MikroTik

nichky

I've not had chance to look into as yet.

@tdw

Three point basket.

vlan-filtering with BCP works well.
Just tested on v718.
Not sure how come i missed that at change log

nichky

did u disable sip 5060/5061 at Service-Port?

nichky

nice one

nichky

why OVPN-Client doesn't show remote address?

also , probably we need one parameter at the client site, to tell us whether we are running tun or tap.

nichky

v7.18 , still not fixed

nichky

@loloski

sorry for late reply

/routing/settings/set dynamic-in-chain=""

[/quote]

i asked for undo, but it seems like that i have to use for now, till MikroTik fix it.
Not sure where this can be used for.

nichky

it seems that i have to use for now.

Probably that will be fix in the next versions.

That is really fresh one

nichky

didnt help

nichky

[rchan@Home] > /routing/settings/set dynamic-in-chain="dynamic-in" [rchan@Home] > /routing filter rule add chain=dynamic-in disabled=no rule="set comment \"test\"; accept;" how to undo this? i was playing around , and i want to bring it to how it was, without /routing ...

nichky

does bgp vpls signaling work over route-reflector ?

nichky

@MikroTik

i have one request Can the new feature random-source-port be moved ar the server (l2tp-server)?

That is really what we need, so we can get multiple VPNs, win & phones, ect.

nichky

@savage

So not quite sure here whether it is, or isn't hardware offloaded :-)

What is the model of that device?

nichky

@adam23450 When will you solve the route leaking problem, or describe in normal how to bypass it? We have a leakage problem between the main array and another VRF, and it still hasn't been fixed. It is not possible to use the microtoken normally, and support responds laconically. Ticket: SUP-175103 ...

nichky

*) cloud - added file-share feature (additional fixes);

does not work properly, from time to time i need to re-add in order to make it works

nichky

@alikemalhalil:

take a look this:

https://help.mikrotik.com/docs/spaces/R ... figuration

nichky

try this maybe:

/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=bridge

nichky

@Amm0

If you don't provide "mtu=" - reset will make all attributes the default value.

even if you specificaties, the command will reset the whole interface

nichky

@anav

even if you specificaties, the command will reset the whole interface

If you don't provide "mtu=" - reset will make all attributes the default value.

[/quote]

nichky

how does that work?

*) log - added option to select TCP or UDP for remote logging;

nichky

according to the log: ESP/Transport 22.22.22.22[4500]->192.168.1.2[4500] , i think that the MT is behind NAT

@sindy will add more

nichky

what are you getting at , /ip/ ipsec/installed-sa , while the connection is trying to establish?

nichky

the flag is c - CONNECT.

what is the output of ip/address/pr ?

nichky

1. The thing is only QR Code from the ip/cloud/ , can create users, which is admin user.
All other created can't do that.

2. The screenshot from my iphone , yes

nichky

@normis
about QR Code from the ip/cloud/ .
Is that limited per user, or we can have it for multiple users, as they have to be admin

nichky

@anav how did you come across to that screenshot?

nichky

@spippan

fyi:

nichky

do we have any update on [SUP-134566]: BGP-VRF V7?

when that feature will be implemented.
It works perfectly fine on v6

nichky

@fischerdouglas, thanks

nichky

we need VRF in to netwatch

nichky

back-to-homes is perfect solution.
I found useful for the phones, however i have some issue with the DNS-Server as that is not reflecting to the clients, so for that one we have to use IKE2 , as there is a feature split-dns/system-dns

nichky

how about 8.8.8.8 or 8.8.4.4?

nichky

does not work for 5ghz

nichky

@burca

just curious, does that help?

/ip ipsec policy add src-address=0.0.0.0/0 dst-address=192.168.88.0/24 action=none place-before=[find where group=FRBD]

nichky

MikroTik Cloud, mynetname is down, Makedonija

pozdrav majstore!

nichky

still down

nichky

VRF's can be tricky as some services might not work on them (as an example DNS is only partially working), and unless really really needed it is better to avoid them.

can you describe more, what do you thing by that

nichky

have u checked tool/traceroute

nichky

ip/firewall/address-list/export file=mylist

to see the it:

drag and drop or

file/ edit "mylist" contents

nichky

there is no feature for that, i get that.
But why is that hard to add it manually?

nichky

*) netwatch - added "ignore-initial-up" and "ignore-initial-down" properties;

what exactly this does?

nichky

about device-mode - install-any-version.
how to get that?

nichky

@sindy

what is the point addign min-prefix=0?

