The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,861 other subscribers

Archive for the ‘Internet’ Category

Mikrotik RouterOS scripting: for loops are a bit of getting used to

Posted by jpluimers on 2017/07/18

Earlier, I wrote “:for loops are a strange beast so I will elaborate on those in a separate post.” so now is the time to do that.

The :for loop documentation is very dense:

Command Syntax Description
for :for <var> from=<int> to=<int> step=<int> do={ <commands> } execute commands over a given number of iterations

So a for loop has these elements:

  • from=
  • to=
  • step=
  • do=

Luckily, the old RouterOS 2.7 documentation on loops (which they’ve revamped after Router OS 2.7 removing many useful examples) has this:

:for – It has one unnamed argument, the name of the loop variable. from argument is the starting value for the loop counter, tovalue is the final value. This command counts loop variable up or down starting at from and ending with to, inclusive, and for each value it executes the do statement. It is possible to change the increment from the default 1 (or -1), by specifying the stepargument.

[admin@MikroTik] > :for i from=1 to=100 step=37  do={:put ($i . " - " . 1000/$i)}
1 - 1000
38 - 26
75 - 13
[admin@MikroTik] >

You might think that from= the start value, to= the finish value and the loop won’t execute when step= a positive value and from= larger than to=. Or that without a step= the loop will always iterate in ascending order.

Wrong! And wrong!

So it’s time for some…

:for loop examples

Read the rest of this entry »

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

TomatoUSB – selectively save/restore NVRAM settings before/after upgrading

Posted by jpluimers on 2017/07/14

TomatoUSB recommends a NVRAM reset (or 30/30/30 reset) before and after upgrades.

This means you loose all your settings which causes a lot of people to not upgrade at all.

The steps to export/import are a bit vague as they depend on what you want to save.

It basically comes down to do this on the old configuration

nvram export --set

Save that output to a local file and then use a search tool searching for specific sections you want to restore.

After you restored the sections ensure you persist them:

nvram commit

This is what the TomatoUSB author usually searches for:

Read the rest of this entry »

Posted in Internet, Power User, routers, TomatoUSB | Leave a Comment »

3.6 GIG – Public-Mikrotik-Bandwidth-Test-Server – MikroTik RouterOS

Posted by jpluimers on 2017/07/10

Don’t abuse: 3.6 GIG – Public-Mikrotik-Bandwidth-Test-Server – MikroTik RouterOS [WayBack]

Primary btest server (for short high speed bursts):

  • IP address: 207.32.195.2
  • User: btest
  • Passowrd: btest
  • Max connection time: 10 minutes
  • No winbox access, only bandwidth test

Secondary btest server (for longer less high speed traffic) [WayBack]:

  • IP address: 207.32.195.10
  • User: btest
  • Passowrd: btest
  • Local Tx Speed: 25k
  • Remote Tx Speed: 25k
  • No winbox access, only bandwidth test

–jeroen

Posted in Internet, MikroTik, Power User, routers | 6 Comments »

Mikrotik RouterOS /ip firewall address-list timeout values sort-of documented

Posted by jpluimers on 2017/07/05

Thanks to ZeroByte answering at [Answered] Where are ip firewall address-list timeout values documented – MikroTik RouterOS [WayBack] which I edited a bit here:

I haven’t seen anything specific to the format of these time tokens, but the firewall add-to-address-list timeout is documented here:
http://wiki.mikrotik.com/wiki/Manual:IP … Properties…It seems to take the same format as any other similar duration-related input I’ve encountered:
  • a raw number is interpreted as seconds
You can specify a number as another duration with tokens:
  • s = seconds (default)
  • m = minutes
  • h = hours
  • d = days
  • w = weeks

A few aspects:

  • Tokens can combine be in any order
  • Whitespace is ignored

So these are all valid:

2s 2h 2w
1w2d3h4m5s
5s4m3h2d1w

  • Days and weeks just get added together. If you specify 1w8d, this is the same as 2w1d
  • The last value specified may be in h:m:s format or in h:m (omit seconds)
  • Interestingly, if you mix and match, they just get added:
    • “1d 2h 12:30” -> “1d 14:30:00”
  • Values larger than 536870911 seconds are stored and tracked but when displayed show as 0sec.
    (248 days, 13:13:55)
  • The maximum value is 4294967295 seconds (which is the maximum 32-bit value)
    This decodes to: 7101w3d6h28m15s as the largest value….
    (7101 weeks is ~136 years counting for leap years, by the way)

–jeroen

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

Tunneling over WebSockets

Posted by jpluimers on 2017/07/04

Just found out about these interesting links I had loved to use years ago, but alas, now I know (:

It looks similar to SSL VPN sometimes also called WebVPN:

Then there are non-VPN tunnels through WebSockets:

Since WebSockets can run over a proxy server you could route any kind of binary traffic through them even in places that disallow non-web protocols or layer-7 inspect https traffic.

Although ops might restrict stuff even further:

–jeroen

Posted in Internet, Network-and-equipment, Power User, VPN | Leave a Comment »

middelink/mikrotik-fwban: Use your Mikrotik firewall to do fail2ban like blocking of unwanted IPs. Written in Go

Posted by jpluimers on 2017/06/26

Interesting: middelink/mikrotik-fwban: Use your Mikrotik firewall to do fail2ban like blocking of unwanted IPs. Written in Go.

It might beat these (that just count SSH connections, not failed connection attempts):

Another alternative is to parse one of the logs:

Of course you should have this installed by default as part of your hardening process:

–jeroen

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

The Bogon Reference – Team Cymru

Posted by jpluimers on 2017/06/23

WHAT IS A BOGON, AND WHY SHOULD I FILTER IT?

A bogon prefix is a route that should never appear in the Internet routing table. A packet routed over the public Internet (not including over VPNs or other tunnels) should never have a source address in a bogon range. These are commonly found as the source addresses of DDoS attacks.

Source: The Bogon Reference – Team Cymru

The regular Bogon list is pretty static (last change in 2012), so I’ve listed the text version below. But the full Bogon list (including unused IPv4 space) is dynamic.

0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4

–jeroen

Posted in Internet, Power User, routers, Security | Leave a Comment »

MikroTik SFP module compatibility table – MikroTik Wiki

Posted by jpluimers on 2017/06/19

Paraphrased from MikroTik SFP module compatibility table – MikroTik Wiki [WayBack]:

SFP+ interface compatibility settings with 1G links

For MikroTik devices with SFP+ interface that support both 10G and 1G link rate following settings are needed to be set on both linked devices for required interfaces. In order to get them working in 1G link rate.

  • auto-negotiation disabled
  • port speed 1G
  • FD

Devices which SFP+ ports support 1G links:

Devices which SFP+ interfaces can be used only for 10G links:

Some caveats leading to the above info: CCR1036-8G-2S+ SFP Problems – MikroTik RouterOS [WayBack]

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »

URLs for Mikrotik PCC load balancing

Posted by jpluimers on 2017/06/16

PCC load balancing saved my ass; here are some link I used:

–jeroen

Posted in Development, Internet, MikroTik, Power User, RouterOS, routers, Scripting, Software Development | Leave a Comment »

IPv6 on Mikrotik URLs

Posted by jpluimers on 2017/06/15

I need to really put some effort in this:

–jeroen

Posted in Internet, MikroTik, Power User, routers | Leave a Comment »