MikroTik

stoser

Good morning mkx. 1) I considered the buffer overrun, it just seemed strange that the buffer would be global/shared across all ports... As a last resort I will dedicate a dumb switch to the faulty device to mitigate the effects on the other devices. At least that way they won't share a buffer. 2) Th...

stoser

I have a Hex POE (RB960PGS) configured as a Bridge on all five ports plus the SFP port. FW 6.48.6. Hardware offloading is enabled on all ports. The SFP port is locked to 1Gbps. All other ports have auto-negotiation enabled. Ethernet Ports have port isolation enabled to all other ethernet ports, so E...

stoser

Thank you very much for the information @ConnyMercier. Very detailed and well explained. I now feel confident to run some tests without fear of damaging a production router.

Kind regards -

stoser

I have two questions concerning the rack mountable CCR1009-7G-1C-1S+ It has dual AC power supplies and PoE in port. Question 1: Can the PoE in port be used simultaneously with one/both of the internal AC power supplies? I don't want to test this out and damage the router. In many other routers with ...

stoser

@doukas, what FW version are you using?

stoser

In the change log for Version 6.47 (2020-Jun-02 07:38) it states: *) winbox - fixed dates and times in interface link up/down properties (WinBox v3.24 required); So ... Supposedly this should be fixed. I have not tested yet because I only use "long term" versions in production routers, whe...

stoser

Thanks for you reply krafg. But I can assure you that the limitation is not with the battery bank, and the cabling is oversized for less than couple of amps. I could power my home for a day on that battery bank. As soon as I can replace the Netonix, I will pull the Power Boxes and test the POE outs ...

stoser

Thanks mducharme, your reply helps me to understand the way the redundancy works.

stoser

I cut the power remotely and let the batteries drain, and I get the following at 18.6V, after the lowest priority POE power cycles name: ether2 ether3 ether4 ether5 poe-out: forced-on forced-on forced-on forced-on poe-out-status: powered-on powered-on powered-on powered-on poe-out-voltage: 18.6V 18....

stoser

The important item is the current (amps), since watts stay the same. As the voltage decreases from 19.4, the current increases proportionally. The voltage range is actually 22 - 17, from equalization to almost completely discharged batteries. But the problem occurs at 18.6V or less The electricity w...

stoser

I just tested that if I lock the data rates on one of the Gb ports to 100Mbps full duplex, the mA used by the device drop by about 60mA, and that seems to be enough to stabilize the situation. But obviously I need Gbps speeds. The fact that a 60mA change makes the problem go away means that at 1000-...

stoser

At 4 prisms it makes sense. Each one would use close to 500mA peaks ... but I am seeing this behavior with 1 prism, 2 AC lite, and an M5 (all ubnt rockets). Total amps barely fluctuate between 1000 and 1100 mA And I also see it on another PowerBox Pro running 2 prisms, an M5 and a simple DC relay. A...

stoser

Looking at the POE-out stats for hours, the "overload" condition seems to be detected when the total POE-out (sum of all ports) is aprox 1.1 amps. This value is low compared to the total stated limit in the specs of 2amps, but it seems pretty close to a +10% margin for 1amp. Is it possible...

stoser

Many thanks mkx I have not been able to interact with one of these units, so I am still a little confused. If I interpret your reply correctly, if both the 48 volt supply and the 18 volt supply are simultaneously attached and functioning, the POE outs will ONLY be 48V? Or is there a way to select be...

stoser

Hello. I am considering purchasing a couple of CRS112-8G-4S-IN to provide power to some equipment over POE-OUT at a remote site. The web page states that "CRS112-8P-4S-IN can power 802.3af/at devices if 48-57 V DC input is used (unit will automatically detect and provide correct power to device...

stoser

Thanks you for your reply changeIP- All DC connections are tight, but I'll replace them tomorrow just in case. Bios is upgraded to same version as FW, 6.45.9. I always prefer to use "long term" FW, but I also looked through the change logs of the stable FW versions and did not find any cha...

stoser

Hello. I have two PowerBox Pro (RB960PGS-PB) that I am using in an emergency to power some equipment until my Netonix gets repaired. FW 6.45.9 Connecting directly to an 18v battery bank, through the DC in jack, so this is not a power supply issue. BOTH PowerBox Pro have this issue, so it is not a da...

stoser

As far as I can see you have implemented the "Multiple host checking per Uplink". You should use your real gateway IP addresses for each WAN. You do not need to change your gateways to the gateways mentioned in the WiKi as they are just examples. This allows more than 1 ICMP responder to b...

stoser

First I would like to understand what exactly is the problem that you are having. Is the problem that you prefer to use the scheduler instead of the s2s solution over netwatch, but would prefer to only receive just one email per fault (instead of one email every 5 minutes)? Or is the problem that yo...

stoser

How should I proceed with the firewall to separate the lans?

see post #24 by @anav

stoser

/ping src-address=172.16.24.1 172.16.24.2 count=4 This one should succeed as both addresses are on directly connected subnet. /ping src-address=192.168.1.1 172.16.24.2 count=4 This one shoukd succeed as well, if it doesnt, tgen there's something wrong on the AP. Also you did not perform the second ...

stoser

Based on the results of the pings, the 4011 can ping the Ubiquiti AP, and it can also ping the other interface on itself. Please do the following: 1- Try ping from Ubiquiti AP to 4011, and post results (172.16.24.2 to 172.16.24.1) 2 - Try tracert from Ubiquiti AP to an internet site (8.8.8.8 for ex)...

stoser

One problem I see is the following: Look closely at the Ip range for dhcp_pool2:

/ip pool
add name=dhcp_pool1 ranges=192.168.1.210-192.168.1.230
add name=dhcp_pool2 ranges=172.16.24.100-192.16.24.120

Also, you should add the network 172.16.24.0/24, as you yourself stated

stoser

I have no idea what you are asking for. Please take some time out of your day and write down specifically what you need, perhaps with an example of a very specific input, and an example of the very specific desired output. It is not fair to waste the time of people who are using their valuable time ...

stoser

Are you referring to printing out a simple ASCII code byte to its corresponding character value?

stoser

:local int 46;
:local output "";

:set output ($int);
:log info ($output);

The above code would log the character string "46"

stoser

All rules in Mikrotik are processed sequentially. Look in Winbox, on the left side of the ip/firewall rules. You will see a column labeled "#". This is the number of the firewall rule. Click the "#" to order the list. The firewall rules will be processed in that order, starting f...

stoser

If the requirement is simple isolation of bridge1 from bridge2, assign the IP address 176.16.24.1 to bridge2 (NOT to ether10) and use the rules already suggested by @mkx: /ip firewall filter add action=drop chain=forward in-interface=bridge2 out-interface=bridge1 add action=drop chain=forward in-int...

stoser

If you already established that the link works from your neighbor's deck to your deck, and the distances are more or less the same, then start by testing out all of the extras, and removing most of them if possible. First test the cable. Make sure it shown link UP. Just plug a computer into the hous...

stoser

I cannot help you with your current design, as I think that is is cumbersome and overly complex. However, I can point you in the direction of a simpler implementation. Have you seen this wiki? https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting It does everything you need minu...

stoser

Perhaps a better way would be to let the mikrotik handle the pings and the failover as designed using recursive routes. You could just schedule a script to check to see if any active route has a distance > 1 (which would indicate that the primary route is down). If the condition is met, send an emai...

stoser

If all you want to do is simulate and view the traffic going out two different interfaces, you can probably use the IP%interface notation for the gateway values in the routing rules. So if your ISP LAN gateway is 192.168.0.1, and your WAN1 interface name is "ether1", and your WAN2 interfac...

stoser

Which IP addresses should I use for checking the link status? Can I use IP addresses of root DNS servers? I use Google DNS (8.8.8.8 or 8.8.4.4) and Level3 (4.2.2.1, 4.2.2.2, 4.2.2.3, 4.2.2.4), or your can use any other reliable icmp responder that can be reached from that WAN So, how should I confi...

stoser

Take a look at this topic, perhaps it will help: https://forum.mikrotik.com/viewtopic.php?f=2&t=139750&hilit=connection Specifically. if you are using srcnat for outgoing traffic, only use srcnat=masquerade. When you use masquerade, the router will automatically clear the connections for you...

stoser

I was able to resolve this on our workstations, it seems to be a difference in how Winbox is writing session files. If you delete the "%userprofile%\appdata\roaming\mikrotik\winbox\sessions" directory, then it all works fine again and correct link down dates are shown. We've confirmed tha...

stoser

Winbox is a classic MDI application, you can use CTRL-F6 and CTRL-SHIFT-F6 to cycle through child windows, forth and back respectively.

