- Public - talk.mikrotik.com.au

LTE B28
by Jason Hecker (Up & Running Tech) 18 Jun '18

18 Jun '18

I just got the newsletter. Will any of the LTE units Duxtel are certifying support B28 (700MHz)? -- <https://www.upandrunningtech.com.au>

4 4

CAPsMAN & Channels
by Dave Browning 14 Jun '18

14 Jun '18

Hi All, Has anyone had luck with setting channels in a CAPsMAN config? Whenever I try to set channels, regardless of it be 2 or 5 ghz, all cAP's report "No supported channel" - The location in the configuration is set to Australia and from what I'm reading the frequencies and width's I'm trying to set are all within AU spec. For reference, this particular deployment is CCR CAPsMAN and 30 odd RBwAPG-5HacT2HnD cAP's all running the latest release channel Cheers, Dave Browning | Network Engineer P 1300 791 678 Level 1, 12 Railway Tce, Milton QLD 4064

2 1

DNS Resolution Case Response
by Dave Browning 11 May '18

11 May '18

Hi All, Anyone else see this from their Ripe’s when using a Mikrotik as DNS? -------------------- DNS Resolver Mangles Case What does this mean? RFC 1034, which defines DNS, states in Section 3.1 that the letter case of a query (i.e. whether the domain name is spelled in upper case, lower case or a mix of the two) should be preserved. In 2008, a technique to improve the security of DNS was proposed that makes use of this feature. In this technique, each letter in a DNS query is randomly set to upper or lower case. When the reply arrives, the letter case is checked to see whether it corresponds to the query. This prevents an attacker from blindly spoofing replies. This technique never became very popular, but did make it into the DNS stub resolver in the libevent library, which is used by the RIPE Atlas measurement code. Unfortunately, some DNS resolvers do not preserve the letter case of queries. Typically, it is the home router that is at fault. Common DNS resolver software, such as BIND and Unbound, cause no problems. A RIPE Atlas probe that is configured to use a resolver that does not preserve the letter case of the query causes measurements that rely on looking at the target of the measurement in DNS to fail. Measurements that target IPv4 or IPv6 literals are unaffected. How can I fix this? You could try to use a different DNS resolver (if you're in charge of the configuration), or use a different type of (home) router. -------------------- Can confirm the DNS implementation on Mikro doesn’t appear to adhere to section 3.1 of RFC 1034; Resolving against a Mikrotik dig sEnTrIaN.CoM.AU @192.168.1.1 +noall +answer ; <<>> DiG 9.10.6-P1 <<>> sEnTrIaN.CoM.AU @192.168.1.1 +noall +answer ;; global options: +cmd sentrian.com.au<http://sentrian.com.au>. 3600 IN A 52.64.78.207 Resolving against non Mikrotik dig sEnTrIaN.CoM.AU @1.1.1.1 +noall +answer ; <<>> DiG 9.10.6-P1 <<>> sEnTrIaN.CoM.AU @1.1.1.1 +noall +answer ;; global options: +cmd sEnTrIaN.CoM.AU. 3590 IN A 52.64.78.207 Doesn’t really cause issues, just interesting the implementation. Cheers, Dave Browning | Network Engineer P 1300 791 678 Level 1, 12 Railway Tce, Milton QLD 4064

1 0

[BYPASS} Potential external Winbox vulnerability
by Timothy Neilen 24 Apr '18

24 Apr '18

A colleague passed this one to me from the Mikrotik forums (https://forum.mikrotik.com/viewtopic.php?f=2&t=133438) Might be an idea to block access to 20, 80, 8291 externally unless from trusted sources if you don't already. TN Regards,Timothy Neilen - Systems Engineer | +61 7 3123 7929Answers IT | 6/192 Evans RoadPh +61 7 3123 7929 | www.answersit.com.au

10 11

BGP & Routing Tables
by Shane Clay 20 Apr '18

20 Apr '18

Hi All I’m curious as to how many people are using Mikrotik devices as border routers? We’re using three CCR1072’s at three different datacentres. The problem (as you can probably guess) is the BGP implementation. We’re taking partial routes from peers (IX’s, local networks we work with, our own downstream IaaS platforms, etc). Currently we’re taking around 250k routes in each routers. They are already struggling. Given we don’t take full tables and we have default routes at each site, convergence isn’t necessarily a huge problem (although it is slow). But, things like “routing bgp advertisements print where peer=”ABC”” being used as part of diagnostics are taking over a minute to run and becoming a problem. How many others are actually using these devices in these sorts of scenarios? I’m beginning to think that once you reach this point, these things need to tossed aside for the real hardware which can cope in the real world… Thoughts? Shane

3 2

Help required
by Ben Jackson - ELOGIK 19 Apr '18

19 Apr '18

Hi all, I'm looking for someone in the Sydney area who can help me with restructuring and rationalising a medium size corporate network. It will require excellent knowledge of site to site VPN's and tunnels, and excellent subnetting and IP addressing skills as well as good 802.11 skills Currently the client has a large multi-site network which has been built quite poorly with too flat a structure. Essentially the network has been built using small business / home networking knowledge and has grown beyond the confines of what is possible with this type of network hierarchy. Whilst I will be managing the project from an operational standpoint, I need someone who I can bounce technical ideas off and liaise with the client periodically to explain technical why's and how's to their IT department. If I can't find the right person locally, I may also consider paying the right candidate per hour / day for remote assistance with the option to travel when absolutely necessary. Please reply to me directly if you are interested or know someone who may be a good fit. Thanks, *BEN JACKSON* Director *M *0404 924745 *E* ben(a)elogik.com.au *W* elogik.com.au <http://www.elogik.com.au/> <http://www.elogik.com.au>

1 0

Supplier in Adelaide
by Peter Silver 11 Apr '18

11 Apr '18

Hi, Just wondering if anyone knows of any Mikrotik suppliers in Adelaide? Trying to get hands on something today, so can't order it in from the usual interstate suppliers. Thanks, Peter

2 2

4G service - backup WAN link
by Vaughan Wickham 11 Apr '18

11 Apr '18

Hi, I've been testing using a 4G service as a backup WAN link in the event that the Main link goes down. I'd chosen ZettaNet. Good pricing. Static IP address. The sites where I will be deploying this solution host servers (mail etc.) and also have IPsec VPN's with other sites; so the static IP address made failover more straightforward. Unfortunately the ZettaNet service has been unavailable a couple of times now over the past few months and they've not been able to provide an explanation so far for the most recent outage. So I'm starting to look around for possible alternative service providers. So far the other service providers I've contacted are only able to provide a dynamic IP address. At the very least this will make DNS updates and IPsec configuration more involved. Questions 1. Has anybody done this where you're hosting internal servers etc. What service provider are you using? Do they provide a static or dynamic IP address? 2. Any comments on using DDNS in A records on DNS and likewise for creating IPsec VPN's. Is it feasible? Thanks Regards, Vaughan

4 5

Mikrotik OpenVPN server Windows OpenVPN Server failure OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
by QCS Group - Infrastructure 31 Mar '18

31 Mar '18

Hi All, I have spent a couple of hours on trying to setup an OpenVPN server on my Mirktoik CCR1036 (Hoping to replicate this for end users) I have tried multiple different guides and each time I come back to the same error message. I will forward my config for the OpenVPN server as well as my Windows client config. OpenVPN Setup on Mikrotik: /certificate add name=CA-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="CA" key-size=4096 days-valid=3650 key-usage=crl-sign,key-cert-sign /certificate sign CA-tpl ca-crl-host=127.0.0.1 name="CA" /certificate add name=SERVER-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="core.router.dc.domainname.com.au" key-size=4096 days-valid=1095 key-usage=digital-signature,key-encipherment,tls-server /certificate sign SERVER-tpl ca="CA" name="SERVER" /certificate add name=CLIENT-tpl country="AU" state="QLD" locality="Brisbane" organization="QCSGroup" unit="QCSGroup" common-name="CLIENT" key-size=4096 days-valid=3650 key-usage=tls-client /certificate add name=CLIENT1 copy-from="CLIENT-tpl" common-name="CLIENT1" /certificate sign CLIENT1 ca="CA" name="CLIENT1" /certificate export-certificate CA export-passphrase="" /certificate export-certificate CLIENT1 export-passphrase="123456789" /ip firewall filter add chain=input comment="Allow OpenVPN" dst-port=1194 protocol=tcp add chain=input comment="Allow OpenVPN" dst-port=1194 protocol=udp /ppp secret add name=OpenVPNTest password=OpenVPNTest profile=OpenVPN-profile service=ovpn /ppp profile add change-tcp-mss=yes local-address=172.16.99.254 name=OpenVPN-profile remote-address=OpenVPN-pool use-encryption=yes /ip pool add name=OpenVPN-pool ranges=172.16.99.10-172.16.99.100 /interface ovpn-server server set auth=sha1 certificate=SERVER cipher=aes256 default-profile=OpenVPN-profile enabled=yes require-client-certificate=yes Windows OpenVPN Client: C:\Program Files\OpenVPN\config Directory contains: (I renamed the exported certs/key) ca.crt client1.crt client1.key client1.ovpn secret client1.ovpn file contains: client dev tun proto tcp-client remote core.router.dc.domainname.com.au port 1194 nobind persist-key persist-tun tls-client remote-cert-tls server ca ca.crt cert client1.crt key client1.key verb 4 mute 10 cipher AES-256-CBC auth SHA1 auth-user-pass secret auth-nocache ;redirect-gateway def1 Windows OpenVPN Log: It looks like everything connects, I can see a TCP connection in the Router logs. THis is the client logs. (I have replaced router.ip with our IP address) Wed Mar 28 16:40:08 2018 us=663815 Local Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client' Wed Mar 28 16:40:08 2018 us=663815 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server' Wed Mar 28 16:40:08 2018 us=663815 Local Options hash (VER=V4): '5cb3f8dc' Wed Mar 28 16:40:08 2018 us=663815 Expected Remote Options hash (VER=V4): '898ae6c6' Wed Mar 28 16:40:08 2018 us=663815 Attempting to establish TCP connection with [AF_INET]router.ip:1194 [nonblock] Wed Mar 28 16:40:08 2018 us=663815 MANAGEMENT: >STATE:1522219208,TCP_CONNECT,,, Wed Mar 28 16:40:09 2018 us=664908 TCP connection established with [AF_INET]routerip:1194 Wed Mar 28 16:40:09 2018 us=664908 TCPv4_CLIENT link local: [undef] Wed Mar 28 16:40:09 2018 us=664908 TCPv4_CLIENT link remote: [AF_INET]router.ip:1194 Wed Mar 28 16:40:09 2018 us=665909 MANAGEMENT: >STATE:1522219209,WAIT,,, Wed Mar 28 16:40:09 2018 us=666913 MANAGEMENT: >STATE:1522219209,AUTH,,, Wed Mar 28 16:40:09 2018 us=666913 TLS: Initial packet from [AF_INET]router.ip:1194, sid=d2631263 4753bbdb Wed Mar 28 16:40:09 2018 us=759771 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Wed Mar 28 16:40:09 2018 us=759771 TLS_ERROR: BIO read tls_read_plaintext error Wed Mar 28 16:40:09 2018 us=759771 TLS Error: TLS object -> incoming plaintext read error Wed Mar 28 16:40:09 2018 us=760772 TLS Error: TLS handshake failed Wed Mar 28 16:40:09 2018 us=760772 Fatal TLS error (check_tls_errors_co), restarting Wed Mar 28 16:40:09 2018 us=760772 TCP/UDP: Closing socket Wed Mar 28 16:40:09 2018 us=760772 SIGUSR1[soft,tls-error] received, process restarting Wed Mar 28 16:40:09 2018 us=760772 MANAGEMENT: >STATE:1522219209,RECONNECTING,tls-error,, Wed Mar 28 16:40:09 2018 us=760772 Restart pause, 5 second(s) If someone could please point out where my issue is I would be most grateful. I have already spent way too much time on this. Kind Regards, Russell Keavy.

4 11

Re: [MT-AU Public] Huawei E8372
by Andrew Gilbett 29 Mar '18

29 Mar '18

Hi Vaughan, I dont have a setup that I can send a config for handy. But i think i was using 1500. The modem was directly connected to the router. The apn and all 4G services and nat are controlled in the stick nkt the mikrotik as they are a router and basically present an ethernet connection over the usb port. Andrew On Thu, 29 Mar. 2018, 08:44 Vaughan Wickham, <vw(a)zeb.com.au> wrote: > Hello Andrew, > > > > Can you advise what MTU you’re using? > > > > I am using, the default 1500. > > > > Also can I confirm that > > > > 1. You’re not using a powered USB hub, you have your E8372 > connected to your Mikrotik directly? > > 2. Have you been able to set the APN for your 4G ISP within the > Mikrotik? > > > > Thanks > > > > Vaughan > > > > *From:* Andrew Gilbett [mailto:andrew@gilbett.net] > *Sent:* Thursday, 29 March 2018 08:27 > *To:* vw(a)zeb.com.au; MikroTik Australia Public List > *Subject:* Re: [MT-AU Public] Huawei E8372 > > > > That sounds like a mtu or mss issue. > > > > I have used these devices very successfully with mikrotik. Including on a > 10m usb extension cable with built in amplifier. > > On Thu, 29 Mar. 2018, 08:19 Vaughan Wickham, <vw(a)zeb.com.au> wrote: > > Hello, > > > > I've been testing an E8372 USB 4G dongle with an RB951Ui-2HnD router > > > > According to https://wiki.mikrotik.com/wiki/Manual:Peripherals the E8372 > works > > > > My experience has been that it "works" to some degree. > > > > Connecting to some Web sites (e.g. www.smh.com.au ) works consistently, > yet > connecting to other Web sites (e.g. any speedtest site does not work at > all). > > > > In contrast, when the dongle is connected to a USB3 port on a Windows PC, > the performance of the dongle is perfect. Also accessing the Web portal of > the dongle seems quicker when the dongle is attached to the Windows > computer > versus the Mikrotik. > > > > I'm pursuing a couple of avenues regarding troubleshooting > > > > - The Mikrotik has a standard USB2 port and this may not be > supplying the required power for the dongle > > o I have ordered a USB2 hub with an external power adapter which will > supply the power requirements of the E8372 (5V and 750mA). So will test > this > soon. > > - I've not been able to configure the APN for the 4G service > provider in the LTE properties. There is no error, but the APN is not > saved. > I am able to save the APN in the 4G dongle's own firmware/web portal, but > I'm not sure whether this is used when the traffic is traversing the LTE > link of the Mikrotik > > > > > > So the questions that I have are: > > > > 1. Is anyone else using an E8372 with a Mikrotik? > > a. If so, what is your config? > > b. Are you using a powered hub > > c. Did you need to save the APN in the LTE properties? > > > > 2. Is anyone using some other 4G USB hub with a Mikrotik? > > > > Thank you > > > > Regards, > > Vaughan > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > >

4 3