Why shame? There is absolutely no problem with that!So, updates work via plain HTTP? No encryption?
Shame!
Because there is no excuse anymore for any service to run without TLS. Certificates are free (if not dirt cheap for those that don't - for whatever reason - like Let's Encrypt).Why shame?
Yeah, it's fine. Until it somehow gets exploited in the future.Remember the update files themselves are signed! The signature is verified before they are installed.
So http is fine.
Microsoft's policies are not an example to be copied.You know, Windows is using http download for windows update as well.
I never inferred that. Logging in to some website is COMPLETELY DIFFERENT from downloading a firmware update.Sure,
So next time you login to your web-banking do not check for TLS.
TLS would remove the possibility to have a local update repository on a closed network. At least until the update URL is made configurable.So yeah, TLS would not hurt and could help some people sleep better.
At least for now.
This is done in 'graphing' you can set up resource graphs and access them through webfig (at login hit the 'Graphs' button underneath the login)Please add average cpu usage for the last day / month / year whatever. This makes it possible to at a glance see how hard a router is working.
Create a 'viw' /session, with those things enabled (And maybe your favourite screens setup and layed out), then use that as your default session view, along with unticking autosave so no matter what you do in that session it resets next time you log-in.The ability to force CPU, uptime, date etc on all winbox sessions.
Instead of having to do it individually
That would be almost okay if the graphs had some authentication built into them as well as opposed to just an ip whitelist.This is done in 'graphing' you can set up resource graphs and access them through webfig (at login hit the 'Graphs' button underneath the login)Please add average cpu usage for the last day / month / year whatever. This makes it possible to at a glance see how hard a router is working.
This will keep a daily, weekly and yearly graph if i remember correctly, daily being 5 minute poll, weekly being 2 hour and yearly being 1 day or something to that effect.
Here is a screenshot form my Splunk Mikrotik project found here: viewtopic.php?t=137338Please add average cpu usage for the last day / month / year whatever. This makes it possible to at a glance see how hard a router is working.
If IP whitelist is not enough, you can limit it to VPN via firewall.1) unsecured graphing which can't be queried using a script anyway
Mikrotik has "The Dude" which works well enough as SNMP server. It is not masterpiece, has its own bugs, but works.2) have to run a 3rd party snmp server because there is no snmp server from Mikrotik
Unsure what do you mean. You can query SNMP from router.... and no ability to query snmp registers from the router itself.
Everyone will ask for different average. Someone will ask for 5m, someone for 1hour, someone for 1day... Cmon, if you have such specific requirements, is it really that hard to make own script, which will grab SNMP counters and show you absolutely anything you can imagine?Surely there's a point where it's simpler to just add in an average counter in the resources tab which can be scripted...
It's okay, I apologize for getting a bit irritated as well. I appreciate your suggestion and will give it a try.@Wyz4k No. I should apologize. I didn't realize it will sound so aggressive. This is certainly about "feature requests". Sometime, requests are great. Sometime not - people submit them due to misunderstanding or lack of information. I just tried to correct some of your statements and I didn't mean to offend you
Your feature is already implemented in RC/testing version. And some people don't like it...I'm new to the forum, and I'd like to know where is the right place for a feature request.
No, RADIUS is not a pool manager it can assign statics, software behind RADIUS would need to still manage a pool, which can get out of sync if you miss a stop record or something.That is already possible via RADIUS!
Current:
/interface ethernet switch vlan add ports=sfp1,sfp2 vlan-id=200
/interface ethernet switch vlan add ports=sfp1,sfp2 vlan-id=201
Proposed:
/interface ethernet switch vlan add ports=sfp1,sfp2 vlan-id=200,201
Current:
/interface ethernet switch vlan add ports=sfp1,sfp2 vlan-id=200
/interface ethernet switch vlan add ports=sfp1,sfp2 vlan-id=201
Proposed:
/interface list add name=sfp-list
/interface list member add interface=sfp1 list=sfp-list
/interface list member add interface=sfp2 list=sfp-list
/interface ethernet switch vlan add ports=sfp-list vlan-id=200,201
Thanks for explanation, I didn't know what's the underlying implementation of interface lists. Well, the idea(1) is still nice to have, since my vlan table entries contain same trunk ports.Remember that interface lists are handled by the CPU. An interface list is just a bit set in the interface definition which can be matched e.g. in the firewall ("is this bit set for the interface where this packet arrived") by the processor.
This is entirely different from switch programming, where a fixed mapping between devices and vlans is programmed in an external chip essentially one-time (at startup) and the mapping is only used by the switch chip, not by the processor.
There should simply be the possibility to add "user graphing" where an SNMP OID is entered and the value is graphed. It has been requested before.It would be really nice if MikroTik would add the ability to graph health information such as voltage and temperature and no I'm not referring about SNMP and API, I am referring to tools->graphing,the same way as resources, queues and interfaces are graphed.
PLEASE!MT please consider doing some BGP and routing-related fixes for christmas.
Would make A LOT of MT users very, very happy! Just to give some examples:
- multi-threading
- BGP4 SNMP MIBs
- better BGP convergence time
- faster route table searches
- fix ipv6 route reflection
- add RPKI support
Hello. It's not a feature request.Hello, why mikrotik does not have the ability to better define user permissions based on roles?
