Tag Info

Hot answers tagged

7

As far as I know, there is no way to do that directly. Workaround could be using firewall rule to add source ip to addresslist: /ip firewall filter add action=add-src-to-address-list address-list=beeplist address-list-timeout=1m1s chain=input disabled=no dst-port=21 protocol=tcp and then run script to check'n'beep: :if ([ :len [ip firewall ...


5

What you've essentially done is setup a VPN AND setup RDP access through the firewall (opening port 3389 to the world). You shouldn't allow RDP access through the firewall at all if you want to limit it to VPN users. Disable that rule completely for RDP. Then...A user will VPN in using the VPN tunnel you setup and THEN rdp into "system A". The VPN puts ...


5

Since the '/export' command dumps the configuration to stdout, I do always backup my mikrotiks vía ssh this way: ~$ ssh admin@router /export > mikrotik.conf


5

I had the same issue trying to decide what to use, as was with you cisco was my first choice but then I saw the licensing and infrastruture costs so I went with a combination of Mikrotik and Ubiquity equipment, I have had great success runnning both, they are nice and customizable (although I will admit the mikrotik cli is a bit annoying at times), the ...


4

Due to the fact that both links have the same IP gateway, you must set in some way the interface you want to use in your routing tables. The syntax is the following: gateway=[ip]%[interface] + specific preferred source; given this fact, in your router these routes should look like the following: /ip route gateway=109.60.164.1%gateway1 pref-src ...


4

The FTP config is actually looking into the FTP data to see the 530 code. You'll want to adapt the SSH config not the FTP config. Try this: add chain=forward protocol=tcp dst-port=3389 src-address-list=rdp_blacklist action=drop \ comment="drop rdp brute forcers" disabled=no add chain=forward protocol=tcp dst-port=3389 connection-state=new \ ...


3

the difference between NAT and proxy server is the way they handle nos of user Actually, the difference is they are almost totally different solutions. NAT is a Layer 3/4 solution that was invented as a hack solution to the exhaustion of IPv4 addresses. It was never meant to be a security or "proxy" solution. All it does is change one address of the ...


3

You should really also consider looking at vendors like Aruba and Motorola when looking into wireless/wireless bridges.


3

The following should do the trick: /ip route add gateway=10.1.1.1 routing-mark=browser /ip route add gateway=10.1.1.2 dst-address=10.1.2.0/24 routing-mark=browser /ip route rule add src-address=10.1.6.2 action=lookup table=browser Note that in RouterOS, the priority is set by the order of the routing rules.


3

For the first project for the wireless link you can get away with a regular wireless router (Linksys is a popular choice for such applications), directional antennas and weather proof housing powered via Ethernet cable. People reported stable links up to 40km/25mi using this setup with good directional antennas, so 500m would be piece of cake for this setup. ...


2

The MikroTik RouteOS is very capable, but definitely designed for smaller installations. They're really aiming at hot-spots and small multi-tenant buildings. FreeBSD is going to be a significantly more capable, configurable, and able to provide greater capacity. What exact pain points are you experiencing with your FreeBSD servers? You say you want to ...


2

No. Here is the wiki link, nowhere is authentication mentioned. MikroTik used to have a Socks proxy, but even that didn't support authentication. EDIT: I e-mailed MikroTik support (support at mikrotik.com) to double check my info and got a reply from @Sergejs. The answer is definitely no. The Socks proxy still exists, but this also does not support ...


2

Use script to transfer configuration. /export file=config.rsc Transfer script to PC. Fix script by removing mac-address options from interfaces at begining of script. Transfer to other Mikrotik And apply script. /system reset-configuration no-defaults=yes run-after-reset=config.rsc PS. For successful applying configuration new router must have ...


2

You have to make decisions and design you network. On ether1 which is connected to your ISP you should define a smaller network. e.g /30 (to tell the truth it is much easier if you request one more smaller range from your ISP than splitting what you have now). So on ether1 10.10.10.192/30 your gw is 10.10.10.193 and 10.10.10.194/30 is your IP (on the ...


2

For anyone who may stumble upon this later, the issue was resolved by explicitly stating the Out interface on the srcnat Masquerade rule. See below.


2

From the Wiki: http://wiki.mikrotik.com/wiki/Manual:Tools/Fetch "Fetch is one of the console tools in Mikrotik RouterOS. It is used to copy files from any network device to a Mikrotik router via HTTP or FTP. In latest v5 versions it is possible also to upload files to remote locations." src-path (string; Default: ) Title of the remote file you need to ...


2

No need of setting proxy in RouterOS. You can route all outgoing HTTP traffic to the server directly thru NAT: ip firewall nat add in-interface=eth1 src-address=!<IP of Squid machine> dst-port=80 protocol=tcp action=dst-nat to-addresses=<IP of Squid machine> to-ports=8080 The last parameter "src-address=!..." is needed in case which squid ...


2

I'm the head network admin of a small company (3000~ users) in Australia that has been using Mikrotik routers (in place of cisco gear) for about 4 years now. The mikrotik stuff is fully 802.11x compatible but they do (similarly to any major player) provide proprietary extentions that are only compatible between mikrotik devices. One of the best examples of ...


2

Old question but I'll add my 2c worth for people wondering about Microtik in the future. I used to work for an ISP that rolled out Microtik access points across a city with both Ubiquiti and Mikrotik hana clients. The performance was fantastic. No, it's not a silly idea to go with Microtik over cisco. In fact, It may be better than cisco. You're buying ...


2

The easy answer is to use something like 802.1x. If you've got a totally blank slate, you then go buy enterasys switches which can apply policies to users based on 802.1x radius responses. Faculty would get unlimited bandwidth, students would get 50k/sec to the internet but unlimited to the local network, etc. If you've got an existing network (and you're ...


2

In my experience, when you use passthrough=yes, for example in a mangle rule, then the packet if it gets matched by that rule it's processed by the subsequent rules. Where in case you use passthrough=no, if the packet gets matched by that rule, it will not get processed by the subsequent rules which can be useful to save some CPU as stated at the bottom of ...


2

First off, the use of FTP is NOT recommended as your password is sent in cleartext, and anyone looking at your traffic can sniff it. IF you want to use FTP, make sure it is enabled under IP > Services. Then go to your terminal, and export the file using the command export file=myname. The file will then be under the File menu as myname.rsc. You then ...


2

You'll be able to do this with policy based routing, which can be done with the mangle table. Essentially it allows you to define a number of conditions and select a next hop based on them. It's well covered here: http://wiki.mikrotik.com/wiki/Policy_Base_Routing


2

Unfortunately there is no way to install curl on a standard Mikrotik installation. The only way to make http requests from a vanilla mikrotik installation is using fetch as you already found. But it does not support POST requests, only GET. There are a couple solutions to this problem depending on your situation. If you are using 5.x version on an x86 ...


1

Disable rule #2 + #3 and test again. Or you can make an exception for your ssh+www ports You are dropping all in traffic from ether1-gateway. Rules #2 + #3 are practically the same. I recommend you to remove #2 UPDATED REPLY For making a secure Router isn't a best practice to change ports, creating a false sense of security. However is an easy ...


1

If you have access to the device's web interface, you can go to the IP menu, then to Firewall. Click on the NAT tab. There you can see the ports it forwards to which devices. Simply disable all ports forwarded from your in interface into your LAN. If you have ssh access, follow the same path: /ip firewall nat And print to see the existing rules. You can ...


1

To achieve this you need to create 2 firewall rules (mangle & nat) and add a static route. First you create the mangle rule which will mark the packets of the specific IP you want to route through WAN2 with a new routing mark. Replace 192.168.1.X with the IP you want to route via WAN2. /ip firewall mangle add chain=prerouting src-address=192.168.1.X \ ...


1

It sounds like you may need to configure the firewall to pass through the NAT traffic on the Mikrotik. This is 'masquerading'. When you enable NAT, by default the Mikrotik doesn't enable masquerading and as a result won't pass through established traffic. You must specifically enable the Firewall rule. An equivalent in IPTABLES would be the basic "allow ...


1

You will need to mark the connections coming from ether3_3G so that you can then mark the replies to be routed back via ether3_3G. Here's an example configuration (not tested) /ip firewall mangle add action=mark-connection chain=prerouting comment="Mark connection so packets from 3G get returned to 3G properly" disabled=no in-interface=ether3_3G ...


1

According to your screenshots the signal is too high and in SXTs and similar routerboards, if there is too high signal then the wireless card's amplifier gets over-driven resulting in bad quality link essentially. You need to lower the tx-power on both sides so that the signal drops at the most to -55dB. Others say it should be -65dB but I've seen SXTs and ...



Only top voted, non community-wiki answers of a minimum length are eligible