UI 網站 » ros

mikrotik 調整 mtu

admin — Mon, 23 Jun 2025 06:11:36 +0000

我的PPPoE MTU ：1500，PPPoE actual MTU:1496(我看錯以為是1492），我把MTU改成1492，以及firewall mangle 中設定MSS Clamping 經過一整天都沒有斷線重連的情況發生 /ip/firewall/mangle add action=change-mss chain=forward comment="IPv4 MSS clamp to PMTU" new-mss=clamp-to-pmtu out-interface="China Telecom" passthrough=yes protocol=tcp tcp-flags=syn 或者去 /interface pppoe-dymic General Max MTU 及 Max MRU 調為 1492 PS: MTU 測試 ping -f … 繼續閱讀 →

routeos macping 錯亂

admin — Sat, 24 May 2025 01:27:58 +0000

/interface ethernet reset-mac-address ether1

#關閉 neighbor
/ip netighbor

Mikrotik IP Tunnel

admin — Mon, 03 Feb 2025 07:24:56 +0000

來源

https://www.youtube.com/watch?v=clQKWo-4CSw&list=PLh8zT6JM0BYE1l-M1DorJKd2BvT2X6v3A&index=95

4G/LTE 網路虛擬IP轉實體IP-RouterOS

admin — Thu, 16 Jan 2025 05:45:47 +0000

參考
#https://ethernet-diy.blogspot.com/2017/05/mikrotik4glteipip-routeros.html

借用 VPN
WAN :Hinet 固IP
LAN: 192.168.88.0/24
VPN : PPTP host to site VPN
Port forward: Wan_IP:8800 -> 192.168.88.101:80 ( wan:8800 –> lan 192.168.88.101)

Server
192.168.1.99/24 G:192.168.1.1
vpn ip: 192.168.88.101/32
web server: TCP 80
SERVER Firewall allow 80

#先設定 pppoe server
[ppp]-pptp server- enable 打勾

[ppp]
Profiles
Name:pptp-1
Local Address:192.168.88.1
Remote Address:192.168.88.101

[ppp]
Secrets
Name:test
password:test
service:pptp
Profile: pptp-1 (上面的pptp-1)

# Firewall Allow
INPUT
Chain: Input
Protocol: Tcp
Dst Port 21,22,23,80,443,1723,8291
Action: accept

Forward
Chain: Forward
Protocol: Tcp
Dst Port : 88,8800
In Interface: ppoe-out1 (注意)
Action: accept

NAT
Chain: dsnat
Protocol: TCP
Dst port:8800
In interface: pppoe-out1
Action: Dst-nat
to Address:192.168.88.101
To Port:80

mikrotik Hairpin NAT

admin — Thu, 16 Jan 2025 05:34:24 +0000

#https://help.mikrotik.com/docs/display/ROS/NAT#NAT-HairpinNAT

/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" \
out-interface=bridge src-address=192.168.1.0/24

mikrotik wireguard export

admin — Thu, 29 Aug 2024 15:09:28 +0000

https://forum.mikrotik.com/viewtopic.php?t=181503

導出WireGuard接口配置,會把所有interface export
/interface export show-sensitive file=wg-config

導出WireGuard對等體配置
/interface/wireguard/ export show-sensitive file=wg1.rsc

匯入配置文件：
/import file-name=wg-config.rsc
/import file-name=wg-peers-config.rsc

shell 底下
/interface/wireguard/ export show-sensitive file=wg1.rsc
export show-sensitive
或
/interface/wireguard print

ros 封包進入順序

admin — Mon, 24 Jun 2024 00:57:46 +0000

封包進入firewall有優先順序，分別是raw->mangle->nat->filter
如果在raw就進行封鎖，後面的流程就不會跑。

也就是在raw進行封鎖是最省系統資源；在filter則是最吃資源。
因為在filter，即便是丟棄封包，封包也得raw->mangle->nat->filter跑完一輪才行。

mikrotik email log

admin — Wed, 22 May 2024 07:25:07 +0000

shell
Email Logs
/log print file=logs
delay 10
/tool e-mail send to="改你的email" subject="$[/system identity get name] logs" \
body="$[/system clock get date] log file" file=logs.txt

synology – 日誌中心 – 日誌接收 – 建立下面規則
日誌格式: BSD 格式
傳輸協定: UDP
連接埠: 514
ros – 先在 remote 打上 log_Server ip位置 , bsd_log 打勾
ros – system-loging-Rules 新增剛剛的 info, erro, warning, critical remote

mikrotik 路徑圖

admin — Fri, 08 Mar 2024 00:52:42 +0000

mikrotik .rsc 匯入注意

admin — Sun, 18 Feb 2024 06:13:28 +0000

Mikrotik 匯入換行格式須為 windows , unix CLRF 格式不行
內容範例
/ip firewall address-list
add address=103.137.150.244 list=Badip_List
# 連續時相同會出現錯誤訊息

再改為
do {/ip firewall address-list add address=xxx.xxx.xxx.xxx list=Ban_ip} on-error={}