- Public - talk.mikrotik.com.au

Fixed wireless in SA
by Paul Julian 03 Jun '14

03 Jun '14

Hi guys, does anybody on this list do fixed wireless in SA ? I am specifically looking for options in the Willunga area along the ridge to the east Please contact me personally if you can help or know somebody who might be able to help. Regards Paul

1 0

Re: [MT-AU Public] Problems with multiple RBMetal2SHPn devices failing at one site
by Karl Auer 01 Jun '14

01 Jun '14

On Tue, 2014-04-29 at 23:37 +1000, Steve at Digitronics wrote: > Typically, a device works ok for a while (up to a month) but then > starts logging kernel faults and exhibiting other weird symptoms such > as script failures, and vanishing scripts. Sometimes only a reboot or > a power cycle will get a failed unit going again. > The chances of their being actual faulty devices is now so vanishing > small as to be discounted, so we are trying to figure out what it is > at this site that could be causing the same persistent failures on the > series of devices. Radiation - is the unit in the path of somebody else's microwave or similar? Heat: Could the unit be above or near an intermittent heat source? Or an "accidental lens" focusing heat on the unit, such as a concave metal or glass panel? Vibration: Is the unit mounted on something that could be subject to intermittent vibration, such as a poorly mounted aircon unit? Vandalism: Is the unit anywhere where an aggrieved person might be playing silly buggers with it? Some people are really touchy about wireless devices nearby. Non-human pest activity: Rats, mice, insects etc. You'd expect visible damage if they were attacking the unit directly, but perhaps they are somehow causing vibration or overheating. If not to the unit, then possibly to the POE injector, the PSU or some other component. Swap the PSU on the suspect end to with the PSU on the other end. Does the problem follow the PSU? Swap the units at the two ends. Does the problem follow the unit, or does the previously good unit that has "never had a failure of any kind" start exhibiting the same symptoms? Is the POE source rated to provide enough power for the aggregate load of this device and any others it is supplying? Long shot, but is there any chance that the method of attaching the unit is in some way penetrating or deforming the unit in some way? Try mounting it differently just for a week or two to see if it makes a difference. Has the CAT5 cable been checked *for POE use*? Some equipment checks only that the cable is good for data... In situations like this, I also I recommend my two debugging mantras: Ain't no such thing as magic. When you have eliminated the impossible, whatever remains, *however improbable*, must be the truth. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 231A B066 CF91 1216 4F0F F2AC CE25 B8AA 46DC CC4F Old fingerprint: 1DB8 0599 13F0 E774 3811 6CA6 D6D0 AFA9 D91A 004C

4 7

IPSEC problems - Mac OS VPN server behind an RB2011
by Thomas Jackson 30 May '14

30 May '14

Hi all, I think I'm missing something obvious here, but it has been so long since I've done anything with IPSEC that I can't remember all of the tricks. The configuration is a RB2011, with two interfaces active - 1 goes to an Optus fibre WAN link, the other goes to a single subnet LAN via NAT. Inside that LAN, there is a Mac OS X box running an IPSEC VPN server for road warrior type access. This was previously working with a Cisco 881, but that has been replaced with the RB2011 to get a bit more flexibility. So far, I have not been able to establish a VPN link from the outside using the Mikrotik. As an aside, the test workstation has a public IP address with no NAT or firewalling involved, so there shouldn't be any problems on that end. I have forwarded ports 500, 1701, 4500 (all UDP) to the server, and (with some additional logging firewall rules), I can see the traffic hitting the router and being forwarded to the Mac server, but I can't see anything going back the other way. /ip firewall filter add chain=input comment="Allow ICMP" protocol=icmp add chain=input comment="Allow established connections" connection-state=established add chain=input comment="Allow related connections" connection-state=related add chain=input comment="Allow access to the administration" in-interface=wan-optus src-address=<my remote admin workstation> add action=drop chain=input comment="Drop anything addressed to the router coming in from WAN not specifically allowed above" in-interface=wan-optus add chain=forward comment="Forward on any established connections without rechecking rules" connection-state=established add chain=forward comment="Forward on any related connections without rechecking rules" connection-state=related add chain=forward comment="Allow some UDP ports in from Optus" dst-port=500,1701,4500 in-interface=wan-optus protocol=udp *** various other allow rules redacted - all of these only touch TCP packets add action=drop chain=forward comment="Drop any invalid" connection-state=invalid add action=drop chain=forward comment="Drop any inbound traffic that is not specifically allowed by other rules" in-interface=wan-optus /ip firewall nat add action=masquerade chain=srcnat comment="NAT masquerade for Optus" out-interface=wan-optus add action=dst-nat chain=dstnat comment="NAT from Optus to Mac server - UDP ports" dst-port=500,1701,4500 in-interface=wan-optus protocol=udp to-addresses=<internal IP of Mac server> *** various other dstnat rules redacted - all involve TCP Any tips would be much appreciated. Cheers, Thomas

