February 2026
M	T	W	T	F	S	S
	1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28

Archive for the ‘MikroTik’ Category

MikroTik PoE: automatically power cycle and reboot device when it becomes unresponsive.

Posted by jpluimers on 2021/09/24

In the past I had these manual scripts to power-cycle a hung RaaspberryPi device:

/interface ethernet poe set ether5 poe-out=off
/interface ethernet poe set ether5 poe-out=forced-on

or on one line:

/interface ethernet poe set ether5 poe-out=off; /interface ethernet poe set ether5 poe-out=forced-on

I am going to try this script for the port having a Raspberry Pi on it (note: this requires a 48V power brick for the Mikrotik!) on RouterOS version 6.48.3 (stable):

/interface ethernet
set [ find default-name=ether5 ] comment="RaspberryPi" poe-out=\
    forced-on power-cycle-ping-address=192.168.124.38 power-cycle-ping-enabled=\
    yes power-cycle-ping-timeout=2m

The above has not worked for a long time as per [Wayback] No POE Power Cycle @ hEX POE – MikroTik:

But it might be fixed as of [Wayback] RouterOS version v6.47.3[stable] as per [Wayback] MikroTik Routers and Wireless – Software: 6.47.3 (2020-Sep-01 05:24):

…

*) poe – fixed “power-cycle” functionality on RB960GSP;

…

Similar issues exist on RB760iGS/Hex S, and there the fix requires new hardware in addition to firmware as per [Wayback] POE OUT issue on ether5 rb760igs (no power) – MikroTik

Note that I did disassemble both of these routers for inspection and there are obvious changes to the hardware to correct the PoE problems – most notably a completely different relay, capacitor and some minor circuit design changes.

If it still fails, I might try

[Wayback] No POE Power Cycle @ hEX POE – MikroTik: workaround script

:local ipPing ("x.x.x.x")
:local pingip
#
# pingip below RUNS and sets the variable
# to number of successful pings ie 3 means 3 of 45 success
# can also use ($pingip > 1) or ($pingip >= 1) both TESTED
# ($pingip >= 1) means if only 1 or 0 pings do the IF, not the ELSE
#
:log info ("ping CHECK script IS RUNNING NOW")
# first delay 90 b4 ping test incase this is running at POWER UP
:delay 90
:set pingip [/ping $ipPing count=45]
:if ($pingip <= 3) do={ :log warning (">95% lost ping LOSS to isp GW IP x.x.x.x via ether5 so DO POE powerCYCLE")
  /interface ethernet poe set ether5 poe-out=off
  :delay 12
  /interface ethernet poe set ether5 poe-out=auto-on
  :delay 10
  :log warning ("ether5 POE HAS BEEN TURNED BACK ON")
  :delay 90
  /system script run emailPOEresult
} else={
  :log warning ("PoeCyclePINGcheck ELSE ran so no ping loss detected by script")
}

Based on:

Read the rest of this entry »

Posted in Development, Hardware Development, Internet, MikroTik, Power User, Raspberry Pi, routers | Leave a Comment »

Mikrotik RouterOS “/ip ssh” setting not available from WinBox and defaulting to insecure?

Posted by jpluimers on 2021/09/20

Still need to research this further:

Somewhere around 6.44, when upgrading an existing RouterOS device, this snippet became part of the configuration:

/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote

A few remarks:

I could not find anything in WinBox that is equivalent.
This sounds very insecure, so I have run this script:
```
/ip ssh
set allow-none-crypto=no forwarding-enabled=no
```
which makes the snippet to disappear (because they are default settings according to [WayBack] Manual:IP/SSH – MikroTik Wiki).

Like usual, the on-line documentation is dense and insufficiently clear, hence my measure.

In the future, I need to decipher these posts (via [WayBack] winbox ssh allow none crypto – Google Search and [WayBack] winbox ssh forwarding enabled remote – Google Search):

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »

MikroTik RB960PGS hEX PoE powering PoE devices: ensure you get a 48V power supply

Posted by jpluimers on 2021/08/24

By default, the [WayBack] MikroTik RB960PGS hEX PoE comes with a 24V power supply.

