The Mikrotik RouterOS config, tips and tricks thread

Listen thanks very much and I dont want to bother you so dont spend too much time at this as you will see from config I have 2 wireless interfaces

ShelmarGarage is main one and I want that to access lan and internet

ShelmarGarageGuests is the guest network and I was wondering if I could restrict that to only access wan port ie no access to lan ports

It works like that on my ASUS router guest network only gets to internet so if I could get it like that on Microtik I would use microtik as my main router and use Asus as extension AP

Thanks again and as I have no experience in these type of routers only ever used consumer routers I hope this config is what you might ned to see what i am talking about



MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK

MikroTik RouterOS 6.15 (c) 1999-2014 http://www.mikrotik.com/

[?] Gives the list of available commands
command [?] Gives help on the command and list of arguments

[Tab] Completes the command/word. If the input is ambiguous,
a second [Tab] gives possible options

/ Move up to base level
.. Move up one level
/command Use command at the base level
[admin@MikroTik] > /export compact
# jan/02/1970 02:06:01 by RouterOS 6.15
# software id = CCB8-P1HX
#
/interface bridge
add admin-mac=D4:CA:6D:BE:8D:FD auto-mac=no l2mtu=1598 name=bridge-local
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=\
20/40mhz-ht-above disabled=no distance=indoors l2mtu=2290 mode=ap-bridge \
ssid=ShelmarGarage wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=\
ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=\
ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=\
ether5-slave-local
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys wpa-pre-shared-key=test1111 wpa2-pre-shared-key=test1111
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile \
wpa-pre-shared-key=test1111 wpa2-pre-shared-key=test1111
/interface wireless
add disabled=no l2mtu=2290 mac-address=D6:CA:6D:BE:8E:01 master-interface=\
wlan1 name=wlan2 security-profile=profile ssid=ShelmarGarageGuests
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge-local lease-time=10m name=\
default
/interface bridge filter
add action=drop chain=forward in-interface=wlan2
add action=drop chain=forward out-interface=wlan2
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
add bridge=bridge-local interface=wlan2
/ip address
add address=192.168.1.2/24 comment="default configuration" interface=\
ether2-master-local network=192.168.1.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=\
no interface=ether1-gateway
/ip dhcp-server network
add address=192.168.1.0/24 comment="default configuration" dns-server=\
192.168.88.1 gateway=192.168.1.2 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=forward comment="default configuration" connection-state=\
established
add chain=forward comment="default configuration" connection-state=related
add action=drop chain=forward comment="default configuration" \
connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=\
yes out-interface=ether1-gateway to-addresses=0.0.0.0
/ip upnp
set allow-disable-external-interface=no
/system leds
set 0 interface=wlan1
[admin@MikroTik] >

Set it to Ireland to get the 13 WiFi channels otherwise you will only get the default 10
Set the frequency mode to manual-txpower for the max power
or set that to regulatory-domain for standard power settings

Was having trouble with my no-ip script to update my dynamic IP address.
It was only updating sometimes - but logging that it had updated

So I set up a script to check for IP changes and email me if there are any.
This way if No-IP doesn't update I can do it manually or just connect directly to IP.

Here's the script I used:

:global ipadd;
:local thisip [/ip address get [find where interface=pppoe-wan] address];

:if ($ipadd != $thisip) do={
    /tool e-mail send to=******@gmail.com subject="ip change" body="New ip $thisip";
    set ipadd $thisip;
} 
#else={
#    /tool e-mail send to=******@gmail.com subject="ip change" body="No change";
#}

The last few lines are commented out - I just used them for testing sending email. They just email 'No Change' if the IP is the same.
Just change the interface to whatever your WAN interface is and put your email in.

I had some issues setting up Gmail but finally got it working.
Online, people were saying to enable TLS and use port 587.
This didn't work for me so I enabled TLS and used default port 25 which did work.
Also had to enable POP in Gmail settings. Works like a charm now.

Have a look here:

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter

same ol sh1te wrote: »

It's configured for NAT, you'll just need to get the Wan working but should be able to get that from the web GUI.

brilliant, decided to give it a punt as I'm sure it'll prove to be a learning experience too! Do I need to configure PPOE or should the basic settings work?

cheers

same ol sh1te wrote: »

If the connection requires it you'll need to configure it. What ISP? What type of connection?

The ISP is Vodafone and it's a fiber connection - I believe from reading the bridging thread that it does require it and that the username/password follows the form of user: serialnumber@vfiefttc.ie password: broadband - router model HG658c - will it prompt me to configure this with the initial installation wizard or will I have to amend the settings via winbox?

cheers

mylesm wrote: »

...........
If anyone could please tell me how to block ping please
..........

once you get that done , don't get carried away and block icmp passing through the yoke - it can break path discovery n stuff -

Just got my Mikrotik router and I'm trying to configure it with a vodafone router - it seems unable to obtain a PPPOE link any idea's as to what I might be doing wrong?





thanks!

same ol sh1te wrote: »

Try leaving the service name blank

Will try that when I'm home thanks! And is txpower automatically at 100%? If not, how do I amend it via webconfig

Thanks

same ol sh1te wrote: »

You'll need winbox, open the wireless interface, set to advanced and in the main wireless tab change frequency mode from regulatory domain to manual tx power. In advanced tab set distance to indoors and in tx power tab set tx power to default

Was being silly, thought it would go into WAN port when it's actually Ethernet #1, PPPOE authentication is now successful!

It seems that those settings for transmitting power had already been enabled by default, should that give it the full 1000mw power?

Cheers

Last question for you haha, I'm achieving good speeds on the laptop (50mb connection) getting about 46 over WiFi - but with my HTC m8 I'm getting a poor link speed and speed test.net reports it to be under 20mb - is the router assigning less speed to the mobile?http://i58.tinypic.com/b3lwyr.png

Thanks

Hi Again

On the quickset screen of winbox there are 2 wireless options one main and one guest network

I set up guest network here and set download limit as well to 3M

this is all available on quickset screen and it works well

I tried to ping devices on my main lan while I am connected to guest network and I cannot ping them which is great as that is what I want

Can someone explain please how the guest network is isolated from main lan as it seems to get ip in same range as main lan
Thanks

mylesm