More for Less: MikroTik Talk

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk

movax: Aug 30, 2008

SamDabbers posted:

Where is it failing? Can you successfully connect but not pass traffic, or is the Shrew Soft client unable to connect at all?

You should allow at least UDP/500 and UDP/4500 (and probably protocol 50 - ESP) on the INPUT chain for IPsec to work. You'll probably also need some rules in the FORWARD chain to allow the VPN pool subnet to talk to the internal network and vice-versa.

Maybe post your sanitized config so we can take a look?

Yeah, I can't connect at all, but I don't have those rules set up either on the INPUT chain. Tried adding them to the input chain as such:

code:

[admin@MikroTik] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     chain=input action=accept protocol=icmp 

 1   ;;; default configuration
     chain=input action=accept connection-state=established 

 2   ;;; default configuration
     chain=input action=accept connection-state=related 

 3   ;;; IPSec
     chain=input action=accept protocol=udp dst-port=500 

 4   chain=input action=accept protocol=ipsec-esp 

 5   chain=input action=accept protocol=udp dst-port=4500 

 6   ;;; Outside_access
     chain=input action=accept protocol=tcp dst-port=8291 

 7   ;;; default configuration
     chain=forward action=accept connection-state=established 

 8   ;;; default configuration
     chain=forward action=accept connection-state=related 

 9   ;;; default configuration
     chain=input action=drop in-interface=ether1-gateway 

10   ;;; default configuration
     chain=forward action=drop connection-state=invalid

Still getting a negotiation timeout from ShrewSoft.

# ? Jan 2, 2014 04:53

Adbot: ADBOT LOVES YOU

# ? Apr 25, 2024 02:22

SamDabbers: May 26, 2003

Bob Morales posted:

We've been using an ancient Adtran 1224R ...

Does the $99 rb2011il seem like the perfect replacement or what? Basically needs to just do NAT and DHCP for about 200 devices and handle peaking out the connection without freezing up.

The RB2011iL should be able to handle that. Consider getting the RB2011UiAS for the additional memory, which would allow for more concurrent TCP connections.

The Ubiquiti EdgeRouter Lite is another option worth considering for the same $99. It has 512MB RAM, hardware acceleration for packet forwarding (they claim 1Mpps) and IPsec, and the OS is a fork of Vyatta.

movax posted:

Yeah, I can't connect at all, but I don't have those rules set up either on the INPUT chain. Tried adding them to the input chain as such:

Still getting a negotiation timeout from ShrewSoft.

Try turning on logging for IPsec on the Mikrotik and see if anything interesting shows up in the logs when you're attempting to connect. Also, check that the encryption and hash algorithms match on both sides for both phases.

code:

/system logging add topics=ipsec action=memory disabled=no

Could you post a sanitized (no pre-shared keys, usernames/passwords, or public IPs) export for the IPsec section?

code:

/ip ipsec export verbose

SamDabbers fucked around with this message at 05:28 on Jan 2, 2014

# ? Jan 2, 2014 05:12

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

I have a Procurve with this config:

code:

snmp-server contact "test@test.com" 
max-vlans 128 
time timezone -8 
interface 1 
  name "To World" 
exit
interface 2 
  name "Test" 
exit
ip default-gateway test.gateway.ip.here
sntp server ip.ip.ip.ip 
ip routing 
timesync sntp 
sntp unicast 
snmp-server community "test_public" Unrestricted 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged 1,3-50 
  ip address test.router.ip.here 255.255.255.240 
  no untagged 2 
exit 
vlan 8 
  name "Test" 
  untagged 2 
  tagged 1 
exit 
ip route 0.0.0.0 0.0.0.0 test.gateway.ip.here 
management-vlan 1

I am trying to set up a Mikrotik Cloud Router to do the exact same.

I've gotten most of this to work due to sheer poking around on the router, but I am curious what is the tagged/untagged equivalent command on Mikrotiks?

# ? Jan 8, 2014 06:08

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

Got our Mikrotik RB2011U or whatever in.

Feels super cheap and lighter than the cardboard box that it comes in. If you tied a balloon to it, it would float away.

That said the web interface is pretty kick rear end and it held up overnight to 65Mbs+ worth of torrents and random downloads. The touch screen was a little weird at first but being able to swipe through the list of interfaces and see the traffic graph for each one is pretty neat.

