Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Canine Blues Arooo
Jan 7, 2008

when you think about it...i'm the first girl you ever spent the night with

Grimey Drawer
I've been trying to get USB Tethering to Work with my RB2011 and a Galaxy S5 and I for the life of me cannot figure this poo poo out. I thought it was pretty obvious, but once again, all we proved is that I don't know nearly as much about networking as I think I do.

Config capture is included. Basically, I added a DHCP client, a masq rule and that's it. I figured that's all I'd need, but it doesn't really work. I might just need a second set of eyes to tell me where I forgot something stupid...

Adbot
ADBOT LOVES YOU

I am not a book
Mar 9, 2013
Wow, I am hugely impressed by this. So much nicer than the lovely netgear I was using before.

wolrah
May 8, 2006
what?

jeeves posted:

Should I be concerned about a 1000 mW antenna off of one of these wifi routers being so close to both?

No more concerned than you should be about your cell phone in your pocket or your laptop on your lap. That is to say not at all. One watt is basically nothing, plus it's non-ionizing radiation so it can't damage atomic structures anyways. You have to get to the high end of light on the electromagnetic spectrum (ultraviolet and up) before electromagnetic radiation of any kind becomes inherently dangerous.

The only physical effect you'll receive from WiFi or any other radio signal is heating. At high powers this can be significant, your microwave oven uses the same frequency range as 802.11b/g and the low band of n. It also has hundreds to over a thousand watts of power directed in to a small chamber designed to reflect it around for maximum efficiency.

Compare this to one single watt being emitted in all directions with no containment. If you're using a normal omnidirectional antenna the amount of the signal that hits you at all drops off massively the further you get away from it. From even two feet you're only in the path of a tiny fraction of the emitted radiation, and clearly you don't absorb anywhere close to all of it since your laptop and cell phone still work just fine when you or anyone else are in between them and the access point. Needless to say, the heating effect is practically immeasurable. Humans on average emit 60 watts of heat when resting apparently, so if you share your bed with another human they'd be heating you significantly more than the WiFi.


tl;dr: Don't worry about radio waves unless they're from a high-power directional source aimed at you.

wolrah fucked around with this message at 22:28 on Oct 9, 2014

thebigcow
Jan 3, 2001

Bully!

Canine Blues Arooo posted:

I've been trying to get USB Tethering to Work with my RB2011 and a Galaxy S5 and I for the life of me cannot figure this poo poo out. I thought it was pretty obvious, but once again, all we proved is that I don't know nearly as much about networking as I think I do.

Config capture is included. Basically, I added a DHCP client, a masq rule and that's it. I figured that's all I'd need, but it doesn't really work. I might just need a second set of eyes to tell me where I forgot something stupid...



US Cellular wants me to pay them to tether things to my phone. Does your provider do anything similar?

CrazyLittle
Sep 11, 2001





Clapping Larry

I am not a book posted:

Wow, I am hugely impressed by this. So much nicer than the lovely netgear I was using before.

The leap from making GBS threads consumer gear is a stark difference. Pretty soon you'll have a 19" half-rack in your basement with 96-port patch panels, and telling all your friends that they don't know what they're missing.

jeeves
May 27, 2001

Deranged Psychopathic
Butler Extraordinaire

wolrah posted:

wordswordswords

Thanks for the reassuring words, as I figured as much. Just seeing one of their units go from 50 mW to the next going to 1000 mW was kind of 'woah what?'

I am not a book
Mar 9, 2013

CrazyLittle posted:

The leap from making GBS threads consumer gear is a stark difference. Pretty soon you'll have a 19" half-rack in your basement with 96-port patch panels, and telling all your friends that they don't know what they're missing.

Yeah no poo poo. One thing that I'm wondering though: should I be doing anything with my firewall filter rules? My shitbox I had before didn't really have any sort of configuration options for it, and I run Ubuntu so I'm not exactly hanging a bunch of open ports out publicly. Right now I've got NAT enabled per the wiki's quickstart guide, is that good enough?


edit: per this link on the wiki: "No access from the Internet will be possible to the Local addresses. If you want to allow connections to the server on the local network, you should use destination Network Address Translation (NAT)".
I only configured one NAT rule, and it's a srcnat, so I should be fine right?

I am not a book fucked around with this message at 04:46 on Oct 10, 2014

BurgerQuest
Mar 17, 2009

by Jeffrey of YOSPOS
Do you want to have children yes/no? If yes, what is the minimum level of deformity acceptable?