Most PoE capable devices cannot be powered by 24V but need 48V. I wrote about this before in the midst of the long post Linus Torvalds – Google+: Working gadgets: Ubiquiti UniFi collection (and a whole bunch of Unifi/Ubiquiti/Ubtn links)

Mikrotik needs to make up their mind, as they ship a 24V power supply which cannot power any 802.3af/802.3at devices. The 48POW power supply enables 802.3af for the RB960PGS hEX PoE: [WayBack] hEX PoE (RB960PGS) – Need 48V Power Supply – MikroTik

So now I re-mention it in a much smaller post so it easier to find back, and a few links to Power over Ethernet – Wikipedia, where especially these bits are relevant:

The PoE Standard implementation for 802.3af (802.3at Type 1) “PoE” requires DC 44.0–57.0 V.
Of the PoE Non-standard_implementations, some common Passive specifications include:
- 24VDC 0.5A 100 Mbit/s or 1 Gbit/s
- 24VDC 1.0A 100 Mbit/s or 1 Gbit/s
- 48VDC 1.0A 100 Mbit/s or 1 Gbit/s
- 56VDC 1.0A and 2.0A 1 Gbit/s (used for 45W+ load point to point microwave and millimeter band radios

The 24V is what MikroTik sticks to with their default power supply.

Read the rest of this entry »

Posted in Internet, MikroTik, Network-and-equipment, Power User, routers, Unifi-Ubiquiti | Leave a Comment »

Winbox 3.19 can connect via MAC whereas Winbox 3.17 cannot

Posted by jpluimers on 2021/08/17

Not sure why, but Winbox 3.17 could not connect to out of the box blank MikroTik equipment at all.

Winbox 3.19 complains every now and than, but usually connects fine.

This was while configuring a bunch of [WayBack] MikroTik Routers and Wireless – Products: CRS305-1G-4S+IN.

Read the rest of this entry »

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

Mikrotik CCR devices based on NAND memory will eventually die

Posted by jpluimers on 2021/08/16

If you own a Mikrotik CCR device based on NAND memory, then be prepared that it will die.

I had this on a (now discontinued [WayBack] MikroTik Routers and Wireless – Products: CCR1009-8G-1S-1S+PC, superseded by the less functional [WayBack] MikroTik Routers and Wireless – Products: CCR1009-7G-1C-1S+PC, which is also NAND based).

Many more people had this or very similar problems:

It also happens due to bad capacitors on the (also discontinued) [WayBack] MikroTik Routers and Wireless – Products: RB1200:

[WayBack] RB1200 + Router keeps rebooting in loop (on power up one beep then it continues in loop) – MikroTik

There have been quite a few NAND related changes to the firmware over the years that have to do with handling corruption:

If you are really lucky (I was not), then it is a bad power supply: [WayBack] bootloop on CCR1036-12g-4s (almost 5 years old) [SOLVED] – MikroTik.

Sometimes you can partially recover using the Console port or NetInstall, but eventually you will trip another part of the faulty NAND storage and it will die again, until it has spent all its lives.

Unlike a cat, those are usually far less than 9 lives.

If you do need to recover, the links might help you:

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »

Factory reset a MikroTik hEX PoE RB960PGS using the reset button

Posted by jpluimers on 2021/08/02

[WayBack] Manual:Reset – MikroTik Wiki:

unplug the device from power

2) press and hold the button right after applying power

Note: hold the button for 5 seconds (USER LED will start flashing)

3) release the button to clear configuration.

Note: If you wait until LED stops flashing, and only then release the button – this will instead launch Netinstall mode, to reinstall RouterOS.

Initial configuration

Connect your machine to port 1 on the Mikrotik hEX PoE RB960PGS (after the reset, this port will have IPv4 address 192.168.88.2 with netmask 255.255.255.0)
Ensure your local machine to IPv4 address 192.168.88.2 with netmask 255.255.255.0 (otherwise WinBox might not see the router, not even in discovery mode):
Have WinBox auto discover it:
Connect with user admin and no password:
Configure your Mikrotik hEX PoE RB960PGS as router or switch

For switch, I prefer a setting like this (the bold portions are different from the default configuration):

/interface bridge
add admin-mac=64:D1:54:13:98:E6 auto-mac=no comment=defconf name=bridgeLocal
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal comment=defconf interface=ether3
add bridge=bridgeLocal comment=defconf interface=ether4
add bridge=bridgeLocal comment=defconf interface=ether5
add bridge=bridgeLocal comment=defconf interface=sfp1
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=bridgeLocal
/ip dns static
add address=192.168.88.1 name=router.lan
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name="RB960PGS <<location-name>>"
/system ntp client
set enabled=yes server-dns-names=0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »

Did not realise that a 2018 Mikrotik vulnerability made it to the top of the CBL (SMTP composite black list) warning page for quite some months as the first ever device

Posted by jpluimers on 2021/07/02

Having it accidentally made it to the CBL (Composite Blocking List – Wikipedia) a long time ago, I discovered the page started with (WayBack link mine):

IMPORTANT: Many CBL/XBL listings are caused by a vulnerability in Mikrotik routers. If you have a Mikrotik router, please check out the [WayBack] Mikrotik blog on this subject and follow the instructions before attempting to remove your CBL listing.

