MikroTik

cavaughan

Guscht, thank you so much! Yep, just had to move the rules to the very beginning of the NAT rules and it worked. So simple....

cavaughan

So I have a block of 5 public IPs. Let's say 173.160.187.9-13 The MK router is on x.9 Now one mail server is at x.10, then next at x.11 Any traffic to x.10 gets NAT-ed over to 10.0.1.13, and for x.11 to 10.0.1.14. All works great! But I need traffic coming out to 10.0.1.13 and 10.0.1.14 to exit thro...

cavaughan

Thanks for that advice. I really thought such rules would better protect our network. I know they sure the router down, but what's more important. I'll start disabling and see how that works.

cavaughan

Code: Select all

cavaughan

After setting up VPN access over Wireguard or L2TP/IPSEC, access to servers over smb, ssh, http(s), rdp, any service that was available on a server within the network was available. Suddenly, now only rdp and ssh work. Oddly enough https to the Mikrotik server on the LAN, of course, works, but http ...

cavaughan

By switching to Channel 8 the speed has dramatically improved to 49 Mbps download.

Spynappels: I listed in my original post the device in question, which is the wifi access point. I also indicated what download speed I'm getting with a wired connection.

cavaughan

Recently we noticed that the wifi in our office has just dropped to a crawl. Doing a speed check using our provider's own speed check tool (which would seemingly choose their closest server) the tool showed about 9 Mbps for download! We should be getting 200 Mbps. Then I directly connected to the sa...

cavaughan

OK, I think it's starting to work!
Thank you SO MUCH TWOFROGS!!!!!!!

How many times did I look at the rules and the 2 never set off an alarm!!!!

cavaughan

I'll delete the 88.0 dst. But yeah, that's exactly what I need to reach from 1.0 network.

OMG! I had 2.0 in there. Now I see. I'm an idiot.....

cavaughan

Here are the rules. You see the 3rd rule I would have hoped allowed anything from the other network. Flags: X - disabled, I - invalid, D - dynamic 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; defconf: accept established,related,untracked chain=input ac...

cavaughan

I then tried disabling src-nat, but that also isn't working.... Wait I'm just masquerading..... I should be doing something else, no? Ok I changed it to: Flags: X - disabled, I - invalid, D - dynamic 0 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface-list=WAN log=no log-prefix=&q...

cavaughan

2frogs! Thank you so much for the reply. On MK2 the NAT config is: Flags: X - disabled, I - invalid, D - dynamic 0 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none But you're saying it should be: Flags: X - disabled, I - invalid, D - dynamic 0 ;;; d...

cavaughan

Here's the routing tables. You see I created the 4th one, but, it no work.... # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 2 ADC 192.168.1.0/24 192.168.1.1 bridge 0 3 ADC 192.168.23.0/24 192.168.23.1 bridge-guests 0 4 AS 192.168.88.0/24 192.168.1.154 2

cavaughan

Probably really messed this up, but it seems like there should be a way to make this work. I wish to note right now that I am having to fix this remotely so a complete reset is not an option. I have a main MK router (MK1), which is the router to the Internet and firewall. It hosts DHCP for internal ...

cavaughan

We have a RB2011UiAS-2HnD as the primary router/firewall for our office. We want to add 2 wifi ap's managed by CAPsMAN. I'm thinking for one point using the RBcAPGi-5acD2nD-US. But I was hoping to use another RB2011UiAS-2HnD, as the other AP because the device that is in that location now (and which...

cavaughan

I have 3 companies using MK routers with VPN's for their clients. Now with people working from home they may be getting taxed, but only 1 is consistently having issues. This only concerns Windows 10 clients, btw. There many posts here about this issue, which comes down to the error: l2tp connection ...

cavaughan

There must be a way to determine what computer is attached to a particular eth port. No? Or at least a MAC or IP address on a particular eth port?

cavaughan

Blocking in raw table? What is that?

cavaughan

Here are the 1st four rules. The rule to block the computer in question is rule No. 3 (counting from 0 - 3), which I put on Drop for Action when wishing to terminate all internet activity. So would I have to basically disable the first rule (as the other 2 are to permit VPN connectivity), then enabl...

cavaughan

Got a question about blocking a computer. On the MK router I have the computer use a static IP and in the firewall I can choose to drop all traffic for that computer. It works for everything except the messaging program Discord. As long as it is open it maintains a connection. HOW?

cavaughan

Thanks for the reply! To be honest, I don't know what is a good and simple protocol for Windows computers. I would never use PPTP, but OpenVPN. But then I only use Linux. But all my clients use Windows, so I need to use a protocol that they can easily set up. I'd really appreciate any input about a ...

cavaughan

Ok, here's another clue. Looking at the firewall and the established connections, I see my devices source address: 192.168.1.10:56126, the dst address: 192.168.1.5:3389, but the TCP State only goes to: syn sent. There is never an awk, I assume. And you can see in the Orig./Repl. Bytes and Packets th...

cavaughan

I've set up PPTP VPN on several MK routers. They all work except for one problem. I need to access the local network hosted by the MK router. Only one of the routers works right. It has to be a firewall issue, as the only major difference is the firewall settings. On the problem routers I was able t...

cavaughan

Thanks! That makes sense, since it would take a while for the "block" to take effect. I never understood why.

cavaughan

The question is: what is the point of the "Block" option.

cavaughan

Under IP > DHCP Server > Leases for a particular client you can check a "Block" option to block access. It used to be that if I wanted to block internet access for a particular device, I would check that box. Now it doesn't seem to do anything. The only way to block internet access was to ...

cavaughan

I have a CRS109-8G-1S-2HnD WiFi modem at 6.42.6 (I'm going to upgrade it here in a second). It's worked great for a few years now, but recently all WiFi connectivity drops. By rebooting it the connectivity is restored. The oddest thing I noticed after rebooting this morning was that the logs stated ...

cavaughan

Ok, I figured it out. The package for Dude was sitting in files and probably installing each time I rebooted all this time. I removed it from Files and now everything is fine.

cavaughan

Yes, that is exactly the version I downloaded, but which the system itself downloaded. Most interesting is the log:

can not install dude-6.39.2: it is not made for mips, but for i386

cavaughan

I have a CRS125-24G-1S-2HnD. It is currently at 6.42.1. I've tried updating it, but it won't take the upgrade. I even downloaded the file, uploaded it to the device, rebooted, but it remains at the same OS. What could be wrong?

cavaughan

OMG! I've been using Mikrotik routers for well over a year now, thought I was always keep them all up-to-date. Today, however, I was poking around on one and noticed a separate section for Firmware updates. I've never done them. Prior to doing this, I just wanted to be sure about any concerns I shou...

cavaughan

Does anyone know whether the cAP devices act as repeaters? It looks like the "cAP ac" device does. But I want to be sure. To be clear I just want to expand the range of my current wifi with a device that would not be physically connected to the primary wifi. It would be working in conjunct...

cavaughan

Lately I've heard a lot about using a VPN/TOR portable router when on the road. Of course one could just set up a VPN on your single computer, but when you're traveling as a family it would make sense to use one of these devices. Just to be sure everyone know what I'm talking about, you can basicall...

cavaughan

Got a CRS125-24G-15-2HnD-IN Could Router Switch. All I really want to use it as right now is as an, let's say, in-house switch, or just a switch. No routing will needed between networks. Another server in the office works as DHCP, so I just need this CRS125 to really be a switch/hub. So far, I've be...

cavaughan

Wondering whether the following can be implemented on a MikroTik wireless device. I want have to have at least 2 wireless networks - one for office personnel with the same ip address subnet as the LAN; and one for guests, which is isolated from the former. I see on the forums talk about wireless iso...

cavaughan

Ok, figured it out.
I just needed to change src-port to dst-port and everything worked!

cavaughan

Ok, figured it out.
I just needed to change src-port to dst-port and everything worked!

cavaughan

Yes, it is an RB750. So are you saying there is no way to access it remotely, or can the firewall rules be manipulated to bypass that default setting. Here is some information about my settings that might help: So here are the results of the commands you asked me to provide. A few things I have remo...

cavaughan

So here are the results of the commands you asked me to provide. A few things I have removed for privacy reasons: /ip service export /ip service set telnet disabled=yes set ftp disabled=yes set ssh port=222 set api disabled=yes /ip firewall filter export /ip firewall filter add chain=input protocol=...

cavaughan

222 was on purpose to help in preventing hacks on port 22.

cavaughan

Well, let's put it this was for ssh, it is listed in the Filter as:

0 ;;; SSH for secure shell
chain=input action=accept protocol=tcp dst-port=222 log=no
log-prefix=""

So wouldn't that be the same?
BTW, note that the 0 means it's in position ZERO.

cavaughan

So, I've set up a new router, enabled ssh and set up PPTP, but am unable to access any the router remotely. I have one other older router that works perfectly and looking at it the only main difference I see is that although it is also set up as a Router, there is a Bridge interface on it. Out of cu...

cavaughan

So, I've set up a new router, enabled ssh and set up PPTP, but am unable to access any the router remotely. I have one other older router that works perfectly and looking at it the only main difference I see is that although it is also set up as a Router, there is a Bridge interface on it. Out of cu...

cavaughan

So, the latter in my understanding of what it should do is not working. I'm watching right now attempted ssh logins, dozens in a row from the same ip all for root. But the rules never applied. Any ideas what's going on?

cavaughan

I added the firewall filters to help prevent bruteforce logins on ssh per the instruction at: http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention_%28FTP_%26_SSH%29 I see continual attempts that trace back to China trying to ssh in, but when I go to: /ip firewall address-list and issue print co...

Search found 45 matches