The official Mikrotik router thread

[Tinuva]

Feedback on the Uptime Kuma (via ntfy) vs email directly from the router:

I prefer the email Very customisable, where the notification to ntfy from uptime Kuma is a bit limited in terms of wording, etc ... unless I just need to play around with it some more

Like what do you want to customize? I mean, its telling you something is down, what else do you need?

Uptime Kuma sure, only allows you to customize the subject in the email, but I am not sure what else you want to change anyway. What Uptime Kuma however give you, is the option of notifications to other things other than email. Also, allows easily monitoring other things, which I guess you don't need.

Just look at this list of options for available notification services:

 

[r00igev@@r]

I use ntfy extensively but have implemented a few things.
- Describe what you are monitoring in great detail. You can use as many characters and words as you want.
- Use the emojis in as many places as possible - they are visually the quickest method to determine whats happening.
- Use monitoring groups.

email is not for notifications and the app on my phone has freed me from my laptop,

 

[LandyMan]

Like what do you want to customize? I mean, its telling you something is down, what else do you need?

Uptime Kuma sure, only allows you to customize the subject in the email, but I am not sure what else you want to change anyway. What Uptime Kuma however give you, is the option of notifications to other things other than email. Also, allows easily monitoring other things, which I guess you don't need.

Just look at this list of options for available notification services:
View attachment 1683227

Yes, it tells me something is down, but this is specifically for loadshedding, notifying multiple devices from different family members. So if I do email directly from the router, I can set from as Eskom Notification, and the message/subject will say Loadshedding started or loadshedding stopped.

With Uptime Kuma (which I am not dissing by the way, just not what I want for my use case) it will say ping failure what what Poolpump down. For me it means loadshedding, for the rest of the household it means there is something wrong with the pool pump

 

[Tinuva]

Yes, it tells me something is down, but this is specifically for loadshedding, notifying multiple devices from different family members. So if I do email directly from the router, I can set from as Eskom Notification, and the message/subject will say Loadshedding started or loadshedding stopped.

With Uptime Kuma (which I am not dissing by the way, just not what I want for my use case) it will say ping failure what what Poolpump down. For me it means loadshedding, for the rest of the household it means there is something wrong with the pool pump

The Email(SMTP) notifier in Uptime Kuma can also do this. See image below.

Maybe you need to be creative to do it correctly. Call the sensor loadshedding, or eskom power, instead of sonoff pool pump. That way, if it goes down, its clear what you are trying to convey to your family. You can also set a custom "from" and custom "subject". So I really don't understand how you can't make this work.

That said, seeing as you happy with the email from the tik directly, perhaps that is what you should use for the use-case.

 

[LandyMan]

The Email(SMTP) notifier in Uptime Kuma can also do this. See image below.

Maybe you need to be creative to do it correctly. Call the sensor loadshedding, or eskom power, instead of sonoff pool pump. That way, if it goes down, its clear what you are trying to convey to your family. You can also set a custom "from" and custom "subject". So I really don't understand how you can't make this work.

That said, seeing as you happy with the email from the tik directly, perhaps that is what you should use for the use-case.

View attachment 1683319

I know I can do email in Kuma, but why replicate what I can already do directly from a Mikrotik script.

 

[r00igev@@r]

The Email(SMTP) notifier in Uptime Kuma can also do this. See image below.

Maybe you need to be creative to do it correctly. Call the sensor loadshedding, or eskom power, instead of sonoff pool pump. That way, if it goes down, its clear what you are trying to convey to your family. You can also set a custom "from" and custom "subject". So I really don't understand how you can't make this work.

That said, seeing as you happy with the email from the tik directly, perhaps that is what you should use for the use-case.

View attachment 1683319

If you create a group named Loadshedding and alert on that you achieve the result desired. Also it can then be configured on a status page which gives a neat summary.
email is a not a notification system.

 

[Angelus]

hi all

I need some help please.
I figured out the NAT part because I can see packet numbers going up each time i check if that port is open. That rule looks like this
chain=dstnat action=dst-nat to-addresses=165.-.-.- to-ports=portnumberhere protocol=tcp in-interface-list=WAN dst-port=portnumberhere log=no log-prefix=""

Where I'm stuck is at the firewall filter section, I cant seem to get that right. Could someone please point me in the right direction.

Thanks

 

[Tinuva]

hi all

I need some help please.
I figured out the NAT part because I can see packet numbers going up each time i check if that port is open. That rule looks like this
chain=dstnat action=dst-nat to-addresses=165.-.-.- to-ports=portnumberhere protocol=tcp in-interface-list=WAN dst-port=portnumberhere log=no log-prefix=""

Where I'm stuck is at the firewall filter section, I cant seem to get that right. Could someone please point me in the right direction.

Thanks

For port forwarding, you don't need to update the firewall if using the default firewall.

Showing you an image of my firewall, just to give you an idea. Input hidden to show less



The important rule, if you do not have it, is this one, that blocks all on WAN except if DSTNATed. Notice the ! saying, only if not DSTNAT.


And here is the script if you want it:

# defconf: drop all from WAN not DSTNATed
:if ([/ip firewall filter print count-only where action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state="!dstnat" connection-state="new" in-interface-list="WAN"]=0) do {
    :log info message="creating drop all from WAN not DSTNATed"
    /ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
}

 

[Angelus]

Hi @Tinuva

Thanks for the reply ;

ok so then I have all this ;


The drop all from wan not dstnated
is just like yours



------------------------------------------------------------

so then in my nat I have this which seems to be working (yes I know it is not enabled lol I left it like that, before going to bed)



I just don't understand if I go to an open port site checker it says that , that port is closed
even though it has activity on that port every time I click on "check" on the site.

 

[LandyMan]

I use ntfy extensively but have implemented a few things.
- Describe what you are monitoring in great detail. You can use as many characters and words as you want.
- Use the emojis in as many places as possible - they are visually the quickest method to determine whats happening.
- Use monitoring groups.

email is not for notifications and the app on my phone has freed me from my laptop,

 

[Tinuva]

so then in my nat I have this which seems to be working (yes I know it is not enabled lol I left it like that, before going to bed)
View attachment 1683653
View attachment 1683655

What exactly you doing here?

The "to address" looks wrong. What is your LAN ip range? surely its one of the RFC1918 ranges? The to address should then be in that range.

If you forwarding to a port that is closed, then thats why it is reported as closed. In your image, it looks like you are forwarding something back to the same ip. In which case the incoming syn packet will just loop.

Change it to the correct ip on your lan.

 

[Tinuva]

Hi @Tinuva

Thanks for the reply ;

ok so then I have all this ;
View attachment 1683641

The drop all from wan not dstnated
is just like yours
View attachment 1683647
View attachment 1683643

------------------------------------------------------------

so then in my nat I have this which seems to be working (yes I know it is not enabled lol I left it like that, before going to bed)
View attachment 1683653
View attachment 1683655

I just don't understand if I go to an open port site checker it says that , that port is closed
even though it has activity on that port every time I click on "check" on the site.

Also, if you forwarding to the same port, no need t specify it again. Just the ip is needed. Unless the port is different on the outside and inside. Can be done, but makes for trickery.

 

[Angelus]

Also, if you forwarding to the same port, no need t specify it again. Just the ip is needed. Unless the port is different on the outside and inside. Can be done, but makes for trickery.

View attachment 1683723

ok sorry about that my lan is all 192.-.-.-. , so now I have changed it to the lan address of the actual pc. If I go to portchecker.co it tells me that the port is closed. What I'm trying to do is, I need to forward ports to allow in and out connections to my pc from the internet. I have changed the to address to my pc lan ip but it recons it still closed

 

[Tinuva]

ok sorry about that my lan is all 192.-.-.-. , so now I have changed it to the lan address of the actual pc. If I go to portchecker.co it tells me that the port is closed. What I'm trying to do is, I need to forward ports to allow in and out connections to my pc from the internet. I have changed the to address to my pc lan ip but it recons it still closed

Do you have the application/game running while testing the port?

 

[Angelus]

no I havnt had the application running let me open and see

Edit : its working lol still dont get how the portchecker.co site says it closed but in the app it is open. anyways thanks for the help ... your a star

 

[Went_For_Beer]

no I havnt had the application running let me open and see

Edit : its working lol still dont get how the portchecker.co site says it closed but in the app it is open. anyways thanks for the help ... your a star

Why dont you enable UPnP, it opens the ports for you as needed

 

[Naks]

guys, I recently got a fibre upgrade to 1Gbps, but I notice that my WiFi speeds on 5GHz are not getting anywhere close to the max, which should be around 433Mbps?

Any pointers on how to improve the download speed please? thanks

config:

# 2024-04-06 12:38:30 by RouterOS 7.14.2
# software id = ZFTT-F8R2
#
# model = RBD52G-5HacD2HnD

/interface bridge
add admin-mac=X auto-mac=no comment=defconf name=bridge port-cost-mode=short

/interface wireless
set [ find default-name=wlan1 ] amsdu-limit=3839 antenna-gain=0 band=2ghz-b/g/n channel-width=20/40mhz-XX country=\
    "south africa" disabled=no distance=indoors frequency=2452 mode=ap-bridge ssid=X2 wireless-protocol=802.11

set [ find default-name=wlan2 ] amsdu-limit=3839 band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee country="south africa" \
    disabled=no mode=ap-bridge ssid=X5 wireless-protocol=802.11

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN

/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik

 

[Mzezman]

guys, I recently got a fibre upgrade to 1Gbps, but I notice that my WiFi speeds on 5GHz are not getting anywhere close to the max, which should be around 433Mbps?

Any pointers on how to improve the download speed please? thanks

config:

# 2024-04-06 12:38:30 by RouterOS 7.14.2
# software id = ZFTT-F8R2
#
# model = RBD52G-5HacD2HnD

/interface bridge
add admin-mac=X auto-mac=no comment=defconf name=bridge port-cost-mode=short

/interface wireless
set [ find default-name=wlan1 ] amsdu-limit=3839 antenna-gain=0 band=2ghz-b/g/n channel-width=20/40mhz-XX country=\
    "south africa" disabled=no distance=indoors frequency=2452 mode=ap-bridge ssid=X2 wireless-protocol=802.11

set [ find default-name=wlan2 ] amsdu-limit=3839 band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee country="south africa" \
    disabled=no mode=ap-bridge ssid=X5 wireless-protocol=802.11

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN

/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik

What channel width is the 5ghz? I see in the config it supports 20/40 and 80 - do you know what channel the device connecting is using?

 

[Naks]

What channel width is the 5ghz? I see in the config it supports 20/40 and 80 - do you know what channel the device connecting is using?

 

[Mzezman]

View attachment 1687137

That looks fine from an AP perspective, not sure what else you can do.