (https://en.wikipedia.org/wiki/IPv6_transition...

Ape

Hi, what do you mean by within the 10 network, 10.10.3 has default route of the mikrotik (10.10.0.1), the 10.10.0 machines do not, so has to be masqueraded Can you please provide a simple network diagram. I can just guess that you have some sort of asymmetric routing on one site with ICMP redirect i...

Ape

Hi, thank you for the description of your solution. As we have the same tunnel IP setup just with L2TP/IPsec tunnels, I was very interested reading that you changed the tunnel IP addresses. I didn't do that but I set all "non OSPF" interfaces to "passive". Since I did that, the i...

Ape

Hi, I can confirm the exact same behavior on a hEX. Did you upgrade from a pre 6.42 RouterOS version? My guess is, that this is an remainder of the auto-conversion of the old master-port configuration method to the new HW accelerated bridge feature. I'll try to reset this device an re-apply an expor...

Ape

Hi there, that's quite interesting, as we've contacted MikroTik regarding a very similar issue with OSPF. It's the same behavior somone mentioned earlier in this thread: OSPF works fine for hours, days, weeks and suddenly the "core" router (hub and spoke VPN setup) stops propagating the ro...

Ape

Hi, I just bought two CRS210-8G-2S+IN. They configured exactly the same: Ports ether1 to ether4 are access ports for VLAN 100. Ports ether5 to ether8 are access ports for VLAN 200. Port sfp-sfplus1 is the trunk port. I followed https://wiki.mikrotik.com/wiki/Manual:CRS_examples#Port_Based_VLAN to do...

Ape

Hi,

thank you for your response!
Good to know.

Any chance to get the ability to see the PFS status in future ROS versions?
I'm okay with your answer but I know for sure some people (customers for example) want to see if PFS is "really" working.

Regards,
Ape

Ape

Hi emils, thank you very much for your answer. In fact I was looking for the flag in the SA table. Is there a possibility to check if PFS is used for the established SAs? I used /ip ipsec installed-sa print detail which gives quite a lot of details but no indication if PFS is used or not. Regards, Ape

Ape

Hi,

the RB2011 has a 600MHz CPU.
It won't be able to handle the traffic of 15 branch offices.

Have a look at the hEX, RB1100AHx4 or CCR1009. Those seem to fit your needs.

Regards,
Ape

Ape

Hi, I've a lab setup, where several RouterBoards should connect to a central VPN server (also Routerboard). I successfully configured a L2TP server and the client RouterBoards establish the L2TP tunnel ("Use IPSec" is checked). According to the IPSec SA table the L2TP sessions are encrypte...

Ape

Hi,

just defining DST-NAT rules isn't the whole thing, because it only handles incoming traffic.
You need to define corresponding SRC-NAT rules aswell.

Regards,
Ape

Ape

Hi, in case you have configured the VLANs as VLAN interfaces on a RouterBoard, just add the VLAN interfaces in a interface list and create a block rule in forward chain with this interface list as source and destination. Edit: I just saw the answer posted before mine. This is the simplest solution, ...

Ape

Hi, it depends on how you realise the forwarding. If you forward traffic on a specific port on 1.1.1.1 to 2.2.2.2 and you use SRC-NAT, the traffic will go through 1.1.1.1. If you don't use SRC-NAT you could end up having an asymmetric path from client to 1.1.1.1 to 2.2.2.2 and from there directly ba...

Ape

Hi,

you can try to disable the ftp service port in the routers's firewall settings.

Is the configuration on both CCR identical regarding NAT and firewall?

Regards,
Ape

Ape

Hi, yes, these two values are especially relevant for SIP/RTP. I can't give a general advice which values to set in your case, but it's worth trying to slightly increase these values. Furthermore, have a read of this thread: https://forum.mikrotik.com/viewtopic.php?t=85039 Usually, the problem is th...

Ape

Hi,

indeed, without further configuration (mangling your traffic), you cannot use both, queues and fasttrack.

Please read viewtopic.php?t=98133 as reference.

Regards,
Ape

Ape

Hi, as troffasky already stated, most of the time these issues occur in conjunction with ALG settings. Another thing to look at: As the firewall is stateful and UDP (which is used fpr SIP) is stateless, the firewall emulates stateful UDP connections by maintaining timers for those UDP connections. A...

Ape

Hi,

your OSPF config export seems incomplete.
Please post a complete OSPF config, so we can try to help you.
Use a code block to format it a little.

Thank you.

Regards,
ape

Ape

Thanks Louis.

I had this talk in mind while writing my post.

Ape

Hi,

are you using NAT masquerade on the CCR?
If you you do and you have a static public address, use a static srcnat instead.

