-
Mikrotik - Part 7 User Topics PDF generated using the open source mwlib toolkit. See http://code.pediapress.com/ for more information.
-
Contents Articles MikroTik RouterOS 1 Hardware 2 Supported Hardware 2 Bandwidth Managment and Queues 24 Firewall 25 Monitoring 26 User/Routing 27 Scripts 29 Tunnels 32 Wireless Setups 32 Manual:MPLS 33 Manual:Virtualization 36 Use Metarouter to Implement Tor Anonymity Software 37 User/IPv6 43 User Management 43 The Dude 44 User Manager 45 API PHP package 48 API in C using winsock 57 Manual:API Python3 77 API multiplatform from townet 81 MikroNode 86 API in Java 9
-
API in C Sharp 252 API PHP class 258 MikroTik for Mac 271 Assorted examples 274 References Article Sources and Contributors 275 Image Sources, Licenses and Contributors 277
-
MikroTik RouterOS MikroTik RouterOS This is a user editable how-to page, anyone can contribute! If you have some firewall rules or scripts to share, simply register and add to the list. This is not the official Mikrotik Manual, this page is maintained by our users - by You. Anyone can join and share their configuration, setups, ideas and manuals. And if you find a mistake in someone elses article - simply correct it.
-
Hardware 2 Hardware • RB 750G - Getting Started Help Supported Hardware This page should be edited by the user community to reflect their tested hardware and version used. See also: Device driver list [1] in manual Motherboards Vendor Model ROS version Result Asrock Intel 82801G chipset 3.0-3.14 Bad performance, locks up under heavy load, supports multi cpu, PATA not supported, integrated ethernet not recognized.
-
Supported Hardware 3 Intel D945GCNL 3.11 Works fine but integrated ethernet (just disable) goes up and down on reboots multi-cpu= yes. shared IRQ for PCI devices, decrease nic performace. Intel D945GNT 2.9.45 Works fine Intel DG33FB 3.7 Works fine, Ethernet but not working (IRQ 9), set in BIOS Security/XD Tegnology to disable Intel DG950 2.9.42 Ethernet not recognized Intel DG965SWH 3.0 beta 9 Works fine, but only with SATA not IDE Intel DH67BLB3 5.
-
Supported Hardware 4 Xen 3.2.1 on Intel C2Q 4.x Installs and runs fine on HVM bootloader using Intel VT technology. Even switches to RouterOS console from Dom0 shell. Ethernet interfaces work perfectly. Do not install xen/kvm RouterOS packages! DFI AD73 Pro (Chipset VIA KT266A/VT8233ACD) 2.9.x-3.30 Works fine. All 5 PCI's ocupied with 1 x LAN and 6 x R52H's (3 in RouterBoard11 and 3 in RouterBoard14!) DFI AK75-EC (Chipset VIA KT133A/686B) 3.14-3.30 Stable.
-
Supported Hardware 5 Intel 82599ES - Intel X520 series adapters 5.x & 6.x Works, fine! Note: has SFP transceiver vendor restrictions: [3] D-Link DFE-528TX rev. E1 3.13 Works D-Link DFE-580TX 4-port 3.0 beta 5 Bad card, not recommended. Hangs router D-Link DFE-530/538TX 2.9.43 - 3.x Works well, no apparent problems. D-Link DUB-E100 USB 3.18 added support, reported to be working Marvell 88E8001 Gigabit Ethernet Controller (rev: 20) 3.13 Works Marvell 88E8056 3.
-
Supported Hardware 6 Dell PowerEdge R210 5.1 - 5.6 1U Rackmount. Half-depth (39cm) chassis. Dual port on-board Broadcom 5716 Gigabit Ethernet controllers. Single CPU on Intel 3420 Motherboard Chipset. Works OK and stable, once installed. Some issues with NetInstall - PXE boot works OK but install can't continue (says waiting for drivers...). Tested with Intel Gigabit ET Quad Port Server Adapter - works perfectly.