Excellent, and thank you nescafe2002. Did not know this.

stoser

@stoser: if routes on VDSL modem are set correctly, no masquerading between LAN and VDSL modem is needed ... straight routing should do the trick. Single masquerading towards internet (covering both 192.168 networks) should be enough. I completely agree with mkx's post. Including the quoted part. E...

stoser

I wanted that the VDSL router has also a connection to the internet, so the clock gets synchronized and log entries have correct timestamps Concerning the VDSL router having the correct time, please note that the VDSL router in BRIDGE mode has no direct internet access. You need to define the defau...

stoser

Hello, I still think that the OP's issue is that the OP was manquerading only when the out interface was equal to "WIA" (the pppoe interface layered on top of ether10). To access the WAN IP subnet, he will need to masquerade traffic to the subnet associated to ether10. See OP's original po...

stoser

Hello, I think that the problem is that you need to masquerade with the Out-Interface set to Interface 10 in order to access the vdsl router. You were masquerading to the PPPoE interface, which is one step ahead of the VDSL router. The PPPoE (WIA) is connecting to you the DSLAM of your provider. Rec...

stoser

I reported it as well

Ticket#2018103022005561

Mikrotik support asked me for screenshots and additional details, I gave them screenshots from 3 differnt RBs, and using different versions of Winbox (when possible). Hopefully it will be corrected in the next version of Winbox.

stoser

Bump... Yesterday I got around to upgrading all of the RBs in my previous post to 6.43.4, and a CRS 326 as well, both firmware and packages. Using both winbox 3.17 and 3.18, the "Last Link uptime" of all active interfaces always gets set to the time that winbox connected ... The last link ...

stoser

I agree that Mikrotik should put the answer to the topic in the Wiki. I have not found the answer in the WIKI. However, I recall reading a forum article a few years ago in which a forum guru wrote that Mikrotik uses the DNS entries with Round Robin, excluding DNS IPs that don't reply. It was never m...

stoser

Not quite sure what you are asking. The config you posted is very basic. Your config shows no explicit blocking of anything at all. I do not see firewall rules. The only "blocking" could be caused by the lack of specified routes... If you want internet access for your DHCP clients, you wil...

stoser

sindy, thanks for the link to the other forum topic. Very informative, especially the parts dealing with PPPoE. Kind regards -

stoser

You need to add routes for all corresponding address ranges. On Mikrotik 1 define a route to get to the 10.10.2.0/24 subnet. The gateway would be 192.168.2.2 on Mikrotik 2 On Mikrotik 1 define a route to get to the 10.10.1.0/24 subnet. The gateway would be 192.168.2.1 on Mikrotik 1 On Mikrotik 1 def...

stoser

Try putting an IP address for the gateway in the route with scope 10 specifically change "ISP" in the route below to the gateway address of your ISP 1 A S dst-address=1.1.1.1/32 gateway=ISP gateway-status=ISP reachable distance=1 scope=10 target-scope=10 I have not been able to get recursi...

stoser

Like the previous two posts state, but I will clarify and add preferencial source in route: -- Add a connection mark for src address -- add routing mark for the new connection mark -- add static route for new routing mark, but clearly state preferential source in the route. That way all connections ...

stoser

Anumrak: I can confirm that your suggestion solved my problem, thanks again. The routing failover is now very fast and the connections do not hang. CPU is good. Hopefully you OP had the same problem, and this will help him as well. Back to the OPs original topic request ...

stoser

Connections get hanging in conn tracker only if you choose whatever source nat action except masquerade. Masq will drop all connection by himself if route though masq interface is unreachable. Anumrak, thank you for this info. There is one interface that I was using src-nat instead of masquerade. I...

stoser

As far as I know, the CRS 326 only shows temp, it does not show input voltage. And in routers like the 2011 and 3011 that do show input voltage, I am unaware of a way to monitor if the input voltage is coming from the DC input jack or the POE in. It seems to me that the DC inputs are bridged, althou...

stoser

I have seen that when the WANs are from a different providers with a different public IP and gateway subnet, many stateful connections hang. This occurs when connection marks are used and the corresponding connections are not expired. Over time I have seen that the traffic slowly increases on the ne...

stoser

I am running 6.42.7 on a power box pro 960PGS

Had the same problem with a UBNT gen 2 rocket prism with POE-OUT set to auto-on. I had to set it to forced-on to make it work. I am powering directly from a battery bank to the DC input jack, I am NOT using POE-IN.

stoser

I have a telecom Italia router with ip 192.168.1.1 and 2 mikrotiks connected trough eth1-wan to the Telecom router. the mikrotik-1 have 192.168.1.10 on the eth1-wan interface and the mikrotik-2 have 192.168.1.20 on the eth1-wan interface. then all the other ports are bridged with assigned networks ...

stoser

accept tcp port 8291 on input chain, set in-interface to be your WAN interface, normally ether1. However you want to limit access to this port by set source IP from which you allow only. Also make sure you are on latest firmware. 1) Recommend to change the winbox port as well, as most robots look f...

stoser

based on your picture, I assume that [10.10.10.2/30----192.168.0.1/30] are two ports on the same router, specifically ether8 and ether1 Two potential problems: 1) # ADDRESS NETWORK INTERFACE 0 192.168.0.2/30 192.168.0.0 ether1 1 10.10.10.1/30 10.10.10.0 ether8 Why are you putting the addresses of th...

stoser

I can confirm that this occurs on the following routers using Winbox 3.17 AND Winbox 3.18. Note: The strange date behavior is NOT occurring with winbox 3.11, on the versions that it can connect to (pre 6.43). 3011UiAS, running 6.40.9, Firmware 3.41 Power Box Pro (960PGS) running 6.42.7 750UP running...

stoser

I am also having this problem, on RouterBOARD 3011UiAS, running 6.40.9, Firmware 3.41 However I do not believe that this has to do with upgrade version or firmware. I believe that it is the newer versions of winbox. Winbox 3.11 connected to the same router shows CORRECT dates in "last link up t...

stoser

... at the router add as many bridges as providers, then add only VLAN 1 to bridge 1, VLAN 2 to bridge 2 and so on, what’s the idea, if you set up a bridge interface you can manually change your MAC address so it will work too. I have already tried this, as per the following link, https://wiki.mikr...

stoser

Question for you - for that 'switch stack', is it a single switch or a group of switches in some kind of failover configuration?

I am using a single switch at this point, a CRS326, as I am still testing. The idea is to add failover once I get it working.

stoser

Thanks for all of the guidance. The access concentrator MAC addresses at the DSLAM were the same for all PPPoE client connections, since the ISP is the same. Also, on my router, the ethernet port mac addresses on which the VLANs were built were also the same, since the idea was to use just one physi...

stoser

Update ... I have set up 3 PPPoE client connections from 1 physical interface on Router A ( physical interface Ether 5). Each PPPoE connection is associated to a VLAN. There is a VLAN trunk coming off of ether 5, and a managed switch is set up with VLAN access ports, each port with a physical cable ...

stoser

Thank you sri2007. Your post made me realize that I was on the right track. I could not get it working with a Router connected to the modems, so I took your advice and connected a CRS switch, and used SwOS to set up the VLAN access ports and trunk, and it all worked out very well. Thanks again. Sett...

stoser

If I understand you correctly, you want to drop requests for all IP addresses that you have NOT assigned to simple queues, You would need to use Firewall Filter. Go to IP --> Firewall --> Filter Rules in winbox, and create rules that allow forwarding for only the IP addresses that you want. Drop all...

stoser

F1le -- did you just load a backup or did you load a .rsc file containing the config script? If you simply loaded a backup, it will not work. You cannot load a backup from one model number of router into a different model number. .backup files are hardware specific. If you loaded the .rsc file and i...

stoser

Hello forum members. I have been trying to make the following scenario work, quite unsuccessfully, for the past couple of days. I am hoping for some pointers... I have an Mtik router acting as a load balancer for a lot of VDSL services. This is ROUTER A. There are more VDSL modems than there are por...

stoser

I though that smaller pkts help voip for low jitter and less delay. Ill give it a try and post results here. Queue size is the maximum number of packets that the queue can have. IT IS NOT the packet size. Packets that come into the queue in excess of the queue size get dropped, and therefore do not...

stoser

50 to 5000 , are you talking about bucket size? @ checito is referring to Queue size. I also mentioned this in my last post. In winbox look at "Queue Types" tab under Queues menu item. Also read: https://wiki.mikrotik.com/wiki/Manual:Queue#Queue_Types In your original post you were using ...

stoser

I think that you want to limit the amount of new SSL OR Telnet connections to a maximum of 5 new sessions every 60 seconds. Is this what you are asking?

stoser

1) Mark Routing from first 4 subnets to a specific routing mark, in ip/firewall/mangle
2) Use desired gateway for that routing mark, in ip/routes

3) Do the same for 5th subnet, or just let the default route catch that.

stoser

please see the code and the picture : https://docs.google.com/document/d/e/2PACX-1vS4Th2WC8AaH4J_umCVInZ7ZKYk7APwFvjbaW0qYg7WG6zckPZeFiUVRT3X-W7KWSuAIXjt0putyJ8C/pub Not a very usefull picture ... You could at least have enlarged the column widths so that the statistics could be read. Too many &quo...

stoser

https://forum.mikrotik.com/viewtopic.php?t=88027 Note normis's reply in the above post Is it really hot to the touch or are you basing this on the system-health-temperature? One time my 2011 got super hot, about 80+ degrees C, practically burned my hand when I touched it, and I turned it off, let it...

stoser

if everything really is bridged ... Put your computer in the same subnet and connect via WINBOX via Mac Address. Then start troubleshooting . Kind regards

stoser

Try giving higher Priority to VOIP child queue. For example leave other traffic as 8, put voip as 2

stoser

I do not have a clear understanding of your problem. Are you saying that you want an always-on redundant router, and that both routers should have the same public facing IP address? That is to say, is your question > --- "Is there a simple way I can get my publicly facing WAN connection to pres...

stoser

Hi, thanks a lot for this. I tried following your steps but something's not working. The counters are getting pegged though. More details below. Please let me know if you spot something wrong in my config. I configured my IP list through IP>Firewall>IP list and that's working fine. I called it NAS-...

stoser

@mburgus: I had too long of a week at work and at home, didn't have time to log int othe forum, and it seems things have gone downhill. Firstly, I must say that you have quite a bit of pain tolerance to be climbing up the steep mtik learning curve, but in the end, if you are going to manage a small ...

stoser

You mean I should drop ICMP requests to router itself. Like PING? If that's what you mean. I prefer to leave it ON so I can ping my host from outside to diagnose connection problems and availability. I recommend turning it off, or using port knocking for all necessary administrative ports, or simpl...

stoser

So If I want to block connection for example to webfig or telnet port on router itself I block it in input chain and You would not be blocking connections (stateful connections tracked by the router). You would be blocking packets. And if you want to block communications initiated by the router its...

stoser

I despise quickset, have never had any luck understanding how it works and from where it gets the values that it displays. Truly hate it. Based on your post, it is unclear if you are an end user simply interested in getting a home setup up and running, or if you are a networking professional or an a...

stoser

The thread that @blaja linked to, and the PCC load balancing page referenced within that thread, describe all of the necessary details to accomplish what you are trying to do. Based on your continuing questions, I don't believe that you have read them, studied them, and internalized them. If you nee...

stoser

See hairpin NAT

https://wiki.mikrotik.com/wiki/Hairpin_NAT

Or just set up the DNS cache on your mtik and set up static entry for local IP address

stoser

If this problem started recently, but was working before, perhaps your provider Telenet changed something or added a requirement similar to the gmail relay requirement mentioned by @Jotne. I can tell you that I have not had a problem with gmail or zoho mail up to and including 6.40.4, running on a R...

stoser

Going back to the topic author's original question: 2frogs is correct. You are dropping requests on the INPUT chain. You need to drop on the forward chain. Also, I recommend dropping ICMP input requests. And I would also like to suggest a double or tripple port knocking as another alternative. If th...

stoser

Expanding on what mali2003 said, I would recommend TWO filter rules. The first will accept traffic explicitly from the one address in the 192.168.20.0/24 subnet to the entire 192.168.0.0/23 subnet, in the forward chain. The second rule would drop all traffic from the 192.168.20.0/24 to the 192.168.0...

stoser

I am not really sure what you are asking, or what behavior your are experiencing. Will need more information. Is the email not being sent correctly? Are you referring to the TLS property of the email tool? Does the mail.com server return an error?

stoser

Three possible problems: 1) Instead of the print command, use the find command . 2) since should not be capitalized (SINCE != since). 3) the get command needs to be executed from the netwatch directory level. It does not exist at root level The following works on a 3011 running 6.40.4. From Terminal...

stoser

Also ... I just read the page that you referenced ... I now see why you are confused. "Interfaces" does not refer to physical ports. It refers to interfaces that can be referenced in the command line, winbox, etc. So any configurations that you apply when you have a switch group MUST refer...

stoser

In response to your questions, based on my experience and understanding (I have 2 different 2011 routers, and 3 different 3011s, which function similarly) 1) The master port is usable. The master and all slaves will function as a standard switch. You can have up to 5 ports on each of two switch grou...

stoser

Okay ... So I scripted a workaround, where I run a script on a schedule every few seconds, and calculate the avg Rate in kbps over that period. See below. It's self explanatory. If by some chance anyone knows how to access the "Rate" property in the Filter Rules directly, please share, as ...

stoser

I need to access the transfer rates associated with a firewall filter rule. The properties that I am referring to can be seen in winbox in the following place: ip/firewall/filter/ ... choose a filter rule ... go to the Statistics tab ... Under that tab there is a graph displayed, and four numerical ...

stoser

Dear dorostkar: When you access cameras, are you accessing them from outside the network in which the cameras are located, or from inside the same network? With what address are you accessing them? a) If you are accessing the cameras from within the same network, you need to access them using their ...

stoser

What is the latency to the server? If high (due to number of hops or physical distance) it could be the TCP window size causing the bandwidth to effectively drop. Try downloading numerous files simultaneously from different servers, add up the bandwidths, and see if you now get the 100Mb/s. Remember...

stoser

simple queue

or

statistic gathering ip filter rules

stoser

1) If you bypassthe Mikrotik, and connect a computer directly to your ISP, does the IP address/gateway/netmask work? 2) If you have connectivity directly form a computer, reconnect to Mikrotik: Do you have filter rules that may be dropping the requests? You only posted the mangle and NAT rules ... s...

stoser

change

dst-address=2.2.98.193

to

dst-address=2.2.98.206

stoser

2 chain=dstnat action=dst-nat to-addresses=192.168.5.15 dst-address=2.2.98.193 in-interface=ether1 log=no Hamsterman: In the above rule, you are forwarding all traffic directed at the gateway 2.2.98.193 to 192.168.5.15. I think that what you really want to do is forward traffic directed to your IP ...

stoser

Hamsterman:

Please post

/ip route print detail

This way I can see routemarks/routing tables

stoser

[admin@MikroTik] /ip route> print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 ADS 0.0.0.0/0 1.1.194.1 1 1 ADC 1.1.194.0/24 1.1.194.166 ether1 0 2 AD...

stoser

safiullahtariq: If I understand you correctly, then you need for internal souce addresses to NOT be routed out the WAN when accessing Internal (or DMZ) servers/services. What I do in such cases is simply bypass the rest of the mangle rules when I detect that source and destination addresses are inte...

stoser

ekpesinyang:

Post screenshot of

1) MAIN page of UBNT
2) Wireless/registration/signal tab on Mtik from winbox for CPE in question...

stoser

cdiedrich was referring to the mtik ... Uniquiti doesn't use one chain to rx and the other to tx, the way I inderstand it is that ubnt uses both chains simultaneously for both rx and tx and thus decreases error rates. So if the Mtik is setup to utilize the two polarity chains in a different way, the...

stoser

Hello, I don't think that it is a polarity mismatch, the Power Beam M5 400 is a dual polarity unit, and I've tested them at 20 degrees off center, and have never seen such a mismatch between signal strengths on AP and CPE. In my experience you would not see such a difference between signal strength ...

stoser

Have you tried using the dynamic address feature in IP/firewall/address-list? Put the http address in the address field, instead of the numeric ip address. Then Mtik dynamically creates entries in the address list. @ZeroByte mentioned this in another post, and it proved very helpful to me. Hope it h...

stoser

Loud and clear, your description makes perfect sense. Thank you.

stoser

Hello, I can't seem to find what the "bytes" and "packets" read only properties capture in IP / Firewall under Filter NAT and Mangle. In the manual it simply says the "Total amount of bytes matched by the rule" and "Total amount of packets matched by the rule"...

