Articles by "Mikrotik"

MIKROTIK DHCP SERVER SETTING USING SCRIPT FAST SETTING
MIKROTIK DHCP SERVER SETTING
MIKROTIK DHCP SERVER SETTING
/interface ethernet
set [find default-name=ether1 ] name=ether1
set [find default-name=ether2 ] name=ether2
set [find default-name=ether3 ] name=ether3
set [find default-name=ether4 ] name=ether4
set [find default-name=ether5 ] name=ether5
set [ find default-name=ether2 ] master-port=ether5
set [ find default-name=ether3 ] master-port=ether5
set [ find default-name=ether4 ] master-port=ether5
set [ find default-name=ether1 ] comment="WAN NETWORK"
set [ find default-name=ether5 ] comment="DHCP SERVER"
/ip address
add address=192.168.1.10/24 comment="WAN NETWORK" interface=ether1 \
network=192.168.1.0
add address=192.168.10.1/24 comment="DHCP SERVER NETWORK" interface=ether5 \
network=192.168.10.0
/ip route
add distance=1 gateway=192.168.1.1
/ip dns
set servers=192.168.1.1,8.8.4.4
/ip pool
add name=dhcp_pool2 ranges=192.168.10.2-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool2 disabled=no interface=ether5 name=dhcp3
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
/ip firewall nat
add action=masquerade chain=srcnat comment="DHCP SERVER MASQUERADE" \
src-address=192.168.10.2-192.168.10.254 to-addresses=0.0.0.0


If we want to limit the lifetime of the user hotspots and hotspot user who desires that are out of active they will automatically disconnect and didisable of hotspot users the example of the following ways can be used.
assumptions targets
Hotspot username = kangndo
= Active period until the date of December 31, 2013 00:00:00 hours GMT
The first step, create scripts
Go to System> Scripts
(+)
Name: kangndo
source Code:

/ip h ac r [/ip h ac f user="kangndo"]; /ip h u d [/ip h u f name="kangndo"]


Langkah kedua, membuat scheduler

Buka System > Scheduler
(+)
name: kangndo
Start Date: Dec/31/2013
Start Time: 00:00:00
Interval: 00:00:00
On Event: kangndo



With the above example, it will automatically hotspot-user kangndo will disconnect (if active) and auto-disable exactly at 00:00:00 dated December 31, 2013.
Good luck, may be useful.

