- Public - talk.mikrotik.com.au

Telstra Frontier Modem/Router with Failover into MK Router
by Matt Hall 27 Mar '18

27 Mar '18

Hi Everyone, The new Frontier router/modem (Technicolour DJN2130) from Telstra has 4G failover built in but if you bridge it failover doesn’t work. I’ve tested this by unplugging the WAN port from the accompanying cable modem (Netgear CM450-TLAUS) and also by unscrewing the fibre cable. 4G won’t kick in. If you do the same with the factory settings config, 4G kicks in. I’d like to route and run Wireless from my MK router but am unsure about a few things. Basically I’d like the Frontier to do as little as possible. So far I would do this on the Frontier: Under WAN Services 1. Turn off NAT-PNP 2. Turn of UpnP? 3. Turn off secure mode? (not sure what that is). 4. Turn off Wi-Fi 5. Turn of DHCP Server 6. How should I setup the Firewall? I can’t turn it off completely it seems. Firewall settings are: Low mode, the firewall will allow all outbound connections. It will reject unknown incoming connections but acknowledge the presence of the gateway. Normal mode, the firewall will allow all outbount connections. It will silently drop unknown incoming connections. High mode, the firewall will allow outgoing connections to the following services: HTTP, HTTPS, SMTP, POP3, IMAP, SSH. It will silently drop unknown incoming connections. User mode, you can configure each individual rule of the firewall as well as the default behaviour. User defined options are: Answer Internet ping On/off Outgoing default policy: ACCEPT/DROP/REJECT The outgoing policy defines what is done with packets coming from the LAN devices toward the internet. Setting it to REJECT or DROP will forbid any internet traffic from the LAN unless explicitely allowed by a firewall rule. Incoming default policy: DROP/REJECT The incoming policy defines what is done with packets destined to the gateway. They can be either REJECTED (the gateway will notify the sender they were rejected) or DROPPED (the gateway will silently discard those packets). Then to manually add a new rule options are: 1. Action: ACCEPT/DROP/REJECT 2. Protocol: TCP, UPD, TCP/UDP, UDP Lite, ICMP, ESP, AH, SCTP, all 3. Src IP 4. Src port 5. Dst IP 6. Dst port Then firewall rules for IPv6 follows the same protocol. Thankyou, Matt Hall Sydney

2 1

Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP ac lite
by Jason Hecker (Up & Running Tech) 08 Mar '18

