The official Mikrotik router thread

[r00igev@@r]

v6.47.10 [long-term] is released!

Here is an updated fix_space.npk package for SMIPS devices which should free up to 1.3Mb to allow upgrading. The underlying issue is fixed in this 6.47.10 version, so the issue should not reoccur again. We apologize for any inconvenience. fix-space-6.47-smips.npk

forum.mikrotik.com

This little puppy freed up the space!

 

[r00igev@@r]

v6.47.10 [long-term] is released!

Here is an updated fix_space.npk package for SMIPS devices which should free up to 1.3Mb to allow upgrading. The underlying issue is fixed in this 6.47.10 version, so the issue should not reoccur again. We apologize for any inconvenience. fix-space-6.47-smips.npk

forum.mikrotik.com

This little puppy freed up the space!

And wham bam thank you mam I'm upgraded!

 

[nad_isa]

Hi All, not sure if i should post a new thread or post here.

My Question below is how to setup simple port based queue and vlans on a RB4011 for me to manage bandwidth on a specific port. The reason is i want to 'share' my fibre with a tenant and im not clued up on networking/mikrotik.

So I have Vumareach fibre (all in one Huawei CPE/Router) that has been provided for the fibre connection - this router/cpe does not have the usual full functionality and certain functions are restricted. The address assigned to this is 192.168.18.1

I have the Mikrotik sitting 'behind' the Huawei CPE which i basically just setup initially using the quick setup. This ip address is 192.168.18.5 (for the internet connection).

On the mikrotik i setup Local network in range 192.168.10.x with IP of mikrotik being 192.168.10.1 ticked DHCP Server and NAT boxes.

Now behind the mikrotik i have my Unifi AP, NVR and deviced hardwired (tv boxes etc). This is my setup as of today.

So to share the internet with tenant my plan was to plug an old asus router into the mikrotik and then create seperate vlans and then have a queue to manage the bandwidth on port 6 (where i am plugging the ASUS router into).

So i plug the ASUS router into the Mikrotik router and setup WAN etc on the ASUS and get internet going and able to connect via wifi on asus to test internet is working. But when i try to setup a simple queue on the mikrotik where i set the max dl & ul on 'ether6' it does not seems to work? i tried watching some youtube videos and cant figure it out.

P.s. i know the above is likely not the most elegant solution and again i am not network savy so please forgive me if im going about this the wrong way - your help or nudge in the right direction will be appreciated.

i have not tried to setup vlans yet.

 

[nad_isa]

Hi All, not sure if i should post a new thread or post here.

My Question below is how to setup simple port based queue and vlans on a RB4011 for me to manage bandwidth on a specific port. The reason is i want to 'share' my fibre with a tenant and im not clued up on networking/mikrotik.

So I have Vumareach fibre (all in one Huawei CPE/Router) that has been provided for the fibre connection - this router/cpe does not have the usual full functionality and certain functions are restricted. The address assigned to this is 192.168.18.1

I have the Mikrotik sitting 'behind' the Huawei CPE which i basically just setup initially using the quick setup. This ip address is 192.168.18.5 (for the internet connection).

On the mikrotik i setup Local network in range 192.168.10.x with IP of mikrotik being 192.168.10.1 ticked DHCP Server and NAT boxes.

Now behind the mikrotik i have my Unifi AP, NVR and deviced hardwired (tv boxes etc). This is my setup as of today.

So to share the internet with tenant my plan was to plug an old asus router into the mikrotik and then create seperate vlans and then have a queue to manage the bandwidth on port 6 (where i am plugging the ASUS router into).

So i plug the ASUS router into the Mikrotik router and setup WAN etc on the ASUS and get internet going and able to connect via wifi on asus to test internet is working. But when i try to setup a simple queue on the mikrotik where i set the max dl & ul on 'ether6' it does not seems to work? i tried watching some youtube videos and cant figure it out.

P.s. i know the above is likely not the most elegant solution and again i am not network savy so please forgive me if im going about this the wrong way - your help or nudge in the right direction will be appreciated.

i have not tried to setup vlans yet.

okay so i got bandwidth control to work by specifying the ip of the asus instead of the port. I click make static on the DHCP server listing of the device to set what i assume to be the same IP address to the ASUS. I also set up a static ip on the client (asus router to that ip).

Now the asus assigns its own ip range 192.168.1.x.

I assume this means anyone connecting via the asus cant connect to my 'network' on the mikrotik. or is there any firewall rules i need to setup on the mikrotik. i assume i dont have to go the vlan method on the mikrotik?

 

[yogidabear]

I assume this means anyone connecting via the asus cant connect to my 'network' on the mikrotik. or is there any firewall rules i need to setup on the mikrotik. i assume i dont have to go the vlan method on the mikrotik?