BLOCK WHATSAPP MESSENGER IN MIKROTIK
BLOCK WHATSAPP MESSENGER IN MIKROTIK


Very sample setup Copy Below address list and paste into terminal to block access of Whatsapp Messenger completely..
/ip firewall address-list
add address=31.13.64.51 list=Whatsapp
add address=31.13.65.49 list=Whatsapp
add address=31.13.66.49 list=Whatsapp
add address=31.13.67.51 list=Whatsapp
add address=31.13.69.240 list=Whatsapp
add address=31.13.70.49 list=Whatsapp
add address=31.13.71.49 list=Whatsapp
add address=31.13.72.52 list=Whatsapp
add address=31.13.73.49 list=Whatsapp
add address=31.13.74.49 list=Whatsapp
add address=31.13.75.52 list=Whatsapp
add address=31.13.76.81 list=Whatsapp
add address=31.13.77.49 list=Whatsapp
add address=31.13.79.195 list=Whatsapp
add address=31.13.80.53 list=Whatsapp
add address=31.13.81.53 list=Whatsapp
add address=31.13.82.51 list=Whatsapp
add address=31.13.83.51 list=Whatsapp
add address=31.13.84.51 list=Whatsapp
add address=31.13.85.51 list=Whatsapp
add address=31.13.86.51 list=Whatsapp
add address=31.13.87.51 list=Whatsapp
add address=31.13.88.49 list=Whatsapp
add address=31.13.88.57 list=Whatsapp
add address=31.13.90.51 list=Whatsapp
add address=31.13.91.51 list=Whatsapp
add address=31.13.92.52 list=Whatsapp
add address=31.13.93.51 list=Whatsapp
add address=31.13.95.63 list=Whatsapp
add address=50.22.75.192/27 list=Whatsapp
add address=50.22.93.192/27 list=Whatsapp
add address=50.22.198.204/30 list=Whatsapp
add address=50.22.210.32/30 list=Whatsapp
add address=50.22.210.128/27 list=Whatsapp
add address=50.22.225.64/27 list=Whatsapp
add address=50.22.235.248/30 list=Whatsapp
add address=50.22.240.160/27 list=Whatsapp
add address=50.23.90.128/27 list=Whatsapp
add address=50.97.57.128/27 list=Whatsapp
add address=75.126.39.32/27 list=Whatsapp
add address=108.168.174.0/27 list=Whatsapp
add address=108.168.176.192/26 list=Whatsapp
add address=108.168.177.0/27 list=Whatsapp
add address=108.168.180.96/27 list=Whatsapp
add address=108.168.254.65 list=Whatsapp
add address=108.168.255.224 list=Whatsapp
add address=108.168.255.227 list=Whatsapp
add address=158.85.0.96/27 list=Whatsapp
add address=158.85.5.192/27 list=Whatsapp
add address=158.85.46.128/27 list=Whatsapp
add address=158.85.48.224/27 list=Whatsapp
add address=158.85.58.0/25 list=Whatsapp
add address=158.85.61.192/27 list=Whatsapp
add address=158.85.224.160/27 list=Whatsapp
add address=158.85.233.32/27 list=Whatsapp
add address=158.85.249.128/27 list=Whatsapp
add address=158.85.249.224/27 list=Whatsapp
add address=158.85.254.64/27 list=Whatsapp
add address=169.53.29.128/27 list=Whatsapp
add address=169.53.71.224/27 list=Whatsapp
add address=169.53.250.128/26 list=Whatsapp
add address=169.54.2.160/27 list=Whatsapp
add address=169.54.51.32/27 list=Whatsapp
add address=169.54.55.192/27 list=Whatsapp
add address=169.54.210.0/27 list=Whatsapp
add address=169.54.222.128/27 list=Whatsapp
add address=169.55.69.128/26 list=Whatsapp
add address=169.55.74.32/27 list=Whatsapp
add address=169.55.235.160/27 list=Whatsapp
add address=173.192.162.32/27 list=Whatsapp
add address=173.192.219.128/27 list=Whatsapp
add address=173.192.222.160/27 list=Whatsapp
add address=173.192.231.32/27 list=Whatsapp
add address=173.193.205.0/27 list=Whatsapp
add address=173.193.230.96/27 list=Whatsapp
add address=173.193.230.128/27 list=Whatsapp
add address=173.193.230.192/27 list=Whatsapp
add address=173.193.239.0/27 list=Whatsapp
add address=174.36.208.128/27 list=Whatsapp
add address=174.36.210.32/27 list=Whatsapp
add address=174.36.251.192/27 list=Whatsapp
add address=174.37.199.192/27 list=Whatsapp
add address=174.37.215.28/30 list=Whatsapp
add address=174.37.217.64/27 list=Whatsapp
add address=174.37.231.64/27 list=Whatsapp
add address=174.37.243.64/27 list=Whatsapp
add address=174.37.251.0/27 list=Whatsapp
add address=179.60.192.51 list=Whatsapp
add address=179.60.193.51 list=Whatsapp
add address=179.60.195.51 list=Whatsapp
add address=184.173.73.176/28 list=Whatsapp
add address=184.173.136.64/27 list=Whatsapp
add address=184.173.147.32/27 list=Whatsapp
add address=184.173.161.64 list=Whatsapp
add address=184.173.161.160/27 list=Whatsapp
add address=184.173.173.116 list=Whatsapp
add address=184.173.179.32/27 list=Whatsapp
add address=184.173.195.32/27 list=Whatsapp
add address=184.173.201.32/27 list=Whatsapp
add address=184.173.204.32/27 list=Whatsapp
add address=184.173.250.53 list=Whatsapp
add address=192.155.212.192/27 list=Whatsapp
add address=198.11.193.182/31 list=Whatsapp
add address=198.11.212.0/27 list=Whatsapp
add address=198.11.217.192/27 list=Whatsapp
add address=198.11.251.32/27 list=Whatsapp
add address=198.23.80.0/27 list=Whatsapp
add address=198.23.86.224/27 list=Whatsapp
add address=198.23.87.64/27 list=Whatsapp
add address=208.43.115.192/27 list=Whatsapp
add address=208.43.117.79 list=Whatsapp
add address=208.43.117.136 list=Whatsapp
add address=208.43.122.128/27 list=Whatsapp
/ip firewall filter
add chain=forward dst-address-list=Whatsapp action=drop comment="Whatsapp Drop by aboutforworld"
add chain=input src-address-list=Whatsapp action=drop comment="Whatsapp Drop by aboutforworld"


