For my link archive: [WayBack] Route traffic from one port via VPN – MikroTik
Via [WayBack] networking – Mikrotik route internet traffic from one interface via vpn – Super User
–jeroen
Archive for the ‘MikroTik’ Category
Route traffic from one port via VPN – MikroTik
Posted by jpluimers on 2019/09/16
Posted in Internet, MikroTik, Power User, routers | Leave a Comment »
Research list: machine sometimes not visible on LAN
Posted by jpluimers on 2019/04/08
When one of the machine isn’t active for a while it seems to disappear. Even when it’s active some of the machines have intermittent errors pinging it as like every 10-30 seconds one of these ping results appear:
92 bytes from tl-er5120 (192.168.71.1): Redirect Host(New addr: 192.168.71.193) Vr HL TOS Len ID Flg off TTL Pro cks Src Dst 4 5 00 0054 05de 0 0000 40 01 644d 192.168.71.108 192.168.71.193
Sometimes even a simple
Request timeout for icmp_seq 6900
So I need to dig into ICMP “Redirect Host” .
It might be a simple ARP thing like mac mini – Why the different results for ping? Or why is the Time Capsule getting involved? – Ask Different [WayBack] but like usual stuff I bump into is of a more complex kind so I’ve archived at least these:
- ICMP – redirect host (5:1) – MikroTik RouterOS [WayBack]
- Directed ARP and ICMP Redirects « ipSpace.net by @ioshints [WayBack]
- ICMP redirects are ba’ad, mkay? [Google Cache as no WayBack]
- networking – Why do ICMP Redirect Host happen? – Server Fault [WayBack]
–jeroen
Share this:
Posted in Internet, MikroTik, Power User, routers | Leave a Comment »
Just in case I move away from Mikrotik
Posted by jpluimers on 2018/07/02
Mikrotik has great hardware, great firmware (if you have the right builds), but notoriously bad documentation and a not so great software release and testing process.
So I might consider switching away, so here are some threats that might lead to alternatives:
[WayBack] Router board based on MediaTek MT7620A MIPS processor with 4 LAN port, one PoE capable WAN port, and two mini PCIe slot for 4G LTE module. – Jeroen Wiert Pluimers – Google+
- Jeroen Pluimers on Twitter: “@B1tSmurf I switched to Mikrotik. Great hardware and possibilities. Horrible documentation and software release processes.”
- @B1tSmurf I’ve used to use MikroTik however their braindead GUI and half Cisco-like cli made me switch to pfSense. Much easier and powerful
besides, pfSense is open source software, rock solid with an active community. You can download an iso and install right away. - @jpluimers
then I’d need to find affordable hardware supporting 10g fiber and 24 port 1g CAT6. - @B1tSmurf What price range? :-)
- @jpluimers around CCR1009 and CRS226 prices.
- @B1tSmurf Take a look at the scope7 line from http://landitec.com , a bit more expensive but powerful and flexible.
scope7-7573 or 8759 are the ones you can stuff a 2/4 port SFP+ module into.
- @B1tSmurf I’ve used to use MikroTik however their braindead GUI and half Cisco-like cli made me switch to pfSense. Much easier and powerful
–jeroen
Vincent Parret commented at https://plus.google.com/+JeroenPluimers/posts/UWZiufmkdK1
I use ubnt edgerouters, great bang for buck. My ER Pro-8 has been up for 8 months (no reboots) and hasn’t missed a beat, rock solid ipsec vpn. I looked at microtik, but found the edgerouters slightly easier to configure.
Share this:
Posted in Internet, MikroTik, Power User, routers | Leave a Comment »
Urgent security advisory – MikroTik – upgrade to 6.41.3 if you can change your bridge implementation, ensure SMB and WWW are not WAN accessible
Posted by jpluimers on 2018/03/31
I both understand the [WayBack] Urgent security advisory – MikroTik and the users reluctant to upgrade: Mikrotik has a history of updates breaking existing behaviour and underdocumenting features and release notes.
The attack is over the www or www-ssl services which by default run on port 80 and 443. You can see on which networks they are bound using this example from the terminal:
> ip service print where name=www
Flags: X - disabled, I - invalid
# NAME PORT ADDRESS CERTIFICATE
0 www 80 192.168.71.0/24
192.168.171.0/24
192.168.124.0/24
> ip service print where name=www-ssl
Flags: X - disabled, I - invalid
# NAME PORT ADDRESS CERTIFICATE
0 www-ssl 443 192.168.71.0/24
192.168.171.0/24
192.168.124.0/24
Note that if your device was infected, not all upgrades will remove the infection on all machines (even though it is mentioned in the FAQ below!). This is one of the “underdocumenting” aspects I mentioned.
