Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
CuddleChunks
Sep 18, 2004

Let's talk about the MikroTik Router Operating System!
code:

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 4.5 (c) 1999-2010       [url]http://www.mikrotik.com/[/url]

What is it? - It's a low-cost, full-featured networking platform.

How do you use it? - Download an image and install it on the compact flash card in your favorite Routerboard model or grab the x86 version and throw it on a spare PC.

What good is it? - Can't afford Cisco? MikroTik has many of the same capabilities at a fraction of the cost. Want a low-cost wireless networking platform? Add in some wireless cards and the MikroTikOS to get cheap and robust wireless solutions. Do you like Latvians? Dude, this was *written* by Latvians.

What does it look like? - You have four ways to interact with a MikroTik: telnet, ssh, Winbox and Webbox. The command-line interface gives you the most control over the unit and there are tasks that are most easily handled by using the command line. Fear not GUI friends, Winbox is there to present nearly all the same commands in a slick graphical layout. The Web interface has been updated and works nearly as well as Winbox.

Load up Winbox and enter the IP address (or MAC address) of the MikroTik you want to manage. You can save a ton of profiles here for handling an entire ISP's worth of these devices.


Once you are logged in, you are presented with a windowed interface for working with the unit. I've got the Interfaces window and the IP -> Firewall -> NAT window open. You can see some NAT rules I built to forward ports to computers on my network.


Click on the Terminal option on the left side of Winbox and you are taken to the command-line interface. I've just entered the "interface print" command to show you what a terminal session looks like.


How do I get it? - Go to http://www.mikrotik.com/ and download a demo. Play around, see if you like it. If you get hooked, you can get a RB750 5 port router/switch for $40 from http://www.roc-noc.com/mikrotik/routerboard/rb750.html It lacks a serial interface but is a solid unit for handling all kinds of routing and networking tasks. The RB750G adds gigabit ethernet ports.

Resources - The following places are great sources for more information on MikroTiks:
http://www.mikrotik.com - Their home site
http://wiki.mikrotik.com/wiki/Main_Page - Online documentation. It's pretty comprehensive.
http://forum.mikrotik.com/ - Some of the programmers of this project are active forum members. There's a lot of help to be had there for crazy networking problems. The best thread is the Bad Installation thread.
http://www.roc-noc.com/ - A place to buy MikroTikOS preinstalled to Routerboards.

Okay, but what do you really use it for? - I work for an ISP that over the last seven years has moved to use tons of MikroTik hardware. We route with them, provide hotspots, setup mesh networks, build backbones, setup AP's, setup CPE's, talk to Big Routers on the Internet with BGP and other crazy networking protocols. If we have to do something, Mikrotik is our go-to solution.

How the hell do we handle them? A mixture of monitoring systems and TheDude. It's a handy way to track lots of MikroTiks and manage them from a single interface.

I bought one for home use because I wanted to have something I was familiar with from work and because a $70 gigabit router that can speak BGP, IPSEC, handle a few thousand packets a second of throughput and all the torrenting you can throw at it without whining or requiring constant reboots was well worth my money. It's a rock solid home router, especially when you add a solid wifi access point (like an Apple Airport Extreme Basestation).

Backups - You've put time and effort into your config. You finally have all the little rules built and want to protect your work. What do you do?
- Log into your MikroTik via Winbox
- Click Files
- Click Backup
- Drag the backup file to your desktop.
You now have all the commands saved to rebuild the router froom scratch.

Starting from Scratch - If you want to start with a clean slate, open a terminal window through Winbox or log in through telnet and type: system reset Hit Y to confirm and the unit will flush the old configuration. Want to just reboot the unit? system reboot will accomplish that.

Scripting - There is a decent scripting language supported for automating tasks, responding to events and changing settings based on other input. It's handy for updating things like DynDNS entries or whatever. A buddy of mine has a ton of scripts and such built so that when he plugs in his Xbox it auto-queues his roommates down so that he can monopolize the connection. He's an rear end, but an rear end with a low ping.

Training - Remit shared this handy link to training videos from MikroTik University.


Moving from 3.x to 4.x firmware - To move from the 3.x series of firmware to the 4.x you will need to upgrade your license from the old 7 digit model to the new 8 digit model. Happily, this is super easy. If possible, upgrade your Mikrotik to 3.30 first. Then in Winbox click on System -> License -> Export Key. Save that to your desktop. Now, drop in the 4.17 firmware and reboot to upgrade. After the upgrade, log in with Winbox and you'll be greeted with a message warning that the license file has changed and would you like to upgrade to the new format? The answer is Yes. The widget that updates the MikroTik license uses your desktop to build a connection out to their servers. You *must* be able to connect to the Internet before hitting "Yes". Reboot once more and you're set with the new license. It's a good idea to update the underlying Routerboard firmware as well. Log in and type: "system router upgrade" in a terminal. Hit "y" to accept the upgrade and reboot. Now you can upgrade to the 6.x firmwares in one shot. Remember to upgrade the Routerboard firmware after you install the new RouterOS.

Update 10/8/2012: RB433's and other routerboards sometimes fail with swollen caps. There are four on the mainboard that fail so get out your soldering irons and fix your routerboards! I just got an RB433 back into operation with only a few (several) minutes work desoldering and reinstalling new capacitors. These boards are very forgiving for my clumsy soldering technique so don't be afraid to try it out. The worst you can do is make your busted routerboard totally non-bootable. Yee-haw!

:siren: Gripes :siren:
There are quirks to using these machines same as any other. Their DNS implementation is primitive as hell and doesn't let you specify custom responses for various domains. If you have an ISP that hijacks search responses this is a major nuisance.

Capacitors blow up on some models of routerboards. This causes your gear out in the field to start rebooting itself or not boot at all. It's obnoxious as hell but can be fixed by ripping off and resoldering new caps. Tedious, but fixable.

IPSEC and other heavy CPU activities murder throughput.

QoS / Queueing - what do you mean you don't understand hierarchical token buckets and the linux packet filtering table? Are you completely stupid? Ach, don't bother me with your trivial hu-man questions, I must go do many complicated things with reindeer so we can release new best gooder version of MikroTik yet! Read the wiki! (Hint: reading the wiki is confusing as poo poo). This is a feature that Mikrotiks *can* perform but getting them to gracefully prioritize packets and help you deal with scummy, bandwidth-hogging roommates is a huge pain in the rear end. It works but requires dark dark voodoo.

RB751 and Wireless - Apple products and regular wifi products sometimes poo poo the bed with RB751's. Their power settings are way out of whack, they have goofy defaults and tweaking this has become a major source of irritation for me. If you have Apple products that support 802.11n set the drat thing to N-only mode and use a WPA2 key with AES. If you have a network of mixed Apple and non-Apple devices then don't bother getting frustrated, get an Apple Airport Extreme Basestation.

Update 6/19/2014: Took out the programming guide, the new defaults work fine out of the box. Log in with a web browser and use their quick setup feature to assign an SSID and WPA key to the router, choose your wan settings and get online quickly. It's nice to see some defaults that make this more usable as a home router than before. 6.15 f/w has been released and works well.

Update 12/19/2014: Here are some settings that seem to work well for Apple products connecting to the wireless routers like RB951 and RB751:
code:
#Apple wifi helpers
/int wir set wlan1 wmm-support=enabled periodic-calibration=enabled \
hw-protection-mode=rts-cts hw-retries=15 frame-lifetime=0 \
adaptive-noise-immunity=ap-and-client-mode disconnect-timeout=00:00:15 \
distance=indoors multicast-helper=full
Universal Plug-n-Play is a handy thing at times, especially if you have an Xbox. It's not so nice if someone from the outside world messes with your router so you should filter their connection attempts.
code:
##Setup UPnP
/ip upnp interfaces add interface=ether1-gateway type=external 
/ip upnp interfaces add interface=bridge-local type=internal 
/ip upnp set enabled=yes
/ip fir fil add chain=input in-interface=ether1-gateway protocol=udp port=1900 \
    action=drop comment="remote UPnP drop"

CuddleChunks fucked around with this message at 20:17 on Dec 19, 2014

Adbot
ADBOT LOVES YOU

CuddleChunks
Sep 18, 2004

nex posted:

How big is your typical node (port/customer density)? Do you buy the boards prefabricated or do you create your own?
We buy them as half-assembled wireless CPE's where we just have to mount the board and case onto the antenna. We run a custom setup script that builds our different roles for the units and then it's time to hang the radios and wiggle them around until they are in alignment. One of the scripts actually beeps like crazy as you align it so you can use the speaker to tell you when you are pretty well dialed in for pointing back to the AP. RB411's are the mainboard in use currently.

nex posted:

How does it work compared to Cisco when it comes to field replaceable parts, redundancy and general uptime?
Our CPE's have a panel antenna, an outdoor case that mounts to the antenna, a routerboard, a wireless card (usually and Atheros), a pigtail for jumping between the card and the antenna and a second ethernet pigtail to jump to the external ethernet port. It then has a weather-resistant coupler so that the whole drat thing can be run via Power-over-Ethernet. You can replace just about every single part in there independently of any other. We've resurrected plenty of boards that burned up their little ethernet surge suppressor pigtail and just jumped them straight to the ethernet port. We've swapped radio cards in the field and done other repairs. Pretty much all of this work requires some screwdrivers and nut drivers. The other routerboard units just need a screwdriver to get into.

Cisco CPE's don't have any field replaceable parts that I'm aware of. I only have interacted with their Aironet series (350's, 1200's, 1300's) but they are all-in-one units and if they stop working you don't have any mechanism to repair them. The mikrotiks are more like a kit that you assemble into a single CPE.


nex posted:

What kind of Cisco platform did you replace?
We bought out an ISP and have ditched their oldass Aironet 350's and replaced them with Glorious MikroTiks everywhere that we possibly can. gently caress those things. Oh sure, it's cute that they can act as wireless repeaters... right up until you see someone repeating a lovely signal through other folks to rig up their network. It's ghastly.


BlackMK4 posted:

How does this compare to an Alix 2D3 or something with PFSense?
Who the gently caress uses pfSense? I kid, I kid. It would be comparable to that platform actually. However, I am not personally very well acquainted with pfSense so trying to do the things I know how to do in a mikrotik would take a lot of retraining.

An example may be helpful.

When I fire up my RB750 I am presented with 5 ethernet ports. One of which I renamed to etherWAN to make sure I could tell it apart in programming. If I want to set up a network on port 2 (port 1 is the WAN) then I would need to do the following:

- Define a set of IP addresses to use for my DHCP server
- Add a gateway address to my IP addresses to use for the server
- Setup NAT
- Setup a DHCP server
- Setup a default route (unless I'm using pppoe to get that)

That's a lot of clicking and fiddling. Like a Cisco, you impose order on a blank canvas of hardware. The default install comes with a ton of this setup but I like to work with the blank install. I started to type up the commands needed but unless you really want that level of detail I'll skip that part.

If you want to add a port forward then it's usually easiest to go this site: http://wiki.mikrotik.com/wiki/Forwarding_a_port_to_an_internal_IP and modify their command line. The command interpreter is *really* nice. It color codes commands, has tab completion and a nice parser so you only have to type partial commands.

This: interface wireless registration print
Becomes: int wir reg pr

I've heard pfSense has add-on modules and such and that's probably where you'd see the Mikrotiks start to fall short. They can forward traffic to a box for further processing but don't contain those modules themselves. Unlike a project like ClearOS that bundles a ton of packages and can add more, MikroTikOS is more of a standalone networking platform. For example it will interface with a web proxy but doesn't do that onboard.

CuddleChunks
Sep 18, 2004

NOTinuyasha posted:

I've been screwing around in Winbox for the last three hours juggling three different PPTP clients with my 750G, parting it up on thursday night as usual.
:hfive:

I laughed at my buddy who keeps tanking his mikrotik as he tries to develop more and more complicated scripts but it's fun. The fact that it auto-responds to something plugging into one of the ethernet ports is pretty drat cool.


COCKMOUTH.GIF posted:

Does the RB750G support UPnP? How would one put together some kind of wireless access with one of these? Would you have to also purchase this to do that? It seems like it has a pretty steep learning curve with WinBox compared to some of the typical consumer routers out there.
Winbox *does* have a learning curve but I've found that the documentation on their wiki has been very helpful, but I have the distinct advantage of working with these every single day at work.


COCKMOUTH.GIF posted:

Yeah I wouldn't be looking into anything that extensive. I'm just thinking of a cheap, MikroTik solution in my head that would provide a wireless AP and a routing solution in a two story house.
RB411's in outdoor cases or RB450's in indoor cases are really nice for this purpose. An RB411 is what we're using for CPE's and they have been rock solid. We even set them up as a home router type thing and they rule for PPPoE termination. An RB450 with an Atheros wireless card is going to be an expensive piece of gear but oh so beautiful and tons of power to spare.

For ultimate cheapness, $40 RB750 for routing duties and a repurposed Linksys WRT54G running DD-WRT as the wifi AP. Put on a decent antenna on the Linksys and you'll be rocking the house. Sure, it will be a 100Mbps network but those two devices alone will kick a lot of rear end. Note: that's what I have at home. :)

CuddleChunks
Sep 18, 2004

feld posted:

I have to do some VPNs between Mikrotiks and ASAs soon. We don't have this specific setup in production anywhere yet as we usually do between Mikrotiks. Anyone know if there are any pitfalls I should beware?

Keep an eye on the MTU's involved. You may want to write a static clamping rule for traffic heading over the VPN. Cisco gear loves to sit around 1300 and if you get gear between yourself and the remote end that doesn't properly handle path MTU discovery then it can get really dicey for making your VPN's move traffic. They'll establish but lag out pretty quickly due to packet corruption.

A static clamp rule is under the Mangle section of the Firewall and looks generally like:
ip firewall mangle add action=change-mss chain=forward comment="" disabled=no dst-address=1.2.3.4 new-mss=1260 protocol=tcp tcp-flags=syn

The fun comes in figuring out if you need to tie that to an interface or to an IP or whatever. Whee! I don't remember our admins complaining too much about the IPSEC VPN setup but I'm sure there's something stupid that will rear its head.

CuddleChunks
Sep 18, 2004

CubanRefugee posted:

Who'd you guys buy out? Please tell me it was Cactus...
Hahah I wish. No, this was an ISP down in the prairie region nearby. It's a constant source of nightmares because of their approach to networking. They did some seriously braindead things with setting up the gear and since none of that shows up until *after* the acquisition it's now our headache. We've expanded into cable internet as well and that's proving to be a joyful kick in the crotch as we find all sorts of messed up lines and poo poo all over the region. Wheee! Good times.



NOTinuyasha posted:

Most official documentation only covers shell configuration. It gets worse if you run a pre-release like v5. You really need background in networking to figure it all out. Basic things come preconfigured (upnp is not one of those things, if I recall).
Oh NOTinuyasha, don't worry too much about Winbox. Anypony can learn to work with it given a little time and some Friends to come and help! Why, I bet if we all put our heads together and learn to work together, we could make this Winbox reach for the stars!

Friendship (and mikrotik config) is Magic!


(but i'm not denying that it looks weird as hell at first. no doubt about that).
Would it be helpful to put together some screenshots of common tasks or something? How about a walkthrough on setting up a basic NAT-ed home network with some ports forwarded?

CuddleChunks
Sep 18, 2004

NOTinuyasha posted:

Thispony is most interested in queue trees, the official documentation is awful and I've never gotten it to work right. I'd be delighted to see some example configurations...
:cry: I'll see what I can do. I have ham-handedly helped with putting together some queueing systems and one of my coworkers is working with our other admins on learning some new hotness for queueing that will probably make all of my info obsolete.


NOTinuyasha posted:

I can see a raw beginners guide that translates common functions like 'port forwarding' into NAT/firewall entries in Winbox as useful for the thread since that sort of thing looks terribly overwhelming compared to home router UIs.
This I can do with my home unit. I'll put something together in a couple days.

CuddleChunks
Sep 18, 2004

Bumping for my new guide on how to setup a mikrotik to act like a home router with NAT-ing, port forwards and dhcp. I used Winbox for the examples to make this as easy as possible. This guide will change your life.

I haven't tackled queueing in there because it's loving black magic but I'll try and get some guidelines cobbled together soonish.

CuddleChunks
Sep 18, 2004

ClosedBSD posted:

Would this work with the RB750 series?
Also, this looks well done, but I can't help but hate you for it at the same time.

Yes, it will work just fine for the RB750. The major difference between the units is that the RB433 has a miniPCI slot with a wifi card in it and the RB750 doesn't have any such thing. Oh and the serial interface on the front of the RB433. Still, you see one more tab in my screenshots than you would on the RB750. I just didn't feel like editing shots of my home router or resetting it to defaults to build the walkthrough.

As for the walkthrough itself, yes, I understand. I'm still laughing everytime I look at it. Just wait till I get around to doing queue trees and whatnot.

Enotnert: thank you for the kind words. What's funny is that with about a dozen lines of the command line crap you can get all the same results, but for me I use Winbox all the time so I can visualize what the hell is going on. The command line is there but my CLI-fu is weak, especially when it comes to sorting and searching the results it generates.

Caged: The RB750 is cheap as hell and immediately gives you 5 sexy 100Mbps ports. 1 gets used for a WAN and the other 4 for whatever you want. The 750G has gigabit ports which is a nice reason to pay the extra money. That's the one I got and love it to death.

CuddleChunks
Sep 18, 2004

yarrmatey posted:

This is gold. I think I have a VP convinced to present this in a video conference as our new documentation standard.

Hahahah holy poo poo. My dumb little guide is going places. I suppose I should sign my work.

CuddleChunks
Sep 18, 2004

Methylethylaldehyde posted:

Does the 750G do multi-WAN worth a drat? Ideally I'd like source port based routing, along with NAT IP based routing. e.g Traffic on port 550 goes out WAN2, and anyone in the .200-.225 range also uses WAN2, but all other IPs, and all other ports use WAN1?

Easy as poo poo.

Packet marks, filter rules, zippity zap you be routing out your wan interfaces like a pro.

This is the guide: http://www.mikrotik.com/testdocs/ros/2.9/ip/route.php Policy-based routing is the section to read.

CuddleChunks
Sep 18, 2004

ruro posted:

I've heard of MikroTik before but never really looked into it. If I wanted ADSL2+ connectivity I'd need a separate modem right?

Correct.

CuddleChunks
Sep 18, 2004

Oddhair posted:

I just got a new router but I'm looking at this one here: the 750G.

It comes with a level 4 license out of the box at the $70 price point. No extra purchases needed.


For the person wanting a Mikrotik-based router and wifi AP there isn't a single product that combines the gigabit ports and wifi yet. Happily, there are rumblings that within a month they should have exactly that available for purchase. It would be worth waiting if you wanted to combine all of those features in a single mikrotik platform.

CuddleChunks
Sep 18, 2004

Weird Uncle Dave posted:

Edit: OP, you might want to put in how to remove an existing configuration from the terminal (/system reset-configuration), in case someone inherits a box whose config is unknown and they want to wipe it, but don't get the "I've just been reset" popup in the first screen of your magical walkthrough.
Good idea. Added.

CuddleChunks
Sep 18, 2004

Methylethylaldehyde posted:

Also, how much of a ratfucker is it to set of the routes using the GUI configuration tools they give you?
Route configuration is pretty easy:



Bukakke-san posted:

I have two RB133s.
What firmware are you using and what radio cards? I'm pretty sure I've seen an RB133C do WPA just fine using 3.30 f/w and an Atheros radio card. They aren't terribly happy in the 3.x f/w but will chug along okay. 4.x is a bit of a mess with 4.16 being relatively stable unless you want to log in with Winbox or look at them sideways. Then they peg to 100% and sit there until rebooted. Then again, an RB133C is a wee little platform and doesn't have nearly as much RAM and CPU as the RB411's.

yarrmatey - Thanks for the writeup!

CuddleChunks fucked around with this message at 18:59 on Mar 22, 2011

CuddleChunks
Sep 18, 2004

feld posted:

Mikrotik can't match empty ACK packets which kills its QoS potential.
QoS is pretty crazy stuff but this page has a set of rules that match ACK's just fine and has a solid set of info on how to build a tiered queue system to prioritize various traffic types over a DSL link.

http://wiki.mikrotik.com/wiki/NetworkPro_on_Quality_of_Service

I haven't done much queueing at home yet so I'll whip something up based on that guide and let you know how it works. It won't be very scientific but hey, it'll be a good learning exercise all around.


COCKMOUTH.GIF posted:

Sounds good, I'll just wait it out then. Do you have any more information on this? I'm interested in the learning experience behind the MikroTiks and it seems like they're fairly dependable.
I don't have any confirmed info yet, but my buddy at work who is our MikroTik guru is the one who's telling me about them coming out. He gets a lot of early release mikrotik stuff so he's been a good source of news. As far as how hard these are to learn I'm not sure. I have a huge advantage of being able to play with these at work every single day since we use them for routers and customer wifi gear. I get to play and learn as I go so for me, it's been a pretty easy platform to pick up. Coming to this fresh would be a little daunting but happily there are loads of guides on how to do specific tasks with these units.

CuddleChunks
Sep 18, 2004

Scaramouche posted:

my-crow-tick

This one.

CuddleChunks
Sep 18, 2004

Cool deal! We've ignored the web interface since 2.8 because of it's glorious track record of destroying the configuration of the unit. Winbox and Terminal 4 Lyfe.

CuddleChunks
Sep 18, 2004

I think we fiddled around with mesh networking on mikrotiks a few years ago. We haven't used it since then because we found that it worked but the drop in throughput wasn't acceptable for general usage. I remember there being one set of radios still in that mode and they limp along okay.

It's probably much better under the newer firmware though, especially with all the fancy new radios that are available.

CuddleChunks
Sep 18, 2004

I'm looking forward to that weirdo Omnitik thing. We've got a couple pairs of those round oddball CPE's at work and though they look like plasticy poo poo, they seem to perform okay. Their antennas are teeny tiny though so we'll have to use them for close-in work.

CuddleChunks
Sep 18, 2004

COCKMOUTH.GIF posted:

Still looks like the cheapest Gigabit router they have then is the RB435G?

The cheapest gigabit router is the RB750 for about $70. I've got one at home and it's glorious. If you mean gigabit and wireless, that's a different story. Then the model above will have both.

CuddleChunks
Sep 18, 2004

I turned off all the services except winbox because I didn't want them facing the internet. It's not a big deal I just didn't want my log to fill up with ssh bots probing the port.

As for firewall rules it's a least-permissions setup on inbound and everything allowed on outbound. If you want to change that, it's not too hard to do. The firewall interface is a little wonky at first but if you have something specific I'm sure I can dummy up an example on how to make it happen.

CuddleChunks
Sep 18, 2004

Remit posted:

Also I glanced over the OP and didnt see this:
http://mikrotikuniversity.com/index.php/mikrotik-training-videos/
Cool, thank you! Added to the OP.


American Jello posted:

Am I going to run into any issues/gotchas switching from DSL (static IP block) to a metro-e setup? I'm assuming I just unplug dsl, plug into the other modem, and adjust the IP ranges? I shouldn't need to do anything else, right? I can't start on this until later but here's my fair warning that I might be blowing up this thread in a few hours.
If you are going to another static IP block it should be just that easy. Make sure and update your addresses under IP -> Addresses, IP -> Routes and Firewall -> Mangle. Those are the main areas that hold IP's that face the WAN.

CuddleChunks
Sep 18, 2004

American Jello posted:



ugh

e:http://whois.domaintools.com/202.57.42.173

Hahhaha, I know your pain. We have hundreds of mikrotiks deployed and our logs are a sea of crap like that. Hooray for the blackhole route on our core routers. Bye bye jerks!

