MikroTik

kamillo

Could you please update https://help.mikrotik.com/docs/display/ ... col+Status.

Thanks

kamillo

+1 - please

kamillo

@normis, can the https://help.mikrotik.com/docs/display/ ... col+Status be updated to reflect any changes in beta4?

kamillo

Im not sure what Mikrotik has done, but look at these numbers with latest ROS7 beta8 on the newly released ccr2004 Over 200 gig duplex against localhost ? They increased MTU size on the loopback interface in 6.47 *) interface - increased loopback interface MTU to 65536; I would guess they did the s...

kamillo

Hi,

CRS125 doesn't support 802.3ad, you can find a bit more info here:
https://wiki.mikrotik.com/wiki/Manual:C ... s#Trunking

kamillo

Cloudflare posted a blog about traffic changes:

https://blog.cloudflare.com/on-the-shou ... t-traffic/

Sent from my MI 8 Pro using Tapatalk

kamillo

10/17/2019 - MikroTik acknowledges and indicates there is no plan to patch in 90 day time frame.

As you can see Mikrotik didn't plan to fix it in the time frame given. Would be interesting to hear why....

kamillo

Never used, but found this:
https://github.com/frap/logstash/blob/m ... s/mikrotik

kamillo

Post your config (in code brakets []) and maybe someone will be able to help you.

kamillo

Not my experience but I remember hearing/ reading something about tweaking DTIM setting on Unifi devices. apparently apple devices prefer DTIM value of 3

Sent from my MI 8 Pro using Tapatalk

kamillo

Lite can be powered with MicroUSB the non Lite version only PoE.
The other difference is in antenna gain 1.5dBi (lite) vs 2dBi.
Also Lite comes with 2 cases where non Lite just one....

Very "practical" differences..

kamillo

7.0b4 is out:
viewtopic.php?f=1&t=152003#p764307

kamillo

Check Mikrotik wiki: https://wiki.mikrotik.com/wiki/Manual:C ... AN_routing

kamillo

no interface queue listed in winbox but present in CLI

- this is already known.
It was mentioned here:
viewtopic.php?f=1&t=153233#p756825

Winbox does not show all features, use CLI for most functionality

kamillo

looks like beta2 is out: https://forum.mikrotik.com/viewtopic.php?f=1&t=152003#p752103 Changes in v7beta2 capsman - improved compatibility between v6 and v7 versions; tr069-client - address support of server CA certificates; winbox - re-added OSPF menu; ppp - fixed "add-default-route" ...

kamillo

For DHCP option try:
https://wiki.mikrotik.com/wiki/Manual:I ... CP_Options

kamillo

Greg Ferro of Packetpusher awarded Marketing Banana award to MicroTik’s Cloud Router Switch https://content.blubrry.com/packetpushers/NB_241_Extreme_Buys_Aerohive_Sloppy_BGP_Plumbing_Causes_Route_Leak.mp3 listen from 32:23 https://packetpushers.net/podcast/network-break-241-extreme-buys-aerohive-slo...

kamillo

You can start here:

https://wiki.mikrotik.com/wiki/Manual:C ... s_switches

https://wiki.mikrotik.com/wiki/Manual:B ... s_switches

kamillo

Not a first mistake like this, you should claim your free MUM ticket.
viewtopic.php?f=21&t=135236&p=666260&hi ... et#p666260

kamillo

Sorry to bump the old thread, has this been implemented?

kamillo

Hi, I don't think anyone will be able to "just help" you with ELK. This is huge topic. Do you have specific problem or just hoping for "how to- step by step" instruction. There is a topic about Splunk and Mikrotik, you may want to check it if looking for inspiration: https://foru...

kamillo

I understand that I will need a guest VLAN, but how can I have two passwords for the same SSID, where each password determines which VLAN the client connects to?
//Nizar

I think this can be achieved with RADIUS authentication.
https://wiki.mikrotik.com/wiki/Manual:RADIUS_Client

kamillo

From the document you posted: Warning: Not all devices with a switch chip are capable of VLAN switching on a hardware level, check the supported features for each switch chip, the compatibility table can be found Here. When you follow the "here" link: You will see that RB4011 doesn't suppo...

kamillo

Hi 2 all! If I'll upgrade mikrotik from 6.42.1 to 6.43.11 with a lot firewall rules, caps-man and vlan created I will get problem that something will not work ?