Even if you specificate once you click apply, there is no value, that only makes sense if it is +1, from what i can see.

nichky

@sindy

probably you did , but i want to inform, that i've tested the nat-src rule, works beautiful, well done!!

nichky

@KiwiBloke Totally not agree with you. i don't want to go deep of what is the beneficios VLAN Filtering , as @pcunite has alredy explained. However nowone is forsing you to use VLAN Filtering . You can use the old methode of implemeting vlans, before VLAN Filtering took a place. This is just one e.g...

nichky

@mzrana

just curiosity.
Is there any chance to remove it , and update it to v7.16.1

nichky

removed

nichky

removed

nichky

just to be more specific.

V7 to V6 do not work

v6 to v6 works!
v7 to v7 works!

nichky

does BCP work on v7?

I can confirm that BCP working perfectly fine on v6.

Today i just tested on v7.16. no luck.

nichky

check the change log

What's new in 7.16rc5
*) netwatch - added DNS probe;

nichky

thx @mrx, CLI does the job.

nichky

@mrz

also i'm getting error with the static path

nichky

oh, different than v6

clear, Thanks

nichky

does MPLS-TE works for v7?

What i've noticed that tunnel1( /mpls/traffic-eng/tunnel) does not appear on ip/address, so am not able to assign an ip-address.

im wondering , how that works

nichky

does TE work on v7?

nichky

@markom does anyone force you to use winbox 4?
Still you have options to use winbox 3.
Be honest for some troubleshooting i found easy to work on winbox3, but the new one looks pretty solid

nichky

@loloski You can also take a look what @ sindy recommended . for me, that works very well. vrf<-->main. Link: https://forum.mikrotik.com/viewtopic.php?t=209202 Me personally from now on i'm trying to play with rtab-1 as much as i can. VRF in V7 is different than what we used to do with VRF in v6 ,

nichky

*) ovpn - added VRF support to OVPN server (server menu now supports multiple entries);
This si bing one. Well done

nichky

*) mpls - added fast-path support for VPLS;

is there any flag that we can that this is running?

nichky

one more thing i noticed today.

when login to back-to-home by using the local lan ip-add , and user and pas from the MT.

With that user you can create and share-users, but with the shared user u can only edit, you cant share

nichky

does anyone play with "Disable VPN when home"?

i'm not expecting to work properly as this is experimental features, but that is so useful.

nichky

ip - added max-sessions property for services;

@rextended

how to get into that?

nichky

with what @sindy adviced, do you need /routing rule if at all?

nichky

not sure if anyone noticed, but neighbors on the winbox4 is responding much more quickly than win3

nichky

@normis

I thing that I figured out.

i was trying with facebook messenger.

teams , whatsapp and messages - all working

nichky

how the Share invite link works?

i can see the link, but it doesn't add on that BTH application (mob to mob)

nichky

hosi69

the script doesn't work

nichky

how about if you play with:
port-cost-mode=short

nichky

am i missing something, how to get in to --> *) added command line launch parameters ( WinBox <connect-to> <addresess> <password>);

nichky

take a look here:
viewtopic.php?t=209202

if that didn't help, show us your conf

nichky

@normis,

it is exactly as was in v3

i got what you are saying, but in the v4 i can't see the session with the ip/mac

nichky

add action=change-mss chain=forward new-mss=1380 out-interface=wireguard1 protocol=tcp tcp-flags=syn tcp-mss=1381-65535

that always whining for me

nichky

@normis,

what is the purpose of Workspace.

It doesn't look similar to v3.

nichky

i think that the session doesn't work properly

nichky

@sas2k

there is no way to run BTH on MMIPS.

