MikroTik

nxs02

device that connected to the same switch can communicate each other, nothing u can do about that

nxs02

keep up the good work guys

nxs02

and also u need forwarding option to disable in wireless interface

nxs02

i am connecting via wireless to my CRS (RoS 6.35), open winbox and click Safe Mode. than i do disable the interface wlan1 and surely i got disconnected with my CRS. after long waiting (about 15 minutes), the wlan1 stay disable and i have to connect with cable to enable it again. Q: how actually the...

nxs02

reset it?

nxs02

check ur forward chain in firewall rules?

nxs02

try to connect to it with ip address
doesnt matter if its not shown in neigbourhood list, u still can connect to it with ip address

nxs02

press the reset button before turn it on, after u press it then turn it on and after 20s release the reset button

nxs02

Just upgraded my RB951 to this version... looks good...

Edited:
System >> Health in RB951 looks weird http://www.tiikoni.com/tis/view/?id=7143c0b

nxs02

what u need is blocking with address list and yes u can block it until 14 days

nxs02

back it up first then reset it

nxs02

u need to accept in forward chain communication between that 2 subnet

nxs02

Two things jump out at me reading your rule- actually three: 1: you used the input chain. Input only refers to traffic to the Mikrotik itself. FORWARD blocks traffic going THROUGH the router. 2: if you reject ICMP with an ICMP message - what's the point? ;) Probably you mean drop... And most import...

nxs02

hi guys i have a problem i cant do any changes in mikrotik because idid my user "admin" with limited power please help me

reset ur mikrotik?

nxs02

as i was said its very difficult to trace who sending it and what add they aiming for

nxs02

after u click upgrade, u need to reboot the router

nxs02

to simplify what u need to choose from is MT that can handle bandwidth u will use

nxs02

ppp -> pppoe client is place to make pppoe dialer

nxs02

simple use different network on ether5, then drop communication between server and local network in firewall forward chain. first check is ether5 not to slave - in default config ether2 is master on ether3-5 yup im agree with him, use different network, then use forward chain drop in firewall rules

nxs02

fasttrack?

nxs02

1. wireless repeater
2. u can set ur password in wireless security profile

nxs02

Table shows the throughput through the router. Not output /input traffic from the routers point of view.
Exactly , is there any way to calculate what maximum link one RB can handle

afaik it depend on RB's processor and RAM and i dont know if there is a way to calculate it

nxs02

bridge?

nxs02

wondering why u not adding default drop in last line
Of course then it will no longer work!
It needs at least a rule to match new traffic in that case.

yeah, im forgot it.
he need accept traffic from LAN and forward it to GW and drop the rest

nxs02

wondering why u not adding default drop in last line

nxs02 · Re: winbox 2.2.14 hhhmmm... someone bump an old topic

hhhmmm... someone bump an old topic

nxs02

accept each interface to IpPublic and drop the rest? or u can use horizon bridge

nxs02

imo using RB951ui-2hnd with having total bandwidth more than 5Mbps will slow down ur router

nxs02

Bridge horizon, bridge firewall, and other layer2 (ethernet in this case) technologies are required to do what you want because inside of a given subnet, the hosts can just talk directly to each other without using the router. That being the case, an IP firewall cannot stop hosts in the subnet from...

nxs02

why not using simple queue with pcq?

nxs02

im curious if u need that firewall filter, imo as long as u have default forward drop and client isolation than u are fine

nxs02

interesting....

nxs02

afaik u can do that in firewall rules

nxs02

understand now the need of default drop

nxs02

Hello Guys 1- I install Dude 3.6 on my Windows 8.1 2- I add my 8 port Huawei switch, Local host, and Google(8.8.8.8) Question- I did not ping any devices, trace root not shown, I join all the devices viva Ethernet link, Ping not shown, Telnet is not working etc. Can anyone please help me out that w...

nxs02

the interesting was before 6.35 version come out in my router fasttrack is sometimes work and sometimes not (most the time is not workin) but after i update it to 6.35 the fastrack feature is always work

nxs02

afaik in serial no format is represent the manufacture date but only mikrotik the one who know how to read it

nxs02

yup most people not aware that even with default drop in input chan, if they check allow remote dns request then port 53 will opening its door from outside DNS access and they need to close it from wan side access to secure it.

nxs02

its supposed ether1 isnt in the bridge and also u can access the modem with Firewall (if u are using default forward drop) and NAT rules

nxs02

keep up the good work guys

nxs02

First of all you need to distinguish what are the good and what are the bad senders. What idea do you have? If you believe the list of the bad addresses is finite, then you can easily drop all traffic from them by one rule in forward chain. But I am sure there will be new and new abusing ip address...

