March 2014 - Public - talk.mikrotik.com.au

MikroTik RB951 loes its NAT rules?!?
by Karl Auer 31 Mar '14

31 Mar '14

A very strange thing happened today. My SOHO router, a MikroTik RB951G-2HnD, suddenly stopped routing. It was very odd - I could reach the router, the router could reach the world, but nothing inside our networks could reach the outside world. Well, actually I *could* reach the outside world for some things - in particular, Google. That was the clue. A look at the NAT table revealed that it was gone - no IPv4 NAT rules at all. It seems that at some time this morning, probably around 11:30am, the router lost its entire IPv4 NAT configuration. Other stuff under /"ip firewall" was fine - it was *only* the NAT rules that were gone. The reason I could still see Google was that Google is reachable on IPv6, which is not NATted, and I run a dual stack network. So I restored from backup and thirty seconds later we were back on line. But: How did this happen? Have others seen this? It's a bit of a worry - we have quite a few MikroTiks deployed... cursory googling doesn't show it up as a well-known issue. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 231A B066 CF91 1216 4F0F F2AC CE25 B8AA 46DC CC4F Old fingerprint: 1DB8 0599 13F0 E774 3811 6CA6 D6D0 AFA9 D91A 004C

2 1

wireless on 6.11
by David Ryan 31 Mar '14

31 Mar '14

Howdy all, just wondering if anyone has seen any wireless issues on V6.11. I upgraded my home router (RB433UAH) on the weekend and have found that I have had to reboot twice over a few days in order to get wireless working again. The clients (tablet, smartphone etc) connect but do not receive an IP address. I am guessing it is a wireless issue since my IP phone which is connected to the same bridge via cable, appears to be fine and it is also DHCP. Any thoughts. Dave. -- David Ryan - 0402 054 426 RJS Communications dsryan(a)rjs.com.au MTCNA, MTCWE, MTCRE

