MikroTik

Njumaen

Script with interface rx/tx bytes with persistence in file works great for me!

As my SXT (used for backup-WAN ) does not have a port for USB storage, I use sshfs to connect to my main router and attach to its local usb storage to store the file.

Ralf.

Njumaen

Can you please make wireguard's AllowedIPs configuarble???

This below is nice but not the right choice for every situation, especially when you need a split tunnel!

[Peer]
PublicKey = .......
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = .......

Njumaen

Could you please reimplement "Open in new winbox"?

Maybe even as a right-click or shift-click on "Connect" and "Connect to RoMON"?

Njumaen

Hey,

approx 20 users met in hall 6 and we had a good time chatting about the stuff we love so much.

CU @ 39C3 !

Njumaen

Hi, finally I could register a "self organized session" at 38C3 for a Mikrotik User Meetup. Day 4 (Monday 30.12.) / 10:30 / SoS Saal 6 https://events.ccc.de/congress/2024/hub/de/event/njumaen/ Some years ago it was a nice meeting with some of the forum folks! See you there Ralf. P.S. Have ...

Njumaen

Try it and use the best for you.

I use macsec to secure an external cabled wAPax. Easy to configure and fast enough for me.

Ralf.

Njumaen

Hi, I think that it's a common misunderstanding (I had to learn it myself) that the definition of "allowed-address" on the responder side allows any packets from the peer to the responder. This has to be done on the config on the client! I usually set * on the responder: allowed-address= t...

Njumaen

I got one and it works as expected with new capsman!

<3

Njumaen

If you are new to mikrotik I would always start with the default config… But holvoetn is of course right!

just my 2ct

Njumaen

As you use different networks you‘ll have to create a NAT masquerading rule for the wireguard interface. And maybe put the wireguard interface into the LAN interface list.

I use to forget this myself sometimes…

Njumaen

mdns-repeater-ifaces (list of interfaces; Default: )
Once an interface in this list receives an mDNS packet, it will forward it to all other interfaces in this list. Only supports IPv4.

see https://help.mikrotik.com/docs/display/ROS/DNS

Njumaen

/ip/dns/set mdns-repeat-ifaces=bridge,vlan-iot

and I'm happy! Dead simple... Thanks!

Njumaen

You can connect to the hotel
wifi with the one wifi interface an use it as WAN.

Then you can build with it a additional virtual AP…

Using this way for example mikrotik builds a repeater with only one physical wifi interface.

Njumaen

I love the way WB4 evolves.. Please add the link to the Application folder in the .dmg

It's common practice ;-)

Njumaen

Just an idea: ever thought of using EoIP instead of VXLAN?

I have EoIP running over wg-tunnels and I‘m very happy with this! Easy and stable.

Ralf.

Njumaen

You need a „reverse proxy“ to do domain name to ip matching. This is done by nginx for example. „Reverse proxies can inspect HTTP headers, which, for example, allows them to present a single IP address to the Internet while relaying requests to different internal servers based on the URL of the HTTP...

Njumaen

Awesome job so far, but

* font and color scheme are hard to read
* I'm also desperately missing the tabs
* Please add "open in new Winbox" to the Winbox settings, maybe even with a right click

Njumaen

OK. Valid arguments!

Njumaen

True so far in theory, BUT... :-) Checked one of my customers (randomly picked) RB3011 to have a real life example. Within the last 31 days about 80% of the packets on the WAN interface had a size of 1024-1518 bytes with routing speed (up to 25 filter rules) 1306.7 Mbps according to the ethernet tes...

Njumaen

Contrary to the others, I would keep the RB3011 as router and CapsMan for the hapac2...

It's an ARM device with two cores, nice performance (unless you have a gigabit on WAN), enough RAM (1GB), enough flash memory (128MB)...

https://mikrotik.com/product/RB3011UiAS-RM

Give it a try!

Njumaen

I can confirm the issue scanning for a single IP!

Njumaen

Looks very promising!

Install on Proxmox Ubuntu LXC was absolutely easy. Nice GUI. Bugreport will follow...

Ralf.

Njumaen

Shot myself in the foot by using it on the "server" side in a router-router-VPN scanario. Result was that new packets form the "client/caller" passed flawlessly, so I could reach other services in my home lab but new packets from the "server/responder" were dropped! Not...

