MikroTik

Znuff

This is interesting! I welcome the addition of native macOS and Linux apps, as the WINE way of running it on macOS felt absolutely terrible and buggy. That being said, while I appreciate the polished new design, and obviously it takes a while to get used to, I find it that it's much more difficult t...

Znuff

That's only for DHCPv6 Relay, which is not helpful at all for most people. I just want to make DHCPv6 reservations based on link-layer adress.

Also it's only RouterOS 7, which is beta, and it's not for my platform (powerpc, RB1100AHx2).

Znuff

Still waiting for RFC 6939.

Without this, IPv6 is unmanageable in RouterOS.

Some client/home-users routers are in a very broken state and they somehow re-generate their DUID all the time, causing /56 pool to be exhausted in 1 hour or less.

Znuff

The recent large security redesigns flowed from the April 0-day. Normis even explicitly stated it, so you are discussing nothing new: Advisory: Vulnerability exploiting the Winbox port [SOLVED] I wasn't even aware of the 0-day exploit from APRIL. I only received the e-mail from MARCH stating that a...

Znuff

Security advisory emails were sent to all users that are in our database. The only e-mail I received was on 31st of March, with: It has come to our attention that a rogue botnet is currently scanning random public IP addresses to find open Winbox (8291) and WWW (80) ports, to exploit a vulnerabilit...

Znuff

It's not an "ip conflict". CPU Usage is low (10-15% tops). I ping from router to lan and lan to router, same results. Like I said, this happens on 2 of the same boards (RB750), but in completely different setups (one is at home, one is at one of my clients). I am very much aware of what is...

Znuff

Is anyone seeing this issue? I have 2 x RB750 (legacy stuff) running either 6.29-6.31+ that show the same problem: after 1 or 2 hours, local latency is incredibly variable, anything from 10ms to 100ms. I've tried resetting the board to defaults. I've downgraded from 6.31 to 6.29 but the problem stil...

Znuff

I second this.

In high-density settings, "band steering" (ie: moving clients that connect to 2Ghz radios, but support 5Ghz, to the 5Ghz radio) is a godsend.

It's a shame that 3 years after this request was done, there is still no sign of such a feature in RouterOS.

Znuff

*bump* again

I'm sure that if Netgear and D-Link can do it, you guys can do it, too.

Znuff

Would anyone be able to test the maximum amount of WiFi clients that this device can support? In real-life tests we concluded that 951 can handle at least 50 users connected simultaneously and still deliver ~30Mbps. I'm interested in this model as a device for hotel-wide WiFi setups, as a replacemen...

Znuff

You will need to block c.whatsapp.net This is currently resolving to these IPs: # dig c.whatsapp.net ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.1 <<>> c.whatsapp.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47757 ;; flags: qr rd ra; QUERY: 1, AN...

Znuff

No link, software is not "ready" for anyone else yet

Znuff

As VLANS are independent L2 domains there is no reason not to assign them same address ranges.

Yeah, there are.

It's a stupid thing to do. Just use different classes.

I don't understand why you would use 100-120 for vlan2 and 200-220 for vlan3 when they aren't even on the same subnet or vlan.

Znuff

My scenario assumes the following: - All your customer leases are on a single machine (we have a main gateway/server). - You are not using a transparent proxy (I am using this to redirect the clients to the "block" page) - Your clients are using fixed IPs (but assigned through DHCP) -- The...

Znuff

I made a simple client administration interface for networks which use dhcp. Here are some pics of it in action: Full Client List: http://i.imgur.com/1noyZka.png Filtering works by typing anything in the search field (can it be mac address, name, ip, dhcp-server name etc.) http://i.imgur.com/Ssiap57...

Znuff

Throws an error at line 6 :while ($i < [:len $aliases]) { -- nevermind, fixed that, there was a missing do={} But there's still an issue at :set server [:pick $aliases $i] ...right, because that has to be either a local or a global variable, not "set". Still not exactly working. Script run...

Znuff

Correct me if I'm wrong, but your last example wouldn't actually work properly for my usage, as I'm trying to get *everything* that contains "youtube" and "googlevideo" etc., as youtube has dozens of CDN hosts and I really have no idea how to get them all other than searching for...