After Paste The Code Reboot Your Router Then Test

BLOCK TEAMVIEWER CONNECTIONS ON MIKROTIK
BLOCK TEAMVIEWER CONNECTIONS ON MIKROTIK
Here is a guide how to block Team Viewer connection Just Paste The Code In New Terminal

/ip firewall address-list
add address=92.51.128.0/18 comment=Teamviewer_Server list=Teamviewer
add address=37.48.64.0/18 comment=Teamviewer_Server list=Teamviewer
add address=217.146.26.0/24 comment=Teamviewer_Server list=Teamviewer
add address=88.198.0.0/16 comment=Teamviewer_Server list=Teamviewer
add address=37.252.253.0/24 comment=Teamviewer_Server list=Teamviewer
add address=178.255.155.0/24 comment=Teamviewer_Server list=Teamviewer
add address=159.8.64.0/18 comment=Teamviewer_Server list=Teamviewer
add address=178.77.64.0/18 comment=Teamviewer_Server list=Teamviewer
/ip firewall filter
add action=drop chain=forward comment="Drop all traffic from address on \\ Teamviewer \\ address list" src-address-list=Teamviewer
add action=drop chain=input comment="Drop all traffic from address on \\ Teamviewer \\ address list" src-address-list=Teamviewer


With these just two settings, your router will ignore any client not getting response from Team Viewer.

If You Have Any Problem in settings so comments me i will help you about this settings

Below script find active user on hotspot and set static ip with mac binding into 2 section.

section 1 find all active users on hotspot
section 2 find IP & Mac into DHCP-Server Leases.

How its works ?
copy below code into system script with name hotspot-binding.
create schedule for Example time 10min timming to run this code ..



This Code is paste in New Script Just like in First Picture

:foreach h in=[/ip hotspot active find] do={
:global address [/ ip hotspot active get $h address];
:global user [/ip hotspot active get $h user];
:global mac [/ip hotspot active get $h mac-address];
/ip hotspot user set $user  mac=$mac address=$address;
:foreach x in=[/ip dhcp-server lease find] do={/ip dhcp-server lease make-static $x};
}

ROS Code Terminal Export for version 6.x :
/system script
add name=hotspot-binding policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":foreach \
    h in=[/ip hotspot active find] do={\r\
    \n:global address [/ ip hotspot active get \$h address];\r\
    \n:global user [/ip hotspot active get \$h user];\r\
    \n:global mac [/ip hotspot active get \$h mac-address];\r\
    \n/ip hotspot user set \$user  mac=\$mac address=\$address;\r\
    \n:foreach x in=[/ip dhcp-server lease find] do={/ip dhcp-server lease make-\
    static \$x};\r\
    \n}"
Control By Time Scheduler Add New Scheduler and paste code :

/system scheduler
add disabled=no interval=10m name=binding-hotspot on-event=hotspot-binding \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
    start-date=jul/24/2015 start-time=22:10:03


If you want Change Name of Script And Scheduler So No Problem you can do it very easy

If You Have Any Problem in settings so comments me i will help you about this settings

Block download based on file Size in MikroTik

howto block downloads of large files (lets say 5mb or above ) in specific timings (like 8pm-12am).
But the issue is How the router will know the file size before it’s downloaded? The router has no way of knowing how big a connection is… An workaround is to create a Firewall Filter rule that will will allow the first 5MB of a connection through, and once it reaches that, it will start to drop packets. I used it a network, and it worked good.