Ping an IP on your mikrotik network from the asus network and you should get a reply, but I may have zoned out counting the NAT's as I cant see how this is routed, perhaps wait for somebody else to advise better.

 

[nad_isa]

Ping an IP on your mikrotik network from the asus network and you should get a reply, but I may have zoned out counting the NAT's as I cant see how this is routed, perhaps wait for somebody else to advise better.

Lol I got lost just trying to explain it so I understand haha.

 

[PhireSide]

Finally got my basic QoS working nicely. I went for a simple queue as I don't need anything fancy. This is just to prevent one connection saturating the line and starving the other clients of bandwidth. (30/30 Frogfoot FTTH):



Config:

/queue type
add kind=sfq name=sfq-default sfq-perturb=10
/queue simple
add max-limit=29M/29M name=sfq-default queue=sfq-default/sfq-default target=10.0.0.0/24

 

[PhireSide]

On the topic of firewall rules, what is a good starting set that I could use to gradually expand on? I am currently running the default set, plus some extra ones blocking SSH access from the outside world, and some NAT rules to allow Wireguard to function:

/ip firewall filter
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid input" connection-state=invalid in-interface-list=!LAN log=yes log-prefix=DROP_INVALID
add action=drop chain=forward comment="defconf: drop invalid forward" connection-state=invalid in-interface-list=!LAN log=yes log-prefix=DROP_INVALID
add action=drop chain=input comment="defconf: drop ICMP" log=yes log-prefix=DROP_ICMP protocol=icmp src-address=!10.0.0.0/24
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log=yes log-prefix=DROP_INVALID_DSTNAT
add action=drop chain=forward comment="drop DoH-Blocklist TCP 443,853,5353" dst-address-list=DoH-Blocklist dst-port=443,853,5353 in-interface-list=LAN log=yes log-prefix=DROP_DOH protocol=tcp src-address-list=!Allowed-DNS
add action=drop chain=forward comment="drop DoH-Blocklist UDP 443,853,5353" dst-address-list=DoH-Blocklist dst-port=443,853,5353 in-interface-list=LAN log=yes log-prefix=DROP_DOH protocol=udp src-address-list=!Allowed-DNS
add action=drop chain=input comment="drop ssh from outside network" dst-port=22 log=yes log-prefix=DROP_SSH protocol=tcp src-address=!10.0.0.0/24
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Mark connections for hairpin NAT" dst-address-list=!Allowed-DNS dst-port=53 new-connection-mark=DNS passthrough=yes protocol=udp src-address-list=!Allowed-DNS
add action=accept chain=prerouting dst-address=10.0.0.0/24 in-interface=bridge
add action=accept chain=prerouting in-interface=pppoe0
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=redirect chain=dstnat comment="Redirect to local DNS" dst-address-list=!Allowed-DNS dst-port=53 protocol=udp src-address-list=!Allowed-DNS to-ports=53
add action=redirect chain=dstnat comment="Redirect to local DNS" dst-address-list=!Allowed-DNS dst-port=53 protocol=tcp src-address-list=!Allowed-DNS to-ports=53
add action=dst-nat chain=dstnat dst-port=51820 protocol=udp to-addresses=10.0.0.5

 

[nad_isa]

okay so i got bandwidth control to work by specifying the ip of the asus instead of the port. I click make static on the DHCP server listing of the device to set what i assume to be the same IP address to the ASUS. I also set up a static ip on the client (asus router to that ip).

Now the asus assigns its own ip range 192.168.1.x.

I assume this means anyone connecting via the asus cant connect to my 'network' on the mikrotik. or is there any firewall rules i need to setup on the mikrotik. i assume i dont have to go the vlan method on the mikrotik?

so while i got internet setup and simple queue working i am struggling to setup vlans on the mikrotik.

i tried simple portbased vlan by
setting up ports 2-5 on vlan 100 and port 6 on vlan 200.

i can still ping a pc connected via wifi on the unifi AP on port 3 from another pc connected to the asus router via wifi on port 6.

if i ping from the pc on unfi ap to pc on asus router i dont get a response. but get a response the other way (from pc connected to asus router to pc connected via unifi ap)

 

[yogidabear]

so while i got internet setup and simple queue working i am struggling to setup vlans on the mikrotik.

i tried simple portbased vlan by
setting up ports 2-5 on vlan 100 and port 6 on vlan 200.

i can still ping a pc connected via wifi on the unifi AP on port 3 from another pc connected to the asus router via wifi on port 6.

if i ping from the pc on unfi ap to pc on asus router i dont get a response. but get a response the other way (from pc connected to asus router to pc connected via unifi ap)

Because of NAT - your original post I commented on showed 3 NATS that I could count if the mikrotik is being NATed through the main router. Its not ideal by far

 

[nad_isa]