nxs02

what about only accept certain ip in port 25 and drop the rest

nxs02

anyone know what need to be set in wireless security profile in general tab and radius tab? topic of interest to me. As far as I could understand usermanager not support eap . Will it be supported? Unclear. Workaround to install openwrt+freeradius -> metarouter how about wap2 for Radius + UserManag...

nxs02

yes u can do that in firewall rules

nxs02

they key is radius + hotspot + usermanager

nxs02

Thanks for the reply, I have updated the Router OS to 6.34.4 but in the /system/routerboard the factory firmware, current firmware and upgrade firmware are all showing 3.27

then it means at the moment there is no new update for firmware

nxs02

based on my experience, its very difficult to trace who sending it and what add they aiming for

nxs02

so ether2 is ur inbound traffic from ur ISP to ur router? but why not using ur ether1 interface?
im curious too what packet is that. based on my experience, its very difficult to trace who sending it and what add they arping it.

nxs02

anyone know what need to be set in wireless security profile in general tab and radius tab?

nxs02

Anyone know detail tutorial article about integration and configuration Radius + User Manager for authentication wireless client (just for Home use)?

thanks before.

nxs02

default drop in input and forward chain?

nxs02

or use the bridge horizon feature...
I like this feature quite a bit myself - for a simple client isolation configuration, it's very useful.

simple, useful, and very powerful

nxs02

What about using the bridge horizon to disable the communication between selected bridge ports in the similar way like disabled default forward does it for wifi clients?

yes its work...

nxs02

or use the bridge horizon feature...

nxs02

Assume your hotspot gateway is 192.168.88.1 you should allow your clients to communicate with their gateway with this 2 rules : add chain=forward dst-address=192.168.88.1 src-address=192.168.88.0/24 add chain=forward dst-address=192.168.88.0/24 src-address=192.168.88.1 then drop every packets in sa...

nxs02

bridge horizon also usefull for ports and client isolation

nxs02

what he mean is forward chain drop src 192.168.88.0/24 dst 192.168.88.0/24

nxs02

afaik u can limit the rate of packet type (broadcast, multicast, and etc) in bridge filter

nxs02

what u mean cain and abel?
im confused in here...

nxs02

What's new in firmware v3.32 ?
Changelog is now to v3.31:
http://wiki.mikrotik.com/wiki/RouterBOOT_changelog

yes finally...

keep up the good work guys...

nxs02

maybe u should run the torch on ether1 when ether2 network is busy

nxs02

Creativity at its finest

nxs02

connect to router via mac add isnt the safe way right from security pov?

nxs02

Well NAND is not completely failed it just have some bad blocks (which are marked after reinstallation with netinstall). It is important that ROS 5.26 does behave normally now. The main problem is coming from fact that this procedure with netinstall, in order to be successful, made me to format NAN...

nxs02

Youtube have all changed to https making it impossible to do this today. The proponents of https like what they have accomplished: impossible for men-in-the-middle to influence the handling of their traffic. Of course it is shortsighted, because this now causes operational problems in the networks t...

nxs02

firmware release notes is in http://wiki.mikrotik.com/wiki/RouterBOOT_changelog
but they not update it yet...

nxs02

Are there release notes for Firmware 3.32 ?

nxs02

nice...
keep the good work...

nxs02

export ur router conf

nxs02

What is Burst mean in Limit Bridge Filter Rule?
and is it true set 'Burst' value at least as high as 'Rate' value?

nxs02

1. give each interface ip add or bridge them, depend on what u want
2. on dhcp client
3. layer7 protocols?

nxs02

u need to know how that software connecting to wifi.
exp they use specify port or not, if yes u can block that port
other than that is difficult to block software

nxs02

first try to reset it, if that not successful then try netinstall

nxs02

IMO u need make scheduler script for that purpose.

nxs02

so which is better for peformance? router cpu or switch cpu.

nxs02

u need install the right wireless package?
and wondering why u not prefer to upgrade it through winbox interface than netinstall it

nxs02

apparently changed modulation not solving the problem
the only way i solved this problem is with ping script

nxs02

ip add clone?

nxs02

problem solved when i change the adsl modulation

nxs02

Anyone know why when im not using internet then PPPoE connection in my Mikrotik RB951Ui-2nd will be disconnected

Capture.JPG

but when im back using the internet again then PPPoE connection will be stay stable.

nxs02

lesson to be learned, next time dont forget click that safe mode button

nxs02

Noone aware if Mikrotik/RouterOS is able to limit packets per second (pps) per IP ?

yes ur right, it can...
usually im doin it in bridge firewall filter...
btw anyone know how many packets per second (pps) for counter measure DDoS?

nxs02

interesting

nxs02

If you want to go even further you can even set /32 mask for every client.

how u set /32 mask for every client in mt?

nxs02

add chain=input comment="Allow LAN access to router and Internet" connection-state=new in-interface=bridge-LAN u dont need anyone in LAN have access to router. add chain=forward comment="Allow LAN access to router and Internet" connection-state=new in-interface=bridge-LAN is it ...

nxs02

afaik use discovery interfaces.

nxs02

afaik having too many firewall rules and queues will slow down mt peformances

nxs02

"disconnected, extensive data loss" because the device is too far from MT AP or device battery is too low
for deauth i dont know yet....

nxs02

If input chain says: Allow established,related Allow ICMP Drop in-interface=pppoe1-out (3 rules in that exact order) Then you'll be safely blocking everything from the Internet - including DNS queries- but allowing anything that's a reply for something the Mikrotik requested. Nice and easy. agree w...

nxs02

or u can use horizon bridge feature

nxs02

The same behaviour can be achieved (isolating bridge members from each other) on a bridge by setting horizon values, check that if you are using bridges for your (v)lans.

agree with this...
this is the best way isolating bridge port mebers from each other

nxs02

well im usually looking at log (log for rule that important)

nxs02

default-forwarding=off -> wireless clients cannot communicate with each other

default-forwarding=on -> they can.

nxs02

interesting...

nxs02

google it dude simple queue with pcq

nxs02

u can do that with forward chain in firewall rule

nxs02

but be careful, AFAIK setting up TX power to big will damaging the mikrotik wireless chip

nxs02

IMO dont need drop invalid packet rule because without that rule, in the end invalid packet will get drop by drop/reject the rest rule.

nxs02

agree with this...

nxs02

nice... keep the good work

nxs02

IMO its normal ARP packet but that make weird is it has consumed alot of yours bandwidth

nxs02

can u show me image capture the eth proto when u torch it?

nxs02

how about maybe arp poisoning or arp spoofing

nxs02

what is this mean http://www.tiikoni.com/tis/view/?id=a57b49a
its in IP >> DNS
am i get dns hijacking or maybe some DNS attack?

nxs02

How to use Management Protection key in Access List and Security Profile? and What Management protection use for?

thanks before.

nxs02

already did it (reset wireless config) but not working...
IMO maybe this is happen when wifi client device is too far from MT so client wifi device is trying connect with wifi signal strength that too weak

nxs02

what i mean was signal strength...
i changed it to chan 11 and it solved my problem
so its solved

nxs02

anyone know how to boost wifi signal strength on RB951Ui-2nd?

nxs02

no it didnt have vlan on it

Capture.PNG

nxs02

i check in interfaces >> vlan and there is no vlan

nxs02

here is example that i took from internet (not mine) http://imgur.com/zGAjnuJ that same happened with my RB951Ui-2nd so there is ssid name "Home-2892" and the other ssid "?" with same mac and etc if i change channel and the other ssid "?" will follow what the hell is go...

nxs02

SOLVED

im accidentally block port 53 in firewall rules

thats why internet access in wifi wasnt working as usual

nxs02

my laptop and mobile can connected to wifi RB 951Ui-2nd but the problem is no internet access but when i connect my laptop to mikrotik using LAN cable, i got internet access.
before this problem started, everything is working fine, i can connect through wifi and internet access working fine.

nxs02

i use 104 firewall filter rules in my mikrotik RB951Ui-2nd
its to many or just fine?

nxs02

Im using RB951Ui-2nD and when im using whatsapp in my mobile phone through wifi to mikrotik and its become slow when loading image in group chat or private chat in whatsapp
Anyone had same experience? and how to fix this issue?

nxs02

SOLVED Everyone who is noticing unusual traffic on your router - we have managed to reproduce this issue and we will fix it as soon as possible. The router is checking the ssh key for amazon cloud installation environments, a feature coming later. As a temporary workaround you can use this solution:...

nxs02

SOLVED Everyone who is noticing unusual traffic on your router - we have managed to reproduce this issue and we will fix it as soon as possible. The router is checking the ssh key for amazon cloud installation environments, a feature coming later. As a temporary workaround you can use this solution:...

nxs02

after i was upgraded my mikrotik to 6.33, there is output connection from my public ip add to 169.254.169.254:80
but when i was downgraded my mikrotik to 6.32.3 then that connection is doesnt show up.
even that my internet connection is running like as usual
im just corious what ip address is that?

nxs02

after i upgraded my mikrotik to 6.33 and then in output connection show up a connection IP Add 169.254.169.254:80 from my IP Public Add but if im downgrade my Mikrotik to 6.32.3 then that output connection doesnt show up again even that, my internet connection is worked as usual. im just corious wha...

Search found 119 matches