Note
But do remember that It will also affect streaming, RDP like protocols, VPNs, and any other connection that transfers a large number of bytes.

/ip firewall filter
add action=drop chain=forward comment="downloading of files larger then 5mb (It will break connection after 5mb of transfer) applicable from 8pm till 12am / aboutforworld" connection-bytes=5242880-0 disabled=no protocol=tcp time=\
20h-23h59m59s,sun,mon,tue,wed,thu,fri,sat

But do remember that it will only drop packets for that specific download, user can do another session of download. to prevent this , you can create mangle rule that will add the user in a temporary list (with timeout value of 1 hour or more) and next time the user will try to download , his access to that particular resource will be denied, you can customize this action to be either whole session or specific file like mp3 exe zip etc etc. You can also do a source base or destination base controlling. I would recommend to GO with Queues and mangle rules, this way nothing will gonna be blocked, but scaling back bandwidth based on how much data has passed through the connection to make downloading large files painful for the cable.net user


You can also forward these packets to external proxy like Squid to do the filter base on reply_body_max_size directive. example:
reply_body_max_size 5242880 deny all # in specific timings only
As some1 asked, for squid use this:
acl localnet src 100.0.0.0/8
reply_body_max_size 5242880 deny localnet # deny download of 1mb and above,
http_access allow localnet

If you have Mikrotik Server with DSL connection with dynamic ip , which changes on every reboot / reset, and you want to access mikrotik from the Internet then you can use changeip.com (DynamicDNS) service, using this service, you don’t have to query the DSL IP every time, all you have to remember the domain name that you register on the site, and rest of things will be handled by the DDNS script configured on the Mikrotik.
Following is the the scenario:
 INTERNET   =>   DSL MODEM  => MIKROTIK
User with WINBox        =     (with dynamic ip)
DSL MODE IP              =   192.168.30.1 (Device or Router opening IP)
MIKROTIK WAN IP    =  192.168.30.5     (winbox Connect to )

CONFIGURE DSL MODEM TO ENABLE PORT FORWARDING
First open you DSL Modem page to enable PORT Forwarding (from DSL Modem to Mikrotik box)
Now add Port Forwarding rule
WINBOX uses TCP Port 8291
As showed in the image below . . .
Access Mikrotik Remotely anywhere in the world via DynamicDNS

Now Click on SAVE / APPLY

CREATE NEW ACCOUNT ON CHANGEIP.COM
Now Open http://www.changeip.com in your browser and register new account.

Now it will send you an confirmation email, Open your mail box, and click on the link it have send you to activate your account.

Now you have to add your own desired name and its domain. You can select various domains from the drop down list. As showed in the image below . . .
dns

To verify that the script is pasted and working properly,
Goto SYSTEMS   >  SCRIPTS , and double click on the DDNS to view its contents, Just verify it everything is in place.
As showed in the image below . . .

After adding this script Click button Run Script
And now open your Mikrotik any other internet in the world

This Script for Only Mikrotik ver 6.x , well tested with ver 6.24
:local ddnsuser "USERNAME"
:local ddnspass "PASSWORD"
:local ddnshost "CHANGEIP_YOUR_WEB_NAME"
:local ddnsinterface "WAN_INTERFACE"
:global ddnslastip
:global ddnsip [ /ip address get [find interface=$ddnsinterface disabled=no] address ]
:if ([ :typeof $ddnslastip ] = nil ) do={ :global ddnslastip 0.0.0.0/0 }
:if ([ :typeof $ddnsip ] = nil ) do={
:log info ("DDNS: No ip address present on " . $ddnsinterface . ", please check.") } else={
:if ($ddnsip != $ddnslastip) do={
:log info "DDNS: Sending UPDATE!"
:log info [ /tool dns-update name=$ddnshost address=[:pick $ddnsip 0 [:find $ddnsip "/"] ] key-name=$ddnsuser key=$ddnspass ]
:global ddnslastip $ddnsip } else={
:log info "DDNS: No change" }
}
Note
Make sure you change the user id + password + host name to match the same you have entered at the time of registration.
If you facing problem in settings so comments like below...