That is only available on ARM/ARM64/TILE

nichky

that is something new in winbox 4 (see the picture)

The new one looks like.
As the workspace does the same as the older winox, as i can see the sessions??

the features that are missing:
close all the windows
Safe Mode
undo/redo
set master password

nichky

@sindy

on top of your head, in which cases Safe Mode didn't revert back.

nichky

both are guys if you noticed, but for me strict doesn't work

nichky

@optio

just ive tested.

The hotspot (public internet library) is only allowing TCP 443, that why WG is not going to work, as this allowing only UDP.

You was right

nichky

ip ipsec policy/
src-port=1701
dst-port=1701
protocol=udp

Make sure is in transport mode

nichky

the protocol for OVPN is TCP, i'll try with UDP.

What you are saying make sense

nichky

/interface ovpn-server server
set auth=sha1,sha256 certificate=Server cipher=aes128-cbc default-profile=ovpn enabled=\
    yes netmask=22 port=443

nichky

any volotier that want to join ?

nichky

i'll be visiting the site next week, and i'll get some pictures and add here

nichky

nichky

im not asking for a help , all i'm saying is that you can't use WG in any situation.

If the IPS is blocking the ports , and even if you play with 433 that will not help to establish connections. Not sure why is that,

So in this case you have to use OVPN

nichky

@anav

i was waiting you there.

For some reason that will not work.

I've tested today, OVPN does.

i'm connected to public internet(hotspot), where all the ports have been disabled except 443

nichky

wIreguard

depend of the situation.
Regarding the performance - I will alway go with WG, however if the IPS is blocking the ports, then OVPN is better solution, as no one is blocking 443.
One more note, OVPN interface is exactly the same as physical interface (mac-address), capable for vlans.

nichky

logicly you wouldn't be able to resolve from the main table if the DNS is in the vrf.

nichky

was that the whole? You need ospf,rip or static route ,In order to establish vpls. Are you able to ping the loop ip-add.

nichky

@clambert

i think that totally makes sense, since that interface is in the VRF.
At the QoS have you tried to use Targed=VRF_TEST instead?

nichky

need the export file of your routers

nichky

in this config. that you provided, i will be surprise if they can ping each other.

How is the status of the vpls tunnel?

do u have any dynamic/static config?

nichky

can we get export file of both routers?

nichky

basically you need BTH session established on your phone Enabling BTH using the app .--->from the wiki (you know more then me how to do that :)) Once you establish the session on the right site where the three dots are you can see the option Shares , Establishing the session is necessary as that wil...

nichky

@clambert im doing this on 7.15.3 /interface list add name=IL_VRF_TEST /ip vrf add interfaces=IL_VRF_TEST name=VRF_TEST /interface list member add interface=ether1 list=IL_VRF_TEST /ip address add address=10.10.10.1/30 interface=ether1 network=10.10.10.0 > ping 10.10.10.2 vrf=VRF_TEST src-address=10...

nichky

ok , probably i misunderstand.

So to make it works i need to save it to the phone (export) than i need to send to WhatsApp.

i was using Share-invite link , with wasn't working

nichky

when i click share and choice whatsapp for e.g. it's sending it as a like, and if click on that, it goes to the back-to-home wiki (with the config)

nichky

curious to hear more about that.
Can we get more details of the issues that you are experiencing

nichky

@anav

did you find "share" option in the BTH app useful?

i mean i can get the file past in to the New Text Document, and then rename it like wg01.conf.

It doest wokt, as i thign that i need to modificate the share link, but that, that should be more easy

nichky

what exactly ?

nichky

For me that feature was never working, and for some reason i was getting high CPU.