I fully underwrite these features requests. The problem is only I have made almost the same, and more, request on Winbox improvement several times over the years and never even got a reply..... None of these 'ergonomic' adjustments are ever implemented.Features Request!
a. Winbox, lets suppose we want to remove 5 columns and add 6 more. That would require to do 11 times the same thing since the list closes every time. Wouldn't it be easier (for the users not the programmer!) to have check box in front of every option, so as to check-uncheck whatever needed?
b. Winbox again. Wouldn't a rule copy from the start page be easier using the right click? got add-remove-enable-disable etc but no copy. Less windows-less clicks
c. Again winbox! Start page of a menu again (e.g. Firewall). A drop menu for the options (when double-clicked?) would be much faster to change an option. Combined with the second request, making a copy of rule and changing one option would be sth like right click-->copy rule--> double click new rule option-->choose new option.
Yup - it can be a little frustrating when a video about Mikrotik is not in English (the only language I know).And now, for something completely different: (no, not the larch)
With all those YouTube videos from MUM taken from all over the world, it would be nice when the language of the video is always visible in the title.
Some of them are in English or another language I could understand, but more often they are completely incomprehensible to me and it would be useful to make that selection already in the title listing.
Very true! Note that in no way I would suggest not to put videos in other languages on the channel.But - I am also very aware that English is not the only language used in the world.
Youtube has that, but it is not really usable right now except when you want to have fun.- However , with todays technology , I suspect that somewhere there just might be a really smart computer than in real-time can verbally translate the spoken language in a video to English and optionally print the translated language on the bottom of the video at the same time.
I don't want to advocate separating English from non-English videos. We should not consider one language "better" than another.Indeed - it would be nice to separate the non-English videos.
RPKI is really neededRPKI/ROV guys, please. No need to re-invent the wheel.
See RTRlib for a lightweight, open-source C library: http://rpki.realmv6.org/
PS: Perfect for a weekend hackathon @ Mikrotik HQ while the weather outside is bad
It is sort of possible to do that, by clicking the "log" checkmark on the last page (the matched traffic will appear in the log).Something like TORCH on firewall rule!
It would be great if i can select firewall rule and click on torch - and see what traffic is triggering on that rule!
.
time - same logline
time - same logline
the line above are repteated X times.
time - end of repeated lines
|
time - new logline
.As long as you have connection tracking, and do not use the log on the "established/related" rule (which should be at or near the top of the list), logging on rules further down the list will usually have less volume and certainly not a duplication of the same info.On that being logged many many times the same loglines it would be nice if that could be avoided by buffering the new and same loglines till an other different logline is going to be written to the log.
When you dealing with external logs, this is something you like to avoid at all cost like here in my Splunk - Mikrotik project:the line above are repeated X times.
In RAW I don't have those control options and thinking further about it.As long as you have connection tracking, and do not use the log on the "established/related" rule (which should be at or near the top of the list), logging on rules further down the list will usually have less volume and certainly not a duplication of the same info.On that being logged many many times the same loglines it would be nice if that could be avoided by buffering the new and same loglines till an other different logline is going to be written to the log.
Of course there can still be a lot of new connections logged this way.
Making it optional on rule level is the way to go. The user have to decide, if it is going to be used or not.When you dealing with external logs, this is something you like to avoid at all cost like here in my Splunk - Mikrotik project:the line above are repeated X times.
viewtopic.php?t=137338
When you read logs external programs its hard to understand what is repeated and get the message back together.
And do you have many boxes that sends syslog to same server, it makes it even worse.
So if implemented, this need to be an option.
[Feature Request] :resolve DNS Client Improvements
One of the advantages of RouterOS is its scriptability and the strength of its shell syntax for getting things done. New improvements in the :system and :tool areas have given us more tools than ever, and augmenting existing features with script="" hooks have given us even more places to use those tools. However, it seems like an important scripting primitive (for a network device, at least) has been neglected for some time: :resolve.
You are right. That’s why in this year’s MUM in Tirana i changed the title and description of my presentations from English to Albanian (the language I was going to give them)I don't want to advocate separating English from non-English videos. We should not consider one language "better" than another.Indeed - it would be nice to separate the non-English videos.
I just would like to see the language of the video in the listing.
https://wiki.mikrotik.com/wiki/Manual:T ... _Generatoradd multi-cpu(multi-core) support to Bandwidth Test Tool.
this is required for 10G/SFP+ speeds testing between CCR1036/ or between CRS317-1G-16S+RM devices.
At the moment Bandwidth Test Tool can generate only 2Gbps and utilize only 1 core on CCR routers.
What's hard on doingWhen do we ever see the option of select and copy text in the winbox log files? This has been asked for years.
Plus the option to search for string of caracters?
When studying your logs in winbox it's at times hard to get the eyes focused on what you want to see if there are many lines to read through.
And copy and paste into a text file would make is so easy to quickly select what you are looking for.
ssh mikrotik "/log print" | less1. I am not doing ssh. 2. I don't want to print anything. I just want to quickly look in my log and highlight a line or try to find just one setting (one mac leaving or connectiong for example on an antenna) so I can see what happened or where something went wrong.What's hard on doingWhen do we ever see the option of select and copy text in the winbox log files? This has been asked for years.
Plus the option to search for string of caracters?
When studying your logs in winbox it's at times hard to get the eyes focused on what you want to see if there are many lines to read through.
And copy and paste into a text file would make is so easy to quickly select what you are looking for.?Code: Select allssh mikrotik "/log print" | less
That is actually already possible.Please make address lists available as destinations in ip route menu.
What's new in 6.41 (2017-Dec-22 11:55):
...
*) bgp - added 32-bit private ASN support;
...
i need me too complete supporto for IPSEC/IKEv2 with EAP Authentication implementation for NordVPNI'd like to ask to complete IPSEC/IKEv2 implementation.
Motivation is : lots of VPN providers - NordVPN and others - are moving to that, leaving L2TP/IPsec disappearing.
Of note: I have some CHRs running on VMware ESXi servers with 10-Gig network cards.Please,
add multi-cpu(multi-core) support to Bandwidth Test Tool.
this is required for 10G/SFP+ speeds testing between CCR1036/ or between CRS317-1G-16S+RM devices.
At the moment Bandwidth Test Tool can generate only 2Gbps and utilize only 1 core on CCR routers.
Since beta version "6.44beta39", bandwidth test utilizes all of the CPU cores.Of note: I have some CHRs running on VMware ESXi servers with 10-Gig network cards.Please,
add multi-cpu(multi-core) support to Bandwidth Test Tool.
this is required for 10G/SFP+ speeds testing between CCR1036/ or between CRS317-1G-16S+RM devices.
At the moment Bandwidth Test Tool can generate only 2Gbps and utilize only 1 core on CCR routers.
A single btest session uses a single CPU - however … multiple btest sessions (a mix of send & receive btest(s) appear to use multiple CPUs.
A single CPU assigned to my CHR ROS system can actually btest using vmxnet-3 Ethernet interfaces through the physical 10-Gig network cards can reach near 10-Gig throughput to another CHR btest device on a different VMware ESXi server.
Additionally , two CHRs running on the same physical VMware ESXi servers using vmxnet-3 interfaces can easily btest to each other at rates faster than 10-Gig (in my case , I have tested two CHRs on the same system at almost 19-Gig. And , a CHR running a btest to the loopback interface 127.0.0.1 can easily hit over 20-Gig. I have never seen a Mikrotik motherboard btest to the loopback 127.0.0.1 interface at even 1/4th that speed.
Also - in my opinion , a CHR running on a decent SuperMicro with fast Intel XEON CPUs and lots of CPU cache has always totally and easily way out performed all Mikrotik motherboards that I have tested. For example, a full BGP load on a 10-Gig feed is almost 10-times faster than a CCR1036 Mikrotik router.
Also - again in my opinion, a CCR1036 is good at speeds less than 2-Gig , and a CRS is more of a switch than a router and they are slower. On both your CCRs and CRS mikrotiks , run a btest to 127.0.0.1 and you will discover they are not all that fast or even in the neighborhood of performance a CHR with good hardware can deliver.
North Idaho Tom Jones
- a mptcp enabled kernel
pound as a loadbalancer service
implement letsencrypt including automatisation for certificare renewals.
That isn't required because when you have no link, you will be disconnected (far to) quickly and lose the open window (reverts to connections list)!Also a green/yellow/red color field within WINBOX to indicate if you are still connected to the router (green - connected, yellow - don't know, red-disconnected)
That is possible with scripts. See my RouterOS Scripts (or at github), especially mode-button-event and mode-button-scheduler.I would love to see the functionality of the Mode button expanded. Specifically, it would be useful to be able to assign different actions taken based on whether the button was pressed once, double-pressed, triple-pressed, or long-pressed.
You can get rid of this. If you do not need the file just add "keep-result=no" to your fetch command. If you do need the file I suppose you read the content later? Just switch to return value to a variable.If anybody from MikroTik is reading this I would make a sugestion that I can somehow disable fetch tool log messages.
I wrote a simple script for fetching public IP address for updating No-ip address, and it works OK, but now I have log flooded with fetch messages.
Not true on MacOS/Wine Winbox.That isn't required because when you have no link, you will be disconnected (far to) quickly and lose the open window (reverts to connections list)!Also a green/yellow/red color field within WINBOX to indicate if you are still connected to the router (green - connected, yellow - don't know, red-disconnected)
What I would like to see is an option to disconnect only after 1-2 minutes of link-down, so it is possible to survive a router reboot somewhere inbetween.
Strange! Under Windows and with Linux/Wine this does not happen, whenever the link is lost you get disconnected within 3 seconds.Not true on MacOS/Wine Winbox.
You get disconnected but it won't through you out (but the clock stops to work!).
+1In "queue tree" please provide the option of specifying limit-at and max-limit as a percentage of the limit on the next higher layer.
When the value of the limit in the parent item changes, automatically re-calculate the values specified by percentage.
Now that you mention this, what about being able to personalize the parameters being shown on the dashboard? It would be useful to use a script to show any value or calculation.Please add temperature and voltage to the dashboard of the Winbox.
Often it is necessary to monitor the parameters and the location on the dashboard would simplify this at times.
winbox upg.jpg
You could replicate this with logging and a syslog (remote) logging server. Bit of a workaroundI would like to receive SNMP traps when WiFi client registration occurs...
for example:
[WIRELESS]--Association:11G STA 80:b0:3d:xx:xx:xx associated with WLAN1 SSID = Mikrotik
It's very useful for smart home automation scenarios
As joegoldman write, syslog is your friend. Look at the project in my signature using Splunk to monitor Mikrotik.I would like to receive SNMP traps when WiFi client registration occurs...
2019-01-24 08:48:09 wireless,info MikroTik: 04:79:70:A9:B1:B3@wlan2: connected, signal strength -45
2019-01-24 08:36:55 wireless,info MikroTik: 04:79:70:A9:B1:B3@wlan2: connected, signal strength -43
2019-01-24 07:51:17 wireless,info MikroTik: 04:79:70:A9:B1:B3@wlan2: connected, signal strength -39
2019-01-23 10:05:08 wireless,info MikroTik: 04:79:70:A9:B1:B3@wlan2: connected, signal strength -32winbox: please have some feature to set (or completely disable) the live update interval of pages that show counters etc.
A simple yet I think important request: provide IPv6 out of the box. This really requires a package to be present and some default firewall & stateless configuration enabled. I don't see the reason why in 2019 they are shipped with IPv4 only where even cheap consumer routers are IPv6 enabled OOB.
A request:
Please create a 2g/3g/4g high gain antenna (dual chain). mANT LTE 5o is very little.
Actually you can do(...)user has to perform factory reset to get decent configuration as starting point - but loosing whatever already done in other parts (IPv4, wlan, VLAN, ...).
/system default-configuration print file=default-cfgWhy do you think so? Did they said something (even unofficially)?Unfortunately it appears the IPv6 developer has left the company (maybe he was also the BGP developer?)
Actually you can do(...)user has to perform factory reset to get decent configuration as starting point - but loosing whatever already done in other parts (IPv4, wlan, VLAN, ...).after installing IPv6 package and you will get the default config with IPv6 related stuffCode: Select all/system default-configuration print file=default-cfg
I think so, because NO development of these components has appeared aside from some minor bug fixes, for several years.Why do you think so? Did they said something (even unofficially)?Unfortunately it appears the IPv6 developer has left the company (maybe he was also the BGP developer?)
We started renting Mikrotik routers to our customers as a basic managed WiFi solution and one thing that any ISP will run into with this type of setup is the customer hitting the damn reset button.
We'd love a way to change the default configuration that doesn't involve netinstall. It's extremely tedious to have someone sit there and netinstall a stack of routers with our custom configuration. There needs to be a better way! Mikrotiks are so close to being perfect for deploying as managed wifi.
To go with that, a basic Tr069 ACS able to run on RouterOS, like Dude or Userman, would be very useful. As long as it can handle applying configurations, setting wifi info and PPPoE logins, it will get people most of the there. Monitoring bandwidth, latency and WiFi stats would also be useful.
+infinity agree with that, Why in the logs cannot log the hostname/comment if is there, is very annoying to see/debug: mac abc123 connected mac abc123 disconnectedIt would be convinient to CAPSAM and DHCP to log to log not only MAC address but also HOSTNAME if it is known.
Process of transforming MAC 2 HOST is tedious and if log changes quickly you have no chance to check who is associating/dhcping
DHCP server lease script can help you:It would be convinient to CAPSAM and DHCP to log to log not only MAC address but also HOSTNAME if it is known.
Process of transforming MAC 2 HOST is tedious and if log changes quickly you have no chance to check who is associating/dhcping
:local leaseHostName;
:if ($leaseBound = 1) do={
:set leaseHostName $"lease-hostname";
:log info ("DHCP server: $leaseServerName => MAC: $leaseActMAC => IP: $leaseActIP => Host Name: " . $leaseHostName);
};https://wiki.mikrotik.com/wiki/Manual:N ... v2_networkMikrotik's wireless nv2 protocol ( a version of TDMA ) currently does not use encryption ( I think I am correct here … ).
+1Can we get standard 802.11s support?
I see that feature on some systems but frankly I just find it irritating (session has been logged out when you come back to it after studying how to solve some issue),For more security, automatically logging out after the SSH session was idle eg for 10 minutes would be great!
SSH forwarding introduces a session takeover scenario, so there is security value of this feature (which is why other vendors implement it). Perhaps a default of 1h or never is better.I see that feature on some systems but frankly I just find it irritating (session has been logged out when you come back to it after studying how to solve some issue),For more security, automatically logging out after the SSH session was idle eg for 10 minutes would be great!
and frankly I don't see how that adds any security. Maybe a little more for telnet where you conceivably could take over the open session when you are at an
intermediate router, but for SSH that does not work.
The topic is marked as "Solved"
IEEE1588 and SyncE would be great, but requires specific support in hardware level
Also +1+1Can we get standard 802.11s support?
802.11s would be useful to mesh for example with OpenWRT based devices (some of which may be routerboards
[...]
Please implement mesh protocols compatible with non-RouterOS devices!
Isn't it the existing Session -> Close Windows?A feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
Hmmm , yea I know if I exit my winbox to a remote Mikrotik then the all the sessions associated with that winbox connection close.Isn't it the existing Session -> Close Windows?A feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
Or I'm not understanding you... or for sure it is the existing option "Session->Close All Windows". It closes all the windows without disconnecting the winbox session. Please, check itA feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
OOoooOr I'm not understanding you... or for sure it is the existing option "Session->Close All Windows". It closes all the windows without disconnecting the winbox session. Please, check itA feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
I think that does not fit within the design philosophy of RouterOS (where you get low-level tools rather than high-level blocks that perform a complex task).So, a feature request for RouterOS, formal, flexible port knocking.