Njumaen

Have a look at The Dude for network monitoring.

Ralf.

Njumaen

In WinBox WireGuard Peer under Client Settings we need a field for AllowedIPs This is so that the Client QR can be configured to only route traffic for particular IPs to via the tunnel, instead of making it the default route (0.0.0.0/0). Right now I have endpoints scan the code, but then have to ma...

Njumaen

I reduced txpower of my APs in capsman2 and now they are roaming much better!

Njumaen

Try
* adding wg interface to LAN interface list
* adding NAT masquerade rule for wg interface

allways worked for me

Cheers

Njumaen · Re: Wireguard setup Roadwarrior [SOLVED] Try AllowedIPs = 192.168.1.0/24

Try

AllowedIPs = 192.168.1.0/24

Njumaen

I‘ve got a mixed setup: * to one wg-interface approx. 20 external customer devices connecting for configuration (inbound) and * to another wg-interface I have 10 routable subnets (outbound) and * yet another wg-interface for interconnetion of two LTE routers behind CGN All seperated by firewall rule...

Njumaen

I think you can define whatever you want on the client side to do this split-tunneling behavior you mention. What you point out is just a reference. Regards. Sure, I could do it on the client side, but with this additional field I can create a complete config file or QRcode on the server side. Chee...

Njumaen

As I cannot open a new topic I post my request here, in hope to be heard... ;-) Feature Request: Wireguard client config: configurable "AllowedIPs" As 0.0.0.0/0, ::0 is not always the right choice, this should be configurable. Most of the time I do not want to route all traffic through wir...

Njumaen

Wireguard!

Fast, simple (once you got used to it *smile*), stable as bricks

Njumaen

I am missing a small RB on a t-tail…

Would be great for industrial and some home installations

Edit: t-rail of course

Njumaen

At one of my customers I did this by connecting 5 locations to the central location with the VoIP server/PSTN-Gateway using wireguard and EoIP.

Quite simple.

Njumaen

I use port 993 (IMAPS) for VPN.

Njumaen

Of course that is up to your decicion BUT having a mikrotik router as exposed host/router with firewall gives you first time full control over your router and network! (blacklist, scripting, logging, statistics (…) only some to mention) I am doing this for a long time for my own network and the netw...

Njumaen

If the firewall on your Mikrotik is up an running you can enable „exposed host“ on your Fritzbox. Everything (except registed VoIP on the Fritze) will be sent to your mikrotik now! So beware! ;) Therefore you have not to beg for bridge-mode. Caveat: if you have a dualstack you will ony get a /64 fro...

Njumaen

As for the "client-allowed-ips" do you mean the parameter10.155 that will be installed on client device when importing configuration? IPs allowed from remote peer? I do not know the internal parameter references of wireguard but simply generate the line AllowedIPs = out of the List of cli...

Njumaen

I'm missing something in the wireguard client config! Right now, it creates a config with the line [copy does not work with winbox by the way] AllowedIPs = 0.0.0.0/0, ::0 It is great for routing everything through the tunnel, but some people (like me ;) ) might need spilt-tunneling. Please add somet...

Njumaen

I use lots of wg clients under W10/11 and have no issues of that kind at all. Check for correct public key on both sides an d correc allowed IPs.

Njumaen

Had two times the issue that capsman2 stopped working in 24 hours. No wifi interfaces! Needed to reboot via VPN ;)

Downgraded to latest stable.

Njumaen

Hi there,

anybody else desperately waiting for wAP ax to get wifiwave2 outside?

Ralf.

Njumaen

I add the guest interface to the bridge manually and set up the VLAN. It is not a nice solution. If i change anything on CAPSMAN side the name of the slave interface will be changed on the CAP and i have to reboot the CAP to restore the interface name/numbering otherwise the bridge config will be f...

Njumaen

Only reason I'm thinking about CAPsMAN is roaming... but i think i will skip it, to much trouble for 2 AP

Roaming is soooo awesome! I have 3 CAP an CAPsMAN running on my 1100ahx4… Found out: running CAPsMAN on a CAP seems not so to be a bright idea.

Njumaen

7.11 stable could be "the one", no problems so far, everything is working like a charm :D (knock, knock, knock so i don't jinx it) I totally agree BUT did anyone manage to get VLAN Slave interfaces (for guest wifi) up an running via capsman? If I set the VLAN tag in the capsman configurat...

Njumaen

*) wireguard - retry "endpoint-address" DNS query on failed resolve;

Great idea! ;-) Thanks!

Njumaen

Anyone got a dhcp-client up and running on a macsec secured LAN-interface? I always get DHCP offers on the "remote" bridge (see it in the logs) but it never get's the address. EDIT: It's all my fault! I missed setting the MTU of both macsec-interfaces to 1500. Shame on me! ;-) And: still n...

Njumaen

Question 2: Every time i reboot the client peer on WG tunnel, the tunnel doesn't go up automatically. Why is that?

Wireguard is stateless. Tunnel get's active with the first sent package.

Solution: create a scheduled ping to on @startup

Njumaen

You should reduce txpower for 2.4GHz wifi as clients usually connect to the *strongest* signal on the same SSID.

This MUM-Video by Ron Touw is an eye-opener !

https://www.youtube.com/watch?v=JRbAqie1_AM

Njumaen

https://mikrotik.com/client

Create account, login, goto Routeros Keys -> Make a demo key

Njumaen

Just get the x86 install image an burn it on a USB-Stick, boot & install. https://mikrotik.com/download CD image on a CD might work as well. I only used the ISO-file on VM before. But beware: config is blank! No adress, no default firewall, etc. ! Later get a demo-license, Full even later... (se...

Njumaen

On a long-term perspective on power consumption this may is not very wise, I belive…

Just my 2ct…

And you need at least
* 2nd NIC
* RouterOS x86 license

Njumaen

and me.

BTW we need Windows x64 Version, no ARM needed here!

Njumaen

Feature Request: commandline connection to RoMON to see its RoMON Neighbors something like winbox.exe --romon <ip> <user> "<passwd>" should result in showing the RoMON neighbours of <ip> from where further connections could be made. Very useful as tool in The Dude... Or maybe something lik...

Njumaen

Could not live w/o DNS blocker! But have a look at adguard home!

Njumaen

Rename address-list -> import new list -> rename renamed address-list to current address-list -> remove renamed address-list still/only containing the double entries. Does not work for me, supposing I rename address-list by set list="new-name" [find list="old-name"] Renaming sto...

Njumaen

Great idea!

Njumaen

/ip/firewall/address-list/ /ip/firewall/address-list> add list=test address=1.1.1.1 /ip/firewall/address-list> add list=test address=1.1.1.1 failure: already have such entry This results in stopping the import of some well-known address-lists e.g. for blocking. Would be great, if a double entry wou...

Njumaen

I think you should better disable WPA PSK! It‘s from the dark age of WIFI an very insecue.

No client device should use this anymore.

Njumaen

SFP modules are known here for bad performance and unreliability…

I’m using the DrayTek Vigor 165 Modem with my customers. It supports 35b supervectoring mode up to 300Mbit.

Njumaen

Looks promising but I could not get it started on latest PhotonOS (awesome lightweighted Docker VM from VMware).

I will test further releases!

Njumaen

Finally I found the solution.
My problem was in NAT. I had the rule masquarade without any interface.
So I put out Interface my PPPoE Client and everything OK now.

Fixed the issue for me as well!

Thanks

Njumaen

Maybe I found an issue with macsec and DHCP client.

When a macsec-interface is connected to a bridge, the DHCP-client on that bridge does not take the offers from the DHCP-server on the "other side". So I hat to add a static address and route.

Njumaen

Are you shure that you plugged the PC into the ETH1/WAN port???

The etherboot loader just looks there!

Njumaen

Here with outside wAPac connected to hAPac MACSEC on v7.6 beta 10 works flawlessly. Even with PoE turned off and on again.

I’m so happy!

Njumaen

If you plugged your PC to ETH1 this happens. ETH1 is the WAN-Port. Plug into ETH2… Happend to me before

Njumaen

Network should be 192.168.0.0/23 !

Works fine here with DHCP and fixed IP.

Proven by using this https://www.calculator.net/ip-subnet-ca ... &x=68&y=10

Njumaen

Still dreaming of working macsec. *sigh*

Njumaen

As I assume I will see a working macsec shortly before I die, I used wireguard (eth --- eth) and VXLAN (bridge -- wg --- wg --- bridge) now to get my external port towards my hAPac in the garden quite secure.

But I still hope for macsec!

