Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Thanks Ants
May 21, 2004

#essereFerrari


That guide is awesome. Might prompt me into getting an RB750 to cut my teeth on.

Adbot
ADBOT LOVES YOU

Thanks Ants
May 21, 2004

#essereFerrari


Definitely planning to pick up an RB2011. Seems like it's capable of handling pretty much any connection you might want to use for the foreseeable future.

Thanks Ants
May 21, 2004

#essereFerrari


Not sure how well this suggestion will go down since they offer very little in terms of settings to play with, but I had Wi-Fi problems constantly in my 3 storey house, until I put an AirPort Extreme on the middle floor. Absolutely flies, especially on 5GHz which my Mac, iPad, iPhone all support, leaving 2.4 free for older kit, consoles, etc. Easily powerful enough for my 80/20 connection that I can tell.

Thanks Ants
May 21, 2004

#essereFerrari


You can do that with a Mikrotik, if you can't bind different services to HTTP headers then Apache Traffic Server can probably do what you want.

Thanks Ants
May 21, 2004

#essereFerrari


I've just started looking at RouterOS vis a RB750GL that was kicking around. It all seems straightforward enough, one thing that I can't see a simple explanation for though is how VLANs work. I've come up with the following conclusions while I was in the shower, can you correct me if they are wrong?

  • If I want to work with untagged traffic on a port then I pick the interface name instead of the VLAN (I'm assuming that this doesn't affect the VLANs but I can't find any reference to this)
  • If I want to tag/untag traffic I can bridge an interface to a VLAN and it will be tagged/untagged as it travels across it
  • If I want to break different VLANs out to different ports then I should really use a managed switch and not a Routerboard

Thanks Ants
May 21, 2004

#essereFerrari


Thanks, that makes sense albeit it's quite longwinded how VLANs have to be created on each interface they need to be tagged on and can't be called the same thing.

Thanks Ants
May 21, 2004

#essereFerrari


Right, I have my VLANs nailed down and testing them thanks to some dodgy Realtek diagnostic utility that has let me create multiple virtual adapters on my PC.

However, when I get a DHCP lease it seems to start at the top of the range and count backwards, is this normal? My DHCP pool is defined as 192.168.0.29-192.168.0.254 and with one client connected it gets .254, next client gets .253 etc. It just seems a bit weird.

Thanks Ants
May 21, 2004

#essereFerrari


It's not a big deal, everything works fine and eventually once I'm done testing the DHCP will be handled by a Windows server as part of AD. I just wanted to check this wasn't abnormal. Thanks.

Thanks Ants
May 21, 2004

#essereFerrari


Can someone idiot check what I'm doing here? I found something online which said the only thing I need to do to have a service on my LAN accessible from outside is to do this:

code:
add action=dst-nat chain=dstnat comment="WebDAV TCP 443" disabled=no \
    dst-address=a.b.c.d in-interface=ether1 protocol=tcp src-port=443 \
    to-addresses=192.168.0.22 to-ports=443
Where a.b.c.d is the external IP address I want to use for that service (I have a block of 8, they have all been added to the routers address list and all ping, I have set the preferred source address for the gateway etc, internet connectivity works as normal. However nothing can see the page running on port 443 in the example above. Am I supposed to also add a firewall rule, and how should it look if I am?

Edit: Scratch that. One of the dynamic routes has a preferred source which is one of the IPs that I don't want to use as our gateway and it's using this for some reason. Anyone got any ideas?

Thanks Ants fucked around with this message at 14:00 on May 19, 2013

Thanks Ants
May 21, 2004

#essereFerrari


Thanks, that makes sense but this still isn't working. Should the new NAT and Firewall rules be above the defaults if these are in Winbox? The default masquerade NAT rule is still in there which I believe is what's giving me working internet at the moment.

Thanks Ants
May 21, 2004

#essereFerrari


code:
# may/19/2013 14:14:43 by RouterOS 5.25
# software id = PKRJ-BZK6
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s \
    tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment="WebDAV TCP 443" connection-state=new disabled=no dst-address=192.168.0.22 dst-port=443 protocol=tcp
add action=accept chain=input comment="default configuration" disabled=no protocol=icmp
add action=accept chain=input comment="default configuration" connection-state=established disabled=no
add action=accept chain=input comment="default configuration" connection-state=related disabled=no
add action=drop chain=input comment="default configuration" disabled=no in-interface=ether1
add action=accept chain=forward comment="default configuration" connection-state=established disabled=no
add action=accept chain=forward comment="default configuration" connection-state=related disabled=no
add action=drop chain=forward comment="default configuration" connection-state=invalid disabled=no
/ip firewall nat
add action=dst-nat chain=dstnat comment="WebDAV TCP 443" disabled=no dst-address=xxx.222.84.211 in-interface=ether1 protocol=tcp src-port=443 to-addresses=192.168.0.22 to-ports=443
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat comment="3CX TCP 5060" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=tcp src-port=5060 to-addresses=192.168.0.21 to-ports=5060
add action=dst-nat chain=dstnat comment="3CX UDP 5060" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=udp src-port=5060 to-addresses=192.168.0.21 to-ports=5060
add action=dst-nat chain=dstnat comment="3CX UDP 9000-9049" disabled=no dst-address=xxx.222.84.210 in-interface=ether1 protocol=udp src-port=9000-9049 to-addresses=192.168.0.21 to-ports=9000-9049
add action=dst-nat chain=dstnat comment="OpenVPN TCP 443" disabled=no dst-address=xxx.222.84.209 in-interface=ether1 protocol=tcp src-port=443 to-addresses=192.168.0.20 to-ports=443
add action=dst-nat chain=dstnat comment="OpenVPN UDP 1194" disabled=no dst-address=xxx.222.84.209 in-interface=ether1 protocol=udp src-port=1194 to-addresses=192.168.0.20 to-ports=1194
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061 sip-direct-media=yes
set pptp disabled=no
Thanks for the help so far, I imagine it's something annoyingly basic.

Thanks Ants
May 21, 2004

#essereFerrari


They were at zero, I changed those. However I think there's a more fundamental issue as there isn't a ping response to that address from the WAN side, and HTTPS connections still don't work. Pings to other addresses in the same IP block from our ISP work fine.

I've moved the HTTPS stuff onto the address that is working and everything's fine. I think I'll be calling the ISP next. Thanks for your help with everything though. Do you want a forums upgrade?

Thanks Ants
May 21, 2004

#essereFerrari


This is what that section looks like:

code:
add address=xxx.222.84.208/22 comment=Router disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.210/22 comment=3CX disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.209/22 comment=OpenVPN disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.213/22 comment="Remote Desktop Gateway" disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.211/22 comment=WebDAV disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.212/22 disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.214/22 disabled=no interface=ether1 network=xxx.222.84.0
add address=xxx.222.84.215/22 disabled=no interface=ether1 network=xxx.222.84.0
They aren't specifically secondary addresses but they are all addresses on that interface. I've changed the NAT to:

code:
add action=src-nat chain=srcnat comment="default configuration" disabled=no out-interface=ether1 to-addresses=xxx.222.84.208
Edit: Addresses that work are .208, .210, .213, .214, .215. There's not really any pattern in that that I can see.

Edit again: I've removed all the addresses above except for

code:
add address=xxx.222.84.208/22 comment=Router disabled=no interface=ether1 network=xxx.222.84.0
And still having issues getting stuff to connect on certain IPs but working fine on others. I'll contact the ISP I think.

Edit again again: Spoke to the ISP, ended up setting a src-nat to send a client out of each of the IP addresses in turn after adding them back in, and it worked fine (verified it was going out on the correct IP as well). Pinged them all from outside the network and everything worked except .212. I'm lost now but I've worked around things and things are at a point where they are working well enough for now. Just SIP calls take ages to go out but I can live with that.

Thanks Ants fucked around with this message at 16:43 on May 19, 2013

Thanks Ants
May 21, 2004

#essereFerrari


Mikrotik posted:

RouterOS 6 released:

================================
What's new in 6.0 (2013-May-17 14:04):

*) ipsec - added /peer passive option which will prevent starting ISAKMP negotiation
and signifies xauth responder/initiator side;
*) RouterBOARD - default wireless config now includes password - serial number;
*) lte - support YOTA WLTUBA-107;
*) console - fixed crash when variable name was not specified for
*) hotspot - added mac-cookie login method;
http://wiki.mikrotik.com/wiki/Manual:Hotspot_Introduction#MAC_Cookie
*) lcd - show a message when system shutdown is complete;
*) lcd - added Log screen which is accessible through the Main Menu
and shows log messages where action=echo;
*) ipsec - added pre-shared-key-xauth and rsa-signature-hybrid authentication methods;
*) increased max l2mtu on CCR to 10226 bytes;
*) fixed crash on RB1200;
*) fixed bonding - did not work after remove, undo;
*) fixed queues - router could become unresponsive when configuring queues;
================================

http://mikrotik.com/download/

Thanks Ants
May 21, 2004

#essereFerrari


I had OpenVPN connecting through a RB750GL with zero issues up to about a month ago when I got bored with it and replaced it with something else.

Is it slow to establish the connection or slow with throughput?

Thanks Ants
May 21, 2004

#essereFerrari


There's a SIP helper on the Mikrotik's that I've found causes more problems than it solves, if you're just using a SIP trunk or one device then you can disable it. You should be able to enter the external IP in the SIP client (PBX, handset etc), and then it's just a case of making sure the relevant ports are forwarded (don't forget SIP voice traffic travels over UDP).

Thanks Ants
May 21, 2004

#essereFerrari


Now we just need to see how many totally unrelated bugs have been introduced

Thanks Ants
May 21, 2004

#essereFerrari


Is your DNS server being changed to the one on the other end of your VPN connection?

Thanks Ants
May 21, 2004

#essereFerrari


Isn't that called not using NAT?

Thanks Ants
May 21, 2004

#essereFerrari


I think I might have missed something but if you want something with a bunch of switch ports on just buy a switch, and trunk it to a Mikrotik router if you want. I can't see any advantage to letting Mikrotik do switching when there's so many other established reliable options.

Thanks Ants
May 21, 2004

#essereFerrari


I'd struggle to pick a switch with Mikrotik's reputation over something like an HP 1810-24G. Granted the 'tik probably has more features but at the end of the day it's a switch and reliability rules the day.

Thanks Ants
May 21, 2004

#essereFerrari


Don't forget to factor in the ProCurve next-day lifetime replacement warranty if you need to do cost comparisons.

And the fact that they work, of course.

Thanks Ants
May 21, 2004

#essereFerrari


If it's saved in Winbox can't you just login and change it using the CLI, or load a new config on with your new password?

Thanks Ants
May 21, 2004

#essereFerrari


Any good? http://localloop.co.za/2008/10/reading-mikrotiks-winbox-addresseswbx-file-format/

Thanks Ants
May 21, 2004

#essereFerrari


Thanks Ants
May 21, 2004

#essereFerrari


If she doesn't have any strange requirements then get an AirPort and forget about it. They are rock solid.

Thanks Ants
May 21, 2004

#essereFerrari


You're right. 2.4GHz is unusable in any sort of built-up area now.

Thanks Ants
May 21, 2004

#essereFerrari


The next time someone has a go at Wi-Fi standards it needs to have a feature that can't be disabled that will ramp the Tx power down as low as it can. People in one bed apartments don't need their Wi-Fi network to be accessible 20m down the hall, it just fucks it up for everyone.

Although you will always get people who shove on bigger antennas and custom firmware to get a stupidly high Tx power because they don't understand how RF works.

Thanks Ants
May 21, 2004

#essereFerrari


I expected their test setup to be a joke photo of them all shitfaced in a bar or something flipping the bird at the camera, but it almost seems like they are trying.

Thanks Ants
May 21, 2004

#essereFerrari


Sounds like a possible MTU issue, but strange that it's only happening to Amazon.

Thanks Ants
May 21, 2004

#essereFerrari


I think it's a leftover feature from when UPnP allowed people to share dial-up connections which were metered by the minute, so being able to disconnect remotely was reasonably useful.

Thanks Ants
May 21, 2004

#essereFerrari


Just set your DNS on your local machine to Google's temporarily to rule out / confirm a DNS issue with the Mikrotik.

Thanks Ants
May 21, 2004

#essereFerrari


Cisco RV130s are cheap little boxes that claim 50Mbps of IPsec.

Thanks Ants
May 21, 2004

#essereFerrari


Does the bridge work if you set a static IP on the TiVo?

Thanks Ants
May 21, 2004

#essereFerrari


Can you manually connect to an AP using the AirPort utility? It sounds like broadcast between LAN and WLAN isn't happening.

Thanks Ants
May 21, 2004

#essereFerrari


Junos

Thanks Ants
May 21, 2004

#essereFerrari


That's a tiny gap - make sure you take into account the fresnel zone when calculating line of site, there's a nice tool on the Proxim website for working out the height that you need to get each antenna at. For 150ft though it's going to be tiny.

A pair of NanoStation M5 Locos will be more than good enough, and you will have to turn the Tx on each down a lot. If you need more than 100 Mbps of real throughput then look at the ACs ^

Thanks Ants
May 21, 2004

#essereFerrari


ERL does hardware acceleration I think. I'm just looking for a small device I can use to troubleshoot on sub-100Mbps networks so the EdgeRouter X will be getting ordered once it's made it over here.

Thanks Ants
May 21, 2004

#essereFerrari


Loco M5 radios are all kinds of awesome. I've literally never had a problem with the pairs I've put up. They are as close to set-and-forget as you can be.

Adbot
ADBOT LOVES YOU

Thanks Ants
May 21, 2004

#essereFerrari


Having to run a DHCP relay would suggest that you're split across two broadcast domains for some reason. That might cause you problems in the future (service discovery, AirPlay etc.).

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply