- Public - talk.mikrotik.com.au

empty connection-state value in filter rule?
by Karl Auer 08 May '20

08 May '20

In a filter list, I have several rules that have connection-state="" in them. For example: chain=ssh action=accept connection-state="" \ protocol=tcp dst-port=22 \ log-prefix="" What do people think would be the behaviour? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: CF68 0C56 EEE4 CC19 28D4 03B3 BCE0 E800 E31F 7254 Old fingerprint: 887A DA07 4DCC EE76 B413 27D4 C638 4189 6CF0 D556

2 5

Router Filtering TCP RST Packets
by Mike O'Connor 19 Apr '20

19 Apr '20

Hi All I've been asked to look at a problem with a web filtering system for a business. Ever since they upgraded from a 6.5.x version to a current long term release of RouterOS the filtering (RST Packets) traffic generated by the filter system has been lost/blocked by the router. I have pcap files generated by the router showing the RST packets being generated and sent to the client and server of a tcp connection but captures of the inbound and outbound traffic path do not show these RST packets. rp-filter is turned off, ip connection traffic how been tried on and off. I found someone else asking this question https://forum.mikrotik.com/viewtopic.php?t=149084 the single reply was from someone who did not understand the problem. Does anyone have any ideas ? Thanks Mike

4 6

routing to remote subnets over IPSEC hops
by Chris Herrmann 23 Mar '20

23 Mar '20

Hi guys, I'm trying to work out how to get traffic from my local LAN to secondary remote IPSEC networks. For example: home <----> work <--> remotesite (where each of the links is an IPSEC tunnel). If I use Forticlient I can do this fine by: - define phase2 dst & src subnets as 0.0.0.0/0.0.0.0 - existing routes from work --> remotesite still function as expected - make sure local client routes 192.168.0.0/16 over IPSEC gateway address - setup policy on fortigate as follows: incoming interface: Forticlient interface outgoing interface: remoteVPN interface incoming subnet: Forticlient Range outgoing subnet: remote range ports etc: as required I can add a specific P2 route by using /ip ipsec policy and this is working OK - but only for the specific subnet that I define in the policy. What I want to do is create a generic policy that only routes traffic via the IPSEC tunnel when it needs to - and not - when it doesn't need to. But... the issue here is I can't define a route - because there's no virtual interface associated with the IPSEC tunnel (whereas on Fortigate you do get a virtual interface that can be referenced in policies / routes etc). And you can't use a standard route, because the gateway in this case is remote (i.e. it's the router at work). If I try to setup a 0/0 P2 it breaks the VPN completely. Any tips for how I might go about making a more generic / scalable approach here?

3 2

Mikrotik RB260GS CSS106-5G-1S Firmware Upgrade Process
by Chris Lee 03 Mar '20

03 Mar '20

Hi all, So this has been bugging me for quite some time, the firmware upgrade process on the RB260GS / CSS106-5G-1S is terribly unclear. I had multiples of these units that I wanted to upgrade to the latest firmware out of the box, and have spent a bit of time narrowing the procedure that worked. I think one of the biggest things that probably sent me around the twist was that if you don't close the web browser session and just refresh the existing page it still shows old firmware version, so to be sure I started using incognito mode along with closing the web browser between reboots to validate the upgrade had taken. Unfortunately there seems to be absolutely no way to upgrade these units remotely in the field, as they require physical power cycling and holding the RES button to boot to a primary firmware. Posting this here in case it helps anyone else out in a similar situation, and anyone who has found a better process feel free to add to this thread... Mikrotik RB260GS CSS106-5G-1S Firmware Upgrade Process (from new in box) ========================================================================= 1. Unbox 2. Press and hold RES button while applying power 3. Wait for ACT light to stop blinking and stay on solid GREEN then release hold of the RES button. 4. Connect programming laptop to Ethernet Port 1 and open a command prompt with "ping -t 192.168.88.1" to keep an eye on switch CPU online 5. Login to web interface at 192.168.88.1 using Chrome/Edge Chromium incognito mode 6. Browse to Upgrade Tab - Current installed version should show 2.7p to indicate its booted the primary firmware. If it shows 2.7 then remove power and start again at step 2. 7. Under Manual Upgrade section click Choose File button and locate the swos-css106-2.11.bin file to upload 8. Click Upgrade button in bottom right corner 9. Red message "Upgrading... (Please do not interrupt)" will show next to upgrade button. Wait for this message to clear. 10. Close incognito web browser. 11. Remove Power from Switch, wait 10 seconds 12. Apply power to switch, wait for ping to respond and then open a new incognito window to 192.168.88.1 and check Upgrade tab shows current installed version now 2.11 NOTES: Have also tested this process upgrading through SFP fibre module (FS.com 1000BASE-LX SFP) from laptop on a remote switch with fibre uplink in same Layer2 segment and worked fine.