I found very useful with script where i'm pushing the file via ftp

nichky

can they expire?

nichky

that definitely is not supported in v7 (7.15.3)

Did you try playing around with NAT?

nichky

from time to time, im not able to log in to the MT by using winbox, reboot fixed it.
Does anyone aware of that?

nichky

just one simple.
When the interface is managed by CapsMan , when i scan with my phone there is no ssid. If i disabel CapsMan than works.

nichky

@erlinden i have lot of issue with that (new CapsMan) , The SSID sometimes it does work some time is doesn't. Local forwarding - does not exist in the new one In general you need to have lot of knowledge to make CapsMan works. (medium or big network) In other vendors that has been done is few clicks...

nichky

if u want to get to the trouble, then use the new CapsMan

nichky

removed

nichky

ukapirao sam . treba nov topik da otvorim za da ti to posaljem

nichky

@sindy,

ako neshto mi treba da te kontaktiram , mogu da vidim tvoj key, sve ok , ali kako da ti poshaljem to?

nichky

What do u mean by future use?

nichky

at the places where i'm living , i think that this is common around the world, all the public internet (hotspot) such a library and airport are blocking all the ports except 443. OpenVPN, SSTP or ZeroTier in this ase are perfect scenario. l2pt/ipsec is nice and easy to set up,but unuseful in this ca...

nichky

@mrz

i've noticed something.

Let say my lan is in vrf1 and i want to get access to another lan (ping works fine) in vrf2.
I can login by using telnet/ssh, however im not able to log in by using Web-Proxy.

Are you aware of that?

nichky

@sindy

also one more thing i've noticed.

If the public ip-add (server) is in the VRF, the clients wouldn't be able to establish VPN.

On v6 that is working perfectly fine, with one simple rule.

Probably that will be fixed in the next versions

bash volim tvoja slika na profil

nichky

@mrz

i was more wory about accessing from the main to vrf, but Maris already explained.

nichky

@sindy, i things we should stop there. from the support: v6 does not have purely VRFs and they are never really isolated. v7 has completely different implementation which is not a simple extension of policy routing. So most of the hacks of v6 is not going to work. If you want to access resources bet...

nichky

because the phone working if they are in VRF as they have link to the 3cx-Cloud, and if i bring it on to the MAIN table they are losing provisioning

nichky

1- Yes, i can ping from the main table. if i add: dst-address=192.168.88.0/24 gateway=bridge1@vrf1 routing-table=main ,===> i can ping the phone, but no access to the phone dst-address=192.168.88.0/24 gateway=vrf1@vrf1 routing-table=main ,======>i can ping the router itslef 2. Your second magic work...

nichky

this is if the br is in the MAIN table

nichky

this is all i can get.

fyi: i can see request on web-proxy , is something is hitting there

nichky

it has to be like:

dst-address=192.168.88.0/24 routing-table=main gateway=bridge@vrf

otherwise is getting unreachable, but ye even if i add that still i cant get access

nichky

@sindy completely agree in v7 VRF is more strict. Be honest i'm running out of ideas, if u have anything particular please advice. I have raised a ticket with them, probably they have some solutions, at the end of the day that option should available. in v7 between 2 VRFs i found that is very simple...

nichky

just switched over to v6, works perfectly fine when i ad the rules in ip route.

Raised the support ticket

nichky

on v6 that works perfectly fine , by using /ip route rule from above ^

nichky

im able to ping the phones from the main table

VRF1
add distance=1 dst-address=wan-ip routing-table=vrf1 scope=30 \
   

MAIN   
add distance=1 dst-address=192.168.88.0/24 gateway=br-lan@vrf1 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10

nichky

doesn't really matter ,my goal is to get access to the phones.

@sindy - jer imas neka ideja brate?

nichky

good catch.That was due to the editing as i'm using long name for the interfaces

nichky

my topology is simple. lan range 192.168.88.0/24 for the phones - on VRF. WAN link via L2tp. problem is : im not able to get access to the phones (by using web-proxy) as they are on VRF. on v6 i was solving this by using /ip route rule - doest work that on v7.15.2 config: /interface bridge add name=...

nichky

Assuming you are using a third party VPN, add this mangle rule: [i]add action=change-mss chain=forward comment="Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu out-interface=wireguard1 passthrough=yes protocol=tcp tcp-flags=syn[/i] If that mangle doesnt resolve MTU problems ...

nichky

ZeroTier after dis/ena the interface, is keep creating a route.
Has this been reported?

v.7.15.2

nichky

@tangent

i think that i made that works, but i noticed something strange.
The value that you mentioned can stay the same (even if i increase the result will be the same), but i need to push the route staticly , even though i got alreadyto 0.0.0.0/0

nichky

on the FW i can see that is scanning,but it doesn't show me the ports

chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 address-list=port_scan address-list-timeout=1d in-interface-list=WAN log=no 
      log-prefix="

nichky

that works but i would say half.

see my e.g.