 Automatic Bandwidth Divide in Users (Bandwidth Management in Mikrotik)
 Automatic Bandwidth Divide in Users (Bandwidth Management in Mikrotik)
Copy This Script And Past In New Terminal 
/ip firewall mangle
add action=mark-connection chain=forward comment="PCQ Eq" \
    new-connection-mark=equal-mark-con src-address=192.168.2.0/24
add action=mark-packet chain=forward comment="PCQ Eq" connection-mark=\
    equal-mark-con new-packet-mark=equal-mark-pack
/queue type
add kind=pcq name=pcq_down pcq-classifier=dst-address
add kind=pcq name=pcq_up pcq-classifier=src-address
/queue tree
add name=DOWLOAD packet-mark=equal-mark-pack parent=LAN queue=pcq_down
add name=UPLOAD packet-mark=equal-mark-pack parent=WAN queue=pcq_up
Note
Please Change the  192.168.2.0/24 with your Network Ip 


Mikrotik DUAL WAN Load Balancing utilizing PCC method orstrategy

Taking after is a finished script for Mikrotik to consolidate/load equalization two DSL lines. In this sample I utilized MikrotikT RB750 5 ports switch.

2 ports were joined with two distinction DSL Routers,

what's more, third port was joined with User LAN.

Both DSL are of same rate , i.e 10Mb each.

DSL MODEM IP'S

DSL MODEM 1 = 192.168.1.1

DSL MODEM 2 = 192.168.2.1

Likewise keep in mind to rename the interface names as needs be.

In my work force experience , If clients solicitation are straightforwardly hitting Mikrotik designed with PCC , then you will get great burden adjusting. Use src-address as classifier, along these lines you will dispose of issues such as https/broken connection, spilling issues and so on. Load adjusting utilizing this PCC strategy (src-location) will be viable and adjusted methodology when more associations (from customers) that happened. I additionally prescribe to utilize SQUID intermediary server alongside mikrotik , either parallel or in front or backend , for better reaction time and it will likewise build great skimming knowledge to clients.

In the event that some way or another you are not fulfilled by the src-address approach,play with the PCC-Classifier, then Try both addresses and ports as the classifier. While this will randomize things the most and in principle give you the most reasonable distribution of data transmission, BUT there is additionally a decent risk that it will break certain things like managing an account sites and a few gatherings. This is on the grounds that as a rule a HTTP solicitations will produce a few associations, so there is a chance that a few solicitations might go out an alternate course than the introductory one, and that will break secure sites. Consequently I for the most part stay with src-address for PCC load adjusting.
Copy Code:
/ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local
add address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 interface=WAN1
add address=192.168.2.2/24 network=192.168.2.0 broadcast=192.168.2.255 interface=WAN2
/ip dns set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000KiB max-udp-packet-size=512 servers=8.8.8.8
/ip firewall mangle
add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=WAN1_conn
add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=WAN2_conn
add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2
add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=Local
add chain=prerouting dst-address=192.168.2.0/24 action=accept in-interface=Local
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=WAN1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
add chain=prerouting connection-mark=WAN1_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN1
add chain=prerouting connection-mark=WAN2_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN2
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-mark=to_WAN1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-mark=to_WAN2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2 check-gateway=ping
/ip firewall nat
add chain=srcnat out-interface=WAN1 action=masquerade
add chain=srcnat out-interface=WAN2 action=masquerade
PCC WITH HOTSPOT (Reference)
/ip firewall nat add action=accept chain=pre-hotspot disabled=no dst-address-type=!local hotspot=auth

Ch.Shahzad Nasir

{facebook#YOUR_SOCIAL_PROFILE_URL} {twitter#YOUR_SOCIAL_PROFILE_URL} {google-plus#YOUR_SOCIAL_PROFILE_URL} {pinterest#YOUR_SOCIAL_PROFILE_URL} {youtube#YOUR_SOCIAL_PROFILE_URL} {instagram#YOUR_SOCIAL_PROFILE_URL}

Contact Form

Name

Email *

Message *

Powered by Blogger.
Javascript DisablePlease Enable Javascript To See All Widget