It wasn’t one of my Mikrotik devices, as first of all they had all being patched out of the box from a really empty internal network before being externally exposed to the internet or more busy internal networks, and second because the CBL entry was a one off on one specific day where someone used our guest network.

Some CBL entries in the range where it was displayed, quite a while after CVE-2018-14847 became public:

WayBack 20190203: CBL. A DIVISION OF SPAMHAUS.
WayBack 20190628: CBL. A DIVISION OF SPAMHAUS.

20180802:

[WayBack] CVE – CVE-2018-14847

Description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

References

Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.

EXPLOIT-DB:45578

[WayBack] URL:https://www.exploit-db.com/exploits/45578/

[WayBack] MISC:https://github.com/BasuCert/WinboxPoC

[WayBack] MISC:https://github.com/BigNerd95/WinboxExploit

[WayBack] MISC:https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf

[WayBack] MISC:https://github.com/tenable/routeros/tree/master/poc/bytheway

[WayBack] MISC:https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847

[WayBack] MISC:https://n0p.me/winbox-bug-dissection/

[WayBack] CVE-2018-14847 : MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

Description
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
EXPLOIT-DB:45578 [WayBack] URL:https://www.exploit-db.com/exploits/45578/ [WayBack] MISC:https://github.com/BasuCert/WinboxPoC [WayBack] MISC:https://github.com/BigNerd95/WinboxExploit [WayBack] MISC:https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf [WayBack] MISC:https://github.com/tenable/routeros/tree/master/poc/bytheway [WayBack] MISC:https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847 [WayBack] MISC:https://n0p.me/winbox-bug-dissection/

[WayBack] NVD – CVE-2018-14847

Hyperlink Resource

https://github.com/BasuCert/WinboxPoC Exploit MitigationThird Party Advisory

https://github.com/BigNerd95/WinboxExploit Exploit MitigationThird Party Advisory

https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf ExploitThird Party Advisory

https://github.com/tenable/routeros/tree/master/poc/bytheway ExploitThird Party Advisory

https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847 ExploitThird Party Advisory

https://n0p.me/winbox-bug-dissection/ ExploitThird Party Advisory

https://www.exploit-db.com/exploits/45578/ ExploitThird Party AdvisoryVDB Entry

Hyperlink	Resource
https://github.com/BasuCert/WinboxPoC	Exploit MitigationThird Party Advisory
https://github.com/BigNerd95/WinboxExploit	Exploit MitigationThird Party Advisory
https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf	ExploitThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/bytheway	ExploitThird Party Advisory
https://github.com/tenable/routeros/tree/master/poc/cve_2018_14847	ExploitThird Party Advisory
https://n0p.me/winbox-bug-dissection/	ExploitThird Party Advisory
https://www.exploit-db.com/exploits/45578/	ExploitThird Party AdvisoryVDB Entry

If you want to try for yourself or harden it: [WayBack] Exploiting Mikrotik for Good ? | Syed Jahanzaib Personal Blog to Share Knowledge !

So I did some more digging.

First of all, it seems that if you ever had an infected Mikrotik system, then you have to factory reset it, then upgrade and configure from scratch. Otherwise at least the SOCKS and Web proxy services can still send out spam: [Archive.is] spammer behind mikrotik or mikrotik is the spammer : sysadmin. There, the best advice was

aliterCogitare, Jr. Sysadmin:

Your mikrotik has been compromised then, I would suggest either going on site and rebuilding the router from scratch, or looking at a few things:

Check System -> Scheduler for any schedules running( that you haven’t configured yourself)

Check Systems -> scripts for any installed scripts that are running and delete, also look for running jobs and terminate them.

Finally check the file explorer for any suspicious files or scripts, and delete any you find. A default library should look like this: flash (the partition) -pub -skins anything else that you havent put there yourself, Delete.

Anything else that I have mentioned above should be empty. Also you need to re-evaluate the security of your network. If you happen to be on site, reset the router and remove the default configuration on the boot prompt. Create two rules:

Allow input chain source IP from your default local network, if i remember correctly its 192.168.88.0/24

create an explicit drop rule on input chain for all interfaces and addresses + ports

disable IP – services except winbox Finally work your way up on what your network needs step by step by creating rules to accept traffic. And be sure to put your explicit rule on the bottom of the list by drag-and-dropping. That is all I can say, I hope I could be of help.

This means the advice in these two links might not be enough:

Another helpful resource [WayBack] Router Sending Spam – MikroTik which discusses the firewall rules, socks and web proxy services.

Second, there are a truckload of these devices around: [WayBack] Thousands of Compromised MikroTik Routers Send Traffic to Attackers and [WayBack] Thousands of MikroTik routers are snooping on user traffic | ZDNet write that in September 2018, at least 7500 devices were known infected and about 370-thousand endpoints vulnerable.

Third, you should be able to use [WayBack] Manual:Tools/Netwatch – MikroTik Wiki to check if you are on the CBL: [WayBack] Probing CBL blacklist – MikroTik.

Read the rest of this entry »

Posted in Firewall, Internet, MikroTik, Power User, routers, SPAM | Leave a Comment »

Forced routing of selective emails to ISP SMTP via Mikrotik Routing | Syed Jahanzaib Personal Blog to Share Knowledge !

Posted by jpluimers on 2021/01/14

For my link archive: [WayBack] Forced routing of selective emails to ISP SMTP via Mikrotik Routing | Syed Jahanzaib Personal Blog to Share Knowledge !

–jeroen

Posted in Development, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

Mikrotik Remote Access via Multiple WAN Links | Syed Jahanzaib Personal Blog to Share Knowledge !

Posted by jpluimers on 2020/11/04

Multi-WAN routing always involves marking incoming connections to the replies go out on the same connection: [WayBack] Mikrotik Remote Access via Multiple WAN Links | Syed Jahanzaib Personal Blog to Share Knowledge !

# Mirkotik IP Firewall Mangle Section

/ ip firewall mangle

# Mark traffic coming via WAN-1 link

add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=WAN1_incoming_conn

# Mark traffic coming via WAN-2 link

add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=WAN2_incoming_conn

# Mark traffic routing mark for above marked connection for WAN-1 , so that mikrotik will return traffic via same interface it came in

add chain=output connection-mark=WAN1_incoming_conn action=mark-routing new-routing-mark=to_WAN1

# Mark traffic routing mark for above marked connection for WAN-2, so that mikrotik will return traffic via same interface it came in

add chain=output connection-mark=WAN2_incoming_conn action=mark-routing new-routing-mark=to_WAN2

# Finally Add appropriate routes in ROUTE section

/ ip route

add dst-address=0.0.0.0/0 gateway=1.1.1.2 routing-mark=to_WAN1 check-gateway=ping

add dst-address=0.0.0.0/0 gateway=2.2.2.2 routing-mark=to_WAN2 check-gateway=ping

–jeroen

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

RB450G and “..could not get answer from dns server” – MikroTik

Posted by jpluimers on 2020/07/06

[WayBack] RB450G and “..could not get answer from dns server” – MikroTik: I do not see a default route. It would be the route with “dst-address=0.0.0.0/0“.

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »

« Previous Entries

Next Entries »

	Jeroen Wiert Pluimer… on Pie Comic by John McNamee: Mov…
	Attila Kovacs on Crowbarring Windows 95 into Wi…
	Jeroen Wiert Pluimer… on Does Odido (the old T-Mobile N…
	Lars Fosdal on Security alarm provider Woonve…
	Thomas Mueller on Question got closed in May 202…

The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

Twitter Updates

My Flickr Stream

Pages

All categories

Email Subscription

Archive for the ‘MikroTik’ Category

MikroTik PoE: automatically power cycle and reboot device when it becomes unresponsive.

Mikrotik RouterOS “/ip ssh” setting not available from WinBox and defaulting to insecure?

MikroTik RB960PGS hEX PoE powering PoE devices: ensure you get a 48V power supply

Winbox 3.19 can connect via MAC whereas Winbox 3.17 cannot

Mikrotik CCR devices based on NAND memory will eventually die

Factory reset a MikroTik hEX PoE RB960PGS using the reset button

Initial configuration

Did not realise that a 2018 Mikrotik vulnerability made it to the top of the CBL (SMTP composite black list) warning page for quite some months as the first ever device

So I did some more digging.

Forced routing of selective emails to ISP SMTP via Mikrotik Routing | Syed Jahanzaib Personal Blog to Share Knowledge !

Mikrotik Remote Access via Multiple WAN Links | Syed Jahanzaib Personal Blog to Share Knowledge !

RB450G and “..could not get answer from dns server” – MikroTik

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

My Flickr Stream

Pages

All categories

Email Subscription

Archive for the ‘MikroTik’ Category

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Initial configuration

Rate this:

Share this:

So I did some more digging.

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this: