April 2016 - Public - talk.mikrotik.com.au

Universal Firewall
by Josh Oberin 29 Apr '16

29 Apr '16

Hi Guys, I'm trying to build a starter universal firewall so people can load it on their routers and then add onto it as needed, or even as just to use as an example. I uploaded it to pastebin as 50 lines is a little too much to slap into an email. http://pastebin.com/Fp05Cwng Let me know of any suggestions you have. Thanks, Josh

6 7

SIP Problem
by QCS Group - Infrastructure 26 Apr '16

26 Apr '16

Hi All, Does anyone have any issues with Mikrotik dropping any SIP traffic after a 10min active call happens? This happens constantly, just wondering what I have to tweak to get this resolved. SIP ALG is off. Firmware version is 6.34.4 Thanks Marius ________________________________ Thinking of updating your phone system? Ask us about our "Cloud Based PABX" solution before you do anything. ________________________________

3 2

Active Directory Reversible Encryption
by Dave Browning 26 Apr '16

26 Apr '16

Hi Guys, Is there ANY way to use AAA with AD and not have to do the reversible encryption thing in AD? If not, will there be in the future? Dave Browning | Network Engineer P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

3 5

Re: [MT-AU Public] RB SXT LTE
by Thomas Jackson 25 Apr '16

25 Apr '16

As a very belated followup to this, I've finally got the SXT-LTE mounted on the TV antenna mast at home (previously was inside the roof where there was a fair bit of attenuation from the insulation - wasn't really an issue since it was just being used as a backup link - but it is nice to get full use of it). Speedtest is now showing roughly 63Mb/sec down and 23Mb/sec up - which beats what I get on my Optus HFC (with Speed Pack) connection! If it wouldn't send me broke with the excess usage fees, I'd move over to the SXT LTE as my primary link in a heartbeat. I'm sure I could squeeze a bit more out of the link if I was to spend some time properly aligning it, but I've run out of time to tinker today. -----Original Message----- From: Thomas Jackson [mailto:thomas@thomax.com.au] Sent: Tuesday, 2 February 2016 12:01 PM To: MikroTik Australia Public List Subject: RE: [MT-AU Public] RB SXT LTE Received the sample earlier today - I've only had a couple of minutes to test, but it worked perfectly first go on Telstra - didn't even need to do any configuration - just dropped in a SIM and plugged it in. >From our office (a known Telstra black-spot) I was able to get 7 mbit down / 9 mbit up with Speedtest.net using the highly scientific method of holding it by hand and pointing it out the window in the rough direction of a Telstra tower. Given that we struggle to get a solid voice call out from here, I'm pretty happy with those numbers. The final destination for this unit is at home (where I get very good Telstra signal) - I'll post the results from that too once I've got it in. -----Original Message----- From: Thomas Jackson [mailto:thomas@thomax.com.au] Sent: Friday, 22 January 2016 4:57 PM To: 'MikroTik Australia Public List' <public(a)talk.mikrotik.com.au> Subject: RE: [MT-AU Public] RB SXT LTE I've got a unit on order now, hopefully will have it in the next week or two. According to the ACMA register, there is a Telstra band 3 station about 800 metres from home, so it should work there if it is going to work at all. Will post back once I have tested it out. -----Original Message----- From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of Matt Perkins Sent: Friday, 22 January 2016 3:03 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: Re: [MT-AU Public] RB SXT LTE I would be interested to know if they work to. Band 3 and 7 both are both used by Telstra and Optus. But i would be a bit worried that the new 700Mhz band is not there. So you would miss out on the new (old analog TV) which is being rolled out in regional areas. Matt. On 22/01/2016 11:00 AM, Andrew Gilbett wrote: > Hi Thomas, > > I asked exactly the same question of duxtel. And am interested in > testing one as well but also have not commited to buying one from > overseas yet. So any feed back is welcome. > > Andrew > On 22/01/2016 9:23 AM, "Thomas Jackson" <thomas(a)thomax.com.au> wrote: > >> Good morning all, >> >> Just wondering if anyone has tested out an RB SXT LTE in AU yet >> (specifically with Telstra)? From my understanding, all three >> networks have band 3 and/or band 7 coverage in metro areas, so I suspect it will work. >> >> I've had a chat to Duxtel and they advised that they're not planning >> on bringing it in at this stage (unless I want to special order a >> carton of them); it would be nice to know if it might work before I >> order one from overseas. >> >> Regards, >> >> Thomas >> >> >> >> _______________________________________________ >> Public mailing list >> Public(a)talk.mikrotik.com.au >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com >> .au >> > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > au -- /* Matt Perkins Direct 1300 137 379 Spectrum Networks Ptd. Ltd. Office 1300 133 299 matt(a)spectrum.com.au Level 6, 350 George Street Sydney 2000 Spectrum Networks is a member of the Communications Alliance & TIO */ _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au

1 0

IP rated enclosure
by Steve Hille 24 Apr '16

24 Apr '16

Hi all, I am looking for a business that can put together an IP rated enclosure (hoping for at least IP67) for a Routerboard RB493G. It has to withstand at least 70 degrees and be mountable somehow. The environment that it will be operating in will be very mobile, hot, dusty and disgusting. RF Elements have a huge big box (Carrier class) that I can stick it in but I'm looking for something a bit smaller if possible. I would really appreciate any suggestions. Cheers,

2 1

Hotspot 2.0
by Mike Everest 21 Apr '16

21 Apr '16

Hi All, Anyone here know much about Hotspot 2.0? It's some kind of wireless authentication scheme that is intended to support wide area handoff between disparate and independent wifi networks that has been billed by some as a "new generation of wifi access technology" I know that some vendors, like Ruckus in particular, have made a big deal of support for this functionality, and a recent question received by our sales team prompted me to ask MT whether there were any plans to implement Hotspot 2.0 for routerOS. Who can guess their reply?? :-D Regards, Mike Everest www.duxtel.com.au 138 Station Street, Norlane Victoria, 3214, AUSTRALIA 1300-DUXTEL (+61-3-5273-4905) ____________________________________________________________________________ ___ Wholesale Distributor for MikroTik and RouterBoard in Australia and Pacific Region ISP and WISP Solutions - Hardware, Software, Training, Engineering and Support All things MikroTik - http://shop.duxtel.com.au ____________________________________________________________________________ ___ Follow our tweets for news and updates: http://twitter.com/duxtel

5 12

General Advise on AP
by Alex Samad - Yieldbroker 21 Apr '16

21 Apr '16

Hi I have 2 x cisco AIR-AP1042N-N-K9 I am looking at replacing these can do 1 x 2.4G and 1 x 5G. I have seen some cisco (and some homo) APS that do 1 x 2.4G and 2 x 5G with multiple antenna with MIMO. With 1G poe LAN network What would I be looking at in the ROS range to do something like that ? This is for install in ceiling A Alex Samad | Network And System Manager | Yieldbroker * +61 2 9994 2893 | ( +61 438 838 143 | * alex.samad(a)yieldbroker.com<mailto:alex.samad@yieldbroker.com> This email is confidential and intended for the addressee only. If you may have received this email in error please delete it and notify the sender immediately. Recipients should not forward, disclose, distribute or copy this e-mail or any attachments in whole or part without the express permission of the sender. Views expressed in this message are those of the individual sender, except where they are specifically stated to be those of Yieldbroker. Yieldbroker accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Yieldbroker can not guarantee the integrity of this communication and shall not be liable for e-mail which may be intercepted, corrupted, lost, spoofed, delayed, incomplete, or virus infected.

2 2

Re: [MT-AU Public] Public Digest, Vol 26, Issue 9
by David Ryan 20 Apr '16

20 Apr '16

Hi Mike, I know about the setting you mention when talking about normal wlan interfaces, but I cannot find an equivalent setting within capsman. It's no biggie at the moment but I will keep trying. Thanks, Dave On 19 April 2016 at 12:00, <public-request(a)talk.mikrotik.com.au> wrote: > Send Public mailing list submissions to > public(a)talk.mikrotik.com.au > > To subscribe or unsubscribe via the World Wide Web, visit > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > or, via email, send a message with subject or body 'help' to > public-request(a)talk.mikrotik.com.au > > You can reach the person managing the list at > public-owner(a)talk.mikrotik.com.au > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Public digest..." > > > Today's Topics: > > 1. Re: capsman v2 (Mike Everest) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 18 Apr 2016 19:12:42 +1000 > From: "Mike Everest" <mike(a)duxtel.com> > To: "'MikroTik Australia Public List'" <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] capsman v2 > Message-ID: <00ec01d19952$768794e0$6396bea0$(a)duxtel.com> > Content-Type: text/plain; charset="us-ascii" > > Hi Dave, > > If you have default-authenticate=yes on the main wlan interface profile, > then access controls might be overridden. > > Try turning off that default-authenticate option and see if that makes a > difference. You'll need to add an ACL rule to match all other clients > though, to let them authenticate also ;) > > Cheers! > > Mike. > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > David > > Ryan > > Sent: Sunday, 17 April 2016 3:49 PM > > To: public(a)talk.mikrotik.com.au > > Subject: [MT-AU Public] capsman v2 > > > > Howdy All, > > > > thought I would post here as I cannot seem to find "New Topic" on > > forum.mikrotik.com but that's another story. > > > > Anywho, I setup capsman V2 on 6.35 today. The CAP is also running 6.35. > > > > All is running well. I decided to try limiting AP TX speed to 512k to the > client. So I > > added an access rule. Whatever I try does not seem to work. > > > > Here is what I have so far: > > > > > > [dsryan@MikroTik] /caps-man> export > > # apr/17/2016 15:44:10 by RouterOS 6.35 > > # software id = S2JW-EBR4 > > # > > /caps-man configuration > > add country=australia datapath.bridge=capsnet distance=indoors > name=captest > > security.authentication-types=\ > > wpa2-psk security.encryption=aes-ccm > security.group-encryption=aes-ccm > > security.passphrase=qwerty123 \ > > ssid=captest > > /caps-man access-list > > add ap-tx-limit=512000 disabled=no mac-address=34:FC:EF:A9:C7:E0 ssid- > > regexp="" > > /caps-man manager > > set enabled=yes > > /caps-man provisioning > > add action=create-dynamic-enabled master-configuration=captest name- > > prefix=HAT > > > > I have a capsman V1 running at another site using an access list there > and > all is > > well. Is this a "feature" or am I having a blonde moment? > > > > Thanks, Dave. > > > > -- > > David Ryan - 0402 054 426 > > RJS Communications > > dsryan(a)rjs.com.au > > MTCNA, MTCWE, MTCRE > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > ------------------------------ > > End of Public Digest, Vol 26, Issue 9 > ************************************* > -- David Ryan - 0402 054 426 RJS Communications dsryan(a)rjs.com.au MTCNA, MTCWE, MTCRE

