MikroTik

tlamik

Stupid me tried to install 7.16 and I could not work with putty anymore.
Downgrade to 7.15.3 works nicely for me.
SIgnal is slow, I frequently roamin from 5G to 2.4G and back, but no disconnection like with 7.16

tlamik

My mikrotik is FW and router, I don't understand how I have to setup NAT for internet access from LAN without masquerade all traffic to the internet ?

tlamik

Hello, I stuck on strange problem with mikrotik. I have inet interface with couple of public ipv4 addresses. I started with one address and then I added more. Everything works great until reboot. Mikrotik choose somehow a different IP address to make a masquerade. Can I somehow setup a priority or s...

tlamik

It sounds promising, but not. All my active interfaces have HW-OFFLOAD.

I tried to disable those bad interfaces for 3 seconds and enabled them again and speed is now OK.

I am happy now.

tlamik

Hi, I have CRS326-24G-2S+ in small data center with a few physical server connected to it. On these servers (Proxmox) I have a couple of VM or LXC containers. I noticed some kind of bad network performance while doing NFS backup, on two servers only. So I installed iperf3 and made some tries on VMs,...

tlamik

Well, I did 2 changes, I installed wifi driver from my wifi card's vendor (not M$ drivers) and did setup connect-priority=0/1 and seems to working on my laptop. On others computers I can see they sometimes roamed, but not so often as my laptop, they mostly disconnected/connected. I read that some of...

tlamik

I am strugling with roaming on Mikrotiks. I have five cAP ax, on one of them I setup CAPSMAN, everything seems to work nice. But I noticed from log that only 2 devices doing roaming (Samsung S10 and Samsung S22). So I uncheck WPA3 and used only WPA2 (according to advice). Now all mobile phones doing...

tlamik

I tried to looking in Filter Output, NAT srcnat and output, Mangle postrouting and output and Raw output.

When I start packet sniffer on inet port I can see traffic from 2.2.2.2:22 to 1.1.1.1, that's fine.

But I thought I can see outgoing traffic on firewall chains too.

tlamik

Hi, I am trying to capture traffic from/to a public IP 1.1.1.1 connecting to my Mikrotik FW/Router/NAT to some specific port, let's say 22/TCP, on public IP address 2.2.2.2. Port 22 is forwarded to a local lan IP 192.168.1.5 with the same port. So IP address 1.1.1.1 trying to connect to 2.2.2.2:22/T...

tlamik

I was a little bit scared of that scenario, so I preffered migrate cAP one by one.

As mentioned in previous post, ax3 CAPsMAN manager can not (yet) provision legacy (non-wifiwave2) clients.

That's why I need to move RB951G CAPSMAN to different device before I will replace it with ax3.

tlamik

I just simply want to move all my cAPs from one CAPSMAN to a new one and then remove CAPSMAN on RB951G-2HnD and then replace with ax3. So I don't really need any prioritizing. Since I am using mgmt vlan on all Mikrotiks I always used Discovery interface vlan99, which was not good in my situation. No...

tlamik

Thanks a lot. That was the magic: The field Discovery interfaces must be empty, otherwise it will search by MAC

tlamik

I have configured and working CAPSMAN on RB951G-2HnD, now I want to replace RB951G-2HnD with hap ax3, BUT in winbox there is missing CAPSMAN configuration, however in CLI there is, but only for wifiwave2 (or maybe I misunderstanding that). So I want to move my CAPSMAN to CRS354-48G-4S+2Q+. I simply ...

tlamik

As far as I know there are three ways to do it, or I am using three ways. 1. binary backup/restore - could be tricky even on the same models, but it copy everything including certs, keys, etc... 2. txt export/import - I am using reset configuration -> no default configuration -> run after reset -> c...

tlamik

I know it's binary backup, but I tried it and somehow it works with some manual changes after restore.

As far as I know I have to change MAC addresses, order of LAN ports, wifiwave was not working (of course), but the rest seems OK.

It was a quickest way, IMHO.

tlamik

It's quite simple: /export file=text_backup /import file=text_backup Import has to be monitored and text backup checked for bindings to particular nonexistend interfaces or particular MACs which obviously change when you move from one device to another. BTW which brand allows seamless transfer of c...

tlamik

Well it's very annoying that MT still don't have an easy way to move config from one device to another. I tried to make a backup and restore on the new device and then I changed some stuff and was able to bring it to the live. BUT I was very disapointed with one thing, when the new device seems to w...

tlamik

I want to change my home router/fw/wifi/vpn MT device. I am searching the best way to do it. I tried to make backup from the old MT and restore to the new one.
But there are some issues I have to deal with. Is there any better/preferred/best scenarion howto do it ?

tlamik

Using https://macvendors.com/ I found out the mac address I am getting is from RaspberryPi. I found out one of my collegue placed some RPi which has conflicted IP address with CRS354-48G-4S+2Q+. But it was not so easy to find out what is going on and where is that device and who is responsible for :...

tlamik

Well when I look to winbox neighbors I can see quite different mac address than I can find on my laptop using arp -a

Of course mac address showed in winbox is correct, on my computer is not correct. I am trying to figure it out what mac it is and why.

tlamik

Well, I tried many differrent setups, including removing vlan interfaces dmz and lan from bridge vlan, but none were working. I tried the last suggestion, again remove dmz and lan and ping was not working again. Then I checked firewalls (yes, I used a laptops with W10), on one laptop there was disab...

tlamik

Winbox says Connection refused. Which is weird. No errors in logs, CPU load is fine.

tlamik

I created two vlans on CRS326-24G-2S+ using a new style of creating vlans. Means all ports in the one bridge, created two VLANS interfaces on interface bridge, added an IP addresses to them. I setup appropriate PVID and VLANS with tagged and untagged interfaces. All seems nice. I created two dhcp se...

tlamik

I have three CRS354-48G-4S+2Q+, every of them on its floor. But one of them acts very strange. I cannot connect to it using winbox and IP address, when I connect using mac address, it looks good, but disconnects couple of times. Sometimes I can even connect using IP address, but mostly not. I cannot...

tlamik

I tesed it myself and seems maybe a little faster, I am waiting for my colleagues what they will say about speed and latency and will be report here. edit: winscp copy of iso file over WG seems to twice faster than copy over ipsec. The same is copy of iso file over smb windows share. edit: when I di...

tlamik

UR the GOD !!! That was exactly my problem. I don't expected that ipsec policies will be "eating" my packets, when I disabled peer and peer is not established. Ipsec policies were the same as new added routes and allowed-address in wireguard. This kick was exactly I hardly needed. Many man...

tlamik

I understand, but I am dealing with specific "small part" problem. On the other hand, all my configs are very huge. This instructions seems pretty easy to me https://help.mikrotik.com/docs/display/ROS/WireGuard Rather than posting all my configs, I created a diagram. Subnets are not missin...

tlamik

I just updated 951G-2HnD to FW 7.1.1 at home and at work. I am using ipsec site2site vpn. Works fine. I would like to change to wireguard. I followed many instructions, videos etc. But I stucked in situation that WG connection between home and office works, I am able to ping from home mikrotik to of...

tlamik

Hi, I never noticed that behavior, but maybe it's my fault and it's normal behavior. When I copy some big data from LAN to DMZ or reverse, Mikrotik goes on 100% CPU, which maybe is OK, but also kills some of other connections (apcupsd network clients reports lost connection to UPS master, CAPSman re...

tlamik

The main trouble is 2.4Ghz covers whole building, 5Ghz is not strong enough, practicaly if UR not in room with 5Ghz AP, than the signal is almost useless. So I covered whole building with 2.4 and can not reduce power. Only a few clients using 5GHz cos its coverage is poor. Perhaps the walls are mixe...

tlamik

I have a similar scenario, but with less count of wireless clients (around 30), but the rest is almost the same, about 100 clients/devices in a whole network. 3 SSID, 2 DHCPs, 2 bridges, 3 RBcAPGi-5acD2nD and all is managed by 951G-2HnD with Capsman. All seems working to me, but I noticed that when ...

tlamik

I don't have a modem, I have an ehternet cable, but it doesn't matter. On ether1 is connected internet with public static IP on it. It is temporary connected to another internet connection for testing only, it's not a permanent solution. I don't want to mess up with our main router, so I made a seco...

tlamik

Well, my config is missing a FW rules, cos I don't have any FW issues to deal with. I am dealing with VLAN only. As I wrote I am able to create some FW drop rules to manage "my VLANs", but I thought that VLAN is working independently to FW. So You have absolutely right that my router right...

tlamik

I tried to make my scenario so simple as possible, without CAPSMan, VPN, FW, etc. So I started over with a plain config. So I have main router 951G-2HnD connected to the internet (public static ip) on ether1, ether3 is connected to my LAN (192.168.10.0/24), ether5 si connected to RBcAPGi-5acD2nD, on...

tlamik

Hi, I need build a guest wifi in our company. We have one main router 951G-2HnD with DNS, DHCP server and FW. Now we bought 3x AP RBcAPGi-5acD2nD (they are connected using non manageable switches) I created a virtual WLAN with guest configuration on each AP (on physical WLAN I have a private wifi). ...

tlamik

mostly FW with packet counts or logs or nothing

tlamik

Hello, I noticed some strange behavior of WinBox. I am connecting to MT RB951G-2HnD and from time to time I forgot to close or exit it, so I am connected all day & all night (sometimes even a couple of days). Sometimes I have 1.2GB/day traffic on port 8291/TCP (WinBox), which is huge, but whatev...

tlamik

I am not sure, but I am unable to import a SHA-2 certificate to RB951G-2HnD, it seems to me that MT doesn't support any other ssl certificate except SHA-1, isn't it ?