-
Supported Hardware 7 Soekris net4801-48/50 + lan1641 3.22 All 7 (3+4) ethernet works, USB works (tested with Huawei 3G modem), extra serial port works. And RouterOS installed on CF card. ALIX 2C0 2.9,3.0 2 Ethernet, 2 miniPCI ,128Mb 433Mhz Amd Geode- Working Perfect ALIX 2C1 2.9,3.0 2 Ethernet, 2 miniPCI ,128Mb 433Mhz Amd Geode- Working Perfect ALIX 2C3 2.9,3.0 2 Ethernet, 2 miniPCI ,256Mb 500Mhz Amd Geode- Working Perfect ALIX 3C1 2.9,3.
-
Supported Hardware 8 Huawei E1550 [8] v3.x and higher USB Huawei E1762 USB Modem v5.14 and higher Locks up occasionally on 433UAH. Need to unplug to reset. USB Huawei E372 (USB) Videotron Canada v5.15 and higher Data channel 0 , Info channel 0, APN ihvm.videotron, Phone = *99# , Dial = ATDT , USB Siemens M20 v3.x and higher Huawei E620; v3.x and higher PCMCIA Kyocera KPC650 v3.x and higher PCMCIA Nokia CS-17 (USB) v5.
-
Supported Hardware 9 Option Qualcomm 3G WCDMA Model M00201-10886 (GTM378) [16] v3.x and higher miniPCI-e Option Qualcomm 3G CDMA Model M00301 (GTM380) [17] v3.x and higher Option Qualcomm 3G CDMA Model M00401 (GTM382) [18] v3.x and higher Ericsson 3G F3607gw miniPCI-e v3.x and higher Sierra Aircard 595 [19] v3.x and higher PCMCIA Sierra Aircard 595U USB Sprint Card [20] v3.x and higher USB Sierra Wireless USB 306 v5.9 and higher Data & Info Channel 2. For Telecom NZ use APN internet.
-
Supported Hardware 10 Sierra Wireless MC8755 for Europe [33] v3.x and higher MiniPCI-e Sierra Wireless MC8765 [33] v3.x and higher MiniPCI-e Sierra Wireless MC8775 [34] v3.x and higher MiniPCI-e Sierra Wireless MC8780 [35] v3.x and higher MiniPCI-e Sierra Wireless MC5725 [31] v3.x and higher MiniPCI-e Sierra Wireless MC5727 [36] v3.x and higher MiniPCI-e Sierra Wireless MC8785 v3.x and higher MiniPCI-e Sierra Wireless MC8790 [37] v3.
-
Supported Hardware 11 ZTE MF680 [45] v5.4 and higher Used by 3 in Sweden. Set data chanel to 1 USB ZTE MF668 [46] v4.5 and higher for Rogers Wireless (Canada) Set APN: isp.apn and Info & Data Channel to 1 USB T-Mobile (Germany) Web´n´Walk Box Micro (Huawei E220) [6] v3.x and higher USB Vodafone (Germany) Easybox 2 (Huawei E220) [6] v3.x and higher USB Surfbox Mini (Huawei E220) [6] v3.x and higher USB E-Plus & Base (Germany) USB Minimodem (Huawei E220) [6] v3.
-
Supported Hardware 12 Novatel Expedite ET620 CDMA/EV-DO v3.x and higher Onda H600/ZTE MF330 v3.x and higher Onda MDC525UP PCMCIA Not supported USB Onda MT833UP (opt. ext. antenna) v5.6 and higher Set info channel = 1, data channel = 0 USB Onda MT835UP (opt. ext. antenna) v5.21 and higher Set info channel = 1, data channel = 0 USB BP3-USB & BP3-EXT HSDPA v3.x and higher USB ZTE MY 39 (MSM 6500 based) [58] v3.x and higher PCMCIA Cricket A600 v3.
-
Supported Hardware 13 ZTE MF112 [67] v5.x and higher Huawei ET127 v5.x and higher 3G Huawei EC1261 v5.x and higher USB Huawei E173 [68] v5.x and higher USB ZTE MF190 [69] v5.x and higher Data channel=3 and info Channel=1 USB ZTE MF102 [70] v5.x and higher Works! Possible that need to change data channel=2 and info channel=2 USB Option Globetrotter GT380 v5.x and higher Simcom 5220 v5.x and higher Huawei K3770 v5.x and higher Novatel USB551L (Verizon) [71] v5.
