MikroTik

aaronhun22

It's not missing; its default which won't show in the config. Haven't you ever read or programmed these?

aaronhun22

InoX

Shows how much you know or didn't you bother with reading my posted config.

jrudrow was actually the one who caught it and CyberTod interpreted the low CCQ was due to no traffic.

Maybe YOU should concentrate on posting useful information instead of sounding like a babbling moron.

aaronhun22

I agree with deanMKD1; sounds like you're missing Masquerade on the out interface. Post your config for better help.

aaronhun22

Changing the client mode to station-bridge fixed it! I wasn't able to get more then 30Mb with Nstreme even though the ping times are shorter. Switching to NV2 I got 400Mb. Thanks everyone!

aaronhun22

I got it to connect with nstreme and the CCQ is now 66/70 but it still won't ping. No traffic across the link.

aaronhun22

Setting the distance to dynamic had no change. NV2 is the only one it will connect with but not even ping with work. CCQ is as low as 2 and as high as 10. Set AP to 20Mhz channels and 80Mhz with no difference.

aaronhun22

After a few days of aligning I now have the signal at -48. My connection says -52 and -53 with NV2 and the CCQ is now 6/2. NetMetal5 with mANT30 and their flex-guide and still no connection.

aaronhun22

I removed the distance setting and CCQ is still 2%.

aaronhun22

Yeah; when I wasn't using NV2 I kept getting disconnect messages in the log. 07:10:50 wireless,info @wlan1 established connection on 5300000, SSID 07:10:53 wireless,info @wlan1: lost connection, received deauth: class 2 frame received (6) 07:10:53 wireless,info @wlan1 established connection on 53000...

aaronhun22

You need to realign the antenna. Same hapened to me but I moved it left to right a lot until the signal was good. The antenna has lobes and you align them on that lobes. Also the signal must be identical +-3dbi. The link must have ~ -60dbi. We actually had it at -53 before we raised it up on the po...

aaronhun22

We have 2 mANT30 with NetMetal5 connected and can only establish a connection with NV2. The link is 33km with the signal at -68 and -74. Noise floor is -104 and signal to noise is 39 but the CCQ is 2/2%. We've tried 20Mhz wide channels on N and 20,40, and 80 Mhz on AC all with the same result. I hav...

aaronhun22

I upgraded to 6.10 and same problem. The voltage doesn't matter in my scenario because I'm running the radios on a PCI to mPCI card in my PC. RouterOS 6.10 x86

aaronhun22

So I've setup a Wireless AP with a Dbii F50N-PRO and again with a Compex WLM200N5-26-ESD and after a week they stop transmitting until I reboot. I'm using RouterOS 6.5 L4 x86 with a StarTech PCI to mPCI adapter. Until I have to reboot they run great.

aaronhun22

I can't answer for your PBX but I do know that on Asterisk when a SIP extension connection is lost they don't reregister when the connection comes back online because Asterisk already knows the IP address of the incoming extension. So for your router SPI wouldn't treat these connections as new since...

aaronhun22

You can change the timeout to more than 15 sec. Also if 1 IP already has a registered phone and a new one tries it will start a new 15 sec trial. Its like you said; connections are only blocked during the 15 sec trial. 15 is long since registration usually takes only 3 sec per device.

aaronhun22

Add the 3G interface to the bridge of the RB acting as modem and make sure the network cable connected to the RB in the basement is connected to your WAN interface. If you're planning on utilizing both 3G and ADSL connections then you'll have to configure 2 WAN interfaces and mangle rules.

aaronhun22

The MT must have a connection in some form (ethernet, fiber, or wireless) to both DSL endpoints in order to connect to them.

aaronhun22

You need to NAT the PPP interface with:

ip firewall nat add chain=srcnat out-interface=ppp action=masquerade

aaronhun22

This will drop all requests to webmin (assuming its still port 80) from 172.20.3.0/24 network.

ip firewall filter add chain=input protocol=tcp port=80 src-address-list=vipguests action=drop

aaronhun22

What hardware are you using; is this a custom build or a RB?