# ? Jan 8, 2014 14:15

zennik: Jun 9, 2002

jeeves posted:

I have a Procurve with this config:
code:
snmp-server contact "test@test.com" 
max-vlans 128 
time timezone -8 
interface 1 
  name "To World" 
exit
interface 2 
  name "Test" 
exit
ip default-gateway test.gateway.ip.here
sntp server ip.ip.ip.ip 
ip routing 
timesync sntp 
sntp unicast 
snmp-server community "test_public" Unrestricted 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged 1,3-50 
  ip address test.router.ip.here 255.255.255.240 
  no untagged 2 
exit 
vlan 8 
  name "Test" 
  untagged 2 
  tagged 1 
exit 
ip route 0.0.0.0 0.0.0.0 test.gateway.ip.here 
management-vlan 1 
I am trying to set up a Mikrotik Cloud Router to do the exact same.

I've gotten most of this to work due to sheer poking around on the router, but I am curious what is the tagged/untagged equivalent command on Mikrotiks?

There are two ways to accomplish this.
You can either do it via bridge groups(will potentially limit your potential throughput). Or you can do it through the switch chip.

If you want to do it through the switch chip, there's a little bit of work behind it.
You have to slave all of the ports to one master port, and then you ingress/egress VLAN translation for port defaults.
For tagged VLANs, you need to use 'VLAN Tagging' to tag it on a particular port.
This is, in my opinion, more easily done through Winbox since it gives a better visual representation of what is going on.

# ? Jan 10, 2014 01:19

zennik: Jun 9, 2002

Here's an example config using the switch chip.
In this example, we take Ether 1-8 and slave them together. We then setup ether2-8 to use VLAN 100 as the port default.
We go on the ingress and tell it everything coming over VLAN 0(default, no vlan, untagged) is going to instead go out into the switch-chip as VLAN 100
Then we do the reverse for the egress: Tell it everything on Switch-chip VLAN 100 is going to come out of those ports on VLAN 0. I then tag vlan 100 on Ether1 to use that as an uplink
Once all that is done, I go in, create my VLAN interface for the actual RouterOS to communicate with, and assign an IP to it.

EDIT: This config is designed and tested on a Mikrotik CRS. I have not tested this config on any other Routerboard yet.

code:

/interface ethernet
set ether2 master-port=ether1
set ether3 master-port=ether1
set ether4 master-port=ether1
set ether5 master-port=ether1
set ether6 master-port=ether1
set ether7 master-port=ether1
set ether8 master-port=ether1

/interface ethernet switch ingress-vlan-translation
add port=ether2 customer-vid=0 new-customer-vid=100
add port=ether3 customer-vid=0 new-customer-vid=100
add port=ether4 customer-vid=0 new-customer-vid=100
add port=ether5 customer-vid=0 new-customer-vid=100
add port=ether6 customer-vid=0 new-customer-vid=100
add port=ether7 customer-vid=0 new-customer-vid=100
add port=ether8 customer-vid=0 new-customer-vid=100

/interface ethernet switch egress-vlan-translation
add port=ether2 customer-vid=100 new-customer-vid=0
add port=ether3 customer-vid=100 new-customer-vid=0
add port=ether4 customer-vid=100 new-customer-vid=0
add port=ether5 customer-vid=100 new-customer-vid=0
add port=ether6 customer-vid=100 new-customer-vid=0
add port=ether7 customer-vid=100 new-customer-vid=0
add port=ether8 customer-vid=100 new-customer-vid=0

/interface ethernet switch egress-vlan-tag
add tagged-ports=ether1 vlan-id=100

/interface vlan
add interface=ether1 l2mtu=1584 name=v100-e1 vlan-id=100

/ip address
add address=10.0.0.1/24 interface=v100-e1

zennik fucked around with this message at 01:47 on Jan 10, 2014

# ? Jan 10, 2014 01:31

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

I'm pretty new with Mikrotik + VLANs, so thanks for the help. I basically got dumped this project from my lead engineer who has years experience with Cisco/Procurve type stuff, and he said "Figure out VLANs on Mikrotik because I don't want to!"

Here's what I did with bridges to get ether1 connected to a VLAN1 out to the internet:

code:

/interface bridge 
add name=br-vlan1
/interface bridge port
add bridge=br-vlan1 interface=ether1

/interface vlan
add interface=br-vlan1 name=vlan1 vlan-id=1

/ip address
add address=<VLAN1.IP>/28 interface=br-vlan1 network=<VLAN1.NETWORK>

/ip route 
add distance=1 gateway=<VLAN1.GATEWAY>

But I kind of hit that brick wall with tagging, as I need to make ether2 connect to a VLAN8 through VLAN1/ether1.

I'll look into the switching thing, but I'm still trying to wrap my head around doing tagging/untagging with all of this.

Edit- Talked to the guy who dumped this on me, and it looks like the Procurves he uses only ever use one trunk/upstream port. So doing the hardware switching is probably the way to go.

jeeves fucked around with this message at 21:46 on Jan 10, 2014

# ? Jan 10, 2014 20:13

zennik: Jun 9, 2002

If you want, draw up a basic rundown of how you want it configured and I can help you with a config.

jeeves posted:

I'm pretty new with Mikrotik + VLANs, so thanks for the help. I basically got dumped this project from my lead engineer who has years experience with Cisco/Procurve type stuff, and he said "Figure out VLANs on Mikrotik because I don't want to!"

Here's what I did with bridges to get ether1 connected to a VLAN1 out to the internet:
code:
/interface bridge 
add name=br-vlan1
/interface bridge port
add bridge=br-vlan1 interface=ether1

/interface vlan
add interface=br-vlan1 name=vlan1 vlan-id=1

/ip address
add address=<VLAN1.IP>/28 interface=br-vlan1 network=<VLAN1.NETWORK>

/ip route 
add distance=1 gateway=<VLAN1.GATEWAY> 
But I kind of hit that brick wall with tagging, as I need to make ether2 connect to a VLAN8 through VLAN1/ether1.

I'll look into the switching thing, but I'm still trying to wrap my head around doing tagging/untagging with all of this.

Edit- Talked to the guy who dumped this on me, and it looks like the Procurves he uses only ever use one trunk/upstream port. So doing the hardware switching is probably the way to go.

# ? Jan 11, 2014 22:34

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

zennik posted:

If you want, draw up a basic rundown of how you want it configured and I can help you with a config.

Basically I need to have this set up:

- ether1, and ether3-ether8 on VLAN id 1, with this VLAN being the gateway/upstream/trunk. I already figured this out via my usage of bridging in my above code, but since there will only be one upstream/trunk per CloudRouter, using the hardware switching is probably better. (This is because these CR are being prepped to replace the more expensive/older Procurve units). Port one has a IP address of the router, and the upstream won't connect unless it is on VLAN1.

- ether2 has another VLAN, in this instance VLAN id 8. It is to be the downstream routed VLAN to a customer, specifically with a /30.

They want more after this (a /29 hanging off of that /30), but I want to try to wrap my head around this before going further. I think once I figure out the translation of tagging to mikrotiks I can probably figure out the rest.

Here's the exact procurve setup that this Mikro is supposed to emulate (with the snmp crap taken out this time) :

code:

max-vlans 128 
interface 1 
  name "To World" 
exit
interface 2 
  name "To customer" 
exit
ip default-gateway 123.123.123.247
ip routing 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged 1,3-8
  ip address 123.123.123.254 255.255.255.240 
  no untagged 2 
exit 
vlan 8 
  name "Test" 
  untagged 2 
  tagged 1 
exit 
ip route 0.0.0.0 0.0.0.0 123.123.123.247 
management-vlan 1

btw thanks in advance, you've been extremely helpful in me trying to figure this out.

jeeves fucked around with this message at 03:21 on Jan 12, 2014

# ? Jan 12, 2014 03:19

zennik: Jun 9, 2002

Not a problem. Also, just to verify, what model Mikrotik is this?

jeeves posted:

Basically I need to have this set up:

- ether1, and ether3-ether8 on VLAN id 1, with this VLAN being the gateway/upstream/trunk. I already figured this out via my usage of bridging in my above code, but since there will only be one upstream/trunk per CloudRouter, using the hardware switching is probably better. (This is because these CR are being prepped to replace the more expensive/older Procurve units). Port one has a IP address of the router, and the upstream won't connect unless it is on VLAN1.

- ether2 has another VLAN, in this instance VLAN id 8. It is to be the downstream routed VLAN to a customer, specifically with a /30.

They want more after this (a /29 hanging off of that /30), but I want to try to wrap my head around this before going further. I think once I figure out the translation of tagging to mikrotiks I can probably figure out the rest.

Here's the exact procurve setup that this Mikro is supposed to emulate (with the snmp crap taken out this time) :
code:
max-vlans 128 
interface 1 
  name "To World" 
exit
interface 2 
  name "To customer" 
exit
ip default-gateway 123.123.123.247
ip routing 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged 1,3-8
  ip address 123.123.123.254 255.255.255.240 
  no untagged 2 
exit 
vlan 8 
  name "Test" 
  untagged 2 
  tagged 1 
exit 
ip route 0.0.0.0 0.0.0.0 123.123.123.247 
management-vlan 1 
btw thanks in advance, you've been extremely helpful in me trying to figure this out.

# ? Jan 12, 2014 03:48

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

CloudRouter Switch. I left it at work, but I can get a complete model number on Monday, but I think all CRS are somewhat the same, RouterOS functionality-wise, right?

# ? Jan 12, 2014 05:11

zennik: Jun 9, 2002

jeeves posted:

CloudRouter Switch. I left it at work, but I can get a complete model number on Monday, but I think all CRS are somewhat the same, RouterOS functionality-wise, right?

Correct. I'll work on this later this afternoon and get that pasted here for you.

