MikroTik

nicopretorius

Our problem was caused by the "next_pool" function. Any IP address in the next pool experienced the problem. The hotspot setup do not allow you to specify anything but a /24 mask, but you can change it manually to a bigger mask.

nicopretorius

We have a requirement to "zero-rate" traffic to a specific range of addresses in the hotspot. When a user have an allocation of 10GB per month we want to zero-rate traffic to walled garden addresses to ensure that traffic to these addresses are not deducted from the user's data package. Ha...

nicopretorius

>>Why are you using multiple ip pools? Due to the size of the hotspot. It is at an international airport with a Cisco WLAN network with Cisco controllers and during busy times we have more than 2500 active leases. Unfortunately the Mikrotik hotspot setup do not allow you to a specify a supernet and ...

nicopretorius

Did you ever manage to get to the bottom of this problem? I have the same issue on 5.25. In my case I noticed the problem is specifically occurring in the case where multiple ip pools are used. The problem only occurs on DHCP addresses issued to pools 2,3,4 etc. Clients with DHCP addresses from the ...

nicopretorius

Would you mind to post the specific reference or more detail how you solved it?

Thank you,

Nico

nicopretorius

I suggest you also check the capacitors on these boards for the problem we are experiening as per the follwing post:

http://forum.mikrotik.com/viewtopic.php ... 73#p314973

nicopretorius

We have hundreds of 411AR and 433AH RouterBoards that are all starting to fail after they have been operational for about 15months. After some investigation we saw that all devices that fail, have swolen 560uF capacitors as per the image below: http://www.alwayson.co.za/images/capacitor.jpg We furth...

nicopretorius

To answer my own question. It is as straight forward as configuring the dst-nat. The to-addresses does not have to be locally connected to the router on one of its physical interfaces.

nicopretorius

I need to forward RADIUS traffic from an external WLAN controller (customer's network with no routing to my priavte network) to my RADIUS server which is on a private routed network i.e. the WLAN controller does not have any routing to my RADIUS server and vice versa. The RADIUS server (10.0.50.30) ...

nicopretorius

The webcast in the link below has been pepared by Ruckus regarding Hotspot 2.0 and 802.11u. http://ed-link.techtarget.com/r/JE0S18F/6XP3N/AYFZ14/XHF0Y/67B4H/7M/h?a=11183469 Herewith an abstract regarding the contents of the webinar: Learn how the new IEEE protocol 802.11u communications protocol bet...

nicopretorius

Are there any plans from Mikrotik to add support for Hotspot 2.0 and 802.11U? Please see the below URL's for more information: http://www.cwnp.com/cwnp_wifi_blog/hotspot-2-0-and-the-next-generation-hotspot http://www.cisco.com/en/US/solutions/collateral/ns341/ns524/ns673/white_paper_c11-649337.html ...

nicopretorius

Thanks fewi, I have seen the ID is available. However, this will not help for my purpose since we use the serial numbers in our asset register which is scanned via bar-code scanner and therfore need the serial number. The serial number is available via /system routerboard print , but as far as I can...

nicopretorius

Is it possible to retrieve the serial number of routerboards via SNMP? If yes, where can I get the OID for this?

Thank you,

Nico

nicopretorius

I would like to send an SNMP trap via a netwatch script. My SNMP is enabled and I configured the trap target to point to my trap server. If I then issue the command as per the below I would expect to receive a trap on my server, but this does not happen. /snmp send-trap value=Test Is it possible to ...

nicopretorius

Thanks for the feedback. This confirms my understanding.

nicopretorius

Thanks, I already have it disabled. The concern was specific to the hotspot "web service".

nicopretorius

One of our roaming partners raised a concern regaring the security of our hotspot implementation based on the following articles. http://www.irongeek.com/i.php?page=security/ddwrt-csrf-example http://www.gnucitizen.org/blog/persistent-xss-and-csrf-on-wireless-g-adsl-gateway-with-speedbooster-wag54gs...

nicopretorius

Why did this then cause a loop on the network when having two AP's connected with WDS? The two APs' are configured in AP-Bridge mode with static wds. On both of them the wlan, eth and wds interfaces are added to the bridge interface on each of the AP's. I changed the bridge-mode setting from enabled...

nicopretorius

This is not the same parameter. My AP's are in ap-bridge mode.

