- Public - talk.mikrotik.com.au

Mangle new routing mark from router traffic
by Steve at Digitronics 02 Mar '24

02 Mar '24

For a long time now I have been steering traffic from the LAN through the router using a <mangle : prerouting : new routing mark> and a routing rule sending that new routing mark out a specific interface. Easy and reliable. Now I want to do the same thing for traffic from the router itself, but it doesn't want to work. It seems the prerouting chain is only for traffic from interfaces, not the router itself, and I can't apply a new routing mark unless it is from the prerouting chain. Catch 22. Am I missing something? Using ROS 6.49.

3 3

OpenVPN implementation ROS 6.49
by Steve at Digitronics 01 Mar '24

01 Mar '24

Can anyone confirm for me that the OpenVPN implementation in 6.49 works with VPN providers' OpenVPN servers generally? There is chat that the OpenVPN implementation in ROS is not 'open' and I would rather be sure before I spend more time trying to get it to work with VPN service providers. -Steve

3 6

Performance on CCR2216-1G-12XS-2XQ
by Shane Clay 18 Feb '24

18 Feb '24

Hi All I've got my hands on a couple of CCR2216-1G-12XS-2XQ fitted with XQ+85MP01D 100G transceivers. Just doing some initial testing using the built in BTest Server & SpeedTest tools as a bit of initial benchmarking. So far I haven't been able to get up to 100G. The instantaneous throughput I see in the interface list is round 50G for TCP and 75G for UDP. There is absolutely no config on the devices (queues, firewall rules, etc). Interfaces are showing auto-negotiation at 100G full duplex. My guess is that this tool isn't up to the job of maxing out the link but iPerf would probably get it up there. Thoughts? [admin@lab2] > tool speed-test address=192.168.0.1 connection-count=20 user=admin password=admin ;;; results can be limited by cpu, note that traffic generation/termination performance might not be representative of forwarding performance status: done time-remaining: 0s ping-min-avg-max: 42us / 49us / 453us jitter-min-avg-max: 0s / 5us / 405us loss: 0% (0/200) tcp-download: 46.4Gbps local-cpu-load:44% tcp-upload: 37.6Gbps local-cpu-load:31% remote-cpu-load:36% udp-download: 37.7Gbps local-cpu-load:15% remote-cpu-load:30% udp-upload: 45.4Gbps local-cpu-load:36% remote-cpu-load:1 [admin@lab2] > tool bandwidth-test direction=receive address=192.168.0.1 duration=20 user=admin password=admin connection-count=20 protocol=udp ;;; results can be limited by cpu, note that traffic generation/termination performance might not be representative of forwarding performance status: done testing duration: 20s rx-current: 79.2Gbps rx-10-second-average: 71.6Gbps rx-total-average: 56.8Gbps lost-packets: 1110 random-data: no direction: receive rx-size: 9000 connection-count: 20 local-cpu-load: 25% remote-cpu-load: 98%

3 2

CCR2216-1G-12XS-2XQ compatible with 10G SFP+
by Shane Clay 29 Jan '24

29 Jan '24

Hi All My research is coming up short! Can anyone confirm (or not) if the SFP28 ports in CCR2216-1G-12XS-2XQ are backwards compatible with SFP+ 10G transceivers? Regards, Shane Clay | Director w: www.caznet.com.au<http://www.caznet.com.au/> p: 1300 229 638 d: 08 8470 8905 a: 172 Morphett Street, Adelaide SA 5000 [https://caznet.com.au/wp-content/uploads/2019/09/caznet_logo.png] Business Phones<https://caznet.com.au/voip-business-phone/> | Private Cloud<https://caznet.com.au/private-cloud/> | Internet<https://caznet.com.au/internet/> | Wide Area Networks<https://caznet.com.au/wide-area-networks/> | Data Centre<https://caznet.com.au/adelaide-data-centre/> Leave us a review on Google: g.page/Caznet/review<http://g.page/Caznet/review>

2 1

EP06-E dropouts
by Jason Hecker 26 Jan '24

26 Jan '24

I have an LHG with an EP06-E module fitted running to a tower about 10km away connected to Telstra. It's been OK for the most part but lately the 4G link has been flapping several times a day, sometime with long periods of silence. The logs show nothing awry apart from the LTE link going down and DHCP not happening. Has anyone else noticed robustness issue with this module? I have set system reboots at 5am to try and help but it keeps happening through the day.

