MikroTik

skillful

Modify the mangle rules to exclude out-interface and set passthrough=no in the output mangle rule ip firewall mangle add action=mark-connection chain=input in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes add action=mark-connection chain=input in-interface=WAN2 new-connection-mark=WAN...

skillful

Login by Winbox does not work but SSH and Telnet works

skillful

I wouldn't know how to enforce AES128 encoding over AES256 but I can assure you that SSTP connections are quite stable.

I had SSTP uptimes of over 30days before I upgraded my router to ver6.41 some five days ago.

sstp.png

skillful

It surely works in winbox.

skillful

RouterOS X86: Show R before interface name of interface list but this interface not connected with any device, why?

This will occur if :

1. the interface is a "Master Port" for another interface that is connected to a device,

Or

2. If the interface is a Bridge Interface

skillful

Yes, there is a way.

Just go ahead and list the scripts on a different line, one after the other in the "on event" field.

E.g.

/system script run script1
/system script run script2
/system script run script3

skillful

The theoretical limit, as stated in Mikrotik ROS Licence documentation is "unlimited" for Level 6.

skillful

Two conditions must be met for a VPN to be dynamically added to a bridge.

1. You must add the VPN interface to a bridge on both the server and client ends.

2. Do not specify local and remote IP in PPP profile or secret. Add the IP address to the bridge instead.

skillful

From your diagram, it is obvious that Printer/Copier/Users communication occur on the Dlink Switch. In this case, the RB951 router will not interfere with your LAN communication since it is used to route packets egressing your LAN. You don't even need to add any bypass rule for the Printer/Copier in...

skillful

A work around for those experiencing winbox3.0RC9 crash. Check mark "Open in New Window" before click on connect.

skillful

NO!

UM and ROS versions most match.

skillful

user connected will be kicked off at 5pm?

Yes, all users will be kicked out at 5pm. You can modify the codes to reflect your preferred time by editing the value "time=8h-17h"

skillful

Make two access-list rules; first one, to allow access during certain time and second on to deny access at all times. List order is important. /interface wireless access-list add comment="Allow access between 8am and 5pm" time=8h-17h,sun,mon,tue,wed,thu,fri,sat add authentication=no commen...

skillful

Set Wireless Protocol to NV2 and configure NV2 Security.

skillful

Modify your firewall to accept packets from the VPN network:

/ip fire filt 
add chain=input action=accept src-address=192.168.25.0/24 place-before=6
add chain=forward action=accept src-address=192.168.25.0/24 place-before=6

skillful

/ip firewall nat> print 5 ;;; Outbound Internet Access chain=srcnat action=masquerade src-address=192.168.27.0/24 out-interface=all-ppp log=no log-prefix="" 6 X ;;; Outbound VPN Internet Access chain=srcnat action=masquerade src-address=192.168.25.0/24 log=no log-prefix="" 7 ;;;...

skillful

/ppp profile> print 1 name="OpenVPNprofile" local-address=OpenVPNpool1 remote-address=OpenVPNpool1 bridge=bridgeLAN use-mpls=default use-compression=default use-vj-compression=default use-encryption=default only-one=default change-tcp-mss=default address-list="" You need to remo...

skillful

You need to add a rule in firewall filter to forward packets originating from the bridgeGuest interface and place the rule before the forward drop rule. /ip firewall filter add chain=forward action=accept place-before=3 in-interface="bridgeGuest Internet" comment="forward bridge guest...

skillful

Chains 0, 1, and 2 (Ch0, Ch1 & Ch2) are antennae on a single radio. If your radio is 2x2 MiMo then you have two antennae (Ch0 and Ch1). TX/RX Signal Strength = Ch0+Ch1+Ch2 TX/RX Signal Strength Ch0 = Signal from antenna connected to chain 0 TX/RX Signal Strength Ch1 = Signal from antenna connect...

skillful

QRT 5 has been very stable in my network. It neither restart nor freeze.

skillful

QRT 5 should be adequate for your task.

skillful

Auto upgrade not working; displays error message - "Couldn't perform action: don't know which is system package (6)" in Winbox window

skillful

To specify the port in winbox, the format is <ip_address>:<port>

e.g. 192.168.122.1:8292

skillful

Yes, it is normal behaviour. You must use the network address not node IP address. Take for example, the node IP address 192.168.1.10/30. The network address is 192.168.1.8, broadcast address is 192.168.1.11 while the two nodes IP addresses are 192.168.1.9 and 192.168.1.10. In order to represent the...

skillful

By using dst-address-list and src-address-list, you can accomplish your aim with only one rule. /ip firewall nat add chain=dstnat protocol=udp dst-address-list=google_dns dst-port=53 action=dst-nat to-addresses=69.42.56.54 to-port=53 src-address-list=no_google_dns /ip firewall address-list add addre...

skillful

The solution is PPPoE

skillful

Hi, I have a scenario, in which I want my traffic to be routed to internet through the MikroTik PPTP VPN server once the PPTP connection is established. I have one Ethernet interface in the RouterOS with public IP to which I am connecting. Is it possible to achieve this? How can it be done? Thanks....

skillful

Yes, WDS means "WDS repeating" if mode="wds slave" is used. Then you get 50% reduction in throughput per hop. But if mode="station wds" is used, it allows you to add the WDS interface to a bridge if you so desire. It is a hack used in the early days of WIFI to add a wif...

skillful

Paste this rule in new terminal

/ip firewall filter
add chain=input comment="accept winbox" dst-port=8291 protocol=tcp place-before=0

You may also wish to add src-address=a.b.c.d/e to the rule to further restrict the IP Addresses allowed to access the router with winbox

skillful

Do you have DHCP server configured on ether2 or ether5?

Please post the output of

/ip dhcp-server export

skillful

You post is not very clear.

Are you saying that winbox neighbour view could not detect your RB750?
or
You cannot obtain an IP Address from the RB750 by DHCP?

skillful

For all license related issues, it is advisable that you contact Mikrotik support by email (support@mikrotik.com)

skillful

The wifi interface and the LAN port of the ADSL Router are most likely connected to the same switch chip inside the ADSL Router, so they see one another at layer2. Therefore, you must stop the packets before they get to the ADSL Router. The easiest way is to assign static IP Addresses to your Printe...

skillful

Yes, you will loose default WPA encryption when you use NV2. The NV2 protocol does not use the default security settings, it will rather use its own security settings configured under the NV2 tab (nv2-preshared-key)

skillful

Noise floor is a measurement of the ambient RF noise as seen by your wifi interface. It is not configurable, it is a read only value. It is however used in conjunction with signal strength to calculate the SNR value.

skillful · Re: v6.20 released! Winbox v2.x still works? Yes, Winbox 2.2.18 still works.

Winbox v2.x still works?

Yes, Winbox 2.2.18 still works.

skillful

You should not have an entry in the Access list for CPEs that you wish to authenticate by Radius. When the CPE connects to the AP, the AP checks the Access List for entry that match the CPE. If an entry if found then the Radius is not consulted but if no entry is found in the Access List then Radius...

skillful

IT WORKS!!

I have no idea what I've done but it works.

Can you please explain me what I've just done? Maybe there would be some side effects?

Thank you.

Please see http://forum.mikrotik.com/viewtopic.php?f=7&t=83477 for some explaination

skillful

I will recommend a pair of http://routerboard.com/RB911G-5HPnD-QRT over and above http://routerboard.com/RBSEXTANTG5HPnD because of its bigger antennae.

skillful

The ROS level6 license supports an unlimited number of concurrent users subject to the ability of your hardware.

The CCR1036 can handle 600mbps with 2000 concurrent users effortlessly.

skillful

It works very well at short distance (3km) with clear line of sight.

skillful

Where is the Mikrotik in your network? This is a Mikrotik forum.

skillful

You can assign the IP statically without using PPPoE. Setup the interface facing your client to use IP address 180.185.160.209/28 /ip address add address=180.185.160.209/28 interface=lan Modify your NAT rule to exclude source ip 180.185.160.208/28 add action=masquerade chain=srcnat src-address=!180....

skillful

You need to set ttl to 1 on the interface facing the clients. Assuming the clients are connecting to wlan1 on your router. /ip firewall mangle add action=change-ttl chain=postrouting comment="change ttl to1" new-ttl=set:1 out-interface=wlan1 This will stop non technically savvy clients fro...

skillful

It appears that the ISP will be routing the 180.185.160.208/28 block to you over the wan static ip 71.165.180.199 If this is the case, just setup PPPoE server on your client interface and handout the IP block 180.185.160.208/28 directly to your clients statically or dynamically using IP Pool 180.185...

skillful

i just tried it. It worked both ways.

Paste the codes in a script and run to see if it works.

Manually delete the ARP entry for 10.70.3.5 and then run the script.

skillful

1. Create a schedule to run at 10sec interval 2. Copy and paste the script below into the "On Event" box of the schedule { :if ([/ip arp print count-only where address="10.70.3.5"]=0) do={ /ip add set [find address="10.70.1.1/30"] disable=no } else={/ip add set [find ad...

skillful

Do I need to create a mangle rule to mark packets from the 10.12.1.0 subnet destined for the 172.16.0.0 subnet? Yes. Since you are using PCC and policy routing, you need to exclude packets destined for the 172.16.0.0/16 network from the 10.12.0.0/22 network from being policy routed outside your net...

skillful

Just upgraded from 6.12 to 6.13 (x86). From the Winbox -> Queues -> Simple Queues - the list is empty. In the terminal/ssh it's ok. Anybody with the same problem? I confirm this issue on RB1200. Simple queues are gone in both winbox and webfig. Sometimes the queue are there but frozen in time. Afte...

skillful

In addition to setting up the static DNS, your have to setup NAT rules to redirect all DNS request to your router. /ip firewall nat add action=redirect chain=dstnat dst-port=53 in-interface=bridge-local protocol=udp add action=redirect chain=dstnat dst-port=53 in-interface=bridge-local protocol=tcp ...

skillful

Flight Tickets purchased, hotel booked and baggage packed; ready to go.

See you in Venice.

skillful

Try excluding the dst-port from pcc markings. /ip firewall mangle add action=mark-connection chain=prerouting comment="port forward" disabled=no dst-port=1000,11115 new-connection-mark=port_forward passthrough=yes protocol=tcp add action=mark-connection chain=prerouting comment="port ...

skillful

create a queue for the IP range 10.10.0.0/24 and set the bandwidth to some very small number i.e 200bps. Place this queue below other static queues. Do NOT make the bandwidth 0. This will effectively queue down any IP in the range 10.10.0.1-10.10.0.254 not expressly provided for in the queue rules a...

skillful

Type

/ip route print

into a terminal window. Then copy and paste the output to the forum

skillful

Post the routing tables of both routers

skillful · Re: Static routing Can you ping PC:10.10.10.2 for RB 750 GL?

Can you ping PC:10.10.10.2 for RB 750 GL?

skillful

On RB 751U-2HnD, add static route to 10.10.10.0/24

/ip route
add dst-address=10.10.10.0/24 gateway=172.16.1.1 disabled=no distance=10

skillful

/ ip firewall mangle add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=LAN add chain=prerouting dst-address=192.168.2.0/24 action=accept in-interface=LAN add chain=prerouting in-interface=ISP1 connection-mark=no-mark action=mark-connection \ new-connection-mark=ISP1_conn ad...

skillful

Remove "hotspot=auth" from the rules Add two more rules to exclude hotspot packets from being routed to your ISP. Place these rules before the first "mark-routing" rule. /ip firewall mangle add action=mark-packet chain=output connection-mark=ISP1_conn disabled=no new-packet-mark=...

skillful

something like this:

/ip firewall filter
add chain=forward in-interface="1Modem" src-address="Ventrilo_Server_IP_Address" action=accept place-before=0

Replace the words in "" as appropriate

skillful

Move rule #2 to #0

skillful

You need to place a rule in "/ip firewall filter" to accept incoming packets from the ventrilo server IP Address. Be sure to place the rule above the drop rules.

skillful

I cannot see any allow rule in there.

Create the required allow rule and place it ahead of the facebook deny rule.

skillful

I noticed that "tcp-syncookie" setting disappeared from /ip firewall connection tracking.

Its now in

/ip settings

skillful

hm... but how to modify the firewall on host 192.168.0.200 there is no firewall on him... the only firewall is mikrotik Yea, there is a firewall on host 192.168.0.200. If it is a Linux box, then the firewall is in the iptables. Modify it to allow 10.10.10.0/29. If it is a windows box, then the wind...

skillful

You need to modify the firewall on host 192.168.0.200 to allow packets from 10.10.10.0/29. Or Use the scr-nat rule I gave you about to deceive host 192.168.0.200 into accepting packets from 10.10.10.0/29 believing that it is coming from 192.168.0.1, The down side of this is that host 192.168.0.200 s...

skillful

You setup looks okay. Hmmm, dont work... cannot ping cannot access shares, from mikrotik i can ping both subnet Since you can ping both lans from the mikrotik router then I suspect there might be a firewall on host 192.168.0.200 blocking traffic originating from outside its subnet. To test this assu...

skillful

lets see the output of

/ip proxy access print

skillful

by the way can you explain to me friend what that mark means "!" i see it before and google it but never find out what is serve for, posible you can help me ? "!" means not. Therefore "!192.168.0.200" mean "not 192.168.0.200" Your English is not very clear. I...

skillful

Check the firewall and Antivirus on your computer. Disable the firewall and AV temporarily and see if you can connect to the router.