4 5

[Fwd: Re: Service Pillars]
by Karl Auer 16 May '14

16 May '14

On Fri, 2014-05-16 at 11:10 +1000, Paul Julian wrote: > We are after one of those service pillars/bollards like Telstra use > for connecting cables in the street. Why? Not even Telstra uses those old things any more! Do what Telstra does - get a couple of old shopping bags and cable-tie them over your punched Krone block. For a professional finish, add a bit of 'leccy tape for cosmetic purposes then leave the assembly lying on the ground. Or, if there's a handy fence post, power pole or similar, hang the bundle of cables over a nail or bolt to expose the open end of the assembly to the healthful rays of the sun. Try to rip up a nature strip or knock over a small shrub as you leave. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 231A B066 CF91 1216 4F0F F2AC CE25 B8AA 46DC CC4F Old fingerprint: 1DB8 0599 13F0 E774 3811 6CA6 D6D0 AFA9 D91A 004C

2 1

Service Pillars
by Paul Julian 16 May '14

16 May '14

Hi guys, I'm hoping somebody may be able to help. We are after one of those service pillars/bollards like Telstra use for connecting cables in the street. It needs to be above ground and either already have, or is able to take a krone block for at least 25 pairs within it. It needs to be waterproof of course but is only going to be used for cable joining and termination of CAT3. I have tried electrical wholesalers who don't know what I am talking about, I have searched the net also without much luck, does anybody know where I can get these things from ?? Thanks Paul

2 2

API Wildcard search
by Mike Everest 15 May '14

15 May '14

Hi folks, Anyone have some experience using routerOS API? I've been extending the configuration group functionality of our DuxTel Commander, and come up against a challenge in filtering API query (http://wiki.mikrotik.com/wiki/API#Queries) The deal is that I use 'comment' field as a way to cross-reference router configuration entries with the configuration database items. For example, a firewall rule might look like: ip firewall filter add chain=forward src-address-list=blocked action=drop comment='Managed by DuxAdmin SetID:443 ItemID:27' So when I want to find all the firewall rules with SetID:443, I can do this: /ip/firewall/filter/find ?>comment=Managed by DuxAdmin SetID:443 Which seems to work OK, but I can't work out how to return just those entries that include 'ItemID:27' I'll put the question to MT support and post a solution (if there is one) if/when they respond, but if anyone has some suggestions, I'm 'all ears'! ;-) Cheers, Mike.

