# mikrotik * [CHR](#chr) * [IPv6](#ipv6) * [Performance](#performance) * [Tasks](#tasks) * [Quickset](#quickset) * [CPE](#cpe) * [Wireless](#wireless) * [Reset](#reset) * [QoS](#qos) * [PCQ](#pcq) * [Cake](#cake) * [hotspot](#hotspot) * [Routing](#routing) * [Packet Flow](#packet-flow) * [Models](#models) * [Switch Chip](#switch-chip) * [Switch VLAN](#switch-vlan) * [Bridge VLAN](#bridge-vlan) * [FastPath + Conntrack = FastTrack](#fastpath--conntrack--fasttrack) * [Sniffer and Wireshark](#sniffer-and-wireshark) * [VPN](#vpn) * [OpenVPN](#openvpn) * [WireGuard](#wireguard) * [PPP BCP](#ppp-bcp) * [mwan](#mwan) * [Bandwidth based - Mangle + scripting](#bandwidth-based---mangle--scripting) * [PCC - diff subnet/bandwidth](#pcc---diff-subnetbandwidth) * [WAN + ppp](#wan--ppp) * [Videos](#videos) * [Automation](#automation) * [Scripting](#scripting) * [SSH](#ssh) * [API](#api) * [Python](#python) * [Monitoring](#monitoring) * [Grafana & Prometheus](#grafana--prometheus) * [Manage Remote](#manage-remote) * [Wireless](#wireless-1) * [802.11r/k/v](#80211rkv) ## CHR * free/trial： * download: /system license renew level: p1 ## IPv6 Server: only delegate IPv6 prefixes, not addresses: ``` # Client /ipv6 dhcp-client add add-default-route=yes interface=ether5 pool-name=pub-pool-1 request=prefix /ipv6 address add address=... eui-64=yes from-pool=pub-pool-1 interface=ether5 ``` ## Performance Hardware offloading([Chip](#switch-chip)) > [Fast Forward(CPU)](https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Fast_Forward) > [Fast Path](https://wiki.mikrotik.com/wiki/Manual:Fast_Path) > Slow Path ``` /interface bridge settings print ``` ## Tasks ``` DDNS /ip cloud set ddns-enabled=yes Export memory log /log print file=log.txt Port scan /system telnet 192.168.1.1 80 Check link speed /interface ethernet monitor SSH /user ssh-keys import public-key-file= user= /ip ssh print /ip ssh set forwarding-enabled=local ``` * if winbox not working: `/webfig/#IP:Services` * create/dump/unpack .npk: * vulnerabilities: * Monitor/control from Home Assistant: ### Quickset * CPE: Client device * BasicAP: Wireless * HomeAP: Wireless/Guest; WAN; LAN; VPN; System update/reset/password * Wireless ISP (WISP) AP: 802.11/nstreme/nv2 Wireless Bridge/Router; VPN; System update/reset/password * Home Mesh: Enables the CAPsMAN server in the router, and places the local WiFi interfaces under CAPsMAN control. Just boot other MikroTik WiFi APs with the reset button pressed. * not adding self => Wireless -> CAP: CAPsMAN addr add "127.0.0.1" * "No supported channel" => reset with default config and run quickset first * PTP Bridge AP: transparently interconnect two remote locations together in the same network, set one device to this mode, and the other => PTP Bridge CPE #### CPE 802.11 * station: if L2 bridging on station is not necessary - as in case of routed or MPLS switched network * station-pseudobridge : single MAC address translation * station-pseudobridge-clone : either address configured or first forwarded frame ``` /interface wireless set [ find default-name=wlan1 ] disabled=no mode=station-pseudobridge ssid=Soyo_22MAR8287 /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm wpa-pre-shared-key=88888888 wpa2-pre-shared-key=88888888 ``` ### Wireless RouterOS AP accepts clients in station-bridge mode when enabled using bridge-mode parameter. default-forwarding (on AP) – gives ability to disable the communication between the wireless clients\ default-authentication – enables AP to register a client even if it is not in access list. In turn for client it allows to associate with AP not listed in client's connect list ### Reset * Hold this button before applying power * three seconds : backup boot loader * flashing ： reset configuration * 5 more seconds, LED turns solid : CAP * 5 more seconds until the LED turns off : [Netinstall](https://help.mikrotik.com/docs/display/ROS/Netinstall) ## QoS ### PCQ ### Cake * config example: * ack-filter: improve the utilization of the upload bandwidth * diffserv8 : 5. Real-time Interactive (40): Interactive applications, such as gaming. ## hotspot ``` /ip hotspot walled-garden ip add dst-address=1.1.1.1 action=accept add dst-host=:^www.bing.com path=":/*\$" >>> regular expression start with a colon (':') >>> $ requires the escape character '\' to stop it from be processed as an actual $) ``` ## Routing ### Packet Flow ![](https://i.imgur.com/Mo8DgjH.png) ## Models | Model | Alias | Arch | Dude | Chip | CPU | MHz | RAM | Storage | Ports | PoE In | Out | Mbit/s | dBi | | ------------------------------------------------------- | -------- | ----- | ------ | -------- | ---- | --- | --- | --------- | ------ | -------- | --- | ------- | ------- | | [RB750Gr3](https://mikrotik.com/product/RB750Gr3) | hEX | MMIPS | v6/7 | MT7621A | 2C4T | 880 | 256 | 16/TF/USB | 5/1G | 8-30 V | N/A | N/A | | | [RB941-2nD](https://mikrotik.com/product/RB941-2nD) | hAP lite | SMIPS | - | QCA9533 | 1C | 650 | 32 | 16 | 4/100 | MicroUSB | N/A | 300 | 1.5 | | [RB951G-2HnD](https://mikrotik.com/product/RB951G-2HnD) | MIPSBE | - | AR9344 | 1C | 600 | 128 | 128 | 5/1G | 8-30 V | N/A | 300 | 2.5 | | | [RBD52G-\*](https://mikrotik.com/product/hap_ac2) | hAP ac² | ARM32 | v6/7 | IPQ-4018 | 4 | 716 | 128 | 16/USB | 5/1G | 18-28 V | N/A | 300/867 | 2.5/2.5 | ## Switch Chip | Model | RB3011 | RB951G | RB750G | RB951Ui-2HnD | RB951-2n | RB750Gr3 | | -------------- | ------------ | ------------ | ------------ | ------------ | ----------- | -------- | | Feature | QCA8337 | Atheros8327 | Atheros8316 | Atheros8227 | Atheros7240 | MT7621 | | Port Switching | yes | yes | yes | yes | yes | yes | | Port Mirroring | yes | yes | yes | yes | yes | yes | | TX limit | yes | yes | yes | yes | yes | no | | RX limit | yes | yes | no | no | no | no | | Vlan table | 4096 entries | 4096 entries | 4096 entries | 4096 entries | 16 entries | no | | Rule table | 92 rules | 92 rules | 32 rules | no | no | no | ### Switch VLAN * vlan-mode # QCA8337(RB3011) and Atheros8327(RB951G-2HnD): when vlan-mode=secure is used, it ignores switch port vlan-header options. * fallback * check ingress * If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped. * forwards all untagged traffic. If a VLAN ID is not found in the VLAN Table, then traffic is forwarded. Used to allow known VLANs only in specific ports. * check * check ingress, drops all untagged traffic. * If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped. * secure * check ingress, drops all untagged traffic. Both ingress and egress port must be found in the VLAN Table for the appropriate VLAN ID, otherwise traffic is dropped. * vlan-header * \=leave-as-is default * \=always-strip for access ports * \=add-if-missing for trunk port ## Bridge VLAN * way 1: add br-vlan: if-vlan + phy-access-port * way 2: set filtering: ## FastPath + Conntrack = FastTrack * * * * ## Sniffer and Wireshark ``` /tool sniffer print # running: yes/no # wireshark capture filter: udp port 37008 /tool sniffer streaming-server=ip.of.wireshark.box => click Start! /interface ethernet switch set switch1 mirror-source= ``` ## VPN ### OpenVPN tun, RouterOS defines this as ip. tap, which is needed for bridge mode gateways. RouterOS defines this as ethernet. ### WireGuard Both WAN: 1 Server: ### PPP BCP ## mwan Bandwidth-based load-balancing with failover: Bonding: - You need to control of both ends of the link Policy routing: - Not dynamic / Scalability problems PCC: - Not bandwidth wise Bandwidth based: + scalable | MPLS TE / Mangle + scripting ### Bandwidth based - Mangle + scripting Steps: from page 23 ### PCC - diff subnet/bandwidth mark connections -> associate routing marks with packets -> Create routes * p81: action=accept chain=prerouting dst-address=172.\*.0.0/24 * p91: action=mark-connection chain=prerouting connection-mark=no-mark in-interface=LAN new-connection-mark=WAN1 passthrough=yes per-connection-classifier= * p100a: action=mark-routing chain=prerouting connection-mark=WAN1 new-routing-mark=WAN1-mark passthrough=yes * p100b: action=mark-routing chain=output connection-mark=WAN1 new-routing-mark=WAN1-mark passthrough=yes * p104: action=mark-connection chain=prerouting connection-mark=no-mark in-interface=WAN1 new-connection-mark=WAN1 passthrough=yes ## WAN + ppp ``` /ip firewall nat add action=masquerade chain=srcnat out-interface=l2tp-out1 /ip route add dst-address=192.168.1.0/24 gateway=192.168.89.1 ... ``` ## Videos TopCommon mistakes: ## Automation Web Helper | need SignUp: | ### Scripting ``` :put [resolve google.com server 8.8.8.8] # put=print ``` ### SSH ### API * #### Python * * ## Monitoring ### Grafana & Prometheus * Py + Dockerfile : * Grafana | docker-compose : * Grafana | RouterOS v7 + Raspi: docker exec -it mktxp /bin/sh mktxp show # cat /root/mktxp/mktxp.conf mktxp print -en 'Sample-Router' -cc # test connection & show CAPsMAN clients * Go + Dockerfile: * Grafana | k8s: ## Manage Remote ROS v7: conf socks4 and route ``` /ip route add dst-address=192.168.1.1/24 gateway=l2tp-out1 /ip socks set enabled=yes ``` [/nw/proxy/#host-apps](https://github.com/fzinfz/book/blob/master/nw/proxy/README.md#host-apps) ## Wireless ### 802.11r/k/v * 7.13+ | * for ARM | NOT copmatible: MIPS * ### 7.12- | --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://book.ferro.pro/nw/mikrotik.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.