There is no way to officially check if your device is infected. If you suspect it is and cannot upgrade to 6.41.3 or more recent, then you need to use [WayBack] Manual:Netinstall – MikroTik Wiki to wipe clean your router and re-install.
Be careful which version you upgrade to:
- 6.41.x and up in the [WayBack] MikroTik – ChangeLog – Current Release Tree need a careful upgrade process have a new bridge implementation (see [WayBack] v6.41 [current] – MikroTik: This update will convert all interface “master-port” configuration into new bridge configuration, and eliminate “master-port” option as such.)
- 6.40.x in the [WayBack] MikroTik – ChangeLog – BugFix Release Tree likely still suffers from the SMB vulnerability (search for “improved NetBIOS name handling and stability” “6.41.3”)
Somewhere in the middle of page 2 of the above post [WayBack], this is slightly addressed:
1) Upgrade to 6.38.5 fixes the botnet scanner and removes it.
2) Upgrade to 6.41.3 fixes SMB vulnerability.
Later this morning further below on page 2 of the above post [WayBack] it was elaborated more:
I recommend that you re-read all the posts from “normis”. Seems that we are going into circles.
1) Winbox port is used only to find out that this is RouterOS powered device (Winbox is not affected by vulnerabilities that we know of);
2) WWW service (“/ip service”) is used in order to “hack” your router if Firewall did not drop connections to this port (affected service was Webfig which by default is running on port 80, but you can change port under “/ip service” menu and then this other port must be protected). For example, “/ip firewall filter add chain=input action=drop in-interface=WAN connection-state=new”;
3) Issue with SMB is completely another thing but the same rules apply. If device (in this case SMB port) is protected by firewall, then no one can use this issue in order to mess up with your router. Usually attacks come to your router from public Internet (not from LAN) and in normal situation SMB access is not open for public Internet;
4) There is not and will not be an official way to gain access to routers shell.You will be safe from both of these issues if you upgrade your routers (6.38.5 for WWW issue and 6.41.3 for SMB). In order to upgrade many devices at the same time – you can use MikroTik tool called The Dude or use scripts.
From the above post, at least read the FAQ:
FAQ:
What is affected?
– Webfig with standard port 80 and no firewall rules
– Winbox has nothing to do with the vulnerability, Winbox port is only used by the scanners to identify MikroTik brand devices. Then it proceeds to exploit WEBFIG through port 80.Am I safe?
– If you upgraded your router in the last ~12 months, you are safe
– If you had “ip service” “www” disabled: you are safe
– If you had firewall configured for port “80”: you are safe
– If you only had Hotspot in your LAN, but Webfig was not available: you are safe.
– If you only had User Manager in your LAN, but Webfig was not available: you are safe.
– If you had other Winbox port before this: you are safe from the scan, but not from the infection.
– If you had “winbox” disabled, you are safe from the scan, not from the infection.– If you had “ip service” “allowed-from” set to specific network: you are safe if that network was not infected.
– If you had “Webfig” visible to LAN network, you could be infected by an infected device in your LAN.How to detect and cure?
– Upgrading to v6.38.5 or newer will remove the bad files, stop the infection and prevent anything similar in the future.
– If you upgrade device and you still see attempts to access Telnet from your network – run Tool/Torch and find out a source of the traffic. It will not be router itself, but another device in local network which also is affected and requires an upgrade.
–jeroen
Share this:
Posted in Internet, MikroTik, Power User, routers, Security | Leave a Comment »
mikrotik CRUD examples for all APIs · danikf/tik4net Wiki
Posted by jpluimers on 2018/01/25
tik4net – Connect from .NET C# application to mikrotik router via ADO.NET like API or enjoy O/R mapper like highlevel api.
Source: CRUD examples for all APIs · danikf/tik4net Wiki
[Archive.is] C# API – tik4net on GitHub – Page 2 – MikroTik RouterOS
–jeroen
Share this:
Posted in .NET, C#, Development, MikroTik, RouterOS, routers, Scripting, Software Development | Leave a Comment »
Some links on isolating parts of networks with Mikrotik
Posted by jpluimers on 2017/11/10
On my research list so I can do proper LoT.
- [WayBack] iptables – How to isolate networks with a Mikrotik router? – Super User
- [WayBack] Can I run multiple networks on this MikroTik L3 switch? – Network Engineering Stack Exchange
- [WayBack] Creating a Guest Wireless Network on a MikroTik running RouterOS 6 with Winbox
- [WayBack] Mikrotik Limiting User Access via DHCP via /32 + Forcing Users to use your DHCP Server Only ! | Syed Jahanzaib Personal Blog to Share Knowledge !
- [WayBack] Isolating Network Traffic – MikroTik RouterOS
- [WayBack] How to isolate two networks – MikroTik RouterOS
- [WayBack] Mikrotik Wireless Client Isolation — Manito Networks
- [WayBack] mikrotik wifi isolate client – YouTube
- [WayBack] A network which can access the Internet, but not other machines on the LAN.Not even ethernet frames. How to Make an Isolated Network | Murray’s Blog
- [WayBack] Mikrotik VLAN switching without bridging – Breek een been!
- [WayBack] How to Config Mikrotik for 2 Wan 2 Network isolated? – Stack Overflow
- [WayBack] Mikrotik Routing between two subnet in one interface – Stack Overflow
–jeroen
Share this:
Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »
How to connect S+DA0003 using SFP between MikroTikCRS226 and MikroTikCCR1009
Posted by jpluimers on 2017/10/30
Mikrotik and SFP versus SFTP+ is always confusing especially as the text on their equipment and their documentation doesn’t show well which situations work.
Equipment text is further on, this is their text searchable documentation:
- [WayBack]: Supported Hardware: SFP+ modules – MikroTik Wiki tells this:
-
Brand Model Distance Rate Connector/Cable type Wavelength Tested with Works / Doesn’t MikroTik S+DA0003 3M 10G Twinax Copper — All MikroTik products with SFP/SFP+ interfaces Natively supported
-
- SplusDA0003: This is highly cost-effective way to connect two SFP/SFP+ devices (for example two units of CCR1036-8G-2S+) for very short distances…[WayBack] RouterBoard.com : SFP+ 3m direct attach cable
As usually, a long search in the forums reveals the background information:
[WayBack] SFP in SFP+ slot – MikroTik RouterOS: 10Gb SFP+ sockets are usually backward compatible with SFP, but this is not guaranteed.
There are two tricks involved to get an SFP connection between these devices working:
Share this:
Posted in Internet, MikroTik, Power User, routers | Leave a Comment »
Need to give this some thought: multi-LAN on Mikrotik
Posted by jpluimers on 2017/10/27
Maybe for my LoT (LAN of Things): having multiple (even many) local LANs some each with their section of LoT equipment nicely separated and partially being able to talk to some of the other LANs or part of the outside world.
Some links that might help me getting this set up:
- [WayBack] How to set up multiple networks on a Mikrotik router | Networking For Integrators
- [WayBack] Masqueraed and routing, few questions (multiple LAN, multiple WAN scenario) – MikroTik RouterOS
- [WayBack] Multiple Lan on single wan – MikroTik RouterOS
- [WayBack] Mikrotik RouterOS routing between subnets on local ports – Network Engineering Stack Exchange
The basic plan:
- Configure each port or grouped (with ethernet master-port or maybe bridged) of ports having their own address pool and DHCP server so each of them are in a separate private network
- Routes between the networks so they can be accessed
- NAT mangling so the networks can reach the other networks or outside world without exposing their private network addresses
- Firewall rules to permit/limit which networks can see each other or the outside world
WinBox displays routes in various colors [WayBack]:
- Black – active
- Blue – inactive
- interface not up or disconnected
- other route with higher precedence already covers this route
- Red – invalid
- interface does not exist
- interface is disabled
- IP address not on that interface any more
Sometimes they show as blue while still being legitimate. Not sure why yet.
–jeroen
Share this:
Posted in Development, MikroTik, RouterOS, routers, Scripting, Software Development | Leave a Comment »
Delay running a script after restart – MikroTik RouterOS
Posted by jpluimers on 2017/10/24
Start Time special value `startup`
There is a special startup value for “Start Time” you can enter which makes it runs once 3 seconds after reboot.
If by then your router isn’t fully “up” yet (i.e. waiting for PPPoE or DHCP network settings), then inside the script you can perform a delay global command as shown in the code fragment from the below forum post.