Regards,
Ape

Ape

Hi, simply spoken, these "bad guys" use your DNS resolver to amplify there attack. They send DNS "small" requests (just a few bytes) with a spoofed source IP address. Your DNS resolver answers to the spoofed source IP address with a much larger response, resulting in an amplifica...

Ape

Hi,

Yes it was DNS issue. After disabling DNS, it is working normally.

Running the DNS cache is not your problem. It's not having appropriate firewall rules.
Please do yourself and the rest of the internet the favor of securing your device!

Regards,
Ape

Ape

Hi, relying on ICMP redirect is a bad pratice in my opinion. You need to configure your devices to accept ICMP redirects. For the mikrotik routers: /ip settings set accept-redirects=yes /ip settings set send-redirects=yes I suggest, you create some sort of transfer network segment and use OSPF in th...

Ape

Hi,

please provide the following information:

/ip firewall filter export compact

/ip dns export compact

Additionally, do another torch, this time, check "Protocol" and "Port".

I suppose you're accidentally running an open DNS resolver.

Regards,
Ape

Ape

Hi,

thank you for letting us know!

Just one objection: Wouldn't it be nicer to use a mangle rule to change outgoing MSS for these connections?

Regards,
Ape

Ape

Hi,

I observed DHCP problems in conjunction with

- wrong MTU setting (expecially along with VLAN),
- no Admin MAC on bridge interface
- STP configured on bridge running DHCP

Apart from layer 1 problems, these points are most of the time the cause of all trouble.

Regards,
Ape

Ape

Hi,

thank you very much normis!
This is a real professional handling of the situation.

Regards,
Ape

Ape

Hi Roland,

simply disable CAP for the WLAN interface:

CAP01.png

CAP02.png

Regards,
Ape

Ape

Hi,

if your can dismiss your router's firewalling / NATing, you'll need a SIP trace from your customers.

Regards,
Ape

Ape

Hi, thank you for your answer mrz. It would be really nice, if the IPSec parameters could be specified in the L2TP-client interface settings. Regarding the default hashing algorithm, which is curently SHA1, one could say it is absolutely necessary to make the L2TP-clients IPSec parameters configurab...

Ape

Hi, maybe I can help. I did this kind of setup myself and I came across the following behavior: Assume, "wlan1" is the physical wifi interface and it is configured as "station". Now, you create a second wifi interface, the virtual AP interface "wlan2", which is the slav...

Ape

Hi,

did you try to netinstall it?
Did you connect to the console? What's the ouput during startup?

Regards,
Ape

Ape

Hi,

configure verbose logging on your MikroTik and have a look what's going on. Without details nobody is able to assist you.

Regards,
Ape

Ape

Thank your for reporting how you solved the issue!

Ape

Hi,

the DHCP server offering leases to hosts in your net is perfectly fine.
There might be a problem with DHCP in VLANs, caused by faulty MTU settings: If DHCP server offers leases "without success", try increasing the MTU of the VLAN interfaces to 1504.

Regads,
Ape

Ape

Hi,

could be a DPD (dead peer detection) problem. Can you find out, what values are used by the Azure gateway and set it on your MikroTik?

Regards,
Ape

Ape

Hi,

regarding 3DES: You need to change the default proposal. Youl'll find it in"IP" -> IPSec" -> Tab "Proposal". Do it for both sides oft the encrypted GRE tunnel.

Regards,
Ape

Ape

Hi, what you're looking for is a feature to add some convenience to handle IP addresses - okay. But it is not a bug in my opinion. My preference is to avoid any auto-magic mechanism because it prevents you from thinking it through. Just my thoughts. Your reasoning is logical but not preferrable for ...

Ape

Hi,

my Ford Focus allows me to drive it against a wall. What's Ford's position on this issue?

To be serious: You configure the device, so you're in charge to do it right, no?

Regards,
Ape

Ape

Hi, just a blind guess: Do you use connection tracking / stateful firewalling for your underlaying network together with dynamic routing? I ask, because the dnymic routing is agnostic regarding the connection states in firewall. Think about this scenario: EoIP tunnel gets established over a specific...

Ape

Hi,

In "System" -> "Logging", tab "Action" "memory": How many lines do you log?
According to the graphics you provided, the RAM eating is quite regular.

Can you please post a "/export compact hide-sensitive".
Thank you.

Regards,
Ape

Ape

Hi,

I had a similar problem some time ago. There was a bug in the TP Link's firmware regarding IGMP handling, resulting in hughe amounts of IGMP traffic originating from the TP Link units. Check if you're running the latest firmware on the TP Link devices.

Regards,
Ape

Ape

Hi,

PCC means "per connection classifier", so it's a expected behavior that you use only one line for one connection. PCC will use multiple WAN lines if you have multiple connections, but every connection can only use one WAN line.

