- Public - talk.mikrotik.com.au

RB4011 and LR9 Kit for sale
by Jason Hecker 17 Jul '23

17 Jul '23

I am moving some used Mikrotik gear on if anyone is interested. LR9 LoRa kit with antenna. Where I live now there is no LoRa activity alas. https://www.ebay.com.au/itm/115855052280 RB4011-with-Wifi. I have upgraded to an RB5009 with hAPAX2s. https://www.ebay.com.au/itm/115855031211 <https://www.upandrunningtech.com.au/>

2 3

MikroTik Certification Training coming to Melbourne in August
by Mike Everest 15 Jun '23

15 Jun '23

Hi Folks! Please excuse the blatant plug :-} Our first physical (face to face) full training program since before covid times is going ahead in August (21st thru 30th) at the Rendezvous Hotel in Flinders Street Melbourne. https://training.duxtel.com This year, we're offering: MTCNA - core modules MTCD - Re-Certification day (to renew an expired cert, or convert the online DTCNA certificate to MTCNA) MTCRE - Routing MTCINE - Internetworking AND, for the first time EVER in Australia: MCIPv6D - Ipv6 (obviously ; ) MTCSWE - Switching Send email to training(a)duxtel.com after you make a provisional enrollment quoting MIKROTIK-AU to get 10% off the full fee! : ) As usual, we'll be looking for prospective recipients of 'sponsored' places where applicable - if you know of someone who would be a potential recipient of a sponsored place (reduced or waived enrollment fee) then please do nominate via training(a)duxtel.com <mailto:training@duxtel.com> (include full statement of why such placement would be beneficial to the candidate, or community) Questions are welcome on or off list, of course! {abuse direct to me please :-} Cheers! Mike.

1 0

ptp w/poe passthru
by Noel Butler 17 Apr '23

17 Apr '23

Hi Mike, all, Looking for a small ptp device with a secondary ethernet port that also is capable of poe out, (think: _insert_other_brand_ nanostation M5) for a solar camera project (trying to avoid "other brand" if possible) Trying to avoid 12v poe switches, I can't even find a MT device that's low-end (as it only needs to cover 300 metres for 1 camera in a mains-less shed) that even has a second port, let alone with poe, surely MT has a competing product? I seem to be too monday-lagged-out to find one on MT's site even after 2 hits of caffeine... Any recommendations? -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

5 7

Setting up IPv6
by Christopher Hawker 07 Mar '23

07 Mar '23

Hello all, I've been scratching my head and banging it against a brick wall for the last month, trying to get this sorted out. In our office, we are announcing a /48 v6 prefix to AAPT from our BGP router. We then have a NAT router for our internal VLANs. We wish to assign addresses to clients within our office. If I set static addresses all works ok so I know it's not a routing issue. We have 4 VLANs within our office to which we wish to allocate a /59 to each. Would anyone have any examples of configs or be able to point me in the right direction, to have our NAT router announce IP addresses to our clients? Thanks, CH.

2 1

Upgrade from 6.36 to 6.48.6
by Karl Auer 03 Mar '23

03 Mar '23

This is an abuse of the mailing list as I could probably figure this out by dint of diligent Googling, but just in case someone has an easy answer... I have finally got the go-ahead to upgrade two Mikrotik RB951G-2HnD units running 6.36. I want to take them to version 6.48.6 (long-term). Can I do that in one jump? Any gotchas? Regards, K. PS: These routers are from 2015 and have never missed a beat, though one did get compromised. I like hardware that just keeps on keeping on. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

3 5

Output Networks for ROS v7 IPv6 BGP
by Christopher Hawker 03 Feb '23

03 Feb '23

Hey folks, First time attempting to setup v6 BGP on an ROS v7 router. Things are a little confusing with Output Networks and Address Lists. I cannot add a v6 address to a v4 address list (which makes sense), and if I create a v6 address list it does not show up in the Output Network drop-down on the Filter tab in the New BGP Connection dialog box. Where on earth do I create the output address list for v6 sessions? Thanks, CH.

1 0

Static routes with bgp communities in ROS7 - how?
by Damien Gardner Jnr 13 Jan '23

13 Jan '23

Hi folks, This one has me a little stumped. I'm working on upgrading one of our systems from ROS6 to ROS7. This system has a controller that talks via API to a number of Mikrotiks around the place, and maintains a number of static routes (can be anywhere from 50 to 1000 depending on time and day). These static routes all have communities set, depending on the function of the route. i.e. a local service suspension route might be 12345:765 which means it is advertised via ospf for blackholing. A mitigation route might be 12345:666 or 12345:667 to be sent via bgp to our border routers for blackholing, or even advertised on to our upstream providers for blackholing or scrubbing. We have routing filters on ROS6 that decide which routes get redistributed to which protocols and which peers based on communities. A basic config for two blackhole routes might look like the following: /ip route add bgp-communities=12345:765 distance=1 dst-address=221.121.69.69/32 type=blackhole add bgp-communities= 12345:666 distance=1 dst-address=221.121.69.70/32 type=blackhole /routing filter add action=accept bgp-communities= 12345:765 chain=ospf-out comment=Suspension prefix=0.0.0.0/0 prefix-length=32 set-distance=100 add action=discard chain=ospf-out add action=accept bgp-communities= 12345:765 chain=bgp-out comment=Suspension prefix=0.0.0.0/0 prefix-length=32 add action=accept bgp-communities=12345:666 chain=bgp-out comment=Mitigation prefix=0.0.0.0/0 prefix-length=32 add action=accept bgp-communities=12345:667 chain=bgp-out comment=LocalBlackhole prefix=0.0.0.0/0 prefix-length=32 Trying to do this in ROS7, there just isn't a bgp-communities attribute on route that I can set. Is there an 'easy' way to do this same thing on ROS7? Or am I going to also need to add routing rules for each IP on the ospf-out and bgp-out chains as needed to say they can or cannot go out? Thanks for any help, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

2 1

EP06-E and Mikrotik
by Jason Hecker 10 Dec '22

10 Dec '22

Hi Anyone who's used an EP06-E and a Mikrotik product, how are they performing for you? I fitted one to an LHG myself last year and the damned thing would go on B28 in the lounge room and then only on 3G up on the roof. I got rid of it after the farm qualified for FW NBN. This was with ROS6 though. There were a lot of up and down events on 3G too. Things can change in a year, how is it with ROS7 and MBIM mode? I have another farm with only B28 towers in close range and more channels on towers further away in the next town. Have the WAPs and LHGs been OK and stable with the EP06-E? Regards, Jason Hecker <https://www.upandrunningtech.com.au/>

1 0

Help with BGP on v7 (not a joke)
by Christopher Hawker 07 Dec '22

07 Dec '22

Hey all, I'm currently trying to get BGP working on v7. I am almost there, we are getting a full table from our upstream peer and are sending them our prefix (which they confirm they are receiving). The final thing we need to work out is filtering. We have a single /24 v4 prefix being announced and receiving a full table. If there's anyone out there that has some working examples for import and export filters it'd be greatly appreciated. Thanks, Christopher H.

2 1

Blocking FTP
by Karl Auer 07 Nov '22

07 Nov '22

I'm wondering if I have fundamentally misunderstood something. In fact I am rather hoping I have. An outside agency has reported seeing telnet connection attempts coming from the outside IPv4 address of a client's router. They have provided info that shows quite clearly that these are attacks coming from the router. To see where in the network they were originating, I added these lines at the front of each of the input, output and forward "/ip firewall filter" chains: chain=xxx action=drop \ protocol=tcp dst-port=23 \ log=yes \ log-prefix="TEL_xxx" My log output shows exclusively lines with "TEL_output". I wasn't expecting any "TEL_input" lines, but I was definitely expecting some "TEL_forward" lines, assuming the miscreant is inside the network. Here is a sample (a.b.c.d is the outside address of the router, w.x.y.z is the destination address): 18:44:35 firewall,info TEL_output output: in:(none) out:e1-uplink, proto TCP (SYN), a.b.c.d:54315->w.x.y.z:23, len 40 I.e., the packets seem to be sourced at the router. Does this mean that the router is the source of this nefariousness?!? Or am I missing something? There are quite a few of these, I'm seeing about 20 per minute. The router version is old and should be upgraded: 6.36 (stable). It appears that an earlier colleague added three mangle/passthrough statements, but these as I understand it are effectively just counters. There are no other mangle statements. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

4 4