08 Mar '18

As an aside, have you seen your non-Apple clients maxing out at 54Mbit TX rate on 2.4GHz as per this thread? https://forum.mikrotik.com/viewtopic.php?f=7&t=102908 At my place Apple devices are fine but anything Android - including out late model Samsung phones refuse to go above 54Mbit TX. I am surprised this isn't resolved and seems to be in the Too Hard basket for Mikrotik! This is a problem anywhere you put in loads of Mikrotik devices. Any thoughts, Mike or anyone else who has deployed public CAPSMAN systems? On 7 March 2018 at 08:09, Ben Farmer <ben.farmer(a)gigafy.co> wrote: > Hi Jason, > > I've applied the changes you've suggested and so far haven't heard back. > Although this issue is a bit weird, sometimes it'll happen immediately, > other times it'll take two to three weeks to be a problem. > > Mikrotik has also loaded one of their test packages on the device to get > more debugging info, so hopefully we have something soon. > > Ben > > -----Original Message----- > From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Jason > Hecker (Up & Running Tech) > Sent: Tuesday, 6 March 2018 10:55 > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Subject: Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP ac > lite > > Hi Ben > > What happened in the end? > > Jason > > On 27 February 2018 at 09:50, Ben Farmer <ben.farmer(a)myport.com.au> wrote: > > > Hi Jason, > > > > Thanks for the suggestions, most of those we've got, but will give it > > a shot with only-N, WMM enabled and multicast helper as well. > > > > Greg, they are not able to roam, the SSID is restricted down to one > > device only. > > > > The error message so far has appeared on both iOS/OSX devices and > > Windows laptops. Haven't heard anything about Android devices, but > > then again they don't seem to be as common these days. > > > > Regards, > > Ben Farmer > > > > Network Engineer > > > > > > www.myport.com.au > > > > Address 86 Brookes St, Fortitude Valley Q 4006 Mobile 0488 034 499 > > Direct 07 3177 1122 Tel 1300 733 629 Fax 07 3177 1129 Email > > ben.farmer(a)myport.com.au > > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > > Jason Hecker (Up & Running Tech) > > Sent: Tuesday, 27 February 2018 7:58 > > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > > Subject: Re: [MT-AU Public] Mikrotik - Wireless Issue on hAP and hAP > > ac lite > > > > Hi Ben, > > > > I generally set the following on 2.4GHz: > > > > - Use only channels 1, 6, 11 > > - Set 20Mhz bandwidth > > - Unless you have old gear set 2GHz-only-N. When devices like Sonos > and > > old printers crop up you have to go back to B/G/N. > > - 802.11 > > - Distance indoors > > - Adaptive noise immunity client and ap > > - Preamble mode to both > > - Any guard interval > > - All chains enabled > > - Full multicast helper > > - WMM enabled > > - Only use WPA2-PSK and only AES > > > > More than 1 AP now I use CAPSMAN, sometimes with local forwarding > > sometimes not. It's just a lot easier in the long run. > > > > Try it out. > > > > Jason > > > > > > > > > > On 27 February 2018 at 08:27, Ben Farmer <ben.farmer(a)myport.com.au> > wrote: > > > > > Hi guys, > > > > > > Hoping any of you can help. We're seeing weird issues with our > > > Mikrotik client routers in deployment, specifically with the 2.4GHz > > > wireless on the hAP and hAP ac lites. > > > > > > This issue we're seeing seems to affect the 2.4GHz wireless card > > > (Atheros > > > AR9300 in both models) but does not affect the 5GHz card in the ac > lite. > > > > > > Customers are reporting to us the inability to connect to wireless > > > at times, such as invalid security key or failure to connect > > > messages (depending on the customer device). > > > > > > The wireless interface itself will show as running, but with no > > > clients connected. No error messages are indicated in the log about > > > exchange key timeouts or anything similar, like you'd expect. > > > > > > Doing anything that performs a soft-reset like operation on the > > > wireless interface will allow the customer to connect again for a > > > period > > of time. > > > This can include: > > > - Doing a wireless scan. > > > - Doing a frequency usage scan. > > > - Changing channel. > > > - Changing SSID. > > > > > > Basically any option you can change will fix it, even rebooting the > > router. > > > > > > We've tried all different types of software from 6.39 through 6.41, > > > even the latest rc (6.42rc35). We've seen this issue for at least > > > three months now, if not longer. It's not isolated to a particular > > > site either, as we receive reports daily from other customer > > > locations > > with the same issue. > > > > > > Initially we thought it was interference, but even then we have > > > customers with very low utilisation and still seeing this issue. > > > > > > We have reported a case with Mikrotik, but their most recent > > > suggestion was to post in the forums to see if anyone else was > > > experiencing this issue (which surprised me, generally they direct > > > you to support if you write this sort of stuff in the forums). > > > > > > Below I've included a brief output from the router showing the way > > > this interface is currently set up. > > > > > > Have any of you seen this type of issue on either this wireless card > > > or others? > > > > > > /interface wireless security-profiles add > > > authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys > > > name=wlan1 supplicant-identity=room-403 > > > > > > /interface wireless > > > set [ find default-name=wlan1 ] > > > adaptive-noise-immunity=ap-and-client-mode > > > band=2ghz-b/g/n country=australia disabled=no distance=indoors > > > frequency=2462 mode=ap-bridge security-profile=wlan1 ssid="Room 403" > > > wireless-protocol=802.11 > > > > > > Regards, > > > Ben > > > > > > _______________________________________________ > > > Public mailing list > > > Public(a)talk.mikrotik.com.au > > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > > au > > > > > > > > > > > -- > > <https://www.upandrunningtech.com.au> > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > > au > > > > > > -- > <https://www.upandrunningtech.com.au> > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > -- <https://www.upandrunningtech.com.au>