Because of NAT - your original post I commented on showed 3 NATS that I could count if the mikrotik is being NATed through the main router. Its not ideal by far

okay thanks - let me go back to the drawing board then and see if i can simplify . i can try and remove DHCP from the ASUS router and see if i set it up to work as an AP. but i dont think i can get around the fibre router being able to do passthrough of some sorts.

let me do some scratching again

 

[PhireSide]

okay thanks - let me go back to the drawing board then and see if i can simplify . i can try and remove DHCP from the ASUS router and see if i set it up to work as an AP. but i dont think i can get around the fibre router being able to do passthrough of some sorts.

let me do some scratching again

Can you maybe setup a PPP server on the Tik, and have the Asus that you want to use for the tenant dial-up to a profile? You should then be able to do rate limiting on the profile. Just a thought I had while examining your scenario.

I am not sure how that would affect NAT/port traversal though.

 

[yogidabear]

okay thanks - let me go back to the drawing board then and see if i can simplify . i can try and remove DHCP from the ASUS router and see if i set it up to work as an AP. but i dont think i can get around the fibre router being able to do passthrough of some sorts.

let me do some scratching again

You can do what Phireside said with a PPPoE server, and route not NAT, but my suggestion is put the Huawei in bridge so the Mikrotik can dial up or DHCP, whatever the ISP needs and then you have the Mikrotik with the public IP

Then you can have 2 DHCP on the Mikrotik, one for the Asus in AP mode and the other for the rest of your local network. You should only have 1 NAT for all when you finished

 

[yogidabear]

Can you even access secure sites like banking with 3 NAT running from the Asus? I thought it would break somewhere....

 

[nad_isa]

Can you maybe setup a PPP server on the Tik, and have the Asus that you want to use for the tenant dial-up to a profile? You should then be able to do rate limiting on the profile. Just a thought I had while examining your scenario.

I am not sure how that would affect NAT/port traversal though.

thanks will have a look into this

 

[nad_isa]

You can do what Phireside said with a PPPoE server, and route not NAT, but my suggestion is put the Huawei in bridge so the Mikrotik can dial up or DHCP, whatever the ISP needs and then you have the Mikrotik with the public IP

Then you can have 2 DHCP on the Mikrotik, one for the Asus in AP mode and the other for the rest of your local network. You should only have 1 NAT for all when you finished

Thanks - the huawei cant be put in bridge mode as far as i am aware. i wont be able to get around the mikrotik not getting public IP - apparently its how the vumareach setup works..

 

[PhireSide]

Managed to get NetInstall working so that I could disband the bundled 6.49.4 package I had installed.

When they are manufactured, they add all the packages in but you won't be able to uninstall them one by one - you need to use NetInstall and boot the router up into Etherboot mode and then 'sideload' the packages you need - most people will need the following:



This saves a few megabytes of space on the NAND, which is limited with the Hex S (16MB) so it should make future upgrades easier. When prior I didnt't have enough space free to even upgrade just the system package due to insufficient space, I can now load all the packages I require and still have a few kilobytes spare:

 

[PhireSide]

I upgraded to 7.1.3 Stable the other day to see if my simplified config would work better, and all seems to have gone without a hitch. MT's decision to group all packages together means that I can't unbundle packages as with the 6.xx branch, so I've lost out on some free space, but I did gain something worthwhile - cake.

7.xx adds more modern queues so I decided to run cake, which is a step up from fq-codel and their ilk. I have a basic setup below, which is working quite well:

/queue type add cake-autorate-ingress=yes cake-bandwidth=30.0Mbps cake-rtt=30ms kind=cake name=cake
/queue simple add max-limit=30M/30M name=cake queue=cake/cake target=10.0.0.0/24

It's well documented by MT themselves, but this config basically optimises for FTTH access, and it will automatically adjust to your current ingress speeds. So, it should also work well for LTE connections that fluctuate often, as these are the hardest to setup queues for. The "Bandwidth Limit" only tells cake what the expected bandwidth should be if you have Autorate Ingress enabled. Without it, the link speed will slowly rise until it hits the max download rate, and then start the queueing process.



The queue seems to be doing a good job of allowing my PS4 to do downloads at near line speed without it having to drop other more critical traffic (MS Teams, web browsing, SIP traffic):

 

[yogidabear]

View attachment 1270686

Hey so glad somebody else is trying this, as I was unsuccessful. Basically the same setup as you, but instead of my ISP limit of 200/100 on a speedtest its drops to 80/70. Switch back to default-small and speedtest goes normal 180/85. I have NAT ticked but remember taking that off and it did nothing. I didnt play with it much to be fair, and am also on ros7.2rc4. Take it a speedtest works fine for you?

 

[AfricanTech]

Going to update my RB3011 to ROS7 later tonight.

Holding thumbs...