Znuff

So for a while now I have been using this script: :global FindList do={ :local myListName $list :local myTimeout "1:00:00" /ip dns cache all { :foreach j in=[find where (name~$server)] do={ :do { :local myName [get $j name] :local myType [get $j type] :local myData [get $j data] #:local my...

Znuff

Having the same issue

Znuff

Could we get support for address-list's in web-proxy?

Thanks.

Znuff

What's your progress on this? Are you using the Connect method (with the JavaScript SDK)? Or simply asking for a Like (without an App confirmation)? I'm interested in doing something like this, too, and I was just looking into Facebook's API. If you're using the App method - where are you hosting it...

Znuff

I know what I'm doing - but *WHY* don't they match anything?

Znuff

I have the following setup: /ip firewall mangle add action=mark-connection chain=prerouting comment="Mark Everything" disabled=no new-connection-mark=everything passthrough=yes add action=mark-connection chain=prerouting comment="n-zone -> extern" connection-mark=everything disab...

Znuff

I had a similar problem using PPTP on a RB750.

Wasn't able to push out more than 13k/s either.

Unfortunatelly I don't have access to a RB750 anymore to test further.

Znuff

Yeah, but there's no way to get EoIP on Windows, right?

So, basically, if I don't want the whole 192.168.100.0/24 to be able to view 192.168.1.0/24, I'll need a RouterOS box just for my laptop, right?

Znuff

Hi there,

I have the setup above - how exactly can I view the network behind my server with the WinBox scanning feature? I tried L2TP but it seems it doesn't work.

Znuff

They work. But not all websites show your real IP address. Some are designed badly and don't check all the HTTP fields corectly.

Znuff

Look up DHCP next time. It will save you the trouble of reconfiguring users computer manually.

Znuff

Solution 1: Proxylizer
Solution 2: Proxy logs sent to a remote logging machine that eventually stores the data in a database.

In either case, you won't be able to monitor SSL (https) connections. Also, your users should be informed about this. It's a privacy concern.

Znuff

Get a secondary web server. Easiest solution by far.

Znuff

Mangle rules are the solution, but it's not an easy concept

Znuff

Enable "Transparent" proxy.

ofcourse your "public ip" won't work, the requests are handled by the PROXY MACHINE, wich is your gateway or whatever.

See here: http://www.ioerror.us/ip/headers

Znuff

Turn on Connection Tracking.

Znuff

Try turning off "Default Forward".

Znuff

Wouldn't it be easier for you guys to stop shoving that hotspot in our face and just create a simple configurable webserver for RouterOS? Doesn't need to run anything special. No Server Side scripting, no nothing. Just to serve static files. Would be usefull to be able to add more than one on differ...

Znuff

Is anyone actually receiving the correct info for the MEM/DSK graphs?

I get weird values.

Znuff

This issue's been here for ages. I even made a ticket about it and got assured that it will get fixed. Guess what? It didn't. I've specifically told you guys that if you log out for more than aproximatelly one hour, you lose your session. You lose selected collumns and such. If you log out and log b...

Znuff

This doesn't freakin' work. We spent 5 hours trying to figure out WHY our "internet" didn't work on a remote station because our first wireless p2p bridge was using station pseudobridge. And guess what? We just added WDS and the damn thing worked. How exactly is station pseudobridge suppos...

Znuff

Can we have old squid back in 3.x?

Thanks.

Znuff

There:

webproxy-3.4.png

Znuff

We've already been trough this with support.

The Mikrotik webproxy is slow. Very slow compared to squid.

Even upgraded to 3.4 today and it was STILL slow. Under 2.9.x, the webproxy-test was slow _AND_ buggy.

No issues with the old webproxy. Any chance to have that back in 3.x?

Znuff

1st of all, stop using AlTeRNatiVE CApS ThiNGiE. It's really annoying. Pay some respect please.

2nd of all, have a look under Firewall -> Address List (/ip firewall address-list in the console).