10.0.1.3 is next hop

nichky

This is probably a bug,

The clients are getting an ip from 20.0/24, and it works perfectly fine.
Just from this router, where the interfaces are in VRF, im not able to ping the domain name.

The topology is simple.

ISP--->R20--->LAN

nichky

e.g. from the Router to peer9

nichky

that is because something is not happy.How the ping looks like?

nichky

brother, read above what @rextended adviced.

No one is willing to write a complicated script something if the solution is with one click (already explained)

nichky

thx @Amm0

i'm using LTE6 , and i'm not able to see the gw ip-address, i thought that there is some secret door,but it seems that that there is not.

nichky

how to see the gateway if it doesn't at /ip/route ?

nichky

@TheWeegee

can i get the full concept please.

Have the pppoe & the pub ip-address (100.64.1.0) been provided from the same ISP?

nichky

@Mumsel

i'm wondering how did u go with that? with the e.g. above , there have been user public ip address on e2, unlike your case where you have local-ip add, so you have to use NAT anyway.

nichky

ppp-->click on the plus and select binding (l2tp in your case). That is for the server site (not sure how to type that in terminal , probably @mrz can help).

From client site where is creating dynamic interface (potential issues in v6, if you play with vrf) profile -> only-one=yes

nichky

and there is one more tip , use in profile -> only-one=yes

nichky

what is the version?

nichky

i know that OVPN does, and i know tha i can make it manually, but that is not what i'm asking for.

nichky

actually i figured out, but it doesn't work that easy how you are saying.

nichky

@normis

if i go to add share its only sending the BTH web pages, what i'm doing wrong?

nichky

@CGGXANNX

That is reminding me to IPsec--> passive mode.
But back to WG. How about on the WG_Server if i didn't specify the Endpoint (usually set up), is that the seme thing?

Than what is purpose of Responder?

nichky

@anav,

do u know what i'm asking about?

Also i've noticed that with BTH , Responder is enabled by default.

nichky

@anav , while we there. (sorry as i didn't open separate topic)

can you please tell me in which cases can i use the option Responder

I need your e.g. dw about wiki.

nichky

when BG--VRF--def-route can be fixed?

nichky

with other words what mvrp-registrar-state does?

Not sure if i understadse the explanation on the wiki.

nichky

not only that , all of them in this group i've never used like

client address
client endpoint
client keepalive
client listen port.

not sure if there is any point playing with that

nichky

still delivering def-route via VRF doesn't work

nichky

bgp-vpn - use VRF interface as gateway for leaked connected routes

I thing that this is what im after. I will check with my lab.

nichky

@Tom
well done !!

nichky

When redistribute def-route via VRF will be added (on v6 that works perfectly fine).

I've been advised from the support teams that this is still not implemented on v7, but do we know what that will be?

nichky

that is something new in v7, i wasn't aware of that. cool

nichky

https://wiki.mikrotik.com/wiki/Manual:USB_Features

nichky

yes Ofcourse

https://help.mikrotik.com/docs/pages/vi ... eId=328206

nichky

what exactly this does?

is that like load balancing or like redundant options?

nichky

when u post your config try to make it more clear, we do not need to know anything about /ip cloud, /user group , /ip firewall filter ect.

Since u are not reporting about that

nichky

:local nama "$[/system identity get name]"; /system backup save name=$nama; /too fetch address=x.x.x.x src-path="/$nama.backup" user=admin password="" dst="$nama.backup" port=21 mode=ftp upload=yes /export file=$nama; /too fetch address=x.x.x.x src-path="...

nichky

basically to use the correct VRF.