Don’t you love how people still tend to both repeat themselves and abbreviate stuff even though they have code completion at their disposal?:
{:delay 10};
/log print file=([/system identity get name] . "Log-" . [:pick [/system clock get date] 7 11] . [:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6]); \
/tool e-mail send to="xxx@xxx.com" subject=([/system identity get name] . " Log " . \
[/system clock get date]) file=([/system identity get name] . "Log-" . [:pick [/system clock get date] 7 11] . \
[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6] . ".txt"); :delay 10; \
/file rem [/file find name=([/system identity get name] . "Log-" . [:pick [/system clock get date] 7 11] . \
[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6] . ".txt")]; \
:log info ("System Log emailed at " . [/sys cl get time] . " " . [/sys cl get date])
Share this:
Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »
Mikrotik Router OS 6.37.1 – scripts and schedules – what policies they need to run
Posted by jpluimers on 2017/10/19
minimum schedule and script policies: read/write/policy/test
A year later, Mikrotik still needs to update their documentation, so from my question at [WayBack] [Mikrotik follow-up needed] Router OS 6.37.1 – scheduled script cannot execute script – MikroTik RouterOS.
TL;DR:
- use the same policies for scripts and schedules
- use these policies as a minimum for scripts and schedules:
- read
- write
- policy
- test
Forum post:
I found out two things:
- the
testFunctionScriptneeds at least these policies to call a function:read,write,policy,test- a
scheduleneeds at least the same permissions as a script in order to run the script at allThis is how the various permissions affect the
testFunctionScriptscript:
- no policies only allow
:log info "testFunctionScript";.readallows the above and:local testFunctionJobs [/system script job print as-value detail];which then is be logged with:log info "testFunctionJobs=$testFunctionJobs";- only
writeseems equivalent to no policies as it will only allow:log info "testFunctionScript";readandwriteis equivalent toread- a lone
policyortestpolicy (talk about confusion!) do not add functionality, so any combinations of justpolicyortestwithreadand/orwriteget the same functionality as abovepolicyandtestwithout any other seem equivalent to no policies as they result in only:log info "testFunctionScript";to execute- the combined policies
read,write,policy,testallow full script functionality including the function call and using the function call resultThe above findings show that more logging is needed: the scheduler should log when (and why!) it does not have enough permissions to run a script. Right now you’re in the dark on when (and why!) a script isn’t ran by the scheduler.
The above findings show that these parts of the documentation need updating:
– http://wiki.mikrotik.com/wiki/Manual:Sc … repository (update with info about the above policy combinations)
– http://wiki.mikrotik.com/wiki/Manual:Ro … Properties (update with info about the above policy combinations)
– http://wiki.mikrotik.com/wiki/Manual:System/Scheduler (does not document anything about policies at all)
The various scripts (apply your mix of policies that you need)
## logon as user jeroenp
/system script environment remove [ /system script environment find where name="testFunction" ];
:global testFunction do={
:local result [/system resource get uptime];
:return $result;
}
/system script environment print detail where name=testFunction
# 0 name="testFunction" value=";(eval /system scheduler (eval /localname=$result;value=(eval (eval /system resource getvalue-name=uptime))) (eval /returnvalue=$result))"
:log info "direct execution of testFunction"
{
:global testFunction;
:local testFunctionType [:typeof testFunction];
:local testFunctionResult [$testFunction];
:log info "testFunctionScript";
:log info "testFunctionType=$testFunctionType";
:log info "testFunctionResult=$testFunctionResult";
:log info "testFunction=$testFunction";
}
/log print where buffer=memory && (message~"testFunction" || topics~"info")
/system script remove [ /system script find where name="testFunctionScript" ];
/system script add name=testFunctionScript owner=jeroenp policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":global testFunction;\r\
\n:log info \"testFunctionScript\";\r\
\n:local testFunctionType [:typeof testFunction];\r\
\n:local testFunctionResult [\$testFunction];\r\
\n:log info \"testFunctionType=\$testFunctionType\";\r\
\n:log info \"testFunctionResult=\$testFunctionResult\";\r\
\n:log info \"testFunction=\$testFunction\";\r\
\n"
:log info "execution of testFunction via testFunctionScript"
/system script run testFunctionScript
/log print where buffer=memory && (message~"testFunction" || topics~"info")
/system scheduler remove [ /system scheduler find where name="testFunctionScriptSchedule" ];
/system scheduler add interval=10s name=testFunctionScriptSchedule on-event=testFunctionScript policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=sep/22/2015 start-time=12:02:37
:log info "execution of testFunction via testFunctionScriptSchedule calling testFunctionScript"
:delay 20s
/system scheduler disable testFunctionScriptSchedule
/log print where buffer=memory && (message~"testFunction" || topics~"info")
/system scheduler print detail where name="testFunctionScriptSchedule"
–jeroen
Share this:
Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »
The Wiert Corner - irregular stream of stuff 