1 0

Re: [MT-AU Public] upgrade from RB2011UiAS to something faster - RB450Gx4 ?
by Chris Herrmann 23 Feb '20

23 Feb '20

Sounds like the RB3011 will fit the bill... I don't quite need to push 1.8Gbps per stream :) The RB3011/4011 are both more $$ than the RB450Gx4 or 750Gr3. If the extra $ are necessary to meet what i want then that's fine, but if the smaller unit will do it - then that would be better as it's smaller... presumably lower power and cheaper. @Russell I think the VLAN on switch chip might be the thing that tripped me up with one of the other units I played with, in which case the 3011 would be a better option? Cheers, Chris

3 3

CHR VPS with megaport
by Mike Everest 23 Feb '20

23 Feb '20

Anyone have a favourite VPS provider for CHR with Megaport connectivity? We currently use Zettagrid for various systems and services, but looking for alternatives to add/expand/enhance existing solutions :) All comments and suggestions are welcome! Cheers, Mike.

3 2

Unable to connect to Telstra BigPond AP?!?
by Karl Auer 10 Jan '20

10 Jan '20

I've temporarily relocated because of the fires and am currently ensconced at a relative's home armed with enough compute power to run a small country. My MikroTik routers do not want to talk to the local Telstra BigPond ADSL router, specifically a Thomson TG782T. There's one for sale on GumTree if you want to see pictures: https://www.gumtree.com.au/s-ad/castle-hill/modems-routers/bigpond-adsl -modem/1207553894 I've changed the wlan1 interface to mode=station and the ssid="TheCorrectSSID". I've changed the default security profile to set mode=dynamic-keys authentication-types=wpa-psk,wpa2-psk wpa-pre-shared-key="ThePSK" wpa2- pre-shared-key="ThePSK" If I change only the SSID and PSKs in the above settings, the MikroTik connects to my phone's hotspot immediately. My phone and several other devices can connect to the Testra router. Is there some trick I'm missing here? This isn't routing or anything like that, it's more fundamental - the wlan1 in station mode never gets to "Running" state. I've tried a hAP Lite and a 951G-2HnD. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 887A DA07 4DCC EE76 B413 27D4 C638 4189 6CF0 D556 Old fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D

2 4

SSL and MT hotspot?
by Karl Auer 09 Jan '20

09 Jan '20

I've just had my first look at the MT hotspot, and while it's pretty clunky, it's reasonably effective. With one HUGE exception: No SSL! Not even a default self-signed one. There seem to be a few scripts around that will do LetsEncrypt certs, but they all require that the certbot runs on a separate system, so they are of limited usefulness. Did I miss something? Does anyone know of an on-board SSL mechanism (LetsEncrypt or anything else) for MikroTik? Without SSL, a MikroTik hotspot is a complete non-starter. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 887A DA07 4DCC EE76 B413 27D4 C638 4189 6CF0 D556 Old fingerprint: 8454 EE43 6215 B6DD 1B4D 9D8D 984D 7BA1 7378 A38D

2 1

Re: [MT-AU Public] Public Digest, Vol 70, Issue 2
by kevin＠scottsip.com.au 11 Dec '19