aaronhun22

This is doable but not over port 443. Depending on what VPN service you use (PPTP, L2TP, or OpenVPN) will determine the ports you'll need to forward.

aaronhun22

You can only use the Nth rule in routing when marking new connections because all packets need to have the correct source address when responding.

aaronhun22

You can use Wireless Access-Lists to lock down access by MAC.

interface wireless access-list

aaronhun22

So are you trying to boost the 3G signal from your basement or are you putting the 3G in the attic and relaying to the basement? Any RB OS with License Level 3 and up can connect to a RB AP in station mode.

aaronhun22

What is your setup and why do you need BGP? If you're looking for a dual WAN setup do you have Public IP's? Any Dual WAN setup needs Mangle rules to direct the LAN devices on which route to take.

aaronhun22

These are rules created by the hotspot module. They auto-populate when you create a new hotspot.

aaronhun22

You would use an address group and then add it to the firewall allow list. ip firewall address-list add list="SIP Allowed" address=sip-address ip firewall filter add chain=forward src-address-list="SIP Allowed" action=accept dst-address=sip-network ip firewall filter add chain=fo...

aaronhun22

If they don't have a license then they'll reboot. You'll have to reinstall to fix and then install your license.

aaronhun22

You could put them into different broadcast domains using VLANs if your switch will support it. Without a managed switch there really is no solution.

aaronhun22

You need to do an update to get those commands.

aaronhun22

Winbox can connect to the router if using the MAC address under the router no matter what the IP is set to.

aaronhun22

Reply from fe80::1845:e662:a9b7:70ac%38: time=1ms This is an IPv6 address better known as a Unicast address. In IPv4 they look like 169.254.x.x and are called local-link addresses. Its what happens when an interface doesn't receive an IP. As for the non-authoritative answer I don't believe the Rout...

aaronhun22

Try deleting the other wireless network. I've seen this before on a laptop. It wouldn't go away until I removed the other wireless network.

aaronhun22

What is your export?

aaronhun22

Do you have static routes setup? Try pinging from the router to the LAN server.

aaronhun22

http://forum.mikrotik.com/viewtopic.php?f=14&t=39275

aaronhun22

Yes, the 751 can act as an AP bridge. All you have to do is connect into any of ports 2-5, turn off dhcp, and set the SSID the same but on a different wireless channel.

aaronhun22

From what I can see you have your WAN port in your Bridge which it shouldn't be. All you need is 1 masquerading rule on the WAN interface and remove it from the bridge. Then put your dhcp-client on the WAN as well.

aaronhun22

interface ethernet set interface l2mtu=

aaronhun22

You can set the MTU on the router that way you don't have to configure every device.

aaronhun22

What is your export?

aaronhun22

I've used Cisco for years and when we came across Mikrotik it really was a no-brainer for us. The tools available in the interface alone made it worth switching and we've found that deployments are quicker too thanks to the simplicity of the interface. Just because Cisco is a big name doesn't mean t...

aaronhun22

On your Mikrotik router get the export.

aaronhun22

From your config it looks like this is your controlled LAN? Wouldn't it be easier to just bond the two interfaces then to use mangle rules? If you apply 802.3ad (LACP) to both sides it will make 1 solid link between the two sides as well as fail over.

aaronhun22

In the command prompt type:

/export compact

aaronhun22

What is your Mikrotik export?

aaronhun22

Sorry, proxy-arp has to go on an interface or a bridge. Try setting it on the bridge your connected to.

interface bridge set arp=proxy-arp

aaronhun22

I've never used that option when setting up the PPTP service in Mikrotik but here is the page that explains the what they're for:

http://wiki.mikrotik.com/wiki/Manual:PPP_AAA

What you're looking for is under "User Database /ppp secret".

aaronhun22

No, they're in a different broadcast domain and MAC addresses will not flow from domain 10.0.10.0 to 10.0.0.0. You need to create 2 hotspots or bridge the 2 networks.

aaronhun22

It sounds like you're behind a NATed connection that's running more than 1 internet connection. What is the WAN IP that your router was given?

aaronhun22

Try setting proxy-arp on your pptp-client interface. When I setup PPTP servers on Mikrotik I have to enable the proxy-arp on the routers bridge so that clients can reach devices other than the router.

aaronhun22

You can use SPI on new connections with: /ip firewall filter add chain=forward in-interface=ether1-gateway src-address-list="SIP Hacker" action=drop /ip firewall filter add chain=forward protocol=udp dst-port=5060 connection-state=new src-address-list="SIP Trial" in-interface=eth...

aaronhun22

What you've proposed will work; you just need to create a second bridge for your internal network. What is the current export for your switch?

aaronhun22

You could do an IP tunnel over IPSec between site A and B and then setup pptp on either site A or B for the road warrior. Even Dynamic Public IP's won't change often and when they do you just put in the new address and everything reconnects. With PPTP guide: http://wiki.mikrotik.com/wiki/PPTPServer ...

aaronhun22

What is the webmin port set to; if its port 80 then that's your problem?

ip service print

aaronhun22

Did you set the gateway address for 0.0.0.0/0 network? If so what is your printout?

aaronhun22

The 951G-2HnD has a built in switch with ports 2-5 already bridged as the default.

aaronhun22

When playing with the interfaces use winbox and connect using the MAC address or leave your WAN2 interface disabled until you're done making changes to the mangle rules.

aaronhun22

You can assign IP Addresses based on MAC with DHCP.

aaronhun22

If you're talking about splitting your tx/rx so that all tx are on one connection and rx on another this can't be done with two different internet connections because all packets returning to the internet must be marked with the same source address as the destination address they came in on. You can...

aaronhun22

What is your firewall printout?

aaronhun22

First you need to remove the routes you have and add this: ip route add dst-address=0.0.0.0/0 gateway=12.32.121.161 distance=1 Then remove your masquerade rules and the source nat rule for 12.32.121.170 and add: add action=masquerade chain=srcnat out-interface=ether1 And remove address 12.32.121.165...

aaronhun22

Yes, plug the unmanaged switch and managed switches into ports 2 and 3. The example you've given is the same but the unifis are on bridged connections which is fine for them to reach your controller on vlan1. But vlan20 shouldn't be on a bridged connection so that you can filter traffic from reachin...

aaronhun22

Yes, set trunking on the APs and MT. Make sure to remove nat from ip firewall nat or don't plug the switches into ether1. interface vlan add vlan-id=20 name=vlan20 interface=ether2-master-local ip address add address=192.168.20.1/24 interface=vlan20 ip pool add name=vlan20 ranges=192.168.20.100-192....

aaronhun22

ip route set numbers='rule number' distance='set high for slow (ie 1 for 10mb and 10 for 2mb)' For torch if you use webmin or winbox under tools you'll find torch and from there select one of the WAN interfaces and click start and you'll see traffic. Also under the interfaces option in webmin or win...

aaronhun22

Create a new master port for port 7 and assign ports 8-24 to it and then masquerade them for NAT based on the LAN and ether1 address. Then if you have a routable subnet from your provider it will route to ports 2-6; otherwise if the address from ether1 is in the same subnet as ports 2-6 then you'll ...

aaronhun22

What is the print-out of your config and the gateway and public IP assigned by your ISP?

aaronhun22

Ha! LOL! I'll bite. What's wrong?

aaronhun22

Which ports are you using because only ports 1-5 are Gb.

aaronhun22

Report back if you're getting an second Wifi adapter in the interface list because I'd like to do what you're doing also.

aaronhun22

You can assign IP addresses based on MAC in your DHCP server and assign that server to the AP only by un-bridging it.

aaronhun22

You can NAT the public IP's to your customers using the answer from this post:

http://forum.mikrotik.com/viewtopic.php?f=2&t=79253

Or you can route the public IP's by sub-netting them on a /30 network.

aaronhun22

As long as both networks route to the same provider you can assign your LAN gateway address with both IP's on eth2. I don't know if having 2,000 IP's in the same broadcast domain will be a problem but what you're proposing will work.

aaronhun22

http://routerboard.com/RB1100AHx2

It's in a table at the bottom of the page.

aaronhun22

Netflix monitors streams based on accounts. I know this because I've watched at my office while 2 tried to watch at my house and my account only supports 2 so the third was given a limit message. I know many WISPs NAT their non-business customers behind 1 public IP so I'm sure Netflix and others are...

aaronhun22

When you have more than 1 default route to the internet or a network you set route costs so that connections with 10mb get used over connections with 2mb. You can do this by setting the Distance in your routes. Also I'm assuming you're load balancing the 3 connections so you could use an nth rule in...

aaronhun22

Set one routerboard wireless as AP Bridge or Station and configure the channel and security profile. Then set the other routerboard as station bridge with the same channel and security profile.

aaronhun22

There is a vlan bug in version 6.6. Revert to 6.5 until they release 6.7 as stated by MT support in post:

http://forum.mikrotik.com/viewtopic.php ... 4&start=58

aaronhun22

No I mean "interface print" should show a second wlan adapter: 0 ether1-gateway ether 1500 1600 4076 1 R ether2-master-local ether 1500 1598 2028 2 R ether3-slave-local ether 1500 1598 2028 3 R ether4-slave-local ether 1500 1598 2028 4 R ether5-slave-local ether 1500 1598 2028 5 R wlan1 wl...

aaronhun22

For L2TP UDP ports 500 and 4500 and protocol ipsec-esp For PPTP TCP port 1723 and protocol gre http://blogs.technet.com/b/rrasblog/archive/2006/06/14/which-ports-to-unblock-for-vpn-traffic-to-pass-through.aspx Once VPN tunnels are established clients will have access to RDP. Now if you want to filte...

aaronhun22

Its a bug in the browser. I've seen it in IE 8.

aaronhun22

As far as I know the USB is for USB HD's to create an SMB or file server. Do you have more than 1 Wifi adapter listed?

aaronhun22

Input and Output are for connections to the router (ie webfig and winbox). Prerouting, Postrouting, and Forward are for connections to the WAN or LAN. You can only load balance connections from the LAN to WAN. Going from WAN to LAN packets must be received and sent from the connection it came on bec...

aaronhun22

Proberbly reffering to this "CONTROLLER (Level 6) $250.00"...

Yeah, that's the one.

aaronhun22

What is your CPU load? Also are you using route costs so that you're surfing out the correct connection?

aaronhun22

It sounds like there isn't anything wrong with the RB1100 and that its dropping packets on purpose for those IP's. Are there any firewall rules in place that are associated with those IP's?

aaronhun22

NAT supersedes Firewall so you need to stop NATing 3389.

aaronhun22

What a wonderful cheat! I never thought of NAT'ing the Public IP.

aaronhun22

I see this available for purchase as a license but does anyone know if its been released?

aaronhun22

This is such a useful post that isn't in the wiki or any tutorial.

aaronhun22

Can you post your configuration for router c?

aaronhun22

Thank you for your reply; it got me to think outside of the box. I found the problem was that the 0.0.0.0/0 was set to only marked routes WAN1 and WAN2 and none for the default main. All started working when I added 2 more 0.0.0.0/0 routes with the default settings.

aaronhun22

The RB951-2n and RB751U-2HnD would work. Or if you want Gigabit RB751G-2HnD (if you can find it) and RB951G-2HnD. One thing to know is Routerboard doesn't use 802.3af for PoE; it uses passive PoE.

aaronhun22

I tried this as well with the same result. I was only able to get it to work over non-bridged connections.

aaronhun22

UDP ports 500 and 4500 and protocol ipsec-esp

aaronhun22

http://wiki.mikrotik.com/wiki/Hairpin_NAT has an example you could use. Instead of using dst-address use in-interface like Rudios suggested. Also you could use DNS entries on your router to resolve to the internal address of your servers instead of the Hairpin NAT.

aaronhun22

So I setup load balancing on my RB751U-2HnD and it works great but I can't get external access to the router to work. I'm sure its replying to request from the wrong interface but I can't see why. From the router itself I can ping out successfully but pinging to the router externally or ssh, winbox,...

Search found 97 matches