2 1

PPPoE bridging via a vlan? Am I losing my mind?
by Damien Gardner Jnr 20 Apr '16

20 Apr '16

Hi Folks, I don't know if I'm doing something wrong, or just losing my mind. We've finally (6 week wait) had FTTN connected at home, and as I had it connected through work, I was able to connect it the same way as my ADSL used to be - static IP with /28 routed down it. I wanted to 'simplify' my routing a little though, and instead of doing everything on my main CRS109, and using a VRF for my internal routing (to keep them separated from the DMZ, and make sure the DMZ can't route down the VPN to work, etc), I figured I'd temporarily use one of my mAP's for the internet routing. So connection was VDSL modem (Netcomm NF4V) -> port one on CRS, with ingress/egress VLAN translations to put it on vlan 99. DMZ is on vlan 101, both of which are tagged onto a port going to the mAP-2n. Configured the vlans on the ether1 on the mAP, brought up an IP to test connectivity, and I could ping the private IP of the VDSL modem. But PPPoE connection would not come up, and PPPoE scan showed nothing. Bringing up that vlan on the CRS109, and doing a PPPoE scan showed two AC's. So I then plugged the cable from the VDSL modem directly into ether2 on the mAP. And still nothing on the PPPoE scan. Put the cable back and trunked the vlan across to a routerOS VM. Nothing on PPPoE Scan. Trunked the vlan to the CRS109 in the garage - and PPPoE scan worked from there (although only showed one AC, not two) I've also tried two other VDSL modems (draytek Vigor 130, and TP-Link TD-W8977), with the same results. Have I missed something? is there a limitation in the mAP (and RouterOS for x86 for that matter?) that would stop PPPoE from working? or does PPPoE bridging need some special config on switching/vlans to let it work? Thanks, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

4 19

capsman v2
by David Ryan 18 Apr '16

18 Apr '16

Howdy All, thought I would post here as I cannot seem to find "New Topic" on forum.mikrotik.com but that's another story. Anywho, I setup capsman V2 on 6.35 today. The CAP is also running 6.35. All is running well. I decided to try limiting AP TX speed to 512k to the client. So I added an access rule. Whatever I try does not seem to work. Here is what I have so far: [dsryan@MikroTik] /caps-man> export # apr/17/2016 15:44:10 by RouterOS 6.35 # software id = S2JW-EBR4 # /caps-man configuration add country=australia datapath.bridge=capsnet distance=indoors name=captest security.authentication-types=\ wpa2-psk security.encryption=aes-ccm security.group-encryption=aes-ccm security.passphrase=qwerty123 \ ssid=captest /caps-man access-list add ap-tx-limit=512000 disabled=no mac-address=34:FC:EF:A9:C7:E0 ssid-regexp="" /caps-man manager set enabled=yes /caps-man provisioning add action=create-dynamic-enabled master-configuration=captest name-prefix=HAT I have a capsman V1 running at another site using an access list there and all is well. Is this a "feature" or am I having a blonde moment? Thanks, Dave. -- David Ryan - 0402 054 426 RJS Communications dsryan(a)rjs.com.au MTCNA, MTCWE, MTCRE

2 1