# ? Jan 13, 2014 18:15

Wolf on Air: Dec 31, 2004; Combat Instructor
Armed Forces, Time-Space Administration Bureau

I recently heard from a friend who has a CRS that they couldn't get VLAN poo poo working on it properly at all (leaking traffic all over), and after a while Mikrotik support told him that they hadn't actually gotten around to implementing all the parts in the backend that are exposed in the UI, so what happens is, the function for not forwarding prohibited traffic (or whatever he meant, I'm not actually sure) to all VLANs is working, but not the associating-ports-with-VLANs part, so if you do that, you're going to lose all connectivity.

Typical Mikrotik behaviour.

# ? Jan 14, 2014 22:35

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

Wolf on Air posted:

I recently heard from a friend who has a CRS that they couldn't get VLAN poo poo working on it properly at all (leaking traffic all over), and after a while Mikrotik support told him that they hadn't actually gotten around to implementing all the parts in the backend that are exposed in the UI, so what happens is, the function for not forwarding prohibited traffic (or whatever he meant, I'm not actually sure) to all VLANs is working, but not the associating-ports-with-VLANs part, so if you do that, you're going to lose all connectivity.

Typical Mikrotik behaviour.

Well, that is disheartening, especially since a whole bunch of CRS purchases for my company are basically hinging on me figuring out this VLAN stuff ASAP-- even though I've already heard from 2 other people in person that "Mikrotiks are great... for everything other than VLANs."

Is there anything in writing from Mikrotik forums or such about this issue that I can present to my superiors about this?

# ? Jan 14, 2014 23:58

Thanks Ants: May 21, 2004; #essereFerrari

I think I might have missed something but if you want something with a bunch of switch ports on just buy a switch, and trunk it to a Mikrotik router if you want. I can't see any advantage to letting Mikrotik do switching when there's so many other established reliable options.

# ? Jan 15, 2014 00:49

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

I was going to say the same thing, then realized that 'cheap copper gig ports' is the reason for tikswitch.

# ? Jan 15, 2014 01:28

Thanks Ants: May 21, 2004; #essereFerrari

I'd struggle to pick a switch with Mikrotik's reputation over something like an HP 1810-24G. Granted the 'tik probably has more features but at the end of the day it's a switch and reliability rules the day.

# ? Jan 15, 2014 02:04

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

falz posted:

I was going to say the same thing, then realized that 'cheap copper gig ports' is the reason for tikswitch.

This is the reason my job (a local ISP branching out into heavy wireless infrastructure work) wants to use Mikrotik-- cheap gigabit switch that can maybe do router things. Basically they're trying to stop relying on Procurve 2980s and such.

# ? Jan 15, 2014 02:41

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

jeeves posted:

This is the reason my job (a local ISP branching out into heavy wireless infrastructure work) wants to use Mikrotik-- cheap gigabit switch that can maybe do router things. Basically they're trying to stop relying on Procurve 2980s and such.

Let's just stop you right there and save the trouble- switch to Ubiquiti for all of your bridges+p2mp stuff, use Cisco switches - 2950g are $40 (100mb ports) or 4948 ($800) / 2970g ($300) if you need gig copper. 3560-poe are only $250ish too and can power RocketM5-Ti nicely for p2p or sectors. For routing, some Cisco 3825 ($200 w/ 1gig ram). You'll be in much better shape than replacing all your tik poo poo in a year after lots of pain.

Prices are ebay-style.

# ? Jan 16, 2014 00:14

SamDabbers: May 26, 2003

falz posted:

Let's just stop you right there and save the trouble- switch to Ubiquiti for all of your bridges+p2mp stuff, use Cisco switches - 2950g are $40 (100mb ports) or 4948 ($800) / 2970g ($300) if you need gig copper. 3560-poe are only $250ish too and can power RocketM5-Ti nicely for p2p or sectors. For routing, some Cisco 3825 ($200 w/ 1gig ram). You'll be in much better shape than replacing all your tik poo poo in a year after lots of pain.

Prices are ebay-style.

This is very, very good advice. You will have a far easier time managing your network without having to deal with Mikrotik's notoriously buggy implementations. I will also add that switches should switch, routers should route, and wireless bridges should wirelessly bridge; there are always compromises with combo devices.

The older Cisco gear requires quite a bit more power though. There are stable, lower-power options out there for switching and routing if your power budget at your POPs/towers won't support that kind of load. Of course, you sacrifice some functionality by not going with Cisco, since IOS supports everything you could possibly want to do with a network, but that doesn't matter if your design doesn't need those features.

