- Public - talk.mikrotik.com.au

Omnitik Access on default config
by Paul Julian 28 Jul '16

28 Jul '16

Hi guys, I have a slight problem, I have chucked an Omnitik on a mast straight out of the box to use as a redundant spare and I can't get into the damn thing now I am back at the office...... I have plugged into ether 1 to get the POE to power it and the default config won't let me in on port 1 no matter what I try. I can't see it in neighbours from the device on the other end of the cable and I really don't want to have to get up on the roof again. Any suggestions on how I might be able to get into it ? I have power cycled it to no avail, I have tried to Mac Telnet to it but it drops the connection. Any suggestions would really be appreciated as it's a PITA to get back on this roof......now I am in the predicament I seem to recall this is always a problem on these Omnitiks ! Regards Paul

4 8

High Latency on LTE Interface
by Dave Browning 26 Jul '16

26 Jul '16

Hi Guys, Have a Telstra 4GX dongle plugged into an RB2011. Don’t know why, but I am getting randomly high latency from the Mikro to the dongle. Would’ve thought it should be <1ms given it’s plugged directly in? [admin@Mikrotik] > ping 192.168.1.1 SEQ HOST SIZE TTL TIME STATUS 0 192.168.1.1 56 64 27ms 1 192.168.1.1 56 64 30ms 2 192.168.1.1 56 64 28ms 3 192.168.1.1 56 64 19ms 4 192.168.1.1 56 64 19ms sent=5 received=5 packet-loss=0% min-rtt=19ms avg-rtt=24ms max-rtt=30ms Dave Browning | Network Engineer P 07 3369 7666 Level 1, 12 Railway Tce, Milton QLD 4064 This email and any files transmitted with it contain confidential information for the exclusive use of the intended recipient. If you received this email in error please notify Sentrian Pty Ltd immediately by return email to the sender and delete the original email. We do not guarantee that this email or any attached files are free of viruses. All recipients should undertake their own virus scanning.

2 2

Mikrotik, PPPOE and Dynamic QOS
by Paul Julian 19 Jul '16

19 Jul '16

Hi all, I have been toying with the idea to try and play around with some way of doing QOS for our customers who have VOIP and continually hammer their downloads, doing basic QOS on the CPE isn't that hard as you know which interface you are dealing with, but trying to prioritise packets to them from our network seems to be more challenging as we are using PPPOE. I have had a look around on the forums and MUM presentations but can't really find anything I can get my teeth into. Does anybody have any suggestions on where to start with this ? I really only have one requirement and that is to prioritise voice traffic over everything else that we send to each client, so I can imagine that we need one parent queue per customer with two child queues, one for VOIP and one for everything else, but I'm not sure how or if it's even possible to create more than one dynamic queue for a PPPOE session when it starts up. Any advice or links to real-life scenarios would be appreciated J Thanks Paul

2 2

Akamai CDN and Win10 update delivery breaking TCP flow control
by Jeremy Hall 17 Jul '16

17 Jul '16

Hi all I came across this post: https://forums.whirlpool.net.au/forum-replies.cfm?t=2530363 ..and thought it might be of interest or help to many users in this mailing list. The post/thread describes an issue with Akamai's (and probably other CDN's) implementation of FastTCP (or some custom TCP stack) where TCP flow control breaks/is broken, and the receiving network or gateway is sent packets until the link is saturated and rendered unusable - effectively a DOS attack. Because of the DOS-like nature of the flood of received packets, no QoS queues or connection limiting strategies can mitigate the effect. The only current workaround is to block the offending network range, but then Akamai will just direct the client to another location. At the moment, it seems to be mainly (only?) Windows 10 updates causing the effect, so disabling updates over the internet is another temporary workaround. There is some interesting discussion in the thread above, including packet captures and observations. A couple of the posters are Mikrotik users so a Mikrotik-specific solution may well find its way there. Cheers Jeremy

1 0

USB 4G Modem for Vodafone
by Russell Hurren 15 Jul '16

15 Jul '16

Hi everyone I've seen the list of supported USB modems (http://wiki.mikrotik.com/wiki/Supported_Hardware#4G_LTE_cards_and_modems) but does anyone know if there's one that I can use for a client who's with Vodafone (and where I could acquire one)? It's just for a backup link in case the ADSL goes down, so if not I may just tell them to get a Telstra pre-paid device. Regards Russell

3 5

Speed and Duplex on Mikrotiks
by Paul Julian 12 Jul '16

12 Jul '16

Hi All, is there an actual way of making mikroik routerboards work when on a fixed duplex and speed setting ?, like one that actually works ? I am so tired of trying to get them to lock onto a speed and duplex only to have them get a mind of their own after a reboot or anytime in the future at all and then stop talking to each other. Even when talking to each other they seem to hold no regard for any hard set parameters and just randomly go to 10M half duplex or something stupid for no reason. When we operate 5 or 6 pieces of gear at a site we need to have some confidence that they will actually be able to communicate with each other, hard setting network speed and duplex is good practice and should really be done on all networking equipment when you are in control of both ends of a line IMHO, but damn Mikrotik's have a mind of their own in this area and I am really sick of fighting with them. Any advice would be appreciated before I lose all remaining hair ! Regards Paul

4 8

quetion re dual VPNs
by Karl Auer 04 Jul '16

04 Jul '16

I'm still playing with AWS Hardware VPN :-) An AWS Hardware VPN is actually two VPNs; their idea seems to be that if one fails the other will still be there. The two VPNs terminate at different endpoints at the AWS end, but at the same endpoint on the MikroTik. Apparently in order to support route-based VPNs, AWS also provides "inside addresses", a pair for each VPN. The actual traffic to AWS has to be routed via the inside address at the AWS end. MikroTik has a bug in that it will not allow two IPsec policies that cover the same traffic. If you set up two VPNs and want to send the same traffic over both - which is what AWS expects you to do - one of the policies will be flagged "invalid". My workaround is to set up one policy for (say) 192.168.100.0/24 for one VPN, then two others for the other VPN, with each covering half the desired range: VPN1: 192.168.100.0/24 VPN2: 192.168.100.0/25 192.168.100.128/25 In order to send traffic to the right place, I also have two routes, one sending 192.168.100/24 via one inside address, the other sending the same traffic via the other inside address. This is all working fine (though I suppose I can't use 192.168.100.127 or 192.168.100.128). If I manually disable either VPN, traffic keeps going on the other - eventually, though it can take a few tens of seconds to reestablish while dead peer detection does its thing. Now to my questions at last :-) I can't test a VPN failure, because I can't drop either VPN at the ASW end. If one of the two VPNs did fail, what would happen? Will the MikroTik figure it out and not try to send packets up the dead one? Do I need to run netwatch and fiddle with the route metrics? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

4 11

RBSXT-LTE
by Karl Auer 02 Jul '16

02 Jul '16

"The SXT LTE supports the popular LTE FDD bands 3 (1800MHz) and 7 (2600MHz), has a miniSIM slot and is not backwards compatible with older networks." Which older networks would those be? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

2 1

Route marking
by Paul Julian 28 Jun '16

28 Jun '16

Hi guys, just wanting to confirm something here due to some strange behaviour which might be admin induced J When using mangle rules to put a routing mark onto packets, does one approach this the same as typical packet marking by marking the connection and then the packets based on the connection mark ? I setup a routing mark rule in this fashion but it did weird things, as soon as I just identified the packets directly based on a dest address instead of a connection rule first, and then set the route mark it worked fine. Thanks Paul

4 7

virtual interfaces in ROS?
by Karl Auer 26 Jun '16

26 Jun '16

I'm currently doing battle with an AWS VPN (and many thanks to those people here who have helped me; I can't name names, but they know who they are). I've got it working, but there are a couple of things I don' t understand. One thing that the AWS doco mentions is "tunnel interfaces" and it is clear from the various sample configurations for other platforms that the common way to do this is to set up a virtual interface at the ends of the tunnel. ASCII art coming up: REALIP REALIP ----------------------- VIP -------------------------------- VIP ----------------------- The tunnel proper is between the two real IPs; these are globally routable IP addresses. In my test setup, they are my routers outside address 1.2.3.4, and an Amazon address 2.3.4.5. Amazon also provides the two VIPs - which it calls "inside addresses" and suggests should be placed on "tunnel interfaces". I've just stuck them on the same interfaces as the real IPs, and it works fine. But is there some way to set up a virtual interface that would work the way Amazon seems to intend? It would be nicer not to have the outside interface festooned with private addresses. By analogy, look at a GRE interface. That's a virtual interface that forms a network with the other end of the GRE tunnel. Traffic can be routed across a GRE tunnel. I tried creating a bridge interface, but could see no way to associate it with the IPsec tunnel. EoIP, IPIP and GRE are about the only tunnel interface types I can think of of the top of my head, but they all require cooperation at the other end. AWS is fully automated - what you get is what you get. Am I not understanding IPsec, or not understanding RouterOS? Any ideas most welcome. Or pointers to good explanations :-) Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 GPG fingerprint: 6D59 8AE6 810D 44E3 7626 7040 4DD6 F89F 3053 4774 Old fingerprint: 9DCA 0903 BCBD 0647 BCCC 2FA7 A35C 57A1 ACF9 00BB

3 7