More for Less: MikroTik Talk

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk

«‹›4 »

Thanks Ants: May 21, 2004; #essereFerrari

That guide is awesome. Might prompt me into getting an RB750 to cut my teeth on.

# ¿ Mar 1, 2011 01:53

Adbot: ADBOT LOVES YOU

# ¿ May 3, 2024 00:20

Thanks Ants: May 21, 2004; #essereFerrari

Definitely planning to pick up an RB2011. Seems like it's capable of handling pretty much any connection you might want to use for the foreseeable future.

# ¿ Apr 25, 2011 15:01

Thanks Ants: May 21, 2004; #essereFerrari

Not sure how well this suggestion will go down since they offer very little in terms of settings to play with, but I had Wi-Fi problems constantly in my 3 storey house, until I put an AirPort Extreme on the middle floor. Absolutely flies, especially on 5GHz which my Mac, iPad, iPhone all support, leaving 2.4 free for older kit, consoles, etc. Easily powerful enough for my 80/20 connection that I can tell.

# ¿ Oct 25, 2012 02:10

Thanks Ants: May 21, 2004; #essereFerrari

You can do that with a Mikrotik, if you can't bind different services to HTTP headers then Apache Traffic Server can probably do what you want.

# ¿ Oct 29, 2012 19:05

Thanks Ants: May 21, 2004; #essereFerrari

I've just started looking at RouterOS vis a RB750GL that was kicking around. It all seems straightforward enough, one thing that I can't see a simple explanation for though is how VLANs work. I've come up with the following conclusions while I was in the shower, can you correct me if they are wrong?

If I want to work with untagged traffic on a port then I pick the interface name instead of the VLAN (I'm assuming that this doesn't affect the VLANs but I can't find any reference to this)
If I want to tag/untag traffic I can bridge an interface to a VLAN and it will be tagged/untagged as it travels across it
If I want to break different VLANs out to different ports then I should really use a managed switch and not a Routerboard

# ¿ Apr 25, 2013 02:26

Thanks Ants: May 21, 2004; #essereFerrari

Thanks, that makes sense albeit it's quite longwinded how VLANs have to be created on each interface they need to be tagged on and can't be called the same thing.

# ¿ Apr 26, 2013 18:19

Thanks Ants: May 21, 2004; #essereFerrari

Right, I have my VLANs nailed down and testing them thanks to some dodgy Realtek diagnostic utility that has let me create multiple virtual adapters on my PC.

However, when I get a DHCP lease it seems to start at the top of the range and count backwards, is this normal? My DHCP pool is defined as 192.168.0.29-192.168.0.254 and with one client connected it gets .254, next client gets .253 etc. It just seems a bit weird.

# ¿ May 1, 2013 00:14

Thanks Ants: May 21, 2004; #essereFerrari

It's not a big deal, everything works fine and eventually once I'm done testing the DHCP will be handled by a Windows server as part of AD. I just wanted to check this wasn't abnormal. Thanks.

# ¿ May 1, 2013 13:35

Thanks Ants: May 21, 2004; #essereFerrari

Can someone idiot check what I'm doing here? I found something online which said the only thing I need to do to have a service on my LAN accessible from outside is to do this:

code:

add action=dst-nat chain=dstnat comment="WebDAV TCP 443" disabled=no \
    dst-address=a.b.c.d in-interface=ether1 protocol=tcp src-port=443 \
    to-addresses=192.168.0.22 to-ports=443

Where a.b.c.d is the external IP address I want to use for that service (I have a block of 8, they have all been added to the routers address list and all ping, I have set the preferred source address for the gateway etc, internet connectivity works as normal. However nothing can see the page running on port 443 in the example above. Am I supposed to also add a firewall rule, and how should it look if I am?

Edit: Scratch that. One of the dynamic routes has a preferred source which is one of the IPs that I don't want to use as our gateway and it's using this for some reason. Anyone got any ideas?