stoser

lelos09: No other mangle rules? If there are, is it possible that they are being triggered? The rule you show has passthrough=yes. No other routes? How do you connect to ISP 1 and ISP 2? What type of service do you have with ISP 1 and ISP 2? Is it PPPoE? if it is PPPoE, is the Mtik handling the PPPo...

stoser

need more information.

show us your ip firewall mangle rules
show us your ip/routes
show us you ip firewall NAT rules

stoser

see this older manual page: https://www.mikrotik.com/testdocs/ros/2.9/tools/graphing.php It states: " RouterOS generates four graphics for each item: "Daily" Graph (5 Minute Average) "Weekly" Graph (30 Minute Average) "Monthly" Graph (2 Hour Average) "Yearly&q...

stoser

see this old post, it may help you

http://forum.mikrotik.com/viewtopic.php?t=26342

Your problem may be the way you set up the default route for your PPtP, and how you associate it to your routing mark.

stoser

Be more sapcific so staff or other user can help you . Elittebb : He was tarpitting the packets, and you wrote "be more SAPcific" ... Gave me the best laugh of the week... :lol: Nitchky: As elitebb wrote. You do not see the logs in the firewall rule in winbox. You can view them in the &qu...

stoser

You should start using the dns-based IP address list feature available in ROSv6.36 block http://www.youtube.com, youtube.com, m.youtube.com, etc. That will block them from any sort of communication, not just http/https. Furthermore, it will block even SSL communications. ZeroByte: Just wanted to th...

stoser

Based on your post, I have absolutely no idea what your network setup is. More details are needed. Show us your tracert and explain the network setup in more detail. Also explain what the 750 is doing. Is it routing? Is it masquerading? What are the ip addresses on the 750? Routes? With the info you...

stoser

You've probably tried, but ... Have you tried to log in with winbox, plugged directly into the router (or otherwise trasnparently bridged to the router), by MAC address? Older versions of winbox allowed this, can't seem to find out how on mewer versions, so I keep v2.2.18 in my laptop just in case ....

stoser

acooperator: jarda is correct on all points. Also, thanks for the welcome jarda. The main thing I can add is this: There are many potential problems with your setup. We cannot possible know what they all are, and we cannot be expected to solve them for you with at a distance. I think that the easies...

stoser

Hello, this is probably not exactly related to your problem, but I'm adding it here just in case it might be useful to you, or if someone searches for topics on overheating units at some point in the future. About 6 months ago I had a 2011 reach 80+ degrees celcius in a forced air ventilated rack (n...

stoser

When Windows shows "No Internet Connection" but you are successfully connected to a wireless network, it is indicative of a gateway problem or perhaps a DNS problem. If I recall correctly, windows performs two checks to determine internet connectivity. The first is a DNS request (tcp port ...

stoser

eKo1: The behavior that you are describing in item 2 of your initial post is a classic case of a hairpin NAT. If you want a better understanding of the problem, read this:

http://wiki.mikrotik.com/wiki/Hairpin_NAT

Regards,

stoser

Hello: In rules 10 and 11 in mangle, under property PCC, you specify 2/2 and 2/3. This is not possible, since the second number is the remainder of a simple division operation. In brief, 2/0 means that the algorithm will divide the number of the connection by 2. if remainder is zero, then the rule i...

stoser

Sorry BartoszP, you are correct. My post was intended for acooperator. I got confused and typed the wrong adressee. I'm reposting below, and have added an additional item that I thought may help diagnose the problem. acooperator: This may seem very basic, but please try the following: 1) In your wir...

stoser

Concerning your 4 dsl connections: FYI, I am load balancing 12 vdsl connections on a 3011. My suggestion is, if possible, do not use the modems as routers. Set them to Bridge mode and have the MTik handle the PPPoE client connections. If you must use the modems as routers, it would be simpler to giv...

stoser

Bartoszp: This may seem very basic, but please try the following: 1) In your wireless Interface, go to the wireless tab. Set the frequency to a static frequency. Do not use AUTO. Also, set Channel width to 20Mhz. 2) Go to IP --> DHCP SERVER --> NETWORKS. Make sure that the network is set up correclt...

stoser

A couple of questions: 1) Please clarify that you mean by "behind" the router. Do you mean when you try to access it from inside your network (LAN)? 2) What is the LAN IP of the computer that you are using to try to access your client's routers. 3) What are the LAN IPs (or IP range) or you...

Search found 123 matches