-
Supported Hardware 14 Nokia Datacard CS-11 & CS-15 v5.14 and higher USB ZTE MF821 v5.15 and higher USB Huawei K4510 [79] v5.15 and higher USB Huawei E173s v5.15 and higher USB Huawei E352 Not supported USB Option3G Mini-PCI model GTM661W Not supported USB Option 225 v5.15 and higher ZTE AC682 USB might not work USB ZTE AX320 v5.15 and higher USB ZTE MF 652 v5.15 and higher USB Vodafone Huawei K-4605 v5.15 and higher USB Huawei E353 v5.15 and higher CELOT CT-680 v5.
-
Supported Hardware 15 4G LTE cards LTE should be configured under the new "/interface lte" menu Model Tested RouterOS version Comments Format BandRich C501 [84] v5.25 and v6.0 Sierra Wireless MC7710 [85] v5.25 and v6.0 If modem uses firmware 3.5 it should be upgraded to 3.5.23.2 firmware release in order to work in RouterOS correctly again. MiniPCI-e Sierra Wireless AirCard 320U [86] v6.0 Vendor/product id pair should be 0x0f3d/0x68AA and DirectIP firmware loaded on the modem.
-
Supported Hardware 16 8GB Seagate ST1 CF microdrive V V NA ? ? 64MB Nokia microSD NA NA ? V ? 512MB Kingston microSD NA NA V ? ? 1GB Apacer microSD NA NA V ? ? 1GB Kingston (SDC/1GB) microSD NA NA ? X ? 2GB Kingston microSD NA NA X X ? 2GB Traxdata microSD NA NA ? V ? 4GB Apacer SDHC (class 6) microSD NA NA V X ? 4GB Axiz microSD NA NA V ? ? 4GB Kingston microSD NA NA V ? ? 4GB Kingston SDHC (C04G JAPAN class 4) microSD NA NA V ? ?
-
Supported Hardware 17 SparkLAN WMIA-165G miniPCI RB1xx / RB3xx / RB4xx / RB5xx / RB6xx / x86 2.9 / 3.x / 4.x Perfect, Stable SparkLAN WMIA-166AG miniPCI RB1xx / RB3xx / RB4xx / RB5xx / RB6xx / x86 2.9 / 3.x / 4.x Perfect, Stable SparkLAN WMIA-166AGH miniPCI RB1xx / RB3xx / RB4xx / RB5xx / RB6xx / x86 2.9 / 3.x / 4.x Perfect, Stable Alfa AWPCI 085 H miniPCI RB1xx/RB333/RB4xx/x86 2.9&3.x All just perfect TP-Link TL-WN550/551 PCI x86 2.9&3.
-
Supported Hardware 18 TP-Link TL-WN881ND [102] ] PCI-e x86 v5.xx, v6.xx v5.xx NOT working not appear in interfaces, v6.x working (6.1 unstable after scan stop working in client or manual scan, set to AP-bridge mode working ok) XR2 miniPCI RB433 3.x works XR5 miniPCI RB433, x86 3.x works SR9 miniPCI RB433 3.x works SR9 miniPCI RB411 & RB433 3.x works miniPCI RB433 3.2 & 4.2 tested B/G only, no A.
-
Supported Hardware 19 T1/E1 Model Form factor Platform ROS Farsite FarSync TE1 PCI x86 Result 3.15 supported Note: Since v3.15 RouterOS doesn't support any Sync/T1/E1 cards except select Farsite models GPS Model Connection Platform ROS EXAMPLE USB x86 Result 3.