3 5

/31 Deployments for Point-to-Point links
by Christopher Hawker 09 Jan '24

09 Jan '24

Hey all, Trying to stand-up a BGP session between a CCR2004-1G-12S+2XS and a CCR2004-16G-2S+ using a /31 for the link. I'm able to ping across the link no problem, however, the BGP session doesn't establish. I'm attempting to move an existing session from a /30 where it works in order to conserve IP space. Is there some skullduggery going on, or is 7.13 just not RFC3021-compliant? Thanks, Christopher Hawker

10 25

RBwAPG-5HacT2HnD losing 5GHz radio?
by Damien Gardner Jnr 22 Dec '23

22 Dec '23

HI all, Kinda pulling my hair out with this one.. Hoping someone has a suggestion. I have a RBwAPG-5HacT2HnD, love this thing. But yesterday morning we started getting weird outage alerts from monitoring at home, with some devices being offline. (The main kicker was the cubby lol) When I got home from work I went looking, and finally tracked it down to wlan2 being missing.. A reboot brought it back.. But 10 mins later it was gone again. Rebooted it a few more times, then added remote syslog, and went to bed. Got up this morning, and remote syslog really wasn't any use at all (I assume there's some specific prefix I should have been punting to remote syslog to catch the device going away), and now reboots aren't helping, it has to be a physical power removal and re-application.. Thankfully I have a spare (Got one on ebay at the start of the year, and had meant to set it up at the back of the house), so have just finished copying the config to it, but would love to get this one working properly again.. Was hoping it was just mini-PCIe cards or something, but alas no. Has anyone had the 5GHz radio go away on these? And fixed it? It's 4 1/2 years old, so I'm pretty sure it's out of warranty period 🤣 Thanks, DG -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

4 3

Proscend PS180-T VDSL SFP Modem EOL
by Tim Sandy 12 Dec '23

12 Dec '23

I'm quite sad to have just discovered that the PS180-T is now EOL, does anyone know of a similar product out there? I've got them at quite a few sites and would really love to avoid running an external modem in bridge mode. Cheers, Tim

6 7

ROS6->ROS7 and BGP
by Tim Warnock 17 Nov '23

17 Nov '23

Hey Guys, I ran an experiment to upgrade a ROS6 box to ROS7 to see what it looks like and found at least the following things: 1 - route "check" tracking doesn't seem to work? 2 - no-exports set on routes towards EBGP peers are interpreted rather than forwarded - so you can't signal to EBGP peers to no-export your routes from outside of their ASN anymore. 3 - it appears that the route policy conversion bugs out if one of the entries is disabled so you have to be prepared to fix any entries that are missing. 4 - you can no longer set the ASN of a route being advertised. (would need to update RPKI information) 5 - non-synchronous network statements are gone, so you can't easily send scrub communities via BGP anymore (because a legit route now has to exist in table). 1,2 and 3 feels like bugs, the rest I'm not sure why the functionality was removed. Anyone successfully spoken to MikroTik about what their thought process was with the changes? (I opened a ticket for 2 and it was ignored.) Thanks Tim

3 2

Puzzled why forwarding no work
by Karl Auer 07 Nov '23

07 Nov '23

Some may recall I now have a Wireguard VPN between a Starlink-connected site and another site. The other site has a static IP address, the Starlink site does not. Inevitably, someone now wants to connect from outside to a server in TCP/85 in the Starlink site. No problem, thinks I. They can connect to the static IP and I will ship their connection over the VPN to the other network. Just dstnat plus srcnat. In the following, xxx is the static IP address, and 192.168.103.184 is the address they want to reach in the Starlink-connected network. /ip filter nat add chain=dstnat action=dst-nat \ dst-address=xxx dst-port=85 protocol=tcp \ to-addresses=192.168.103.184 to-ports=85 \ in-interface=e1-uplink log=yes log-prefix="A" add chain=srcnat action=masquerade \ ???? out-interface=wg0 log=yes log-prefix="B" I can't figure out what I should put in the srcnat rule that will limit it so it only src-nats packets coming from the public internet. The obvious one, filtering on "in-interface=e1-uplink", isn't possible with srcnat. What am I missing? Or do I have to add "accept" rules for all the networks I don't want NATted by wg0? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

5 10