2 2

Mikrotik - Wireless Issue on hAP and hAP ac lite
by Ben Farmer 06 Mar '18

06 Mar '18

Hi guys, Hoping any of you can help. We're seeing weird issues with our Mikrotik client routers in deployment, specifically with the 2.4GHz wireless on the hAP and hAP ac lites. This issue we're seeing seems to affect the 2.4GHz wireless card (Atheros AR9300 in both models) but does not affect the 5GHz card in the ac lite. Customers are reporting to us the inability to connect to wireless at times, such as invalid security key or failure to connect messages (depending on the customer device). The wireless interface itself will show as running, but with no clients connected. No error messages are indicated in the log about exchange key timeouts or anything similar, like you'd expect. Doing anything that performs a soft-reset like operation on the wireless interface will allow the customer to connect again for a period of time. This can include: - Doing a wireless scan. - Doing a frequency usage scan. - Changing channel. - Changing SSID. Basically any option you can change will fix it, even rebooting the router. We've tried all different types of software from 6.39 through 6.41, even the latest rc (6.42rc35). We've seen this issue for at least three months now, if not longer. It's not isolated to a particular site either, as we receive reports daily from other customer locations with the same issue. Initially we thought it was interference, but even then we have customers with very low utilisation and still seeing this issue. We have reported a case with Mikrotik, but their most recent suggestion was to post in the forums to see if anyone else was experiencing this issue (which surprised me, generally they direct you to support if you write this sort of stuff in the forums). Below I've included a brief output from the router showing the way this interface is currently set up. Have any of you seen this type of issue on either this wireless card or others? /interface wireless security-profiles add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=wlan1 supplicant-identity=room-403 /interface wireless set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode band=2ghz-b/g/n country=australia disabled=no distance=indoors frequency=2462 mode=ap-bridge security-profile=wlan1 ssid="Room 403" wireless-protocol=802.11 Regards, Ben

3 5

Bulk net-installing
by Thomas Jackson 05 Mar '18

05 Mar '18

As someone with a large pile of hAP devices that need to be netinstalled (both to run a config script, and to get them onto the right version of ROS), my options appear to be a) spend all day laboriously processing one device at a time, b) try and find someone else to push the job onto, or c) figure out a way that I can run the process in bulk. Before I spend more time reverse engineering the netinstall process to try and replicate it en-masse, how do others typically approach this? My other thought is to use flashfig with a line in the script to pull down the right ROS version as part of the process, the downside there is that (if my understanding is right) our config is not "burned into" the device so if they are reset in the field they'll go back to the factory-default Mikrotik configuration which isn't ideal in this environment.

5 6

queue noob
by Karl Auer 04 Feb '18

04 Feb '18

I bought an HAP ac lite, intending to use it as a throttle between a bunch of evil leeching wifi users and a client's tender defenseless Internet router. I have had a test unit (an older 951 unit) in there and used the bandwidth command on the relevant ethernet port. That worked a treat. Turns out none of the interfaces on the HPA ac line support the set bandwidth command :-( So I have turned to queues. I cannot figure them out. This command should IMHO limit the total bandwidth coming IN to ether1 to 1 megabit, and the total bandwidth for traffic LEAVING ether1 to 500 kilobits: /queue simple add target=ether1 queue=ethernet-default/ethernet-default max-limit=500K/1M But when I do that, nothing moves over ether1 (which is the link between the HAP and the Internet router). So I deleted that queue and tried this (192.168.100.0/24 is the network containing the leeches - wlan1, wlan2, ether2/3/4 bridged): /queue simple add target=192.168.100.0/24 queue=ethernet-default/ethernet-default max-limit=500K/1M Traffic flows over ether1, but this in no way limits the bandwidth to anything like those values. If I use 10K/10K instead and then download a file in Firefox, I see the transfer rate start at 12KB/s (kilobytes per second) and creep steadily up to around 100KB/s by the time the whole 50MB file has been downloaded. That's in stark contrast to the 1 or 2 megabytes per second I get without the queue, so *something* is happening, it just doesn't seem very predictable. Ideas would be very welcome... Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D Old fingerprint: 58F8 09D4 97E4 D74A 0940 44BC 8D6D C28C 3BC9 B0CB

