MikroTik

R1CH

Note that Apple recommends DTIM interval of 4.

R1CH

UDP has no congestion control, so a naïve sender will simply flood the link, ignoring that packets are lost since UDP has no reliability guarantees. TCP provides reliability guarantees and also implements congestion control so that a single sender won't monopolize the link bandwidth. Due to this the...

R1CH

My config is nearly identical to yours, except I have added an address from pool KPN to the pppoe interface. I don't quite recall why this was needed but it might be worth trying.

R1CH

Your clamp-to-pmtu rule is wrong, you should be doing this for packets going OUT of the router, not ones coming in. Change in-interface-list to out-interface-list and make sure MTU of the outbound interface matches what the next router expects (otherwise specify clamping value manually).

R1CH

Is Mikrotik recalling these clearly defective products from distributors? When will these be safe to purchase?

R1CH

Correct, pretty much any number with "22" in it will get hit by scanners, security by obscurity does not work!

R1CH

Test THROUGH the device, not ON the device. Never use the built in speed test.

R1CH

You can also try setting up a qdisc on the Linux server to limit each host to 1gbps, essentially rate limiting how fast the data comes into the RB5009 to work around the broken switch chip.

R1CH

I would not recommend using RouterOS SSH for anything more than device admin, it is proprietary and has had numerous bugs over the years and functionality of the SSH protocol beyond terminal access is likely rarely tested. Plus you will be putting extra load on your router and limiting throughput to...

R1CH

Calling this "new" in 2024... everything old is eventually rediscovered and called new I guess

. This has been known about since the dawn of the internet. You should not be exposing such services to untrusted networks.

R1CH

Remove your "DDoS" rules, they are likely the cause of the problem. Make sure you have blackhole / unreachable routes for private subnets and aren't allowing traffic from the internet to the router.

R1CH

Yeah, RAM and CPU are mostly meaningless for a switch, it's just for management purposes. The big question is if the switch chip is stable or if it has problems like the other CRS models.

R1CH

It's a rack mount switch, if it can't handle being installed in a rack "covered by other peripherals" then it is defective. So glad I didn't take the gamble on this hardware, it's ridiculous that these are still being sold with so many problems.

R1CH

I would imagine the rule does not function with out specifying the protocols. How would it know where to look for the value?

R1CH

Wi-Fi 6E will probably be a year+ away still given how long it took to get AX to market. Don't even think about Wi-Fi 7...

R1CH

The RB5009 CPU should easily be able to handle more than 800mbps though. What's on the other end of the link? Numerous 2.5 GbE cards require firmware updates or similar to function properly, the popular Intel i225/i226 line is pretty much broken for example.

R1CH

It is not possible to redirect HTTPS, HTTP redirect is enough for captive portal detection.

R1CH

One of the first things I do is raise the NAT timeouts, even the Linux default of 30 seconds for UDP is way too low.

R1CH

Flow control for backpressure is not recommended these days, it's better to let packets drop so that the upper level protocols know to slow down. It's especially bad when you have an uplink port that's transmitting to an end device - backpressure from the end device will cause flow control to be sen...

R1CH

CAKE forces all traffic through software traffic control which is very slow, you won't be able to use 1gbps connections with Mikrotik hardware if it is on by default.

R1CH

Use WPA2/3 only, AES only, long, complex passphrase, disable PMKID, enable PMF.

R1CH

Looks broken, I'd RMA.

R1CH

This has nothing to do with Winbox, the malware picks a random appdata folder to hide in.

R1CH

Did you power it on without antennas connected? Maybe you burned up the radio.

R1CH

Contact Mikrotik support.

R1CH

I also really dislike this new design. It looks untidy and makes it easier to accidentally dislodge it.

R1CH

Why are you using hotspot if everyone shares the login? You could make an SSID with WPA2/WPA3 and give the guests that password instead. No worries about licenses or session limits.

R1CH

You're probably getting your frequency changed due to radar detect, and it's selecting a TPC DFS channel which is designed for short range devices. Don't pick DFS channels or use "auto" frequency to avoid this.

R1CH

Some Mikrotik hardware has issues when running ports at 100mbps. If you have any 1gbps devices on the switch try removing them or force all ports to 100mbps.

R1CH

Of course you can use firewall to block whatever you want but the root cause is arp replies from the "wrong" interface. No amount of firewalling in L3 can fix the underlying L2 issue.

R1CH

Contact Mikrotik support via email if you want an official answer, this is a user support forum.

R1CH

There was probably a faulty RAM chip at manufacturing so they disabled it rather than throw the whole package away. It's possibly even something that's detected on a startup memory test but usually that's in the realm of ECC memory. I wouldn't worry about it, 32mb isn't going to make a big differenc...

R1CH

Linux defaults. I don't believe RouterOS exposes the necessary knobs to control this.

https://sysctl-explorer.net/net/ipv4/arp_ignore/
https://sysctl-explorer.net/net/ipv4/arp_filter/

R1CH

@EdPa

Could you elaborate more what "stability when receiving malformed packets" means?

This almost certainly means DoS / RCE from exposed www service. "Stability" in Mikrotik-speak means crashes.

R1CH

Same issue here on two different products with < 100m links, feels like another case of broken hardware design.

R1CH

Yes, make a NAT rule. But crafty students will use DoH and you're out of luck.

R1CH

Why use a full relay and not STUN? Wireguard runs over UDP so hole punching should work fine with a short enough keepalive.

R1CH

There is no protection against DDoS other than having more bandwidth available than the attacker. You absolutely do NOT want complex "anti DDoS" filters with address lists and all that other garbage, you want the junk packets to be discarded as fast as possible with minimal CPU overhead, o...

R1CH

No, it isn't supported. Flash OpenWrt if you want a wave2 Wi-Fi driver.

R1CH

Odd, sounds like some kind of weird hardware failure in that case.

R1CH

Those are LLDP packets, presumably whatever device 4c5e is, is broadcasting LLDP packets, they go out ether6 and there's a loop at the unmanaged switch and the packet comes back. Perhaps some user connected the passthrough port of the IP phone to the switch. Either way you probably have a broadcast ...

R1CH

RouterOS SSHD uses weak and outdated algorithms by default, you need to set /ip ssh set strong-crypto=yes

R1CH

Keep in mind routerboot is just another disk partition, while unlikely it's possible for it to be compromised and allow malware to persist post-netinstall. In this case where the scheduler was used, it's more likely that RouterOS itself was compromised rather than the device itself.

R1CH

This is a UDP broadcast packet. You do not have a blackhole route for 169.254 so the best route is out your gateway, so MT sets up a NAT entry for it.

R1CH

I don't know if it's something about the 60 GHz devices or just extra interference from being outdoors, but I've also had a lot of issues with links dropping to 100mbps.

R1CH

Looks fine, how are you testing the speed? You should test through the devices, not on the devices. And post the config if you still have issues.

R1CH

Note that a single stream will only usually be processed by a single core, it is unrealistic to expect a TCP connection to hit 25 Gbps (never mind without tuning TCP windows and congestion control algorithms). Try with parallel iperf to see more accurate numbers for maximum throughput. If all you ca...

R1CH

Ditch the pointless anti-DDoS / anti-virus / etc rules, they will only slow down your router and cause problems / open you up to DoS.

R1CH

Your ISP might have wrong geo data about your public IP, only they can fix that.

R1CH

I would like some more details of this new default password feature. Is this procedurally generated, e.g. from serial number or MAC address? Or is this a serial <-> secure password table that each distributor gets? Please explain how a distributor is able to help you with a forgotten password and th...

R1CH

Looks like you have some subnet mask issues. That 172.16.0.0/12 looks suspicious. Check all your routes and IP addresses.

R1CH

Mikrotik is not considered enterprise level equipment. Get proper switches for datacenter use if you need features like reverse airflow.

R1CH

The idea is this: if some remote host tries to connect to IP/port combination which is not allowed (either it's not DST NATed in IPv4 or is blocked in IPv6), then such remote host is added to black list. Hence forth the same host can not connect to otherwise allowed/open IP/port combination (e.g. H...

R1CH

The gigabit Ethernet spec requires autonegotiation. If it doesn't happen, then generally the cable or port is damaged.

R1CH

I have a friend who did this with Unifi, hiding them inside cabinets and behind TVs etc. The performance kind of sucks, presumably there's a lot of self-interference from the reflections. I wouldn't recommend it.

R1CH

Using netinstall is probably safer.

R1CH

Try setting more compatible protocols instead of only n / ac. Cheap IOT chipsets sometimes don't even support 802.11n.