See how it goes, you need some sort rules on /ip/magle or /routing/rule/ in order to reach the Hotspot

nichky

try this: /ip firewall mangle add action=mark-connection chain=prerouting connection-state=new new-connection-mark=hotspot_conn src-address=LAN passthrough=no /ip firewall mangle add action=mark-routing chain=prerouting connection-mark=hotspot_conn \ in-interface=WAN new-routing-hotspot_rout

nichky

do we have any update on that?

nichky

Do u mean winbox u/p?
Use radius.

nichky

has this been above removed from the wiki?

nichky

thanks @holvoetn, good to know that

nichky

btw- on the v7 where is the option local forwarding?

nichky

@Guntis thanks for sharing all that info.

Put this way, CAPsMAN in v7 is double trouble.
Probably you need to make it more simple (with some other vendors that can be done with 2 to 3 clicks).

Me personality, im using CAPsMAN a lot (v6).

I'm not even thinking to move to v7.

nichky

what are u referring to, i got BTH, and i didn't noticed an issue .

Usually i'm using it the main link faile

nichky

*) bgp - added initial vpnv6 support;

waithign to see some e.g. of how that works

nichky

pretty sure that you added this on wrong topic

nichky

the whole point is as LB is allows us to do is one client on ap 1 second on on ap 2. in this case i will have 6 on one ap1 and 6 on the second one

nichky

CAPsMAN config with LB.
reason is, the end user has +16 devices (none MikroTik) and the point to to make 8 devices on AP1 and 8 on AP2

For some reason on the log i can see, the following:
@cap1 rejected, not allowed due to load balancing

any thoughts?

nichky

i'll go through the wiki once again, then probably i'll ask support

nichky

exactly, that is the whole point, specifice secret from specific devices. Doesn't work.

has this been tested on your end?

nichky

it seems that romon works with the first secret specificated.

In case if i have second one ,that doesn't work.

What is pont for the option that we can specificate more than one secrets?

nichky

What is NetBEUI ?

Very poor info

nichky

I got the same.
My advice is;
- search for specific subnet, (by using Y next to the comment), or
- user terminal

nichky

@mrz

this is the plan for v7.15?

/ip route
add dst-address=10.11.0.0/24 gateway=vrfTest1@vrfTest1 routing-table=vrfTest2
add dst-address=10.12.0.0/24 gateway=vrfTest2@vrfTest2 routing-table=vrfTest1

nichky

as long as u have def-route provided by ospf , will do redundancy. but your topology is not designed for that.
How about if R2 die?

nichky

why i cant see the following rule on my firewall?
I got BTH enabled on v7.14

ip/firewall/filter/print
0 D ;;; back-to-home-vpn
chain=forward action=drop src-address-list=back-to-home-lan-restricted-peers out-interface-list=LAN

nichky

Can BGP-VPLS has staic name? (even if disconection happen)

nichky

VPNv4 works perfectly fine on v7

nichky

without adding a static route, can u ping the other end?

nichky

@massinia

how did u get access there ?
is that similar way as SMB?

nichky

i'm confused with that feature. e.g. once u establish pppoe- client automatically is ading in to vrf interface even though it is in to the main table.

Didnt check with dhcp-client , but im predy sure that is behavior the same

nichky

clear we can see those two interfaces are in to the main table as they have +.
So your VRF is not working that for sure.

nichky

why is that

/interface vlan
add interface="SL LACP" name=slc-VIC vlan-id=161

/interface bridge vlan
add bridge=bridge1 tagged=slc-VIC untagged=bridge1 vlan-ids=2,8

nichky

@normis

what do u mean that he has removed all the posts?

nichky

@mrz
can U advice please?

nichky

@emilst

What issue are you referring to? Do you have a support ticket already open for this issue?

support #[SUP-138649]:

nichky

also ovpn between MTs is extremely unstable, unlike MT-->win

nichky

the LTE still no fixed!

nichky

that will be nice

nichky

statically

nichky

Can you please clarify exactly what you mean ?

the LTE usb 4g dongles , since v7.13 are not working.
I've raised a ticket, and i've been advised that on v7.14 stable probably will be fixed.

(im using that fro BTH)

Search found 1588 matches