# ? Jan 16, 2014 01:04

zennik: Jun 9, 2002

Sorry for the delay, here's a config that should accomplish what you want.
Also, they aren't incorrect in their suggestions on using a better switch.
The CRS is a work in progress and not all the features on the switch-chip work, as of yet.
That being said, if you aren't having any issues as of right now with throughput(ie, you should be fine up to around 200-300 megabit), then sticking with the bridge group is the safest bet for the time being.

code:

/interface ethernet
set ether2 master-port=sfp1
set ether3 master-port=sfp1
set ether4 master-port=sfp1
set ether5 master-port=sfp1
set ether6 master-port=sfp1
set ether7 master-port=sfp1
set ether8 master-port=sfp1

/interface ethernet switch ingress-vlan-translation
add port=ether1 customer-vid=0 new-customer-vid=1
add port=ether2 customer-vid=0 new-customer-vid=8
add port=ether3 customer-vid=0 new-customer-vid=1
add port=ether4 customer-vid=0 new-customer-vid=1
add port=ether5 customer-vid=0 new-customer-vid=1
add port=ether6 customer-vid=0 new-customer-vid=1
add port=ether7 customer-vid=0 new-customer-vid=1
add port=ether8 customer-vid=0 new-customer-vid=1

/interface ethernet switch egress-vlan-translation
add port=ether1 customer-vid=1 new-customer-vid=0
add port=ether2 customer-vid=8 new-customer-vid=0
add port=ether3 customer-vid=1 new-customer-vid=0
add port=ether4 customer-vid=1 new-customer-vid=0
add port=ether5 customer-vid=1 new-customer-vid=0
add port=ether6 customer-vid=1 new-customer-vid=0
add port=ether7 customer-vid=1 new-customer-vid=0
add port=ether8 customer-vid=1 new-customer-vid=0

/interface ethernet switch egress-vlan-tag
add tagged-ports=ether2 vlan-id=8

/interface vlan
add interface=ether2 name=v1-e2 vlan-id=1

/ip address
add address=123.123.123.254/28 interface=v1-e2

/ip route
add distance=1 gateway=123.123.123.247

# ? Jan 16, 2014 05:20

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

Thanks for the code, zennik. It's really helpful to have some sort of starting code to work with to show my superiors on this project instead of just being like "well I couldn't really get it to work but everyone says it sucks anyhow so lets just keep using Mikrotiks for just the small stuff like routers in front of customers' office ports and or switches off of wireless points of presence"

And yeah, this whole project is basically my superiors wow'd by how cheap RB750s are for small things, and "Oh gently caress they make CRS now for only $200? We should replace ALL OF OUR PROCURVES WITH THESE DUE TO $$$$$$$$$$" which is a bit scary to me.

# ? Jan 16, 2014 06:12

Thanks Ants: May 21, 2004; #essereFerrari

Don't forget to factor in the ProCurve next-day lifetime replacement warranty if you need to do cost comparisons.

And the fact that they work, of course.

# ? Jan 16, 2014 14:48

zennik: Jun 9, 2002

jeeves posted:

Thanks for the code, zennik. It's really helpful to have some sort of starting code to work with to show my superiors on this project instead of just being like "well I couldn't really get it to work but everyone says it sucks anyhow so lets just keep using Mikrotiks for just the small stuff like routers in front of customers' office ports and or switches off of wireless points of presence"

And yeah, this whole project is basically my superiors wow'd by how cheap RB750s are for small things, and "Oh gently caress they make CRS now for only $200? We should replace ALL OF OUR PROCURVES WITH THESE DUE TO $$$$$$$$$$" which is a bit scary to me.

Having worked with people like that in the past, for nearly 8 years... I can say without a doubt that if that is their mentality, then prepare to become very well versed in Mikrotiks.
Yes, ProCurves and similar switches would be nicer... but unless you have to meet some kind of compliance standards as far as security... well, the bleedover that occasionally happens when doing VLANs in Mikrotiks is fairly manageable. Just understand that especially on the RB750, your CPU is limited. Pick the right Routerboard for the right deployment.

# ? Jan 17, 2014 01:46

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

I couldn't get the above switch code to work, probably because I failed to mention that ether1 was going to be the trunk port that VLAN1 was going through.

I got the trunk port to work with bridging at least, I just need to figure out if ingress/egress-vlan-translation and tagged-ports for vlan-ids work with bridging. Or maybe just try to convert the below to switch code versus bridge code

Here's the bridge code that I used to get ether1 on VLAN1 and out to see the world, but now I need ether2 on VLAN8 to see the world through VLAN1/ether1:

code:

/interface bridge 
add name=br-vlan1
/interface bridge port
add bridge=br-vlan1 interface=ether1

/interface vlan
add interface=br-vlan1 name=vlan1 vlan-id=1

/ip address
add address=IP.IP.IP.254/28 interface=br-vlan1 network=IP.IP.IP.240

/ip route 
add distance=1 gateway=IP.IP.IP.241

Edit: then I used the same code to try to get the same working for VLAN8 via Ether2:

code:

/interface bridge 
add name=br-vlan8
/interface bridge port
add bridge=br-vlan8 interface=ether2

/interface vlan
add interface=br-vlan8 name=vlan1 vlan-id=8

However now I just need to figure out how to get VLAN2/ether2 to use VLAN1/ether1 as a gateway, and then I can hang a computer off of ether2 with a VLAN8 static IP.IP.IP.42/30 with gateway of IP.IP.IP.41 and it should see out as well.

jeeves fucked around with this message at 20:13 on Jan 17, 2014

# ? Jan 17, 2014 19:31

mAlfunkti0n: May 19, 2004; Fallen Rib

So I have a new setup to work with for a client. I picked up an RB750 and a Unifi AP. One of the requirements is that we block access to all web traffic except a couple of sites, no problem .. so I thought.

Using the web proxy as normal, however, one of the pages is HTTPS and will not load. Is there any way to allow this site?

# ? Jan 28, 2014 00:19

zennik: Jun 9, 2002

mAlfunkti0n posted:

So I have a new setup to work with for a client. I picked up an RB750 and a Unifi AP. One of the requirements is that we block access to all web traffic except a couple of sites, no problem .. so I thought.

Using the web proxy as normal, however, one of the pages is HTTPS and will not load. Is there any way to allow this site?

I've never done this using a proxy, but I know you can set up firewall rules to block all traffic except Layer7 protocols you specify. I use this to block facebook and google apps and such, but you could do the reverse, block all EXCEPT for the patterns you specify.

# ? Jan 28, 2014 00:39

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

Oh hey, this thread.

I got my issue to work with VLANs, basically I had to set up a bridge to get the router itself to have an IP address to log in through, and then had to set up a switch code to have the vlans trunk through the main port.

# ? Jan 28, 2014 00:43

mAlfunkti0n: May 19, 2004; Fallen Rib

zennik posted:

I've never done this using a proxy, but I know you can set up firewall rules to block all traffic except Layer7 protocols you specify. I use this to block facebook and google apps and such, but you could do the reverse, block all EXCEPT for the patterns you specify.

Ahh, I will check this out. Thanks!

# ? Jan 28, 2014 00:44

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

Next Mikrotik quandry: is it possible to have multiple networks share one trunk?

Currently I have like 3 Mikrotiks, each feeding a different office. So each Mikrotik has a single upstream (with an individual network IP) and 4 DHCP addresses.

I'm trying to consolidate these Mikrotiks into a single Cloudrouter-- my gut tells me they can all share a single upstream, but I know the easiest way to do this is to make a dedicated upstream for each of the consolidated Mikrotiks in the CRS.

Basically instead of:

code:

1 upstream upstream port (10.0.0.1) -> router -> 4 DHCP downstream ports (192.168.1.x)

code:

1 upstream port (10.0.0.1, 10.0.0.2, 10.0.0.3) -> router -> 3x 4 DHCP downstream ports(192.168.1.x, 192.168.2.x, 192.168.3.x)

I am guessing the combining of 3 network upstream IDs into one upstream can't be done, or am I missing something basic? I know I can easily just do 3x of the former in the CRS, with each little sub-network having their own upstream to emulate an old 5 port mikrotik, but I thought I might ask if I can squeeze a few more ports out of each CRS.

jeeves fucked around with this message at 00:48 on Feb 4, 2014

# ? Feb 4, 2014 00:44

kiwid: Sep 30, 2013

jeeves posted:

Next Mikrotik quandry: is it possible to have multiple networks share one trunk?

Currently I have like 3 Mikrotiks, each feeding a different office. So each Mikrotik has a single upstream (with an individual network IP) and 4 DHCP addresses.

I'm trying to consolidate these Mikrotiks into a single Cloudrouter-- my gut tells me they can all share a single upstream, but I know the easiest way to do this is to make a dedicated upstream for each of the consolidated Mikrotiks in the CRS.

Basically instead of:
code:
1 upstream upstream port (10.0.0.1) -> router -> 4 DHCP downstream ports (192.168.1.x)
to
code:
1 upstream port (10.0.0.1, 10.0.0.2, 10.0.0.3) -> router -> 3x 4 DHCP downstream ports(192.168.1.x, 192.168.2.x, 192.168.3.x)
I am guessing the combining of 3 network upstream IDs into one upstream can't be done, or am I missing something basic? I know I can easily just do 3x of the former in the CRS, with each little sub-network having their own upstream to emulate an old 5 port mikrotik, but I thought I might ask if I can squeeze a few more ports out of each CRS.

Maybe I'm misunderstanding your post but what you're describing is exactly vlans.

# ? Feb 4, 2014 01:42

jeeves: May 27, 2001; Deranged Psychopathic
Butler Extraordinaire

kiwid posted:

Maybe I'm misunderstanding your post but what you're describing is exactly vlans.

It's been a long day and I guess I didn't know how to describe what I was looking for, especially since I know gently caress all about VLANs (as my previous posts show). I basically want to try to compress a bunch of other smaller RB750s into one CloudRouter, but save as many ports as I can by having only one WAN port on the CRS instead of one per RB750. The sub networks that the RB750s used to be on need to stay completely different (hence the easy but dumb solution of preserving the old RB750s' WAN ports on the CRS), but I figure I'd try to save some ports and have only one WAN port.

If I was breaking all of the small networks (with their own WAN IPs) into a VLANs from the shared WAN port, how would I get it to route the traffic to specific subnets?

Basically I currently have a managed switch giving out IPs, which go down to individual WAN ports on a bunch of RB750s. The RB750s then split those off into DHCP internal IPs for the office jacks that it serves (one RB per office). I'm trying to consolidate all of those RBs into one CRS, with maybe just one WAN port, but no VLAN trunking pushed down from the original managed switch.

I may be describing this incorrectly, as by the end of today I couldn't even get the CRS to route traffic from a WAN port to a bunch of NAT'd DHCP ports (trying it the dumb way of having one WAN per subnet), even though the setup was pretty much mirroring what I do on a working office upstream RB750s. So yeah, I may be missing something simple here.

edit - I should probably take this quandry to a networking thread, as it is more general VLAN planning than Mikrotik specific.

jeeves fucked around with this message at 17:03 on Feb 4, 2014

# ? Feb 4, 2014 05:35

ssergE: Sep 10, 2001; No longer a stupid baby. Now a stupid teenager.

Hi

I recently got a RB951G-2HnD (running 6.9) and am loving it. Just using it for basic home usage.
I have an OpenVPN that I have running an a VPS that I use to watch Netflix in Australia. Previously I had a router running TomatoUSB with an OpenVPN client, and all was well.

I was wondering if it would be possible to have the RB configured so that interfaces [1-3] are the standard home setup, with interface 4 routing everything over the OpenVPN, including DNS requests. Therefore I will only have to switch which ethernet port my PS4 is in to go on the VPN or not.

I've managed to configure my OpenVPN client successfully, and it connects and maintains connection. The rest eludes me as networking is not my strong point.

My current configuration is as follows:

code:

[admin@MikroTik] > int pr         
Flags: D - dynamic, X - disabled, R - running, S - slave 
 #     NAME                                TYPE         MTU L2MTU  MAX-L2MTU
 0  R  ether1-gateway                      ether       1500  1598       4074
 1  RS ether2-master-local                 ether       1500  1598       4074
 2  RS ether3-slave-local                  ether       1500  1598       4074
 3  RS ether4-slave-local                  ether       1500  1598       4074
 4   S ether5-slave-local                  ether       1500  1598       4074
 5  RS wlan1                               wlan        1500  2290
 6  R  bridge-local                        bridge      1500  1598
 7  R  xxxxxxxxxx-com-vpn                  ovpn-out    1500

[admin@MikroTik] > ip route print 
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 ADS  0.0.0.0/0                          10.10.104.1               1
 1  DS  0.0.0.0/0                          10.8.0.1                  1
 2 ADC  10.8.0.1/32        10.8.0.6        xxxxxxxxxx-com-vpn        0
 3 ADC  10.10.104.0/23     10.10.104.89    ether1-gateway            0
 4 ADC  192.168.88.0/24    192.168.88.1    bridge-local              0

[admin@MikroTik] > ip ad pr       
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         INTERFACE                                
 0   ;;; default configuration
     192.168.88.1/24    192.168.88.0    ether2-master-local                      
 1 D 10.10.104.89/23    10.10.104.0     ether1-gateway                           
 2 D 10.8.0.6/32        10.8.0.1        xxxxxxxxxx-com-vpn

Thanks for any help.

# ? Feb 8, 2014 05:05

zennik: Jun 9, 2002

ssergE posted:

Hi

I recently got a RB951G-2HnD (running 6.9) and am loving it. Just using it for basic home usage.
I have an OpenVPN that I have running an a VPS that I use to watch Netflix in Australia. Previously I had a router running TomatoUSB with an OpenVPN client, and all was well.

I was wondering if it would be possible to have the RB configured so that interfaces [1-3] are the standard home setup, with interface 4 routing everything over the OpenVPN, including DNS requests. Therefore I will only have to switch which ethernet port my PS4 is in to go on the VPN or not.

I've managed to configure my OpenVPN client successfully, and it connects and maintains connection. The rest eludes me as networking is not my strong point.

My current configuration is as follows:
code:
[admin@MikroTik] > int pr         
Flags: D - dynamic, X - disabled, R - running, S - slave 
 #     NAME                                TYPE         MTU L2MTU  MAX-L2MTU
 0  R  ether1-gateway                      ether       1500  1598       4074
 1  RS ether2-master-local                 ether       1500  1598       4074
 2  RS ether3-slave-local                  ether       1500  1598       4074
 3  RS ether4-slave-local                  ether       1500  1598       4074
 4   S ether5-slave-local                  ether       1500  1598       4074
 5  RS wlan1                               wlan        1500  2290
 6  R  bridge-local                        bridge      1500  1598
 7  R  xxxxxxxxxx-com-vpn                  ovpn-out    1500

[admin@MikroTik] > ip route print 
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 ADS  0.0.0.0/0                          10.10.104.1               1
 1  DS  0.0.0.0/0                          10.8.0.1                  1
 2 ADC  10.8.0.1/32        10.8.0.6        xxxxxxxxxx-com-vpn        0
 3 ADC  10.10.104.0/23     10.10.104.89    ether1-gateway            0
 4 ADC  192.168.88.0/24    192.168.88.1    bridge-local              0

[admin@MikroTik] > ip ad pr       
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         INTERFACE                                
 0   ;;; default configuration
     192.168.88.1/24    192.168.88.0    ether2-master-local                      
 1 D 10.10.104.89/23    10.10.104.0     ether1-gateway                           
 2 D 10.8.0.6/32        10.8.0.1        xxxxxxxxxx-com-vpn
Thanks for any help.

Too tired to give you a whole config. But basically you can do it 2 ways.
You can take those other ports and put them on their very own bridge, create their own subnet, and then create a NAT Src-nat rule with the action src-nat being the IP on your OVPN interface, or alternatively the out interface being your OVPN interface.

Option 2 is to just create individual src-nat rules for specific internal IPs.

# ? Feb 9, 2014 16:24

movax: Aug 30, 2008

Is there an updated tutorial / guide somewhere on setting up QoS via PCQ on RouterOS 6.x?

Basically want to set up QoS such that with (example numbers) 10Mbit w/ 1 users, he gets 10mbit, 2 users, each is guaranteed at least 5mbit, etc. My old setup with PCQ seemed to work OK, but of course I forgot to back it up. :downs:

# ? Feb 17, 2014 06:17

Atreus: Sep 20, 2005

This is probably a pretty dumb question, but haven't been able to be 100% based on licensing rules and such.

I've got a 951-2Hnd or something or another with an L4 license and 5.25 ROS. I heard something about not being able to upgrade versions with that license unless it's one behind. What can I actually upgrade to, or am I stuck with 5.25 unless I fork out extra dollars?

# ? Feb 18, 2014 18:04

zennik: Jun 9, 2002

Atreus posted:

This is probably a pretty dumb question, but haven't been able to be 100% based on licensing rules and such.

I've got a 951-2Hnd or something or another with an L4 license and 5.25 ROS. I heard something about not being able to upgrade versions with that license unless it's one behind. What can I actually upgrade to, or am I stuck with 5.25 unless I fork out extra dollars?

951 should be able to run the latest, no problem. You'll just have to manually drop in the 6.x ROS package file, as the auto updater wont upgrade from 5.x to 6.x

# ? Feb 18, 2014 19:14

thebigcow: Jan 3, 2001; Bully!

What he said. http://wiki.mikrotik.com/wiki/Manual:License#Licenses_and_RouterOS_upgrades

# ? Feb 18, 2014 20:10

kiwid: Sep 30, 2013

movax posted:

Is there an updated tutorial / guide somewhere on setting up QoS via PCQ on RouterOS 6.x?

Basically want to set up QoS such that with (example numbers) 10Mbit w/ 1 users, he gets 10mbit, 2 users, each is guaranteed at least 5mbit, etc. My old setup with PCQ seemed to work OK, but of course I forgot to back it up.

If you find any, can you link it? I think this is something I'll be looking at in the near future.

# ? Feb 20, 2014 16:49

Adbot: ADBOT LOVES YOU

# ? Apr 25, 2024 02:22

thebigcow: Jan 3, 2001; Bully!

Just got a couple RB2011-lettersgohere for a project and a few things stood out, mostly because MikroTik has nothing but pictures from the front of the device.

They are way smaller than the pictures made them look.
They do have holes for mounting on screws so the wall mount kits aren't necessary, although I will probably keep them.
The wall mount kit screws into the sides of the unit. It keeps the power connector in and blocks the serial port.
The RJ45 serial port is on the back by the power connector.

# ? Feb 26, 2014 05:18

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk

«‹›64 »