2 1

Re: [MT-AU Public] Public Digest, Vol 1, Issue 4
by Greg Sowell 28 Mar '14

28 Mar '14

I was thinking the same thing on the CRS' Andrew...at least feature wise. I'm fine with a low power CPU as long as it has basic features like DHCP snooping and dynamic ARP inspection. Honestly these are basic industry standard features for switches. Perhaps something like openTRILL in place of STP. I see the new SFP+ models as pretty good options for the server environment where those features aren't required. I'm sure they will make great media converters, though :) Greg On Thu, Mar 27, 2014 at 8:00 PM, <public-request(a)talk.mikrotik.com.au>wrote: > Send Public mailing list submissions to > public(a)talk.mikrotik.com.au > > To subscribe or unsubscribe via the World Wide Web, visit > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > or, via email, send a message with subject or body 'help' to > public-request(a)talk.mikrotik.com.au > > You can reach the person managing the list at > public-owner(a)talk.mikrotik.com.au > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Public digest..." > > > Today's Topics: > > 1. 'null' value of firewall filter attribute (Mike Everest) > 2. Re: 'null' value of firewall filter attribute (Mike Everest) > 3. Re: Thoughts on new CRS226-24G-2S+IN? (Mike Everest) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Mar 2014 19:28:09 +1100 > From: "Mike Everest" <mike(a)duxtel.com> > To: <public(a)talk.mikrotik.com.au>, <members(a)talk.mikrotik.com.au> > Subject: [MT-AU Public] 'null' value of firewall filter attribute > Message-ID: <0adf01cf4996$7c66d5f0$753481d0$(a)duxtel.com> > Content-Type: text/plain; charset="us-ascii" > > Hi Folks, > > > > I've been doing some work using API for various remote/centralised > configuration push applications, and I've come across a surprising problem. > > > > Surprising only because I never realised that I didn't know how to do it > until I decided to try! :-D > > > > Think winbox - we can enter a value against some firewall filter attribute, > say 'src-port' for example, and then if we decide we don't want it any > more, > we can click that little 'up arrow' to null the value for that variable. > We > can see the difference when using ip firewall filter print: > > > > With dst-port specified > > > > 1 ;;; test1 > > chain=input action=accept protocol=tcp src-address=1.2.3.0/24 > > dst-address=0.0.0.0/0 dst-port=25 > > > > After 'nulling' that dst-port value > > > > 1 ;;; test1 > > chain=input action=accept protocol=tcp src-address=1.2.3.0/24 > > dst-address=0.0.0.0/0 > > > > My question is how to do that in shell? I'm baffled! :-} > > > > Regards, Mike Everest > > www.duxtel.com.au > > > ____________________________________________________________________________ > ___ > > > > Wholesale Distributor for MikroTik and RouterBoard in Australia and Pacific > Region > > ISP and WISP Solutions - Hardware, Software, Training, Engineering and > Support > > All things MikroTik - <http://shop.duxtel.com.au/> > http://shop.duxtel.com.au > > > ____________________________________________________________________________ > ___ > > > > Follow our tweets for news and updates: http://twitter.com/duxtel > > > > > > ------------------------------ > > Message: 2 > Date: Thu, 27 Mar 2014 19:31:00 +1100 > From: "Mike Everest" <mike(a)duxtel.com> > To: "'MikroTik Australia Public List'" <public(a)talk.mikrotik.com.au>, > <members(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] 'null' value of firewall filter attribute > Message-ID: <0ae401cf4996$e25643a0$a702cae0$(a)duxtel.com> > Content-Type: text/plain; charset="us-ascii" > > Duh, there it is! > > /ip firewall filter unset 1 dst-port > > I spoke too soon. > > (or is it 'asked to soon' ;-) > > Cheers! > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Mike > > Everest > > Sent: Thursday, 27 March 2014 7:28 PM > > To: public(a)talk.mikrotik.com.au; members(a)talk.mikrotik.com.au > > Subject: [MT-AU Public] 'null' value of firewall filter attribute > > > > Hi Folks, > > > > > > > > I've been doing some work using API for various remote/centralised > > configuration push applications, and I've come across a surprising > problem. > > > > > > > > Surprising only because I never realised that I didn't know how to do it > until I > > decided to try! :-D > > > > > > > > Think winbox - we can enter a value against some firewall filter > attribute, say > > 'src-port' for example, and then if we decide we don't want it any more, > we can > > click that little 'up arrow' to null the value for that variable. We can > see the > > difference when using ip firewall filter print: > > > > > > > > With dst-port specified > > > > > > > > 1 ;;; test1 > > > > chain=input action=accept protocol=tcp src-address=1.2.3.0/24 > > > > dst-address=0.0.0.0/0 dst-port=25 > > > > > > > > After 'nulling' that dst-port value > > > > > > > > 1 ;;; test1 > > > > chain=input action=accept protocol=tcp src-address=1.2.3.0/24 > > > > dst-address=0.0.0.0/0 > > > > > > > > My question is how to do that in shell? I'm baffled! :-} > > > > > > > > Regards, Mike Everest > > > > www.duxtel.com.au > > > > ________________________________________________________________ > > ____________ > > ___ > > > > > > > > Wholesale Distributor for MikroTik and RouterBoard in Australia and > Pacific > > Region > > > > ISP and WISP Solutions - Hardware, Software, Training, Engineering and > > Support > > > > All things MikroTik - <http://shop.duxtel.com.au/> > http://shop.duxtel.com.au > > > > ________________________________________________________________ > > ____________ > > ___ > > > > > > > > Follow our tweets for news and updates: http://twitter.com/duxtel > > > > > > > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > ------------------------------ > > Message: 3 > Date: Fri, 28 Mar 2014 00:17:51 +1100 > From: "Mike Everest" <mike(a)duxtel.com> > To: "'MikroTik Australia Public List'" <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] Thoughts on new CRS226-24G-2S+IN? > Message-ID: <0b0401cf49be$f51e47d0$df5ad770$(a)duxtel.com> > Content-Type: text/plain; charset="us-ascii" > > {resending this one after discovering that I sent 'from' wrong email > address > :-} > > Yes! The low CPU spec is a bit of a surprise to me too :-o > > My guess is that they figured that as a switch, most of the forwarding is > done by the switch chips and so powerful cpu is not important. Looking at > typical load on other CRS switches in production at the moment, the routing > capabilities are not used a great deal - just with one routed port as an > internet gateway perhaps. In campus or enterprise switch application, cpu > is probably doing little more than management tasks, so 400mhz is perfectly > adequate ;-) > > We have a few units already on order - hope to receive them by end of next > week! :) > > Cheers! > > Mike. > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > > Andrew Lau > > Sent: Tuesday, 25 March 2014 8:08 PM > > To: Public(a)talk.mikrotik.com.au > > Subject: [MT-AU Public] Thoughts on new CRS226-24G-2S+IN? > > > > Hi, > > > > first non announcement post! > > > > Has anyone seen the new CRS226-24G-2SplusIN > > http://routerboard.com/CRS226-24G-2SplusIN -- thoughts? > > > > I'm working on a larger scale project that's was leaning towards a full > Mikrotik > > environment but wasn't possible because of the missing > > SFP+ ports on the current CRS series. From initial view, this new CRS > > seems to be lacking in grunt although the newer CPU. Nor a rackmount > case? > > > > I have a two of the first CRS125s and they seem to be serving me well, > although > > the software is still lacking a little.. > > > > I wonder how long till our local friends Duxtel will have stock :) > > > > Andrew > > > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > ------------------------------ > > End of Public Digest, Vol 1, Issue 4 > ************************************ > -- GregSowell.com TheBrothersWISP.com

2 1

Thoughts on new CRS226-24G-2S+IN?
by Andrew Lau 28 Mar '14

28 Mar '14

Hi, first non announcement post! Has anyone seen the new CRS226-24G-2SplusIN http://routerboard.com/CRS226-24G-2SplusIN -- thoughts? I'm working on a larger scale project that's was leaning towards a full Mikrotik environment but wasn't possible because of the missing SFP+ ports on the current CRS series. From initial view, this new CRS seems to be lacking in grunt although the newer CPU. Nor a rackmount case? I have a two of the first CRS125s and they seem to be serving me well, although the software is still lacking a little.. I wonder how long till our local friends Duxtel will have stock :) Andrew

3 2

'null' value of firewall filter attribute
by Mike Everest 27 Mar '14

27 Mar '14

Hi Folks, I've been doing some work using API for various remote/centralised configuration push applications, and I've come across a surprising problem. Surprising only because I never realised that I didn't know how to do it until I decided to try! :-D Think winbox - we can enter a value against some firewall filter attribute, say 'src-port' for example, and then if we decide we don't want it any more, we can click that little 'up arrow' to null the value for that variable. We can see the difference when using ip firewall filter print: With dst-port specified 1 ;;; test1 chain=input action=accept protocol=tcp src-address=1.2.3.0/24 dst-address=0.0.0.0/0 dst-port=25 After 'nulling' that dst-port value 1 ;;; test1 chain=input action=accept protocol=tcp src-address=1.2.3.0/24 dst-address=0.0.0.0/0 My question is how to do that in shell? I'm baffled! :-} Regards, Mike Everest www.duxtel.com.au ____________________________________________________________________________ ___ Wholesale Distributor for MikroTik and RouterBoard in Australia and Pacific Region ISP and WISP Solutions - Hardware, Software, Training, Engineering and Support All things MikroTik - <http://shop.duxtel.com.au/> http://shop.duxtel.com.au ____________________________________________________________________________ ___ Follow our tweets for news and updates: http://twitter.com/duxtel

1 1

Welcome!
by Mike Everest 24 Mar '14

24 Mar '14

Hi All! Welcome to the MikroTik-AU public e-mailing list :) Right now, there are only a small number of subscriptions, but we're expecting that this number will increase over the weeks ahead as word gets around. One of the first points of discussion that I think is worth starting off with is the question: "What kind of resources do you think would be useful for a regional MikroTik community like this?" Some examples might include forum application (if mikrotik.com forums are not cutting it for us) online databases of "who's using mikrotik" (has been suggested) bugtrack app, anything else? With the aim of building a community of MikroTik Professionals, to share skills and experiences among like-minded individuals, we're "all ears" to your ideas and needs! Regards, Mike Everest www.duxtel.com.au

1 0

[Public] Thanks!
by Mike Everest 20 Mar '14

20 Mar '14

Big thanks to Tom and Jethro from ConnectivityIT in getting these forums off the ground! Regards, Mike Everest www.duxtel.com.au ____________________________________________________________________________ ___ Wholesale Distributor for MikroTik and RouterBoard in Australia and Pacific Region ISP and WISP Solutions - Hardware, Software, Training, Engineering and Support All things MikroTik - <http://shop.duxtel.com.au/> http://shop.duxtel.com.au ____________________________________________________________________________ ___ Follow our tweets for news and updates: http://twitter.com/duxtel

1 0