Thanks Ants fucked around with this message at 15:00 on May 19, 2013

# ¿ May 19, 2013 14:50

Thanks Ants: May 21, 2004; #essereFerrari

Thanks, that makes sense but this still isn't working. Should the new NAT and Firewall rules be above the defaults if these are in Winbox? The default masquerade NAT rule is still in there which I believe is what's giving me working internet at the moment.

# ¿ May 19, 2013 15:06

Thanks Ants: May 21, 2004; #essereFerrari

code:

# may/19/2013 14:14:43 by RouterOS 5.25
# software id = PKRJ-BZK6
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s \
    tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment="WebDAV TCP 443" connection-state=new disabled=no dst-address=192.168.0.22 dst-port=443 protocol=tcp
add action=accept chain=input comment="default configuration" disabled=no protocol=icmp
add action=accept chain=input comment="default configuration" connection-state=established disabled=no
add action=accept chain=input comment="default configuration" connection-state=related disabled=no
add action=drop chain=input comment="default configuration" disabled=no in-interface=ether1
add action=accept chain=forward comment="default configuration" connection-state=established disabled=no
add action=accept chain=forward comment="default configuration" connection-state=related disabled=no
add action=drop chain=forward comment="default configuration" connection-state=invalid disabled=no
/ip firewall nat
add action=dst-nat chain=dstnat comment="WebDAV TCP 443" disabled=no dst-address=xxx.222.84.211 in-interface=ether1 protocol=tcp src-port=443 to-addresses=192.168.0.22 to-ports=443
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat comment="3CX TCP 5060" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=tcp src-port=5060 to-addresses=192.168.0.21 to-ports=5060
add action=dst-nat chain=dstnat comment="3CX UDP 5060" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=udp src-port=5060 to-addresses=192.168.0.21 to-ports=5060
add action=dst-nat chain=dstnat comment="3CX UDP 9000-9049" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=udp src-port=9000-9049 to-addresses=192.168.0.21 to-ports=9000-9049
add action=dst-nat chain=dstnat comment="OpenVPN TCP 443" disabled=no dst-address=xxx.222.84.209 in-interface=ether1 protocol=tcp src-port=443 to-addresses=192.168.0.20 to-ports=443
add action=dst-nat chain=dstnat comment="OpenVPN UDP 1194" disabled=no dst-address=xxx.222.84.209 in-interface=ether1 protocol=udp src-port=1194 to-addresses=192.168.0.20 to-ports=1194
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061 sip-direct-media=yes
set pptp disabled=no

Thanks for the help so far, I imagine it's something annoyingly basic.

# ¿ May 19, 2013 15:16

Thanks Ants: May 21, 2004; #essereFerrari

They were at zero, I changed those. However I think there's a more fundamental issue as there isn't a ping response to that address from the WAN side, and HTTPS connections still don't work. Pings to other addresses in the same IP block from our ISP work fine.

I've moved the HTTPS stuff onto the address that is working and everything's fine. I think I'll be calling the ISP next. Thanks for your help with everything though. Do you want a forums upgrade?

# ¿ May 19, 2013 15:48

Thanks Ants: May 21, 2004; #essereFerrari

This is what that section looks like:

code:

add address=xxx.222.84.208/22 comment=Router disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.210/22 comment=3CX disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.209/22 comment=OpenVPN disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.213/22 comment="Remote Desktop Gateway" disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.211/22 comment=WebDAV disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.212/22 disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.214/22 disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.215/22 disabled=no interface=ether1 network=xxx.222.84.0

They aren't specifically secondary addresses but they are all addresses on that interface. I've changed the NAT to:

code:

add action=src-nat chain=srcnat comment="default configuration" disabled=no out-interface=ether1 to-addresses=xxx.222.84.208

Edit: Addresses that work are .208, .210, .213, .214, .215. There's not really any pattern in that that I can see.

Edit again: I've removed all the addresses above except for

code:

add address=xxx.222.84.208/22 comment=Router disabled=no interface=ether1 network=xxx.222.84.0

And still having issues getting stuff to connect on certain IPs but working fine on others. I'll contact the ISP I think.

Edit again again: Spoke to the ISP, ended up setting a src-nat to send a client out of each of the IP addresses in turn after adding them back in, and it worked fine (verified it was going out on the correct IP as well). Pinged them all from outside the network and everything worked except .212. I'm lost now but I've worked around things and things are at a point where they are working well enough for now. Just SIP calls take ages to go out but I can live with that.

Thanks Ants fucked around with this message at 17:43 on May 19, 2013

# ¿ May 19, 2013 16:09

Thanks Ants: May 21, 2004; #essereFerrari

Mikrotik posted:

RouterOS 6 released:

================================
What's new in 6.0 (2013-May-17 14:04):

*) ipsec - added /peer passive option which will prevent starting ISAKMP negotiation
and signifies xauth responder/initiator side;
*) RouterBOARD - default wireless config now includes password - serial number;
*) lte - support YOTA WLTUBA-107;
*) console - fixed crash when variable name was not specified for
*) hotspot - added mac-cookie login method;
http://wiki.mikrotik.com/wiki/Manual:Hotspot_Introduction#MAC_Cookie
*) lcd - show a message when system shutdown is complete;
*) lcd - added Log screen which is accessible through the Main Menu
and shows log messages where action=echo;
*) ipsec - added pre-shared-key-xauth and rsa-signature-hybrid authentication methods;
*) increased max l2mtu on CCR to 10226 bytes;
*) fixed crash on RB1200;
*) fixed bonding - did not work after remove, undo;
*) fixed queues - router could become unresponsive when configuring queues;
================================

http://mikrotik.com/download/

# ¿ May 21, 2013 09:20

Thanks Ants: May 21, 2004; #essereFerrari

I had OpenVPN connecting through a RB750GL with zero issues up to about a month ago when I got bored with it and replaced it with something else.

Is it slow to establish the connection or slow with throughput?

# ¿ Aug 14, 2013 00:14

Thanks Ants: May 21, 2004; #essereFerrari

There's a SIP helper on the Mikrotik's that I've found causes more problems than it solves, if you're just using a SIP trunk or one device then you can disable it. You should be able to enter the external IP in the SIP client (PBX, handset etc), and then it's just a case of making sure the relevant ports are forwarded (don't forget SIP voice traffic travels over UDP).

# ¿ Sep 16, 2013 15:58

Thanks Ants: May 21, 2004; #essereFerrari

Now we just need to see how many totally unrelated bugs have been introduced

# ¿ Dec 4, 2013 02:49

Thanks Ants: May 21, 2004; #essereFerrari

Is your DNS server being changed to the one on the other end of your VPN connection?

# ¿ Dec 9, 2013 18:24

Thanks Ants: May 21, 2004; #essereFerrari

Isn't that called not using NAT?

# ¿ Dec 9, 2013 20:40

Thanks Ants: May 21, 2004; #essereFerrari

I think I might have missed something but if you want something with a bunch of switch ports on just buy a switch, and trunk it to a Mikrotik router if you want. I can't see any advantage to letting Mikrotik do switching when there's so many other established reliable options.

# ¿ Jan 15, 2014 00:49

Thanks Ants: May 21, 2004; #essereFerrari

I'd struggle to pick a switch with Mikrotik's reputation over something like an HP 1810-24G. Granted the 'tik probably has more features but at the end of the day it's a switch and reliability rules the day.

# ¿ Jan 15, 2014 02:04

Thanks Ants: May 21, 2004; #essereFerrari

Don't forget to factor in the ProCurve next-day lifetime replacement warranty if you need to do cost comparisons.

And the fact that they work, of course.

# ¿ Jan 16, 2014 14:48

Thanks Ants: May 21, 2004; #essereFerrari

If it's saved in Winbox can't you just login and change it using the CLI, or load a new config on with your new password?

# ¿ Mar 3, 2014 19:16

Thanks Ants: May 21, 2004; #essereFerrari

Any good? http://localloop.co.za/2008/10/reading-mikrotiks-winbox-addresseswbx-file-format/

# ¿ Mar 3, 2014 19:27

Thanks Ants: May 21, 2004; #essereFerrari

# ¿ Mar 3, 2014 19:43

Thanks Ants: May 21, 2004; #essereFerrari

If she doesn't have any strange requirements then get an AirPort and forget about it. They are rock solid.

# ¿ Mar 3, 2014 21:28

Thanks Ants: May 21, 2004; #essereFerrari

You're right. 2.4GHz is unusable in any sort of built-up area now.

# ¿ Mar 3, 2014 21:55

Thanks Ants: May 21, 2004; #essereFerrari

The next time someone has a go at Wi-Fi standards it needs to have a feature that can't be disabled that will ramp the Tx power down as low as it can. People in one bed apartments don't need their Wi-Fi network to be accessible 20m down the hall, it just fucks it up for everyone.

Although you will always get people who shove on bigger antennas and custom firmware to get a stupidly high Tx power because they don't understand how RF works.

# ¿ Mar 4, 2014 01:08

Thanks Ants: May 21, 2004; #essereFerrari

I expected their test setup to be a joke photo of them all shitfaced in a bar or something flipping the bird at the camera, but it almost seems like they are trying.

# ¿ Aug 15, 2014 22:12

Thanks Ants: May 21, 2004; #essereFerrari

Sounds like a possible MTU issue, but strange that it's only happening to Amazon.

# ¿ Dec 21, 2014 16:55

Thanks Ants: May 21, 2004; #essereFerrari

I think it's a leftover feature from when UPnP allowed people to share dial-up connections which were metered by the minute, so being able to disconnect remotely was reasonably useful.

# ¿ Dec 22, 2014 10:54

Thanks Ants: May 21, 2004; #essereFerrari

Just set your DNS on your local machine to Google's temporarily to rule out / confirm a DNS issue with the Mikrotik.

# ¿ Dec 23, 2014 01:22

Thanks Ants: May 21, 2004; #essereFerrari

Cisco RV130s are cheap little boxes that claim 50Mbps of IPsec.

# ¿ Jan 1, 2015 20:28

Thanks Ants: May 21, 2004; #essereFerrari

Does the bridge work if you set a static IP on the TiVo?

# ¿ Jan 9, 2015 13:03

Thanks Ants: May 21, 2004; #essereFerrari

Can you manually connect to an AP using the AirPort utility? It sounds like broadcast between LAN and WLAN isn't happening.

# ¿ Jan 10, 2015 17:17

Thanks Ants: May 21, 2004; #essereFerrari

Junos

# ¿ Mar 31, 2015 21:03

Thanks Ants: May 21, 2004; #essereFerrari

That's a tiny gap - make sure you take into account the fresnel zone when calculating line of site, there's a nice tool on the Proxim website for working out the height that you need to get each antenna at. For 150ft though it's going to be tiny.

A pair of NanoStation M5 Locos will be more than good enough, and you will have to turn the Tx on each down a lot. If you need more than 100 Mbps of real throughput then look at the ACs ^

# ¿ Apr 15, 2015 08:54

Thanks Ants: May 21, 2004; #essereFerrari

ERL does hardware acceleration I think. I'm just looking for a small device I can use to troubleshoot on sub-100Mbps networks so the EdgeRouter X will be getting ordered once it's made it over here.

# ¿ May 24, 2015 20:03

Thanks Ants: May 21, 2004; #essereFerrari

Loco M5 radios are all kinds of awesome. I've literally never had a problem with the pairs I've put up. They are as close to set-and-forget as you can be.

# ¿ Jul 15, 2015 00:18

Adbot: ADBOT LOVES YOU

# ¿ May 3, 2024 00:20

Thanks Ants: May 21, 2004; #essereFerrari

Having to run a DHCP relay would suggest that you're split across two broadcast domains for some reason. That might cause you problems in the future (service discovery, AirPlay etc.).

# ¿ Nov 30, 2015 21:09

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk

«‹›4 »