Knocking should allow any combination and order of ports and protocols, up to N layers deep.
Kids control.I think that does not fit within the design philosophy of RouterOS (where you get low-level tools rather than high-level blocks that perform a complex task).
Dear Mikrotik, what about automatic sertificates from Let's Encrypt?
From the manual page (https://ndilieto.github.io/uacme/ ), it appears uacme supports dns-01 challenges and allows total flexibility by the --hook option, which calls an external script to accept, decline or set up the challenge environment.I'm sure that MikroTik can easily write their own ACME client. But it's even more important how it should fit into RouterOS and work for as many scenarios as possible.
For example, maybe you just want certificate for https WebFig (or SSTP server). Sounds easy, right? There's already a webserver on router, so simple http-01 validation can be used. But what if you don't want or can't open port 80 (AFAIK http-01 always starts with plain http on standard port 80)? It would be the case on at least half of routers where I'd like to use Let's Encrypt certificates, because there's typically only one public address and standard http(s) ports are already forwarded to some internal webserver. There would have to be support for dns-01 validation and it has different problems too.
I think it's doable, I tried some suggestions in Support for ACME/Let's Encrypt certificate management thread, but so far it doesn't look like anyone from MikroTik though "oh yes, it's super-awesome, we need to have that!" Maybe try to invent some other foolproof plan that will finally convince them.
If specified, uacme executes PROGRAM (a binary, a shell script or any file that can be executed by the operating system) for every challenge with the following 5 string arguments:
METHOD one of begin, done or failed.
begin is called at the beginning of the challenge. PROGRAM must return 0 to accept it. Any other return code declines the challenge. Neither done nor failed method calls are made for declined challenges.
done is called upon successful completion of an accepted challenge.
failed is called upon failure of an accepted challenge.
TYPE challenge type (for example dns-01 or http-01)
IDENT The identifier the challenge refers to
TOKEN The challenge token
AUTH The key authorization (for dns-01 already converted to the base64-encoded SHA256 digest format to be provisioned as _acme-challenge DNS TXT record).
I've tried to search this topic, but I haven't found it (hope there are not any duplicates):
NTP Client - Possibility to use server name, not just IP address
exFAT (FAT64) or NTFS support - yes, MT is not NAS (it's slow), but it would be great to use file system capable of handling >4GB file complatible with Windows (you have HDD with big files and you want to share some files - you cannot connect it to MT, you have to reformat it to FAT32, copy everything except for big files back...)
Wireless - move Country and Distance setting to Simple Mode - you can set every other important "basic" setting in simple mode, but you have to switch to Advanced Mode for these two settings.
Quick Set - It's working with WPA1 password. It doesn't recognise, when you manually set WPA2-PSK AES only password. It requires also setting WPA1 password (even if WPA1 is not allowed), otherwise Quick Set shows WiFi password red and empty (WPA2 only is used)
Yea , using a connect list with MAC address could almost work (almost).And it is already available... you can make a connect list with different MAC addresses for the same SSID.
Re compatibility problems - that is the reason I stated optional setting. Default on an upgrade to a newer ROS with such a feature should be default Off.Why use SSID for this? This may bring compatibilty problems. Wouldn't a preferred list of AP's (e.g. by address instead of SSID) on the client alone help with your issues? So no change on the AP side necessary.
When you have to manage 300 devices you should have some mechanism in place to support remote management.Thus, if you have 300 clients connecting to a tower with more than one AP , then you can end up with 300 clients that need to be reconfigured/re-programmed.
I've been down this road many times in the past and it ain't pretty.
Re: … mechanism in place to support remote management …When you have to manage 300 devices you should have some mechanism in place to support remote management.Thus, if you have 300 clients connecting to a tower with more than one AP , then you can end up with 300 clients that need to be reconfigured/re-programmed.
I've been down this road many times in the past and it ain't pretty.
It can be done with MikroTik. I have seen solutions for that presented at MUM events.
E.g. you make a scheduled job that runs once a day and attempts to download some file with a naming convention depending on the client, and when it exists it imports that file.
(it would be a good idea to have some version numbering so you can avoid re-running the same file every day after it has been already run once)
There should be more explicit support for that in the Dude.
This is very much needed.Routeros openvpn server needs a way to push routes to the clients.
These issues are completely independent. You need a bulk management method to distrubute any configuration changes to your clients, but apparently you already have it.The problem with bulk management is configuring an algorithm which does two thing - 1; load share connected clients on APs and 2; define a set of client preferred APs to use when available.
I had similar issue (although I do not run commercial ISP but community network). My solution was to use my own MAC addresses (invented for the purpose) for network adapters.That means, after I replace adapter, I set designated MAC for that AP and clients see no difference.Using a MAC address connect method presents a management problem for all clients when an AP needs to be replaced or upgraded.
A change of an AP, can result in a different MAC address , which then can result if every wireless client needing to be re-configured.
Thus, if you have 300 clients connecting to a tower with more than one AP , then you can end up with 300 clients that need to be reconfigured/re-programmed.
I've been down this road many times in the past and it ain't pretty.
I would love to see this also. Often on lower end RBs people dont realize how much CPU load winbox/mgmt can have on the device. the more winbox windows open, the more updates that have to be sent, thus more CPU load (im talking in a single winbox session/window / connected to a single routerboard).A feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
Then why did you not notice the replies made to Tom that this feature is already available?I would love to see this also.A feature I would like to see in Winbox is a new selection to close all winbox windows
Example - many many windows open in winbox , click close-all and presto they all close and you still have your connected winbox session
North Idaho Tom Jones
wrongThe suggestion from another user session-> close all windows , only occurs when you EXIT winbox (ie the next time you connect all windows will be closed).
oh wow, you are correct, choosing session-> close all windows , does infact accomplish this (wo existing the app). thanks!wrongThe suggestion from another user session-> close all windows , only occurs when you EXIT winbox (ie the next time you connect all windows will be closed).
netwatch with option to set src-address will make easier to test connections on multi connection routers...and the possibility to set source address (e.g. remote ipsec hosts)Hey, Mikrotik team!
Please extend "netwatch" funtionality a little bit. It is a nice feature, but so undeveloped.
It will be nice to have an option to set amount of ping to send before change status to down and at its frequency.
any poe-command (even print command) causes error in script if HW doesn't have poe-out interfaces...
A workaround for this was already found in another topic.Can you post the command that fails? There may be a solution to test for poe interface before command is run.any poe-command (even print command) causes error in script if HW doesn't have poe-out interfaces...
Need feature to detect if device have poe-out interfaces - now any poe-command (even print command) causes error in script if HW doesn't have poe-out interfaces...
pppoe has no relation to poe!I don't know how to script it, but possibility is available already: /interface print where type=pppoe-outNeed feature to detect if device have poe-out interfaces - now any poe-command (even print command) causes error in script if HW doesn't have poe-out interfaces...
Aargh ... suits me for not being careful enough when readingpppoe has no relation to poe!I don't know how to script it, but possibility is available already: /interface print where type=pppoe-outNeed feature to detect if device have poe-out interfaces - now any poe-command (even print command) causes error in script if HW doesn't have poe-out interfaces...
Hello Muetzekoeln,RouterOS includes limited (S)NTP support for syncing clocks. For many applications (e.g. in telecoms and industry) more time precision is required. Protocol IEEE 1588-2008 (aka PTP, IEEE1588v2) is used for this. It would be a great benefit if Mikrotik devices would support IEEE 1588 and function as transparent clock, better yet boundary clock. Maybe some of the built-in switch chips already support for IEEE1588 timestamping in hardware.
You find some information about IEEE 1588 here:
https://www.endruntechnologies.com/pdf/PTP-1588.pdf
https://www.endace.com/ptp-timing-whitepaper
This forum already had some discussion about IEEE 1588:
viewtopic.php?f=1&t=70793&p=534801&hili ... 88#p534801
viewtopic.php?f=1&t=87471&p=465496&hili ... 88#p465496
viewtopic.php?f=1&t=79304&p=421858&hili ... 88#p421858
viewtopic.php?f=21&t=121198&p=605388&hilit=1588#p605388
Of course one has to have a grandmaster clock accessible to make use of IEEE 1588. Mikrotik devices only could transport PTP packets better, if supported.
Thank you very much MKX,Answer to questions 1,2,4 and 5 is: No.
Variation of answer to question 2: most decent switches/routers are good enough as a (single?) step in otherwise fully IEEE1588-compliant path if they are lightly loaded so that delay jitter is really low. This way the additional constant delay due to active devices can be attributed to constant path delay (just think of it as being some 500km longer). Namely: the big thing about IEEE1588 (as compared to NTP) is to get around the delay jitter which kills precision of normal NTP. And delay jitter is there due to active devices doing buffering, not due to changing speed of light in fibre.
Answer to question 3 is: probably your understanding of IEEE1588 concept is not right. The Ptp-aware switches need HW support for timestamping ... because IEEE1588 requires very precise knowledge of delay imposed by device on PtP packet passing by. Which means the following steps done in hardware:
- add ingress timestamp to a packet immediately after it is received by ingress port (before it hits any cache or processing queue)
- get precise estimation of egress timestamp for that packet (which needs to take into account all remaining processing and cache waiting time)
- calculate delay from the above timestamps and adjust the PtP header.
So to enable IEEE1588, device needs HW support for the timestamping and currently none of Mikrotik's gear has it (or it has it exposed).
And the procedures above have nothing to do with 1PPS.
1. No idea. If I have to choose, then I'd hesitantly choose a yes.Still I want to ask you about 1PPS signal.
1. Is there any component/hardware (eg: GPS) of a Mikrotik equipment which can provide to the other LAN equipment such kind of signal (1PPS)?
2. I have a heX router (NTP client) which is synchronized to a RB1100AH (NTP server). Directly connected to heX, there is a gear who can generate/provide 1PPS signal. Can I combine the NTP clock and 1PPS signal to provide a precise clock for a different equipement, either mikrotik or any other brand?
I have an application which requires accuracy of ~10us and I generally use NTP for "coarse" time (~1ms) and then connect 1PPS from a GPS receiver directly to the PC for the2. If you use NTP (which is the most precise timing protocol supported by mikrotik) to propagate the time, then I don't think you gain much by using 1PPS source ... Precission gain will have order of magnitude of milliseconds and that's also order of magnitude of precission obtainable using NTP over lightly congested IP connections.
