MikroTik

andrace

Hi all!!! Please advise me. Some time ago I setup a webproxy for publish websites, before was one netmap nat rule and all worked fine, but an activated webproxy rule, make a huge load on a cpu of the mirkotik 100%, because it handle many connections, and I cant avoid this via general rules, is it po...

andrace

Yes. I missed your post

andrace

Answer :

IPSEC has highest priority than any other tunnels, ignoring main routing table

andrace

Ok, thanks to all and to pe1chl separetly!!!
But as says one of minders, all genious is simple/ And in my case I just should used a l2tp with ipsec instead a clean ipsec )))))

andrace

Thanks for your help, it is more cleary. A main problem is a dynamic ip and one thing which I can use now, on my view point -it is ipsec. Or may you advice something else?

andrace

......ok. if I right understood it means that if I set a metric 20 to the default route and on other hand I set a metric 10 to ipip route , the traffic go via ipip, is it right?

andrace

i suppose your ipsec tunnel goes to wan interface - YES i suppose your wan interface has a default route - YES because that if the ipip tunnel has a more specific route than default the traffic will go for it - BUT NO!!! It is my headache, time to time routeros forwarding the traffic choosing random...

andrace

What happening? Nobody knows?!!

andrace

How the RouterOS decides, where to forward a traffic if exists two connections into a one private subnet via an ipip and via a ipsec.

andrace

How the RouterOS decides, where to forward a traffic if exists two connections into a one subnet via an ipip and via a ipsec. ?

andrace

And yes, I need a direct communication between private networks

andrace

In this case I don't see a big difference between the ipip and the eoip connection. Main question is if in the same time works bonding and ipsec ( in the shown case via 3g modem ) , what of these connections will get a highest priority ? On the branch side, obviously I have two routes (via bonding-b...

andrace

How to implement a failover using ISP2-Branch and do not use a scripts

andrace

At the moment. HQ [ ISP1-HQ + ISP1-Branch ] - EoIP1-hq [ ISP2-HQ + ISP1-Branch ] - EoIP2-hq [ EoIP1-hq + EoIP2-hq ] - Bonding hq Branch [ ISP1-Branch + ISP1-HQ ] - EoIP1-branch [ ISP1-Branch + ISP2-HQ ] - EoIP2-branch [ EoIP1-branch + EoIP2-branch ] - Bonding branch All works excelent !!!! BUT, if I...

andrace

[img]Problem.jpg[/img]

Scheme of networks

andrace

Bump

Help! I need sombody
Help! Not just anybody
Help! You know I need someone
Heeelp

andrace

Ok. This is what I want. I have a HQ with two ISPs(public ip addresses ) and I have a branch with one ISP ( cable and a public ip address ) and second ISP ( 3g modem and a DYNAMIC ip assress ) for a reserve. I want that the branch, if no connect via the main connection ( cable ) switch to 3g modem. ...

andrace

Please help

andrace

If I have one route using IPIP interface to 192.168.0.0/16 subnet and second route using IPSec to 192.168.0.0/16. Which of route will be highest priority if metrics the same for both? And in this case what should I do If general route has a metric : the least number - that the high priority on other...

andrace

andrace

Hi all manual (http://wiki.mikrotik.com/wiki/Manual:IP/IPsec) tell that a priority - Policy ordering classificator (signed integer). Larger number means higher priority. Is it correct, considering than the general behaviour of priority is oppositely ? And next question? What kind a connection has a ...

andrace

It is not so hard, I gave you some karma. ))))

andrace

Thanks to All
Yes it is right. An ISP blocked the port on 15 minutes if outgoing connections more than their limit. )))

andrace

Hi
mikrotik ccr1016-12g

can't access to external smtp servers.

After two month of properly work and upgrade to 6.31.2 I have no more aceess to external smtp servers (outgoing 25 port)

Who can help me, where to send "supout.rif" file?

andrace

I have two ISP one on 1st port and second on 2d port I want to achieve next goals 1. pptp server on the 1st interface with a radius 2 pptp server on the 2d port with a different radius At the moment both authentication methods work on both ports at the same time. Also I want to achieve that a first ...

andrace

I have two ISP one on 1st port and second on 2d port I want to achieve next goals 1. pptp server on the 1st interface with a radius 2 pptp server on the 2d port with a different radius At the moment both authentication methods work on both ports at the same time. Also I want to achieve that a first ...

andrace

How can I bind pptp-server to a specific incoming interface?

What should I do if I want to up two different ( authentication service ) pptp-servers on the mikrotik

andrace

Also using private ip's all working well

andrace

Hi all. Can you help me. I created IPIP w/IPSEC between two mikrotik. And I have a problem with connection to a public ip of second mikrotik behind a first. I can connect via ssh, but in sevral seconds a console freezing. I can connect via winbox but when opened a miktorik gui all window is blank an...

andrace

The same problem, after an upgrade to 6.30.1 and 6.30.2 ,an address 0.0.0.0 no working

andrace

How to forward the "toll fetch" into a ipsec or a vpn tunnel?

andrace

is anybody resolved this ?

andrace

unfortunately magchiel, your advise didn't help : - ( but anyway thanks for your reply

andrace

If I correct understood action must be "accept", is it right? If yes, then I can't understand why it is not working

andrace

But I had such rule and I added another one 0 chain=srcnat action=accept src-address=192.168.111.0/24 dst-address=192.168.0.0/16 log=no log-prefix="111______" 1 chain=srcnat action=accept src-address=192.168.0.0/16 dst-address=192.168.111.0/24 log=no log-prefix="112__" but it is ...

andrace

The problem solved. ( incorrect rules on the dfl side )

andrace

Can me somebody explain, why when I made an ipsec channel between lans, on one side i getting all connections from a remote lan with the same ip for all clients? I suspect that a nat rule working, but how I can get clients original ip addresess?

andrace

The problem is still here

andrace

andrace

found no solution till this time. Anybody can make another advise how to resolve this issue

andrace

Before was the DFL instead the mikrotik and all worked. But after replacement not working only ICMP, all other traffic passing correctly. I can't understand where I need to dig/

andrace

Hi all. Please advise me. I have such scheme : [192.168.250.0/23]--------[10.10.0.0/24(DFL800)]---IPSEC-----[192.168.75.0/24(Mikrotik)] I made an ipsec channel between dfl800 and mikrotik but have a little problem All working excluding an icmp traffic from 192.168.250.0/23 and 10.10.0.0/24 to 192.16...

Search found 42 matches