- Public - talk.mikrotik.com.au

Route marking
by Paul Julian 28 Jun '16

28 Jun '16

Hi guys, just wanting to confirm something here due to some strange behaviour which might be admin induced J When using mangle rules to put a routing mark onto packets, does one approach this the same as typical packet marking by marking the connection and then the packets based on the connection mark ? I setup a routing mark rule in this fashion but it did weird things, as soon as I just identified the packets directly based on a dest address instead of a connection rule first, and then set the route mark it worked fine. Thanks Paul

4 7

virtual interfaces in ROS?
by Karl Auer 26 Jun '16

26 Jun '16

I'm currently doing battle with an AWS VPN (and many thanks to those people here who have helped me; I can't name names, but they know who they are). I've got it working, but there are a couple of things I don' t understand. One thing that the AWS doco mentions is "tunnel interfaces" and it is clear from the various sample configurations for other platforms that the common way to do this is to set up a virtual interface at the ends of the tunnel. ASCII art coming up: REALIP REALIP ----------------------- VIP -------------------------------- VIP ----------------------- The tunnel proper is between the two real IPs; these are globally routable IP addresses. In my test setup, they are my routers outside address 1.2.3.4, and an Amazon address 2.3.4.5. Amazon also provides the two VIPs - which it calls "inside addresses" and suggests should be placed on "tunnel interfaces". I've just stuck them on the same interfaces as the real IPs, and it works fine. But is there some way to set up a virtual interface that would work the way Amazon seems to intend? It would be nicer not to have the outside interface festooned with private addresses. By analogy, look at a GRE interface. That's a virtual interface that forms a network with the other end of the GRE tunnel. Traffic can be routed across a GRE tunnel. I tried creating a bridge interface, but could see no way to associate it with the IPsec tunnel. EoIP, IPIP and GRE are about the only tunnel interface types I can think of of the top of my head, but they all require cooperation at the other end. AWS is fully automated - what you get is what you get. Am I not understanding IPsec, or not understanding RouterOS? Any ideas most welcome. Or pointers to good explanations :-) Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

3 7

Wifi blackspot coverage improvement
by Ben Williams 24 Jun '16

24 Jun '16

Hey, I've got an RB951G-2HnD doing routing & wifi for my network. It's doing a great job. I'm in a very old house with double-brick internal walls everywhere, and I've got a black spot out the back I want to get better coverage for. What's the best option if I want to stick with Mikrotik gear? (Which of course I do :) ) - Ben

3 2

Re: [MT-AU Public] Industrial data (Jeremy Hall)
by Jeremy Hall 09 Jun '16

09 Jun '16

Hi Steve It's definitely possible to use a routerboard with a RS-232 port as a 'device serial server' - I have done so many times, usually to interface to an energy meter, inverter or other RS232 device. It's really easy to configure on the board. Something like: /port remote-access add allowed-addresses=0.0.0.0/0 log-file=serial port=serial0 protocol=raw tcp-port=10000 You can then use an application like VSPE ( http://www.eterlogic.com/Products.VSPE.html) to build a virtual serial port tunnel, which will create a fake local COM port. You'd just point your application at that local COM port. A box that does this off the shelf is called a 'serial device server'. The difference is that you are typically are given a proprietary application (varying in quality..) that creates the dummy COM port, and it will have additional settings to optimise for latency or throughput, additional serial options etc. A big advantage here is that these devices will support RS485 which may be better than using adapters. An entry level model is the O-Ring IDS-5012 at about AUD $120: http://www.oring-networking.com/product/cate.list/sn/102/Industrial%20Devic… If you can spring for more, Moxa and Perle are two other brands, though you'll likely pay at least double that. Note that when using a serial device server, we don't need to know or care about the protocol that is being used over serial - it just creates a 'serial tunnel'. However, for something that is specifically talking Modbus, as your device is is, then a better solution could be a device that converts from Modbus RTU/ASCII (over RS232 or RS285 serial) to Modbus TCP (over IP/ethernet). These devices are typically called 'gateways' and they understand well Modbus enough to pass requests on to slave devices. Using a gateway, it is possible for your application to make Modbus requests (over Modbus TCP_ to a device that is talking Modbus RTU or ACII (over serial). This can be very advantageous as the Modbus TCP packets can be sent over any IP network, sent over NAT, etc. One example of this is the O-Ring IDS-M311 on that same page above. One 'gotcha' with both the scenarios above is that if there is any problem in your network, and a modbus request or reply does not get through, it is lost. Modbus does not have any native provision for timestamping or sending multiple values - you ask for a register (offset address) and you get a value in reply. Depending on your application, intermittency like this may or may not be a problem. If it is, you might consider placing your datalogger or Modbus client closer to the device. There are thousands of dataloggers that have both Ethernet and RS485 connectivity and would be a drop-in solution, though such 'industrial' devices tend to get really expensive really quickly. One product that I can really recommend for this is Mango Automation, distributed by Infinite Automation. The free version of the software is limited to 25 Modbus TCP data points and I have run it comfortably on a Raspberry Pi. The commercial license is around US$400 but for not much more you can get an actual appliance which has the fully licensed software on it plus a RS-485 port. If you want to use the free version on a Raspberry Pi then any generic USB RS-485 adapter should work. There is a slight learning curve to the software but once set up it is incredibly robust and reliable. The Modbus library used (Modbus4J) is very clever and makes it very straightforward. Out of the box, you can monitor points, save them to a database, and generate charts. You can create alarm conditions and when triggered, you can fire off emails, set values of other points, or use scripting for powerful logic. You can configure also have reports sent via email that include charts and CSVs. There's even a RESTful API now that lets you retrieve data. Feel free to contact me off-list if you'd like any further detail. I worked with the software professionally for a few years and am quite familiar with it, and very much a fan of it! Cheers Jeremy On Wed, Jun 8, 2016 at 7:00 PM, <public-request(a)talk.mikrotik.com.au> wrote: > Send Public mailing list submissions to > public(a)talk.mikrotik.com.au > > To subscribe or unsubscribe via the World Wide Web, visit > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > or, via email, send a message with subject or body 'help' to > public-request(a)talk.mikrotik.com.au > > You can reach the person managing the list at > public-owner(a)talk.mikrotik.com.au > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Public digest..." > > Today's Topics: > > 1. Re: Industrial data (Jason Hecker (Up & Running Tech)) > 2. Re: Industrial data (Russell Hurren) > 3. Re: Industrial data (Mike O'Connor) > 4. Re: Industrial data (Jason Hecker (Up & Running Tech)) > > > ---------- Forwarded message ---------- > From: "Jason Hecker (Up & Running Tech)" <jason(a)upandrunningtech.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 12:00:35 +1000 > Subject: Re: [MT-AU Public] Industrial data > I think if you can convert the RS485 to RS232 you can hook into a serial > port on one of the Routerboards that support serial. Then in the Mikrotik > settings you can hook this serial port up to a TCP port and connect to it > over telnet/WindowsVirtualCOMport/socat/netcat. > > So: > * Choose a Routerboard that supports Wifi and serial > * Set up the Other End to capture the data from the serial port over TCP/IP > using one of the above methods. > > Can you have your MOBUS application at the Other End hook up to a virtual > COM port in Windows? How do you want to capture or store the data? > > On 8 June 2016 at 11:48, Steve Hille <stevehille84(a)gmail.com> wrote: > > > Greetings all, > > > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > > other type industrial electrical equipment using Mikrotik gear, or if it > is > > even possible? > > > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or > > something similar as a 'station' and then shoot the data off to my access > > point, we will be able to collect data from this industrial equipment, > just > > hoping for some gotchas before I really get into it. > > > > Cheers, > > > > Steve > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > -- > > > > ---------- Forwarded message ---------- > From: Russell Hurren <russell(a)zeropointnetworks.com> > To: "'MikroTik Australia Public List'" <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 10:02:15 +0800 > Subject: Re: [MT-AU Public] Industrial data > Hi Steve > > I've never done it, but I presume you'd use something like this: > > > http://www.emtec.com.au/serial-and-usb/serial-to-ethernet-servers/single-po… > > Then it's just a case of plugging it into the network (whether that's into > a Groove or something else), installing the RealPort software on a computer > and then collect data as though that computer was connected directly. > > Regards > > Russell > > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of > Steve Hille > Sent: Wednesday, 8 June 2016 09:49 > To: public(a)talk.mikrotik.com.au > Subject: [MT-AU Public] Industrial data > > Greetings all, > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > other type industrial electrical equipment using Mikrotik gear, or if it is > even possible? > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or something similar as a 'station' and then shoot the data off to my > access point, we will be able to collect data from this industrial > equipment, just hoping for some gotchas before I really get into it. > > Cheers, > > Steve > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > ---------- Forwarded message ---------- > From: "Mike O'Connor" <mike(a)oeg.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 11:38:05 +0930 > Subject: Re: [MT-AU Public] Industrial data > On 8/06/2016 11:18 AM, Steve Hille wrote: > >> Greetings all, >> >> I'm wondering if anyone has or is collecting data from MODBUS / RS485 or >> other type industrial electrical equipment using Mikrotik gear, or if it >> is >> even possible? >> >> I'm thinking perhaps if I can somehow interface the MODBUS into a Groove >> or >> something similar as a 'station' and then shoot the data off to my access >> point, we will be able to collect data from this industrial equipment, >> just >> hoping for some gotchas before I really get into it. >> >> Cheers, >> >> Steve >> _______________________________________________ >> Public mailing list >> Public(a)talk.mikrotik.com.au >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au >> > > Hi Steve > > I have no idea about Mikrotik gear but I've done this sort of things for > years using a number of different boards running Linux. Nowdays RPI is a > good option. > > I've written tools which will run as a mobus master or slave, talking TCP > or RTU. Some of the code for this is on github at > https://github.com/latproc/clockwork > > > > > > > ---------- Forwarded message ---------- > From: "Jason Hecker (Up & Running Tech)" <jason(a)upandrunningtech.com.au> > To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> > Cc: > Date: Wed, 8 Jun 2016 12:08:37 +1000 > Subject: Re: [MT-AU Public] Industrial data > I'll add have a look at the Port feature in the Mikrotik. > > http://wiki.mikrotik.com/wiki/Manual:Port > > > > On 8 June 2016 at 11:48, Steve Hille <stevehille84(a)gmail.com> wrote: > > > Greetings all, > > > > I'm wondering if anyone has or is collecting data from MODBUS / RS485 or > > other type industrial electrical equipment using Mikrotik gear, or if it > is > > even possible? > > > > I'm thinking perhaps if I can somehow interface the MODBUS into a Groove > or > > something similar as a 'station' and then shoot the data off to my access > > point, we will be able to collect data from this industrial equipment, > just > > hoping for some gotchas before I really get into it. > > > > Cheers, > > > > Steve > > _______________________________________________ > > Public mailing list > > Public(a)talk.mikrotik.com.au > > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > > > > > > -- > > > _______________________________________________ > Public mailing list > Public(a)talk.mikrotik.com.au > http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au > >

1 0

Industrial data
by Steve Hille 08 Jun '16

08 Jun '16

Greetings all, I'm wondering if anyone has or is collecting data from MODBUS / RS485 or other type industrial electrical equipment using Mikrotik gear, or if it is even possible? I'm thinking perhaps if I can somehow interface the MODBUS into a Groove or something similar as a 'station' and then shoot the data off to my access point, we will be able to collect data from this industrial equipment, just hoping for some gotchas before I really get into it. Cheers, Steve

4 4

Port Mirroring on a Virtual MT
by Dave Browning 01 Jun '16

01 Jun '16

Hi Guys, How does one do port mirroring on a virtual mikro? Looked at http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Port_Mirroring but the '/interface ethernet switch' command isn’t available. Dave Browning | Network Engineer P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

2 1

Need help with IPSec (and AWS VPN)
by Karl Auer 01 Jun '16

01 Jun '16

I am trying to get an AWS VPN going to a MikroTik. I have gotten *so close* - AWS says the tunnel is UP, I see valid SAs at my end, I can even ping across the link - but only from the router. Not from within my network. I feel it just has to be some simple NAT or firewall thing, but I've run out of ideas. If anyone out there would be prepared to help, I'd be most grateful. Call me any time on 0-65947435, or email me and I'll call you... Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

3 2

Windows 7 w/ WPA2-Enterprise
by Dave Browning 01 Jun '16

01 Jun '16

Hi All, Has anyone been able to get Windows 7 (and probably Windows 8) to authenticate to a Mikrotik CAPsMAN deployment whereby the authentication is via Radius to NPS? From what I can see NPS accepts and allows the request (getting Reason-Code 0). Windows 10 works fine, phones and macs work fine. Have tried this, https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_… The log on the Mikrotik when it tries to connect is; disconnected, received deauth: unspecified (1) Cheers, Dave Dave Browning | Network Engineer P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

1 0

queues I cant get my head around
by Patrick Sayer 26 May '16

26 May '16

I want to stop any given hotspot user from maxing out the upload bandwidth on a connection (ADSL2+ in most cases). I dont want to have to add queues for each user as this obviously changes. I don't really want to rely on the burst settings as this is time based and if the user is the only one using bandwidth they will get limited after the burst time is used up regardless if noone else wants bandwidth at that time still. What I would like to see happens is each user is allocated a minimum amount of bandwidth (like PCQ can do), but allow them to burst indefinitely rather than on a timed basis. And if multiple users try to use bandwidth then the burst they receive gets shared in the same way that PCQ is doing in the first place. Having 10 users in a PCQ list with a total of 1Mbit bandwidth will limit each user to 100Kbps even if only one of them is using the system at the time from what I can see, and this is not a desired outcome. Does this explanation make sense and has anyone come up with a solution along those lines? Thanks in Advance, Patrick

1 0

bgp peering with cisco
by Alex Samad - Yieldbroker 26 May '16

26 May '16

Hi Wonder if any one has come across any issue with MED attribute not been see from a cisco router. I have a client saying they are setting the MED attribute on a prefix and its not showing up on my end. Alex

3 7