Regards,
Ape

Ape

Hi,

use Firewall Mangle Rules to add packet marks as desired. Keep in mind that you need to mark incoming and outgoing packets as there is no connection tracking on packet level.
Afterwards, configure queues for the marked packets as you like.

Regards,
Ape

Ape

Hi,

what's in the logs of the MikroTik and the SonicWALL?
Configuring a syslog server for logging the SonicWALL's messages and the MikroTik's messages would be helpful to correlate the findings.

Regards,
Ape

Ape

Hi,

please post the output of the

/export

command.
Thank you.

Ape

Ape

Hi, this is an example port forwarding for port 80: /ip firewall nat add action=dst-nat chain=dstnat disabled=no in-interface=<your wan interface> dst-port=80 protocol=tcp to-addresses=<IP of host> to-ports=80 /ip firewall filter add action=accept chain=forward connection-state=new \ disabled=no dst...

Ape

Hi, please have a look at: http://wiki.mikrotik.com/wiki/Load_Balancing I recommend PCC oder NTH load balancing in your case. Using the sum of both WAN connections from one client is only theoretically possible. To understand the resulting amount of bandwith you're finally getting, it is important t...

Ape

In some scenarios with MPLS/VPLS, it might look like a loop but it isn't. It can happen when paths are switching. IMHO, as long as your log is not filling up with this message, you should be okay. Additionally you can enable STP/RSTP on the bridge. For debugging: Capture the traffic on a mirrored po...

Ape

Whatever you try to do, keep in mind, that willful disturbance of communication might be illegal in your country...

Ape

Hi,

the port forwarding is just one thing to do.
Propably you must also add a firewall rule in the forward chain to allow the incoming traffic.

Ape

Ape

Hi, if you're on a MikrotikRouter without VLAN capable switch chip, you should create a bridge for every VLAN an bridge the desired VLAN interfaces in this bridge. As you already wrote, the bridge interfaces must be configured with the desired IP addresses. As kamillo already said, this setup will c...

Ape

Hi, What could be the use of this TR-069 in MikroTik? Never heard of it before. In short: It's a remote configuration protocol / engine (in fact it's not, TR-069 is just the name of the standard released by the broadband forum, but that's just a detail). An ISP can auto-configure thousands of device...

Ape

Hi normis, great that you are adding TR-069 to RouterOS! I've just one request regarding TR-069 support: Please add it in the form of a separate package. I think there are people out there (including me) that get scared when thinking about TR-069 running on a core router. It's fine and necessary on ...

Ape

Hi,

Okay. Thank you for clarifying.

Just add the DNS server's IP in your "DHCP server" -> "network" config. That's it.

Ape

Ape

Hi, you already described the solution to your issue: The only workaround I have found is http://wiki.mikrotik.com/wiki/Force_use ... DNS_server which would force all requests on port 53 to go via the RB but this would still leave 192.168.0.1 listed as a DNS server for clients using DHCP eg: This is...

Ape

Hi again, sorry MikroTik....it's not a bug in RouterOS, it's a bug in my brain. The described issue has nothing to do with RouterOS! But, there is in fact a bridge, leaking packets from VLAN 100 to VLAN 300 in my network. It's completly unrelated to the described issue, but maybe it is helpful for s...

Ape

Hi, a RB2011 and a RB750GL are connected as following: https://www.jumping-frog.de/files/theme/img/projects/RouterOS_VLAN_Setup/VLAN_setup.jpg This is the config on the RB2011: /interface export compact /interface bridge add comment=LAN mtu=1500 name=br_vlan100 protocol-mode=none add comment=guests ...

Ape

Hi,

I'm glad to hear you managed to solve your issue.

I recommend to avoid TCP based VPNs like OpenVPN in RouterOS and SSTP because they add latency due to the (additonal) TCP handshake.
IPSec is fine.

Ape

Ape

Hi, I guess you're always talking about a wired connection from your computer to the router for testing the throughput, right? Another thing I could imagine: You provider artificially limits the bandwidth when another device is connected. Determine the MAC address of the WAN interface of the router/...

Ape

Hi, regarding CPU load: Check this with /system resource monitor while pushing traffic through the device. Regarding MTU: A often used way to determine actual MTU of a path is pinging the remote side with a ping of a given sized and the DF (=dont fragment) bit set. Keep in mind, that you have to add...

Ape

Hi,

yes, someone in the path is blocking the packets and informs you with an ICMP "admin prohibited" response.
You can get further information on https://en.wikipedia.org/wiki/Internet_ ... l_messages.

Ape

Ape

Hi, Agreed, I need to rout the SIP LAN address through office2 WAN IP. The question is how? or what is the method and I will search? Thanks, /ip route add dst-address=xx.xx.xx.xx gateway=yy.yy.yy.yy xx.xx.xx.xx/xx = IP range of your SIP provider's SIP gateways yy.yy.yy.yy = local IP of the router in...

Ape

Hi,

it's a matter of routing.
You must route traffic to your SIP provider's IP range over the gatway of office 2.

Ape

Ape

Hi, normis already answered the question: MikroTik FTP server is only for uploading NPK files and downloading backups. It is not designed to be a public FTP server for large files and resume downloads. The conclusion is: The embedded FTP server is not intended to be used for anything other than uplo...

Ape

Hi,

as long as your links are L2 transparent, you should be able to use the MAC based bonding interface feature.

Ape

Ape

Hi,

good question!

Another question would be: Is the profiler displaying processes and/or threads?
Displaying the same process name on multiple CPU isn't necessarily an indicator for multi-threading, the process may be just instantiated multiple times.

Ape

Ape

Hi, thank you for providing your config. I can't see anything obviously wrong in your config. Two things came to my mind: 1) PPPoE can handle a MTU up to 1492, but your provider can use a lower value. You could try to successively decerease the MTU on the PPPoE interface. 2) I don't see anything in ...

Ape

Hi,

please post your router's config. Everything else would be just guessing.

Thanks.

Ape

Ape

Hi, thank you for sharing your experience. In my case, the faulty behavior of the unit suddenly disappeared. Still, I don't know what caused the issue and neither what made it stop. I marked the device and I only will use it for testing in future. For my the state of the issue is between "solve...

Ape

Hi, I think you would like to import a user's SSH key. AFAIK you cannot generate the key on the MikroTik router. You have to generate it on another machine and then move the public key via Winbox or ftp to the router's filesystem. Afterwards, you can use /user ssh-keys import public-key-file=id_rsa....

Ape

Hi, how to Protect your hotspot from hacker 1- go to ip address change the "Local"(out interface) subnet mask to 8 (255.0.0.0) ex: my Local ip is 192.168.10.1/24 change to 192.168.10.1/8 2- go to ip dhcp server - network chane the subnet to 8 I would like to read the explanation too. Thank...

Ape

Hi.

@mbfound:
Thank you for sharing your solution.

@MikroTik
Maybe the MikroTik staff can shed some light in the internal working because I'm really interested in how Winbox's cache results in this error message in the router's log. Thanks.

Ape

Ape

Hi elsev7,

I'm sorry to hear that.

Yes, I agree, you have to exclude external L2 issues.
In the hope we're dealing with deterministic devices, there must a be chain of causality.

If you need further assistance, feel free to ask.

Ape

Ape

Hi,

How many connections are NATed on the Metal 2SHP?
Is this legitimate traffic or some sort of attack?

I don't have any real life experience with many NATed connections on a Metal 2SHP, but from the specs (400MHz, 64MB RAM) I guess, it should be able to handle some hundred NATed connections.

Ape

Ape

Hi,

if you only experience this issue over PPPoE, then MTU could be the cause.
Whats your path MTU? What MTU is configured for the PPPoE connection?

Ape

Ape

Hi,

"/system shutdown" is intended to shut the system down, not rebooting it.
Yesterday I configured a couple RB941 and they properly shut down when "/system shutdown" was issued.

I'm using RouterOS 6.30.2. Please try updating your device.

Ape

Ape

Hi, thank you for the image. "/ip neighbor" is exactly what's the reason you can see MikroTik devices in Winbox's list. Please have a look at http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery . You can change ether2's arp setting from "proxy-arp" back to "enabled&qu...

Ape

Hi,

according to the How-To you mentioned, ether2 is your LAN interface to which the router's IP is assigned, right?
In this case, enable "proxy arp" on ether2.

Also make sure, the pptp client interface is enabled in IP -> Neighbors.

Ape

Ape

Hi. Yes, that's right. You need to enable connection tracking in order to have NAT working. It's not an issue, it's a feature: Connection tracking needs additional resources, like CPU and RAM, so it's up to you to enable or disable it. In order to build a stateful firewall or to use NAT it must be e...

Ape

Great! It's always a pleasure to help.

Please prefix the title of your first post with "[solved]", so other people looking for a similar problem can see at a glance that this thread describes an approved solution. Thank you!

Ape

Ape

Hi,

I'm sorry to hear that.

Have a look at http://forum.mikrotik.com/viewtopic.php ... 4&p=472523.
It might be some conflicting files.

If you can dismiss this possibility I think you should write to support@mikrotik.com

Ape

Ape

Hi, I just read the changelog ( http://forum.mikrotik.com/viewtopic.php?f=21&t=99531 ) for RouterOS 6.31 and found this line: What's new in 6.31 (2015-Aug-14 15:42): [...] *) bridge fastpath - fixed updating bridge FDB on receive (could cause TX traffic flooding on all bridge ports) Maybe this i...

Ape

Hi, okay - I understand ;-) Did you upload the new packages via Winbox/FTP or did you used "Check for updates" button? Normally uploading the .npk-File and rebooting the device does the trick. Sorry for asking this dumb question, but did you use the right npk-file for the CCR's system arch...

Ape

Hi,

a pragmatic way to solve this would be:

Export your config.
Do a netinstall with new RouterOS.
Import your config.

If this device is mission critical, try this at first with a spare device to ensure the exported configuration works flawlessly with the new RouterOS version.

Ape

Ape

Hi, your routing table shows, that 172.16.250.254 is still the active default gateway. I guess the active default gateway should be 200.85.183.173? Try disabling port 10 (to your Fortigate) and/or the default route using 172.16.250.254. Another thing to consider: Did you adapt your firewall rules to...

Ape

Hi,

if you unchecked "Add default route" in the PPPoE client's configuration and it still adds a default route for this PPPoE client then yes, it's a bug.

Ape

Ape

Hi, @kuranga I think the traffic does not die totally over that UDP port but gets slowed down towards 0 - asymptotically. Sounds comprehensible, but every udp packet corresponding to the identified udp "connection" should reset the timer, which it obviously does not do. It really looks lik...

Ape

Hi, as you already said, I would setup tagged trunk ports (ports 23 and 24 on yoour image) between the switches and one additional trunk port for connecting your router on a stick thing. In your desired setup you must ensure that your workstations can tag the ethernet frames and that the switches on...

Ape

Hi,

is connection tracking enabled and used on one of your Metals? If so, it might be the UDP connection timers.
I have had quite a similar issue with SIP sessions over UDP and I think it is related to the UDP connection timers.

Ape

Ape

Hi,

you could measure/monitor voltage and current provided by the ToughSwitch to prove your assumption.

I think it is possible that power supply gear (like a PoE switch) will get unable to provide enough power over time due to aging of electronic components like capacitors.

Ape

Ape

Hi,

you could configure the CRS to do policy based routing. This way you have the control about what host uses which provider for outgoing traffic.
But depending on the desired / required bandwidth the CRS might not be able to handle the traffic load when doing L3 forwarding.

Ape

Ape

Hi, it is a little unclear what you try to achieve. If you simply want a failover for your internet connection, add two default routes with "check gateway" set to "ping". The preferred default route with distance 1 the second (backup) route with distance 2. As long as the gateway...

Ape

Are you sure, the switch is the origin of the unicast flood?
Is your backup software possibly using (excessive) broadcasts / weird multicasts?

Ape

Please share the URL to the MikroTik documentation where you got the VLAN thing from, so I can have a look and reply to your question, thank you. Debugging LDP: Got to "System" -> "Logging" and add a rule with the topic "ldp" and "debug". This ways you should ...

Ape

Okay, some causes could be: ARP timers on hosts are longer than the switch's address cache - so the switch basically forgets what MAC is associated to which port, resulting in flooding. But this should not be a matter of hours of unicast flooding like in your case. MAC table of switch/bridge is full...

Ape

Ah!

You are bridging all ports - not using the switch chip.
I use the "real" switch feature, in my FDB table there are entries for every port/MAC association known to the switch.

Why are you bridging all your ports instead of using the switch chip?

Ape

Ape

Hi, looks good to me. The most important part, besides MPLS/VPLS is running, is the L2MTU on the physical interfaces. It must be at least the size of your MPLS MTU. You configured the MPLS MTU to 1530 which is fine when the physical interfaces on your routers support an L2MTU of at least 1530 and al...

Ape

Hi,

as far as I understand this, ARP has nothing to do with the FDB.
I also have a CRS125-24G-1S, the only entry in my ARP table is the MAC from the computer I'm accessing the switch for management.
So, AFAIK the entries in ARP table and FDB table are not related.

Ape

Ape

Hi, what do you mean with "all my traffic"? TLB/ALB bonding works per MAC address, so a connection from host A to host B will always use only link #1 for example. A connection from host A to host C might use link #2. So, only in the case host A has connections to hosts B and C, both links ...

Ape

Hi,

I'm not completly sure, but maybe

/interface ethernet switch set unicast-fdb-timeout=300

is what you are looking for?

If you're interested in further reading:
http://wiki.mikrotik.com/wiki/Manual:CR ... nicast_FDB

Ape

Ape

Hi,

the FTP APPE command means "append to file".
I think MikroTik's FTP server implementation simply does not support this ftp feature.