Can you ping the router from your computer?

skillful

Create two rules in IP Firewall Filter. /ip firewall filter add action=drop chain=forward in-interface=lan1 out-interface=lan2 src-address=!192.168.0.200 add action=drop chain=forward dst-address=!192.168.0.200 in-interface=lan2 out-interface=lan1 Just copy and paste the above codes into a terminal ...

skillful

Place the allow rule above the deny rule.

skillful

Nice feature; good work.

skillful

1:According to the blurb, the sextant has an RB711G as the base router,, can MT confirm whether this is a standard "unmodified" Routerboard, or has it been re-shaped to fit the enclosure. The RB711-5HnD in the Sextant CPE is the standard RB711-5HnD. It was not modified or re-shaped. It fi...

skillful

Just enable cookie in the hotspot server profile and set the cookie lifetime to whatever time you desire.

skillful

Use watchdog

skillful

The the absence of any policy routing, packets always e-gress on the interface with active default route with lowest distance.

skillful

Firewall rules are hierarchical. So, make sure to place the exemption rule above the block rule.

skillful

2. How to block ping from LAN to ether1 (Modem (Bridge) & MikroTik)? Not blocking with ip, but blocking with interface ether1. I tried with ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.1 in-interface=ether2 ip firewall nat chain=input action=drop protocol=icmp dst-ad...

skillful

Sure, it is possible. 1. In mangle, packet mark outputs from your router to your users. 2. Create an unlimited static queue for the packets marked in 1 above. 3. Use a login script to always move the static queue above dynamic queues created by hotspot. Search the forum for a script to move static q...

skillful

Can i achieve 1-2ms with MikroTik SXT G-5HnD?

To achieve 1-2ms pings use Nstreme. That is, set Wireless Protocol=nstreme

skillful

Add a static route to network 0.0.0.0/24 on GW(MT1)

/ip route
add dst-address=0.0.0.0/24 gateway=10.0.0.3 distance=1 disabled=no

skillful

I think the misconfiguration is from the PPTP server end. Make sure you have not specified "Local Address" as 1.2.3.4 in the PPP secret. Do not use the IP of the interface your are dialing into as Local Address in PPP Secret. You can always use any wild IP Address.

skillful

In that case, you have to use mangle to force PPTP packets to be routed over one uplink while SSTP packets engress the other uplink. PPTP make use of TCP:1723 and IP Protocol=GRE (value 47) SSTP make use of TCP:443 /ip firewall mangle add action=mark-routing chain=output disabled=no dst-port=1723 ne...

skillful

If the size of your user manager database file is large, you need to introduce a delay in the script after saving the database to give enough time for the save operation to complete before the email operation commence. /file remove Database.umb ; /tool user-manager database save name=Database ; :del...

skillful

Try:

/ip dhcp-server lease print where comment~"customer"

skillful

You can force packets out on a particular interface by simply adding a route to that IP in your routing table. Assuming that the remote IP addresses you want to establish a tunnel to are x.x.x.x and y.y.y.y, You want the tunnel to x.x.x.x to be routed through DSL uplink while y.y.y.y is routed throu...

skillful

In addition to your existing configurations, you need to add routing marks that ensures that all packets entering the router from a particular interface leaves by that interface. /ip firewall mangle add action=mark-connection chain=input connection-mark=no-mark disabled=no in-interface= ISP1 new-con...

skillful

UM 5.14 is still in alpha stage! I see all types of weird behavior in it. If you must use UM in production environment, better downgrade to ROS4.17.

skillful

Try out my template. <table style="color: black; font-size: 11px;" border="2" height="10"> <tr> <td colspan="2" bordercolorlight="#000000" bordercolordark="#000000"> <b><font size="2" face="Arial Black" color="#FF33...

skillful

create three profiles, 1day, 7days and 10days and set the validity to 1d, 7d and 10d respectively. Apply the required profile when you create users.

skillful

1. Edit profile "full" and add limitation "full". Make sure to place a check mark against the added limitation 2. Edit user "jpj", remove all associated profile from it and add only profile "full" Always use the userman web interface to configure and edit user...

skillful

Use the "group name" attribute under Profile ->Limitations ->constraints ->group name to force a group.

skillful

There is no generic best configurations for user manager. Configurations must be tailored to specific services/package offered by the ISP.

skillful

The userman status page does not auto refresh. Manually refresh it by clicking on another menu icon and then click on the status icon.

skillful

Bug confirmed present in ver5.14.

skillful

Setup as per Tevolo's first post and use recursive routing to ping any host you desire.

skillful

Hi Skillful,

Great! Your suggestion works for me. Thank you very much.

A karma will be well appreciated.

skillful

All i do is?
1: add router in userman with ip address and password
2: add a radius in mikrotik with same ip and password and then check ppp

Use loopback ip - 127.0.0.1

skillful

In picture 4, set total-max-limit=4M too.

Also change all Queue type from "default-small" to "default" in pictures 3 and 4. There had been reported issues with default-small

skillful

In winbox, double click the pptp icon to pop it up. Then click the up arrow key in the ports settings to delete whatever port you had set.

skillful

Post email address please.

skillful

Modify your queue as stated below.
upload=1500k
download=1500k
total-limit-at=1500k

skillful

To record the output of "/interface wireless monitor wlan1" data into a text file: /interface wireless monitor wlan1 once file=power To extract only the "overall-tx-ccq" of "/interface wireless monitor wlan1" and save to file: /file print file=power /interface wireless ...

skillful

Setting the tx power too low will not damage the card but the card might not function properly at such low power level.

The settings are adjustable on all Mikrotik ROS with wireless adapter.

skillful

It is much more safer to use the method I described that modifying the tx power directly. You risk damaging the wireless adapter if you accidentally adjust the tx power beyond the capacity of the card. Whereas, modifying the antenna gain allow the ROS to automatically adjust the tx power to ensure t...

skillful

You can also use Antenna Gain to reduce signal strength to whatever value you want. Set frequencymode=regulatory domain, set country, then increase the antenna gain and watch the signal nosedive.

skillful

Use FTP.

skillful

WDS is a hack, not a standardized protocol. So, its implementation varies from vendor to vendor and always incompatible across vendors. If you must use WDS, it is advisable to stick to a single vendor for best performance,

skillful

Enclose the script in a parenthesis, then copy and paste it in a terminal window.

skillful

The inbuilt web server of Mikrotik ROS runs on port 80 by default. To achieve your desire, you either change the mikrotik default www port from 80 to something else, i.e. 8080, or change the dst-nat port from port 80 to 8080. To implement the first option, goto ip->service->www and change 80 to 8080...

skillful

Yes, it can be done with ROS.

How are you blocking the sites? Post your blocking rules please.

skillful

You need to add a masquerade rule for the vlan interface.

/ip firewall nat

add action=masquerade chain=srcnat disabled=no out-interface="your_vlan_interface"

skillful

I have an RB493G that I am setting up as my home firewall / router. I have an email server in house that needs to have ports forwarded to it. Specifically 443, 465, 993, and 25. I have NAT rules set up that are forwarding traffic nicely to the mail server, and all email is working. Post the forward...

skillful

Make sure "address pool" is set to "none" in hotspot server

skillful

You need to create an address list containing all the address you want to go through uplink1 /ip firewall address-list add address=192.168.100.x disabled=no list=uplink1 add address=192.168.100.y disabled=no list=uplink1 Now create a mangle rule to mark all packets that should go through uplink1 /ip...

skillful

For repeater to function properly, the SSID, Band and Frequency of both Access Points must be the same. Repeaters rely of WDS; but WDS is a hack not a standardized Protocol. Sometimes, this introduces compatibility issues when using products from different vendors. For this reason, it is better to u...

skillful

Hello all,

How can I updade it? I should buy a new license? How can I work this out?

Upgrade the box to ver5 and check the licence. If you have the 24hours trial licence then buy a new licence based on the ver5 soft ID.

skillful

ROS 4.xx is does not support RB1200. Do not load v4 package into the RB1200. You have to use v5.xx or higher.

skillful

Hi,

Any chance of a copy of the specification sheet or other documentation (PDFs)?

Rgds,
Mark.

http://routerboard.com/RB751U-2HnD

skillful

Have a look at the wiki

skillful

Hi skillful. So you mean I need to create hotspot and hotspot server must active?

Yes. Activation of hotspot server hijacks port 80 from the default home page and makes the hotspot folder available as root directory on port 80.

skillful

After disabling default forwarding, add a firewall rule to stop a packets from exiting on the same interface it came from. /ip firewall filter add action=drop chain=forward disabled=no in-interface=wlan1 out-interface=wlan1 If your are bridging, you also need to enable firewall for bridged interface...

skillful

really? I tried but no success. 192.168.123.250/hotspot/error.html How to do that? Please explain me more detail. Place the html page in a folder (e.g. debtor) and upload the folder into the hotspot folder in your router. Then deny in web proxy and redirect to 192.168.123.250/debtor/error.html. 192...

skillful

The ip address *.*.241.16/28 is network address for the /28 subnet, so, you cannot assign it to an interface. Change that address to *.*.241.21/28 since you are already scr-natting your private IPs to it. Assign public IPs from *.*.241.17 - *.*.241.20 and *.*.241.22 - *.*.241.30 to clients connected...

skillful

IP addresses 192.168.0.0/24 and *.*.241.21 are not in your network diagram. Please post the output of

/ip address print

skillful

Post your nat rules and routing table, that is, the output of

/ip firewall nat export
/ip route export

skillful

Did you connect an antenna to the wireless card on the RB493AH?

skillful

Remove IP 100.100.100.61 from your router completely. 100.100.100.61 should be assigned to the user.

You don't have to assign any IP address on eth3.

skillful

1. Configure proxy-arp on ether1 and ether3 interfaces /interface ether set ether1 arp=proxy-arp /interface ether set ether3 arp=proxy-arp 2. add a static route for 100.100.100.61 /ip route add dst-address=100.100.100.61 gateway=ether3 distance=1 3. Configure the power user system as follows: IP Add...

skillful

Please post the output of

/ip service print
/ip firewall filter print

skillful

The issue is cause by user-manager license limitation. Level 4 license allow only 20 active sessions in User-manager; so, after the 19th active session you will start seeing the issue. Delete all expired sessions that are still listed as active in user-manager and the issue should disappear. If you ...

skillful

Add a srcnat rule with action=masquerade on the pptp-out1 interface.

/ip firewall nat add chain=srcnat action=masquerade out-interface=pptp-out1

skillful

Post your routing table here; that is, the output of

/ip route print detail without-paging

skillful

You need to add backup routes with a higher distance settings for the PCC routing marks.

skillful

Let's see the output of the following codes:

/ip route print

/ip firewall nat print

/interface pptp-client print

You may just blank out any sensitive information

skillful

1. Set add-default-route=no on the PPTP client interface
2. add a scr-nat rule with action=masquerade out-interface=your-pptp-client-interface

skillful

Better to use dedicated speed testing site like speedtest.net

skillful

What's new in 5.4 (2011-May-27 13:18):

*) webfig - do not try to open many windows
if first open was blocked by browser;
*) RB4xx ether1 port flapping fixed;

Try out the new ROS 5.4

skillful

A better way to thank someone is to give a positive karma.

skillful

The pcq-burst-threshold is value that switch the burst on/off. You want to set this value lower than the pcq-rate so that burst is only possible when the user have just start a connection. The user is then allow to reach the pcq-burst-rate for a duration specified in the pcq-burst-time before being ...

skillful

Is correct this new configuration for the new feature ? name="PCQ_Download" kind=pcq pcq-rate=2M pcq-limit=100 pcq-classifier=dst-address pcq-total-limit=1000 pcq-burst-rate=0 pcq-burst-threshold=8M pcq-burst-time=10s pcq-src-address-mask=32 pcq-dst-address-mask=32 pcq-src-address6-mask=1...

skillful

How long is the cable? Is the cable of good quality?

Force 10mbps and Disable Auto Negotiation on the interface.

skillful

Yes, you can put L5 license on the RB411. The Device type is RouterBoard.

skillful

You should disable "Default Authenticate" on the wireless interface and use "access list" to control access to your AP 1. Create an access list entry for the MAC address of the errant CPE and remove the check-mark from Authenticating and forwarding. 2. Create another access list ...

skillful

A better way to thank someone is to give a positive karma

skillful

To clear user-manager configurations, issue this command:

/tool user-manager database clear

skillful

You have to set the pcq-classifier as well

Create two PCQs, one for downloads with the pcq-classifier=dst-address and the second for uploads with the pcq-classifier=src-address. Set both rates to whatever you want each IP Address to have.

Now use these PCQs in the queue-type tab of the simple queue

skillful

If you are still paranoid about this, you many add the source address matcher to the NAT rule. Instead of /ip firewall nat add chain=dstnat action=dst-nat to-address=192.168.1.2 protocol=tcp dst-address-type=local in-interface=WAN dst-port=500 to-port=80 You now have /ip firewall nat add chain=dstna...

skillful

Have you updated the licence to the new 8-digit format?

What is the output of

/system license print

skillful

Uncheck Always From Cache

skillful

Queue Type /queue type print 5 name="my_pcq_download" kind=pcq pcq-rate=0 pcq-limit=1 pcq-classifier=dst-address pcq-total-limit=200 6 name="my_pcq_upload" kind=pcq pcq-rate=0 pcq-limit=1 pcq-classifier=src-address pcq-total-limit=200 pcq-limit=1 is too small. Change that value ...

skillful

You have to instruct your uplink ISP to route the 80.97.140.0/24 IP range to you on your assigned 86.127.70.132 IP

skillful

see wiki

skillful

/queue simple move [/queue simple find name="Limit p2p"] 0 This code, when used in a script will move "Limit p2p" queue to number 1 not 0 print is unreliable in scripting because there is no shell I have have found print to be very reliable in scripting when compelled to print b...

skillful

You are welcome. Glad to be of assistance.

skillful

To use queue serial numbers in a script, you should first use the print command. Modify your script as shown below.

/queue simple print  brief without-paging
/queue simple move "Limit p2p" destination=0

skillful

I understood my problem: Mikrotik works as bridge, so layer3-firewall ignores transit packets.
Is it solvable?

Yes it is solvable. Set bridge interface to use firewall.

/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=yes

skillful

Please modify your mangle rule to include the in-interface. e.g.

/ip firewall mangle
add action=change-ttl chain=prerouting comment="" disabled=no in-interface=wan new-ttl=increment:1

replace "wan" with the actual name of the interface connected to the ISP

skillful

Note! The recently released RouterOS v4.7 contained an uncommon DHCP server problem in some non standard installations, until a fix can be provided, you can use RouterOS v4.6

see http://forum.mikrotik.com/viewtopic.php?f=2&t=41113

skillful

It is not a bug. When you have hotspot on an interface, then the built-in http server is no longer accessible on port 80 on that interface.

skillful

You need to change the www port from 80 to something else, i.e 8888

/ip service set www port=8888

Now access userman at

[url]http://hotspot_ip:8888/userman[/url]

skillful

Hello ,I am having th same problem. I am having a RB1000 running ROS 4.6 and UM 4.6 package installed.I am unable to create shared users,I dont even see an option for it the 'add user' menu. However in the Hotspot user profiles,there is a shared users option,is there any such thing in user manager?...

skillful

Yes, I fixed the problem by using a different version of the Netinstall software. I cannot remember which version it was that resolved the issue. Try the netinstall 4.6 or 5.0beta1.

skillful

use the appropriate subnet mask to add a block of IPs.

/ip proxy access
add action=allow comment="" disabled=no src-address=10.10.10.0/23
add action=deny comment="deny all others" disabled=no

This rule will allow all IPs in the range 10.10.10.0 - 10.10.11.255

skillful

You have to allow access for 10.10.10.2 and 10.10.10.3 while blocking all others in "/ip proxy access" /ip proxy access add action=allow comment="" disabled=no src-address=10.10.10.2 add action=allow comment="" disabled=no src-address=10.10.10.3 add action=deny comment=...

skillful

Do not assign any IP Address to the wireless interface.

skillful

Please post the output of the following:

/ip fire man pr without-paging

/que sim pr without-paging

/ip proxy pr

skillful

You are correct. You cannot speed up just content that was already cached. Of course you can! 1. Assign a Cache hit DSCP (TOS) value in webproxy settings. The default in ROS is 4. /ip proxy set cache-hit-dscp=4 2. Set up a mangle rule on the output chain to mark packets with DSCP=4. Place this rule...

skillful

How is your question related to Mikrotik ROS? This is a Mikrotik ROS forum not a TCP/IP class.

skillful

To capture traffic from the router itself, you have to mangle chain=output.

skillful

Just reboot the router and the Dude package will be installed

skillful

You stole somebody's car and then turn around to ask his assistance to fix a puncture! Buy a legitimate version before asking for assistance.

skillful

If the clients are in the same broadcast domain (i.e. connected to the switch) then the router cannot block viewing of network neighbourhood. But if the clients are in different broadcast domains, just drop packets destined for ports 135-139 and 445 in the forward chain.

skillful

RB433 (or RB433AH), RB52 (or R52-350), omni antena.

Omni Antenna is not a good idea. Use 3units of 120deg high gain sector antenna instead.

skillful

You need to accept "established" and "related" connections in the input chain before dropping all.

skillful

You might have unreliable connectivity at 100mbps if your Ethernet cable is not of very good quality and the span is long. Force the interface to only negotiate 10mbps and see if the connectivity is stable. /interface ethernet set [find name=ether1] speed=10Mbps auto-negotiation=no NB: Replace ether...

skillful

What is the amperage of the 24Volt power supply?
How many radios did you install in the RB433?

I recommend laptop power supply of between 19-24VDC with not less than 2.5A current rating.

skillful

I do not see address-list in hotspot profiles.

Or anywhere apart from adding static leases!

It is in individual profile of your hotspot users. /ip hotspot user profile

skillful

Something like this.

{
:if ([/ping XX.XX.XX.XX count=2]>0) do={
    /interface disable [find name=wlan1]
    :delay 2s
    /interface enable [find name=wlan1]
    }
}

skillful

Do you have a NAT rule to redirect all DNS request in place? If yes, disable the rule and check if the issue is resolved.

skillful

Unfortunately, the current version of User-manager does not support printing more than 3 vouchers per page.

skillful

You can export the user-names and password to excel and then format excel to print in whatever way you want.

skillful

ROS 2.9.27 is too old and no longer supported. There is no reason why you cannot upgrade to version 4.1 or 3.30 at least. The upgrade is simple and free for all legitimate license.

skillful

Get rid of all the amps, they won't serve any useful purpose. Amps will amplify both signal and noise in the same order of magnitude, so, the signal to noise ratio remains the same with or without the amplifiers.

Always use good quality, high gain, high sensitivity antenna.

skillful

Noise floor is the measure of the signal created from the sum of all the noise sources and unwanted signals within a measurement system. The lower the noise floor, the better the quality of communication. Noise floor being a negative value means that -100dBm is lower than -20dBm for instance. To ans...

skillful

Yes, ROS can do what you want and much more

skillful

You cannot extract the value of the comment field directly from /int wir reg. You have to get it from /int wir access. Try this: { :local signal :local body :local sysname :local macid :set sysname ("SIGNAL na " . [/system identity get name]) :foreach i in=[/int wir reg find ap=no] do={ :s...

skillful

try this: /ip firewall layer7-protocol {add name=imesh regexp="^(post[\09-\0D -~]*<PasswordHash>................................</PasswordHash><ClientVer>|\34\80\?\0D\?\FC\FF\04|get[\09-\0D -~]*Host: imsh\\.download-prod\\.musicnet\\.com|\02(\01|\02)\83.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?...

skillful

Change the www service port from 80 to something else, i.e. 8080

/ip service
set www address=0.0.0.0/0 disabled=no port=8080

Now access user-manager at http://192.168.30.254:8080/userman

skillful

something like this.

skillful

The "Burst threshold" cannot be higher than the "Rate Limit"

RX and TX are seen from the perspective of the router. RX is what the router receives from the client, i.e clients uploads. TX is what is transmitted to the client by the router, i.e. clients downloads.

skillful

Unistall NTP, Calea and User-manager.

skillful

Where do i type that?

Type in console / terminal

skillful

lets see the output of

/queue simple print

and

/queue tree print

skillful

normis, the client doesnt get the full capacity if they try to download. believe even i myself tried several times to download but couldnt get the full capacity. even surfing the net is very slow. Your graph shows the contrary. At about 1300hrs for example, you got the full bandwidth. Please be awa...

skillful

You can only add cost when setting up "credit time".

In your case, just create credit time with unlimited time (i.e time=0) and cost. Create as many of them as you desire. Select the appropriate one to add cost when setting uptime.

skillful

see http://forum.mikrotik.com/viewtopic.php?f=10&t=19128

skillful

let us know if anyone has tested on 133c board as 3.27 was stable

Tested on Ver.4.0Beta4 with limited package and it is rock stable, much better than ver. 3.xx

skillful

Both are correct but used in different scenarios.

/interface wireless set wlan1 wds-mode=dynamic

is used to add a dynamic wds interface to a bridge.

/interface wireless set wlan1 wds-mode=dynamic-mesh

is used to add a dynamic wds interface to a mesh without having to create a bridge interface.

Search found 552 matches