The official Mikrotik router thread

B-127 said:
Ok, do you have a router before the Mikrotik, or are you dialed up directly on the Mikrotik? Trying to understand your network configuration.

I've got the following:

Public accessible IP on the LTE side.
LTE Router (port 443) -> Mikrotik -> Network Server (port 44301)

Code: 
/ip firewall nat
add action=masquerade chain=srcnat \
    ipsec-policy=out,none out-interface-list=LAN
/ip dns static
add address=192.168.1.3 regexp=*.mydomain.co.za
I've mitigated the need for Hairpin NAT by adding static DNS pointing to my Mikrotik on the local network. The masquerade for LAN is needed for local forwarding.
Click to expand...

I've added this, and while DNS recolves to the router, I'm also not getting to the sites when accessing from LAN.
 
Leno said:
Aha - connection aborted, something is messing with the SYN ACK or something, very weird
The packet trace you pasted yesterday did show the router forwarding the traffic and the pc replying, odd!
Click to expand...

Yep, still showing this:
Code: 
dstnat: in:ether1 out:(unknown 0), src-mac X, proto TCP (SYN), PhoneIP:54106->RouterIP:9595, prio 2->0, len 60
forward: in:ether1 out:bridge, src-mac X, proto TCP (SYN), PhoneIP:54106->192.168.88.248:9595, NAT PhoneIP:54106->(RouterIP:9595->192.168.88.248:9595), prio 2->0, len 60
 
Naks said:
Yep, still showing this:
Code: 
dstnat: in:ether1 out:(unknown 0), src-mac X, proto TCP (SYN), PhoneIP:54106->RouterIP:9595, prio 2->0, len 60
forward: in:ether1 out:bridge, src-mac X, proto TCP (SYN), PhoneIP:54106->192.168.88.248:9595, NAT PhoneIP:54106->(RouterIP:9595->192.168.88.248:9595), prio 2->0, len 60
Click to expand...
With your phone connected to wifi, does http://192.168.88.248:9595 work as expected?
 
Naks said:
ffffffff

all it took was to ask Afrihost to assign me a new PublicIP, which the Tik took over as its own, and BOOM, everything works.

Going to go have a stiff whiskey now, before I try the hairpin stuff
Click to expand...
Glad you got it working.
 
Naks said:
ffffffff

all it took was to ask Afrihost to assign me a new PublicIP, which the Tik took over as its own, and BOOM, everything works.

Going to go have a stiff whiskey now, before I try the hairpin stuff
Click to expand...
We'll keep an eye out for our bottles of whiskey as well. I prefer Glenfiddich 12yo, btw.

Please forward the tracking numbers once received. Tks:p
 
I want to create a virtual WiFi interface so I can choose to connect to Cloudflare WARP by selecting the WiFi network on my devices (e.g. TV doesn't support it). wlan2 will connect normally, but if I connect to wlan-vpn it should route through Wireguard.

I have set Wireguard successfully, and the VPN works if I route all traffic to it. The only issue is I can't route traffic from a slave wireless interface. I get the following error:
1651646917629.png

Does anyone know how to get around this? Below is my setup:

WiFi interfaces:
1651647174523.png

Bridge ports:
1651646825686.png

Mangle rule:
1651646863344.png
1651646875302.png

Thanks :)
 
giggity said:
I want to create a virtual WiFi interface so I can choose to connect to Cloudflare WARP by selecting the WiFi network on my devices (e.g. TV doesn't support it). wlan2 will connect normally, but if I connect to wlan-vpn it should route through Wireguard.

I have set Wireguard successfully, and the VPN works if I route all traffic to it. The only issue is I can't route traffic from a slave wireless interface. I get the following error:
View attachment 1302580

Does anyone know how to get around this? Below is my setup:

WiFi interfaces:
View attachment 1302582

Bridge ports:
View attachment 1302572

Mangle rule:
View attachment 1302574
View attachment 1302576

Thanks :)
Click to expand...

Does the cloudflare wifi have a separate ip range, if so you could mangle based on source ip
 
Leno said:
Does the cloudflare wifi have a separate ip range, if so you could mangle based on source ip
Click to expand...
It doesn't have a separate IP range at the moment. I'd like to keep it in the same range if possible, but if it's the only option then I'll do that.
 
I did similar but VLANed with a separate IP range and Gateways specified and distributed through DHCP
 
giggity said:
It doesn't have a separate IP range at the moment. I'd like to keep it in the same range if possible, but if it's the only option then I'll do that.
Click to expand...
Unfortunately a slave interface is similar to a bridge, as in on the ip level mikrotik wont see any difference to the traffic to be able to intentify it

I am not sure if you can do seperate ip's on slave wifi's but if you can, that would probably be easiest
 
This is probably not Mikrotik related, but you guys seem to know your ****, so here goes:

I still have my fq codel queue setup on the PPPoE interface. Currently two streams running:

1. Teams meeting with Video
2. twitch stream, manually "hard-locked" at 1080 quality.

Now, when I look at the interface traffic, it hovers around 5-8 Mbps. What is strange, is that I can see on the twitch stream the quality drops below 1080, but the traffic through the interface remains below 10Mbps. I would expect to see a spike in the traffic, and not a drop in stream quality (100 Mbps/100 Mbps).

Any ideas?

1651821714668.png
 
LandyMan said:
This is probably not Mikrotik related, but you guys seem to know your ****, so here goes:

I still have my fq codel queue setup on the PPPoE interface. Currently two streams running:

1. Teams meeting with Video
2. twitch stream, manually "hard-locked" at 1080 quality.

Now, when I look at the interface traffic, it hovers around 5-8 Mbps. What is strange, is that I can see on the twitch stream the quality drops below 1080, but the traffic through the interface remains below 10Mbps. I would expect to see a spike in the traffic, and not a drop in stream quality (100 Mbps/100 Mbps).

Any ideas?

View attachment 1303898
Click to expand...
What is your queue bandwidth limits set to for this particular queue?
 
But even with the queue off, it happens ... hence my original statement that I am not sure it is Mikrotik related
 
Does anyone know how to configure queues so that available bandwidth is distributed evenly between active clients? I have fq_codel queue type enabled, and it's doing its job - if I have a call while Netflix is going and Windows is updating there is no noticeable difference in my call quality.

The problem is that if the TV is on and I download something, the TV sometimes buffers because my laptop uses 90% of the network. I would prefer the router attempt to auto-balance 50% of my download bandwidth to each of the two devices currently downloading.

I have a 50mbps line. I don't want to configure it so that my laptop gets 25mbps and the TV gets 25mbps - the laptop should use 100% when the network isn't being used by any other device. If 4 devices connect and all start downloading at the same time, they should each get 12.5mbps.

Is this possible, preferably while retaining fq_codel?
 
giggity said:
Does anyone know how to configure queues so that available bandwidth is distributed evenly between active clients? I have fq_codel queue type enabled, and it's doing its job - if I have a call while Netflix is going and Windows is updating there is no noticeable difference in my call quality.

The problem is that if the TV is on and I download something, the TV sometimes buffers because my laptop uses 90% of the network. I would prefer the router attempt to auto-balance 50% of my download bandwidth to each of the two devices currently downloading.

I have a 50mbps line. I don't want to configure it so that my laptop gets 25mbps and the TV gets 25mbps - the laptop should use 100% when the network isn't being used by any other device. If 4 devices connect and all start downloading at the same time, they should each get 12.5mbps.

Is this possible, preferably while retaining fq_codel?
Click to expand...
SFQ queues are exactly what you are looking for, not sure if you can do it on fq_codel

SFQ​

Stochastic Fairness Queuing (SFQ) is ensured by hashing and round-robin algorithms. A traffic flow may be uniquely identified by a 4 options(src-address, dst-address, src-port and dst-port), so these parameters are used by SFQ hashing algorithm to classify packets into one of 1024 possible sub-streams. Then round-robin algorithm will start to distribute available bandwidth to all sub-streams, on each round giving sfq-allot bytes of traffic. The whole SFQ queue can contain 128 packets and there are 1024 sub-streams available
Click to expand...
 
giggity said:
Does anyone know how to configure queues so that available bandwidth is distributed evenly between active clients? I have fq_codel queue type enabled, and it's doing its job - if I have a call while Netflix is going and Windows is updating there is no noticeable difference in my call quality.

The problem is that if the TV is on and I download something, the TV sometimes buffers because my laptop uses 90% of the network. I would prefer the router attempt to auto-balance 50% of my download bandwidth to each of the two devices currently downloading.

I have a 50mbps line. I don't want to configure it so that my laptop gets 25mbps and the TV gets 25mbps - the laptop should use 100% when the network isn't being used by any other device. If 4 devices connect and all start downloading at the same time, they should each get 12.5mbps.

Is this possible, preferably while retaining fq_codel?
Click to expand...
I also tried it on fq_codel, and it didn't do the job properly.

I am currently testing pcq, and it seems ok, but I am not 100% happy

Will try SFQ as per @Leno
 
I tried SFQ, but unfortunately it caused a lot of bufferbloat on my upload. After doing a bit more research, it looks like Cake should handle this use case, while still minimising bufferbloat. But from my personal experience using it, fq_codel easily outperforms cake by 30-50ms.

I might be configuring it incorrectly - I know the queue speed has to be set on the queue type and not the simple queue config.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X