I'm referrring to:
http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless bridge-mode (disabled | enabled; Default: enabled) on General interface properties, Sub-menu: /interface wireless

Thanks,
Nico

nicopretorius

Can we please get clarity exactly what the new "Bridge-Mode=enabled" option in the Wireless section of a wlan interafce is and how it is different to adding wds and wlan interfaces in a bridge? The description of what this option does, is blank in the wiki documentation. It is very problem...

nicopretorius

Currently we have no plans to add support for PCI ADSL cards, but we do have a plan to make a RouterBOARD with an ADSL port in the future.

Hi Normis, this is excellent news. Can you give any indication on timelines when you think this might become available?

Thanks,
Nico

nicopretorius

Thanks for the reply Normis. Since this aspect was listed seperate in the list of fixes for RC9 and since wireless-nv2 is a separate package to the wireless package, this was not clear to me. Thanks for clearing that it has been included.

nicopretorius

Has the following fix which was incorporated in ROS v5 RC9 been also been included in 4.17?

*) wireless - more improvements for 11n compatibility;

nicopretorius

I would like to add only a specific page to a walled garden site rather than the complete site. My understanding is that this is possible by adding the path to the walled garden Path option in addition to adding the Dst. Host. I want to allow access only to the following site and path: http://www.ne...

nicopretorius

What's new in 5.0beta3 (2010-Jun-17 13:46):

*) hotspot - drop hotspot specific tcp connections from non-hotspot clients
already at firewall;

Can you please provide more information about this new "feature"?

Thanks,

Nico

nicopretorius

Thank you I can confim that these covert work well with the 411 and 433 boards we've tested thus far.

Regards,
Nico

nicopretorius

I cannot understand why Mikrotik keep on discontinuing products without suitable replacements. I specifically refer to routerboards that can be used as internal AP's with PoE (802.3af) switches. I also cannot believe that we are the only people that are begging Mikrotik for 48v 802.3af compliant rou...

nicopretorius

Maybe it would have been better to have started a new post to reduce the confusion. The function of rogue AP detection is not to prevent competitors using your SSID nor will it prevent somebody from ruining your network via interference or other mechanisms. It functions extactly as per roadracer pos...

nicopretorius

Normis, Correct me if I'm wrong, but 'management frame protection' does not protect non Mikrotik clients (laptops, smartphones, etc) from being disconnected. It will only ensure that WDS links between Mikrotik's, or Mikrotik devices in "station mode" are not affected. Therefore it will not...

nicopretorius

Various vendors (Cisco, Xirrus, Trapeze, Colubris, etc.) have implemented Rogue AP Detection as part of their solution and unless you get the network provider to allow your "SSID" to be excluded you will not solve this problem. The best is to scan for the other network's SSID to identify t...

nicopretorius

Hi Normis,

The company that we are working with is prepared to make their code and how they do this available to you. I will send you an email to support@mikrotik.com with more detail.

nicopretorius

We a have a requirement to always display an advertisement in the hotspot pages for our complimentary users. We can do this by using an external transparant proxy which automatically injects an iframe into all browser sessions. It would be preferable if we can use the Mikrotik proxy to perform this ...

nicopretorius

Hi Normis, how would you know whether the client device has support for Management Frame protection? Also this will not solve the problem for non wireless clients and any client that does not support the Management Frame Protection. The only way we were able to prevent the hacker from stealing the s...

nicopretorius

I solved my problem. For my purposes I also needed the following jump and mark-routing rule in the pre-routing chain: add action=jump chain=prerouting comment="" disabled=no hotspot=auth jump-target=hotspot src-address-list="" add action=mark-routing chain=prerouting comment=&quo...

nicopretorius

I solved my problem I needed to use the pre-routing chain as opposed to the forward chain for my purpose.

nicopretorius

I have a requirement where I want to dynamically policy route different categories of hotspot users via different routes, i.e. I have "complementary users" that will be routed via a proxy that injects in inline frame which then displays advertising to the complementory users. However, in t...

nicopretorius

It is automatically put into the hotspot chain when the parameters are configured. There is no setting to select a particular chain.

nicopretorius

I have the same requirements as detailed above, i.e. I have complementory hotspot users which i want to force via a proxy server and I have commercial hotspot users which I want to route via a diffferent path. I have followed the instructions above. I have successfully added the users to the user gr...

nicopretorius

I experienced problems on multiple devices (RB532, RB112, RB153) where the wireless "stopped working", i.e. cannot connect to AP with laptop and WDS links stops working after the devices were upgraded to 3.28. Has anybody else experienced this?

nicopretorius

Any information on the plans for implementing MLPPP server side on MT?

nicopretorius

See the following post for some ideas that might help you. http://forum.mikrotik.com/viewtopic.php?f=2&t=30182 Unfotunately the only way to completely stop the problem while maintaining an open wireless network is if Mikrotik implements a "session-id" connection tracking mechanism to p...

nicopretorius

I have come across another nth load balancing example that was posted by Janisk: http://wiki.mikrotik.com/wiki/NTH_load_balancing_with_masquerade_%28another_approach%29 I have also implemented his approach. The distribution between the IP addresses with this example is better than the http://wiki.mi...

nicopretorius

I have changed my config to the one listed below in order to "resolve my problem" where my "odd address list" contained about 3-4 times more addresses than my "even address list" /ip firewall mangle add action=mark-connection chain=prerouting comment="" disabl...

nicopretorius

See the following topic which acknowledge and explains the disconnects:

http://forum.mikrotik.com/viewtopic.php ... th#p151317

nicopretorius

Hi Normis, thank for the information re ECMP. I have changed my ECMP config to NTH load balancing with masquerade as per the Wiki. Everything seems to work fine except that the load balancing is very skewed towards the "odd" connection. Below find the config that I have implemented on ROS3...

nicopretorius

I have experienced the same problem on the RB600 specific to 3.22. On 3.20 or earlier I don't have the problem. However, once it has failed on 3.22 and I downgraded to 3.20 I still had the same problem. The problem was only solved when I did a netinstall with 3.20.

nicopretorius

I have added the configs as detailed below to my original posting and also upgraded all routers involved to 3.22. I still experienced issues with my PPTP connections. Specifically, the disconnection issues related to my second PPTP connection (from the same client to my secondary VPN server) which w...

nicopretorius

I have the same problem. My branding package also indicates that it is broken on 3.22.

nicopretorius

I have been told that apparantly Chilispot prevents "session-highjacking" by utilising a session-ID. I'm sure Mikrotik should be able to implement something similar?

nicopretorius

Thank you rmichael for a very valuable article. I also got hold of the following article which also has some valuable suggestions: http://www.cs.pitt.edu/~jcb/slides/net2004.ppt However, in order to implement these we would need the help of Mikrotik. I cannot see how this can be implemented otherwis...

nicopretorius

That is an option. However, unfortunately this person will also obtain this information if he logs in with a "valid username". We have been successful to identify and track one of these usernames and are currently using it to gather information for a criminal investigation that has been st...

nicopretorius

Although the detail as per my previous post stopped Netcut, the hacker has found something else and somehow still manages to de-assign the ip address of active DHCP-clients and in some cases highjack their sessions. He changes his IP addres so often and so quickly that I'm almost cetain he does this...

nicopretorius

I have not made any significant progress with my idea of the script but I have solved my problem in the sense that the hacker is no longer able to "steal" sessions with arp spoofing as per the detail of the following post:

http://forum.mikrotik.com/viewtopic.php?f=2&t=30182

nicopretorius

Although the feature will still be usefull I solved my problem as detailed in the following post:

http://forum.mikrotik.com/viewtopic.php?f=2&t=30182

nicopretorius

I have managed to "solve" a problem that we experienced with a hacker that "stole" our clients' sessions with hacker tools such as Netcut. I combined various methods and also used tips from various posts in the forums to finally get to a configuration that works well for us so fa...

nicopretorius

I want to try and do a script that will detect devices that distribute incorrect mac address detail in "fraudulent ARP packets" and add their addresses to a blacklist. The idea is that the script will sniff arp packets and if the reply-mac address is different to the known mac address for ...

nicopretorius

Is there any way to identify the address of a device that performs arp spoofing and dropping traffic for such device with a firewall filter in ROS? In the absense of this would it be possible to add something such as arpwatch (http://en.wikipedia.org/wiki/Arpwatch) to ROS to enable one to add such a...

nicopretorius

The config works better now that I have changed my config to do src-nat on interfaces as per the latest wiki config rather on the src-address and also based on what has been posted in http://forum.mikrotik.com/viewtopic.php?f=2&t=29464. I use a RB600 as my "ECMP router" and I used the ...

nicopretorius

As many users in the forums I have run into problems with the load balancing example in the wiki: http://wiki.mikrotik.com/wiki/Load_Balancing_Persistent. I have configured a basic setup as per the example with the exception that I'm using interface routing to add the defaults gateways rather than I...

nicopretorius

what's wrong with RB333? it's performance is better than RB532, so there can be no reason it can't do the same as RB532 ...

It does not have support for 48V or Power over data lines.

nicopretorius

I'm afraid I'm not able to repeat your results. Both WLAN1 and WLAN2 on either side have wireless registration of 45dBm or better and connect at 54Mbps for both rx and tx. In fact I have even fixed the rates on either side. CPU is not an issue < 20%. With both iterfaces enabled the best I can get by...

nicopretorius

I have applied the exact config as described by KimC above with two RB600 with R52H cards running ROS3.6. However if I copy a file between two devices on either side of the link the bonding performance with two interfaces is worse than when I use just one of the links in the bonding interface. While...

nicopretorius

Any feedback whether this has been fixed?

nicopretorius

It would help very much if one can limit which menu items a user can see based on his user rights, i.e. I would like to give a user read-only rights but unfrutnately as part oif that he acn also see sensitive info such as radius secrets, local user name details in hotspot, etc. I want to be able to ...

nicopretorius

I also have an ugrent requirement to get this card going on MT. There is huge potential especially on networks where HSDPA have been launched. Please add the support to MT.

nicopretorius

Are there any Wi-Max miniPCI adapters such as the (http://www.wavesat.com/products/mini-pci.html) for which support is available or planned?

nicopretorius

I have a PPTP server setup on MT 2.9.5. Everything works very well, except that I cannot connect to the PPTP server from my VPN client once I have made a sucessfull connection from my Win XP VPN client. Traffic to other hosts on the subnet is fine. Is there perhaps a setting that one can set to be a...

nicopretorius

Changed the channel to 1 which resolved the problem. There is obviously some from of interference that seriously affects the other channels.

nicopretorius

I have two RB511 configured with WDS. The link is very intermittent and I get high packet loss although the devices have good signals levels (better than -68dbm 99% of the time) according to the registation tables. The problem seems to be worse at certain times. Below find some detail: Ping between ...

nicopretorius

Mikrotik recommends a max-mtu of 1480 as the optimal value. However most ISP's recomend 1492 for ADSL (1500-8 bytes overhead for PPPoE). If my ISP recommends 1492, should I still set the value of 1480 on my Mikrotik as per the Mikrotik documentation?

nicopretorius

Below is an extract from the Cisco PIX documenation, which provides more detail about the TSMTP fixup command: The fixup protocol smtp command enables the Mail Guard feature. This restricts mail servers to receiving the seven minimal commands defined in RFC 821, section 4.5.1 (HELO, MAIL, RCPT, DATA...

nicopretorius

Ok I found something. The problem is related to the SMTP fixup setting on the PIX. If I disable the fixup for smtp on the PIX my problem is solved.

I however don't understanbd why the PIX smtp fixup stops the MT email client?

nicopretorius

I'm trying get my MT to do SMTP relaying via my Microsoft Win 2003 SMTP server that is behind a Cisco PIX Firewall. I can send email from my MT with telnet i.e. "/system telnet ip_of_smtp_server 25" without any problems. However the MT email client refuses to sent email via this SMTP serve...

nicopretorius

I upgraded from 2.9B16 to 2.9B18. The upgrade was sucessfull. However when I run Winbox, it falls over, i.e. "Winbox has encountered a problem and needs to close". I can run all other versions of Winbox without any problem (from 2.8.11 to 2.9B16) I even renamed my Winbox folder in Applicat...

nicopretorius

Yes it is possible. We're already running muliple hotspots with VLAN's on 2.9. Create VLAN interfaces as sub interfaces of your hotspot interface and then specify the VLAN interface as the relevant hotspot interface

nicopretorius

It would be great if the DNS name of the SMTP server that is used for relaying email in the hotspot can be specified rather than a IP address.

nicopretorius

I have a MT with router OS 2.8.19 connected directly to a Linksys WAP54G (tried firmware versions 1.08 to 2.08) on its hotspot (private) interface. I also have another Linksys connected on the Internet (public) interface. I connected the linksys to the MT via 10/100 Ethernet NIC's in the MT. In orde...

Search found 77 matches