- Public - talk.mikrotik.com.au

Output Networks for ROS v7 IPv6 BGP
by Christopher Hawker 02 Feb '23

02 Feb '23

Hey folks, First time attempting to setup v6 BGP on an ROS v7 router. Things are a little confusing with Output Networks and Address Lists. I cannot add a v6 address to a v4 address list (which makes sense), and if I create a v6 address list it does not show up in the Output Network drop-down on the Filter tab in the New BGP Connection dialog box. Where on earth do I create the output address list for v6 sessions? Thanks, CH.

1 0

Static routes with bgp communities in ROS7 - how?
by Damien Gardner Jnr 13 Jan '23

13 Jan '23

Hi folks, This one has me a little stumped. I'm working on upgrading one of our systems from ROS6 to ROS7. This system has a controller that talks via API to a number of Mikrotiks around the place, and maintains a number of static routes (can be anywhere from 50 to 1000 depending on time and day). These static routes all have communities set, depending on the function of the route. i.e. a local service suspension route might be 12345:765 which means it is advertised via ospf for blackholing. A mitigation route might be 12345:666 or 12345:667 to be sent via bgp to our border routers for blackholing, or even advertised on to our upstream providers for blackholing or scrubbing. We have routing filters on ROS6 that decide which routes get redistributed to which protocols and which peers based on communities. A basic config for two blackhole routes might look like the following: /ip route add bgp-communities=12345:765 distance=1 dst-address=221.121.69.69/32 type=blackhole add bgp-communities= 12345:666 distance=1 dst-address=221.121.69.70/32 type=blackhole /routing filter add action=accept bgp-communities= 12345:765 chain=ospf-out comment=Suspension prefix=0.0.0.0/0 prefix-length=32 set-distance=100 add action=discard chain=ospf-out add action=accept bgp-communities= 12345:765 chain=bgp-out comment=Suspension prefix=0.0.0.0/0 prefix-length=32 add action=accept bgp-communities=12345:666 chain=bgp-out comment=Mitigation prefix=0.0.0.0/0 prefix-length=32 add action=accept bgp-communities=12345:667 chain=bgp-out comment=LocalBlackhole prefix=0.0.0.0/0 prefix-length=32 Trying to do this in ROS7, there just isn't a bgp-communities attribute on route that I can set. Is there an 'easy' way to do this same thing on ROS7? Or am I going to also need to add routing rules for each IP on the ospf-out and bgp-out chains as needed to say they can or cannot go out? Thanks for any help, Damien -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

2 1

EP06-E and Mikrotik
by Jason Hecker 10 Dec '22

10 Dec '22

Hi Anyone who's used an EP06-E and a Mikrotik product, how are they performing for you? I fitted one to an LHG myself last year and the damned thing would go on B28 in the lounge room and then only on 3G up on the roof. I got rid of it after the farm qualified for FW NBN. This was with ROS6 though. There were a lot of up and down events on 3G too. Things can change in a year, how is it with ROS7 and MBIM mode? I have another farm with only B28 towers in close range and more channels on towers further away in the next town. Have the WAPs and LHGs been OK and stable with the EP06-E? Regards, Jason Hecker <https://www.upandrunningtech.com.au/>

1 0

Help with BGP on v7 (not a joke)
by Christopher Hawker 07 Dec '22

07 Dec '22

Hey all, I'm currently trying to get BGP working on v7. I am almost there, we are getting a full table from our upstream peer and are sending them our prefix (which they confirm they are receiving). The final thing we need to work out is filtering. We have a single /24 v4 prefix being announced and receiving a full table. If there's anyone out there that has some working examples for import and export filters it'd be greatly appreciated. Thanks, Christopher H.

2 1

Blocking FTP
by Karl Auer 07 Nov '22

07 Nov '22

I'm wondering if I have fundamentally misunderstood something. In fact I am rather hoping I have. An outside agency has reported seeing telnet connection attempts coming from the outside IPv4 address of a client's router. They have provided info that shows quite clearly that these are attacks coming from the router. To see where in the network they were originating, I added these lines at the front of each of the input, output and forward "/ip firewall filter" chains: chain=xxx action=drop \ protocol=tcp dst-port=23 \ log=yes \ log-prefix="TEL_xxx" My log output shows exclusively lines with "TEL_output". I wasn't expecting any "TEL_input" lines, but I was definitely expecting some "TEL_forward" lines, assuming the miscreant is inside the network. Here is a sample (a.b.c.d is the outside address of the router, w.x.y.z is the destination address): 18:44:35 firewall,info TEL_output output: in:(none) out:e1-uplink, proto TCP (SYN), a.b.c.d:54315->w.x.y.z:23, len 40 I.e., the packets seem to be sourced at the router. Does this mean that the router is the source of this nefariousness?!? Or am I missing something? There are quite a few of these, I'm seeing about 20 per minute. The router version is old and should be upgraded: 6.36 (stable). It appears that an earlier colleague added three mangle/passthrough statements, but these as I understand it are effectively just counters. There are no other mangle statements. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

4 4

WTB Mikrotik CCR2004-1G-12S+2XS
by Christopher Hawker 11 Oct '22

11 Oct '22

Hello all, Trying to hunt down a CCR2004-1G-12S+2XS somewhere in Sydney. If you have one interstate I will also consider, however pickup is preferred. CH.

1 0

Mikrotik as NBN router?
by Karl Auer 27 Sep '22

27 Sep '22

Hullo all. A client is about to change NBN suppliers, and the new supplier apparently does IP-over-Ethernet (IPoE). >From what I can find out about this, it should be pretty much as simple as "connect port 1 on the Mikrotik to the correct data port on the NTD". And, I guess, make sure there is a DHCP client on port 1 and turn off the existing PPPoE stuff. However there are mentions of having to set up the Mikrotik to send DHCP option 60 with its DHCP requests. Has anyone used a Mikrotik with the NBN and IPoE, and if so are there any tricks? Regards, K. PS: I haven't seen any messages on this list for it seems like yonks... though there was a mailing list reminder on 1/9. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

7 11

Mikrotik Routers in Sydney
by Christopher Hawker 30 Aug '22

30 Aug '22

Hi All, Currently looking for a router in Sydney which has 2 x SFP cages and can handle two multihoming peers with full feeds. All the usual vendors are low on stock with ETAs of 2+ months for delivery. Please do reach out to me off-list. Thanks, Christopher H.

1 0

MTCNA Training Duxtel USB
by Dave Browning 23 Aug '22

23 Aug '22

Hi All, Wandering if anyone has the USB that you receive from the Duxtel MTCNA training? I recall it having a PDF of the training material, as well as some configs and useful tools. I just have no idea where I put mine 😂 Cheers, Dave

1 0

Partial internet on MacOS. Unable to browse to Mikrotik
by Chris Herrmann 24 Jun '22

24 Jun '22

This might be related to a routing issue that we saw earlier. We had connectivity issues to a range of Akamai & AWS IP space from a variety of end points domestic & international. It seemed to be picked up and mitigated quickly by Australian 4G operators, but there are several ISPs locally & internationally I'm aware of who didn't fix it - and they only got visibility again once the underlying issue was sorted. >From our side we saw everything come up again ~11am Sydney time (GMT+10). If it's now working OK for you... then that was probably it. If it's still broken... then probably not... Cheers, Chris

2 1