R1CH

Note that if you're testing by enabling / disabling the rules while you check the connection, this won't work. As soon as the connection hits fasttrack it will be offloaded to hardware, so it won't hit any more firewall rules. You need to test with a completely new connection every time.

R1CH

Did you try a reboot after deleting it?

R1CH

I only have “drop invalid” on input chain. Never in forward chain even if everything is a public /22 (IPv4) and public /32 (IPv6). We've observed it breaks legitimate traffic such as WireGuard (UDP) for the customers. If everyone is on a public IP, then I agree that DROP INVALID in forward is unnec...

R1CH

This is unnecessary, all input on the WAN side should be blocked by default.

R1CH

The INVALID rule will still function to prevent non-NATted connections from going out. It offers no extra "security" to use strict tracking, it only causes users grief when their valid connections get dropped by over-aggressive timeouts or router reboots. How is a client sending an ACK to ...

R1CH

Internet + IPTV is usually a very complex setup, requiring a separate subnet, DHCP with specific options, VLANs and IGMP configuration. If the CPE box isn't causing you problems I'd recommend continuing to use it, while you can do IPTV over pure Mikrotik, the setup is complex and differs from ISP to...

R1CH

Why do you have open ports to the internet to begin with? Just drop all inbound traffic rather than slowing down your router with these junk rules.

R1CH

It's for picking up existing connections. E.g.: User opens connection to tcp.example.com port 22, sends and receives data. Router has NAT entry to handle outbound / inbound packets. Disaster! Router crashes or reboots for some reason. Or the router has NAT timeouts too low and the NAT entry expires ...

R1CH

40 MHz channel width on 2.4 GHz will certainly lead to bad results. But you need to be specific about what you mean by "Bad wifi", your screenshot does not help.

R1CH

do mikrotik normally reboot if no command / action given when it's in netinstall mode? No, if router successfully enters netinstall mode, it stays in that mode until netinstall "server" (application on your PC) successfully establishes connection. If your router seems to be rebooting, the...

R1CH

Unfortunate that it copied the cAP XL design, I also find it very ugly.

R1CH

Open resolvers on port 53 are often abused for DDoS reflection attacks, your ISP or another upstream is probably filtering it.

R1CH

Very glad I found this topic 1 year ago, I almost purchased a bunch of these and the issue is still not fixed after a year! It must be broken hardware, very irresponsible to continue shipping it.

R1CH

Same issue... I guess Mikrotik hasn't set up any monitoring for this service?

R1CH

This is definitely possible, I have such a router myself. One thing to watch out for is by blocking non-tunneled traffic, if your hotel hotspot / Wi-Fi session expires you will never be redirected to the captive portal to login again.

R1CH

Unfortunately there's not a lot in the way of proper anti-spoofing (DHCP snooping, IP source guard, etc) on Mikrotik products. I've generally found these features to cause more problems than they are worth though with various interop issues and bugs.

R1CH

I hope I never have to use such ISPs that mess with the TCP established timeout... 1 day is already significantly lower than the Linux default (5 days). Unless you're actually running out of memory due to conntrack entries, I really don't recommend touching this. Sure, most home users who do simple ...

R1CH

The unpowered side is safe to use with any hardware, it's just a standard Ethernet cable. Power only goes out the powered side - make sure you connect that side to ONLY Mikrotik devices, it's non-standardized passive PoE so it is unsafe to use with any 802.3af/at hardware as it constantly supplies v...

R1CH

hAP ac is actually 3 chain https://mikrotik.com/product/RB962UiGS-5HacT2HnT

Ah yeah, forgot the original was 3 chain, but the CPU is too weak to actually get more throughput than 2 chains.

R1CH

This indicates you are getting duplicated / replayed packets somewhere.

R1CH

hAP AC2/3 is also only a two chain device, so it can't possibly be faster - it maxes out at 866mbps. While I would also like to see more chains, most client devices are only two chain so the benefits in real world scenarios are limited.

R1CH

layer2+3+4 is OK as long as you don't have fragmentation on your network (which you should never have these days due to poor support of fragments on the internet). The router is stateless, so if it sees a fragment then it has no idea what the original packet's TCP/UDP header was so it can no longer ...

R1CH

Wireguard uses public key cryptography - there is nothing to brute force. Either a packet has a valid handshake or it is silently discarded without any state being allocated, making it DoS-resistant. No one can even tell that Wireguard is running unless they are an allowed peer. See https://www.wire...

