- Public - talk.mikrotik.com.au

Sanity Check on Route Filters
by Christopher Hawker 06 Nov '23

06 Nov '23

Hey all, Just looking to get a sanity check done on a route filter. If an AS is receiving routes from an IX route server, will this allow routes from the RS to be received? I'm confident it will, however just looking for validation before we test it. /routing filter rule add chain=AS64496-V4-IN disabled=no rule="if ( bgp-input-remote-as 64496) { set bgp-local-pref 200; accept }" Regards, Christopher Hawker

2 2

40G QSFP+ Card Support on Mikrotik ROS x86
by Christopher Hawker 30 Oct '23

30 Oct '23

Hi All, I'm currently trying to source a dual-port QSFP+ card that is supported on ROS x86 (bare-metal). Are there any cards that people know of that are supported? We are trying to avoid the overhead of virtualisation that comes along with running CHR on a hypervisor. Thanks, Christopher H.

2 1

Re: [MT-AU Public] Getting out of CAP mode
by Roger Plant 22 Oct '23

22 Oct '23

Sorry if this is a duplicate, It seems to have bounced earlier. Hi, Not sure if this is in the spirit of the exercise, but traditionally a cap had no password and no firewall. If this is still the case, just login (with winbox via mac address if need be) and reset to defaults? Otherwise my only suggestion is: https://help.mikrotik.com/docs/display/ROS/Reset+Button Which I am fairly sure you have looked at more than once... Regards Roger To: MikroTik Public <public(a)talk.mikrotik.com.au> Date sent: Sun, 22 Oct 2023 13:18:03 +1100 Organization: Nullarbor Consulting pty Ltd Subject: [MT-AU Public] Getting out of CAP mode From: Karl Auer via Public <public(a)talk.mikrotik.com.au> Send reply to: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Copies to: Karl Auer <kauer(a)nullarbor.com.au> [ Double-click this line for list subscription options ] Skip to end for actual question. Otherwise: So. Did I miss something? Is there a special trick for getting out of CAP mode? Is this behaviour possibly even intended? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au ---------------------------- Roger Plant

1 0

Getting out of CAP mode
by Karl Auer 22 Oct '23

22 Oct '23

Skip to end for actual question. Otherwise: I have a spare/test Mikrotik 951G 2HnD here at home. We've been through many adventures together. I trust it. I think it trusts me. Today I thought: CAPSMAN looks interesting! I took my trusty spare router, did the reset thing and put it into CAP mode. Configured up another router as a manager and it all worked swimmingly. Still have to figure out multiple SSIDs and VLANs, but that is for another day. Tired but happy, and wanting to revert my trusty spare router back to default settings for our next adventure, I pressed the reset pin while plugging in the power, waited the usual few seconds until the ACT light started flashing, and released the pin. The unit remained in CAP mode. Huh. Repeat. Repeat carefully. Repeat even more carefully. Repeat. Repeat. Speak gently to router and repeat. Speak forcefully to router and repeat. Apologise to router and repeat. Sigh. So I read numerous web pages, as one does. It seems a lot of people have difficulty distinguishing flashing LEDs from solid LEDs, distinguishing mode buttons from reset buttons, locating small holes, counting to five, coordinating their limbs etc, but these defects do not apply to me. I have reset this specific router many dozens of times. Possibly hundreds. It has always returned faithfully to a usable default configuration. OK, dragged out NetInstall (Linux version, yay!). It duly sent a new copy of RouterOS7 over to my little friend. Which remained in CAP mode. Kind of expected, so I repeated the process with "-r" to clear the configuration. And finally, finally, my little friend and I fell sobbing into one anothers' arms. So. Did I miss something? Is there a special trick for getting out of CAP mode? Is this behaviour possibly even intended? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

1 0

SPF bounces - oops!
by Mike Everest 19 Oct '23

19 Oct '23

Hi Folks! I spotted a whole bunch of list unsubscribes due to excessive bounces today - due to (mostly gmail) remote servers rejecting posts due to lack of SFP record <d'oh!> FWIW, we *did* have SPF configured for the domain, but overlooked the fact that emails come from '@talk.mikrotik.com' :-} It's now fixed and I re-activated those disabled memberships - there's no search function that let's me find all of the affected subscriptions, so I can't be certain that I fixed all of them - so if I overlooked you, please accept my apology! (but if I overlooked you, I suppose you'd never know that I did - does it keep me 'safe'? ; ) Cheers! Mike.

1 0

Re: [MT-AU Public] Mikrotik and Starlink
by Karl Auer 19 Oct '23

19 Oct '23

On Sun, 2023-10-15 at 14:55 +0000, Andrew Oakeley wrote: > I'd be inclined to set your allowed-address for the peers to > 0.0.0.0/0 On Mon, 2023-10-16 at 09:10 +1100, Roger Plant wrote: > On the Server, You need to add 192.168.16.3 to the allowed > addresses in the Client peer entry. > > On the Client, You need to add 192.168.16.1 (or maybe .16.0/24 if > there will be other peers attached to server in future) to > the allowed addresses in the Server peer entry. I had already tried what Roger suggested, and had added ",192.168.16.0/24" to the allowed-address on each end. It changed the error, but only on the client end, from the error 126 to a timeout. So I just now tried what Andrew suggested, and FMS it then worked; I could ping each Wireguard interface address from its "opposing" address on the link. But WHY?!? Why was it not enough to add just the Wireguard link subnet to each end's allowed-address list? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

4 13

BGP Multithreading on ROS v7
by Christopher Hawker 16 Oct '23

16 Oct '23

Hey All, I need to call on the wisdom of the brains trust here... I'm needing to enable multithreading on a CCR1009 that is taking in 4 full tables (2 x v4 and 2 x v6). From what I've read, the input and output affinity needs to be configured on the sessions however I'm uncertain as to how it should be set or what options need to be enabled. Would anyone have working configs for this or know how to best set them? Thanks! CH

1 0

Mikrotik and Starlink
by Karl Auer 15 Oct '23

15 Oct '23

Wondering if anyone has any tips here. A client has acquired a company whose office has a Starlink connection. This client also has an existing office with an NBN connection. The latter is connected to a Mikrotik that does plain old DHCP to get its WAN address from the NPN. Now the client wants to use the acquired company's office instead. They want to move the Mikrotik there and keep more or less the same network behind it that they have now. They've done the obvious thing and just plugged the WAN interface on the Mikrotik into an Ethernet port on the Starlink router, but no go. "No go" in this case means that PCs on the inside network don't have Internet access, and that's as far as they know how to go. I have never seen the new office or the Starlink router (or any Starlink routers). I have no idea if they connected the right Mikrotik interface to it. In fact I don't even know if the port on the Starlink router is in fact an Ethernet port. My searching on the subject finds numerous articles saying that Starlink routers have no Ethernet ports, that additional hardware must be purchased from Starlink and talking about "Bypass Mode", none of which is inspiring... Anyway, if anybody has run a small network behind Mikrotik using a Starlink router as the WAN connnection can share any info, that'd be great. Many thanks in advance, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

8 20

Conntrack count vs. total-entries, different values?
by Matthew Kobayashi 09 Oct '23

09 Oct '23

Hi all, I've come across something in RouterOS that I don't quite understand, and I was hoping someone could shed a little light on what I'm seeing. The values for the output of the below commands on my router are always quite different (approx. 150-200 apart) and I'm not sure why. As best I can tell from the documentation, these values should be identical (or at least very close), but they never seem to be close to one another. Does anyone know of a reason why they wouldn't be the same? Does total-entries mean something other than the total number of connections currently in the conntrack table? [matthew@gateway] > /ip/firewall/connection/print count-only 445 [matthew@gateway] > :put [/ip/firewall/connection/tracking/get total-entries] 648 Kind regards, Matthew Kobayashi

3 3

ROS V7
by Andrew Gilbett 19 Sep '23

19 Sep '23

Hi Team, I am interested in what the collective brains trust thinks about ROS v7 in production. It appears that the availability of CCR's that support V6 is dwindling and that V7 is the future. The question is: What has your experience with V7 been like and what type of env are you running it in? And are you ready for 100% v7?

7 6