- Public - talk.mikrotik.com.au

EoIP Tunnel that doesn't want to tunnel
by Christopher Hawker 06 Sep '21

06 Sep '21

Hi Everyone, I for some reason, have two MT devices (A-side is a CCR1009-8G-1S-1S+ and the Z-side is a CHR) and they don't seem to want to tunnel together. The tunnel comes up, two ICMP packets get through, and the link goes down. There is no firewalling in place (or has been disabled altogether for testing purposes) however the issue still manifests. The only thing is on the A side the public IP address is received by DHCP, however a reservation has been set by the carrier so the address will not change. *** A Side *** /interface eoip add allow-fast-path=no disabled=yes ipsec-secret="fakepass" local-address=192.0.2.10 mac-address=12:34:56:78:90:12 name=tun1 remote-address=203.0.113.10 tunnel-id=1 /ip address add address=172.21.254.2/30 interface=tun1 network=172.21.254.0 *** Z Side *** /interface eoip add allow-fast-path=no disabled=yes ipsec-secret="fakepass" local-address=203.0.113.10 mac-address=21:09:87:65:43:21 name=tun1 remote-address=192.0.2.10 tunnel-id=1 /ip address add address=203.0.113.10/29 interface=ether1 network=27.32.52.8 add address=172.21.254.1/30 interface=tun1 network=172.21.254.0 If anyone would be able to point out any issues or have any ideas, it'd be much appreciated! Thanks, Christopher Hawker

4 7

State of 3G/4G fallback on MikroTik?
by Karl Auer 01 Sep '21

01 Sep '21

We need to quote to a client for two routers capable of running a VPN between two sites - easy, that's a MikroTik. But they want a fallback to 3G/4G so that the site that falls back keeps Internet access AND so that the VPN keeps running. What's the state of MikroTik 3G/4G fallback? Last I looked it seemed very roll-your-own, and supported only a few very specific dongles... Ideally it would work like the (vastly more expensive) Merakis and just fail everything over to the secondary link if the primary fails, where "fail" would be either a ping test or interface down. That said, I'm OK with a solution that needs more work, as long as once done it is set-and-forget. Any pointers? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 887A DA07 4DCC EE76 B413 27D4 C638 4189 6CF0 D556 Old fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D

7 12

Proscend 180T and hEX-S
by Jason Hecker 16 Aug '21

16 Aug '21

Hi I am contemplating using a 180T and hEX-S. Does anyone have any experience with this combination and long term reliability? Jason Hecker <https://www.upandrunningtech.com.au/>

4 6

We're back!
by Mike Everest 15 Aug '21

15 Aug '21

Apologies for the whitespace for a couple of days - thanks to Tom and Chris and team for getting the list back online again! : ) Cheers, Mike. ---------------------------------------------------------------------------- -------- Why Choose DuxTel for all your MikroTik needs? 10 good reasons: http://duxtel.com/why_duxtel ---------------------------------------------------------------------------- -------- Follow our tweets for news and updates: http://twitter.com/duxtel

1 0

hAP Lite not hAP-pening...
by Karl Auer 10 Aug '21

10 Aug '21

I have a hAP Lite (RB941-2nD-TC). I went to upload an NPK file and found that I couldn't. scp fails with various errors, mostly "temporarily unavailable", and only about three-quarters of the file is copied. This is with a direct connection to a laptop. The same cable works fine with other MikroTiks, the problem happens with other cables, the problem happens on ports 2,3 and 4, and the problem persists after a configuration reset. The problem is completely repeatable. The connection is not a complete failure - I can for example log in to the device over a cable and configure it. It's a cheap device, so I don't want to spend too much time on it, but if this is a known issue with a quick fix it'd be nice :-) Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 9FB6 C08F 91CB 5093 30EF 3E2F 8C94 EEBD 117C 4A10 Old fingerprint: CF68 0C56 EEE4 CC19 28D4 03B3 BCE0 E800 E31F 7254