Znuff

You most likely got a JMICRON IDE controller, wich is very faulty under linux. If I remember corectly, the onboard ethernet is an intel e1000, thus it requires the newest drivers. If Mikrotik is not using the latest linux kernel, it won't work. You could also have a realtek gigabit controller that n...

Znuff

Are you guys just going to release major versions one after each other untill you reach 3.9 and then going to start with minor versions? 3.9.x?

It certainly seems so.

Znuff

3000 clients behind NAT?

Are you buying IPs for $10/a piece? Or what?

Jesus.

Znuff

yes, there are 64Gb: http://gadgets.fosfor.se/64-gb-compact-flash-from-samsung/ and 48Gb: http://www.engadget.com/tag/48gb/ tip: you don't need so much cache, because most of the web objects today are not cachable, everything is dynamic and built on php + javascript. you can only cache images and s...

Znuff

I took a similar approach (block port 25 outgoing) so users can still use SMTPS (over ssl) on different ports, but I've created an address list, so I exclude everyone who requests smtp acces by adding them to that IP list. /ip firewall filter chain=forward action=reject reject-with=icmp-network-unre...

Znuff

Also, you should look about increasing the MAXIMUM CLIENT and MAXIMUM SERVER connections, as 1000 is quite... low :-/

Znuff

2.9 is considered legacy

Znuff

As a customer I'm paying for bandwidth. Why restrict me using the bandwidth I'M PAYING for?

Znuff

I'd sue an ISP if they'd block peer2peer.

And anyway... there are always tunnels and traffic encryption to go pass your filters... so why bother?

Znuff

Do I have to mispell and talk bad english to get an official answer around here? :-/

Znuff

I noticed that after the proxy crashed the first time, I can't stop it anymore! I tried unticking the "Enable" checkbox, and hit Apply... but nothing happens. Even tried disabling it from command line! But the darn thing doesn't want to stop. [Znuff@gateway.n-Zone.ro] > /ip proxy [Znuff@ga...

Znuff

I'm not going to upgrade my box to v3 yet. [Znuff@gateway.n-Zone.ro] ip proxy> print enabled: yes src-address: 86.107.189.1 port: 3129 parent-proxy: 0.0.0.0:0 cache-drive: system cache-administrator: "" max-disk-cache-size: 51877000KiB max-ram-cache-size: 287034KiB cache-only-on-disk: no m...

Znuff

I can't believe nobody else has seen this before...

Nobody filled up their webproxy-test?

Znuff

We ship PoweRouters with dual-core P4s and so far had no issues that I know of with using multi-cpu .

There's no such thing as dual-core pentium 4. It's Pentium D.

Yes, I emphaze semantics.

Znuff

Could someone supply some links where the "multi-core issues" are described on linux?

I'm having a hard time finding any info. And curiously I see linux boxes running with 2 to 8 cores without problems. I say... *what* issues?

Znuff

Hello, I'm curious if anyone else has the same issue. The webproxy-test package works great in 2.9.50, I can see it's being more efficient that the old squid (package webproxy), but I seem to be having the same issue again and again. When the hdd fils up, the proxy goes *POOF*, it crashes, doesn't w...

Znuff

Actually we need 8 gigabit ports.

Znuff

Hamachi is a proprietary client and server application. You can't setup a server... DOH. And even if you could: how the hell would you make the client application to connect to your own server? Hamachi uses the address range 5.0.0.0/8 wich is reserved address space especially for this kind of applic...

Znuff

This is confirmed under version 3.00 RC7 too.

Znuff

Can't try to use RC6 on that particular box. It's our main gateway and I don't want to risk breaking internet access for all our customer. I'll try and see on another box.

Znuff

Is this thing actually getting noticed?

Znuff

The PPPoE _server_ supports up to 200 clients.

Turn on debug for ppp and see what you get.

Znuff

Erm... Port 25 is the standard email port. There's no reason to change that... Instead MT RouterOS should support SMTPS for ISPs that block that port.

Znuff

So where do I post a bug, seeming that here nobody notices the bug posts?

Znuff

Can the MikrotikHttpProxy use a Squid running on Linux as a parent proxy or do I have to use the old webproxy package based on squid for RouterOS?

Znuff

Hello. I'm using webproxy-test under 2.9.45 and I have a small issue with a website and probably with others. Try visiting http://www.upc.ro when the webproxy-test is enabled and set as transparent proxy. Nothing loads up. Not the images, not the javascript, not the css and links don't work. Upon di...

Znuff

is that nstreme2? 'cose I find it hard to believe if even routed without turbo...

and I usually get x86's if I need good speed and space is not a problem.

Znuff

or just enable UPnP

Znuff

What kind of internet connections are those? Cable Modems by any chance?

Znuff

if you plan on using that kind of restrictive firewall then just drop the public ip space, there's no reason for it if you don't accept NEW connections.

My 2 cents.

Znuff

just set them as 1db or something similar

Znuff

Me too pretty please.

znuffy@gmail.com

Gmail doesn't accept .exe's, or zipped .exe's, so you should mail it as a rar or something

Thanks

Znuff

oh, I didn't notice that, my bad

Znuff

I would very much like to know how this works too... I could't make it work when I tested. Tried the same way as jd6strings:

RB133 { ether+wlan (mode=ap-bridge) bridged } -->> RB133c { ether+wlan (mode=station pseudo-bridge) bridged }

Znuff

You could probably run a router on a 16bit cpu

you don't need big float operations on a router to actually need 64bit.

Znuff

Waaaaaaaaaaait, but how was the p2p filtering done previous to layer7? in 2.9.x?

Znuff

Yes, that's how queues work. Under any system. When you reach maximum bandwidth, that's the only way something is going to slow you down.

Packets will be slowed down and queued. That's how latency appears

Znuff

With simple queues that would be easy:

add a simple queue for 1024kb

then, add 4 other queues for 1024 with the first one set as a parent!

Ofcourse, the smart way would be to use queue trees so they each get equal bandwidth

Znuff

1st of all I have more than 200 computers. 2nd a max-timeout shouldn't be user configurable - that's why we have an option to specify the TTL, refresh, retry etc. values for our domains. When I'm talking about DNS changes, I'm reffering to websites that move for a reason or another. DNS is a very dy...

Znuff

Mikrotik is not 64bit.

If your CPU supports x86 instructions too, it should work.

Znuff

You shouldn't even get 14Mbps if you locked to 24Mbps.

Znuff

Is this 2.9 or 3.0?

Znuff

I'd seconnd that reconnect stuff.

It could just ask me if I want to reconnect after it gets a disconnect. Would save the trouble of starting winbox again, even after a reboot.

Znuff

A government agency would just run fiber and not wireless, they have the resources. Also, any kind of encryption will add protocol overhead and will slow down the link considerably.

Znuff

Having THAT BIG DNS caches is stupid. Why? Because the world keeps changing. Websites update their DNS every day.

10MB is MORE than enough, considering that 256Kb of DNS cache can hold more than 1000 entries. I've never seen my DNS cache max out at 10MB, even for a month of uptime.

Znuff

rb133c has less memory than rb133... I wouldn't recommend you use it as an Access Point

Znuff

Are you sure you're not maxing out the queue?

Znuff

You're doing something wrong. You can't get that much if you locked to 24Mbps.

Znuff

I'm guessing you want to do something like this: [ gateway 192.168.1.1 for network 192.168.1.0/24 ] | v [ BOX1, set as an Access Point, 192.168.1.2] | v [ BOX2, set as an AP Client, 192.168.1.3 on the wlan, gateway for 192.168.99.0/24, 192.168.99.1 on the ether interface ] Just add a default route, ...

Znuff

User Manager can do all that, and I'd guess it's even easier. I'm not sure what you mean by Captive Portal.

Znuff

Hello. 1st of all, this is the wrong category for this question. A more appropiate place for this would have been the General Networking section, but maybe someone will move it. Anyway, the short answer is YES, you can do that. I just recommend you use simple queues or other type of queue to limit t...

Znuff

Hello again, and sorry for the double post. We tested with RouterOS v3rc4 tonight and here are the results: UDP - from Computer to Computer (same setup with WDS + Bridge): 57Mbps one way, with the bandwidth test. TCP - from Computer to Computer (same setup, wds + bridge): 37Mbps one way, using FTP. ...

Znuff

if you have access to a linux box, it's easy, here's a bash script that does what I mentioned above and creating the .rsc script to import them in RouterOS: #!/bin/bash #Replace file.ips with the name of the file with your original range ips ORGFILE="file.ips" #empty the files :-) echo > f...

Znuff

Post your routes table.

Znuff

Encrypted p2p traffic is impossible to detect.

Znuff

You should create an Adress List with the contents of that file, but they have to be entered in CIDR notation. So: 62.13.192.0-62.13.223.255 becomes 62.13.192.0/19 62.26.210.0-62.26.210.63 becomes 62.26.210.0/26 and so on Then you just create a firewall rule to deny connections to and from that src/...

Znuff

Try this:

http://wiki.mikrotik.com/wiki/Transpare ... o_Networks

Znuff

What CPU do you have there? Is it a RouterBoard?

Znuff

Are you using Queues?

Is the client maxing out his bandwidth? Because that's the way queues work. Once client hits his maximum bandwidth, his latency will increase.

Znuff

Is this too complex?

Znuff

Then let's hope we get v3 asap

Znuff

Our setup was like: RB133 {bridged ether2 & wlan2} {wlan2 mode = bridge, wds dynamic} | | v RB133c {bridged ether1 & wlan1 } {wlan1 mode = station wds} (We followed this tutorial: http://wiki.mikrotik.com/wiki/Transparently_Bridge_two_Networks as it seems that you CAN'T bridge an ap client -...

Znuff

Any clue where could I buy that kind of cable? Or some prices please?

Looks really interesting.

Znuff

what do you mean by mount?

Znuff

RedHat 9 is seriously outdated and insecure and has reached End of Life for ages. Squid packages might be insecure and exploitable. You can use debian or even ubuntu-server, and that actually works on a low-end computer like 233Mhz with 128MB of ram or something similar. Please stop instructing user...

Znuff

post the full message

Znuff

Simple answer: you can't.

And you shouldn't. What if the user has more computers at home? Many people have a laptop and a desktop @ home and their using a router so they can use them both at the same time. I'd stay away from an ISP like that.

Just a friendly advice.

Znuff

Nope. It can be done under linux, but it's a bit complicated.

Znuff

voip4life: depends, I'd like to see the names of my customers, not their MAC address... as I can't ask the customer "oh, so you're 00:0F:F3:3D:whatever ?"

Znuff

No, you won't be able to block MSN Live Messenger. Whatever port you block, it will try to a different one untill it connects.

Znuff

Yes, but not with Red Hat, unless you're willing to pay $1000 or whatever for an enterprise license. Use Ubuntu Server + Squid.

Znuff

Who's doing the routing between 172.16.0.X and 10.0.15.XXX/16?

Znuff

I don't think Squid or any other proxy will comunicate properly with Win2003's ISA. Your best chance is to use Linux with Squid or RouterOS.

Znuff

Sorry for the double post, but it's easier for me this way :-) Currently we don't have the 2nd connection set-up, and the customers are all using our main connection. We want 192.168.9.0/24 and 192.168.11.0/24 to be NAT-ed under the 2nd connection. (The ones in the diagram marked with NAT and PPPoE)...

Znuff

Hello,

This is our network diagram. I'll post our complex config in a new post.

Znuff

Hi. I would also like to have First / Last name in the User List, or at least make the fields searchable . I'm planning to switch all clients to DHCP-Radius-UserManager, but I need to be able to search them by those private fields, including LOCATION. Please have it in version 3.0, at least. :-) Oh,...

Znuff

There are lots of different NIC Chipsets in those NF3/NF4 Mainboards. Could you be more specific?

Znuff

well, input/output only reffers to packages to wich the destination/source is teh router itself (mt), you probably want to add those rules in the FORWARD chain.

Znuff

Remove the 2seconds delay, there's no need for that.

Znuff

Hello, I've implemented the Local/Overseas traffic on two of our networks, each network has a MT as a gateway, using this setup: --- My ISP ---> [ MT - TCT ] --- Network|---> [ MT - NZN ] ---> Customers-NZN |---> [ MT - IT3 ] ---> Customers-IT3 |---> Customers-TCT My problem is mainly the way traffi...

Znuff

First of all you should set up your DHCP server as Authorative, most ADSL routers with dhcp obey that flag.

Znuff

Hello, I'm trying to extend the Different Limits for Overseas/Local Traffic into something like "Local/Metro/Extern", in wich Local means the local network(s), direct peering or such, Metro is for my ISP's Network and Extern is for the rest of the connections. My setup consist of 3 MT's, o...

Znuff

transparent proxy works ok, there's no issue with that

Znuff

then don't block those websites

if you're an ISP that's probably against the law

Znuff

Will queues still work?

I'm using this setup:
http://wiki.mikrotik.com/wiki/How_to_ap ... as_traffic

and I'd not sure if this will work after I switch my clients to PPPoE, and also, will transparent proxy work?

Znuff

Hi. My network has grown larger and larger and I had the need for a second /24 IP class but because they don't share the broadcasts, 2 clients from 2 different classes communicate trough the Mikrotik router. Can I do something about it? Is it possible to make them "communicate" without pas...

Znuff

I'm thinking of switching the whole network to use PPPoE, but one thing is not clear to me: how do I stop the clients from just configuring their network address manually and accesing the internet? I'm kind of new to PPPoE

Znuff

dainen: I'm looking for a solution that I can just enable/disable one rule whenever I want to block a customer

I'm not the full-time admin of that network, the person who manages is not that technical and I want to keep it simple... Eventually to make a script that enables/disables that rule

Znuff

dainen: I'm looking for a solution that I can just enable/disable one rule whenever I want to block a customer

I'm not the full-time admin of that network, the person who manages is not that technical and I want to keep it simple.

Znuff

I don't want to block only TCP, that's the issue. I want to block everything. If I block only TCP they could, for instance, play games over the net =/

I'll try the mac auth. in hotspot this weekend when I get back into town. Is arp=reply-only still needed if I use hotspot?

Znuff

Sorry but I don't understand your english... You lost me on the subnet parts =/ Could you please explain more detailed? I'm willing to try this MAC Authentification on the hotspot if you explain me in depth :-) Also I want to specify that I have 2 public ip classes, a /26 and a /25 (and I'll probabl...

Znuff

Well, I don't want to use authentification, as it's not such a big network (max 200 users). Can't I just redirect all traffic to another http server?
I've tried that in numerous ways, but it seems I'm missing something.

Znuff

Currently I'm telling my customers to pay the bill with the hotspot trick described in the wiki http://wiki.mikrotik.com/wiki/How_to_Block_Customer. Problem is that I'm also using arp=reply-only, and I still want to use it. When you enable the hotspot, it bypasses all clients, so if a client just ch...

Znuff

Try connecting your computer directly to your ISP. See if it works. If it doesn't then your provider blocked your entire connection.

If it does, verify your mac address. They have no way in finding out that you have a MT router.

Znuff

I'm paying $200 for 10Mbit, fiber... your price is unbelievable!

Znuff

I tried using DHCP leases. I added every client, bla, bla... I set arp to reply-only and clients are still able to access the internet and ping the local mikrotik server... How's that? =/ I've got enabled the following "tricks": http://wiki.mikrotik.com/wiki/How_to_Block_Customer http://wi...

Znuff

well, first I tried to block everything in forward that is not marked with "allowed". but if I mark packages that way, bandwidth limiting doesn't work anymore, because it overrides the previously "local" / "external" traffic marks. I can't use the ARP table because I us...

Znuff

Hello. I know this thing has been posted, but I feel like I've got a special situation: I need to create a "WhiteList" for people that are allowed to acces the internet on the MT. I'm only using it as a LAN station, so no Wireless involved. I've been trying numerous solutions... I can't ma...

Znuff

this is so freakin' frustratring... I borked my configuration... I reset everything and now scripts won't work AGAIN X(

there's doesn't say anywhere in the manual that the script has to have the extension .rsc and when you /import you have to omit the extension...

Znuff

nvm, figured out

Search found 142 matches