3 6

Re: [MT-AU Public] queue noob
by Michael Junek 03 Feb '18

03 Feb '18

Hi Karl, If you're using a bridge, the IP should be assigned to the bridge interface, not to one of the members. That might be your issue. M ________________________________ From: Karl Auer <kauer(a)nullarbor.com.au> Sent: Saturday, 3 February 2018 2:31 pm To: MikroTik Australia Public List Subject: Re: [MT-AU Public] queue noob On Sat, 2018-02-03 at 13:43 +1100, Mike Everest wrote: > if the interface is configured as a bridge port, then define the > bridge as the interface for queue not the physical port. Thanks - but still no go. The bridge has three interfaces in it - ether2, wlan1, wlan2. ether3 and ether4 are slaved to ether2. ether5 has been split off as a management port, nothing on it for these tests. The network on the bridge (actually on ether2) is 192.168.100.0/24. The bridge settings are: use-ip-firewall: yes use-ip-firewall-for-vlan: no use-ip-firewall-for-pppoe: no allow-fast-path: yes bridge-fast-path-active: no bridge-fast-path-packets: 0 bridge-fast-path-bytes: 0 bridge-fast-forward-packets: 0 bridge-fast-forward-bytes: 0 My queue looks like this (formatting edits only): Flags: X - disabled, I - invalid, D - dynamic 0 name="test" target=bridge parent=none packet-marks="" priority=8/8 queue=default-small/default-small limit-at=0/0 max-limit=10k/10k burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1 With target=ether1, nothing moves. With target=bridge, the queue has no effect at all. With target=192.168.100.0/24, the queue seems to slow down interactive access to the router dramatically (leading to unfounded optimism), but a file transfer in Firefox scoots up to 100 kiloBYTES per second average over a 50 megabyte download. The thing is, without the queue the transfer happens at 1.2 megabytes per second, so clearly the queue is doing something! Just not remotely like what I am expecting. In desperation I set max-limit to 1000/1000 and things almost stopped :-) Interaction with the router CLI involved multi-minute delays. The browser was rendered unusable, so could not see whether the download was any slower. What am I missing? This seems like a totally simple thing to want, it must be a common requirement, how come it is so danged hard to achieve? "That link there - allow no more than X bps inbound and Y bps outbound". Regards, K. > > > > -----Original Message----- > > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf > > Of Karl > > Auer > > Sent: Friday, 2 February 2018 11:21 PM > > To: MikroTik Public <public(a)talk.mikrotik.com.au> > > Subject: [MT-AU Public] queue noob > > > > I bought an HAP ac lite, intending to use it as a throttle between > > a bunch of > > evil leeching wifi users and a client's tender defenseless Internet > > router. I > > have had a test unit (an older 951 unit) in there and used the > > bandwidth > > command on the relevant ethernet port. That worked a treat. > > > > Turns out none of the interfaces on the HPA ac line support the set > > bandwidth > > command :-( > > > > So I have turned to queues. I cannot figure them out. This command > > should > > IMHO limit the total bandwidth coming IN to ether1 to 1 megabit, > > and the > > total bandwidth for traffic LEAVING ether1 to 500 kilobits: > > > > /queue simple > > add target=ether1 queue=ethernet-default/ethernet-default max- > > limit=500K/1M > > > > But when I do that, nothing moves over ether1 (which is the link > > between the > > HAP and the Internet router). > > > > So I deleted that queue and tried this (192.168.100.0/24 is the > > network > > containing the leeches - wlan1, wlan2, ether2/3/4 bridged): > > > > /queue simple > > add target=192.168.100.0/24 queue=ethernet-default/ethernet-default > > max- > > limit=500K/1M > > > > Traffic flows over ether1, but this in no way limits the bandwidth > > to anything > > like those values. If I use 10K/10K instead and then download a > > file in Firefox, > > I see the transfer rate start at 12KB/s (kilobytes per second) and > > creep > > steadily up to around 100KB/s by the time the whole 50MB file has > > been > > downloaded. > > That's in stark contrast to the 1 or 2 megabytes per second I get > > without the > > queue, so *something* is happening, it just doesn't seem very > > predictable. > > Ideas would be very welcome... > > Regards, K. > > -- > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > ~~~~~~~~ > > Karl Auer (kauer(a)nullarbor.com.au) work +61 2 > > 64957435 > > http://www.nullarbor.com.au mobile +61 428 > > 957160 > > > > GPG fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D > > Old > > fingerprint: 58F8 09D4 97E4 D74A 0940 44BC 8D6D C28C 3BC9 B0CB > > > > > > > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.c > > om.au > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com > .au -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D Old fingerprint: 58F8 09D4 97E4 D74A 0940 44BC 8D6D C28C 3BC9 B0CB _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au

2 5

CRS-109, Vlan Translations, and SFP's.. Am I missing something?
by Damien Gardner Jnr 02 Feb '18

02 Feb '18

Hi Folks, (Sorry, this is a bit long, but hoping I'm just missing something bleedingly obvious..) Playing with one of the VDSL SFP's this evening, working quite nicely. However hitting a weird snag. On the Huawei HG658 i was using, I had vlan100 set on the PTM bridge, so was simply doing ingress/egress translations of vlan 0 to vlan 99 on the switch chip in the CRS109. (Vlan100 is already in use in my network, so my PPPOE bridge network ended up on vlan 99) Something like: /interface ethernet switch vlan add ports=ether1-master-local,ether2-huawei-bridge,switch1-cpu vlan-id=99 /interface ethernet switch egress-vlan-tag add tagged-ports=ether1-master-local,ether2-huawei-bridge,switch1-cpu vlan-id=99 /interface ethernet switch egress-vlan-translation add customer-vid=99 customer-vlan-format=untagged-or-tagged new-customer-vid=0 ports=ether2-huawei-bridge service-vlan-format=untagged-or-tagged /interface ethernet switch ingress-vlan-translation add new-customer-vid=99 ports=ether2-huawei-bridge That way the bridged VDSL traffic on native VLAN from the huawei ends up in VLAN99 on the RouterOS CPU interface (And ether1-master-local which goes to my other CRS-109 which sometimes brings up a separate PPPOE session). Plugging in the VDSL SFP, I knew I needed to do the vlan 100 tagging myself, so figured I can simply do VLAN translations 100<>99, instead of 0<>99 on the sfp1-slave-local interface (ether1-master-local is master port to all ports on the CRS-109). I'm using similar to this on another CRS at work doing Vlan translations on my uplink port, and it's working fine on the ether1 port.. Is the SFP port special in any way? Adding the appropriate rules similar to above to add vlan 99 being re-written as vlan 100 on SFP side as below, doesn't end up with any traffic passing: /interface ethernet switch vlan add ports=ether1-master-local,ether2-huawei-bridge,sfp1-slave-local,switch1-cpu vlan-id=99 /interface ethernet switch egress-vlan-tag add tagged-ports=ether1-master-local,ether2-huawei-bridge,sfp1-slave-local,switch1-cpu vlan-id=99 /interface ethernet switch egress-vlan-translation add customer-vid=99 customer-vlan-format=untagged-or-tagged new-customer-vid=100 ports=sfp1-slave-local bridge service-vlan-format=untagged-or-tagged /interface ethernet switch ingress-vlan-translation add customer-vid=100 new-customer-vid=99 ports=sfp1-slave-local I'd have thought this SHOULD work? If I pull the SFP1 interface out of the switch chip (i.e. master=none), and create vlan100 under it, and then assign the pppoe interface to sfp1_vlan100, it comes up instantly. If I leave it IN the switch chip, and instead just add vlan 100 to sfp port, and then use vlan100 for the pppoe dialler, it also works - but I don't want PPPOE traffic on vlan100 internally, as that's the LAN.. Is this maybe a hiccup with the CRS109's switch chip vlan translations, that you can't do translations between two vlan ID's which it's using internally or somesuch? Thanks, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

4 4

PPPOE and Fast Path
by Paul Julian 12 Jan '18

12 Jan '18

For those of you running Mikrotik as a PPPOE LNS what are you doing with Fast Track/Fast Path when you are using dynamic simple queues for users ? We seem to have hit and miss results with it, sometimes it works, sometimes it doesn't. If we have a simple queue not matching any upload traffic we have to disable fast path and it works again. Any thoughts or experiences in this area ? We even have some routers where some customer queues work ok and others don't match upload traffic with default settings for fast path. Strange... Regards Paul

3 2

Internet Usage Reporting device
by Paul Julian 10 Jan '18

10 Jan '18

Hi all, Happy New Year BTW ! I am looking to put together a solution which we can provide as a diagnosis service for our customers to help them analyse what is happening on their Internet connection. There are a number of products which can give you information on such things like PfSense, Untangle, BandwidthD etc, but basically I am after something that can report things to the customer, or us actually so that we can then put together a report and recommendations. The sort of things we want to report on are: - Top talkers - Bandwidth used - Application usage We are not interested in tracking end user usage or anything, it's more just so that the customer knows what their Internet is getting used for and how much. I would really love to put this into a Mikrotik Routerboard but can't see how it's possible. I know we will need some type of proxy running like Squid or something, but it's the information gathering and reporting that are important. At this point my best solution seems to be a NUC running windows with Untangle on it and a mAP-2nD or something to redirect the traffic transparently to the NUC Proxy. Has anybody done a project like this before or does anybody have any better suggestions than what I am thinking of at the moment ? Thanks Paul

6 13

Monitoring port flapping or OSPF
by Paul Julian 30 Nov '17

30 Nov '17

Hi all, just wondering if anybody can recommend any tools for monitoring port flaps or OSPF status changes on Mikrotik devices ? We use a host of monitoring products but the SNMP support within RouterOS is limited/non- existent for these items, and other monitoring tools seem to be unable to pickup some slight issues. Thanks Paul

3 2