- Public - talk.mikrotik.com.au

CGNAT implementation with routerOS
by Mike Everest 03 Feb '16

03 Feb '16

Hi all, I thought members of this list may be interested in results of some discussions that I have been having over last few weeks with tech team at MT regarding CGNAT implementations and RFC7422. In reaction to these duiscussions, Janis M and Maris have put together an article on the subject here: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT#Carrier-Grade_NAT_.28CG NAT.29_or_NAT444 Two important points coming out of this discussion are: 1) src-nat table does not have major impact on CPU resource since only the first packet of the connection parses this table, therefore it is OK to have very large numbers of rules with no need for partitioning via multiple jump rules 2) a script published by Maris and Janis offers an effective way to build CGNAT rules with flexible definitions of src-port grouping When we started talking about this, I was asking for feature to make a CGNAT rule like that using just one entry, and although I still think that such a feature enhancement would be particularly valuabe, this scripted result achieves pretty much exactly what I was asking for ;) THANK YOU Maris and Janis M :-) Cheers, Mike.

4 4

RB SXT LTE
by Thomas Jackson 02 Feb '16

02 Feb '16

Good morning all, Just wondering if anyone has tested out an RB SXT LTE in AU yet (specifically with Telstra)? From my understanding, all three networks have band 3 and/or band 7 coverage in metro areas, so I suspect it will work. I've had a chat to Duxtel and they advised that they're not planning on bringing it in at this stage (unless I want to special order a carton of them); it would be nice to know if it might work before I order one from overseas. Regards, Thomas

6 9

6.34 reset issue turns RB-941-2ND into paper weight
by Andrew Gilbett 01 Feb '16

01 Feb '16

Hi Guys, I was playing with some RB-941-2ND's and I upgraded them to 6.34 and I am now unable to log in to them after a reset. Basically I set up a CPE style config using pppoe and mistyped the password and therefore reset it to get back in and following a reset it did not respond on 192.168.88.1 at all. Is there any way to bring these devices back to life? I have tried netinstall with out any luck and multiple resets. Any help would be appreciated. Thanks Andrew

4 3

FW: CCR performance testing again
by Alex Samad - Yieldbroker 25 Jan '16

25 Jan '16

Try again san's pictures :) From: Alex Samad - Yieldbroker [mailto:Alex.Samad@yieldbroker.com] Sent: Friday, 22 January 2016 1:50 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: RE: [MT-AU Public] CCR performance testing again HI Thought I would put the commands I am using [root@alextest1 ~]# iperf -c 192.168.213.52 -i 30 -t 60 -u -l 12k -b 2 -> packets leave eth0 Goto ccr [root@alextest2 ~]# iperf -s -u -l 12k -> come in eth1 on here ------------------------------------------------------------ Client connecting to 192.168.213.52, UDP port 5001 Sending 12288 byte datagrams UDP buffer size: 32.0 MByte (default) ------------------------------------------------------------ [ 3] local 10.172.203.51 port 59192 connected with 192.168.213.52 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-30.0 sec 7.00 GBytes 2.01 Gbits/sec [ 3] 30.0-60.0 sec 7.01 GBytes 2.01 Gbits/sec [ 3] 0.0-60.0 sec 14.0 GBytes 2.01 Gbits/sec [ 3] Sent 1224310 datagrams [ 3] Server Report: [ 3] 0.0-60.0 sec 6.93 GBytes 992 Mbits/sec 0.576 ms 618577/1224308 (51%) [ 3] 0.0-60.0 sec 327413 datagrams received out-of-order [root@alextest1 ~]# At 2G cpu usage Picture of low cpu usage! 3g - 99% Picture of high cpu usage ... >98% Somebody on the list was suggesting maybe a LACP issue . haven't had an opportunity to test that. ------------------------------------------------------------ Server listening on UDP port 5001 Receiving 12288 byte datagrams UDP buffer size: 32.0 MByte (default) ------------------------------------------------------------ [ 3] local 192.168.213.52 port 5001 connected with 10.172.203.51 port 52469 [ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams [ 3] 0.0-60.0 sec 6.86 GBytes 981 Mbits/sec 0.671 ms 625418/1224436 (51%) [ 3] 0.0-60.0 sec 322936 datagrams received out-of-order [ 3] WARNING: ack of last datagram failed after 10 tries. [ 4] local 192.168.213.52 port 5001 connected with 10.172.203.51 port 59192 [ 4] 0.0-60.0 sec 6.93 GBytes 992 Mbits/sec 0.576 ms 618577/1224308 (51%) [ 4] 0.0-60.0 sec 327413 datagrams received out-of-order [ 4] WARNING: ack of last datagram failed after 10 tries. -----Original Message----- From: Alex Samad - Yieldbroker Sent: Friday, 22 January 2016 12:28 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: RE: [MT-AU Public] CCR performance testing again No Same vlan, different ip network. Why would it be sending redirects. Src is 192.168.213.52 dst is 10.172.213.51. Just because they are the same vlan doesn't allow them to talk directly (normally) Packet path is 192.168.213.52 -> 192.168.213.2 (ccr) -> 10.172.213.2 (ccr - same interface) - > 10.172.213.51 I have setup another test such that it doesn't do this. Instead in one interface and out another interface ... Again > 3G floods the CPU :(..... -----Original Message----- From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of Damien Gardner Jnr Sent: Friday, 22 January 2016 10:38 AM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: Re: [MT-AU Public] CCR performance testing again In and out the same interface.. as in vlans? Or two actual subnets on the one physical network? If it's two subnets on the same network, it should be sending an ICMP redirect back for each packet that comes via the router, which would certainly be maxxing a few CPU's? On 22 January 2016 at 10:27, Alex Samad - Yieldbroker < Alex.Samad(a)yieldbroker.com> wrote: > Hmmm > > > No > > Iperf at 3G udp > > All 36 CPU's are up around 96-100% > > It's a hairpin route in and out the same interface .... not sure if > that's the problem... > > Alex > > -----Original Message----- > From: Alex Samad - Yieldbroker > Sent: Thursday, 21 January 2016 3:30 PM > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Subject: RE: [MT-AU Public] CCR performance testing again > > I think I have found my problem. > > This is a replacement CCR1036-8G-2S+ 6.33.3 > > I replace the config with a config from a previous ccr. > > All the mac's are not the default ones. I am presuming that's causing > all the packets to hit the CPU's > > My other CCR sitting next to it, same config (diff ip's) same package. > > Will advise when I get a chance to reset it > > A > > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Andrew Cox > Sent: Thursday, 21 January 2016 3:18 PM > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] CCR performance testing again > > Hey Alex, > > It should be fine, but can you provide an example of your test config > and the routers software version? > Is the test single or multi-threaded, tcp or udp? > > - Andrew > > On Thu, Jan 21, 2016 at 1:14 PM, Alex Samad - Yieldbroker < > Alex.Samad(a)yieldbroker.com> wrote: > > > Just checked > > /system resource cpu > > > > 36 cpu doing ~100% (97-98%) load and irq ... feels like somethings > > wrong there. > > > > A > > > > -----Original Message----- > > From: Alex Samad - Yieldbroker > > Sent: Thursday, 21 January 2016 1:57 PM > > To: public(a)talk.mikrotik.com.au > > Subject: CCR performance testing again > > > > Hi > > > > I'm testing switches again and doing a comparison to the CCR. > > > > For some reason I can't seem to get past 1Gb/s without losses on my > > ccr1036. > > > > Now this could be my VM's as VM to VM I can only get around 2-3Gb/s > > before iperf starts complaining .. > > > > How are other people's experience with the CCR's I know about the > > 1Gb/s tcp stream limit, but I hand heard of any issues with UDP. > > > > Infact I was pretty sure I had push it up to 9.8Gb/s.. but that was > > a while ago > > > > A > > > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > au > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > au > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > au > -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au