-
Supported Hardware 20 Brand Model Works / Doesn't generic USB flash drive Works Kingston DataTraveler 2GB Works SFP modules Brand Model Rate Connector/Cable type Wavelength Tested with Works / Doesn't MikroTik S-85DLC05D 1,25G Dual LC, MM 850 CCR/RB2011 Natively supported MikroTik S-31DLC20D 1,25G Dual LC, SM 1310 CCR/RB2011 Natively supported MikroTik S-35LC20D 1,25G LC, SM T1310nm/R1550nm CCR/RB2011 Natively supported MikroTik S-53LC20D 1,25G LC, SM T1550nm/R1310n
-
Supported Hardware 21 Ingellen INSP-SX-MM 1,25G LC, MM 850 RB2011LS-IN Works! AXCEN AXGT-R1T4-05I1 10/100/1000 RJ45, Cat6 - RB2011LS-IN Works! AXCEN AXGD-37А4-0531 1,25G Bi-Di LC, MM 1550/1310 RB2011LS-IN Works! AXCEN AXGD-16А4-0531 1,25G Bi-Di LC, MM 1310/1550 RB2011LS-IN Works! AXCEN AXGD-1354-0531 1,25G LC, MM 1310 RB2011LS-IN Works! AXCEN AXGD-5854-0511 1,25G LC, MM 850 RB2011LS-IN Works! TP-Link TL-SM311LS 1,25G LC, SM 1310 RB2011LS-IN Works! TP-Link
-
Supported Hardware • USB_HSO • USB_USBNET AX88178 (USB2.0 Gigabit Ethernet) recognized but not working. References [1] http:/ / wiki. mikrotik. com/ wiki/ Manual:Driver_list [2] http:/ / forum. mikrotik. com/ viewtopic. php?f=1& t=28184 [3] http:/ / www. intel. com/ support/ network/ adapter/ pro100/ sb/ CS-030612. htm [4] http:/ / www. cmotech. com/ eng/ usbModems/ product. do?act=view& product_seq=55 [5] http:/ / 3g-modem. wetpaint. com/ page/ Ericsson+ F3507G [6] http:/ / www. huaweidevice.
-
Supported Hardware [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69] [70] http:/ / www. novatelwireless. com/ images/ pdf/ Merlin_X720_Datasheet. pdf http:/ / www. novatelwireless. com/ content/ pdf/ Merlin_PC720_Datasheet. pdf http:/ / www. novatelwireless. com/ images/ pdf/ Merlin_XU870_DataSheet. pdf http:/ / www. novatelwireless. com/ content/ pdf/ Merlin_X950D_datasheet. pdf http:/ / www. novatelwireless.
-
Supported Hardware [108] http:/ / www. compex. com. sg/ fullDescription. aspx?pID=96 [109] http:/ / www. compex. com. sg/ fullDescription. aspx?pID=32 [110] http:/ / dbii. com/ f52N-PRO.
-
Firewall Firewall Miscellaneous • • • • • • • • • • • • • Basic universal firewall script Attempt To Detect And Block Bad Hosts Securing A New RouterOS Install Spam Filtering with Port Forwarding and Geo-Location Bridge Filter - Blocking DHCP Traffic Protecting your customers Securing your router How to secure a network using ARP Drop IM Using L7 Drop port scanners Redirect mail traffic to a specified server How to Block Customer Dmitry on firewalling • • • • • • • • • • • • • • • • • • • • • • • • Netw
-
Firewall Web-Proxy or External Cache Servers (SQUID, ISA, any Open Source Cache Server) • Examples for Use Caching Server (5 Main Idea’s) • Squid3+TPROXY4+Mikrotik5 • open source caching server Firewall mangle prerouting • Live-IP-CONCEPT route a IP in any interface with Original ID • Upload_wan_download_another Firewall Scripts • Home Firewall • BOGON Address List Monitoring • • • • • • • • • • SNMP Write RouterOS and Traffic-Flow How to make Ethereal/Wireshark to accept MikroTik sniffer TZSP stream S
-
User/Routing User/Routing Routing • • • • • • • • • • • • • Split horizon Dynamic Routing Concepts ECMP load balancing with masquerade NTH load balancing with masquerade NTH load balancing with masquerade (another approach) Basic Internet Connection Sharing (NAT) Connection Sharing in a Single MAC-Address Restricted Service Access Multiple gateway simple failover Bonding Load Balancing over Multiple Gateways ECMP Failover Script Routing Questions Suggested literature (Book review) • • • • • • • • Policy
-
User/Routing • BGP Load Balancing with two interfaces OSPF • • • • • • • • Steps of making neighborship between OSPF routers OSPF and Point-to-Point interfaces OSPF and Area summaries OSPF to simulate full duplex links with redundancy OSPF and PPPoE Setup OSPFv3 with Quagga OSPF summarization and redistribution complex example Mutual internet backup between two small ISP IPv6 • Creating loopback interface for IPv6 • Setting up an IPv6 tunnel via a tunnel broker RIP • Routing Information Protocol Concept
-
Scripts 29 Scripts Setup • How to Make an Automated Configuration and Uninstall • A script to set up WAN/LAN/WLAN to get you started General • • • • • • • • Traffic Prioritization Script Automated Billing Script Automated Usage Script without usermanager Dynamic DNS Update Script for ChangeIP.
