- Public - talk.mikrotik.com.au

Speed and Duplex on Mikrotiks
by Paul Julian 12 Jul '16

12 Jul '16

Hi All, is there an actual way of making mikroik routerboards work when on a fixed duplex and speed setting ?, like one that actually works ? I am so tired of trying to get them to lock onto a speed and duplex only to have them get a mind of their own after a reboot or anytime in the future at all and then stop talking to each other. Even when talking to each other they seem to hold no regard for any hard set parameters and just randomly go to 10M half duplex or something stupid for no reason. When we operate 5 or 6 pieces of gear at a site we need to have some confidence that they will actually be able to communicate with each other, hard setting network speed and duplex is good practice and should really be done on all networking equipment when you are in control of both ends of a line IMHO, but damn Mikrotik's have a mind of their own in this area and I am really sick of fighting with them. Any advice would be appreciated before I lose all remaining hair ! Regards Paul

4 8

quetion re dual VPNs
by Karl Auer 04 Jul '16

04 Jul '16

I'm still playing with AWS Hardware VPN :-) An AWS Hardware VPN is actually two VPNs; their idea seems to be that if one fails the other will still be there. The two VPNs terminate at different endpoints at the AWS end, but at the same endpoint on the MikroTik. Apparently in order to support route-based VPNs, AWS also provides "inside addresses", a pair for each VPN. The actual traffic to AWS has to be routed via the inside address at the AWS end. MikroTik has a bug in that it will not allow two IPsec policies that cover the same traffic. If you set up two VPNs and want to send the same traffic over both - which is what AWS expects you to do - one of the policies will be flagged "invalid". My workaround is to set up one policy for (say) 192.168.100.0/24 for one VPN, then two others for the other VPN, with each covering half the desired range: VPN1: 192.168.100.0/24 VPN2: 192.168.100.0/25 192.168.100.128/25 In order to send traffic to the right place, I also have two routes, one sending 192.168.100/24 via one inside address, the other sending the same traffic via the other inside address. This is all working fine (though I suppose I can't use 192.168.100.127 or 192.168.100.128). If I manually disable either VPN, traffic keeps going on the other - eventually, though it can take a few tens of seconds to reestablish while dead peer detection does its thing. Now to my questions at last :-) I can't test a VPN failure, because I can't drop either VPN at the ASW end. If one of the two VPNs did fail, what would happen? Will the MikroTik figure it out and not try to send packets up the dead one? Do I need to run netwatch and fiddle with the route metrics? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

4 11

RBSXT-LTE
by Karl Auer 02 Jul '16

02 Jul '16

"The SXT LTE supports the popular LTE FDD bands 3 (1800MHz) and 7 (2600MHz), has a miniSIM slot and is not backwards compatible with older networks." Which older networks would those be? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

2 1

Route marking
by Paul Julian 28 Jun '16

28 Jun '16

Hi guys, just wanting to confirm something here due to some strange behaviour which might be admin induced J When using mangle rules to put a routing mark onto packets, does one approach this the same as typical packet marking by marking the connection and then the packets based on the connection mark ? I setup a routing mark rule in this fashion but it did weird things, as soon as I just identified the packets directly based on a dest address instead of a connection rule first, and then set the route mark it worked fine. Thanks Paul

4 7

virtual interfaces in ROS?
by Karl Auer 27 Jun '16

27 Jun '16

I'm currently doing battle with an AWS VPN (and many thanks to those people here who have helped me; I can't name names, but they know who they are). I've got it working, but there are a couple of things I don' t understand. One thing that the AWS doco mentions is "tunnel interfaces" and it is clear from the various sample configurations for other platforms that the common way to do this is to set up a virtual interface at the ends of the tunnel. ASCII art coming up: REALIP REALIP ----------------------- VIP -------------------------------- VIP ----------------------- The tunnel proper is between the two real IPs; these are globally routable IP addresses. In my test setup, they are my routers outside address 1.2.3.4, and an Amazon address 2.3.4.5. Amazon also provides the two VIPs - which it calls "inside addresses" and suggests should be placed on "tunnel interfaces". I've just stuck them on the same interfaces as the real IPs, and it works fine. But is there some way to set up a virtual interface that would work the way Amazon seems to intend? It would be nicer not to have the outside interface festooned with private addresses. By analogy, look at a GRE interface. That's a virtual interface that forms a network with the other end of the GRE tunnel. Traffic can be routed across a GRE tunnel. I tried creating a bridge interface, but could see no way to associate it with the IPsec tunnel. EoIP, IPIP and GRE are about the only tunnel interface types I can think of of the top of my head, but they all require cooperation at the other end. AWS is fully automated - what you get is what you get. Am I not understanding IPsec, or not understanding RouterOS? Any ideas most welcome. Or pointers to good explanations :-) Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

3 7

Wifi blackspot coverage improvement
by Ben Williams 24 Jun '16

24 Jun '16

Hey, I've got an RB951G-2HnD doing routing & wifi for my network. It's doing a great job. I'm in a very old house with double-brick internal walls everywhere, and I've got a black spot out the back I want to get better coverage for. What's the best option if I want to stick with Mikrotik gear? (Which of course I do :) ) - Ben

3 2

Re: [MT-AU Public] Industrial data (Jeremy Hall)
by Jeremy Hall 10 Jun '16

10 Jun '16

Hi Steve It's definitely possible to use a routerboard with a RS-232 port as a 'device serial server' - I have done so many times, usually to interface to an energy meter, inverter or other RS232 device. It's really easy to configure on the board. Something like: /port remote-access add allowed-addresses=0.0.0.0/0 log-file=serial port=serial0 protocol=raw tcp-port=10000 You can then use an application like VSPE ( http://www.eterlogic.com/Products.VSPE.html) to build a virtual serial port tunnel, which will create a fake local COM port. You'd just point your application at that local COM port. A box that does this off the shelf is called a 'serial device server'. The difference is that you are typically are given a proprietary application (varying in quality..) that creates the dummy COM port, and it will have additional settings to optimise for latency or throughput, additional serial options etc. A big advantage here is that these devices will support RS485 which may be better than using adapters. An entry level model is the O-Ring IDS-5012 at about AUD $120: http://www.oring-networking.com/product/cate.list/sn/102/Industrial%20Devic… If you can spring for more, Moxa and Perle are two other brands, though you'll likely pay at least double that. Note that when using a serial device server, we don't need to know or care about the protocol that is being used over serial - it just creates a 'serial tunnel'. However, for something that is specifically talking Modbus, as your device is is, then a better solution could be a device that converts from Modbus RTU/ASCII (over RS232 or RS285 serial) to Modbus TCP (over IP/ethernet). These devices are typically called 'gateways' and they understand well Modbus enough to pass requests on to slave devices. Using a gateway, it is possible for your application to make Modbus requests (over Modbus TCP_ to a device that is talking Modbus RTU or ACII (over serial). This can be very advantageous as the Modbus TCP packets can be sent over any IP network, sent over NAT, etc. One example of this is the O-Ring IDS-M311 on that same page above. One 'gotcha' with both the scenarios above is that if there is any problem in your network, and a modbus request or reply does not get through, it is lost. Modbus does not have any native provision for timestamping or sending multiple values - you ask for a register (offset address) and you get a value in reply. Depending on your application, intermittency like this may or may not be a problem. If it is, you might consider placing your datalogger or Modbus client closer to the device. There are thousands of dataloggers that have both Ethernet and RS485 connectivity and would be a drop-in solution, though such 'industrial' devices tend to get really expensive really quickly. One product that I can really recommend for this is Mango Automation, distributed by Infinite Automation. The free version of the software is limited to 25 Modbus TCP data points and I have run it comfortably on a Raspberry Pi. The commercial license is around US$400 but for not much more you can get an actual appliance which has the fully licensed software on it plus a RS-485 port. If you want to use the free version on a Raspberry Pi then any generic USB RS-485 adapter should work. There is a slight learning curve to the software but once set up it is incredibly robust and reliable. The Modbus library used (Modbus4J) is very clever and makes it very straightforward. Out of the box, you can monitor points, save them to a database, and generate charts. You can create alarm conditions and when triggered, you can fire off emails, set values of other points, or use scripting for powerful logic. You can configure also have reports sent via email that include charts and CSVs. There's even a RESTful API now that lets you retrieve data. Feel free to contact me off-list if you'd like any further detail. I worked with the software professionally for a few years and am quite familiar with it, and very much a fan of it! Cheers Jeremy On Wed, Jun 8, 2016 at 7:00 PM, <public-request(a)talk.mikrotik.com.au> wrote: > Send Public mailing list submissions to > public(a)talk.mikrotik.com.au > > To subscribe or unsubscribe via the World Wide Web, visit > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > or, via email, send a message with subject or body 'help' to > public-request(a)talk.mikrotik.com.au > > You can reach the person managing the list at > public-owner(a)talk.mikrotik.com.au > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Public digest..." > > Today's Topics: > > 1. Re: Industrial data (Jason Hecker (Up & Running Tech)) > 2. Re: Industrial data (Russell Hurren) > 3. Re: Industrial data (Mike O'Connor) > 4. Re: Industrial data (Jason Hecker (Up & Running Tech)) > > > ---------- Forwarded message ---------- > From: "Jason Hecker (Up & Running Tech)" <jason(a)upandrunningtech.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 12:00:35 +1000 > Subject: Re: [MT-AU Public] Industrial data > I think if you can convert the RS485 to RS232 you can hook into a serial > port on one of the Routerboards that support serial. Then in the Mikrotik > settings you can hook this serial port up to a TCP port and connect to it > over telnet/WindowsVirtualCOMport/socat/netcat. > > So: > * Choose a Routerboard that supports Wifi and serial > * Set up the Other End to capture the data from the serial port over TCP/IP > using one of the above methods. > > Can you have your MOBUS application at the Other End hook up to a virtual > COM port in Windows? How do you want to capture or store the data? > > On 8 June 2016 at 11:48, Steve Hille <stevehille84(a)gmail.com> wrote: > > > Greetings all, > > > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > > other type industrial electrical equipment using Mikrotik gear, or if it > is > > even possible? > > > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or > > something similar as a 'station' and then shoot the data off to my access > > point, we will be able to collect data from this industrial equipment, > just > > hoping for some gotchas before I really get into it. > > > > Cheers, > > > > Steve > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > -- > > > > ---------- Forwarded message ---------- > From: Russell Hurren <russell(a)zeropointnetworks.com> > To: "'MikroTik Australia Public List'" <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 10:02:15 +0800 > Subject: Re: [MT-AU Public] Industrial data > Hi Steve > > I've never done it, but I presume you'd use something like this: > > > http://www.emtec.com.au/serial-and-usb/serial-to-ethernet-servers/single-po… > > Then it's just a case of plugging it into the network (whether that's into > a Groove or something else), installing the RealPort software on a computer > and then collect data as though that computer was connected directly. > > Regards > > Russell > > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Steve Hille > Sent: Wednesday, 8 June 2016 09:49 > To: public(a)talk.mikrotik.com.au > Subject: [MT-AU Public] Industrial data > > Greetings all, > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > other type industrial electrical equipment using Mikrotik gear, or if it is > even possible? > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or something similar as a 'station' and then shoot the data off to my > access point, we will be able to collect data from this industrial > equipment, just hoping for some gotchas before I really get into it. > > Cheers, > > Steve > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > ---------- Forwarded message ---------- > From: "Mike O'Connor" <mike(a)oeg.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 11:38:05 +0930 > Subject: Re: [MT-AU Public] Industrial data > On 8/06/2016 11:18 AM, Steve Hille wrote: > >> Greetings all, >> >> I'm wondering if anyone has or is collecting data from MODBUS / RS485 or >> other type industrial electrical equipment using Mikrotik gear, or if it >> is >> even possible? >> >> I'm thinking perhaps if I can somehow interface the MODBUS into a Groove >> or >> something similar as a 'station' and then shoot the data off to my access >> point, we will be able to collect data from this industrial equipment, >> just >> hoping for some gotchas before I really get into it. >> >> Cheers, >> >> Steve >> _______________________________________________ >> Public mailing list >> Public(a)talk.mikrotik.com.au >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au >> > > Hi Steve > > I have no idea about Mikrotik gear but I've done this sort of things for > years using a number of different boards running Linux. Nowdays RPI is a > good option. > > I've written tools which will run as a mobus master or slave, talking TCP > or RTU. Some of the code for this is on github at > https://github.com/latproc/clockwork > > > > > > > ---------- Forwarded message ---------- > From: "Jason Hecker (Up & Running Tech)" <jason(a)upandrunningtech.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 12:08:37 +1000 > Subject: Re: [MT-AU Public] Industrial data > I'll add have a look at the Port feature in the Mikrotik. > > http://wiki.mikrotik.com/wiki/Manual:Port > > > > On 8 June 2016 at 11:48, Steve Hille <stevehille84(a)gmail.com> wrote: > > > Greetings all, > > > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > > other type industrial electrical equipment using Mikrotik gear, or if it > is > > even possible? > > > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or > > something similar as a 'station' and then shoot the data off to my access > > point, we will be able to collect data from this industrial equipment, > just > > hoping for some gotchas before I really get into it. > > > > Cheers, > > > > Steve > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > -- > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > >

1 0

Industrial data
by Steve Hille 08 Jun '16

08 Jun '16

Greetings all, I'm wondering if anyone has or is collecting data from MODBUS / RS485 or other type industrial electrical equipment using Mikrotik gear, or if it is even possible? I'm thinking perhaps if I can somehow interface the MODBUS into a Groove or something similar as a 'station' and then shoot the data off to my access point, we will be able to collect data from this industrial equipment, just hoping for some gotchas before I really get into it. Cheers, Steve

4 4

Port Mirroring on a Virtual MT
by Dave Browning 01 Jun '16

01 Jun '16

Hi Guys, How does one do port mirroring on a virtual mikro? Looked at http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Port_Mirroring but the '/interface ethernet switch' command isn’t available. Dave Browning | Network Engineer P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

2 1

Need help with IPSec (and AWS VPN)
by Karl Auer 01 Jun '16

01 Jun '16

I am trying to get an AWS VPN going to a MikroTik. I have gotten *so close* - AWS says the tunnel is UP, I see valid SAs at my end, I can even ping across the link - but only from the router. Not from within my network. I feel it just has to be some simple NAT or firewall thing, but I've run out of ideas. If anyone out there would be prepared to help, I'd be most grateful. Call me any time on 0-65947435, or email me and I'll call you... Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

3 2