4 7

PPPoE client with ADSL modems
by Russell Hurren 13 May '14

13 May '14

Is anyone successfully using the PPPoE client on a Mikrotik router with an ADSL bridge? I'm using Draytek Vigor 120 routers and I'm having to run them in half-bridge mode and terminate the PPPoE connection on the device rather than on the Mikrotik router. In the past I've been able to connect to Telstra Bigpond from the Mikrotik, but I'm not able to anymore and I've never been able to connect to my primary ISP (WebVault). I've used the same draytek devices in full bridge mode with other brand routers making the PPPoE connection, so I'm fairly sure the issue is with the Mikrotik PPPoE client. I'd be interested to hear what ISP and hardware you're using if you've got this to work. I've contacted Mikrotik support and found a similar issue in the forum (http://forum.mikrotik.com/viewtopic.php?f=2&t=46384) but no-one's answering me. Regards Russell Hurren Managing Director Zero Point Networks PTY LTD +61 8 6262 9376

5 13

CRS default trunked vlan script
by Andrew Cox 07 May '14

07 May '14

Hey All, I've been playing around with v6.13rc1-12 over the last week on a CRS125-24G-1S and have put together a an example script for provisioning the CRSwitches with a user and admin vlan that is trunked back via the SFP port. Hopefully this is useful to some of us; I know I've been waiting for a long time to have a usable and readable switch chip config on the CRS platform :-) In the config: vlan20 is the user facing vlan (untagged on ether1-24, tagged on sfp1) vlan90 is the admin vlan (tagged on sfp1) vlan90 is attached to the router cpu 10.0.0.2/24 is assigned to vlan90 10.0.0.1 is set as the default gateway Cheers, Andrew Cox

3 4

Re: [MT-AU Public] Dodgy winbox after upgrades to V6.x when using VPN
by Karl Auer 06 May '14

06 May '14

On Tue, 2014-05-06 at 15:42 +1000, Paul Julian wrote: > Hey Mike, any suggestions on how to get the supout off a router I can > only SSH to from another router ? If you can get to the router with ssh, then you can move stuff to and from the router with scp. scp me@myrouter.com.au:/myfile.txt . There's a space before the rightmost period. The above command copies myfile.txt from the root directory of the router to your local current directory, assuming the account "me" exists on the router and has read access to myfile.txt. If you are using Windows, you will need am scp program, I believe the puTTY suite has one. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 231A B066 CF91 1216 4F0F F2AC CE25 B8AA 46DC CC4F Old fingerprint: 1DB8 0599 13F0 E774 3811 6CA6 D6D0 AFA9 D91A 004C

1 0

Dodgy winbox after upgrades to V6.x when using VPN
by Paul Julian 06 May '14

06 May '14

Hi guys, I was hoping somebody may have come across this issue before and might have a fix. We have a customer with a 2.4Ghz wireless network in a resort, the AP's are all RB411AH units and seem to be working fine in general. The AP's are backhauled to the main building using some Omnitiks and SXT's, the backhaul is very reliable and stable, average signal is about -55, these are running in A/N mode and happy. The AP then connects into our hotspot gateway and everything works happily. All customer AP's are bridged back to the hotspot gateway via EOIP tunnels, once again that works fine. For management we have a VPN from each device which goes back to our data centre, as the backhaul network and all devices are fully routed these VPN's just travel across the network and out the Internet connection and work fine. The problem we have is that we have upgraded a couple of AP's and backhaul radios to v6.11, they were previously 5.4, as soon as we upgrade them we can't winbox to them anymore. We first noticed the issue a couple of days ago and didn't really think the upgrades were the cause, but I have spent a couple of hours tonight just going through configs, firewall rules, ACL's etc trying to find some reason why winbox won't work to these units, I have now got to the point where I reckon that it's something to do with the upgrades as the units which still haven't been upgraded connect up instantly without an issue. I thought I might be the winbox cache on my windows 7 PC so I deleted it, I can connect fine to other routers which I have upgraded to v6.10, but not with 6.11 or 6.12 which is what I am using on these radios. Has anybody come across this issue before and have any suggestions as I am all out of them now. The curly one with this problem is though that the issue only occurs when accessing the routers via VPN, direct access works fine, and I have reduced MTU's and tried everything but they should work with the same PPTP settings as the other routers on V5.4 as they are connected exactly the same way and are configured exactly the same way with exception to the ROS version. Any suggestions would be greatly appreciated ! although I am happy with CLI it's just easier to do some things in the GUI and you can see graphs and stuff J Thanks Paul

2 13