-
Scripts 30 • • • • • • Get active VPN connections via e-mail (PPTP and L2TP) Get active VPNs, connected wireless stations, active Hotspot sessions and connected administrators via e-mail Using scripting to overcome the inability to specify number ranges on the command line Converting network and gateway from routing table to hexadecimal string Useful Bash Scripts Update static DNS entries every 10mins.
-
Scripts 31 System Maintenance • • • • • • • • • • • • • • • • BackupROS (Centralized Backups) - by Nahuel Ramos (new!) Centralized Automated Backups via Email with Procmail and Perl Automatic Backup with Centralized Storage Antenna Alignment with RB532 LED Audible signal test Logging SNR and thruput values Logging Average CCQ and Wireless Clients Stats Generate routes for stress testing BGP functionality Improved Semi-automatic system-update script Scheduled sending of an email with system backup attache
-
Tunnels Tunnels • • • • • • • • • • • • • • • PPtP Server / VPN PPtP Client / VPN PPTP VPN - multiple ADSL remote locations to Cental Office IPSec VPN with Dynamic Routing / Mikrotik and Cisco IPSec VPN / Mikrotik and Linksys BEFVP41 VPN with Virtual Routing and Forwarding / Mikrotik and Cisco OpenVPN Layer2 VPN Server MikroTik RouterOS and Windows XP IPSec/L2TP IPSec VPN between MikroTik RouterOS and SonicWall SonicOS Enhanced PPPoe Server / VPN MikroTik router to CISCO PIX Firewall IPSEC Routing through
-
Wireless Setups 33 • Bridge Network With Wireless Modes • Wireless WDS Mesh • Connect to an Available Wireless Network References [1] http:/ / www. mikrotik. com/ test_link.
-
Manual:MPLS 34 Forwarding Table Sub-menu: /mpls forwarding-table Entries in this sub-menu shows label bindings for specific routes that will be used in MPLS label switching.
-
Manual:MPLS 35 Property Description comment (string; Default: ) Short description of the interface disabled (yes | no; Default: no) If set to yes then this configuration is ignored. interface (string | all; Default: all) Interface name to which apply settings. If set to all then the same config will be used for every interface if there is no specific configuration for the interface. mpls-mtu (integer [512..
-
Manual:MPLS Remote Bindings Sub-menu: /mpls remote-bindings Sub-menu shows label bindings for routes received from other routers. This table is used to build Forwarding Table [ Top | Back to Content ] References [1] http:/ / mikrotik. com/ software. html [2] http:/ / routerboard. com Manual:Virtualization Applies to RouterOS: 3, v4 RouterOS has three different Virtualization implementations.
-
Manual:Virtualization • offer virtual routers with VPN solutions that give a network administrator customer his own router on a highspeed backbone to make any kind of tunneled intranet or simply VPN access system At the wireless ISP client site • set up two isolated routers and set the wireless control only for the router controlled by the WISP while the Ethernet side router is fully under the clients control At multiclient sites (such as office buildings) • in locations serving multiple clients by Ethernet
-
Use Metarouter to Implement Tor Anonymity Software Why use Tor? From the Tor web site [2] "Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." Traffic analysis can be used to infer who is talking to whom over a public network. Knowing the source and destination of your Internet traffic allows others to track your behavior and interests.
-
Use Metarouter to Implement Tor Anonymity Software These commands set up the necessary bridges and add interfaces to the natBridge. In this example, an RB433AH with wifi card is being used. Three physical ports will be added to the natBridge (ether2, ether3 and wlan1). Ether1 is the port for the internet connection. Configure Wifi AP /interface wireless set [find name="wlan1"] disabled=no \ mode=ap-bridge band=2.
-
Use Metarouter to Implement Tor Anonymity Software add chain=dstnat action=dst-nat add chain=dstnat action=dst-nat in-interface=ether1 protocol=tcp dst-port=8118 \ to-addresses=10.192.168.2 to-ports=8118 disabled=no in-interface=ether1 protocol=tcp dst-port=9050 \ to-addresses=10.192.168.2 to-ports=9050 disabled=no In this configuration, we don't want to masquerade the natBridge directly. Instead, in order to maintain anonymity, privacy and encryption, only torBridge is masqueraded.
-
Use Metarouter to Implement Tor Anonymity Software The first command names the new Metarouter virtual machine. The second command sets up a dynamic interface for the metarouter the torBridge interface.
-
Use Metarouter to Implement Tor Anonymity Software t rely on it for strong anonymity. (Running on Linux mips) Aug 18 00:45:18.923 [notice] Choosing default nickname 'openwrt' Aug 18 00:45:18.925 [notice] Your ContactInfo config option is not set. Please c onsider setting it, so we can contact you if your server is misconfigured or som ething else goes wrong. Aug 18 00:45:18.954 [notice] Initialized libevent version 1.4.13-stable using me thod epoll. Good. Aug 18 00:45:18.
-
User/IPv6 User/IPv6 • • • • • • Overview and examples Setting up an IPv6 tunnel via a tunnel broker Creating loopback address for IPv6 OSPFv3 with Quagga Setting up an IPv6 tunnel via 6to4 Setting up DHCPv6 User Management • • • • • HotSpot Redirect to external login page HotSpot external login page Pppoe_server_with_profiles Hotspot_server_setup SSL Certificate setup • • • • • • • Manual HotSpot Setup (In Greek) Troubleshooting HotSpot PPTP_Server_With_Profile Notify your customers internet is down,
-
The Dude 44 The Dude The Dude [1] is a free application by MikroTik, which can dramatically improve the way you manage your network environment. It will automatically scan all devices within specified subnets, draw and layout a map of your networks, monitor services of your devices and execute actions based on device state changes. Not only can you monitor your devices, you can also manage them.
-
The Dude • • • • • • • • • • • • • Graphing Client Signal Strength Managing Multiple Remote Bridged Routers Dude as Syslog Server Dude como Servidor Syslog (el español) Custom probe settings Extra Tools Start The Dude with Shortcut Email notifications Email notifications using... Gmail Alternate SMTP port for notifications View and Graph the Number of Wireless Clients Display voltage for Mipsbe devices DOCSIS Statistics (Arris C3, Motorola cablemodems) (new) References [1] http:/ / www. mikrotik.
-
User Manager Concepts explained Common • • • • • • • • • • • • Customers Users Routers Sessions Payments Reports Logs Customer permission levels Character constants Active sessions Active users Customer public ID Version 4.x test package specific • • • • • • Profiles Limitations User data templates MAC binding Languages CoA (Radius incoming) Version 3.
-
User Manager Customer page • Setup • How to find it? • Sections • • • • • • • • Status Routers Credits Users Sessions Customers Reports Logs User page • Setup • How to find it? • Link to user page • Sections • Status • Payments • Settings User sign-up • Setup • Sign-up steps • Creating account • Activating account • Login User payments • Authorize.
-
User Manager • • • • • • How to create timed Voucher? Cannot access User Manager WEB interface Incorrect time shown for sessions and credits User Manager does not allow to login due to expired uptime How to debug PayPal payments How to send logs to a remote host, using SysLog API PHP package Client The examples on this page use the PEAR2_Net_RouterOS [1] package. You can install it with Pyrus, PEAR, Composer or just download the ".phar" file and include it from your PHP file.
-
API PHP package 49 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
RouterOS log Unable to connect to RouterOS.
-
API PHP package 50
| Ping from router This example is particularly useful when you want to ping someone from inside the network while browsing the page from outside the network.
-
API PHP package 51
-
Results:'; foreach ($results as $result) { //Add whatever you want displayed in this section.
-
API PHP package 52 //Here's the fun part - actually changing the password $setRequest = new RouterOS\Request('/ip hotspot user set'); $client($setRequest ->setArgument('numbers', $hotspotUsername) ->setArgument('password', $_POST['password']) ); } } ?> PAGE 56
API PHP package 53
-