Tag Info

Hot answers tagged

6

As far as I know, there is no way to do that directly. Workaround could be using firewall rule to add source ip to addresslist: /ip firewall filter add action=add-src-to-address-list address-list=beeplist address-list-timeout=1m1s chain=input disabled=no dst-port=21 protocol=tcp and then run script to check'n'beep: :if ([ :len [ip firewall ...


5

I had the same issue trying to decide what to use, as was with you cisco was my first choice but then I saw the licensing and infrastruture costs so I went with a combination of Mikrotik and Ubiquity equipment, I have had great success runnning both, they are nice and customizable (although I will admit the mikrotik cli is a bit annoying at times), the ...


5

What you've essentially done is setup a VPN AND setup RDP access through the firewall (opening port 3389 to the world). You shouldn't allow RDP access through the firewall at all if you want to limit it to VPN users. Disable that rule completely for RDP. Then...A user will VPN in using the VPN tunnel you setup and THEN rdp into "system A". The VPN puts ...


4

The FTP config is actually looking into the FTP data to see the 530 code. You'll want to adapt the SSH config not the FTP config. Try this: add chain=forward protocol=tcp dst-port=3389 src-address-list=rdp_blacklist action=drop \ comment="drop rdp brute forcers" disabled=no add chain=forward protocol=tcp dst-port=3389 connection-state=new \ ...


3

For the first project for the wireless link you can get away with a regular wireless router (Linksys is a popular choice for such applications), directional antennas and weather proof housing powered via Ethernet cable. People reported stable links up to 40km/25mi using this setup with good directional antennas, so 500m would be piece of cake for this setup. ...


3

The following should do the trick: /ip route add gateway=10.1.1.1 routing-mark=browser /ip route add gateway=10.1.1.2 dst-address=10.1.2.0/24 routing-mark=browser /ip route rule add src-address=10.1.6.2 action=lookup table=browser Note that in RouterOS, the priority is set by the order of the routing rules.


3

You should really also consider looking at vendors like Aruba and Motorola when looking into wireless/wireless bridges.


3

Due to the fact that both links have the same IP gateway, you must set in some way the interface you want to use in your routing tables. The syntax is the following: gateway=[ip]%[interface] + specific preferred source; given this fact, in your router these routes should look like the following: /ip route gateway=109.60.164.1%gateway1 pref-src ...


2

The easy answer is to use something like 802.1x. If you've got a totally blank slate, you then go buy enterasys switches which can apply policies to users based on 802.1x radius responses. Faculty would get unlimited bandwidth, students would get 50k/sec to the internet but unlimited to the local network, etc. If you've got an existing network (and you're ...


2

Old question but I'll add my 2c worth for people wondering about Microtik in the future. I used to work for an ISP that rolled out Microtik access points across a city with both Ubiquiti and Mikrotik hana clients. The performance was fantastic. No, it's not a silly idea to go with Microtik over cisco. In fact, It may be better than cisco. You're buying ...


2

No need of setting proxy in RouterOS. You can route all outgoing HTTP traffic to the server directly thru NAT: ip firewall nat add in-interface=eth1 src-address=!<IP of Squid machine> dst-port=80 protocol=tcp action=dst-nat to-addresses=<IP of Squid machine> to-ports=8080 The last parameter "src-address=!..." is needed in case which squid ...


2

From the Wiki: http://wiki.mikrotik.com/wiki/Manual:Tools/Fetch "Fetch is one of the console tools in Mikrotik RouterOS. It is used to copy files from any network device to a Mikrotik router via HTTP or FTP. In latest v5 versions it is possible also to upload files to remote locations." src-path (string; Default: ) Title of the remote file you need to ...


2

Use script to transfer configuration. /export file=config.rsc Transfer script to PC. Fix script by removing mac-address options from interfaces at begining of script. Transfer to other Mikrotik And apply script. /system reset-configuration no-defaults=yes run-after-reset=config.rsc PS. For successful applying configuration new router must have ...


2

I'm the head network admin of a small company (3000~ users) in Australia that has been using Mikrotik routers (in place of cisco gear) for about 4 years now. The mikrotik stuff is fully 802.11x compatible but they do (similarly to any major player) provide proprietary extentions that are only compatible between mikrotik devices. One of the best examples of ...


2

No. Here is the wiki link, nowhere is authentication mentioned. MikroTik used to have a Socks proxy, but even that didn't support authentication. EDIT: I e-mailed MikroTik support (support at mikrotik.com) to double check my info and got a reply from @Sergejs. The answer is definitely no. The Socks proxy still exists, but this also does not support ...


2

The MikroTik RouteOS is very capable, but definitely designed for smaller installations. They're really aiming at hot-spots and small multi-tenant buildings. FreeBSD is going to be a significantly more capable, configurable, and able to provide greater capacity. What exact pain points are you experiencing with your FreeBSD servers? You say you want to ...


2

You have to make decisions and design you network. On ether1 which is connected to your ISP you should define a smaller network. e.g /30 (to tell the truth it is much easier if you request one more smaller range from your ISP than splitting what you have now). So on ether1 10.10.10.192/30 your gw is 10.10.10.193 and 10.10.10.194/30 is your IP (on the ...


2

In my experience, when you use passthrough=yes, for example in a mangle rule, then the packet if it gets matched by that rule it's processed by the subsequent rules. Where in case you use passthrough=no, if the packet gets matched by that rule, it will not get processed by the subsequent rules which can be useful to save some CPU as stated at the bottom of ...


2

For anyone who may stumble upon this later, the issue was resolved by explicitly stating the Out interface on the srcnat Masquerade rule. See below.


2

the difference between NAT and proxy server is the way they handle nos of user Actually, the difference is they are almost totally different solutions. NAT is a Layer 3/4 solution that was invented as a hack solution to the exhaustion of IPv4 addresses. It was never meant to be a security or "proxy" solution. All it does is change one address of the ...


1

Unfortunately Mikrotik RouterOS does not support acting as HTTPS proxy. Also if you check further it does not have any options for SSL certificates regarding to its proxy. You can use Linux/squid or Microsoft ISA / TMG for HTTPS scenario. If you want, Mikrotik has HTTP proxy with authentication in IP > Web Proxy.


1

I'm assuming that you're using the PPTP VPN protocol here. I'm not sure if this will cause failures at the authentication stage, but check that the client has GRE connectivity to the server. GRE runs directly on IP (and not over TCP or UDP), and so it may be treated differently by the modem, or a certain telecommunication monopoly's network. You can use ...


1

Yes this is possible. You need to set up repeater/universal repeater mode on those APs. Check TP Link WA 730 RE models... http://www.tp-link.com/en/products/details/?model=TL-WA730RE Note: Do not expect miracles because it all depends from the signal between whose APs. Also, do not overload APs with to many users...


1

I usually recommend OpenVPN, but if you don't want to install additional software your only option is PPTP. There is an open source server called PoPToP which runs on Linux, but you can also use Windows Server.


1

What is wrong with installing OpenVPN clients? I would find out from your customers if this is an option, because it will be cheap and probably do what you want... though there is some configuration required (I haven't ever done it, but I've read about it being pretty good). On another note, I've used Watchguard firewalls with mobile VPN, and been pretty ...


1

It seems that there isn't error handling in this kind of scripts. You should probably adopt the solution proposed by this guy: So you have to have 2 scripts, one that runs and does stuff and handles situation when some value is not received as expected, and other script does the job, that can fail. as a result, if second script fails, first one that ...


1

Even if VMQ is enabling automatically, you still need to enable VLAN trunking on the Intel nic. On our Hyper-V setup, they default access types, and additional vlan tagged traffic gets dropped. The team that is setup as trunk ports and trunk to the switch can accept VLAN traffic and it does get routed to the VM using the setup you have above.


1

It can be done by using the API, if you are using PHP language then it helps -> http://wiki.mikrotik.com/wiki/API_PHP_class


1

What about the default ipv6 route? have you tried to set the 2000::/3 gateway=sit1? can you add a ipv4 firewall log rule to see ip protocol 41 transit?


1

There are many lesser-known vendors who make long-distance wireless bridge solutions, and many of them have been around for a long time. Because one vendor is providing both ends of the bridge, interoperability isn't as much of a concern as it is for a traditional 802.11 wireless LAN. I am not sure it's still the case, but many vendors used to do things ...



Only top voted, non community-wiki answers of a minimum length are eligible