No one can possibly answer that question. Start with checking changelogs: https://mikrotik.com/download/changelogs

kamillo

Here you will find more some documentation and examples: https://wiki.mikrotik.com/wiki/Manual:TOC

kamillo

Depending on version and edition of Windows they use, you could look into: Delivery optimization https://docs.microsoft.com/en-gb/windows/deployment/update/waas-delivery-optimization There is also something called BranchCache https://docs.microsoft.com/en-gb/windows/deployment/update/waas-branchcach...

kamillo

You can start here:

https://wiki.mikrotik.com/wiki/Manual:C ... s_examples
https://wiki.mikrotik.com/wiki/Manual:C ... ith_Trunks
https://wiki.mikrotik.com/wiki/Manual:S ... r#Firewall

kamillo

https://linitx.com/search.php?keywords=rb4011 says:

Stock expected 7-Dec-2018

kamillo

You don't give too much details to go by...
maybe you should hire consultant: https://mikrotik.com/consultants

kamillo

2 years ago the ROS 7.0 was on alpha 134:

https://mobile.twitter.com/mikrotik_com ... 4195920896

kamillo

Start with Wiki: https://wiki.mikrotik.com/wiki/Manual:I ... forwarding

Have a look at this article as well: https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

kamillo

cdr.pl initial claimed arrival at the mid September then changed that to "Beginning of October". https://linitx.com has date of 16th of October

kamillo

Be aware of the max speeds you can get. Check the below link

https://mikrotik.com/product/RB750Gr3#fndtn-testresults

kamillo

To my understanding it means that traffic will be capped at that speed only if it will have to go through all 25 rules before it is matched. Usually, as the first rule, you would have something to allow all established and related connections. Therefore most of the traffic would be matched by the fi...

kamillo

Check https://mikrotik.com/product/RB3011UiAS ... estresults you will see that RB3011 can do 1Gbps but of course it will depend how you use it.

kamillo

This feature is now only in RuterOS 6.42 RC

*) dhcpv6-server - added DHCPv4 style user options;

https://mikrotik.com/download/changelog ... lease-tree

kamillo

Hi,

Here are some articles about VLANs on CRS125:

https://wiki.mikrotik.com/wiki/Manual:S ... p_Features
https://wiki.mikrotik.com/wiki/Manual:CRS_examples
https://wiki.mikrotik.com/wiki/Manual:C ... ith_Trunks

kamillo

You can try Netinstall to reinstall RouterOS:

https://wiki.mikrotik.com/wiki/Manual:Netinstall

kamillo

Hi, CRS125 has rather weak CPU so it may not handle all the things you want to do. Saying that I'm using CRS125 as my home switch/ router. I have 70Mbps up and 10Mbps Internet connection, whole bunch of firewall rules and for most of the time CPU usage is around 5%. Use switch chip where you can ins...

kamillo

I'm not sure about that, according to "The Register" On a shared system, such as a public cloud server, it is possible, depending on the configuration, for software in a guest virtual machine to drill down into the host machine's physical memory and steal data from other customers' virtual...

kamillo

Admire the spirit, Christmas period and you are releasing new (RC) version. But looking at changes 4 out of 6 are fixes so this sounds more like 6.41.1 not 6.42.

kamillo

Hi,

You could look at same examples on wiki:

https://wiki.mikrotik.com/wiki/Manual:S ... our_Router
https://wiki.mikrotik.com/wiki/Manual:I ... all/Filter

kamillo

Don't use bridges on CRS125. Bridging is done in software therefore uses CPU which is very weak on CRS125. Use switch vlan. https://wiki.mikrotik.com/wiki/Manual:CRS_examples#VLAN The above comment doesn't apply if you are using 6.41RCxx of the RouterOS, they have change how bridges work but this ve...

kamillo

Hi,

Can you show your interfaces, bridges and vlans config?

kamillo

This is probably long shot but can you check what you have in your mikrotik device in ipv6 settings.
There is setting called "ip-forward", this should be set to yes.

https://wiki.mikrotik.com/wiki/Manual:IPv6/Settings

kamillo

Do you have any rules in the firewall? Maybe traffic gets blocked there.

kamillo

Hi, For APs I would go for wAP AC, they can be powered via PoE and they are good looking. Router wise, if he needs at least 8 ports I would say RB2011 or RB3011, depending on a budget and Internet speed connection. They are 2 issues with above routers, RB3011 has got only one PoE out port so you wil...

kamillo

To add to JimmyNyholm's comment: I'm still waiting for LACP hardware support (offload) in CRS125

kamillo

Good staring point: https://wiki.mikrotik.com/wiki/Main_Page

kamillo

You can try to login to console and see what went wrong....

kamillo

There is whole thread RE this: viewtopic.php?f=3&t=104109

kamillo

Not sure how one would do that but maybe this will help: https://wiki.mikrotik.com/wiki/Manual:C ... #Isolation

kamillo

CPU load on my WAP AC is nearly 0%, also 6.40.4 version (managed by CAPSMAN)

kamillo

How to downgrade to an older rc? I cannot find a download-link.

Go to https://mikrotik.com/download

Grab a link to latest RC for your platform and edit url to the version you want.

https://download2.mikrotik.com/routeros/6.41rc38/routeros-mipsbe-6.41rc38.npk

kamillo

On your internal network you can have IPv6 regardless of what your ISP is offering, but you will not be able to communicate to the rest of the world over IPv6.

Other solution is to look at IPv6 tunnel, something like this:
https://tunnelbroker.net/

kamillo

Hi, I would suggest to move your allow, fastrack and related/ established rules to the top of the list, otherwise even already established sessions (trusted) will be checked against bogons lists rules etc. Also consider moving rules which check against bogons list to the raw table more about raw tab...

kamillo

Yes it is possible, if you do something like that:

filter add chain=input src-address=58.218.198.171/32 in-interface=ether1 action=drop log=yes

RouterOS will drop packets from 58.218.198.171 incoming on interface ether1 and will also log an action (you will see an entry in the logs)

kamillo

Try:
https://wiki.mikrotik.com/wiki/Manual:Reset
and/ or:
https://wiki.mikrotik.com/wiki/Manual:Netinstall

and after:

https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

kamillo

Hi, The connections are coming on port ether1 18:30:45 firewall,info input: in:ether1 out:(none), src-mac 58:f3:9c:3d:bb:1a, proto TCP (SYN), 58.218.198.171:60001->myWAN:22, len 60 therefore correct firewall rule should be: filter add chain=input src-address=58.218.198.171/32 in-interface=ether1 act...

kamillo

According to Normis UDP support is coming in v7:

teaser:

Code: Select all

What's new in 7.0 alpha
*) added support for UDP OpenVPN;

viewtopic.php?f=1&t=26499&hilit=Teaser& ... 00#p617477

kamillo

Start with this: https://wiki.mikrotik.com/wiki/Manual:IPv6

You will need to enable IPv6 package first.

kamillo

The RFC (4941) part you are referring to uses world SHOULD so it is not compulsory to have that. Additionally the same RFC says (note world MUST): Devices implementing this specification MUST provide a way for the end user to explicitly enable or disable the use of temporary addresses. So event if t...

kamillo

"Privacy extension" looks like invention for consumer end of the market not enterprise. In enterprise environment you can control your devices and disable "privacy extension". But I agree with above comments. Proper DHCPv6 server implementation would be very welcome addition to R...

kamillo

If you need IPv6 only for internal use set pool to something like: name: "pool name" prefix: fd00:9324:28ac::/64 prefix length: 64 next in IPv6 address list add address ::/64 from pool: "pool name" interface: <your internal network interface> tick: advertise this is quick why to ...

kamillo

If your ISP does not provide IPv6, you can not access Internet over IPv6. IPv4 and IPv6 are different protocols. If you want to use IPv6 to access the Internet you can use IPv6 tunnel. Do some reading to understand IPv6 better, you can start here: https://wiki.mikrotik.com/wiki/Manual:IPv6/Address h...

kamillo

You prefix in the pool is empty you need an address like 2001

:/64 to give it to your clients.

I'm assuming you are aware that if your ISP doesn't support IPv6 you will not be able to brake to the Internet unless you have an IPv6 tunnel like HE (https://tunnelbroker.net/).

kamillo

Ability to specify which interfaces get which subnets assigned to them from a pool of IPv6 space I have not found a way to do this - e.g. if I were to receive a /56 from dhcpv6-pd, it would be nice to say: "MyPool:ff::1/64 -> GuestBridge" If this is doable, I'd love to know how. This is p...

kamillo

As far as I know there is no support for switch based LACP on CRS125, there may be on CSS326 & CRS317 but only on SwitchOS

What's new in v2.1:

*) added support for LACP in CSS326 & CRS317;

But I'm not sure if this is switch based LACP support.

kamillo

Setting egress is not enough. When you switch to "vlan" tab (the first to the left of "eg. vlan tag"- as on the last image you send), what can you see there?

kamillo

You need to configure a port you plugged your AP to as a trunk port for vlan 10, 30 and 40 (I'm assuming this will be a port on one of your 14 switches). Since your vlans are working OK with a cable connection I'm assuming your uplink switch and RB and configured correctly.

kamillo

Hi,

If you get IP of 172.16.10.70 (linux box?) and trying to ping 192.168.0.200 (on of the servers behind vpn?). This sounds like routing/ firewall issue.

kamillo

Hi,

The access point is plugged in to a port on one of the 14 switches, and I have also set the egress VLAN ID's on that port too. (Image 2).

Did you add eth9-meraki... port to relevant VLANs (Vlan tab on your Image 2)?

kamillo

Have you checked:

https://wiki.mikrotik.com/wiki/Manual:CRS_examples
and
https://wiki.mikrotik.com/wiki/Manual:CRS_features ?

kamillo

According to https://forum.mikrotik.com/viewtopic.php?f=21&t=121198&start=100 Version 6.40rc18 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade p...

kamillo

This may be overkill for what you are trying to do but you could setup something like Graylog with NetFlow plugin

https://graylog.org/
https://marketplace.graylog.org/addons/ ... a8e2657c34

kamillo

Is there going to be live stream from the MUM?

kamillo

Telnet uses TCP where SNMP on port 161 is UDP. You will not be able to telnet to 161.

use something like snmpwalk to test SNMP

kamillo

Thanks, for sharing. Good to know

kamillo

From what I remember both methods will work. If you have interfaces without vlan in a trunk and you will configure the trunk with vlans, config will be propagated to individual interfaces. The same goes other way around if you have vlans on individual interfaces and you added them to a trunk, trunk ...

kamillo

Yes, this is how I understand that. Trunking will have better speed on CRS but no LACP. If you want LACP you need to use bonding but this is only supported in software. As far as I know CRS switch chip is capable of handling LACP but this was never implemented in RouterOS. It looks like LACP is supp...

kamillo

Check mikrotik's wiki pages: https://wiki.mikrotik.com/wiki/Manual:Interface/Bonding https://wiki.mikrotik.com/wiki/Manual:CRS_examples#Trunking https://wiki.mikrotik.com/wiki/Manual:CRS_features#Trunking You can use LACP but this will be without hardware support, only software. I'm not sue if CRS12...

kamillo

Mikrotik's implementation of OVPN doesn't support UDP nor compression.

Here you will find more info: https://wiki.mikrotik.com/wiki/Manual:Interface/OVPN

kamillo

Check this: https://serverfault.com/questions/12005 ... te-desktop
RDP uses port 3389 so I'm not sure why are you using 4001?
Another thing could be firewall blocking traffic

kamillo

There is "Address list"
https://wiki.mikrotik.com/wiki/Manual:I ... dress_list

You could use that instead static IP, but you would have to find a way to dynamically add your IP to that list. Maybe with a script?

kamillo

Hi, I use CRS125 as a switch/ router + wAP AC at home and it works for me (ADSL broadband, some firewall rules and no QoS - CPU usage around 5-10%). You need to remember CRS is primary a switch with routing capabilities. You are asking if this will work. It should but depends on your requirements an...

kamillo

Configuration will depend on your hardware. With CRS is better to use switch chip instead bridges

Check:
https://wiki.mikrotik.com/wiki/Manual:Interface/VLAN
https://wiki.mikrotik.com/wiki/Manual:CRS_examples
https://wiki.mikrotik.com/wiki/Manual:CRS_features

kamillo

The CRS125 is primary a switch. It can server as a router but its CPU is to weak to do any serious work. CRS125-24G-1S-IN AR9344 1G all port test Mode Configuration 1518 byte 512 byte 64 byte kpps Mbps kpps Mbps kpps Mbps Bridging none (fast path) 81.0 983.7 232.0 950.3 269.6 138.0 Bridging 25 bridg...

kamillo

Are you sure you don't have something else on the network causing this? Packet storm for example?

kamillo

I have NTP package installed on CRS125 and it is working OK:

          enabled: yes
             mode: unicast
      primary-ntp: 91.189.91.157
    secondary-ntp: 91.189.89.198
  dynamic-servers:
           status: synchronized

kamillo

Firewall?

Also check if ipv6 -> settings -> forward is set to "yes"

https://wiki.mikrotik.com/wiki/Manual:IPv6/Settings

kamillo

http://wiki.mikrotik.com/wiki/Manual:System/Packages

kamillo

CRS125 supports vlans on switch-cpu level. Bridges operate on CPUlevel. CPU is rather weak on CRS125 therefore using bridges could harm performance.

Check:
http://wiki.mikrotik.com/wiki/Manual:CRS_features
http://wiki.mikrotik.com/wiki/Manual:CRS_examples

Best,

kamillo

Hi,

When you say "Inter-vlan" do you mean that you do routing on that box?

What is the CPU usage?

kamillo

Hi,

CRS125 doesn't have hardware support for LACP, you can set it up but all the traffic will go via switch's CPU. Which is counterproductive as the CPU is rather weak.

No sure if this will work but you can try and use "Trunking"
http://wiki.mikrotik.com/wiki/Manual:CR ... s#Trunking

kamillo

I would like to know that too...

kamillo

In regards to CRS317, is LACP support going to be implemented on hardware level?

kamillo

To block traffic to your device you use chain "INPUT" to block traffic passing thorough the device you need use chain "FORWARD" here is a RouterOS wiki page about firewall: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter and here you will find some examples: http://wiki.m...

kamillo

Without looking at your firewall rules it is hard to tell what is wrong. Did you use "forward" chain to block traffic from one interface to another?

kamillo

I would also check where your rule is in the chain (how far down the list), by default I think the rule will be added to the bottom of the list. So if you have a rule above your rule which allows traffic to spotify. traffic will never touch your rule. Rules are stopped processed as soon as first mat...

kamillo

They will have stock in 10 days:

https://linitx.com/product/mikrotik-rou ... -5nd/14762

kamillo

It looks like you are using bridges to do VLANs. This is not as effective as doing VLANs on a switch chip level. Check the link provided by pukkitta: When you add vlans as interfaces you're doing VLAN in software, so this uses the CPU. Is it possible to use hardware VLAN, by using the Switch chip VL...

kamillo

From your logs it looks like you are using DynDNS, this is probably why changing public IP doesn't help.

UDP traffic to/from 5678 is used by MT discovery protocol: http://forum.mikrotik.com/viewtopic.php?t=19812

kamillo

Hi,

Have you checked speed/ duplex on interfaces? Do you have any firewall rules? Are you using bridges? Do the 2 ports belong to the same master port?

kamillo

Doing tests from/ to CRS125 may not be the best way, CPU is rather weak on these devices, try with PC instead CRS125. Not sure about RB3011

kamillo

you are applying drop action on the INPUT chain, so traffic going to the router itself and you are allowing all the traffic to go to anything behind the router. Looking at the ports you are scanning they look like services you would run on a server, not on the router. What I'm trying to say is: shou...

kamillo

For CRS check:

http://wiki.mikrotik.com/wiki/Manual:CRS_examples
http://wiki.mikrotik.com/wiki/Manual:CRS_features

Best

kamillo

So you want to remove the Cisco router from your network and just use CRS125 instead? If this is the case like Paternot said, don't. CPU is too weak. CRS is a switch with limited routing capabilities (hardware wise) If you need router you will be better of by looking at something like RB2011, RB3011...

kamillo

From the info presented I'm under impression that CRS125 is not involved in routing and only acts as a switch. It looks like (cisco ?) 10.254.43.1 acts as a router. Is that correct?

kamillo

by looks of it there is no issues with routing, I would check the router for any blocking policies/ speed policies and also check things like speed/ duplex on the interfaces between CRS125 and router

kamillo

On the bottom of: https://routerboard.com/CRS212-1G-10S-1SplusIN you can find tables with some data what you can expect from the device in terms of throughput.

kamillo

Hi, Not sure if I understood your network layout but... Your trace results: The first one, you doing that from 192.168.203.254 to 10.254.43.37, and all is good right? The second, from 10.254.43.37 to 192.168.203.254, which is opposite direction from what you have done in above example, and this is n...

kamillo

Hi, I have CRS125 at home and never had issues like this. I don't remember my config from top of my head but it looks similar to yours. I think the problem is with a test method. You are sending a loads of traffic to the switch itself. CPU on the switch is to weak to process all the traffic this is ...

kamillo

Hi,

As far as I remember non of MT product has ADSL modem build in. So yes you need another device to connect to he phone line.
PoE in is a "Power over Ethernet" port. It means you can power device via Ethernet cable. https://en.wikipedia.org/wiki/Power_over_Ethernet

Best,

kamillo

Hi, You may want to check http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features as well. Generally if you use switch chip you can get wire speed. If you use bridge your traffic will go via CPU and that will add a load to your CPU, as a result you may not achieve wire speeds In your example RB201...

kamillo

Hi, Just a side note, don't use bridges on CRS. Traffic in bridges goes via CPU and CRS has got only 1Gbps connection between switch chip and CPU. Better to implement vlans on switch chip level Check this: http://wiki.mikrotik.com/wiki/Manual:CRS_examples http://wiki.mikrotik.com/wiki/Manual:CRS_fea...

kamillo

Hi,

To little info to tell.

I looks like you may be getting IPs from the TP-link as it is on 192.168.0.x, double check your vlan/ trunk configuration

kamillo

Hard to say why it is not working without your config, have you checked following:

http://wiki.mikrotik.com/wiki/Manual:CRS_examples
http://wiki.mikrotik.com/wiki/Manual:CRS_features
http://wiki.mikrotik.com/wiki/Manual:Sw ... p_Features

kamillo

I would like to see hardware level support for LACP as well. PoE support would be nice as well

kamillo

Great news with STP on CRS. What I would like to see is hardware support for LACP on CRS, any chance/ time scale for that?

kamillo

Hi, You can have LACP trunk on CRS but I wouldn't do that. The reason for this is LACP tunnel on CRS will use CPU, it is not supported by switch chip.... You can use trunking Check some wiki pages, they should help you: http://wiki.mikrotik.com/wiki/Manual:CRS_examples http://wiki.mikrotik.com/wiki/...

kamillo

If I'm correct, it works this way: you put all interfaces on master port - this works like normal switch. Do the same but with vlans and you can separate traffic. But put some interfaces on on master and some other to other master and you will end up with 2 independent switches (so it would work lik...

kamillo

Since you have dynamic IP address this may be a problem From HE.com web page: https://ipv6.he.net/certification/faq.php My IPv4 endpoint address is dynamic. Can I still create a tunnel? If yes, what do I need to do when my IP address changes? Yes, you can still create a tunnel even if you are using ...

kamillo

7 G 2001:470:25:301::2/64 sit1 no 8 G 2001:470:26:301::1/64 VLAN666 yes I don't understand why do you have the same subnet on 2 different interfaces? Your default IPv6 route sends traffic to 2001:470:26:301::1 so it goes via VLAN666

kamillo

Hi, If you are trying to do 802.3ad, don't. CRS125 doesn't support that in the switch chip, so all the traffic will go via CPU and that will potentially hammer it. Additionally, bond interfaces can't belong to any master ports. Try using trunking instead: http://wiki.mikrotik.com/wiki/Manual:CRS_exa...

kamillo

Hi,

You didn't post your config...

kamillo

The first rule is disabled

disabled=yes

kamillo

There are 2 ways of setting VLANs on CRS devices. One, by using bridges - you will be able to use STP but whole traffic will go via CPU. So you are limited to what CPU can achieve in terms of bandwidth. The other way is to use switch chip and enjoy wire speed but no STP. Here is instruction how to d...

kamillo

If you live in the EU you always can try distributor from different country:

https://linitx.com/product/mikrotik-rou ... -psu/14663
http://cdr.pl/p4905,mikrotik-routerboar ... ac2nd.html

kamillo

This is correct behaviour, traffic matches first rule so it is not processed by other rules.

I'm not Exchange expert but this is not the way to achieve your goal. Maybe something like "Network Load Balancing Services"

kamillo

happy to hear that. You are probably right regarding switch1-chip. I checked my config and it was there but I'm using routing between VLANs. Anyway it is working, great!

kamillo

interface ethernet switch egress-vlan-tag should be used only for trunk ports and switch1-cpu should be included

switch1-cpu should also be included: in /interface ethernet switch vlan

kamillo

Hi, I have CRS with working vlan config. My trunk ports look like that: <interface ethernet switch egress-vlan-tag> print # VLAN-ID TAGGED-PORTS 0 10 bond0 ether17 ether23 switch1-cpu 1 96 bond0 ether17 ether23 switch1-cpu 2 15 bond0 ether23 switch1-cpu 3 2 ether1 switch1-cpu 4 D 4095 So I'm using e...

kamillo

Unoptimized, that is, without fasttrack?

yes, without fasttrack. fasttrack was introduced after I configurer the switch and never bothered to enable it as never had to.

kamillo

Well, somebody posted once that some CPU resources are used for switching, so it would be good for Mikrotik to comment on this.

Yes if you use bridges, no if you use switch chip

kamillo

I have CRS125. It is connected to Cisco ADSL router 15Mbps down and 1Mbps up. I have firewall, OpenVPN and routing between 4 VLANs, no bridges. CPU usage average usage is around 6% with picks to 52%. NATing happens on Cisco but the firewall rules and routing happens on CRS125. This is home usage, wi...

kamillo

Hi,

If you can ping the servers over VPN but can't access other resources (ssh/ http etc) there must be some filter somwhere if not on the router itself maybe servers?

kamillo

It looks like HAP AC will be available in UK around 26/02

https://linitx.com/product/mikrotik-rou ... -psu/14663

kamillo

Bonding does work in the CRS series if the port is routed or bridged and not switched Not sure about that I have CRS with bonding interface where both Ethernet interfaces are switched, with vlan trunk configured. I'm using xor balance Flags: X - disabled, I - invalid # NAME MEMBER-PORTS 0 bond0 eth...

kamillo

After upgrade on CRS125, vlans trunk disappeared from bonded interface.

Easily fixed by adding vlans to the interface but that should not happened.

kamillo

Hi,

Yes you are right, there must be a filter on the 2nd hop. Standard traceroute sends ICMP packets to the destination but it will play around with TTL

more about traceroute on https://en.wikipedia.org/wiki/Traceroute

Rergards,

kamillo

I don't have any experience with this and I'm not sure if it is supported by RouterOS but maybe it will be useful to you:

https://en.wikipedia.org/wiki/Virtual_Extensible_LAN

kamillo

I think easier would be to write some Windows script to check for network status on both nics. If both Ethernet and WiFi are up and belong to the same subnet, disable one or change default GW or do whatever you think is appropriate. You could deploy that with Group Policy.

kamillo

Not quite sure if this is new with 6.33.3 but pretty often the webfig becomes unresponsive and does not react on any clicks anymore. An F5 reload fixes it for a bit until it fails again within a few minutes. I have noticed the same. Before in version 6.32.x I didn't have this issue. I'm using Firef...

kamillo

Hi, I don't understand what are you trying to achieve. vlan20 (on top bridge1) - 10.1.20.1/24 vlan40 (on top bridge1) ether24 - x.x.x.17,18,19,20/29 If I set address on vlan40 i can ping x.x.x.21, so the VLAN is working. I have no control over x.x.x.21. Setting bridge between vlan40 and ether24 is n...

kamillo

Check Wiki: http://wiki.mikrotik.com/wiki/Manual:TOC

kamillo

Hi,

Generally I would avoid using bridges as the traffic will pass thorough CPU. I would use switch chip for that (this is how it works on my CRS switch).

Check:
http://wiki.mikrotik.com/wiki/Manual:CRS_examples#VLAN
http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

kamillo

If you route whole traffic to VPN tunnel, your tunnel itself will try to follow the path and it will go down therefore you will lose connection. What you need to do is to set the routes the way that the tunnel itself uses DSL and the rest of the traffic will go via tunnel.

kamillo

Hi,

The implementation is different.

MT doesn't support UDP nor compression.

You can read more about that on MT wiki pages and there is a topic on the forum with UDP support request.

kamillo

Above solution is Ok just keep in mind that CRS doesn't have powerful CPU and if you bridge interfaces whole traffic will pass through CPU (traffic from bridged interfaces). So keep an eye on the CPU usage

kamillo

The problem is that you have both interfaces (public and private) attached to different master ports. Basically you have isolated the two networks so they are unable to talk to each other despite the fast they use the same ip range. I would suggest assigning different IP range to VPN side and set up...

kamillo

Hi,

I don't understand what do you mean by "my workplace that using PPTP " do you want to configure PPTP VPN or you just telling us that you can connect to your corporate network using PPTP?

kamillo

I would like to see UDP and compression support as well

kamillo

I like the idea

kamillo

Hi,

If I remember correctly, MT doesn't support certificate authentication only user/ password

Check: http://wiki.mikrotik.com/wiki/Manual:Interface/OVPN

kamillo

Do you have firewall configured? Can you ping the same host from any device which is behind the router? Did you try to ping IP or just a hostname?

kamillo

Hi there,

You need to give use little bit more... what is your current configuration? What is your scenario? Where is the problem?

kamillo

Hi,

Try other distributor from EU maybe they will be willing to ship it to Poland
One example from UK:
http://linitx.com/product/mikrotik-rout ... -psu/14396

(30 in stock)

Best

kamillo

I have seen connection restarting like that when username or password was incorrect. Remember that username is case sensitive

Could you post your router configuration for OpenVPN?

kamillo

Hi there, From the config file you posted it looks like you are trying to use compression: # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo try and comment out the line with comp-lzo. As far as I remember OpenVPN on Mikrotik do...

kamillo

Hi,

Picture shows packets with destination x.x.181.1 if this is your router's public IP, you should change chain from forward to input

kamillo

Hi all, I hope someone could point me to right direction on how to solve my problem. I have a CRS125-24G-1S, firmware version 3.15, RouterOS 6.17 I wanted to implement InterVLAN routing and I followed http://wiki.mikrotik.com/wiki/Manual:CRS_examples#InterVLAN_Routing The problem is that on access p...

kamillo

Hi all, I hope someone could point me to right direction on how to solve my problem. I have a CRS125-24G-1S, firmware version 3.12, RouterOS 6.15 I wanted to implement InterVLAN routing and I followed http://wiki.mikrotik.com/wiki/Manual:CRS_examples#InterVLAN_Routing The problem is that on access p...

Search found 162 matches