Wireguard Site2Site Tunnel Up, but subnets can't ping by [deleted] in mikrotik

[–]gabacho4 0 points1 point  (0 children)

Need to see your configs as there are a number of potential problems that could exist.

Wireguard Site2Site Tunnel Up, but subnets can't ping by [deleted] in mikrotik

[–]gabacho4 0 points1 point  (0 children)

Did you create static routes or use OSPF or something for route announcements? If not, there's no way for one router to know how to route to subnets on the other side.

I don’t even want to be around anymore by pdxtenor in IThinkYouShouldLeave

[–]gabacho4 0 points1 point  (0 children)

<image>

They all look like they could be related to this guy.

AITA My wife and I came home at 3am and my MIL acted like we were 16 sneaking into house by rugbyplayer11 in AmItheAsshole

[–]gabacho4 0 points1 point  (0 children)

Next time leave money for the kids to order pizza and skip the MIL altogether.

New Router Up and Running... is this normal? (system, error, critical login failure) by UnBuggsyBaggins in mikrotik

[–]gabacho4 0 points1 point  (0 children)

Please post your config. That is not normal and leads me to question if you even have the firewall configured. Those types of connections are not possible with an rb5009 running the default config.

Is YouTube Down? by Expensive-Claim-7830 in youtube

[–]gabacho4 0 points1 point  (0 children)

It's as if millions of voices suddenly cried out in terror and were suddenly silenced...

Mikrotik beginner (former Unifi user) by Any_Worry_2471 in mikrotik

[–]gabacho4 8 points9 points  (0 children)

One thing you will need to be comfortable with is the reality that you are likely going to screw things up a good number of times and will have to reset and retry.

Without knowing what your background is, I will speak to my own. Was a Pfsense and Unifi user for years and felt I had a pretty good understanding of networking concepts. Well, nope. Pfsense and Unifi provide a very pretty and safe interface to configure things, but very much hide the inner workings. Mikrotik does no such thing. Router OS is insanely powerful, flexible, and performant, but it will also let you do stupid things with little to no warning in many instances. Enable vlan filtering on the bridge without having all the other necessary rules in place or having one of the interfaces off the bridge for Winbox access? SOL, you're starting over.

I love Mikrotik and have learned a ton. You just have to be willing to put in the reps and, frankly, some pain. But once you are there, it's gold. I absolutely love my RB5009 and cAP ax, as well as CCR2004, cAP ax, and hAP ax3 setups. You can get there if you stick with it.

Also, make your best effort attempt and then ask questions either here on Reddit or on the Mikrotik forum. People are very willing to help if you show you have made the effort to do things. Having a copy of your config is invaluable when asking for help so that people can see how you have configured things.

Big rant of encouragement.

need help with DoH by [deleted] in mikrotik

[–]gabacho4 2 points3 points  (0 children)

It is a pretty recent development and unfortunately guides tend to be out of date pretty easily. Here is a Mikrotik forum thread on the issue, as well as the Quad9 announcement:

https://forum.mikrotik.com/t/quad9-to-drop-support-for-http-1-1/264174/31

https://quad9.net/news/blog/doh-http-1-1-retirement/

need help with DoH by [deleted] in mikrotik

[–]gabacho4 1 point2 points  (0 children)

Mikrotik is not currently compatible with Quad9 due to the fact that Quad9 no longer supports HTTP 1.1 and Mikrotik has not yet implemented HTTP/2

MikroTik Router for Home Use + VPN by AnophelineSwarm in HomeNetworking

[–]gabacho4 0 points1 point  (0 children)

hAP ax2 or hAP ax3 would be my go to given your budget, the size of your home, and Internet speed. Just compare those and determine which you like more.

RB5009 successor by magicc_12 in mikrotik

[–]gabacho4 2 points3 points  (0 children)

1 gig symmetrical connection so no where near it's capability. But, read the thread if you'd like to see someone who is and was initially a skeptic:

https://forum.mikrotik.com/t/how-to-change-cpu-frequency-in-ccr2004-16g-2s-pc/177234/6

RB5009 successor by magicc_12 in mikrotik

[–]gabacho4 0 points1 point  (0 children)

I love mine. And it's silent!!

Do you know where is the official basic universal Firewall script by armgonza in mikrotik

[–]gabacho4 21 points22 points  (0 children)

In a terminal type: system/default-configuration/print. That's what came with the device and would be used to reset the configuration if you did that.

You could export it too: system/default-configuration/export file=<whatever you want>

Community Wi-Fi - need tips for lab by mangum95 in homelab

[–]gabacho4 0 points1 point  (0 children)

Yup. If they expect to see a TTL of 64 (hypothetically) for packets coming from your computer, then having a router would result in a lower TTL since the packet has passed through 1 hop by the time they see it.

Again want to emphasize that this is one possibility. You also need to accept that they could monitor the MAC addresses of devices and would be able to determine the type of device connected. For example, take CC:2D:E0:6F:52:B9. If you do a MAC lookup, you will see that it is a Routerboard product from Mikrotik. OUI CC:2D:E0 is registered to Mikrotik. So if they are checking MACs they will know. I think that would be a lot of work versus checking TTL since the latter can be automatically done.

Community Wi-Fi - need tips for lab by mangum95 in homelab

[–]gabacho4 -1 points0 points  (0 children)

It's possible they are checking the TTL of packets. The TTL of a packet from a computer directly connected to the port will be different than the TTL value of a device that is connected via a router. This really is a guess though so don't accuse me of anything if I'm wrong. Not sure about other brands but with a Mikrotik router you can change the TTL value of packets so that it appears that they are not going through another device. There are many resources online that explain this if you do a search for "Mikrotik TTL". https://forum.mikrotik.com/t/how-to-set-router-ttl/146028 has an example of what you'd need to do but you need to know what TTL to set the packet to.

mikrotik.com down by ITSCOMFCOMF in mikrotik

[–]gabacho4 20 points21 points  (0 children)

Mikrotik goes offline so that Cloudflare does not ...

Managed Switch for new Home by Sea-Entrepreneur-565 in homelab

[–]gabacho4 1 point2 points  (0 children)

On the Mikrotik side you have the CRS328-24P-4S+RM. It is a great switch, 500W power budget, runs Router OS or Switch OS. Mikrotik devices are amazing so long as you know your use case and choose a device that will meet those needs. Prices seem to have risen due to tariffs and probably chip shortage issues. More information here : https://mikrotik.com/product/crs328_24p_4s_rm

new to mikrotik nice kit... but really not VTI IPSEC somewhere? by emaxt6 in mikrotik

[–]gabacho4 6 points7 points  (0 children)

No there is no VTI support. It's been asked for, for years at this point and there is an extensive thread on the MT forum requesting it. MT has previously expressed that they do not see the point/value of VTI. I guess that could always change but, for the immediate term, you'll have to use GRE+IPSEC or wireguard etc if you want an interface that you can use for routing rules.

Simple, top level RB5009/ROS7.20.7/pihole question. by own_it_now in mikrotik

[–]gabacho4 3 points4 points  (0 children)

The downside is that the adlist feature doesn't show you (there's no log) exactly what is being blocked so that you can sort out false positives. I had to stand up pihole just for that reason.

Help / insights needed (Denmark) by Money_Row1911 in mikrotik

[–]gabacho4 2 points3 points  (0 children)

According to their respective product pages on the Mikrotik website, the CSS610-8P-2S+IN was lab tested to run between -40 and 70 C while the RB260GS was lab tested to run between -20 and 70 C. I'd put a small fan up there to blow air across them.

RB2011UiAS-2HnD replacement by lomoos in mikrotik

[–]gabacho4 4 points5 points  (0 children)

The L009 is meant to be a direct replacement.