Njumaen

My RB1100AHx4 Dude Edition is very happy...

Njumaen

Check if the CAP is using certificates… I had an issue there…

Njumaen

I would reset to default configuration. Then DHCP works by default on ether2 and folowing…

Njumaen

You might set the cpu frequency to a lower rate in
/system routerboard settings

Njumaen

I think he's missing the Dude Server... I am for my "RB1100AHx4 Dude Edition" .

Njumaen

Do both users come from the same (public) IP? Then this is normal. IPSec cannot distinguish them.

Try one from a different IP, for example via WIFI tethering from your mobile phone.

Njumaen

Because ping is not tcp but icmp!

https://en.wikipedia.org/wiki/Ping_(networking_utility)

Njumaen

Can't wait for running macsec!

I've go the same issue with hEX PoE / hAP ac^2

Njumaen

The issues (random video playback lags -wirered- or loosing wireless connection) vanished with downgrade to 2.8 of my two rb260gsp.

Before downgrading I looked for transmission errors, but none were shown.

Ralf.

Njumaen

Where can I find the 2.8 files? I want to check if some strange behaviour of my rb260gsp is related to the update

Njumaen

get piHole running on an RaspberryPi or on a VM... Fast & simple.

There are "public piholes" as well, like https://freek.ws/2017/03/18/public-pi-hole/

Ralf.

Njumaen

*) crs3xx - fixed tagged packet forwarding without VLAN filtering (introduced in 6.42.6);

This really drove me crazy on my CRS328-24P-4S+

Thanks for fixing!

Njumaen

*) wireless - added option to disable PMKID for WPA2;

Even in CAPsMAN! \o/

Great Job!

Ralf.

Njumaen

I had the same issue. As far as I can rembember it had to do with mangeling the MSS value. In older firmware by firewall/mangle rule, today by a checkbox in ppp/profiles So first check on the server: is „change TCP MSS“ enabled in the used profile. And second try disabeling fast path on VPN connecti...

Njumaen

Cha0s: by default skin for security reasons I aggree... The less info the better!

Most of my devices can only be seen from inside my management network.

Maybe we can get a fully customizable login page by skinning some time? Logo, ID, firmware, links...

Ralf.

Njumaen

Hi,

it would be nice to see the identity (maybe even the system) on the webfig login page.

Ralf.

Njumaen

In your office, route 10.0.2.0/24 at 172.16.1.2, 10.0.6.0/24 at 182.168.1.6, etc. That's all that needs to be done in the office router. In the customer router, that is where you put the netmap rules: chain=srcnat out-interface=gre1-b action=netmap src-address=192.168.0.0/24 to-address=10.0.2.0/24 ...

Njumaen

Did this as an example with "iVinci Express" on my Mac.

* create a 320x30 canvas
* import .svg
* fit
* save as .svg
* upload to TheDude
* screenshot

Will you provide a set?

Njumaen

Great work!

Could you please provide dude-compatible .svg files? I've tried those from 'sources' but they are far too large (and with a lot of blank space) even scaled to 10%...

Ralf.

Njumaen

Hi,

when one starts a verbose inport and an errors occurs it would be great if one could decide to

[c]ontinue or top

or something else like

[n]ext or [c)ancel !

Right now one has to manually restart an import with the next line number.

Ralf.

Njumaen

I only can support this request, especially when using capsman!

Took me 3 bucks for a WeMos D1 and 5 minutes for flashing to start sending deauth packets.

„most recent kernels“ might be the problem

Njumaen

[Ticket#2017071322001096] CRS326 - no DNLA accessible

Issue solved. Thanks!

Njumaen

I feel your pain but hope MT guys will fix more serious things first.

Sure. No big issue...

Njumaen

Hi,

please make it possible to disable LEDs e.g. for RB260GSP in future SwOS.

Got two in my home and dislike the lightshow

Ralf.

(Sure, duct tape is a valid quick fix...)

Njumaen

Hi!

On hAPac (RB926UiGS-5HacT2HnT) it'n not possible to disable all LEDs.

Winbox System/LEDs/Settings ->immediate

results in

"Couldn't change LED Settings - This feature is not supported on this board (6)"

Ralf.

Njumaen

on the hAPac the "Partition" menu is shown but you can not partition because of only 16MiB Total HDD Size...

"Repartition" of course fails with an error message.

Njumaen

Same issue with RB3011 as reported by Brightstar, bootloop on RB3011 after updating it to 6.39 Same here. Here as well. Due to the previous posts I was alerted an got my W10 notebook loaded with netinstall and both stable and current .npk at hand Thank to the FSM, I did daily config-backups on an a...

Njumaen

rc80 works fine with my CRS125-24G-1S and three hAPac and a wAPac attached via capsman.
one thing: webfig shows non-master-interfaces in the CAPs Scanner... obsolte because you only can select the master-ifs

great work so far!

Regards,

Ralf.

Njumaen

Just my luck I'm using caps-man ! There's no DFS yet ;-) As reported before, I also have lots of new RADAR stations in the 5 GHz wireless. A connection is not possible or is only possible for a short time. The router constantly changes the channel on the 5 GHz network, because of the detected RADAR ...

Njumaen

RSTP problems... First I did upgrades from 6.37.4 (bugfix) to 6.38.3 on CRS125 (switch with caps-man) hree hAPac in cap-mode and one RB750GR3 : no problems at all! (Remark: all bridges have RSTP on!) Then I upgraded the router. It's an RB3011... After this it lost the connection to the CRS125. RB301...

Njumaen

No "disconnect/close"-issue on MacOS with wine-1.9.23 or wine-2.0-rc6

Good work!

Njumaen

RB3011 (WAN up/downstream perfect!) , CRS125, hAPac, RB75Gr3 no problems.

Njumaen

Might be simple but works for me... Update2: Using LeaseScript Register the DASH-Button at Amazon as described in the instructions but do not select a product. Stop here. On the DHCP server give the Dash a static IP. In my example it is 192.168.1.61 Set the lease time for it to 30sec (00:00:30) (may...

Njumaen

And there is another issue RB3011 (my router) on 6.38 download max. 3.25 Mbps installed 3.63.4 results in max. 110 Mbps as to be explected tripple checked - same result. no queues upload max both approx 8Mbps.. So for my part I'll stick on the bugfix only on the RB3011... http://store4.imghost.eu/20...

Njumaen

Is this intended? Why? What's the point I am missing? You forgot to read the release notes!! Important note!!! To avoid STP/RSTP compatibility issues with older RouterOS versions upgrade RouterOS on all routers in Layer2 networks with VLAN and STP/RSTP configurations. Sure I did not forgot this! Th...

Njumaen

I had the following strange (???) behaviour: RB3011 (6.36.4 bugfix) is connected to CRS125 (6.38 current). Unless I set the STP protocol mode to "none" on the RB3011 local bridge they lose connection when I upgrade the RB3011 to 6.38 Is this intended? Why? What's the point I am missing? Ha...

Njumaen

I've done something like this by using php and the mikrotik api, so I get a nice table of all registered clients.

http://wiki.mikrotik.com/wiki/API_PHP_class

get the class and examples from github, set debug in the exaple code to false...

it's quite easy...

Njumaen

O' 6.37.1 eth1 gets a lease on 6.37.2 no. I had to downgrade to make it work

In 6.37.2 the ether-interfaces are missing for dhcp-client.

I'm simply using a LAN-Bridge containing ether1

Njumaen

Dowgrade from 6.37.1 to this due to stability worked on my rb3011! The rb3011 issue (was affected by it!) really has been fixed!

Good job!

*Mantra: I will stay on bugfix channel! I will stay on bugfix channel! I will stay on bugfix channel! ...

Njumaen

RB3011, CRS125 (CAPsMAN), hAPac (as CAP) no issues after upgrade

Njumaen

Hi,

it would be nice to have a checkbox in Quick Set for enabling RoMON in WebFig and WinBox, maybe near the password field.

Cheers,

Ralf.

Njumaen

Got mine today from meconet.de ! \o/ What a awesome device! What I did so far: Connected eth1 to my lan, connected to wAPac by wifi, winbox, system upgrade. Downloaded the actual wireless-rep package (mipsbe) on my Mac, put it into files, reboot (winbox.exe runs perferct with wine!) disconnected fro...

Njumaen

Hi,

it would be nice have a checkbox to enable temporary reverse DNS lookups in address lists.

Ralf.

Njumaen

Another small feature request: possibility to disable/enable single CAPsMAN's configurations

Thanks,

Ralf.

Search found 113 matches