That makes sense. I was wondering about combining NTP (for coarse estimation) with 1PPS (for precission) in a RB device and then propagating the time to "end users" via LAN but not using IEEE1588.I have an application which requires accuracy of ~10us and I generally use NTP for "coarse" time (~1ms) and then connect 1PPS from a GPS receiver directly to the PC for the2. If you use NTP (which is the most precise timing protocol supported by mikrotik) to propagate the time, then I don't think you gain much by using 1PPS source ... Precission gain will have order of magnitude of milliseconds and that's also order of magnitude of precission obtainable using NTP over lightly congested IP connections.
accurate sync (using chrony).
Hi Mkx,1. No idea. If I have to choose, then I'd hesitantly choose a yes.Still I want to ask you about 1PPS signal.
1. Is there any component/hardware (eg: GPS) of a Mikrotik equipment which can provide to the other LAN equipment such kind of signal (1PPS)?
2. I have a heX router (NTP client) which is synchronized to a RB1100AH (NTP server). Directly connected to heX, there is a gear who can generate/provide 1PPS signal. Can I combine the NTP clock and 1PPS signal to provide a precise clock for a different equipement, either mikrotik or any other brand?
2. If you use NTP (which is the most precise timing protocol supported by mikrotik) to propagate the time, then I don't think you gain much by using 1PPS source ... Precission gain will have order of magnitude of milliseconds and that's also order of magnitude of precission obtainable using NTP over lightly congested IP connections.
1. Is there any component/hardware (eg: GPS) of a Mikrotik equipment which can provide to the other LAN equipment such kind of signal (1PPS)?
1. No idea. If I have to choose, then I'd hesitantly choose a yes.
According to wiki (https://wiki.mikrotik.com/wiki/Manual:System/GPS):
Note: The time is not stratum 1 as RouterBOARD devices do not have PPS implemented
I have no practical experience with PTP. Some years ago I needed clocks on a couple of servers very accurately synced for a co-channel FM transmitter network we were building.Hi PE1CHL,
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#* PPS 0 4 377 16 +719ns[ +834ns] +/- 4782ns
^- lpk.pi2nos.ampr.org 1 9 377 104 +106us[ +111us] +/- 244us
^- pi2nos.ampr.org 1 10 377 672 +915us[ +938us] +/- 2275us
^- pi3goe.ampr.org 1 10 377 931 +95us[ +109us] +/- 5718us
2. With your topic you want to say that the accuracy difference NTP+1PPS versus IEEE1588 is insignificant?
3. If in the future I decide to use a PTP/IEEE1588 grandmaster server and broadcast/unicast the clock via a VLAN, will this process of tagging/untagging have a big impact on the accuracy of the clock?
This is already done in v7Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.
There is no v7This is already done in v7Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.
There is as you can see at the top of this page:There is no v7This is already done in v7Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.
There is no v7This is already done in v7Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.
There is as you can see at the top of this page:
BETA Testing and Feature Suggestions for the next RouterOS release (ROS v7)
Maybe you can put a topic here of those features that are already done in v7?This is already done in v7Please add IEEE 802.1AE AKA MACSEC to Router & SwitchOS.
and if I provide with run-after-reset= aditional delay. Delay must be ~10second to all interfaces up and then run this .rsc script.Please, to \system reset-configuration...
+1add the command :commit to commit all the changes to the flash, otherwise to discard changes after reboot
Do you both know about Safe Mode?+1add the command :commit to commit all the changes to the flash, otherwise to discard changes after reboot
Have seen it in professional equipment before. Very useful!!
Safe Mode is quite the opposite of the requested commit!Do you both know about Safe Mode?
https://wiki.mikrotik.com/wiki/Manual:P ... s#Commands => save-config-toSafe Mode is quite the opposite of the requested commit!
The idea is to collect all changes and apply them at once!
The idea is to collect all changes and apply them at once!
{
command1
command2
...
commandN
}
Safe mode is quite restricted and rather a winbox feature than something universal. The suggested commit command could be considered as an universal extension to safe mode, e.g. :safe for starting safe mode and :commit for writing changes to the persistant memory and :reject respectively.Do you both know about Safe Mode?
Huh?..Safe mode is quite restricted and rather a winbox feature than something universal.
Ctrl+XThe suggested commit command could be considered as an universal extension to safe mode, e.g. :safe for starting safe mode
Ctrl+X againand :commit for writing changes to the persistant memory
Ctrl+Dand :reject respectively.
and what about ansible + ssh ?Huh?..Safe mode is quite restricted and rather a winbox feature than something universal.
Ctrl+XThe suggested commit command could be considered as an universal extension to safe mode, e.g. :safe for starting safe mode
Ctrl+X againand :commit for writing changes to the persistant memory
Ctrl+Dand :reject respectively.
There is a difference in philosophy. In RouterOS you can use "safe mode" to make some changes and they will be rolled back when you lose the connection.Ctrl+X againand :commit for writing changes to the persistant memory
What's wrong with ansible + ssh?and what about ansible + ssh ?
It's not obvious to send CTRL+_ commands over sshWhat's wrong with ansible + ssh?and what about ansible + ssh ?
Yeah, reading the docs is kind of requirement...It's not obvious to send CTRL+_ commands over ssh
Is it what you expect or what you're afraid of? Because it's like this by design: if you broke access 'forever', it will be rolled back. But generally ssh is quite tolerant to network instability.While reconfiguring routeros the ssh session could be broken and all the changes will be discarded due to safe mode.
Well, it is certainly a weak point in the RouterOS "safe mode" that it immediately rolls back all changes upon any disconnect, without some form of timeout.Is it what you expect or what you're afraid of? Because it's like this by design: if you broke access 'forever', it will be rolled back. But generally ssh is quite tolerant to network instability.
We need to have the possibility to set the parameters GPON password and GPON serial number in MikroTik RouterOS to authenticate in ISP OLT
Isn't "dst-limit" what you're looking for?Please add hashlimit: http://ipset.netfilter.org/iptables-extensions.man.html
Isn't "dst-limit" what you're looking for?Please add hashlimit: http://ipset.netfilter.org/iptables-extensions.man.html
Well, it is certainly a weak point in the RouterOS "safe mode" that it immediately rolls back all changes upon any disconnect, without some form of timeout.Is it what you expect or what you're afraid of? Because it's like this by design: if you broke access 'forever', it will be rolled back. But generally ssh is quite tolerant to network instability.
I have experienced a couple of times that I could not complete a change without disconnect/re-connect and so was unable to use "safe mode".
Fortunately RouterOS often allows things that other systems don't, so it is possible to o through the steps required without much risk of a permanent lockout.
Still I think it would be useful to have some more where all changes are only made in memory and are not saved until that mode is left, independent of disconnection.
You could setup a scheduled job to do a reboot, then set memory-mode and make your changes and test them, and when everything is fine you save the changes
and remove the job. When you get locked out the job reboots the router and it falls back to previously saved configuration.
I would like to bump this. Since there is now PTP support in 6.46beta55.IEEE1588 and SyncE would be great, but requires specific support in hardware level
IEEE1588 works without hardware support, but performance is not so good. It even works over WLAN:
https://www.researchgate.net/profile/Wu ... ion_detail
There are switch chips (also from QC) with support for IEEE1588 and sometimes SyncE since many years. It would be nice to know which Mikrotik products already have these built-in. Someone with this knowledge out there??
It could also support a better TDMA protocol as suggested here:
viewtopic.php?t=87471#p465494
viewtopic.php?t=70793&start=100#p515551
Maybe Mikrotik can also offer an affordable GNSS-based POE-powered IEEE1588 grandmaster-clock device for mast mounting ....
Yes , I would think a router would be transparent to routed traffic.The way I understand things setting of net.inet.tcp.delayed_ack doesn't do anything to the traffic routed through a router, it only affects traffic generated by the router. So it's not clear to me how could this setting affect speed of e.g. NFS connection between two external devices being routed by the router (benefitial effect on btest is clear).
Add an "interface watch" for link-up / link-down functionality to script in. Similar to Netwatch host.
Isn't that what "dst-limit" actually does?It would be useful when the Limit (rate limiting) specifier in a IP or bridge firewall rule could specify that the limit is not on the rule itself but on the hash of the source address (IP address, subnet or MAC address).
I.e. with a single rule you can accept traffic from multiple source hosts each limited at the specified rate.
This is the "hashlimit" module in iptables.
AH yes it looks like it... I overlooked that.Isn't that what "dst-limit" actually does?
tool netwatch set 0 comment="OhNo Re-Activation again"do {ip firewall layer7-protocol add name=NetWatchTimeSince comment=[/system resource get uptime] } on-error={};
/local NetWatchDuration ([/system resource get uptime] - [/ip firewall layer7-protocol get [find name=NetWatchTimeSince] comment])
/log warning ("Netwatch: UP | check 1.1.1.1 | OffLine Duration was: ".$NetWatchDuration)
/ip firewall layer7-protocol set [find name=NetWatchTimeSince] comment=[/system resource get uptime];
+1 This was write here few times and I try not add this again."number of missed/received pings" setting before the netwatch triggers
Netwatch works as *sys user, he not create global variable. L7 comment works after reboot gut it's not necessary.But of course in this case (where it does not have to survive reboot) you can use global variables for that.
We specifically need public IP (DDNS and NTP is also OK, but not required).@algisr It sounds like you want to use the demo mode as a free DDNS tool.
If that's what you are looking for there are already plenty of sites which offer free DDNS
SHIFT + INSERT not work ? (old ctrl+v from DOS times...). In WinBox>Terminal worksEnable basic Clipboard Paste in Woobm terminal.... Better to say: stop denying it..
SSTP VPN works very similar (SSL tunnel) and I haven't seen ISP which would block TCP port 443.......
The reason, why we are using Stunnel, not other solutions is that it is very similair as simple HTTPS for DPI of internet providers, who are denying usage of openvpn and others too.So, vpn is not applicable solution in most of cases.
Please, review the possibility to include Stunnel client in feature of Router OS or, please, propose alternative way to connect to my Stunnel server,
jo2jo
Basic TCP single scan is build-in into telnet.we need a basic portscan tool in rOS
+1In some cases it would be useful to allow to add static DHCP leases with the same address but different MAC address. The warning message displayed now should remain, but with an option to ignore it.
E.g.: we will get new printers. We like to keep the same addresses. The new printer will replace the old one at the same location. The MAC addresses of the new printers are known beforehand.
It would be useful to add new static leases for the new printers with the same address as the printer they replace, then wait for the technician to swap all printers, then delete all old static leases.
As it is now, we will have to change each lease as the technician moves along, requiring a contact for each printer being replaced.
Another use case is to assign the same address to a device which can be connected either via ethernet or wireless (and which auto-disables the wireless when ethernet is active).