3 6

Re: [MT-AU Public] RB SXT LTE
by Karl Auer 22 Jan '16

22 Jan '16

On Fri, 2016-01-22 at 15:02 +1100, Matt Perkins wrote: > I would be interested to know if they work too. Is it really too expensive to buy one or two to test? Hey, why not each pay half? These are MikroTik prices, remember. At your pay grades, you've probably already spent about three times the price of one just discussing it... Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

2 1

Re: [MT-AU Public] CCR performance testing again
by Alex Samad - Yieldbroker 22 Jan '16

22 Jan '16

Just checked /system resource cpu 36 cpu doing ~100% (97-98%) load and irq ... feels like somethings wrong there. A -----Original Message----- From: Alex Samad - Yieldbroker Sent: Thursday, 21 January 2016 1:57 PM To: public(a)talk.mikrotik.com.au Subject: CCR performance testing again Hi I'm testing switches again and doing a comparison to the CCR. For some reason I can't seem to get past 1Gb/s without losses on my ccr1036. Now this could be my VM's as VM to VM I can only get around 2-3Gb/s before iperf starts complaining .. How are other people's experience with the CCR's I know about the 1Gb/s tcp stream limit, but I hand heard of any issues with UDP. Infact I was pretty sure I had push it up to 9.8Gb/s.. but that was a while ago A

3 5

CCR performance testing again
by Alex Samad - Yieldbroker 21 Jan '16

21 Jan '16

Hi I'm testing switches again and doing a comparison to the CCR. For some reason I can't seem to get past 1Gb/s without losses on my ccr1036. Now this could be my VM's as VM to VM I can only get around 2-3Gb/s before iperf starts complaining .. How are other people's experience with the CCR's I know about the 1Gb/s tcp stream limit, but I hand heard of any issues with UDP. Infact I was pretty sure I had push it up to 9.8Gb/s.. but that was a while ago A

1 0

[FS] 2x Astaro Security Gateway 625 ASG625
by Tim Warnock 11 Jan '16

11 Jan '16

Hey Guys, I have a pair of ASG625s for sale. I have them running MikroTik x86 on a USB thumb drive. The ASG625 is a 2RU dual CPU, quad core intel xeon @ 3ghz with 18 (!) intel E1000 interfaces (not switch ports) 10 are 10/100/1000 copper, 8 are 1G SFP and has dual PSUs. If you are interested, please drop me a line :- timoid(a)timoid.org?subject=ASG625 otherwise sorry for the noise. -Tim

2 1

scripting question
by Alex Samad - Yieldbroker 11 Jan '16

11 Jan '16

Hi I keep a single rsc file for 2 CCR's that have the same firewall rules simple like /ip firewall filter remove [ find ] # ##### # YB IN # ##### add action=jump chain=YBIN comment="Check YB SRC" jump-target=YBSRC add chain=YBIN comment="Allow SSH" dst-port=22 protocol=tcp add chain=YBIN comment=OSPF protocol=ospf add chain=YBIN comment=NTP dst-port=123 protocol=udp src-port=123 Now I find I have need to have specific rules for each router, for natting. is there some what to include some sort if statement where I can go if hostname = rtr1 then include this line instead of having to have 2 files.

3 6

Re: [MT-AU Public] Dark Fibre
by Jason Clarke 09 Jan '16

09 Jan '16

Hi All, Sorry about not related to MikroTik (it will be if we can lease the fibre) But I was wondering if anyone knew who to contact about leasing VicTrack fibre? Regards, Jason

1 0