Unfortunatelly, I doubt that you can change the behavior of the ftp client (IP camera in your case) - sorry

Ape

Ape

Hi, if I understand your question correctly, you're asking what topology would be the best. If this is the case, this is my thought: If you don't want to create multiple VPNs in Azure, you should go with a hub and spoke (or star) topology regarding your VPN connections. In this setup you will be abl...

Ape

Hi,

as long as the ports are configured as switch ports or bridge ports and you use STP / RSTP, you'll get the desired redundancy (and of course a loop free topology).
A more sophisticated setup would be bonding the interfaces, this way you get redundancy and more throughput.

Ape

Ape

Hi, please check if the speed and duplex auto-negotiation actually negotiated 1GB/100MB full duplex on the affected port. It looks like there might be a negotiation problem between your RB and the AP you're using. You can try disabling auto-negotiation for this ethernet port and setting it to 100MB ...

Ape

Hi,

although I'm a MikroTik fan, I would go with the "PC running Linux" solution.
It will be better suited to your needs and more flexible.

Ape

Ape

Hi,

out of curiosity: What device / kind of hardware do you use?

Corruption may be defined as "file does not contain what it is supposed to contain". Just guessing: Maybe the file got corrupted in a crash situatiom, maybe flash storage is defective, and so on.

Ape

Ape

Hi MTusewk, I cannot give you a walk-through for your torrent blocking task, but I want to share some thoughts: - devices using torrent file sharing typically open many connections in a short time period on specific ports (these port numbers are AFAIK client software dependant), this should be detec...

Ape

Hi Micat, I'm glad to hear your problem is solved. The setting was "rstp". Changing it to "none" did the trick. What if I do not want to disable STP? It's a good question. IMHO, the timeout for getting an IP address by DHCP is configured to short on the devices - I know you won't...

Ape

Probably you have allowed external requests to you DNS on the MikroTik but you didn't have restricted the access to your LAN. So everyone from the internet can access (and will acess) your DNS. As jarda already stated, this topic is covered multiple times in this board. The last thread I remember co...

Ape

Hi,

just to keep this updated:

Another unit that arrived today works stable for hours now with the excat same config.
As soon as I can recover the defective unit from the customer, I'll open the ticket.

Ape

Ape

Okay, I'll create a ticket and give you remote access next week.
Thanks for your support!

Ape

Ape

HI normis, okay. Thank you. I just ordered two devices and will configure them exactly the same as I did with the malfunctioning device (I was able to export the initial config before the issue occured the second time). Nice piece of hardware by the way :-) (I just notice this could be interpreted a...

Ape

Hi normis, thank your for answering. I setup the device yesterday ~ 6pm. After a while the devide became unresponsive and I notice the empty windows in WinBox. Then I netinstalled the device right after this happened the first time. After netinstalling, I configured the device and it was running til...

Ape

Hi, I just bought a bunch of hAP lite. I use them for VPN and OSPF in a SoHo environment. No problems so far - I like them. Yesterday I set up a hAP lite (RouterOS 6.30.2 / Firmware 3.24) and when I tried to add a static lease, the device became unreachable by ip. First I thought I did a configurati...

Ape

Hi, two things come to my mind: - if you use input rules on firewall, allow input for port 67 and 68 UDP (https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#Operation) - is your DHCP server acting on a bridge interface which has STP enabled? STP takes time to establish loop free conne...

Ape

Hi opalit,

please enable debug logging for "pppoe" and "interface". Maybe you'll get some helpful additional information.

And again, please tell us your RouterOS version and your RouterBoard firmware version. AFAIK, there were port flapping issues in the past.

Ape

Ape

Hi,

do you see ethernet port status changes in the router's log?
Did you notice connection drops?

What RouterOS, what RouterBoard firmware? To what kind of device ether1 is connected to?

Ape

Ape

Hi Mashal, what you stated is right for routing in layer 3. But you have connected two overlapping networks to your router. Without understanding subnetting and the internal working of the IP stack on a device, you won't be able to understand why your setup is not working and why "By default fo...

Ape

Hi Mashal, I'm afraid, without changing one of your network addresses / subnet masks you really won't get this working. This is the fundamental working of IPv4 networks. You must create a setup, where the network address space you want to route to, is not contained in the originating network address...

Ape

Hi,

you won't be able to get this working with plain routing because 10.10.1.252/30 is a subnet of 10.10.1.0/24.
If you don't need the whole /24 range, you could configure 10.10.1.1/25, now 10.10.1.0/25 and 10.10.1.252/30 are really different nets between you can route.

Ape

Ape

Hi, yes, to log messages remotely you need to create a logging action "remote" with the correct settings for your syslog server. Afterwards you can copy an existing or create a new log rule with the desired topic and the remote action. To address your filesharing problem: It is not that ea...

Ape

Hi, if the have SSH enabled, you can find the with their ssh server string. user@server:~$ nmap -A -T4 -p 22 -n 192.168.0.1 Starting Nmap 6.40 ( http://nmap.org ) at 2015-07-27 22:12 CEST Nmap scan report for 192.168.0.1 Host is up (0.00034s latency). PORT STATE SERVICE VERSION 22/tcp open ssh Mikro...

Ape

Hi inteq, I have a RB1100AHx2 too, but still on 5.26. Yo could try to log debug messages (topic "debug" in /system logging) and log these messages to a external syslog server (in case the router crashes you still have access to the last log messages). Maybe the debug messages can help to t...

Ape

Hi,

did you already try to netinstall your device?
The file system may be corrupted.

If this strange behavior continues after netinstall, I would say the device is a candidate for RMA.

Ape

Ape

A linux system.
If it should be low energy and low cost, a raspberry pi can do the job.

Ape

Ape

Hi, Secondly since we are on topic. I want to know is it possible to log every connection attempt of users to anywhere on the internet in MikroTik? Regardless of whether it was failed/successful connection attempt? If it is possible then how can I do it? Yes, it is possible. You can configure firewa...

Ape

Hi,

thank you for sharing your finding.

I'm glad that you have figured out how to solve your problem.

That is in fact interesting, a MTU mismatch should not make the tunnel unusable but lead to fragmentation on the transport connection.

Ape

Ape

Hi,

your description of the topology is not detailed enough.
We need a plan of your network topology and some information about your adressing scheme to help you.

It could be possible that you need to use proxy arp. As I do not know your topology and adressing, this is just a guess.

Ape

Ape

Hi, you need to create a mangle rule to mark connections to port 25. Then, you need to apply a routing mark to this connections and add route which will route the so marked connections over your VPN tunnel. Have a look at: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle http://wiki.mikrotik....

Ape

Hi, I think it's a GRE issue. As your router is also acting as a PPTP client, it seems the GRE packets from the VPN server to the client connected to the AP do not arrive. To debug this, you could capture the GRE packets on the WAN interface and look for the addresses. Another thing: Your firewall r...

Ape

Hi, @jarda You need two rules. Unfortunately it is so. I would also like multiple choices in other fields... I guess ROS is using iptables as firewall and iptables does not support specifying multiple protocols. It also would be very difficult to implement because many other options of a firewall ru...

Ape

Hi,

with WinBox 3RC12 I can connect to a device using ROS 5.26, but secure mode does not work.
Connecting to a ROS 6.30.1 device, I get a secured connection.

Of course I checked "secure mode" in WinBox.

Anyone else experiencing this?

Ape

Ape

Hi,

you probably hit the leap second bug.
Please see: http://forum.mikrotik.com/viewtopic.php?f=21&t=98224

Ape

Ape

Hi,

i just tried using RSTP and it's working fine.

As the "R" in RSTP stands for "rapid", I think the time it takes to achieve loop free connection is short enough so the WiFi device gets an IP before it sends the disassociation.

Ape

Ape

Hi, I solved my issue. In our server room, there is a sign on the rack "Thinking helps" and ideed it does! My issue is not related to WiFi or DHCP but to STP! I have to share this: I configured a bridge "loopback". I configuren ports ether1, ether6 and wlan1 as slaves of this bri...

Ape

Hi jarda, thank you for your input. I forgot about wireless debug logging - noob error. Yes, I do run a DHCP server on the bridge-interface, which bridges wlan0, ether1 and ether6. Thanks for the hint. This could be the explanation why the clients do the disassociaten by themselves. Next question is...

Ape

Hi, a single broadcast domain with 50 clients is okay in my opinion. Most MikroTik devices have a built in switch chip, so this is probably the better way to interconnect the ports of your device. If you do not need any bridge features, you can lower CPU usage / improve throughput by configuring you...

Ape

Hi, I'm running a RB2011UiAS-2HnD for a year now (running ROS 6.29.1 and the wireless-fp package). This morning, I suddenly got problems regarding the clients connecting to wifi. I can't connect WiFi devices to the AP anymore. The log shows 07:15:51 wireless,info 84:63:D6:B4:46:CC@wlan1: connected 0...

Ape

As it onloy has a 400MHz CPU, I think it is designed to handle a modest amount of L3 traffic, but certainly not for all ports at full wirespeed, especially if firewall rules come into play. IMHO, the naming "Cloud Router Switch" is more a marketing thing than an appropriate product descrip...

Ape

AFAIK this is not possible, because the AP must keep track of the associated clients in order to be able to send data as efficient as possible over the air.

Ape

Hi, reboots may occure if watchdog triggers. One possible reason for this is (very) high CPU load. To find the reason, I suggest you configure the "error", "warning" and "critical" topics to be logged on disk. Another way is to use a syslog server to collect the log mes...

Ape

Hi,

without a

/export compact

it is hard to help.

I suggest you configure the DHCP server on the bridge interface instead of ether1.

Ape

Ape

Hi,

in WinBox, go to "Interfaces", open the PPPoE interface window by double-clicking and click on "Torch".
There you can see what traffic is flowing on this interface.

The next steps depend on what kind of traffic you'll see.

Ape

Ape

Hi, I'm sorry to hear your problem persists. What OS the server is running? I had the problem with Ubuntu 10.4, but not with a Windows 7 laptop on the exact same port. This was the scary part I did not unterstand. Changing the switch port the pbx was connect to did not change the ARP issue. I could ...

Ape

Hi gabak, the non-technical explanation for "dual chain" is, that there are "two sources of and two inputs for" the wireless signal. Dual chain therefore also means "MIMO" (multiple in, multiple out). "Dual band" means, that the device will send at for example...

Ape

Hi, thanks for sharing your experience Pe3ucTop! I restored the VLAN config with a freshly installed (netinstall) 6.29.1. No more ARP issues - rebooted the unit several times - seems to be stable now. For reference I'll drop the running config: [admin@ASW-07] > /interface ethernet switch export /int...

Ape

Hi, I just want to drop an update on this: After re-updating to 6.29.1 with netinstall, the booting process does not stop at "starting services" anymore. I think this might be due to the firmware (3.22) I also updated during my first update to 6.29.1. I think 6.12 is somehow incompatible w...

Ape

Thank you for your input on this. Unfortunatelly I wasn't able to do an export because of the "starting services" issue. The unit was shipped with ROS 6.12, updated to 6.29.1 and then downgraded back to 6.12 with netinstall. I tried waiting about 10 minutes before re-powering the unit - no...

Ape

Hi all, I'm running a CSR 125 24G-1S-RM. Port 24 is master port for all ports as it is a VLAN trunk port to another switch. There are VLANs on the trunked port: VID 10, VID 20, VID 30 and VID 100. Ports 1 - 4 are untagged ports for VLAN 10, ports 5 - 8 untagged for VLAN 20, ports 9 - 12 untagged for...

Ape

Hi, although this is an old post, I would like to share my own experience. As you're not very precise when unit is rebooting, I guess it could be related to too much traffic, maxing out the CPU. I observed the same behavior with ROS 5.26. RB750GL keeps rebooting when passing ~200MBit/s traffic over ...

Ape

Hi,

I figured it out myself: I must add a accept rule for dst ip on router in mangle table (chain prerouting).

Ape

Ape

Hey guys, I've to WAN uplinks. Default route goes over WAN1 (Telekom VDSL) and for WAN2 (clara.net SDSL) I set up policy based routing, so connections to WAN2 leave on WAN2. The problem: port forwarding for the "Telekom WAN" works fine, port forwarding for the "clara.net WAN" whi...

Ape

You're missing the intended modular concept of the MikroTik devices. They're not an out of the box solution for your problem, I like to see them as advanced router construction kits. It's up to your configuration skills to make them doing what you think they're supposed to do. So yes, this flexibili...

Ape

True that InoX. It's the same thing with almost every software. In this business, if you have critical infrastructure, you stick with the older stable things if they don't lack security and/or needed features. To be honest, I think you wont get any other so rich featured device for the same amount o...

Ape

Hi,

Error 721 is GRE related: GRE packets cannot reach destination. I ran in similar problems trying to redirect the PPTP ports. Since I use OpenVPN, everything works pretty well.

If you habe to stick to PPTP investigate why GRE cannot pass.

Ape

Ape

Hi,

at least for the proxy I would assume the following:

The proxy creates a special directory structure for optimized file access speed. I would guess, the creation of this directory structure is meant by "Oct 23 13:15:53 192.168.88.1 web-proxy1: disk setup finished successfully".

Ape

Ape

Or maybe I should have asked: Is there a difference in prerouting and input chain for an incoming connection which will be terminated in the router?

The packet flow diagram says no, because it's "prerouting -> routing decision -> input". Am I missing something?

Thanks.

Ape

Ape

Hi, I dual WAN config (PPPoE & leased line with static public ips) on my RB750G running ROS 6.1 I tried to set up mangle rules to route a incoming connection over the WAN interface it was coming in. I know, that I have to use mangle rules to mark the connection and to mark the routing. It's work...

Ape

Hi, I see no need to change the listening port of your touch screen, because the NAT rule can also do port redirection. I assume following things in your setup: All touch screens listening on port 80. WAN connection is NATed. So, you have to configure a NAT rule: On tab "General" Chain: ds...

Search found 177 matches