11 Dec '19

I have predominantly been installing the Netgear DM200 -100AUS modems, updating the firmware and placing them in Bridge mode so that a Mikrotik device can do the Authentication / ip addressing. https://www.netgear.com.au/home/products/networking/modem-routers/DM200.aspx It works well, just make sure that you set the modem to "other" as the provider and let it synchronise correctly. That means pull the configuration of the connection down to the modem or you will have issues. V 1.0.0.61 is the firmware that I have been using with TPG/iiNet/AAPT NBN installations <-- needs to be this firmware or higher else you will have internet connection issues. FTTC / FTTB (close to the node connections) Bandwidth synchronises at the modem around 107 Mb for 100 Mb NBN connections - close to 97 Mb using speedtest.net / google speed test. Regards, Kevin -----Original Message----- From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of public-request(a)talk.mikrotik.com.au Sent: Wednesday, 11 December 2019 12:00 PM To: public(a)talk.mikrotik.com.au Subject: Public Digest, Vol 70, Issue 2 Send Public mailing list submissions to public(a)talk.mikrotik.com.au To subscribe or unsubscribe via the World Wide Web, visit http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au or, via email, send a message with subject or body 'help' to public-request(a)talk.mikrotik.com.au You can reach the person managing the list at public-owner(a)talk.mikrotik.com.au When replying, please edit your Subject line so it is more specific than "Re: Contents of Public digest..." Today's Topics: 1. Re: RB760iGS with PS180-T VDSL SFP (Jason Hecker) ---------------------------------------------------------------------- Message: 1 Date: Tue, 10 Dec 2019 18:03:07 +1100 From: "Jason Hecker" <jason(a)upandrunningtech.com.au> To: public(a)talk.mikrotik.com.au Subject: Re: [MT-AU Public] RB760iGS with PS180-T VDSL SFP Message-ID: <520c5bdf-1079-497f-b9d0-8216c3d785f5(a)www.fastmail.com> Content-Type: text/plain Another basic (and small) VDSL2 modem you can put in bridge mode is the Netgear DM200. They retail for around $80. Regards, Jason Hecker <https://www.upandrunningtech.com.au/> <https://www.upandrunningtech.com.au/> On Fri, 29 Nov 2019, at 16:51, Russell Hurren wrote: > I've also tried one. It works fine on my home connection at 25/5 but it's slower at my office on 100/40. It does get a bit hot, but I've still found it to be stable. > I've worked with Duxtel and Proscend to analyse the data I collected, but there wasn't anything more we could do to improve the connection speed, so I'll keep using Draytek Vigor 130s for now. > > The DV130 was reaching speeds in excess of 100Mbps downstream, while the VDSL module was only reaching 90Mbps. I can't prove that the DV130 isn't misreporting it's speed, and I haven't had a chance to do an accurate speed test (my ISP only just set up their own speed test site recently). > > Only thing I had to do to make it work was to disable auto-negotiation. If you want the tool to measure the speed, Duxtel can send it to you. > > Regards > > > Russell Hurren > > > -----Original Message----- > From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Darryl > Ross > Sent: Friday, 29 November 2019 11:16 > To: public(a)talk.mikrotik.com.au > Subject: [MT-AU Public] RB760iGS with PS180-T VDSL SFP > > Hey All, > > I have a client that has 8 sites, all of them are going to be ethernet handoff (FTTC or HFC) except for one site that is going to be FTTB (VDSL). I'm planning on dropping RB760iGS into each store. > > I see on the duxtel site that the VSDL SFP module has passed compliance testing in September, does that mean it's now been approved for use on the NBN or just that its compliant with the specs? Anyone had issues running one in the desktop MTs? > > -Darryl > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > au > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com. > au > ------------------------------ Subject: Digest Footer _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au ------------------------------ End of Public Digest, Vol 70, Issue 2 *************************************

2 1

RB760iGS with PS180-T VDSL SFP
by Darryl Ross 10 Dec '19

10 Dec '19

Hey All, I have a client that has 8 sites, all of them are going to be ethernet handoff (FTTC or HFC) except for one site that is going to be FTTB (VDSL). I'm planning on dropping RB760iGS into each store. I see on the duxtel site that the VSDL SFP module has passed compliance testing in September, does that mean it's now been approved for use on the NBN or just that its compliant with the specs? Anyone had issues running one in the desktop MTs? -Darryl

4 3