7 11

Re: [MT-AU Public] IPSec puzzlement
by Karl Auer 16 Jul '21

16 Jul '21

On Fri, 2021-07-16 at 20:14 +1000, Karl Auer wrote: > I have these two routers which *were* doing an IPSec VPN quite > successfully, but for reasons unclear now no longer have a (VPN) > connection. There is Internet connectivity between them, but IPsec > stays stubbornly down. I'm at a bit of a loss, because the setup > seems ridiculously simple! I'm almost too embarrassed to write this, but here goes. Basically I made the cardinal mistake of assuming something instead of just noting the symptoms. I assumed the VPN was down; but all I really knew was that my test traffic was not being delivered as it should have been, and that it should have been going over the VPN. The policy at one end says run traffic over the VPN if it comes from 192.168.102.0/24 and is going to 192.168.103.0/24. The policy at the other end says vice versa. I was testing from the routers themselves - which have many interfaces and thus many possible source addresses. And I was not specifying a source address for my tests, so my test packets were not coming from source addresses that matched the policies. The penny dropped as I watched (for the thousandth time) a host unreachable come back from the ISP's next hop address, and oh-so- belatedly twigged that my test packets were not being directed over the VPN at all... As soon as I specified the right source addresses in my tests, the traffic went over the VPN. And when I then tested from the networks on the LAN sides of the routers (something I should have tried a lot earlier), that worked too. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

1 0

RB951G-2HnD - upgrade 6.36 to 6.47.10?
by Karl Auer 11 Jul '21

11 Jul '21

Two MikroTik RB951G-2HnD routers have sort of swung back into my orbit with the return after some time of an old customer. These routers both have 6.36 on them, and I'm thinking I should upgrade them to 6.47.10 LTS. Is that too big a jump? Will chunks of the current configuration fail? It's all fairly plain-vanilla except for an IPSec VPN running between the two devices. The particular model is barely mentioned in any of the (many, many) release notes since 6.36, and nothing really relevant. Any hints appreciated. Thanks, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

2 1

MF823's on routerOS?
by Damien Gardner Jnr 10 Jul '21

10 Jul '21

Hi Folks, We had a bit of an outage at work this morning, and I was a little surprised that my 'net at home went down - it should have just failed over to going via VPN over the MF823 with Telstra 4G that I have had plugged in for YEARS here.. Finally had some time to sit down and check, and the LTE interface is nowhere to be found. Rebooted the CRS109 incase something was hinkey.. No go. Moved the MF823 to another CRS109.. Still no go. Swapped in a spare MF823.. STILL no go.. These are on 6.47.10 and 6.46.8. Tested on our travel router (RB2011, 6.45.6), and lte1 comes up fine! Have Mikrotik removed support for MF823's in the last 12 months?? Anyone have a suggestion of something not crazy expensive to replace them with? :) -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

2 1

Re: [MT-AU Public] MF823's on routerOS?
by Two Fat Monkeys - Dirk Bermingham 10 Jul '21

10 Jul '21

Hi Damien, I have no idea on the CRS109 support. However, I've generally given up on 4G USB modems as I've found too many times they let you down when failover is critical due to a quirk of some sort... My go to now are the Teltonika RUT240 (sorry Mike ☹) the bonus is they have Band 28 support too, I've got a few dozen scattered around with 100% reliability so far. Hope this helps, DB -----Original Message----- From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Damien Gardner Jnr Sent: Saturday, 10 July 2021 2:50 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: [DKIM Failure] [MT-AU Public] MF823's on routerOS? Hi Folks, We had a bit of an outage at work this morning, and I was a little surprised that my 'net at home went down - it should have just failed over to going via VPN over the MF823 with Telstra 4G that I have had plugged in for YEARS here.. Finally had some time to sit down and check, and the LTE interface is nowhere to be found. Rebooted the CRS109 incase something was hinkey.. No go. Moved the MF823 to another CRS109.. Still no go. Swapped in a spare MF823.. STILL no go.. These are on 6.47.10 and 6.46.8. Tested on our travel router (RB2011, 6.45.6), and lte1 comes up fine! Have Mikrotik removed support for MF823's in the last 12 months?? Anyone have a suggestion of something not crazy expensive to replace them with? :) -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - https://click.pstmrk.it/2t/www.rendrag.net%2F/YYsaliMN/OHBV/RUqHRZAp5S -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au https://click.pstmrk.it/2t/talk.mikrotik.com.au%2Fmailman%2Flistinfo%2Fpubl…

1 0

PS180-T upgrade firmware issue solved!
by Mike Everest 29 Jun '21

29 Jun '21

For all who are following the PS180-T issue, we are finally able to offer a solution - details in the article: https://shop.duxtel.com.au/article_info.php?articles_id=98 Questions are always welcome as usual! Regards, Mike.

4 7