Will be supported SHA-2 in the future and when ?

Is there some workaround ?

Tlamik

tlamik

on linux with iptables there are these two lines to capture/drop attempts tu use bash weakness: # iptables -A INPUT -m string --algo bm --hex-string '|28 29 20 7B|' -j DROP # ip6tables -A INPUT -m string --algo bm --hex-string '|28 29 20 7B|' -j DROP howto use that lines in MT firewall ? Regards, Tl...

tlamik

v 6.13 not working too

tlamik

Yes, that's it. I spent many nights to find a proper way to clone configuration from one MT to another. If U have the same FW on both of them, it will works. If not then U should manually review Your rsc.
It is a little annoying, but works too.

tlamik

Maybe I not understand good, but :

/ip dhcp-server lease export file=dhcp
/ip firewall nat export file=nat

then

/import file-name=dhcp
/import file-name=nat

tlamik

Sure. As I wrote with v5.26 works, with v6.12 don't.

tlamik

I used Android winbox from time to time in v5.26, but after upgrade to v6.12, I am unable to connect. Can somebody try ?

tlamik

The best way to clone I've already have is : - export compact on device1 - system reset-configuration no-defaults=yes on device2 - login using MAC with winbox - import previous backup from device1 -problem no.1: I am unable to copy files while I am connected through MAC -problem no.2: if during an i...

tlamik

Thanks, I understand, on the same device I can use system backup. I don't understand the second sentence. You wrote that I have to use /system export, but this command will save only settings from /system, which is not enough. I've made a good experience with compact option. I noticed that export wi...

tlamik

I have two production MT and one backup. Both of them are on v5.26. I want to cover these two situations: mismatch or lost configuration, total HW destruction. So there can be a two situations, I will need to restore configuration on the same device or I will need to restore configuration to another...

tlamik

Ok, after netinstall my troubles with system backup are gone. I played with export and import commands whole day and I am little bit confused. I'll create a new topic for that.
I can confirm backup command working now.

tlamik

Thanks, so I decide to use netinstall, I suppose I can load the last v6.12 directly with it. Can I load my script backup after that ? Or do I have to setup everything from the beginning, because I made a script export within v5.16 ? Update: I have 3 the same MT, two of them are production and one of...

tlamik

Diky Jardo za rychlou reakci :) I have MT 951G-2HnD and there is no v6.12. In system -> routerboard - I can see Current FW 3.10 and Upgrade FW 3.08 ??? But in the quick set when I press check for upgrade I can see 5.26, which I have now and its the last FW. I tried to make a script export, which was...

tlamik

It's weird, but when I restore MT using reset button, then I can make a backup. But load of scripts not works for me :( After successfuly reset MT and successfuly create of backups, I load my previously correct backups and make some changes by hand. In every important step I tried to make a backup, ...

tlamik

And then can I try to restore one of my backups ? I am a little bit lazy to configure all my settings again

I suppose that the biggest one will not be ok, the same IMHO the smallest one, but I have a few properly created backups, what do You think ?

tlamik

I have MT 951G-2HnD at home. Very small network, a few network devices, a few firewall rules. Today I changed an internet provider. So I made a few changes in my configuration. My previous backups has about 245KB, after a couple of restarts (incl. factory configuration) backup has 1.3MB!!!. After so...

tlamik

I have some news. I am able to ping from router from both IP's to 8.8.8.8. That's OK. But nobody can't ping from internet to my router's second public IP. When I launch Torch, I can see packet from other public IP to my router, BUT I am unable to see any incoming packets in firewall input, NAT nor m...

tlamik

I thing I have these setting, but no success. I have let's say primary the old one IP with its default GW and mask 24. In linux environment someone tells me when I adding a new IP on the same interface I have to add it with mask 32. So, there should be only one 24 mask on the interface and the rest ...

tlamik

Thanks for reply. It's seems very complicated to me. I am not sure if there are separate devices or not. I get UTP cable and these two public IPs from my provider, don't know what is behind. I want to replace my old iptables linux FW with that MT. I have one physical cable and two different public I...

tlamik

Hi, I'm trying to setup two public IP on one WAN interface (RB951G-2HnD), but works only one. I think there may be a problem with GW or routing, cos each IP is from different subnet and each IP has its own GW. I'm tried setup two public IP from the same rage with the same GW and it works great. I'm ...

Search found 57 matches