CuddleChunks
Sep 18, 2004

BurgerQuest posted:

Do you want to have children yes/no? If yes, what is the minimum level of deformity acceptable?

Hahahah it's funny to me because I run into folks who believe this stuff.

1000 milliWatts of microwave radiation ain't no thang. It's 1 Watt. You get more energy across your skin from a 60 Watt lightbulb and THAT you can actually feel heating you up if you put your arm up next to it. It's much higher energy stuff too than microwaves.

As was stated earlier, if you have a focused beam of microwaves and enough power behind it then it can cook you just like your home ovens. You shouldn't ever be in a situation where that is possible but if you are - don't stand in front of an active microwave emitter horn at an airbase. You will not like the results.

jeeves
May 27, 2001

Deranged Psychopathic
Butler Extraordinaire
I guess when I saw the mW I thought it was actually MW, which is quite a difference.

But having that thing a couple of feet away from where I sleep did make me wonder when I saw the 50mW versus 1000mW difference, heh.

Methylethylaldehyde
Oct 23, 2004

BAKA BAKA

jeeves posted:

I guess when I saw the mW I thought it was actually MW, which is quite a difference.

But having that thing a couple of feet away from where I sleep did make me wonder when I saw the 50mW versus 1000mW difference, heh.

God, a 1000MW omnidirectional wireless G card would power fry pretty much anything within a dozen meters, and gently caress up anything and everything that has a wireless antenna for a few hundred miles.

At 1 GW transmitted power, you could dangle a turkey from a stick at 75 meters and have it absorb 1000W of microwave radiation, assuming the transmitter was an idealized spherical emitter.

That kind of power would allow you to get reasonably good wifi service on the moon. Possibly mars as well if you upped the TCP rwin and timeouts sufficiently.

thebigcow
Jan 3, 2001

Bully!
Anyone heard anything about the new RB850? There's a thread on their forums where people are saying it has a max mtu of 1506.

CuddleChunks
Sep 18, 2004

thebigcow posted:

Anyone heard anything about the new RB850? There's a thread on their forums where people are saying it has a max mtu of 1506.

That would be bizarre. What in the hell? It looks like a platform upgrade over the RB450G so why would they lock it down to some goofy MTU? We haven't gotten any in at work yet so I'll see if our guys go nuts fiddling with these things.

thebigcow
Jan 3, 2001

Bully!

CuddleChunks posted:

That would be bizarre. What in the hell? It looks like a platform upgrade over the RB450G so why would they lock it down to some goofy MTU? We haven't gotten any in at work yet so I'll see if our guys go nuts fiddling with these things.

Its weird because its the same switch chip in every current model so its either the CPU or a Latvian mystery.

Its interesting that they put out another PPC based model. The benchmark results were in one of their threads and its roughly twice as powerful as the RB2011 boards.

falz
Jan 29, 2005

01100110 01100001 01101100 01111010
They appear to have listed 1506 as MTU in their wiki

http://wiki.mikrotik.com/wiki/Manual:Maximum_Transmission_Unit_on_RouterBoards

With a faster-ish CPU and 512MB of RAM it seems like it would make a better SLA or monitoring device since it does have a serial port and temperature sensor. Toss one somewhere and maybe run Dude on it or something.

I am not a book
Mar 9, 2013

I am not a book posted:

Yeah no poo poo. One thing that I'm wondering though: should I be doing anything with my firewall filter rules? My shitbox I had before didn't really have any sort of configuration options for it, and I run Ubuntu so I'm not exactly hanging a bunch of open ports out publicly. Right now I've got NAT enabled per the wiki's quickstart guide, is that good enough?


edit: per this link on the wiki: "No access from the Internet will be possible to the Local addresses. If you want to allow connections to the server on the local network, you should use destination Network Address Translation (NAT)".
I only configured one NAT rule, and it's a srcnat, so I should be fine right?

Anyone? I'm not trying to do anything fancy, I just want to make sure no one can log in from the internet.

CuddleChunks
Sep 18, 2004

I am not a book posted:

Anyone? I'm not trying to do anything fancy, I just want to make sure no one can log in from the internet.

Log into your Mikrotik and type this into a terminal window:

ip firewall filter export


Post the results, that will tell us what rules you have configured. You can scrub any sensitive IP's but we'll probably laugh at you if you do.

I am not a book
Mar 9, 2013

CuddleChunks posted:

Log into your Mikrotik and type this into a terminal window:

ip firewall filter export


Post the results, that will tell us what rules you have configured. You can scrub any sensitive IP's but we'll probably laugh at you if you do.

add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="default configuration" in-interface=ether1-gateway
add chain=forward comment="default configuration" connection-state=established
add chain=forward comment="default configuration" connection-state=related
add action=drop chain=forward comment="default configuration" connection-state=invalid

CuddleChunks
Sep 18, 2004

quote:

add action=drop chain=input comment="default configuration" in-interface=ether1-gateway

You're set. Unsolicited inbound connections get kicked to the curb, assuming you are using DHCP or a static IP on your ether1-gateway.

I am not a book
Mar 9, 2013

CuddleChunks posted:

using DHCP or a static IP on your ether1-gateway.

What other options are there?

jeeves
May 27, 2001

Deranged Psychopathic
Butler Extraordinaire
Speaking of firewalls, is there an easy way to block a certain port from going out certain ports?

I use cFos for traffic shaping, but I only need it on my home server / main computer. However it spams out the other ports of my router constantly, so I was curious if there was a way to force it to only be able to send port traffic out specific ports.

CuddleChunks
Sep 18, 2004

I am not a book posted:

What other options are there?

PPPoE primarily.

thebigcow
Jan 3, 2001

Bully!
New update is out, apparently SD cards work again :v:

I am not a book
Mar 9, 2013
I'm looking at the first script here, and I'm a little unsure about what is going on around line 10:
code:
/ip dhcp-server lease;
:foreach i in=[find] do={
  /ip dhcp-server lease;
From my limited understanding, it's printing all dhcp leases on line 10("/ip dhcp-server lease;"), and then iterating over them on line 11(":foreach i in=[find] do={"), but why print the same thing twice on lines 10 and 12, and why doesn't it requre "/ip dhcp-server lease print" like on the command line?

Weird Uncle Dave
Sep 2, 2003

I could do this all day.

Buglord

I am not a book posted:

I'm looking at the first script here, and I'm a little unsure about what is going on around line 10:
code:
/ip dhcp-server lease;
:foreach i in=[find] do={
  /ip dhcp-server lease;
From my limited understanding, it's printing all dhcp leases on line 10("/ip dhcp-server lease;"), and then iterating over them on line 11(":foreach i in=[find] do={"), but why print the same thing twice on lines 10 and 12, and why doesn't it requre "/ip dhcp-server lease print" like on the command line?

The Mikrotik CLI is kinda sorta trying to pretend to be a file system. The "/ip dhcp-server lease" indicates that it's going into that "directory." Since you're there, you can just do 'find' instead of having to fully-qualify it with "/ip dhcp-server lease find".

The second one probably isn't strictly necessary, but it certainly won't hurt anything.

I am not a book
Mar 9, 2013

Weird Uncle Dave posted:

The Mikrotik CLI is kinda sorta trying to pretend to be a file system. The "/ip dhcp-server lease" indicates that it's going into that "directory." Since you're there, you can just do 'find' instead of having to fully-qualify it with "/ip dhcp-server lease find".

The second one probably isn't strictly necessary, but it certainly won't hurt anything.

Ok, I see that, thanks.

I am not a book
Mar 9, 2013
Ok, for the life of me I can't figure out how to see what IP space is allocated to my wlan. I've tried /ip address but it seems to only show the ethernet address space, and I've tried /wireless but the only option is "export".

Weird Uncle Dave
Sep 2, 2003

I could do this all day.

Buglord
If there are IP addresses assigned to your wireless interface, they should be under /ip address. Are you sure you've actually assigned one?

robostac
Sep 23, 2009
The default setup (at least on the devices I've got - 751/951) is to bridge the local network ports and the wireless device and use the the same IP / DHCP server for the bridge rather than assigning different addresses to the wireless / ethernet.

CuddleChunks
Sep 18, 2004

The range of addresses available to the DHCP server are under: /ip pool

I am not a book
Mar 9, 2013

CuddleChunks posted:

The range of addresses available to the DHCP server are under: /ip pool

Awesome, thanks.

CuddleChunks
Sep 18, 2004

Updated the OP with some new info about Apple products and Universal Plug-n-Play.

Update 12/19/2014: Here are some settings that seem to work well for Apple products connecting to the wireless routers like RB951 and RB751:
code:
#Apple wifi helpers
/int wir set wlan1 wmm-support=enabled periodic-calibration=enabled \
hw-protection-mode=rts-cts hw-retries=15 frame-lifetime=0 \
adaptive-noise-immunity=ap-and-client-mode disconnect-timeout=00:00:15 \
distance=indoors multicast-helper=full
Universal Plug-n-Play is a handy thing at times, especially if you have an Xbox. It's not so nice if someone from the outside world messes with your router so you should filter their connection attempts.
code:
##Setup UPnP
/ip upnp interfaces add interface=ether1-gateway type=external 
/ip upnp interfaces add interface=bridge-local type=internal 
/ip upnp set enabled=yes
/ip fir fil add chain=input in-interface=ether1-gateway protocol=udp port=1900 \
    action=drop comment="remote UPnP drop"

jeeves
May 27, 2001

Deranged Psychopathic
Butler Extraordinaire

I am not a book posted:

Ok, for the life of me I can't figure out how to see what IP space is allocated to my wlan. I've tried /ip address but it seems to only show the ethernet address space, and I've tried /wireless but the only option is "export".

The export command dumps out all of the code for any specific place you're in.


/ip address export
will dump out any code on the router under the sub-fields of /ip address.

Typing export from / will dump out all code that the router currently has on anything.

Mikrotik CLI is pretty cool like that.

FunOne
Aug 20, 2000
I am a slimey vat of concentrated stupidity

Fun Shoe
I have a RB750 connected to a Netgear DSL modem, the RB750 handles the PPPoE connection for AT&T. Yes, I hate it.

But, I have this problem with Amazon where half the time the page will not load. I do not notice this ANYWHERE else, but Amazon. I've tried turning off IPv6 with no improvement, I've tried loving around with MTU, no improvement. I'm using Google's DNS settings.

What else should I try to get Amazon to load correctly?

jeeves
May 27, 2001

Deranged Psychopathic
Butler Extraordinaire
I take it you've tried with multiple computers behind your router to show that it is the actual router having the problem?

Thanks Ants
May 21, 2004

#essereFerrari


Sounds like a possible MTU issue, but strange that it's only happening to Amazon.

FunOne
Aug 20, 2000
I am a slimey vat of concentrated stupidity

Fun Shoe

jeeves posted:

I take it you've tried with multiple computers behind your router to show that it is the actual router having the problem?

Multiple computers, multiple browsers. Happens on tablets (no adblock), happens on my Wife's work laptop.

Mug
Apr 26, 2005

CuddleChunks posted:

Updated the OP with some new info about Apple products and Universal Plug-n-Play.

Update 12/19/2014: Here are some settings that seem to work well for Apple products connecting to the wireless routers like RB951 and RB751:
code:
#Apple wifi helpers
/int wir set wlan1 wmm-support=enabled periodic-calibration=enabled \
hw-protection-mode=rts-cts hw-retries=15 frame-lifetime=0 \
adaptive-noise-immunity=ap-and-client-mode disconnect-timeout=00:00:15 \
distance=indoors multicast-helper=full
Universal Plug-n-Play is a handy thing at times, especially if you have an Xbox. It's not so nice if someone from the outside world messes with your router so you should filter their connection attempts.
code:
##Setup UPnP
/ip upnp interfaces add interface=ether1-gateway type=external 
/ip upnp interfaces add interface=bridge-local type=internal 
/ip upnp set enabled=yes
/ip fir fil add chain=input in-interface=ether1-gateway protocol=udp port=1900 \
    action=drop comment="remote UPnP drop"

Simple question but for that firewall rule that disabled remote UPnP drops, because I have two PPPoE interface for internet connections, instead of choosing an "In-Interface" and I instead do "Src-Address != 192.168.88.0/32"?

CuddleChunks
Sep 18, 2004

Mug posted:

Simple question but for that firewall rule that disabled remote UPnP drops, because I have two PPPoE interface for internet connections, instead of choosing an "In-Interface" and I instead do "Src-Address != 192.168.88.0/32"?

I'd add two filter rules that target your PPPoE interfaces. We run PPPoE for our customers so that's how we usually have that rule written. Something like this:

code:
/ip fir fil add chain=input in-interface=PPPoE-1 protocol=udp port=1900 \
    action=drop comment="remote UPnP drop"
/ip fir fil add chain=input in-interface=PPPoE-2 protocol=udp port=1900 \
    action=drop comment="remote UPnP drop"

Adbot
ADBOT LOVES YOU

Mug
Apr 26, 2005
Okay cool, I'll just do that then.

edit: Also what the hell's the point of "Allow UPnP to disable external interface"? If we have that enabled, and we don't have that firewall rule in place, can arseholes remotely disable our PPPoE?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply