The official Mikrotik router thread

PhireSide said:
Very nice! Yeah, once they are up and running, they just work (tm).

I recently setup a nice Grafana dashboard on Docker that pulls information from the Mikrotik API. It needed some minor tweaking (I had to multiply the one query result with 8 because it was giving me the wrong speed) but otherwise it seems to be a nice collection of info. My low uptime is thanks to an inverter trip a few days back.

View attachment 1432621

View attachment 1432619

Link here: akpw/mktxp: Prometheus Exporter for Mikrotik RouterOS devices (github.com)
Click to expand...
Be extremely careful with Prometheus and Grafana, you might just lose two weeks and wonder what the hell just happened.
 
Thor said:
What would be the easiest way to achieve the following:

Using the RB4011 ( ether 1 will be connected to the ONT )

PPPOE ether 1

192.169.1.1/24 network on ether 2 ( uses 192.169.1.111 as DNS )

10.0.10.1/22 network on ether 3 ( uses 192.169.1.111 as DNS )

10.0.20.1/22 network on ether 4 ( uses 192.169.1.111 as DNS )

ether 3 and ether 4 networks must not be able to access ether 2 networks.
You can use VLANs to segregate the networks and put applicable firewall rules in place.
All DNS requests on the Mikrotik must go to 192.169.1.111 ( Pi-Hole Raspberry Pi )
You will need a firewall rule to allow traffic from all subnets to 192.169.1.111 OR point DNS to the Tik and redirect that to the Pi. You can also use Mangle and NAT to redirect DNS traffic if you don't want DNS leakage.
Port must be opened for Wiregaurd on ( WAN:51820 point to 192.169.1.111:51820 )
A simple NAT rule can do this for you
Context:

Network 192.169.1.1/24 ( I know 169 is not allowed, but Hik had a typo & to change the IPs of all the cameras and facial readers now after it is set up in Hik Central is too much work ( days and costs ) )
Hikvision NVR ( static IP )
Hikvision Smart POE 24 Port Switch ( static IP )
32 Cameras ( static IPs )
12 Facial Readers ( static IPs )
2 Security APs ( ± 10 users each using DHCP - password protected )
1 Rapsbery Pi ( static IP - pihole and wiregaurd )

Network 10.0.10.1/22 ( Guest )
1 x 8 port unmanaged switch
4 x UniFi APs with Free WiFi ( no password )

Network 10.0.20.1/22 ( Guest )
1 x 8 port unmanaged switch
4 x UniFi APs with Free WiFi ( no password )
You will need to trunk the VLAN traffic to the ports these switches are connected to, and make sure your Firewall rules are watertight since you cannot do ACLs on unmanaged switches.
Click to expand...
Replied to some of your points above. The new Mikrotik help site also has nice examples and all the stuff here is very well documented - RouterOS - RouterOS - MikroTik Documentation
 
what he said OR point DNS to the Tik and redirect that to the Pi.
/ip firewall nat
add action=redirect chain=dstnat comment="Redirect DNS" dst-port=53 protocol=udp src-address=!the ip address of your Pi to-ports=53
/ip dns
set allow-remote-requests=yes servers=the ip address of your Pi
 
Should I do my setup above via bridges or vlans

I checks the MikroTik documentation as best I could ( bit of a information overload )
 
Thor said:
Should I do my setup above via bridges or vlans

I checks the MikroTik documentation as best I could ( bit of a information overload )
Click to expand...
Thor...I am going to be completely honest with you but I have no damn idea. And the info overload is perfectly normal. If you are familiar with iptables you will feel a bit more at home, but the interface can be very overwhelming at first.

I run a flat network at home, and I don't know Mikrotik at all well enough to give you any decent advice. What I will do however is point you to a very knowledgeable channel that might be of more assistance:


His channel has tons of content on, a lot of it focused on Mikrotik. Good luck!
 
yogidabear said:
what he said OR point DNS to the Tik and redirect that to the Pi.
/ip firewall nat
add action=redirect chain=dstnat comment="Redirect DNS" dst-port=53 protocol=udp src-address=!the ip address of your Pi to-ports=53
/ip dns
set allow-remote-requests=yes servers=the ip address of your Pi
Click to expand...
Excellent! What I would also do, if you really wanted captive DNS, is to block DNS over TLS, which can be done with a firewall rule to block the more common providers.

And lastly, @Thor, this button is you friend:

1669926882313.png
 
Thor said:
Should I do my setup above via bridges or vlans

I checks the MikroTik documentation as best I could ( bit of a information overload )
Click to expand...
VLAN would be to separate networks
Bridges would be to let them all chat
 
PhireSide said:
Very nice! Yeah, once they are up and running, they just work (tm).

I recently setup a nice Grafana dashboard on Docker that pulls information from the Mikrotik API. It needed some minor tweaking (I had to multiply the one query result with 8 because it was giving me the wrong speed) but otherwise it seems to be a nice collection of info. My low uptime is thanks to an inverter trip a few days back.

View attachment 1432621

View attachment 1432619

Link here: akpw/mktxp: Prometheus Exporter for Mikrotik RouterOS devices (github.com)
Click to expand...
Please tell us some more ... :)
 
LandyMan said:
Please tell us some more ... :)
Click to expand...
Ag, not much to tell really, as setup is a breeze.

I used their docker-compose command and changed one query by adding '*8' to it to display the correct results. Other than that, it seems to be running well. Oh, and you have to edit the mktxp.conf file with your router details and of course create an API user on the Tik for them to communicate.

1669957210773.png
 
Thor said:
Should I do my setup above via bridges or vlans

I checks the MikroTik documentation as best I could ( bit of a information overload )
Click to expand...
None you have separated LAN already on each Ethernet port. The only way for them to see each other is through the router as it will add a route for each by default. So then you block subnet a from talking to subnet b in your firewall. Nobody talks to the Pi anymore if you use Mikrotik for DNS.
 
yogidabear said:
None you have separated LAN already on each Ethernet port. The only way for them to see each other is through the router as it will add a route for each by default. So then you block subnet a from talking to subnet b in your firewall. Nobody talks to the Pi anymore if you use Mikrotik for DNS.
Click to expand...
I want the Pi to be the DNS for all networks ( so DNS relay on the Tik and a port 53 rule I suppose ? )
 
Thor said:
I want the Pi to be the DNS for all networks ( so DNS relay on the Tik and a port 53 rule I suppose ? )
Click to expand...
Yes apologies that assumes you use my first suggestion as well.

Then you will be fine, except you will never know whois 192.169.1.0/24, but youll survive
 
PhireSide said:
It's awfully quiet in here...

How is everyone's Tiks holding up?
Click to expand...
Since I got mine about a year ago I haven't used it yet, bleh! I shortly got a Huawei LTE router... I honestly dunno what to do with the Mikrotik. Any suggestions? interesting hacks/things I can do with maybe?
 
Anunnaki-11 said:
Since I got mine about a year ago I haven't used it yet, bleh! I shortly got a Huawei LTE router... I honestly dunno what to do with the Mikrotik. Any suggestions? interesting hacks/things I can do with maybe?
Click to expand...
Nothing springs to mind. What model do you have? You could turn it into a switch if you have need of one. I for one have found the Netwatch tool quite useful. For me, it's a rudimentary Load Shedding monitor.

I use it to watch an IP of a device that is powered by municipality power, and if it goes offline, it kills my 2nd WAN connection which flaps due to the nearby cell tower going offline. Simple, but it works well enough.
 
Anunnaki-11 said:
Since I got mine about a year ago I haven't used it yet, bleh! I shortly got a Huawei LTE router... I honestly dunno what to do with the Mikrotik. Any suggestions? interesting hacks/things I can do with maybe?
Click to expand...
Netwatcher,per-device bandwidth usage tracking,firewall,AP,walled-garden guest wifi
So many possibilities
 
Anunnaki-11 said:
Since I got mine about a year ago I haven't used it yet, bleh! I shortly got a Huawei LTE router... I honestly dunno what to do with the Mikrotik. Any suggestions? interesting hacks/things I can do with maybe?
Click to expand...
I like the fact that I can route DNS traffic to smartDNS, guaranteed.

Even hardcoded DNS devices.
 
PhireSide said:
Very nice! Yeah, once they are up and running, they just work (tm).

I recently setup a nice Grafana dashboard on Docker that pulls information from the Mikrotik API. It needed some minor tweaking (I had to multiply the one query result with 8 because it was giving me the wrong speed) but otherwise it seems to be a nice collection of info. My low uptime is thanks to an inverter trip a few days back.

View attachment 1432621

View attachment 1432619

Link here: akpw/mktxp: Prometheus Exporter for Mikrotik RouterOS devices (github.com)
Click to expand...
Thank you for mentioning this. This is pretty awesome!
 
PhireSide said:
Ag, not much to tell really, as setup is a breeze.

I used their docker-compose command and changed one query by adding '*8' to it to display the correct results. Other than that, it seems to be running well. Oh, and you have to edit the mktxp.conf file with your router details and of course create an API user on the Tik for them to communicate.

View attachment 1433287
Click to expand...
Out of interest sake, you changing the "byte" query to give you "bits". But why? Or is it because the grafana dash show it as bits aka Mb/s ?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X