Hello guys,

i am in a big problem. I have RB450 router and DHCP on router. also i have local server with domain. around 70 computer on my network. all computer login via domain. everything was going fine. but problem suddenly my computers going to lost connection and ping to my local server some computers but some not.when i restart my router connection back again. its remain sometime but again after sometime lost connection.

please urgently help me how can i solve this. i am going to be a mad for this.

I would look for a virus flooding your ethernet or wan ports. I have a customer that had this same problem just two weeks ago. Soon as the virus figured out the internet was there it would just tie up the lan. Never did get it removed. I had to reload the infected machine.

Please post /export compact

it will better to help you.

Please post /export compact

it will better to help you.

here is /export compact

[riajul@Vision Info Ltd] > /export compact
# jul/14/2013 12:25:07 by RouterOS 6.1
# software id = TP5V-XEDH
#
/interface ethernet
set 0 speed=1Gbps
set 1 name=ether2-local-slave
set 2 master-port=ether4_BDCOM name=ether3-WIFI
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=Vision
/ip firewall layer7-protocol
add name=facebook regexp="^.+(facebook.com).*\$"
add name=youtube regexp="^.+(youtube.com).*\$"
add name=PornWeb regexp=\
"^.+(rapid8.com|Livejasmin.com|mig33.com|amarnatok).*\$"
add name=Torrent regexp="^.*(get|GET).+(torrent|thepiratebay|isohunt|entertane|d\
emonoid|btjunkie|mininova|flixflux|torrentz|vertor|h33t|btscene|bitunity|bit\
toxic|thunderbytes|entertane|zoozle|vcdq|bitnova|bitsoup|meganova|fulldls|bt\
bot|flixflux|seedpeer|fenopy|gpirate|commonbits|extratorrent).*\$"
add name="BlockAll Website" regexp="^.+(.).*\$"
add name="Only access" regexp="^.+(yahoo.com|bdnews24.com |skype.com|teamviewer.com).*\$"
/ip hotspot profile
set [ find default=yes ] dns-name=vision
add hotspot-address=192.168.2.254 login-by=http-chap name=hsprof1
/ip pool
add name=Vision ranges=192.168.2.60-192.168.2.250
add name=Admin ranges=192.168.2.2-192.168.2.20
add name=Administrator ranges=192.168.2.1
add name=ProcessingPool ranges=192.168.2.21-192.168.2.40
add name=BlockedGroup ranges=192.168.2.41-192.168.2.59
add name="DHCP Pool" ranges=192.168.2.1-192.168.2.250
/ip dhcp-server
add add-arp=yes address-pool="DHCP Pool" bootp-lease-time=lease-time \
bootp-support=dynamic disabled=no interface=ether1-LAN name=Vision
/ip hotspot
add address-pool=Vision disabled=no idle-timeout=20m interface=ether1-LAN name=\
hotspot1 profile=hsprof1
/ip hotspot user profile
set [ find default=yes ] address-pool=Vision keepalive-timeout=30m \
mac-cookie-timeout=3d shared-users=15
add address-pool=Admin idle-timeout=none keepalive-timeout=20m \
mac-cookie-timeout=3d name=admin shared-users=10
add address-pool=Vision idle-timeout=none keepalive-timeout=30m \
mac-cookie-timeout=3d name=VisionUsers shared-users=5
add address-pool=Administrator idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d name=Administrator transparent-proxy=yes
add address-pool=ProcessingPool idle-timeout=none keepalive-timeout=30m \
mac-cookie-timeout=3d name=Processing shared-users=6
add address-pool=BlockedGroup idle-timeout=none keepalive-timeout=30m \
mac-cookie-timeout=3d name=BlockedGroup shared-users=5
/port
set 0 name=serial0
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" \
paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no \
permissions=owner signup-allowed=no time-zone=-00:00
/ip address
add address=114.31.3.132/29 interface=ether4_BDCOM network=114.31.3.128
add address=58.147.172.156/29 interface=ether5-AFTAB network=58.147.172.152
add address=192.168.2.254/24 interface=ether1-LAN network=192.168.2.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1-LAN
add dhcp-options=hostname,clientid disabled=no interface=ether3-WIFI
/ip dhcp-server lease
add address=192.168.2.2 client-id=1:bc:ae:c5:64:38:14 mac-address=\
BC:AE:C5:64:38:14 server=Vision
add address=192.168.2.1 client-id=1:d8:5d:4c:80:49:b7 mac-address=\
D8:5D:4C:80:49:B7 server=Vision
add address=192.168.2.21 client-id=1:50:e5:49:3e:2f:d8 mac-address=\
50:E5:49:3E:2F:D8 server=Vision
add address=192.168.2.23 client-id=1:50:e5:49:2a:81:3a mac-address=\
50:E5:49:2A:81:3A server=Vision
add address=192.168.2.22 client-id=1:50:e5:49:26:50:7 mac-address=\
50:E5:49:26:50:07 server=Vision
add address=192.168.2.25 client-id=1:50:e5:49:a6:30:96 mac-address=\
50:E5:49:A6:30:96 server=Vision
add address=192.168.2.24 client-id=1:1c:6f:65:ae:b4:ed mac-address=\
1C:6F:65:AE:B4:ED server=Vision
add address=192.168.2.31 always-broadcast=yes client-id=1:60:eb:69:9c:91:71 \
mac-address=60:EB:69:9C:91:71 server=Vision
add address=192.168.2.3 always-broadcast=yes client-id=1:0:25:0:d6:f9:90 \
mac-address=00:25:00:D6:F9:90 server=Vision
add address=192.168.2.61 client-id=1:30:85:a9:86:4a:af mac-address=\
30:85:A9:86:4A:AF server=Vision
/ip dhcp-server network
add address=10.5.50.0/24 comment="hotspot network" gateway=10.5.50.1
add address=192.168.2.0/24 comment="default configuration" dns-server=\
192.168.2.1 domain=visioninfoltd.com gateway=192.168.2.254 netmask=24
/ip dns
set allow-remote-requests=yes servers=\
58.147.168.7,114.31.0.66,192.168.2.1,192.168.2.254
/ip dns static
add address=192.168.88.1 name=router
add address=192.168.2.1 name=visioninfoltd.com
add address=127.0.0.1 comment="feb/17/2013 13:58:39" name=clock.localhost
/ip firewall address-list
add address=192.168.2.2-192.168.2.20 list=Admin
add address=192.168.2.60-192.168.2.253 list=VisiouUsers
add address=192.168.2.1 list=Administrator
add address=192.168.2.21-192.168.2.40 list=Processing
add address=192.168.2.41-192.168.2.59 list=BlockedGroup
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" \
disabled=yes
add action=drop chain=forward comment="Vision Users Blocking rules started" \
layer7-protocol=facebook src-address-list=VisiouUsers
add action=drop chain=forward layer7-protocol=PornWeb src-address-list=\
VisiouUsers
add action=drop chain=forward layer7-protocol=youtube src-address-list=\
VisiouUsers
add action=drop chain=forward layer7-protocol=Torrent src-address-list=\
VisiouUsers
add action=drop chain=forward comment="Processing Blocked Rules started" \
layer7-protocol=facebook src-address-list=Processing
add action=drop chain=forward comment=youtube layer7-protocol=youtube \
src-address-list=Processing
add action=drop chain=forward comment="porn web" layer7-protocol=PornWeb \
src-address-list=Processing
add action=drop chain=forward comment=torrent layer7-protocol=Torrent \
src-address-list=Processing
add chain=forward comment="For BlockedGroup" disabled=yes layer7-protocol=\
"Only access" src-address-list=BlockedGroup
add action=drop chain=forward comment="all for admin" disabled=yes \
layer7-protocol="BlockAll Website" src-address-list=BlockedGroup
/ip firewall mangle
add action=mark-connection chain=input hotspot=auth in-interface=ether5-AFTAB \
new-connection-mark=ether5-AFTAB_conn
add action=mark-connection chain=input hotspot=auth in-interface=ether4_BDCOM \
new-connection-mark=ether4_BDCOM_conn
add action=mark-routing chain=output connection-mark=ether5-AFTAB_conn hotspot=\
auth new-routing-mark=to_ether5-AFTAB
add action=mark-routing chain=output connection-mark=ether4_BDCOM_conn hotspot=\
auth new-routing-mark=to_ether4_BDCOM
add chain=prerouting dst-address=114.31.3.128/29 in-interface=ether1-LAN
add chain=prerouting dst-address=58.147.172.152/29 in-interface=ether1-LAN
add action=mark-connection chain=prerouting dst-address-type=!local hotspot=\
auth in-interface=ether1-LAN new-connection-mark=ether5-AFTAB_conn \
per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-connection chain=prerouting dst-address-type=!local hotspot=\
auth in-interface=ether1-LAN new-connection-mark=ether4_BDCOM_conn \
per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-routing chain=prerouting connection-mark=ether5-AFTAB_conn \
hotspot=auth in-interface=ether1-LAN new-routing-mark=to_ether5-AFTAB
add action=mark-routing chain=prerouting connection-mark=ether4_BDCOM_conn \
hotspot=auth in-interface=ether1-LAN new-routing-mark=to_ether4_BDCOM
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" \
disabled=yes to-addresses=0.0.0.0
add action=masquerade chain=srcnat out-interface=ether4_BDCOM
add action=masquerade chain=srcnat out-interface=ether5-AFTAB
add action=dst-nat chain=dstnat dst-address=58.147.172.156 dst-port=!81,8291 \
protocol=tcp to-addresses=192.168.2.1
/ip hotspot ip-binding
add address=192.168.2.2 mac-address=BC:AE:C5:64:38:14 server=hotspot1 \
to-address=192.168.2.2
add address=192.168.2.3 mac-address=00:25:00:D6:F9:90 server=hotspot1 \
to-address=192.168.2.3
add address=192.168.2.1 mac-address=00:15:17:FA:BA:BC server=hotspot1 \
to-address=192.168.2.1 type=bypassed
add address=192.168.2.10 mac-address=60:EB:69:9C:91:71 server=hotspot1 \
to-address=192.168.2.10 type=bypassed
add address=192.168.2.98 mac-address=1C:6F:65:8C:42:8A server=hotspot1 \
to-address=192.168.2.4
add address=192.168.2.250 mac-address=00:15:99:7F:F2:78 to-address=\
192.168.2.250 type=bypassed
/ip hotspot user
add name=Alamin password=* profile=admin server=hotspot1
add name=riajul password=* profile=admin
add name=processing password=* profile=Processing
add name=sujan password=* profile=admin
add name=touhid password=* profile=VisionUsers
add name=ismail password=* profile=VisionUsers
add name=blockedgroup password=* profile=BlockedGroup
/ip hotspot walled-garden
add comment="place hotspot rules here" disabled=yes
add dst-host=visioninfoltd.com server=hotspot1
add dst-host=192.168.2.1 server=hotspot1 src-address=0.0.0.0/0
/ip hotspot walled-garden ip
add action=accept disabled=no dst-host=http://windowsupdate.microsoft.com
add action=accept disabled=no dst-host=http://v4.windowsupdate.microsoft.com
add action=accept disabled=no dst-host=https://v4.windowsupdate.microsoft.com
add action=accept disabled=no dst-host=http://download.windowsupdate.com
add action=accept disabled=no dst-host=http://v5.windowsupdate.microsoft.com
add action=accept disabled=no dst-host=https://v5.Windowsupdate.microsoft.com
/ip proxy
set max-cache-size=none port=3128
/ip route
add check-gateway=ping distance=1 gateway=58.147.172.153 routing-mark=\
to_ether5-AFTAB
add check-gateway=ping distance=1 gateway=114.31.3.129 routing-mark=\
to_ether4_BDCOM
add distance=1 gateway=114.31.3.129,58.147.172.153,58.147.172.153
/ip service
set www port=81
set api disabled=yes
/ip socks
set enabled=yes
/ip traffic-flow
set cache-entries=4k
/radius
add accounting-backup=yes address=192.168.2.254 secret=12345678901 service=\
hotspot
/radius incoming
set accept=yes
/system clock manual
set time-zone=+06:00
/system identity
set name="Vision Info Ltd"
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
set time disabled=yes display-time=5s
set resources disabled=yes display-time=5s
set uptime disabled=yes display-time=5s
set packets disabled=yes display-time=5s
set bits disabled=yes display-time=5s
set version disabled=yes display-time=5s
set identity disabled=yes display-time=5s
set ether1-LAN disabled=yes display-time=5s
set ether2-local-slave disabled=yes display-time=5s
set ether3-WIFI disabled=yes display-time=5s
set ether4_BDCOM disabled=yes display-time=5s
set ether5-AFTAB disabled=yes display-time=5s
/system ntp client
set enabled=yes primary-ntp=82.165.36.179
/system upgrade upgrade-package-source
add address=58.147.172.156 user=admin
/tool e-mail
set address=173.194.77.108 from="Vision Network Master" last-status=succeeded \
password=* port=587 start-tls=yes user=vilnetmaster
/tool graphing interface
add
/tool graphing resource
add
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-local-slave
add interface=ether3-WIFI
add interface=ether4_BDCOM
add interface=ether5-AFTAB
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-local-slave
add interface=ether3-WIFI
add interface=ether4_BDCOM
add interface=ether5-AFTAB
/tool netwatch
add down-script="/tool e-mail send to=*@hotmail.com subject=\"AF\
TABIT INTERNET CONNECTION DOWN!!!!\" body=\"AFTABIT INTERNET CONNECTION DOWN\
!!!!.ping 58.147.172.153 -t.URGENT call support 01678002424 or 93335325\"" \
host=58.147.172.153 up-script="/tool e-mail send to=*@hotmai\
l.com subject=\"AFTABIT INTERNET CONNECTION NOW UP\" body=\"AFTABIT INTERNET\
\_CONNECTION NOW OK.test ping 58.147.172.153 -t.If still down call support 0\
1678002424 or 93335325\""
add down-script="/tool e-mail send to=*@hotmail.com subject=\"BD\
COM INTERNET CONNECTION DOWN!!!!\" body=\"BDCOM INTERNET CONNECTION DOWN!!!!\
.ping 114.31.3.129 -t.URGENT call support 01613331402\"" host=114.31.3.129 \
up-script="/tool e-mail send to=*@hotmail.com subject=\"BDCO\
M INTERNET CONNECTION NOW UP\" body=\"BDCOM CONNECTION NOW OK.test ping 114.\
31.3.129 -t.If still down call support 01613331402\""
/tool traffic-monitor
add interface=ether1-LAN name=tmon1 threshold=0
add interface=ether5-AFTAB name=tmon2 threshold=0
[riajul@Vision Info Ltd] >

What does this mean? Is there a hotspot on this interface?

all computer login via domain. everything was going fine.

Disable the hotspot NAT to allow localnet communication. Otherwise, the hotspot will attempt to arp poison your localnet to perform that NAT.

What does this mean? Is there a hotspot on this interface?

all computer login via domain. everything was going fine.

Disable the hotspot NAT to allow localnet communication. Otherwise, the hotspot will attempt to arp poison your localnet to perform that NAT.

Code: Select all

/ip hotspot
set 0 address-pool=none

let me make you clear you.
i have a domain server with name visioninfoltd.com (192.168.2.1), my all computer login with domain user.

my all computer users dont have internet access. but they have local server "visioninfoltd.com (192.168.2.1)" access for domain login, and file transfer/sharing. i made hotspot for specific guys. when they login to hotspot (192.168.2.254 which is router ) and they get internet access.

if i disable hotspot then internet will be open for all. which i donot want. Hope i made you understand.

if i disable hotspot then internet will be open for all. which i donot want.

I did not advise you to disable the hotspot. I recommended you disable the hotspot NAT. That is causing your problem. It shouldn't affect the operation of your localnet unless your dhcp server settings are incorrect.

if i disable hotspot then internet will be open for all. which i donot want.

I did not advise you to disable the hotspot. I recommended you disable the hotspot NAT. That is causing your problem. It shouldn't affect the operation of your localnet unless your dhcp server settings are incorrect.

thanks bro, now i understood.
I have done as you said
/ip hotspot
set 0 address-pool=none

does this command making hotspot nat disable ? or any more i will need to do ? sorry bro, i am not expert enough.


I am again giving conclusion of my problem. everything going fine but suddenly i lost ping to my local server (192.168.2.1),not all computer, from some computer ping ok, from some not . if i reboot router, i get ping back. also if i disable and enable my lan card , i also get ping back to local server (192.168.2.1), sometime not until my router reboot.

The hotspot NAT is for applications like mine. I sell wireless time pay-per-day. Some of my clients have static ips assigned to their computers, and without the hotspot NAT, they would not be able to connect to the internet.

If you have a standard network where the clients are all set to your localnet settings or use dhcp, then you will have no problems disabling the hotspot nat.

The hotspot NAT is for applications like mine. I sell wireless time pay-per-day. Some of my clients have static ips assigned to their computers, and without the hotspot NAT, they would not be able to connect to the internet.

If you have a standard network where the clients are all set to your localnet settings or use dhcp, then you will have no problems disabling the hotspot nat.

Thanks brother. Understood. I have done as you shown. Lets see how it goes. meanwhile can you please give me a advice of following tropic ? i am badly waiting for this

http://forum.mikrotik.com/viewtopic.php?f=2&t=74687

thanks

Don't think I can help you there. As I recall, Skype should be a point-to-point connection like a torrent upload/download, and are equally as difficult to allow as to stop.

thanks brother, its still now working good from yesterday to till now. but one problem i am in. sometime hotspot internet users see that no internet. webpage not found etc. but i tried to ping to google.com/yahoo.com working. but if i browse it not working.

other way i have DNS,

58.147.168.7 which from ISP 1
114.31.0.66 which from ISP 2
192.168.2.1 which from my local (domain login)
192.168.2.254 which is router

if i restart my local server (192.168.2.1) , my internet connection lost.
please brother help me with this. my local connectivity problem solved but this is new problem.

If it required the hotspot NAT for some of your clients to connect (like mine do), then they may not have correct network settings. Check "/ip hotspot host". Are all the address ips in the localnet?

What are these? Which ip is assigned to the router?

192.168.2.1 which from my local (domain login)
192.168.2.254 which is router

Are you sure your dhcp server is issuing the correct gateway?

If it required the hotspot NAT for some of your clients to connect (like mine do), then they may not have correct network settings. Check "/ip hotspot host". Are all the address ips in the localnet?

What are these? Which ip is assigned to the router?

192.168.2.1 which from my local (domain login)
192.168.2.254 which is router

Are you sure your dhcp server is issuing the correct gateway?

192.168.2.254 is assigned to router. attached dhcp configuration. and yes, dhcp server giving perfect gateway for all computer.

Then 192.168.2.1 is the dns server for your network? That sounds like the dns server has a problem. Maybe you should try a couple tests with nslookup.

Can you access the internet if you do not use dns?

Then 192.168.2.1 is the dns server for your network? That sounds like the dns server has a problem. Maybe you should try a couple tests with nslookup.

Can you access the internet if you do not use dns?

192.168.2.1 is local domain and DNS server. my other computer login to domain user via this server. another strange i have not checked before, now have seen yes i can browse internet without dns. but problem is user cannot login to domain because when they try to connect domain computer (192.168.2.1) its cannot found. where i have removed DNS.

so will i remove DNS from isp ? and add my local ? (192.168.2.1)

Try your ISP's dns server instead of 192.168.2.1.

Add: If the dns server at 192.168.2.1 is not logged in, it will not be able to perform any dns resolutions. Bear in mind the clients must renew the dhcp lease before the change will be effective.

Try your ISP's dns server instead of 192.168.2.1.

Add: If the dns server at 192.168.2.1 is not logged in, it will not be able to perform any dns resolutions. Bear in mind the clients must renew the dhcp lease before the change will be effective.

thanks bro. its working fine now. lets see if there any new issue raise.

dear

i am different problem now. as i said i have two ISP connection to my network. today i got different problem. when one connection down, i was not able to browse internet from other one. i was able to ping google.com or yahoo.com via router. but not from computer. when i restart my local DNS server (192.168.2.1) my internet connection started working good from other connection .

does here i am doing any wrong ? please help..