R1CH

/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps

Try and set this back to autonegotiation.

R1CH

You can work around it by creating a separate network for such crap, with a separate SSID and authentication configuration. Yeah, I did that. But the interesting thing is that I can't manually configure the same behaviour that auto does: in my case, it seems, Ring cameras want TKIP enabled for some...

R1CH

Both CAP and WAP were updated recently, without name change. New models are based on IPQ4019 and can do ~400-500mbps real world (802.11ac 2x2).

R1CH

I was never able to solve this, it was probably just low per-core speed causing bottlenecking. The hardware was replaced with a Xeon E-2388G based router which has no problem with 3+gbps single connection TCP performance.

R1CH

What exactly was improved? I personally have not experienced any problems with user policies There is a security bug that allows users with limited privileges to elevate them ("become admin"). It requires a specific setup to exist. Why is this not flagged as a security issue with an accom...

R1CH

No, 802.11r/k/v is required. Mikrotik does not support this.

R1CH

Nothing you can do if your pipe is smaller than the attack bandwidth. Has to be mitigated upstream.

R1CH

If you want to run docker and kubernetes you should buy a general purpose server, not a router. Mikrotik is designed for home / office / small ISP networks, not datacenters.

R1CH

Totally normal to see, this is why NAT sucks - implementations of NAT have their own idea of when a connection is "finished" that doesn't match the OSes communicating.

R1CH

"Zero trust" is a common model used by serious organizations. You should not assume your management VLAN is secure, if one device is compromised an attacker should not be able to leverage their network position to move to other devices. So even internally-facing devices and open ports need...

R1CH

Not gonna hold my breath... just look at the problems with the outdated ssh-rsa public key signature algorithm which Mikrotik have known would be an issue since 2020. Unfortunately things have to break before they will be fixed. Please prove me wrong Mikrotik and release a big crypto update that rem...

R1CH

Many ISPs block these ports since they have typically been exploited by worms (Blaster, Sasser, etc).

R1CH

Your firewall input drop rule is blocking your phone's DHCP request (and presumably every other device on your LAN). I am not sure why the default firewall rules were deleted as they take care of this. You should add a rule to input, action=accept, in-interface=bridge1 to trust all traffic on your L...

R1CH

PC in the model name means Passive Cooling.

R1CH

The accept input rule must be above any default drop rule. I would also suggest avoiding "auto" frequency on 5 GHz and use something like 5180-Ceee. Try to avoid upper bands.

R1CH

- Missing country on 5 GHz, probably using channels phone does not support
- Firewall input rules do not have "accept" for established connections, probably why update check is broken
- Fasttrack on PPPOE does not work AFAIK

R1CH

Traceroute works with any protocol, Linux uses UDP for example but you can even use TCP. This whole idea seems shady as hell, like you're hiding what service you're really selling and tricking your customers.

R1CH

500 clients at 2mbps is not happening on 2.4 GHz. You'll be lucky to get 10-20 clients per channel given the interference. Probe requests alone will probably kill half the frequency.

R1CH

With the 4011, if you have a 4x4 client in theory the speed should be ~800mbps with a good signal. The Audience also has a 4x4 radio. Keep in mind you'll need the wifiwave2 package to make full use of the radios: https://help.mikrotik.com/docs/display/ROS/WifiWave2 If you want faster, you'll need no...

R1CH

Try netbooting the device with OpenWrt and seeing if the same behavior occurs there. This would rule out hardware issues.

R1CH

Not without rooting it.

R1CH

Doesn't help. I'm guessing this affects only v7 but it would be nice to know for sure, and whether this will be backported. I've lost at least one 6.x device after a failed upgrade.

R1CH

Regarding this particular release - it fixes a very rare situation when a router could brick itself during the upgrade process by removing/corruption filesystem so the device could not read system files anymore. The router had to be get netinstalled. Does this affect all v6.x and v7.x releases? If ...

R1CH

Well this is one of the scariest changelog entries. Is every prior RouterOS version affected by this "filesystem stability and data integrity" issue?

R1CH

Switch channel on the AP if you can and ideally avoid 2.4 GHz entirely, way too much interference.

R1CH

Hi Rich, restrictive filtering vice the current setting of loose. What penalties does on pay for that approach as there must be a reason mine is on loose, other than I like to match my skin turgor, which at my age is loose. ;-) Loose mode allows asymmetric routing and only drops packets with no val...

R1CH

Then add a blackhole route for 192.168.0.0/16

R1CH

Blackhole route is indeed the correct way to do this. Your more specific local prefixes will take precedence over blackhole.

If you are concerned with private IPs entering your WAN interface, use strict reverse path filtering instead of a firewall rule, it will be more efficient.

R1CH

Simply looking at the SMB menu creates this share, it's one of those RouterOS quirks.

R1CH

Port 514 is https://en.wikipedia.org/wiki/Remote_Shell - your ISP likely filters it to prevent insecure services.

The fact that all your ports aren't filtered though suggests you have an improper firewall setup.

R1CH

Did you upgrade bootloader to v7? If so you have to downgrade it.

R1CH

Pick a provider: https://www.google.com/search?q=dns+phishing+protection

R1CH

In that context, it means "over the distance of 2.4km". So basically, it worked at 2.4km "easily", but they didn't try beyond that.

R1CH

I've been looking forward to 802.11ay for a while so it's great to see devices starting to come out, though I had hoped for at least 10gbps. I hope higher speed links are on the roadmap.

R1CH

Ask yourself, what is the real problem you are trying to solve? Users downloading random .exe files and installing unapproved apps or malware? Then the solution is AppLocker. This shouldn't be something controlled at the network level.

R1CH

Tool / Profile

R1CH

Remember UDP is connectionless, the source address can be spoofed. Using this, anyone with knowledge of your blacklist can now force you to blacklist arbitrary IP addresses. If your legit VPN endpoint IPs are discovered your anti-brute-force is now a DoS vector.

R1CH

That is expected behavior if the wireguard tunnel terminates on the router. If you want to control what the packets inside the tunnel can reach once they are in your network, you need to set up rules on the forward chain. So you're saying that packets entering through a wireguard interface will alr...

R1CH

Pretty much impossible with static filters, there are nearly infinite possible ways of writing the exploit so you'd need a logic parser to be able to catch them all.

R1CH

That is expected behavior if the wireguard tunnel terminates on the router. If you want to control what the packets inside the tunnel can reach once they are in your network, you need to set up rules on the forward chain.

R1CH

OpenWRT also works great on older devices if you don't need RouterOS, I have a hAP AC2 and wAP ACs running OpenWRT which gives modern wireless drivers and WPA3, 802.11r, etc.

R1CH

That is talking about switching device mode between enterprise and home, used to lock down configuration to users (eg ISPs limiting what users can do on their router). The flagged config part of device mode seems entirely unrelated to the mode it is in. I don't even know why it's considered part of ...

R1CH

Still nervous to upgrade any device to RouterOS with "device mode" until I know what triggers it. How can RouterOS distinguish my access from a hacker? You need to press a button to accept some changes. How can a hacker do that remote? ? There's nothing in the docs about pressing buttons....

R1CH

Still nervous to upgrade any device to RouterOS with "device mode" until I know what triggers it. How can RouterOS distinguish my access from a hacker?

R1CH

Perhaps the design of the block diagram could be updated to reflect that.

R1CH

Netinstall + config script

R1CH

You don't have to use Adobe's shit reader, there are plenty of PDF readers without such a massive attack surface and it's built in to a lot of modern browsers. And as others have said, please make all links https:// - I couldn't even click it in my email. Also is the 4x10G SFP+ on the CCR2116 really...

R1CH

BBR is for clients and servers, a router doesn't care.

R1CH

Why are you not dropping everything on your WAN interface? If they are targeting a client behind NAT, then that client would have to have initiated the connection in order for the router to forward fragments. If you're using a routed setup then just drop all fragments at the edge, there's no good re...

R1CH

Yes, it's 802.11ac, Mikrotik do not make any 802.11ax products.

R1CH

I did some more testing, netinstall does actually work fine, I just wasn't waiting long enough for the device to show up. There's something about the BOOTP response from tftpd32 the hAP AC3 does not tolerate, yet it works fine on the hAP AC2. I thought the hardware was mostly identical so this is a ...

R1CH

Yup, I've been running the patched OpenWrt on hAP AC2 for a month now and it's been flawless. Hopefully the PR makes it into the official release soon.

R1CH

Well shit, I was about to build my new network with these switches at the core. The lack of response and root cause from Mikrotik sounds like they aren't able to fix this, I guess the Marvel chip is broken and they are trying software workarounds to no avail. Is there anyone at Mikrotik willing to c...

R1CH

This is commonly called private VLAN by other vendors. It's pretty nice if you have a bunch of untrusted devices like IoT sensors and you don't want them having access to anything except the router. This seems to be supported natively with "interface ethernet switch port-isolation" rather ...

R1CH

IP Cloud DDNS does not register fake IPv6 addresses, the IPv6 packet reached the IP Cloud Servers at some point. So that router had working IPv6. If it doesn't now, that's another issue. And as stated in numerous places it only requires a Disable / Enable of IP Cloud DDNS. Disable sends a clear rec...

R1CH

Yeah that's an option, but unfortunately these are dynamic IPs so I'm using the build in Cloud DNS names. Unfortunately the Mikrotik Cloud DNS registers the IPv6 address even if it's in an error state, so there's no way to easily connect to the IPv4 address returned by the name. Give me my happy eye...

R1CH

My ISP recently enabled IPv6 and now I'm finally joining the modern internet! Unfortunately Winbox seems to prefer IPv6 addresses when connecting to a multi-homed DNS name, and several of the routers I have saved in my Winbox do not accept connections on IPv6. There is no fallback to IPv4, meaning I...

R1CH

The description for flagged mode is confusing. On one part it says it checks for system files, but on another part it says it checks your configuration. If suspicious configuration is detected, the suspicious configuration will be disabled and the flagged parameter will be set to "yes" Wha...

R1CH

Where are you seeing a DoS? There is no traffic beyond background noise in your screenshot.

R1CH

Anyone having trouble with the hAP AC3 and netinstall / TFTP PXE booting? I can easily get the device into etherboot mode, but it sits there spamming bootp or dhcp requests and ignores the response from my DHCP server, eventually timing out and booting back into RouterOS. I tried upgrading Routerboo...

R1CH

These "free" VPNs turn your PC / network into a VPN endpoint for other users, which is why you get blocked or receive abuse reports. Best solution is to enforce TOS against such clients, this isn't easily solved on a technical level due to wide array of ports and protocols used to bypass f...

R1CH

It's not realistically possible, the best you can do is block DNS of popular torrents and trackers, but with DHT and PeX it only takes 1 peer to get through for torrents to work. Your best option is to throttle the speed you provide so that torrents don't negatively affect your network.

R1CH

Strange, I've managed about 960mbps through a single TCP connection on a CCR1009. What does tool / profile look like?

R1CH

Is iperf showing dropped packets / retransmission? If not then it's limited by OS on one of the sides. Have you adjusted buffer sizes and window scaling on the sender / receiver?

R1CH

Port forwarding is a relic of the 00s and not necessary for any modern applications. Only if you want to host a server do you need port forwarding.

Most likely it is blocked by their ISP, cellular connections tend not to work great for anything except simple TCP/IP.

R1CH

Damn, that review does not look good. Wonder how it can be so much worse than the original? Maybe you got a bad model.

R1CH

Your business model will always be able to be subverted by technical means, so further discussion is somewhat pointless.

R1CH

The kernel assigns default mark of 0, so "meta mark 0" I would assume.

R1CH

Looking forward to a wAP AC XL too with similar 'internals' I saw a photo of the new wAP AC and it does seem to have changed to PCB antennas, I wonder how much of a difference these are compared to the plate antennas? https://openwrt.org/_media/media/mikrotik/mikrotik_wap_ac_rbwapg-5hacd2hnd_pcb.jpg

R1CH

FYI hAP ac2 just got official OpenWRT support, this milestone opens the possibility of supporting more Mikrotik IPQ40XX devices such as cAP ac and hAP ac3 in the future. https://firmware-selector.openwrt.org/?version=SNAPSHOT&target=ipq40xx%2Fmikrotik&id=mikrotik_hap-ac2 I finally got aroun...

R1CH

Thankfully OpenWRT fixes that.

R1CH

Random reset is usually power related. Check power supply voltage and output power, make sure cable length is not too long.

Webpages not opening may be due to incorrect MSS, need more diagnostics (ping, trace, etc) to confirm.

R1CH

Does the cAP XL ac have a square case option like the original? I couldn't see anything on the product page and most installs I've done prefer the aesthetics of the square case.

R1CH

And also makes you extremely vulnerable to simple CPU DoS if someone spoofs IP and fills your blacklist with millions of IPs. Can also do http://your_ip:8291/lol in an image tag and firewall yourself off... these rules do more harm than good in the long run.

R1CH

I wonder if there is some traffic amplification bug in the socks proxy, this doesn't make any sense to use as a DDOS botnet if you still have to originate all the attack traffic. I suppose it makes an attack harder to block when it originates from thousands of infected IPs, but based on volume this ...

R1CH

There are no non-mikrotik binaries involved, only legitimate SOCKS, L2TP and Scheduler configuration. What native functions in RouterOS support sending pipelined HTTP requests at these kind of rates? I find it unlikely that the attackers are simply proxying their DDoS traffic through infected Mikro...

R1CH

Since these infected users still appear to be upgrading to recent RouterOS versions, can the upgrade process look for non-Mikrotik binaries or other signs of infection and warn the administrator to netinstall? If there was a system exploit to run arbitrary code, simply removing socks and scripts and...

R1CH

Looks like there is a new DDoS botnet on the loose, comprised of Mikrotik devices. We do not know precisely what particular vulnerabilities lead to the situation where Mikrotik devices are being compromised on such a large scale. Several records at the Mikrotik forum indicate that its customers expe...

R1CH

Is the Docker support an optional package? I can't imagine many people wanting this, and it introduces massive security implications especially for all those hacked routers. Since privilege escalation is pretty much a given, can we also allow root SSH access to RouterOS directly now? Running a singl...

R1CH

All those DDoS detect / drop rules actually make you more susceptible to DDoS since your router CPU increases for every rule a packet has to traverse.

R1CH

Given the awful upload performance, are you sure you have MTU / MSS set properly?

R1CH

No, just the one that dns.google uses.

R1CH

The cacert.pem is the same list that most browsers and operating systems trust. So if you don't trust them, you have a bigger problem :). If you only want to import a specific certificate, inspect the certificate chain of eg https://dns.google/ in your browser and import the relevant root certificate.

R1CH

DoH in RouterOS is still beta-quality IMO, I wouldn't rely on it just yet.

R1CH

You should be blocking *everything* by default and then open only strictly necessary ports. Use VPN or LAN interface for management. You will need to do a clean reinstall if its been hacked already.

R1CH

WMM is about traffic prioritization not speed ... WMM is required for all rates above 54mbps. I don't know how exactly it's implemented on Mikrotik since even with it off you can still see > 54mbps, but the spec requires it for all 802.11n / 802.11ac rates. I think it's ridiculous that it's off and...

R1CH

Advanced mode, enable WMM, set indoors installation, set 80 MHz channels. For further speed, install OpenWRT.

R1CH

ROS 7 is a dealbreaker for me, can't put anything into production that's running buggy beta software. And all these new CPUs seem to take a very long time to actually become stable, look at 4011, 2004... I really want to like the hardware but the software just can't keep up.

R1CH

You would need multiple 5 GHz radios to do this, a smartphone in hotspot mode runs as an AP, not a client, so you need a unique radio to connect to each smartphone in client mode. So no, wAP AC cannot do this (in fact, this setup is not really realistic for any Mikrotik product)

R1CH

Why did you bump a thread from 2012 ...

R1CH

There is already multicast package which does this.

R1CH

Get rid of any complicated anti DDoS rules, you want your router to forward the packets as fast as possible to your much more powerful PC that ignores them. Sounds like the real DoS condition is your router CPU being overwhelmed by too many rules, or it's a simple bandwidth exhaustion attack (in whi...

R1CH

erlinden is entirely correct. Running a residential AP at 30dBm TX power is downright stupid and no wonder people think Wi-Fi sucks when operators do this. You want balanced TX/RX powers to avoid problem shown above, ideally TX power as low as possible to avoid co-interference and encourage client r...

R1CH

Try disabling fastpath/fasttrack, netfilter timeouts don't update properly for offloaded traffic.

R1CH

The default firewall does not block outbound connections, port 22 is likely filtered further upstream by modem / ISP.

R1CH

Try winbox mac connection, sometimes you won't have any config after netinstall.

R1CH

... Experiments indicate that every Wi-Fi product is affected by at least one vulnerability... (...and that most products are affected by several vulnerabilities...) ... https://www.fragattacks.com/ Nice, fragattacks for say this, has buyed every model of access pont than exist on the world! But re...

R1CH

Did anyone bother to even test a MikroTik device for the said vulnerability? or we're just posting shit on the forums? "Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities." I wasn't able to...

R1CH

This looks bad: 11 May 2021 — This website presents FragAttacks (fragmentation and aggregation attacks) which is a collection of new security vulnerabilities that affect Wi-Fi devices. An adversary that is within radio range of a victim can abuse these vulnerabilities to steal user information or at...

R1CH

RouterOS does not support 802.11ax.

R1CH

OpenWRT handles saturation much better due to fq_codel / cake schedulers, not yet available on Mikrotik. You have to cap your bandwidth significantly below link saturation point to avoid buffers being flooded.

R1CH

You can't "block" broadcast traffic, it doesn't get routed. If you don't want it on your network you need to filter it on your switches or disable LLDP on the source devices.

R1CH

This is expected as you've disabled the conntrack helper.

/ip firewall service-port
set ftp disabled=yes

R1CH

Probably conntrack FTP helper is turned off or behind dual NAT. Winnet FTP uses active mode (requires open port) by default.

R1CH

Yes, this is exactly what happens. A Mikrotik router does not run "dnsmasq", it is instead home-grown MT DNS server. So an ISP in between the place you are scanning from and your router is intercepting your DNS queries. This is why users should use DoH / DNSCrypt / etc to prevent this kind...

R1CH

If you have a non-1500 MTU, yeah you can clamp it to avoid clients having to do PMTU discovery. But this has no relation to DoS resistance.

R1CH

It looks like you have ports in a bridge or a switch that are flooding multicast traffic. Filter or rate limit broadcasts / multicasts from clients from or disable multicast flooding if it isn't necessary. A complete topology of your network would be needed to diagnose further.

R1CH

https://support.mozilla.org/en-US/kb/ca ... ion-dnsnet

R1CH

This is not possible. You can only use HTTPS for your payment / login gateway pages, but not for redirection. If anyone could intercept HTTPS requests it wouldn't be very secure would it?

R1CH

1gbps on AC is an unrealistic expectation, and physically impossible with the 2x2 card you listed. The most you can expect is ~400mbps real-world throughput at 2x2 80 MHz MCS-9. Mikrotik products like hAP AC2/3 and RB4011 can achieve this. I don't think anything supports 160 MHz currently which woul...

R1CH

Disabling all service helpers is a good idea, very rarely will they help. Modern SIP phones for example have built-in NAT traversal and FTP commonly uses encryption that makes the helper unable to see the data.

R1CH

Yes, ALG is enabled for all protocols in default config.

R1CH

Mikrotik routers are generic CPUs like a PC would be, ASICs you will find in higher end gear like Cisco. A PC router would be faster than most Mikrotik products.

IMO ASIC isn't needed until you get into the 20gb+ line rate.

R1CH

The IP ranges are published at https://ip-ranges.amazonaws.com/ip-ranges.json, just script something to update the address list.

R1CH

This is not a vulnerability. https://raxis.com/blog/2018/06/04/goodi ... timestamps

R1CH

With OpenWRT on wAP AC (original), I get ~ 350mbps single client TCP throughput at MCS-9, 2x2, 80 MHz, WPA3. Device CPU is very close to 100% though which seems to be the limiting factor. Very happy with stability, every device "just works" and no weird throughput issues like MT wireless h...

R1CH

Yes, exactly that. Since it knows the gain of the integrated antenna it uses a hard coded value instead of being set from user input. So if you have any device with integrated antenna, there is no good way to reduce TX power.

R1CH

What most people really want is to enter simple value that lowers the gain proportionally for all modulations by a specified number. If I want 5dBm weaker signal, I just enter "5" and I get 5dBm less signal over all modulations and modes. Irregardless of regulation domain settings, MIMO c...

R1CH

2.4 GHz is usually pretty bad except in remote places, way too much interference. You should also enable WMM if you want 802.11n to work.

R1CH

Great to finally see some movement on newer wireless drivers, but also disappointing to see that no currently released AP hardware can use them (especially the just-released wAP AC revision). Wave2 has been around for over four years at this point! There should have been plenty of time to evaluate t...

Search found 1127 matches