CuddleChunks
Sep 18, 2004

American Jello posted:

ok, one more question for tonight. I've got a sharepoint site and a staging site, and right now i'm using something similar to:


/ip dns static add name=123.com address=192.168.0.2

to resolve the internal IP. Is there a way to do this outside of DNS? My laptop users have ipconfig /flushdns once in a while. Say 123.com resolves to 123.123.123.123 externally. Can I instead do something like redirect all traffic outbound with a 123.123.123.123 destination to 192.168.0.2?

A NAT rule should do this for you. Set 123.... as the destination address and NAT traffic to that address to 192.x. Something like this:

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=192.168.0.2 \
to-ports=80 protocol=tcp dst-address=123.123.123.123 dst-port=80


That will redirect all port 80 traffic with destination address "123.123.123.123" to your internal server. I think it will work if you leave off the ports specification. I'd prefer to be specific but who knows.

CuddleChunks
Sep 18, 2004

American Jello posted:

Does anyone have any experience with this guy?
http://www.ubnt.com/unifi

We have had good luck with their nanostations (with some firmware upgrades) but haven't tried that product out yet.

CuddleChunks
Sep 18, 2004

Weird Uncle Dave posted:

Sadly, I think I can make this work, except for this part: is it possible to create a PPTP client instance and force that PPTP client to only use a specific interface

Pretty sure the answer is "no". I checked a live mikrotik and the manual: http://wiki.mikrotik.com/wiki/Manual:Interface/PPTP and see no way to bind the client to a particular interface. :( Sorry.

CuddleChunks
Sep 18, 2004

DJ Commie posted:

I'm considering running this on a laptop jammed in a waterproof case, running a Sierra Wireless 598U USB 3G modem and traffic out the LAN port on the laptop. Its an ancient Compaq Armada PIII 1GHz with 512MB RAM and an 80GB hard drive. I'd be definitely running the proxy, some QoS, DHCP, and not much more. Thoughts?

Barring any weirdness on install, this should work very nicely. The hard drive may be the weak point as it's years old and will be nearer the end of its life but no biggie. Just back up your config once you've got it stable and then when that one dies you can throw in an SSD or something and be on your way again.

CuddleChunks
Sep 18, 2004

Weird Uncle Dave posted:

I was able to get the desired effect here by putting several IPs on the "remote" box, having each PPTP client connect to a different IP, and using policy routing (to force connections to IP1 to use pppoe-out1 as its gateway, IP2 uses pppoe-out2, and so on).

Nice solution. Now document it so the next poor bastard doesn't wonder what crack you were smoking.

CuddleChunks
Sep 18, 2004

krackpot posted:

Anyone upgrade from 4.17 to 5.4?

What's the process? Backup settings, upgrade, check settings migrated correctly?

We have a few units running the 5.x series and that was exactly the process. It wasn't particularly notable now that we're past the 3.x to 4.x license thing. Ooh, I should mention that in the OP.

CuddleChunks
Sep 18, 2004

mono posted:

I'm delving into the MikroTik world and I'm having a hell of a time with port forwarding. I followed the Anypony guide and although the forwarding works fine (I started with 80 and 443 to an SBS 2011 box and I can access it from the outside no problem) it kills any outgoing traffic to 80 and 443 from inside the network. I'm wondering if I screwed something up elsewhere in Winbox, or if I'm missing something. I'm running 5.5 on an RB750G (it had the same behavior before upgrading it to 5.5). Any help is appreciated.

Open up winbox, click on New Terminal on the left.
In the terminal window type: ip fire mang export

Right-click on the window and select "Copy All". Paste that into notepad, clean out any of the boring intro crap and paste the rules you wrote here. That should give us a clear idea of what your rules look like.

CuddleChunks
Sep 18, 2004

mono posted:

Here's all I got when I did that (I X'd out part of the ID since I'm not sure if

:( oops, try: ip fir nat export

CuddleChunks
Sep 18, 2004

Those rules NAT everything hitting the ports. You need one more condition for them to trigger selectively. In my case, I put in my static IP from the WAN side so my rule looks like this:

/ip firewall nat add action=dst-nat chain=dstnat comment="" \
disabled=no dst-address=XX.XX.XX.XX dst-port=80 protocol=tcp \
to-addresses=192.168.17.3 to-ports=80


I've bolded the dst-address field to make it stand out more.

CuddleChunks
Sep 18, 2004

Arnika - they announced it in their product brochure but the release date keeps slipping. RB751G I think is the model number or something like that. It looks sexy as hell but we still have to wait for now.

CuddleChunks
Sep 18, 2004

Methylethylaldehyde posted:

Now it's time to figure out how to do multi-queue QoS on two or more connections with different link speeds and throughput caps.

Hahaha I love Mikrotiks. The very idea that you can consider doing this kind of nonsense without paying thousands of dollars is a real joy. Good luck to you!

CuddleChunks
Sep 18, 2004

ManicJason posted:

Question: We use hotspot authentication through a web interface in a couple apartment buildings we provide with wireless. The problem is game consoles. Right now the only way to get them to work is to manually plug in MAC addresses. There has to be a way to get the Mikrotiks to recognize console traffic and let it bypass authentication. I couldn't find any info though.

There is a scripting section to use for the hotspot but as far as I've ever done, I just added folks to the Bypassed section under IP Bindings. Yes, it's manual and tedious but that's what we've done at hotels and spots with Hotspot running.

The official forums may have more help in that regard since loads of folks do crazy things with their hotspot services that we haven't tried.

CuddleChunks
Sep 18, 2004

falz - We use RB1xx, RB2xx, RB4xx, RB5xx, RB7xx, RB1000's and probably a few other boards I can't remember. The RB100 series and RB411's are setup with panel antennas in little outdoor cases. For the last several years we've had them in all the nasty weather the West can throw at them and they have held up remarkably well.

It's been a very good fit for us and the extra features they offer has made them extremely powerful for building out our network.

CuddleChunks
Sep 18, 2004

American Jello posted:

e: would changing it to 10.0.1.0/25 be a good idea? That should keep the range between 10.0.1.128 and 10.0.1.255
Bad idea.

If you do an ipconfig on your vpn-connected computer what IP address do you get? What does it show for the gateway? Can you ping that? Can you ping any of the machines within that subnet (assuming they are pingable)?

Your initial config looks like you're on a different network than the other machines assuming a /24 subnet. Now, with you in the same subnet things should be much better. One curiosity, what's the IP address you have on the machine before bringing up PPTP? I want to make sure you're in a 192.168.x range or something like that so that your computer knows where to send packets.

CuddleChunks
Sep 18, 2004

I just set this up at home as a test. Follow the instructions in the Mikrotik Wiki and make sure you are in the same network range as your other network devices AND that you setup Proxy-ARP on the ethernet interface hosting those other connections. That's the missing step I needed in order to start talking to machines on my remote LAN.

code:
[admin@RemoteOffice] /interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] /interface ethernet> print
Flags: X - disabled, R - running
  #    NAME                 MTU   MAC-ADDRESS         ARP
  0  R ether1              1500  00:30:4F:0B:7B:C1 enabled
  1  R ether2              1500  00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>
That's pasted from the wiki.

CuddleChunks
Sep 18, 2004

Under XP it didn't show any gateway on my machine either, just the assigned IP and netmask.

Adbot
ADBOT LOVES YOU

CuddleChunks
Sep 18, 2004

krackpot posted:

5.7 Released.
Changelog: http://www.mikrotik.com/download/CHANGELOG_5

This is particularly interesting:
*) improved ipv4 forwarding performance on all boards with simple configuration
by up to 30%;

"All boards now run on PixiedustOS and use unicorn hooves to improve throughput by 200% over prior models. Do not look directly at Routerboards during assembly or warranty will be void."

I swear they have some creepy magic poo poo going on with these things sometimes. Still, that's cool as hell to read. I wonder what bottleneck they found and fixed.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply